diff --git a/BORINGSSL_REVISION b/BORINGSSL_REVISION
index 26d2c0d..86689d4 100644
--- a/BORINGSSL_REVISION
+++ b/BORINGSSL_REVISION
@@ -1 +1 @@
-c9a7dd687987666df5910f2b35fdc8c3d1e5ed05
+1530333b25589ee4d4d52b10e78ee55dd82f6dcd
diff --git a/BUILD.generated.bzl b/BUILD.generated.bzl
index 5e19592..c7a4925 100644
--- a/BUILD.generated.bzl
+++ b/BUILD.generated.bzl
@@ -37,6 +37,8 @@
     "src/crypto/fipsmodule/cipher/aead.c",
     "src/crypto/fipsmodule/cipher/cipher.c",
     "src/crypto/fipsmodule/cipher/e_aes.c",
+    "src/crypto/fipsmodule/cipher/e_aesccm.c",
+    "src/crypto/fipsmodule/cmac/cmac.c",
     "src/crypto/fipsmodule/dh/check.c",
     "src/crypto/fipsmodule/dh/dh.c",
     "src/crypto/fipsmodule/digest/digest.c",
@@ -47,7 +49,7 @@
     "src/crypto/fipsmodule/ec/felem.c",
     "src/crypto/fipsmodule/ec/oct.c",
     "src/crypto/fipsmodule/ec/p224-64.c",
-    "src/crypto/fipsmodule/ec/p256-x86_64.c",
+    "src/crypto/fipsmodule/ec/p256-nistz.c",
     "src/crypto/fipsmodule/ec/p256.c",
     "src/crypto/fipsmodule/ec/scalar.c",
     "src/crypto/fipsmodule/ec/simple.c",
@@ -76,6 +78,7 @@
     "src/crypto/fipsmodule/rsa/rsa_impl.c",
     "src/crypto/fipsmodule/self_check/fips.c",
     "src/crypto/fipsmodule/self_check/self_check.c",
+    "src/crypto/fipsmodule/service_indicator/service_indicator.c",
     "src/crypto/fipsmodule/sha/sha1-altivec.c",
     "src/crypto/fipsmodule/sha/sha1.c",
     "src/crypto/fipsmodule/sha/sha256.c",
@@ -192,6 +195,7 @@
     "src/include/openssl/ripemd.h",
     "src/include/openssl/rsa.h",
     "src/include/openssl/safestack.h",
+    "src/include/openssl/service_indicator.h",
     "src/include/openssl/sha.h",
     "src/include/openssl/siphash.h",
     "src/include/openssl/span.h",
@@ -230,8 +234,8 @@
     "src/crypto/fipsmodule/digest/internal.h",
     "src/crypto/fipsmodule/digest/md32_common.h",
     "src/crypto/fipsmodule/ec/internal.h",
-    "src/crypto/fipsmodule/ec/p256-x86_64-table.h",
-    "src/crypto/fipsmodule/ec/p256-x86_64.h",
+    "src/crypto/fipsmodule/ec/p256-nistz-table.h",
+    "src/crypto/fipsmodule/ec/p256-nistz.h",
     "src/crypto/fipsmodule/ec/p256_table.h",
     "src/crypto/fipsmodule/ecdsa/internal.h",
     "src/crypto/fipsmodule/md5/internal.h",
@@ -240,6 +244,7 @@
     "src/crypto/fipsmodule/rand/getrandom_fillin.h",
     "src/crypto/fipsmodule/rand/internal.h",
     "src/crypto/fipsmodule/rsa/internal.h",
+    "src/crypto/fipsmodule/service_indicator/internal.h",
     "src/crypto/fipsmodule/sha/internal.h",
     "src/crypto/fipsmodule/tls/internal.h",
     "src/crypto/hrss/internal.h",
@@ -314,7 +319,6 @@
     "src/crypto/chacha/chacha.c",
     "src/crypto/cipher_extra/cipher_extra.c",
     "src/crypto/cipher_extra/derive_key.c",
-    "src/crypto/cipher_extra/e_aesccm.c",
     "src/crypto/cipher_extra/e_aesctrhmac.c",
     "src/crypto/cipher_extra/e_aesgcmsiv.c",
     "src/crypto/cipher_extra/e_chacha20poly1305.c",
@@ -324,7 +328,6 @@
     "src/crypto/cipher_extra/e_rc4.c",
     "src/crypto/cipher_extra/e_tls.c",
     "src/crypto/cipher_extra/tls_cbc.c",
-    "src/crypto/cmac/cmac.c",
     "src/crypto/conf/conf.c",
     "src/crypto/cpu_aarch64_apple.c",
     "src/crypto/cpu_aarch64_fuchsia.c",
@@ -522,10 +525,13 @@
 
 crypto_sources_apple_aarch64 = [
     "apple-aarch64/crypto/chacha/chacha-armv8.S",
+    "apple-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S",
     "apple-aarch64/crypto/fipsmodule/aesv8-armx64.S",
     "apple-aarch64/crypto/fipsmodule/armv8-mont.S",
     "apple-aarch64/crypto/fipsmodule/ghash-neon-armv8.S",
     "apple-aarch64/crypto/fipsmodule/ghashv8-armx64.S",
+    "apple-aarch64/crypto/fipsmodule/p256-armv8-asm.S",
+    "apple-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S",
     "apple-aarch64/crypto/fipsmodule/sha1-armv8.S",
     "apple-aarch64/crypto/fipsmodule/sha256-armv8.S",
     "apple-aarch64/crypto/fipsmodule/sha512-armv8.S",
@@ -587,10 +593,13 @@
 
 crypto_sources_linux_aarch64 = [
     "linux-aarch64/crypto/chacha/chacha-armv8.S",
+    "linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S",
     "linux-aarch64/crypto/fipsmodule/aesv8-armx64.S",
     "linux-aarch64/crypto/fipsmodule/armv8-mont.S",
     "linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S",
     "linux-aarch64/crypto/fipsmodule/ghashv8-armx64.S",
+    "linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S",
+    "linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S",
     "linux-aarch64/crypto/fipsmodule/sha1-armv8.S",
     "linux-aarch64/crypto/fipsmodule/sha256-armv8.S",
     "linux-aarch64/crypto/fipsmodule/sha512-armv8.S",
@@ -661,10 +670,13 @@
 
 crypto_sources_win_aarch64 = [
     "win-aarch64/crypto/chacha/chacha-armv8.S",
+    "win-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S",
     "win-aarch64/crypto/fipsmodule/aesv8-armx64.S",
     "win-aarch64/crypto/fipsmodule/armv8-mont.S",
     "win-aarch64/crypto/fipsmodule/ghash-neon-armv8.S",
     "win-aarch64/crypto/fipsmodule/ghashv8-armx64.S",
+    "win-aarch64/crypto/fipsmodule/p256-armv8-asm.S",
+    "win-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S",
     "win-aarch64/crypto/fipsmodule/sha1-armv8.S",
     "win-aarch64/crypto/fipsmodule/sha256-armv8.S",
     "win-aarch64/crypto/fipsmodule/sha512-armv8.S",
diff --git a/BUILD.generated_tests.bzl b/BUILD.generated_tests.bzl
index 51a5ea4..89f730b 100644
--- a/BUILD.generated_tests.bzl
+++ b/BUILD.generated_tests.bzl
@@ -26,8 +26,8 @@
     "src/crypto/fipsmodule/digest/internal.h",
     "src/crypto/fipsmodule/digest/md32_common.h",
     "src/crypto/fipsmodule/ec/internal.h",
-    "src/crypto/fipsmodule/ec/p256-x86_64-table.h",
-    "src/crypto/fipsmodule/ec/p256-x86_64.h",
+    "src/crypto/fipsmodule/ec/p256-nistz-table.h",
+    "src/crypto/fipsmodule/ec/p256-nistz.h",
     "src/crypto/fipsmodule/ec/p256_table.h",
     "src/crypto/fipsmodule/ecdsa/internal.h",
     "src/crypto/fipsmodule/md5/internal.h",
@@ -36,6 +36,7 @@
     "src/crypto/fipsmodule/rand/getrandom_fillin.h",
     "src/crypto/fipsmodule/rand/internal.h",
     "src/crypto/fipsmodule/rsa/internal.h",
+    "src/crypto/fipsmodule/service_indicator/internal.h",
     "src/crypto/fipsmodule/sha/internal.h",
     "src/crypto/fipsmodule/tls/internal.h",
     "src/crypto/hrss/internal.h",
@@ -86,7 +87,6 @@
     "src/crypto/chacha/chacha_test.cc",
     "src/crypto/cipher_extra/aead_test.cc",
     "src/crypto/cipher_extra/cipher_test.cc",
-    "src/crypto/cmac/cmac_test.cc",
     "src/crypto/compiler_test.cc",
     "src/crypto/conf/conf_test.cc",
     "src/crypto/constant_time_test.cc",
@@ -106,13 +106,15 @@
     "src/crypto/evp/scrypt_test.cc",
     "src/crypto/fipsmodule/aes/aes_test.cc",
     "src/crypto/fipsmodule/bn/bn_test.cc",
+    "src/crypto/fipsmodule/cmac/cmac_test.cc",
     "src/crypto/fipsmodule/ec/ec_test.cc",
-    "src/crypto/fipsmodule/ec/p256-x86_64_test.cc",
+    "src/crypto/fipsmodule/ec/p256-nistz_test.cc",
     "src/crypto/fipsmodule/ecdsa/ecdsa_test.cc",
     "src/crypto/fipsmodule/md5/md5_test.cc",
     "src/crypto/fipsmodule/modes/gcm_test.cc",
     "src/crypto/fipsmodule/rand/ctrdrbg_test.cc",
     "src/crypto/fipsmodule/rand/fork_detect_test.cc",
+    "src/crypto/fipsmodule/service_indicator/service_indicator_test.cc",
     "src/crypto/fipsmodule/sha/sha_test.cc",
     "src/crypto/hkdf/hkdf_test.cc",
     "src/crypto/hmac_extra/hmac_test.cc",
@@ -183,10 +185,6 @@
     "src/crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt",
     "src/crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt",
     "src/crypto/cipher_extra/test/xchacha20_poly1305_tests.txt",
-    "src/crypto/cmac/cavp_3des_cmac_tests.txt",
-    "src/crypto/cmac/cavp_aes128_cmac_tests.txt",
-    "src/crypto/cmac/cavp_aes192_cmac_tests.txt",
-    "src/crypto/cmac/cavp_aes256_cmac_tests.txt",
     "src/crypto/curve25519/ed25519_tests.txt",
     "src/crypto/ecdh_extra/ecdh_tests.txt",
     "src/crypto/evp/evp_tests.txt",
@@ -194,8 +192,12 @@
     "src/crypto/fipsmodule/aes/aes_tests.txt",
     "src/crypto/fipsmodule/bn/bn_tests.txt",
     "src/crypto/fipsmodule/bn/miller_rabin_tests.txt",
+    "src/crypto/fipsmodule/cmac/cavp_3des_cmac_tests.txt",
+    "src/crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt",
+    "src/crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt",
+    "src/crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt",
     "src/crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt",
-    "src/crypto/fipsmodule/ec/p256-x86_64_tests.txt",
+    "src/crypto/fipsmodule/ec/p256-nistz_tests.txt",
     "src/crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt",
     "src/crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt",
     "src/crypto/fipsmodule/modes/gcm_tests.txt",
diff --git a/LICENSE b/LICENSE
new file mode 120000
index 0000000..da348fc
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1 @@
+src/LICENSE
\ No newline at end of file
diff --git a/android-sources.cmake b/android-sources.cmake
index 294c054..cff671f 100644
--- a/android-sources.cmake
+++ b/android-sources.cmake
@@ -70,7 +70,6 @@
   ${BORINGSSL_ROOT}src/crypto/chacha/chacha.c
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/cipher_extra.c
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/derive_key.c
-  ${BORINGSSL_ROOT}src/crypto/cipher_extra/e_aesccm.c
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/e_aesctrhmac.c
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/e_aesgcmsiv.c
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/e_chacha20poly1305.c
@@ -80,7 +79,6 @@
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/e_rc4.c
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/e_tls.c
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/tls_cbc.c
-  ${BORINGSSL_ROOT}src/crypto/cmac/cmac.c
   ${BORINGSSL_ROOT}src/crypto/conf/conf.c
   ${BORINGSSL_ROOT}src/crypto/cpu_aarch64_apple.c
   ${BORINGSSL_ROOT}src/crypto/cpu_aarch64_fuchsia.c
@@ -326,7 +324,6 @@
   ${BORINGSSL_ROOT}src/crypto/chacha/chacha_test.cc
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/aead_test.cc
   ${BORINGSSL_ROOT}src/crypto/cipher_extra/cipher_test.cc
-  ${BORINGSSL_ROOT}src/crypto/cmac/cmac_test.cc
   ${BORINGSSL_ROOT}src/crypto/compiler_test.cc
   ${BORINGSSL_ROOT}src/crypto/conf/conf_test.cc
   ${BORINGSSL_ROOT}src/crypto/constant_time_test.cc
@@ -346,13 +343,15 @@
   ${BORINGSSL_ROOT}src/crypto/evp/scrypt_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/aes/aes_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/bn/bn_test.cc
+  ${BORINGSSL_ROOT}src/crypto/fipsmodule/cmac/cmac_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/ec/ec_test.cc
-  ${BORINGSSL_ROOT}src/crypto/fipsmodule/ec/p256-x86_64_test.cc
+  ${BORINGSSL_ROOT}src/crypto/fipsmodule/ec/p256-nistz_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/ecdsa/ecdsa_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/md5/md5_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/modes/gcm_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/rand/ctrdrbg_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/rand/fork_detect_test.cc
+  ${BORINGSSL_ROOT}src/crypto/fipsmodule/service_indicator/service_indicator_test.cc
   ${BORINGSSL_ROOT}src/crypto/fipsmodule/sha/sha_test.cc
   ${BORINGSSL_ROOT}src/crypto/hkdf/hkdf_test.cc
   ${BORINGSSL_ROOT}src/crypto/hmac_extra/hmac_test.cc
@@ -391,10 +390,13 @@
 )
 set(crypto_sources_apple_aarch64
   ${BORINGSSL_ROOT}apple-aarch64/crypto/chacha/chacha-armv8.S
+  ${BORINGSSL_ROOT}apple-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
   ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/aesv8-armx64.S
   ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/armv8-mont.S
   ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/ghash-neon-armv8.S
   ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/ghashv8-armx64.S
+  ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/p256-armv8-asm.S
+  ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
   ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/sha1-armv8.S
   ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/sha256-armv8.S
   ${BORINGSSL_ROOT}apple-aarch64/crypto/fipsmodule/sha512-armv8.S
@@ -452,10 +454,13 @@
 )
 set(crypto_sources_linux_aarch64
   ${BORINGSSL_ROOT}linux-aarch64/crypto/chacha/chacha-armv8.S
+  ${BORINGSSL_ROOT}linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
   ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/aesv8-armx64.S
   ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/armv8-mont.S
   ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S
   ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/ghashv8-armx64.S
+  ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S
+  ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
   ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/sha1-armv8.S
   ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/sha256-armv8.S
   ${BORINGSSL_ROOT}linux-aarch64/crypto/fipsmodule/sha512-armv8.S
@@ -521,10 +526,13 @@
 )
 set(crypto_sources_win_aarch64
   ${BORINGSSL_ROOT}win-aarch64/crypto/chacha/chacha-armv8.S
+  ${BORINGSSL_ROOT}win-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
   ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/aesv8-armx64.S
   ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/armv8-mont.S
   ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/ghash-neon-armv8.S
   ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/ghashv8-armx64.S
+  ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/p256-armv8-asm.S
+  ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
   ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/sha1-armv8.S
   ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/sha256-armv8.S
   ${BORINGSSL_ROOT}win-aarch64/crypto/fipsmodule/sha512-armv8.S
diff --git a/apple-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S b/apple-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
new file mode 100644
index 0000000..233910d
--- /dev/null
+++ b/apple-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
@@ -0,0 +1,3017 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include <openssl/arm_arch.h>
+.section	__TEXT,__const
+
+.align	7
+Lchacha20_consts:
+.byte	'e','x','p','a','n','d',' ','3','2','-','b','y','t','e',' ','k'
+Linc:
+.long	1,2,3,4
+Lrol8:
+.byte	3,0,1,2, 7,4,5,6, 11,8,9,10, 15,12,13,14
+Lclamp:
+.quad	0x0FFFFFFC0FFFFFFF, 0x0FFFFFFC0FFFFFFC
+
+.text
+
+
+.align	6
+Lpoly_hash_ad_internal:
+.cfi_startproc
+	cbnz	x4, Lpoly_hash_intro
+	ret
+
+Lpoly_hash_intro:
+	cmp	x4, #16
+	b.lt	Lpoly_hash_ad_tail
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #16
+	b	Lpoly_hash_ad_internal
+
+Lpoly_hash_ad_tail:
+	cbz	x4, Lpoly_hash_ad_ret
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the AAD
+	sub	x4, x4, #1
+
+Lpoly_hash_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, x4]
+	mov	v20.b[0], w11
+	subs	x4, x4, #1
+	b.ge	Lpoly_hash_tail_16_compose
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+Lpoly_hash_ad_ret:
+	ret
+.cfi_endproc
+
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_seal(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *seal_data);
+//
+.globl	_chacha20_poly1305_seal
+.private_extern	_chacha20_poly1305_seal
+
+.align	6
+_chacha20_poly1305_seal:
+	AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+	stp	x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset	80
+.cfi_offset	w30, -72
+.cfi_offset	w29, -80
+	mov	x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+	stp	d8, d9, [sp, #16]
+	stp	d10, d11, [sp, #32]
+	stp	d12, d13, [sp, #48]
+	stp	d14, d15, [sp, #64]
+.cfi_offset	b15, -8
+.cfi_offset	b14, -16
+.cfi_offset	b13, -24
+.cfi_offset	b12, -32
+.cfi_offset	b11, -40
+.cfi_offset	b10, -48
+.cfi_offset	b9, -56
+.cfi_offset	b8, -64
+
+	adrp	x11, Lchacha20_consts@PAGE
+	add	x11, x11, Lchacha20_consts@PAGEOFF
+
+	ld1	{v24.16b - v27.16b}, [x11] // Load the CONSTS, INC, ROL8 and CLAMP values
+	ld1	{v28.16b - v30.16b}, [x5]
+
+	mov	x15, #1 // Prepare the Poly1305 state
+	mov	x8, #0
+	mov	x9, #0
+	mov	x10, #0
+
+	ldr	x12, [x5, #56]   // The total cipher text length includes extra_in_len
+	add	x12, x12, x2
+	mov	v31.d[0], x4  // Store the input and aad lengths
+	mov	v31.d[1], x12
+
+	cmp	x2, #128
+	b.le	Lseal_128 // Optimization for smaller buffers
+
+    // Initially we prepare 5 ChaCha20 blocks. Four to encrypt up to 4 blocks (256 bytes) of plaintext,
+    // and one for the Poly1305 R and S keys. The first four blocks (A0-A3..D0-D3) are computed vertically,
+    // the fifth block (A4-D4) horizontally.
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	sub	x5, x5, #32
+
+	mov	x6, #10
+
+.align	5
+Lseal_init_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lseal_init_rounds
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #4
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	and	v4.16b, v4.16b, v27.16b
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	mov	x16, v4.d[0] // Move the R key to GPRs
+	mov	x17, v4.d[1]
+	mov	v27.16b, v9.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+
+	mov	x3, x0
+	cmp	x2, #256
+	b.le	Lseal_tail
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #256
+
+	mov	x6, #4 // In the first run of the loop we need to hash 256 bytes, therefore we hash one block for the first 4 rounds
+	mov	x7, #6 // and two blocks for the remaining 6, for a total of (1 * 4 + 2 * 6) * 16 = 256
+
+Lseal_main_loop:
+	adrp	x11, Lchacha20_consts@PAGE
+	add	x11, x11, Lchacha20_consts@PAGEOFF
+
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	sub	x5, x5, #32
+.align	5
+Lseal_main_loop_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x6, x6, #1
+	b.ge	Lseal_main_loop_rounds
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	subs	x7, x7, #1
+	b.gt	Lseal_main_loop_rounds
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #5
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	add	v14.4s, v14.4s, v29.4s
+	add	v19.4s, v19.4s, v30.4s
+
+	cmp	x2, #320
+	b.le	Lseal_tail
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v4.16b
+	eor	v21.16b, v21.16b, v9.16b
+	eor	v22.16b, v22.16b, v14.16b
+	eor	v23.16b, v23.16b, v19.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #320
+
+	mov	x6, #0
+	mov	x7, #10 // For the remainder of the loop we always hash and encrypt 320 bytes per iteration
+
+	b	Lseal_main_loop
+
+Lseal_tail:
+    // This part of the function handles the storage and authentication of the last [0,320) bytes
+    // We assume A0-A4 ... D0-D4 hold at least inl (320 max) bytes of the stream data.
+	cmp	x2, #64
+	b.lt	Lseal_tail_64
+
+    // Store and authenticate 64B blocks per iteration
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v22.d[0]
+	mov	x12, v22.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v23.d[0]
+	mov	x12, v23.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	st1	{v20.16b - v23.16b}, [x0], #64
+	sub	x2, x2, #64
+
+    // Shift the state left by 64 bytes for the next iteration of the loop
+	mov	v0.16b, v1.16b
+	mov	v5.16b, v6.16b
+	mov	v10.16b, v11.16b
+	mov	v15.16b, v16.16b
+
+	mov	v1.16b, v2.16b
+	mov	v6.16b, v7.16b
+	mov	v11.16b, v12.16b
+	mov	v16.16b, v17.16b
+
+	mov	v2.16b, v3.16b
+	mov	v7.16b, v8.16b
+	mov	v12.16b, v13.16b
+	mov	v17.16b, v18.16b
+
+	mov	v3.16b, v4.16b
+	mov	v8.16b, v9.16b
+	mov	v13.16b, v14.16b
+	mov	v18.16b, v19.16b
+
+	b	Lseal_tail
+
+Lseal_tail_64:
+	ldp	x3, x4, [x5, #48] // extra_in_len and extra_in_ptr
+
+    // Here we handle the last [0,64) bytes of plaintext
+	cmp	x2, #16
+	b.lt	Lseal_tail_16
+    // Each iteration encrypt and authenticate a 16B block
+	ld1	{v20.16b}, [x1], #16
+	eor	v20.16b, v20.16b, v0.16b
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	st1	{v20.16b}, [x0], #16
+
+	sub	x2, x2, #16
+
+    // Shift the state left by 16 bytes for the next iteration of the loop
+	mov	v0.16b, v5.16b
+	mov	v5.16b, v10.16b
+	mov	v10.16b, v15.16b
+
+	b	Lseal_tail_64
+
+Lseal_tail_16:
+    // Here we handle the last [0,16) bytes of ciphertext that require a padded block
+	cbz	x2, Lseal_hash_extra
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the plaintext/extra in
+	eor	v21.16b, v21.16b, v21.16b // Use T1 to generate an AND mask that will only mask the ciphertext bytes
+	not	v22.16b, v20.16b
+
+	mov	x6, x2
+	add	x1, x1, x2
+
+	cbz	x4, Lseal_tail_16_compose // No extra data to pad with, zero padding
+
+	mov	x7, #16          // We need to load some extra_in first for padding
+	sub	x7, x7, x2
+	cmp	x4, x7
+	csel	x7, x4, x7, lt // Load the minimum of extra_in_len and the amount needed to fill the register
+	mov	x12, x7
+	add	x3, x3, x7
+	sub	x4, x4, x7
+
+Lseal_tail16_compose_extra_in:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, #-1]!
+	mov	v20.b[0], w11
+	subs	x7, x7, #1
+	b.gt	Lseal_tail16_compose_extra_in
+
+	add	x3, x3, x12
+
+Lseal_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x1, #-1]!
+	mov	v20.b[0], w11
+	ext	v21.16b, v22.16b, v21.16b, #15
+	subs	x2, x2, #1
+	b.gt	Lseal_tail_16_compose
+
+	and	v0.16b, v0.16b, v21.16b
+	eor	v20.16b, v20.16b, v0.16b
+	mov	v21.16b, v20.16b
+
+Lseal_tail_16_store:
+	umov	w11, v20.b[0]
+	strb	w11, [x0], #1
+	ext	v20.16b, v20.16b, v20.16b, #1
+	subs	x6, x6, #1
+	b.gt	Lseal_tail_16_store
+
+    // Hash in the final ct block concatenated with extra_in
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+Lseal_hash_extra:
+	cbz	x4, Lseal_finalize
+
+Lseal_hash_extra_loop:
+	cmp	x4, #16
+	b.lt	Lseal_hash_extra_tail
+	ld1	{v20.16b}, [x3], #16
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #16
+	b	Lseal_hash_extra_loop
+
+Lseal_hash_extra_tail:
+	cbz	x4, Lseal_finalize
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the remaining extra ciphertext
+	add	x3, x3, x4
+
+Lseal_hash_extra_load:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, #-1]!
+	mov	v20.b[0], w11
+	subs	x4, x4, #1
+	b.gt	Lseal_hash_extra_load
+
+    // Hash in the final padded extra_in blcok
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+Lseal_finalize:
+	mov	x11, v31.d[0]
+	mov	x12, v31.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+    # Final reduction step
+	sub	x12, xzr, x15
+	orr	x13, xzr, #3
+	subs	x11, x8, #-5
+	sbcs	x12, x9, x12
+	sbcs	x13, x10, x13
+	csel	x8, x11, x8, cs
+	csel	x9, x12, x9, cs
+	csel	x10, x13, x10, cs
+	mov	x11, v27.d[0]
+	mov	x12, v27.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+
+	stp	x8, x9, [x5]
+
+	ldp	d8, d9, [sp, #16]
+	ldp	d10, d11, [sp, #32]
+	ldp	d12, d13, [sp, #48]
+	ldp	d14, d15, [sp, #64]
+.cfi_restore	b15
+.cfi_restore	b14
+.cfi_restore	b13
+.cfi_restore	b12
+.cfi_restore	b11
+.cfi_restore	b10
+.cfi_restore	b9
+.cfi_restore	b8
+	ldp	x29, x30, [sp], 80
+.cfi_restore	w29
+.cfi_restore	w30
+.cfi_def_cfa_offset	0
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+Lseal_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+	eor	v25.16b, v25.16b, v25.16b
+	mov	x11, #1
+	mov	v25.s[0], w11
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v17.16b, v30.16b
+	add	v15.4s, v17.4s, v25.4s
+	add	v16.4s, v15.4s, v25.4s
+
+	mov	x6, #10
+
+Lseal_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lseal_128_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+
+    // Only the first 32 bytes of the third block (counter = 0) are needed,
+    // so skip updating v12 and v17.
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+
+	add	v30.4s, v30.4s, v25.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v30.4s, v30.4s, v25.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	and	v2.16b, v2.16b, v27.16b
+	mov	x16, v2.d[0] // Move the R key to GPRs
+	mov	x17, v2.d[1]
+	mov	v27.16b, v7.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+	b	Lseal_tail
+.cfi_endproc
+
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_open(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *aead_data);
+//
+.globl	_chacha20_poly1305_open
+.private_extern	_chacha20_poly1305_open
+
+.align	6
+_chacha20_poly1305_open:
+	AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+	stp	x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset	80
+.cfi_offset	w30, -72
+.cfi_offset	w29, -80
+	mov	x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+	stp	d8, d9, [sp, #16]
+	stp	d10, d11, [sp, #32]
+	stp	d12, d13, [sp, #48]
+	stp	d14, d15, [sp, #64]
+.cfi_offset	b15, -8
+.cfi_offset	b14, -16
+.cfi_offset	b13, -24
+.cfi_offset	b12, -32
+.cfi_offset	b11, -40
+.cfi_offset	b10, -48
+.cfi_offset	b9, -56
+.cfi_offset	b8, -64
+
+	adrp	x11, Lchacha20_consts@PAGE
+	add	x11, x11, Lchacha20_consts@PAGEOFF
+
+	ld1	{v24.16b - v27.16b}, [x11] // Load the CONSTS, INC, ROL8 and CLAMP values
+	ld1	{v28.16b - v30.16b}, [x5]
+
+	mov	x15, #1 // Prepare the Poly1305 state
+	mov	x8, #0
+	mov	x9, #0
+	mov	x10, #0
+
+	mov	v31.d[0], x4  // Store the input and aad lengths
+	mov	v31.d[1], x2
+
+	cmp	x2, #128
+	b.le	Lopen_128 // Optimization for smaller buffers
+
+    // Initially we prepare a single ChaCha20 block for the Poly1305 R and S keys
+	mov	v0.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v15.16b, v30.16b
+
+	mov	x6, #10
+
+.align	5
+Lopen_init_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lopen_init_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+
+	and	v0.16b, v0.16b, v27.16b
+	mov	x16, v0.d[0] // Move the R key to GPRs
+	mov	x17, v0.d[1]
+	mov	v27.16b, v5.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+
+Lopen_ad_done:
+	mov	x3, x1
+
+// Each iteration of the loop hash 320 bytes, and prepare stream for 320 bytes
+Lopen_main_loop:
+
+	cmp	x2, #192
+	b.lt	Lopen_tail
+
+	adrp	x11, Lchacha20_consts@PAGE
+	add	x11, x11, Lchacha20_consts@PAGEOFF
+
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	sub	x5, x5, #32
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	lsr	x4, x2, #4 // How many whole blocks we have to hash, will always be at least 12
+	sub	x4, x4, #10
+
+	mov	x7, #10
+	subs	x6, x7, x4
+	subs	x6, x7, x4 // itr1 can be negative if we have more than 320 bytes to hash
+	csel	x7, x7, x4, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are full
+
+	cbz	x7, Lopen_main_loop_rounds_short
+
+.align	5
+Lopen_main_loop_rounds:
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+Lopen_main_loop_rounds_short:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x7, x7, #1
+	b.gt	Lopen_main_loop_rounds
+	subs	x6, x6, #1
+	b.ge	Lopen_main_loop_rounds_short
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #5
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	add	v14.4s, v14.4s, v29.4s
+	add	v19.4s, v19.4s, v30.4s
+
+    // We can always safely store 192 bytes
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #192
+
+	mov	v0.16b, v3.16b
+	mov	v5.16b, v8.16b
+	mov	v10.16b, v13.16b
+	mov	v15.16b, v18.16b
+
+	cmp	x2, #64
+	b.lt	Lopen_tail_64_store
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+
+	mov	v0.16b, v4.16b
+	mov	v5.16b, v9.16b
+	mov	v10.16b, v14.16b
+	mov	v15.16b, v19.16b
+
+	cmp	x2, #64
+	b.lt	Lopen_tail_64_store
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v4.16b
+	eor	v21.16b, v21.16b, v9.16b
+	eor	v22.16b, v22.16b, v14.16b
+	eor	v23.16b, v23.16b, v19.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+	b	Lopen_main_loop
+
+Lopen_tail:
+
+	cbz	x2, Lopen_finalize
+
+	lsr	x4, x2, #4 // How many whole blocks we have to hash
+
+	cmp	x2, #64
+	b.le	Lopen_tail_64
+	cmp	x2, #128
+	b.le	Lopen_tail_128
+
+Lopen_tail_192:
+     // We need three more blocks
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v15.16b, v30.16b
+	mov	v16.16b, v30.16b
+	mov	v17.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	eor	v21.16b, v21.16b, v21.16b
+	ins	v23.s[0], v25.s[0]
+	ins	v21.d[0], x15
+
+	add	v22.4s, v23.4s, v21.4s
+	add	v21.4s, v22.4s, v21.4s
+
+	add	v15.4s, v15.4s, v21.4s
+	add	v16.4s, v16.4s, v23.4s
+	add	v17.4s, v17.4s, v22.4s
+
+	mov	x7, #10
+	subs	x6, x7, x4 // itr1 can be negative if we have more than 160 bytes to hash
+	csel	x7, x7, x4, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are hashing
+	sub	x4, x4, x7
+
+	cbz	x7, Lopen_tail_192_rounds_no_hash
+
+Lopen_tail_192_rounds:
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+Lopen_tail_192_rounds_no_hash:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x7, x7, #1
+	b.gt	Lopen_tail_192_rounds
+	subs	x6, x6, #1
+	b.ge	Lopen_tail_192_rounds_no_hash
+
+    // We hashed 160 bytes at most, may still have 32 bytes left
+Lopen_tail_192_hash:
+	cbz	x4, Lopen_tail_192_hash_done
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #1
+	b	Lopen_tail_192_hash
+
+Lopen_tail_192_hash_done:
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v16.4s, v16.4s, v30.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v15.4s, v15.4s, v21.4s
+	add	v16.4s, v16.4s, v23.4s
+	add	v17.4s, v17.4s, v22.4s
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #128
+	b	Lopen_tail_64_store
+
+Lopen_tail_128:
+     // We need two more blocks
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v15.16b, v30.16b
+	mov	v16.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	eor	v22.16b, v22.16b, v22.16b
+	ins	v23.s[0], v25.s[0]
+	ins	v22.d[0], x15
+	add	v22.4s, v22.4s, v23.4s
+
+	add	v15.4s, v15.4s, v22.4s
+	add	v16.4s, v16.4s, v23.4s
+
+	mov	x6, #10
+	sub	x6, x6, x4
+
+Lopen_tail_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v1.4s, v1.4s, v6.4s
+	eor	v16.16b, v16.16b, v1.16b
+	rev32	v16.8h, v16.8h
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v6.16b, v6.16b, v11.16b
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	add	v1.4s, v1.4s, v20.4s
+	eor	v16.16b, v16.16b, v1.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v20.16b, v20.16b, v11.16b
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v16.16b, v16.16b, v16.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	add	v1.4s, v1.4s, v6.4s
+	eor	v16.16b, v16.16b, v1.16b
+	rev32	v16.8h, v16.8h
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v6.16b, v6.16b, v11.16b
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	add	v1.4s, v1.4s, v20.4s
+	eor	v16.16b, v16.16b, v1.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v20.16b, v20.16b, v11.16b
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v16.16b, v16.16b, v16.16b, #4
+	subs	x6, x6, #1
+	b.gt	Lopen_tail_128_rounds
+	cbz	x4, Lopen_tail_128_rounds_done
+	subs	x4, x4, #1
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	b	Lopen_tail_128_rounds
+
+Lopen_tail_128_rounds_done:
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v16.4s, v16.4s, v30.4s
+	add	v15.4s, v15.4s, v22.4s
+	add	v16.4s, v16.4s, v23.4s
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+	sub	x2, x2, #64
+
+	b	Lopen_tail_64_store
+
+Lopen_tail_64:
+    // We just need a single block
+	mov	v0.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v15.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	ins	v23.s[0], v25.s[0]
+	add	v15.4s, v15.4s, v23.4s
+
+	mov	x6, #10
+	sub	x6, x6, x4
+
+Lopen_tail_64_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	subs	x6, x6, #1
+	b.gt	Lopen_tail_64_rounds
+	cbz	x4, Lopen_tail_64_rounds_done
+	subs	x4, x4, #1
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	b	Lopen_tail_64_rounds
+
+Lopen_tail_64_rounds_done:
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v15.4s, v15.4s, v23.4s
+
+Lopen_tail_64_store:
+	cmp	x2, #16
+	b.lt	Lopen_tail_16
+
+	ld1	{v20.16b}, [x1], #16
+	eor	v20.16b, v20.16b, v0.16b
+	st1	{v20.16b}, [x0], #16
+	mov	v0.16b, v5.16b
+	mov	v5.16b, v10.16b
+	mov	v10.16b, v15.16b
+	sub	x2, x2, #16
+	b	Lopen_tail_64_store
+
+Lopen_tail_16:
+    // Here we handle the last [0,16) bytes that require a padded block
+	cbz	x2, Lopen_finalize
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the ciphertext
+	eor	v21.16b, v21.16b, v21.16b // Use T1 to generate an AND mask
+	not	v22.16b, v20.16b
+
+	add	x7, x1, x2
+	mov	x6, x2
+
+Lopen_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x7, #-1]!
+	mov	v20.b[0], w11
+	ext	v21.16b, v22.16b, v21.16b, #15
+	subs	x2, x2, #1
+	b.gt	Lopen_tail_16_compose
+
+	and	v20.16b, v20.16b, v21.16b
+    // Hash in the final padded block
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	eor	v20.16b, v20.16b, v0.16b
+
+Lopen_tail_16_store:
+	umov	w11, v20.b[0]
+	strb	w11, [x0], #1
+	ext	v20.16b, v20.16b, v20.16b, #1
+	subs	x6, x6, #1
+	b.gt	Lopen_tail_16_store
+
+Lopen_finalize:
+	mov	x11, v31.d[0]
+	mov	x12, v31.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+    # Final reduction step
+	sub	x12, xzr, x15
+	orr	x13, xzr, #3
+	subs	x11, x8, #-5
+	sbcs	x12, x9, x12
+	sbcs	x13, x10, x13
+	csel	x8, x11, x8, cs
+	csel	x9, x12, x9, cs
+	csel	x10, x13, x10, cs
+	mov	x11, v27.d[0]
+	mov	x12, v27.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+
+	stp	x8, x9, [x5]
+
+	ldp	d8, d9, [sp, #16]
+	ldp	d10, d11, [sp, #32]
+	ldp	d12, d13, [sp, #48]
+	ldp	d14, d15, [sp, #64]
+.cfi_restore	b15
+.cfi_restore	b14
+.cfi_restore	b13
+.cfi_restore	b12
+.cfi_restore	b11
+.cfi_restore	b10
+.cfi_restore	b9
+.cfi_restore	b8
+	ldp	x29, x30, [sp], 80
+.cfi_restore	w29
+.cfi_restore	w30
+.cfi_def_cfa_offset	0
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+Lopen_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+	eor	v25.16b, v25.16b, v25.16b
+	mov	x11, #1
+	mov	v25.s[0], w11
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v17.16b, v30.16b
+	add	v15.4s, v17.4s, v25.4s
+	add	v16.4s, v15.4s, v25.4s
+
+	mov	x6, #10
+
+Lopen_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lopen_128_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+
+	add	v30.4s, v30.4s, v25.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v30.4s, v30.4s, v25.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	and	v2.16b, v2.16b, v27.16b
+	mov	x16, v2.d[0] // Move the R key to GPRs
+	mov	x17, v2.d[1]
+	mov	v27.16b, v7.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+
+Lopen_128_store:
+	cmp	x2, #64
+	b.lt	Lopen_128_store_64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v22.d[0]
+	mov	x12, v22.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v23.d[0]
+	mov	x12, v23.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+
+	mov	v0.16b, v1.16b
+	mov	v5.16b, v6.16b
+	mov	v10.16b, v11.16b
+	mov	v15.16b, v16.16b
+
+Lopen_128_store_64:
+
+	lsr	x4, x2, #4
+	mov	x3, x1
+
+Lopen_128_hash_64:
+	cbz	x4, Lopen_tail_64_store
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #1
+	b	Lopen_128_hash_64
+.cfi_endproc
+
+#endif  // !OPENSSL_NO_ASM
diff --git a/apple-aarch64/crypto/fipsmodule/p256-armv8-asm.S b/apple-aarch64/crypto/fipsmodule/p256-armv8-asm.S
new file mode 100644
index 0000000..0b655fc
--- /dev/null
+++ b/apple-aarch64/crypto/fipsmodule/p256-armv8-asm.S
@@ -0,0 +1,1762 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include "openssl/arm_arch.h"
+
+.text
+.align	5
+Lpoly:
+.quad	0xffffffffffffffff,0x00000000ffffffff,0x0000000000000000,0xffffffff00000001
+LRR:	//	2^512 mod P precomputed for NIST P256 polynomial
+.quad	0x0000000000000003,0xfffffffbffffffff,0xfffffffffffffffe,0x00000004fffffffd
+Lone_mont:
+.quad	0x0000000000000001,0xffffffff00000000,0xffffffffffffffff,0x00000000fffffffe
+Lone:
+.quad	1,0,0,0
+Lord:
+.quad	0xf3b9cac2fc632551,0xbce6faada7179e84,0xffffffffffffffff,0xffffffff00000000
+LordK:
+.quad	0xccd1c8aaee00bc4f
+.byte	69,67,80,95,78,73,83,84,90,50,53,54,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
+.align	2
+
+// void	ecp_nistz256_to_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	_ecp_nistz256_to_mont
+.private_extern	_ecp_nistz256_to_mont
+
+.align	6
+_ecp_nistz256_to_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	x3,LRR		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	adr	x2,LRR		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_from_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	_ecp_nistz256_from_mont
+.private_extern	_ecp_nistz256_from_mont
+
+.align	4
+_ecp_nistz256_from_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	mov	x3,#1			// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	adr	x2,Lone		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_mul_mont(BN_ULONG x0[4],const BN_ULONG x1[4],
+//					     const BN_ULONG x2[4]);
+.globl	_ecp_nistz256_mul_mont
+.private_extern	_ecp_nistz256_mul_mont
+
+.align	4
+_ecp_nistz256_mul_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	x3,[x2]		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_sqr_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	_ecp_nistz256_sqr_mont
+.private_extern	_ecp_nistz256_sqr_mont
+
+.align	4
+_ecp_nistz256_sqr_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_sqr_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_div_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	_ecp_nistz256_div_by_2
+.private_extern	_ecp_nistz256_div_by_2
+
+.align	4
+_ecp_nistz256_div_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_div_by_2
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_mul_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	_ecp_nistz256_mul_by_2
+.private_extern	_ecp_nistz256_mul_by_2
+
+.align	4
+_ecp_nistz256_mul_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_mul_by_3(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	_ecp_nistz256_mul_by_3
+.private_extern	_ecp_nistz256_mul_by_3
+
+.align	4
+_ecp_nistz256_mul_by_3:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	mov	x4,x14
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	mov	x8,x4
+	mov	x9,x5
+	mov	x10,x6
+	mov	x11,x7
+
+	bl	__ecp_nistz256_add_to	// ret += a	// 2*a+a=3*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_sub(BN_ULONG x0[4],const BN_ULONG x1[4],
+//				        const BN_ULONG x2[4]);
+.globl	_ecp_nistz256_sub
+.private_extern	_ecp_nistz256_sub
+
+.align	4
+_ecp_nistz256_sub:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_neg(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	_ecp_nistz256_neg
+.private_extern	_ecp_nistz256_neg
+
+.align	4
+_ecp_nistz256_neg:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	mov	x2,x1
+	mov	x14,xzr		// a = 0
+	mov	x15,xzr
+	mov	x16,xzr
+	mov	x17,xzr
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// note that __ecp_nistz256_mul_mont expects a[0-3] input pre-loaded
+// to x4-x7 and b[0] - to x3
+
+.align	4
+__ecp_nistz256_mul_mont:
+	mul	x14,x4,x3		// a[0]*b[0]
+	umulh	x8,x4,x3
+
+	mul	x15,x5,x3		// a[1]*b[0]
+	umulh	x9,x5,x3
+
+	mul	x16,x6,x3		// a[2]*b[0]
+	umulh	x10,x6,x3
+
+	mul	x17,x7,x3		// a[3]*b[0]
+	umulh	x11,x7,x3
+	ldr	x3,[x2,#8]		// b[1]
+
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adc	x19,xzr,x11
+	mov	x20,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	ldr	x3,[x2,#8*(1+1)]	// b[1+1]
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	ldr	x3,[x2,#8*(2+1)]	// b[2+1]
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	// last reduction
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	adcs	x17,x19,x11
+	adc	x19,x20,xzr
+
+	adds	x8,x14,#1		// subs	x8,x14,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x19,xzr		// did it borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+// note that __ecp_nistz256_sqr_mont expects a[0-3] input pre-loaded
+// to x4-x7
+
+.align	4
+__ecp_nistz256_sqr_mont:
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is , i.e. follow 
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	x15,x5,x4		// a[1]*a[0]
+	umulh	x9,x5,x4
+	mul	x16,x6,x4		// a[2]*a[0]
+	umulh	x10,x6,x4
+	mul	x17,x7,x4		// a[3]*a[0]
+	umulh	x19,x7,x4
+
+	adds	x16,x16,x9		// accumulate high parts of multiplication
+	mul	x8,x6,x5		// a[2]*a[1]
+	umulh	x9,x6,x5
+	adcs	x17,x17,x10
+	mul	x10,x7,x5		// a[3]*a[1]
+	umulh	x11,x7,x5
+	adc	x19,x19,xzr		// can't overflow
+
+	mul	x20,x7,x6		// a[3]*a[2]
+	umulh	x1,x7,x6
+
+	adds	x9,x9,x10		// accumulate high parts of multiplication
+	mul	x14,x4,x4		// a[0]*a[0]
+	adc	x10,x11,xzr		// can't overflow
+
+	adds	x17,x17,x8		// accumulate low parts of multiplication
+	umulh	x4,x4,x4
+	adcs	x19,x19,x9
+	mul	x9,x5,x5		// a[1]*a[1]
+	adcs	x20,x20,x10
+	umulh	x5,x5,x5
+	adc	x1,x1,xzr		// can't overflow
+
+	adds	x15,x15,x15	// acc[1-6]*=2
+	mul	x10,x6,x6		// a[2]*a[2]
+	adcs	x16,x16,x16
+	umulh	x6,x6,x6
+	adcs	x17,x17,x17
+	mul	x11,x7,x7		// a[3]*a[3]
+	adcs	x19,x19,x19
+	umulh	x7,x7,x7
+	adcs	x20,x20,x20
+	adcs	x1,x1,x1
+	adc	x2,xzr,xzr
+
+	adds	x15,x15,x4		// +a[i]*a[i]
+	adcs	x16,x16,x9
+	adcs	x17,x17,x5
+	adcs	x19,x19,x10
+	adcs	x20,x20,x6
+	lsl	x8,x14,#32
+	adcs	x1,x1,x11
+	lsr	x9,x14,#32
+	adc	x2,x2,x7
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	adc	x17,x11,xzr		// can't overflow
+
+	adds	x14,x14,x19	// accumulate upper half
+	adcs	x15,x15,x20
+	adcs	x16,x16,x1
+	adcs	x17,x17,x2
+	adc	x19,xzr,xzr
+
+	adds	x8,x14,#1		// subs	x8,x14,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x19,xzr		// did it borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+// Note that __ecp_nistz256_add_to expects both input vectors pre-loaded to
+// x4-x7 and x8-x11. This is done because it's used in multiple
+// contexts, e.g. in multiplication by 2 and 3...
+
+.align	4
+__ecp_nistz256_add_to:
+	adds	x14,x14,x8		// ret = a+b
+	adcs	x15,x15,x9
+	adcs	x16,x16,x10
+	adcs	x17,x17,x11
+	adc	x1,xzr,xzr		// zap x1
+
+	adds	x8,x14,#1		// subs	x8,x4,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x1,xzr		// did subtraction borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+
+.align	4
+__ecp_nistz256_sub_from:
+	ldp	x8,x9,[x2]
+	ldp	x10,x11,[x2,#16]
+	subs	x14,x14,x8		// ret = a-b
+	sbcs	x15,x15,x9
+	sbcs	x16,x16,x10
+	sbcs	x17,x17,x11
+	sbc	x1,xzr,xzr		// zap x1
+
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = ret+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adc	x11,x17,x13
+	cmp	x1,xzr			// did subtraction borrow?
+
+	csel	x14,x14,x8,eq	// ret = borrow ? ret+modulus : ret
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,eq
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+
+.align	4
+__ecp_nistz256_sub_morf:
+	ldp	x8,x9,[x2]
+	ldp	x10,x11,[x2,#16]
+	subs	x14,x8,x14		// ret = b-a
+	sbcs	x15,x9,x15
+	sbcs	x16,x10,x16
+	sbcs	x17,x11,x17
+	sbc	x1,xzr,xzr		// zap x1
+
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = ret+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adc	x11,x17,x13
+	cmp	x1,xzr			// did subtraction borrow?
+
+	csel	x14,x14,x8,eq	// ret = borrow ? ret+modulus : ret
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,eq
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+
+.align	4
+__ecp_nistz256_div_by_2:
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = a+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adcs	x11,x17,x13
+	adc	x1,xzr,xzr		// zap x1
+	tst	x14,#1		// is a even?
+
+	csel	x14,x14,x8,eq	// ret = even ? a : a+modulus
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	csel	x17,x17,x11,eq
+	csel	x1,xzr,x1,eq
+
+	lsr	x14,x14,#1		// ret >>= 1
+	orr	x14,x14,x15,lsl#63
+	lsr	x15,x15,#1
+	orr	x15,x15,x16,lsl#63
+	lsr	x16,x16,#1
+	orr	x16,x16,x17,lsl#63
+	lsr	x17,x17,#1
+	stp	x14,x15,[x0]
+	orr	x17,x17,x1,lsl#63
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+.globl	_ecp_nistz256_point_double
+.private_extern	_ecp_nistz256_point_double
+
+.align	5
+_ecp_nistz256_point_double:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	sub	sp,sp,#32*4
+
+Ldouble_shortcut:
+	ldp	x14,x15,[x1,#32]
+	mov	x21,x0
+	ldp	x16,x17,[x1,#48]
+	mov	x22,x1
+	ldr	x12,Lpoly+8
+	mov	x8,x14
+	ldr	x13,Lpoly+24
+	mov	x9,x15
+	ldp	x4,x5,[x22,#64]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[x22,#64+16]
+	add	x0,sp,#0
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(S, in_y);
+
+	add	x0,sp,#64
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Zsqr, in_z);
+
+	ldp	x8,x9,[x22]
+	ldp	x10,x11,[x22,#16]
+	mov	x4,x14		// put Zsqr aside for p256_sub
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x0,sp,#32
+	bl	__ecp_nistz256_add_to	// p256_add(M, Zsqr, in_x);
+
+	add	x2,x22,#0
+	mov	x14,x4		// restore Zsqr
+	mov	x15,x5
+	ldp	x4,x5,[sp,#0]	// forward load for p256_sqr_mont
+	mov	x16,x6
+	mov	x17,x7
+	ldp	x6,x7,[sp,#0+16]
+	add	x0,sp,#64
+	bl	__ecp_nistz256_sub_morf	// p256_sub(Zsqr, in_x, Zsqr);
+
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(S, S);
+
+	ldr	x3,[x22,#32]
+	ldp	x4,x5,[x22,#64]
+	ldp	x6,x7,[x22,#64+16]
+	add	x2,x22,#32
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(tmp0, in_z, in_y);
+
+	mov	x8,x14
+	mov	x9,x15
+	ldp	x4,x5,[sp,#0]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[sp,#0+16]
+	add	x0,x21,#64
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(res_z, tmp0);
+
+	add	x0,sp,#96
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(tmp0, S);
+
+	ldr	x3,[sp,#64]		// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x0,x21,#32
+	bl	__ecp_nistz256_div_by_2	// p256_div_by_2(res_y, tmp0);
+
+	add	x2,sp,#64
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(M, M, Zsqr);
+
+	mov	x8,x14		// duplicate M
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	mov	x4,x14		// put M aside
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x0,sp,#32
+	bl	__ecp_nistz256_add_to
+	mov	x8,x4			// restore M
+	mov	x9,x5
+	ldr	x3,[x22]		// forward load for p256_mul_mont
+	mov	x10,x6
+	ldp	x4,x5,[sp,#0]
+	mov	x11,x7
+	ldp	x6,x7,[sp,#0+16]
+	bl	__ecp_nistz256_add_to	// p256_mul_by_3(M, M);
+
+	add	x2,x22,#0
+	add	x0,sp,#0
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, in_x);
+
+	mov	x8,x14
+	mov	x9,x15
+	ldp	x4,x5,[sp,#32]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[sp,#32+16]
+	add	x0,sp,#96
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(tmp0, S);
+
+	add	x0,x21,#0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(res_x, M);
+
+	add	x2,sp,#96
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_x, res_x, tmp0);
+
+	add	x2,sp,#0
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(S, S, res_x);
+
+	ldr	x3,[sp,#32]
+	mov	x4,x14		// copy S
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x2,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, M);
+
+	add	x2,x21,#32
+	add	x0,x21,#32
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, S, res_y);
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+.globl	_ecp_nistz256_point_add
+.private_extern	_ecp_nistz256_point_add
+
+.align	5
+_ecp_nistz256_point_add:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	stp	x27,x28,[sp,#80]
+	sub	sp,sp,#32*12
+
+	ldp	x4,x5,[x2,#64]	// in2_z
+	ldp	x6,x7,[x2,#64+16]
+	mov	x21,x0
+	mov	x22,x1
+	mov	x23,x2
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x25,x8,x10
+	cmp	x25,#0
+	csetm	x25,ne		// ~in2infty
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z2sqr, in2_z);
+
+	ldp	x4,x5,[x22,#64]	// in1_z
+	ldp	x6,x7,[x22,#64+16]
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x24,x8,x10
+	cmp	x24,#0
+	csetm	x24,ne		// ~in1infty
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	ldr	x3,[x23,#64]
+	ldp	x4,x5,[sp,#192]
+	ldp	x6,x7,[sp,#192+16]
+	add	x2,x23,#64
+	add	x0,sp,#320
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, Z2sqr, in2_z);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,x22,#64
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	x3,[x22,#32]
+	ldp	x4,x5,[sp,#320]
+	ldp	x6,x7,[sp,#320+16]
+	add	x2,x22,#32
+	add	x0,sp,#320
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, S1, in1_y);
+
+	ldr	x3,[x23,#32]
+	ldp	x4,x5,[sp,#352]
+	ldp	x6,x7,[sp,#352+16]
+	add	x2,x23,#32
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	x2,sp,#320
+	ldr	x3,[sp,#192]	// forward load for p256_mul_mont
+	ldp	x4,x5,[x22]
+	ldp	x6,x7,[x22,#16]
+	add	x0,sp,#160
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, S1);
+
+	orr	x14,x14,x15	// see if result is zero
+	orr	x16,x16,x17
+	orr	x26,x14,x16	// ~is_equal(S1,S2)
+
+	add	x2,sp,#192
+	add	x0,sp,#256
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U1, in1_x, Z2sqr);
+
+	ldr	x3,[sp,#128]
+	ldp	x4,x5,[x23]
+	ldp	x6,x7,[x23,#16]
+	add	x2,sp,#128
+	add	x0,sp,#288
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in2_x, Z1sqr);
+
+	add	x2,sp,#256
+	ldp	x4,x5,[sp,#160]	// forward load for p256_sqr_mont
+	ldp	x6,x7,[sp,#160+16]
+	add	x0,sp,#96
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, U1);
+
+	orr	x14,x14,x15	// see if result is zero
+	orr	x16,x16,x17
+	orr	x14,x14,x16	// ~is_equal(U1,U2)
+
+	mvn	x27,x24	// -1/0 -> 0/-1
+	mvn	x28,x25	// -1/0 -> 0/-1
+	orr	x14,x14,x27
+	orr	x14,x14,x28
+	orr	x14,x14,x26
+	cbnz	x14,Ladd_proceed	// if(~is_equal(U1,U2) | in1infty | in2infty | ~is_equal(S1,S2))
+
+Ladd_double:
+	mov	x1,x22
+	mov	x0,x21
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	add	sp,sp,#256	// #256 is from #32*(12-4). difference in stack frames
+	b	Ldouble_shortcut
+
+.align	4
+Ladd_proceed:
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#96]
+	ldp	x6,x7,[sp,#96+16]
+	add	x2,x22,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldp	x4,x5,[sp,#96]
+	ldp	x6,x7,[sp,#96+16]
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldr	x3,[x23,#64]
+	ldp	x4,x5,[sp,#64]
+	ldp	x6,x7,[sp,#64+16]
+	add	x2,x23,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, res_z, in2_z);
+
+	ldr	x3,[sp,#96]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,sp,#96
+	add	x0,sp,#224
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	x3,[sp,#128]
+	ldp	x4,x5,[sp,#256]
+	ldp	x6,x7,[sp,#256+16]
+	add	x2,sp,#128
+	add	x0,sp,#288
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, U1, Hsqr);
+
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	add	x0,sp,#128
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	x2,sp,#192
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	x2,sp,#224
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	x2,sp,#288
+	ldr	x3,[sp,#224]		// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#320]
+	ldp	x6,x7,[sp,#320+16]
+	add	x0,sp,#32
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	x2,sp,#224
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S1, Hcub);
+
+	ldr	x3,[sp,#160]
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x2,sp,#160
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	x2,sp,#352
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	x4,x5,[sp,#0]		// res
+	ldp	x6,x7,[sp,#0+16]
+	ldp	x8,x9,[x23]		// in2
+	ldp	x10,x11,[x23,#16]
+	ldp	x14,x15,[x22,#0]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#0+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+0+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+0+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#0+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#0+48]
+	stp	x14,x15,[x21,#0]
+	stp	x16,x17,[x21,#0+16]
+	ldp	x14,x15,[x22,#32]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#32+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+32+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+32+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#32+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#32+48]
+	stp	x14,x15,[x21,#32]
+	stp	x16,x17,[x21,#32+16]
+	ldp	x14,x15,[x22,#64]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#64+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	stp	x14,x15,[x21,#64]
+	stp	x16,x17,[x21,#64+16]
+
+Ladd_done:
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+.globl	_ecp_nistz256_point_add_affine
+.private_extern	_ecp_nistz256_point_add_affine
+
+.align	5
+_ecp_nistz256_point_add_affine:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-80]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	sub	sp,sp,#32*10
+
+	mov	x21,x0
+	mov	x22,x1
+	mov	x23,x2
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	ldp	x4,x5,[x1,#64]	// in1_z
+	ldp	x6,x7,[x1,#64+16]
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x24,x8,x10
+	cmp	x24,#0
+	csetm	x24,ne		// ~in1infty
+
+	ldp	x14,x15,[x2]	// in2_x
+	ldp	x16,x17,[x2,#16]
+	ldp	x8,x9,[x2,#32]	// in2_y
+	ldp	x10,x11,[x2,#48]
+	orr	x14,x14,x15
+	orr	x16,x16,x17
+	orr	x8,x8,x9
+	orr	x10,x10,x11
+	orr	x14,x14,x16
+	orr	x8,x8,x10
+	orr	x25,x14,x8
+	cmp	x25,#0
+	csetm	x25,ne		// ~in2infty
+
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	mov	x4,x14
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	ldr	x3,[x23]
+	add	x2,x23,#0
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, Z1sqr, in2_x);
+
+	add	x2,x22,#0
+	ldr	x3,[x22,#64]	// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x0,sp,#160
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, in1_x);
+
+	add	x2,x22,#64
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#160]
+	ldp	x6,x7,[sp,#160+16]
+	add	x2,x22,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldr	x3,[x23,#32]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,x23,#32
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	x2,x22,#32
+	ldp	x4,x5,[sp,#160]	// forward load for p256_sqr_mont
+	ldp	x6,x7,[sp,#160+16]
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, in1_y);
+
+	add	x0,sp,#224
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldp	x4,x5,[sp,#192]
+	ldp	x6,x7,[sp,#192+16]
+	add	x0,sp,#288
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	x3,[sp,#160]
+	ldp	x4,x5,[sp,#224]
+	ldp	x6,x7,[sp,#224+16]
+	add	x2,sp,#160
+	add	x0,sp,#256
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	x3,[x22]
+	ldp	x4,x5,[sp,#224]
+	ldp	x6,x7,[sp,#224+16]
+	add	x2,x22,#0
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in1_x, Hsqr);
+
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	add	x0,sp,#224
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	x2,sp,#288
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	x2,sp,#256
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	x2,sp,#96
+	ldr	x3,[x22,#32]	// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#256]
+	ldp	x6,x7,[sp,#256+16]
+	add	x0,sp,#32
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	x2,x22,#32
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, in1_y, Hcub);
+
+	ldr	x3,[sp,#192]
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x2,sp,#192
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	x2,sp,#128
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	x4,x5,[sp,#0]		// res
+	ldp	x6,x7,[sp,#0+16]
+	ldp	x8,x9,[x23]		// in2
+	ldp	x10,x11,[x23,#16]
+	ldp	x14,x15,[x22,#0]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#0+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+0+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+0+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#0+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#0+48]
+	stp	x14,x15,[x21,#0]
+	stp	x16,x17,[x21,#0+16]
+	adr	x23,Lone_mont-64
+	ldp	x14,x15,[x22,#32]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#32+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+32+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+32+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#32+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#32+48]
+	stp	x14,x15,[x21,#32]
+	stp	x16,x17,[x21,#32+16]
+	ldp	x14,x15,[x22,#64]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#64+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	stp	x14,x15,[x21,#64]
+	stp	x16,x17,[x21,#64+16]
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x29,x30,[sp],#80
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_mul_mont(uint64_t res[4], uint64_t a[4],
+//                                uint64_t b[4]);
+.globl	_ecp_nistz256_ord_mul_mont
+.private_extern	_ecp_nistz256_ord_mul_mont
+
+.align	4
+_ecp_nistz256_ord_mul_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	x23,Lord
+	ldr	x3,[x2]		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+
+	ldp	x12,x13,[x23,#0]
+	ldp	x21,x22,[x23,#16]
+	ldr	x23,[x23,#32]
+
+	mul	x14,x4,x3		// a[0]*b[0]
+	umulh	x8,x4,x3
+
+	mul	x15,x5,x3		// a[1]*b[0]
+	umulh	x9,x5,x3
+
+	mul	x16,x6,x3		// a[2]*b[0]
+	umulh	x10,x6,x3
+
+	mul	x17,x7,x3		// a[3]*b[0]
+	umulh	x19,x7,x3
+
+	mul	x24,x14,x23
+
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adc	x19,x19,xzr
+	mov	x20,xzr
+	ldr	x3,[x2,#8*1]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	ldr	x3,[x2,#8*2]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	ldr	x3,[x2,#8*3]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	lsl	x8,x24,#32		// last reduction
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	subs	x8,x14,x12		// ret -= modulus
+	sbcs	x9,x15,x13
+	sbcs	x10,x16,x21
+	sbcs	x11,x17,x22
+	sbcs	xzr,x19,xzr
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_sqr_mont(uint64_t res[4], uint64_t a[4],
+//                                int rep);
+.globl	_ecp_nistz256_ord_sqr_mont
+.private_extern	_ecp_nistz256_ord_sqr_mont
+
+.align	4
+_ecp_nistz256_ord_sqr_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	x23,Lord
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+
+	ldp	x12,x13,[x23,#0]
+	ldp	x21,x22,[x23,#16]
+	ldr	x23,[x23,#32]
+	b	Loop_ord_sqr
+
+.align	4
+Loop_ord_sqr:
+	sub	x2,x2,#1
+	////////////////////////////////////////////////////////////////
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is , i.e. follow 
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	x15,x5,x4		// a[1]*a[0]
+	umulh	x9,x5,x4
+	mul	x16,x6,x4		// a[2]*a[0]
+	umulh	x10,x6,x4
+	mul	x17,x7,x4		// a[3]*a[0]
+	umulh	x19,x7,x4
+
+	adds	x16,x16,x9		// accumulate high parts of multiplication
+	mul	x8,x6,x5		// a[2]*a[1]
+	umulh	x9,x6,x5
+	adcs	x17,x17,x10
+	mul	x10,x7,x5		// a[3]*a[1]
+	umulh	x11,x7,x5
+	adc	x19,x19,xzr		// can't overflow
+
+	mul	x20,x7,x6		// a[3]*a[2]
+	umulh	x1,x7,x6
+
+	adds	x9,x9,x10		// accumulate high parts of multiplication
+	mul	x14,x4,x4		// a[0]*a[0]
+	adc	x10,x11,xzr		// can't overflow
+
+	adds	x17,x17,x8		// accumulate low parts of multiplication
+	umulh	x4,x4,x4
+	adcs	x19,x19,x9
+	mul	x9,x5,x5		// a[1]*a[1]
+	adcs	x20,x20,x10
+	umulh	x5,x5,x5
+	adc	x1,x1,xzr		// can't overflow
+
+	adds	x15,x15,x15	// acc[1-6]*=2
+	mul	x10,x6,x6		// a[2]*a[2]
+	adcs	x16,x16,x16
+	umulh	x6,x6,x6
+	adcs	x17,x17,x17
+	mul	x11,x7,x7		// a[3]*a[3]
+	adcs	x19,x19,x19
+	umulh	x7,x7,x7
+	adcs	x20,x20,x20
+	adcs	x1,x1,x1
+	adc	x3,xzr,xzr
+
+	adds	x15,x15,x4		// +a[i]*a[i]
+	mul	x24,x14,x23
+	adcs	x16,x16,x9
+	adcs	x17,x17,x5
+	adcs	x19,x19,x10
+	adcs	x20,x20,x6
+	adcs	x1,x1,x11
+	adc	x3,x3,x7
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adc	x17,xzr,x24		// can't overflow
+	mul	x11,x14,x23
+	lsl	x8,x24,#32
+	subs	x15,x15,x24
+	lsr	x9,x24,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x11
+	mul	x10,x13,x11
+	umulh	x24,x13,x11
+
+	adcs	x10,x10,x9
+	adc	x24,x24,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x24
+	adcs	x16,x17,x11
+	adc	x17,xzr,x11		// can't overflow
+	mul	x24,x14,x23
+	lsl	x8,x11,#32
+	subs	x15,x15,x11
+	lsr	x9,x11,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adc	x17,xzr,x24		// can't overflow
+	mul	x11,x14,x23
+	lsl	x8,x24,#32
+	subs	x15,x15,x24
+	lsr	x9,x24,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x11
+	mul	x10,x13,x11
+	umulh	x24,x13,x11
+
+	adcs	x10,x10,x9
+	adc	x24,x24,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x24
+	adcs	x16,x17,x11
+	adc	x17,xzr,x11		// can't overflow
+	lsl	x8,x11,#32
+	subs	x15,x15,x11
+	lsr	x9,x11,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	adds	x14,x14,x19	// accumulate upper half
+	adcs	x15,x15,x20
+	adcs	x16,x16,x1
+	adcs	x17,x17,x3
+	adc	x19,xzr,xzr
+
+	subs	x8,x14,x12		// ret -= modulus
+	sbcs	x9,x15,x13
+	sbcs	x10,x16,x21
+	sbcs	x11,x17,x22
+	sbcs	xzr,x19,xzr
+
+	csel	x4,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x5,x15,x9,lo
+	csel	x6,x16,x10,lo
+	csel	x7,x17,x11,lo
+
+	cbnz	x2,Loop_ord_sqr
+
+	stp	x4,x5,[x0]
+	stp	x6,x7,[x0,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w5(uint64_t *val, uint64_t *in_t, int index);
+.globl	_ecp_nistz256_select_w5
+.private_extern	_ecp_nistz256_select_w5
+
+.align	4
+_ecp_nistz256_select_w5:
+	AARCH64_VALID_CALL_TARGET
+
+    // x10 := x0
+    // w9 := 0; loop counter and incremented internal index
+	mov	x10, x0
+	mov	w9, #0
+
+    // [v16-v21] := 0
+	movi	v16.16b, #0
+	movi	v17.16b, #0
+	movi	v18.16b, #0
+	movi	v19.16b, #0
+	movi	v20.16b, #0
+	movi	v21.16b, #0
+
+Lselect_w5_loop:
+    // Loop 16 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+	add	w9, w9, #1
+
+    // [v22-v27] := Load a (3*256-bit = 6*128-bit) table entry starting at x1
+    //  and advance x1 to point to the next entry
+	ld1	{v22.2d, v23.2d, v24.2d, v25.2d}, [x1],#64
+
+    // x11 := (w9 == w2)? All 1s : All 0s
+	cmp	w9, w2
+	csetm	x11, eq
+
+    // continue loading ...
+	ld1	{v26.2d, v27.2d}, [x1],#32
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+	dup	v3.2d, x11
+
+    // [v16-v19] := (Mask == all 1s)? [v22-v25] : [v16-v19]
+    // i.e., values in output registers will remain the same if w9 != w2
+	bit	v16.16b, v22.16b, v3.16b
+	bit	v17.16b, v23.16b, v3.16b
+
+	bit	v18.16b, v24.16b, v3.16b
+	bit	v19.16b, v25.16b, v3.16b
+
+	bit	v20.16b, v26.16b, v3.16b
+	bit	v21.16b, v27.16b, v3.16b
+
+    // If bit #4 is not 0 (i.e. idx_ctr < 16) loop back
+	tbz	w9, #4, Lselect_w5_loop
+
+    // Write [v16-v21] to memory at the output pointer
+	st1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x10],#64
+	st1	{v20.2d, v21.2d}, [x10]
+
+	ret
+
+
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w7(uint64_t *val, uint64_t *in_t, int index);
+.globl	_ecp_nistz256_select_w7
+.private_extern	_ecp_nistz256_select_w7
+
+.align	4
+_ecp_nistz256_select_w7:
+	AARCH64_VALID_CALL_TARGET
+
+    // w9 := 0; loop counter and incremented internal index
+	mov	w9, #0
+
+    // [v16-v21] := 0
+	movi	v16.16b, #0
+	movi	v17.16b, #0
+	movi	v18.16b, #0
+	movi	v19.16b, #0
+
+Lselect_w7_loop:
+    // Loop 64 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+	add	w9, w9, #1
+
+    // [v22-v25] := Load a (2*256-bit = 4*128-bit) table entry starting at x1
+    //  and advance x1 to point to the next entry
+	ld1	{v22.2d, v23.2d, v24.2d, v25.2d}, [x1],#64
+
+    // x11 := (w9 == w2)? All 1s : All 0s
+	cmp	w9, w2
+	csetm	x11, eq
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+	dup	v3.2d, x11
+
+    // [v16-v19] := (Mask == all 1s)? [v22-v25] : [v16-v19]
+    // i.e., values in output registers will remain the same if w9 != w2
+	bit	v16.16b, v22.16b, v3.16b
+	bit	v17.16b, v23.16b, v3.16b
+
+	bit	v18.16b, v24.16b, v3.16b
+	bit	v19.16b, v25.16b, v3.16b
+
+    // If bit #6 is not 0 (i.e. idx_ctr < 64) loop back
+	tbz	w9, #6, Lselect_w7_loop
+
+    // Write [v16-v19] to memory at the output pointer
+	st1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x0]
+
+	ret
+
+#endif  // !OPENSSL_NO_ASM
diff --git a/apple-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S b/apple-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
new file mode 100644
index 0000000..317b813
--- /dev/null
+++ b/apple-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
@@ -0,0 +1,317 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include "openssl/arm_arch.h"
+
+.text
+.globl	_beeu_mod_inverse_vartime
+.private_extern	_beeu_mod_inverse_vartime
+
+.align	4
+_beeu_mod_inverse_vartime:
+    // Reserve enough space for 14 8-byte registers on the stack
+    // in the first stp call for x29, x30.
+    // Then store the remaining callee-saved registers.
+    //
+    //    | x29 | x30 | x19 | x20 | ... | x27 | x28 |  x0 |  x2 |
+    //    ^                                                     ^
+    //    sp  <------------------- 112 bytes ----------------> old sp
+    //   x29 (FP)
+    //
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-112]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	stp	x27,x28,[sp,#80]
+	stp	x0,x2,[sp,#96]
+
+    // B = b3..b0 := a
+	ldp	x25,x26,[x1]
+	ldp	x27,x28,[x1,#16]
+
+    // n3..n0 := n
+    // Note: the value of input params are changed in the following.
+	ldp	x0,x1,[x2]
+	ldp	x2,x30,[x2,#16]
+
+    // A = a3..a0 := n
+	mov	x21, x0
+	mov	x22, x1
+	mov	x23, x2
+	mov	x24, x30
+
+    // X = x4..x0 := 1
+	mov	x3, #1
+	eor	x4, x4, x4
+	eor	x5, x5, x5
+	eor	x6, x6, x6
+	eor	x7, x7, x7
+
+    // Y = y4..y0 := 0
+	eor	x8, x8, x8
+	eor	x9, x9, x9
+	eor	x10, x10, x10
+	eor	x11, x11, x11
+	eor	x12, x12, x12
+
+Lbeeu_loop:
+    // if B == 0, jump to .Lbeeu_loop_end
+	orr	x14, x25, x26
+	orr	x14, x14, x27
+
+    // reverse the bit order of x25. This is needed for clz after this macro
+	rbit	x15, x25
+
+	orr	x14, x14, x28
+	cbz	x14,Lbeeu_loop_end
+
+
+    // 0 < B < |n|,
+    // 0 < A <= |n|,
+    // (1)      X*a  ==  B   (mod |n|),
+    // (2) (-1)*Y*a  ==  A   (mod |n|)
+
+    // Now divide B by the maximum possible power of two in the
+    // integers, and divide X by the same value mod |n|.
+    // When we're done, (1) still holds.
+
+    // shift := number of trailing 0s in x25
+    // (      = number of leading 0s in x15; see the "rbit" instruction in TEST_B_ZERO)
+	clz	x13, x15
+
+    // If there is no shift, goto shift_A_Y
+	cbz	x13, Lbeeu_shift_A_Y
+
+    // Shift B right by "x13" bits
+	neg	x14, x13
+	lsr	x25, x25, x13
+	lsl	x15, x26, x14
+
+	lsr	x26, x26, x13
+	lsl	x19, x27, x14
+
+	orr	x25, x25, x15
+
+	lsr	x27, x27, x13
+	lsl	x20, x28, x14
+
+	orr	x26, x26, x19
+
+	lsr	x28, x28, x13
+
+	orr	x27, x27, x20
+
+
+    // Shift X right by "x13" bits, adding n whenever X becomes odd.
+    // x13--;
+    // x14 := 0; needed in the addition to the most significant word in SHIFT1
+	eor	x14, x14, x14
+Lbeeu_shift_loop_X:
+	tbz	x3, #0, Lshift1_0
+	adds	x3, x3, x0
+	adcs	x4, x4, x1
+	adcs	x5, x5, x2
+	adcs	x6, x6, x30
+	adc	x7, x7, x14
+Lshift1_0:
+    // var0 := [var1|var0]<64..1>;
+    // i.e. concatenate var1 and var0,
+    //      extract bits <64..1> from the resulting 128-bit value
+    //      and put them in var0
+	extr	x3, x4, x3, #1
+	extr	x4, x5, x4, #1
+	extr	x5, x6, x5, #1
+	extr	x6, x7, x6, #1
+	lsr	x7, x7, #1
+
+	subs	x13, x13, #1
+	bne	Lbeeu_shift_loop_X
+
+    // Note: the steps above perform the same sequence as in p256_beeu-x86_64-asm.pl
+    // with the following differences:
+    // - "x13" is set directly to the number of trailing 0s in B
+    //   (using rbit and clz instructions)
+    // - The loop is only used to call SHIFT1(X)
+    //   and x13 is decreased while executing the X loop.
+    // - SHIFT256(B, x13) is performed before right-shifting X; they are independent
+
+Lbeeu_shift_A_Y:
+    // Same for A and Y.
+    // Afterwards, (2) still holds.
+    // Reverse the bit order of x21
+    // x13 := number of trailing 0s in x21 (= number of leading 0s in x15)
+	rbit	x15, x21
+	clz	x13, x15
+
+    // If there is no shift, goto |B-A|, X+Y update
+	cbz	x13, Lbeeu_update_B_X_or_A_Y
+
+    // Shift A right by "x13" bits
+	neg	x14, x13
+	lsr	x21, x21, x13
+	lsl	x15, x22, x14
+
+	lsr	x22, x22, x13
+	lsl	x19, x23, x14
+
+	orr	x21, x21, x15
+
+	lsr	x23, x23, x13
+	lsl	x20, x24, x14
+
+	orr	x22, x22, x19
+
+	lsr	x24, x24, x13
+
+	orr	x23, x23, x20
+
+
+    // Shift Y right by "x13" bits, adding n whenever Y becomes odd.
+    // x13--;
+    // x14 := 0; needed in the addition to the most significant word in SHIFT1
+	eor	x14, x14, x14
+Lbeeu_shift_loop_Y:
+	tbz	x8, #0, Lshift1_1
+	adds	x8, x8, x0
+	adcs	x9, x9, x1
+	adcs	x10, x10, x2
+	adcs	x11, x11, x30
+	adc	x12, x12, x14
+Lshift1_1:
+    // var0 := [var1|var0]<64..1>;
+    // i.e. concatenate var1 and var0,
+    //      extract bits <64..1> from the resulting 128-bit value
+    //      and put them in var0
+	extr	x8, x9, x8, #1
+	extr	x9, x10, x9, #1
+	extr	x10, x11, x10, #1
+	extr	x11, x12, x11, #1
+	lsr	x12, x12, #1
+
+	subs	x13, x13, #1
+	bne	Lbeeu_shift_loop_Y
+
+Lbeeu_update_B_X_or_A_Y:
+    // Try T := B - A; if cs, continue with B > A (cs: carry set = no borrow)
+    // Note: this is a case of unsigned arithmetic, where T fits in 4 64-bit words
+    //       without taking a sign bit if generated. The lack of a carry would
+    //       indicate a negative result. See, for example,
+    //       https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/condition-codes-1-condition-flags-and-codes
+	subs	x14, x25, x21
+	sbcs	x15, x26, x22
+	sbcs	x19, x27, x23
+	sbcs	x20, x28, x24
+	bcs	Lbeeu_B_greater_than_A
+
+    // Else A > B =>
+    // A := A - B; Y := Y + X; goto beginning of the loop
+	subs	x21, x21, x25
+	sbcs	x22, x22, x26
+	sbcs	x23, x23, x27
+	sbcs	x24, x24, x28
+
+	adds	x8, x8, x3
+	adcs	x9, x9, x4
+	adcs	x10, x10, x5
+	adcs	x11, x11, x6
+	adc	x12, x12, x7
+	b	Lbeeu_loop
+
+Lbeeu_B_greater_than_A:
+    // Continue with B > A =>
+    // B := B - A; X := X + Y; goto beginning of the loop
+	mov	x25, x14
+	mov	x26, x15
+	mov	x27, x19
+	mov	x28, x20
+
+	adds	x3, x3, x8
+	adcs	x4, x4, x9
+	adcs	x5, x5, x10
+	adcs	x6, x6, x11
+	adc	x7, x7, x12
+	b	Lbeeu_loop
+
+Lbeeu_loop_end:
+    // The Euclid's algorithm loop ends when A == gcd(a,n);
+    // this would be 1, when a and n are co-prime (i.e. do not have a common factor).
+    // Since (-1)*Y*a == A (mod |n|), Y>0
+    // then out = -Y mod n
+
+    // Verify that A = 1 ==> (-1)*Y*a = A = 1  (mod |n|)
+    // Is A-1 == 0?
+    // If not, fail.
+	sub	x14, x21, #1
+	orr	x14, x14, x22
+	orr	x14, x14, x23
+	orr	x14, x14, x24
+	cbnz	x14, Lbeeu_err
+
+    // If Y>n ==> Y:=Y-n
+Lbeeu_reduction_loop:
+    // x_i := y_i - n_i (X is no longer needed, use it as temp)
+    // (x14 = 0 from above)
+	subs	x3, x8, x0
+	sbcs	x4, x9, x1
+	sbcs	x5, x10, x2
+	sbcs	x6, x11, x30
+	sbcs	x7, x12, x14
+
+    // If result is non-negative (i.e., cs = carry set = no borrow),
+    // y_i := x_i; goto reduce again
+    // else
+    // y_i := y_i; continue
+	csel	x8, x3, x8, cs
+	csel	x9, x4, x9, cs
+	csel	x10, x5, x10, cs
+	csel	x11, x6, x11, cs
+	csel	x12, x7, x12, cs
+	bcs	Lbeeu_reduction_loop
+
+    // Now Y < n (Y cannot be equal to n, since the inverse cannot be 0)
+    // out = -Y = n-Y
+	subs	x8, x0, x8
+	sbcs	x9, x1, x9
+	sbcs	x10, x2, x10
+	sbcs	x11, x30, x11
+
+    // Save Y in output (out (x0) was saved on the stack)
+	ldr	x3, [sp,#96]
+	stp	x8, x9, [x3]
+	stp	x10, x11, [x3,#16]
+    // return 1 (success)
+	mov	x0, #1
+	b	Lbeeu_finish
+
+Lbeeu_err:
+    // return 0 (error)
+	eor	x0, x0, x0
+
+Lbeeu_finish:
+    // Restore callee-saved registers, except x0, x2
+	add	sp,x29,#0
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldp	x25,x26,[sp,#64]
+	ldp	x27,x28,[sp,#80]
+	ldp	x29,x30,[sp],#112
+
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+#endif  // !OPENSSL_NO_ASM
diff --git a/crypto_test_data.cc b/crypto_test_data.cc
index 67371ed..4c5667e 100644
--- a/crypto_test_data.cc
+++ b/crypto_test_data.cc
@@ -46,18 +46,18 @@
  *       crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt \
  *       crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt \
  *       crypto/curve25519/ed25519_tests.txt \
- *       crypto/cmac/cavp_3des_cmac_tests.txt \
- *       crypto/cmac/cavp_aes128_cmac_tests.txt \
- *       crypto/cmac/cavp_aes192_cmac_tests.txt \
- *       crypto/cmac/cavp_aes256_cmac_tests.txt \
  *       crypto/ecdh_extra/ecdh_tests.txt \
  *       crypto/evp/evp_tests.txt \
  *       crypto/evp/scrypt_tests.txt \
  *       crypto/fipsmodule/aes/aes_tests.txt \
  *       crypto/fipsmodule/bn/bn_tests.txt \
  *       crypto/fipsmodule/bn/miller_rabin_tests.txt \
+ *       crypto/fipsmodule/cmac/cavp_3des_cmac_tests.txt \
+ *       crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt \
+ *       crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt \
+ *       crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt \
  *       crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt \
- *       crypto/fipsmodule/ec/p256-x86_64_tests.txt \
+ *       crypto/fipsmodule/ec/p256-nistz_tests.txt \
  *       crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt \
  *       crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt \
  *       crypto/fipsmodule/modes/gcm_tests.txt \
@@ -2330,55 +2330,9 @@
     "28bb92e9a0edec8951ce2009a88ee1b64d9b9e89f69051203384210a102a44d2d6703173b68507dceadd3bf6510df2a5cefd9c80e4f385b2f9e6215813ed32\nSIG: 9da60cc4a64d07dee1346bd3d3010995ce2738208ab35b34c2a8fd1787ae3a1e207fe784525154fae4f5794cd8503045fea85cf77fd92f6a70cd0c5a52c0810e\n\nPRIV: 1126496a582ce58d3d618dd8a3933547aa7a8a30fb54063b8dfdd31671c6c73de10229c623fa8ad8982c3e4c36ff52df0f219b57915b6e980e5fe72ea0962e22\nPUB: e10229c623fa8ad8982c3e4c36ff52df0f219b57915b6e980e5fe72ea0962e22\nMESSAGE: 6a4b52d730ddab829b2a179590cbd4c372498e9f439977c0a10dc13c0ae1736eaaff063371434fd0da80360ec5890607d2fae1c9a2e1ab0b7f3d667f5b1b9c418f18b10c9e6fd669d3ebec168efef44163e577a2ebd0f2cb768f80c23188e86069e4d10f410306cedd7a341a61e0f4f3bc25041bc2f922ed073e1e2f1b709c579d10630f33071754d707894a1c62190de18882c564dc4c01dc545dd8966404ed78fa3267a9469f63b6120abb65f9b3ba3eee28d79c2eb4e7020cc6987dfc5c29672f8c0fa3e690d584fe000c64f352610179621bfd5ff3eb30d18f1a0250416db93b1c1e93cf8a3646517560d1cc8fff822b51ef27b200e987b592390753453ef138bd3d29db7cb1b5f45e4795b89c53f49704192752237c6ab274849f9594ee9777f6efe70483129d067f97199d9ae36090703864f7ca4750a6f3b6ff83824c910484394d1e2eceba18446fe4e994ce07433a740ddd05f0e396d482894e6f14acf7b97bae6c7eb88703039fa785d60a3af78b13243a4f88dde1d998617f2e3fa7eafc2f435dd4ac1ea9c238407aa09b4eea8ed434927b406674ac270458cfb3bf29c347f94559613179b9502192321b88e9af0a90e9a4ab9eddaae382e3734d1415ebe32499c34e6fdeaf15b0d9787985e08dfe495460c54f6743d81ff16881e5e30c51f4b092373783f12423c3e1ae8591130a269980caa1cb5c\nSIG: b30eb56ca9b120bf849a3a9d56af033de8a590c9e1240c1e36dbc6cf0a71b78a11ec143fb9959a8f25b57711d6a90a67e01be3a4da2b69394869bb8d64b87e0f\n\nPRIV: 9c167aff3b1b788f133d422de8ca9a64316409f9e35bfe22032ec417ae9abc6defb534f0d47c068e77b28a906d95ad8d213a4d4fc1c70542f01e596d57b5f019\nPUB: efb534f0d47c068e77b28a906d95ad8d213a4d4fc1c70542f01e596d57b5f019\nMESSAGE: 68ac0fc2b607ba38e377fae845c808c8f9fa614eb1f31158a9620a937d3e301e85acaa69144bc349a39dfb582041c4a197ae99b4d4d59b7a2ca3d16228b5591cbf57c18a781efd19193c47b16c6023a3a8ba3d668f05a37f1e83b0d7febdd10f63e48ef7a20e015b1c6725d4c300a986c60e3a115469c8e52ba05b51c05d0af40d89fd9ed76f36950aee3c7819898a903cfe0361a91c69100b495141e86ee79d63d17403fb1a1629ef63cb7e9d2720cbfff0002b190bcdc26794124dd38d42bcaa7175405eb0bbcf8e37d65d05a37195b479371fa2bbbb167d91cee88235dd72ea88fc73ce3ce43d33b715f25f192ec215dac124899c5e7586e86340d8cbe53735defbe02e4cc9fde69fb9794d1db72b98c0f19766ee5138bbfa78909aa299b4913c499deaf54b4841d5044829984936700dcf92f36542b2fc7e86441b9925f5d0b78c17a85cfcfcb20b0fd751349c27463abde4d27df74265288713f96dea013b945521808b4996b1b2dc0338b6d236efd6d2b27dafda46ec5fa32b965e8bb5e8bb61bd966edeb774681e0ea8c17b8c99fa7d660f0f66c9bc6d95cbd7dc094724098eb05191b53a3df6566b9c90e0d7dff2943848b61a20d48c22b6d3c958e293d709c8f48110230ff51918562877daf6d920c85a82e07c451fe7ae9759c0a77e97bb298b5d0592a41d08f67a4ed5a1bb41e937b6a68aeb38fd5be9\nSIG: c9ae67fd6415dcbab292fab394ca6c3b7d90ca244dc6a7764e74fd202bf4b2905bd2030e6beb914c3c238db371b1cba6d9261aa392ec871a4b8b12fe9c1c970e\n\nPRIV: e9948805eb341b2867479c668fd3532c309941c0ad4cb2e54231756e6a1bdecb5447a8e34d6a640002d8d60bcf1ddc711e4c465c94c34b50bdef358960ff81f1\nPUB: 5447a8e34d6a640002d8d60bcf1ddc711e4c465c94c34b50bdef358960ff81f1\nMESSAGE: 91cffd7eb1cf6bd4756bce6a30af9dfba26ddd1cce0394c194a3e39cc3d1cbc221b7eb70bea18d29c267457176a3c9e53c18e47d10a67c464505197702e6b2470d38869db5174b158f9992e4435d02246f540258dedd3ce33df582555a681fb76ecaccb1c2989b177e3b7e454aaa529de59bf5a03123d571df2e7f7cb830805c58b74a653bac0e5a888e08dc2236d6cd496aa06d0d67cf3b335e218c49dedad82fc1be9ef20cac61905c30eb132d739b16ca8a8c906619c0e0d8b33985327e36f3d4b8fda387c186cc50443104db761f7ff9301270204a713e58902101fad000ce931647c577fdec148dca95cdc08918ebed037c60332fadf088f036083ebc92e173b7ddcc30c493f27e69cd17a20d30b78f83a72e4f5a747d86d96c5e1bb7a438166204013e2164d6aabc0d562f54015c365c80445607145e5692ee34f6353077fab7452d88ce3eb01d2b3797dc91b341a3a726301516baae18e851f74dfbdf0866bb2376867de55231e362c472c52116544cd4f81e93571c4ec820e7e653f4e21be0a942576c9de91e7d1251683d859de448f822dcf3d2cf55ede2f9c71b6063d1373061f8f5936b698d1384e65459ea2bc26ec96775ef425207432dda0ac1fe28526c5e4559349c3d8df9918230f4044683cc2c1b858d141ab8d0805bb9336067522aa89c810f3eaa7ac2d8dd28c3751225a19ecec8bcca52439946\nSIG: d3dc62d6ce9c766f2abaf9a7fbe09d6bdb07a4747b56080db09beb4a4e804a70d7ddf4119475c7be834f31956f4a71dad029cdf2363dd0365ce22dc27f078003\n\nPRIV: b01753efa73bb3de7aa778be7afcbff66a5d3e2c2f8b5aa2b048844050996965d0cc6cf109c999fbf6d16f471fafd0232b0a68d4c46406ec7545dbaba8194158\nPUB: d0cc6cf109c999fbf6d16f471fafd0232b0a68d4c46406ec7545dbaba8194158\nMESSAGE: 684e612f27eead0d34844cc81ba911c28aaf6d66e71229e8cc3462f7c7a050daa30cb74471150f07dad459b5a91358476c0598255d8a642dd7c0802811bd88e4cac597efe41ebd96cd0f3b5ce72db4be1a3dbd6b84f5446e3da600d3b1d2b460a009bd31cacd98a91518ce33e9a703d404288736ccc43103fc69e67974f31652fa3dadef3337f6c897a3d201303c8f03597b4a87c98f291ccd58a3f1e898332aa5993b47fcb5ddaa1c0868b643742d0e4a4b9cd427038b3b74999bc89ac3484c0ca13f25aae8e78ae1ccee6218accab81a4f694f5324a347629d49b55e4037504a9acc8df58c6841dddcd4fc4347f7b6f1fd9de0564577e6f329ed951a0a6b9124ff63e22eb36d3a8863bc1bf69cea24c605967e7d8948953f27d5c4c75f0849f872a3e3d16d422fa5a11e1b9a74df6f38b90f277d81fce8437a14d99d2bef189d7cac83ddc61377ed348b3c4fc09ec2b9005925d04a71e26d641667bdf549294331c6ea01cd5c0bd1b6a7ecfda20b0f1929582b74697cb262c3927d6b223f4b5f3043aa6eb4571a78e9da11c2b36f64552580caa7b5fa6b90f929e0162e608d1240d7242cd2f47025c03debe059b1dc94770232bc6765148480bb1d9f50da1ee6448cf9c88b19dd459932c06ed811c4a64a12d5938bd1c757bcfaeaee8933fe5fff21763de740482bcf1ba59afdc8fcf873c3d507bb394e32e45f736519\nSIG: 16b7421227ae09130685cbb1a0c60aa57a5e1afe1bbe6bacea0c281bcc8998e6824a772c3208a6b6b4d236695505c9be82700cf93a783985a39e16e377a7410e\n\nPRIV: 4f4b20d899366f2f23ee628f229b236cf80f43ba183177c97ee34829546f1742c94576641f4a893cdfcee7b39fc21929b86b349976d7b0a46d39a588bcfe4357\nPUB: c94576641f4a893cdfcee7b39fc21929b86b349976d7b0a46d39a588bcfe4357\nMESSAGE: db8ef02e3033e6b96a56cab05082fb4695f4a1c916250dd75173f430a10c9468817709d37623346ae8245b42bda0da6b60462ccfdfc75a9ab994e66c9ab9fecdd8599610910affe4f10215cb280bf8f9f2700a444796dae93e06c6bea7d8b4fe1301baa79ccec769368feb2442c7de84f095e6b3bff63d388cbafb2b9809dc38e9b12ebd039c0a57f4d522e91ec8d1f2b8d23a4a0ae059af85393bb0a15f749110f6774a1fd731a6ec213e4ff435daab546d31ed9ec3b6d8cc2edacebf4facc5566556eea92e5b3f2542239b25e28012dd4ef40072eebf83ed2a255181f3a442189d68c6c609f4dfdf3db7d67d087a2fcd6d2dc50bbfed8bfbbfcb74d3c41f02a87865b13b8efcf5c3581257be0aa913f60c370527bde11a475c136a17c5eefeb03f5bff28693ed841e8ed1f7c29102f5599dd444009bcea6a92d5574152458e0caf8a36aa72b5dc4908a6461c9b741453005c8fbcc68113ae184208ee14b835480c6efafed18a76000b38e5858290f4d51f52f096cbe490e1eb5cacb226ec495a55a7fa457843d57fab67f8be7e209334785bdd665d7b63e4daf57b6e78928b603c8c0f9bc85464733b61273ef9e2b8a0cd7c3bf8ee0a6872e34d5a27a625e35eaf7ff5440b8b141af704df70c9c18623bd11209513192505105cd7bcfa5f0d919da706948fbe1f761f315846aa3b4813dd9ba3d81b9204e5409c0382b6eb\nSIG: 0f80ff5d17488fe26f93c543b04ed959b5f0643fc61c7f2c3bc60132ba9c6210c8b250ea5e84d07b01de68bc174414eeeb31fdc2ba6823e231e312a91ededd02\n\n\n# Additional test vectors from RFC 8032\n\nPRIV: f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e\nPUB: 278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e\nMESSAGE: 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc27",
     "32e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0\nSIG: 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03\n\nPRIV: 833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf\nPUB: ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf\nMESSAGE: ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f\nSIG: dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704\n",
 };
-static const size_t kLen32 = 41961;
+static const size_t kLen32 = 58307;
 
 static const char *kData32[] = {
-    "# This file has been modified to remove the 65536-byte long inputs.\r\n\r\n#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = TDES KeySize = 3 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:47 2011\r\n\r\n\r\nCount = 0\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 3bb96170d5df4cce\r\nKey2 = 25d5daa22a982f08\r\nKey3 = 52f4a110dcdc9e45\r\nMsg = 00\r\nMac = 96\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 1\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 9413d38685688f58\r\nKey2 = dc38b6b3cef125f1\r\nKey3 = 5b61f4f7a1c46ed6\r\nMsg = 00\r\nMac = fc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 2\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 101a2f13fbb69473\r\nKey2 = 76fb98f24073f4d5\r\nKey3 = 2ca2706d76d00b67\r\nMsg = 00\r\nMac = 53\r\nResult = P\r\n\r\nCount = 3\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 2f8a238552c1e367\r\nKey2 = f8131f1c26ab3289\r\nKey3 = 83d5b6ba253bea31\r\nMsg = 00\r\nMac = 95\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 4\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = c1bafb5dc7100758\r\nKey2 = e9ef047a58b5ba89\r\nKey3 = 76cb4fb55ebcc1c7\r\nMsg = 00\r\nMac = f4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 5\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = c82c29f1cb5851b6\r\nKey2 = 8b5b45dcbf0d8079\r\nKey3 = e6407057ae34ec0b\r\nMsg = 00\r\nMac = 03\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 6\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 6b455116f4f883d5\r\nKey2 = a81a206d25152aab\r\nKey3 = 86dc07b607202abc\r\nMsg = 00\r\nMac = 75\r\nResult = P\r\n\r\nCount = 7\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = c873d5bc4598d0b0\r\nKey2 = 1c1523cb4f794c8a\r\nKey3 = cedf6797d523dcab\r\nMsg = 00\r\nMac = 2e\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 8\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 45ce943bd31fe9b5\r\nKey2 = 677cc47c13c24923\r\nKey3 = 6b2086f14934838a\r\nMsg = 00\r\nMac = 01\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 9\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 804f9ef7baf7dfc7\r\nKey2 = 9bb6494cb60b8c07\r\nKey3 = 2080fe52e0d3943d\r\nMsg = 00\r\nMac = c3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 10\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 73c10b833e1043ab\r\nKey2 = 16dcd343645d5207\r\nKey3 = 6426f7f88c3473c8\r\nMsg = 00\r\nMac = 8b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 11\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 310d54d96bc73452\r\nKey2 = bae34f158ceafb04\r\nKey3 = 4651c1b53de3da26\r\nMsg = 00\r\nMac = ce\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 12\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 0e3d49d0e692f20e\r\nKey2 = a9cd384a3b688c0e\r\nKey3 = 584ae5f794f8fe7f\r\nMsg = 00\r\nMac = 4b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 13\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = b0fda857ea402f0b\r\nKey2 = d567e9f48568f1e0\r\nKey3 = 0ec2ad452a547a91\r\nMsg = 00\r\nMac = 04\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 14\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 1ac1543b1591f270\r\nKey2 = dcda0e9870b9d949\r\nKey3 = 68ea9b1c4380ae9e\r\nMsg = 00\r\nMac = 43\r\nResult = P\r\n\r\nCount = 15\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = d0b008aea4454551\r\nKey2 = 9234a7731ab610b5\r\nKey3 = 2fb97a8ffbaedae6\r\nMsg = 00\r\nMac = 4c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 16\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 04793b0b0e976d0b\r\nKey2 = bf493e58fb73681f\r\nKey3 = 1f54a262d649b985\r\nMsg = 00\r\nMac = 77\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 17\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 043b759b578ae570\r\nKey2 = 5e522f19cb9de092\r\nKey3 = 2af2e90eb6dcc1fd\r\nMsg = 00\r\nMac = 77\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 18\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = e58520088910513d\r\nKey2 = 7c10196e1a310dd5\r\nKey3 = 5b043b2a1ab97f85\r\nMsg = 00\r\nMac = 1c\r\nResult = P\r\n\r\nCount = 19\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = f27fd0f189452c15\r\nKey2 = 04681651014916ab\r\nKey3 = 204046aeeffecd15\r\nMsg = 00\r\nMac = 0b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 20\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 860864a710ab0475\r\nKey2 = b9205751bfd91f7f\r\nKey3 = 3bf72abf13d97640\r\nMsg = 00\r\nMac = e890abe6ea126215\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 21\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = a7a1d57aabf1137c\r\nKey2 = fd0df2e35b8cdf2a\r\nKey3 = b386755bc2ab3d9d\r\nMsg = 00\r\nMac = f475587c2101eff2\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 22\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = c2c28a4c7698804c\r\nKey2 = ab25b53783dc0419\r\nKey3 = ab16341f4cead054\r\nMsg = 00\r\nMac = d335575aa3a4d8af\r\nResult = P\r\n\r\nCount = 23\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 7594a7aed3e986ba\r\nKey2 = 52a280e662d9e9da\r\nKey3 = 7649d3ad6838f2c2\r\nMsg = 00\r\nMac = 0e109f43557f250f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 24\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 0798d9ef158cd698\r\nKey2 = fff4ade09b169762\r\nKey3 = 5b6e6849ec2c238a\r\nMsg = 00\r\nMac = 05af623529b168a9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 25\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 254991cb4af76dc8\r\nKey2 = 2cf2e915918a025b\r\nKey3 = 2c61bfaee69b2676\r\nMsg = 00\r\nMac = 725ab7a770762894\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 26\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 9f68cbbf3bb5b3da\r\nKey2 = 31adb5a46e2cc8e3\r\nKey3 = f86ed9eaabb625da\r\nMsg = 00\r\nMac = 0422d94f874dda7e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 27\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 1fd51f70a77ac8e9\r\nKey2 = 5dd9986e974c08ec\r\nKey3 = fd61ce34a75279f7\r\nMsg = 00\r\nMac = a163a5d269b3cc3e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 28\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 078c57d6df9ba1d5\r\nKey2 = 08d94ac1b3d3c183\r\nKey3 = e90bf4fe7973c2c7\r\nMsg = 00\r\nMac = 9af3f01e20dc7c1e\r\nResult = P\r\n\r\nCount = 29\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 08df322f040e7c01\r\nKey2 = e92343e69d83eac7\r\nKey3 = fe94c1ec0da22c1a\r\nMsg = 00\r\nMac = 3d88c20a4f828c5b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 30\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = b2ecf41c8692c2b0\r\nKey2 = 8ff18c1f1f296454\r\nKey3 = 383dcbc4a28c7629\r\nMsg = 00\r\nMac = 17241dc726fa4c56\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 31\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 07d99d58f2ec1fd5\r\nKey2 = ea46c73bf4b60ed0\r\nKey3 = f20ec149c831aecb\r\nMsg = 00\r\nMac = f6a8a0b536fd97d3\r\nResult = P\r\n\r\nCount = 32\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 3dfdc19426fbd56d\r\nKey2 = b03b7985b32af857\r\nKey3 = a807c7b3621ffdda\r\nMsg = 00\r\nMac = 3ef9b263ae1df460\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 33\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = fbc79bab46b97923\r\nKey2 = ece6da4c40f1e6e9\r\nKey3 = eaa76770ef517a40\r\nMsg = 00\r\nMac = b2da3efa7fc64abe\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 34\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 5ba4a1d5a80db5ef\r\nKey2 = 7ce6aeb9261cb00b\r\nKey3 = 8a5df23ea445e0c8\r\nMsg = 00\r\nMac = 51b2e75334d90889\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 35\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = e9c494e001027c86\r\nKey2 = c4649e58ea251904\r\nKey3 = 8025343dec34409e\r\nMsg = 00\r\nMac = 166123f1c59132a3\r\nResult = P\r\n\r\nCount = 36\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 6bce61e646452a46\r\nKey2 = 54ba8a020d0876fb\r\nKey3 = 34ea2f6149bad664\r\nMsg = 00\r\nMac = b0d0f625f06f2a3a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 37\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 2f38f79bc8e0ea4a\r\nKey2 = d09876f22ca43e10\r\nKey3 = 3b8fab02299d328c\r\nMsg = 00\r\nMac = b26d377a504b8985\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 38\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 51febf790815f1d0\r\nKey2 = 9152d5e32f6713fb\r\nKey3 = 4a40c2c8fdb9f2b5\r\nMsg = 00\r\nMac = a27978e62026743b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 39\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 10ba8fd6256ee9a4\r\nKey2 = fa8332a46ead52ab\r\nKey3 = b0e06e1fef04abb5\r\nMsg = 00\r\nMac = e1b0a228c142555c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 40\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = f2fbab6734769e9b\r\nKey2 = ab45910e5775ab0d\r\nKey3 = 5bd5ea0db015a89e\r\nMsg = 7efeb7d4d14b3f2b3df4b8a276b18b49\r\nMac = 5c\r\nResult = P\r\n\r\nCount = 41\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 5bc776ba64adf4ea\r\nKey2 = 195e04987c62a4f2\r\nKey3 = c1642fdc1a31705d\r\nMsg = d1fb4f35914404af9df3bf5c368c0e69\r\nMac = 4d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 42\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = b67c57f770202c6e\r\nKey2 = e91f4fb361bcae37\r\nKey3 = ada8d3df4fbcf4b9\r\nMsg = 9800db878187c87ea05bf92054b0e3e3\r\nMac = 8b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 43\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = ce0bc48002fe7602\r\nKey2 = e702abe31c7a2313\r\nKey3 = d61964867f2579da\r\nMsg = 704e4e75be1623b21332c14555bf5edc\r\nMac = b0\r\nResult = F (2 - Key or Key2 changed",
-    ")\r\n\r\nCount = 44\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = ad75e32cc11980f2\r\nKey2 = d0570429680e9486\r\nKey3 = c2379207f862dcfd\r\nMsg = 197de855b3962b1fdad687f9c4f1efd6\r\nMac = 44\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 45\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 9db504803d29f126\r\nKey2 = 07fe58b3da765bad\r\nKey3 = 6dc489516e9bb5f8\r\nMsg = 8f296b265fa575d146799f9e39d52965\r\nMac = 14\r\nResult = P\r\n\r\nCount = 46\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 991f0ed04079293d\r\nKey2 = 57077ff1baecd907\r\nKey3 = dcc7a719c4372967\r\nMsg = d9cfcc67520c5b2ceeb622c694a8e3fe\r\nMac = a3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 47\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = eca815d6b0371cf1\r\nKey2 = 597980cdb6c892df\r\nKey3 = 3dba0ed3ba16ae1c\r\nMsg = a03636db2fdc84722aeb9d98a6ed70d0\r\nMac = 78\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 48\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = ea80a43d5886dfef\r\nKey2 = 08bf4f76a8893732\r\nKey3 = 4557a13752d6730d\r\nMsg = 0371a63ad722523ef297d8399b124593\r\nMac = be\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 49\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = e9fe73e640808c02\r\nKey2 = 9be6986446012091\r\nKey3 = 707023615462a40e\r\nMsg = 83bcb484dca73d49ac234ece3a5d2ad3\r\nMac = d6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 50\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 1fe9800ecb0dd9f1\r\nKey2 = dbbc6bc72c794c23\r\nKey3 = 899b08469b6bc8b5\r\nMsg = 95f4a41c4c64cd7310fba748aa267a14\r\nMac = 59\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 51\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 34546261a21c1c43\r\nKey2 = 0449eaeca4f29725\r\nKey3 = 4cc4e6525186802f\r\nMsg = d204de1e671d3e43670dd67fee114402\r\nMac = 6e\r\nResult = F (1 - Message changed)\r\n\r\nCount = 52\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 048aa8701fb5fe26\r\nKey2 = d56bd53d83e60bd9\r\nKey3 = 6707d6523ebc32f4\r\nMsg = f4e9f92fd2c9313fb61a889eaa4ff283\r\nMac = d5\r\nResult = P\r\n\r\nCount = 53\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 6ec19b02976e5ba2\r\nKey2 = 13540732d997c2b6\r\nKey3 = 7f4068926183251c\r\nMsg = 963363ab7c82b634974954bd0fe2c307\r\nMac = d7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 54\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = f4ecea5d32e32c6e\r\nKey2 = 385710cd3eb0fe51\r\nKey3 = 5d4c8f7ccdf10154\r\nMsg = a298857dc60ad2f0a8fa878607b50c18\r\nMac = 4c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 55\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = b31ff49dd970f8e9\r\nKey2 = 164aefb00efb5461\r\nKey3 = 981629757f4532dc\r\nMsg = fc3957b2ed0558bce61d478be615b774\r\nMac = 90\r\nResult = P\r\n\r\nCount = 56\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 85384543d3aef157\r\nKey2 = 57ea916d9b2fd0c8\r\nKey3 = 1a85830473fbe6c4\r\nMsg = 87db0d9d69bc0cf69cabeb92570e482b\r\nMac = 53\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 57\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 9bf8fb0b464070f8\r\nKey2 = 10ea23c7e5a19bcb\r\nKey3 = 408c236e10863e2a\r\nMsg = f9c98cd8a7d27553da946427b8276349\r\nMac = 53\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 58\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 91b083e9c8e9803b\r\nKey2 = 76d0341cd54c38e5\r\nKey3 = 07bca7f44a3e76bc\r\nMsg = 7e5b64dc6bcbae6bb4496fc033947343\r\nMac = de\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 59\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = e6795b1ffe8f3e38\r\nKey2 = 4fdcea8c73c76e75\r\nKey3 = df0726ae4c079461\r\nMsg = 5265fb6a796d99a6beec6f71ba267b5d\r\nMac = e0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 60\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 375710c76202bff1\r\nKey2 = 3bb96170d5df4cce\r\nKey3 = 23d5daa22a982f08\r\nMsg = 52f5a110dddc9f44f8a534eef9df0b22\r\nMac = b1b9e11939228900\r\nResult = P\r\n\r\nCount = 61\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = b59b855dce76adf4\r\nKey2 = be9bae10fe34fb1c\r\nKey3 = 0d49159bf804a4ea\r\nMsg = 869f3b62ee78bfeb5287168eacf69ccb\r\nMac = 169a389352793c8b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 62\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 615d792a7038fd89\r\nKey2 = 98ce972f016e75a8\r\nKey3 = c470255783b32f01\r\nMsg = e5aed6715aa4291f9c32baf6b8449b53\r\nMac = 73ac2da999bfdf5d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 63\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 1fb09443a1074564\r\nKey2 = 3d1aa82c086eba13\r\nKey3 = c137d0f4ea54d604\r\nMsg = 16f02efd285381d7657ca5cd99d9e25b\r\nMac = 38126d16957893ce\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 64\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 2e5d163461fea761\r\nKey2 = 9173bf75372fb640\r\nKey3 = 9e3d1c3dcdbfbc31\r\nMsg = b10fcb03443302ae929ff95a17b025fa\r\nMac = b70f2d761ca643c9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = b9e5861c1c4013d3\r\nKey2 = d554806efd3801a1\r\nKey3 = 64d9bc3d646e76dc\r\nMsg = 0e6c9fced82669cffe7b5a6f09dceec8\r\nMac = 78ce4635e486635a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 66\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = ad2376516b974c70\r\nKey2 = cd3b5870c2312929\r\nKey3 = 1a731a7feacbf783\r\nMsg = 88eb7a0379da9d113343dc1fe0f3e6f7\r\nMac = 0c949483e7fa7d0c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 67\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 9ada194c100eeacb\r\nKey2 = da23ad9825c194d0\r\nKey3 = 3ef1f4c438dce031\r\nMsg = 0f9703a3454c25c0b1053de62b0ffc5b\r\nMac = c78a4ca3662527e5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 68\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = e375f870f4d55b02\r\nKey2 = 1b015791e3e337b3\r\nKey3 = 370dc45b15671c5b\r\nMsg = 5ad9dd3b112ea4cee1654d2dfabab01e\r\nMac = 22becbbe7bfcade5\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 69\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = d61f4aeff4b5f2f8\r\nKey2 = 0486b53de3ecc297\r\nKey3 = 807fe92fc2fed376\r\nMsg = d094cf77a709c0fa5d6b4b7e9e86a2c2\r\nMac = 947d024d9d5359a8\r\nResult = P\r\n\r\nCount = 70\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = c2c28a4c7698804c\r\nKey2 = ab25b53783dc0419\r\nKey3 = ab16341f4cead054\r\nMsg = 7295a7aed3e987baef19ad68c33ba5a5\r\nMac = 58de82acc10d556f\r\nResult = P\r\n\r\nCount = 71\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = f1ce4992c851e3a8\r\nKey2 = 835ec1abef97f2c8\r\nKey3 = 5b92384f20dcc2ad\r\nMsg = 9094935fcd7c389dd17b5b121cddadf9\r\nMac = 319c70370c172de3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 72\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = c16ebcc1165d6892\r\nKey2 = 75268c4602f8c8bf\r\nKey3 = dab97f79544cf1cd\r\nMsg = b7ba1c66282cb6092ba601407ff9578a\r\nMac = d73c26311bd44a32\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 73\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = fe4a796720a46dbc\r\nKey2 = 98f45289e9f8b080\r\nKey3 = e05def5b25520d43\r\nMsg = 31c9eed491bb0cda9b8c0eb5afa31019\r\nMac = 8c2ce22633c62751\r\nResult = F (1 - Message changed)\r\n\r\nCount = 74\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = eefb40c715c4546d\r\nKey2 = 5b2325c8d9daa48a\r\nKey3 = d5ec4a6bc82a7a62\r\nMsg = 5a97259dfa081f040d3893da2f231ca3\r\nMac = a64113544f509be8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 75\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 0d0851311ca45db0\r\nKey2 = 3d7c458957c8c408\r\nKey3 = 98d37c9d51ab2f25\r\nMsg = 8be16380af3e2dbc6cf678c2e3331335\r\nMac = 8817baeaa909e33a\r\nResult = P\r\n\r\nCount = 76\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = b7239438d61cd626\r\nKey2 = 082c6404cb3897b5\r\nKey3 = c4c732cdd5e043c2\r\nMsg = 7120f19169e7cbb913c7d1f0ceb006c0\r\nMac = 32841ad7621cc0fc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 77\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 73f449ef83df75e9\r\nKey2 = 5f3d2016bfd0703b\r\nKey3 = 31abc16b58b64af4\r\nMsg = 83ecbfcff3bc37f1305d83bc0290350c\r\nMac = 8f8ba8bfc74203fa\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 78\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 9b6ea461c7b9abe6\r\nKey2 = 4a08dcdc5b9e01fe\r\nKey3 = 6b850e9b6ebae9d6\r\nMsg = c538416fba487fac5c94449d0757f3e9\r\nMac = c13f372e9a061db8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 79\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = c7aeeacb156dfbfb\r\nKey2 = ba43ef516232a7d3\r\nKey3 = 2c572aea62808c68\r\nMsg = a1bc9950759d0df4cffaf29345dfb340\r\nMac = d7dad4519b56a1eb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 80\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = cda4d34370234946\r\nKey2 = c408ea6bec07c78c\r\nKey3 = 19eff7f798fd6808\r\nMsg = d1fb0b68176269cf9fda18bf13efc054f0c24fd042b9e2ecaf75e86cb60484f6\r\nMac = d8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 81\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 02100be5627686a8\r\nKey2 = 7f0b38ec073e75ef\r\nKey3 = 373b1a64ba5416d9\r\nMsg = c60be37fb0bda4f46894690b3344643c772fbd2237db348adaa407ca2eae1654\r\nMac = fb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 82\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 7597571a6e7c6bc8\r\nKey2 = c143a2a461626b1a\r\nKey3 = 6b1307d910434cc7\r\nMsg = 49cb128641f7952dfdf34f338da268b2ef1482557b593e",
-    "c57f930164264ff83e\r\nMac = 90\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 83\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = ae89ad615201546b\r\nKey2 = ae20765745458fce\r\nKey3 = efd0867fba43dcb0\r\nMsg = e47d8659c9ad94971adedd6bce744206e1cfb65d042b942d93c4363cc73ec3e3\r\nMac = 95\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 84\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = b65886f13d6e8c4a\r\nKey2 = 0708e0b0730473a8\r\nKey3 = d04f2a86dc0b9e7a\r\nMsg = b97c12251d91512fe7b3a349a982409c7412f39494d970e77acbe9d3fac3dca7\r\nMac = 05\r\nResult = P\r\n\r\nCount = 85\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 3197a4a26261588a\r\nKey2 = 0dc4a75ec8b99b58\r\nKey3 = efb93e7620205289\r\nMsg = 65f4b3a00c1c1ef39445a69b2150b034705410140ff9dad0ce21740271cef04a\r\nMac = 57\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 86\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 62c4a16e946b4313\r\nKey2 = d09ea80e7fb33449\r\nKey3 = 164fdc04c2d5f116\r\nMsg = 898e824fdc89f21779156a9e58564c4b99004b95226c2ebb8aebd0b5365a6c6a\r\nMac = 93\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 87\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 6eeff20d3d5d5223\r\nKey2 = 258076b313611c1c\r\nKey3 = b013b957f70d9e62\r\nMsg = 2d7fec1a1e9ee85cf960e5dc4e239619ed85f4b14d32cbd42dfa79f77a27f2cd\r\nMac = 0a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 88\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 193e23e6fd8aa185\r\nKey2 = 1910cbdc549da804\r\nKey3 = 6b769b4923523425\r\nMsg = bd65798a1d02ab164e2d31b1387e505874779539046820bd429043c617854c36\r\nMac = d3\r\nResult = P\r\n\r\nCount = 89\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 150789ab37ef2ce9\r\nKey2 = 10cdf45dad9ed9e5\r\nKey3 = f475fd3e153898fe\r\nMsg = 044dd73a7d1ef37a437c09e9268708c82ebad189dc1e989ab3bd8d7ff75abc23\r\nMac = e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 90\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 48d9d08a6bdcc4f8\r\nKey2 = 1383641c08735d0e\r\nKey3 = 374a89c8cb73a7f4\r\nMsg = d62fb84f2a2442b52acf817d7f067edca031970bea092c35f29f9a931aa06dd6\r\nMac = 26\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 91\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 68f4620da8b00201\r\nKey2 = df1c8362345180d3\r\nKey3 = 26abda897f89d90d\r\nMsg = 0ac3f7f22d24b64aa584845d3a990bb69e5d2d4650640056c16c17c0b636045f\r\nMac = f9\r\nResult = P\r\n\r\nCount = 92\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 1c259df7492361b6\r\nKey2 = cd4acdb65b3e5b1c\r\nKey3 = 3b01addc2579ef64\r\nMsg = 607f4730a5ea9dabfbcd8586f680c3021c7ebc858e73354beb975d58713b0eb1\r\nMac = fa\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 93\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = f18a9dba9db5dff1\r\nKey2 = d5987013a4b69e38\r\nKey3 = dc16e0ce1351e3f4\r\nMsg = bfe99e184a7d7bf0b4ade8f402f2c49aa4948e74b2d5c905756ba5d32934dbbd\r\nMac = e4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 94\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 8361bac48afb1091\r\nKey2 = da85400d107fbf8f\r\nKey3 = 31ec732cc29d7045\r\nMsg = 3a1ee70d4607325c13bff68e402e0a72742f6a63ae972c6dda74b6b2a3922f0c\r\nMac = 0e\r\nResult = F (1 - Message changed)\r\n\r\nCount = 95\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = d0df1adf1cf72032\r\nKey2 = 1504d564ec1aea61\r\nKey3 = c42fada45d80a43e\r\nMsg = 3a53d9c7ae59e7811699fb0973e43256ed92162267c7ca4b57f5887ad5a24e02\r\nMac = 8a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 96\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 973bfe5b3be573da\r\nKey2 = 94b3ec7f343e46ab\r\nKey3 = dcaeabc8df405db6\r\nMsg = c8437dba76591a9031b3aa3b59fec0562d4eac439ca8efca57c3f2022b0ff775\r\nMac = 53\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 97\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = bc89867c43a74640\r\nKey2 = df347fb319464c80\r\nKey3 = fd92108a266bcdcd\r\nMsg = 1c9898ede16139560519e808ee9ddaf710a5bab30f54ed98230d1a44c189ea4f\r\nMac = f6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 98\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = fde925e301897f67\r\nKey2 = 54b3ab80f815df15\r\nKey3 = dc58928aa286c8e5\r\nMsg = b34f898d98a3aa0fa022b1b1d76953a5b3ecc88d60f2c79b59e1b1f636bc0d60\r\nMac = 0f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 99\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 8a704ffe43e951f8\r\nKey2 = 2346dc8501202a40\r\nKey3 = d67afed616230113\r\nMsg = b2b4cb5e90ebf4bd265093b7f5efd4d62dc60e29737aa496e14929724e40c74f\r\nMac = df\r\nResult = P\r\n\r\nCount = 100\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 8c1f29f440f7f8b5\r\nKey2 = 5b45fe8f1f688661\r\nKey3 = ba40f43d9e7cc86b\r\nMsg = 220817144a15a0a654fc1beaabce60270aa72df83591754ee7a5fbb40b7420d7\r\nMac = 80ac51c2ef7bd5d7\r\nResult = P\r\n\r\nCount = 101\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d66e76d97f94ea16\r\nKey2 = f15e3ed06dd94598\r\nKey3 = ae073d1a6e5bc819\r\nMsg = 233d547ab33790859ab0dbc7a93f3bbebb610bed9acbfbce1fff580e9a1e8ef9\r\nMac = 4cb8ce681e4bc7c8\r\nResult = F (1 - Message changed)\r\n\r\nCount = 102\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 0437836df770e943\r\nKey2 = c96e2c43bffd5298\r\nKey3 = 8552fbc16215e0c4\r\nMsg = 4f87d730bdfc7a7c72525c6b26ee9cae9a219b30d9575fedbd913a07b615a616\r\nMac = ea79cbc28f4264db\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 103\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d849ba8570b6ef9d\r\nKey2 = f1405732aeb61f92\r\nKey3 = 73c8e51ff167f857\r\nMsg = fd03202d0bd109b6e4299c7390c1407cd21ffb110013e6381185dea8f8707de6\r\nMac = 71070b17d05dabef\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 104\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 914cef7ab6d998dc\r\nKey2 = a767abc18cf485e9\r\nKey3 = a2624ff20b2a408a\r\nMsg = bc5ce4c0bf3ad1a93e5306c9d7dbb620dde8708efe84e78c2200f41a958cdef8\r\nMac = 3cf4aaf3d337c9c8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 105\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 757f52e626eabce0\r\nKey2 = 700d91f14554bcb0\r\nKey3 = 548640d0dfaec2ab\r\nMsg = 22a4cf581584346095783be0982744c6201ff040760f868ab63895058d1edb88\r\nMac = b008b1150535ef11\r\nResult = F (1 - Message changed)\r\n\r\nCount = 106\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d65d0e58d3133b34\r\nKey2 = 289e58704994a249\r\nKey3 = e3df20ae3d585e2f\r\nMsg = 94c8414cbbec52e2d73bb8f02ef687c91432495c0c744666317d02e6d46706d2\r\nMac = b1292e1c7074dcfc\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 107\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d77a4989f4a17f2a\r\nKey2 = 409d91d51fa4d045\r\nKey3 = 6bb652ea1526fd4f\r\nMsg = 7a08ce579ae7af8004421cff72715e0b137da81f47d8f84da34c3ed53c32c0f6\r\nMac = 8b3cb70477ca7ca8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 108\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = e670c17519d9c2f2\r\nKey2 = dcc8a132629b462f\r\nKey3 = 58c1d52543ad570d\r\nMsg = a6dbad96ad23ff61479df39b99f0673a09f2a7eaebbd34b95d05c4146fa989f2\r\nMac = c470ec40599a0a11\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 109\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 290d292a15b6268a\r\nKey2 = 2638d9ad83ad1f34\r\nKey3 = a7d9ba62735dc2d3\r\nMsg = ef995cbfc49b0ebccdbd37d9f40a431c385d33d4b8234d7f0d6211eaddfb709a\r\nMac = 67ae62fb8142bd8b\r\nResult = P\r\n\r\nCount = 110\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 4faba73bcd5b5dfe\r\nKey2 = 1c97ea85207a97a7\r\nKey3 = 19eff116100dc82f\r\nMsg = c48e53c6956432460584c7ee1577c1c38b7fae2ff288199be25bf64081154139\r\nMac = d68a4558e95a67e4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 111\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d37c3dbc2f68baba\r\nKey2 = 918cb5e39237e016\r\nKey3 = f286b0739d38c4fb\r\nMsg = 2533361761ac80578fa262a50462045e3ec6e4d5d25c6e99a5c4ccf75f5affc0\r\nMac = c20f36e67732f864\r\nResult = P\r\n\r\nCount = 112\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = a0baa71c38d6d064\r\nKey2 = 8f58ba45cb494ab9\r\nKey3 = 853decc431f7b3cd\r\nMsg = 20e394c7cc90bdfa6186fc1ba6fff158dfc690e24ba4c9fbf11b68519d573a8a\r\nMac = 4ba956b98a99d7bf\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 113\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = b69752407c68b6bf\r\nKey2 = 8fceb05201ec4320\r\nKey3 = 2a755e372373ef26\r\nMsg = e884d65c87411584a56956d5b27ca9725b473c205b64cff09400671f5ee0473a\r\nMac = 9f3de5e8cddc374d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 114\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 8c04e0f27f83b0ec\r\nKey2 = 042cfb6883348fe6\r\nKey3 = 404f5dfe587ab591\r\nMsg = 8a34cd562b111fe04fa0bf5e004faedaef99d0bab9344d966c8b3847486e6f40\r\nMac = 6c530215fb25015b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 115\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 429401ea49cd97b0\r\nKey2 = a8f1b6b63101cee0\r\nKey3 = 20bcd08c5d16e049\r\nMsg = 591d88123fc9a786b247e8d5ce155f136d6fe4084117c41f2056b67f9e3e1077\r\nMac = 6c414640b424cf56\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 116\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = c470255783b32f01\r\nKey2 = e3aed6705ba4291f\r\nKey3 = 7319100e54f432d3\r\nMsg = 01acc3282fe41b62f95f5dbfb7e7bfef694c5fe34ca87d31abe7e7bbf887b48c\r",
-    "\nMac = cd99df4814667454\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 117\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 73c10b833e1043ab\r\nKey2 = 18dcd343645d5207\r\nKey3 = 6426f7f88c3473c8\r\nMsg = 068e4a0b1a62dd64198f1b9ece814c2feeeee50ba814b70d7d42659952991b80\r\nMac = 1fc90834b7dd090b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 118\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 37eae98ff42afb25\r\nKey2 = f2231c028c29da9d\r\nKey3 = ef3da8d0c77fbf45\r\nMsg = f266cec01c5fc08c0bdabc9537bd1aa2df9f2b8ffbe5cc94722a3bca8de529ea\r\nMac = b3809c8b0eb9dd8d\r\nResult = P\r\n\r\nCount = 119\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 1358fb67155e0145\r\nKey2 = d02c54a1206b5d7f\r\nKey3 = 1c04ba46c74a5d49\r\nMsg = e38b4c3e7a82643beb3192426555ad9c9b2620d677373fc40c9ddbc4cd531347\r\nMac = b000e2ea1ef48a8f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 120\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f6b9a81067255b58\r\nKey2 = 927cfbc4cdec9285\r\nKey3 = dcd62345bfe03b92\r\nMsg = 246b66b10696adc45840\r\nMac = b4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 121\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = fea186dc73d3807f\r\nKey2 = b8fec7387a197962\r\nKey3 = 4c91abe60db64ff1\r\nMsg = 8ba298364af144a8d5f3\r\nMac = a6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 122\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f264da8607ea439e\r\nKey2 = fdb9daa41fd34958\r\nKey3 = f85d6b859b9892bf\r\nMsg = 402006f6b18dbd11dcd1\r\nMac = 28\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 191c461adc4f7f4f\r\nKey2 = 75b932e68cb98cfd\r\nKey3 = cb2943857a1c9438\r\nMsg = 391deef3a9a41394d14a\r\nMac = 3c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 124\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = a2c2f713430ece92\r\nKey2 = df081ae9627a1351\r\nKey3 = c1ec469ba8c73b67\r\nMsg = 37a49535684637f67573\r\nMac = 40\r\nResult = F (1 - Message changed)\r\n\r\nCount = 125\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 7b61dac238ba3e83\r\nKey2 = d05e9ed34fc410ce\r\nKey3 = 98da194c100eeacb\r\nMsg = da22ad9825c195d1e297\r\nMac = 43\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 126\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 13aec10d13fd37c7\r\nKey2 = 89198c3bcd38b951\r\nKey3 = ecf843cdef7397cb\r\nMsg = b7625aa78d2961c0fee6\r\nMac = f1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 127\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = d94a68ec329d914a\r\nKey2 = 394a8acea420e952\r\nKey3 = ec04c8cb8602aec8\r\nMsg = e043f30a405c41938914\r\nMac = 6f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 128\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = d5cb7579582fb6a8\r\nKey2 = e67f3ba11383d61f\r\nKey3 = da370852e9b9c2a1\r\nMsg = 7d32f440151a7069fd73\r\nMac = b7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 129\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 92402f6eb54526b3\r\nKey2 = 924515d92ad5a1d0\r\nKey3 = 9ead2adfb025f81a\r\nMsg = fd44d8d0fea5cfdf3321\r\nMac = 2f\r\nResult = P\r\n\r\nCount = 130\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = a9daad97ad23fe61\r\nKey2 = 32e5988a37987a38\r\nKey3 = 31626d16a780c825\r\nMsg = d6cf17192f8ad745ab5b\r\nMac = 8f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 131\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 52c457d9d5d5ab94\r\nKey2 = 9d3875ba6d75fdba\r\nKey3 = 4fb91a863d15ce52\r\nMsg = 4effbf732e67af7203b3\r\nMac = 04\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 132\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 7304b65492fd0402\r\nKey2 = 62a4cb7c23708057\r\nKey3 = f2f7bf13839e01e5\r\nMsg = a630c0f362eef35b6a58\r\nMac = aa\r\nResult = P\r\n\r\nCount = 133\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 51b33425a1349792\r\nKey2 = dc5b8ca440eae6ad\r\nKey3 = 70adf49dd0a8f119\r\nMsg = af246a8a810cca5e657b\r\nMac = 0b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 134\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f22029ce51619e0d\r\nKey2 = 9d51bcc2089785e0\r\nKey3 = 689d62621abab3b0\r\nMsg = a9c9fb632423d367b3eb\r\nMac = 0c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 135\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 1ca226d0dc8c328a\r\nKey2 = f18a9dc176621f51\r\nKey3 = 3d765d20e03b4cea\r\nMsg = f9d9fb44919e47cdeaf8\r\nMac = b0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 136\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f3ce4992c851e3a8\r\nKey2 = 835ec1abef97f2c8\r\nKey3 = 5b92384f20dcc2ad\r\nMsg = 9094935fcd7c389dd17b\r\nMac = 3c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 137\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = bfd929cdd9c2089d\r\nKey2 = 8e49988abcfbf458\r\nKey3 = da73d986894fce4c\r\nMsg = 88018424fdb76c908bd6\r\nMac = 94\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 138\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 57bf2ca4e3629797\r\nKey2 = ef7f675443402546\r\nKey3 = 6e4f924038f8bc92\r\nMsg = dd4f0a872f4b7089d697\r\nMac = 5b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 139\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = ba86924908df08b3\r\nKey2 = 26b954ba52df2c98\r\nKey3 = bf38cb0e89b9f4cd\r\nMsg = a682e6fd64df4b9f4fe8\r\nMac = ea\r\nResult = P\r\n\r\nCount = 140\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 52859849a4b6c1d5\r\nKey2 = 380e73c7aefb0168\r\nKey3 = c479fef80eb6260d\r\nMsg = ee6857533675b5ed8d43\r\nMac = 43fd25f696cb0693\r\nResult = F (1 - Message changed)\r\n\r\nCount = 141\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 97ae01315d13ec52\r\nKey2 = c7674cc1ab0bbab3\r\nKey3 = b68fb99797b33b79\r\nMsg = ce9127f649bfff849826\r\nMac = 2dfe01d9bc07646b\r\nResult = P\r\n\r\nCount = 142\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 2b257032b0d9b0b3\r\nKey2 = 49f7c10e8a9bcd37\r\nKey3 = 20f4fb4679106ddc\r\nMsg = b2c62d03902c44253368\r\nMac = 14c5ccf5f9433a0f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 143\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 0b988c3d380e5b80\r\nKey2 = b86be99162029b54\r\nKey3 = e0bc9775838a58ea\r\nMsg = 61ababff3763183c348d\r\nMac = 28a2de26aa6b4074\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 144\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 26e9abbf201fe5b9\r\nKey2 = 7062a82f800d5183\r\nKey3 = cd45e654bf5d205e\r\nMsg = 020683e1f0392f4cac54\r\nMac = 6f1522d3c8186217\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 145\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 3443f4016dadcd86\r\nKey2 = 235dec80323e5838\r\nKey3 = fd583285e6efbc51\r\nMsg = e64eeb89828b4297601a\r\nMac = 5575a40dba5bc4c6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 146\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 76c7616785916470\r\nKey2 = 5b3d1f10e5252fda\r\nKey3 = 75a2d632a46ea18c\r\nMsg = ac7d701597f0ba879055\r\nMac = 06b98e161e6a6754\r\nResult = P\r\n\r\nCount = 147\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = f12367b568a758b5\r\nKey2 = 7b2f9770924f2c0d\r\nKey3 = 1f8ad9e9b97a088a\r\nMsg = b99de8168e8c13ea4aef\r\nMac = db534a059f930ee0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 148\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = f1adb67986923d8c\r\nKey2 = 02671957dcf75808\r\nKey3 = 52732ae970467019\r\nMsg = f759c3033d4ed34948d7\r\nMac = 2d9caabf50999ac6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 149\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 792f9770924f2c0d\r\nKey2 = 1f8ad9e9b97a088a\r\nKey3 = b99de9168f8c13ea\r\nMsg = 8bae64015d62f68565d1\r\nMac = a42f89527f5cb219\r\nResult = F (1 - Message changed)\r\n\r\nCount = 150\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 31ec790d4a8a131c\r\nKey2 = 562c8cdc07e331d3\r\nKey3 = f4a7467043924c4f\r\nMsg = 1798286c37c1504fc0d7\r\nMac = f0d6e2f7edce6349\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 151\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = adb692e376a12585\r\nKey2 = 8c8c4362ea97f810\r\nKey3 = 528f204c19f21a31\r\nMsg = 6543e675d34639a7f7eb\r\nMac = fac96e6804526535\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 152\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 62984a64ec7c4a92\r\nKey2 = feda64dfd9a24f9b\r\nKey3 = cbb04f7a1f26df31\r\nMsg = adb555fd5f5c6bdd9c4e\r\nMac = e8dee8714b285a00\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 153\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = ef0d58b55ddae95d\r\nKey2 = 80e07ca4aebcfd34\r\nKey3 = bf947ff4ab2904e5\r\nMsg = 1fe87a2f431f3718665a\r\nMac = 44a869aee76d79db\r\nResult = P\r\n\r\nCount = 154\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = aef4ceb55e3d37fe\r\nKey2 = bc0bb9d05bad972c\r\nKey3 = e0a29b2c7940ce9b\r\nMsg = 78ad5f3718acf9e8cc7c\r\nMac = dcc1d44200caf6f7\r\nResult = F (1 - Message changed)\r\n\r\nCount = 155\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = a4403438f8fb254f\r\nKey2 = bac752cd83a170b5\r\nKey3 = 6bf71654f1854589\r\nMsg = 349566b6716e5f831d69\r\nMac = 7c08cc43ff4d8e07\r\nResult = F (1 - Message changed)\r\n\r\nCount = 156\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 2fc7f4c1ce042f73\r\nKey2 = 8346bf7a80b38640\r\nKey3 = 2ff74abfc197a732\r\nMsg = 43a32b8ab9b7ce4bbd1b\r\nMac = 8000a2612215014a\r\nResult = P\r\n\r\nCount = 157\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = c40ddc9e29ce041a\r\nKey2 = 583d6bc4c1a2abf2\r\nKey3 = 9b018fd5a4084a64\r\nMsg = 228",
-    "6a1eddd80737a724c\r\nMac = 0ff14761c982f890\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 158\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = bc327a0bcb2575df\r\nKey2 = 6b9483e6e0755d2a\r\nKey3 = 622cdc5b2916ab89\r\nMsg = e1be89af98ffd7d9257a\r\nMac = d6f4c8d96b3e2180\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 159\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 9e517cd616a48ada\r\nKey2 = 6d266192d5387a97\r\nKey3 = 8a081fda97c86b94\r\nMsg = 9e9fb0b2b77be6eeaae8\r\nMac = ba0b73fbffc0ab0b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 160\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = e0b9a826a85efe94\r\nKey2 = 4f615bce7cc1ba68\r\nKey3 = 3bb56d3d9816103e\r\nMsg = cfe9ee956cb1f5a60aa6ec79a3e454224b456879\r\nMac = 64\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 161\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 1e08a794a175b69e\r\nKey2 = f7d3ab46aeb9073e\r\nKey3 = 3e7cf8cea19d0891\r\nMsg = eb4f5b04517ee93e2c900e01948ac81ca56b2b26\r\nMac = 79\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 162\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 8f26700dc140570b\r\nKey2 = 8325e3a889c823ad\r\nKey3 = 6b048aa73decf83b\r\nMsg = cefb55151933a488e2b3d421dea9720727188106\r\nMac = 85\r\nResult = P\r\n\r\nCount = 163\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 3443f4016dadcd86\r\nKey2 = 255dec80323e5838\r\nKey3 = fd583285e6efbc51\r\nMsg = e64eeb89828b4297601a5b3fcde60075fc2424ae\r\nMac = c0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 164\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 91a401cbb6460b16\r\nKey2 = 85438675f15b6e73\r\nKey3 = b09140318a767038\r\nMsg = 8c65cde13149d9d54a5bccc17747f1d5f3e807e3\r\nMac = 56\r\nResult = F (1 - Message changed)\r\n\r\nCount = 165\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = b78a16fb9b075d3b\r\nKey2 = dcabbf7a07150261\r\nKey3 = f7644a01d5dcea46\r\nMsg = abe2fd996bb6804ed3286c057df9cea6836a2dad\r\nMac = 09\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 166\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = ce8a467534cd679e\r\nKey2 = cb9ee6fb70a42f4f\r\nKey3 = 16c1e5c1459e4ac8\r\nMsg = 3c56ccfbe92023109983e740d6a53488b813ee87\r\nMac = c8\r\nResult = F (1 - Message changed)\r\n\r\nCount = 167\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 401f0de0efd6dfa8\r\nKey2 = 16ae7c3bbc6e5b86\r\nKey3 = 4ffebf790815f1d0\r\nMsg = 9052d5e22e6712fab88e8dfaa928b6e015ca589c\r\nMac = 61\r\nResult = P\r\n\r\nCount = 168\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = d357bf5bef2cfba7\r\nKey2 = b757d3abf49b4ac2\r\nKey3 = 16388051da8a04a7\r\nMsg = b04e8f6d20924be8e4e2c6767f87b74377bdf90c\r\nMac = 72\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 169\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = f8ea68aba1bcd9e6\r\nKey2 = 4abaa4260d864573\r\nKey3 = a49840ab737af7b0\r\nMsg = 1fc99e586f87932445930a300eb28191d9c6215b\r\nMac = 19\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 170\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 94ec086d8c0110cd\r\nKey2 = 4ea11f327f70c245\r\nKey3 = c8d07adf7c7c5eb9\r\nMsg = 812dbc453a1fda59f73aceea3bc84d2c7a437dfc\r\nMac = b2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 171\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 9d575d582a9723c1\r\nKey2 = 294af47a54b051fe\r\nKey3 = 5131bff85bf12608\r\nMsg = 266e5305b96f497a956ae82b20367ebac0b14215\r\nMac = a9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 172\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 913d800ecd0dc762\r\nKey2 = 7f6ec476b6b07c15\r\nKey3 = 973262ab7c83b634\r\nMsg = 4670a266bebcdf95c62d36cda33d50e6650fcdcd\r\nMac = 4f\r\nResult = P\r\n\r\nCount = 173\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = b97ffe79d068ece5\r\nKey2 = 4a75fe2f67dae392\r\nKey3 = 45a4d9f17a9d70f8\r\nMsg = b53017500c100dea0511845597214484fc5f7f34\r\nMac = 6d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 174\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 7e1af10bcd86c283\r\nKey2 = 51cd37540e19021a\r\nKey3 = 988fd3c7250e2a6d\r\nMsg = da1919d4a2a7fcc34c88fb2065e52bf9dbc50731\r\nMac = 22\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 175\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 8c0dc16eb9c80775\r\nKey2 = 6eeff20d3d5d5223\r\nKey3 = 258076b313611c1c\r\nMsg = b212b857f70c9f63d0c9d2ccd253c28d1534631f\r\nMac = 2e\r\nResult = F (1 - Message changed)\r\n\r\nCount = 176\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 92c29eb0bf3e73a4\r\nKey2 = c6ecfbe6cd49bf4f\r\nKey3 = ef19d9d06d7a5e7f\r\nMsg = 969304e651ca62039088f8123085ac3263796b67\r\nMac = 57\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 177\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = a4432f52975e4316\r\nKey2 = 7f2086da04fddf4f\r\nKey3 = 8302139e79684329\r\nMsg = 5c9bcd197ea59e1b58b3da707b253491cc5a5ef8\r\nMac = ea\r\nResult = P\r\n\r\nCount = 178\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 5ae0b6d6c2855b7a\r\nKey2 = ec675d3e73bfd685\r\nKey3 = d3406b868fd3ae0e\r\nMsg = 89b9ecfef6f10e81f7956dbc7ca4a335047535a8\r\nMac = 70\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 179\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 8f7f85649d5e08a4\r\nKey2 = ceda75687308e07a\r\nKey3 = 9215c4c19bdc0d46\r\nMsg = e53101e6eabcda32c13d7b1dd1d88e7c2ca3ddc2\r\nMac = 14\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 180\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 7061b5f46b98d394\r\nKey2 = 58c2ce3807623475\r\nKey3 = 0df8e3c432da8a37\r\nMsg = 1086953d352e94a51a6d4c59a2295e8fff5b311e\r\nMac = 554d4df88228eba3\r\nResult = P\r\n\r\nCount = 181\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 347a25a1ec433b52\r\nKey2 = ec75d97046152c10\r\nKey3 = 86b937b6ad1ccbf8\r\nMsg = 4fe6bd43c28143ea5d40919cb5330a7e674f5bd8\r\nMac = 3d0d841895fb7c65\r\nResult = F (1 - Message changed)\r\n\r\nCount = 182\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = b3701aa7da61512c\r\nKey2 = 46dacba40740e3c1\r\nKey3 = 8f79a4dcadbc315e\r\nMsg = 4612fb4586d7518d0d648894347ae7d49d043f29\r\nMac = e5dd4392afbeabe7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 183\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = b5b57acb2c7fd6cb\r\nKey2 = 70b02c9d8651c889\r\nKey3 = 07f485f7b00e45d9\r\nMsg = 9011231ec382ecaaae57f34de1ac6bbb50741014\r\nMac = d34581ad5a3e9e57\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 184\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 88985bdfd9852604\r\nKey2 = f7f829aec8a208b3\r\nKey3 = d5ba012ce6754554\r\nMsg = 6cad7f3b9f196839bbc5a7f755c09aa8e17c83d9\r\nMac = fc7c93552aa14ca2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 185\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = cd0815194319d552\r\nKey2 = 346bb634027668d9\r\nKey3 = c17f2a26257afbad\r\nMsg = e31b3d97ba6ee6f2e18f084215ca0a5ca0d816d7\r\nMac = af5772396bb63d20\r\nResult = F (1 - Message changed)\r\n\r\nCount = 186\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 236e5201dfc1081a\r\nKey2 = c81526bc85c7a2ce\r\nKey3 = ab91d0aee0d68931\r\nMsg = 1f36b9cbf3d4d4dfcc4ba7fafa7c229f0a9253f4\r\nMac = 27586cf856a41e82\r\nResult = P\r\n\r\nCount = 187\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 2e01198faeb6986e\r\nKey2 = 7cb564801f15bc5d\r\nKey3 = f2d3ef0d4fec61c1\r\nMsg = 27c8c90c9e46e14b8cbb0b7559bb166d65f58aeb\r\nMac = eaa7b4a171e449ef\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 188\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = df575b851331b016\r\nKey2 = 33ec7326e9ef31e5\r\nKey3 = 1686c1ec8a3ea16d\r\nMsg = 1e4e01d38ff65d05646d544b52a6df49b897eacc\r\nMac = 45789bd32147c0ae\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 189\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 43b68c1f29ef5b94\r\nKey2 = a7dfa1cbe9ea3df1\r\nKey3 = 83d3c286e973ada1\r\nMsg = 0ca9b0f6465db0e101f8c14b2e73859d9c355b0a\r\nMac = da439a51157ff0d5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 190\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = bf91d679268c85ce\r\nKey2 = 46b9f7bf4aa1a2c2\r\nKey3 = f7fd15fda2cd6408\r\nMsg = 0c2933e39d7e601ee6f2519eaf01294853664262\r\nMac = 455cd46d3b452a55\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 191\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 0dad9d451f890b38\r\nKey2 = 3416e3c240a16ee6\r\nKey3 = 5b80d6aefd4ab5a4\r\nMsg = b6e1de9abef7525c5dabbdc85746958781d50139\r\nMac = 3445a869cca839fb\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 192\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 96858f8f2ab56df2\r\nKey2 = 5edc3b04b94ca7cd\r\nKey3 = bf10614ce0491645\r\nMsg = ec9aa18b3e7da99dcbd7de7617a79130abe3348a\r\nMac = c744a1392fc656c2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 193\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 46ad6ebad9644a67\r\nKey2 = da684aa48f23d619\r\nKey3 = 43a2316b40a46e25\r\nMsg = cf97c2abe3d0fc89e05538b50147a3f405391219\r\nMac = 7ac08967edc5730b\r\nResult = P\r\n\r\nCount = 194\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 68647694efb32023\r\nKey2 = 0d2938c8fe1a4057\r\nKey3 = f479f16e7552942f\r\nMsg = 33a9c750bb532d2d37ec86fa851aeb3cad1eaad8\r\nMac = 3873ae02210eb5fc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 195\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 58d62fd92af7437f\r\nKey2 = 89dfb51fc807cd6d\r\nKey3 = 024fd04f40d5d0e3\r",
-    "\nMsg = cc293c9e1780b401d2e7fceef6f69edcf0f70b86\r\nMac = 6574bfceaf04b4e1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 196\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 4b377f98df0b7598\r\nKey2 = bf73f4c2cb074001\r\nKey3 = dc9857f47fe6101f\r\nMsg = 9ba5dbe7a8ecfbedadd7889cd7f1ae073e01ee3b\r\nMac = aaaeb7223578bbad\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 197\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 91c8851934cdecc2\r\nKey2 = 582562aef1205e32\r\nKey3 = a12a70eacbad310e\r\nMsg = aa390a0ae33751b0bd8de5723df91d999aa70358\r\nMac = 67f76912ed61eaab\r\nResult = P\r\n\r\nCount = 198\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = dcc2bacbea0dcd10\r\nKey2 = c18ca45ed57f8f97\r\nKey3 = 5d58157a677f1951\r\nMsg = a7573e5b7dd7f4ce9e4480f603c14145a27f7c7a\r\nMac = 2b6af968464ac63f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 199\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = fe6d49702f044f40\r\nKey2 = 33321613da401004\r\nKey3 = 8c3438f74cc2680d\r\nMsg = b15a118b3132c20c31e6c9d09acdee0e15fcc59d\r\nMac = 9f28413a00da00ab\r\nResult = F (2 - Key or Key2 changed)\r\n",
-};
-static const size_t kLen33 = 53587;
-
-static const char *kData33[] = {
-    "#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = AES KeySize = 128 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:37 2011\r\n\r\n\r\nCount = 0\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 27b5686c79b3d242f96d3892c6135b26\r\nMsg = 00\r\nMac = c98d11822b9b4d7a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 1\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = b4542a22baa348ee2d11ef62d44cebab\r\nMsg = 00\r\nMac = f7a2a3f519fc462f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 2\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 7256e344f68b3e7f9dd6e04c5c65135c\r\nMsg = 00\r\nMac = d4d7fcc5f979230f\r\nResult = P\r\n\r\nCount = 3\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 7a2116595c5cf6482199d3312498006d\r\nMsg = 00\r\nMac = c3c4fa28709060b0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 4\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 0341551d6c7e7c57f678068f0b41d1fe\r\nMsg = 00\r\nMac = 821030d4b7889fcf\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 5\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = b67ba2aa4e9ea9871c3def87e2dd77f4\r\nMsg = 00\r\nMac = ea896182698ac145\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 6\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 0091d39f3478d2c59bf874b96db9ce0f\r\nMsg = 00\r\nMac = fb12c5971b0f2f18\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 7\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 46a2e6bd3fd5336abf02eace3cd1e1f6\r\nMsg = 00\r\nMac = 9c6b46ef046ae1d1\r\nResult = P\r\n\r\nCount = 8\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 4b0fbd5e6f9298e5ced5ebdc60fc18a7\r\nMsg = 00\r\nMac = 221857badcbcd2be\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 9\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = fb20547da671acd4c6df37f6568a6428\r\nMsg = 00\r\nMac = ba0c9bfd3d9c0c95\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 10\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = b787def50aaf446bf15c562434844562\r\nMsg = 00\r\nMac = ba60bdae64068330\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 11\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 67d77f50727c7cd5b38e0b175a888c88\r\nMsg = 00\r\nMac = 555923e6b5fbc504\r\nResult = P\r\n\r\nCount = 12\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 6f552ef7d309bb98597b91cecc21e158\r\nMsg = 00\r\nMac = c2aa402c0443dfbd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 13\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 411871267919a145532cc401e753ebff\r\nMsg = 00\r\nMac = 167a31913228f45f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 14\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = abfe32efdf0464cb2eaafca8eac30d9b\r\nMsg = 00\r\nMac = 8edbc729b1923e10\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 15\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 85504d59a12f3e17edfb0b6337d4a081\r\nMsg = 00\r\nMac = 9045fd77cb26dcb2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 16\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 55f7565826b0e2ccc1368f4de32022de\r\nMsg = 00\r\nMac = f82395416a8dc209\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 17\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 43c8f984390debb0f26c6b9c2df8518c\r\nMsg = 00\r\nMac = b5d732086bf8feab\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 18\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = da288d2014616f16a2abf5923dea49ad\r\nMsg = 00\r\nMac = e03b67b53fc7863f\r\nResult = P\r\n\r\nCount = 19\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = e2f962d076df051c2d291b47a902ea0c\r\nMsg = 00\r\nMac = df1456a7edeb4e42\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 20\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 191b53e0c7d90161e5e2014e9b8aea31\r\nMsg = 00\r\nMac = 1e210cff3c90bd2e2a27a78ef7662f61\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 21\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 54666bdf6db300ee10982d14dac828bc\r\nMsg = 00\r\nMac = 9fef67209b8da28049b80efe98f85f13\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 22\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 9a143c21cc6c9528b9ddd7e4405682e1\r\nMsg = 00\r\nMac = 1c3c3b6d1d86ac5787234f8f6d707acc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 23\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 802047ee1309e548ae81e93a17bff9e7\r\nMsg = 00\r\nMac = 1472aecaa0a09e45893a14090ed9a17f\r\nResult = P\r\n\r\nCount = 24\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = ab79ce74c0959aea0fd0b28ea5d0afe2\r\nMsg = 00\r\nMac = fde8a95536cc334f7fc8881a187afc61\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 25\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 644ac6fdc1e713ecb7ff1e0bd5729a57\r\nMsg = 00\r\nMac = 95a93bb50703521e6c1a8be1aab6a646\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 26\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = b4571e56f66a857daffbdc99370ceddd\r\nMsg = 00\r\nMac = d2742ea62f1d6513c4eb0e533922f251\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 27\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = abff2b097d688293701ff2c49ba48eb3\r\nMsg = 00\r\nMac = 17e724f66d4a9ef5dfc0cf903f8ff04a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 28\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 9d45f6d97d1573de3cb3488befaf5b7f\r\nMsg = 00\r\nMac = 96ec3cf234d6704483a93885bd67e6dc\r\nResult = P\r\n\r\nCount = 29\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 00d385629e5df815a5300e6635351934\r\nMsg = 00\r\nMac = cb23bb449ac26e2186b02f7428fa022b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 30\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 2f9109e7eea21b2615c81c03182ce603\r\nMsg = 00\r\nMac = 4532211f48124a9eacd795ea4313adaf\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 31\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 9f3830f5cd40a2396b6093b358cef1e9\r\nMsg = 00\r\nMac = f5ea59ec909a8ec2d8b11f5f276201fd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 32\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 17378e17c41586b88523a6b6af738dc4\r\nMsg = 00\r\nMac = 40cc8b388be6789aca584659acc7aa06\r\nResult = P\r\n\r\nCount = 33\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 064e8c88a0a0766186d75867b5ca3acd\r\nMsg = 00\r\nMac = b2f94222a68fcf803868b00404ad170f\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 34\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 1e39f1cba97dac4e4d4f3bce7fda72e5\r\nMsg = 00\r\nMac = 60763815c1075c31078a9b44fe4b8427\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 35\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 06f0e4618e0ea8fa5443b50ea005b672\r\nMsg = 00\r\nMac = 295c6cd08b1d668d9fa85ef851b1e029\r\nResult = P\r\n\r\nCount = 36\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 648d77b57770b67ecda1ce7951eaaeea\r\nMsg = 00\r\nMac = 2f3fbc6edf5827fce440b9a7ff8535b4\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 37\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 6f3938932b5c1280311e892280d8a822\r\nMsg = 00\r\nMac = df02edfb316350c81dbee385d6e1d8e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 38\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = f909903451d1f9f45ffcb93a407ffb50\r\nMsg = 00\r\nMac = d176620722c5327270ef30956d7ac02f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 39\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 181d92c7df1ebb0924719e066e08b95e\r\nMsg = 00\r\nMac = 144f688fa0d29faf787c48cd0765eecd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 40\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0c5b763b1e97b4f4dfc7059e4896ba58\r\nMsg = a0b3c6944b35f7208dfb40b4c4ba134a14dac928b679950793b3b6751221f178\r\nMac = d922ea85b3992a67\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 41\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 461d7d629778c8b05a688bee4fc01e9f\r\nMsg = 07571a6c9bcb6f97d626796bc74e551d1c45cce38afed761706f6264b7e751d3\r\nMac = 794b224a85396a27\r\nResult = P\r\n\r\nCount = 42\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = b91c6b09bf5a0487a9b5ea2fe0c1f3d2\r\nMsg = d31fd388e97727ba0a35d34ae05d9980e5974f6b3d86e2d4dd569b70f394a159\r\nMac = 2665ff2785bcb606\r\nResult = F (1 - Message changed)\r\n\r\nCount = 43\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0737836cf771e842a70f3eeed7206799\r\nMsg = fce631a9eb130178018ca88cec966ae53ecc83a51d0a73173c8a9af10b4d04d6\r\nMac = 1eee822e37dd1e84\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 44\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 120132c315bfc9c4fb93023f5d3500d7\r\nMsg = c2576ed3189eff3205f5e01dd8fe7c64f12dc73c807c22918f607f9e43fcc5ba\r\nMac = ddca15c8b5a80cb2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 45\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 5363bd7d867a9f9f0592dd9940a791e8\r\nMsg = f34e86b8803d386573b81045df945df8319a93b613de4c41904c8e1879844cee\r\nMac = 109dd7c920ebbf41\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 46\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 3fa1c7cffaa167557b250634e8052fa0\r\nMsg = 4255f8af18df7237e0abe98421aec9634443561752d893aaffe76380e829ef32\r\nMac = 0eceab8d28dd4a2a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 47\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 6583a4ff27b6e109046d11b977c8293d\r\nMsg = b63be320f92",
-    "e01260fba37312224494a2764dfc928287c75dc1cafee7b698d48\r\nMac = fa0cced22e896b40\r\nResult = F (1 - Message changed)\r\n\r\nCount = 48\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 5949378fd3135dd02ee1929014000411\r\nMsg = 65c16f4e66b10c7c153be7ba2dbe3a6d4eed3b04fec44188edc229747d52f8c8\r\nMac = 9ef023345848680b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 49\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0e80fa889b1d96a0d23d236d4d642a27\r\nMsg = f6f094e46cdb2e45fe49b18aff1427ebdac9710fa7f47f75fc9ec7140613ef3e\r\nMac = a09774009934c9d4\r\nResult = P\r\n\r\nCount = 50\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1f88dfd4f5c52c22b1db47f9f4fb6e2f\r\nMsg = de433ebd1cdabeac46b94cc00d984f172923535ca8fdfeeb860546357dd8e266\r\nMac = bb17b3983faee0db\r\nResult = P\r\n\r\nCount = 51\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = ab0ab9e79ee53a6946a31ea807258dbb\r\nMsg = 89ddbb042aa2aea5207b312c9831fb48138aca90626ef7c5ce474d5797ae1b2b\r\nMac = 72f316d5bfcfcf6f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 52\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1eb19542a0064564e096e5d7d60acaa6\r\nMsg = ca25504f3f5559aa0e88199ce1551c9240b5c76f55b83bdbf2777cded54ad3af\r\nMac = d936b1fca0a96aec\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 53\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 33f11aa36d8ab0fc53486839a576b31e\r\nMsg = a58524e37c2504468f77a9c21b0e6d1a6b5e06fa051d5b8025ef97fa69417cf2\r\nMac = fd64f7cb283adce1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 54\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = a7b81d8245129aa451dcb7229de415e5\r\nMsg = 2b2ec02aba10aee056443cf90585caa2510b3b835454a99f1324567b0dcbe682\r\nMac = f4cd48f32c9dc66b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 55\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 3c1baf0d915e5aec92bb62babad0ba2c\r\nMsg = f8f2424c2dc0d0f3821af7244038da0832c547be4ff0850b98c04d4d44a716b1\r\nMac = e17ea6862129d6b9\r\nResult = P\r\n\r\nCount = 56\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 943a49073db6ae94a88844ed895f8fd9\r\nMsg = 8a15e5be479d3a39a459ca7b50457472cbf44f6a8324ee3d4096e2c3bf1d8190\r\nMac = adcce0ea2c8b11d9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 57\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = ebf8935f53dfb3bd40453c31f627c73e\r\nMsg = 7edddb03d861dc9796f8e069bde434681620f604db436f34b7a6a3beeec925b3\r\nMac = e8ea88729d49bea4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 58\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = f18e8feed77d1b80c31483fe69073d56\r\nMsg = 37c6206e23163c39a13f19de48cc25dc26e6f83cb376e8d2048ad7c141fa503d\r\nMac = 0d4f5cdb2a49b471\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 59\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = b4e41c7bfb8fcaa5236f656185c1496b\r\nMsg = 32758ae47884fcef766dd1fee1a7f55ca6f6691574e2ea097a68cd4072ef2e7d\r\nMac = bad08badb66c8e5f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 60\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 708484fba04972b815256c5dab12d5d4\r\nMsg = 97751b4893a83cfe6b760e10da795682e9668749c09036f9bfadce9dcbdd85e6\r\nMac = fa74b33267c5ffeca75e5e16978bd7b0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 61\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = d0df1bdf1df6203241722fb9c9c1cf74\r\nMsg = 0e41361ebfbe4e6580fb5751e58e98de8ee5d9849fe875026fdab15a85804c1d\r\nMac = de4992c9d33659620cc203848e42a279\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 62\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 7c0b7db9811f10d00e476c7a0d92f6e0\r\nMsg = 1ee0ec466d46fd849b40c066b4fbbd22a20a4d80a008ac9af17e4fdfd106785e\r\nMac = baecdc91e9a1fc3572adf1e4232ae285\r\nResult = P\r\n\r\nCount = 63\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 7b4c800f5071521119e4cc6deee8729f\r\nMsg = 775946f3014523b6ea37804585cadd35e74e9382ebc1022579fbebe407281b6e\r\nMac = 2f6697f5d067aecdb3ff5a09d9169b3b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 64\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 7618d222630138cc14246e8fddcf98cf\r\nMsg = 432e3575a966958434da38dda3606f1f69adeaca536a7bf66c8b1e451edc3716\r\nMac = d7d78aac615ffc1bb32dfea41f2b8771\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = c8804fef18ef263c010c8a205e14516e\r\nMsg = f2d23bc605181e3894f61fa63d61ed4a610123ab7d3531c0b7579a58b74161ba\r\nMac = bfe5e2c10a5cecccd3de2529f340cf6b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 66\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = f98ac86ecb742c188852980b5150d100\r\nMsg = 4e6fd4fa7669ce9552154bd796644961b51067dc02303430150aacf671280031\r\nMac = 73df5f4d3ab9240d4fb2be775188adc0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 67\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 638d7d95ff5f57571261e23ffa081189\r\nMsg = 5f5bc4e32764bb00085667b7f1b15433f09c1f6fa48689f8f50dcaf5021f2864\r\nMac = 96b270629b2bfbf721f1a70eccf9abe0\r\nResult = P\r\n\r\nCount = 68\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = a5a20d8139472a4cb38993c5711ac2ca\r\nMsg = 73e1e75538f9a63e49a068189e3b0a1a1e65ca5d1295589bdafa3136deaa287c\r\nMac = 320647d53ccdf2335a9c9a3452c1cee5\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 69\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 57656be54860414e8a62223381ca4405\r\nMsg = 3447e82ecec6c8b6fe1e44ed91f933e4a70c431911eb86eefe222d5ad78193df\r\nMac = 47c6b5a28d723129648aef418b74daa8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 70\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = e7b665600a2aa413e117c53816cbed34\r\nMsg = 5e4d49ab796025157add6d42258b9c506d9ce82bdd85c604360db0ff5aa4262c\r\nMac = e741166cfa2a58003dcae357d7a199b8\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 71\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 693cbb46bc8366086ec7cd7776f2c563\r\nMsg = 5a908ae85ff721ffc5096aeeda5ee83bddcf639e7be68d109394e5253c22dc9b\r\nMac = 9d56b03ef83082f601a9cc8730b0de42\r\nResult = F (1 - Message changed)\r\n\r\nCount = 72\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = b4190e3462e07fca26496adcb877724f\r\nMsg = 02097035a312cb02ea7f09fc1accc230a205e4a208e64a8f204291f581a12756\r\nMac = eb9604ec71aac0cacb63e0b369ae7664\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 73\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 4ae06c3b2940819e58eb24122a2988c9\r\nMsg = a2e7be3314238d7e4f604e134790bb15a87c09356c091b1aacb9f605b67475b5\r\nMac = 14b4507ae4b50cfe4989b544bede756c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 74\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 8d560de2e310ea69389221ce2e850625\r\nMsg = 04d9db45e4df19db757b9b95c25be43e822b8372ed148d49ce824a36da2b2f2e\r\nMac = 647f2874a083e82fa804b6c58c7b5c90\r\nResult = P\r\n\r\nCount = 75\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 0e1a79c5d734118c19eaba700f5da238\r\nMsg = 026470d57dad9893dc037b80978bf70c2e552fe46c8fe8c3ebf8338bda984d94\r\nMac = b936ff3bb8afb9e42351a2a3ad49d70a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 76\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = c88b1bc0050e19780ab53efbea175634\r\nMsg = 7207aa8fa87283f1f57019bf1c89645ff8fc36ab1102704e6d577671a9f7e098\r\nMac = c1dbd79e31c3b0bb824f16f735ccdfe6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 77\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = d87df10a53eb3ea24c003d2a65e44921\r\nMsg = fedd5813146a8c2af398d6066956829833b75e44b6e010e4f025ac0fad6f869b\r\nMac = 9dd7cbb34445bfb351d01e8cdb21d695\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 78\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 4d436a4a5c02b22ad49548b97216f277\r\nMsg = 2d73204f0b2d35806a8227206922ac9c18eff6ebddc73809179d67a702cf3e21\r\nMac = d2654d9bd6396075296cbe918d90670f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 79\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 8af7b74e35eb38f4086343bc329ab465\r\nMsg = ada1fa439c653d0cc88c0d129ba252e86c7d20a3087be93e920bf13d8e6f0391\r\nMac = 0fc9b177c874ea909b6beb1db1b802b4\r\nResult = P\r\n\r\nCount = 80\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 91ce6c87860aa84053f42e1abc16f489\r\nMsg = 4c287bc16196698d762d5fb428e801975fdaa29026b7b78dba968bfee0f534f27cfec57c6009c55c6261e0dbb14bddf76944d0c0648b910254df6c240e8a1a50\r\nMac = c1ce12f51aa823d0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 81\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = b7b774e5c9e2f6926660c48b8df52354\r\nMsg = 937273c7355e7b88a630d15be875234cacaa44e815f31997bf10b52c008cc3bb6d3724aaa0d7da0b391b252923d0eb6119575d346857d89af6af099883af5514\r\nMac = ff845eb2d77aa5a7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 82\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = d7572ed0e37261efa02f8c83e695efdc\r\nMsg = 85a327b0c7a31a4116e7fae0c0971e1578ab6fbdf90124b9ecacd0e70c909f51882cdca5a8b6b7e6b46d4660122bc9e1ae3932269f68e594075dbc293a2d4eb1\r\nMac = b8b3b7526419e069\r\nResult = P\r\n\r\nCount = 83\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 259129eb760f8a770410c160e4e13a6b\r\nMsg = 77d9c30",
-    "6aa257379053cf1f2043c388a301dac2a9e2bb89eb8bab6eb3f150fe391b7a3f628be6b4b649c5c108a108f0e0c55a0800b9954251ab07e94450a23d0\r\nMac = f9376f11cbec0ec0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 84\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6ccd61ed20f16ca7a78192f5b6ab5528\r\nMsg = 9211231ec382ecaaae57f34de1ac6bbb50741014a978160ce59c60491e64f30da0b8aa1442e42bc0f7e31973a0dd8c3c24eebeb7c329072ea7dd0b04bc163254\r\nMac = 94c275e6a4675d8a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 85\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 1cdc44c40efc3c0ed6fb84b0c2f78aec\r\nMsg = 818c636772036761af037c23aa8cb63e424f0ba0375b645de2f8f5af23d3ca3b9a5ca3951a6d02075a2c828eee326a2676ed8247164226b0267798632a519bf1\r\nMac = 74355397c7a29bb1\r\nResult = P\r\n\r\nCount = 86\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 2e523e9d8a5532127ec63b220838f11b\r\nMsg = e6d067907610109b8789e1ad00542539991677b9efc97a98d8bfcb50f3e334d0844323207fcb5a47e353e76d49dd573dbd17278dcc287b41dea8126cc7f07ab9\r\nMac = 7bd6745c6f73d92e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 87\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0eee5bc8994b723a580f67d45ccb194a\r\nMsg = 1dc4fcbc73dab4e73ed9d7606acdcd42b74972460c640fe50f028abdf255d9368fa3bc65b849ac31c8000eb47e5fade40ca167726aa927f2f043133d24ad0613\r\nMac = 486721355fff9cbc\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 88\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 388468d10bf0b770cc125f8b7d359261\r\nMsg = b9aaadfb3f60e48f1b421a9450129d75af2ce811ab0b1661680e9d5b147c38167ac7252ed40d916ae1e4519c3857d2c9dc2c538a106951b26d16433131438839\r\nMac = e13cef9392f4a80b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 89\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = edfe2e15edf0b0c28875651d4becfca5\r\nMsg = 70b1e2e4cf260b108f5a52d0d8234838ffd6ffe7b4acd78d7d6b95aa6342b598eaf402cb47396358ce61f8b4aa3a65bed0346e0036c3c5323f051f007aa58d0e\r\nMac = 7b70730219907d18\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 90\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6876df1a77e11165331a5ce2e0e6bea6\r\nMsg = 34b73ba208bbe1df06da768b0321243815df4ece555974dee2bf5732295f5ea9631939425e13c47681ae2ecb0bb85aa69be38560f5752a9d034222d91ad71044\r\nMac = 80e00df873439fe7\r\nResult = F (1 - Message changed)\r\n\r\nCount = 91\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = e65d5fd5f446b4eab63d56b0a5eb1d29\r\nMsg = 554395f9b113c0f2a1f155de171d6c0a805c838beb90c3756e8b864dc52517c03d8cb894d1dceae092f0e8784c7775ac664ad7320afd246086b3bc9ef237171c\r\nMac = c60f8ced2efd52fe\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 92\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5bdbd06f4df6e15d644f3a635d7bb14f\r\nMsg = 4fcc7c2763a8dd5bfe74e34f512be8042af9ba1c73a944edfb616ad47a8d34cbcf192f3e8be3101bb3709b29c2dec39aee1913e3ac524ccb76ad50c2cc3a3e75\r\nMac = af33d5a2746bfa5c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 93\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 13bf2f72211cc8e16ac1986a22e19f60\r\nMsg = 8ee212ed4bd110ca6a91b37bca59e19ba842e3a1b50619bc6b07ec02a09303ca5c66ba56e870d0b627d95fe829431244fe4f9218c862418f14a92bd76b5a3a82\r\nMac = 18e8cd5bd42c75ea\r\nResult = P\r\n\r\nCount = 94\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = e9b913c2f0630562eb1c16b3b1ed8409\r\nMsg = 031105ff01daa66ff95834e47b6f5c683994084d0fcb84c140d1dfa2039a95933efe6a4f91af993d966e2e45677eb1e36159047928a38eeaeb5c9a64ea59f97d\r\nMac = f00a17da0fb9e6b6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 95\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6fa5a5991315702cba3beb33867c7bca\r\nMsg = bb0fabffbcc6935ca35755fd4bfbd192b6812cf75c4dc95bc3a175a1501be2065d7f57058cb7a5785a185dfff7e740a5551cf7c17e65051b2c6ef9509360e878\r\nMac = dcfd143f86442183\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 96\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 3f8c6d21ec05bc439bf82774f1812bd2\r\nMsg = d726deb8537bcd671ddbaff8fcc6968f951b71aa82dfc802a53aadb2bcc2ef9a35fd90064320798b311d6d32f7dd3cd90bca39d57991eddc36260d23b108aac3\r\nMac = 449e20567875d56f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 97\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 8ed1a4873bb37fafd4f8c2ee417443cf\r\nMsg = 1652c9539bff4b6e9f303f3e6b5d4b9ff7e85aa2a401ee8c2dc7b722dbaf6424f92ab9188882e2483405070e8666204f5a600b46949cdb830fd57433d63a55a1\r\nMac = 601eb06acc5a4e0a\r\nResult = P\r\n\r\nCount = 98\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 83a4669cb9961448cf418cb83a16098b\r\nMsg = 26d97c3e28460d46216da39e043e024ed08e387b1e5fcfd3f962472cf1bac4676b03039b3b93927075ff41c87fe1d4a56bd9fa4784d283942787cdbdd5457f1f\r\nMac = 01a42494a10691ce\r\nResult = F (1 - Message changed)\r\n\r\nCount = 99\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = c9e6d0b3dcd8ab50ba5ff31d9c1bd95d\r\nMsg = 0d32c1cd73569ab2b10c67c167875fe22625358ed3469b424c5e052d4e49af2c97dfe1f947c972a08c938b327e01adbc48a7f57a89b49f49fa0fca5b50a57a2e\r\nMac = 476add8ee51b5e3e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 100\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 17281acb525b13653000ab45d86e7010\r\nMsg = 225750ca982e5b34fc62e277eaaa0f248532abf374933e572b0278566cc7cf980df26abefb493ef57f8477cac0bd19408a22e71f4ded84906996d8e7a846b5c0\r\nMac = 0f2aa7f2dffcf7df34c84d101aa9bab5\r\nResult = P\r\n\r\nCount = 101\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = d3624653ad0ed144667df0e0e355c29e\r\nMsg = 39dd298acc45cb597f0733572677f7102536c0dd86fcfcc44895d29af92a5b6a87c20f1b53087d4c874f4083aad32e877142d20ad87b1d8b7295587bfd235d9f\r\nMac = 795da5a50f5b7df40317616b5a470c02\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 102\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 813b3d579664cebe50a8e7050a0b4e65\r\nMsg = 78ad6517a09b99c1113d175f3129aade4d4a2516ebe054f15bc833d08ffe5e2a2d60c976e1b4b14cf8edd2c72baadb2db8001fd2b8798d39ac5ce27d592f1def\r\nMac = 20f40553bedb6496233e0b53143b6d10\r\nResult = F (1 - Message changed)\r\n\r\nCount = 103\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 21095cdbe94afa27d84bcd68276993f3\r\nMsg = 10525eb2794d03409faeab22a6d4cc4ebc0421daacb0e865b0f94eb387722897c827e31676debec9d49c36837b6bc234a95bc10ddcc7b1e5a0d9a1dca550e93e\r\nMac = c0b806ce5eaceb51b53b028e6efea9c7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 104\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 6c769a4822523525bb36c02518475549\r\nMsg = 4af38908fa44b46873535b39f432d9b3e677f6d06d8719af3d15b936afe515fc13d62566481fd0108bd95f6e8dbe32b3c830b1f1127d868273610aa834ccfc70\r\nMac = c1934b9c74127cfd515521df330c0333\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 105\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 6b454930925ca09d39e1e39a2e78fbfc\r\nMsg = 2bc884394ab7050c14d66fb8901cac109c0126668d918a4419bfcc5d75fb6bc2ba07f6598d06cf8cffd62f3eb29f6a033eac7490d27aa4701f0fb9f9718d1b7f\r\nMac = db19b8ef218018e5a53abcc39b7c514a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 106\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 5df295be7c44d59c44fead3f1988356f\r\nMsg = 3d7370cc2d61af35bf7b2ba50a143b23bfa0d1eff66c5ace2d8de5a28d17883d708fff7721a2977ee2164b6e34022c22523a0649ff0e40bc8134040fee02a065\r\nMac = 81b3181acbc2d6d2960ec57441ff3c40\r\nResult = P\r\n\r\nCount = 107\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 387fc73be9f019913f2222d98053f95b\r\nMsg = 944daaa76249bd9d3bd517d01b074920b7d4434d1a2618af902e0228c3fca658244d990f8ca42208239c42d4827cf114140cabebc2a72bb3cf9277ef008c1c81\r\nMac = 5de79be9ff9c3c9d64f9cce35b188648\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 108\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 7424990dee834ad05f4218861ab21eae\r\nMsg = 49fd56dec210e903f6c703332637f9c267eab9333e2701a16c74ce5e0b5a16d9da68b9c5d67bb6770a3c9a90a7e93fdd5759b27bcf3a753fa39ee7545fb60026\r\nMac = 38b66049ee8ed81f3f8ce2b45a4001ad\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 109\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 232407986ad4a8e438990fd04ffa35bf\r\nMsg = 9d88a7970d4c58cecc20ed1811298a5b37297419ca49c74fe216679dafc938a656cb92bafb78efb31f24e71c2d5b5f994f6dfd82862adfd2faeb8c408fd22aab\r\nMac = 313d46dda3ccb75f497f9069c9478b3a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 110\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = d9bd6ac153cb0bc4e19e59c45cfe0d6f\r\nMsg = c68094c26c7f017b79f126dc26b3bbcb95f97535ca412da5f7853e15fcb52f042e6492c857c22b26ffca5520eabca20ee2cec2f0b71ea60383ece49232065e0f\r\nMac = 3b17778955990ae58e03feda7fc43998\r\nResult = P\r\n\r\nCount = 111\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 857fa35c6f70f637a9a5e6f215c694fd\r\nMsg = a1fc1307757ed91665980e2d3cf9778d8bffc9a84cce6bd5c5a07e47af5c1b409869db8286c49d07dd5083f1826e3ec441ce8cd36c85fef8c55fff889e761286\r\nMac = e1ddd63db51d3035adfd309ddc186238\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 112\r\nKlen = 16 \r\nMlen",
-    " = 64\r\nTlen = 16\r\nKey = 501f5c58355d1800f155f272dd09afee\r\nMsg = fd3564848ceb5d8cddfd50732956d18b4af433efc2e2a914ff66aba1de7b9b816d81a936f534f47038dbf1def7c11144b7e99ecec5fee6a478899cbeb6677bfa\r\nMac = d995f9bae6150996cd9b798fcbc623c2\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 113\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = c1d636989dfbcb0edc9f014cc82da6b5\r\nMsg = 20ef1bbf8a719497797f1f1bc4617179ea682a24a92f0831cd215a01473bb8207e13f26dea1a467bde1ed638a51359ccd11210c4d0a2fb70c0374e8984f81f17\r\nMac = e4972a59db04f78da1728cab051faa98\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 114\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = b4bc5a4d40716fb06a359ef9537726b7\r\nMsg = 36594fae7b487798d62c2c95ccbf51c984df5ca6343465b2dd147c8b36a34028e53fae61f51b36b28529143cbd3edd0c077158a07bc490a79a06270940f7ed27\r\nMac = cfb3fce039ee2bb94b6961ff86688237\r\nResult = F (1 - Message changed)\r\n\r\nCount = 115\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = dc796e5d9b712c798922eef315cb4728\r\nMsg = d5755c40f52364343d2613420441afe9da9a5329d3c1e5a123ee49f5eb8ad47253f104f5d9776e08e9a9f74fadd5472326cc7b7c7ce61a1492474bc9de614543\r\nMac = 315f0ce76352448bbd8a5012a9907a23\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 116\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = b82fd283922e730a07f7ddb87484f66f\r\nMsg = 94e47b82b728d639777d5d5843de2a5c364956cb4b21cabdced2529b10b3f4275f307fbc352866d7b094cfd7426ae801aac17ac72335c04adb8d791da69b3c4c\r\nMac = 86e6a8485b43f1b258eb59688af91fbb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 117\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = f6db7efdfe73dcb4a26b8448842b55e8\r\nMsg = a1fa1fcd5f095b2768e32cd733365a136a108e7493f212aaef27d86da253beb6154f103099344ee94db6304e41b4e856db0ca7fd7ab462f45a07d697b85cca1f\r\nMac = f998bba6c5d3efd78af9ef57e7a38f7b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 118\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 3c1ba92d096fba134dfb4ef412b2568d\r\nMsg = ba7725d74465f5d92454bff794e0be51c4d0af7d88f729834d57312c528d0a7d15694a7e0bdc334093173f1d2df1fd42e7891c6b192dc5ee527b2ffb92c66d22\r\nMac = cfe6022ad29a54627ae7c4f907ef4da1\r\nResult = P\r\n\r\nCount = 119\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 4a92337f017a85b136ba6766444bbe84\r\nMsg = b0a3a8aa5d4bdfbb4c5c52acdcc60405c379f752b077eed42f2d7777cc0329047b322b9837d5f655ea445b578d9dc7e990a3c6f97cccc6cad7951ee948194e62\r\nMac = 153eff3c035db2fdc752ebd22302adae\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 120\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 305ec69b23e4490e0f8a5241cb9c8c85\r\nMsg = c641cf589020b94026ae\r\nMac = 3bc054afa9771970\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 121\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 28929286bd1391468ac75f5c03689f74\r\nMsg = 3813592f268a7a863c3b\r\nMac = bf1b514d2f899620\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 122\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 1b3163e2d3a471b9823525abc7543c4c\r\nMsg = cada03e8c967f9732a81\r\nMac = 53702fa98e6f9a19\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = be1ed49e2cb0caf6b6a0940c58453b93\r\nMsg = 4a348c5ec996f7a97ef0\r\nMac = 3358d143dff4adfa\r\nResult = F (1 - Message changed)\r\n\r\nCount = 124\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = f18be18df045ba31b80f3283cee6a681\r\nMsg = 93006a06d7e6df775b19\r\nMac = f3252f061dce32f6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 125\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = b9dafe18a904ba761762ec3fe0e4120b\r\nMsg = 173887316279a47fc699\r\nMac = 884f5b21d478d60b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 126\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 31fee08df80cc1009e661230e25939fd\r\nMsg = aa54ff7466923b265fb5\r\nMac = 03dd2a9616f653a7\r\nResult = P\r\n\r\nCount = 127\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 65a28d970b2bc7afafb4069c26d264a4\r\nMsg = 1aa5a3a4e6c5e5394e50\r\nMac = e0423589b192caab\r\nResult = F (1 - Message changed)\r\n\r\nCount = 128\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 6dc38e37d1379732df4dd535db88d17a\r\nMsg = 0093c6d94aed50b398ad\r\nMac = 19b08e65d391c491\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 129\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = c5329fd99848e1cdcfa406ec09745ae2\r\nMsg = 6d83d0ad7cc7efd0d2ca\r\nMac = 8ec2709e1466f8d3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 130\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = e608914a930b9c300b677afcb8689d63\r\nMsg = 146629e70b37d8b83ee8\r\nMac = db78a639bb15c84c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 131\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 0a998d3d390f5a80ad398b2070489984\r\nMsg = a91c1a8d9d268ad153bb\r\nMac = 5643a8c99b99d944\r\nResult = P\r\n\r\nCount = 132\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 2b6f78ceace47509a43ceb6b761e7866\r\nMsg = 3c0a41a78240c9d2fc22\r\nMac = 811acef50d6c1913\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 133\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = ca481f557306f9ce386edd0cfde375a5\r\nMsg = 9f3488736ef6e2c3a51b\r\nMac = 57e8a0e5965399c0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 134\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = c0dd1cfb3add04cd67a8e59be7ac8dcf\r\nMsg = a7c559c82776f429ac31\r\nMac = 7e43a2b43d030ff4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 135\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = d3130d9e5ef516b6bf172953a37913a1\r\nMsg = cbe97e14c3100c9fc564\r\nMac = db9f674a2d0e9ed9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 136\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 9ec8661a880ebfd15fd8b04f2ae09dbd\r\nMsg = eff803e0fc809cc48587\r\nMac = febec8d41b6bdc1f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 137\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 6c2b091433833a0ed915354dcb70d982\r\nMsg = 90f1416768fca7dd48d0\r\nMac = f6ada24319e502ab\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 138\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = bc79d444dff9d9e722effab07b068cb7\r\nMsg = 07d5a925b724e2443936\r\nMac = f964302c270af24c\r\nResult = P\r\n\r\nCount = 139\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 1a15b24ba5d9648358f2c39c9da8512b\r\nMsg = 15b94910853a8f23dfb8\r\nMac = 8cdfbc13239e6aa1\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 140\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 618fb69c8fb670250c306b3225687d17\r\nMsg = 7f54845a57d916866eff\r\nMac = c0d4db73891bb1efa232593407856808\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 141\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 8000aa080c127cbabfdfa5d9d9728c7b\r\nMsg = e53101e6eabcda32c13d\r\nMac = 5671badc409d4b170d4c861a0b3e1fec\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 142\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = b05b5557ab145cec2f00706dbc6a3c23\r\nMsg = 5e2f601395ec406fcf96\r\nMac = d00243508d25804548c4b4b512cb1906\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 143\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = e8b13346b61daedc1f9e3b49df8d1cd6\r\nMsg = 0593365419e0f75b6323\r\nMac = 871eb97850a776e7ad498467064484f9\r\nResult = P\r\n\r\nCount = 144\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = bc498326755503ff25d02805eb351722\r\nMsg = 9ece4c82fe9d38ef64ac\r\nMac = b5e88af50d1cff3d2b6d304edf042c43\r\nResult = F (1 - Message changed)\r\n\r\nCount = 145\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 4d248e73886a0e36b3ce7c6113477f4d\r\nMsg = 8de6fe3b24fd6c202ef0\r\nMac = c1a4f6d0ff7330171cfe570e900ce2c8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 146\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = b1b9fd78e3f8eaf4e8c91da62b2da534\r\nMsg = 482ea6f652067e8b791c\r\nMac = 63c6994c98bda91723f832020fa7d223\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 147\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 85e4e63341658144a99fbd17d94e3177\r\nMsg = 21ff834bec4ec6384522\r\nMac = 580c1e549a2ceca4743256a9cc972e84\r\nResult = P\r\n\r\nCount = 148\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 88b5448372548e6aab1b262630a28a47\r\nMsg = 36dbbff560ef04ea731b\r\nMac = 5fd17fd704baaf1ae6b3330ef2989dae\r\nResult = F (1 - Message changed)\r\n\r\nCount = 149\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 8cc76730ca47620d0b437112a2c93fd0\r\nMsg = c73be9f019913f2222d9\r\nMac = 2c73e2b5b84d8f4f3db1fc92831a03bf\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 150\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 7b657c640f155f1ff461c83cd656614d\r\nMsg = be9c5e77bf1b9dcbd4f1\r\nMac = b660ec36c0c0b4d987439505f1bf57e8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 151\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = d5044e9f10bd274aad4f7e605bb828f2\r\nMsg = d0be84df789c98dd125b\r\nMac = a26e513b09f184caf8d76d76961d1466\r\nResult = F (1 - Message changed)\r\n\r\nCount = 152\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 24d6d4bdc9fc4cd05b2867e9123acf18\r\nMsg = 0f9703a3454c25c0b105\r\nMac = 41676ddadb7b960e0269c8a59a6d9b91\r\nResult = F (4 - Key or Key1 chan",
-    "ged)\r\n\r\nCount = 153\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 6aa049d06bf66d2e2b65541eaa3730d8\r\nMsg = c562ab24ae5cdb7654df\r\nMac = 0d4d1196158fec46bfa754a526ba4a25\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 154\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = cf3727509577f1932bd7a92589c11e67\r\nMsg = 831188efc5d1f6dc9bb8\r\nMac = b5d162c885d7d4f6f65f4188d6582240\r\nResult = P\r\n\r\nCount = 155\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 0bc2fdd890c19882640f8d4188b88b9d\r\nMsg = 296828cbee50f41d19b1\r\nMac = e583d77645a603d841eaafa8860bfa91\r\nResult = F (1 - Message changed)\r\n\r\nCount = 156\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 5bab8051e2520b75673068b9cda93cba\r\nMsg = f16cba03402f9924daa3\r\nMac = 97f7eab25dc3ab017a9affc0e400dcc3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 157\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 7ac46e3249ca28e1ef0531d80fd37c12\r\nMsg = 3e9ddb8121760bffb7c6\r\nMac = c6eb13d5087d05b4eba2e74b283b7fe3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 158\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 40f78f7ad3eede36e13bce222c6a4bc7\r\nMsg = 4fa8ad212ef73d37d48e\r\nMac = 3831419e62b51b7ced0d9117e48fabf6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 159\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = a1f82c9924411e98e6f93fa0d07559e2\r\nMsg = 7d4748147575bc0113ab\r\nMac = c23dbc58fe22b34f7b007590558a3080\r\nResult = P\r\n\r\nCount = 160\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 84760f98ec565d281496b1295b25150e\r\nMsg = 9ce942ec81f8226506d48788e3acf49fcab6da22\r\nMac = 606c2f459a9ce198\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 161\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 3b6dd5169350b230774b02b9b44f06bc\r\nMsg = adb1ad81dac0ebc650d48f7a9329755a83f293d0\r\nMac = d7ceaa858508c476\r\nResult = F (1 - Message changed)\r\n\r\nCount = 162\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = f98d00755bcb45e6822121fe7cb03c8e\r\nMsg = 7064a2491f716f4a2969815e4a281a54690ced9f\r\nMac = e14634c400b9f561\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 163\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 5d27cb435e7724a246f158576fdbac68\r\nMsg = ee8ed4c12b0cf7c03bf91fba31a6a7b2d64c36c4\r\nMac = c10b474c0077a39a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 164\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 098c12058a0bc5951fc092aba322e1a0\r\nMsg = a2b76835229017bd0e8167a40ea1e2e18cc5db0a\r\nMac = 1d44128c3db0f7b9\r\nResult = P\r\n\r\nCount = 165\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 74f7f6516a17d5386c289756240241ed\r\nMsg = 8eafce9ba466fd53eb87f499d7c76bd486db0e90\r\nMac = acd978e0065375b6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 166\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 013bba67d26c7e52ae48dda3b67c9c96\r\nMsg = 48c0d53b85e6fa4928d3e9953afb9b451bc91a48\r\nMac = ef41ce0d30baece9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 167\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 14cea4c46d837c9439b088fba0e9d85d\r\nMsg = 3477384c396a9e9efb3e169722cba779fef240c4\r\nMac = 902158426696c229\r\nResult = P\r\n\r\nCount = 168\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 24f7b08fc2e6af6402243e22ca0626f9\r\nMsg = 914cf55a3fc739b5f87ac7518cc4171b4499d951\r\nMac = b775a3c1dc11d074\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 169\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 35b5428d440503773f30748ff843be68\r\nMsg = a5e5804cfdded4d610d1b05b7313ece84f369ccc\r\nMac = 6dac0947366be803\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 170\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = c8afe4e5b1d019c2efdbeda65d874ba9\r\nMsg = f739e632436470b5a1db9fa9796ed384c0523f40\r\nMac = 04c8aceaa8f8c3a1\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 171\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 05a7910edcd7252b37e6d3d080a9ee90\r\nMsg = 702db7761abb9b5de41a86c8659270570be9d52d\r\nMac = 889a990539cbc30a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 172\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 4c8b0850eab7b212ad96dc7a032f8855\r\nMsg = 2de32ff6ca41b4c97424b121b8ad4edb133c00ea\r\nMac = f5ce7f46d457ec37\r\nResult = P\r\n\r\nCount = 173\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 687bcb63755f2b5c7daf4a154e8525a8\r\nMsg = 02778ca34db1cb5df76cb1a7619448f67d63b26d\r\nMac = 49d48bb0a684c6f2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 174\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = f8c4e562fde4379b08e512b0132766a4\r\nMsg = 627868b46ba546252f4eaa1c25205ccff72902d7\r\nMac = 5459c0ac5bb6701a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 175\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = dd235b05c15479dfe0326ba206ac784e\r\nMsg = e044ec24ddc0605bca89925a4ebc0234811e2a0b\r\nMac = 5ed0a03da09555b3\r\nResult = P\r\n\r\nCount = 176\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 665c2d7d6e69c2ce8f0d06b41038b83c\r\nMsg = 4fcd7541000cfc223fe9da6a030c681d0fb926cf\r\nMac = 1f022feb38ae6131\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 177\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 2efb7cd914a59b6ad63b7d1812f254db\r\nMsg = 67c9fe3e163787705a20f2fc8c468c4f771991fe\r\nMac = a866d6a31c0b42e6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 178\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 74f6fd37ccb4b7702bb3a03b7322c0d5\r\nMsg = 011ecbe98c5cb7734476dedbb852e2474a5ad594\r\nMac = 707ec713b9bce5d5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 179\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = e673b3a954a00082cb7516ca9a54d9a1\r\nMsg = a6fbd41a838bdf0fab3e7b56c27a8c18dc4bf970\r\nMac = ad4dfde057b54a27\r\nResult = F (1 - Message changed)\r\n\r\nCount = 180\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = ce5bf070678cb07e963263b1562ff793\r\nMsg = 2bd10c4397a19fc79a307116a0847e0aaaefe813\r\nMac = 299e5910f128a1f091dfb6b70f6a60ea\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 181\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = bf144c9bb974729aaa1188ceefdf85e1\r\nMsg = 5e1ef2ad86ceaf5439fe87d2ec9bc41b52e5ba01\r\nMac = 58b4a32ae55966e42712721363ac9eda\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 182\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = a0cd07b684bb9e0e6692e320cec4510c\r\nMsg = 6e1e490a30f0c9e3d3b79f1c36aab742bd67c585\r\nMac = 24dd518ffffc1070f13d50d0bca42711\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 183\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = e3ceb929b52a6eec02b99b13bf30721b\r\nMsg = d2e8a3e86ae0b9edc7cc3116d929a16f13ee3643\r\nMac = 10f3d29e89e4039b85e16438b2b2a470\r\nResult = P\r\n\r\nCount = 184\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 4073251950e3331d03d67a2399576d28\r\nMsg = d5dfd0321b26e578fe987456ff061dc1cdaa4161\r\nMac = ed2823fb8fcae918064cef6211646e50\r\nResult = F (1 - Message changed)\r\n\r\nCount = 185\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = b08f47101365111133d974e8f0206507\r\nMsg = cefe484955fae117649ec158416a7439f29a596b\r\nMac = 3317717c6c0b138275090ea961c8d58f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 186\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 166fb8d0e110124c09013e05688605ee\r\nMsg = 24c65f715742da7d06046c783a35b2648180b4f2\r\nMac = d27901a86dbf0ed8bde0d69203646b7a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 187\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 20f6f56117758ba47a08dadf93a59056\r\nMsg = 7514e0f402e73d9c0b0576782011b2e6b2080a6a\r\nMac = 11cda489b6dc0ab48d111ee6cb26a829\r\nResult = P\r\n\r\nCount = 188\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 7fa6ef35ad594a09cb74daf27e50a6b3\r\nMsg = ac0d616ed7dd3c3e86b3507d9f2bdc3a807d490e\r\nMac = fbad2fc6c9d0e5d21b25445f499eee10\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 189\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 815871a8300471dc325f8289d0d37211\r\nMsg = a8ff31e90556236cb4df078943c1f2528b42a7ce\r\nMac = 5544c93de980bcf653354ce08aa9dc3b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 190\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 06aa3f6fc20f867b42ec234a1bcb8665\r\nMsg = 25df5cc617e6e68be181694721a2a112a1bfb7c6\r\nMac = 2eeb7ab470caea3317a6336f5eee24a6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 191\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 860f8fdb021b1974d40e3d4bc41fa967\r\nMsg = 6c982a616510db422cc2f1beb955c3e7a88b6097\r\nMac = d2280a55cd0bcd18846b4e30db6322bb\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 192\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 15105c6285a9015d0edd414d6a806bd7\r\nMsg = f1cc55636836e67909ed3a581de20630226dd5af\r\nMac = e9cc5799a630c6f26087c1bd3b6f1791\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 193\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = b47aa890b03a8ac0dbc8f96c30fdf7db\r\nMsg = 58b06c99e0d0256cb1c556ec3b48a3bce73450a0\r\nMac = 3376cacc247686832736cea7e67e13af\r\nResult = P\r\n\r\nCount = 194\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = dd057368033252d9bb2081a0b1a0229e\r\nMsg = 81de8f50fbe35f7ed95430e74d28666c885b6100\r\nMac = faa08c5a3a4ffdce81ca31873197d0",
-    "35\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 195\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = baf5afafd7d0c8ad42a44e4e0a90fd2c\r\nMsg = cc5a4209a6a60dcf12621e17150b4576b918732e\r\nMac = 5a43002d9144a1d5e48c2dc8dc167a52\r\nResult = P\r\n\r\nCount = 196\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = fa6405355bfb5065dc81e764d20277bb\r\nMsg = 5dd1febed8e94d4715e772c3295b48eaf471daee\r\nMac = 29e96ce5ba930134670b3c68b5c512f3\r\nResult = F (1 - Message changed)\r\n\r\nCount = 197\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = ad2e3d3af6195e74b3e43296b1f618d3\r\nMsg = ca776f79b8581014ae58a4d533b60483fd1fbbd0\r\nMac = b32ce1f493b126fccb9829d4dbe76382\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 198\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 04ae7190f0cabd117d30a359f80b720c\r\nMsg = b885e5e147f967032ab2552829a6e09210c44a45\r\nMac = 9386d73a01960ab399bb7d290674b21f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 199\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 51fdc65f6bb0d20a3c08ac1493ddddb2\r\nMsg = 1f0a56fb615b594d938bb8a27f4b2f5463ee9a61\r\nMac = 8506fb1b74806381e2654c8764464d8d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 200\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = cfb7e930b838dc3644f6c06f2ad0c8d1\r\nMsg = 611db4c194dbb54d80a4f4fa731cd9a6a330eaca734d3351f2cfebaba4bd541d86b3e35b4c1fa158edb0d15d610cd359a9c24878117f77f6b284f0363a576e0ef0\r\nMac = e9589a711f5d4a5a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 201\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = d179dfeead9d765d000462785459b1e2\r\nMsg = 795ee78ffdf302f3f1f2b31629ae918409cb42979afe3752dd14968d603678520e6b55884b5ebcce416248aa74b3cfe39dfedc2bb5246001503ca4d62cd7826f0a\r\nMac = f16ea84f554dfb54\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 202\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 22b7eb25e688672ab0e17206623094b0\r\nMsg = d830b16fa236a1dbe60f6db8d7e81a3ddb5f658c9f446e94639cae3699ec2ea6afb4fb152939d58df287271cf4b73c34e66eaf5265a623de47b135522c7aaf9f55\r\nMac = 16229efcb7523025\r\nResult = F (1 - Message changed)\r\n\r\nCount = 203\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = a64fa98b4662d801159f61eefd1c8bc5\r\nMsg = d5982c462ad40458660cd7b120ce07fce9afe812caedcebdee536ac19b5d561d679dee8ea85d62552c86093a2ac1f8d179dbd4fc006ee4b16ebe6afd2be134498e\r\nMac = 2f9a2fbcb96461fd\r\nResult = P\r\n\r\nCount = 204\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = e4fb10325d18666c382e6cc2442381e1\r\nMsg = dc28484ebfd293d62ac759d5754bdf502423e4d419fa79020805134b2ce3dff738c7556c91d810adbad8dd210f041296b73c2185d4646c97fc0a5b69ed49ac8c7c\r\nMac = 8f771ffe0c8d3445\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 205\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = fdcd3459061c36c9a0daa0dcab2b967f\r\nMsg = 1cfa3342540d03ec3fcc8378c021443ba3321fbc26dad7c5b859faba004a082a21d6d7a43d2836cc3820d1adbe4c55518714d48fd9346a254f702107da8212f605\r\nMac = 6635f9e17949a14e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 206\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = fc593384e6eebc508d181fc49ee10e56\r\nMsg = a6c891c9dd1fcc982c35bc74cfe71651bae424602519672b466d80e160af51eefccc5fcf76467a25bce1a10853a0209d9beffbeb53228fea5f1e77ddc956ade207\r\nMac = 7a6fd94e3928d2a0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 207\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 4e4ff248f591ca27665960d9357a8de1\r\nMsg = 198d5c9c4aa35d12b62e8c4bf6f3f141e6ebefd8ab396c71f55e32bc82b094cde409547383bcc4c5e5cd2cfd2d616c8ae273e260f2c98e93f7267424b8c2421bf3\r\nMac = 9140f91a0cf70762\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 208\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = f20826990acdf225d9451a3d22f89747\r\nMsg = 03d340904ace1cd52d4b72a96d96afd77aee68ac3936415005ed0d56f46036915b1e5f2994ad49effe7bf3ee46170642e5a16f2eea804e68fa520fb79529d6c09a\r\nMac = f30b668f16bfe6c4\r\nResult = P\r\n\r\nCount = 209\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = c231ea8b75c65de68c49b76e7a3128de\r\nMsg = 5b50879191a6debdb96c0bfaf9086b7dc6e25594416b08d2c75fe16cc347d2e3c7410fe3dc030a6c161ea22f6b80973bc43d42d8558f83b32a1bfa3c03757a4d62\r\nMac = 65ba53ef4711e807\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 210\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 8ef18639bc8c831dc0b4aeeca25eff4f\r\nMsg = 094c4d9baead7c5acd7dc58f3b4b4f57f1406b4e6af81a034d90cfa94c01760f4cacb4d2c63671d16d9594e1116b0dc2c39319523afac10175b1a485a240f7cf3f\r\nMac = d84f89e16c3b1633\r\nResult = P\r\n\r\nCount = 211\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = bab9d79aae4a1b282d8c5aa35d5c0876\r\nMsg = 02815f53c2be5f7246d4794895b4b15b6c3944819dfd3051b371f6d7d52d9f8ced84fd84095c33ea013c78aa5aa7176d6aa9bacabdafe9bab89cce4d7c183b9c0d\r\nMac = a01f976031bc8140\r\nResult = F (1 - Message changed)\r\n\r\nCount = 212\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 42b97f583f64d88358885c66add5d03a\r\nMsg = 187fe16a764c0987a28088f5cfcf55a6b9591b6395d2d41043e09932cbc4b8ae073d08d39da9799b316eef2ed89851a8cfc4dc1c6d3cbed95663e0ecf25403e61d\r\nMac = 0820b1ca0cd34e5f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 213\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 4fd555bd3a5253a90b68b5d4d46bd050\r\nMsg = 1ef253c61ac8ac66734ea80eefc1dc077edd660dc3518b5ecf709f10302925a72a3938e7449f2ae707506a67022dab63113242e9dff0d027aa3d22c8462a558165\r\nMac = 3770a6cc988a28eb\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 214\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = d3a8eb3f9e5fb264ff098d85c28dd763\r\nMsg = e97a0986bf75e0e821f5adda80778863d9d479bd8ac3e7fe64a053f8016c465d581487278ef6923610a1463bdedcded62aeb22fb210dde9a0949947f8c6a6e7753\r\nMac = 4947e6e28dbba216\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 215\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 3043857fc40be37fb0bda4f46894690b\r\nMsg = 14874a8b59b0178c5ec89cd7316d909371969c1a1a1bc8a29f78341d39ce085e7e2aad7c350a3e7b691d3929bc4b7b47fef56be9fe7e7520a00abad5308505f8f6\r\nMac = 1a8c82e9109a68a5\r\nResult = F (1 - Message changed)\r\n\r\nCount = 216\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = b325d425c810d22deb3209f29c5c1377\r\nMsg = e44c4202499440c12109296a35dfb1f669f97e7f415cd251a5e36943e134a548f0f2e841fa3541151b374c04665053382a24b99d731b99f3d411aa22644f66cd07\r\nMac = 84faaeb5a9756a27\r\nResult = P\r\n\r\nCount = 217\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 7cb6a84e99f5573c1eb27c0078f2127b\r\nMsg = d7fa7be9c10252d6e41bc1a08195a344ef77b81785cea6b4ba453d398bf6ffb31d80e0d6a45a4af283676422b5ca94c76bfb4334f61ae0abe884278976a5a3bd21\r\nMac = 64fa7f9284c24f14\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 218\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 00341fb81209c2abdfe3a9d607b98277\r\nMsg = 74f6fd37ccb4b7702bb3a03b7322c0d5fcc657cb2c3f1361488d853589d2d6207359b65d62d896ed66f217395000c2fa0d11f956332f2d4bdae55251adfe903b41\r\nMac = 4cf05b6e583c70f9\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 219\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 647a5be8a66c83b4b238975388e15d00\r\nMsg = 0db33eda4188a9165147e24e40f79fee1985eb68d51627287e9c4ec995a77d89b27fb2fa6a6fd3fb7563f3e710b6d20ca145a25f9ac8116d9f628395eb769f75f0\r\nMac = e8ef4f3cd7442246\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 220\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c98fc3416457d9eed0fa7ab1dc1b8a6a\r\nMsg = 190ae57ab8bb70464e4a10c112a54c646438301b5662f3536c26d754a02451d1a9c76abd7dbf656115b2a2ac702ec2cadae30cf86e0f0f96da39897d6222889428\r\nMac = 1bea94a457b2886e9098bf3ded932a3a\r\nResult = P\r\n\r\nCount = 221\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 87428d5a53f750abdb335f70ee13b5d1\r\nMsg = 7bb0c2ecfd141e7e93a897b259732b6153af3542eb7289b1a18dc0aefeb4d129c9e0e27d7ef25d3afc9945277e75cb87cc7d1c9cb39e7e6ab2a49bbdf65e1c6d89\r\nMac = a854d2da46afb77a787f0606a69cf467\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 222\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c725d9ef0dc6cfca84865cf5cc91d403\r\nMsg = d3208eb695e84c7a9250378e18be2f231ca3ebe72ba68e3ea4ff7bcf25206b43439bbd497e400dde738507cb542c7d6f961fb8bee99f0c8a6d9daf022368cc78a2\r\nMac = 35d57445a5f10fd567595fc668293e95\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 223\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 13e3fe7856cd680593a85cda3d6ff873\r\nMsg = b208e5a1a852caef0795150cf8313ee0cff06e3d28d438c2351484005661cbdcea6d8a3466aef0c6a460da4d7dc902ec99c073d086704112085a76dab0994fcab0\r\nMac = efb2bef5aae555463ebbeebe69791459\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 224\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 9b8112c1fb29fba2c8b0d8f16481b993\r\nMsg = f54105a04a4a02a1a07e020a6a4f4176e9c92bf40018ccac434988c650550c87625b84bd232d0e5ec20e6f6c46ba061b22a7fe36098bc7bf031ec6d6c1214bdb2d\r\nMac = 673281bc0effe92adfac4fef49477ee2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 225\r\nKlen = 16 \r",
-    "\nMlen = 65\r\nTlen = 16\r\nKey = 82e71e3ad1bc9a12a46e460a05ad9c05\r\nMsg = 41fb3dd6df78fe267175297e208ac753d50aaabd9edbf5e45385dfb47988b3d966f31be7a6329fd89e2869bc6f7e4bac1e3a0300f193bdc21c03d9629c9fefaa64\r\nMac = 36f7df58abb54a053988cae066110ecb\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 226\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = b46e219217ab73c34904e24c6d995b72\r\nMsg = 887d6576572a3d8f6a1649394248c4d09d15026ffa930c0659508bac4243e7360802af084f363c2bcc4c91a04c6e86f4f8b22615d7915564949ab60b8267cb91dd\r\nMac = 10c1d8054ac549ad24ae4af2d8de97e2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 227\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = b66edcc59dc9d8e34bea3baf4bfc0d5e\r\nMsg = 57caadbb1a56cc5b8a5cf9584552e17e7af9542ba13e9c54695e0dc8f24eddb93d5a3678e10c8a80ff4f27b677d40bef5cb5f9b3a659cc4127970cd2c11ebf22d5\r\nMac = 0c5864eefc04a6cac4f053ab2f65f851\r\nResult = P\r\n\r\nCount = 228\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c607f631d792499ea43586b81fa3e2f2\r\nMsg = 21ed22abc7bbb62fb2d51d1fb8830ca95b16213f56291af976274934ab0d43805f71d9b906c44973f7d4b59b7a94d35c2220e7405dfcee98499c1c1dc92a89d7d9\r\nMac = 4e65b3d58492a0eebb66928a8214498f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 229\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = d9e9136339d361949242e4d8a0cd6917\r\nMsg = 419b9c9b093052577837862900e7de29273eb0678bf6238223b59176c78430b6f382f27bc8d9a95b53f26f1d12e545ccb434fa0a21b84fa7badb5872e208254fbd\r\nMac = 6c81094aded51ccd4da38d0412e7ca67\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 230\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 6f349dd8b69dd41c6f246a1685115772\r\nMsg = a5a3c8afe5b84e0c3ba4f708a87b596d1b7c8694dbe691d7240e4e4815ad5aa4ca7e5b82c50989d092b96e80aa35e97f99ed79e75cf3b8750d0d263dc208289cb2\r\nMac = cbf41299c35e65fa4e2626430f95051e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 231\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c15e4e552c9197184b3eb0a74f5fffe0\r\nMsg = 7c4699a7d9e2d9f31410f20029676f3c97f5793f6732f95f6d33fd7ecc205d27b8e89eda803316a3cb9951f12111b4a6aeac606b43835a469eede86eebf63e5e8b\r\nMac = 77e77de5c5600900e5b928d4be3d5f8c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 232\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 2eda9b2c6d7ad95b644a8739580ab4a4\r\nMsg = beadccddcf392ee56a8913f057da183ab06ec538e581b52c027ff7f63574b32d8bc4116efa1c56f4a4a851695a87f5fc5f7c47b46fe67b0400f2599fc80fe68d7f\r\nMac = 948e63657b8b6e2d130f6f25369d6160\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 233\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 233088b67b741f07859d122a6a406d89\r\nMsg = 5717ed57ca0b6921f04dcacad34e0f6210c36673dc9f4d92493ff733c6e5f1c2e56805ef622a5f496049ee0ef51a0d41e9d363febb87070be558e8af61e86dc76c\r\nMac = c778152b00760fcd85bced0f58861d13\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 234\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = b7471a8b2e50fb319f198a09cdaeb319\r\nMsg = 385f9fb139dbf88561b7a500b0c7b835fe57e2698c6d9f76de4fae6dcd45c47fd8a0811ebbfba35f43c17aa360f09c767c1cd9b70bb671fa638e852ace97cc73de\r\nMac = 1a8b81be875a4814e3f988c274784a63\r\nResult = P\r\n\r\nCount = 235\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = adf072ebb71e3400a2175c96fb0007a3\r\nMsg = a49840ab727bf6b03015eaca3f15a2bb64fd27b51b27fe7a2e0559c287ac8fdd4294ca990799ff66974624b8a4539dade66cf7f06b35d8dd2f8a36e6ec0bc83533\r\nMac = ceac74b3af8750467e3b3c51624d96d1\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 236\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 1b1d471add4e7f4fe197e3a4a44d06ab\r\nMsg = da06bd1405028d93fefa3c037b5ad551879451a28314bae86a7591b359f56e4b4e26e6fb2fe7b1af0f930cc2ae785d113e8b16546d59dbae9f41e7827be1ac89aa\r\nMac = 16d0021b1f9c00b37fefb60af3358d87\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 237\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = af5d4991c189dada2cb552c3c52d599d\r\nMsg = 1bb1e0efa2d6811d2370a039a0c47c59683befbd46c04257f86a468ae25ba03304e865e62afae77a62b3cec7b3556aae0c60475a7bfb02c69f955c7f60cc8dacdd\r\nMac = d7056fe01f0ed1b20adbe05cbccc544b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 238\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = d149441e667b245d4640e04c53ca6f51\r\nMsg = cbb34794bc8bfdf93d3c8d9f87ec1482b516b48b1e8a89b5e3b5df70c423a243384215b4bc69c76c6b18c497cf82088af74839a8c98895869a16294dfc094360d7\r\nMac = 64f5e8dce5c3e0f9cc224e306de70b87\r\nResult = P\r\n\r\nCount = 239\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c2f5d4837f9f75fb440c3bccad7c2e69\r\nMsg = 6a84594c4b3865f047c96038060b5b413db0d4e081c62e405b815ecd9e3be651f8b9075dc8b032eb2f87c1416a5fe4195f51defe75f671f9a92d966ddf18724075\r\nMac = df8c8c61e8d604e24c7e3d0115dbe898\r\nResult = F (1 - Message changed)\r\n",
-};
-static const size_t kLen34 = 69750;
-
-static const char *kData34[] = {
-    "# This file has been modified to remove the 65536-byte long inputs.\r\n\r\n#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = AES KeySize = 192 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:38 2011\r\n\r\n\r\nCount = 0\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 771887708683bcb3577fbd0e6c13cad39955eafdc226d17b\r\nMsg = 00\r\nMac = a0db9bb6e8891e92\r\nResult = P\r\n\r\nCount = 1\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 733fd349c56d1086794eb20ed59ddc89b065bb8533b968c6\r\nMsg = 00\r\nMac = c76f82937b457105\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 2\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 761d74be5fae170a1bdfa16081b44c1e49972e15ce0818df\r\nMsg = 00\r\nMac = c65feb3d5336dffa\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 3\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 40f4a2261f154280a311f5b172c7ae34243cf2c59b98d37e\r\nMsg = 00\r\nMac = 05d920e78520839e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 4\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = e27150ee958b998c8a7e8b9324ead937d15580d09d6ffc3a\r\nMsg = 00\r\nMac = cf60783b5defbe3f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 5\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = d9bf5efb694089b2de533b1a65c12ae96d8c5bd75bd67fa5\r\nMsg = 00\r\nMac = ccde2029fb26c8ff\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 6\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = bcc658b2e53d51ed00c567ded2a124f8d1f85fc72dce5f80\r\nMsg = 00\r\nMac = 35d0d9ccab5b0f41\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 7\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = e31fdf3891c9068f621430315fb1daf418c328baf5e6da97\r\nMsg = 00\r\nMac = 8802047c11abcf2a\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 8\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 16a10208e91807fc479607cbaa39fa9c7273d89ce403b796\r\nMsg = 00\r\nMac = fcedadeca37381c1\r\nResult = P\r\n\r\nCount = 9\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 50fec559910391abc23eb7f5eddbc26a1031c0abd0a29ad6\r\nMsg = 00\r\nMac = cdc41e9b491092ce\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 10\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 6e9e0ae953b1b486ecd6b766d7b961ab79bcdfe2ffe95e94\r\nMsg = 00\r\nMac = 5096b9fc700929c6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 11\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 48043c405ef221c281d1e88246b6e1dda77e072f9d10353d\r\nMsg = 00\r\nMac = cab96cfcaad5cc20\r\nResult = P\r\n\r\nCount = 12\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 10c361934fd6ff77a5051879ff228b08d841660d48b4067e\r\nMsg = 00\r\nMac = 167e7227d59d65e1\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 13\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 867ab71470f2dc3f5f11f8bfa7272dfc9c888e8e03323103\r\nMsg = 00\r\nMac = 96d9e7b084448004\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 14\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 5b10c228b447968267293ede9131d9345daa18c11d71eff4\r\nMsg = 00\r\nMac = f7055fcd9e8a8fd0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 15\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 997b712cd9295dc43cc19b40679f218c27af3e8c638d2e5d\r\nMsg = 00\r\nMac = 79a13778151aaaba\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 16\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 465b9364b3f06f3c28da12707673fecb4b8071de06b6e0a3\r\nMsg = 00\r\nMac = 945198b568ed3db3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 17\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = d233ef50e0ce1924abd315510464ce22de377026529085ce\r\nMsg = 00\r\nMac = 240698cd0183f002\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 18\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = eb6e828e01930a4b0afc8bda63160942ce32df7b2c38a8c9\r\nMsg = 00\r\nMac = c68fc388f0633ecf\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 19\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 471b8a2e5cb08c21d87e9eb7ecff1d6e6fc2335581769dc4\r\nMsg = 00\r\nMac = ab5e7c91c35a0e91\r\nResult = P\r\n\r\nCount = 20\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 8b404993b4c3f62a57e4aef272788206c8076acc32cf3a1d\r\nMsg = 00\r\nMac = 6a3beff4d1d0e84ea4d4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 21\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7cccb84fa5c1c795bc05a05ea5bc6497acd2de2d193fba72\r\nMsg = 00\r\nMac = 557b8efe4ca9c4e603f7\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 22\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = f1d434dac8cefca05ba120a34840531bf1542c8fd03b1ff9\r\nMsg = 00\r\nMac = e2c299a2c5159eb777cb\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 23\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7fac8beb476b470e13a404ded315db1b15a85c2783eb3017\r\nMsg = 00\r\nMac = 50faaf26afd61c5f616c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 24\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = f5b4c2a9f096e13ab426dd8654fc7b8ae6a4a8d3daa16b9c\r\nMsg = 00\r\nMac = 535cde3d2c32788bf167\r\nResult = P\r\n\r\nCount = 25\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = f72879cc3446de9a0a43ae1cf08935b8c83f9265b8cb2258\r\nMsg = 00\r\nMac = 4eeea4a1847f2a30010c\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 26\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7021eaab074be980543cc70c809186d93652d7674c10ddd9\r\nMsg = 00\r\nMac = d98c93f4e0228ff68cad\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 27\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7fd546397a9a0129861fb6815d419a307f90d259d55f3503\r\nMsg = 00\r\nMac = 13597bb97e38f400e686\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 28\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 563cfb49f1af034cd38d2112685a52ebce8dca93e84ca10f\r\nMsg = 00\r\nMac = 866bc21135b11ea1bc24\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 29\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 17e9555b9b4f89cb63f2e90aca95c27ead6a099bc41c4c05\r\nMsg = 00\r\nMac = b04b3bd1719d35e80e2d\r\nResult = P\r\n\r\nCount = 30\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = a65d24bd1ab92d8d294d654423412860e113c976f12ed76b\r\nMsg = 00\r\nMac = 83c1c0f3e89f6584bdd1\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 31\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 35555c801a2e7c68cd0c347e0f006be00fcce70fdd8d60ae\r\nMsg = 00\r\nMac = 7e3670cab617e79b3f57\r\nResult = P\r\n\r\nCount = 32\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 138b3db9baca13bc66e893efee2b767ce6a912b172c2cda7\r\nMsg = 00\r\nMac = 4686805681afa38cb7c4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 33\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 1bc05440ee3e34d0f25e90ca1ecbb555d0fb92b311621d17\r\nMsg = 00\r\nMac = 1e9f80432b39f7318433\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 34\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 5776d94b577ed26820fb13c00ab0e2d1a1c3589bfdc45cbd\r\nMsg = 00\r\nMac = 4d5f56d3543abed97233\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 35\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 22e493c1f2e27c9be7bb07fc00fdd51089582d139b0a9f68\r\nMsg = 00\r\nMac = efe1c6493542a8412118\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 36\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = d52f030107a2becde77331fff0c24cd72ef62c0f46ae3e6b\r\nMsg = 00\r\nMac = d1b9c7f13b189cd828c7\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 37\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = be31363e5144d9ff49ee67efebeef6d9a97e22f8a3ceb209\r\nMsg = 00\r\nMac = 03228a1a80d5f3d87b56\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 38\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 6a46492ab7ae5f3dbf16ee7b8876e0b4f0449f3b4f8cd89a\r\nMsg = 00\r\nMac = f016af853140edf22d31\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 39\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 89ef2284d8245d87f88919d4d2f71a2df05ee21d85b7d689\r\nMsg = 00\r\nMac = acdbd54bfb1f20bb65cf\r\nResult = P\r\n\r\nCount = 40\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = f4e74acdeb91d0f0ab143823102d5baed1ffe168fdb5587a\r\nMsg = 00\r\nMac = 9c15bfd3c766f88190e54d395e5387\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 41\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = d9aa4efa5d75195a400018bd38f7d8cd53fdffe88df1837f\r\nMsg = 00\r\nMac = 4a11b22e871b051ea74db3f763f140\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 42\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 13439fb32b1514d48de6002f5d12e19e1ced4caf35042602\r\nMsg = 00\r\nMac = 1412aad5e6b7f0d924700b438e0aaa\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 43\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = ffead92a4a5dc1eec6d2e441de9a9e1b7a88c607c9a79079\r\nMsg = 00\r\nMac = 6fb18d51e9a30fe6b7a6f405b3d3b4\r\nResult = P\r\n\r\nCount = 44\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 176ad1686a81992e042d6497a305038ba0cabf74c6ecd8eb\r\nMsg = 00\r\nMac = f676bdc753ffdad36628b1724b967e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 45\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = acd58261bcb2eb6345af7290b1d216c3016af6697bf5ab88\r\nMsg = 00\r\nMac = a6ae95e5a23b5f5a2dd8c8a520b9a4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 46\r\nKlen = 24 \r\n",
-    "Mlen = 0\r\nTlen = 15\r\nKey = 0b5eb52135dc6d9c1f56a2571c1389852482e7aa3edc245a\r\nMsg = 00\r\nMac = a46221058177012b073c6ebc6aff1c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 47\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 7bd398d1b9b45f7a024e70e71c1ee7132795fbaa2d63306d\r\nMsg = 00\r\nMac = 119bc07d7f3da0be3a87844b425c0d\r\nResult = P\r\n\r\nCount = 48\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 47575b64fd4797cda8d67e9cf115ae850d7998c39d2f8709\r\nMsg = 00\r\nMac = 3f2010bdcb2fd70241475db9381570\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 49\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 68627d802cfc43bb1a987e1ef4401fa84e8a7b2b43759f50\r\nMsg = 00\r\nMac = 1e0e3333ca5790a7e7df0d6d4bf860\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 50\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 7f16b90a18deec135d32c836063cde963fc4e6daa1555476\r\nMsg = 00\r\nMac = 013e1d0bfc7a7a6c838ac98ce0da2e\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 51\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 3c89c59ab30eba6e5be8f69f597adc534cb52e94259780f6\r\nMsg = 00\r\nMac = 7f9f1bdba93d26cc3c1f022244bff6\r\nResult = P\r\n\r\nCount = 52\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = fdcf28931c91b4b79c8f8332b4eeb3f995eb1ed2fb1e8ab9\r\nMsg = 00\r\nMac = ad7f8852f1bfd65dfbce3bb39db59b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 53\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 8f570ddd0963a80abec82caf8883eaddfd63cee9f375fa7a\r\nMsg = 00\r\nMac = 82b16380d804b8eef855afb5eb839d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 54\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = cc1d70d3050f022442093e3210f5b45f1b610dc0f12fef74\r\nMsg = 00\r\nMac = d1dc61c2ef7e2cd1a4e43dc34c0ba5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 55\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = a8a1cf9547543045fa2f00edf79bd85436bc1ae1d746790b\r\nMsg = 00\r\nMac = 48fc14782a351553ea453a3ec2538f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 56\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 123ff732cccb535ec7a1c47a6b0ead68df31094d896709a1\r\nMsg = 00\r\nMac = 8f29dcec0a5d026d6fe4dc64cd1d4a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 57\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = ed06bd049d772cb6cc5a705faa734e87321dc8f2a4ea366a\r\nMsg = 00\r\nMac = e3fcf2590fa9ffe093bbfe8d3d7b0b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 58\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = fa18c0b348aad167b7050c0ef6e7caf0436750873c7e4929\r\nMsg = 00\r\nMac = 630915919b6108770f5c3deaece1af\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 59\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = f66296bf67b6e91d8ad629c1b260cb5ca1985273925e73fb\r\nMsg = 00\r\nMac = 729f983d3b49b2ebf24eb04368a851\r\nResult = P\r\n\r\nCount = 60\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 2f4a6501d8fe7b65f607757ddff6ed87ae0681b98b53331d\r\nMsg = 2361d2ed837c14b6c231daf0acf2623779e0d952e98e14149308807f79145c30\r\nMac = 9a8ad7bb37d79321\r\nResult = P\r\n\r\nCount = 61\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = e2d592cb412e65f9044257d78e7491f9f80c8b08102c2d5d\r\nMsg = 4163b7ad671761a3f27394776970b413e35a2c43ca85560cdd3c9b407bfadb4f\r\nMac = ab85ac3a4f92ee2c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 62\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1534e69565cbc541bfde6901bd6e598e41a7a703091c2240\r\nMsg = 85b78269899a4712eaa9c3de041f5a74766ec27dd5265da8a117c6f277baaa24\r\nMac = 6b177203b17cc7c2\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 63\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = f0302d9a197a285909657d611ce12458b8d24652e91ffe8c\r\nMsg = 3fd6b98961f31c7b7fff0baf1cbb5884a9290ea7b5ee49915efb4b510b6ccd8c\r\nMac = d2d84fac8ecb665d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 64\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 2081442435626f7ce377132c46385510d9febfdd90c3f104\r\nMsg = c4185eb75fc23adff60d6380006a1c20fa2ff466ffddf67e99a421bfd729188b\r\nMac = 7373df1900b7a3df\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 715fb6fb464513f3650a9d0c3687980ab9caa9876d69dfeb\r\nMsg = d60b3402ad9f5f09375862ae7a370f0c744ffaf5001c80e3fd150730ab848689\r\nMac = ba39c81c18821872\r\nResult = F (1 - Message changed)\r\n\r\nCount = 66\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = a4d9f94e644fbcd97e0d993cb0af507eed259fbcf8fd7083\r\nMsg = 677acb68500d6cbbf77a3f34f58840f0c16044827641dc43d6767ce98f85dd5c\r\nMac = b129c1785acf17ba\r\nResult = P\r\n\r\nCount = 67\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 94b911cdc3137a6f7f32651b788eb82975660aea52b2c03b\r\nMsg = 549aa84bb182312dd016e3107f3b1f9c5b6a89b543561a450ccf713c76e66ad5\r\nMac = 7b92156f8b36d5eb\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 68\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = d3fff7b6f08dc4256239fc112890429fa00393e84e9b294f\r\nMsg = 15d1522654bcdce344b5d9753a0a6f31c859d547edf520478a8b5ae41506d5f7\r\nMac = 2d778849023fc9e9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 69\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 77bbda69ec034d73e02b06f0af30e2dab60ac80cb7822eb1\r\nMsg = 1e6ee96598bd014c95e9540f5cadfe6885cd094e04048e81633d1d634f065f09\r\nMac = d35f3c169f67b597\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 70\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 544a757bc50658d7e73b25688e7fef86fb1f9f08ffb33a70\r\nMsg = e473fe5656713b3b0e4fd12c640e8c542950577f446b01d09cbc41b6393ef81c\r\nMac = e1dad03ab8d2f432\r\nResult = F (1 - Message changed)\r\n\r\nCount = 71\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1bebfde2d5468ba0a3031bde629b11fd4094afcb205393fa\r\nMsg = cf27b30423bd7e40d6b3aeb4b1bc01b40aec081aa00f2e3bc63ff61ac4b684dc\r\nMac = 617fdf927d0e4e42\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 72\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = ab83567833d2f3461b5fbecc0e366694bb5ea00933b2b3e7\r\nMsg = 58d43b9f1581c590daab1a5c56d6fbcff749e489acc3ed51ee6aeeac0104e6ae\r\nMac = b29232e882dcb8ef\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 73\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0e0fece7b6b659b642668e8ba3dca330523e70279155f485\r\nMsg = d8c35129ca5a84e2e6723332217f0fd2e19fd06eb27d84a93b75276270f97335\r\nMac = d7ea4755260630e2\r\nResult = P\r\n\r\nCount = 74\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = b15763294afa61bc27e0785500ab5739136f51bc78b65562\r\nMsg = 8e8271b2758964fa71520f26aab6f870fa76ea4aa220475b3b379ec4ef8e80a7\r\nMac = 6357fb64482d171c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 75\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 6dd6efd6f6caa63b729aa8186e308bc1bda06307c05a2c0a\r\nMsg = d2c9c1300f5a7520614550f9d23dcba6b41be6733426616f32912f155045282c\r\nMac = a12adaf849719778\r\nResult = P\r\n\r\nCount = 76\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 35631c844313ac335aa0d590fec472d805521f0905d44ca4\r\nMsg = 766f9ac761a06f4e006f405f7b3398aecad253f5cb8653e091e17427ff0fc1f9\r\nMac = 49090265af87c220\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 77\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 35008ef5baf263ae233758ca237dec1a51d67fcd3573094c\r\nMsg = a8f1b7b73100cfe1a03003331d9d55b75fb0d2596ede723fae9240581967ba38\r\nMac = af6c2ebe004c6d71\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 78\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 6f383f798df8f4b9f0a99206cff82709c367340c7b3b0401\r\nMsg = 9668a011e5a3a613ddfd149b0e529e9e66665006f98e730400adb4a8226283af\r\nMac = f97fcc39e240b547\r\nResult = F (1 - Message changed)\r\n\r\nCount = 79\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 9071be7a11dcf7a062d582dd5932f047396fd9eb71982bcd\r\nMsg = a8a6703044010f8301ea33bd9a808ca35838c9f58683ae3925ab67b9e1fe1ccf\r\nMac = 9065cbc5249ff8b3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 80\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 36ad69f192ae4dcab771aeeacf01bbd32609bcbbea8ff9df\r\nMsg = 6e60fac7c027aed4632444a95824e61e2c50aa3ecdaf09ed9cec92cec35adf63\r\nMac = b6bf70e67b315c256f41\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 81\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 0cbb1d567bce009d1dc5bdb8115607213ed9a516389f728f\r\nMsg = 634efdf89ce2a9fcbd38bdc0b4cece54dfd7532880e0b4ce6eb3a4010b7cb1e7\r\nMac = 4f0af4ff9a9c9e844fe6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 82\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = ec65afd2d72bf477c7fdd9fbe3f1694c328088cb5f39d9a2\r\nMsg = 10d0e88b0db8d515bdff3a791c830b28e4e3ff4fa63f45b31a3f73dfb457bf82\r\nMac = 7172095284694f5ccdf5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 83\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = a76b981540ce229e73064af4474a7ca4a042d03a6e6bdcbf\r\nMsg = 740d4b25ca7221d0826057701a6bfd66c50a82f010a57be8c5efa0af0f761764\r\nMac = 94b657fb57cb2fd6ed3c\r\nResult = P\r\n\r\nCount = 84\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 36bf85bf63b28093d2dae511990a0bbd75184044b033c66d\r\nMsg = c1fbbae61b81ae",
-    "bacf151f1bccfb1584f3a211fe797996938c03e806392e14c1\r\nMac = 71796cf452f61db7f540\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 85\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 67b79d9ef1a47867c7d21f19f99ed1085f17a9f092fac689\r\nMsg = d354c54151c9dcdf0d0fd8c51413c2645efafb2bf6b680b25ad76d3825a4c04f\r\nMac = e324e8d377447b40629f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 86\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = eafa8699695431ab3cfa1e87ffeae4b822a391653d2e9d78\r\nMsg = bd647990f7afec76c8f726d1de806ca0cae6f708b5024b514f11c4320913724e\r\nMac = b0da9d38a1e821ef1f39\r\nResult = P\r\n\r\nCount = 87\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 1fc4fcbc73dab4e73ed9d7606acdcd42b74972460c640fe5\r\nMsg = c86553a60da69bec1924788fc3ab985158a2d4788f33c01abead80974d26dd67\r\nMac = 992fd0b735b9fa9255c1\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 88\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 618041501dfcfdd2b60d71c04d635f6357ad8b0643af77aa\r\nMsg = e7e6b57e74ce7afbde3697e2a69d61ca615aa3dfd32fe31f5521e6ca79877613\r\nMac = c183b8f21cb2aac7201a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 89\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 53bcc9e9244e2fa1752c61e65aa5c592138447ef9287fdcb\r\nMsg = 92e962f0086591b6f61c2ce5af62480722ba6a640c3f53806c421de438358721\r\nMac = 105d286777da3f2a03a5\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 90\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 6d2429921f90a22893cb65c4530e56068e9944d0b0f61fa7\r\nMsg = ea2ad7b7d3f80793391af0328fbb594d79898e1047210628bbc7441e135bfbe3\r\nMac = 482a75ec0ecf1ea59f5c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 91\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 3100d3c70e823fee9a1bf486ec1c56771acae35246535de1\r\nMsg = 4e6ddae0d805afcd10a055bce584c848d050fb29fe8f1c64b18e1abfe46b6578\r\nMac = b0deaf1bb6d0425d1810\r\nResult = P\r\n\r\nCount = 92\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 79aa6c03dde4bc5949921563264b440ebef71b3298da67b9\r\nMsg = 879954f977e945cd4db33d20e6749a6832677adbdd9c7e262e4acf632f665f45\r\nMac = 9863fe041d191777067d\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 93\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 85467aa82c22ab019f9243c203b4371c95604dccee5d81ef\r\nMsg = b86edcc59dc9d8e34bea3baf4bfc0d5e117482a48e522c1b02a370e9124b379e\r\nMac = 54b2f4664eca96639f7a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 94\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = d37e7aa9215cb5c2c2fe81834f200192ada3dd0f4ccb9d69\r\nMsg = 064f85a23e049529c74c4f8267abbbe685b6a838841a9e304fdf14b835eee396\r\nMac = 536701771f51d2ec354f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 95\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 72e8c7d74cec3e248fe938a1159d8d969928e6da26b8cf96\r\nMsg = 58019989445d5ee855e0ffcf84e76f3383ae09cfad74276a3edaf05cbf8d714f\r\nMac = 182d3bf14cc391aef27b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 96\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 5f847950d2a5d44137110594d3c0afa995b36422ab36d044\r\nMsg = 70523bc397417e09d791a4976960e02636ca7144a5681cf7b116daa33eface2d\r\nMac = 5f0b325fbfaede23de5c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 97\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = b01e84220a7d514060a79088b754ac0beacb60e5b3a47020\r\nMsg = 036137cfed567fc5e234f18d6c2b8c7e9ae0f3fa526d6596e9a9ee7bf1abdf0d\r\nMac = dbe49af18c1e1bc99b73\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 98\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = d90ba47d7c9107b103cf167041dbd7b41d96016d93961917\r\nMsg = 2d53836a0437ccf27cdfe2bf2ad53f3082100a9f045cebe6b3031d21c9a6c5b6\r\nMac = 7252ee3b5eb76abeec9a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 99\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 02e5a1306f612bdec098458cff3e691d93f050ba11ba6273\r\nMsg = 4bef96da992ab9386a3463213773f3ca7164813a15e014ab819f153386fa04a3\r\nMac = 5fac9c1a1636b66e2f55\r\nResult = P\r\n\r\nCount = 100\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 4c99ce359b8b82b67ee990529a10f2ecceadad456925a57d\r\nMsg = 89ed296a3ac03fbfb71422b9211799150b9d766a8116bebd48bd0a5068132dbc\r\nMac = e0e9583d784f87e0b7dd8fd7494a81\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 101\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = f085fb257ab64013b43a59150864a31e76c9ae94913a56ef\r\nMsg = b90ef6b773f250d4dac6fb9e62babad69ab424c96a8c0625987c030a91d27d64\r\nMac = 96f1dc9a1c668bb203428181c016ec\r\nResult = P\r\n\r\nCount = 102\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 8109f3208d5cda0f12141e40c85959b72eff1a937dae7f4c\r\nMsg = 49ab30d5c01e91bf113764342cb8ad32e6af945341a9c6a0ee2319a910416fd6\r\nMac = d13777a33f9520793eb8cbcec047cd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 103\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 1eba29062320df7275a51aa090ab489571057e64f0ff6a52\r\nMsg = 754f03c2e298a699568d10c3e40390e0f8c398283ce1c35dbc4916fe479b87be\r\nMac = 87dcee48dfaa43e8223a2b338b220f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 104\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = a04b976fa01411bcc9a3863cec91f486944fdca6e8754615\r\nMsg = abf45f39904a8f5766763fe80fa189ed9c6c15bb1a7a8fa0ae3058c9e5b87c63\r\nMac = 577aa39884335a4f66dce2a612515b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 105\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = c6f0a3692c9280c48393b0dd763e5d0b90477f34ad69f192\r\nMsg = 737bab64c8a0fd6a07329bd729d2ec88685cb5404bd13a40e095a61846dbacbc\r\nMac = d61ad5f6d8aecb7b3fc1ddb1aff64d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 106\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 095eb52135dc6d9c1f56a2571c1389852482e7aa3edc245a\r\nMsg = 47c577d1a7e69828b5c3264738dd334be8d7678ec77bf1ccb5fec3843f85ffa1\r\nMac = 4fd309a62435edd9b1ac8861f904c1\r\nResult = P\r\n\r\nCount = 107\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 2f853c1ddb31694985ea5e47322bfc8567fd7a74a46b0597\r\nMsg = 5719e671686e87e931c2c0e5842e907bf584d226e040645eaebb896b53a28c7a\r\nMac = 75ed56da2db0ffa101578118e3f620\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 108\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 67f5adc0842d7e1a4f8591d678334c95ac83df95c4341c30\r\nMsg = 6c8aaf2f91ba87b61814ed689331264c7bf98c2223c426a4ebbf7b0db692a8d8\r\nMac = b7c591522e9a5a4f3af3aea24121b6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 109\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 8702cfd1ff87a749ceb0a7192f5a872740b7fc600845df4f\r\nMsg = d29b6a2d421abd00a59b756af34bd72a42f5557a2ed40f8a7ea59b2e05ff01d3\r\nMac = 33b597665d375c95464af2ad56465c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 110\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 64ec1fd6af554485856b7bb3c0ad16fcd9c4ec690914a09f\r\nMsg = 0418a0afc13d6215c7bd68b12a327587eb63c145120ea626fce59c16f7d66717\r\nMac = 80a85e77efe4f47d8938dd9c55d67e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 111\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = f2991112c2cbd3038ae37b772a5090690006009f0c1965dc\r\nMsg = 231d72c9325f8c17aef4efc94855803eb2fc1eea601c84a98e8f7053840f0591\r\nMac = 14269c545a0e3d56ac9cb195cb6197\r\nResult = F (1 - Message changed)\r\n\r\nCount = 112\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 2c6d7fb9e92d98a1dd92e96f6b4013954ce1aaa5de242e6f\r\nMsg = 87ec7423f1ebfc37ee83c85938d58259efd16e3c8e55fb871e9998baa9cac81a\r\nMac = 782b7ebbada87c3572a3918a03305f\r\nResult = P\r\n\r\nCount = 113\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = d95a1b24964bfea5dd5a65f5a1398c6f9d43b26d98b47816\r\nMsg = 92f9cf56188322d18cb41d723847e6d419cd163e2be71b78e7b8dbdd099a99b2\r\nMac = 2498787836840fe1411a17f153c546\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 114\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 62f2490ba0c658848859fcbea8cc6774e24c9de979dd29d0\r\nMsg = 0822e3e6ba982091d532cd5271fbde25305d1f6e71880f81c618f267a9f122e0\r\nMac = ffb6c2a6c73245138ce06e458cf914\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 115\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 1841161a3752de1491b2b2f519d8447636e149437478d2ff\r\nMsg = 238e36b73b474de88226d4298121393ac9162f1736040bcd717b6e8db85125ff\r\nMac = 4d1656a2c8632260aa55a097451fe7\r\nResult = P\r\n\r\nCount = 116\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = d7d9a5f750078f1a82dffe2c70e6b0016eb42d13e1a8aad1\r\nMsg = 28a107d22fcd0499e0ea5aceda6dbc288a5f1d9da003c626bfb9a6c27922e9bd\r\nMac = b67bc2e20c422f9c7c27a84ba0bcfe\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 117\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = dc3ca30782c9c0a7fe8923d4b8d31aaf21e63895f51fb2f1\r\nMsg = 8716298bc17ed51aa273711873e2c2863e7a5021e46a183e6c6c81f99c02918e\r\nMac = f41b1896a22db30dac50b6b3e5e2b8\r\nResult = F (1 - Message changed)\r\n\r\nCount = 118\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 0b6b36339122610178c4bb72eb558abf15e5ed9ea0077a5c\r\nMsg = 52839f2f0853a30df14ec897a1914c685c1ac21470d00654c8c37",
-    "663bfb65fa7\r\nMac = 665f05a489f8ad0feea290401b4bf2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 119\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = e200414db0255ca3faa7f6b17a62523f2c75d99f6ae162e0\r\nMsg = e749041b314f8719e17a8cb26162e2c910b31116dd769083149238d67792f991\r\nMac = 713fb4d0c95743ee7da970cac7f771\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 120\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = ea77165284ada4599f0bc0a41db787310f53a1588282b866\r\nMsg = f3a1a6dc2092ae7099bda65f8af32aa19796254a13fd9e0e7319d50402598faad6ccae2a028604db0d44690ba3530bfc8bad062cd96635d9654647c57bb81537\r\nMac = 9c7c379b5f8ee87f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 121\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 18e2baabdcebcd25958eb53d1bd2a95ffb9b51a3c1d92a9f\r\nMsg = 1df7392e915726847822817cb542df6b14df16d7d3d3ea8d615fe9ee651c938a0234bef059d139c350d6b01192cecfe1d821aa0b668e5d4dd8d5ef9a1eb47db5\r\nMac = db521506073b8c9e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 122\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = d39f12a9c6b63c17f116bc003f4def172943350e29d60258\r\nMsg = 75225a26d63e91281fb37ace46354f81de99dedfde8b770ea47f08503aea87d8d7b190dda9e150ecd1a2a182b06676da61667a04864ff4374838ee6899d8961b\r\nMac = 65aa057a01b390ec\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = b2212ca369c611b725eccc3daa58df412787a3475f418d82\r\nMsg = 3727bac9706f482f55bda86dc052aa6810e2c1137b97fc93a65838a2724a9531199726517b6fed53b24d062eec7c22227ad9379b24da7658c0cf7ecc0368cfc5\r\nMac = b869a9e06994fb39\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 124\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 25e5fd5c39e684696e71a6f81f843a196dcd030ce2c07afc\r\nMsg = 899b48338d5ec3bb4a681f76ef37b6e25357b50e9578d85204c3753d3b6ebccf908e3de8b02dab01839ddf1a560b1ff33857a17fa4244b96612bbdeaa7d4913c\r\nMac = cfb0650c7566dc49\r\nResult = F (1 - Message changed)\r\n\r\nCount = 125\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 49bc9d3bcf3c22daa8cf55c1b59d4bffddc2412d60518e98\r\nMsg = 980026395d0544975dffaaa2c56db1df5816cd80cde513dc76f6f81d21f15c383c97c7233c9af2423fb28922efed2f69aa47c30de17ae1c5be17acbd0ad6cb8e\r\nMac = a7ed2a35c89130ad\r\nResult = F (1 - Message changed)\r\n\r\nCount = 126\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = c53f21f1ce3a1792a2de14277eb97664d4c561b3fd4b0e32\r\nMsg = 66e15206c23751497bc2c8d734aa1136aec08bd4e80fe3408bb3929a84efa749f379c7eb441872929b71872d761e0b448e0126e9fed86eeba611694cd2df4cf5\r\nMac = 1b86a912a0ec9f94\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 127\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6286e3e53ffb9bb143fcae724b45f86a23bbd74c42518144\r\nMsg = 62766e9acd41285eeed9b4007340dbb611699624274ad1179e327076135d907638c60f0c773c4ea8d9b8352027ee78ea4f22198f083d2f5cb920e55b9738c582\r\nMac = 3c56ff841dca9662\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 128\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 9c5d43c1a1269cde199509a1eff67cc83a1759b71c9e7a6e\r\nMsg = d576565a938782fc7e9b095db6213002bf5bbfdcd761fd6d876adb2c7947702b8930a5f71ec332bfbb4ac9b9d13d90c2d808d5459d0dfe5ddeedbe3e14038fd1\r\nMac = cc7b2038ead10d8e\r\nResult = P\r\n\r\nCount = 129\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 512a23489b8d6b62b63e9188c0ee5016f20448c082eefe82\r\nMsg = 1fdbfff7941ba22dd8e1dd13a05a3bd8f2c8096894266536c40a983929d0a6340af5233bbec1477363294519d3f3d9c6d41b20f18f76adb54495d9d43bec5afd\r\nMac = b81c76829839cd43\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 130\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 20d22c3b6ab38c5995e22b341f359be25616b2b8c7269510\r\nMsg = a1c041d1d4e7cd6a953f2e4837e3e676ed48633a2f15828f5f3551d5ad2a19c838a49caf75529bd5d5f89b3da2c2e9922ad8dc5d20325a7b3fae9dcd305f3731\r\nMac = aac4d4f4172e1f05\r\nResult = P\r\n\r\nCount = 131\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 22e29aa7547e5ed3a64611e04f1d55f7a397c1619669879c\r\nMsg = 773b577b95e29d36fb30779d2ea23e2ffed9e1b46aede42bbe03a904fe22ef8f874298b5f4a6afe63f6ca9522863eb5cdb1c8d4bcd445e43e7302875e6ba3592\r\nMac = 16bf98c7a5deff18\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 132\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = b320edb777d317af6c933a6530d9f5cb78d2d3104ac02120\r\nMsg = b31d3f55909bb660628de9eb95b75df776455f2f535f461edcfdf8a0cffdb096d573fedea7400f8374e62e30879a8beb259b3bffb4c3813a235b4c59853400c1\r\nMac = a0d9a7da024326ea\r\nResult = F (1 - Message changed)\r\n\r\nCount = 133\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = b9bcd0ae7100f991f4365ba0683b6d461979ffe86d0ecc24\r\nMsg = 19d0077952eba12a01db1d137050bd7e9102a31242eb38a5cfb3cf51b86c86cab57f6deef8e6eb9eb29c5dcdd852ffd627641013660b31abebd40fab60514159\r\nMac = 972119a55b125e0f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 134\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 00af010f462ad40a38eefb788b648e1cc292cd4bb08ebeff\r\nMsg = 573db0961531873316e87090f79e84f040c8358f8ca78fd9ea1ebeda82c1cff67c2ebbda1da0a1b233c1539cb4c0145da2a4a05431e06dac2c2731d59581a434\r\nMac = 92a67a99c128e173\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 135\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = e12f98507d6514c3b551d240595346bc9e9b6a987033b3c5\r\nMsg = 3927bac9706f482f55bda86dc052aa6810e2c1137b97fc93a65838a2724a9531199726517b6fed53b24d062eec7c22227ad9379b24da7658c0cf7ecc0368cfc5\r\nMac = ef48edc762db1d47\r\nResult = F (1 - Message changed)\r\n\r\nCount = 136\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 66fe8076d4e8538e18b84f965255d143f1c7d377e099c1c2\r\nMsg = b3fe18cbe086955384226c11c62c1dd14e7eabda573450d005b46fd9f9eccaff24dbf5d6d8530b5e25fd9f2a629df5c20a977247cab35255d71d992d85b04c14\r\nMac = cb67f0c1819ae458\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 137\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 82233a224ed122d7306bd6717a80fa1986964f9db41bd40b\r\nMsg = 65c46382a278490b9825d4f1907f3b9f196e136906067020b6b94ee398cb2f39ed07055dd0b151d974bb8d56ae3bc8b3b31d9054221514bd45d88a5f948ccfb1\r\nMac = 27e94d22e8961f92\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 138\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = d3e3bd80f45140cfc2f857a913a89f0c7dec86790feda4f9\r\nMsg = ff26ab66c6a10ef910f5b94589b24a7b6fae8e4396faa552b014603fcb5eee921bcfb81ffae989922debf24a6947ed6b1556c02e524b247c3966a7bc636a4fe9\r\nMac = d2d326c999095b39\r\nResult = P\r\n\r\nCount = 139\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 466fa94c2158c1cd84b83fb2f15ccfce804f611ad0fbc4fd\r\nMsg = 5ea068d4f363dc7f1badf97b77ec85412a06dc8d8e3f4364265c7956d4088f014c78fad6c94be720ffb4ce4150da4a3f427f288031e0bdd241dd7daf975acabe\r\nMac = d6023f6ffd3c788f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 140\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 6f5a146524457615d81a605b38a5ff03edbc5c426ec7d551\r\nMsg = 9be3a736e7e72560bea45e9c8ee8bf37c279bf5b2ef16483adcc093208c05ee51a4db04632946ba2b96cdd9d15b33c25cce2eba4ede4f97aac29ebaa4cf6bbd3\r\nMac = af8fd676ee05154b82c3\r\nResult = P\r\n\r\nCount = 141\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = c62e6eb86b8daa37936086dd2c346e3b14be5054cdc2f3a4\r\nMsg = 559407bb6930d5adbdf19a7e285ba1dee5caa03ef54e3a3fc1b8c86a02f55921de9bf7d553c22d7ad915c6384329d664e70dffaefe22ed9c4e2c233706aafa04\r\nMac = e297ad7830c79d387ac2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 142\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 225557b0faca3d6cbaedec5c39c98f0ba0723f4070f2278c\r\nMsg = eb1383e84d4bfc5a9dad25374055b81eec74316b18f6e001b0623d470c027b7023456000fc61538b663cb7c0e98d77a7fc3ee2277816bacb4d9487c6741e3134\r\nMac = f07332a3b01d0e8026ce\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 143\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = c36acf733d310e3b9842b3006aa637ab092faf4a580043b5\r\nMsg = 1d674eb5d85945a6c7842042adebe549d4fe515501c06c1ba72961ee5bc98d8588afd6fd64893e21220db7ea6a973a420613130dde1d7f6a26677836d65bd0d3\r\nMac = d629ef50a784db860de4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 144\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 332e30ab63b197e79b86e4da732bad9250c0a5c9976a6c67\r\nMsg = fb41304f9f5b0f696ddb0e2f0f57bb091f8a31b5324d3cdf15c3bdf256d3502d06db2df9bea24c7ae08fcd641f199610427f3ecf24b92a7e00aef55aeba71516\r\nMac = 983e453f602db30e1f85\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 145\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = b311796b0519a45c176f3ff458d4d818668093e82fb871f4\r\nMsg = ec1a1e9ee85cf960e5dc4e239619ed85f4b14d32cbd42dfa79f77a27f2cd740d08730de2eaeb91d0eacb8c498336e99b9a0c57c4045ef18749251dbfa733b4f4\r\nMac = cb2be0fd09f10deac5cc\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 146\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 6311e7f0a7bcc11176fb411fe719d4e0782c8935524776f3\r\nMsg = 85f647d940a6d1acb6b7851912f807063515631eaabaa019dcfb993",
-    "e86f408266cace4c24940eda0083d8569364dc1afb816c0e5b95f3bafe7745e5ddfccd6b1\r\nMac = 776b9642c47fabd7e9c8\r\nResult = P\r\n\r\nCount = 147\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 6d120cbf74df2efffe98397ee303ead4e91c5e7839b82885\r\nMsg = 27ea9ff8359463a7742cd9c9c269ee678f4ab22091fdaf29b9007a92658687cbd71c4166e68c5a1ef30160191f6d926abb28f1da01da9ae8019a520edd576346\r\nMac = 5a902959d73ac97ea071\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 148\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 8e09d421e09dac1d9d966f02a3a520972c6aed2003d907dc\r\nMsg = cb32cb87ed59ee959c011211ae7cd475c3b5feb21cbafdd0b17796d47dc4d4e61da345b399c2661182485be13dcee33a9eaa8cc4b9742361f4c36f1361381f1a\r\nMac = 1b2bc5956223b8801456\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 149\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 3eeb143d4a3c08ecd9f7df8eba42789b517dfe99e07958ed\r\nMsg = 3292b8548a35fe34136457bcff52b469eafdb1b86b6cc88bed35c4cfba43785c59d6b01c1acb6870ef1e3ccf7dad20b1733f51ab1bc48cdb2fdf7d86eda17a00\r\nMac = 3a85ae8fd368cf9846bc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 150\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 606452c62290b43559a588bb03356f846cecb0ccaf0bdaf6\r\nMsg = 3cfbc77b8897b6a5613f62f6b1c89b0d68f272c6c19b9e0ec6331ef616702006e64322d3460a57d3a5074c719811cb5dd78900268890da0ac177b40d48773548\r\nMac = 325aa552529e66a13904\r\nResult = P\r\n\r\nCount = 151\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = eac3a1a6eb8efe983c6b37b6c2709f5a8851ab72cb23a66e\r\nMsg = 2801a813dfc3f1c753f4f342a113c09b8e9a7ac16483c31bfd0b746b1db692f805937eec44c16bfbd132154557afb17ed01c1f4c55fe67f0343a6329441fb955\r\nMac = 5b0b383c4870af31a9a1\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 152\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = e2d592cb412e65f9044257d78e7491f9f80c8b08102c2d5d\r\nMsg = 3f63b7ad671761a3f27394776970b413e35a2c43ca85560cdd3c9b407bfadb4f1edd0e6026572ca0d8274bdaa6870749b0a727aa8c5b7e9442100e0c9b057455\r\nMac = 0380cb126c63bb48bdb7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 153\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = b7b86dff6746145aa7d5bba73ed6a46da5b1200bd3520357\r\nMsg = 8e7f7e7e3ac2286bef6822ef47f5f73f2ff512e599df17c3723f7a55d4144a367c774de67e7e52ca3760c37484da7a2531d1d590b5380de11c34c3fe447edc0d\r\nMac = e7aaf6f82894d8825d80\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 154\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 70a26d985e6b99bd3a37575f011f2b84ed84bebf99a52760\r\nMsg = a2cfbcfdcd90e0962f233d7fb70668c8c36cd5e195e2ef5c043268f47187cecffdd36000f96e1f509f00283effa040443b3db15cf73d55c30c65f0fd7cf9c219\r\nMac = 96d09f0a799cb52575d0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 155\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 5d678acdb2e6cc03537411ae2e95da120161ecb6c92d5e23\r\nMsg = 91dee0cd1d17d9342f4d346cee19f5f42e0c3b0498447ec4043c15bb2ae8fb8a7a02d2da489f28932c05fa4ea9c0760e0cf3052a97ed898edffce3247386b98c\r\nMac = 4a40b4f63330413918a7\r\nResult = P\r\n\r\nCount = 156\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 795846f9dbf36415640276642cccf87e3dbdf6519c5b2db8\r\nMsg = 4fc989f327e1a1cc7b8af618ee6ae6d25f78e2b76b681455336945655f13fd5a639bec3a004a88ad0e2df8547a0d315b8ba15f5269038638df6169d960f5ab5b\r\nMac = cc5efa5ef19f6cc63f83\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 157\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 61eab54142fe7e16787fd2d54829cd3c4bbd793e72f9ef9e\r\nMsg = 13f079b004d1fdf02121564f0a96b057f120899ce920169561d5e3aaeb16bb8e4347c7cf8c86f9acdc25ac26fb5d845a68409c0d9df0e089940fb7a88a76e62e\r\nMac = 920de91f34eabfc31648\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 158\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = b64d00f3a4df754fa4ee6376922fb67ccce0c6209f677397\r\nMsg = 8003586af34bdd0acae4f5547394245027c2ffcdc9d1335311acc859e9a2a7b817755a601dad14495d32f1ad811a7e751ac07cf18716e1cb193c203e7551aa83\r\nMac = 79e8a0ca036d7b0bd2c0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 159\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 98f4596970e6515b5357f6c6396aac182d126decaddf567d\r\nMsg = 65737b65927aebcf6cefc7ca107fda8447e8bebf1f08a280d53a4b07f8e35904cc48cc08eda3c63a3475924bde1de6acebaa65fec5ee68ca22d3fe722bf33267\r\nMac = 05c51c2507108a3f8293\r\nResult = F (1 - Message changed)\r\n\r\nCount = 160\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = f0409b050346fbd319c8630e4bc9dd6d055355fbb961f018\r\nMsg = 731db98bd990b2ea19f848fda3519b32bc1d2fcb2f4d42e13f655da8e1dc2af428c185fc01a5d55e20b49d643a254e8675d560301d2ea0c5984ecce39c655de9\r\nMac = d37deaceea7ea3b50aeb02636e5095\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 161\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = f266cec01c5fc08c0bdabc9537bd1aa2df9f2b8ffbe5cc94\r\nMsg = e19cbaa489a0f65681c983cfee3a4b699339ccb096df06bc871398be9eb926d84426fd32d5d7fa4aa563a88b41afa822f761560d9897a9747cd85b3dc74b4adb\r\nMac = 8690d4f8153e56e3ab80c7e918679a\r\nResult = P\r\n\r\nCount = 162\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 6e12c112720ef346bbbe7d1c19483721b1c52c438dad40e3\r\nMsg = ab8b36f46d1749cde7dd9936df95cdc8e0b359b8963bff4e7bd59599b32408623354a15e29f287a79801866d434a0ee9cdf37f931e53a39509057c7f2b3b413c\r\nMac = be9e70fdd15f96a8b7457cb727caf6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 163\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = e9ed05813262fbe769c1104d8ba5c836dbd229a22a681de3\r\nMsg = 606452c62290b43559a588bb03356f846cecb0ccaf0bdaf67a18abd811d4315a966e2f3f87f6c2428814446563fa71864d97c8336b0e34bf9466ec95598398cd\r\nMac = 4b3ac19f4dfa04108283b0e2e3a8e6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 164\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 0c84328951c66e0f5341b741d2c2796d3524ef732c69e779\r\nMsg = 9071c45a99cb987aa79596a2014f54e6fe400a6bbd5de96e156cae87cf69762f1329d481213d213d42191312fd76911d8df4c6ad9304754909058cf477adfbaf\r\nMac = 1e1003ce7546009a3ba7f59dec236d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 165\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 3aa8ec246323db7a3953737928061c79757de2e921c27643\r\nMsg = 84e9cc9bb7f4fb62ae7396859fcf33da5ca6c80c311eb392107afeddebebe0d662a887879e4014187d2fe8feefb01e6fa0d35819d7cfbf139e99451423b62ee3\r\nMac = 4259d5f983a287fbd987e3badafb33\r\nResult = P\r\n\r\nCount = 166\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 66c07634c94dedb5d4c6f19e7cdeb954692ccf51fa242abc\r\nMsg = 4bbc9d3bcf3c22daa8cf55c1b59d4bffddc2412d60518e986899d6a3e2a781668b0c6b9b4ee0ddbbcd06bd643eb201fe7829699e4dc86e2a1b4876bf9e40494f\r\nMac = c40f872ea2f1a1b45ab5737c2e4f33\r\nResult = F (1 - Message changed)\r\n\r\nCount = 167\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 3b9d6b0652836457ec4f701f0dc0e5aed73d16585d61cb1b\r\nMsg = df7b23a4e4456e0152b24853fe0d5de4179974b2b9d4a1cdbefcbc01d8d311b5dda059136176ea698ab82acf20dd490be47130b1235cb48f8a6710473cfc923e\r\nMac = 602941735206bbe57ce1c2e3b9509d\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 168\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 7253ef10bbc302f01aecf315f9a4122ba805dc4048c30ac1\r\nMsg = e12f98507d6514c3b551d240595346bc9e9b6a987033b3c50940442dc385634e2a28292856b97d5a78704388b2b6d0ff2ce7a19c64574deac593b98a7ce98bd8\r\nMac = 9e62a5b8851d3a0fcddf06fe116ac2\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 169\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = d718af395ba3f5f4c6d15c24475ec7f0f74f3238c81d42d7\r\nMsg = 0c0d3d7ff5d1b707be9648f263b8f013fa439978e959efef57d471cae02dc8e08d9d58d40381169afa039936f1f773c72003c1c5af03018725ab2408236ee4ea\r\nMac = 75749ed44b76d7ac16c98d8b6bc18f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 170\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = ec98ec44f5a86715014783172e667a748f162c5c26a8b34a\r\nMsg = c0947efb86d54644087247f9fd95133a94075faf6250a2cc9f20df5393edbe1a4bdee20e90e877781a370a7f00cf9eee7373fc38acc54aba23b0df3f020356c9\r\nMac = d994553290066d778369b54ae06668\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 171\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 9fab32caed6e1cb27d2115cc641779127d4aa57db0955bd6\r\nMsg = 6e3e25db29da2c787bb37755ee770e2402fb8208da23389d36030439a143f971ecc880dfda90a8231ddebd2881981ca968ed45f3763a32ec8d2fe854fc2e4b4b\r\nMac = 4d3cbf9b68da0c5b49ab3b0913a2b1\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 172\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = aae24266e5981b2ed14213a29f961cbbf7f02f63a33c987e\r\nMsg = 8244cb416b3d09521ac2fd28c29084ff3d64761d46617b59e8b221de36702c2d3dc62e61375357b702cf8d4dd0f2bf2a1f91777fec0baf2c23e3e6865bae7358\r\nMac = ab8e9df7128f4857e0a1c24fbce473\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 173\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = b9bec4e88775777ff1eb3df671fe8ac03a693a1c26ea254f\r\nMsg = 8eaed4810702df8caa",
-    "12fe7e26e7ebbca11aa2de9f3169a8262c0e3c205a708f0071401aa8de09d28a5a6e590ebeb476341880c37bfee1a501229081eb27772d\r\nMac = 273b0d874010eac97ceda34232f7ee\r\nResult = P\r\n\r\nCount = 174\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 15120ac9468fa30c92ad87e7aba41ef552814e4ecbcb9350\r\nMsg = e3de6c6119d7db471136285d10b47a450221b16978569190ef6a22b055295603c9c1ed5da3bf96bdb43a5722cf4e2ea087cdf9b23b3093d250d44047be634b3f\r\nMac = 9a166994de85e5d60b154d49a867f4\r\nResult = F (1 - Message changed)\r\n\r\nCount = 175\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = f9b9633f12967f1841161a3752de1491b2b2f519d8447636\r\nMsg = fa14d3656f7f7610f3a629bce14648a593250c6f309c02c6c552bb42984ac58db920dbc7d98f59295f37f3e9b99da55ef074ed65801b390366669b4c7aa1c483\r\nMac = 2c9f3650866b97ecc5ed66929f41dd\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 176\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = e87275bc62ad067b121b83f220d4ee2b4245541283dfadcd\r\nMsg = 6475757f30dd0a96ad64bde5c2605a9d2ca82a7223a9ba4c39b6dd3f86a0f4bd02876d0a32ef8af1071664b603862f4b9de6bfc6e7154b136e7a72e661957bf4\r\nMac = d0bd2d3d35a22f37bf113090cebecd\r\nResult = F (1 - Message changed)\r\n\r\nCount = 177\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 8b63d3c794e5ba0e09e5d5a5c56670bc0e289b30171ccfa4\r\nMsg = 44da1657e4be60d887a097e29d03bdbf5920bb0504e654bd963f58c487951a72e395237a9d32281125ed3a533c543de208c99bd063853abf79ddab4692c3a497\r\nMac = 29d04b97ac302fefa80f71ea378e7e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 178\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 17039577fa27ef5ac3bf97572d9de5f8eac0aa58ff29b990\r\nMsg = b0329a0978e5a2d1bc85bdca333e7d0d1e9950217ee9547a84e76d3f49999451bf787288e8d12d40456c8214926c14e9b076032fe315c1633d5d21d85acfb1b8\r\nMac = 51b4bc8b479dbd60e5de94ba8b9d0f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 179\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = cf6b5edc515882f8a7954a5d8517b1a85e9559858527d0db\r\nMsg = fde631afc6c042d77b579dab9298862d943be673cea59eab4a0c1b5cfddc2aef42590e6d8786d18a4646d7e338c2b984c50a50adbeff0fd64e7096f02e8385ee\r\nMac = 5ee3547a06661661c46c3778b0823d\r\nResult = P\r\n\r\nCount = 180\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 7b6f4f158422f33543ca90dd0a76cbb23c0dbef26ee140aa\r\nMsg = 6704dc39a259152d2dc3f08b8799ffecf4e1bc38\r\nMac = 5c12ff63244c64bd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 181\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 7a381f75058b85680061eeaa0242d3a16a64a5ca50cb61fe\r\nMsg = 18b31ed5ba1c3ac562ff3ef274424b86c0815c26\r\nMac = eb8f3d508c9edb8b\r\nResult = P\r\n\r\nCount = 182\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 3662d7b7c93211535c862ef3dc2724c492cc1e53a58f23a3\r\nMsg = 8ac860504258c134c6835d4cfaabdb316c36d99e\r\nMac = bc1b870eab5bea9d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 183\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 9eac76976750b7937b3bbc6986b4c726f0d0a63310db85d7\r\nMsg = 5de2265292780222349ac793eaa17c5a22902344\r\nMac = a69594e569230df0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 184\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = ed1531500f319e09227d6bd181786b3b446f081abff2e697\r\nMsg = 7a734243e53cee654be988f5c735b19bb11f3389\r\nMac = 9f2cc2a8c3d0a34f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 185\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 85d0d04cd3fd2fb34dc18fd55e645f7492d5280657577008\r\nMsg = df899dd6b99cc28d66604ca92431fa7f442a4927\r\nMac = 18fc40b25fb9c138\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 186\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 90b0c8b542c91c1b2dfdebb589a7eced6c9b7b43a7729840\r\nMsg = 38d1a87296529595acce251cb232db8ede65581b\r\nMac = 077570fd0efa770b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 187\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = eceacd807db82378e9bd7c79054878f09dcb5087c2e1c349\r\nMsg = 09bf4f77a9883733590a3cc7ee97f3c9b70f4db2\r\nMac = 58af901fe0fb5d29\r\nResult = P\r\n\r\nCount = 188\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 16227835305b7586a3106d93da8bd70aa0025df69a0e85dc\r\nMsg = 1a223362dccc99472b2cd1d712ec6dadd60ef972\r\nMac = c26f3980d17f6c36\r\nResult = F (1 - Message changed)\r\n\r\nCount = 189\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = d18cf5dbf5b2094dd6ad85d975449e2dda35b184633235ca\r\nMsg = 7f557e74f53c344daf7495526d1270dfa8fd24ad\r\nMac = 5b7cf33ec05b1576\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 190\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = f1681287bc931a0d8f296e13b3584d6efcb6ca76aa90cc02\r\nMsg = 08c62ff9bd7bcf189f530d5065f8764532d2692f\r\nMac = d646e2ec15afb14d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 191\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 116f4855121d6aa53e8b8b43a2e23d468c8568c744f49de5\r\nMsg = ab91d1aa072947d22f0dc322355a022fe7f0747f\r\nMac = 489068c07931ee9d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 192\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 0a23972e036d62199ec327b25a3cf4e14c29279c6449d3b8\r\nMsg = 2df3e80fb6ddc1fcc7615330b24fbaa4981441c8\r\nMac = 7842f16a0cc7bd6d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 193\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = becfa1c96686b04153fae144c187f034dac3ee6ed70d867c\r\nMsg = a3a114679ce30c8472149da9bf3a42b1ffb07e66\r\nMac = 74fe19b5183ed3a1\r\nResult = P\r\n\r\nCount = 194\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 866b43c8fe3769ec0aeefd4dd02210488a354d67e82a81d7\r\nMsg = d9bd6ac153cb0bc4e19e59c45cfe0d6f4c9d20a3\r\nMac = a3a2ef83eba2a6f3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 195\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 7e00aa080c127cbabfdfa5d9d9728c7b25358aecd26f5850\r\nMsg = ce1a38cd75b9e955483ab53fe59649d087ecd1d6\r\nMac = 8375c666d09bf259\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 196\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 4bbf4c9cb6758329b2d5a53c4fbfe2d3df4fb50e57b3699b\r\nMsg = 6429ea2cc8fdaf58100347d21da64375b3ab2058\r\nMac = 77e417a60bca9a9d\r\nResult = P\r\n\r\nCount = 197\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 274b394da9402d3eafdf733994ec58ab22d71829a9839957\r\nMsg = 2b3d7949805afd73234cd327a62951b32c51df2f\r\nMac = 8f9ce09fee15516d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 198\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = d4140d988448d557454c3434fd77f8597e6420566845e316\r\nMsg = b53017500c100dea0511845597214484fc5f7f34\r\nMac = b9e85ce9178b81c7\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 199\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 43d0d326c511e3bcf4f52660fc3c706a6a95c0ab550615f6\r\nMsg = 7c880698ef372304a663f0f02944500393585d42\r\nMac = 843f71e93b22f1e4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 200\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 273cc5013785baeb5abc79c8bde73af71085d7018e7be92a\r\nMsg = 086e6e3a21787acf7293446516b5f54da95a2988\r\nMac = 658a112d7a9e7a08c024\r\nResult = F (1 - Message changed)\r\n\r\nCount = 201\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 492bf7946bce1d3c6f168f4475e5bb3a67d5df2fa01e64bc\r\nMsg = f7b577f1396b23c27eb637e53d3d92460270b001\r\nMac = f2dffabed6871cca2e41\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 202\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 8e7d8a44244daa7df2b340993e32dac50e05d7b2e103be98\r\nMsg = 2c3c3582e026a3f29ffd21a92a8e1ee70f3a4147\r\nMac = 1bb40d091dde1903ac0a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 203\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = d2069266b0f180cb319e30ded7535bbe52d24be151de4bb5\r\nMsg = 392d567f0b8045359dedd1591517ded0171fdcda\r\nMac = c1ca2813ad38fd7f0f58\r\nResult = P\r\n\r\nCount = 204\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = f35c46bca9236830ff4bb057cd5764f02720ccb03b253937\r\nMsg = d4586dbdd5655cf659891f5b6015da524548dbbe\r\nMac = 4b6dcc78f6e0e9b7e35a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 205\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 509f1e38591e03a30a7409bc7e18595848253308c15edf40\r\nMsg = fd2109cac9f42fbb093a8675e5cd962c4c31df2f\r\nMac = 35387ef3967eed5b579b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 206\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 0e9cf0ec43ca3fb7fb9a2b1999ae635d5041bf42f1b0bea1\r\nMsg = 65960c7fd43891ebdc7bf862b28d4822a8488270\r\nMac = 93c33247ca546a8c3fba\r\nResult = P\r\n\r\nCount = 207\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 51597a4c68cd228371e86c179fe04492642ad9b888405067\r\nMsg = cd8799124d94064f47d7eec59aff543b81ac66f4\r\nMac = 0eed36a27b40560b89db\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 208\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = f9f049328f5db22c41a501088e5759ef4d04db0c4b4f6d3f\r\nMsg = 7bdc26b5b4df58af539d91eb2ea10263a3e58b07\r\nMac = 68c45551f1367c989a9d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 209\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 5343dacb05a29b3119d6f19bdfbcd6674950e710fc70180a\r\nMsg = 057c2d386fb1693b845bef585e76e0fc",
-    "4971ffb3\r\nMac = 372a801d1cd33d1059ba\r\nResult = F (1 - Message changed)\r\n\r\nCount = 210\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 5987fcfe8a1ee76afaef54cb22d8b2a20b116f72bfc7117f\r\nMsg = 8abbdf380c668c6ff34a4f128567bfaf256570db\r\nMac = 5a8089b3d9f6c72fc858\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 211\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 301e0712ce74a1ad02079aeb0ce35edacc33f9a5d907cf70\r\nMsg = b2d894833daef4070b764361685fc94a780a7292\r\nMac = 57a225eca09fb227f79e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 212\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 144840494d15b2b31ad63ee05bf579a5e9fb98f534a6309c\r\nMsg = 71bf573cf63b0022d8143780fc2d9c7dbd0505ac\r\nMac = d1b2baf05cdd5fecd1cb\r\nResult = P\r\n\r\nCount = 213\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = b4bc602dc860108aaff5b3befb948a561ac495a22af9085b\r\nMsg = 3fa85ca50cc4c4817e951b5a95ac006973324c2f\r\nMac = daa1246b82d2e14e3056\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 214\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = ff48804c82414ff67f9b917a4d5d062d439454aad8eb4b0f\r\nMsg = 6def37d9b73fed0390f260491f582d2215369811\r\nMac = d7712f7d5f0da5dec6b6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 215\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 0273e421ee670be6322675f26f9014c040a76f0c869698f0\r\nMsg = d9de46934cb56e58899a31fd14ca64509131dc27\r\nMac = b3e79909c16c561eb7ca\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 216\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 27eb9812d3f7816fb6a1cfe474496e80750b1ed3959ec7f5\r\nMsg = 776ba7990086731ef7504947be74b3c455bfde5f\r\nMac = fc0f2dcf4e6fa041830d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 217\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = c56f710e39deed799ffde6d10e8aebfa2bab5e5e073d78e2\r\nMsg = f6fe0f16403182d012f8b6e02539c386075b4585\r\nMac = 6bcc4c1b06099220e9c0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 218\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 0236ce1fd3ef645a64b4ee7048dd35942e6a09e8099884a8\r\nMsg = dbf06366f766e2811ecd5d4384d6d08336adc37e\r\nMac = 1de717c402baf964e817\r\nResult = P\r\n\r\nCount = 219\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 5cf781067bc1ef948e929b7287279c71cae5143631ca57d6\r\nMsg = a7f3fb7ed1342862247fb4b1993788837cc87041\r\nMac = ee867d4c0f910e9d9288\r\nResult = F (1 - Message changed)\r\n\r\nCount = 220\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 3e19b6f3f3fa3c2551466c9e09f0391350682495426fbb08\r\nMsg = c7496322ede893ae368884a91f80c3bac3505c0d\r\nMac = 55b25da032db8f3b4293a4865df77e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 221\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 5717ed57ca0b6921f04dcacad34e0f6210c36673dc9f4d92\r\nMsg = 5e3ed45f07a6b3c225ba73d04d867f9c5b4aa703\r\nMac = 1b642dcc4fa08cbd36d109d55a8501\r\nResult = P\r\n\r\nCount = 222\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 8eca0fb8033e63e24a54a3e63bcf8e4ec331b04ddedfeeff\r\nMsg = e3807f6d8c6471ffe188df67d952a7d67021bf41\r\nMac = 9a37eda1e3331bf86d208b2c0338c9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 223\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 633f44dad6995a6af0302692142a47430491ae7b54f8b00c\r\nMsg = 3caa9b8b24097d29bd24b913692acf96cc78b998\r\nMac = a6665b3b158f37f587dfa0bde7f300\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 224\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 14ef8096666ddf28e0ac5f3458b52f3e0c601deae57fffc9\r\nMsg = 11d5cef384474f33c2d313e6e1050d8c7ae5b019\r\nMac = 2643bb3e1c01f406d90104c4437189\r\nResult = F (1 - Message changed)\r\n\r\nCount = 225\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 0c2e1951eeba1a9b6592202b1b8547f43fd755fbd844a874\r\nMsg = 9ad62bff38e28f75302b6527c1c107543f798817\r\nMac = f42ff7aa728c2d815ac7c701b59627\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 226\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 1ee2df7aa80e3a131e2aad9c17bcbf546d8b25e5a849db31\r\nMsg = c4e8594cd09be010b6934157e0557686310e8dbe\r\nMac = 34496d184bbdc0c9a57916ff64dc3c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 227\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 75650ce366757618af20205b69af7e5d4e82c398c00101e2\r\nMsg = 42a71eb81ad1c97ac53b88831b2d15f3c57e7cf8\r\nMac = 4c03394a98bb43e6197074abe63070\r\nResult = P\r\n\r\nCount = 228\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 386c659bc45d0a88acd54ef7eeaa3e140e1cafb1b01474a0\r\nMsg = f4fc5acff75d404849675b813cf7adcaeb8f3d56\r\nMac = 5cfb2fc8869304428fc012a14b616e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 229\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = ac192759625f4e42d1d1fa73dc0f62199142155615478f88\r\nMsg = d33f716df06e9047f8d718ab1faa06ec7b773bb7\r\nMac = bbf5b7207faa5b004216fa5caf3f93\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 230\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = efb497fb9b85d472e7c9d061aff501f7b1e3a311a86cfc69\r\nMsg = 1fd425560816aa21d6572150d1161cfb3bd61e6b\r\nMac = 2b7e14864d29437647cc1b27a8a0ad\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 231\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 344fbbeaf82ede8a401df7cc121ed3da43be9bcadeeb5614\r\nMsg = 93febc9e16003cc8d6490ba5a6e64dd673a0f887\r\nMac = d34ef878392bc226f7ce1519f3bc23\r\nResult = F (1 - Message changed)\r\n\r\nCount = 232\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 4b6c6b6be3c04985bff49719c4e11be97d7757801dafadc3\r\nMsg = 754336f8cf27f4bcc7af5207ff02a662232d9a62\r\nMac = 5389c533cf43ca0332574802c2ace3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 233\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = fe5ddb0645387cc6535e5b7991e6428c4157a76bb41084fe\r\nMsg = 216d9eb896edc693520f99ac91f34cb54e76d719\r\nMac = b43388ba7859f803655d914b60ce90\r\nResult = P\r\n\r\nCount = 234\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = ed14373671cd8041e00874b5d098ea225eaf9c68bb51cecb\r\nMsg = 0569c6be9ddcfbb82618fdcfcab3dd60c20c49f5\r\nMac = c2c11297111a92a484868179c5931d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 235\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = f2faab6735779e9ac49716e7fcd3faac939366a7249f4f0a\r\nMsg = e7292269b07683acf5bea0b300782749074e2313\r\nMac = e10f324c19d79ed83256f15e302699\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 236\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 2bddd90daa1251a42a0e2fd2858568887f85e6d96d57daff\r\nMsg = 0f8b828c0e59effbdecc30abb6cae0d9af9c7636\r\nMac = 1aab0530749ac4c6432157730ee3ee\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 237\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 586233e492b76ade095e8f5ffc6df4bf6caad2a675953b2b\r\nMsg = 92af89c950d6221473a358dd0f280277bde7ab0c\r\nMac = 2a79121e68ea6b841e175ab5066388\r\nResult = F (1 - Message changed)\r\n\r\nCount = 238\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 5aea45c0995e950f333e29f4db82ea4c4c080ff82fe32bd6\r\nMsg = d9ff1c84bdb03114ebd5f471247a579311f4672b\r\nMac = dc58e7582cb555ea784036a8ba4b8b\r\nResult = P\r\n\r\nCount = 239\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 900c8283c7d50d6da79cc07d3dc7b76c2ef76100fa3ae2df\r\nMsg = 3f8c6d21ec05bc439bf82774f1812bd2dfe0d3c4\r\nMac = ec1fa18916f991d7276428b9c93c70\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 240\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = abbb803150cd7fdb9f3d571bc749debe72c825e45568aa5e\r\nMsg = bb5fd7f4fb020d38c13df3003a9bb852a86948f406c51624eaf81989b006\r\nMac = 799d598f32ebd9cc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 241\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 2fa619eed51bccdd2ce63580ebf85467ac9136f79256bf1b\r\nMsg = f92d1a6731f3bdd811fde1ed936de907ebbc4179670857859aafe788b91c\r\nMac = 6477feb7dd4c818a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 242\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = d0115f369d0f74073a46e3b9625660847dd7ac7571e40814\r\nMsg = 97da5d1f669dc60b6c6fe4369e01f3fbb9af30b483b23d885497c684d6ef\r\nMac = 3d7f0acc627b785b\r\nResult = P\r\n\r\nCount = 243\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 045c4b86eed865cd989f035afe8c257c400c11b1f72548c6\r\nMsg = 5a6233e492b76ade095e8f5ffc6df4bf6caad2a675953b2bdfa8513df1dd\r\nMac = b5a44479b0be31ce\r\nResult = F (1 - Message changed)\r\n\r\nCount = 244\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 4a83bf338fc0125ee1966df46d46a0d0b41e51569b3fa957\r\nMsg = 794a86f5b20d344ad86fd5523d08f1864737be57731440c29aa6b4257457\r\nMac = b45939cc01918eab\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 245\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = d9ccd93317441e9d6ccc358f31e7e2ccef8c921b23d74299\r\nMsg = 48754401bb69bed2cce8689e47210435878c7ce184d911f60d26b4aa5174\r\nMac = e0d1b6a530944550\r\nResult = P\r\n\r\nCount = 246\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 1e50fae752ac3a6e2b1755475e84441947e9f4b1d29546f4\r\nMsg = 34245df514f6c273d252271a980929e50a7cb0e77b05c7d46092abc30493\r\nMac = a0fd99f1405b027e\r\nResult = F (1 - Message changed)\r\n\r\nCount ",
-    "= 247\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 4f98838899bb47fd3b0fd5efcf55403996567a0fbe1abdda\r\nMsg = 0c8cc752ae8d487c621be129326513a5ccb4141e324d21aab399148c1a83\r\nMac = 1aef1b7bc7856c6e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 248\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = c98a22a667aafab0c94047e03837d51b11490693d5c57ea2\r\nMsg = e4fb1612e50607457dee8087ec41e57fcd7fc550497eaf1c8b0d47c773d8\r\nMac = 2c467fe37fee5342\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 249\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = bc6d4c46476ac1ea902be391b8a3f04e102aecead167f0e4\r\nMsg = 93b3314baf20e28a39e89592012c35adfaa3ee6d3d8e494051ee9944aaf4\r\nMac = 7f10757d2d36a55d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 250\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 5783548205826853ae740d35d6d69ab524c38fdfc5c51eb1\r\nMsg = 11c90809f9c53d2f77b56af0a42287ac6920e3d2921cceb824d496caf1a7\r\nMac = 07630c2fc52a24b2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 251\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 9cac76976750b7937b3bbc6986b4c726f0d0a63310db85d7\r\nMsg = 5de2265292780222349ac793eaa17c5a22902344063f497aabb9dc038ce2\r\nMac = fd092bab159861c0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 252\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 616de0b0f868eec923bf9edebbbaa51d3faaa3f86b2a5687\r\nMsg = 38013d62558647bc21d293830aa3ba80ff3fb84a8e0938754c5213077771\r\nMac = b4e782780989dc11\r\nResult = F (1 - Message changed)\r\n\r\nCount = 253\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 5df77b26f3d34eba49d287addf0a38d20514e2b7e6059935\r\nMsg = 1930a8b428334df9fa1ac16890f3a6a93fcf9d6855d00b06ff831d8f6a70\r\nMac = a8ad975046cd7571\r\nResult = P\r\n\r\nCount = 254\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = c56f710e39deed799ffde6d10e8aebfa2bab5e5e073d78e2\r\nMsg = f6fe0f16403182d012f8b6e02539c386075b4585be5b18d6ae1c5f9ebdff\r\nMac = d0df47dda012655d\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 255\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = fef8982f7342f1b953658453cd5ea413700eff00f1ee7d6f\r\nMsg = 269b6c1c95bc079398bb31e285a887c1832202d6ec257a2cf62468e29358\r\nMac = d2c90040bf66b2a6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 256\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = a34dfa24847c365291ce1b54bcf8d9a75d861e5133cc3a74\r\nMsg = 105d2b82676bf67ca9575ffd31d7d114e709826fccb6a5c3d3d7e26ff258\r\nMac = 5e60278f98b3135c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 257\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 520fe80cc4a3a5ad9c31f7010504923b7a7fd88292a64f98\r\nMsg = 2e1e0712ce74a1ad02079aeb0ce35edacc33f9a5d907cf70d0548d84ec3c\r\nMac = daf839ef84f1c81d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 258\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = da4775b8f7d654bc4cf2eb75ecf4831411bbc9a960ea2df0\r\nMsg = bfaccce3a9e66f45e454090ffedc348306dc2807951ce0bf100178612703\r\nMac = 3e2eb7f029e687be\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 259\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 15e3b3c5794fececd703ac58ccb22a78e15bbd55c579416b\r\nMsg = c6c3457ffcb6e66c085ecb69492deaa704e25aeeabb7b7795fdcc807b325\r\nMac = afd75cdc02222e65\r\nResult = P\r\n\r\nCount = 260\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = e0f2cdfb64bda8f02ab90620fc5a1943c4b536a99f3f8820\r\nMsg = fd0365ff6061e5f55c0e382f5861aad99c135f9511f33ace4bdcfe48c6e4\r\nMac = a1046d4b29fc50ed94a4\r\nResult = F (1 - Message changed)\r\n\r\nCount = 261\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = c7aafe7d3b419fa4ea06143897054846ac4b25e4744b62ba\r\nMsg = f1baf3be69f69611fcd47256e43830a1b3fd8bd3952eb26ed679eda7a4e0\r\nMac = dbc419e1ddd5cfdc63a7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 262\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 58c219f2bc8ef2ed7a82cf70e4af4747e36a30809a5a6222\r\nMsg = 622642aa69b3efe14abe0a1d2ba20f3f76efddf62e6cafe2845c4dfaa501\r\nMac = 4e496c3d2d84d11923c2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 263\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = abccee975feb10f635d548a8502f7c8b6adbd2be74117257\r\nMsg = 4f37a460d180a12789779fc335326c983ad6b18295b47f1715b82b2dc704\r\nMac = 41b234e0173770c469b9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 264\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 0218eb619dbbde2e846218339aee4383792856496eb3b85c\r\nMsg = 28d3510a37d5f8481e7f22941c1fb1d6c70686fbad9747a23c9d5f18dfe2\r\nMac = 3cede44c942387d91767\r\nResult = P\r\n\r\nCount = 265\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 88b2514f368d51db283039efcde1891652a77daf68feec43\r\nMsg = 067a3a0434e92cac02710221fbb6dfcb7ef0264e2994905491317c8c3697\r\nMac = 128e652ce0a8f1a6194d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 266\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = f2a78c449621278e9e927fcd50742d042d98d5142380fd3d\r\nMsg = df899dd6b99cc28d66604ca92431fa7f442a4927d03b392e707b548b8ebf\r\nMac = 2eca3c42b5e5d0f3b9e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 267\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 01fbfbde7dfdd6f0a0c5244cf6c36eece4d6dedd8baa463b\r\nMsg = 485ef613bdab5473763bb269a0d8c7a4bf4850bba072a96f8fc39a31cbd0\r\nMac = 333eb331d6a0d46fa279\r\nResult = P\r\n\r\nCount = 268\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 6ce99c231d2ef0fd48c2375dca93f8bb0df97d4a44e835cf\r\nMsg = 32d71e59634126ac6c6156a80a0dfa0175b29e9f40a3169680b1c15830fc\r\nMac = 3e90350e115c425ba466\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 269\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = f7a93aab5707ca3d2362c5669198e0218493acc3cb7b02d3\r\nMsg = aeec40ca8964fd6a67d3dc871ebf1bfb72f52907f1d6ad441bf2cadcc6d8\r\nMac = 7381d65aa138c86713b5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 270\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 84f39f5207afcfd677a7544579f2b888a1eabdee4e835924\r\nMsg = b8d21e9c70bf63f04be311d50f84aad7e1bd2b0e517434ab978d68d01c5d\r\nMac = 4ab61c537f8b15f824cd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 271\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = d488bdda400932de56a9f105f0e74ee79c2ed869faaadc31\r\nMsg = e64949ed85de6359595f286e29014c26daa7759aee56e4194ee958774606\r\nMac = 2752bc490802b9dd8686\r\nResult = F (1 - Message changed)\r\n\r\nCount = 272\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 76ddfb075fce4be8854185c6899a88d06e24854506b31237\r\nMsg = 9d86ae7d70e839078babf7fd60480a4351690867c6a8af837d9ad465220c\r\nMac = 2522efecaa1ba11c0260\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 273\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 618041501dfcfdd2b60d71c04d635f6357ad8b0643af77aa\r\nMsg = e5e6b57e74ce7afbde3697e2a69d61ca615aa3dfd32fe31f5521e6ca7987\r\nMac = d958753757a11eacc848\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 274\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = dff6b9493de80447ee18ea7311fc9b8d74f77ac1ab21ce84\r\nMsg = d70aef3532bdc5293a3ebb11589ac1f801c9f93ea0d656e1d04068facf9f\r\nMac = 9a761e0e54767e414cf2\r\nResult = P\r\n\r\nCount = 275\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = d7780ba2dc5cc584472b64bc9f6246bedb27c70aca22c0a3\r\nMsg = 14691c1b47ff1547c1d2151913c2d1862d8f54782291ea202caa3d8ef07a\r\nMac = 78a2bf3a5fc87a14e090\r\nResult = P\r\n\r\nCount = 276\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 3bc5dba883e2e3b81df06760cc32f11009cf5a5503cbe864\r\nMsg = 9d043e368b41acb5eebb99197e15adbc3d19175a0bfcc97275e3e5efcfa5\r\nMac = f457293acf683c873add\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 277\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 7b3fba25c5ef410ecec62276b105ecc01c325dc2530e8364\r\nMsg = fda4bede287c57eea4448af5e99d41c7d307d1f202af7f387f874342a29c\r\nMac = 0cfb78ede5f4c185c33b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 278\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 38efdbbc5645f65414b9cb81d2f9e4f190cf6e6e05eaedbe\r\nMsg = 50422c5e6a0fb8231b3bb6e2f89607019be6ad92a4dae8e0fe3f9e486476\r\nMac = 0c1acd8e8527e2663486\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 279\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 94ea5b0aa6c8b07e379122006042c920077bd61610df6b4b\r\nMsg = 1d52f401f01058356d8c4c630f64c5322caa6063d6365ebf0040ec4ee12e\r\nMac = 2dec0d3bca617209b07a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 280\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 5584994f80640233ac8eb4d2f873e8c997499095250b48b3\r\nMsg = 91febca4f1ae7e27501400c44ce8681ec90f5a5637c962db142c9284b1d1\r\nMac = f0b3135c1748e823aed10c4694fc60\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 281\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 57e99653fdcab10135a2ee3bf45c1be69e9ed57bd74dfbad\r\nMsg = 51c88fd98a7d82043a1500fc3d8a66ba7ab7760467c7fd89cfeeb22dd257\r\nMac = c588ee1d4f330e51872065c02cae61\r\nResult = F (1 - Message changed)\r\n\r\nCount = 282\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = f622d736124641bb7d53706bf2a69db2fc31461fb92818be\r\nMsg = f09569906",
-    "381138cc49e3fc2384c5d33c34abd3d617c487b52ec6ee7b510\r\nMac = 610e1c1f9ab35059580061b8662a81\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 283\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 9662baae49c26e5452f3304ceed3b78326d2020a99a63f69\r\nMsg = 1d93aca4e2e31f5ebb84fad580fe74f5b6d1d86ab30cd0c8031be4090be1\r\nMac = 3c5a4eb51ec58ef3468bb00e7cae8c\r\nResult = P\r\n\r\nCount = 284\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = f2100615431349aba5c4f5a7f358fe7be579f4cb9e8f33d2\r\nMsg = aaf26bff7ad4116969c15d9206de6c737b7dda87619e3575d9b6b2efd8b0\r\nMac = 7396deeb4316fc6d84d3af119656f3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 285\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = a5993acbea8c55d7eb55d60596f83e1d9f2cf636d06240da\r\nMsg = 0bc1fede6a6ed9e1deda82612fbaa6e60f0b2461fd5d131e6a7206f41a07\r\nMac = 2f6b0a9f2a972d299bfa5892f8ea83\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 286\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 775846f9dbf36415640276642cccf87e3dbdf6519c5b2db8\r\nMsg = 4fc989f327e1a1cc7b8af618ee6ae6d25f78e2b76b681455336945655f13\r\nMac = 8b3cf3171912096763a2ebe5ea9e41\r\nResult = P\r\n\r\nCount = 287\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = b214b16bbac27ccc9773d3c8dd31275da4876c039740ca8d\r\nMsg = 7786a3e30acffd6dde375bd859dd6be2c9221b979d0c66d1d5ed6e00b73f\r\nMac = 1a73acbf4e9250610b74c727b9c42c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 288\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 032b4cfce8a1acd89de5f6f78794e2813bbcdb89959dafec\r\nMsg = 3f0bf0141dd3ace0fabeace61811eac5ec801deb7ffe3b0514d43db90bf0\r\nMac = c24066cbc00cb5c28e48141b627411\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 289\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = a053255875ed4b5193bd9c5fa4172a1f660ecfd2a394c2a5\r\nMsg = 14666eb960c6b4f8b6ccc49f79a039b12c02e0972c300f1e9d0a38c0a474\r\nMac = abce3abc224772a43c058016bf25bc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 290\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 0ee87b40abaa99f598fba22c3e677a85ca3ec95c3a51aca8\r\nMsg = 1bff19aacb9c7d0a44a15ce686a2469e3934d086365d36f449484498353d\r\nMac = 4d565c2e12901845e77ed8b02746ca\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 291\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 3384f8563cfd0fc8019bacc9b691c9ba4ae6dc8cf4c00629\r\nMsg = d31e959cf7842db351db407266ddae0b36e37f34270576724083e9989764\r\nMac = 96d0dbf51d96b532321da593383964\r\nResult = P\r\n\r\nCount = 292\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 375904fb9fcafb7f19877b145b0284cef61ac7a3d88f537c\r\nMsg = 441bd4db5e80c7db1b575a19b7bad021a719658a2c818566291d3cdd32fd\r\nMac = 3b8dac029f6658e44e5f5bb8f8ee40\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 293\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 3c1ca347a7d3d8db8f704410c493d7a65718cb7bffec2dff\r\nMsg = 555fd02fad4f44484133f9472c050f9da27390fa2a3e48cb0be0d7020171\r\nMac = 32be39d874c15a0fffc7111f76bbc4\r\nResult = F (1 - Message changed)\r\n\r\nCount = 294\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 8bed296a3ac03fbfb71422b9211799150b9d766a8116bebd\r\nMsg = 6df3de543cdb6d1adb6ca7df6b5a4510fc8379a4f2c87497ad1c2b9a69da\r\nMac = f24ff3218e7905d81c3e99c84bfd26\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 295\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 9530bb291d38f6bed10318081dde8fd178f02eb0e8b7d022\r\nMsg = 5f48624302d1acf7750994d45f0999ecd89a3861cd0268d5a51e672124b1\r\nMac = 0afed54c577e550eba7ac94a2d82d8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 296\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = f5400b86ace6e3da5f090befb96fc05d0409bf41fc77b4e0\r\nMsg = 1c79b055fded54af5ad2f3253f93a090ec003863d9458d3ff718c4c13937\r\nMac = 59f94d4b13539a5f0a8672e4599bad\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 297\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = c033e4a512297caecdbead892b11a9f7007af9a74bcab89e\r\nMsg = 3ce965d58856663d54269af4791ec57ef98227ea387d525769c23ab74674\r\nMac = 0dc19e37a255dabb61957f7f89ab06\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 298\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 2459f951d1255d093b72144b83b05ea3185d5123d1ca864d\r\nMsg = 661c6ff41af91a6d828a4d5d507f8a9130abe91412070950c5fa4c75c8d7\r\nMac = ac8e75b4465a52b3a7da3746f9875a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 299\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 3b63415210361822e23cccf0faae88cd7642f44cec45fe37\r\nMsg = d7f78e950d2ab520a6f1e82ec6f206b2e8c71131c85234bd80500527f131\r\nMac = 15e59760acd3dd74155d6d3739c189\r\nResult = P\r\n",
-};
-static const size_t kLen35 = 61387;
-
-static const char *kData35[] = {
-    "#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = AES KeySize = 256 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:45 2011\r\n\r\n\r\nCount = 0\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 45b74171271e1fdc19f9beadda58010d843af69dc2f4ad003dd74b9b570d5a98\r\nMsg = 00\r\nMac = dc0ee796\r\nResult = P\r\n\r\nCount = 1\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 2cb4239fffd13762fb5391f5a4760d12d96ea12666a793b4d651e9f4891c22c1\r\nMsg = 00\r\nMac = 2e19d6cf\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 2\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = d88586da8b605a6fd5a45d316b89fea15e27ff4d92238397718e68b8e00ad605\r\nMsg = 00\r\nMac = 8ad78885\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 3\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 136ffda3359fee8c81e6dac131256f4bffc0d3c3e74f8aaf2f979a0fa5b8ed32\r\nMsg = 00\r\nMac = e430d0da\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 4\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = e1a7867476bee9928b7237ab7a3d502fbe3d2d45b6e4c41aa9f12b79099f019d\r\nMsg = 00\r\nMac = b6f00f90\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 5\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 5b4d945d55dea22e37821ec396476a4bfb617d2f392ad93afe67bcfda9cd9b72\r\nMsg = 00\r\nMac = 5076ef43\r\nResult = P\r\n\r\nCount = 6\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 23df62a79fd5866425427d0ccabf05b16590e8452ee22e028b51910926ad314a\r\nMsg = 00\r\nMac = 7bd29398\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 7\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = ce9da814595f76a7e52a1222c7c9a6579b3cc2e393ba51580ff6cc9b6ea2ad8a\r\nMsg = 00\r\nMac = ce872fd7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 8\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 507c4f32246d637fe08e454c638b014438109e1fca31f724d40ac6ec1aa20268\r\nMsg = 00\r\nMac = 282a7ec2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 9\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 537dfe9fc000468dde29800549b1cfaae67ad89d22c8264d7eadcd914ac54ef4\r\nMsg = 00\r\nMac = 7936b7d5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 10\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 1f57959cecbd377374477e33b34979814f260f77867392ed645998f73a3b06ae\r\nMsg = 00\r\nMac = b4b63264\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 11\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 3d272b4a1a1031369aff514e2df98d580f972b5abeacc05cb1288e6e473c0fed\r\nMsg = 00\r\nMac = 18b35edb\r\nResult = P\r\n\r\nCount = 12\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 8774d1acf96362215a3d1e51e1a52a980685dec4f3afd2d438c03c00c04a79f9\r\nMsg = 00\r\nMac = 80eb7a84\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 13\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = f37155beb5eed8899d9ed4b5fa21b60b40af289f090a355d5bb1aee52957cd99\r\nMsg = 00\r\nMac = 6827f73d\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 14\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = fcb52c44379ae8083bdc7b827383df93cb1a7ecc21574730f9fe003b7302de23\r\nMsg = 00\r\nMac = ccad16d9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 15\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 83e231ecf8913ebce00e62b8f00c1abbaad710142fdb912c54664169f7af0e51\r\nMsg = 00\r\nMac = 8e393f56\r\nResult = P\r\n\r\nCount = 16\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 7d35e77450e2adf8805d5ad67de5835b2c5dccafe8440865c7e7a1501ed53a98\r\nMsg = 00\r\nMac = c6899710\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 17\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 87143071241bb65261fe7afcc102416e59b9e46ee0c9007308f0eec10e45f6d6\r\nMsg = 00\r\nMac = a1a4449e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 18\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = d30d2d1670553c71ff0264ab861574dd03a103d954226d1b540f18fc47b3fc29\r\nMsg = 00\r\nMac = 217ac763\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 19\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = d6983226b2c3a431abcceb77c8ec6b9bae80199115b28c5d7c56561e1b12944c\r\nMsg = 00\r\nMac = 26c717ce\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 20\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 0cf53b4aae3e0a209e58385dd32d9cc6163265241332c332af4de4b99b4022fa\r\nMsg = 00\r\nMac = 1bfd19f6e1070186\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 21\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 5f988f38410d26d293ef32d74eaa81acca82545e767ab59dcc750a09849cebad\r\nMsg = 00\r\nMac = 7e52911c0d7987a2\r\nResult = P\r\n\r\nCount = 22\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = d8fd6e1dfcca8f656705aed7e356a576baf8907c8d10d54c833d62a8a6703624\r\nMsg = 00\r\nMac = 31b478b4b4adaae0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 23\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 49fd56dec210e903f6c703332637f9c267eab9333e2701a16c74ce5e0b5a16d9\r\nMsg = 00\r\nMac = c8be2b36c93684f3\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 24\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = fa282e1f3276a3e0c769f2ba25ce830591e860300cc03ab57abdb14c0374d060\r\nMsg = 00\r\nMac = 27b8111c3d9f14f1\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 25\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1c6942e914218135496e0d7910abe67b9f7f29bb09029bb37021865d7543c4f6\r\nMsg = 00\r\nMac = 466b7077bec98b7b\r\nResult = P\r\n\r\nCount = 26\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 08f199a8d7e3ea821dd3106e8947cd2e9d485342b25a64713db2b8a650a49ffd\r\nMsg = 00\r\nMac = 796deae0d06b1bf4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 27\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = febacddf3448c7464297ae53166793e2ed962de0d0947c5e5e17abe3cc103b07\r\nMsg = 00\r\nMac = 5e2d21aa3351a2a0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 28\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 59b9fb83b6a85f017bde6c0ff3ced955b9f343cc71b680c6b591302f52759412\r\nMsg = 00\r\nMac = 3e5428eca10808b6\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 29\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = f07e6655424125462a96390e02bfee9d89cb271bd9bbf22a9de45f6b7e949343\r\nMsg = 00\r\nMac = eed5aed01096226b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 30\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = a04f84bd79406c138d02698f003276d0449120bef4578d78fecabe8e070e1171\r\nMsg = 00\r\nMac = 18553226e5f9788a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 31\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1673a52494e9af02472c1777232aa3813c7c162593eca7112f34b3807009af5e\r\nMsg = 00\r\nMac = c5907fff58c68ee7\r\nResult = P\r\n\r\nCount = 32\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1e4ffbed2d5a7bcda5e24a66048660629d57567f83307087a846db8246ff332a\r\nMsg = 00\r\nMac = 29599bc212927246\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 33\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 8b80c24ab4a3c24ced82ca8c69924553a37a139bfa2541c59e15188ab0fa5a34\r\nMsg = 00\r\nMac = 299746d93b0b4881\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 34\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = a00ebf59768f6437b48a91923f5effcf31c745b980f79f2edde9ed18dcf2ffa0\r\nMsg = 00\r\nMac = 61950ed83db6bf74\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 35\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 319d3f58fd7257901ff364fa68b86b1ba27c11962b2c5be8e33eb95548444322\r\nMsg = 00\r\nMac = 26793e8f8d5eb7c2\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 36\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 015a9d1f2df2c31f14cfbdc0bd68725fe8113a024f2a43312d963207fd6f0d88\r\nMsg = 00\r\nMac = b19fc2680b8b82b7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 37\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 003cff344c4e1932ac628440d819eaaafcc3ebe7c525cb7abb7a6716d2b76e05\r\nMsg = 00\r\nMac = 48a98dbf16257142\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 38\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1a581f36e1816d346f7bcc6df78316aa353111e447fee6f0bd05d562f30626ab\r\nMsg = 00\r\nMac = 587155c18ebbf8b8\r\nResult = P\r\n\r\nCount = 39\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = ebab54c4a22a16f7d9546bbf682b995a6ce944e949f1920eee058db95ab9c93f\r\nMsg = 00\r\nMac = 067927f063adfaac\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 40\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 58405ef8fb69e88221edc10a92c01cc44255aa7083096adb79bec3a8cec6d050\r\nMsg = b4aaf9ad1bde60a8d7e7cb16c1cf6b713df17d1507b028973068a95963a5ad5b\r\nMac = 42ffe65f\r\nResult = P\r\n\r\nCount = 41\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = ca0f404e3389e9527135f53eb58bca7726266b8086d33fb512e8143daad7633a\r\nMsg = 8f2a6b2185f73372ccaeaa7f93d30d1ca80a451ee0e46ccbbaf98c8f3f37aaf1\r\nMac = f2b311b4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 42\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 67b896b88f07962e08471634ab7e522144d716a2969bde55a05c3c931f747a8d\r\nMsg = 0218eb619dbbde2e846218339aee4383792856496eb3b85cc43fa81446fedc5d\r\nMac = 69db1949\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 43\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 422994df8766f7a6a7ebfa2ca57ed6189d9e9e8455c8715c14f3f407b75dff4a\r\nMsg =",
-    " 12f0c45d06a138a964fb11b2d450620a2977bcd2952afe371cad6e3d48b009bc\r\nMac = fc5f1ccc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 44\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 3291be3aecd2e06cd2ee61a14d723450043d450567cbb0bf88ba32972d86dca3\r\nMsg = 343d5a4ad39acf81adcf24e9807618932abcb3bc076734f179174c77c8cb89e9\r\nMac = 3593d615\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 45\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = a1885ce431cedbb60f7b3d96a06cbc60a964df156ea4b4191abc5a9f60a0c361\r\nMsg = eedd0d767a25b24ee25fe747718256af51d7b4bfe900adc069381a71a2dc7aad\r\nMac = c558f768\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 46\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 039188ec58fa55acde53c337fcfd0013f0c6efa55c60ce470112159bcaada11e\r\nMsg = 009f47f180e085776be6644aeac0070be64c289f84a7ba3dece7cdc54f0db354\r\nMac = 20d3639b\r\nResult = P\r\n\r\nCount = 47\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = f7d946f66e1cc4e5a79dfb5559cbea5a128545eac38e17ee7f3bac9a806faefa\r\nMsg = f250c49f9882f10db247adfdb2112c2589e1011f77c48e0f219dbf85e326f8a5\r\nMac = 90b4bfcb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 48\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = a61f586ddbbe0219187f8f446d4b172f5e9bf855d1d5d6592ad8e03eb4d555d6\r\nMsg = 71c8eb0079559a306e236c49b7ce1b6cfe26c7888733eb7ec07690831a72c0c5\r\nMac = 78ce0135\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 49\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 7774802fd82fe96c05431acd40b49b1160d403c0db09b10f23d0bd0435022edc\r\nMsg = e75b6ca1b87e775b33536979422a1cf743f58c71b1599adb00050972c843cdf2\r\nMac = d885703e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 50\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = c4261ebb87a76aaa82a00392ee2e2318f0b52d5f2724e374847ad9ea5c8929c1\r\nMsg = a41bb1f256228302cd0548ae2148ff42774d18c2d6d3e38b36bc4938da13bac3\r\nMac = 857d8909\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 51\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 6219c19233c1b91d7785fde3b65df3bd2e1d74331ba62e4d365947a77cd243c4\r\nMsg = 68f17b9f57734784144112c79bf360ee324d37f9a7718137d954b15e796fa9db\r\nMac = 0e85de57\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 52\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 7e8cae1374d3a21bf2dd3786754668f17aa63dd5e3654cff9dd18041806d1968\r\nMsg = 2d335be62ecfed45183f5a04014c1a52afb7b918b9cc1f2be93b15c6e5240537\r\nMac = b56ee72c\r\nResult = P\r\n\r\nCount = 53\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = c2425ed20cd28fda67a2bcc0ab342a49d79d6b4eb196266cb0d116fc18895545\r\nMsg = b5f24c00cd15e377f444ae55e02b335379e7ae14e7c9bd05f0575d8981941553\r\nMac = 2e44c573\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 54\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 1f7871680bfa59a8a178604dc513b51a3d4c682cc4c421de594512e9dd062ad0\r\nMsg = fcb43224bf8989e1809d90481ba043328febaf4b6c1c05d18800ed98f4b71c52\r\nMac = bee03b92\r\nResult = F (1 - Message changed)\r\n\r\nCount = 55\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = d8a27558d070214d3f765cf969b2b8f09c0b14ebc492cb2539072b04db9f29fc\r\nMsg = fc69a1f0d0ba8eca9e7c0570cec9c76b511c74b2d8b65928444189675eb42fbc\r\nMac = fab3b2f6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 56\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 72354b455230b72a6dbfa5cf6c3726d7f8e65ca773f9d469e99d165743657b36\r\nMsg = aac60835c309d837aacc635931af95702a4784c214283ebbfb43c4e29973560b\r\nMac = 69519d9e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 57\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = ca92b095173076a40e24522297be27fd3a765c8d417f24c71a9f03b3fe3d8e20\r\nMsg = a96c4d5c89a364263c97a453308b9360bc0ed868602b9ff54fe13f162ad31ab2\r\nMac = c59a1a39\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 58\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = aa56f98e03f559eea02ad958e125f2312ff97bc3310079ce437b383f247a9b3f\r\nMsg = 01bf2aa8dc66ca44d16d4567f1adddd4461f78706ff15cf68ad937eb57aa62d5\r\nMac = 31171cfc\r\nResult = P\r\n\r\nCount = 59\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = a0e317b790870e6703e6077dfb8ea327c12e29a17107284cb89d5effddb2d9a1\r\nMsg = eb4ea6b72dfc6657e835bf82054796183330c02a8db3c5b179abe37fd0a05675\r\nMac = 05d54199\r\nResult = F (1 - Message changed)\r\n\r\nCount = 60\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = e3de27949ff64066131c81bfee172b308f9bb0b31710678ec394837b79434605\r\nMsg = e41557341e8dae33568524f3f64b23426044c9db3526463ad16786af14f611b2\r\nMac = 975ad1d2fcff6a85\r\nResult = F (1 - Message changed)\r\n\r\nCount = 61\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 492dacdcb4a35fc438a6eaa35e26d2f683a1e85e92df28f213dfe1da6511161a\r\nMsg = 0515ad7b8576258645d37b7ac771745620e2e9e009cd778f34ed77a7dc5c30a6\r\nMac = 9f43dba2aad2f539\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 62\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = d71c50d55850d432cd8c8ff4ea427b3f19cbe14c785a7704202fcbcead0de5a5\r\nMsg = 7ffbc4a09583029cbb0acb6b13f08a189033da22c2ecf921f01d79ac68a9397b\r\nMac = 5d00ffc5f8cf1ddd\r\nResult = P\r\n\r\nCount = 63\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 557eb2e709d58915a8bada6433f2e5660247e0cb1588ea84a9d24028090eb396\r\nMsg = 003132645e3026f6a2b9d0644c16e5e4d1bf8b53a51f0e1b999bd45a67d19341\r\nMac = 6f3d9f50d09476ef\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 64\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 351d779277148ab4474843cc798942cacbe863eb1c1c9338dc25e251c12fda68\r\nMsg = 34bcdd3d0469c01d0d95a85ca705d887385bfde20596a90b47d902db826dbc8d\r\nMac = 79ded259f93456bc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = e1c17ce3d3c61468a7652a95128bc0f6c33d9ccc46e7490327f15f645a94040c\r\nMsg = 97829c60ca9a71c23eaf1c4b4fbd72043037ef0cd356b68e0db0d4f0f50cc54d\r\nMac = a93f0d16499f63ec\r\nResult = F (1 - Message changed)\r\n\r\nCount = 66\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = a9a86a4407b7ecebc89434baa65ef173e88bd2dad9899b717ca578867c2d916f\r\nMsg = 25a152850b4b80b19d8f0b504b2a8a241824b3a1fca8d85c8713b2c0c84b5e02\r\nMac = fe84ce3defe00f67\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 67\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = ed14373671cd8041e00874b5d098ea225eaf9c68bb51cecbe8083149bdda062a\r\nMsg = 38106cdc72b1ddd0fe11f23819096dd7479e95ee9730940c28f51e28eca653ed\r\nMac = 470404ed731640a7\r\nResult = P\r\n\r\nCount = 68\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 009f47f180e085776be6644aeac0070be64c289f84a7ba3dece7cdc54f0db354\r\nMsg = 2eced43c084a86f89f61e7237425137c167aac29e4cac4071afafd3f0c9dee1a\r\nMac = f67d432e5b6fc5e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 69\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = f250c49f9882f10db247adfdb2112c2589e1011f77c48e0f219dbf85e326f8a5\r\nMsg = ce61d6d8de1b299c9b063d1e1cb1faf7a616faa7c6673d7f9c0a1ebe7ae285fa\r\nMac = e1d950593abc14e4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 70\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 001150b2dd572288b6fde466ec2c2a64c75a9d516b7096f7082bec9f52c20ad8\r\nMsg = 6dc38e37d1379732df4dd535db88d17aa59d7cf9e8d60ae695b4047b90d899f7\r\nMac = 2de6700fc1562ad3\r\nResult = P\r\n\r\nCount = 71\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 68e00d394855b6697da8213a120dc2213b3a8a1e88c9b93f5edef465a809974a\r\nMsg = d21aed2073e8ae9c0560f9dc1adb961d4f959fa12c0384a44c675192bea13477\r\nMac = 9594f10d5ce5e616\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 72\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = be0f6052baf658a3607d999b81401edf7e2afac2b143e1b908c8ea0ff38193d9\r\nMsg = e502f0b4710bfe517e783c4bbb85055c8471b04e12dd6776f276367fb5d36369\r\nMac = d409a879dccca77d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 73\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 7147b3c5ffb2660c45cd8d78a6fd44bdd5ba75349642b32ec88f6688a287297f\r\nMsg = cebe84df789c98dd125bf43cd993e2f089611b98d10be04904e2468d116dd2ab\r\nMac = 21cfc1e6c1c38df8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 74\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 205e751926038ef940c6599d84a9e1b4737bc826e9fcde544d43f2a10b5de931\r\nMsg = 86ffd5bd3bd1cae10706a61d247b2257b165f37cb53ff21761077a2295a9111b\r\nMac = 73d66ea826b84fc0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 75\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 8c8a502eafcfbb813dd1ea907b1660a41fcaa3f905aa93c22320f96ebfaf632a\r\nMsg = 626aed82974ef29a1ba0a6c6fefcbf34ca982e6214835183502f6a24ea2e500f\r\nMac = ca3d007ecd99be83\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 76\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 596db502a357e102566291b916b32b8a09e99d3739f5e6543a2cd8fb0c9a1cc2\r\nMsg = 22bade59214fa4b933cb5e3dc5f096e239af4c2f44f582b095c7fea6b8914bfd\r\nMac = ff4ec21d89d4762c\r\nResult = P\r\n\r\nCount = 77\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = f51f2fb4b3fd8045b70d34b600a2697cbf7503be0d8cfb5cdc60f9312e3e269",
-    "5\r\nMsg = 4d43702be4f0530319555d7f1a3356160f6cae48051f12e22a153d7e405c1149\r\nMac = 3d615ee77043d8b4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 78\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 80a4b14f951490618ce53d39abd3d786b425d4f76b26a25052d98ebdb7e9e666\r\nMsg = 0b2a77b0175ffafee40cf83bd19e785dc7ec4319786c49b3e7a741142aea901d\r\nMac = aedcaa2e26d2f5a7\r\nResult = F (1 - Message changed)\r\n\r\nCount = 79\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 39fb57fadff7cd9e1cfdba154422b71d693d08807d86da46ba63c929417ea549\r\nMsg = 567c7400f190d06e682b3dac5f751639a9007362b1a2a8b618800fbb9f6c08df\r\nMac = e29461fe8c6b3767\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 80\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 535ed61510eb268100be032b7a258e84bdb32448269d3000a76444ca74b4695c\r\nMsg = f7f28df82f910badc5f4b3860af28cbb6a1c7af3fafa6dae5398d8e0a14165def78be77ee6948f7a4d8a64167271ed0352203082368de1cd874bd3b2e351b281\r\nMac = 4a0fd541\r\nResult = F (1 - Message changed)\r\n\r\nCount = 81\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 713fd349c56d1086794eb20ed59ddc89b065bb8533b968c6dfa60bddd16646fd\r\nMsg = 4f3b91aeaaabfc7d4dd6821549d4eee2ea17f59aa196c67b422be2d46f3a2ec65494464c969b157985a6a30199a72dfb1c0b7be524e16ee9c43fd95e83e19192\r\nMac = bd4eab1e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 82\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 1f89d9ee93294aeaf3503d15a6dbef48708de48897a72b3545b9e3852eb7fe31\r\nMsg = ea0608b19f47676f0f342cc2742e003a6a74fa2850f41e0cf162235163887a3830dd8b13b45842b3c686ca239bdb9897e646ac9f440713a0d8c5b18532db3db2\r\nMac = 8bddd404\r\nResult = P\r\n\r\nCount = 83\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 2b50dbe8a5ed0c7cb69aa60a38d10cfa4553c73d58c0ce84b26504b0fd55038a\r\nMsg = 2586563b0102f662b5a8f9bfb0c1d107a4c27569d27bc066889213e3e830427ceafaae1ca543aecaca7f34c671fbadd518cc28d9e806bba43b2e220e5cf1aa45\r\nMac = 987514d4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 84\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 29a7ed3aa55c7eb7e5bf343ca0efbf8b2062ce67b086255551a8efa0ae16569f\r\nMsg = 2e6f2d21aa133a5061622f08ac64c6b3a3dc8154862033055c27c3a3d9e42dc885d2c9f91bd1d0212f301c3e140b2f5bfdd777be623bd162a6214ba8f60e2e49\r\nMac = 1bf45457\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 85\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = a16a2e741f1cd9717285b6d882c1fc53655e9773761ad697a7ee6410184c7982\r\nMsg = 65916ae3d88ab2add5c0c6910ea993d385cbd35c5077ea0d9db30e53f378abfcbb1e0649fe14204470d4dd53ae16650ec444cb4ef22fed86b0009b57ef71fb5e\r\nMac = 578f80b2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 86\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 47e49e5b57fbb834932fa32107697471119f1be3c3a6e71a8c474d4b1596e539\r\nMsg = b3cec7ad75e2bf6c87029a67365aa83cf797ae2f4d42e720ed4c48ba21ea08ee6aa3609f69a6909fff6222dbb45172d255146e4ce1c59b48a7895936a8646766\r\nMac = e6e64597\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 87\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = f0b0aaacc25a791c236aed0e9b537fad00a15efa9c89b5068ac52c64639fb1de\r\nMsg = 9a5a9560baed3b8e0e90b92655d4e5f33889e5d7253d9f6c5aff71ea4069224cfbdd19ae3f0ecdfa65c27dc3bed721712784a09fdde243c193ab6a0ac2417e8d\r\nMac = 990bb31e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 88\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 14db1ffc1c87117fc72981706c0f90404acc98aabe950839baeb6f0b727bd6d4\r\nMsg = 3d736aeca5720f5c7bbb16df61f6d785facfa070aaa89c2d9e8af9450d62490ebd6a29c7c8e521e4a00fcca7515439f006c09056cfb7f976a1e6b98b9f799e40\r\nMac = a6786e52\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 89\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = c6f0a3692c9280c48393b0dd763e5d0b90477f34ad69f192ae4dcab771aeeacf\r\nMsg = 8439ff717e1e15161119494d368d7f3812601588265bbefbc6d48e22cc8a51688dd021500cee38fe6ec402f9aeb0762f92b2a73adece96e1c7b24be2aa9924ef\r\nMac = 70126cfa\r\nResult = P\r\n\r\nCount = 90\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 75225a26d63e91281fb37ace46354f81de99dedfde8b770ea47f08503aea87d8\r\nMsg = d729d8cd1631aacfe485b1f408a4fb60256e7a8ed6e5b53afc34be7e57f1643b549fa9ba2677779318688ece225cc149babd6259ec37fbb4adc03e8f6dd63f03\r\nMac = 5112f762\r\nResult = P\r\n\r\nCount = 91\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = ab72eef2aba30205c986e2052d6e2c67881d24ae5fceaa8fa77969539152527e\r\nMsg = 5251a0aadbc92b76705eb053d09b25b5ad38eebabfe1980d143ac90aa81f7723353059824c8d9befa5ded6f5b4973f407c7a1f4aa85d8337d82d34fd3933e9c7\r\nMac = 52f7a014\r\nResult = F (1 - Message changed)\r\n\r\nCount = 92\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 6906d6533fbc33f56e38e6a639798005daa228ebd2fc8f93803d26fef30b8e95\r\nMsg = 6341370e126097f9721a13c977eb4875cf1286e15c3adfa4e7597e0e13d93b6a8ff66c809067fd5e7f40c358ee170d4ed1657c2deb3015b886e79589678e0452\r\nMac = 1b6a021e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 93\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = cd9072aeffebbdfcce95b569c34158d0e130ef24dc99e3f98a4dd246949be269\r\nMsg = f882339f93ff114bfead78044aab1c7fe109dbf1bb2d968ad476403fdd2034cd3168ccfb0cf02f1ff7646ae3875ec349478749edf300b08be7005cc0d6bebc15\r\nMac = d16bcdc7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 94\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 3005c0100dff59e5e4b0e3b95abbbc79749dc49ba29a79b1fcf7613ecb6aa9c8\r\nMsg = 4c2c670f3ac1c4e33a8d43063c8983e20f1ce6a73299fef1e70a42a5882c061b1ebaaa8330ee1181d946541b1d84b8d57df8de1ac9013ade36d2c682b172f8f8\r\nMac = e5689100\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 95\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = f32eefb301356fb1cad6dfa94864542b5f8cd8e98438bdbfbbb431f0c10f12b3\r\nMsg = dae6db62842a8a25123e50041b701ad17e2f63a0496443c3d905a9f943e6e4e2f3d369b693ddd0372ff11fe496af4b700378fc72fcc9915e7bc864b44c1d4f77\r\nMac = 280624c3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 96\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = b0212ca369c611b725eccc3daa58df412787a3475f418d820971af46773382c0\r\nMsg = 13ca022396285bf7b82a600b560208c54ee14f8496bce684895029027e6451a09f4eeb0af9b889dacfa4b7b934ae30c7d991523e23edd0528048a75bfc525335\r\nMac = 8e9759db\r\nResult = F (1 - Message changed)\r\n\r\nCount = 97\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 57a9d1ea216c69c6e360221f8c858a9d356598a8b253e2cf67f1116b5df5927f\r\nMsg = 77772e91be674abb0f496b47dbd632e5616177a0d16a8c11b271c2d381082f379b2cae385dd526b189cc10cdebbd33bf3d8db2b449ed49064d30d4b3a359110d\r\nMac = 41022947\r\nResult = P\r\n\r\nCount = 98\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 749f2fb720d321757473afc5d3a377a0eaacb425e5591026e3a1bae6a785b921\r\nMsg = 2e4f5149d67c955c409b63b04d95538808da6202e69a50ed4d3846da52fcbc76c7089a17758d9d94a63efd5ae7054dbc0bf5a28b7381f7e78debd0549bff1e11\r\nMac = 67b34b0a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 99\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = f8ebad761b9e73c77faae3fd9390093fef595e77e6d7f6b35e2dfccbde925c44\r\nMsg = 18430f34d5b5fddbd228a910cab9c48e1ba2b5f57819eacbde756cc0c993b736a778c8008d37776a2915077af8ecfc76b8cd2ca621e9195bd0b27e31843d2890\r\nMac = 7a446398\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 100\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5bb9fb83b6a85f017bde6c0ff3ced955b9f343cc71b680c6b591302f52759412\r\nMsg = ee7e6655424125462a96390e02bfee9d89cb271bd9bbf22a9de45f6b7e949343def818dfc93d777528f609cd38be0a013b1eef816eb1f9593a850bb7aec5b9a7\r\nMac = 5e1fa5b9c9dcd90e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 101\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 57a9d1ea216c69c6e360221f8c858a9d356598a8b253e2cf67f1116b5df5927f\r\nMsg = 77772e91be674abb0f496b47dbd632e5616177a0d16a8c11b271c2d381082f379b2cae385dd526b189cc10cdebbd33bf3d8db2b449ed49064d30d4b3a359110d\r\nMac = 430229471a1cf1b5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 102\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 749f2fb720d321757473afc5d3a377a0eaacb425e5591026e3a1bae6a785b921\r\nMsg = 304f5149d67c955c409b63b04d95538808da6202e69a50ed4d3846da52fcbc76c7089a17758d9d94a63efd5ae7054dbc0bf5a28b7381f7e78debd0549bff1e11\r\nMac = 65b34b0ace2fc6bc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 103\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f8ebad761b9e73c77faae3fd9390093fef595e77e6d7f6b35e2dfccbde925c44\r\nMsg = 18430f34d5b5fddbd228a910cab9c48e1ba2b5f57819eacbde756cc0c993b736a778c8008d37776a2915077af8ecfc76b8cd2ca621e9195bd0b27e31843d2890\r\nMac = 7a446398a5c59ec6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 104\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = b228c753292acd5df351000a591bf960d8555c3f6284afe7c6846cbb6c6f5445\r\nMsg = c66d322247ebf272e6a353f9940b00847cf78e27f2bc0c81a696db411e47c0e9630137d3fa860a71158e23d80b699e8006e52345fb7273b2e084407f19394258\r\nMac = 129",
-    "e40ed97c02ff9\r\nResult = P\r\n\r\nCount = 105\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 8ea05a5033ab8b009664fa2800c24e217488ce6888cad14774ad75b2696e9470\r\nMsg = b3f09d990c2f41c8707368bba007803621ecd76540cdb8705435d74f4300eee04710a936f241c034709e625b0dd5dae1f6e86d034426819c365a05f5be420cdf\r\nMac = 08e5d5b3facd3b01\r\nResult = P\r\n\r\nCount = 106\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 016b5537198ed152670c5fcfb70ade276de97ce0cb771c5f6f66fcfe1dfd945e\r\nMsg = 7ad591e67c6a3ce3c9f871e328fc4ce3b6e7048e80691da551efdfa4c96b06a3af53bb7a88ecc32869c8f776098df4d71af91393da239c24e50436e04d35a2d9\r\nMac = 36df9931a14dca9b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 107\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 22d5d4c3a3aa8d2fd5f25c08b83cea60e94058e8235ddd050646b02617f82854\r\nMsg = e86dd3216500273d0b6150227cf03adc20c8a5fed4a2799fdff759a327657a3ca554b6af16d9dc5cf3db4bf9a474bf1ef1996a06b9fe4794e634ab94a0141d44\r\nMac = f0246b4959d2fa89\r\nResult = F (1 - Message changed)\r\n\r\nCount = 108\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = c892b095173076a40e24522297be27fd3a765c8d417f24c71a9f03b3fe3d8e20\r\nMsg = a96c4d5c89a364263c97a453308b9360bc0ed868602b9ff54fe13f162ad31ab20f3fc51bd2346ae68a006afb50e846e8431dbf7bd0eb3c8f30326d26311a2eb8\r\nMac = 1d943a8b0c470221\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 109\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 2c87c0d64806fe303c5e97bccf48360f89374b6119319bfaf8defbe74adf58f1\r\nMsg = 37c6206e23163c39a13f19de48cc25dc26e6f83cb376e8d2048ad7c141fa503d594bd395f4d36c70aa1e8a5672910f735d4da49884574f833ef54760975b0790\r\nMac = 58cb614230d590f4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 110\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 028600eebf6b3eb04d8fac18399965aa8fb5f3954d3a657e188ba17f2e3bfc70\r\nMsg = 5b80d1cf745b14cb71cbc8dfe0bc7c7358f721c00099b3e250c41c2e1c9455c5ce55ce69f3f31090f9b1a1b7361e27f92d46d1e00d25f37b7b61f0b191385dd4\r\nMac = 02587102e6450de1\r\nResult = P\r\n\r\nCount = 111\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = ea1a626b623e9440e3f6f5c0b8b63b9967374ee82c1957fca5cd195ccfb2840b\r\nMsg = d082b2aad7058c3142021457d47d51d8ebaab62ab452f6039e771a1b0f3bd03355fe0656dfc7b75fade505bb05d689706867e75ec41da5c5ebd43d0844a670b1\r\nMac = c874df0a8aa87c5f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 112\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = d1155265fe296f374366dbd11f14466df1ea210cc88b0d1876509347e64815c2\r\nMsg = 3e3d3a464b2e6030be877f8db4c1c42bd2b8247adcf792ee833675a57f21594ade5be4399cc30ce373f68874f41584b4d7c8992b9082fc892307f645382c9483\r\nMac = 6bfdc96378f0c8f2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 113\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 9bcf914f787fd3cf62c6315a12feee358eaacf1f63ac802932b933c86b098a29\r\nMsg = 02c8b892b13f04d99b875b8aaa32136d19dd6b9c2a10d8871c66993a57ee91e3ebd0568e38348634ee5f5af4391f7da0356a1e7ba8424441f0db61683a002ba6\r\nMac = 365da451a2787193\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 114\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 35d5df6d714e2ba5b307c4d1908e108bc6fece682a23aa35e2de0e80d4cb3c5b\r\nMsg = 963ef1899cff6e0a6dcd80a27b63c20fdb8e9fa1ee3e14ed40ddb7c6b0dff969d29ba8f89159b82a19ac4240f402cd3b7279cd4c4ff4698c906f81edae8ff070\r\nMac = 33995a3d9c470cf4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 115\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 511ab5e28b6fda481fa5a0fb3709b249fbf29be56346378a4d3f67e1cd6f09a5\r\nMsg = e4cbbf14f27490843b0f9a17b4520d4bb2c89726f4c788cae4a3344a1a2198bc222e41907fd16a20ef5f6587f1ee3cb7850b97c633b0e0894e70a6647af53f60\r\nMac = 3b4aacb52525b58b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 116\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5e79f14d5f687ce62b82f856695af9f7dd350543ec763de75b593f1859e44c2a\r\nMsg = c0dfcb62fbc3a67ceb792b3428d040ed5e50999296702472b709a44f4c0b9bb1876f6e80866cc4d2d6ee2f0236440e029d18b2f27ea5bff14a24d53337877053\r\nMac = af30acca71feba3c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 117\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = cf8a477434cc679e52dc3f3f3520eb108239dad5bb363034bf0768c790343e70\r\nMsg = b891b1ab5a6919e0b99013e40fa7c910e55a480bd043d3d85b0b7d1342d3f777e1d2a6a4eb3ff81f5f71f99bb845217765c0708778f5be17a2294c2d5f369e0f\r\nMac = dc10e268f5f73bbc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 118\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 67d77f50727c7cd5b38e0b175a888c88687c97f2ccaa3daecc519116a7c5683c\r\nMsg = 02c5c55e7677c84a199d6e534772123c4e5c933622cfa8ef536e74cb3d745b717f53138aae9bfec54a1cb71ff04feb61d2f26aea65f37dae598f7b7fcebb978c\r\nMac = 885050ec166faef6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 119\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0091d39f3478d2c59bf874b96db9ce0f7e8b85a9b805e07dc96b219819d51663\r\nMsg = 7207aa8fa87283f1f57019bf1c89645ff8fc36ab1102704e6d577671a9f7e098482573c64ab24fe8007c697020353c411566bccb98b38c7784607045e61405b3\r\nMac = 96f639a86a2d698e\r\nResult = P\r\n\r\nCount = 120\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 0e6d99ee5137c8f6b9bb45a961be8a29358a91189cf9974f5bcf20d3b64c3b04\r\nMsg = 543ef4638f1322131402172d193bd304b34e3745ecedb9db16f35c0f5fa6\r\nMac = 33f10660\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 121\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 82421ddaaa5767a496f2b78f816cd1e1e6699f6e9e6576c34c909ba5f8dc06ba\r\nMsg = 4e2f0f91990b855a00d27fbb2e8db7184cd82909de361b52e7a75b16547d\r\nMac = 3f5ed151\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 122\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 134f20cb62084a98601f0e69d257fd2064beb47248caa79720a71d461ed07ce0\r\nMsg = c248fa87a6e48cdfafd1e5ac00f95fb1dfda861465747265796654dcff54\r\nMac = e7b21645\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 98505229c1927d13001b53850d0b7d56f49087afc6c2351190cc1b998e4d6883\r\nMsg = 9bee2e347f763c5c506876bb514b5ba1248abc6b3d17cd4c96537d4ea432\r\nMac = 2c212c7d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 124\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = cad710b48ea0bce4a897482a535aeeaeabebb42619578a9d1296927301b3bfa6\r\nMsg = c1db23e776272765a0fee49edcce28ff7702b9ff9b6e31a4c3ed0c497248\r\nMac = 7f27420d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 125\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 0bbf4f77a9883733590a3cc7ee97f3c9b70f4db255620e88cd5080badc73684c\r\nMsg = 7ff9ca86f820e4d57995d450611009ffaa726e6fbe4ce1558ca1e775daed\r\nMac = b2e5a268\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 126\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 6efabed650ce05ff22b67768e3bcc88c7746952106ecea92a38707af2b8a64a4\r\nMsg = 9cbce402511b890c8c9fa215b59c813b3e51b5dce01e776327f145623002\r\nMac = 03728e46\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 127\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = ca2843847a1c9539917206d344161dc40b379fd45dfa6a73ba6fa14defc40920\r\nMsg = d9365304c4363fba73feaa69d4cbb343a76eb2d29de6782ebb34d873006b\r\nMac = a94841ee\r\nResult = F (1 - Message changed)\r\n\r\nCount = 128\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = e5a1108da9cf587bcbdf051e216231bc27f0e6c1e97729b324d23768a89e0e77\r\nMsg = 536d4b6182a698d456e1fd9d522aab38cf05656f41a5e02cbd5e6f8cb85d\r\nMac = f52a4ba3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 129\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 008ee06bf9b19536190e87820af9cdddb40aac44b0c3b1e50074fc29fe5cdff2\r\nMsg = c1eb4c800c631d9f387d2e8e431677b7fc8f65235ad0cf9b118d2b0d67c8\r\nMac = ba255bd7\r\nResult = P\r\n\r\nCount = 130\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = ba0bfda3b03c736c121cf9a257db55060b621be5168619ec4182f13ef6a408c4\r\nMsg = 69be384eb107340d953753e6a860ea2710e662e8953de8eff8f465d086f3\r\nMac = 9f650d24\r\nResult = P\r\n\r\nCount = 131\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 7a88524accb59f1c6307a1719a011eff211df24645086c67710ef539f5d3f29a\r\nMsg = bebe346356681f27bc62f0b838a25268e3b04194b865bf83eef2c8928625\r\nMac = b2566e6a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 132\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 9c956d7bbe2028739d73a2f0a80af5f2f180de923d5571e65bee0b25b5dd890b\r\nMsg = e0d2ea49e3e4a5823efd1b229c705ec3bb5048a7658f10fba2671c5d2cf9\r\nMac = 480a14ab\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 133\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 2090b970a71ce2cf399a0d9e1d3d72c4eb500004abcba1303b24bf9af16707cc\r\nMsg = 0e0ef2cd18533bee01f19870f2fb22176c7e04748db4dcb98f7a65cc9104\r\nMac = ddb6f30c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 134\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 66921951731e95bbd45c014af5cf623933350dd9a90d1a36465716f8239bf887\r\nMsg = 0de1e090eb47dd4fca966e5f8fa5616618701164370d8a43fae2eeaf3016\r\nMac = b91b3131\r\nResult = F (1 - Message cha",
-    "nged)\r\n\r\nCount = 135\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 43c1142877d9f450e12d7b6db47a85baca7eea7fde595393fb394c1f34369aa4\r\nMsg = 77772e91be674abb0f496b47dbd632e5616177a0d16a8c11b271c2d38108\r\nMac = b2de16cc\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 136\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = db4b6206d001af121051cec70195055fc1fd0dc06ccc74549bc440152aded5e7\r\nMsg = 94394feda0528fcc67124dd1d77f0ec0b911f08c3e01e0c0dbc40c1d57d2\r\nMac = 5f72de94\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 137\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 4d658be9cfcdb19f79abc78f4d7f986d02b43a03098b37c8ca56ebb331e62d51\r\nMsg = e28660f57b044a44a19ca40ff7b6469a41523e8d1cef22f4edaba58917ab\r\nMac = 11fa4d1e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 138\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 70b4cf3883fea8c6cd852a4293c7e5cb0586a6cd71294883b760cdbbfd07aeda\r\nMsg = 4cb9aa069475e54b25e5688a52dd4acd134169c858105f01a0a1b134c72d\r\nMac = b6b60815\r\nResult = F (1 - Message changed)\r\n\r\nCount = 139\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = f75bb63d52c35137448c58383afe47e026d536f67e3afdff87f29b10d3d6d9e0\r\nMsg = 4259e4fdf10acd8da40accd6354f4baef4859a2f5ebada0d2c5b1b26905f\r\nMac = 336ee1e8\r\nResult = P\r\n\r\nCount = 140\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = c938f6bcdeca02939fef931c969a25edcc3daf338d8286016e3c7ee78f9d52c7\r\nMsg = 47179ddaa9d7ef6b9a53c646325c80db69128c6fc4f92ccd345078383b9e\r\nMac = 5cbd65df0ca36898\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 141\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 9540e4bdd8c7ab99f0b76dd9de24c340a60f7706f680448509d5dc35cb5930da\r\nMsg = 4715a9a66d10b2dc1869d90fcf9b7fa99e91b40abcb8fc356b5853c92024\r\nMac = dcbd4dae7cc60d46\r\nResult = P\r\n\r\nCount = 142\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = d5c396fc1ee960215e57cfeeea1e792fab9334f2c45dd93e74cc47023e6daa4c\r\nMsg = ce188965b4d347a6c36a6fa5a47296b32ff0fa27311266b16b1d56ebdda7\r\nMac = 1684fadaea17bc79\r\nResult = F (1 - Message changed)\r\n\r\nCount = 143\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 897193cbbccbead9957876b8b42a77b404aed32a3f63bb9ab5f08cfe4936f35a\r\nMsg = 87767f13bb4904d0df0d64eb22c9ddb65e81b5739baad86ad5e2c239ffde\r\nMac = 84ef6f59b770d42a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 144\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 86aa015253a7114e1770b6a48fdb3ef22e9d5abac25fdc145315c09f4e8b69bd\r\nMsg = 2595cb8d4d6aaa148596e8502ec80a030d82195f9e1d9a26ab0ec0101e67\r\nMac = 63e67c44ecc05dab\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 145\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = a082c12e97bddeb0c74c13aa4ba788f8a127c44fbac6682050271dbf7ad6cbc4\r\nMsg = 7fc97a698d7b0eed7d7602a5d13e956a538c71c4b45978a47439c05601ea\r\nMac = 3e1fe077fc7e903b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 146\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 18716638a2f6b4fb8dd2849fa9aab80b8dc846ee7e6b3cb0926101a814d8dd8f\r\nMsg = 6593194b9970545c5a910b2b4fcd46f0ddc7aa0bf873f0a339d5958d310c\r\nMac = c4556a75b754f6c9\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 147\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 6237aa30f1e3df239c96e7e50b69496da9305951024fb83a6fd01e96f6b2578c\r\nMsg = 0c5b7d1ba68654cd24871964f1b31ef7900dabc025baa02d37b55b35b4c4\r\nMac = 22c74fc64489ca5e\r\nResult = P\r\n\r\nCount = 148\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 32f60011bec76a79d2e837c611fad1cad486ee6f2aeeb74f1ea32a7e3899bdaa\r\nMsg = cf772bac3e767534b13efd381119b66f8a99b91aa52c8d3ab5f0a60073c9\r\nMac = 08d02ce41d4964b9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 149\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = cb6cee5ba7b799f16254a17b1870cdb85fe0ef3f42110c138742bd7734f0d504\r\nMsg = 40d3c65a00d9204b76e013975ffd729b351698105d47448da285a84de281\r\nMac = 4cc6718396dbe247\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 150\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 9b8cdf91e848eeded2598ccdf084bf591ec2eb668236f555ca61a9d6b49959fd\r\nMsg = 7b3cc6f18a27047f4cdc35404e44eb8e51b1855d4bcd54ccafd1fcfaeef7\r\nMac = faf72c383b56a4ef\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 151\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = e6fdbe9a1efe081bbcfeb25b844734fe60aa6b80a5b5f611982de1a331b88041\r\nMsg = 59a0f85349c3f378d56c509a0a45a1512b5072474b297f9c1a8c24890016\r\nMac = 020354f33df66723\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 152\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = da360852e8b8c3a1b65af9e8630ee5481aa91dce414166f8f3dacb75b142f12d\r\nMsg = 61d908e9663fb195afc259529fc229b14e87995f8d3591b125fcce816090\r\nMac = f8963157ef7c1ba3\r\nResult = P\r\n\r\nCount = 153\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = c9bf0e7e470d0ffc88593796c4cf9a61c6db81d343305ee06a0f0563bcc618c0\r\nMsg = 19378e17c41586b88523a6b6af738dc47e63ea64b4b83fa283f1e502add5\r\nMac = 550523c0347fbcf1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 154\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 7129ca274190400720bba27651f1ee0d5aa79116af9929418e198f9928a715b7\r\nMsg = 891e73a81d7574ce6f73e09e08cbaa0b9db242963f4469cdd2234512c061\r\nMac = 9982a14d261a4060\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 155\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = dfaa73c82a978548c99c0f1c34e1edc2c4edd42b73613511e4e6648ba364f9df\r\nMsg = 18044ac51ea97341061ae7d5bce017fd5cfb1554a384a75aa3919a74ba59\r\nMac = fd3a17e8c51a004f\r\nResult = P\r\n\r\nCount = 156\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 6f0be1905d1b5b607574ad93a1e7b4a536020fc6798acae862253916a0562707\r\nMsg = 8e502d5af4701025787e5b251121676182a0b26cdf52847f4d56d2ca0983\r\nMac = 73d76950066c77d0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 157\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = b9fe826b0138de8184a3002d8bb59d228862e4a14f8556f88282d8494d29068c\r\nMsg = c97ca1930b65064b70d12fc46af4d5e220e6009e729a28a13b0f9a11d3ca\r\nMac = b8bccd70bb90084f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 158\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 99c8f69fb91b17299461fd8d633bd516dcdb172760695ec476a5775377cdb7a4\r\nMsg = ef589e3b4ad9a7ba390574a2db5330baea64894f8f881cd67b842dd23393\r\nMac = 38e11613e67e0416\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 159\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = a86e8b43a1e81dce7b26420c0409628d145445d1c512e1c3df3270839475c668\r\nMsg = c71a0d1e20a7dc8e7adea91a408ecf3d512bcb15a6d8fc1435c6a7f915bd\r\nMac = 101c06c22819404a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 160\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = c5a850167a5bfdf56636ce9e56e2952855504e35cc4f5d24ee5e168853be82d8\r\nMsg = d4794f6f563d5f6445450b59c1ff95d24eadc9c02b68eaa5df64edf81475e5cba8d2bfab021a2fc8\r\nMac = bf99dc0b\r\nResult = P\r\n\r\nCount = 161\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 551e188cbb7c7d1ff33b4bd5bb6c60da184b18f44d68d5c30704df47d8be6fa2\r\nMsg = 2b421be47d07dcb12a0706f7490d05024fce8f433079e18ec78f4c8678f5f1551448c9a0fc70e8b9\r\nMac = 32aeb3d7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 162\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 000da8307f0e6112f0b8a8b1f927f62e8a9e5aefc0d37995088dd32e867148ac\r\nMsg = b89266f3a33e5b6883206e44f8e8e0cb01275039c304960e8630f0aa011c5c19d769443061a060d9\r\nMac = 1b5e30f0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 163\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = f4ae2113ce96435b27369fd4571ae2841a965c8ddbfe61023219eff9abd490e2\r\nMsg = 433ea4e1923267fe443e1e89d2472834b72ef97323ad6d82f3825ca9e1d06fbff8c232ed4c716ab4\r\nMac = 05b3c894\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 164\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = e7c78ef4c4b959ee00cb1a09d71221a43892ef8ad705edd27ed85d03a377907c\r\nMsg = 4da25d1e7064bc4b4903a77452952885a06ba0712544210d30c0182533182fcac90b71e9f71caf22\r\nMac = c15acf48\r\nResult = F (1 - Message changed)\r\n\r\nCount = 165\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 6f48b3bf240525adcb02985900fa29747e4b1265e5a8899abb0ee51cb0f90367\r\nMsg = 98bf67b6e342dd94c948e76aabb69e7d091d24fba54ae233e4181404768988963915a2495b42a4eb\r\nMac = 71bb5873\r\nResult = F (1 - Message changed)\r\n\r\nCount = 166\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = cb6cee5ba7b799f16254a17b1870cdb85fe0ef3f42110c138742bd7734f0d504\r\nMsg = 40d3c65a00d9204b76e013975ffd729b351698105d47448da285a84de281bc3307cfd80b39488213\r\nMac = 592e54d4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 167\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = bbab624862e268765e9e6a13df55cf7a2267520e4e66042ba0b4905dc554c3d0\r\nMsg = d43b841f174335f1347834590b0984a2cb35f7a00a0ee993157d2d4f8487489a12ceddd6ac5b69e0\r\nMac = 3480805a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 168\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 2fc9e8f409cc6c0156ccf9f00686ac7abba6cbe08982a737fa08c7035",
-    "6f54208\r\nMsg = c1cd63e24e41f69a146b448cee0a2107817c8105732745aed817541eede8ee6809e73ddbd0742d84\r\nMac = 91623558\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 169\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = c49dc812061fa4995aa7c160ed7cdf769dd1ef570d8fc9c7f8552101c5bdb711\r\nMsg = 74ec6f53d188be3bdb647f37619fa5848076c66d21bac164c381a4517b1dcd2a384a4fc44cab97e9\r\nMac = 07471b07\r\nResult = P\r\n\r\nCount = 170\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 84b6cd1c6618c42ba74e746075dc28700333578131ca6fde6971d2f0c6e31e6a\r\nMsg = dc79743d2360cc52cee202b9bde9abc7c09d9d0311d89c3722da36c7993feb42992e913744d2f74a\r\nMac = 3acba1e8\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 171\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = dd472b0bf50519020a182f122239d161d9659773b4df454eb378fedc250eb490\r\nMsg = bdf56403d5ff8df4ffca92eb40d54a79b5595abcd67b9e2ffcc5cbc621d7523be75a87a2dc360244\r\nMac = 3bb0894f\r\nResult = P\r\n\r\nCount = 172\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 00ebd245e8c0e0b60847da5c8f7a1f33604932b9cd47a845a1a44599645b62ba\r\nMsg = a238e542f1c22621aebbe331e71123ed7f2591e4192180ae378c2c24a31c42d10fcba3a3f82c65e6\r\nMac = 1d17d6ab\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 173\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 2ecddb226ae668315eecf107c344926330b94077e029ac3bb67e6a077ee05361\r\nMsg = 38ee97f0dc635c7416a024e3af5c95dd1d496db8a5a5c3bcc20b9093ca906dfbcf0b9ebec3b450e4\r\nMac = 08834104\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 174\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 0a2978b5f20d3b5e5ed7ed5a78a093a51d5aa6e728077346f429c27f1c79b635\r\nMsg = 28313dfdc449628f4e2d6c895381844559067823cebb56cd41493ac0d29d6408e7d78d4a21637b08\r\nMac = b2635d7b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 175\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 7f2286d42b4f9eefed1087f3eb3dc814145be4a110c0e74176f83e7d4068cb7e\r\nMsg = 6c1aa088d1a6086d0e72636744a6840c80ab8223409c61b733f7ef6a4199ed0ccbe96f6c3453866e\r\nMac = 10bf9789\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 176\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = bb0fabffbcc6935ca35755fd4bfbd192b6812cf75c4dc95bc3a175a1501be206\r\nMsg = 9801da81a6d9861f26900401aeaec89a74e3d5aec0a5d612a11b6bb4e03ac1db322e65afb1fb5afb\r\nMac = 9ad23631\r\nResult = P\r\n\r\nCount = 177\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = ed1d11cc4876f58feefc463b52d8d36e69c4c2c9227b32fe356d1e2a1bb88466\r\nMsg = b16e6c44f429efdc06a892cede56296e12bf185d4b3c6953f7d31b1c3d59bce136d93aa95a3af61f\r\nMac = 29b26a75\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 178\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = a6fd8382447181bd300ec1ef039d3f353446d01fde490509c3ef52a992bf6fe4\r\nMsg = d41f8fbb6f968dda0c1b2cadbec04a6c72124eb5dc40b8d2b180fd3b17af915b5a374597e036d38d\r\nMac = 2b343893\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 179\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = df0821c9ea6ab329c626d11b4bc1ba7351ca934ece6aae483e3d0bef48601f78\r\nMsg = 84b9c150a1df00ba29386197d79d29a2ceb42fe6390c9e763169f75fe15c55dbe817f5c7fe80f557\r\nMac = 3a5026ef\r\nResult = F (1 - Message changed)\r\n\r\nCount = 180\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 0f1b73e54f4571b2d42aa5ab673f3e99b44f6c37a07a5d4edc7d6b1fba349401\r\nMsg = 3918467effb5d5dc009aaefce84d8cb4fe8f80eb608f4c678f5d0de02ea11e59078d38b04f10de73\r\nMac = 1c207499e0877bb2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 181\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 25a152850b4b80b19d8f0b504b2a8a241824b3a1fca8d85c8713b2c0c84b5e02\r\nMsg = b06f6b3f197bae7d8cde9daf38530e25bc51b68f9aa23ec0e95199b14bca96c91f3db15bf8432f71\r\nMac = b860013252ae83a4\r\nResult = P\r\n\r\nCount = 182\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 849d861aa5a37c6389f7bc2fc3b4860fac9d2277fa5e1a1f9415a6aaa5106886\r\nMsg = 191b53e0c7d90161e5e2014e9b8aea315b4bddf5750aba4be69c944d71896361f210f961ee6b38f9\r\nMac = c9dc7e167c2e442b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 183\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 29dd1ee0ffa12de3a1f2cb8e4e24d2e548794a5e7e372f946bfd733f3c564764\r\nMsg = 891c806e0700f6df72befe47ff088d917cc30763866810a2fcaa9f38b45953156c860b7303e8b15f\r\nMac = 2f7355b3994f45d9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 184\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 6cd7349d96feffbcf6e95a96eacbbe8ddab702ef70052b7804f78518589df3f7\r\nMsg = bbe054fbef86db3ce7ad796e6d0add15455b9cff57fb787610b4e1ba05d5bcaed98564d16157ee70\r\nMac = 8a421387c53702d3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 185\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = a32e186c29f6f1852b483a37b50c02defeb2ce81488198bc082c17fd47a741f4\r\nMsg = e687143dc4d98dcc6a2dfe6ee0f85d565d1f46bb0fafe62a17d01720d6f4ccd86754b0626c9d0af5\r\nMac = d44d78445c5ed8de\r\nResult = F (1 - Message changed)\r\n\r\nCount = 186\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 338f8054d58c26c49360c3e87af56523acf6d89d03e56ff2f868002bc3e431ed\r\nMsg = d42b10d3a688c39edf543ae7330466eeb9e3b678ef073967ff83038d40ded1c200c4f03481fc5aff\r\nMac = b25bf6993f18d503\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 187\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 96e04382027fffcaf779c984be80da16f8437db0e39a7123d9048ff71954acb7\r\nMsg = 494c8f931029a4919e2dcbc16512a8bfe275382e7d29c9abb1d14a006caec59ab9b52a3e9ce54ef7\r\nMac = 5a94a03591ee9cc7\r\nResult = P\r\n\r\nCount = 188\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 682f8bc1eafd4d369df384841a88db7b7fb96c9dd9abd6dedc9290a8d8d17d22\r\nMsg = 87b937b1d36e8a9ab33a1d3eed617030923acaabc7e620dfcb3c388936030fc67f647729c19e040b\r\nMac = 89347722a73d8bf9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 189\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 954222a9cabaa5a0a91100b158a3aeb655c4473d0b00afe6a7a78e0d278a01a9\r\nMsg = b9197eb50c8168d16b8a12bd261d553ffcc521d979b26fee820376252e452213d736c21471cf0179\r\nMac = e5d175fa24cf0fd6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 190\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 18349be2894d49290339b97f4db28c92b3e112ffac77100abbf9c093935b1a46\r\nMsg = 4b02fd5a46ac681a42424ac9723911af4e389ac73829f36f60916563e51cb2ec3d7d9b55d674a59f\r\nMac = 18c98fd13595f857\r\nResult = P\r\n\r\nCount = 191\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = f1f9fdfa9ae3ba8bc6fcdb2e15ae2c47e6292c2acb091fe03e325f298ffff3bd\r\nMsg = 75965cfbf66b0ba13274fce6537fd7aa4efa5d75195a400018bd38f7d8cd53fdffe88df1837fa06f\r\nMac = 935e4d4367aef07e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 192\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 4652bacedb47faee1be641ebf433157f416b4c7d9e8c7c6f7b17b47e70156993\r\nMsg = 17e6acda3c05c9549eadad55d8918f4870aec63a18802fa33175cf838fa2b9b17cb43270ff2a1444\r\nMac = 7ce4adc343a4498a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 193\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 200e4929c275557d9caab0ba3b0a153dd8010ff8f11ebc1f336dd0249d01dce6\r\nMsg = bd05d26ebfcb5f6e102e79976fbd038e02da6a64a6be90bb84bd092be5cb8ae447409e94afd89b8b\r\nMac = 5484fd10e83798c2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 194\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 8c6a6e77534976b4d74a0972742989dbc0f753281a5ff10a862e9048b813b4a9\r\nMsg = 869c482db2b0825cd09d295749359b99fde85240e5ddaebef642f4d249e096b77af2b59b4e37e452\r\nMac = 9e640a86d55be78d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 195\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = be3db75687360fc31c27752a5f32125cf04f8bbab694339ebcb57ff63fc7ba32\r\nMsg = 33dfb223c009001a7b3b81916bb094390c42c24a47884fc8a0410f05b2f57b67d8d9046b2ef4a8ea\r\nMac = c7666f25d2329fb6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 196\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 29e7acc4facc2618f242ec9260a8ec36c4c9dabb89bb8092f00855234b0c505a\r\nMsg = 09bf4f77a9883733590a3cc7ee97f3c9b70f4db255620e88cd5080badc73684c8b80393302ca8803\r\nMac = 424535e20d082087\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 197\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 23f0d00daef3177fbcda6e9953a5a37d5da395204d8af5fb05c74e03f71343da\r\nMsg = 2222135e545f2af53be42d7a463719447e0a6a305fbe8e43e6279a91eb8f3c5db1fdf081bcb77711\r\nMac = 52c42541e2e93f3e\r\nResult = P\r\n\r\nCount = 198\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 6746d9a90e0e763679d5469a1bcffcc4f18f35f50c7714d14c7329b76ce7984e\r\nMsg = 68530f15423071410a349872c559669301096c827333adc4df9da477387c89870942d12513b7f475\r\nMac = 2bf36912e1139629\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 199\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 6b1d94bc0c6e45fc905c509ea667853e4b2c5a8848dd914efcef14d95b12247d\r\nMsg = 207b649c46c1963723624d8428d4b64c08cd4091cc055175223d3758f880614149a9cf7f3725c790\r\nMac = 34f46b361bddf55c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 200\r\nKlen =",
-    " 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 5c77fe134af3fef72fcd16006097dc7dbc45ca10339ae3bc85e0993e4cdcefa1\r\nMsg = fab52c44379ae8083bdc7b827383df93cb1a7ecc21574730f9fe003b7302de237bed535d40832763e7a2cab5806de91d39aa3f38d167ae3250e48ed1f6ad45b5\r\nMac = 03f36c5a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 201\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 997c6b4b513bbdeaf701867bbe81bdee63de0d0d18c870bcc1e9ff7f627f093e\r\nMsg = 4c23d92665e88a4f6f732de384034d493d5df37b767a8260557de05688e8d60dcd0eba9cb8cc4bceb174dcbd3c0ab5a37db3b6ecfb6a3d90a4f54a9f1117e11e\r\nMac = 9e798c73\r\nResult = F (1 - Message changed)\r\n\r\nCount = 202\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 64e390edd97c0af1ba5165900828e0630606f83d4df5240e1b05c307ee9153ff\r\nMsg = 1ae71094fc1b304adfa3378c4efa8fb290526bb314714c9613beca2a709c91f7e3f6aa74561bfc7b8fcd12f910941eea3b593e85ba2fffb31e7420c6c6199868\r\nMac = 1977347f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 203\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 44e2f6d41e04b75f541e724c6f6325f27d7475b3676fa0247f28b36e58b6fdf5\r\nMsg = b9ac624288352617e4d375f33953b431cbf8f03f9ecbda9893330ff2d3c59db8705dc3ba4a6ef924309630ac48765b10b1c02ec0669126d76602c95012fa2f77\r\nMac = 2cba4713\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 204\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 8e0f75b7029d4afc2a86adb4a088b89ef9783965027c1176497ada0fdfd0cd99\r\nMsg = 21cd3ff946e2b3c1c61932205899502852b1333d1c79a3d4e5b6617996ffba17041e5b746ab967fb1632c7be62cbc2bbe60ecd5eec6ca4482424994f9a662cc6\r\nMac = b651d356\r\nResult = P\r\n\r\nCount = 205\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 35b1106d174acce103ecf5801b03d3c10d579c4ee491ebad25fb6f1f1787e0c8\r\nMsg = 960026395d0544975dffaaa2c56db1df5816cd80cde513dc76f6f81d21f15c383c97c7233c9af2423fb28922efed2f69aa47c30de17ae1c5be17acbd0ad6cb8e\r\nMac = 8a8f65a8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 206\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 71efa75961dfd60ad533082a8cfe111214eb02573adc4591c5d0e961640a3ab2\r\nMsg = 6bafbd22b75e21e1fa5444af283e69d53ac2f0412f717a2153f74eb1c195fc5127d240dbc96d2833c9957920a55c505a016a05e4a7ee549bccdbbf1095502e93\r\nMac = 88fea081\r\nResult = F (1 - Message changed)\r\n\r\nCount = 207\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 11752eb8aeffa364c9947092c1612461cc19b6c3a3ddd1817b5e6f7f3745a942\r\nMsg = 2d9109e7eea21b2615c81c03182ce6033c93783b13d698624392bd2a8a202bd0ffc860f29b31afa2f71c2bb85752c66ce8dbba244671288a4135ffe2e1a0209b\r\nMac = b5a26c1c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 208\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 279a6c226f6a48f3128626012baaa309d99065a59dc0a4c003a6e94d85e61638\r\nMsg = 9bff96ba07a52d9ea2415283321395cf57cb37c610fad7a482c74de9f5e3d7f520bf73d4a6fc8b5be023d774dd9680b6a7c68139c8a753a80d61c9978a493917\r\nMac = 5e281941\r\nResult = P\r\n\r\nCount = 209\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 0bcdcaa87ddf8bbe6db8411d14bb9064e4a121286cc8a6e97fce1844935f436b\r\nMsg = 3ec0aa8d30d5ed825b77dc7095f421b1e608158797a377ff8bed641bd387832f7c14818cabf9bd5ced6044cdc883ff7296272be693660ab234b2d870ba170131\r\nMac = 1da79d07\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 210\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 1b41d148e3c202d419ce16385139da196dede5be63987e6940a2bae86d62e567\r\nMsg = 13ecd70e2d76dd53a19b2e5fc0afe0c0793577ba8948b7d4ef3ab797a07a37927dbb33a18252b96f40e0f73a8d3298d67a6551f5854eb6a51019531a122ff8ae\r\nMac = 91bd49b2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 211\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = a1ccc9c992c8a307ad39504854456696f8eafd7c8da0c0c53b3a4485570e985e\r\nMsg = f68b0c3b4556c7f8866b3fa873ed2014418d6421d3f224512e5dae8c2d8dd92175e09508acbcc66ae62d536260cf790671ef66a1bded0343ace4117c1b8d7764\r\nMac = b9317feb\r\nResult = P\r\n\r\nCount = 212\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 4d8d0264ae6d8f7a7440dd760e0ded25a3a94cb0491fe81e7b55221ac8ed24f7\r\nMsg = 5faaf6b8ee8ed5b56bfc1a7f886f9f91a6566ceb99c39462ab675a3ae3be98f68787626fdf77e6243c2e96d1396a8a43417b1f6a51f7e5b0ffaeb889bce02c4b\r\nMac = 3f610010\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 213\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = bcf95051ae2ae84ac32a763d5477ccc4659a9ed3e25de5932939826dc90e2464\r\nMsg = fce924dd27db3e07837694c34f576c16084e5b0a254ca3af0582bf6026c73b47973ac924b02992490032cae987a887932539d3fa53cdfff711b03bd11ff464bb\r\nMac = 7b7e89ef\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 214\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 45ce953ad31ee9b53a9c948883bc86f4bbe0f0744085a9943cbad1066cd7b4f3\r\nMsg = edb1aaa7e8ac37bca99ff8eff5516464aa33fc2bebef8a727d43abf971108bc604aef019c3837aa2f3d429f22fda1f305319a70d99ed77f902663298f855316f\r\nMac = cbf4addd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 215\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = d60841cd71d7227ab56e767817760edba9ce2290f8da504b341ee2c1910b5018\r\nMsg = 365fea641559759d1e5b5581218486318b1c776de812b1aca6a9ba6b1c6e39c5cb6d5a44e3a474f709b8eac457e74f00a43ecd3d060cc7639696bd03730c70e7\r\nMac = 7406f935\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 216\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = d172f991eb697ffdefc57349dadbe51066d2744c39041cd55ca75024eead495d\r\nMsg = 6a91da64812b9bb41a026e727b4f77c384813da2948caed5a9846420c86a26b89f46b2fa6975b95d12452ca69bbfb65bc1c48a79d95c5e69ff4ab7316fe468e8\r\nMac = 6bd82bcc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 217\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 3725c7905bfaca415908c617b78f8deeeff286e0c2bba268d0de92c7664238a7\r\nMsg = fc4bbe329a86089ebe2a2f3320dad55a9bdac1133dd28ddc9ace9ed665885a2341ea9492d4cf4b7e1d0a95f308a9d613407b35b845cf515bbe7f2f35102d78a3\r\nMac = c8e11823\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 218\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = bb3087d1b5b0f6f14a532c3604c82874fb15e97a4b3883dfc50e71ffe5752d40\r\nMsg = 979a9f96112d1ea95eec2cdfdf48c55114472360aa7de24bb53761013af96b33f02b17ae470fece8aaf649d801b4040b7b5152f58a01e7852f565efc77b5dafe\r\nMac = 66466425\r\nResult = P\r\n\r\nCount = 219\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = eeb983439a03ee6a315ebf941e9368f90bb6845b03b31839d72a1946c17d2f19\r\nMsg = 6d5573c9279897d7d1602d8a95c04bb5ca3fad2dbe89a024b3651eb227e73bb559e7c0db08b215fd7efe64afcd24fb155989f2f8965d0e181389e6c4b8e244a9\r\nMac = 7f77d596\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 220\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6f0353a0ad95df6d3190a251435f62c30ed6b9cc0dd024c3c316565cad83d2e1\r\nMsg = 83011a83db0524628b55589ba0165523ce7c916465eaf185805b97ec7f00fc01b82a3e356a6bbb44f2f8deb6425239ac8e26d4d94871c5cf4fe7017c649672f4\r\nMac = 9e56e4574dd01fe8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 221\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 777a22c5fa2f864a9233587e3e9634172ce25006daacbba97b68e7429c8266a8\r\nMsg = 1f7d58d65c36142620172fda3197d3c629bc7bc584e1aaa0f8b6dd320588becaccc39ad124b515adeb941de49ac31c851c5172c4e1c322e42e13cb5ab7f8db2f\r\nMac = 498dafe2807ba34e\r\nResult = P\r\n\r\nCount = 222\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = e17736560b1a13aa8e536500ea6cdb9a6757309aadf25a6a9189055a309c3f8b\r\nMsg = 1a6b80d506147c3c02c89f50892bd1f04d34f9f21e8307140df43835d17495c56a13be7a045be5441de01d84ea19d579f76e9ffa0f92376b5b13c0eacd3050c9\r\nMac = 52d3fbc6e5821f1d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 223\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f31f2fb4b3fd8045b70d34b600a2697cbf7503be0d8cfb5cdc60f9312e3e2695\r\nMsg = 4f43702be4f0530319555d7f1a3356160f6cae48051f12e22a153d7e405c11494c31e6098e24225eb676094755c6d7e992ec0c8c1e2608e76a72d79d173a4e07\r\nMac = 71239a4c38fa04b3\r\nResult = F (1 - Message changed)\r\n\r\nCount = 224\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 10a678f591b4d87280f42d77a91635575e2e82ef610a7c9105c3a9418f932c24\r\nMsg = f7b577f1396b23c27eb637e53d3d92460270b001cc612fd3b4d68bcdd09c2d50571ea4350636324cc2428a087e7bd8785f8202791e3c2d2bafe084a1204e34dd\r\nMac = 5b11c1407904c15e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 225\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = b8728441226558fa9764824597fe254bf8c2623789541feaf6c007efeb0dd2b1\r\nMsg = 80a2be15809f12738f305be3a210ba0c933599c4b24b48257c60e8e3aae189dc6ec58ff1f9085a15405b26a3001a2ff5ff7e1932961490676c6d2cda8417979b\r\nMac = e73ed6c4f81b0ecd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 226\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 22a877d974cdf4d65bbd77958b2b77fc5ddb33a221aca3ecb6d5ae76596f9db4\r\nMsg = ce2ce41f76ca7477972d38a3e8fad1122db34ee80c379fa01f884cf648d1670445a8bfab8490563438c21537ac2dbfbcd7bb24a132d6973cc62ba14089adf7e5\r\nMac = 0ff91813a56b98dd\r\nResult = F (1 - Message",
-    " changed)\r\n\r\nCount = 227\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 03fa02c4df99b8295f502e3145e2edd3ff16722b87092e708bc8d126cc1ec894\r\nMsg = ec9a9babb68e09c38617c9b16e8a2d92e711030bcda4b9e0ab35c4c2392b41692312dde30c91f32cd39cf5fe15ea0deaf3aa04a8157262acee78d7f94204d93a\r\nMac = e50d9a04f79cf9b4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 228\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0e12df1bf17e9645c5507bc2069ca4611dc0488c9996231dbcee1c73393b26c4\r\nMsg = 86814ce4a867f80ce9b618c6aecce37c89851508bbb095c8f7c055f569c47a30f79abe5ec75f12b601298718d6f96ea1c1ebbe7c0cb0b7fb973ec5e6d5c6a713\r\nMac = 05338bce9ed8f495\r\nResult = P\r\n\r\nCount = 229\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 51c88fd98a7d82043a1500fc3d8a66ba7ab7760467c7fd89cfeeb22dd25762a2\r\nMsg = 0e403cff47adee3ec5bb6b178dabfc7d53b60a04eaad33a2fedd9db705358a4c73ab2d982ddbbdc941f1c701d4cac89e5c56fbbe0f4170029ad25e931713ba63\r\nMac = 38c34175627b07e8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 230\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0feb23c7e4a19bcbd70bd300d76ec9045d696f8c9687f49ec4154400e231d2f0\r\nMsg = 0330ed97e44e8b15a49f29c72a7997d05d398a9d45dae41a6cc635258beb824362124691e86cb7fea46e4ab85bdf79e4eb30c492770bf6f0c42ea9bde37a0c01\r\nMac = 271a7c2e687d84c5\r\nResult = P\r\n\r\nCount = 231\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5d649799771f9074d18a2477ccd4d9e136e01451c1eb2e8bb370cb79e0486770\r\nMsg = d715bc0520dbb86543e76fede49dc6be2cce59d3c0db133ff31efcb63a85514fe080da88fa1e788b9e73feb0503c4142bdc67386ac0bacf9311ecada23ca7be8\r\nMac = 42de9f52567b4506\r\nResult = F (1 - Message changed)\r\n\r\nCount = 232\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 4c96d520d8d5a54eb73f8f558e328d1b3e5ba360161fb8444739a40a97a58a1b\r\nMsg = ee409b050346fbd319c8630e4bc9dd6d055355fbb961f018d3fda0c1eea6f61248f43709737fb18d4efc4faf34a96c2f73ece54200367292692e36870a0c94c5\r\nMac = 28610f524d88e727\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 233\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = b186b9273d8cd77d68c05ec5389b2f6e2f267fe6cd6e7cb35a3233c0dfe0b1f4\r\nMsg = 0df3fc6396f851785fca9aa5ffb0cd98bdecf8bbae4c82641efcb34d319e7643ca9c5e22acbde800e0f700a95685c64ccf399173f9123438dc1181b676490cbf\r\nMac = 8d2f69b44614485a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 234\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 1b1374648d93aadb186326e4ca2b82fd37f7234712816fe4feb339a3a16880df\r\nMsg = 9a661677f1e07153e1c9c661c91901757f5b4d9938031f01a802773d6a9863b2a169c44be0d4546c4780e828ef37f3b389f84c1a41473131e9c88bcd530c7334\r\nMac = 72838b59593c011c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 235\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f70b8a4eee3518bba071af55f25f7b698a5b7dc8865cdaca6d1c7993657acc95\r\nMsg = 795ee1af7504621aac329f5081912de545fa11174f3979b14f11aa30df813a235b467fd8f3a14734fe5ac9e39105dcb25184673885cd19bc70ee5a53dd4e8149\r\nMac = 93542734d6cd43de\r\nResult = P\r\n\r\nCount = 236\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0c456d199abae4758734f506c4e9ccdb767e4fd156d5a4085726f3938a516d74\r\nMsg = 78f3bf568f1c3f2866eff8a246a70cf0faee4c3078f3fb27c4bdd53312bf50812bac2280118c0396e610b4110a22406084c18283a30ce7c0e49c769817170df9\r\nMac = c4c5be3c94fb7b9c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 237\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0a8725bd8c8eab9ed52ca47835837b9f00a6c8d834ab17105b01eb4eb30402e7\r\nMsg = d7867ff428c37836161a534d1d697fba43e86b0096c49b63d50afaf06ec772bda86eba7222796f087c5367d1547642b974d041cb496c5cf7984e8e126c9f741e\r\nMac = b5d40f8633965c33\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 238\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = ce9ea80e7fb235486b5f1d0321c68a0e44cd5f15e21f27c402754a2f7c138772\r\nMsg = c246453f5d0f4957e6418b4d17b748f5c30e7ee672b4af2e4e41e145400be94056f4e94768871849fb44c1ee65378fce32d007e0c7ee5635453d4de6b0c2aa4b\r\nMac = 33ae4c66895989ee\r\nResult = F (1 - Message changed)\r\n\r\nCount = 239\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f26fad377bf7d6b35d8ea2e0621b678dad85826fadd3ee684d9215086b77e555\r\nMsg = 63539f949990883ac4f3ef9158b382a30254023c301de9fcd3cd4faa638a0ecb241a2573a9555a5c96da2435aa02c73cfc12c10f84b565bfdea9c6274bb8d67c\r\nMac = 8cda222f03f92913\r\nResult = F (2 - Key or Key2 changed)\r\n",
-};
-static const size_t kLen36 = 58307;
-
-static const char *kData36[] = {
     "# Tests from NIST CAVP SP 800-56A ECCCDH Primitive Test Vectors.\n# http://csrc.nist.gov/groups/STM/cavp/documents/components/ecccdhtestvectors.zip\n#\n# P-521 test vectors were fixed to have the right length.\n\nCurve = P-224\nPrivate = 8346a60fc6f293ca5a0d2af68ba71d1dd389e5e40837942df3e43cbd\nX = 8de2e26adf72c582d6568ef638c4fd59b18da171bdf501f1d929e048\nY = 4a68a1c2b0fb22930d120555c1ece50ea98dea8407f71be36efac0de\nPeerX = af33cd0629bc7e996320a3f40368f74de8704fa37b8fab69abaae280\nPeerY = 882092ccbba7930f419a8a4f9bb16978bbc3838729992559a6f2e2d7\nZ = 7d96f9a3bd3c05cf5cc37feb8b9d5209d5c2597464dec3e9983743e8\n\nCurve = P-224\nPrivate = 043cb216f4b72cdf7629d63720a54aee0c99eb32d74477dac0c2f73d\nX = 2f90f5c8eac9c7decdbb97b6c2f715ab725e4fe40fe6d746efbf4e1b\nY = 66897351454f927a309b269c5a6d31338be4c19a5acfc32cf656f45c\nPeerX = 13bfcd4f8e9442393cab8fb46b9f0566c226b22b37076976f0617a46\nPeerY = eeb2427529b288c63c2f8963c1e473df2fca6caa90d52e2f8db56dd4\nZ = ee93ce06b89ff72009e858c68eb708e7bc79ee0300f73bed69bbca09\n\nCurve = P-224\nPrivate = 5ad0dd6dbabb4f3c2ea5fe32e561b2ca55081486df2c7c15c9622b08\nX = 005bca45d793e7fe99a843704ed838315ab14a5f6277507e9bc37531\nY = 43e9d421e1486ae5893bfd23c210e5c140d7c6b1ada59d842c9a98de\nPeerX = 756dd806b9d9c34d899691ecb45b771af468ec004486a0fdd283411e\nPeerY = 4d02c2ca617bb2c5d9613f25dd72413d229fd2901513aa29504eeefb\nZ = 3fcc01e34d4449da2a974b23fc36f9566754259d39149790cfa1ebd3\n\nCurve = P-224\nPrivate = 0aa6ff55a5d820efcb4e7d10b845ea3c9f9bc5dff86106db85318e22\nX = 2f96754131e0968198aa78fbe8c201dc5f3581c792de487340d32448\nY = 61e8a5cd79615203b6d89e9496f9e236fe3b6be8731e743d615519c6\nPeerX = 0f537bf1c1122c55656d25e8aa8417e0b44b1526ae0523144f9921c4\nPeerY = f79b26d30e491a773696cc2c79b4f0596bc5b9eebaf394d162fb8684\nZ = 49129628b23afcef48139a3f6f59ff5e9811aa746aa4ff33c24bb940\n\nCurve = P-224\nPrivate = efe6e6e25affaf54c98d002abbc6328da159405a1b752e32dc23950a\nX = 355e962920bde043695f6bffb4b355c63da6f5de665ed46f2ec817e2\nY = 748e095368f62e1d364edd461719793b404adbdaacbcadd88922ff37\nPeerX = 2b3631d2b06179b3174a100f7f57131eeea8947be0786c3dc64b2239\nPeerY = 83de29ae3dad31adc0236c6de7f14561ca2ea083c5270c78a2e6cbc0\nZ = fcdc69a40501d308a6839653a8f04309ec00233949522902ffa5eac6\n\nCurve = P-224\nPrivate = 61cb2932524001e5e9eeed6df7d9c8935ee3322029edd7aa8acbfd51\nX = d50e4adabfd989d7dbc7cf4052546cc7c447a97630436997ad4b9536\nY = 5bea503473c5eaef9552d42c40b1f2f7ca292733b255b9bbe1b12337\nPeerX = 4511403de29059f69a475c5a6a5f6cabed5d9f014436a8cb70a02338\nPeerY = 7d2d1b62aa046df9340f9c37a087a06b32cf7f08a223f992812a828b\nZ = 827e9025cb62e0e837c596063f3b9b5a0f7afd8d8783200086d61ec1\n\nCurve = P-224\nPrivate = 8c7ace347171f92def98d845475fc82e1d1496da81ee58f505b985fa\nX = b1a8dcac89aca2799320b451df1c7ff4d97567abb68141c0d95fc2aa\nY = 3524950902b1510bdc987d860afc27ad871ceaea66935abd3c0a99a8\nPeerX = 314a0b26dd31c248845d7cc17b61cad4608259bed85a58d1f1ffd378\nPeerY = 66e4b350352e119eecada382907f3619fd748ea73ae4899dfd496302\nZ = 335ba51228d94acbed851ca7821c801d5cb1c7975d7aa90a7159f8fa\n\nCurve = P-224\nPrivate = 382feb9b9ba10f189d99e71a89cdfe44cb554cec13a212840977fb68\nX = abb6f1e3773ff8fc73aea2a0b107809ce70adcefed6e41fc5cb43045\nY = a963897ae906c10a055eeadb97ffdd6f748d3e5621e5fff304e48ba7\nPeerX = abe6843beec2fd9e5fb64730d0be4d165438ce922ed75dd80b4603e5\nPeerY = 6afe8673a96c4ba9900ad85995e631e436c6cc88a2c2b47b7c4886b8\nZ = 8c2e627594206b34f7356d3426eb3d79f518ef843fbe94014cceace3\n\nCurve = P-224\nPrivate = e0d62035101ef487c485c60fb4500eebe6a32ec64dbe97dbe0232c46\nX = 88537735e9b23e3e0e076f135a82d33f9bffb465f3abce8322a62a62\nY = b4c8c123673197875c0bd14ed097606d330fba2b9200ef65a44764d3\nPeerX = 13cf9d6d2c9aae8274c27d446afd0c888ffdd52ae299a35984d4f527\nPeerY = dcbee75b515751f8ee2ae355e8afd5de21c62a939a6507b538cbc4af\nZ = 632abb662728dbc994508873d5c527ca5ef923c0d31fa6c47ef4c825\n\nCurve = P-224\nPrivate = b96ade5b73ba72aa8b6e4d74d7bf9c58e962ff78eb542287c7b44ba2\nX = 37682926a54f70a4c1748f54d50d5b00138a055f924f2c65e5b0bbe4\nY = 596afefcdd640d29635015b89bdddd1f8c2723686d332e7a06ca8799\nPeerX = 965b637c0dfbc0cf954035686d70f7ec30929e664e521dbaa2280659\nPeerY = 82a58ff61bc90019bbcbb5875d3863db0bc2a1fa34b0ad4de1a83f99\nZ = 34641141aab05ef58bd376d609345901fb8f63477c6be9097f037f1f\n\nCurve = P-224\nPrivate = a40d7e12049c71e6522c7ff2384224061c3a457058b310557655b854\nX = 399801243bfe0c2da9b0a53c8ca57f2eee87aaa94a8e4d5e029f42ca\nY = aa49e6d4b47cee7a5c4ab71d5a67da84e0b9b425ce3e70da68c889e7\nPeerX = 73cc645372ca2e71637cda943d8148f3382ab6dd0f2e1a49da94e134\nPeerY = df5c355c23e6e232ebc3bee2ab1873ee0d83e3382f8e6fe613f6343c\nZ = 4f74ac8507501a32bfc5a78d8271c200e835966e187e8d00011a8c75\n\nCurve = P-224\nPrivate = ad2519bc724d484e02a69f05149bb047714bf0f5986fac2e222cd946\nX = df9c1e0ef15e53b9f626e2be1cbe893639c06f3e0439ee95d7d4b1e3\nY = 7a52a7386adda243efdf8941085c84e31239cab92b8017336748965e\nPeerX = 546578216250354e449e21546dd11cd1c5174236739acad9ce0f4512\nPeerY = d2a22fcd66d1abedc767668327c5cb9c599043276239cf3c8516af24\nZ = ad09c9ae4d2324ea81bb555b200d3c003e22a6870ee03b52df49e4de\n\nCurve = P-224\nPrivate = 3d312a9b9d8ed09140900bbac1e095527ebc9e3c6493bcf3666e3a29\nX = b4a0198dc8810e884425b750928b0c960c31f7a99663400b01a179df\nY = 812b601bfc0738242c6f86f830f27acd632ca618a0b5280c9d5769f7\nPeerX = 1d46b1dc3a28123cb51346e67baec56404868678faf7d0e8b2afa22a\nPeerY = 0ec9e65ec97e218373e7fc115c2274d5b829a60d93f71e01d58136c3\nZ = ef029c28c68064b8abd2965a38c404fb5e944ace57e8638daba9d3cd\n\nCurve = P-224\nPrivate = 8ce0822dc24c153995755ac350737ef506641c7d752b4f9300c612ed\nX = 00dfc7ec137690cd6d12fdb2fd0b8c5314582108769c2b722ffb3958\nY = 5eef3da4ba458127346bb64023868bddb7558a2ecfc813645f4ce9fe\nPeerX = 266d038cc7a4fe21f6c976318e827b82bb5b8f7443a55298136506e0\nPeerY = df123d98a7a20bbdf3943df2e3563422f8c0cf74d53aaabdd7c973ba\nZ = f83c16661dfcbad021cc3b5a5af51d9a18db4653866b3ff90787ce3e\n\nCurve = P-224\nPrivate = 0ff9b485325ab77f29e7bc379fed74bfac859482da0dee7528c19db2\nX = 7e603e6976db83c36011508fa695d1b515249e2e54b48fcbcfb90247\nY = 0179a600ce86adfca9b1b931fa5173d618da09e841803d19b0264286\nPeerX = eb0a09f7a1c236a61f595809ec5670efd92e4598d5e613e092cdfdca\nPeerY = 50787ae2f2f15b88bc10f7b5f0aee1418373f16153aebd1fba54288d\nZ = f51258c63f232e55a66aa25ebd597b2018d1052c02eeb63866758005\n\nCurve = P-224\nPrivate = 19cf5ff6306467f28b9fe0675a43c0582552c8c12e59ce7c38f292b1\nX = fc20e906e609c112cfc2e0fea6303882c5db94e87e022373ab2c082a\nY = aecdf1daa71782bc5a26bbbd8d7e8a76490e26abc17dffc774bd7341\nPeerX = 6b2f6b18a587f562ffc61bd9b0047322286986a78f1fd139b84f7c24\nPeerY = 7096908e4615266be59a53cd655515056ff92370a6271a5d3823d704\nZ = 7fdc969a186ff18429f2a276dac43beea21182d82ce2e5a0876552b1\n\nCurve = P-224\nPrivate = 90a15368e3532c0b1e51e55d139447c2c89bc160719d697291ea7c14\nX = c6837d506e976da7db3ad1267c359dff2ea6fb0b7f7f8e77024c59e9\nY = 67eb491d2fc8a530c46525d2a8b2d7c1df5fba1ae740a4649c683ee6\nPeerX = 328101ba826acd75ff9f34d5574ce0dbc92f709bad8d7a33c47940c1\nPeerY = df39f1ea88488c55d5538160878b9ced18a887ea261dd712d14024ff\nZ = 3d60ab6db2b3ffe2d29ccff46d056e54230cf34982e241556ed2920c\n\nCurve = P-224\nPrivate = 8e0838e05e1721491067e1cabc2e8051b290e2616eec427b7121897d\nX = e9150f770075626019e18f95473b71e6828041791d3f08d3faeeaa2b\nY = 475f70735eaae52308a3b763dc88efe18ab590ebafa035f6e08b001c\nPeerX = 0081e34270871e2ebbd94183f617b4ae15f0416dd634fe6e934cf3c0\nPeerY = 3a1e9f38a7b90b7317d26b9f6311063ab58b268cf489b2e50386d5d6\nZ = 9116d72786f4db5df7a8b43078c6ab9160d423513d35ea5e2559306d\n\nCurve = P-224\nPrivate = 38106e93f16a381adb1d72cee3da66ae462ad4bbfea9ecdf35d0814e\nX = 7be6c4c917829ab657dd79e8637d7aefd2f81f0de7654d957e97658d\nY = 430d22d9e8438310f61e0d43f25fa3e34585f432baad27db3021bf0d\nPeerX = 2623632fdf0bd856805a69aa186d4133ef5904e1f655a972d66cce07\nPeerY = 2cef9728dd06fb8b50150f529b695076d4507983912585c89bd0682e\nZ = 207c53dcefac789aaa0276d9200b3a940ce5f2296f4cb2e81a185d3d\n\nCurve = P-224\nPrivate = e5d1718431cf50f6cbd1bc8019fa16762dfa12c989e5999977fb4ea2\nX = 2ea4966e7f92ed7f5cc61fde792045f63b731d6e7d0de2577f2d8ece\nY = 1c4a7b1ede6f839162292df424be78e8176fb6f942a3c02391700f31\nPeerX = 8ee4d1dcc31dee4bf6fe21ca8a587721d910acfb122c16c2a77a8152\nPeerY = 4ebf323fff04eb477069a0ac68b345f6b1ae134efc31940e513cb99f\nZ = 10e467da34f48ad7072005bccd6da1b2ba3f71eafa1c393842f91d74\n\nCurve = P-224\nPrivate = 3d635691b62a9a927c633951c9369c8862bd2119d30970c2644727d6\nX =",
     " 438bbb980517afb20be1d674e3ac2b31cef07a9b23fb8f6e38e0d6c0\nY = 0be5f1c47d58d21b6ed28423b32f5a94750da47edcef33ea79942afd\nPeerX = 97dcbe6d28335882a6d193cc54a1063dd0775dc328565300bb99e691\nPeerY = dad11dd5ece8cfd9f97c9a526e4a1506e6355969ee87826fc38bcd24\nZ = 82fd2f9c60c4f999ac00bbe64bfc11da8ff8cda2e499fced65230bb1\n\nCurve = P-224\nPrivate = acf3c85bbdc379f02f5ea36e7f0f53095a9e7046a28685a8659bf798\nX = ff7511215c71d796bd646e8474be4416b91684ce0d269ef6f422013b\nY = b7bf5e79b5a9393bb9ea42c0bdb2d3c2dc806e1a7306aa58e4fdbea5\nPeerX = ce9126dd53972dea1de1d11efef900de34b661859c4648c5c0e534f7\nPeerY = e113b6f2c1659d07f2716e64a83c18bbce344dd2121fe85168eae085\nZ = 530f7e7fc932613b29c981f261cb036cba3f1df3864e0e1cba2685a2\n\nCurve = P-224\nPrivate = cffd62cb00a0e3163fbf2c397fadc9618210f86b4f54a675287305f0\nX = 04bf4d948f4430d18b4ed6c96dbaf981fa11a403ed16887f06754981\nY = 7c1326a9cef51f79d4e78303d6064b459f612584ac2fdf593d7d5d84\nPeerX = 84419967d6cfad41e75a02b6da605a97949a183a97c306c4b46e66a5\nPeerY = 5cc9b259718b1bc8b144fde633a894616ffd59a3a6d5d8e942c7cbb7\nZ = 49f6fd0139248ef4df2db05d1319bd5b1489e249827a45a8a5f12427\n\nCurve = P-224\nPrivate = 85f903e43943d13c68932e710e80de52cbc0b8f1a1418ea4da079299\nX = 970a4a7e01d4188497ceb46955eb1b842d9085819a9b925c84529d3d\nY = dfa2526480f833ea0edbd204e4e365fef3472888fe7d9691c3ebc09f\nPeerX = 7c9cac35768063c2827f60a7f51388f2a8f4b7f8cd736bd6bc337477\nPeerY = 29ee6b849c6025d577dbcc55fbd17018f4edbc2ef105b004d6257bcd\nZ = 8f7e34e597ae8093b98270a74a8dfcdbed457f42f43df487c5487161\n\nCurve = P-224\nPrivate = cce64891a3d0129fee0d4a96cfbe7ac470b85e967529057cfa31a1d9\nX = a6b29632db94da2125dc1cf80e03702687b2acc1122022fa2174765a\nY = 61723edd73e10daed73775278f1958ba56f1fc9d085ebc2b64c84fe5\nPeerX = 085a7642ad8e59b1a3e8726a7547afbecffdac1dab7e57230c6a9df4\nPeerY = f91c36d881fe9b8047a3530713554a1af4c25c5a8e654dcdcf689f2e\nZ = 71954e2261e8510be1a060733671d2e9d0a2d012eb4e09556d697d2a\n\nCurve = P-256\nPrivate = 7d7dc5f71eb29ddaf80d6214632eeae03d9058af1fb6d22ed80badb62bc1a534\nX = ead218590119e8876b29146ff89ca61770c4edbbf97d38ce385ed281d8a6b230\nY = 28af61281fd35e2fa7002523acc85a429cb06ee6648325389f59edfce1405141\nPeerX = 700c48f77f56584c5cc632ca65640db91b6bacce3a4df6b42ce7cc838833d287\nPeerY = db71e509e3fd9b060ddb20ba5c51dcc5948d46fbf640dfe0441782cab85fa4ac\nZ = 46fc62106420ff012e54a434fbdd2d25ccc5852060561e68040dd7778997bd7b\n\nCurve = P-256\nPrivate = 38f65d6dce47676044d58ce5139582d568f64bb16098d179dbab07741dd5caf5\nX = 119f2f047902782ab0c9e27a54aff5eb9b964829ca99c06b02ddba95b0a3f6d0\nY = 8f52b726664cac366fc98ac7a012b2682cbd962e5acb544671d41b9445704d1d\nPeerX = 809f04289c64348c01515eb03d5ce7ac1a8cb9498f5caa50197e58d43a86a7ae\nPeerY = b29d84e811197f25eba8f5194092cb6ff440e26d4421011372461f579271cda3\nZ = 057d636096cb80b67a8c038c890e887d1adfa4195e9b3ce241c8a778c59cda67\n\nCurve = P-256\nPrivate = 1accfaf1b97712b85a6f54b148985a1bdc4c9bec0bd258cad4b3d603f49f32c8\nX = d9f2b79c172845bfdb560bbb01447ca5ecc0470a09513b6126902c6b4f8d1051\nY = f815ef5ec32128d3487834764678702e64e164ff7315185e23aff5facd96d7bc\nPeerX = a2339c12d4a03c33546de533268b4ad667debf458b464d77443636440ee7fec3\nPeerY = ef48a3ab26e20220bcda2c1851076839dae88eae962869a497bf73cb66faf536\nZ = 2d457b78b4614132477618a5b077965ec90730a8c81a1c75d6d4ec68005d67ec\n\nCurve = P-256\nPrivate = 207c43a79bfee03db6f4b944f53d2fb76cc49ef1c9c4d34d51b6c65c4db6932d\nX = 24277c33f450462dcb3d4801d57b9ced05188f16c28eda873258048cd1607e0d\nY = c4789753e2b1f63b32ff014ec42cd6a69fac81dfe6d0d6fd4af372ae27c46f88\nPeerX = df3989b9fa55495719b3cf46dccd28b5153f7808191dd518eff0c3cff2b705ed\nPeerY = 422294ff46003429d739a33206c8752552c8ba54a270defc06e221e0feaf6ac4\nZ = 96441259534b80f6aee3d287a6bb17b5094dd4277d9e294f8fe73e48bf2a0024\n\nCurve = P-256\nPrivate = 59137e38152350b195c9718d39673d519838055ad908dd4757152fd8255c09bf\nX = a8c5fdce8b62c5ada598f141adb3b26cf254c280b2857a63d2ad783a73115f6b\nY = 806e1aafec4af80a0d786b3de45375b517a7e5b51ffb2c356537c9e6ef227d4a\nPeerX = 41192d2813e79561e6a1d6f53c8bc1a433a199c835e141b05a74a97b0faeb922\nPeerY = 1af98cc45e98a7e041b01cf35f462b7562281351c8ebf3ffa02e33a0722a1328\nZ = 19d44c8d63e8e8dd12c22a87b8cd4ece27acdde04dbf47f7f27537a6999a8e62\n\nCurve = P-256\nPrivate = f5f8e0174610a661277979b58ce5c90fee6c9b3bb346a90a7196255e40b132ef\nX = 7b861dcd2844a5a8363f6b8ef8d493640f55879217189d80326aad9480dfc149\nY = c4675b45eeb306405f6c33c38bc69eb2bdec9b75ad5af4706aab84543b9cc63a\nPeerX = 33e82092a0f1fb38f5649d5867fba28b503172b7035574bf8e5b7100a3052792\nPeerY = f2cf6b601e0a05945e335550bf648d782f46186c772c0f20d3cd0d6b8ca14b2f\nZ = 664e45d5bba4ac931cd65d52017e4be9b19a515f669bea4703542a2c525cd3d3\n\nCurve = P-256\nPrivate = 3b589af7db03459c23068b64f63f28d3c3c6bc25b5bf76ac05f35482888b5190\nX = 9fb38e2d58ea1baf7622e96720101cae3cde4ba6c1e9fa26d9b1de0899102863\nY = d5561b900406edf50802dd7d73e89395f8aed72fba0e1d1b61fe1d22302260f0\nPeerX = 6a9e0c3f916e4e315c91147be571686d90464e8bf981d34a90b6353bca6eeba7\nPeerY = 40f9bead39c2f2bcc2602f75b8a73ec7bdffcbcead159d0174c6c4d3c5357f05\nZ = ca342daa50dc09d61be7c196c85e60a80c5cb04931746820be548cdde055679d\n\nCurve = P-256\nPrivate = d8bf929a20ea7436b2461b541a11c80e61d826c0a4c9d322b31dd54e7f58b9c8\nX = 20f07631e4a6512a89ad487c4e9d63039e579cb0d7a556cb9e661cd59c1e7fa4\nY = 6de91846b3eee8a5ec09c2ab1f41e21bd83620ccdd1bdce3ab7ea6e02dd274f5\nPeerX = a9c0acade55c2a73ead1a86fb0a9713223c82475791cd0e210b046412ce224bb\nPeerY = f6de0afa20e93e078467c053d241903edad734c6b403ba758c2b5ff04c9d4229\nZ = 35aa9b52536a461bfde4e85fc756be928c7de97923f0416c7a3ac8f88b3d4489\n\nCurve = P-256\nPrivate = 0f9883ba0ef32ee75ded0d8bda39a5146a29f1f2507b3bd458dbea0b2bb05b4d\nX = abb61b423be5d6c26e21c605832c9142dc1dfe5a5fff28726737936e6fbf516d\nY = 733d2513ef58beab202090586fac91bf0fee31e80ab33473ab23a2d89e58fad6\nPeerX = 94e94f16a98255fff2b9ac0c9598aac35487b3232d3231bd93b7db7df36f9eb9\nPeerY = d8049a43579cfa90b8093a94416cbefbf93386f15b3f6e190b6e3455fedfe69a\nZ = 605c16178a9bc875dcbff54d63fe00df699c03e8a888e9e94dfbab90b25f39b4\n\nCurve = P-256\nPrivate = 2beedb04b05c6988f6a67500bb813faf2cae0d580c9253b6339e4a3337bb6c08\nX = 3d63e429cb5fa895a9247129bf4e48e89f35d7b11de8158efeb3e106a2a87395\nY = 0cae9e477ef41e7c8c1064379bb7b554ddcbcae79f9814281f1e50f0403c61f3\nPeerX = e099bf2a4d557460b5544430bbf6da11004d127cb5d67f64ab07c94fcdf5274f\nPeerY = d9c50dbe70d714edb5e221f4e020610eeb6270517e688ca64fb0e98c7ef8c1c5\nZ = f96e40a1b72840854bb62bc13c40cc2795e373d4e715980b261476835a092e0b\n\nCurve = P-256\nPrivate = 77c15dcf44610e41696bab758943eff1409333e4d5a11bbe72c8f6c395e9f848\nX = ad5d13c3db508ddcd38457e5991434a251bed49cf5ddcb59cdee73865f138c9f\nY = 62cec1e70588aa4fdfc7b9a09daa678081c04e1208b9d662b8a2214bf8e81a21\nPeerX = f75a5fe56bda34f3c1396296626ef012dc07e4825838778a645c8248cff01658\nPeerY = 33bbdf1b1772d8059df568b061f3f1122f28a8d819167c97be448e3dc3fb0c3c\nZ = 8388fa79c4babdca02a8e8a34f9e43554976e420a4ad273c81b26e4228e9d3a3\n\nCurve = P-256\nPrivate = 42a83b985011d12303db1a800f2610f74aa71cdf19c67d54ce6c9ed951e9093e\nX = ab48caa61ea35f13f8ed07ffa6a13e8db224dfecfae1a7df8b1bb6ebaf0cb97d\nY = 1274530ca2c385a3218bddfbcbf0b4024c9badd5243bff834ebff24a8618dccb\nPeerX = 2db4540d50230756158abf61d9835712b6486c74312183ccefcaef2797b7674d\nPeerY = 62f57f314e3f3495dc4e099012f5e0ba71770f9660a1eada54104cdfde77243e\nZ = 72877cea33ccc4715038d4bcbdfe0e43f42a9e2c0c3b017fc2370f4b9acbda4a\n\nCurve = P-256\nPrivate = ceed35507b5c93ead5989119b9ba342cfe38e6e638ba6eea343a55475de2800b\nX = 9a8cd9bd72e71752df91440f77c547509a84df98114e7de4f26cdb39234a625d\nY = d07cfc84c8e144fab2839f5189bb1d7c88631d579bbc58012ed9a2327da52f62\nPeerX = cd94fc9497e8990750309e9a8534fd114b0a6e54da89c4796101897041d14ecb\nPeerY = c3def4b5fe04faee0a11932229fff563637bfdee0e79c6deeaf449f85401c5c4\nZ = e4e7408d85ff0e0e9c838003f28cdbd5247cdce31f32f62494b70e5f1bc36307\n\nCurve = P-256\nPrivate = 43e0e9d95af4dc36483cdd1968d2b7eeb8611fcce77f3a4e7d059ae43e509604\nX = f989cf8ee956a82e7ebd9881cdbfb2fd946189b08db53559bc8cfdd48071eb14\nY = 5eff28f1a18a616b04b7d337868679f6dd84f9a7b3d7b6f8af276c19611a541d\nPeerX = 15b9e467af4d290c417402e040426fe4cf236bae72baa392ed89780dfccdb471\nPeerY = cdf4e9170fb904302b8fd93a820ba8cc7ed4efd3a6f2d6b05b80b2ff2aee4e77\nZ = ed56bcf695b734142c24ecb1fc1bb64d08f175eb243a31f37b3d9bb4407f3b96\n\nCurve = P-256\nPrivate = b2f3600df3368ef8a0bb85ab22f41fc0e5f4fdd54be8167a5c3cd4b08db04903\nX = 69c627",
     "625b36a429c398b45c38677cb35d8beb1cf78a571e40e99fe4eac1cd4e\nY = 81690112b0a88f20f7136b28d7d47e5fbc2ada3c8edd87589bc19ec9590637bd\nPeerX = 49c503ba6c4fa605182e186b5e81113f075bc11dcfd51c932fb21e951eee2fa1\nPeerY = 8af706ff0922d87b3f0c5e4e31d8b259aeb260a9269643ed520a13bb25da5924\nZ = bc5c7055089fc9d6c89f83c1ea1ada879d9934b2ea28fcf4e4a7e984b28ad2cf\n\nCurve = P-256\nPrivate = 4002534307f8b62a9bf67ff641ddc60fef593b17c3341239e95bdb3e579bfdc8\nX = 5fe964671315a18aa68a2a6e3dd1fde7e23b8ce7181471cfac43c99e1ae80262\nY = d5827be282e62c84de531b963884ba832db5d6b2c3a256f0e604fe7e6b8a7f72\nPeerX = 19b38de39fdd2f70f7091631a4f75d1993740ba9429162c2a45312401636b29c\nPeerY = 09aed7232b28e060941741b6828bcdfa2bc49cc844f3773611504f82a390a5ae\nZ = 9a4e8e657f6b0e097f47954a63c75d74fcba71a30d83651e3e5a91aa7ccd8343\n\nCurve = P-256\nPrivate = 4dfa12defc60319021b681b3ff84a10a511958c850939ed45635934ba4979147\nX = c9b2b8496f1440bd4a2d1e52752fd372835b364885e154a7dac49295f281ec7c\nY = fbe6b926a8a4de26ccc83b802b1212400754be25d9f3eeaf008b09870ae76321\nPeerX = 2c91c61f33adfe9311c942fdbff6ba47020feff416b7bb63cec13faf9b099954\nPeerY = 6cab31b06419e5221fca014fb84ec870622a1b12bab5ae43682aa7ea73ea08d0\nZ = 3ca1fc7ad858fb1a6aba232542f3e2a749ffc7203a2374a3f3d3267f1fc97b78\n\nCurve = P-256\nPrivate = 1331f6d874a4ed3bc4a2c6e9c74331d3039796314beee3b7152fcdba5556304e\nX = 59e1e101521046ad9cf1d082e9d2ec7dd22530cce064991f1e55c5bcf5fcb591\nY = 482f4f673176c8fdaa0bb6e59b15a3e47454e3a04297d3863c9338d98add1f37\nPeerX = a28a2edf58025668f724aaf83a50956b7ac1cfbbff79b08c3bf87dfd2828d767\nPeerY = dfa7bfffd4c766b86abeaf5c99b6e50cb9ccc9d9d00b7ffc7804b0491b67bc03\nZ = 1aaabe7ee6e4a6fa732291202433a237df1b49bc53866bfbe00db96a0f58224f\n\nCurve = P-256\nPrivate = dd5e9f70ae740073ca0204df60763fb6036c45709bf4a7bb4e671412fad65da3\nX = 30b9db2e2e977bcdc98cb87dd736cbd8e78552121925cf16e1933657c2fb2314\nY = 6a45028800b81291bce5c2e1fed7ded650620ebbe6050c6f3a7f0dfb4673ab5c\nPeerX = a2ef857a081f9d6eb206a81c4cf78a802bdf598ae380c8886ecd85fdc1ed7644\nPeerY = 563c4c20419f07bc17d0539fade1855e34839515b892c0f5d26561f97fa04d1a\nZ = 430e6a4fba4449d700d2733e557f66a3bf3d50517c1271b1ddae1161b7ac798c\n\nCurve = P-256\nPrivate = 5ae026cfc060d55600717e55b8a12e116d1d0df34af831979057607c2d9c2f76\nX = 46c9ebd1a4a3c8c0b6d572b5dcfba12467603208a9cb5d2acfbb733c40cf6391\nY = 46c913a27d044185d38b467ace011e04d4d9bbbb8cb9ae25fa92aaf15a595e86\nPeerX = ccd8a2d86bc92f2e01bce4d6922cf7fe1626aed044685e95e2eebd464505f01f\nPeerY = e9ddd583a9635a667777d5b8a8f31b0f79eba12c75023410b54b8567dddc0f38\nZ = 1ce9e6740529499f98d1f1d71329147a33df1d05e4765b539b11cf615d6974d3\n\nCurve = P-256\nPrivate = b601ac425d5dbf9e1735c5e2d5bdb79ca98b3d5be4a2cfd6f2273f150e064d9d\nX = 7c9e950841d26c8dde8994398b8f5d475a022bc63de7773fcf8d552e01f1ba0a\nY = cc42b9885c9b3bee0f8d8c57d3a8f6355016c019c4062fa22cff2f209b5cc2e1\nPeerX = c188ffc8947f7301fb7b53e36746097c2134bf9cc981ba74b4e9c4361f595e4e\nPeerY = bf7d2f2056e72421ef393f0c0f2b0e00130e3cac4abbcc00286168e85ec55051\nZ = 4690e3743c07d643f1bc183636ab2a9cb936a60a802113c49bb1b3f2d0661660\n\nCurve = P-256\nPrivate = fefb1dda1845312b5fce6b81b2be205af2f3a274f5a212f66c0d9fc33d7ae535\nX = 38b54db85500cb20c61056edd3d88b6a9dc26780a047f213a6e1b900f76596eb\nY = 6387e4e5781571e4eb8ae62991a33b5dc33301c5bc7e125d53794a39160d8fd0\nPeerX = 317e1020ff53fccef18bf47bb7f2dd7707fb7b7a7578e04f35b3beed222a0eb6\nPeerY = 09420ce5a19d77c6fe1ee587e6a49fbaf8f280e8df033d75403302e5a27db2ae\nZ = 30c2261bd0004e61feda2c16aa5e21ffa8d7e7f7dbf6ec379a43b48e4b36aeb0\n\nCurve = P-256\nPrivate = 334ae0c4693d23935a7e8e043ebbde21e168a7cba3fa507c9be41d7681e049ce\nX = 3f2bf1589abf3047bf3e54ac9a95379bff95f8f55405f64eca36a7eebe8ffca7\nY = 5212a94e66c5ae9a8991872f66a72723d80ec5b2e925745c456f5371943b3a06\nPeerX = 45fb02b2ceb9d7c79d9c2fa93e9c7967c2fa4df5789f9640b24264b1e524fcb1\nPeerY = 5c6e8ecf1f7d3023893b7b1ca1e4d178972ee2a230757ddc564ffe37f5c5a321\nZ = 2adae4a138a239dcd93c243a3803c3e4cf96e37fe14e6a9b717be9599959b11c\n\nCurve = P-256\nPrivate = 2c4bde40214fcc3bfc47d4cf434b629acbe9157f8fd0282540331de7942cf09d\nX = 29c0807f10cbc42fb45c9989da50681eead716daa7b9e91fd32e062f5eb92ca0\nY = ff1d6d1955d7376b2da24fe1163a271659136341bc2eb1195fc706dc62e7f34d\nPeerX = a19ef7bff98ada781842fbfc51a47aff39b5935a1c7d9625c8d323d511c92de6\nPeerY = e9c184df75c955e02e02e400ffe45f78f339e1afe6d056fb3245f4700ce606ef\nZ = 2e277ec30f5ea07d6ce513149b9479b96e07f4b6913b1b5c11305c1444a1bc0b\n\nCurve = P-256\nPrivate = 85a268f9d7772f990c36b42b0a331adc92b5941de0b862d5d89a347cbf8faab0\nX = 9cf4b98581ca1779453cc816ff28b4100af56cf1bf2e5bc312d83b6b1b21d333\nY = 7a5504fcac5231a0d12d658218284868229c844a04a3450d6c7381abe080bf3b\nPeerX = 356c5a444c049a52fee0adeb7e5d82ae5aa83030bfff31bbf8ce2096cf161c4b\nPeerY = 57d128de8b2a57a094d1a001e572173f96e8866ae352bf29cddaf92fc85b2f92\nZ = 1e51373bd2c6044c129c436e742a55be2a668a85ae08441b6756445df5493857\n\nCurve = P-384\nPrivate = 3cc3122a68f0d95027ad38c067916ba0eb8c38894d22e1b15618b6818a661774ad463b205da88cf699ab4d43c9cf98a1\nX = 9803807f2f6d2fd966cdd0290bd410c0190352fbec7ff6247de1302df86f25d34fe4a97bef60cff548355c015dbb3e5f\nY = ba26ca69ec2f5b5d9dad20cc9da711383a9dbe34ea3fa5a2af75b46502629ad54dd8b7d73a8abb06a3a3be47d650cc99\nPeerX = a7c76b970c3b5fe8b05d2838ae04ab47697b9eaf52e764592efda27fe7513272734466b400091adbf2d68c58e0c50066\nPeerY = ac68f19f2e1cb879aed43a9969b91a0839c4c38a49749b661efedf243451915ed0905a32b060992b468c64766fc8437a\nZ = 5f9d29dc5e31a163060356213669c8ce132e22f57c9a04f40ba7fcead493b457e5621e766c40a2e3d4d6a04b25e533f1\n\nCurve = P-384\nPrivate = 92860c21bde06165f8e900c687f8ef0a05d14f290b3f07d8b3a8cc6404366e5d5119cd6d03fb12dc58e89f13df9cd783\nX = ea4018f5a307c379180bf6a62fd2ceceebeeb7d4df063a66fb838aa35243419791f7e2c9d4803c9319aa0eb03c416b66\nY = 68835a91484f05ef028284df6436fb88ffebabcdd69ab0133e6735a1bcfb37203d10d340a8328a7b68770ca75878a1a6\nPeerX = 30f43fcf2b6b00de53f624f1543090681839717d53c7c955d1d69efaf0349b7363acb447240101cbb3af6641ce4b88e0\nPeerY = 25e46c0c54f0162a77efcc27b6ea792002ae2ba82714299c860857a68153ab62e525ec0530d81b5aa15897981e858757\nZ = a23742a2c267d7425fda94b93f93bbcc24791ac51cd8fd501a238d40812f4cbfc59aac9520d758cf789c76300c69d2ff\n\nCurve = P-384\nPrivate = 12cf6a223a72352543830f3f18530d5cb37f26880a0b294482c8a8ef8afad09aa78b7dc2f2789a78c66af5d1cc553853\nX = fcfcea085e8cf74d0dced1620ba8423694f903a219bbf901b0b59d6ac81baad316a242ba32bde85cb248119b852fab66\nY = 972e3c68c7ab402c5836f2a16ed451a33120a7750a6039f3ff15388ee622b7065f7122bf6d51aefbc29b37b03404581b\nPeerX = 1aefbfa2c6c8c855a1a216774550b79a24cda37607bb1f7cc906650ee4b3816d68f6a9c75da6e4242cebfb6652f65180\nPeerY = 419d28b723ebadb7658fcebb9ad9b7adea674f1da3dc6b6397b55da0f61a3eddacb4acdb14441cb214b04a0844c02fa3\nZ = 3d2e640f350805eed1ff43b40a72b2abed0a518bcebe8f2d15b111b6773223da3c3489121db173d414b5bd5ad7153435\n\nCurve = P-384\nPrivate = 8dd48063a3a058c334b5cc7a4ce07d02e5ee6d8f1f3c51a1600962cbab462690ae3cd974fb39e40b0e843daa0fd32de1\nX = e38c9846248123c3421861ea4d32669a7b5c3c08376ad28104399494c84ff5efa3894adb2c6cbe8c3c913ef2eec5bd3c\nY = 9fa84024a1028796df84021f7b6c9d02f0f4bd1a612a03cbf75a0beea43fef8ae84b48c60172aadf09c1ad016d0bf3ce\nPeerX = 8bc089326ec55b9cf59b34f0eb754d93596ca290fcb3444c83d4de3a5607037ec397683f8cef07eab2fe357eae36c449\nPeerY = d9d16ce8ac85b3f1e94568521aae534e67139e310ec72693526aa2e927b5b322c95a1a033c229cb6770c957cd3148dd7\nZ = 6a42cfc392aba0bfd3d17b7ccf062b91fc09bbf3417612d02a90bdde62ae40c54bb2e56e167d6b70db670097eb8db854\n\nCurve = P-384\nPrivate = 84ece6cc3429309bd5b23e959793ed2b111ec5cb43b6c18085fcaea9efa0685d98a6262ee0d330ee250bc8a67d0e733f\nX = 3222063a2997b302ee60ee1961108ff4c7acf1c0ef1d5fb0d164b84bce71c431705cb9aea9a45f5d73806655a058bee3\nY = e61fa9e7fbe7cd43abf99596a3d3a039e99fa9dc93b0bdd9cad81966d17eeaf557068afa7c78466bb5b22032d1100fa6\nPeerX = eb952e2d9ac0c20c6cc48fb225c2ad154f53c8750b003fd3b4ed8ed1dc0defac61bcdde02a2bcfee7067d75d342ed2b0\nPeerY = f1828205baece82d1b267d0d7ff2f9c9e15b69a72df47058a97f3891005d1fb38858f5603de840e591dfa4f6e7d489e1\nZ = ce7ba454d4412729a32bb833a2d1fd2ae612d4667c3a900e069214818613447df8c611de66da200db7c375cf913e4405\n\nCurve = P-384\nPrivate = 68fce2121dc3a1e37b10f1dde309f9e2e18fac47cd1770951451c3484cdb77cb136d00e731260597cc2859601c01a25b\nX = 868be0e694841830e424d913d8e7d86b84ee1021d82b0ecf523f09fe89a76c0c95c49f2dfbcf829c1e39709d55efbb3b\nY = 9195eb183675b40fd",
@@ -2388,9 +2342,9 @@
     "fd3e0faceb636b34ed17e044a9f249dae8fc132e937e2d9349cd2ed77bb1049ceb692a2ec5b17ad61502a64c\nY = 001ec91d3058573fa6c0564a02a1a010160c313bc7c73510dc983e5461682b5be00dbce7e2c682ad73f29ca822cdc111f68fabe33a7b384a648342c3cdb9f050bcdb\nPeerX = 017200b3f16a68cbaed2bf78ba8cddfb6cffac262bba00fbc25f9dc72a07ce59372904899f364c44cb264c097b647d4412bee3e519892d534d9129f8a28f7500fee7\nPeerY = 00baba8d672a4f4a3b63de48b96f56e18df5d68f7d70d5109833f43770d6732e06b39ad60d93e5b43db8789f1ec0aba47286a39ea584235acea757dbf13d53b58364\nZ = 0101e462e9d9159968f6440e956f11dcf2227ae4aea81667122b6af9239a291eb5d6cf5a4087f358525fcacfa46bb2db01a75af1ba519b2d31da33eda87a9d565748\n\nCurve = P-521\nPrivate = 005bacfff268acf6553c3c583b464ea36a1d35e2b257a5d49eb3419d5a095087c2fb4d15cf5bf5af816d0f3ff7586490ccd3ddc1a98b39ce63749c6288ce0dbdac7d\nX = 0036e488da7581472a9d8e628c58d6ad727311b7e6a3f6ae33a8544f34b09280249020be7196916fafd90e2ec54b66b5468d2361b99b56fa00d7ac37abb8c6f16653\nY = 011edb9fb8adb6a43f4f5f5fdc1421c9fe04fc8ba46c9b66334e3af927c8befb4307104f299acec4e30f812d9345c9720d19869dbfffd4ca3e7d2713eb5fc3f42615\nPeerX = 004efd5dbd2f979e3831ce98f82355d6ca14a5757842875882990ab85ab9b7352dd6b9b2f4ea9a1e95c3880d65d1f3602f9ca653dc346fac858658d75626f4d4fb08\nPeerY = 0061cf15dbdaa7f31589c98400373da284506d70c89f074ed262a9e28140796b7236c2eef99016085e71552ff488c72b7339fefb7915c38459cb20ab85aec4e45052\nZ = 0141d6a4b719ab67eaf04a92c0a41e2dda78f4354fb90bdc35202cc7699b9b04d49616f82255debf7bbec045ae58f982a66905fcfae69d689785e38c868eb4a27e7b\n\nCurve = P-521\nPrivate = 008e2c93c5423876223a637cad367c8589da69a2d0fc68612f31923ae50219df2452e7cc92615b67f17b57ffd2f52b19154bb40d7715336420fde2e89fee244f59dc\nX = 00fa3b35118d6c422570f724a26f90b2833b19239174cea081c53133f64db60d6940ea1261299c04c1f4587cdb0c4c39616479c1bb0c146799a118032dcf98f899c0\nY = 0069f040229006151fa32b51f679c8816f7c17506b403809dc77cd58a2aec430d94d13b6c916de99f355aa45fcfbc6853d686c71be496a067d24bfaea4818fc51f75\nPeerX = 0129891de0cf3cf82e8c2cf1bf90bb296fe00ab08ca45bb7892e0e227a504fdd05d2381a4448b68adff9c4153c87eacb78330d8bd52515f9f9a0b58e85f446bb4e10\nPeerY = 009edd679696d3d1d0ef327f200383253f6413683d9e4fcc87bb35f112c2f110098d15e5701d7ceee416291ff5fed85e687f727388b9afe26a4f6feed560b218e6bb\nZ = 00345e26e0abb1aac12b75f3a9cf41efe1c336396dffa4a067a4c2cfeb878c68b2b045faa4e5b4e6fa4678f5b603c351903b14bf9a6a70c439257199a640890b61d1\n\nCurve = P-521\nPrivate = 0004d49d39d40d8111bf16d28c5936554326b197353eebbcf47545393bc8d3aaf98f14f5be7074bfb38e6cc97b989754074daddb3045f4e4ce745669fdb3ec0d5fa8\nX = 012ec226d050ce07c79b3df4d0f0891f9f7adf462e8c98dbc1a2a14f5e53a3f5ad894433587cc429a8be9ea1d84fa33b1803690dae04da7218d30026157fc995cf52\nY = 004837dfbf3426f57b5c793269130abb9a38f618532211931154db4eeb9aede88e57290f842ea0f2ea9a5f74c6203a3920fe4e305f6118f676b154e1d75b9cb5eb88\nPeerX = 01a3c20240e59f5b7a3e17c275d2314ba1741210ad58b71036f8c83cc1f6b0f409dfdd9113e94b67ec39c3291426c23ffcc447054670d2908ff8fe67dc2306034c5c\nPeerY = 01d2825bfd3af8b1e13205780c137fe938f84fde40188e61ea02cead81badfdb425c29f7d7fb0324debadc10bbb93de68f62c35069268283f5265865db57a79f7bf7\nZ = 006fe9de6fb8e672e7fd150fdc5e617fabb0d43906354ccfd224757c7276f7a1010091b17ed072074f8d10a5ec971eb35a5cb7076603b7bc38d432cbc059f80f9488\n\nCurve = P-521\nPrivate = 011a5d1cc79cd2bf73ea106f0e60a5ace220813b53e27b739864334a07c03367efda7a4619fa6eef3a9746492283b3c445610a023a9cc49bf4591140384fca5c8bb5\nX = 00eb07c7332eedb7d3036059d35f7d2288d4377d5f42337ad3964079fb120ccd4c8bd384b585621055217023acd9a94fcb3b965bfb394675e788ade41a1de73e620c\nY = 00491a835de2e6e7deb7e090f4a11f2c460c0b1f3d5e94ee8d751014dc720784fd3b54500c86ebaef18429f09e8e876d5d1538968a030d7715dde99f0d8f06e29d59\nPeerX = 007e2d138f2832e345ae8ff65957e40e5ec7163f016bdf6d24a2243daa631d878a4a16783990c722382130f9e51f0c1bd6ff5ac96780e48b68f5dec95f42e6144bb5\nPeerY = 00b0de5c896791f52886b0f09913e26e78dd0b69798fc4df6d95e3ca708ecbcbcce1c1895f5561bbabaae372e9e67e6e1a3be60e19b470cdf673ec1fc393d3426e20\nZ = 01e4e759ecedce1013baf73e6fcc0b92451d03bdd50489b78871c333114990c9ba6a9b2fc7b1a2d9a1794c1b60d9279af6f146f0bbfb0683140403bfa4ccdb524a29\n\nCurve = P-521\nPrivate = 010c908caf1be74c616b625fc8c1f514446a6aec83b5937141d6afbb0a8c7666a7746fa1f7a6664a2123e8cdf6cd8bf836c56d3c0ebdcc980e43a186f938f3a78ae7\nX = 0031890f4c7abec3f723362285d77d2636f876817db3bbc88b01e773597b969ff6f013ea470c854ab4a7739004eb8cbea69b82ddf36acadd406871798ecb2ac3aa7f\nY = 00d8b429ae3250266b9643c0c765a60dc10155bc2531cf8627296f4978b6640a9e600e19d0037d58503fa80799546a814d7478a550aa90e5ebeb052527faaeae5d08\nPeerX = 00118c36022209b1af8ebad1a12b566fc48744576e1199fe80de1cdf851cdf03e5b9091a8f7e079e83b7f827259b691d0c22ee29d6bdf73ec7bbfd746f2cd97a357d\nPeerY = 00da5ff4904548a342e2e7ba6a1f4ee5f840411a96cf63e6fe622f22c13e614e0a847c11a1ab3f1d12cc850c32e095614ca8f7e2721477b486e9ff40372977c3f65c\nZ = 0163c9191d651039a5fe985a0eea1eba018a40ab1937fcd2b61220820ee8f2302e9799f6edfc3f5174f369d672d377ea8954a8d0c8b851e81a56fda95212a6578f0e\n\nCurve = P-521\nPrivate = 01b37d6b7288de671360425d3e5ac1ccb21815079d8d73431e9b74a6f0e7ae004a357575b11ad66642ce8b775593eba9d98bf25c75ef0b4d3a2098bbc641f59a2b77\nX = 00189a5ee34de7e35aefeaeef9220c18071b4c29a4c3bd9d954458bd3e82a7a34da34cff5579b8101c065b1f2f527cf4581501e28ef5671873e65267733d003520af\nY = 01eb4bc50a7b4d4599d7e3fa773ddb9eb252c9b3422872e544bdf75c7bf60f5166ddc11eb08fa7c30822dabaee373ab468eb2d922e484e2a527fff2ebb804b7d9a37\nPeerX = 01780edff1ca1c03cfbe593edc6c049bcb2860294a92c355489d9afb2e702075ade1c953895a456230a0cde905de4a3f38573dbfcccd67ad6e7e93f0b5581e926a5d\nPeerY = 00a5481962c9162962e7f0ebdec936935d0eaa813e8226d40d7f6119bfd940602380c86721e61db1830f51e139f210000bcec0d8edd39e54d73a9a129f95cd5fa979\nZ = 015d613e267a36342e0d125cdad643d80d97ed0600afb9e6b9545c9e64a98cc6da7c5aaa3a8da0bdd9dd3b97e9788218a80abafc106ef065c8f1c4e1119ef58d298b\n\nCurve = P-521\nPrivate = 00f2661ac762f60c5fff23be5d969ccd4ec6f98e4e72618d12bdcdb9b4102162333788c0bae59f91cdfc172c7a1681ee44d96ab2135a6e5f3415ebbcd55165b1afb0\nX = 00a8e25a6902d687b4787cdc94c364ac7cecc5c495483ed363dc0aa95ee2bd739c4c4d46b17006c728b076350d7d7e54c6822f52f47162a25109aaaba690cab696ec\nY = 0168d2f08fe19e4dc9ee7a195b03c9f7fe6676f9f520b6270557504e72ca4394a2c6918625e15ac0c51b8f95cd560123653fb8e8ee6db961e2c4c62cc54e92e2a2a9\nPeerX = 016dacffa183e5303083a334f765de724ec5ec9402026d4797884a9828a0d321a8cfac74ab737fe20a7d6befcfc73b6a35c1c7b01d373e31abc192d48a4241a35803\nPeerY = 011e5327cac22d305e7156e559176e19bee7e4f2f59e86f1a9d0b6603b6a7df1069bde6387feb71587b8ffce5b266e1bae86de29378a34e5c74b6724c4d40a719923\nZ = 014d6082a3b5ced1ab8ca265a8106f302146c4acb8c30bb14a4c991e3c82a9731288bdb91e0e85bda313912d06384fc44f2153fb13506fa9cf43c9aab5750988c943\n\nCurve = P-521\nPrivate = 00f430ca1261f09681a9282e9e970a9234227b1d5e58d558c3cc6eff44d1bdf53de16ad5ee2b18b92d62fc79586116b0efc15f79340fb7eaf5ce6c44341dcf8dde27\nX = 006c1d9b5eca87de1fb871a0a32f807c725adccde9b3967453a71347d608f0c030cd09e338cdecbf4a02015bc8a6e8d3e2595fe773ffc2fc4e4a55d0b1a2cc00323b\nY = 01141b2109e7f4981c952aa818a2b9f6f5c41feccdb7a7a45b9b4b672937771b008cae5f934dfe3fed10d383ab1f38769c92ce88d9be5414817ecb073a31ab368ccb\nPeerX = 00a091421d3703e3b341e9f1e7d58f8cf7bdbd1798d001967b801d1cec27e605c580b2387c1cb464f55ce7ac80334102ab03cfb86d88af76c9f4129c01bedd3bbfc4\nPeerY = 008c9c577a8e6fc446815e9d40baa66025f15dae285f19eb668ee60ae9c98e7ecdbf2b2a68e22928059f67db188007161d3ecf397e0883f0c4eb7eaf7827a62205cc\nZ = 0020c00747cb8d492fd497e0fec54644bf027d418ab686381f109712a99cabe328b9743d2225836f9ad66e5d7fed1de247e0da92f60d5b31f9e47672e57f710598f4\n\nCurve = P-521\nPrivate = 005dc33aeda03c2eb233014ee468dff753b72f73b00991043ea353828ae69d4cd0fadeda7bb278b535d7c57406ff2e6e473a5a4ff98e90f90d6dadd25100e8d85666\nX = 00c825ba307373cec8dd2498eef82e21fd9862168dbfeb83593980ca9f82875333899fe94f137daf1c4189eb502937c3a367ea7951ed8b0f3377fcdf2922021d46a5\nY = 016b8a2540d5e65493888bc337249e67c0a68774f3e8d81e3b4574a0125165f0bd58b8af9de74b35832539f95c3cd9f1b759408560aa6851ae3ac7555347b0d3b13b\nPeerX = 004f38816681771289ce0cb83a5e29a1ab06fc91f786994b23708ff08a08a0f675b809ae99e9f9967eb1a49f196057d69e50d6dedb4dd2d9a81c02bdcc8f7f518460\nPeerY = 009efb244c8b91087de1eed766500f0e81530752d469256ef79f6b965d8a2232a0c2dbc4e8e1d09214bab38485be6e357c4200d073b52f04e4a16fc6f5247187aecb\nZ = 00c2bfafcd7fbd3e2fd1c",
     "750fdea61e70bd4787a7e68468c574ee99ebc47eedef064e8944a73bcb7913dbab5d93dca660d216c553622362794f7a2acc71022bdb16f\n\nCurve = P-521\nPrivate = 00df14b1f1432a7b0fb053965fd8643afee26b2451ecb6a8a53a655d5fbe16e4c64ce8647225eb11e7fdcb23627471dffc5c2523bd2ae89957cba3a57a23933e5a78\nX = 004e8583bbbb2ecd93f0714c332dff5ab3bc6396e62f3c560229664329baa5138c3bb1c36428abd4e23d17fcb7a2cfcc224b2e734c8941f6f121722d7b6b94154576\nY = 01cf0874f204b0363f020864672fadbf87c8811eb147758b254b74b14fae742159f0f671a018212bbf25b8519e126d4cad778cfff50d288fd39ceb0cac635b175ec0\nPeerX = 01a32099b02c0bd85371f60b0dd20890e6c7af048c8179890fda308b359dbbc2b7a832bb8c6526c4af99a7ea3f0b3cb96ae1eb7684132795c478ad6f962e4a6f446d\nPeerY = 017627357b39e9d7632a1370b3e93c1afb5c851b910eb4ead0c9d387df67cde85003e0e427552f1cd09059aad0262e235cce5fba8cedc4fdc1463da76dcd4b6d1a46\nZ = 01aaf24e5d47e4080c18c55ea35581cd8da30f1a079565045d2008d51b12d0abb4411cda7a0785b15d149ed301a3697062f42da237aa7f07e0af3fd00eb1800d9c41\n",
 };
-static const size_t kLen37 = 136462;
+static const size_t kLen33 = 136462;
 
-static const char *kData37[] = {
+static const char *kData33[] = {
     "# Public key algorithm tests\n\n# Keys used for PKEY operations.\n\n# RSA 2048 bit key.\nPrivateKey = RSA-2048\nType = RSA\nInput = 308204bc020100300d06092a864886f70d0101010500048204a6308204a20201000282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f02030100010282010060297ac7991b167a06d6b24758b8cbe208beb9b2d9ec9738bd80f90a2e35005dd7ce292d9e29ba885bd316fef1f20913bc0ac90d6b0808b2414d82104441d8624a33ce0233c8f780a48b375aff02d76712228a702484db3f9ebecccfbbee1709dba182800d949e9e4216e0bff3558388f8bd90da373a1d82743ec3fbdd1427fd16825a657a316912e8695365117ca2f845c909405fcac55f895fc15d20386c26ee78c9e99075029a178a6c1e4cf0c200e8a9cfb27e9d156f86e6c2adc22b1a84a1cd5ca5b2790875d79407c84b352395cb81cc3fed5bb043b69ede0c07204550025cee8c5f440170b6120bb48e0f747bcd8f522110850df043c428dfd187053102818100f6f961b47cbc035d3aedebc7de850a956b65ecdb9cf60764063f15aa48553c58d972fe6675056e35ddfdc37bf3b9f2f622ee271337256849c9bef2176fe8f7c3f8bb91ba374dd53baf3dec814d2bdec10c1fdc88cdd16876f26b1edfa3f094197edf4d42ff1fb2971103b898ca859c427287086a842ab410bb69cf2d35af6be302818100d47e724a7ff41048b270c2524a4101878b73159bb73d3dbc187b220e635b3534f96e243a184d93f860b6bfbb6b71c1ed9a1e1f458583023c301e96a692c1a08b53d0ec9ca910100d80451e3b7dc6a01bac4aecef8df798846bc235a08cbba2cf4c06804cc11219e95608c714e3f1430d491fadbba32a5751a04f97745834c9a502818021f2452bb9b95dfd028c914bf799f1ca77e89a95d50d3c16d384f8455f8bd7af9eb3dfa3d591d9842def235f7630a8e48c088ff6642e101794535a933e1e976fa8509fc728b2da0c4a1a08d7fcf37abaae1ff3001aca1dc1bbb05d9dffbaa1a09f7fb1eef38237d9ebccc722b9338436dde7119112798c26809c1a8dec4320610281801f7510aa62c2d8de4a3c53282781f41e02d0e8b402ae78432e449c48110161a11403f02d01880a8dcc938152d79721a4711a607ac4471ebf964810f95be47a45e60499e29f4c9773c83773404f606637728c2d0351bb03c326c8bb73a721e7fa5440ea2172bba1465fcc30dcb0d9f89930e815aa1f7f9729a857e00e0338dd590281804d1f0d756fe77e01099a652f50a88b7b685dc5bf00981d5d2376fd0c6fe29cd5b638734479305a73ad3c1599d39eae3bae035fbd6fed07c28de705933879a06e48e6a603686ed8e2560a5f6af1f2c24faf4aa960e382186f15eedce9a2491ae730680dd4cf778b70faa86826ab3223477cc91377b19a6d5a2eaea219760beed5\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The public half of the same key encoded as a SubjectPublicKeyInfo.\nPublicKey = RSA-2048-SPKI\nType = RSA\nInput = 30820122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same key but with a negative RSA modulus.\nPublicKey = RSA-2048-SPKI-Negative\nInput = 30820121300d06092a864886f70d01010105000382010e003082010902820100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001\nError = NEGATIVE_NUMBER\n\n# The same key but with missing parameters rather than a NULL.\nPublicKey = RSA-2048-SPKI-Invalid\nInput = 30820120300b06092a864886f70d0101010382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001\nError = DECODE_ERROR\n\n# The same key but with an incorrectly-encoded length prefix.\nPublicKey = RSA-2048-SPKI-Invalid2\nInput = 3083000122300d06092a864886f70d01010105000382010f003082010a0282010100cd0081ea7b2ae1ea06d59f7c73d9ffb94a09615c2e4ba7c636cef08dd3533ec3185525b015c769b99a77d6725bf9c3532a9b6e5f6627d5fb85160768d3dda9cbd35974511717dc3d309d2fc47ee41f97e32adb7f9dd864a1c4767a666ecd71bc1aacf5e7517f4b38594fea9b05e42d5ada9912008013e45316a4d9bb8ed086b88d28758bacaf922d46a868b485d239c9baeb0e2b64592710f42b2d1ea0a4b4802c0becab328f8a68b0073bdb546feea9809d2849912b390c1532bc7e29c7658f8175fae46f34332ff87bcab3e40649b98577869da0ea718353f0722754886913648760d122be676e0fc483dd20ffc31bda96a31966c9aa2e75ad03de47e1c44f0203010001\nError = DECODE_ERROR\n\n# RSA 512 bit key.\nPrivateKey = RSA-512\nType = RSA\nInput = 30820154020100300d06092a864886f70d01010105000482013e3082013a020100024100dd20403d976a38c9d79152d87b5c8e9f05033eadd7b7de709bf5b0c4a5182a97d18483526b02362b992e154a9f37faa396ca2685cdab8fec09877ebe705f4dd70203010001024055bebcca655d7e39de8a6eaa9d636db682161907064039544755c53eeb99ec618c03a210dbc61471eaba10c5c365c9726d6b7a96f54d455f7d168d49367270e1022100f21a05d9fd6817301ce49ce10448f9bdd44f5ef5b7557cd7d83155db46382ae7022100e9d1f7157783db2feab1936954ddc4e83aa365695868144cda1be6813b61d791022100d6001eb0040920860ce41fafdf23ca6dfbdf74e6e9f98cf3164cf5c16f9e727d02206f6f73f4b52b10517be6f9bc5f87fa0a3bb817e2e711636b651f9af1c85d4f21022063eff2e57f5b4ca20342cfe793e25526624e3692f192461f9e1ce7f13f2d72c8\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# RSA 515 bit key.\nPrivateKey = RSA-515\nType = RSA\nInput = 30820157020100300d06092a864886f70d0101010500048201413082013d0201000241054fa166e205e658bbe8a2dc35311c0c2b75b7e4569fd9642c8bae809279271fc824f26baa1166ea46298ca63379ea76adbada2b61e5066820a35beaec1aca227f020301000102410266c972be0d30e53ac2acb1aa13b4bd0401cccf212452a66b4615f7e943831f67b4ca48560582d0ca886044aaaaf87945252a848c1947944186e6eb83969bf91102210309e631761842cc8a2ccfd372c20a9cba21de1a199c30ab440bc6b51079f4e825022101bf715c1db432627ca7c29a293b9210f2eff1e92d12f306ebaa5334f8ee03dcd30221018ac58a765f2b8f37d434081fe5ff92b81735ead2f263f4968ccf63d61fbe3d0d0221015b247a1159a2d5a25d0db049593c6405f77f3a278c521d066e290c2a2d8fb59d0221026224aa31fd95c14d24fd03b8a195bba4cc88df7c37f5370a5ab19f882f1404d6\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# EC P-256 key\nPrivateKey = P-256\nType = EC\nInput = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same key as above with the optional public key omitted.\nPrivateKey = P-256-MissingPublic\nType = EC\nInput = 3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same key as above with redundant parameters.\nPrivateKey = P-256-ExtraParameters\nType = EC\nInput = 308193020100301306072a8648ce3d020106082a8648ce3d0301070479307702010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a00a06082a8648ce3d030107a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\n# The key re-encodes with the parameters removed.\nOutput = 308187020100301306072a8648c",
     "e3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same key, but with the redundant parameters in the ECPrivateKey mismatched.\nPrivateKey = P-256-BadInnerParameters\nInput = 308190020100301306072a8648ce3d020106082a8648ce3d0301070476307402010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a00706052b81040022a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nError = GROUP_MISMATCH\n\n# The same key, but with the curve spelled explicitly.\nPrivateKey = P-256-ExplicitParameters\nType = EC\nInput = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020101046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nOutput = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same as above, but with the optional cofactor omitted.\nPrivateKey = P-256-ExplicitParameters-NoCofactor\nType = EC\nInput = 3082015e0201003081e906072a8648ce3d02013081dd020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nOutput = 308187020100301306072a8648ce3d020106082a8648ce3d030107046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same as above, but the cofactor is zero instead of one.\nPrivateKey = P-256-ExplicitParameters-CofactorZero\nInput = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020100046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nError = UNKNOWN_GROUP\n\n# The same as above, but the cofactor is two instead of one.\nPrivateKey = P-256-ExplicitParameters-CofactorTwo\nInput = 308201610201003081ec06072a8648ce3d02013081e0020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff30440420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b0441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020102046d306b02010104208a872fb62893c4d1ffc5b9f0f91758069f8352e08fa05a49f8db926cb5728725a144034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nError = UNKNOWN_GROUP\n\n# The public half of the same key encoded as a PublicKey.\nPublicKey = P-256-SPKI\nType = EC\nInput = 3059301306072a8648ce3d020106082a8648ce3d030107034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same as above, but with the curve explicitly spelled out.\nPublicKey = P-256-SPKI\nInput = 3082014b3082010306072a8648ce3d02013081f7020101302c06072a8648ce3d0101022100ffffffff00000001000000000000000000000000ffffffffffffffffffffffff305b0420ffffffff00000001000000000000000000000000fffffffffffffffffffffffc04205ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b031500c49d360886e704936a6678e1139d26b7819f7e900441046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5022100ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551020101034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nError = DECODE_ERROR\n\n# The same as above, but with trailing data after the curve name.\nPublicKey = P-256-SPKI\nInput = 305b301506072a8648ce3d020106082a8648ce3d0301070500034200042c150f429ce70f216c252cf5e062ce1f639cd5d165c7f89424072c27197d78b33b920e95cdb664e990dcf0cfea0d94e2a8e6af9d0e58056e653104925b9fe6c9\nError = DECODE_ERROR\n\n# A DSA private key.\nPrivateKey = DSA-1024\nType = DSA\nInput = 308202650201003082023906072a8648ce3804013082022c02820101009e12fab3de12213501dd82aa10ca2d101d2d4ebfef4d2a3f8daa0fe0cedad8d6af85616aa2f3252c0a2b5a6db09e6f14900e0ddb8311876dd8f9669525f99ed65949e184d5064793271169a228680b95ec12f59a8e20b21f2b58eb2a2012d35bde2ee351822fe8f32d0a330565dcce5c672b7259c14b2433d0b5b2ca2b2db0ab626e8f13f47fe0345d904e7294bb038e9ce21a9e580b83356278706cfe768436c69de149ccff98b4aab8cb4f6385c9f102ce59346eaeef27e0ad222d53d6e89cc8cde5776dd00057b03f2d88ab3cedbafd7b585f0b7f7835e17a3728bbf25ea62572f245dc111f3ce39cb6ffacc31b0a2790e7bde90224ea9b09315362af3d2b022100f381dcf53ebf724f8b2e5ca82c010fb4b5eda9358d0fd88ed278589488b54fc3028201000c402a725dcc3a62e02bf4cf43cd17f4a493591220223669cf4193edab423ad08dfb552e308a6a57a5ffbc7cd0fb2087f81f8df0cb08ab2133287d2b6968714a94f633c940845a48a3e16708dde761cc6a8eab2d84db21b6ea5b07681493cc9c31fbc368b243f6ddf8c932a8b4038f44e7b15ca876344a147859f2b43b39458668ad5e0a1a9a669546dd2812e3b3617a0aef99d58e3bb4cc87fd94225e01d2dcc469a77268146c51918f18e8b4d70aa1f0c7623bcc52cf3731d38641b2d2830b7eecb2f09552ff137d046e494e7f33c3590002b16d1b97d936fda28f90c3ed3ca35338168ac16f77c3c57adc2e8f7c6c2256e41a5f65450590dbb5bcf06d66610423022100b0c768702743bc51242993a971a52889795444f7c6452203d0ce84fe6117d46e\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# A DSA public key.\nPublicKey = DSA-1024-SPKI\nType = DSA\nInput = 308201b73082012c06072a8648ce3804013082011f02818100b3429b8b128c9079f9b72e86857e98d265e5d91661ed8b5f4cc56e5eed1e571da30186983a9dd76297eab73ee13a1db841f8800d04a7cab478af6cde2ea4a2868531af169a24858c6268efa39ceb7ed0d4227eb5bbb01124a2a5a26038c7bcfb8cc827f68f5202345166e4718596799b65c9def82828ce44e62e38e41a0d24b1021500c5a56c81ddd87f47e676546c56d05706421624cf0281810094de40d27314fe929e47ff9b1ac65cfc73ef38c4d381c890be6217b15039ae18190e6b421af8c0bda35a5cfd050f58ae2644adce83e68c8e5ba11729df56bbb21e227a60b816cc033fa799a38fe1ba5b4aa1801b6f841ce3df99feb3b4fb96950c960af13fa2ce920aabc12dd24ad2044a35063ea0e25f67f560f4cfbdc55983",
     "03818400028180258c30ebbb7f34fdc873ce679f6cea373c7886d75d4421b90920db034daedd292c64d8edd8cdbdd7f3ad23d74cfa2135247d0cef6ecf2e14f99e19d22a8c1266bd8fb8719c0e5667c716c45c7adbdabe548085bdad2dfee636f8d52fd6adb2193df6c4f0520fbd171b91882e0e4f321f8250ffecf4dbea00e114427d3ef96c1a\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# The same key as above, but without the parameters.\nPublicKey = DSA-1024-SPKI-No-Params\nType = DSA\nInput = 308192300906072a8648ce38040103818400028180258c30ebbb7f34fdc873ce679f6cea373c7886d75d4421b90920db034daedd292c64d8edd8cdbdd7f3ad23d74cfa2135247d0cef6ecf2e14f99e19d22a8c1266bd8fb8719c0e5667c716c45c7adbdabe548085bdad2dfee636f8d52fd6adb2193df6c4f0520fbd171b91882e0e4f321f8250ffecf4dbea00e114427d3ef96c1a\nExpectNoRawPrivate\nExpectNoRawPublic\n\n# Private keys from RFC 8032.\nPrivateKey = Ed25519\nType = Ed25519\nInput = 302e020100300506032b6570042204209d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60\nExpectRawPrivate = 9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60\nExpectRawPublic = d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a\n\nPrivateKey = Ed25519-2\nType = Ed25519\nInput = 302e020100300506032b6570042204204ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb\nExpectRawPrivate = 4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb\nExpectRawPublic = 3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c\n\nPrivateKey = Ed25519-3\nType = Ed25519\nInput = 302e020100300506032b657004220420c5aa8df43f9f837bedb7442f31dcb7b166d38535076f094b85ce3a2e0b4458f7\nExpectRawPrivate = c5aa8df43f9f837bedb7442f31dcb7b166d38535076f094b85ce3a2e0b4458f7\nExpectRawPublic = fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025\n\nPrivateKey = Ed25519-4\nType = Ed25519\nInput = 302e020100300506032b657004220420f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5\nExpectRawPrivate = f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5\nExpectRawPublic = 278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e\n\nPrivateKey = Ed25519-5\nType = Ed25519\nInput = 302e020100300506032b657004220420833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42\nExpectRawPrivate = 833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42\nExpectRawPublic = ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf\n\n# Public keys from RFC 8032.\nPublicKey = Ed25519-SPKI\nType = Ed25519\nInput = 302a300506032b6570032100d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a\nExpectNoRawPrivate\nExpectRawPublic = d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a\n\nPublicKey = Ed25519-SPKI-2\nType = Ed25519\nInput = 302a300506032b65700321003d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c\nExpectNoRawPrivate\nExpectRawPublic = 3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c\n\nPublicKey = Ed25519-SPKI-3\nType = Ed25519\nInput = 302a300506032b6570032100fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025\nExpectNoRawPrivate\nExpectRawPublic = fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025\n\nPublicKey = Ed25519-SPKI-4\nType = Ed25519\nInput = 302a300506032b6570032100278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e\nExpectNoRawPrivate\nExpectRawPublic = 278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e\n\nPublicKey = Ed25519-SPKI-5\nType = Ed25519\nInput = 302a300506032b6570032100ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf\nExpectNoRawPrivate\nExpectRawPublic = ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf\n\n# The first key, private and public, with invalid NULL parameters.\nPrivateKey = Ed25519-NULL\nInput = 3030020100300706032b65700500042204209d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60\nError = DECODE_ERROR\n\nPublicKey = Ed25519-SPKI-NULL\nInput = 302c300706032b65700500032100d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a\nError = DECODE_ERROR\n\n# Sample public key from RFC 8410.\nPublicKey = Ed25519-SPKI-Spec\nType = Ed25519\nInput = 302a300506032b657003210019bf44096984cdfe8541bac167dc3b96c85086aa30b6b6cb0c5c38ad703166e1\n\n# Sample private key from RFC 8410.\nPrivateKey = Ed25519-Spec\nType = Ed25519\nInput = 302e020100300506032b657004220420d4ee72dbf913584ad5b6d8f1f769f8ad3afe7c28cbf1d4fbe097a88f44755842\n\n\n# RSA tests\n\nSign = RSA-2048\nDigest = SHA1\nInput = \"0123456789ABCDEF1234\"\nOutput = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad\n\nVerify = RSA-2048\nDigest = SHA1\nInput = \"0123456789ABCDEF1234\"\nOutput = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad\n\nVerify = RSA-2048-SPKI\nDigest = SHA1\nInput = \"0123456789ABCDEF1234\"\nOutput = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad\n\n# Digest too long\nSign = RSA-2048\nDigest = SHA1\nInput = \"0123456789ABCDEF12345\"\nError = INVALID_MESSAGE_LENGTH\n\nVerify = RSA-2048\nDigest = SHA1\nInput = \"0123456789ABCDEF12345\"\nOutput = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad\nError = INVALID_MESSAGE_LENGTH\n\n# Digest too short\nSign = RSA-2048\nDigest = SHA1\nInput = \"0123456789ABCDEF123\"\nError = INVALID_MESSAGE_LENGTH\n\nVerify = RSA-2048\nDigest = SHA1\nInput = \"0123456789ABCDEF123\"\nOutput = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99b7638d72bb687f97661d304ae145d64a474437a4ef39d7b8059332ddeb07e92bf6e0e3acaf8afedc93795e4511737ec1e7aab6d5bc9466afc950c1c17b48ad\nError = INVALID_MESSAGE_LENGTH\n\n# Digest too large for key.\nSign = RSA-512\nDigest = SHA512\nInput = \"0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF\"\nError = DIGEST_TOO_BIG_FOR_RSA_KEY\n\n# Mismatched digest\nVerify = RSA-2048\nDigest = SHA1\nInput = \"0123456789ABCDEF1233\"\nOutput = c09d402423cbf233d26cae21f954547bc43fe80fd41360a0336cfdbe9aedad05bef6fd2eaee6cd60089a52482d4809a238149520df3bdde4cb9e23d9307b05c0a6f327052325a29adf2cc95b66523be7024e2a585c3d4db15dfbe146efe0ecdc0402e33fe5d40324ee96c5c3edd374a15cdc0f5d84aa243c0f07e188c6518fbfceae158a9943be398e31097da81b62074f626eff738be6160741d5a26957a482b3251fd85d8df78b98148459de10aa93305dbb4a5230aa1da291a9b0e481918f99",
@@ -2409,19 +2363,19 @@
     "d88a1d7ba50cee5ef7e701b3a589adc09a752a974a6805956f4a1a0582f66309a1e02e9fb6b10d2c820fe98bb2eb04f435bc8a649cc9ab6c5a4c03e83800d1\n\nVerifyMessage = RSA-2048-SPKI\nDigest = SHA256\nInput = \"Hello world\"\nOutput = 301894798b49d6ec55d32dcc74314f04230591a515781f3eb4492f5324b56046836c4bc3e25942af341e88558cb4c3814a849207575d343189147989b16e296b5138dbbc717116dc416f201dfa35943d15060493953cda1f04a13ff89845cf7fd69e1a78d5d38522a77bb234e5d0ba2ae17ada6e22fdae27a4052fdb8ac267507dfe06ed7a865e61a52b530bbbf65c7caa89739613df10ae3b0e62ff6831ee0770086aad39c329462aede9f1b29a501bc3d09e0fe4034aa5d6831d44491d508111d88a1d7ba50cee5ef7e701b3a589adc09a752a974a6805956f4a1a0582f66309a1e02e9fb6b10d2c820fe98bb2eb04f435bc8a649cc9ab6c5a4c03e83800d1\n\nVerifyMessage = P-256\nDigest = SHA256\nInput = \"Hello world\"\nOutput = 304502204c66004635c267394bd6857c1e0b53b22a2bab1ca7dff9d5c1b42143858b3ea7022100ae81228510e03cd49a8863d2ebd1c05fe0c87eacd1150433132b909994cd0dbd\n\n# Digest can't be omitted in many algorithms.\nSignMessage = RSA-2048\nInput = \"Hello world\"\nError = NO_DEFAULT_DIGEST\n\nVerifyMessage = RSA-2048\nInput = \"Hello world\"\nOutput = 301894798b49d6ec55d32dcc74314f04230591a515781f3eb4492f5324b56046836c4bc3e25942af341e88558cb4c3814a849207575d343189147989b16e296b5138dbbc717116dc416f201dfa35943d15060493953cda1f04a13ff89845cf7fd69e1a78d5d38522a77bb234e5d0ba2ae17ada6e22fdae27a4052fdb8ac267507dfe06ed7a865e61a52b530bbbf65c7caa89739613df10ae3b0e62ff6831ee0770086aad39c329462aede9f1b29a501bc3d09e0fe4034aa5d6831d44491d508111d88a1d7ba50cee5ef7e701b3a589adc09a752a974a6805956f4a1a0582f66309a1e02e9fb6b10d2c820fe98bb2eb04f435bc8a649cc9ab6c5a4c03e83800d1\nError = NO_DEFAULT_DIGEST\n\n# Signing test vectors from RFC 8032.\nSignMessage = Ed25519\nInput = \"\"\nOutput = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b\n\nSignMessage = Ed25519-2\nInput = 72\nOutput = 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00\n\nSignMessage = Ed25519-3\nInput = af82\nOutput = 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a\n\nSignMessage = Ed25519-4\nInput = 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0\nOutput = 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03\n\nSignMessage = Ed25519-5\nInput = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f\nOutput = dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704\n\n# Signing with public keys is not allowed.\nSignMessage = Ed25519-SPKI\nInput = \"\"\nError = NOT_A_PRIVATE_KEY\n\n# Verify test vectors from RFC 8032. Test verifying with both the public and\n# private key.\nVerifyMessage = Ed25519\nInput = \"\"\nOutput = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b\n\nVerifyMessage = Ed25519-SPKI\nInput = \"\"\nOutput = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b\n\nVerifyMessage = Ed25519-2\nInput = 72\nOutput = 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00\n\nVerifyMessage = Ed25519-SPKI-2\nInput = 72\nOutput = 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00\n\nVerifyMessage = Ed25519-3\nInput = af82\nOutput = 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a\n\nVerifyMessage = Ed25519-SPKI-3\nInput = af82\nOutput = 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a\n\nVerifyMessage = Ed25519-4\nInput = 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0\nOutput = 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681",
     "e30a6ac00a9704a188a03\n\nVerifyMessage = Ed25519-SPKI-4\nInput = 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0\nOutput = 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03\n\nVerifyMessage = Ed25519-5\nInput = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f\nOutput = dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704\n\nVerifyMessage = Ed25519-SPKI-5\nInput = ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f\nOutput = dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704\n\n# Length is wrong.\nVerifyMessage = Ed25519-SPKI\nInput = \"\"\nOutput = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a10\nError = INVALID_SIGNATURE\n\n# Message is wrong.\nVerifyMessage = Ed25519-SPKI\nInput = \"Hello world\"\nOutput = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b\nError = INVALID_SIGNATURE\n\n# Ed25519 does not support configuring a digest.\nSignMessage = Ed25519\nInput = \"\"\nDigest = SHA256\nError = COMMAND_NOT_SUPPORTED\n\n# Ed25519 does not support signing a pre-hashed value.\nSign = Ed25519\nInput = \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"\nError = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE\n\nVerify = Ed25519\nInput = \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"\nOutput = e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b\nError = OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE\n\n\n# Derive tests.\n\nPrivateKey = ECDH-P256-Private\nType = EC\nInput = 3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104207d7dc5f71eb29ddaf80d6214632eeae03d9058af1fb6d22ed80badb62bc1a534\n\nPublicKey = ECDH-P256-Peer\nType = EC\nInput = 3059301306072a8648ce3d020106082a8648ce3d03010703420004700c48f77f56584c5cc632ca65640db91b6bacce3a4df6b42ce7cc838833d287db71e509e3fd9b060ddb20ba5c51dcc5948d46fbf640dfe0441782cab85fa4ac\n\nDerive = ECDH-P256-Private\nDerivePeer = ECDH-P256-Peer\nOutput = 46fc62106420ff012e54a434fbdd2d25ccc5852060561e68040dd7778997bd7b\nSmallBufferTruncates\n\nPrivateKey = X25519-Private\nType = X25519\nInput = 302e020100300506032b656e04220420a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4\nExpectRawPrivate = a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4\n\nPublicKey = X25519-Peer\nType = X25519\nInput = 302a300506032b656e032100e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c\nExpectRawPublic = e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c\n\nPublicKey = X25519-SmallOrderPeer\nType = X25519\nExpectRawPublic = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800\nInput = 302a300506032b656e032100e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800\n\nDerive = X25519-Private\nDerivePeer = X25519-Peer\nOutput = c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552\n\nDerive = X25519-Private\nDerivePeer = X25519-SmallOrderPeer\nError = INVALID_PEER_KEY\n",
 };
-static const size_t kLen38 = 1262;
+static const size_t kLen34 = 1262;
 
-static const char *kData38[] = {
+static const char *kData34[] = {
     "#\n# Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.\n#\n# Licensed under the OpenSSL license (the \"License\").  You may not use\n# this file except in compliance with the License.  You can obtain a copy\n# in the file LICENSE in the source distribution or at\n# https://www.openssl.org/source/license.html\n\nPassword = \"\"\nSalt = \"\"\nN = 16\nr = 1\np = 1\nKey = 77d6576238657b203b19ca42c18a0497f16b4844e3074ae8dfdffa3fede21442fcd0069ded0948f8326a753a0fc81f17e8d3e0fb2e0d3628cf35e20c38d18906\n\nPassword = \"password\"\nSalt = \"NaCl\"\nN = 1024\nr = 8\np = 16\nKey = fdbabe1c9d3472007856e7190d01e9fe7c6ad7cbc8237830e77376634b3731622eaf30d92e22a3886ff109279d9830dac727afb94a83ee6d8360cbdfa2cc0640\n\nPassword = \"pleaseletmein\"\nSalt = \"SodiumChloride\"\nN = 16384\nr = 8\np = 1\nKey = 7023bdcb3afd7348461c06cd81fd38ebfda8fbba904f8e3ea9b543f6545da1f2d5432955613f0fcf62d49705242a9af9e61e85dc0d651e40dfcf017b45575887\n\n# NB: this test requires more than 1GB of memory to run so it is disabled by\n# default. Uncomment it to run.\n# Password = \"pleaseletmein\"\n# Salt = \"SodiumChloride\"\n# N = 1048576\n# r = 8\n# p = 1\n# Key = 2101cb9b6a511aaeaddbbe09cf70f881ec568d574a2ffd4dabe5ee9820adaa478e56fd8f4ba5d09ffa1c6d927c40f4c337304049e8a952fbcbf45c6fa77a41a4\n# MaxMemory = 10000000000\n",
 };
-static const size_t kLen39 = 2270;
+static const size_t kLen35 = 2270;
 
-static const char *kData39[] = {
+static const char *kData35[] = {
     "# Test vectors from FIPS-197, Appendix C.\n\nMode = Raw\nKey = 000102030405060708090a0b0c0d0e0f\nPlaintext = 00112233445566778899aabbccddeeff\nCiphertext = 69c4e0d86a7b0430d8cdb78070b4c55a\n\nMode = Raw\nKey = 000102030405060708090a0b0c0d0e0f1011121314151617\nPlaintext = 00112233445566778899aabbccddeeff\nCiphertext = dda97ca4864cdfe06eaf70a0ec0d7191\n\nMode = Raw\nKey = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f\nPlaintext = 00112233445566778899aabbccddeeff\nCiphertext = 8ea2b7ca516745bfeafc49904b496089\n\n\n# Test vectors from\n# http://csrc.nist.gov/groups/ST/toolkit/documents/kms/key-wrap.pdf\n\nMode = KeyWrap\nKey = 000102030405060708090a0b0c0d0e0f\nPlaintext = 00112233445566778899aabbccddeeff\nCiphertext = 1fa68b0a8112b447aef34bd8fb5a7b829d3e862371d2cfe5\n\nMode = KeyWrap\nKey = 000102030405060708090a0b0c0d0e0f1011121314151617\nPlaintext = 00112233445566778899aabbccddeeff\nCiphertext = 96778b25ae6ca435f92b5b97c050aed2468ab8a17ad84e5d\n\nMode = KeyWrap\nKey = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f\nPlaintext = 00112233445566778899aabbccddeeff\nCiphertext = 64e8c3f9ce0f5ba263e9777905818a2a93c8191e7d6e8ae7\n\nMode = KeyWrap\nKey = 000102030405060708090a0b0c0d0e0f1011121314151617\nPlaintext = 00112233445566778899aabbccddeeff0001020304050607\nCiphertext = 031d33264e15d33268f24ec260743edce1c6c7ddee725a936ba814915c6762d2\n\nMode = KeyWrap\nKey = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f\nPlaintext = 00112233445566778899aabbccddeeff0001020304050607\nCiphertext = a8f9bc1612c68b3ff6e6f4fbe30e71e4769c8b80a32cb8958cd5d17d6b254da1\n\nMode = KeyWrap\nKey = 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f\nPlaintext = 00112233445566778899aabbccddeeff000102030405060708090a0b0c0d0e0f\nCiphertext = 28c9f404c4b810f4cbccb35cfb87f8263f5786e2d80ed326cbc7f0e71a99f43bfb988b9b7a02dd21\n\n\n# Test vectors from https://tools.ietf.org/html/rfc5649#section-6\n\nMode = KeyWrapWithPadding\nKey = 5840df6e29b02af1ab493b705bf16ea1ae8338f4dcc176a8\nPlaintext = c37b7e6492584340bed12207808941155068f738\nCiphertext = 138bdeaa9b8fa7fc61f97742e72248ee5ae6ae5360d1ae6a5f54f373fa543b6a\n\nMode = KeyWrapWithPadding\nKey = 5840df6e29b02af1ab493b705bf16ea1ae8338f4dcc176a8\nPlaintext = 466f7250617369\nCiphertext = afbeb0f07dfbf5419200f2ccb50bb24f\n",
 };
-static const size_t kLen40 = 920103;
+static const size_t kLen36 = 920103;
 
-static const char *kData40[] = {
+static const char *kData36[] = {
     "# Sum tests.\n#\n# These test vectors satisfy A + B = Sum.\n\nSum = 0\nA = 0\nB = 0\n\nSum = c590e57ee64fced3ca84d4bb013bba7d633e68b2ff4e27bf1db43f386dbfcce501f112b7fff6fb9436a576ccfccce12867becf02b91961453ea41f414764407d\nA = c590e57ee64fced3ca84d4bb013bba7d633e68b2ff4e27bf1db43f386dbfcce501f112b7fff6fb9436a576ccfccce12867becf02b91961453ea41f414764407d\nB = 0\n\nSum = -c590e57ee64fced3ca84d4bb013bba7d633e68b2ff4e27bf1db43f386dbfcce501f112b7fff6fb9436a576ccfccce12867becf02b91961453ea41f414764407d\nA = -c590e57ee64fced3ca84d4bb013bba7d633e68b2ff4e27bf1db43f386dbfcce501f112b7fff6fb9436a576ccfccce12867becf02b91961453ea41f414764407d\nB = 0\n\nSum = 0\nA = c590e57ee64fced3ca84d4bb013bba7d633e68b2ff4e27bf1db43f386dbfcce501f112b7fff6fb9436a576ccfccce12867becf02b91961453ea41f414764407d\nB = -c590e57ee64fced3ca84d4bb013bba7d633e68b2ff4e27bf1db43f386dbfcce501f112b7fff6fb9436a576ccfccce12867becf02b91961453ea41f414764407d\n\nSum = c590e57ee64fced3ca84d4bb013bba7d633e68b2ff4e27bf1db43f386dbfcce501f112b7fff6fb9436a576ccfccce12867becf02b91961453ea41f414764407d\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 23f85668bf4d0fa273d8c7f63c5fee57811062a674111e295a73a58e08dd0fd58eda1f473960559d5b96d1862164e96efded31f756df3f57c\n\nSum = c590e57ee64fceccd54e0bdc52476a756d32e794922dca0acc780d2c6af8852351102b40dfb97009f95e019a5bf38e5d127aa78bc34425edf96f763084a8b09f\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -4b5b16252ba2355e0b87f01baa721783c403607a4c1b5652c09a68e96926c8e314fa580bf0ad3f8f59bd70f14df86a4676661899b54c79a62\n\nSum = -c590e57ee64fcec882fef3ffd015a3fd9024d8f5f6d53eb537d6abdb0ff5e76a8fb08d5feed113fc9e74745d957adf32704a08339ba42efd5746c5d478e3f57b\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 908007a2f3c551c58958d1059427a0391d4d768f61cb802e4cb062c778354ea3eaa8f0dfbd14ca8203e07ae6d07269b58088a39f7608c5586\n\nSum = -c590e57ee64fceeb242f8a0893eaa0d2ccc3dc57ec40fe917cfde66618fba678ce0c8fffc566d4e8c7944d6443def8014fe8ee410a1b8dfd06cb0b436619e0dd\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1999301bd9877fe07ca711f308b2f1bc4a704fd194ec4dbc297355d6285340d6ad7e90cb0add1770aea19737a06750c3a7a6fa0b778ca995dc\n\nSum = c590e57ee64fcef321395bba088ca0a867e1e85a1ea77478f8783e6a6cf8f3e582bff83cb2d7d9fd549fcbb40dea22ac140351007030059500bdca81413600e9\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 219639ed8afc21e052422fff0ae5583231ebca2999404b099628093e6540b1dbc20b9c495aa7229b5965b19a5fcd653b3fa0eccab567c5b5e8\n\nSum = c590e57ee64fce834a00cc6282cb0eef49eac7a8d5b51988cb49253ed85ae261c76f2327a691fc63eceab02614807048b2816cdb9b89ca66a17b6ed1abdab580\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -4e40fea1cc899fb166dbc721a6639a28be4164ef92545307ed934796afcb9401d75c18d23352471709fbd049c50740ffeebe5590fa2d959581\n\nSum = -c590e57ee64fce1a17609c61ce02f1020c6eb6e241e3fdd01546ce7247725589de32db95f36718d410f9ce9a94fecc8fb205e876fde75ce83f4d01e1bd5d818d\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = b7739ed1cd3e67cf541943326cf76b4476f767465ee53b94c57c83de417ebee5673809b3bed1c8bac2fc4bce29a4e36d6d2083fdea1c12c974\n\nSum = -c590e57ee64fd03e2d08c3d8e5110d08e3d36557d82e0e49b408337a8c9d4298802ae5f0145a9587531a70d2f8af932b8262245428b5c549817d333f2dfaeeec\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -16ca20955a9d8a64cb2be217c089edecc02a75a1ea95fef584925742c18a234974c0a16ee7991e80bd8d4106db385eafaf421ac3373548aa3eb\n\nSum = c590e57ee64fd1bcac71b5b055e5934ba15dd7f56370063369c36e57a6b753269e085d0f4d38bfb711d5579dd1d89d07f266e727b232a497d5b0d9bfbc02d8a5\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 2eb21724781497ad2f57babeea62a20c3ec5d1559867a0968d74351a337db12c17bc8d1d5446b1115b5441530870f67da4275dfd9f3e2928da4\n\nSum = c590e57ee64fc7860b0be6ce861bc2f099db7fb623912b7b0729c019a8183c669c73efe02b195483a4cd2c78244cd59678ac4d62f6887fe686a3eed37ed460ff\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -74b7ff38760864efd658bd6699915be16cc058454b78495ade8be42c9f7470ca9b7a43655e1427ab1bc35a5693dac424a6ed92d10f85a9bea02\n\nSum = -c590e57ee64fc3126776e79d9fca06233bd2ef5570a65e4521183627bdbdbc555e9118508cf63f519bc0caedbffd5b1a913ee8c3603804820a9ce54b1207bdef\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = bbf238886916ca0ba32e9def9f9c8a8e401eb95dea96ef02df9fc25a186e52fbee9ad42b76ba6ca2c381d12cddd4292c5d355341a80c7688d12\n\nSum = -c590e57ee64fe6dfd728dfbe45aee52380b5a00cf1e05e9f09ac582e2714bb589caf2ad038111c5b1b5573a45706ab1f6fd5d5a1ee7ef4a9bf186dca8a9ede12\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -180e4c29718f394424cd5b03b6bdb8911c57fcfe435cfa66d10941f870f8c5eb1e1fd251f14af03f23ccc1841f014bb42a545f476dfeb12e9311\n\nSum = c590e57ee65004b3e18a5820de4a6d25e7c3d310003e0b8716bbfd51d5f0f3e87fdf8e00599d713397255281e66ef419a9d9bb228e8f052764f5f861ccca656f\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 35e2568ae9f1d1dfaccfc211e9c0c6eec9400a0de880a94309992528d428e77772f84e21d0287fa76cc6fb880481ebc43ad20524f895f35a1a6e\n\nSum = c590e57ee64f84896a5f11f575d34b6001f27d4b4d6e7cd9485260629f8f7f1c6ca6f6115b98d776774295dde4d59cdbbceccad097a0a054b501bfb47d81e85c\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -4a4820a05c39969774f623bf6c03ebe0c56dc45bb46e8d1e6b32ee0fc3c6168d26c4d1c0ec7b81f1ea76f164ebd00b2a2a00aacf40175bee62a5\n\nSum = -c590e57ee64edf1b2b57b4cbb92d778ea6b9d9878a0374d4ea81691b09811b105bb6dbf23a57d89264f0e6c83f8d00fe00681644feed56e15fc81103ab9b7dd6\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = efb65fa7b963533d48c77ef80fc7af4bcd72222cabb6232ccf3efeffdde537ce25a8e4129b91273a8654ade9a05ba3dd73740008eec82dd4cd2b\n\nSum = -c590e57ee650e25da7b60146e014f472bfff9809aa8f519db7943f69d9ad09ee75a3427c6127cce7bd27f224b9dec03111fb066956b4903f9f9740cce1aa4ba7\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1138c1cb69317d3aa341c9a4daeba71400f56aae62a98acff1f9f1aec88a4ef01ceac74246fcb531738de63a94fc8b3e9c5ea3fc64101083a00a6\n\nSum = c590e57ee653af8752322840ed720f628f9674c81073b58372e49ef26d4a2a9d46a0391bc170336614b27849de98709a4b321da4ddfb978e9f10df29154edb9f\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 3e0b5c732ba11e1074f0c69e48b78d724733c66368a21409c404debe97f444f4a352acbaef5f077d0e9479ce067043b30cd393f3fdf5d3bde909e\n\nSum = c590e57ee64bc13634cbd149aae35ee47bde6ea3663f74ff300cfdb2d845f902f017586c6d4f83f08c3b4f0c035055d13fc9d340b7b9ed164432aed44e8f4d7c\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -40d9b56339ce561876171a9d37aabd30fcd47dca1171e5467f14c6a9f616b04d67a4abcc8334d637731816e87e35feb10dd3f1b9e50f78ae0fd85\n\nSum = -c590e57ee6477eb692705f8da1357e71591336907a5e0a6e39715088d53b2610882765357563fd101bcf05ca545a0c718f52879fdf4f80cb9a12cf108eca60ed\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0f",
     "fcbd9704b01\nB = 8501af88f0ea16b3541e4cc9eb2bebef137d8d33cc4485772c43ed28f54a1fcc2012b2d347c8f126d7ae11eff2f00c37b4989c5be30bb4aa5ea14\n\nSum = -c590e57ee669b662e37f5abf13d00d2f0c1c9a8b99ec546361aad255f375bc2742a3487c351c5ba00efef09c77331577460a47c57125c620b643e9eaf36a146b\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -19e791587fec9007654cd8e66ab13c609d121c54fcbd84c6c7d1d7e7ec8ea4c2f65d64c5fb6e43106b8e2497b89124ce5afbcb5672ea1f19f9c96a\n\nSum = c590e57ee681dcbf1554f22c0b1ffead917dd414299cb37ce6967ffec9c333931e70358729843c8130ac95aba47fa1fa5da74000eff25eecae176f093a4effca\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 320ded8a5583fcfeb53e576bcbeac4f04d7135d9e86b2d9d154943c3b97bafb75e3e45e7a913523db81aa7af5589604d2794974e466f3d60deb4c9\n\nSum = c590e57ee5e505ae4a2e1f25a1ae9b7b4d17dd2cccc09f2416d964e55af6d0d31fe259c160f87646a72e6732d5110256b3b35425225d622b81418435c9dd8cc4\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -6ac92340d14f096abc24dad89a0c226c8ea322f5d4afebd1b7197c3ad46016112d87f4a1d51b2691b684fbfa9e627b806d6829de8f7b960f92be3d\n\nSum = -c590e57ee58c3ef1582bf7a516e36f92b60f5a587e2c8cb071d1d52ff215854e52de1519fd5204fa52292dfdc397d8d76b78005941358b63a3e6ca41b0eb09b7\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = c38fe032d37689f58750c36fa28ef6bb22b5969adc3fa13a98650107d8a4bd74d3f940f6da545ba32fae7b42d9b64761953ef1bbea358a2885414a\n\nSum = -c590e57ee80262967da4038a143f8ff2e78646108f25ff7183444ba507d76f9b05a34c8310e682c05495d0863ceff264964dbfa7c064adf6d26d2dca6e22ab13\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1b293c4f2a4955b07d4cf9cc1d45cc155d6bd2a769636d3db29854baaec92ab9ec084850b924e2cd6286b11e7fc09071d99e3a1729c2dfe94b26012\n\nSum = c590e57ee85427f08e8c89ffebfcc05c73370ad4cb77696c2b2f3878e6f6df341d4d931b5097aba49f14ac0312e7da1c843d6fd08119822e75e6e7a8c7bcb7b0\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 204591f038d1bd0df9200064d852185922827251e8123a7ba48f4e4c296d943de71ad69561129a9ac2052c9d5ebb92fde4eb7d91615e7dcee4c6caf\n\nSum = c590e57ee051ca1a363c47a4cc016c3de7f7e17985009b545528289e9fbc9086f4b42a73826eca0c278b0d1b4ef6d74b9a0bfcb7855d40fdb201fbad1074b927\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -5fe04b754c3268a406954183dba07d5b44ea6f2b785ec328cf159c866028f63efb7342f2178753e17d0b0071445b9e91d6d8957adcf041ec8fb91da\n\nSum = -c590e57edcd6e9ef06fe33f3817ba3d0c50c8122b77615c4b8fa50c5514f113d7ba53ce057d487bcbc373c4384d07b29a527b7ef785ca609474879b42a9a4c3a\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 978e4e284013a3b8aef1c8560a5682c81d92c8253b3c40bdb5ed911df117cf71a51767e8ccc4615e1f70c290929feb12a6e244c18888617aed5fec7\n\nSum = -c590e57f0436bdceb586a093522eb1630e0fc08f8790957aba1875a42b7676f9ca936e8f6f3478d6ef5cd590bf6ded0700440dcd769496822af8015f0a6ba2b6\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1de6eefd2a87326445c3f10ce85dd7404e415333ad6a60d2fec88caa6fdcb4b7fd0e7a9ba659533758a665b451f2572cd3c9cc2ccb27019330fb57b5\n\nSum = c590e57f1df3f004d5e49f49fa28603b26659f1fd35e0d8d7a2753591dbc12c51e6b588427dbe3faba2f0c1f2f0a2aea9ba1fcb2fe71c6ff40555058d23c8661\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 37a421334ae5311aedbd9fe500b3b5d09a0ecb466d793e87f10e2875c3b49eacb5b5e5bf712b89c5c842a397ed5046125ba6fca9e084508cf8cc3b60\n\nSum = c590e57e9a4abf4572fa7c4c9f73e9d3fd1227646fd6d15b51924bd7a5d417b01fe6b4273eaa6ece387422b81c8116f29702d7d66d2f6e8c3454807b3b7d413c\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -4c050f8c1804f1e26cf6d682289fc1eac97870ebbb1bc8f986d9d29f3ad005b0337b8f6d108f5fa14a467060174edeca359b5bc92b7c7f509df309c5\n\nSum = -c590e57e64216c306f17017ac9dd7085113e16c83168664dbb77c7ad3ddfc79b09f9ea0c474a0b497ca15e7fb258eed9666fd009f691a3b2d691c2c6b22ba3b3\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 822e62a11be86cb4428d4fd11473d28707e6dbf951364d23eece22b450bccfcb2adbf2f1cc6223d9b46e987947e1e696ac3926a2893f3d052744a74e\n\nSum = -c590e5806ab4d09773c4f94a4aac09f6ed7609eec1d0bafecb09e30f032f706e9adadc191ff9e6d7dccc821f7a8666a590e521749d24912c5a5ffeff246f7c85\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1846501c5e8c58b1b3e4149a0c7c4209f888178b7be5bce3dd681861f40242241add3e89c93c8ffc613bedf52e2936ad3fa59c6d6fa8eff334aff3184\n\nSum = c590e58248cbf5dd61ec57994fc862ab479dc6cda51cc17356c45cef66bbfdd12f5cc421940a561581c123fb17483beb7a1cce2596fa9ca76e722a6f4621eae9\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 3627c270bd6ece96a435da25521ebdd7e6bcd7f2c4a16481e3a0e1381d4a60a4a21e457da38bda1a1b080b498cbcb1784f42fd2520ea12aa36cb19fe8\n\nSum = c590e5771a85bdb1f26c0386ce837bec4b0af5656496efdf4f134d875f066dd6d477ca8f87ffb275da07da4dd1bed4232849a526836b47f2d69f2d53b6b3e2f1\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -7cbca111f98936aa83de74469daa6f3e9d4b85267bd9ac749cda77c78863eef47ea264bc56efba80b9508b32f8608117a1f5f82628931d27822bc6810\n\nSum = -c590e571c76afad23439f904e8a80fc28dcabb6cb732e361ed3eef471be6fa755e3fe746edbfe448c1f289ffed7dfc01fe9066d780564f57f93abbca9b9a995a\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = d1ee4d3ff56c5752a23c2b09397e72de2821c5ee51f6f258a10c6efd9fc76d290846619f28710f85979498b50afc14fc922747afd669644013dd5b1a7\n\nSum = -c590e598cd5d4a59ff5d6c97c6370fb517f1d492a7776f90063b0ddd6702e37c60fc78bb12857911cea37b7263584d7dc815676de6b8880200acea154b59b08b\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -19e70d7b88745dfe68b9cc4f5ef23feb436e282d48f98cf90c3a54f92d0645bee3a05f7ad6859ff918fc90c62b19c3b0cd43edbdaca0dbea4971e9658a\n\nSum = c590e5b5829e6fceb77830fbe999a98127b50302fd0f6a86ea4aea27b846747a07e6fcf5457676e6446137d6bdd8ff4fb7ca747b650b066d65d7dc1e172488e7\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 369c4ea0fd2c78c2ccdd2ee92b020319b3c3c0283fdd9cd5568b988a2aad30431dd35078aafb5db57d571177fd0978bddac2403c180606dc523db43de6\n\nSum = c590e52a3ab5d5c458634254e2f672a322000750741e969d2f6cd12d172480ad1455300e3a0575b068b85d50b58f9737be13073188d0f03b71494bd0fd2fea16\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -54ab99f90d329c2bda29744db303b1e1fec530aba9dd4143a4158969a2466189c93820888ae04b2508b137f01af03eaf6f19f9da19ee87b3fadc4060eb\n\nSum = -c590e4880579ef7241bde94e8c7847badc705f53828751f9975f0e66371d2ddff8740b143f32e88be8e686e2bf5a3ce03d864d7699a813b1777b9239af242c7d\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = f6e0d5df5f494184e07ff2789b494189fbb6c7f04d754f066af590bc6f6242aec332f315af601cfb76a76d4a7270cb692a0922b6a3e8556d922a4c1e84\n\nSum = -c590e6dbe54098694155509e38c61d503ab7e5237d2cdfc2b87fb57e3a8420fe37fe50a0dad4f0eae3d38fad6198e4ecaeae183a12078f53d09ac8099c715242\nA = -c590e5",
     "7ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -15cfef0c997b655e26f2c5b5cfa1505fbd443dd9d7babd1a0ad0dd636aedd4796c968aef2af9ad00d53fad15d9a005c61996f3cc4fe70c9c83dc3010741\n\nSum = c590e906254d013be2021ad591e76e26706a6815b8c484b6528fec65416e1066957002713e1183f1005f565983aad7aa031e549e6fc57094ca3e4383e7fdbc15\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 3873efd326a5702aca6857cadd04ab87ec67f75426f45e1d79414c026173ab94899cbeb85b5b75bd4001ce3505754cc9dfdccfaa63f6a6d43b80e8d7114\n\nSum = c590e0e0079190d7afd80acd6326fe93cc00903318608df31ee4493d11271dac7291bd142cca0e5dd7dda59dabd460a69b7855d9c2acb5f062de76665e07cbd7\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -49edebe3df9db276361a943c1c259b1591c20eeb453edc9cb941b86cca2e824fcc3455befdd7125dcbbbaf326ac12d960c6e01e1464fcf289657b687f2a\n\nSum = -c590d9ae456d66c1b132d844eb223867ba4560b36f53c42a616cf8cc657e6d252f813847fb9fc50127227684e5c0f5cd890eceb341d21e788e42f843e9b64080\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = bd0a0e2680fd9cc95ea214887ee6b6c889bc9fb7e1cab411c04c72f7d2a2b35818f7686393a21e10bd4810691852542e7ed60f8abdcd18e0787efba0a81\n\nSum = -c5910498291472fe1d0047d5bdd9e46deb3f26000e943fce8d83d700d9ae233ab3a28849bbb346803da142db6a471e9f79cd49571f40dbc46f7b727a4bb3016a\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1f1942c4a42c9200d9a6b16f2417c58d3cb0d544fd8780d5c22fad0038eb58ebce72498d4844f49dc082037f974ccb7b92b67c76116f0faa72ae7242b669\n\nSum = c59112d841ea109440e78563d9eefef201c81e86ae967083f8b7db80d1eaf58551d30519ca6dd79164fe69a29cf1ba22446cb2999f73292241005bf17b37528e\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 2d595b9a41c2b5e81734cd843e9bdc16353775472e3cec09c6afa53d0b35f71c4b425847d9561bfae749362a32cf961afbf8fca85ecce12f5c25a1c7078d\n\nSum = c590671f890ca06c74ac6d2c4d75aabeaaa55312e85a5e1ea9cef0e08e154e2b090eaba869e9f6e4a47ae10b9c1eb0f6ae4fb3ef12b3121d96066c6c8e592b6e\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -7e5f5d432e6516530102bef515977b0c963c50f4e42862df23f09e989c2451a80e2f083c0756a488a14dcaa8d65c000202b19017b837c9ca935f4b171f93\n\nSum = -c58ff0ae92ab03072154949a7143d45278ef77a0ba71a785d5a370e0d30a9b4b4f7e96a395d13e6afeebbd717365d471ee56ba11c472a63c0532558104bedfc5\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = f4d053a4cbca69aad9949b26ec03acc271ae7edd9ac1370aa3f059a34f040b382333dc54bfd04a17c4e7f361b2e0bffafc8ede5824195a9eaa4ad4b16b3c\n\nSum = -c5927a5fcc3b31abeca3998ad99c07626112288a6ad95b24929fed581040757fdce73881c48b02daf09986ea436a3f5ceb6833c31fa2e1691567601a26c7a6c9\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -194e0e5eb62da61a42b5bcd31470c3b603f3b318a18dd85f1d886e3928b3082307eaa5265049fa7960490dca2b80a3d167d227cd81713b596604e4d575bc8\n\nSum = c59395e94d495451e3fea153f3e4361a088004a7d5426c1b94aec44108ad6f5cecc3a80dda0cea9f51b882747258137e171bf021b4fc59f4dcf0106d4ba952fa\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 2b06a66f9858058ff3324e77975c3e2ce1b589bf329d48800af6fdbff850d920cee3667e6ec6408b5001b0b908c2b68ca398112318f9f7d1f10a1723907f9\n\nSum = c58bdb26c0fd6766f3affea389cbe7db25c06d5d56356d3d945347775bddf479ffc9e279e7d1ee88eddb239906749815ae4502fbbc6fe978a001ccdafd89cb10\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -50a582552676a974f6f8b829ed87afff17bf1e319d509785acd59d0cff5d55aecd75d8a540fb25b285ec06052ef3d000cb3a4e65ae0dcbfcf32f0dbe67ff1\n\nSum = -c581afe9b7ae86d4b7053f19649beea6cb935799a553f035f9b9a7fba6d5559e4ecdcd1637c73c8052c6cc52ee1c28d1e5aed9db7261b7356afd6e3dbc213684\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = f35952ea147fcd3fa2f15a7ced1af5a1e91b593fb521112f46cd585d894b10be8ecc13a5ec1baf63cb60678ab5e80c8a2dcc53069131ff4d3918e1d4f147d\n\nSum = -c5a19f36a65a6a8d52a53a63f99a1b957d6e376b7010ad14695d78d67b0d7c86881006188bd27bbf205c8c9c200dc8f5c08ab6b97dcd512f6cb93ed9a361ff9f\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -10b9b7c00a9bbbc7a5cc34ed2f5b3f57bc4e1c36c16acd5caf64054e5f92372d594c4119ac7d83d7590a42b94641a312390018db0286da0ce83f0dc9f1b49e\n\nSum = c5cd0e5da24b67a894402b0eee5dd586ab70e5beb0693e263a54995193663a9b770141379c1f097a49d1a889bbf0c348c6f40ed50bd7bdc11a7869c6106c6d80\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 3c28debbfb98d70940bcdfe1f3153085befc6f7719fbdf2da6848066b8504c1c4a876029f90b3f00ce263055293bf618a25834690cf36bbaa769fa36fc227f\n\nSum = c54e2c560a00226701b76cf03d5de27a8c69b38a6b85dad9f7c903d2e87f9a7d247522e72491460f6a529e5ca2aaaf690cb238b873ffb49d9fb0ecacfedd4e90\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -42b928dc4fac6a8948013ecf0cdddb994835c4cdc9676d14e510fe442e4fd2364196f04d94b82bdeb0e3fcc41cd7e9a19f7de82ecb15b7c020131eda92fc71\n\nSum = -c4bfb037f6e6e861efb090ee610c33e7568790259f747dc6e55d442aadd68c0cc93c7617f83980e8813c0fb7dd28c8aaca6ad8fdde5d2bfec9ae096faa9ef54e\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = d13546ef68e66f9b4edd40ab5e8c6ecf2a592999dac4802750d0a67ed75e42917a43bf79ec7d52c7c772a1899ebea7e3e6dda2c46d9e569622f65c2ed155b3\n\nSum = -c6aa2af8c9ae8be4aada83f66b7f31a8bce5e92c67d8938424a1405903e5502bffc4ee1e333da4bcfd0cb383b19a566372f877a8344b66dbceabc9786dd0e4f2\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1194579e35ebd131fdb15c75f1471529733ffdd2e89513d17f32b87d73765dca50e3446c117a681b409312a4ad2cf10c4a6c10791809c866edac9ac946099f1\n\nSum = c8aff66c9bdaa49eafac0f65d3ddff223b7a5471f7400431ca3a54615d600fc4a163f8fb648bddb5fd6915db1991611805040e0f86f152c8fd3333ef70d632e4\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = 31f10edb58ad5cd24aca136c7733ecc15c86b22bdf0c1eabd8c3f9030b2257546ad3f23f265df7ab4659381b2c9d9c556b2576ee42688739d6234239765e7e3\n\nSum = be1b6eb768e2cef388eebe31f9b21e51b38b351cc8175eba06d49eef04c2936f32167174dcb82297fd4180d0afb5da2c455d158c7a5bf01bdef8c295a4f20390\nA = c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -77576c77d6cffde0210affd12b8a2047226b4327137e38d05d975e227eb56e028a04862956ddba34bc20188b711ad2668f4a114286eda3980d83d36347e4771\n\nSum = -ba32fca1d5cc5f31ecaf5407f376d3aef9f4abc04fd4c6893721d3e50e9141abf356eb2ff6f7a4f9b42983148670d2918e1dff7aa7ae33a6e9dadcb708b4f9dc\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = b5de8dd10836f9f9e501a2718f3eca72bbd3d8ee97a7bbdd58c40ec1e1ca8a3675fcea77b2e594194d9ff44e056b4c12033b725fb1c96ae75f62314d0bb5125\n\nSum = -e388afbf17c495f86aa7298a45f848eb57e5baaee42b1f7de8c2311bfbb8f74549712c05fd3bd11ab8874fb55abb22a37ba3512e733ecd5c472842e8e6f7b179\nA = -c590e57ee64fced18aff6e2f0c6ac05625b1e94f394f42470cae14d12cadea4f5ab6b9d77225fe3b4903825966c78752ae51b6a0a2caca555fd0ffcbd9704b01\nB = -1df7ca403174c726dfa7bb5b398d88953233d15faadbdd36dc141c",
@@ -2536,13 +2490,59 @@
     "b4d2e263c8efb08bde7d92eae8607fb5e88b1378f0f1bd0733f229a35be6b1383a48d32749d5d6b32427d26323b7ab05bb5781289e96bfbc21971439319b15f6c0fe93fdb35d0b67ec41443c59a081dd3cef047ac797fccb45bece84c0bb0bb7e1797259526d8ec9cc63ba4d32cfc692ccd3d243cb2b53ac216312f3a8e8c0daa09d21b6150d697639a5e52059414a417c607be8ec0eee2e708219cadbaf37a369c4485b01ed87bbc2\nB = 2c474e396a2dd9cd10b9d7313f69d3b4ca123e9fd853edd488339236d14c56453a1381958864a04d2624e81995dabcdd0ccf60db9917813f887de68da075d0ea4440001e18f470e43b38ee3440b49be651d709fbdef980e3e4149913f4ae2681124f54523f4881376ddb533b5219e804cc26f4c2e577be4e02613c4da80ba1215775b0a5178a965ad47bd2befb32493943ded1004ef66347b4983f8d1ba990d4a943505dfce6debcfb322842ed88106cd6dee9aa592ff0d2274bc727a6e1f14c\nLCM = 9c129cf649555bfd2d3d9c64dc6d6f022295e53bca5d2f218adaa66aa60eb4694429b7e83bf81b6df4459c5104023ab9a33f006ffcd8114507baa17e2ef6fe23ebdd4740f66879033da2041f2cb7ba517ad3526ffe75614ea9432c085f71b2d65a736bac7ba42b639e330b82733372083843dcb78b6a273ab20e0d4b7c8998a14048aa15bb20a0a0bd997917107274c89b4cec175fb98043d52e6c555bd9e0036566d052a6d4e7e276d1e8835e1f06e3ca46d47747ba586e95fb1a790d992834b7c3e136141eb8a434e6c12067246ac3c0a81c69e03b1ed28aa0b3173d6eff83d278c2f461a47a416f3f9a5dae3bb410fd18817bd4115e7f1e84b936cc02364\n\nGCD = 95aa569a2c76854300d7660847dd20fe0b8c445fdbcaa98465cee61aee76ad6a438e75a8c573198570ffb62bc07ec3a2be0ae0a1f631670fa88d6f75f3161e8b9a4d44b6801ffc884c7f469c5ed1f27b1edecce9f2977f9e92d1a3b230492fea7e6f2af739dc158a7fbd29856cbedb57b4119e64b27ab09eb1c2df01507d6e7fd\nA = 4c653b5bfec44e9be100c064dffe5d8cd59b0cf4cc56b03eabb4ef87cfda6506c9a756b811907fe9d8b783eb7a0b9e129773bf1da365ddb488d27b16fb983e89345d1ccdb4f06a67a11925c3f266373be5d7b0075189c6f3c2157e2da197058fe0a7bcc50adc34e99e254a29abbe2d5948d3157e1b0c3fca3d641760f7b9862843b63abef0b3d83fd486f4526b30382fda355575da30e9a106718a3921774c4d69f5311f8d737fe618f5236b4763fe1b2ee7f13184db67367d3903c535ff6d7b\nB = 2dcca83c99a28e9fd2f84e78973699baf2f04fd454094730948b22477834a0064817b86e0835e6d7b26e5b0b1dcf4ad91a07ac0780d6522df1fcac758cf5db6c2a5623d7c0f1afefd5718f7b6de639867d07a9ec525991304e9355d1635104bea837f74758d6aa2aab4e4afbb606af1d98de7417505e4710cd0589bdff9a0bf38a857cc59a5f1781043e694fc2337fd84bdeb28b13a222bb09328a81ec409ad586e74236393d27398cc24d412135e34247c589149e134b97f4bd538ac9a3424b\nLCM = 1760c0b0066aa0695767099e87e9388729ea89b8e8c36bddcd04d257591e741613c07b0e69447c0a468c33a745084171e06523d987d8db40a1433bf435325e8a724a0876503b34495170ff3671d42117a2e4f3a75b1d9dd809a34fa0fb26fe50d84f80a9b02e40190e5efb927a5a61a03f13edbce2e666af6c3a2a9bcb84e47e3090008753ff27c4b8cf06480f471379a93f5230923623a83b286b71a555cd5e5347282f664ed90b14b2c4de84a70375e488211a7b3931119ef3bbe029b712389fe784818a0bf29d80733ce9cc940c547aa1eb3f06d492eb676bf37802283c82ce76156dfaab5c2d5107e08062681b5fa169f6eb68e1ab8bd9b2005e90bd4fd\n\nGCD = 244b9b1290cf5b4ba2f810574c050651489f2d3a2b03e702b76ebfaf4e33de9bbe5da24c919e68d3a72eadd35982b3a89c6b18b38ff7082ac65263e52b6ec75a5717b971c98257b194c828bff0216a99536603b41a396ea2fb50f5ea7cf3edf10bb0d039123e78593ae9ffcbbba02e51e038533e83b6bc73c70551d6467f39809\nA = 41a0b1310669500681cdf888836f6c556758750f562d743ac780dd4c0d161856380e44fdbb1f8a2786bf45be6b0e7f1cb2cd85f6b9e50acc72793d92383c7d7fb796fc74d32e8fac8225bdc19ae47546d9c9c75f5f06ca684f07daccaf89ccf2cddeb7ec255d530c7dd1e71daf44cafdc9d30fbcb1cbaefae3480585f79f4177e3834a5bc91845e2e8cd8aeb27f484e5e5b2c3c076dbb6c23e91303f0a0fdde83cd33a8ea6ed1549e727b4d766c1017c169710fd98e1585d60f66e121f9180b3\nB = 251f5aeaa60b3959285f49540cdaf8e21451110bbddb9933bbbcaea3112f4eb45e435a3ba37c52d2ab79ce997a8f6c829b3aa561f2852924b8effb52396d09d2bf257ebb4fb56c7aa25648f69b06d2cd01e876c9f9c0679de9e6fffa79eb7e603723e5af7de46ee405a5a079229577b5b6fffb8d43e391fe6f4eb89638e64d6eff8026249aaa355a91625eb0bfd14caa81e4c3586aaa2e94fde143a44f223a91e226661d12f55dfcdb4215e5a64e14e968005733be6a71c465de312ca109b34a\nLCM = 431f918b274f3e43f446e4e85567883d6536a0332db662cef088f5a36b0f4b68372048174ba10fee94b9f8f1c2e189c974be2e6e8ae8e2ae108445326d40f63e38d8d4e2e46174589a3cbc9583e0036dc8146e79eee9e96f4436313b3f143dd0f5aceab05243def7f915169c360f55ef123977cf623c5ba432c3259c62fb5e37d5adab0f24b825aa4ada99ec4e83e9ca4698399e1ed633091ce5f9844c540a642cd264201116ed4168aa2105a5159f5df064f845830c469140f766c7319052ce59bd1ad7c3f2d8c30e54f147f6aeb5586c70c984302ba18d854a60aec01b394c7d66fa33fe18fe4a8cfb3238df219294e6e42190a30d28b10049a1b75853a4e\n\nGCD = 206695d52bc391a4db61bf8cb6ea96188333a9c78f477ee76976c2346dad682cf56ca6f176d86ef67d41ff5921b6162b0eca52359975872430dd14c45643eacdf028d830770714c033fd150669705851b2f02de932322d271d565d26768530c3f6cb84f0b3356f970b9070b26c050ead0417152c324c8ffe266d4e8b5b7bef3a\nA = 1114eb9f1a9d5947eb1399e57f5c980833489685023ed2fe537fe1276c1e026b9a19e6fff55aa889d6c4e977b6e6f3111e2ad463138637b50f42cf32e57d83f282de9e72f813e5969195159a666d74dcd689bd527c60199ae327f7bd548ac36868fea5fdf6f35d19b921e7c10b6448ca480de6826478cd0642d72f05af3f8e65ce42409fbd49f56e81946e89c8e83962c4edc0ed54600600a305e52d081aed3c351e450e11f8fb0ce5754c92cf765b71393b2b7a89c95df79b9ea1b3cb600862\nB = 1d8f3179ca7b5cc7119360c10de939ffa57c9043da2f2b0ca3009c9bdad9f19ed16e3c2c197bef4b527fa1bf2bbab98b77e26c329911db68bd63d3d0fbfc727a977395b9ad067106de3094d68e097830858c5ccfa505fc25e972bdee6f347e7d1163efacd3d29a791ec2a94ffeed467884ae04896efc5e7e5f43d8d76c147e3c9951a1999173bc4e5767d51268b92cc68487ba1295372143b538711e0a62bf0ac111cc750ca4dd6c318c9cbe106d7fc492261404b86a1ba728e2d25b1976dc42\nLCM = f9570211f694141bfb096560551080cbe02a80271b4505591aaea9e3b99ea1d5ac1c1f2378fd72799e117ac2a73381b1ad26314e39972164d93971479ee3ba21a4d98cef0bd299d540ce5826995dcee0de420dff73d30b23cbf3188c625c7696df517535bc5675d71faa00807efbebdca547933f4a37849d1c014484a77da6df0670c4974bcc91eb5f5fe5faf9dd095ef195ec32ad9eeebf0e63288b4032ed9e70b888afc642f4ff96f0b4c0a68787301c12e4527fe79bdfe72dd3844ab5e094a9295df6616f24d1b9eeebc2116177dacf91969dda73667bc421ef3ccd8d5c23dddc283f5d36568d31f2654926be67f78e181075bdc148f2b39c630b141ae8a\n\nGCD = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\nA = 0\nB = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\nLCM = 0\n\nGCD = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\nA = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\nB = 0\nLCM = 0\n\nGCD = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\nA = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\nB = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\nLCM = 3d319c42d872f21131ce5ff3ab8bec94339308e620316dda218e85fedcd511cd62f0b2f3448d5e58fd3520ae8118abd54ead9ad9e8ec3890365c6b2cca2172d4b8839b2d2c5ab02f65180826cb0cd5c9798f5d6261efe6e6ec31dea047da7c486b0590359e6f333557f67ceebf9ea9cd5dd986a999a8c88bdbd0ca21816b2423\n\nGCD = 2\nA = 14e95a85e59ade9ef39e2f400c65db18702fa5fc485b9bba479a5282b2206129160e54f73ef4917983c17b4c5ebff7be112a886de069706eee29ba902515",
     "cb038\nB = ddcfff1d39c90c599f55495bf71c1e7597c6b08b7430707f360c6a6e5137bbc7b403c6d9e2c34f3d2f29d5d32b869346853c2de239cc35381bdfb4a01569211a\nLCM = 90f38564ee72e55d362c04599e7d74f068c75f541b84e97abba2841f1a9f66b06b5c9009f6a4c2e319fced85270588de03ccebddbd9279aaecb13bdc1dbea7f42acaee751cb7da83779b8785cc86f41b94b13b54964208ca287d981634778d1096f20e76ca636c0717fd27e0800c43f599a5eded807421b502eaf9990a8c8ed8\n\nGCD = 4\nA = 3c719c1c363cdeb7b57c2aabb71f425da4c3e6d3e447204d555e7cf0f3d372bdda906f36078045044978dafc20171767c8b1464d52dfdf3e2ba8a4906da033a8\nB = 30fe0ef151ac51404e128c064d836b191921769dc02d9b09889ed40eb68d15bfdd2edea33580a1a4d7dcee918fefd5c776cbe80ca6131aa080d3989b5e77e1b24\nLCM = 2e4526157bbd765b0486d90bcd4728f890bc6dbd9a855c67ca5cb2d6b48f8e74e1d99485999e04b193afca58dbf282610185d6c0272007744ff26e00dbdc813929b47940b137dc56ba974da07d54a1c50ec4a5c2b26e83f47cf17f4ccce8c3687e8d1e91d7c491a599f3d057c73473723ce9eee52c20fe8ae1595447552a7ee8\n\nGCD = 10\nA = 44e04071d09119ea9783a53df35de4a989200133bb20280fdca6003d3ca63fdd9350ad1a1673d444d2f7c7be639824681643ec4f77535c626bd3ee8fa100e0bb0\nB = ca927a5a3124ce89accd6ac41a8441d352a5d42feb7f62687a5ebc0e181cc2679888ecc2d38516bdc3b3443550efccac81e53044ae9341ecace2598fe5ce67780\nLCM = 36805ba9b2412a0cb3fe4ed9bdabfa55515c9d615a3d0af268c45c5f6098d2de4a583f3791f1e3883c55d51ce23c5658fd0e8faa9a3709a1cfbd6a61dbab861690f27c86664f084c86cfd4a183b24aaadf59a6f8cbec04f1b0ded8a59b188cb46ae920052e3e099a570540dbc00f7d4a571eef08aa70d2d189a1804bf04e94a80\n\nGCD = 100\nA = 73725032b214a677687c811031555b0c51c1703f10d59b97a4d732b7feaec5726cb3882193419d3f057583b2bc02b297d76bb689977936febaae92638fdfc46a00\nB = 979f4c10f4dc60ad15068cedd62ff0ab293aeaa1d6935763aed41fe3e445de2e366e8661eadf345201529310f4b805c5800b99f351fddab95d7f313e3bb429d900\nLCM = 4460439b4be72f533e9c7232f7e99c48328b457969364c951868ceab56cb2cbbeda8be2e8e3cae45c0758048468b841fdb246b2086d19b59d17b389333166ab82ed785860620d53c44f7aaaff4625ee70fb8072df10fb4d1acb142eadc02978ff2bb07cea9f434e35424b3323a7bda3a1a57aa60c75e49ebb2f59fb653aa77da00\n\nGCD = 100000000\nA = f8b4f19e09f5862d79fb2931c4d616a1b8e0dd44781ca52902c8035166c8fca52d33a56ff484c365ec1257de7fa8ed2786163cfc051d5223b4aad859a049e8ba00000000\nB = 6e54cb41b454b080e68a2c3dd0fa79f516eb80239af2be8250ca9cd377ba501aabafc09146fad4402bdc7a49f2c3eec815e25f4c0a223f58e36709eefd92410500000000\nLCM = 6b3020a880ddeff9d17d3dc234da8771962de3322cd15ba7b1e4b1dd4a6a2a802a16c49653865c6fdf6c207cbe0940f8d81ef4cb0e159385fd709d515ee99d109ad9ad680031cbae4eab2ed62944babdade4e3036426b18920022f737897c7d751dce98d626cdda761fec48ad87a377fb70f97a0a15aa3d10d865785719cc5a200000000\n",
 };
-static const size_t kLen41 = 18795;
+static const size_t kLen37 = 18795;
 
-static const char *kData41[] = {
+static const char *kData37[] = {
     "# This file contains test vectors for whether B is a Miller-Rabin composite\n# witness for W. W must be odd and B must satisfy 1 <= B <= W-1.\n#\n# The following Python function may be used to check values.\n#\n#  def is_miller_rabin_witness(w, b):\n#      # Variable names taken from FIPS 186-4 C.3.1 but the algorithm skips a\n#      # couple of optimizations in the FIPS formulation.\n#      m = w - 1\n#      a = 0\n#      while m&1 == 0:\n#          a += 1\n#          m //= 2\n#      # b is a composite witness for w iff the following are true:\n#      # - b^m != 1 (mod w)\n#      # - b^(m*2^j) != -1 (mod w), for 0 <= j < a\n#      z = pow(b, m, w)\n#      if z == 1:\n#         # b^m = 1 (mod w)\n#         return False\n#      for j in range(a):\n#         if z == w-1:\n#             # b^(m*2^j) = -1 (mod w)\n#             return False\n#         z = (z * z) % w\n#      # At this point, z is b^(w-1) (mod w). If z is not 1, w has failed the\n#      # Fermat test and is composite. If z is 1, the value of z immediately\n#      # before it became 1 is a non-trivial root of unity and w is composite.\n#      return True\n\n# Exhaustively test a small prime.\n\nResult = PossiblyPrime\nW = 7\nB = 1\n\nResult = PossiblyPrime\nW = 7\nB = 2\n\nResult = PossiblyPrime\nW = 7\nB = 3\n\nResult = PossiblyPrime\nW = 7\nB = 4\n\nResult = PossiblyPrime\nW = 7\nB = 5\n\nResult = PossiblyPrime\nW = 7\nB = 6\n\n\n# Random large inputs which try to cover a few cases. The nontrivial square root\n# case appears to be difficult to hit randomly.\n\n# b^m = w-1\nResult = PossiblyPrime\nW = d6b4ffc7cf70b2a2fc5d6023015875504d40e3dcce7c2e6b762c3de7bb806a5074144e7054198dabf53d23108679ccc541d5a99efeb1d1abaf89e0dbcead2a8b\nB = fabbafdbec6494ddb5ea4bf458536e87082369b0e53a200ed413f3e64b2fddc7c57c565710fbe73fae5b188fce97d8dcca74c2b5d90906c96d3c2c358a735cd\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 52cc61c42b341ad56dc11495e7cb2fe31e506b9e99522efbf44cd7c28468d3833c5e360f3c77b0aa43c0495c4e14665ab0d7cee9294c722f0de47d4401828401\nB = 3bdc9639c0fc2e77ab48d46e0b4ac6529c11c900e8fe4d82d75767c0556feb23d3f42d4924d16876a743feb386b7b84c7fd16a6c252f662faf0024d19972e62f\n\n# b^m = w-1\nResult = PossiblyPrime\nW = cff9897aa7dce0f2afad262b2de57d301305de717f3539c537c4ce062f8cb70df13fbc1eb4a3b9f0958a8810d1ca9042b4f23334b285a15fee3fc66498761d4b\nB = 9ceb43132fddf9ee4104ea1cb3eb2253c1d7f803f05f0305de9e31a17dd75832f47b8bf189a9b7ca0905f2a7470d9c6349080f481ff1708696fa12d972e7d7ba\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 67d1825dad5344170e65247a87aef1634a1b32bdc22f2f04d9d2959767bb5a27610fba55cd607e0f9fdd9fbb0f7f98e40d5e1eb2f52318fb5be4dbfd30d38861\nB = 260fb14724ff80984736859d8755ee98b25bcb56db9fde1db001a1e1273374034c5b75fd60b3710c7a08ce7d390776f010f384d4e32943cf0c477497d53e9e05\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = ad0bc85b58aaa204177aa9431a40929beb1cbea2dd6f66a25cc54600013213b225ba881805661df43f4208965ada7aacc8095d07d3cbef1a7bbfaae8b745f731\nB = 3d9310f20e9c80269fa6830c7e1a6f02fc5c58646001a9ef6b8b3e496602ff22c3dcb2ddb6a221723fc1722ce237fb46f7a7bb2945e415c8839b15a972f076c9\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = b25c917f55f6c7b596921daba919f35039e5d805119c1587e99849dd7104460c86214f162a6f17aea847bc7f3859e59f2991d457059511972ef373d4bc75e309\nB = a1f10b261dee84619b0423201d46af19eef9ec0612cf947c4d5c36c0c4b28207f75967e69452eabad0a5dcd28f27f7a8a7ed9c8b3e5026c6e0ba5634d94c2d44\n\n# b^m = 1\nResult = PossiblyPrime\nW = d3eeb0eff05b6992e9fa61b02755e155f4aae28c6e45ddb874edd86acdd2d83d18a20e0e00d8b8bc94b92d14fc3f41ced6ababe8ac98c7730c075dbe0f699369\nB = 6b7717269c6225203681a1cacec87cacd83003ec6e9e3f04effcc4f86634770c0860e1f2770b8f303719a44949664a1094205a99d95a0856758fed66d690105e\n\n# b^m = 1\nResult = PossiblyPrime\nW = 64561b8d9aa50340c3a01ccb3e6e17f5023513661c012be288f3900a3ca76890e67290b9560fa1d480f9d2aacccca581b5690636665f243fa13aff5d0bff12d3\nB = 1f5ff70d3d60671ebc5fbfca731898a04438053dbc3c841e6335f487e457d92d9efb5d506d5bef6872d58d12b9a41c950bfc38d12ed977c90eacdd6535b811a0\n\n# b^m = 1\nResult = PossiblyPrime\nW = 69c63fbf44df21b0ed0ee929a740c12d1f3f064da0dcd9d509f31fa45fa27d1a759ab5a9f6f1040d7ee90a0b1e68f779273c41ea1c1198fd547ff6bd70c7e787\nB = 5f7996a9bbfd8fd88e472220b70077bfdacdd63d88885134431f024c2acb7126827b174eb093eb5313f07bb5461de9b0feb7d77ca2c39c2a323a150f33ea525f\n\n# End of iteration\nResult = Composite\nW = 28cc3e08c44571c6dcb98a9ab8b4f3e2b16e1f884997d94a3188bcbb7f1b7cdaecdae8329c013ec8f75dc00004da0039943e4262cd080b16a42910102e00dddb\nB = 512061ab1c69931c2fa0bb89d8d09f3c9209230bf927ddd6fb6a72075f967ed3c4dbb5f437bf4d31ca7344782b22011ad56609dc19aed65319bababfc13dd7\n\n# End of iteration\nResult = Composite\nW = 4eeb7b4d371c45fe8586fee3b1efd792176b70f6cc2698dfa1dd028366626febe0199c3c5f77a5c3cad0057a04767383051d41965255d03681b2a37edad34a9b\nB = 4afc2e85f84017b3fd6967a227eb74c8297b40ea02733d9513bff9b3f01081963f25872f4254afc4e9321eea35b2a1e42eadb186fcc84f2f30f4a994350b93b8\n\n# End of iteration\nResult = Composite\nW = 8e35a959555dd2eb66c65cee3c264071d20671f159e1f9896f1d0ceb041905fcf053eacc189de317c3ee6f93901223cbf30d5b7ddbbdab981790e2f6397e6803\nB = 44c0153759309ec4e5b1e59d57c1b126545ef7ea302b6e43561df4d16068b922389d6924f01c945d9080d1f93a0732599bdedae72d6d590839dc0884dd860441\n\n\n# 0x6c1 = 1729 = 7 * 13 * 19 is a Fermat pseudoprime.\n\n# Found non-trivial square root\nResult = Composite\nW = 6c1\nB = b8\n\n# End of iteration\nResult = Composite\nW = 6c1\nB = 111\n\n# End of iteration\nResult = Composite\nW = 6c1\nB = 11d\n\n# Found non-trivial square root\nResult = Composite\nW = 6c1\nB = 19c\n\n# Found non-trivial square root\nResult = Composite\nW = 6c1\nB = 223\n\n# End of iteration\nResult = Composite\nW = 6c1\nB = 3aa\n\n# Found non-trivial square root\nResult = Composite\nW = 6c1\nB = 653\n\n\n# 1729 has a number of false witnesses.\n\n# b^m = 1\nResult = PossiblyPrime\nW = 6c1\nB = 78\n\n# b^m = 1\nResult = PossiblyPrime\nW = 6c1\nB = eb\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 6c1\nB = 178\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 6c1\nB = 178\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 6c1\nB = 1aa\n\n# b^m = 1\nResult = PossiblyPrime\nW = 6c1\nB = 271\n\n# b^m = 1\nResult = PossiblyPrime\nW = 6c1\nB = 2b2\n\n\n# 1 and W-1 are always nonwitnesses.\nResult = PossiblyPrime\nW = 6c1\nB = 1\n\nResult = PossiblyPrime\nW = 6c1\nB = 6c0\n\n\n# https://kconrad.math.uconn.edu/blurbs/ugradnumthy/millerrabin.pdf, examples\n# 3.1 and 3.2 has a complete list of false witnesses for 65 = 0x41 and\n# 85 = 0x55.\n\n# b^m = 1\nResult = PossiblyPrime\nW = 41\nB = 1\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 41\nB = 8\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 41\nB = 12\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 41\nB = 2f\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 41\nB = 39\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 41\nB = 40\n\n# b^m = 1\nResult = PossiblyPrime\nW = 55\nB = 1\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 55\nB = d\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 55\nB = 26\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 55\nB = 2f\n\n# Some b^(m*2^j) = w-1\nResult = PossiblyPrime\nW = 55\nB = 48\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 55\nB = 54\n\n# Other witnesses for 65 and 85 will report composite:\n\n# Found non-trivial square root\nResult = Composite\nW = 41\nB = 2c\n\n# End of iteration\nResult = Composite\nW = 41\nB = 16\n\n# End of iteration\nResult = Composite\nW = 41\nB = 14\n\n# End of iteration\nResult = Composite\nW = 41\nB = 2\n\n# End of iteration\nResult = Composite\nW = 41\nB = 3a\n\n# End of iteration\nResult = Composite\nW = 55\nB = 40\n\n# End of iteration\nResult = Composite\nW = 55\nB = 7\n\n# End of iteration\nResult = Composite\nW = 55\nB = 23\n\n# End of iteration\nResult = Composite\nW = 55\nB = 2e\n\n# End of iteration\nResult = Composite\nW = 55\nB = 2a\n\n# W below is composite, but it is one of the worst case scenarios for\n# Miller-Rabin, from Wycheproof tests. 1/4 of witnesses report the value is\n# prime. Test that we correctly classify false and true witnesses.\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 379c6027f818b5164bc13dff",
     "5e996ec7210976f33570d5c60275918b8988d97a63bb6582af85682c45667a8b94b7acab4d919ede00f5bd2ba7abc8634d66f8875fd930f35ec8013d37b958e65f07de015c0574e64198d73aab5466f3a971b74830b7f1671cb9277fbc95c1ba8c29dc903d8cea1b74c22ab9164f9c438ab9ba7d9919f832e40c3e36faca7343e2314669b0104d9c4f2e1b011cdbd9c686baef0\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 3cc4b644965b2133caffc2bb6258b1ecd5b586b900a09b010382fcef709e4cd37ee3e3182bf8d393c1ab6f9a933d46338b3d960923d8c9607c2b2763d5680230a2bc0c91138e9d0ecb35e7154a06aaa902d34b9b14964b81f4d8232641492d83b22cd805a115e75ddd8e63b864c00e4c90ba36a41e7966e97e063a60a6a6cfd53e1f62a57852c7443e88dcf6245557a4b65494c3e88e466ad75316aaa9727def\n\n# b^m = 1\nResult = PossiblyPrime\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 40c03b6ba22bd62c0379b1c36dfccd34d61e3d15f7af1d5f6a60ab972a9d0e956e2bb9e275294e0f1c879eb7a4555443429c99a8d74f7bd359a1046ac30072c04b0e2cbd005be15ff4ce0c93276de2c513fbc5771b5059904a87f180530f6773498114b5aaf70da01967d8294742e451df6377dd5e64b2a8968f4ba61b51a154317d63958ff3788defbeeebee21af5027c2291e8c5df8c0b66770d91b683cffe\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 3c7c71b84f0c6c3817f57511946315cec7d0120a9c30ceabda801fbaec329a8f10c7b9f0ae90a3dada9885bf73a3cabed86784af9682f3dea50a7817f65cfc9190cf997f12784223c4965ed6e52a1be26d4dde31741cd3d1a2e2f3a74040d0f3868eef849727aa855f66c94791194ad5d360298364e2de9ca9288e6423f644b01d52e1bd66a9f7f00bd7995a9ca2ed16f40e902852c6250a3b52bbbf5bfd33e8\n\n# b^m = w-1\nResult = PossiblyPrime\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 36e6aa9acb399a50f52be0324dcef05f3cff3117f94538f6d0952b7d7be88ba4dc75d843ff7ff775e11f55c86ba6b2a6ddebd8850c33424b4d35c66321af426662e7074f0a2409a9ccf1c66ef7d823efc8240b8f3c7e9e8dd65a64e8a3ca5b26695ef17171ffe136c0593b179414c5b5ad0d66f2a25146c38b2f97e60b0472ed72de34bff1b6ac186f23645a1bbe909cdfc2b2d861eb44931568f1bb117d8a0c\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 278f2215d3ab836043fbfa472216bbdcedb775a6a0ed711754d05aa75089a9e5d8201e113d68656f37381e44483cd365f5d383bdca5ae8d1f2e6575d7873851cfff0e12b1cfe100a04cb300cbd924353fcbd3307d01242cf6a5e86e752c6f4586bcabf48b018bb97e65c3ed409fd6f67f98987517356d88344b3c8945ccd753148a37b648dd2db44d19522a69a9ad8eb23edc55340e85a198abf179ad731db41\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = afa1478bebbfe1157568f4ae53549b4c3a6a8771b816970bfac6ce5c8b962231db7a41da4d5f1d8bf504dcfe440325b54e1888bdae344eb969436a35e5c6ce5300d46313cb2fcb57fc83305f65f53d392de400e9231cbbc2ac8243defcaf7063c632b9601a81d83138274702ff336d727d3e82ccacce069843ac9c1c590c772c8c586b65c7085a1df5a47fc960d4098a22418b41f0062c77b5d55d17149d167\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 10f7030590b629e0313a61bdf46936a1f25db91b2b421f7ebb671f7844c22561b44b2f7699db61e5228ebb5817afad416325f9439eff7a82d8a630c504de12eaa44d97c79ee56e726ae74ee0b472f0d5fa8f20aee426e689cd33dd084f96bf4d928a21e815f7e8aaca4a5752f39c4a76bdfaa8227dc05d0dfa885d8b26d46fbcbf0d2e0d999d2c31ad84c306c9126539dbdf447f8dc707d29c7fa8021a767668\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 97dbb6a55c039ec926aaa5ff15a2917a2b4cafc3ca07c4c6b05f931d86c9bf60ee05cbbace194e5ca97682ec67c36394018d68c3536fbf13b50f8a7e31eaed87307759a0a48c6c58d21bc7c38b878c53db5d7a8e1fdd81abefc50470a3800852e74d76fdd1933e45f39ee97b8efb68837721890d867b32a894dd0ceb4c5844a05d384145865c10973ce748ccdd8fee73f1bf8611ce0535430b6b98fb36cad7a\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 225f58add44ed2b0a64a1d8452866d0f3c0cd45c8375e1bb33c188915c77fa11b81250b920245dda7f6126e5e0c79e6f98f89dc15db86394cf81b44f0d801e613fa4d5c6fef66fa31f26cfe6153f2e8159aad6b0351dcc0e93f9a68f649b2a77cff747b605b542d22419166befebec6cde3201e3c0cacaa2bc9d87073b8d1f1aa2b114d61de45ac8b0ad2141b43434a629ef284cd999fd82b310db7c57cf5c81\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 2780926c9cf7c1eb2aaa935d90b6d4dea44eeefdfcf9ccd4a33feb215e3a1cb2d358136a490fed18403947f3d98807819737c66e12d42c3cc8c0e246b96b3c3b0795ab875fbaf668b81b5b05bf23e258ea00a0a140a790f76e04ab619800b7597f614ffc1a1c94be2f3f1a71d64eb47d98e4653d76eabedacff3a97ecf590e6a1fd55096b7bc9314629f698d0fbe9b01a1f2bc0bf3a2c097f99f1fd222b52ed2\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 129cc5b0d9f8001b3895f1fcb4833779763636aeeeb3f980e63ea506202e6bde868444b6a58ff1dca08625f025a7e95a5eaaf1a8899eee640e3f05fbdb2867e2483bdc27c87b58684416e521c107f3667ed8dd23f0381edab767c5205a4378118bc011947cb6bdfe3fa4af50b8de876b555c9a0b2b0dae01261847f63e1e0cac2d032530bf19d5da60a04dfe22ce6343f60defbb94ccf0bdf010f89a4029720\n\n# b^m = 1\nResult = PossiblyPrime\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d",
     "9a6cdcf912a2dd0a12ba7e87\nB = 4e2a47cf67c3331b1e9976f583f6339cf76a8d48682d01355c25b2aed90c5544e737ecfa849c17d27a64fad7e659ef48df9a3ac0410e5c7ca8d087fc3a3ba23e5a3f000be009fcc8227ead28158c5b5d66f2efb47111638ef61cea4984de42fbd476bc2236ad02154d3ce85805c45e49d16b496e313a4052a37d4b88a3b13e598d2074a3e36a37e90278601f2b2305e034f9bf3aea8e939c3ba274e8ff4d8a14\n\n# b^m = 1\nResult = PossiblyPrime\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 2455c4ab826e2ae72708a8ff51348ce4821cb86fa89e298c751c1754211c63b2e9a712d40f0235f310606fcf296726a86973f19f890d571f5b90f026e8d24d07bc0478a3c1333171587387f1f7fe4a770b593216f2743318aabacb3320c40a4e52b9f409e1176fe8db099e93a7991eb8568168e2e486fa5aa228bb1dce9df3290ef13fd21c331479bb0f8b7a7e7f03c5211ae8cc46fa4d0f46e86b2dadeddd5b\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 9951c2c02dd7deedce29bd0c78dd80066b1d69c0e6fe4a17f7d03c6a640d866d01fc8214bafb6737efd93d80a35b8993f5367ce287459b07954e9771ffbc72ccdd812d26a9bf4be0292a24eb5c3b56f09619b1c1b481f7566f7e50e65f69f5feb591bd107fec72a783429dbde6e2607f3db2c58d4b070a45b4d6b43537e19942ce890b04ae1e91069c04a96ed03ddb2f4fc456f136b98102c70a15700dbd911\n\n# End of iteration\nResult = Composite\nW = 550fda19f97cdfbd13930911ef6e9e1cb2b7b5215a35c215d51ebffeb435642174cbe998f4451bde2d4bd2ce92ab5b9493b657f1d77d9ad4d348550247b903906109c608ecba7f88c239c76f0afc231e7f1ac1cee87b4c34448a16f7979ff4c18e65e05d5a86909615fe56587576962a2cb3ba467d9806445a0f039907601af77ba7d07578eff612364fbcac11d35e243734aa6d9a6cdcf912a2dd0a12ba7e87\nB = 4cb8217d229d5f95f6d94807a99363823655d6bba6bdafa4f0dbfe7a5c538aa79c918710aad4f55caaee5ab405ebdcef29dfb76cae99fca8d5a955b6315f71a3cb2d69a217ff45aed66ba87cdc5c0de5d512c6dd12e641e9fe6a2557dd2f03bf3a18650ff139efa179f0fbe69cbb4b54e50d13177bfe7bb90de36b548d5ccfef74b05d3c08a7e2a3bb4dc8d7eb338a7a1b068c433ea204d171eda5e7c6b6722c\n",
 };
+static const size_t kLen38 = 41961;
+
+static const char *kData38[] = {
+    "# This file has been modified to remove the 65536-byte long inputs.\r\n\r\n#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = TDES KeySize = 3 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:47 2011\r\n\r\n\r\nCount = 0\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 3bb96170d5df4cce\r\nKey2 = 25d5daa22a982f08\r\nKey3 = 52f4a110dcdc9e45\r\nMsg = 00\r\nMac = 96\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 1\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 9413d38685688f58\r\nKey2 = dc38b6b3cef125f1\r\nKey3 = 5b61f4f7a1c46ed6\r\nMsg = 00\r\nMac = fc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 2\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 101a2f13fbb69473\r\nKey2 = 76fb98f24073f4d5\r\nKey3 = 2ca2706d76d00b67\r\nMsg = 00\r\nMac = 53\r\nResult = P\r\n\r\nCount = 3\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 2f8a238552c1e367\r\nKey2 = f8131f1c26ab3289\r\nKey3 = 83d5b6ba253bea31\r\nMsg = 00\r\nMac = 95\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 4\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = c1bafb5dc7100758\r\nKey2 = e9ef047a58b5ba89\r\nKey3 = 76cb4fb55ebcc1c7\r\nMsg = 00\r\nMac = f4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 5\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = c82c29f1cb5851b6\r\nKey2 = 8b5b45dcbf0d8079\r\nKey3 = e6407057ae34ec0b\r\nMsg = 00\r\nMac = 03\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 6\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 6b455116f4f883d5\r\nKey2 = a81a206d25152aab\r\nKey3 = 86dc07b607202abc\r\nMsg = 00\r\nMac = 75\r\nResult = P\r\n\r\nCount = 7\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = c873d5bc4598d0b0\r\nKey2 = 1c1523cb4f794c8a\r\nKey3 = cedf6797d523dcab\r\nMsg = 00\r\nMac = 2e\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 8\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 45ce943bd31fe9b5\r\nKey2 = 677cc47c13c24923\r\nKey3 = 6b2086f14934838a\r\nMsg = 00\r\nMac = 01\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 9\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 804f9ef7baf7dfc7\r\nKey2 = 9bb6494cb60b8c07\r\nKey3 = 2080fe52e0d3943d\r\nMsg = 00\r\nMac = c3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 10\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 73c10b833e1043ab\r\nKey2 = 16dcd343645d5207\r\nKey3 = 6426f7f88c3473c8\r\nMsg = 00\r\nMac = 8b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 11\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 310d54d96bc73452\r\nKey2 = bae34f158ceafb04\r\nKey3 = 4651c1b53de3da26\r\nMsg = 00\r\nMac = ce\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 12\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 0e3d49d0e692f20e\r\nKey2 = a9cd384a3b688c0e\r\nKey3 = 584ae5f794f8fe7f\r\nMsg = 00\r\nMac = 4b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 13\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = b0fda857ea402f0b\r\nKey2 = d567e9f48568f1e0\r\nKey3 = 0ec2ad452a547a91\r\nMsg = 00\r\nMac = 04\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 14\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 1ac1543b1591f270\r\nKey2 = dcda0e9870b9d949\r\nKey3 = 68ea9b1c4380ae9e\r\nMsg = 00\r\nMac = 43\r\nResult = P\r\n\r\nCount = 15\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = d0b008aea4454551\r\nKey2 = 9234a7731ab610b5\r\nKey3 = 2fb97a8ffbaedae6\r\nMsg = 00\r\nMac = 4c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 16\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 04793b0b0e976d0b\r\nKey2 = bf493e58fb73681f\r\nKey3 = 1f54a262d649b985\r\nMsg = 00\r\nMac = 77\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 17\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = 043b759b578ae570\r\nKey2 = 5e522f19cb9de092\r\nKey3 = 2af2e90eb6dcc1fd\r\nMsg = 00\r\nMac = 77\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 18\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = e58520088910513d\r\nKey2 = 7c10196e1a310dd5\r\nKey3 = 5b043b2a1ab97f85\r\nMsg = 00\r\nMac = 1c\r\nResult = P\r\n\r\nCount = 19\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 1\r\nKey1 = f27fd0f189452c15\r\nKey2 = 04681651014916ab\r\nKey3 = 204046aeeffecd15\r\nMsg = 00\r\nMac = 0b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 20\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 860864a710ab0475\r\nKey2 = b9205751bfd91f7f\r\nKey3 = 3bf72abf13d97640\r\nMsg = 00\r\nMac = e890abe6ea126215\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 21\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = a7a1d57aabf1137c\r\nKey2 = fd0df2e35b8cdf2a\r\nKey3 = b386755bc2ab3d9d\r\nMsg = 00\r\nMac = f475587c2101eff2\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 22\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = c2c28a4c7698804c\r\nKey2 = ab25b53783dc0419\r\nKey3 = ab16341f4cead054\r\nMsg = 00\r\nMac = d335575aa3a4d8af\r\nResult = P\r\n\r\nCount = 23\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 7594a7aed3e986ba\r\nKey2 = 52a280e662d9e9da\r\nKey3 = 7649d3ad6838f2c2\r\nMsg = 00\r\nMac = 0e109f43557f250f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 24\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 0798d9ef158cd698\r\nKey2 = fff4ade09b169762\r\nKey3 = 5b6e6849ec2c238a\r\nMsg = 00\r\nMac = 05af623529b168a9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 25\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 254991cb4af76dc8\r\nKey2 = 2cf2e915918a025b\r\nKey3 = 2c61bfaee69b2676\r\nMsg = 00\r\nMac = 725ab7a770762894\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 26\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 9f68cbbf3bb5b3da\r\nKey2 = 31adb5a46e2cc8e3\r\nKey3 = f86ed9eaabb625da\r\nMsg = 00\r\nMac = 0422d94f874dda7e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 27\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 1fd51f70a77ac8e9\r\nKey2 = 5dd9986e974c08ec\r\nKey3 = fd61ce34a75279f7\r\nMsg = 00\r\nMac = a163a5d269b3cc3e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 28\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 078c57d6df9ba1d5\r\nKey2 = 08d94ac1b3d3c183\r\nKey3 = e90bf4fe7973c2c7\r\nMsg = 00\r\nMac = 9af3f01e20dc7c1e\r\nResult = P\r\n\r\nCount = 29\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 08df322f040e7c01\r\nKey2 = e92343e69d83eac7\r\nKey3 = fe94c1ec0da22c1a\r\nMsg = 00\r\nMac = 3d88c20a4f828c5b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 30\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = b2ecf41c8692c2b0\r\nKey2 = 8ff18c1f1f296454\r\nKey3 = 383dcbc4a28c7629\r\nMsg = 00\r\nMac = 17241dc726fa4c56\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 31\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 07d99d58f2ec1fd5\r\nKey2 = ea46c73bf4b60ed0\r\nKey3 = f20ec149c831aecb\r\nMsg = 00\r\nMac = f6a8a0b536fd97d3\r\nResult = P\r\n\r\nCount = 32\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 3dfdc19426fbd56d\r\nKey2 = b03b7985b32af857\r\nKey3 = a807c7b3621ffdda\r\nMsg = 00\r\nMac = 3ef9b263ae1df460\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 33\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = fbc79bab46b97923\r\nKey2 = ece6da4c40f1e6e9\r\nKey3 = eaa76770ef517a40\r\nMsg = 00\r\nMac = b2da3efa7fc64abe\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 34\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 5ba4a1d5a80db5ef\r\nKey2 = 7ce6aeb9261cb00b\r\nKey3 = 8a5df23ea445e0c8\r\nMsg = 00\r\nMac = 51b2e75334d90889\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 35\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = e9c494e001027c86\r\nKey2 = c4649e58ea251904\r\nKey3 = 8025343dec34409e\r\nMsg = 00\r\nMac = 166123f1c59132a3\r\nResult = P\r\n\r\nCount = 36\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 6bce61e646452a46\r\nKey2 = 54ba8a020d0876fb\r\nKey3 = 34ea2f6149bad664\r\nMsg = 00\r\nMac = b0d0f625f06f2a3a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 37\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 2f38f79bc8e0ea4a\r\nKey2 = d09876f22ca43e10\r\nKey3 = 3b8fab02299d328c\r\nMsg = 00\r\nMac = b26d377a504b8985\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 38\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 51febf790815f1d0\r\nKey2 = 9152d5e32f6713fb\r\nKey3 = 4a40c2c8fdb9f2b5\r\nMsg = 00\r\nMac = a27978e62026743b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 39\r\nKlen = 3 \r\nMlen = 0\r\nTlen = 8\r\nKey1 = 10ba8fd6256ee9a4\r\nKey2 = fa8332a46ead52ab\r\nKey3 = b0e06e1fef04abb5\r\nMsg = 00\r\nMac = e1b0a228c142555c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 40\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = f2fbab6734769e9b\r\nKey2 = ab45910e5775ab0d\r\nKey3 = 5bd5ea0db015a89e\r\nMsg = 7efeb7d4d14b3f2b3df4b8a276b18b49\r\nMac = 5c\r\nResult = P\r\n\r\nCount = 41\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 5bc776ba64adf4ea\r\nKey2 = 195e04987c62a4f2\r\nKey3 = c1642fdc1a31705d\r\nMsg = d1fb4f35914404af9df3bf5c368c0e69\r\nMac = 4d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 42\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = b67c57f770202c6e\r\nKey2 = e91f4fb361bcae37\r\nKey3 = ada8d3df4fbcf4b9\r\nMsg = 9800db878187c87ea05bf92054b0e3e3\r\nMac = 8b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 43\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = ce0bc48002fe7602\r\nKey2 = e702abe31c7a2313\r\nKey3 = d61964867f2579da\r\nMsg = 704e4e75be1623b21332c14555bf5edc\r\nMac = b0\r\nResult = F (2 - Key or Key2 changed",
+    ")\r\n\r\nCount = 44\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = ad75e32cc11980f2\r\nKey2 = d0570429680e9486\r\nKey3 = c2379207f862dcfd\r\nMsg = 197de855b3962b1fdad687f9c4f1efd6\r\nMac = 44\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 45\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 9db504803d29f126\r\nKey2 = 07fe58b3da765bad\r\nKey3 = 6dc489516e9bb5f8\r\nMsg = 8f296b265fa575d146799f9e39d52965\r\nMac = 14\r\nResult = P\r\n\r\nCount = 46\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 991f0ed04079293d\r\nKey2 = 57077ff1baecd907\r\nKey3 = dcc7a719c4372967\r\nMsg = d9cfcc67520c5b2ceeb622c694a8e3fe\r\nMac = a3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 47\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = eca815d6b0371cf1\r\nKey2 = 597980cdb6c892df\r\nKey3 = 3dba0ed3ba16ae1c\r\nMsg = a03636db2fdc84722aeb9d98a6ed70d0\r\nMac = 78\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 48\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = ea80a43d5886dfef\r\nKey2 = 08bf4f76a8893732\r\nKey3 = 4557a13752d6730d\r\nMsg = 0371a63ad722523ef297d8399b124593\r\nMac = be\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 49\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = e9fe73e640808c02\r\nKey2 = 9be6986446012091\r\nKey3 = 707023615462a40e\r\nMsg = 83bcb484dca73d49ac234ece3a5d2ad3\r\nMac = d6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 50\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 1fe9800ecb0dd9f1\r\nKey2 = dbbc6bc72c794c23\r\nKey3 = 899b08469b6bc8b5\r\nMsg = 95f4a41c4c64cd7310fba748aa267a14\r\nMac = 59\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 51\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 34546261a21c1c43\r\nKey2 = 0449eaeca4f29725\r\nKey3 = 4cc4e6525186802f\r\nMsg = d204de1e671d3e43670dd67fee114402\r\nMac = 6e\r\nResult = F (1 - Message changed)\r\n\r\nCount = 52\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 048aa8701fb5fe26\r\nKey2 = d56bd53d83e60bd9\r\nKey3 = 6707d6523ebc32f4\r\nMsg = f4e9f92fd2c9313fb61a889eaa4ff283\r\nMac = d5\r\nResult = P\r\n\r\nCount = 53\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 6ec19b02976e5ba2\r\nKey2 = 13540732d997c2b6\r\nKey3 = 7f4068926183251c\r\nMsg = 963363ab7c82b634974954bd0fe2c307\r\nMac = d7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 54\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = f4ecea5d32e32c6e\r\nKey2 = 385710cd3eb0fe51\r\nKey3 = 5d4c8f7ccdf10154\r\nMsg = a298857dc60ad2f0a8fa878607b50c18\r\nMac = 4c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 55\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = b31ff49dd970f8e9\r\nKey2 = 164aefb00efb5461\r\nKey3 = 981629757f4532dc\r\nMsg = fc3957b2ed0558bce61d478be615b774\r\nMac = 90\r\nResult = P\r\n\r\nCount = 56\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 85384543d3aef157\r\nKey2 = 57ea916d9b2fd0c8\r\nKey3 = 1a85830473fbe6c4\r\nMsg = 87db0d9d69bc0cf69cabeb92570e482b\r\nMac = 53\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 57\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 9bf8fb0b464070f8\r\nKey2 = 10ea23c7e5a19bcb\r\nKey3 = 408c236e10863e2a\r\nMsg = f9c98cd8a7d27553da946427b8276349\r\nMac = 53\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 58\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = 91b083e9c8e9803b\r\nKey2 = 76d0341cd54c38e5\r\nKey3 = 07bca7f44a3e76bc\r\nMsg = 7e5b64dc6bcbae6bb4496fc033947343\r\nMac = de\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 59\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 1\r\nKey1 = e6795b1ffe8f3e38\r\nKey2 = 4fdcea8c73c76e75\r\nKey3 = df0726ae4c079461\r\nMsg = 5265fb6a796d99a6beec6f71ba267b5d\r\nMac = e0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 60\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 375710c76202bff1\r\nKey2 = 3bb96170d5df4cce\r\nKey3 = 23d5daa22a982f08\r\nMsg = 52f5a110dddc9f44f8a534eef9df0b22\r\nMac = b1b9e11939228900\r\nResult = P\r\n\r\nCount = 61\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = b59b855dce76adf4\r\nKey2 = be9bae10fe34fb1c\r\nKey3 = 0d49159bf804a4ea\r\nMsg = 869f3b62ee78bfeb5287168eacf69ccb\r\nMac = 169a389352793c8b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 62\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 615d792a7038fd89\r\nKey2 = 98ce972f016e75a8\r\nKey3 = c470255783b32f01\r\nMsg = e5aed6715aa4291f9c32baf6b8449b53\r\nMac = 73ac2da999bfdf5d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 63\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 1fb09443a1074564\r\nKey2 = 3d1aa82c086eba13\r\nKey3 = c137d0f4ea54d604\r\nMsg = 16f02efd285381d7657ca5cd99d9e25b\r\nMac = 38126d16957893ce\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 64\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 2e5d163461fea761\r\nKey2 = 9173bf75372fb640\r\nKey3 = 9e3d1c3dcdbfbc31\r\nMsg = b10fcb03443302ae929ff95a17b025fa\r\nMac = b70f2d761ca643c9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = b9e5861c1c4013d3\r\nKey2 = d554806efd3801a1\r\nKey3 = 64d9bc3d646e76dc\r\nMsg = 0e6c9fced82669cffe7b5a6f09dceec8\r\nMac = 78ce4635e486635a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 66\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = ad2376516b974c70\r\nKey2 = cd3b5870c2312929\r\nKey3 = 1a731a7feacbf783\r\nMsg = 88eb7a0379da9d113343dc1fe0f3e6f7\r\nMac = 0c949483e7fa7d0c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 67\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 9ada194c100eeacb\r\nKey2 = da23ad9825c194d0\r\nKey3 = 3ef1f4c438dce031\r\nMsg = 0f9703a3454c25c0b1053de62b0ffc5b\r\nMac = c78a4ca3662527e5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 68\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = e375f870f4d55b02\r\nKey2 = 1b015791e3e337b3\r\nKey3 = 370dc45b15671c5b\r\nMsg = 5ad9dd3b112ea4cee1654d2dfabab01e\r\nMac = 22becbbe7bfcade5\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 69\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = d61f4aeff4b5f2f8\r\nKey2 = 0486b53de3ecc297\r\nKey3 = 807fe92fc2fed376\r\nMsg = d094cf77a709c0fa5d6b4b7e9e86a2c2\r\nMac = 947d024d9d5359a8\r\nResult = P\r\n\r\nCount = 70\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = c2c28a4c7698804c\r\nKey2 = ab25b53783dc0419\r\nKey3 = ab16341f4cead054\r\nMsg = 7295a7aed3e987baef19ad68c33ba5a5\r\nMac = 58de82acc10d556f\r\nResult = P\r\n\r\nCount = 71\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = f1ce4992c851e3a8\r\nKey2 = 835ec1abef97f2c8\r\nKey3 = 5b92384f20dcc2ad\r\nMsg = 9094935fcd7c389dd17b5b121cddadf9\r\nMac = 319c70370c172de3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 72\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = c16ebcc1165d6892\r\nKey2 = 75268c4602f8c8bf\r\nKey3 = dab97f79544cf1cd\r\nMsg = b7ba1c66282cb6092ba601407ff9578a\r\nMac = d73c26311bd44a32\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 73\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = fe4a796720a46dbc\r\nKey2 = 98f45289e9f8b080\r\nKey3 = e05def5b25520d43\r\nMsg = 31c9eed491bb0cda9b8c0eb5afa31019\r\nMac = 8c2ce22633c62751\r\nResult = F (1 - Message changed)\r\n\r\nCount = 74\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = eefb40c715c4546d\r\nKey2 = 5b2325c8d9daa48a\r\nKey3 = d5ec4a6bc82a7a62\r\nMsg = 5a97259dfa081f040d3893da2f231ca3\r\nMac = a64113544f509be8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 75\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 0d0851311ca45db0\r\nKey2 = 3d7c458957c8c408\r\nKey3 = 98d37c9d51ab2f25\r\nMsg = 8be16380af3e2dbc6cf678c2e3331335\r\nMac = 8817baeaa909e33a\r\nResult = P\r\n\r\nCount = 76\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = b7239438d61cd626\r\nKey2 = 082c6404cb3897b5\r\nKey3 = c4c732cdd5e043c2\r\nMsg = 7120f19169e7cbb913c7d1f0ceb006c0\r\nMac = 32841ad7621cc0fc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 77\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 73f449ef83df75e9\r\nKey2 = 5f3d2016bfd0703b\r\nKey3 = 31abc16b58b64af4\r\nMsg = 83ecbfcff3bc37f1305d83bc0290350c\r\nMac = 8f8ba8bfc74203fa\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 78\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = 9b6ea461c7b9abe6\r\nKey2 = 4a08dcdc5b9e01fe\r\nKey3 = 6b850e9b6ebae9d6\r\nMsg = c538416fba487fac5c94449d0757f3e9\r\nMac = c13f372e9a061db8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 79\r\nKlen = 3 \r\nMlen = 16\r\nTlen = 8\r\nKey1 = c7aeeacb156dfbfb\r\nKey2 = ba43ef516232a7d3\r\nKey3 = 2c572aea62808c68\r\nMsg = a1bc9950759d0df4cffaf29345dfb340\r\nMac = d7dad4519b56a1eb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 80\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = cda4d34370234946\r\nKey2 = c408ea6bec07c78c\r\nKey3 = 19eff7f798fd6808\r\nMsg = d1fb0b68176269cf9fda18bf13efc054f0c24fd042b9e2ecaf75e86cb60484f6\r\nMac = d8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 81\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 02100be5627686a8\r\nKey2 = 7f0b38ec073e75ef\r\nKey3 = 373b1a64ba5416d9\r\nMsg = c60be37fb0bda4f46894690b3344643c772fbd2237db348adaa407ca2eae1654\r\nMac = fb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 82\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 7597571a6e7c6bc8\r\nKey2 = c143a2a461626b1a\r\nKey3 = 6b1307d910434cc7\r\nMsg = 49cb128641f7952dfdf34f338da268b2ef1482557b593e",
+    "c57f930164264ff83e\r\nMac = 90\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 83\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = ae89ad615201546b\r\nKey2 = ae20765745458fce\r\nKey3 = efd0867fba43dcb0\r\nMsg = e47d8659c9ad94971adedd6bce744206e1cfb65d042b942d93c4363cc73ec3e3\r\nMac = 95\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 84\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = b65886f13d6e8c4a\r\nKey2 = 0708e0b0730473a8\r\nKey3 = d04f2a86dc0b9e7a\r\nMsg = b97c12251d91512fe7b3a349a982409c7412f39494d970e77acbe9d3fac3dca7\r\nMac = 05\r\nResult = P\r\n\r\nCount = 85\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 3197a4a26261588a\r\nKey2 = 0dc4a75ec8b99b58\r\nKey3 = efb93e7620205289\r\nMsg = 65f4b3a00c1c1ef39445a69b2150b034705410140ff9dad0ce21740271cef04a\r\nMac = 57\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 86\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 62c4a16e946b4313\r\nKey2 = d09ea80e7fb33449\r\nKey3 = 164fdc04c2d5f116\r\nMsg = 898e824fdc89f21779156a9e58564c4b99004b95226c2ebb8aebd0b5365a6c6a\r\nMac = 93\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 87\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 6eeff20d3d5d5223\r\nKey2 = 258076b313611c1c\r\nKey3 = b013b957f70d9e62\r\nMsg = 2d7fec1a1e9ee85cf960e5dc4e239619ed85f4b14d32cbd42dfa79f77a27f2cd\r\nMac = 0a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 88\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 193e23e6fd8aa185\r\nKey2 = 1910cbdc549da804\r\nKey3 = 6b769b4923523425\r\nMsg = bd65798a1d02ab164e2d31b1387e505874779539046820bd429043c617854c36\r\nMac = d3\r\nResult = P\r\n\r\nCount = 89\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 150789ab37ef2ce9\r\nKey2 = 10cdf45dad9ed9e5\r\nKey3 = f475fd3e153898fe\r\nMsg = 044dd73a7d1ef37a437c09e9268708c82ebad189dc1e989ab3bd8d7ff75abc23\r\nMac = e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 90\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 48d9d08a6bdcc4f8\r\nKey2 = 1383641c08735d0e\r\nKey3 = 374a89c8cb73a7f4\r\nMsg = d62fb84f2a2442b52acf817d7f067edca031970bea092c35f29f9a931aa06dd6\r\nMac = 26\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 91\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 68f4620da8b00201\r\nKey2 = df1c8362345180d3\r\nKey3 = 26abda897f89d90d\r\nMsg = 0ac3f7f22d24b64aa584845d3a990bb69e5d2d4650640056c16c17c0b636045f\r\nMac = f9\r\nResult = P\r\n\r\nCount = 92\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 1c259df7492361b6\r\nKey2 = cd4acdb65b3e5b1c\r\nKey3 = 3b01addc2579ef64\r\nMsg = 607f4730a5ea9dabfbcd8586f680c3021c7ebc858e73354beb975d58713b0eb1\r\nMac = fa\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 93\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = f18a9dba9db5dff1\r\nKey2 = d5987013a4b69e38\r\nKey3 = dc16e0ce1351e3f4\r\nMsg = bfe99e184a7d7bf0b4ade8f402f2c49aa4948e74b2d5c905756ba5d32934dbbd\r\nMac = e4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 94\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 8361bac48afb1091\r\nKey2 = da85400d107fbf8f\r\nKey3 = 31ec732cc29d7045\r\nMsg = 3a1ee70d4607325c13bff68e402e0a72742f6a63ae972c6dda74b6b2a3922f0c\r\nMac = 0e\r\nResult = F (1 - Message changed)\r\n\r\nCount = 95\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = d0df1adf1cf72032\r\nKey2 = 1504d564ec1aea61\r\nKey3 = c42fada45d80a43e\r\nMsg = 3a53d9c7ae59e7811699fb0973e43256ed92162267c7ca4b57f5887ad5a24e02\r\nMac = 8a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 96\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 973bfe5b3be573da\r\nKey2 = 94b3ec7f343e46ab\r\nKey3 = dcaeabc8df405db6\r\nMsg = c8437dba76591a9031b3aa3b59fec0562d4eac439ca8efca57c3f2022b0ff775\r\nMac = 53\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 97\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = bc89867c43a74640\r\nKey2 = df347fb319464c80\r\nKey3 = fd92108a266bcdcd\r\nMsg = 1c9898ede16139560519e808ee9ddaf710a5bab30f54ed98230d1a44c189ea4f\r\nMac = f6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 98\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = fde925e301897f67\r\nKey2 = 54b3ab80f815df15\r\nKey3 = dc58928aa286c8e5\r\nMsg = b34f898d98a3aa0fa022b1b1d76953a5b3ecc88d60f2c79b59e1b1f636bc0d60\r\nMac = 0f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 99\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 1\r\nKey1 = 8a704ffe43e951f8\r\nKey2 = 2346dc8501202a40\r\nKey3 = d67afed616230113\r\nMsg = b2b4cb5e90ebf4bd265093b7f5efd4d62dc60e29737aa496e14929724e40c74f\r\nMac = df\r\nResult = P\r\n\r\nCount = 100\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 8c1f29f440f7f8b5\r\nKey2 = 5b45fe8f1f688661\r\nKey3 = ba40f43d9e7cc86b\r\nMsg = 220817144a15a0a654fc1beaabce60270aa72df83591754ee7a5fbb40b7420d7\r\nMac = 80ac51c2ef7bd5d7\r\nResult = P\r\n\r\nCount = 101\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d66e76d97f94ea16\r\nKey2 = f15e3ed06dd94598\r\nKey3 = ae073d1a6e5bc819\r\nMsg = 233d547ab33790859ab0dbc7a93f3bbebb610bed9acbfbce1fff580e9a1e8ef9\r\nMac = 4cb8ce681e4bc7c8\r\nResult = F (1 - Message changed)\r\n\r\nCount = 102\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 0437836df770e943\r\nKey2 = c96e2c43bffd5298\r\nKey3 = 8552fbc16215e0c4\r\nMsg = 4f87d730bdfc7a7c72525c6b26ee9cae9a219b30d9575fedbd913a07b615a616\r\nMac = ea79cbc28f4264db\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 103\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d849ba8570b6ef9d\r\nKey2 = f1405732aeb61f92\r\nKey3 = 73c8e51ff167f857\r\nMsg = fd03202d0bd109b6e4299c7390c1407cd21ffb110013e6381185dea8f8707de6\r\nMac = 71070b17d05dabef\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 104\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 914cef7ab6d998dc\r\nKey2 = a767abc18cf485e9\r\nKey3 = a2624ff20b2a408a\r\nMsg = bc5ce4c0bf3ad1a93e5306c9d7dbb620dde8708efe84e78c2200f41a958cdef8\r\nMac = 3cf4aaf3d337c9c8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 105\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 757f52e626eabce0\r\nKey2 = 700d91f14554bcb0\r\nKey3 = 548640d0dfaec2ab\r\nMsg = 22a4cf581584346095783be0982744c6201ff040760f868ab63895058d1edb88\r\nMac = b008b1150535ef11\r\nResult = F (1 - Message changed)\r\n\r\nCount = 106\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d65d0e58d3133b34\r\nKey2 = 289e58704994a249\r\nKey3 = e3df20ae3d585e2f\r\nMsg = 94c8414cbbec52e2d73bb8f02ef687c91432495c0c744666317d02e6d46706d2\r\nMac = b1292e1c7074dcfc\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 107\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d77a4989f4a17f2a\r\nKey2 = 409d91d51fa4d045\r\nKey3 = 6bb652ea1526fd4f\r\nMsg = 7a08ce579ae7af8004421cff72715e0b137da81f47d8f84da34c3ed53c32c0f6\r\nMac = 8b3cb70477ca7ca8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 108\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = e670c17519d9c2f2\r\nKey2 = dcc8a132629b462f\r\nKey3 = 58c1d52543ad570d\r\nMsg = a6dbad96ad23ff61479df39b99f0673a09f2a7eaebbd34b95d05c4146fa989f2\r\nMac = c470ec40599a0a11\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 109\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 290d292a15b6268a\r\nKey2 = 2638d9ad83ad1f34\r\nKey3 = a7d9ba62735dc2d3\r\nMsg = ef995cbfc49b0ebccdbd37d9f40a431c385d33d4b8234d7f0d6211eaddfb709a\r\nMac = 67ae62fb8142bd8b\r\nResult = P\r\n\r\nCount = 110\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 4faba73bcd5b5dfe\r\nKey2 = 1c97ea85207a97a7\r\nKey3 = 19eff116100dc82f\r\nMsg = c48e53c6956432460584c7ee1577c1c38b7fae2ff288199be25bf64081154139\r\nMac = d68a4558e95a67e4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 111\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = d37c3dbc2f68baba\r\nKey2 = 918cb5e39237e016\r\nKey3 = f286b0739d38c4fb\r\nMsg = 2533361761ac80578fa262a50462045e3ec6e4d5d25c6e99a5c4ccf75f5affc0\r\nMac = c20f36e67732f864\r\nResult = P\r\n\r\nCount = 112\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = a0baa71c38d6d064\r\nKey2 = 8f58ba45cb494ab9\r\nKey3 = 853decc431f7b3cd\r\nMsg = 20e394c7cc90bdfa6186fc1ba6fff158dfc690e24ba4c9fbf11b68519d573a8a\r\nMac = 4ba956b98a99d7bf\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 113\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = b69752407c68b6bf\r\nKey2 = 8fceb05201ec4320\r\nKey3 = 2a755e372373ef26\r\nMsg = e884d65c87411584a56956d5b27ca9725b473c205b64cff09400671f5ee0473a\r\nMac = 9f3de5e8cddc374d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 114\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 8c04e0f27f83b0ec\r\nKey2 = 042cfb6883348fe6\r\nKey3 = 404f5dfe587ab591\r\nMsg = 8a34cd562b111fe04fa0bf5e004faedaef99d0bab9344d966c8b3847486e6f40\r\nMac = 6c530215fb25015b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 115\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 429401ea49cd97b0\r\nKey2 = a8f1b6b63101cee0\r\nKey3 = 20bcd08c5d16e049\r\nMsg = 591d88123fc9a786b247e8d5ce155f136d6fe4084117c41f2056b67f9e3e1077\r\nMac = 6c414640b424cf56\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 116\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = c470255783b32f01\r\nKey2 = e3aed6705ba4291f\r\nKey3 = 7319100e54f432d3\r\nMsg = 01acc3282fe41b62f95f5dbfb7e7bfef694c5fe34ca87d31abe7e7bbf887b48c\r",
+    "\nMac = cd99df4814667454\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 117\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 73c10b833e1043ab\r\nKey2 = 18dcd343645d5207\r\nKey3 = 6426f7f88c3473c8\r\nMsg = 068e4a0b1a62dd64198f1b9ece814c2feeeee50ba814b70d7d42659952991b80\r\nMac = 1fc90834b7dd090b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 118\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 37eae98ff42afb25\r\nKey2 = f2231c028c29da9d\r\nKey3 = ef3da8d0c77fbf45\r\nMsg = f266cec01c5fc08c0bdabc9537bd1aa2df9f2b8ffbe5cc94722a3bca8de529ea\r\nMac = b3809c8b0eb9dd8d\r\nResult = P\r\n\r\nCount = 119\r\nKlen = 3 \r\nMlen = 32\r\nTlen = 8\r\nKey1 = 1358fb67155e0145\r\nKey2 = d02c54a1206b5d7f\r\nKey3 = 1c04ba46c74a5d49\r\nMsg = e38b4c3e7a82643beb3192426555ad9c9b2620d677373fc40c9ddbc4cd531347\r\nMac = b000e2ea1ef48a8f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 120\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f6b9a81067255b58\r\nKey2 = 927cfbc4cdec9285\r\nKey3 = dcd62345bfe03b92\r\nMsg = 246b66b10696adc45840\r\nMac = b4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 121\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = fea186dc73d3807f\r\nKey2 = b8fec7387a197962\r\nKey3 = 4c91abe60db64ff1\r\nMsg = 8ba298364af144a8d5f3\r\nMac = a6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 122\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f264da8607ea439e\r\nKey2 = fdb9daa41fd34958\r\nKey3 = f85d6b859b9892bf\r\nMsg = 402006f6b18dbd11dcd1\r\nMac = 28\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 191c461adc4f7f4f\r\nKey2 = 75b932e68cb98cfd\r\nKey3 = cb2943857a1c9438\r\nMsg = 391deef3a9a41394d14a\r\nMac = 3c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 124\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = a2c2f713430ece92\r\nKey2 = df081ae9627a1351\r\nKey3 = c1ec469ba8c73b67\r\nMsg = 37a49535684637f67573\r\nMac = 40\r\nResult = F (1 - Message changed)\r\n\r\nCount = 125\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 7b61dac238ba3e83\r\nKey2 = d05e9ed34fc410ce\r\nKey3 = 98da194c100eeacb\r\nMsg = da22ad9825c195d1e297\r\nMac = 43\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 126\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 13aec10d13fd37c7\r\nKey2 = 89198c3bcd38b951\r\nKey3 = ecf843cdef7397cb\r\nMsg = b7625aa78d2961c0fee6\r\nMac = f1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 127\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = d94a68ec329d914a\r\nKey2 = 394a8acea420e952\r\nKey3 = ec04c8cb8602aec8\r\nMsg = e043f30a405c41938914\r\nMac = 6f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 128\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = d5cb7579582fb6a8\r\nKey2 = e67f3ba11383d61f\r\nKey3 = da370852e9b9c2a1\r\nMsg = 7d32f440151a7069fd73\r\nMac = b7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 129\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 92402f6eb54526b3\r\nKey2 = 924515d92ad5a1d0\r\nKey3 = 9ead2adfb025f81a\r\nMsg = fd44d8d0fea5cfdf3321\r\nMac = 2f\r\nResult = P\r\n\r\nCount = 130\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = a9daad97ad23fe61\r\nKey2 = 32e5988a37987a38\r\nKey3 = 31626d16a780c825\r\nMsg = d6cf17192f8ad745ab5b\r\nMac = 8f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 131\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 52c457d9d5d5ab94\r\nKey2 = 9d3875ba6d75fdba\r\nKey3 = 4fb91a863d15ce52\r\nMsg = 4effbf732e67af7203b3\r\nMac = 04\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 132\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 7304b65492fd0402\r\nKey2 = 62a4cb7c23708057\r\nKey3 = f2f7bf13839e01e5\r\nMsg = a630c0f362eef35b6a58\r\nMac = aa\r\nResult = P\r\n\r\nCount = 133\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 51b33425a1349792\r\nKey2 = dc5b8ca440eae6ad\r\nKey3 = 70adf49dd0a8f119\r\nMsg = af246a8a810cca5e657b\r\nMac = 0b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 134\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f22029ce51619e0d\r\nKey2 = 9d51bcc2089785e0\r\nKey3 = 689d62621abab3b0\r\nMsg = a9c9fb632423d367b3eb\r\nMac = 0c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 135\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 1ca226d0dc8c328a\r\nKey2 = f18a9dc176621f51\r\nKey3 = 3d765d20e03b4cea\r\nMsg = f9d9fb44919e47cdeaf8\r\nMac = b0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 136\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = f3ce4992c851e3a8\r\nKey2 = 835ec1abef97f2c8\r\nKey3 = 5b92384f20dcc2ad\r\nMsg = 9094935fcd7c389dd17b\r\nMac = 3c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 137\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = bfd929cdd9c2089d\r\nKey2 = 8e49988abcfbf458\r\nKey3 = da73d986894fce4c\r\nMsg = 88018424fdb76c908bd6\r\nMac = 94\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 138\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = 57bf2ca4e3629797\r\nKey2 = ef7f675443402546\r\nKey3 = 6e4f924038f8bc92\r\nMsg = dd4f0a872f4b7089d697\r\nMac = 5b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 139\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 1\r\nKey1 = ba86924908df08b3\r\nKey2 = 26b954ba52df2c98\r\nKey3 = bf38cb0e89b9f4cd\r\nMsg = a682e6fd64df4b9f4fe8\r\nMac = ea\r\nResult = P\r\n\r\nCount = 140\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 52859849a4b6c1d5\r\nKey2 = 380e73c7aefb0168\r\nKey3 = c479fef80eb6260d\r\nMsg = ee6857533675b5ed8d43\r\nMac = 43fd25f696cb0693\r\nResult = F (1 - Message changed)\r\n\r\nCount = 141\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 97ae01315d13ec52\r\nKey2 = c7674cc1ab0bbab3\r\nKey3 = b68fb99797b33b79\r\nMsg = ce9127f649bfff849826\r\nMac = 2dfe01d9bc07646b\r\nResult = P\r\n\r\nCount = 142\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 2b257032b0d9b0b3\r\nKey2 = 49f7c10e8a9bcd37\r\nKey3 = 20f4fb4679106ddc\r\nMsg = b2c62d03902c44253368\r\nMac = 14c5ccf5f9433a0f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 143\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 0b988c3d380e5b80\r\nKey2 = b86be99162029b54\r\nKey3 = e0bc9775838a58ea\r\nMsg = 61ababff3763183c348d\r\nMac = 28a2de26aa6b4074\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 144\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 26e9abbf201fe5b9\r\nKey2 = 7062a82f800d5183\r\nKey3 = cd45e654bf5d205e\r\nMsg = 020683e1f0392f4cac54\r\nMac = 6f1522d3c8186217\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 145\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 3443f4016dadcd86\r\nKey2 = 235dec80323e5838\r\nKey3 = fd583285e6efbc51\r\nMsg = e64eeb89828b4297601a\r\nMac = 5575a40dba5bc4c6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 146\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 76c7616785916470\r\nKey2 = 5b3d1f10e5252fda\r\nKey3 = 75a2d632a46ea18c\r\nMsg = ac7d701597f0ba879055\r\nMac = 06b98e161e6a6754\r\nResult = P\r\n\r\nCount = 147\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = f12367b568a758b5\r\nKey2 = 7b2f9770924f2c0d\r\nKey3 = 1f8ad9e9b97a088a\r\nMsg = b99de8168e8c13ea4aef\r\nMac = db534a059f930ee0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 148\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = f1adb67986923d8c\r\nKey2 = 02671957dcf75808\r\nKey3 = 52732ae970467019\r\nMsg = f759c3033d4ed34948d7\r\nMac = 2d9caabf50999ac6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 149\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 792f9770924f2c0d\r\nKey2 = 1f8ad9e9b97a088a\r\nKey3 = b99de9168f8c13ea\r\nMsg = 8bae64015d62f68565d1\r\nMac = a42f89527f5cb219\r\nResult = F (1 - Message changed)\r\n\r\nCount = 150\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 31ec790d4a8a131c\r\nKey2 = 562c8cdc07e331d3\r\nKey3 = f4a7467043924c4f\r\nMsg = 1798286c37c1504fc0d7\r\nMac = f0d6e2f7edce6349\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 151\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = adb692e376a12585\r\nKey2 = 8c8c4362ea97f810\r\nKey3 = 528f204c19f21a31\r\nMsg = 6543e675d34639a7f7eb\r\nMac = fac96e6804526535\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 152\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 62984a64ec7c4a92\r\nKey2 = feda64dfd9a24f9b\r\nKey3 = cbb04f7a1f26df31\r\nMsg = adb555fd5f5c6bdd9c4e\r\nMac = e8dee8714b285a00\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 153\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = ef0d58b55ddae95d\r\nKey2 = 80e07ca4aebcfd34\r\nKey3 = bf947ff4ab2904e5\r\nMsg = 1fe87a2f431f3718665a\r\nMac = 44a869aee76d79db\r\nResult = P\r\n\r\nCount = 154\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = aef4ceb55e3d37fe\r\nKey2 = bc0bb9d05bad972c\r\nKey3 = e0a29b2c7940ce9b\r\nMsg = 78ad5f3718acf9e8cc7c\r\nMac = dcc1d44200caf6f7\r\nResult = F (1 - Message changed)\r\n\r\nCount = 155\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = a4403438f8fb254f\r\nKey2 = bac752cd83a170b5\r\nKey3 = 6bf71654f1854589\r\nMsg = 349566b6716e5f831d69\r\nMac = 7c08cc43ff4d8e07\r\nResult = F (1 - Message changed)\r\n\r\nCount = 156\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 2fc7f4c1ce042f73\r\nKey2 = 8346bf7a80b38640\r\nKey3 = 2ff74abfc197a732\r\nMsg = 43a32b8ab9b7ce4bbd1b\r\nMac = 8000a2612215014a\r\nResult = P\r\n\r\nCount = 157\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = c40ddc9e29ce041a\r\nKey2 = 583d6bc4c1a2abf2\r\nKey3 = 9b018fd5a4084a64\r\nMsg = 228",
+    "6a1eddd80737a724c\r\nMac = 0ff14761c982f890\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 158\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = bc327a0bcb2575df\r\nKey2 = 6b9483e6e0755d2a\r\nKey3 = 622cdc5b2916ab89\r\nMsg = e1be89af98ffd7d9257a\r\nMac = d6f4c8d96b3e2180\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 159\r\nKlen = 3 \r\nMlen = 10\r\nTlen = 8\r\nKey1 = 9e517cd616a48ada\r\nKey2 = 6d266192d5387a97\r\nKey3 = 8a081fda97c86b94\r\nMsg = 9e9fb0b2b77be6eeaae8\r\nMac = ba0b73fbffc0ab0b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 160\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = e0b9a826a85efe94\r\nKey2 = 4f615bce7cc1ba68\r\nKey3 = 3bb56d3d9816103e\r\nMsg = cfe9ee956cb1f5a60aa6ec79a3e454224b456879\r\nMac = 64\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 161\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 1e08a794a175b69e\r\nKey2 = f7d3ab46aeb9073e\r\nKey3 = 3e7cf8cea19d0891\r\nMsg = eb4f5b04517ee93e2c900e01948ac81ca56b2b26\r\nMac = 79\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 162\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 8f26700dc140570b\r\nKey2 = 8325e3a889c823ad\r\nKey3 = 6b048aa73decf83b\r\nMsg = cefb55151933a488e2b3d421dea9720727188106\r\nMac = 85\r\nResult = P\r\n\r\nCount = 163\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 3443f4016dadcd86\r\nKey2 = 255dec80323e5838\r\nKey3 = fd583285e6efbc51\r\nMsg = e64eeb89828b4297601a5b3fcde60075fc2424ae\r\nMac = c0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 164\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 91a401cbb6460b16\r\nKey2 = 85438675f15b6e73\r\nKey3 = b09140318a767038\r\nMsg = 8c65cde13149d9d54a5bccc17747f1d5f3e807e3\r\nMac = 56\r\nResult = F (1 - Message changed)\r\n\r\nCount = 165\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = b78a16fb9b075d3b\r\nKey2 = dcabbf7a07150261\r\nKey3 = f7644a01d5dcea46\r\nMsg = abe2fd996bb6804ed3286c057df9cea6836a2dad\r\nMac = 09\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 166\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = ce8a467534cd679e\r\nKey2 = cb9ee6fb70a42f4f\r\nKey3 = 16c1e5c1459e4ac8\r\nMsg = 3c56ccfbe92023109983e740d6a53488b813ee87\r\nMac = c8\r\nResult = F (1 - Message changed)\r\n\r\nCount = 167\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 401f0de0efd6dfa8\r\nKey2 = 16ae7c3bbc6e5b86\r\nKey3 = 4ffebf790815f1d0\r\nMsg = 9052d5e22e6712fab88e8dfaa928b6e015ca589c\r\nMac = 61\r\nResult = P\r\n\r\nCount = 168\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = d357bf5bef2cfba7\r\nKey2 = b757d3abf49b4ac2\r\nKey3 = 16388051da8a04a7\r\nMsg = b04e8f6d20924be8e4e2c6767f87b74377bdf90c\r\nMac = 72\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 169\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = f8ea68aba1bcd9e6\r\nKey2 = 4abaa4260d864573\r\nKey3 = a49840ab737af7b0\r\nMsg = 1fc99e586f87932445930a300eb28191d9c6215b\r\nMac = 19\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 170\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 94ec086d8c0110cd\r\nKey2 = 4ea11f327f70c245\r\nKey3 = c8d07adf7c7c5eb9\r\nMsg = 812dbc453a1fda59f73aceea3bc84d2c7a437dfc\r\nMac = b2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 171\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 9d575d582a9723c1\r\nKey2 = 294af47a54b051fe\r\nKey3 = 5131bff85bf12608\r\nMsg = 266e5305b96f497a956ae82b20367ebac0b14215\r\nMac = a9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 172\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 913d800ecd0dc762\r\nKey2 = 7f6ec476b6b07c15\r\nKey3 = 973262ab7c83b634\r\nMsg = 4670a266bebcdf95c62d36cda33d50e6650fcdcd\r\nMac = 4f\r\nResult = P\r\n\r\nCount = 173\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = b97ffe79d068ece5\r\nKey2 = 4a75fe2f67dae392\r\nKey3 = 45a4d9f17a9d70f8\r\nMsg = b53017500c100dea0511845597214484fc5f7f34\r\nMac = 6d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 174\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 7e1af10bcd86c283\r\nKey2 = 51cd37540e19021a\r\nKey3 = 988fd3c7250e2a6d\r\nMsg = da1919d4a2a7fcc34c88fb2065e52bf9dbc50731\r\nMac = 22\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 175\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 8c0dc16eb9c80775\r\nKey2 = 6eeff20d3d5d5223\r\nKey3 = 258076b313611c1c\r\nMsg = b212b857f70c9f63d0c9d2ccd253c28d1534631f\r\nMac = 2e\r\nResult = F (1 - Message changed)\r\n\r\nCount = 176\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 92c29eb0bf3e73a4\r\nKey2 = c6ecfbe6cd49bf4f\r\nKey3 = ef19d9d06d7a5e7f\r\nMsg = 969304e651ca62039088f8123085ac3263796b67\r\nMac = 57\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 177\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = a4432f52975e4316\r\nKey2 = 7f2086da04fddf4f\r\nKey3 = 8302139e79684329\r\nMsg = 5c9bcd197ea59e1b58b3da707b253491cc5a5ef8\r\nMac = ea\r\nResult = P\r\n\r\nCount = 178\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 5ae0b6d6c2855b7a\r\nKey2 = ec675d3e73bfd685\r\nKey3 = d3406b868fd3ae0e\r\nMsg = 89b9ecfef6f10e81f7956dbc7ca4a335047535a8\r\nMac = 70\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 179\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 1\r\nKey1 = 8f7f85649d5e08a4\r\nKey2 = ceda75687308e07a\r\nKey3 = 9215c4c19bdc0d46\r\nMsg = e53101e6eabcda32c13d7b1dd1d88e7c2ca3ddc2\r\nMac = 14\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 180\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 7061b5f46b98d394\r\nKey2 = 58c2ce3807623475\r\nKey3 = 0df8e3c432da8a37\r\nMsg = 1086953d352e94a51a6d4c59a2295e8fff5b311e\r\nMac = 554d4df88228eba3\r\nResult = P\r\n\r\nCount = 181\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 347a25a1ec433b52\r\nKey2 = ec75d97046152c10\r\nKey3 = 86b937b6ad1ccbf8\r\nMsg = 4fe6bd43c28143ea5d40919cb5330a7e674f5bd8\r\nMac = 3d0d841895fb7c65\r\nResult = F (1 - Message changed)\r\n\r\nCount = 182\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = b3701aa7da61512c\r\nKey2 = 46dacba40740e3c1\r\nKey3 = 8f79a4dcadbc315e\r\nMsg = 4612fb4586d7518d0d648894347ae7d49d043f29\r\nMac = e5dd4392afbeabe7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 183\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = b5b57acb2c7fd6cb\r\nKey2 = 70b02c9d8651c889\r\nKey3 = 07f485f7b00e45d9\r\nMsg = 9011231ec382ecaaae57f34de1ac6bbb50741014\r\nMac = d34581ad5a3e9e57\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 184\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 88985bdfd9852604\r\nKey2 = f7f829aec8a208b3\r\nKey3 = d5ba012ce6754554\r\nMsg = 6cad7f3b9f196839bbc5a7f755c09aa8e17c83d9\r\nMac = fc7c93552aa14ca2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 185\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = cd0815194319d552\r\nKey2 = 346bb634027668d9\r\nKey3 = c17f2a26257afbad\r\nMsg = e31b3d97ba6ee6f2e18f084215ca0a5ca0d816d7\r\nMac = af5772396bb63d20\r\nResult = F (1 - Message changed)\r\n\r\nCount = 186\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 236e5201dfc1081a\r\nKey2 = c81526bc85c7a2ce\r\nKey3 = ab91d0aee0d68931\r\nMsg = 1f36b9cbf3d4d4dfcc4ba7fafa7c229f0a9253f4\r\nMac = 27586cf856a41e82\r\nResult = P\r\n\r\nCount = 187\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 2e01198faeb6986e\r\nKey2 = 7cb564801f15bc5d\r\nKey3 = f2d3ef0d4fec61c1\r\nMsg = 27c8c90c9e46e14b8cbb0b7559bb166d65f58aeb\r\nMac = eaa7b4a171e449ef\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 188\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = df575b851331b016\r\nKey2 = 33ec7326e9ef31e5\r\nKey3 = 1686c1ec8a3ea16d\r\nMsg = 1e4e01d38ff65d05646d544b52a6df49b897eacc\r\nMac = 45789bd32147c0ae\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 189\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 43b68c1f29ef5b94\r\nKey2 = a7dfa1cbe9ea3df1\r\nKey3 = 83d3c286e973ada1\r\nMsg = 0ca9b0f6465db0e101f8c14b2e73859d9c355b0a\r\nMac = da439a51157ff0d5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 190\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = bf91d679268c85ce\r\nKey2 = 46b9f7bf4aa1a2c2\r\nKey3 = f7fd15fda2cd6408\r\nMsg = 0c2933e39d7e601ee6f2519eaf01294853664262\r\nMac = 455cd46d3b452a55\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 191\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 0dad9d451f890b38\r\nKey2 = 3416e3c240a16ee6\r\nKey3 = 5b80d6aefd4ab5a4\r\nMsg = b6e1de9abef7525c5dabbdc85746958781d50139\r\nMac = 3445a869cca839fb\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 192\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 96858f8f2ab56df2\r\nKey2 = 5edc3b04b94ca7cd\r\nKey3 = bf10614ce0491645\r\nMsg = ec9aa18b3e7da99dcbd7de7617a79130abe3348a\r\nMac = c744a1392fc656c2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 193\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 46ad6ebad9644a67\r\nKey2 = da684aa48f23d619\r\nKey3 = 43a2316b40a46e25\r\nMsg = cf97c2abe3d0fc89e05538b50147a3f405391219\r\nMac = 7ac08967edc5730b\r\nResult = P\r\n\r\nCount = 194\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 68647694efb32023\r\nKey2 = 0d2938c8fe1a4057\r\nKey3 = f479f16e7552942f\r\nMsg = 33a9c750bb532d2d37ec86fa851aeb3cad1eaad8\r\nMac = 3873ae02210eb5fc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 195\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 58d62fd92af7437f\r\nKey2 = 89dfb51fc807cd6d\r\nKey3 = 024fd04f40d5d0e3\r",
+    "\nMsg = cc293c9e1780b401d2e7fceef6f69edcf0f70b86\r\nMac = 6574bfceaf04b4e1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 196\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 4b377f98df0b7598\r\nKey2 = bf73f4c2cb074001\r\nKey3 = dc9857f47fe6101f\r\nMsg = 9ba5dbe7a8ecfbedadd7889cd7f1ae073e01ee3b\r\nMac = aaaeb7223578bbad\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 197\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = 91c8851934cdecc2\r\nKey2 = 582562aef1205e32\r\nKey3 = a12a70eacbad310e\r\nMsg = aa390a0ae33751b0bd8de5723df91d999aa70358\r\nMac = 67f76912ed61eaab\r\nResult = P\r\n\r\nCount = 198\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = dcc2bacbea0dcd10\r\nKey2 = c18ca45ed57f8f97\r\nKey3 = 5d58157a677f1951\r\nMsg = a7573e5b7dd7f4ce9e4480f603c14145a27f7c7a\r\nMac = 2b6af968464ac63f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 199\r\nKlen = 3 \r\nMlen = 20\r\nTlen = 8\r\nKey1 = fe6d49702f044f40\r\nKey2 = 33321613da401004\r\nKey3 = 8c3438f74cc2680d\r\nMsg = b15a118b3132c20c31e6c9d09acdee0e15fcc59d\r\nMac = 9f28413a00da00ab\r\nResult = F (2 - Key or Key2 changed)\r\n",
+};
+static const size_t kLen39 = 53587;
+
+static const char *kData39[] = {
+    "#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = AES KeySize = 128 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:37 2011\r\n\r\n\r\nCount = 0\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 27b5686c79b3d242f96d3892c6135b26\r\nMsg = 00\r\nMac = c98d11822b9b4d7a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 1\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = b4542a22baa348ee2d11ef62d44cebab\r\nMsg = 00\r\nMac = f7a2a3f519fc462f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 2\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 7256e344f68b3e7f9dd6e04c5c65135c\r\nMsg = 00\r\nMac = d4d7fcc5f979230f\r\nResult = P\r\n\r\nCount = 3\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 7a2116595c5cf6482199d3312498006d\r\nMsg = 00\r\nMac = c3c4fa28709060b0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 4\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 0341551d6c7e7c57f678068f0b41d1fe\r\nMsg = 00\r\nMac = 821030d4b7889fcf\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 5\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = b67ba2aa4e9ea9871c3def87e2dd77f4\r\nMsg = 00\r\nMac = ea896182698ac145\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 6\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 0091d39f3478d2c59bf874b96db9ce0f\r\nMsg = 00\r\nMac = fb12c5971b0f2f18\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 7\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 46a2e6bd3fd5336abf02eace3cd1e1f6\r\nMsg = 00\r\nMac = 9c6b46ef046ae1d1\r\nResult = P\r\n\r\nCount = 8\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 4b0fbd5e6f9298e5ced5ebdc60fc18a7\r\nMsg = 00\r\nMac = 221857badcbcd2be\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 9\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = fb20547da671acd4c6df37f6568a6428\r\nMsg = 00\r\nMac = ba0c9bfd3d9c0c95\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 10\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = b787def50aaf446bf15c562434844562\r\nMsg = 00\r\nMac = ba60bdae64068330\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 11\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 67d77f50727c7cd5b38e0b175a888c88\r\nMsg = 00\r\nMac = 555923e6b5fbc504\r\nResult = P\r\n\r\nCount = 12\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 6f552ef7d309bb98597b91cecc21e158\r\nMsg = 00\r\nMac = c2aa402c0443dfbd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 13\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 411871267919a145532cc401e753ebff\r\nMsg = 00\r\nMac = 167a31913228f45f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 14\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = abfe32efdf0464cb2eaafca8eac30d9b\r\nMsg = 00\r\nMac = 8edbc729b1923e10\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 15\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 85504d59a12f3e17edfb0b6337d4a081\r\nMsg = 00\r\nMac = 9045fd77cb26dcb2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 16\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 55f7565826b0e2ccc1368f4de32022de\r\nMsg = 00\r\nMac = f82395416a8dc209\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 17\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = 43c8f984390debb0f26c6b9c2df8518c\r\nMsg = 00\r\nMac = b5d732086bf8feab\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 18\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = da288d2014616f16a2abf5923dea49ad\r\nMsg = 00\r\nMac = e03b67b53fc7863f\r\nResult = P\r\n\r\nCount = 19\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 8\r\nKey = e2f962d076df051c2d291b47a902ea0c\r\nMsg = 00\r\nMac = df1456a7edeb4e42\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 20\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 191b53e0c7d90161e5e2014e9b8aea31\r\nMsg = 00\r\nMac = 1e210cff3c90bd2e2a27a78ef7662f61\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 21\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 54666bdf6db300ee10982d14dac828bc\r\nMsg = 00\r\nMac = 9fef67209b8da28049b80efe98f85f13\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 22\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 9a143c21cc6c9528b9ddd7e4405682e1\r\nMsg = 00\r\nMac = 1c3c3b6d1d86ac5787234f8f6d707acc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 23\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 802047ee1309e548ae81e93a17bff9e7\r\nMsg = 00\r\nMac = 1472aecaa0a09e45893a14090ed9a17f\r\nResult = P\r\n\r\nCount = 24\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = ab79ce74c0959aea0fd0b28ea5d0afe2\r\nMsg = 00\r\nMac = fde8a95536cc334f7fc8881a187afc61\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 25\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 644ac6fdc1e713ecb7ff1e0bd5729a57\r\nMsg = 00\r\nMac = 95a93bb50703521e6c1a8be1aab6a646\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 26\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = b4571e56f66a857daffbdc99370ceddd\r\nMsg = 00\r\nMac = d2742ea62f1d6513c4eb0e533922f251\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 27\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = abff2b097d688293701ff2c49ba48eb3\r\nMsg = 00\r\nMac = 17e724f66d4a9ef5dfc0cf903f8ff04a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 28\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 9d45f6d97d1573de3cb3488befaf5b7f\r\nMsg = 00\r\nMac = 96ec3cf234d6704483a93885bd67e6dc\r\nResult = P\r\n\r\nCount = 29\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 00d385629e5df815a5300e6635351934\r\nMsg = 00\r\nMac = cb23bb449ac26e2186b02f7428fa022b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 30\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 2f9109e7eea21b2615c81c03182ce603\r\nMsg = 00\r\nMac = 4532211f48124a9eacd795ea4313adaf\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 31\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 9f3830f5cd40a2396b6093b358cef1e9\r\nMsg = 00\r\nMac = f5ea59ec909a8ec2d8b11f5f276201fd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 32\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 17378e17c41586b88523a6b6af738dc4\r\nMsg = 00\r\nMac = 40cc8b388be6789aca584659acc7aa06\r\nResult = P\r\n\r\nCount = 33\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 064e8c88a0a0766186d75867b5ca3acd\r\nMsg = 00\r\nMac = b2f94222a68fcf803868b00404ad170f\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 34\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 1e39f1cba97dac4e4d4f3bce7fda72e5\r\nMsg = 00\r\nMac = 60763815c1075c31078a9b44fe4b8427\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 35\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 06f0e4618e0ea8fa5443b50ea005b672\r\nMsg = 00\r\nMac = 295c6cd08b1d668d9fa85ef851b1e029\r\nResult = P\r\n\r\nCount = 36\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 648d77b57770b67ecda1ce7951eaaeea\r\nMsg = 00\r\nMac = 2f3fbc6edf5827fce440b9a7ff8535b4\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 37\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 6f3938932b5c1280311e892280d8a822\r\nMsg = 00\r\nMac = df02edfb316350c81dbee385d6e1d8e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 38\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = f909903451d1f9f45ffcb93a407ffb50\r\nMsg = 00\r\nMac = d176620722c5327270ef30956d7ac02f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 39\r\nKlen = 16 \r\nMlen = 0\r\nTlen = 16\r\nKey = 181d92c7df1ebb0924719e066e08b95e\r\nMsg = 00\r\nMac = 144f688fa0d29faf787c48cd0765eecd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 40\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0c5b763b1e97b4f4dfc7059e4896ba58\r\nMsg = a0b3c6944b35f7208dfb40b4c4ba134a14dac928b679950793b3b6751221f178\r\nMac = d922ea85b3992a67\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 41\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 461d7d629778c8b05a688bee4fc01e9f\r\nMsg = 07571a6c9bcb6f97d626796bc74e551d1c45cce38afed761706f6264b7e751d3\r\nMac = 794b224a85396a27\r\nResult = P\r\n\r\nCount = 42\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = b91c6b09bf5a0487a9b5ea2fe0c1f3d2\r\nMsg = d31fd388e97727ba0a35d34ae05d9980e5974f6b3d86e2d4dd569b70f394a159\r\nMac = 2665ff2785bcb606\r\nResult = F (1 - Message changed)\r\n\r\nCount = 43\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0737836cf771e842a70f3eeed7206799\r\nMsg = fce631a9eb130178018ca88cec966ae53ecc83a51d0a73173c8a9af10b4d04d6\r\nMac = 1eee822e37dd1e84\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 44\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 120132c315bfc9c4fb93023f5d3500d7\r\nMsg = c2576ed3189eff3205f5e01dd8fe7c64f12dc73c807c22918f607f9e43fcc5ba\r\nMac = ddca15c8b5a80cb2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 45\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 5363bd7d867a9f9f0592dd9940a791e8\r\nMsg = f34e86b8803d386573b81045df945df8319a93b613de4c41904c8e1879844cee\r\nMac = 109dd7c920ebbf41\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 46\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 3fa1c7cffaa167557b250634e8052fa0\r\nMsg = 4255f8af18df7237e0abe98421aec9634443561752d893aaffe76380e829ef32\r\nMac = 0eceab8d28dd4a2a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 47\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 6583a4ff27b6e109046d11b977c8293d\r\nMsg = b63be320f92",
+    "e01260fba37312224494a2764dfc928287c75dc1cafee7b698d48\r\nMac = fa0cced22e896b40\r\nResult = F (1 - Message changed)\r\n\r\nCount = 48\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 5949378fd3135dd02ee1929014000411\r\nMsg = 65c16f4e66b10c7c153be7ba2dbe3a6d4eed3b04fec44188edc229747d52f8c8\r\nMac = 9ef023345848680b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 49\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0e80fa889b1d96a0d23d236d4d642a27\r\nMsg = f6f094e46cdb2e45fe49b18aff1427ebdac9710fa7f47f75fc9ec7140613ef3e\r\nMac = a09774009934c9d4\r\nResult = P\r\n\r\nCount = 50\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1f88dfd4f5c52c22b1db47f9f4fb6e2f\r\nMsg = de433ebd1cdabeac46b94cc00d984f172923535ca8fdfeeb860546357dd8e266\r\nMac = bb17b3983faee0db\r\nResult = P\r\n\r\nCount = 51\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = ab0ab9e79ee53a6946a31ea807258dbb\r\nMsg = 89ddbb042aa2aea5207b312c9831fb48138aca90626ef7c5ce474d5797ae1b2b\r\nMac = 72f316d5bfcfcf6f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 52\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1eb19542a0064564e096e5d7d60acaa6\r\nMsg = ca25504f3f5559aa0e88199ce1551c9240b5c76f55b83bdbf2777cded54ad3af\r\nMac = d936b1fca0a96aec\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 53\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 33f11aa36d8ab0fc53486839a576b31e\r\nMsg = a58524e37c2504468f77a9c21b0e6d1a6b5e06fa051d5b8025ef97fa69417cf2\r\nMac = fd64f7cb283adce1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 54\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = a7b81d8245129aa451dcb7229de415e5\r\nMsg = 2b2ec02aba10aee056443cf90585caa2510b3b835454a99f1324567b0dcbe682\r\nMac = f4cd48f32c9dc66b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 55\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 3c1baf0d915e5aec92bb62babad0ba2c\r\nMsg = f8f2424c2dc0d0f3821af7244038da0832c547be4ff0850b98c04d4d44a716b1\r\nMac = e17ea6862129d6b9\r\nResult = P\r\n\r\nCount = 56\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = 943a49073db6ae94a88844ed895f8fd9\r\nMsg = 8a15e5be479d3a39a459ca7b50457472cbf44f6a8324ee3d4096e2c3bf1d8190\r\nMac = adcce0ea2c8b11d9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 57\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = ebf8935f53dfb3bd40453c31f627c73e\r\nMsg = 7edddb03d861dc9796f8e069bde434681620f604db436f34b7a6a3beeec925b3\r\nMac = e8ea88729d49bea4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 58\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = f18e8feed77d1b80c31483fe69073d56\r\nMsg = 37c6206e23163c39a13f19de48cc25dc26e6f83cb376e8d2048ad7c141fa503d\r\nMac = 0d4f5cdb2a49b471\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 59\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 8\r\nKey = b4e41c7bfb8fcaa5236f656185c1496b\r\nMsg = 32758ae47884fcef766dd1fee1a7f55ca6f6691574e2ea097a68cd4072ef2e7d\r\nMac = bad08badb66c8e5f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 60\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 708484fba04972b815256c5dab12d5d4\r\nMsg = 97751b4893a83cfe6b760e10da795682e9668749c09036f9bfadce9dcbdd85e6\r\nMac = fa74b33267c5ffeca75e5e16978bd7b0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 61\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = d0df1bdf1df6203241722fb9c9c1cf74\r\nMsg = 0e41361ebfbe4e6580fb5751e58e98de8ee5d9849fe875026fdab15a85804c1d\r\nMac = de4992c9d33659620cc203848e42a279\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 62\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 7c0b7db9811f10d00e476c7a0d92f6e0\r\nMsg = 1ee0ec466d46fd849b40c066b4fbbd22a20a4d80a008ac9af17e4fdfd106785e\r\nMac = baecdc91e9a1fc3572adf1e4232ae285\r\nResult = P\r\n\r\nCount = 63\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 7b4c800f5071521119e4cc6deee8729f\r\nMsg = 775946f3014523b6ea37804585cadd35e74e9382ebc1022579fbebe407281b6e\r\nMac = 2f6697f5d067aecdb3ff5a09d9169b3b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 64\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 7618d222630138cc14246e8fddcf98cf\r\nMsg = 432e3575a966958434da38dda3606f1f69adeaca536a7bf66c8b1e451edc3716\r\nMac = d7d78aac615ffc1bb32dfea41f2b8771\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = c8804fef18ef263c010c8a205e14516e\r\nMsg = f2d23bc605181e3894f61fa63d61ed4a610123ab7d3531c0b7579a58b74161ba\r\nMac = bfe5e2c10a5cecccd3de2529f340cf6b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 66\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = f98ac86ecb742c188852980b5150d100\r\nMsg = 4e6fd4fa7669ce9552154bd796644961b51067dc02303430150aacf671280031\r\nMac = 73df5f4d3ab9240d4fb2be775188adc0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 67\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 638d7d95ff5f57571261e23ffa081189\r\nMsg = 5f5bc4e32764bb00085667b7f1b15433f09c1f6fa48689f8f50dcaf5021f2864\r\nMac = 96b270629b2bfbf721f1a70eccf9abe0\r\nResult = P\r\n\r\nCount = 68\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = a5a20d8139472a4cb38993c5711ac2ca\r\nMsg = 73e1e75538f9a63e49a068189e3b0a1a1e65ca5d1295589bdafa3136deaa287c\r\nMac = 320647d53ccdf2335a9c9a3452c1cee5\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 69\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 57656be54860414e8a62223381ca4405\r\nMsg = 3447e82ecec6c8b6fe1e44ed91f933e4a70c431911eb86eefe222d5ad78193df\r\nMac = 47c6b5a28d723129648aef418b74daa8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 70\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = e7b665600a2aa413e117c53816cbed34\r\nMsg = 5e4d49ab796025157add6d42258b9c506d9ce82bdd85c604360db0ff5aa4262c\r\nMac = e741166cfa2a58003dcae357d7a199b8\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 71\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 693cbb46bc8366086ec7cd7776f2c563\r\nMsg = 5a908ae85ff721ffc5096aeeda5ee83bddcf639e7be68d109394e5253c22dc9b\r\nMac = 9d56b03ef83082f601a9cc8730b0de42\r\nResult = F (1 - Message changed)\r\n\r\nCount = 72\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = b4190e3462e07fca26496adcb877724f\r\nMsg = 02097035a312cb02ea7f09fc1accc230a205e4a208e64a8f204291f581a12756\r\nMac = eb9604ec71aac0cacb63e0b369ae7664\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 73\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 4ae06c3b2940819e58eb24122a2988c9\r\nMsg = a2e7be3314238d7e4f604e134790bb15a87c09356c091b1aacb9f605b67475b5\r\nMac = 14b4507ae4b50cfe4989b544bede756c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 74\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 8d560de2e310ea69389221ce2e850625\r\nMsg = 04d9db45e4df19db757b9b95c25be43e822b8372ed148d49ce824a36da2b2f2e\r\nMac = 647f2874a083e82fa804b6c58c7b5c90\r\nResult = P\r\n\r\nCount = 75\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 0e1a79c5d734118c19eaba700f5da238\r\nMsg = 026470d57dad9893dc037b80978bf70c2e552fe46c8fe8c3ebf8338bda984d94\r\nMac = b936ff3bb8afb9e42351a2a3ad49d70a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 76\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = c88b1bc0050e19780ab53efbea175634\r\nMsg = 7207aa8fa87283f1f57019bf1c89645ff8fc36ab1102704e6d577671a9f7e098\r\nMac = c1dbd79e31c3b0bb824f16f735ccdfe6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 77\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = d87df10a53eb3ea24c003d2a65e44921\r\nMsg = fedd5813146a8c2af398d6066956829833b75e44b6e010e4f025ac0fad6f869b\r\nMac = 9dd7cbb34445bfb351d01e8cdb21d695\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 78\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 4d436a4a5c02b22ad49548b97216f277\r\nMsg = 2d73204f0b2d35806a8227206922ac9c18eff6ebddc73809179d67a702cf3e21\r\nMac = d2654d9bd6396075296cbe918d90670f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 79\r\nKlen = 16 \r\nMlen = 32\r\nTlen = 16\r\nKey = 8af7b74e35eb38f4086343bc329ab465\r\nMsg = ada1fa439c653d0cc88c0d129ba252e86c7d20a3087be93e920bf13d8e6f0391\r\nMac = 0fc9b177c874ea909b6beb1db1b802b4\r\nResult = P\r\n\r\nCount = 80\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 91ce6c87860aa84053f42e1abc16f489\r\nMsg = 4c287bc16196698d762d5fb428e801975fdaa29026b7b78dba968bfee0f534f27cfec57c6009c55c6261e0dbb14bddf76944d0c0648b910254df6c240e8a1a50\r\nMac = c1ce12f51aa823d0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 81\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = b7b774e5c9e2f6926660c48b8df52354\r\nMsg = 937273c7355e7b88a630d15be875234cacaa44e815f31997bf10b52c008cc3bb6d3724aaa0d7da0b391b252923d0eb6119575d346857d89af6af099883af5514\r\nMac = ff845eb2d77aa5a7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 82\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = d7572ed0e37261efa02f8c83e695efdc\r\nMsg = 85a327b0c7a31a4116e7fae0c0971e1578ab6fbdf90124b9ecacd0e70c909f51882cdca5a8b6b7e6b46d4660122bc9e1ae3932269f68e594075dbc293a2d4eb1\r\nMac = b8b3b7526419e069\r\nResult = P\r\n\r\nCount = 83\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 259129eb760f8a770410c160e4e13a6b\r\nMsg = 77d9c30",
+    "6aa257379053cf1f2043c388a301dac2a9e2bb89eb8bab6eb3f150fe391b7a3f628be6b4b649c5c108a108f0e0c55a0800b9954251ab07e94450a23d0\r\nMac = f9376f11cbec0ec0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 84\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6ccd61ed20f16ca7a78192f5b6ab5528\r\nMsg = 9211231ec382ecaaae57f34de1ac6bbb50741014a978160ce59c60491e64f30da0b8aa1442e42bc0f7e31973a0dd8c3c24eebeb7c329072ea7dd0b04bc163254\r\nMac = 94c275e6a4675d8a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 85\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 1cdc44c40efc3c0ed6fb84b0c2f78aec\r\nMsg = 818c636772036761af037c23aa8cb63e424f0ba0375b645de2f8f5af23d3ca3b9a5ca3951a6d02075a2c828eee326a2676ed8247164226b0267798632a519bf1\r\nMac = 74355397c7a29bb1\r\nResult = P\r\n\r\nCount = 86\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 2e523e9d8a5532127ec63b220838f11b\r\nMsg = e6d067907610109b8789e1ad00542539991677b9efc97a98d8bfcb50f3e334d0844323207fcb5a47e353e76d49dd573dbd17278dcc287b41dea8126cc7f07ab9\r\nMac = 7bd6745c6f73d92e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 87\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0eee5bc8994b723a580f67d45ccb194a\r\nMsg = 1dc4fcbc73dab4e73ed9d7606acdcd42b74972460c640fe50f028abdf255d9368fa3bc65b849ac31c8000eb47e5fade40ca167726aa927f2f043133d24ad0613\r\nMac = 486721355fff9cbc\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 88\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 388468d10bf0b770cc125f8b7d359261\r\nMsg = b9aaadfb3f60e48f1b421a9450129d75af2ce811ab0b1661680e9d5b147c38167ac7252ed40d916ae1e4519c3857d2c9dc2c538a106951b26d16433131438839\r\nMac = e13cef9392f4a80b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 89\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = edfe2e15edf0b0c28875651d4becfca5\r\nMsg = 70b1e2e4cf260b108f5a52d0d8234838ffd6ffe7b4acd78d7d6b95aa6342b598eaf402cb47396358ce61f8b4aa3a65bed0346e0036c3c5323f051f007aa58d0e\r\nMac = 7b70730219907d18\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 90\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6876df1a77e11165331a5ce2e0e6bea6\r\nMsg = 34b73ba208bbe1df06da768b0321243815df4ece555974dee2bf5732295f5ea9631939425e13c47681ae2ecb0bb85aa69be38560f5752a9d034222d91ad71044\r\nMac = 80e00df873439fe7\r\nResult = F (1 - Message changed)\r\n\r\nCount = 91\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = e65d5fd5f446b4eab63d56b0a5eb1d29\r\nMsg = 554395f9b113c0f2a1f155de171d6c0a805c838beb90c3756e8b864dc52517c03d8cb894d1dceae092f0e8784c7775ac664ad7320afd246086b3bc9ef237171c\r\nMac = c60f8ced2efd52fe\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 92\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5bdbd06f4df6e15d644f3a635d7bb14f\r\nMsg = 4fcc7c2763a8dd5bfe74e34f512be8042af9ba1c73a944edfb616ad47a8d34cbcf192f3e8be3101bb3709b29c2dec39aee1913e3ac524ccb76ad50c2cc3a3e75\r\nMac = af33d5a2746bfa5c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 93\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 13bf2f72211cc8e16ac1986a22e19f60\r\nMsg = 8ee212ed4bd110ca6a91b37bca59e19ba842e3a1b50619bc6b07ec02a09303ca5c66ba56e870d0b627d95fe829431244fe4f9218c862418f14a92bd76b5a3a82\r\nMac = 18e8cd5bd42c75ea\r\nResult = P\r\n\r\nCount = 94\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = e9b913c2f0630562eb1c16b3b1ed8409\r\nMsg = 031105ff01daa66ff95834e47b6f5c683994084d0fcb84c140d1dfa2039a95933efe6a4f91af993d966e2e45677eb1e36159047928a38eeaeb5c9a64ea59f97d\r\nMac = f00a17da0fb9e6b6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 95\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6fa5a5991315702cba3beb33867c7bca\r\nMsg = bb0fabffbcc6935ca35755fd4bfbd192b6812cf75c4dc95bc3a175a1501be2065d7f57058cb7a5785a185dfff7e740a5551cf7c17e65051b2c6ef9509360e878\r\nMac = dcfd143f86442183\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 96\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 3f8c6d21ec05bc439bf82774f1812bd2\r\nMsg = d726deb8537bcd671ddbaff8fcc6968f951b71aa82dfc802a53aadb2bcc2ef9a35fd90064320798b311d6d32f7dd3cd90bca39d57991eddc36260d23b108aac3\r\nMac = 449e20567875d56f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 97\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 8ed1a4873bb37fafd4f8c2ee417443cf\r\nMsg = 1652c9539bff4b6e9f303f3e6b5d4b9ff7e85aa2a401ee8c2dc7b722dbaf6424f92ab9188882e2483405070e8666204f5a600b46949cdb830fd57433d63a55a1\r\nMac = 601eb06acc5a4e0a\r\nResult = P\r\n\r\nCount = 98\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = 83a4669cb9961448cf418cb83a16098b\r\nMsg = 26d97c3e28460d46216da39e043e024ed08e387b1e5fcfd3f962472cf1bac4676b03039b3b93927075ff41c87fe1d4a56bd9fa4784d283942787cdbdd5457f1f\r\nMac = 01a42494a10691ce\r\nResult = F (1 - Message changed)\r\n\r\nCount = 99\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 8\r\nKey = c9e6d0b3dcd8ab50ba5ff31d9c1bd95d\r\nMsg = 0d32c1cd73569ab2b10c67c167875fe22625358ed3469b424c5e052d4e49af2c97dfe1f947c972a08c938b327e01adbc48a7f57a89b49f49fa0fca5b50a57a2e\r\nMac = 476add8ee51b5e3e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 100\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 17281acb525b13653000ab45d86e7010\r\nMsg = 225750ca982e5b34fc62e277eaaa0f248532abf374933e572b0278566cc7cf980df26abefb493ef57f8477cac0bd19408a22e71f4ded84906996d8e7a846b5c0\r\nMac = 0f2aa7f2dffcf7df34c84d101aa9bab5\r\nResult = P\r\n\r\nCount = 101\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = d3624653ad0ed144667df0e0e355c29e\r\nMsg = 39dd298acc45cb597f0733572677f7102536c0dd86fcfcc44895d29af92a5b6a87c20f1b53087d4c874f4083aad32e877142d20ad87b1d8b7295587bfd235d9f\r\nMac = 795da5a50f5b7df40317616b5a470c02\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 102\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 813b3d579664cebe50a8e7050a0b4e65\r\nMsg = 78ad6517a09b99c1113d175f3129aade4d4a2516ebe054f15bc833d08ffe5e2a2d60c976e1b4b14cf8edd2c72baadb2db8001fd2b8798d39ac5ce27d592f1def\r\nMac = 20f40553bedb6496233e0b53143b6d10\r\nResult = F (1 - Message changed)\r\n\r\nCount = 103\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 21095cdbe94afa27d84bcd68276993f3\r\nMsg = 10525eb2794d03409faeab22a6d4cc4ebc0421daacb0e865b0f94eb387722897c827e31676debec9d49c36837b6bc234a95bc10ddcc7b1e5a0d9a1dca550e93e\r\nMac = c0b806ce5eaceb51b53b028e6efea9c7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 104\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 6c769a4822523525bb36c02518475549\r\nMsg = 4af38908fa44b46873535b39f432d9b3e677f6d06d8719af3d15b936afe515fc13d62566481fd0108bd95f6e8dbe32b3c830b1f1127d868273610aa834ccfc70\r\nMac = c1934b9c74127cfd515521df330c0333\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 105\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 6b454930925ca09d39e1e39a2e78fbfc\r\nMsg = 2bc884394ab7050c14d66fb8901cac109c0126668d918a4419bfcc5d75fb6bc2ba07f6598d06cf8cffd62f3eb29f6a033eac7490d27aa4701f0fb9f9718d1b7f\r\nMac = db19b8ef218018e5a53abcc39b7c514a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 106\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 5df295be7c44d59c44fead3f1988356f\r\nMsg = 3d7370cc2d61af35bf7b2ba50a143b23bfa0d1eff66c5ace2d8de5a28d17883d708fff7721a2977ee2164b6e34022c22523a0649ff0e40bc8134040fee02a065\r\nMac = 81b3181acbc2d6d2960ec57441ff3c40\r\nResult = P\r\n\r\nCount = 107\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 387fc73be9f019913f2222d98053f95b\r\nMsg = 944daaa76249bd9d3bd517d01b074920b7d4434d1a2618af902e0228c3fca658244d990f8ca42208239c42d4827cf114140cabebc2a72bb3cf9277ef008c1c81\r\nMac = 5de79be9ff9c3c9d64f9cce35b188648\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 108\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 7424990dee834ad05f4218861ab21eae\r\nMsg = 49fd56dec210e903f6c703332637f9c267eab9333e2701a16c74ce5e0b5a16d9da68b9c5d67bb6770a3c9a90a7e93fdd5759b27bcf3a753fa39ee7545fb60026\r\nMac = 38b66049ee8ed81f3f8ce2b45a4001ad\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 109\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 232407986ad4a8e438990fd04ffa35bf\r\nMsg = 9d88a7970d4c58cecc20ed1811298a5b37297419ca49c74fe216679dafc938a656cb92bafb78efb31f24e71c2d5b5f994f6dfd82862adfd2faeb8c408fd22aab\r\nMac = 313d46dda3ccb75f497f9069c9478b3a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 110\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = d9bd6ac153cb0bc4e19e59c45cfe0d6f\r\nMsg = c68094c26c7f017b79f126dc26b3bbcb95f97535ca412da5f7853e15fcb52f042e6492c857c22b26ffca5520eabca20ee2cec2f0b71ea60383ece49232065e0f\r\nMac = 3b17778955990ae58e03feda7fc43998\r\nResult = P\r\n\r\nCount = 111\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 857fa35c6f70f637a9a5e6f215c694fd\r\nMsg = a1fc1307757ed91665980e2d3cf9778d8bffc9a84cce6bd5c5a07e47af5c1b409869db8286c49d07dd5083f1826e3ec441ce8cd36c85fef8c55fff889e761286\r\nMac = e1ddd63db51d3035adfd309ddc186238\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 112\r\nKlen = 16 \r\nMlen",
+    " = 64\r\nTlen = 16\r\nKey = 501f5c58355d1800f155f272dd09afee\r\nMsg = fd3564848ceb5d8cddfd50732956d18b4af433efc2e2a914ff66aba1de7b9b816d81a936f534f47038dbf1def7c11144b7e99ecec5fee6a478899cbeb6677bfa\r\nMac = d995f9bae6150996cd9b798fcbc623c2\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 113\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = c1d636989dfbcb0edc9f014cc82da6b5\r\nMsg = 20ef1bbf8a719497797f1f1bc4617179ea682a24a92f0831cd215a01473bb8207e13f26dea1a467bde1ed638a51359ccd11210c4d0a2fb70c0374e8984f81f17\r\nMac = e4972a59db04f78da1728cab051faa98\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 114\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = b4bc5a4d40716fb06a359ef9537726b7\r\nMsg = 36594fae7b487798d62c2c95ccbf51c984df5ca6343465b2dd147c8b36a34028e53fae61f51b36b28529143cbd3edd0c077158a07bc490a79a06270940f7ed27\r\nMac = cfb3fce039ee2bb94b6961ff86688237\r\nResult = F (1 - Message changed)\r\n\r\nCount = 115\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = dc796e5d9b712c798922eef315cb4728\r\nMsg = d5755c40f52364343d2613420441afe9da9a5329d3c1e5a123ee49f5eb8ad47253f104f5d9776e08e9a9f74fadd5472326cc7b7c7ce61a1492474bc9de614543\r\nMac = 315f0ce76352448bbd8a5012a9907a23\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 116\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = b82fd283922e730a07f7ddb87484f66f\r\nMsg = 94e47b82b728d639777d5d5843de2a5c364956cb4b21cabdced2529b10b3f4275f307fbc352866d7b094cfd7426ae801aac17ac72335c04adb8d791da69b3c4c\r\nMac = 86e6a8485b43f1b258eb59688af91fbb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 117\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = f6db7efdfe73dcb4a26b8448842b55e8\r\nMsg = a1fa1fcd5f095b2768e32cd733365a136a108e7493f212aaef27d86da253beb6154f103099344ee94db6304e41b4e856db0ca7fd7ab462f45a07d697b85cca1f\r\nMac = f998bba6c5d3efd78af9ef57e7a38f7b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 118\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 3c1ba92d096fba134dfb4ef412b2568d\r\nMsg = ba7725d74465f5d92454bff794e0be51c4d0af7d88f729834d57312c528d0a7d15694a7e0bdc334093173f1d2df1fd42e7891c6b192dc5ee527b2ffb92c66d22\r\nMac = cfe6022ad29a54627ae7c4f907ef4da1\r\nResult = P\r\n\r\nCount = 119\r\nKlen = 16 \r\nMlen = 64\r\nTlen = 16\r\nKey = 4a92337f017a85b136ba6766444bbe84\r\nMsg = b0a3a8aa5d4bdfbb4c5c52acdcc60405c379f752b077eed42f2d7777cc0329047b322b9837d5f655ea445b578d9dc7e990a3c6f97cccc6cad7951ee948194e62\r\nMac = 153eff3c035db2fdc752ebd22302adae\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 120\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 305ec69b23e4490e0f8a5241cb9c8c85\r\nMsg = c641cf589020b94026ae\r\nMac = 3bc054afa9771970\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 121\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 28929286bd1391468ac75f5c03689f74\r\nMsg = 3813592f268a7a863c3b\r\nMac = bf1b514d2f899620\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 122\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 1b3163e2d3a471b9823525abc7543c4c\r\nMsg = cada03e8c967f9732a81\r\nMac = 53702fa98e6f9a19\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = be1ed49e2cb0caf6b6a0940c58453b93\r\nMsg = 4a348c5ec996f7a97ef0\r\nMac = 3358d143dff4adfa\r\nResult = F (1 - Message changed)\r\n\r\nCount = 124\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = f18be18df045ba31b80f3283cee6a681\r\nMsg = 93006a06d7e6df775b19\r\nMac = f3252f061dce32f6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 125\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = b9dafe18a904ba761762ec3fe0e4120b\r\nMsg = 173887316279a47fc699\r\nMac = 884f5b21d478d60b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 126\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 31fee08df80cc1009e661230e25939fd\r\nMsg = aa54ff7466923b265fb5\r\nMac = 03dd2a9616f653a7\r\nResult = P\r\n\r\nCount = 127\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 65a28d970b2bc7afafb4069c26d264a4\r\nMsg = 1aa5a3a4e6c5e5394e50\r\nMac = e0423589b192caab\r\nResult = F (1 - Message changed)\r\n\r\nCount = 128\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 6dc38e37d1379732df4dd535db88d17a\r\nMsg = 0093c6d94aed50b398ad\r\nMac = 19b08e65d391c491\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 129\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = c5329fd99848e1cdcfa406ec09745ae2\r\nMsg = 6d83d0ad7cc7efd0d2ca\r\nMac = 8ec2709e1466f8d3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 130\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = e608914a930b9c300b677afcb8689d63\r\nMsg = 146629e70b37d8b83ee8\r\nMac = db78a639bb15c84c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 131\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 0a998d3d390f5a80ad398b2070489984\r\nMsg = a91c1a8d9d268ad153bb\r\nMac = 5643a8c99b99d944\r\nResult = P\r\n\r\nCount = 132\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 2b6f78ceace47509a43ceb6b761e7866\r\nMsg = 3c0a41a78240c9d2fc22\r\nMac = 811acef50d6c1913\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 133\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = ca481f557306f9ce386edd0cfde375a5\r\nMsg = 9f3488736ef6e2c3a51b\r\nMac = 57e8a0e5965399c0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 134\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = c0dd1cfb3add04cd67a8e59be7ac8dcf\r\nMsg = a7c559c82776f429ac31\r\nMac = 7e43a2b43d030ff4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 135\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = d3130d9e5ef516b6bf172953a37913a1\r\nMsg = cbe97e14c3100c9fc564\r\nMac = db9f674a2d0e9ed9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 136\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 9ec8661a880ebfd15fd8b04f2ae09dbd\r\nMsg = eff803e0fc809cc48587\r\nMac = febec8d41b6bdc1f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 137\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 6c2b091433833a0ed915354dcb70d982\r\nMsg = 90f1416768fca7dd48d0\r\nMac = f6ada24319e502ab\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 138\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = bc79d444dff9d9e722effab07b068cb7\r\nMsg = 07d5a925b724e2443936\r\nMac = f964302c270af24c\r\nResult = P\r\n\r\nCount = 139\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 8\r\nKey = 1a15b24ba5d9648358f2c39c9da8512b\r\nMsg = 15b94910853a8f23dfb8\r\nMac = 8cdfbc13239e6aa1\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 140\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 618fb69c8fb670250c306b3225687d17\r\nMsg = 7f54845a57d916866eff\r\nMac = c0d4db73891bb1efa232593407856808\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 141\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 8000aa080c127cbabfdfa5d9d9728c7b\r\nMsg = e53101e6eabcda32c13d\r\nMac = 5671badc409d4b170d4c861a0b3e1fec\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 142\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = b05b5557ab145cec2f00706dbc6a3c23\r\nMsg = 5e2f601395ec406fcf96\r\nMac = d00243508d25804548c4b4b512cb1906\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 143\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = e8b13346b61daedc1f9e3b49df8d1cd6\r\nMsg = 0593365419e0f75b6323\r\nMac = 871eb97850a776e7ad498467064484f9\r\nResult = P\r\n\r\nCount = 144\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = bc498326755503ff25d02805eb351722\r\nMsg = 9ece4c82fe9d38ef64ac\r\nMac = b5e88af50d1cff3d2b6d304edf042c43\r\nResult = F (1 - Message changed)\r\n\r\nCount = 145\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 4d248e73886a0e36b3ce7c6113477f4d\r\nMsg = 8de6fe3b24fd6c202ef0\r\nMac = c1a4f6d0ff7330171cfe570e900ce2c8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 146\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = b1b9fd78e3f8eaf4e8c91da62b2da534\r\nMsg = 482ea6f652067e8b791c\r\nMac = 63c6994c98bda91723f832020fa7d223\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 147\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 85e4e63341658144a99fbd17d94e3177\r\nMsg = 21ff834bec4ec6384522\r\nMac = 580c1e549a2ceca4743256a9cc972e84\r\nResult = P\r\n\r\nCount = 148\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 88b5448372548e6aab1b262630a28a47\r\nMsg = 36dbbff560ef04ea731b\r\nMac = 5fd17fd704baaf1ae6b3330ef2989dae\r\nResult = F (1 - Message changed)\r\n\r\nCount = 149\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 8cc76730ca47620d0b437112a2c93fd0\r\nMsg = c73be9f019913f2222d9\r\nMac = 2c73e2b5b84d8f4f3db1fc92831a03bf\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 150\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 7b657c640f155f1ff461c83cd656614d\r\nMsg = be9c5e77bf1b9dcbd4f1\r\nMac = b660ec36c0c0b4d987439505f1bf57e8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 151\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = d5044e9f10bd274aad4f7e605bb828f2\r\nMsg = d0be84df789c98dd125b\r\nMac = a26e513b09f184caf8d76d76961d1466\r\nResult = F (1 - Message changed)\r\n\r\nCount = 152\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 24d6d4bdc9fc4cd05b2867e9123acf18\r\nMsg = 0f9703a3454c25c0b105\r\nMac = 41676ddadb7b960e0269c8a59a6d9b91\r\nResult = F (4 - Key or Key1 chan",
+    "ged)\r\n\r\nCount = 153\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 6aa049d06bf66d2e2b65541eaa3730d8\r\nMsg = c562ab24ae5cdb7654df\r\nMac = 0d4d1196158fec46bfa754a526ba4a25\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 154\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = cf3727509577f1932bd7a92589c11e67\r\nMsg = 831188efc5d1f6dc9bb8\r\nMac = b5d162c885d7d4f6f65f4188d6582240\r\nResult = P\r\n\r\nCount = 155\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 0bc2fdd890c19882640f8d4188b88b9d\r\nMsg = 296828cbee50f41d19b1\r\nMac = e583d77645a603d841eaafa8860bfa91\r\nResult = F (1 - Message changed)\r\n\r\nCount = 156\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 5bab8051e2520b75673068b9cda93cba\r\nMsg = f16cba03402f9924daa3\r\nMac = 97f7eab25dc3ab017a9affc0e400dcc3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 157\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 7ac46e3249ca28e1ef0531d80fd37c12\r\nMsg = 3e9ddb8121760bffb7c6\r\nMac = c6eb13d5087d05b4eba2e74b283b7fe3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 158\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = 40f78f7ad3eede36e13bce222c6a4bc7\r\nMsg = 4fa8ad212ef73d37d48e\r\nMac = 3831419e62b51b7ced0d9117e48fabf6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 159\r\nKlen = 16 \r\nMlen = 10\r\nTlen = 16\r\nKey = a1f82c9924411e98e6f93fa0d07559e2\r\nMsg = 7d4748147575bc0113ab\r\nMac = c23dbc58fe22b34f7b007590558a3080\r\nResult = P\r\n\r\nCount = 160\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 84760f98ec565d281496b1295b25150e\r\nMsg = 9ce942ec81f8226506d48788e3acf49fcab6da22\r\nMac = 606c2f459a9ce198\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 161\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 3b6dd5169350b230774b02b9b44f06bc\r\nMsg = adb1ad81dac0ebc650d48f7a9329755a83f293d0\r\nMac = d7ceaa858508c476\r\nResult = F (1 - Message changed)\r\n\r\nCount = 162\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = f98d00755bcb45e6822121fe7cb03c8e\r\nMsg = 7064a2491f716f4a2969815e4a281a54690ced9f\r\nMac = e14634c400b9f561\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 163\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 5d27cb435e7724a246f158576fdbac68\r\nMsg = ee8ed4c12b0cf7c03bf91fba31a6a7b2d64c36c4\r\nMac = c10b474c0077a39a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 164\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 098c12058a0bc5951fc092aba322e1a0\r\nMsg = a2b76835229017bd0e8167a40ea1e2e18cc5db0a\r\nMac = 1d44128c3db0f7b9\r\nResult = P\r\n\r\nCount = 165\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 74f7f6516a17d5386c289756240241ed\r\nMsg = 8eafce9ba466fd53eb87f499d7c76bd486db0e90\r\nMac = acd978e0065375b6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 166\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 013bba67d26c7e52ae48dda3b67c9c96\r\nMsg = 48c0d53b85e6fa4928d3e9953afb9b451bc91a48\r\nMac = ef41ce0d30baece9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 167\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 14cea4c46d837c9439b088fba0e9d85d\r\nMsg = 3477384c396a9e9efb3e169722cba779fef240c4\r\nMac = 902158426696c229\r\nResult = P\r\n\r\nCount = 168\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 24f7b08fc2e6af6402243e22ca0626f9\r\nMsg = 914cf55a3fc739b5f87ac7518cc4171b4499d951\r\nMac = b775a3c1dc11d074\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 169\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 35b5428d440503773f30748ff843be68\r\nMsg = a5e5804cfdded4d610d1b05b7313ece84f369ccc\r\nMac = 6dac0947366be803\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 170\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = c8afe4e5b1d019c2efdbeda65d874ba9\r\nMsg = f739e632436470b5a1db9fa9796ed384c0523f40\r\nMac = 04c8aceaa8f8c3a1\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 171\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 05a7910edcd7252b37e6d3d080a9ee90\r\nMsg = 702db7761abb9b5de41a86c8659270570be9d52d\r\nMac = 889a990539cbc30a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 172\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 4c8b0850eab7b212ad96dc7a032f8855\r\nMsg = 2de32ff6ca41b4c97424b121b8ad4edb133c00ea\r\nMac = f5ce7f46d457ec37\r\nResult = P\r\n\r\nCount = 173\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 687bcb63755f2b5c7daf4a154e8525a8\r\nMsg = 02778ca34db1cb5df76cb1a7619448f67d63b26d\r\nMac = 49d48bb0a684c6f2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 174\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = f8c4e562fde4379b08e512b0132766a4\r\nMsg = 627868b46ba546252f4eaa1c25205ccff72902d7\r\nMac = 5459c0ac5bb6701a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 175\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = dd235b05c15479dfe0326ba206ac784e\r\nMsg = e044ec24ddc0605bca89925a4ebc0234811e2a0b\r\nMac = 5ed0a03da09555b3\r\nResult = P\r\n\r\nCount = 176\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 665c2d7d6e69c2ce8f0d06b41038b83c\r\nMsg = 4fcd7541000cfc223fe9da6a030c681d0fb926cf\r\nMac = 1f022feb38ae6131\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 177\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 2efb7cd914a59b6ad63b7d1812f254db\r\nMsg = 67c9fe3e163787705a20f2fc8c468c4f771991fe\r\nMac = a866d6a31c0b42e6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 178\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = 74f6fd37ccb4b7702bb3a03b7322c0d5\r\nMsg = 011ecbe98c5cb7734476dedbb852e2474a5ad594\r\nMac = 707ec713b9bce5d5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 179\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 8\r\nKey = e673b3a954a00082cb7516ca9a54d9a1\r\nMsg = a6fbd41a838bdf0fab3e7b56c27a8c18dc4bf970\r\nMac = ad4dfde057b54a27\r\nResult = F (1 - Message changed)\r\n\r\nCount = 180\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = ce5bf070678cb07e963263b1562ff793\r\nMsg = 2bd10c4397a19fc79a307116a0847e0aaaefe813\r\nMac = 299e5910f128a1f091dfb6b70f6a60ea\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 181\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = bf144c9bb974729aaa1188ceefdf85e1\r\nMsg = 5e1ef2ad86ceaf5439fe87d2ec9bc41b52e5ba01\r\nMac = 58b4a32ae55966e42712721363ac9eda\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 182\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = a0cd07b684bb9e0e6692e320cec4510c\r\nMsg = 6e1e490a30f0c9e3d3b79f1c36aab742bd67c585\r\nMac = 24dd518ffffc1070f13d50d0bca42711\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 183\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = e3ceb929b52a6eec02b99b13bf30721b\r\nMsg = d2e8a3e86ae0b9edc7cc3116d929a16f13ee3643\r\nMac = 10f3d29e89e4039b85e16438b2b2a470\r\nResult = P\r\n\r\nCount = 184\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 4073251950e3331d03d67a2399576d28\r\nMsg = d5dfd0321b26e578fe987456ff061dc1cdaa4161\r\nMac = ed2823fb8fcae918064cef6211646e50\r\nResult = F (1 - Message changed)\r\n\r\nCount = 185\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = b08f47101365111133d974e8f0206507\r\nMsg = cefe484955fae117649ec158416a7439f29a596b\r\nMac = 3317717c6c0b138275090ea961c8d58f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 186\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 166fb8d0e110124c09013e05688605ee\r\nMsg = 24c65f715742da7d06046c783a35b2648180b4f2\r\nMac = d27901a86dbf0ed8bde0d69203646b7a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 187\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 20f6f56117758ba47a08dadf93a59056\r\nMsg = 7514e0f402e73d9c0b0576782011b2e6b2080a6a\r\nMac = 11cda489b6dc0ab48d111ee6cb26a829\r\nResult = P\r\n\r\nCount = 188\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 7fa6ef35ad594a09cb74daf27e50a6b3\r\nMsg = ac0d616ed7dd3c3e86b3507d9f2bdc3a807d490e\r\nMac = fbad2fc6c9d0e5d21b25445f499eee10\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 189\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 815871a8300471dc325f8289d0d37211\r\nMsg = a8ff31e90556236cb4df078943c1f2528b42a7ce\r\nMac = 5544c93de980bcf653354ce08aa9dc3b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 190\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 06aa3f6fc20f867b42ec234a1bcb8665\r\nMsg = 25df5cc617e6e68be181694721a2a112a1bfb7c6\r\nMac = 2eeb7ab470caea3317a6336f5eee24a6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 191\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 860f8fdb021b1974d40e3d4bc41fa967\r\nMsg = 6c982a616510db422cc2f1beb955c3e7a88b6097\r\nMac = d2280a55cd0bcd18846b4e30db6322bb\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 192\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 15105c6285a9015d0edd414d6a806bd7\r\nMsg = f1cc55636836e67909ed3a581de20630226dd5af\r\nMac = e9cc5799a630c6f26087c1bd3b6f1791\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 193\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = b47aa890b03a8ac0dbc8f96c30fdf7db\r\nMsg = 58b06c99e0d0256cb1c556ec3b48a3bce73450a0\r\nMac = 3376cacc247686832736cea7e67e13af\r\nResult = P\r\n\r\nCount = 194\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = dd057368033252d9bb2081a0b1a0229e\r\nMsg = 81de8f50fbe35f7ed95430e74d28666c885b6100\r\nMac = faa08c5a3a4ffdce81ca31873197d0",
+    "35\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 195\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = baf5afafd7d0c8ad42a44e4e0a90fd2c\r\nMsg = cc5a4209a6a60dcf12621e17150b4576b918732e\r\nMac = 5a43002d9144a1d5e48c2dc8dc167a52\r\nResult = P\r\n\r\nCount = 196\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = fa6405355bfb5065dc81e764d20277bb\r\nMsg = 5dd1febed8e94d4715e772c3295b48eaf471daee\r\nMac = 29e96ce5ba930134670b3c68b5c512f3\r\nResult = F (1 - Message changed)\r\n\r\nCount = 197\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = ad2e3d3af6195e74b3e43296b1f618d3\r\nMsg = ca776f79b8581014ae58a4d533b60483fd1fbbd0\r\nMac = b32ce1f493b126fccb9829d4dbe76382\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 198\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 04ae7190f0cabd117d30a359f80b720c\r\nMsg = b885e5e147f967032ab2552829a6e09210c44a45\r\nMac = 9386d73a01960ab399bb7d290674b21f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 199\r\nKlen = 16 \r\nMlen = 20\r\nTlen = 16\r\nKey = 51fdc65f6bb0d20a3c08ac1493ddddb2\r\nMsg = 1f0a56fb615b594d938bb8a27f4b2f5463ee9a61\r\nMac = 8506fb1b74806381e2654c8764464d8d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 200\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = cfb7e930b838dc3644f6c06f2ad0c8d1\r\nMsg = 611db4c194dbb54d80a4f4fa731cd9a6a330eaca734d3351f2cfebaba4bd541d86b3e35b4c1fa158edb0d15d610cd359a9c24878117f77f6b284f0363a576e0ef0\r\nMac = e9589a711f5d4a5a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 201\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = d179dfeead9d765d000462785459b1e2\r\nMsg = 795ee78ffdf302f3f1f2b31629ae918409cb42979afe3752dd14968d603678520e6b55884b5ebcce416248aa74b3cfe39dfedc2bb5246001503ca4d62cd7826f0a\r\nMac = f16ea84f554dfb54\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 202\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 22b7eb25e688672ab0e17206623094b0\r\nMsg = d830b16fa236a1dbe60f6db8d7e81a3ddb5f658c9f446e94639cae3699ec2ea6afb4fb152939d58df287271cf4b73c34e66eaf5265a623de47b135522c7aaf9f55\r\nMac = 16229efcb7523025\r\nResult = F (1 - Message changed)\r\n\r\nCount = 203\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = a64fa98b4662d801159f61eefd1c8bc5\r\nMsg = d5982c462ad40458660cd7b120ce07fce9afe812caedcebdee536ac19b5d561d679dee8ea85d62552c86093a2ac1f8d179dbd4fc006ee4b16ebe6afd2be134498e\r\nMac = 2f9a2fbcb96461fd\r\nResult = P\r\n\r\nCount = 204\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = e4fb10325d18666c382e6cc2442381e1\r\nMsg = dc28484ebfd293d62ac759d5754bdf502423e4d419fa79020805134b2ce3dff738c7556c91d810adbad8dd210f041296b73c2185d4646c97fc0a5b69ed49ac8c7c\r\nMac = 8f771ffe0c8d3445\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 205\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = fdcd3459061c36c9a0daa0dcab2b967f\r\nMsg = 1cfa3342540d03ec3fcc8378c021443ba3321fbc26dad7c5b859faba004a082a21d6d7a43d2836cc3820d1adbe4c55518714d48fd9346a254f702107da8212f605\r\nMac = 6635f9e17949a14e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 206\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = fc593384e6eebc508d181fc49ee10e56\r\nMsg = a6c891c9dd1fcc982c35bc74cfe71651bae424602519672b466d80e160af51eefccc5fcf76467a25bce1a10853a0209d9beffbeb53228fea5f1e77ddc956ade207\r\nMac = 7a6fd94e3928d2a0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 207\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 4e4ff248f591ca27665960d9357a8de1\r\nMsg = 198d5c9c4aa35d12b62e8c4bf6f3f141e6ebefd8ab396c71f55e32bc82b094cde409547383bcc4c5e5cd2cfd2d616c8ae273e260f2c98e93f7267424b8c2421bf3\r\nMac = 9140f91a0cf70762\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 208\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = f20826990acdf225d9451a3d22f89747\r\nMsg = 03d340904ace1cd52d4b72a96d96afd77aee68ac3936415005ed0d56f46036915b1e5f2994ad49effe7bf3ee46170642e5a16f2eea804e68fa520fb79529d6c09a\r\nMac = f30b668f16bfe6c4\r\nResult = P\r\n\r\nCount = 209\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = c231ea8b75c65de68c49b76e7a3128de\r\nMsg = 5b50879191a6debdb96c0bfaf9086b7dc6e25594416b08d2c75fe16cc347d2e3c7410fe3dc030a6c161ea22f6b80973bc43d42d8558f83b32a1bfa3c03757a4d62\r\nMac = 65ba53ef4711e807\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 210\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 8ef18639bc8c831dc0b4aeeca25eff4f\r\nMsg = 094c4d9baead7c5acd7dc58f3b4b4f57f1406b4e6af81a034d90cfa94c01760f4cacb4d2c63671d16d9594e1116b0dc2c39319523afac10175b1a485a240f7cf3f\r\nMac = d84f89e16c3b1633\r\nResult = P\r\n\r\nCount = 211\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = bab9d79aae4a1b282d8c5aa35d5c0876\r\nMsg = 02815f53c2be5f7246d4794895b4b15b6c3944819dfd3051b371f6d7d52d9f8ced84fd84095c33ea013c78aa5aa7176d6aa9bacabdafe9bab89cce4d7c183b9c0d\r\nMac = a01f976031bc8140\r\nResult = F (1 - Message changed)\r\n\r\nCount = 212\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 42b97f583f64d88358885c66add5d03a\r\nMsg = 187fe16a764c0987a28088f5cfcf55a6b9591b6395d2d41043e09932cbc4b8ae073d08d39da9799b316eef2ed89851a8cfc4dc1c6d3cbed95663e0ecf25403e61d\r\nMac = 0820b1ca0cd34e5f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 213\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 4fd555bd3a5253a90b68b5d4d46bd050\r\nMsg = 1ef253c61ac8ac66734ea80eefc1dc077edd660dc3518b5ecf709f10302925a72a3938e7449f2ae707506a67022dab63113242e9dff0d027aa3d22c8462a558165\r\nMac = 3770a6cc988a28eb\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 214\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = d3a8eb3f9e5fb264ff098d85c28dd763\r\nMsg = e97a0986bf75e0e821f5adda80778863d9d479bd8ac3e7fe64a053f8016c465d581487278ef6923610a1463bdedcded62aeb22fb210dde9a0949947f8c6a6e7753\r\nMac = 4947e6e28dbba216\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 215\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 3043857fc40be37fb0bda4f46894690b\r\nMsg = 14874a8b59b0178c5ec89cd7316d909371969c1a1a1bc8a29f78341d39ce085e7e2aad7c350a3e7b691d3929bc4b7b47fef56be9fe7e7520a00abad5308505f8f6\r\nMac = 1a8c82e9109a68a5\r\nResult = F (1 - Message changed)\r\n\r\nCount = 216\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = b325d425c810d22deb3209f29c5c1377\r\nMsg = e44c4202499440c12109296a35dfb1f669f97e7f415cd251a5e36943e134a548f0f2e841fa3541151b374c04665053382a24b99d731b99f3d411aa22644f66cd07\r\nMac = 84faaeb5a9756a27\r\nResult = P\r\n\r\nCount = 217\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 7cb6a84e99f5573c1eb27c0078f2127b\r\nMsg = d7fa7be9c10252d6e41bc1a08195a344ef77b81785cea6b4ba453d398bf6ffb31d80e0d6a45a4af283676422b5ca94c76bfb4334f61ae0abe884278976a5a3bd21\r\nMac = 64fa7f9284c24f14\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 218\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 00341fb81209c2abdfe3a9d607b98277\r\nMsg = 74f6fd37ccb4b7702bb3a03b7322c0d5fcc657cb2c3f1361488d853589d2d6207359b65d62d896ed66f217395000c2fa0d11f956332f2d4bdae55251adfe903b41\r\nMac = 4cf05b6e583c70f9\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 219\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 8\r\nKey = 647a5be8a66c83b4b238975388e15d00\r\nMsg = 0db33eda4188a9165147e24e40f79fee1985eb68d51627287e9c4ec995a77d89b27fb2fa6a6fd3fb7563f3e710b6d20ca145a25f9ac8116d9f628395eb769f75f0\r\nMac = e8ef4f3cd7442246\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 220\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c98fc3416457d9eed0fa7ab1dc1b8a6a\r\nMsg = 190ae57ab8bb70464e4a10c112a54c646438301b5662f3536c26d754a02451d1a9c76abd7dbf656115b2a2ac702ec2cadae30cf86e0f0f96da39897d6222889428\r\nMac = 1bea94a457b2886e9098bf3ded932a3a\r\nResult = P\r\n\r\nCount = 221\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 87428d5a53f750abdb335f70ee13b5d1\r\nMsg = 7bb0c2ecfd141e7e93a897b259732b6153af3542eb7289b1a18dc0aefeb4d129c9e0e27d7ef25d3afc9945277e75cb87cc7d1c9cb39e7e6ab2a49bbdf65e1c6d89\r\nMac = a854d2da46afb77a787f0606a69cf467\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 222\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c725d9ef0dc6cfca84865cf5cc91d403\r\nMsg = d3208eb695e84c7a9250378e18be2f231ca3ebe72ba68e3ea4ff7bcf25206b43439bbd497e400dde738507cb542c7d6f961fb8bee99f0c8a6d9daf022368cc78a2\r\nMac = 35d57445a5f10fd567595fc668293e95\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 223\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 13e3fe7856cd680593a85cda3d6ff873\r\nMsg = b208e5a1a852caef0795150cf8313ee0cff06e3d28d438c2351484005661cbdcea6d8a3466aef0c6a460da4d7dc902ec99c073d086704112085a76dab0994fcab0\r\nMac = efb2bef5aae555463ebbeebe69791459\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 224\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 9b8112c1fb29fba2c8b0d8f16481b993\r\nMsg = f54105a04a4a02a1a07e020a6a4f4176e9c92bf40018ccac434988c650550c87625b84bd232d0e5ec20e6f6c46ba061b22a7fe36098bc7bf031ec6d6c1214bdb2d\r\nMac = 673281bc0effe92adfac4fef49477ee2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 225\r\nKlen = 16 \r",
+    "\nMlen = 65\r\nTlen = 16\r\nKey = 82e71e3ad1bc9a12a46e460a05ad9c05\r\nMsg = 41fb3dd6df78fe267175297e208ac753d50aaabd9edbf5e45385dfb47988b3d966f31be7a6329fd89e2869bc6f7e4bac1e3a0300f193bdc21c03d9629c9fefaa64\r\nMac = 36f7df58abb54a053988cae066110ecb\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 226\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = b46e219217ab73c34904e24c6d995b72\r\nMsg = 887d6576572a3d8f6a1649394248c4d09d15026ffa930c0659508bac4243e7360802af084f363c2bcc4c91a04c6e86f4f8b22615d7915564949ab60b8267cb91dd\r\nMac = 10c1d8054ac549ad24ae4af2d8de97e2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 227\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = b66edcc59dc9d8e34bea3baf4bfc0d5e\r\nMsg = 57caadbb1a56cc5b8a5cf9584552e17e7af9542ba13e9c54695e0dc8f24eddb93d5a3678e10c8a80ff4f27b677d40bef5cb5f9b3a659cc4127970cd2c11ebf22d5\r\nMac = 0c5864eefc04a6cac4f053ab2f65f851\r\nResult = P\r\n\r\nCount = 228\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c607f631d792499ea43586b81fa3e2f2\r\nMsg = 21ed22abc7bbb62fb2d51d1fb8830ca95b16213f56291af976274934ab0d43805f71d9b906c44973f7d4b59b7a94d35c2220e7405dfcee98499c1c1dc92a89d7d9\r\nMac = 4e65b3d58492a0eebb66928a8214498f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 229\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = d9e9136339d361949242e4d8a0cd6917\r\nMsg = 419b9c9b093052577837862900e7de29273eb0678bf6238223b59176c78430b6f382f27bc8d9a95b53f26f1d12e545ccb434fa0a21b84fa7badb5872e208254fbd\r\nMac = 6c81094aded51ccd4da38d0412e7ca67\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 230\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 6f349dd8b69dd41c6f246a1685115772\r\nMsg = a5a3c8afe5b84e0c3ba4f708a87b596d1b7c8694dbe691d7240e4e4815ad5aa4ca7e5b82c50989d092b96e80aa35e97f99ed79e75cf3b8750d0d263dc208289cb2\r\nMac = cbf41299c35e65fa4e2626430f95051e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 231\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c15e4e552c9197184b3eb0a74f5fffe0\r\nMsg = 7c4699a7d9e2d9f31410f20029676f3c97f5793f6732f95f6d33fd7ecc205d27b8e89eda803316a3cb9951f12111b4a6aeac606b43835a469eede86eebf63e5e8b\r\nMac = 77e77de5c5600900e5b928d4be3d5f8c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 232\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 2eda9b2c6d7ad95b644a8739580ab4a4\r\nMsg = beadccddcf392ee56a8913f057da183ab06ec538e581b52c027ff7f63574b32d8bc4116efa1c56f4a4a851695a87f5fc5f7c47b46fe67b0400f2599fc80fe68d7f\r\nMac = 948e63657b8b6e2d130f6f25369d6160\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 233\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 233088b67b741f07859d122a6a406d89\r\nMsg = 5717ed57ca0b6921f04dcacad34e0f6210c36673dc9f4d92493ff733c6e5f1c2e56805ef622a5f496049ee0ef51a0d41e9d363febb87070be558e8af61e86dc76c\r\nMac = c778152b00760fcd85bced0f58861d13\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 234\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = b7471a8b2e50fb319f198a09cdaeb319\r\nMsg = 385f9fb139dbf88561b7a500b0c7b835fe57e2698c6d9f76de4fae6dcd45c47fd8a0811ebbfba35f43c17aa360f09c767c1cd9b70bb671fa638e852ace97cc73de\r\nMac = 1a8b81be875a4814e3f988c274784a63\r\nResult = P\r\n\r\nCount = 235\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = adf072ebb71e3400a2175c96fb0007a3\r\nMsg = a49840ab727bf6b03015eaca3f15a2bb64fd27b51b27fe7a2e0559c287ac8fdd4294ca990799ff66974624b8a4539dade66cf7f06b35d8dd2f8a36e6ec0bc83533\r\nMac = ceac74b3af8750467e3b3c51624d96d1\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 236\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = 1b1d471add4e7f4fe197e3a4a44d06ab\r\nMsg = da06bd1405028d93fefa3c037b5ad551879451a28314bae86a7591b359f56e4b4e26e6fb2fe7b1af0f930cc2ae785d113e8b16546d59dbae9f41e7827be1ac89aa\r\nMac = 16d0021b1f9c00b37fefb60af3358d87\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 237\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = af5d4991c189dada2cb552c3c52d599d\r\nMsg = 1bb1e0efa2d6811d2370a039a0c47c59683befbd46c04257f86a468ae25ba03304e865e62afae77a62b3cec7b3556aae0c60475a7bfb02c69f955c7f60cc8dacdd\r\nMac = d7056fe01f0ed1b20adbe05cbccc544b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 238\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = d149441e667b245d4640e04c53ca6f51\r\nMsg = cbb34794bc8bfdf93d3c8d9f87ec1482b516b48b1e8a89b5e3b5df70c423a243384215b4bc69c76c6b18c497cf82088af74839a8c98895869a16294dfc094360d7\r\nMac = 64f5e8dce5c3e0f9cc224e306de70b87\r\nResult = P\r\n\r\nCount = 239\r\nKlen = 16 \r\nMlen = 65\r\nTlen = 16\r\nKey = c2f5d4837f9f75fb440c3bccad7c2e69\r\nMsg = 6a84594c4b3865f047c96038060b5b413db0d4e081c62e405b815ecd9e3be651f8b9075dc8b032eb2f87c1416a5fe4195f51defe75f671f9a92d966ddf18724075\r\nMac = df8c8c61e8d604e24c7e3d0115dbe898\r\nResult = F (1 - Message changed)\r\n",
+};
+static const size_t kLen40 = 69750;
+
+static const char *kData40[] = {
+    "# This file has been modified to remove the 65536-byte long inputs.\r\n\r\n#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = AES KeySize = 192 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:38 2011\r\n\r\n\r\nCount = 0\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 771887708683bcb3577fbd0e6c13cad39955eafdc226d17b\r\nMsg = 00\r\nMac = a0db9bb6e8891e92\r\nResult = P\r\n\r\nCount = 1\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 733fd349c56d1086794eb20ed59ddc89b065bb8533b968c6\r\nMsg = 00\r\nMac = c76f82937b457105\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 2\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 761d74be5fae170a1bdfa16081b44c1e49972e15ce0818df\r\nMsg = 00\r\nMac = c65feb3d5336dffa\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 3\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 40f4a2261f154280a311f5b172c7ae34243cf2c59b98d37e\r\nMsg = 00\r\nMac = 05d920e78520839e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 4\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = e27150ee958b998c8a7e8b9324ead937d15580d09d6ffc3a\r\nMsg = 00\r\nMac = cf60783b5defbe3f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 5\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = d9bf5efb694089b2de533b1a65c12ae96d8c5bd75bd67fa5\r\nMsg = 00\r\nMac = ccde2029fb26c8ff\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 6\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = bcc658b2e53d51ed00c567ded2a124f8d1f85fc72dce5f80\r\nMsg = 00\r\nMac = 35d0d9ccab5b0f41\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 7\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = e31fdf3891c9068f621430315fb1daf418c328baf5e6da97\r\nMsg = 00\r\nMac = 8802047c11abcf2a\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 8\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 16a10208e91807fc479607cbaa39fa9c7273d89ce403b796\r\nMsg = 00\r\nMac = fcedadeca37381c1\r\nResult = P\r\n\r\nCount = 9\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 50fec559910391abc23eb7f5eddbc26a1031c0abd0a29ad6\r\nMsg = 00\r\nMac = cdc41e9b491092ce\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 10\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 6e9e0ae953b1b486ecd6b766d7b961ab79bcdfe2ffe95e94\r\nMsg = 00\r\nMac = 5096b9fc700929c6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 11\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 48043c405ef221c281d1e88246b6e1dda77e072f9d10353d\r\nMsg = 00\r\nMac = cab96cfcaad5cc20\r\nResult = P\r\n\r\nCount = 12\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 10c361934fd6ff77a5051879ff228b08d841660d48b4067e\r\nMsg = 00\r\nMac = 167e7227d59d65e1\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 13\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 867ab71470f2dc3f5f11f8bfa7272dfc9c888e8e03323103\r\nMsg = 00\r\nMac = 96d9e7b084448004\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 14\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 5b10c228b447968267293ede9131d9345daa18c11d71eff4\r\nMsg = 00\r\nMac = f7055fcd9e8a8fd0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 15\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 997b712cd9295dc43cc19b40679f218c27af3e8c638d2e5d\r\nMsg = 00\r\nMac = 79a13778151aaaba\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 16\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 465b9364b3f06f3c28da12707673fecb4b8071de06b6e0a3\r\nMsg = 00\r\nMac = 945198b568ed3db3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 17\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = d233ef50e0ce1924abd315510464ce22de377026529085ce\r\nMsg = 00\r\nMac = 240698cd0183f002\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 18\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = eb6e828e01930a4b0afc8bda63160942ce32df7b2c38a8c9\r\nMsg = 00\r\nMac = c68fc388f0633ecf\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 19\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 8\r\nKey = 471b8a2e5cb08c21d87e9eb7ecff1d6e6fc2335581769dc4\r\nMsg = 00\r\nMac = ab5e7c91c35a0e91\r\nResult = P\r\n\r\nCount = 20\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 8b404993b4c3f62a57e4aef272788206c8076acc32cf3a1d\r\nMsg = 00\r\nMac = 6a3beff4d1d0e84ea4d4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 21\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7cccb84fa5c1c795bc05a05ea5bc6497acd2de2d193fba72\r\nMsg = 00\r\nMac = 557b8efe4ca9c4e603f7\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 22\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = f1d434dac8cefca05ba120a34840531bf1542c8fd03b1ff9\r\nMsg = 00\r\nMac = e2c299a2c5159eb777cb\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 23\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7fac8beb476b470e13a404ded315db1b15a85c2783eb3017\r\nMsg = 00\r\nMac = 50faaf26afd61c5f616c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 24\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = f5b4c2a9f096e13ab426dd8654fc7b8ae6a4a8d3daa16b9c\r\nMsg = 00\r\nMac = 535cde3d2c32788bf167\r\nResult = P\r\n\r\nCount = 25\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = f72879cc3446de9a0a43ae1cf08935b8c83f9265b8cb2258\r\nMsg = 00\r\nMac = 4eeea4a1847f2a30010c\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 26\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7021eaab074be980543cc70c809186d93652d7674c10ddd9\r\nMsg = 00\r\nMac = d98c93f4e0228ff68cad\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 27\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 7fd546397a9a0129861fb6815d419a307f90d259d55f3503\r\nMsg = 00\r\nMac = 13597bb97e38f400e686\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 28\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 563cfb49f1af034cd38d2112685a52ebce8dca93e84ca10f\r\nMsg = 00\r\nMac = 866bc21135b11ea1bc24\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 29\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 17e9555b9b4f89cb63f2e90aca95c27ead6a099bc41c4c05\r\nMsg = 00\r\nMac = b04b3bd1719d35e80e2d\r\nResult = P\r\n\r\nCount = 30\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = a65d24bd1ab92d8d294d654423412860e113c976f12ed76b\r\nMsg = 00\r\nMac = 83c1c0f3e89f6584bdd1\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 31\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 35555c801a2e7c68cd0c347e0f006be00fcce70fdd8d60ae\r\nMsg = 00\r\nMac = 7e3670cab617e79b3f57\r\nResult = P\r\n\r\nCount = 32\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 138b3db9baca13bc66e893efee2b767ce6a912b172c2cda7\r\nMsg = 00\r\nMac = 4686805681afa38cb7c4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 33\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 1bc05440ee3e34d0f25e90ca1ecbb555d0fb92b311621d17\r\nMsg = 00\r\nMac = 1e9f80432b39f7318433\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 34\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 5776d94b577ed26820fb13c00ab0e2d1a1c3589bfdc45cbd\r\nMsg = 00\r\nMac = 4d5f56d3543abed97233\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 35\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 22e493c1f2e27c9be7bb07fc00fdd51089582d139b0a9f68\r\nMsg = 00\r\nMac = efe1c6493542a8412118\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 36\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = d52f030107a2becde77331fff0c24cd72ef62c0f46ae3e6b\r\nMsg = 00\r\nMac = d1b9c7f13b189cd828c7\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 37\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = be31363e5144d9ff49ee67efebeef6d9a97e22f8a3ceb209\r\nMsg = 00\r\nMac = 03228a1a80d5f3d87b56\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 38\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 6a46492ab7ae5f3dbf16ee7b8876e0b4f0449f3b4f8cd89a\r\nMsg = 00\r\nMac = f016af853140edf22d31\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 39\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 10\r\nKey = 89ef2284d8245d87f88919d4d2f71a2df05ee21d85b7d689\r\nMsg = 00\r\nMac = acdbd54bfb1f20bb65cf\r\nResult = P\r\n\r\nCount = 40\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = f4e74acdeb91d0f0ab143823102d5baed1ffe168fdb5587a\r\nMsg = 00\r\nMac = 9c15bfd3c766f88190e54d395e5387\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 41\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = d9aa4efa5d75195a400018bd38f7d8cd53fdffe88df1837f\r\nMsg = 00\r\nMac = 4a11b22e871b051ea74db3f763f140\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 42\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 13439fb32b1514d48de6002f5d12e19e1ced4caf35042602\r\nMsg = 00\r\nMac = 1412aad5e6b7f0d924700b438e0aaa\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 43\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = ffead92a4a5dc1eec6d2e441de9a9e1b7a88c607c9a79079\r\nMsg = 00\r\nMac = 6fb18d51e9a30fe6b7a6f405b3d3b4\r\nResult = P\r\n\r\nCount = 44\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 176ad1686a81992e042d6497a305038ba0cabf74c6ecd8eb\r\nMsg = 00\r\nMac = f676bdc753ffdad36628b1724b967e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 45\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = acd58261bcb2eb6345af7290b1d216c3016af6697bf5ab88\r\nMsg = 00\r\nMac = a6ae95e5a23b5f5a2dd8c8a520b9a4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 46\r\nKlen = 24 \r\n",
+    "Mlen = 0\r\nTlen = 15\r\nKey = 0b5eb52135dc6d9c1f56a2571c1389852482e7aa3edc245a\r\nMsg = 00\r\nMac = a46221058177012b073c6ebc6aff1c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 47\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 7bd398d1b9b45f7a024e70e71c1ee7132795fbaa2d63306d\r\nMsg = 00\r\nMac = 119bc07d7f3da0be3a87844b425c0d\r\nResult = P\r\n\r\nCount = 48\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 47575b64fd4797cda8d67e9cf115ae850d7998c39d2f8709\r\nMsg = 00\r\nMac = 3f2010bdcb2fd70241475db9381570\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 49\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 68627d802cfc43bb1a987e1ef4401fa84e8a7b2b43759f50\r\nMsg = 00\r\nMac = 1e0e3333ca5790a7e7df0d6d4bf860\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 50\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 7f16b90a18deec135d32c836063cde963fc4e6daa1555476\r\nMsg = 00\r\nMac = 013e1d0bfc7a7a6c838ac98ce0da2e\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 51\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 3c89c59ab30eba6e5be8f69f597adc534cb52e94259780f6\r\nMsg = 00\r\nMac = 7f9f1bdba93d26cc3c1f022244bff6\r\nResult = P\r\n\r\nCount = 52\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = fdcf28931c91b4b79c8f8332b4eeb3f995eb1ed2fb1e8ab9\r\nMsg = 00\r\nMac = ad7f8852f1bfd65dfbce3bb39db59b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 53\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 8f570ddd0963a80abec82caf8883eaddfd63cee9f375fa7a\r\nMsg = 00\r\nMac = 82b16380d804b8eef855afb5eb839d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 54\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = cc1d70d3050f022442093e3210f5b45f1b610dc0f12fef74\r\nMsg = 00\r\nMac = d1dc61c2ef7e2cd1a4e43dc34c0ba5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 55\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = a8a1cf9547543045fa2f00edf79bd85436bc1ae1d746790b\r\nMsg = 00\r\nMac = 48fc14782a351553ea453a3ec2538f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 56\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = 123ff732cccb535ec7a1c47a6b0ead68df31094d896709a1\r\nMsg = 00\r\nMac = 8f29dcec0a5d026d6fe4dc64cd1d4a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 57\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = ed06bd049d772cb6cc5a705faa734e87321dc8f2a4ea366a\r\nMsg = 00\r\nMac = e3fcf2590fa9ffe093bbfe8d3d7b0b\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 58\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = fa18c0b348aad167b7050c0ef6e7caf0436750873c7e4929\r\nMsg = 00\r\nMac = 630915919b6108770f5c3deaece1af\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 59\r\nKlen = 24 \r\nMlen = 0\r\nTlen = 15\r\nKey = f66296bf67b6e91d8ad629c1b260cb5ca1985273925e73fb\r\nMsg = 00\r\nMac = 729f983d3b49b2ebf24eb04368a851\r\nResult = P\r\n\r\nCount = 60\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 2f4a6501d8fe7b65f607757ddff6ed87ae0681b98b53331d\r\nMsg = 2361d2ed837c14b6c231daf0acf2623779e0d952e98e14149308807f79145c30\r\nMac = 9a8ad7bb37d79321\r\nResult = P\r\n\r\nCount = 61\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = e2d592cb412e65f9044257d78e7491f9f80c8b08102c2d5d\r\nMsg = 4163b7ad671761a3f27394776970b413e35a2c43ca85560cdd3c9b407bfadb4f\r\nMac = ab85ac3a4f92ee2c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 62\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1534e69565cbc541bfde6901bd6e598e41a7a703091c2240\r\nMsg = 85b78269899a4712eaa9c3de041f5a74766ec27dd5265da8a117c6f277baaa24\r\nMac = 6b177203b17cc7c2\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 63\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = f0302d9a197a285909657d611ce12458b8d24652e91ffe8c\r\nMsg = 3fd6b98961f31c7b7fff0baf1cbb5884a9290ea7b5ee49915efb4b510b6ccd8c\r\nMac = d2d84fac8ecb665d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 64\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 2081442435626f7ce377132c46385510d9febfdd90c3f104\r\nMsg = c4185eb75fc23adff60d6380006a1c20fa2ff466ffddf67e99a421bfd729188b\r\nMac = 7373df1900b7a3df\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 715fb6fb464513f3650a9d0c3687980ab9caa9876d69dfeb\r\nMsg = d60b3402ad9f5f09375862ae7a370f0c744ffaf5001c80e3fd150730ab848689\r\nMac = ba39c81c18821872\r\nResult = F (1 - Message changed)\r\n\r\nCount = 66\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = a4d9f94e644fbcd97e0d993cb0af507eed259fbcf8fd7083\r\nMsg = 677acb68500d6cbbf77a3f34f58840f0c16044827641dc43d6767ce98f85dd5c\r\nMac = b129c1785acf17ba\r\nResult = P\r\n\r\nCount = 67\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 94b911cdc3137a6f7f32651b788eb82975660aea52b2c03b\r\nMsg = 549aa84bb182312dd016e3107f3b1f9c5b6a89b543561a450ccf713c76e66ad5\r\nMac = 7b92156f8b36d5eb\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 68\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = d3fff7b6f08dc4256239fc112890429fa00393e84e9b294f\r\nMsg = 15d1522654bcdce344b5d9753a0a6f31c859d547edf520478a8b5ae41506d5f7\r\nMac = 2d778849023fc9e9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 69\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 77bbda69ec034d73e02b06f0af30e2dab60ac80cb7822eb1\r\nMsg = 1e6ee96598bd014c95e9540f5cadfe6885cd094e04048e81633d1d634f065f09\r\nMac = d35f3c169f67b597\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 70\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 544a757bc50658d7e73b25688e7fef86fb1f9f08ffb33a70\r\nMsg = e473fe5656713b3b0e4fd12c640e8c542950577f446b01d09cbc41b6393ef81c\r\nMac = e1dad03ab8d2f432\r\nResult = F (1 - Message changed)\r\n\r\nCount = 71\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 1bebfde2d5468ba0a3031bde629b11fd4094afcb205393fa\r\nMsg = cf27b30423bd7e40d6b3aeb4b1bc01b40aec081aa00f2e3bc63ff61ac4b684dc\r\nMac = 617fdf927d0e4e42\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 72\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = ab83567833d2f3461b5fbecc0e366694bb5ea00933b2b3e7\r\nMsg = 58d43b9f1581c590daab1a5c56d6fbcff749e489acc3ed51ee6aeeac0104e6ae\r\nMac = b29232e882dcb8ef\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 73\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 0e0fece7b6b659b642668e8ba3dca330523e70279155f485\r\nMsg = d8c35129ca5a84e2e6723332217f0fd2e19fd06eb27d84a93b75276270f97335\r\nMac = d7ea4755260630e2\r\nResult = P\r\n\r\nCount = 74\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = b15763294afa61bc27e0785500ab5739136f51bc78b65562\r\nMsg = 8e8271b2758964fa71520f26aab6f870fa76ea4aa220475b3b379ec4ef8e80a7\r\nMac = 6357fb64482d171c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 75\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 6dd6efd6f6caa63b729aa8186e308bc1bda06307c05a2c0a\r\nMsg = d2c9c1300f5a7520614550f9d23dcba6b41be6733426616f32912f155045282c\r\nMac = a12adaf849719778\r\nResult = P\r\n\r\nCount = 76\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 35631c844313ac335aa0d590fec472d805521f0905d44ca4\r\nMsg = 766f9ac761a06f4e006f405f7b3398aecad253f5cb8653e091e17427ff0fc1f9\r\nMac = 49090265af87c220\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 77\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 35008ef5baf263ae233758ca237dec1a51d67fcd3573094c\r\nMsg = a8f1b7b73100cfe1a03003331d9d55b75fb0d2596ede723fae9240581967ba38\r\nMac = af6c2ebe004c6d71\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 78\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 6f383f798df8f4b9f0a99206cff82709c367340c7b3b0401\r\nMsg = 9668a011e5a3a613ddfd149b0e529e9e66665006f98e730400adb4a8226283af\r\nMac = f97fcc39e240b547\r\nResult = F (1 - Message changed)\r\n\r\nCount = 79\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 8\r\nKey = 9071be7a11dcf7a062d582dd5932f047396fd9eb71982bcd\r\nMsg = a8a6703044010f8301ea33bd9a808ca35838c9f58683ae3925ab67b9e1fe1ccf\r\nMac = 9065cbc5249ff8b3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 80\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 36ad69f192ae4dcab771aeeacf01bbd32609bcbbea8ff9df\r\nMsg = 6e60fac7c027aed4632444a95824e61e2c50aa3ecdaf09ed9cec92cec35adf63\r\nMac = b6bf70e67b315c256f41\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 81\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 0cbb1d567bce009d1dc5bdb8115607213ed9a516389f728f\r\nMsg = 634efdf89ce2a9fcbd38bdc0b4cece54dfd7532880e0b4ce6eb3a4010b7cb1e7\r\nMac = 4f0af4ff9a9c9e844fe6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 82\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = ec65afd2d72bf477c7fdd9fbe3f1694c328088cb5f39d9a2\r\nMsg = 10d0e88b0db8d515bdff3a791c830b28e4e3ff4fa63f45b31a3f73dfb457bf82\r\nMac = 7172095284694f5ccdf5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 83\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = a76b981540ce229e73064af4474a7ca4a042d03a6e6bdcbf\r\nMsg = 740d4b25ca7221d0826057701a6bfd66c50a82f010a57be8c5efa0af0f761764\r\nMac = 94b657fb57cb2fd6ed3c\r\nResult = P\r\n\r\nCount = 84\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 36bf85bf63b28093d2dae511990a0bbd75184044b033c66d\r\nMsg = c1fbbae61b81ae",
+    "bacf151f1bccfb1584f3a211fe797996938c03e806392e14c1\r\nMac = 71796cf452f61db7f540\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 85\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 67b79d9ef1a47867c7d21f19f99ed1085f17a9f092fac689\r\nMsg = d354c54151c9dcdf0d0fd8c51413c2645efafb2bf6b680b25ad76d3825a4c04f\r\nMac = e324e8d377447b40629f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 86\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = eafa8699695431ab3cfa1e87ffeae4b822a391653d2e9d78\r\nMsg = bd647990f7afec76c8f726d1de806ca0cae6f708b5024b514f11c4320913724e\r\nMac = b0da9d38a1e821ef1f39\r\nResult = P\r\n\r\nCount = 87\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 1fc4fcbc73dab4e73ed9d7606acdcd42b74972460c640fe5\r\nMsg = c86553a60da69bec1924788fc3ab985158a2d4788f33c01abead80974d26dd67\r\nMac = 992fd0b735b9fa9255c1\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 88\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 618041501dfcfdd2b60d71c04d635f6357ad8b0643af77aa\r\nMsg = e7e6b57e74ce7afbde3697e2a69d61ca615aa3dfd32fe31f5521e6ca79877613\r\nMac = c183b8f21cb2aac7201a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 89\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 53bcc9e9244e2fa1752c61e65aa5c592138447ef9287fdcb\r\nMsg = 92e962f0086591b6f61c2ce5af62480722ba6a640c3f53806c421de438358721\r\nMac = 105d286777da3f2a03a5\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 90\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 6d2429921f90a22893cb65c4530e56068e9944d0b0f61fa7\r\nMsg = ea2ad7b7d3f80793391af0328fbb594d79898e1047210628bbc7441e135bfbe3\r\nMac = 482a75ec0ecf1ea59f5c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 91\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 3100d3c70e823fee9a1bf486ec1c56771acae35246535de1\r\nMsg = 4e6ddae0d805afcd10a055bce584c848d050fb29fe8f1c64b18e1abfe46b6578\r\nMac = b0deaf1bb6d0425d1810\r\nResult = P\r\n\r\nCount = 92\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 79aa6c03dde4bc5949921563264b440ebef71b3298da67b9\r\nMsg = 879954f977e945cd4db33d20e6749a6832677adbdd9c7e262e4acf632f665f45\r\nMac = 9863fe041d191777067d\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 93\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 85467aa82c22ab019f9243c203b4371c95604dccee5d81ef\r\nMsg = b86edcc59dc9d8e34bea3baf4bfc0d5e117482a48e522c1b02a370e9124b379e\r\nMac = 54b2f4664eca96639f7a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 94\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = d37e7aa9215cb5c2c2fe81834f200192ada3dd0f4ccb9d69\r\nMsg = 064f85a23e049529c74c4f8267abbbe685b6a838841a9e304fdf14b835eee396\r\nMac = 536701771f51d2ec354f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 95\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 72e8c7d74cec3e248fe938a1159d8d969928e6da26b8cf96\r\nMsg = 58019989445d5ee855e0ffcf84e76f3383ae09cfad74276a3edaf05cbf8d714f\r\nMac = 182d3bf14cc391aef27b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 96\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 5f847950d2a5d44137110594d3c0afa995b36422ab36d044\r\nMsg = 70523bc397417e09d791a4976960e02636ca7144a5681cf7b116daa33eface2d\r\nMac = 5f0b325fbfaede23de5c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 97\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = b01e84220a7d514060a79088b754ac0beacb60e5b3a47020\r\nMsg = 036137cfed567fc5e234f18d6c2b8c7e9ae0f3fa526d6596e9a9ee7bf1abdf0d\r\nMac = dbe49af18c1e1bc99b73\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 98\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = d90ba47d7c9107b103cf167041dbd7b41d96016d93961917\r\nMsg = 2d53836a0437ccf27cdfe2bf2ad53f3082100a9f045cebe6b3031d21c9a6c5b6\r\nMac = 7252ee3b5eb76abeec9a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 99\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 10\r\nKey = 02e5a1306f612bdec098458cff3e691d93f050ba11ba6273\r\nMsg = 4bef96da992ab9386a3463213773f3ca7164813a15e014ab819f153386fa04a3\r\nMac = 5fac9c1a1636b66e2f55\r\nResult = P\r\n\r\nCount = 100\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 4c99ce359b8b82b67ee990529a10f2ecceadad456925a57d\r\nMsg = 89ed296a3ac03fbfb71422b9211799150b9d766a8116bebd48bd0a5068132dbc\r\nMac = e0e9583d784f87e0b7dd8fd7494a81\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 101\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = f085fb257ab64013b43a59150864a31e76c9ae94913a56ef\r\nMsg = b90ef6b773f250d4dac6fb9e62babad69ab424c96a8c0625987c030a91d27d64\r\nMac = 96f1dc9a1c668bb203428181c016ec\r\nResult = P\r\n\r\nCount = 102\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 8109f3208d5cda0f12141e40c85959b72eff1a937dae7f4c\r\nMsg = 49ab30d5c01e91bf113764342cb8ad32e6af945341a9c6a0ee2319a910416fd6\r\nMac = d13777a33f9520793eb8cbcec047cd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 103\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 1eba29062320df7275a51aa090ab489571057e64f0ff6a52\r\nMsg = 754f03c2e298a699568d10c3e40390e0f8c398283ce1c35dbc4916fe479b87be\r\nMac = 87dcee48dfaa43e8223a2b338b220f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 104\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = a04b976fa01411bcc9a3863cec91f486944fdca6e8754615\r\nMsg = abf45f39904a8f5766763fe80fa189ed9c6c15bb1a7a8fa0ae3058c9e5b87c63\r\nMac = 577aa39884335a4f66dce2a612515b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 105\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = c6f0a3692c9280c48393b0dd763e5d0b90477f34ad69f192\r\nMsg = 737bab64c8a0fd6a07329bd729d2ec88685cb5404bd13a40e095a61846dbacbc\r\nMac = d61ad5f6d8aecb7b3fc1ddb1aff64d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 106\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 095eb52135dc6d9c1f56a2571c1389852482e7aa3edc245a\r\nMsg = 47c577d1a7e69828b5c3264738dd334be8d7678ec77bf1ccb5fec3843f85ffa1\r\nMac = 4fd309a62435edd9b1ac8861f904c1\r\nResult = P\r\n\r\nCount = 107\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 2f853c1ddb31694985ea5e47322bfc8567fd7a74a46b0597\r\nMsg = 5719e671686e87e931c2c0e5842e907bf584d226e040645eaebb896b53a28c7a\r\nMac = 75ed56da2db0ffa101578118e3f620\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 108\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 67f5adc0842d7e1a4f8591d678334c95ac83df95c4341c30\r\nMsg = 6c8aaf2f91ba87b61814ed689331264c7bf98c2223c426a4ebbf7b0db692a8d8\r\nMac = b7c591522e9a5a4f3af3aea24121b6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 109\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 8702cfd1ff87a749ceb0a7192f5a872740b7fc600845df4f\r\nMsg = d29b6a2d421abd00a59b756af34bd72a42f5557a2ed40f8a7ea59b2e05ff01d3\r\nMac = 33b597665d375c95464af2ad56465c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 110\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 64ec1fd6af554485856b7bb3c0ad16fcd9c4ec690914a09f\r\nMsg = 0418a0afc13d6215c7bd68b12a327587eb63c145120ea626fce59c16f7d66717\r\nMac = 80a85e77efe4f47d8938dd9c55d67e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 111\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = f2991112c2cbd3038ae37b772a5090690006009f0c1965dc\r\nMsg = 231d72c9325f8c17aef4efc94855803eb2fc1eea601c84a98e8f7053840f0591\r\nMac = 14269c545a0e3d56ac9cb195cb6197\r\nResult = F (1 - Message changed)\r\n\r\nCount = 112\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 2c6d7fb9e92d98a1dd92e96f6b4013954ce1aaa5de242e6f\r\nMsg = 87ec7423f1ebfc37ee83c85938d58259efd16e3c8e55fb871e9998baa9cac81a\r\nMac = 782b7ebbada87c3572a3918a03305f\r\nResult = P\r\n\r\nCount = 113\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = d95a1b24964bfea5dd5a65f5a1398c6f9d43b26d98b47816\r\nMsg = 92f9cf56188322d18cb41d723847e6d419cd163e2be71b78e7b8dbdd099a99b2\r\nMac = 2498787836840fe1411a17f153c546\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 114\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 62f2490ba0c658848859fcbea8cc6774e24c9de979dd29d0\r\nMsg = 0822e3e6ba982091d532cd5271fbde25305d1f6e71880f81c618f267a9f122e0\r\nMac = ffb6c2a6c73245138ce06e458cf914\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 115\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 1841161a3752de1491b2b2f519d8447636e149437478d2ff\r\nMsg = 238e36b73b474de88226d4298121393ac9162f1736040bcd717b6e8db85125ff\r\nMac = 4d1656a2c8632260aa55a097451fe7\r\nResult = P\r\n\r\nCount = 116\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = d7d9a5f750078f1a82dffe2c70e6b0016eb42d13e1a8aad1\r\nMsg = 28a107d22fcd0499e0ea5aceda6dbc288a5f1d9da003c626bfb9a6c27922e9bd\r\nMac = b67bc2e20c422f9c7c27a84ba0bcfe\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 117\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = dc3ca30782c9c0a7fe8923d4b8d31aaf21e63895f51fb2f1\r\nMsg = 8716298bc17ed51aa273711873e2c2863e7a5021e46a183e6c6c81f99c02918e\r\nMac = f41b1896a22db30dac50b6b3e5e2b8\r\nResult = F (1 - Message changed)\r\n\r\nCount = 118\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = 0b6b36339122610178c4bb72eb558abf15e5ed9ea0077a5c\r\nMsg = 52839f2f0853a30df14ec897a1914c685c1ac21470d00654c8c37",
+    "663bfb65fa7\r\nMac = 665f05a489f8ad0feea290401b4bf2\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 119\r\nKlen = 24 \r\nMlen = 32\r\nTlen = 15\r\nKey = e200414db0255ca3faa7f6b17a62523f2c75d99f6ae162e0\r\nMsg = e749041b314f8719e17a8cb26162e2c910b31116dd769083149238d67792f991\r\nMac = 713fb4d0c95743ee7da970cac7f771\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 120\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = ea77165284ada4599f0bc0a41db787310f53a1588282b866\r\nMsg = f3a1a6dc2092ae7099bda65f8af32aa19796254a13fd9e0e7319d50402598faad6ccae2a028604db0d44690ba3530bfc8bad062cd96635d9654647c57bb81537\r\nMac = 9c7c379b5f8ee87f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 121\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 18e2baabdcebcd25958eb53d1bd2a95ffb9b51a3c1d92a9f\r\nMsg = 1df7392e915726847822817cb542df6b14df16d7d3d3ea8d615fe9ee651c938a0234bef059d139c350d6b01192cecfe1d821aa0b668e5d4dd8d5ef9a1eb47db5\r\nMac = db521506073b8c9e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 122\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = d39f12a9c6b63c17f116bc003f4def172943350e29d60258\r\nMsg = 75225a26d63e91281fb37ace46354f81de99dedfde8b770ea47f08503aea87d8d7b190dda9e150ecd1a2a182b06676da61667a04864ff4374838ee6899d8961b\r\nMac = 65aa057a01b390ec\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = b2212ca369c611b725eccc3daa58df412787a3475f418d82\r\nMsg = 3727bac9706f482f55bda86dc052aa6810e2c1137b97fc93a65838a2724a9531199726517b6fed53b24d062eec7c22227ad9379b24da7658c0cf7ecc0368cfc5\r\nMac = b869a9e06994fb39\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 124\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 25e5fd5c39e684696e71a6f81f843a196dcd030ce2c07afc\r\nMsg = 899b48338d5ec3bb4a681f76ef37b6e25357b50e9578d85204c3753d3b6ebccf908e3de8b02dab01839ddf1a560b1ff33857a17fa4244b96612bbdeaa7d4913c\r\nMac = cfb0650c7566dc49\r\nResult = F (1 - Message changed)\r\n\r\nCount = 125\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 49bc9d3bcf3c22daa8cf55c1b59d4bffddc2412d60518e98\r\nMsg = 980026395d0544975dffaaa2c56db1df5816cd80cde513dc76f6f81d21f15c383c97c7233c9af2423fb28922efed2f69aa47c30de17ae1c5be17acbd0ad6cb8e\r\nMac = a7ed2a35c89130ad\r\nResult = F (1 - Message changed)\r\n\r\nCount = 126\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = c53f21f1ce3a1792a2de14277eb97664d4c561b3fd4b0e32\r\nMsg = 66e15206c23751497bc2c8d734aa1136aec08bd4e80fe3408bb3929a84efa749f379c7eb441872929b71872d761e0b448e0126e9fed86eeba611694cd2df4cf5\r\nMac = 1b86a912a0ec9f94\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 127\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6286e3e53ffb9bb143fcae724b45f86a23bbd74c42518144\r\nMsg = 62766e9acd41285eeed9b4007340dbb611699624274ad1179e327076135d907638c60f0c773c4ea8d9b8352027ee78ea4f22198f083d2f5cb920e55b9738c582\r\nMac = 3c56ff841dca9662\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 128\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 9c5d43c1a1269cde199509a1eff67cc83a1759b71c9e7a6e\r\nMsg = d576565a938782fc7e9b095db6213002bf5bbfdcd761fd6d876adb2c7947702b8930a5f71ec332bfbb4ac9b9d13d90c2d808d5459d0dfe5ddeedbe3e14038fd1\r\nMac = cc7b2038ead10d8e\r\nResult = P\r\n\r\nCount = 129\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 512a23489b8d6b62b63e9188c0ee5016f20448c082eefe82\r\nMsg = 1fdbfff7941ba22dd8e1dd13a05a3bd8f2c8096894266536c40a983929d0a6340af5233bbec1477363294519d3f3d9c6d41b20f18f76adb54495d9d43bec5afd\r\nMac = b81c76829839cd43\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 130\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 20d22c3b6ab38c5995e22b341f359be25616b2b8c7269510\r\nMsg = a1c041d1d4e7cd6a953f2e4837e3e676ed48633a2f15828f5f3551d5ad2a19c838a49caf75529bd5d5f89b3da2c2e9922ad8dc5d20325a7b3fae9dcd305f3731\r\nMac = aac4d4f4172e1f05\r\nResult = P\r\n\r\nCount = 131\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 22e29aa7547e5ed3a64611e04f1d55f7a397c1619669879c\r\nMsg = 773b577b95e29d36fb30779d2ea23e2ffed9e1b46aede42bbe03a904fe22ef8f874298b5f4a6afe63f6ca9522863eb5cdb1c8d4bcd445e43e7302875e6ba3592\r\nMac = 16bf98c7a5deff18\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 132\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = b320edb777d317af6c933a6530d9f5cb78d2d3104ac02120\r\nMsg = b31d3f55909bb660628de9eb95b75df776455f2f535f461edcfdf8a0cffdb096d573fedea7400f8374e62e30879a8beb259b3bffb4c3813a235b4c59853400c1\r\nMac = a0d9a7da024326ea\r\nResult = F (1 - Message changed)\r\n\r\nCount = 133\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = b9bcd0ae7100f991f4365ba0683b6d461979ffe86d0ecc24\r\nMsg = 19d0077952eba12a01db1d137050bd7e9102a31242eb38a5cfb3cf51b86c86cab57f6deef8e6eb9eb29c5dcdd852ffd627641013660b31abebd40fab60514159\r\nMac = 972119a55b125e0f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 134\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 00af010f462ad40a38eefb788b648e1cc292cd4bb08ebeff\r\nMsg = 573db0961531873316e87090f79e84f040c8358f8ca78fd9ea1ebeda82c1cff67c2ebbda1da0a1b233c1539cb4c0145da2a4a05431e06dac2c2731d59581a434\r\nMac = 92a67a99c128e173\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 135\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = e12f98507d6514c3b551d240595346bc9e9b6a987033b3c5\r\nMsg = 3927bac9706f482f55bda86dc052aa6810e2c1137b97fc93a65838a2724a9531199726517b6fed53b24d062eec7c22227ad9379b24da7658c0cf7ecc0368cfc5\r\nMac = ef48edc762db1d47\r\nResult = F (1 - Message changed)\r\n\r\nCount = 136\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 66fe8076d4e8538e18b84f965255d143f1c7d377e099c1c2\r\nMsg = b3fe18cbe086955384226c11c62c1dd14e7eabda573450d005b46fd9f9eccaff24dbf5d6d8530b5e25fd9f2a629df5c20a977247cab35255d71d992d85b04c14\r\nMac = cb67f0c1819ae458\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 137\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 82233a224ed122d7306bd6717a80fa1986964f9db41bd40b\r\nMsg = 65c46382a278490b9825d4f1907f3b9f196e136906067020b6b94ee398cb2f39ed07055dd0b151d974bb8d56ae3bc8b3b31d9054221514bd45d88a5f948ccfb1\r\nMac = 27e94d22e8961f92\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 138\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = d3e3bd80f45140cfc2f857a913a89f0c7dec86790feda4f9\r\nMsg = ff26ab66c6a10ef910f5b94589b24a7b6fae8e4396faa552b014603fcb5eee921bcfb81ffae989922debf24a6947ed6b1556c02e524b247c3966a7bc636a4fe9\r\nMac = d2d326c999095b39\r\nResult = P\r\n\r\nCount = 139\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 8\r\nKey = 466fa94c2158c1cd84b83fb2f15ccfce804f611ad0fbc4fd\r\nMsg = 5ea068d4f363dc7f1badf97b77ec85412a06dc8d8e3f4364265c7956d4088f014c78fad6c94be720ffb4ce4150da4a3f427f288031e0bdd241dd7daf975acabe\r\nMac = d6023f6ffd3c788f\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 140\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 6f5a146524457615d81a605b38a5ff03edbc5c426ec7d551\r\nMsg = 9be3a736e7e72560bea45e9c8ee8bf37c279bf5b2ef16483adcc093208c05ee51a4db04632946ba2b96cdd9d15b33c25cce2eba4ede4f97aac29ebaa4cf6bbd3\r\nMac = af8fd676ee05154b82c3\r\nResult = P\r\n\r\nCount = 141\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = c62e6eb86b8daa37936086dd2c346e3b14be5054cdc2f3a4\r\nMsg = 559407bb6930d5adbdf19a7e285ba1dee5caa03ef54e3a3fc1b8c86a02f55921de9bf7d553c22d7ad915c6384329d664e70dffaefe22ed9c4e2c233706aafa04\r\nMac = e297ad7830c79d387ac2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 142\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 225557b0faca3d6cbaedec5c39c98f0ba0723f4070f2278c\r\nMsg = eb1383e84d4bfc5a9dad25374055b81eec74316b18f6e001b0623d470c027b7023456000fc61538b663cb7c0e98d77a7fc3ee2277816bacb4d9487c6741e3134\r\nMac = f07332a3b01d0e8026ce\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 143\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = c36acf733d310e3b9842b3006aa637ab092faf4a580043b5\r\nMsg = 1d674eb5d85945a6c7842042adebe549d4fe515501c06c1ba72961ee5bc98d8588afd6fd64893e21220db7ea6a973a420613130dde1d7f6a26677836d65bd0d3\r\nMac = d629ef50a784db860de4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 144\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 332e30ab63b197e79b86e4da732bad9250c0a5c9976a6c67\r\nMsg = fb41304f9f5b0f696ddb0e2f0f57bb091f8a31b5324d3cdf15c3bdf256d3502d06db2df9bea24c7ae08fcd641f199610427f3ecf24b92a7e00aef55aeba71516\r\nMac = 983e453f602db30e1f85\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 145\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = b311796b0519a45c176f3ff458d4d818668093e82fb871f4\r\nMsg = ec1a1e9ee85cf960e5dc4e239619ed85f4b14d32cbd42dfa79f77a27f2cd740d08730de2eaeb91d0eacb8c498336e99b9a0c57c4045ef18749251dbfa733b4f4\r\nMac = cb2be0fd09f10deac5cc\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 146\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 6311e7f0a7bcc11176fb411fe719d4e0782c8935524776f3\r\nMsg = 85f647d940a6d1acb6b7851912f807063515631eaabaa019dcfb993",
+    "e86f408266cace4c24940eda0083d8569364dc1afb816c0e5b95f3bafe7745e5ddfccd6b1\r\nMac = 776b9642c47fabd7e9c8\r\nResult = P\r\n\r\nCount = 147\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 6d120cbf74df2efffe98397ee303ead4e91c5e7839b82885\r\nMsg = 27ea9ff8359463a7742cd9c9c269ee678f4ab22091fdaf29b9007a92658687cbd71c4166e68c5a1ef30160191f6d926abb28f1da01da9ae8019a520edd576346\r\nMac = 5a902959d73ac97ea071\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 148\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 8e09d421e09dac1d9d966f02a3a520972c6aed2003d907dc\r\nMsg = cb32cb87ed59ee959c011211ae7cd475c3b5feb21cbafdd0b17796d47dc4d4e61da345b399c2661182485be13dcee33a9eaa8cc4b9742361f4c36f1361381f1a\r\nMac = 1b2bc5956223b8801456\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 149\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 3eeb143d4a3c08ecd9f7df8eba42789b517dfe99e07958ed\r\nMsg = 3292b8548a35fe34136457bcff52b469eafdb1b86b6cc88bed35c4cfba43785c59d6b01c1acb6870ef1e3ccf7dad20b1733f51ab1bc48cdb2fdf7d86eda17a00\r\nMac = 3a85ae8fd368cf9846bc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 150\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 606452c62290b43559a588bb03356f846cecb0ccaf0bdaf6\r\nMsg = 3cfbc77b8897b6a5613f62f6b1c89b0d68f272c6c19b9e0ec6331ef616702006e64322d3460a57d3a5074c719811cb5dd78900268890da0ac177b40d48773548\r\nMac = 325aa552529e66a13904\r\nResult = P\r\n\r\nCount = 151\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = eac3a1a6eb8efe983c6b37b6c2709f5a8851ab72cb23a66e\r\nMsg = 2801a813dfc3f1c753f4f342a113c09b8e9a7ac16483c31bfd0b746b1db692f805937eec44c16bfbd132154557afb17ed01c1f4c55fe67f0343a6329441fb955\r\nMac = 5b0b383c4870af31a9a1\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 152\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = e2d592cb412e65f9044257d78e7491f9f80c8b08102c2d5d\r\nMsg = 3f63b7ad671761a3f27394776970b413e35a2c43ca85560cdd3c9b407bfadb4f1edd0e6026572ca0d8274bdaa6870749b0a727aa8c5b7e9442100e0c9b057455\r\nMac = 0380cb126c63bb48bdb7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 153\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = b7b86dff6746145aa7d5bba73ed6a46da5b1200bd3520357\r\nMsg = 8e7f7e7e3ac2286bef6822ef47f5f73f2ff512e599df17c3723f7a55d4144a367c774de67e7e52ca3760c37484da7a2531d1d590b5380de11c34c3fe447edc0d\r\nMac = e7aaf6f82894d8825d80\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 154\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 70a26d985e6b99bd3a37575f011f2b84ed84bebf99a52760\r\nMsg = a2cfbcfdcd90e0962f233d7fb70668c8c36cd5e195e2ef5c043268f47187cecffdd36000f96e1f509f00283effa040443b3db15cf73d55c30c65f0fd7cf9c219\r\nMac = 96d09f0a799cb52575d0\r\nResult = F (1 - Message changed)\r\n\r\nCount = 155\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 5d678acdb2e6cc03537411ae2e95da120161ecb6c92d5e23\r\nMsg = 91dee0cd1d17d9342f4d346cee19f5f42e0c3b0498447ec4043c15bb2ae8fb8a7a02d2da489f28932c05fa4ea9c0760e0cf3052a97ed898edffce3247386b98c\r\nMac = 4a40b4f63330413918a7\r\nResult = P\r\n\r\nCount = 156\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 795846f9dbf36415640276642cccf87e3dbdf6519c5b2db8\r\nMsg = 4fc989f327e1a1cc7b8af618ee6ae6d25f78e2b76b681455336945655f13fd5a639bec3a004a88ad0e2df8547a0d315b8ba15f5269038638df6169d960f5ab5b\r\nMac = cc5efa5ef19f6cc63f83\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 157\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 61eab54142fe7e16787fd2d54829cd3c4bbd793e72f9ef9e\r\nMsg = 13f079b004d1fdf02121564f0a96b057f120899ce920169561d5e3aaeb16bb8e4347c7cf8c86f9acdc25ac26fb5d845a68409c0d9df0e089940fb7a88a76e62e\r\nMac = 920de91f34eabfc31648\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 158\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = b64d00f3a4df754fa4ee6376922fb67ccce0c6209f677397\r\nMsg = 8003586af34bdd0acae4f5547394245027c2ffcdc9d1335311acc859e9a2a7b817755a601dad14495d32f1ad811a7e751ac07cf18716e1cb193c203e7551aa83\r\nMac = 79e8a0ca036d7b0bd2c0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 159\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 10\r\nKey = 98f4596970e6515b5357f6c6396aac182d126decaddf567d\r\nMsg = 65737b65927aebcf6cefc7ca107fda8447e8bebf1f08a280d53a4b07f8e35904cc48cc08eda3c63a3475924bde1de6acebaa65fec5ee68ca22d3fe722bf33267\r\nMac = 05c51c2507108a3f8293\r\nResult = F (1 - Message changed)\r\n\r\nCount = 160\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = f0409b050346fbd319c8630e4bc9dd6d055355fbb961f018\r\nMsg = 731db98bd990b2ea19f848fda3519b32bc1d2fcb2f4d42e13f655da8e1dc2af428c185fc01a5d55e20b49d643a254e8675d560301d2ea0c5984ecce39c655de9\r\nMac = d37deaceea7ea3b50aeb02636e5095\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 161\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = f266cec01c5fc08c0bdabc9537bd1aa2df9f2b8ffbe5cc94\r\nMsg = e19cbaa489a0f65681c983cfee3a4b699339ccb096df06bc871398be9eb926d84426fd32d5d7fa4aa563a88b41afa822f761560d9897a9747cd85b3dc74b4adb\r\nMac = 8690d4f8153e56e3ab80c7e918679a\r\nResult = P\r\n\r\nCount = 162\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 6e12c112720ef346bbbe7d1c19483721b1c52c438dad40e3\r\nMsg = ab8b36f46d1749cde7dd9936df95cdc8e0b359b8963bff4e7bd59599b32408623354a15e29f287a79801866d434a0ee9cdf37f931e53a39509057c7f2b3b413c\r\nMac = be9e70fdd15f96a8b7457cb727caf6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 163\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = e9ed05813262fbe769c1104d8ba5c836dbd229a22a681de3\r\nMsg = 606452c62290b43559a588bb03356f846cecb0ccaf0bdaf67a18abd811d4315a966e2f3f87f6c2428814446563fa71864d97c8336b0e34bf9466ec95598398cd\r\nMac = 4b3ac19f4dfa04108283b0e2e3a8e6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 164\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 0c84328951c66e0f5341b741d2c2796d3524ef732c69e779\r\nMsg = 9071c45a99cb987aa79596a2014f54e6fe400a6bbd5de96e156cae87cf69762f1329d481213d213d42191312fd76911d8df4c6ad9304754909058cf477adfbaf\r\nMac = 1e1003ce7546009a3ba7f59dec236d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 165\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 3aa8ec246323db7a3953737928061c79757de2e921c27643\r\nMsg = 84e9cc9bb7f4fb62ae7396859fcf33da5ca6c80c311eb392107afeddebebe0d662a887879e4014187d2fe8feefb01e6fa0d35819d7cfbf139e99451423b62ee3\r\nMac = 4259d5f983a287fbd987e3badafb33\r\nResult = P\r\n\r\nCount = 166\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 66c07634c94dedb5d4c6f19e7cdeb954692ccf51fa242abc\r\nMsg = 4bbc9d3bcf3c22daa8cf55c1b59d4bffddc2412d60518e986899d6a3e2a781668b0c6b9b4ee0ddbbcd06bd643eb201fe7829699e4dc86e2a1b4876bf9e40494f\r\nMac = c40f872ea2f1a1b45ab5737c2e4f33\r\nResult = F (1 - Message changed)\r\n\r\nCount = 167\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 3b9d6b0652836457ec4f701f0dc0e5aed73d16585d61cb1b\r\nMsg = df7b23a4e4456e0152b24853fe0d5de4179974b2b9d4a1cdbefcbc01d8d311b5dda059136176ea698ab82acf20dd490be47130b1235cb48f8a6710473cfc923e\r\nMac = 602941735206bbe57ce1c2e3b9509d\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 168\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 7253ef10bbc302f01aecf315f9a4122ba805dc4048c30ac1\r\nMsg = e12f98507d6514c3b551d240595346bc9e9b6a987033b3c50940442dc385634e2a28292856b97d5a78704388b2b6d0ff2ce7a19c64574deac593b98a7ce98bd8\r\nMac = 9e62a5b8851d3a0fcddf06fe116ac2\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 169\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = d718af395ba3f5f4c6d15c24475ec7f0f74f3238c81d42d7\r\nMsg = 0c0d3d7ff5d1b707be9648f263b8f013fa439978e959efef57d471cae02dc8e08d9d58d40381169afa039936f1f773c72003c1c5af03018725ab2408236ee4ea\r\nMac = 75749ed44b76d7ac16c98d8b6bc18f\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 170\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = ec98ec44f5a86715014783172e667a748f162c5c26a8b34a\r\nMsg = c0947efb86d54644087247f9fd95133a94075faf6250a2cc9f20df5393edbe1a4bdee20e90e877781a370a7f00cf9eee7373fc38acc54aba23b0df3f020356c9\r\nMac = d994553290066d778369b54ae06668\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 171\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 9fab32caed6e1cb27d2115cc641779127d4aa57db0955bd6\r\nMsg = 6e3e25db29da2c787bb37755ee770e2402fb8208da23389d36030439a143f971ecc880dfda90a8231ddebd2881981ca968ed45f3763a32ec8d2fe854fc2e4b4b\r\nMac = 4d3cbf9b68da0c5b49ab3b0913a2b1\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 172\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = aae24266e5981b2ed14213a29f961cbbf7f02f63a33c987e\r\nMsg = 8244cb416b3d09521ac2fd28c29084ff3d64761d46617b59e8b221de36702c2d3dc62e61375357b702cf8d4dd0f2bf2a1f91777fec0baf2c23e3e6865bae7358\r\nMac = ab8e9df7128f4857e0a1c24fbce473\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 173\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = b9bec4e88775777ff1eb3df671fe8ac03a693a1c26ea254f\r\nMsg = 8eaed4810702df8caa",
+    "12fe7e26e7ebbca11aa2de9f3169a8262c0e3c205a708f0071401aa8de09d28a5a6e590ebeb476341880c37bfee1a501229081eb27772d\r\nMac = 273b0d874010eac97ceda34232f7ee\r\nResult = P\r\n\r\nCount = 174\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 15120ac9468fa30c92ad87e7aba41ef552814e4ecbcb9350\r\nMsg = e3de6c6119d7db471136285d10b47a450221b16978569190ef6a22b055295603c9c1ed5da3bf96bdb43a5722cf4e2ea087cdf9b23b3093d250d44047be634b3f\r\nMac = 9a166994de85e5d60b154d49a867f4\r\nResult = F (1 - Message changed)\r\n\r\nCount = 175\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = f9b9633f12967f1841161a3752de1491b2b2f519d8447636\r\nMsg = fa14d3656f7f7610f3a629bce14648a593250c6f309c02c6c552bb42984ac58db920dbc7d98f59295f37f3e9b99da55ef074ed65801b390366669b4c7aa1c483\r\nMac = 2c9f3650866b97ecc5ed66929f41dd\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 176\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = e87275bc62ad067b121b83f220d4ee2b4245541283dfadcd\r\nMsg = 6475757f30dd0a96ad64bde5c2605a9d2ca82a7223a9ba4c39b6dd3f86a0f4bd02876d0a32ef8af1071664b603862f4b9de6bfc6e7154b136e7a72e661957bf4\r\nMac = d0bd2d3d35a22f37bf113090cebecd\r\nResult = F (1 - Message changed)\r\n\r\nCount = 177\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 8b63d3c794e5ba0e09e5d5a5c56670bc0e289b30171ccfa4\r\nMsg = 44da1657e4be60d887a097e29d03bdbf5920bb0504e654bd963f58c487951a72e395237a9d32281125ed3a533c543de208c99bd063853abf79ddab4692c3a497\r\nMac = 29d04b97ac302fefa80f71ea378e7e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 178\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = 17039577fa27ef5ac3bf97572d9de5f8eac0aa58ff29b990\r\nMsg = b0329a0978e5a2d1bc85bdca333e7d0d1e9950217ee9547a84e76d3f49999451bf787288e8d12d40456c8214926c14e9b076032fe315c1633d5d21d85acfb1b8\r\nMac = 51b4bc8b479dbd60e5de94ba8b9d0f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 179\r\nKlen = 24 \r\nMlen = 64\r\nTlen = 15\r\nKey = cf6b5edc515882f8a7954a5d8517b1a85e9559858527d0db\r\nMsg = fde631afc6c042d77b579dab9298862d943be673cea59eab4a0c1b5cfddc2aef42590e6d8786d18a4646d7e338c2b984c50a50adbeff0fd64e7096f02e8385ee\r\nMac = 5ee3547a06661661c46c3778b0823d\r\nResult = P\r\n\r\nCount = 180\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 7b6f4f158422f33543ca90dd0a76cbb23c0dbef26ee140aa\r\nMsg = 6704dc39a259152d2dc3f08b8799ffecf4e1bc38\r\nMac = 5c12ff63244c64bd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 181\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 7a381f75058b85680061eeaa0242d3a16a64a5ca50cb61fe\r\nMsg = 18b31ed5ba1c3ac562ff3ef274424b86c0815c26\r\nMac = eb8f3d508c9edb8b\r\nResult = P\r\n\r\nCount = 182\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 3662d7b7c93211535c862ef3dc2724c492cc1e53a58f23a3\r\nMsg = 8ac860504258c134c6835d4cfaabdb316c36d99e\r\nMac = bc1b870eab5bea9d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 183\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 9eac76976750b7937b3bbc6986b4c726f0d0a63310db85d7\r\nMsg = 5de2265292780222349ac793eaa17c5a22902344\r\nMac = a69594e569230df0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 184\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = ed1531500f319e09227d6bd181786b3b446f081abff2e697\r\nMsg = 7a734243e53cee654be988f5c735b19bb11f3389\r\nMac = 9f2cc2a8c3d0a34f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 185\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 85d0d04cd3fd2fb34dc18fd55e645f7492d5280657577008\r\nMsg = df899dd6b99cc28d66604ca92431fa7f442a4927\r\nMac = 18fc40b25fb9c138\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 186\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 90b0c8b542c91c1b2dfdebb589a7eced6c9b7b43a7729840\r\nMsg = 38d1a87296529595acce251cb232db8ede65581b\r\nMac = 077570fd0efa770b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 187\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = eceacd807db82378e9bd7c79054878f09dcb5087c2e1c349\r\nMsg = 09bf4f77a9883733590a3cc7ee97f3c9b70f4db2\r\nMac = 58af901fe0fb5d29\r\nResult = P\r\n\r\nCount = 188\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 16227835305b7586a3106d93da8bd70aa0025df69a0e85dc\r\nMsg = 1a223362dccc99472b2cd1d712ec6dadd60ef972\r\nMac = c26f3980d17f6c36\r\nResult = F (1 - Message changed)\r\n\r\nCount = 189\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = d18cf5dbf5b2094dd6ad85d975449e2dda35b184633235ca\r\nMsg = 7f557e74f53c344daf7495526d1270dfa8fd24ad\r\nMac = 5b7cf33ec05b1576\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 190\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = f1681287bc931a0d8f296e13b3584d6efcb6ca76aa90cc02\r\nMsg = 08c62ff9bd7bcf189f530d5065f8764532d2692f\r\nMac = d646e2ec15afb14d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 191\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 116f4855121d6aa53e8b8b43a2e23d468c8568c744f49de5\r\nMsg = ab91d1aa072947d22f0dc322355a022fe7f0747f\r\nMac = 489068c07931ee9d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 192\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 0a23972e036d62199ec327b25a3cf4e14c29279c6449d3b8\r\nMsg = 2df3e80fb6ddc1fcc7615330b24fbaa4981441c8\r\nMac = 7842f16a0cc7bd6d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 193\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = becfa1c96686b04153fae144c187f034dac3ee6ed70d867c\r\nMsg = a3a114679ce30c8472149da9bf3a42b1ffb07e66\r\nMac = 74fe19b5183ed3a1\r\nResult = P\r\n\r\nCount = 194\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 866b43c8fe3769ec0aeefd4dd02210488a354d67e82a81d7\r\nMsg = d9bd6ac153cb0bc4e19e59c45cfe0d6f4c9d20a3\r\nMac = a3a2ef83eba2a6f3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 195\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 7e00aa080c127cbabfdfa5d9d9728c7b25358aecd26f5850\r\nMsg = ce1a38cd75b9e955483ab53fe59649d087ecd1d6\r\nMac = 8375c666d09bf259\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 196\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 4bbf4c9cb6758329b2d5a53c4fbfe2d3df4fb50e57b3699b\r\nMsg = 6429ea2cc8fdaf58100347d21da64375b3ab2058\r\nMac = 77e417a60bca9a9d\r\nResult = P\r\n\r\nCount = 197\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 274b394da9402d3eafdf733994ec58ab22d71829a9839957\r\nMsg = 2b3d7949805afd73234cd327a62951b32c51df2f\r\nMac = 8f9ce09fee15516d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 198\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = d4140d988448d557454c3434fd77f8597e6420566845e316\r\nMsg = b53017500c100dea0511845597214484fc5f7f34\r\nMac = b9e85ce9178b81c7\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 199\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 8\r\nKey = 43d0d326c511e3bcf4f52660fc3c706a6a95c0ab550615f6\r\nMsg = 7c880698ef372304a663f0f02944500393585d42\r\nMac = 843f71e93b22f1e4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 200\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 273cc5013785baeb5abc79c8bde73af71085d7018e7be92a\r\nMsg = 086e6e3a21787acf7293446516b5f54da95a2988\r\nMac = 658a112d7a9e7a08c024\r\nResult = F (1 - Message changed)\r\n\r\nCount = 201\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 492bf7946bce1d3c6f168f4475e5bb3a67d5df2fa01e64bc\r\nMsg = f7b577f1396b23c27eb637e53d3d92460270b001\r\nMac = f2dffabed6871cca2e41\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 202\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 8e7d8a44244daa7df2b340993e32dac50e05d7b2e103be98\r\nMsg = 2c3c3582e026a3f29ffd21a92a8e1ee70f3a4147\r\nMac = 1bb40d091dde1903ac0a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 203\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = d2069266b0f180cb319e30ded7535bbe52d24be151de4bb5\r\nMsg = 392d567f0b8045359dedd1591517ded0171fdcda\r\nMac = c1ca2813ad38fd7f0f58\r\nResult = P\r\n\r\nCount = 204\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = f35c46bca9236830ff4bb057cd5764f02720ccb03b253937\r\nMsg = d4586dbdd5655cf659891f5b6015da524548dbbe\r\nMac = 4b6dcc78f6e0e9b7e35a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 205\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 509f1e38591e03a30a7409bc7e18595848253308c15edf40\r\nMsg = fd2109cac9f42fbb093a8675e5cd962c4c31df2f\r\nMac = 35387ef3967eed5b579b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 206\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 0e9cf0ec43ca3fb7fb9a2b1999ae635d5041bf42f1b0bea1\r\nMsg = 65960c7fd43891ebdc7bf862b28d4822a8488270\r\nMac = 93c33247ca546a8c3fba\r\nResult = P\r\n\r\nCount = 207\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 51597a4c68cd228371e86c179fe04492642ad9b888405067\r\nMsg = cd8799124d94064f47d7eec59aff543b81ac66f4\r\nMac = 0eed36a27b40560b89db\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 208\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = f9f049328f5db22c41a501088e5759ef4d04db0c4b4f6d3f\r\nMsg = 7bdc26b5b4df58af539d91eb2ea10263a3e58b07\r\nMac = 68c45551f1367c989a9d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 209\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 5343dacb05a29b3119d6f19bdfbcd6674950e710fc70180a\r\nMsg = 057c2d386fb1693b845bef585e76e0fc",
+    "4971ffb3\r\nMac = 372a801d1cd33d1059ba\r\nResult = F (1 - Message changed)\r\n\r\nCount = 210\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 5987fcfe8a1ee76afaef54cb22d8b2a20b116f72bfc7117f\r\nMsg = 8abbdf380c668c6ff34a4f128567bfaf256570db\r\nMac = 5a8089b3d9f6c72fc858\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 211\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 301e0712ce74a1ad02079aeb0ce35edacc33f9a5d907cf70\r\nMsg = b2d894833daef4070b764361685fc94a780a7292\r\nMac = 57a225eca09fb227f79e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 212\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 144840494d15b2b31ad63ee05bf579a5e9fb98f534a6309c\r\nMsg = 71bf573cf63b0022d8143780fc2d9c7dbd0505ac\r\nMac = d1b2baf05cdd5fecd1cb\r\nResult = P\r\n\r\nCount = 213\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = b4bc602dc860108aaff5b3befb948a561ac495a22af9085b\r\nMsg = 3fa85ca50cc4c4817e951b5a95ac006973324c2f\r\nMac = daa1246b82d2e14e3056\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 214\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = ff48804c82414ff67f9b917a4d5d062d439454aad8eb4b0f\r\nMsg = 6def37d9b73fed0390f260491f582d2215369811\r\nMac = d7712f7d5f0da5dec6b6\r\nResult = F (1 - Message changed)\r\n\r\nCount = 215\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 0273e421ee670be6322675f26f9014c040a76f0c869698f0\r\nMsg = d9de46934cb56e58899a31fd14ca64509131dc27\r\nMac = b3e79909c16c561eb7ca\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 216\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 27eb9812d3f7816fb6a1cfe474496e80750b1ed3959ec7f5\r\nMsg = 776ba7990086731ef7504947be74b3c455bfde5f\r\nMac = fc0f2dcf4e6fa041830d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 217\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = c56f710e39deed799ffde6d10e8aebfa2bab5e5e073d78e2\r\nMsg = f6fe0f16403182d012f8b6e02539c386075b4585\r\nMac = 6bcc4c1b06099220e9c0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 218\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 0236ce1fd3ef645a64b4ee7048dd35942e6a09e8099884a8\r\nMsg = dbf06366f766e2811ecd5d4384d6d08336adc37e\r\nMac = 1de717c402baf964e817\r\nResult = P\r\n\r\nCount = 219\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 10\r\nKey = 5cf781067bc1ef948e929b7287279c71cae5143631ca57d6\r\nMsg = a7f3fb7ed1342862247fb4b1993788837cc87041\r\nMac = ee867d4c0f910e9d9288\r\nResult = F (1 - Message changed)\r\n\r\nCount = 220\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 3e19b6f3f3fa3c2551466c9e09f0391350682495426fbb08\r\nMsg = c7496322ede893ae368884a91f80c3bac3505c0d\r\nMac = 55b25da032db8f3b4293a4865df77e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 221\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 5717ed57ca0b6921f04dcacad34e0f6210c36673dc9f4d92\r\nMsg = 5e3ed45f07a6b3c225ba73d04d867f9c5b4aa703\r\nMac = 1b642dcc4fa08cbd36d109d55a8501\r\nResult = P\r\n\r\nCount = 222\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 8eca0fb8033e63e24a54a3e63bcf8e4ec331b04ddedfeeff\r\nMsg = e3807f6d8c6471ffe188df67d952a7d67021bf41\r\nMac = 9a37eda1e3331bf86d208b2c0338c9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 223\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 633f44dad6995a6af0302692142a47430491ae7b54f8b00c\r\nMsg = 3caa9b8b24097d29bd24b913692acf96cc78b998\r\nMac = a6665b3b158f37f587dfa0bde7f300\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 224\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 14ef8096666ddf28e0ac5f3458b52f3e0c601deae57fffc9\r\nMsg = 11d5cef384474f33c2d313e6e1050d8c7ae5b019\r\nMac = 2643bb3e1c01f406d90104c4437189\r\nResult = F (1 - Message changed)\r\n\r\nCount = 225\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 0c2e1951eeba1a9b6592202b1b8547f43fd755fbd844a874\r\nMsg = 9ad62bff38e28f75302b6527c1c107543f798817\r\nMac = f42ff7aa728c2d815ac7c701b59627\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 226\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 1ee2df7aa80e3a131e2aad9c17bcbf546d8b25e5a849db31\r\nMsg = c4e8594cd09be010b6934157e0557686310e8dbe\r\nMac = 34496d184bbdc0c9a57916ff64dc3c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 227\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 75650ce366757618af20205b69af7e5d4e82c398c00101e2\r\nMsg = 42a71eb81ad1c97ac53b88831b2d15f3c57e7cf8\r\nMac = 4c03394a98bb43e6197074abe63070\r\nResult = P\r\n\r\nCount = 228\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 386c659bc45d0a88acd54ef7eeaa3e140e1cafb1b01474a0\r\nMsg = f4fc5acff75d404849675b813cf7adcaeb8f3d56\r\nMac = 5cfb2fc8869304428fc012a14b616e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 229\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = ac192759625f4e42d1d1fa73dc0f62199142155615478f88\r\nMsg = d33f716df06e9047f8d718ab1faa06ec7b773bb7\r\nMac = bbf5b7207faa5b004216fa5caf3f93\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 230\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = efb497fb9b85d472e7c9d061aff501f7b1e3a311a86cfc69\r\nMsg = 1fd425560816aa21d6572150d1161cfb3bd61e6b\r\nMac = 2b7e14864d29437647cc1b27a8a0ad\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 231\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 344fbbeaf82ede8a401df7cc121ed3da43be9bcadeeb5614\r\nMsg = 93febc9e16003cc8d6490ba5a6e64dd673a0f887\r\nMac = d34ef878392bc226f7ce1519f3bc23\r\nResult = F (1 - Message changed)\r\n\r\nCount = 232\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 4b6c6b6be3c04985bff49719c4e11be97d7757801dafadc3\r\nMsg = 754336f8cf27f4bcc7af5207ff02a662232d9a62\r\nMac = 5389c533cf43ca0332574802c2ace3\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 233\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = fe5ddb0645387cc6535e5b7991e6428c4157a76bb41084fe\r\nMsg = 216d9eb896edc693520f99ac91f34cb54e76d719\r\nMac = b43388ba7859f803655d914b60ce90\r\nResult = P\r\n\r\nCount = 234\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = ed14373671cd8041e00874b5d098ea225eaf9c68bb51cecb\r\nMsg = 0569c6be9ddcfbb82618fdcfcab3dd60c20c49f5\r\nMac = c2c11297111a92a484868179c5931d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 235\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = f2faab6735779e9ac49716e7fcd3faac939366a7249f4f0a\r\nMsg = e7292269b07683acf5bea0b300782749074e2313\r\nMac = e10f324c19d79ed83256f15e302699\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 236\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 2bddd90daa1251a42a0e2fd2858568887f85e6d96d57daff\r\nMsg = 0f8b828c0e59effbdecc30abb6cae0d9af9c7636\r\nMac = 1aab0530749ac4c6432157730ee3ee\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 237\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 586233e492b76ade095e8f5ffc6df4bf6caad2a675953b2b\r\nMsg = 92af89c950d6221473a358dd0f280277bde7ab0c\r\nMac = 2a79121e68ea6b841e175ab5066388\r\nResult = F (1 - Message changed)\r\n\r\nCount = 238\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 5aea45c0995e950f333e29f4db82ea4c4c080ff82fe32bd6\r\nMsg = d9ff1c84bdb03114ebd5f471247a579311f4672b\r\nMac = dc58e7582cb555ea784036a8ba4b8b\r\nResult = P\r\n\r\nCount = 239\r\nKlen = 24 \r\nMlen = 20\r\nTlen = 15\r\nKey = 900c8283c7d50d6da79cc07d3dc7b76c2ef76100fa3ae2df\r\nMsg = 3f8c6d21ec05bc439bf82774f1812bd2dfe0d3c4\r\nMac = ec1fa18916f991d7276428b9c93c70\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 240\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = abbb803150cd7fdb9f3d571bc749debe72c825e45568aa5e\r\nMsg = bb5fd7f4fb020d38c13df3003a9bb852a86948f406c51624eaf81989b006\r\nMac = 799d598f32ebd9cc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 241\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 2fa619eed51bccdd2ce63580ebf85467ac9136f79256bf1b\r\nMsg = f92d1a6731f3bdd811fde1ed936de907ebbc4179670857859aafe788b91c\r\nMac = 6477feb7dd4c818a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 242\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = d0115f369d0f74073a46e3b9625660847dd7ac7571e40814\r\nMsg = 97da5d1f669dc60b6c6fe4369e01f3fbb9af30b483b23d885497c684d6ef\r\nMac = 3d7f0acc627b785b\r\nResult = P\r\n\r\nCount = 243\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 045c4b86eed865cd989f035afe8c257c400c11b1f72548c6\r\nMsg = 5a6233e492b76ade095e8f5ffc6df4bf6caad2a675953b2bdfa8513df1dd\r\nMac = b5a44479b0be31ce\r\nResult = F (1 - Message changed)\r\n\r\nCount = 244\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 4a83bf338fc0125ee1966df46d46a0d0b41e51569b3fa957\r\nMsg = 794a86f5b20d344ad86fd5523d08f1864737be57731440c29aa6b4257457\r\nMac = b45939cc01918eab\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 245\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = d9ccd93317441e9d6ccc358f31e7e2ccef8c921b23d74299\r\nMsg = 48754401bb69bed2cce8689e47210435878c7ce184d911f60d26b4aa5174\r\nMac = e0d1b6a530944550\r\nResult = P\r\n\r\nCount = 246\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 1e50fae752ac3a6e2b1755475e84441947e9f4b1d29546f4\r\nMsg = 34245df514f6c273d252271a980929e50a7cb0e77b05c7d46092abc30493\r\nMac = a0fd99f1405b027e\r\nResult = F (1 - Message changed)\r\n\r\nCount ",
+    "= 247\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 4f98838899bb47fd3b0fd5efcf55403996567a0fbe1abdda\r\nMsg = 0c8cc752ae8d487c621be129326513a5ccb4141e324d21aab399148c1a83\r\nMac = 1aef1b7bc7856c6e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 248\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = c98a22a667aafab0c94047e03837d51b11490693d5c57ea2\r\nMsg = e4fb1612e50607457dee8087ec41e57fcd7fc550497eaf1c8b0d47c773d8\r\nMac = 2c467fe37fee5342\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 249\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = bc6d4c46476ac1ea902be391b8a3f04e102aecead167f0e4\r\nMsg = 93b3314baf20e28a39e89592012c35adfaa3ee6d3d8e494051ee9944aaf4\r\nMac = 7f10757d2d36a55d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 250\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 5783548205826853ae740d35d6d69ab524c38fdfc5c51eb1\r\nMsg = 11c90809f9c53d2f77b56af0a42287ac6920e3d2921cceb824d496caf1a7\r\nMac = 07630c2fc52a24b2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 251\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 9cac76976750b7937b3bbc6986b4c726f0d0a63310db85d7\r\nMsg = 5de2265292780222349ac793eaa17c5a22902344063f497aabb9dc038ce2\r\nMac = fd092bab159861c0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 252\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 616de0b0f868eec923bf9edebbbaa51d3faaa3f86b2a5687\r\nMsg = 38013d62558647bc21d293830aa3ba80ff3fb84a8e0938754c5213077771\r\nMac = b4e782780989dc11\r\nResult = F (1 - Message changed)\r\n\r\nCount = 253\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 5df77b26f3d34eba49d287addf0a38d20514e2b7e6059935\r\nMsg = 1930a8b428334df9fa1ac16890f3a6a93fcf9d6855d00b06ff831d8f6a70\r\nMac = a8ad975046cd7571\r\nResult = P\r\n\r\nCount = 254\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = c56f710e39deed799ffde6d10e8aebfa2bab5e5e073d78e2\r\nMsg = f6fe0f16403182d012f8b6e02539c386075b4585be5b18d6ae1c5f9ebdff\r\nMac = d0df47dda012655d\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 255\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = fef8982f7342f1b953658453cd5ea413700eff00f1ee7d6f\r\nMsg = 269b6c1c95bc079398bb31e285a887c1832202d6ec257a2cf62468e29358\r\nMac = d2c90040bf66b2a6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 256\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = a34dfa24847c365291ce1b54bcf8d9a75d861e5133cc3a74\r\nMsg = 105d2b82676bf67ca9575ffd31d7d114e709826fccb6a5c3d3d7e26ff258\r\nMac = 5e60278f98b3135c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 257\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 520fe80cc4a3a5ad9c31f7010504923b7a7fd88292a64f98\r\nMsg = 2e1e0712ce74a1ad02079aeb0ce35edacc33f9a5d907cf70d0548d84ec3c\r\nMac = daf839ef84f1c81d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 258\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = da4775b8f7d654bc4cf2eb75ecf4831411bbc9a960ea2df0\r\nMsg = bfaccce3a9e66f45e454090ffedc348306dc2807951ce0bf100178612703\r\nMac = 3e2eb7f029e687be\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 259\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 8\r\nKey = 15e3b3c5794fececd703ac58ccb22a78e15bbd55c579416b\r\nMsg = c6c3457ffcb6e66c085ecb69492deaa704e25aeeabb7b7795fdcc807b325\r\nMac = afd75cdc02222e65\r\nResult = P\r\n\r\nCount = 260\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = e0f2cdfb64bda8f02ab90620fc5a1943c4b536a99f3f8820\r\nMsg = fd0365ff6061e5f55c0e382f5861aad99c135f9511f33ace4bdcfe48c6e4\r\nMac = a1046d4b29fc50ed94a4\r\nResult = F (1 - Message changed)\r\n\r\nCount = 261\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = c7aafe7d3b419fa4ea06143897054846ac4b25e4744b62ba\r\nMsg = f1baf3be69f69611fcd47256e43830a1b3fd8bd3952eb26ed679eda7a4e0\r\nMac = dbc419e1ddd5cfdc63a7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 262\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 58c219f2bc8ef2ed7a82cf70e4af4747e36a30809a5a6222\r\nMsg = 622642aa69b3efe14abe0a1d2ba20f3f76efddf62e6cafe2845c4dfaa501\r\nMac = 4e496c3d2d84d11923c2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 263\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = abccee975feb10f635d548a8502f7c8b6adbd2be74117257\r\nMsg = 4f37a460d180a12789779fc335326c983ad6b18295b47f1715b82b2dc704\r\nMac = 41b234e0173770c469b9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 264\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 0218eb619dbbde2e846218339aee4383792856496eb3b85c\r\nMsg = 28d3510a37d5f8481e7f22941c1fb1d6c70686fbad9747a23c9d5f18dfe2\r\nMac = 3cede44c942387d91767\r\nResult = P\r\n\r\nCount = 265\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 88b2514f368d51db283039efcde1891652a77daf68feec43\r\nMsg = 067a3a0434e92cac02710221fbb6dfcb7ef0264e2994905491317c8c3697\r\nMac = 128e652ce0a8f1a6194d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 266\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = f2a78c449621278e9e927fcd50742d042d98d5142380fd3d\r\nMsg = df899dd6b99cc28d66604ca92431fa7f442a4927d03b392e707b548b8ebf\r\nMac = 2eca3c42b5e5d0f3b9e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 267\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 01fbfbde7dfdd6f0a0c5244cf6c36eece4d6dedd8baa463b\r\nMsg = 485ef613bdab5473763bb269a0d8c7a4bf4850bba072a96f8fc39a31cbd0\r\nMac = 333eb331d6a0d46fa279\r\nResult = P\r\n\r\nCount = 268\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 6ce99c231d2ef0fd48c2375dca93f8bb0df97d4a44e835cf\r\nMsg = 32d71e59634126ac6c6156a80a0dfa0175b29e9f40a3169680b1c15830fc\r\nMac = 3e90350e115c425ba466\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 269\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = f7a93aab5707ca3d2362c5669198e0218493acc3cb7b02d3\r\nMsg = aeec40ca8964fd6a67d3dc871ebf1bfb72f52907f1d6ad441bf2cadcc6d8\r\nMac = 7381d65aa138c86713b5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 270\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 84f39f5207afcfd677a7544579f2b888a1eabdee4e835924\r\nMsg = b8d21e9c70bf63f04be311d50f84aad7e1bd2b0e517434ab978d68d01c5d\r\nMac = 4ab61c537f8b15f824cd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 271\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = d488bdda400932de56a9f105f0e74ee79c2ed869faaadc31\r\nMsg = e64949ed85de6359595f286e29014c26daa7759aee56e4194ee958774606\r\nMac = 2752bc490802b9dd8686\r\nResult = F (1 - Message changed)\r\n\r\nCount = 272\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 76ddfb075fce4be8854185c6899a88d06e24854506b31237\r\nMsg = 9d86ae7d70e839078babf7fd60480a4351690867c6a8af837d9ad465220c\r\nMac = 2522efecaa1ba11c0260\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 273\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 618041501dfcfdd2b60d71c04d635f6357ad8b0643af77aa\r\nMsg = e5e6b57e74ce7afbde3697e2a69d61ca615aa3dfd32fe31f5521e6ca7987\r\nMac = d958753757a11eacc848\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 274\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = dff6b9493de80447ee18ea7311fc9b8d74f77ac1ab21ce84\r\nMsg = d70aef3532bdc5293a3ebb11589ac1f801c9f93ea0d656e1d04068facf9f\r\nMac = 9a761e0e54767e414cf2\r\nResult = P\r\n\r\nCount = 275\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = d7780ba2dc5cc584472b64bc9f6246bedb27c70aca22c0a3\r\nMsg = 14691c1b47ff1547c1d2151913c2d1862d8f54782291ea202caa3d8ef07a\r\nMac = 78a2bf3a5fc87a14e090\r\nResult = P\r\n\r\nCount = 276\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 3bc5dba883e2e3b81df06760cc32f11009cf5a5503cbe864\r\nMsg = 9d043e368b41acb5eebb99197e15adbc3d19175a0bfcc97275e3e5efcfa5\r\nMac = f457293acf683c873add\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 277\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 7b3fba25c5ef410ecec62276b105ecc01c325dc2530e8364\r\nMsg = fda4bede287c57eea4448af5e99d41c7d307d1f202af7f387f874342a29c\r\nMac = 0cfb78ede5f4c185c33b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 278\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 38efdbbc5645f65414b9cb81d2f9e4f190cf6e6e05eaedbe\r\nMsg = 50422c5e6a0fb8231b3bb6e2f89607019be6ad92a4dae8e0fe3f9e486476\r\nMac = 0c1acd8e8527e2663486\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 279\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 10\r\nKey = 94ea5b0aa6c8b07e379122006042c920077bd61610df6b4b\r\nMsg = 1d52f401f01058356d8c4c630f64c5322caa6063d6365ebf0040ec4ee12e\r\nMac = 2dec0d3bca617209b07a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 280\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 5584994f80640233ac8eb4d2f873e8c997499095250b48b3\r\nMsg = 91febca4f1ae7e27501400c44ce8681ec90f5a5637c962db142c9284b1d1\r\nMac = f0b3135c1748e823aed10c4694fc60\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 281\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 57e99653fdcab10135a2ee3bf45c1be69e9ed57bd74dfbad\r\nMsg = 51c88fd98a7d82043a1500fc3d8a66ba7ab7760467c7fd89cfeeb22dd257\r\nMac = c588ee1d4f330e51872065c02cae61\r\nResult = F (1 - Message changed)\r\n\r\nCount = 282\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = f622d736124641bb7d53706bf2a69db2fc31461fb92818be\r\nMsg = f09569906",
+    "381138cc49e3fc2384c5d33c34abd3d617c487b52ec6ee7b510\r\nMac = 610e1c1f9ab35059580061b8662a81\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 283\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 9662baae49c26e5452f3304ceed3b78326d2020a99a63f69\r\nMsg = 1d93aca4e2e31f5ebb84fad580fe74f5b6d1d86ab30cd0c8031be4090be1\r\nMac = 3c5a4eb51ec58ef3468bb00e7cae8c\r\nResult = P\r\n\r\nCount = 284\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = f2100615431349aba5c4f5a7f358fe7be579f4cb9e8f33d2\r\nMsg = aaf26bff7ad4116969c15d9206de6c737b7dda87619e3575d9b6b2efd8b0\r\nMac = 7396deeb4316fc6d84d3af119656f3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 285\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = a5993acbea8c55d7eb55d60596f83e1d9f2cf636d06240da\r\nMsg = 0bc1fede6a6ed9e1deda82612fbaa6e60f0b2461fd5d131e6a7206f41a07\r\nMac = 2f6b0a9f2a972d299bfa5892f8ea83\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 286\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 775846f9dbf36415640276642cccf87e3dbdf6519c5b2db8\r\nMsg = 4fc989f327e1a1cc7b8af618ee6ae6d25f78e2b76b681455336945655f13\r\nMac = 8b3cf3171912096763a2ebe5ea9e41\r\nResult = P\r\n\r\nCount = 287\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = b214b16bbac27ccc9773d3c8dd31275da4876c039740ca8d\r\nMsg = 7786a3e30acffd6dde375bd859dd6be2c9221b979d0c66d1d5ed6e00b73f\r\nMac = 1a73acbf4e9250610b74c727b9c42c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 288\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 032b4cfce8a1acd89de5f6f78794e2813bbcdb89959dafec\r\nMsg = 3f0bf0141dd3ace0fabeace61811eac5ec801deb7ffe3b0514d43db90bf0\r\nMac = c24066cbc00cb5c28e48141b627411\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 289\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = a053255875ed4b5193bd9c5fa4172a1f660ecfd2a394c2a5\r\nMsg = 14666eb960c6b4f8b6ccc49f79a039b12c02e0972c300f1e9d0a38c0a474\r\nMac = abce3abc224772a43c058016bf25bc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 290\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 0ee87b40abaa99f598fba22c3e677a85ca3ec95c3a51aca8\r\nMsg = 1bff19aacb9c7d0a44a15ce686a2469e3934d086365d36f449484498353d\r\nMac = 4d565c2e12901845e77ed8b02746ca\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 291\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 3384f8563cfd0fc8019bacc9b691c9ba4ae6dc8cf4c00629\r\nMsg = d31e959cf7842db351db407266ddae0b36e37f34270576724083e9989764\r\nMac = 96d0dbf51d96b532321da593383964\r\nResult = P\r\n\r\nCount = 292\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 375904fb9fcafb7f19877b145b0284cef61ac7a3d88f537c\r\nMsg = 441bd4db5e80c7db1b575a19b7bad021a719658a2c818566291d3cdd32fd\r\nMac = 3b8dac029f6658e44e5f5bb8f8ee40\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 293\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 3c1ca347a7d3d8db8f704410c493d7a65718cb7bffec2dff\r\nMsg = 555fd02fad4f44484133f9472c050f9da27390fa2a3e48cb0be0d7020171\r\nMac = 32be39d874c15a0fffc7111f76bbc4\r\nResult = F (1 - Message changed)\r\n\r\nCount = 294\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 8bed296a3ac03fbfb71422b9211799150b9d766a8116bebd\r\nMsg = 6df3de543cdb6d1adb6ca7df6b5a4510fc8379a4f2c87497ad1c2b9a69da\r\nMac = f24ff3218e7905d81c3e99c84bfd26\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 295\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 9530bb291d38f6bed10318081dde8fd178f02eb0e8b7d022\r\nMsg = 5f48624302d1acf7750994d45f0999ecd89a3861cd0268d5a51e672124b1\r\nMac = 0afed54c577e550eba7ac94a2d82d8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 296\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = f5400b86ace6e3da5f090befb96fc05d0409bf41fc77b4e0\r\nMsg = 1c79b055fded54af5ad2f3253f93a090ec003863d9458d3ff718c4c13937\r\nMac = 59f94d4b13539a5f0a8672e4599bad\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 297\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = c033e4a512297caecdbead892b11a9f7007af9a74bcab89e\r\nMsg = 3ce965d58856663d54269af4791ec57ef98227ea387d525769c23ab74674\r\nMac = 0dc19e37a255dabb61957f7f89ab06\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 298\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 2459f951d1255d093b72144b83b05ea3185d5123d1ca864d\r\nMsg = 661c6ff41af91a6d828a4d5d507f8a9130abe91412070950c5fa4c75c8d7\r\nMac = ac8e75b4465a52b3a7da3746f9875a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 299\r\nKlen = 24 \r\nMlen = 30\r\nTlen = 15\r\nKey = 3b63415210361822e23cccf0faae88cd7642f44cec45fe37\r\nMsg = d7f78e950d2ab520a6f1e82ec6f206b2e8c71131c85234bd80500527f131\r\nMac = 15e59760acd3dd74155d6d3739c189\r\nResult = P\r\n",
+};
+static const size_t kLen41 = 61387;
+
+static const char *kData41[] = {
+    "#  CAVS 11.0\r\n#  CMACVer information \r\n#  Algorithms tested:Alg = AES KeySize = 256 Mode = Verify  \r\n#  Generated on Tue Mar 15 08:40:45 2011\r\n\r\n\r\nCount = 0\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 45b74171271e1fdc19f9beadda58010d843af69dc2f4ad003dd74b9b570d5a98\r\nMsg = 00\r\nMac = dc0ee796\r\nResult = P\r\n\r\nCount = 1\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 2cb4239fffd13762fb5391f5a4760d12d96ea12666a793b4d651e9f4891c22c1\r\nMsg = 00\r\nMac = 2e19d6cf\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 2\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = d88586da8b605a6fd5a45d316b89fea15e27ff4d92238397718e68b8e00ad605\r\nMsg = 00\r\nMac = 8ad78885\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 3\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 136ffda3359fee8c81e6dac131256f4bffc0d3c3e74f8aaf2f979a0fa5b8ed32\r\nMsg = 00\r\nMac = e430d0da\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 4\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = e1a7867476bee9928b7237ab7a3d502fbe3d2d45b6e4c41aa9f12b79099f019d\r\nMsg = 00\r\nMac = b6f00f90\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 5\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 5b4d945d55dea22e37821ec396476a4bfb617d2f392ad93afe67bcfda9cd9b72\r\nMsg = 00\r\nMac = 5076ef43\r\nResult = P\r\n\r\nCount = 6\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 23df62a79fd5866425427d0ccabf05b16590e8452ee22e028b51910926ad314a\r\nMsg = 00\r\nMac = 7bd29398\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 7\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = ce9da814595f76a7e52a1222c7c9a6579b3cc2e393ba51580ff6cc9b6ea2ad8a\r\nMsg = 00\r\nMac = ce872fd7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 8\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 507c4f32246d637fe08e454c638b014438109e1fca31f724d40ac6ec1aa20268\r\nMsg = 00\r\nMac = 282a7ec2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 9\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 537dfe9fc000468dde29800549b1cfaae67ad89d22c8264d7eadcd914ac54ef4\r\nMsg = 00\r\nMac = 7936b7d5\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 10\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 1f57959cecbd377374477e33b34979814f260f77867392ed645998f73a3b06ae\r\nMsg = 00\r\nMac = b4b63264\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 11\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 3d272b4a1a1031369aff514e2df98d580f972b5abeacc05cb1288e6e473c0fed\r\nMsg = 00\r\nMac = 18b35edb\r\nResult = P\r\n\r\nCount = 12\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 8774d1acf96362215a3d1e51e1a52a980685dec4f3afd2d438c03c00c04a79f9\r\nMsg = 00\r\nMac = 80eb7a84\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 13\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = f37155beb5eed8899d9ed4b5fa21b60b40af289f090a355d5bb1aee52957cd99\r\nMsg = 00\r\nMac = 6827f73d\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 14\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = fcb52c44379ae8083bdc7b827383df93cb1a7ecc21574730f9fe003b7302de23\r\nMsg = 00\r\nMac = ccad16d9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 15\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 83e231ecf8913ebce00e62b8f00c1abbaad710142fdb912c54664169f7af0e51\r\nMsg = 00\r\nMac = 8e393f56\r\nResult = P\r\n\r\nCount = 16\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 7d35e77450e2adf8805d5ad67de5835b2c5dccafe8440865c7e7a1501ed53a98\r\nMsg = 00\r\nMac = c6899710\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 17\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = 87143071241bb65261fe7afcc102416e59b9e46ee0c9007308f0eec10e45f6d6\r\nMsg = 00\r\nMac = a1a4449e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 18\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = d30d2d1670553c71ff0264ab861574dd03a103d954226d1b540f18fc47b3fc29\r\nMsg = 00\r\nMac = 217ac763\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 19\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 4\r\nKey = d6983226b2c3a431abcceb77c8ec6b9bae80199115b28c5d7c56561e1b12944c\r\nMsg = 00\r\nMac = 26c717ce\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 20\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 0cf53b4aae3e0a209e58385dd32d9cc6163265241332c332af4de4b99b4022fa\r\nMsg = 00\r\nMac = 1bfd19f6e1070186\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 21\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 5f988f38410d26d293ef32d74eaa81acca82545e767ab59dcc750a09849cebad\r\nMsg = 00\r\nMac = 7e52911c0d7987a2\r\nResult = P\r\n\r\nCount = 22\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = d8fd6e1dfcca8f656705aed7e356a576baf8907c8d10d54c833d62a8a6703624\r\nMsg = 00\r\nMac = 31b478b4b4adaae0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 23\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 49fd56dec210e903f6c703332637f9c267eab9333e2701a16c74ce5e0b5a16d9\r\nMsg = 00\r\nMac = c8be2b36c93684f3\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 24\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = fa282e1f3276a3e0c769f2ba25ce830591e860300cc03ab57abdb14c0374d060\r\nMsg = 00\r\nMac = 27b8111c3d9f14f1\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 25\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1c6942e914218135496e0d7910abe67b9f7f29bb09029bb37021865d7543c4f6\r\nMsg = 00\r\nMac = 466b7077bec98b7b\r\nResult = P\r\n\r\nCount = 26\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 08f199a8d7e3ea821dd3106e8947cd2e9d485342b25a64713db2b8a650a49ffd\r\nMsg = 00\r\nMac = 796deae0d06b1bf4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 27\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = febacddf3448c7464297ae53166793e2ed962de0d0947c5e5e17abe3cc103b07\r\nMsg = 00\r\nMac = 5e2d21aa3351a2a0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 28\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 59b9fb83b6a85f017bde6c0ff3ced955b9f343cc71b680c6b591302f52759412\r\nMsg = 00\r\nMac = 3e5428eca10808b6\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 29\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = f07e6655424125462a96390e02bfee9d89cb271bd9bbf22a9de45f6b7e949343\r\nMsg = 00\r\nMac = eed5aed01096226b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 30\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = a04f84bd79406c138d02698f003276d0449120bef4578d78fecabe8e070e1171\r\nMsg = 00\r\nMac = 18553226e5f9788a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 31\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1673a52494e9af02472c1777232aa3813c7c162593eca7112f34b3807009af5e\r\nMsg = 00\r\nMac = c5907fff58c68ee7\r\nResult = P\r\n\r\nCount = 32\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1e4ffbed2d5a7bcda5e24a66048660629d57567f83307087a846db8246ff332a\r\nMsg = 00\r\nMac = 29599bc212927246\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 33\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 8b80c24ab4a3c24ced82ca8c69924553a37a139bfa2541c59e15188ab0fa5a34\r\nMsg = 00\r\nMac = 299746d93b0b4881\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 34\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = a00ebf59768f6437b48a91923f5effcf31c745b980f79f2edde9ed18dcf2ffa0\r\nMsg = 00\r\nMac = 61950ed83db6bf74\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 35\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 319d3f58fd7257901ff364fa68b86b1ba27c11962b2c5be8e33eb95548444322\r\nMsg = 00\r\nMac = 26793e8f8d5eb7c2\r\nResult = F (1 - MAC changed - for 0-len msg)\r\n\r\nCount = 36\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 015a9d1f2df2c31f14cfbdc0bd68725fe8113a024f2a43312d963207fd6f0d88\r\nMsg = 00\r\nMac = b19fc2680b8b82b7\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 37\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 003cff344c4e1932ac628440d819eaaafcc3ebe7c525cb7abb7a6716d2b76e05\r\nMsg = 00\r\nMac = 48a98dbf16257142\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 38\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = 1a581f36e1816d346f7bcc6df78316aa353111e447fee6f0bd05d562f30626ab\r\nMsg = 00\r\nMac = 587155c18ebbf8b8\r\nResult = P\r\n\r\nCount = 39\r\nKlen = 32 \r\nMlen = 0\r\nTlen = 8\r\nKey = ebab54c4a22a16f7d9546bbf682b995a6ce944e949f1920eee058db95ab9c93f\r\nMsg = 00\r\nMac = 067927f063adfaac\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 40\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 58405ef8fb69e88221edc10a92c01cc44255aa7083096adb79bec3a8cec6d050\r\nMsg = b4aaf9ad1bde60a8d7e7cb16c1cf6b713df17d1507b028973068a95963a5ad5b\r\nMac = 42ffe65f\r\nResult = P\r\n\r\nCount = 41\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = ca0f404e3389e9527135f53eb58bca7726266b8086d33fb512e8143daad7633a\r\nMsg = 8f2a6b2185f73372ccaeaa7f93d30d1ca80a451ee0e46ccbbaf98c8f3f37aaf1\r\nMac = f2b311b4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 42\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 67b896b88f07962e08471634ab7e522144d716a2969bde55a05c3c931f747a8d\r\nMsg = 0218eb619dbbde2e846218339aee4383792856496eb3b85cc43fa81446fedc5d\r\nMac = 69db1949\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 43\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 422994df8766f7a6a7ebfa2ca57ed6189d9e9e8455c8715c14f3f407b75dff4a\r\nMsg =",
+    " 12f0c45d06a138a964fb11b2d450620a2977bcd2952afe371cad6e3d48b009bc\r\nMac = fc5f1ccc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 44\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 3291be3aecd2e06cd2ee61a14d723450043d450567cbb0bf88ba32972d86dca3\r\nMsg = 343d5a4ad39acf81adcf24e9807618932abcb3bc076734f179174c77c8cb89e9\r\nMac = 3593d615\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 45\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = a1885ce431cedbb60f7b3d96a06cbc60a964df156ea4b4191abc5a9f60a0c361\r\nMsg = eedd0d767a25b24ee25fe747718256af51d7b4bfe900adc069381a71a2dc7aad\r\nMac = c558f768\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 46\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 039188ec58fa55acde53c337fcfd0013f0c6efa55c60ce470112159bcaada11e\r\nMsg = 009f47f180e085776be6644aeac0070be64c289f84a7ba3dece7cdc54f0db354\r\nMac = 20d3639b\r\nResult = P\r\n\r\nCount = 47\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = f7d946f66e1cc4e5a79dfb5559cbea5a128545eac38e17ee7f3bac9a806faefa\r\nMsg = f250c49f9882f10db247adfdb2112c2589e1011f77c48e0f219dbf85e326f8a5\r\nMac = 90b4bfcb\r\nResult = F (1 - Message changed)\r\n\r\nCount = 48\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = a61f586ddbbe0219187f8f446d4b172f5e9bf855d1d5d6592ad8e03eb4d555d6\r\nMsg = 71c8eb0079559a306e236c49b7ce1b6cfe26c7888733eb7ec07690831a72c0c5\r\nMac = 78ce0135\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 49\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 7774802fd82fe96c05431acd40b49b1160d403c0db09b10f23d0bd0435022edc\r\nMsg = e75b6ca1b87e775b33536979422a1cf743f58c71b1599adb00050972c843cdf2\r\nMac = d885703e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 50\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = c4261ebb87a76aaa82a00392ee2e2318f0b52d5f2724e374847ad9ea5c8929c1\r\nMsg = a41bb1f256228302cd0548ae2148ff42774d18c2d6d3e38b36bc4938da13bac3\r\nMac = 857d8909\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 51\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 6219c19233c1b91d7785fde3b65df3bd2e1d74331ba62e4d365947a77cd243c4\r\nMsg = 68f17b9f57734784144112c79bf360ee324d37f9a7718137d954b15e796fa9db\r\nMac = 0e85de57\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 52\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 7e8cae1374d3a21bf2dd3786754668f17aa63dd5e3654cff9dd18041806d1968\r\nMsg = 2d335be62ecfed45183f5a04014c1a52afb7b918b9cc1f2be93b15c6e5240537\r\nMac = b56ee72c\r\nResult = P\r\n\r\nCount = 53\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = c2425ed20cd28fda67a2bcc0ab342a49d79d6b4eb196266cb0d116fc18895545\r\nMsg = b5f24c00cd15e377f444ae55e02b335379e7ae14e7c9bd05f0575d8981941553\r\nMac = 2e44c573\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 54\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 1f7871680bfa59a8a178604dc513b51a3d4c682cc4c421de594512e9dd062ad0\r\nMsg = fcb43224bf8989e1809d90481ba043328febaf4b6c1c05d18800ed98f4b71c52\r\nMac = bee03b92\r\nResult = F (1 - Message changed)\r\n\r\nCount = 55\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = d8a27558d070214d3f765cf969b2b8f09c0b14ebc492cb2539072b04db9f29fc\r\nMsg = fc69a1f0d0ba8eca9e7c0570cec9c76b511c74b2d8b65928444189675eb42fbc\r\nMac = fab3b2f6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 56\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = 72354b455230b72a6dbfa5cf6c3726d7f8e65ca773f9d469e99d165743657b36\r\nMsg = aac60835c309d837aacc635931af95702a4784c214283ebbfb43c4e29973560b\r\nMac = 69519d9e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 57\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = ca92b095173076a40e24522297be27fd3a765c8d417f24c71a9f03b3fe3d8e20\r\nMsg = a96c4d5c89a364263c97a453308b9360bc0ed868602b9ff54fe13f162ad31ab2\r\nMac = c59a1a39\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 58\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = aa56f98e03f559eea02ad958e125f2312ff97bc3310079ce437b383f247a9b3f\r\nMsg = 01bf2aa8dc66ca44d16d4567f1adddd4461f78706ff15cf68ad937eb57aa62d5\r\nMac = 31171cfc\r\nResult = P\r\n\r\nCount = 59\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 4\r\nKey = a0e317b790870e6703e6077dfb8ea327c12e29a17107284cb89d5effddb2d9a1\r\nMsg = eb4ea6b72dfc6657e835bf82054796183330c02a8db3c5b179abe37fd0a05675\r\nMac = 05d54199\r\nResult = F (1 - Message changed)\r\n\r\nCount = 60\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = e3de27949ff64066131c81bfee172b308f9bb0b31710678ec394837b79434605\r\nMsg = e41557341e8dae33568524f3f64b23426044c9db3526463ad16786af14f611b2\r\nMac = 975ad1d2fcff6a85\r\nResult = F (1 - Message changed)\r\n\r\nCount = 61\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 492dacdcb4a35fc438a6eaa35e26d2f683a1e85e92df28f213dfe1da6511161a\r\nMsg = 0515ad7b8576258645d37b7ac771745620e2e9e009cd778f34ed77a7dc5c30a6\r\nMac = 9f43dba2aad2f539\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 62\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = d71c50d55850d432cd8c8ff4ea427b3f19cbe14c785a7704202fcbcead0de5a5\r\nMsg = 7ffbc4a09583029cbb0acb6b13f08a189033da22c2ecf921f01d79ac68a9397b\r\nMac = 5d00ffc5f8cf1ddd\r\nResult = P\r\n\r\nCount = 63\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 557eb2e709d58915a8bada6433f2e5660247e0cb1588ea84a9d24028090eb396\r\nMsg = 003132645e3026f6a2b9d0644c16e5e4d1bf8b53a51f0e1b999bd45a67d19341\r\nMac = 6f3d9f50d09476ef\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 64\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 351d779277148ab4474843cc798942cacbe863eb1c1c9338dc25e251c12fda68\r\nMsg = 34bcdd3d0469c01d0d95a85ca705d887385bfde20596a90b47d902db826dbc8d\r\nMac = 79ded259f93456bc\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 65\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = e1c17ce3d3c61468a7652a95128bc0f6c33d9ccc46e7490327f15f645a94040c\r\nMsg = 97829c60ca9a71c23eaf1c4b4fbd72043037ef0cd356b68e0db0d4f0f50cc54d\r\nMac = a93f0d16499f63ec\r\nResult = F (1 - Message changed)\r\n\r\nCount = 66\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = a9a86a4407b7ecebc89434baa65ef173e88bd2dad9899b717ca578867c2d916f\r\nMsg = 25a152850b4b80b19d8f0b504b2a8a241824b3a1fca8d85c8713b2c0c84b5e02\r\nMac = fe84ce3defe00f67\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 67\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = ed14373671cd8041e00874b5d098ea225eaf9c68bb51cecbe8083149bdda062a\r\nMsg = 38106cdc72b1ddd0fe11f23819096dd7479e95ee9730940c28f51e28eca653ed\r\nMac = 470404ed731640a7\r\nResult = P\r\n\r\nCount = 68\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 009f47f180e085776be6644aeac0070be64c289f84a7ba3dece7cdc54f0db354\r\nMsg = 2eced43c084a86f89f61e7237425137c167aac29e4cac4071afafd3f0c9dee1a\r\nMac = f67d432e5b6fc5e4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 69\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = f250c49f9882f10db247adfdb2112c2589e1011f77c48e0f219dbf85e326f8a5\r\nMsg = ce61d6d8de1b299c9b063d1e1cb1faf7a616faa7c6673d7f9c0a1ebe7ae285fa\r\nMac = e1d950593abc14e4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 70\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 001150b2dd572288b6fde466ec2c2a64c75a9d516b7096f7082bec9f52c20ad8\r\nMsg = 6dc38e37d1379732df4dd535db88d17aa59d7cf9e8d60ae695b4047b90d899f7\r\nMac = 2de6700fc1562ad3\r\nResult = P\r\n\r\nCount = 71\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 68e00d394855b6697da8213a120dc2213b3a8a1e88c9b93f5edef465a809974a\r\nMsg = d21aed2073e8ae9c0560f9dc1adb961d4f959fa12c0384a44c675192bea13477\r\nMac = 9594f10d5ce5e616\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 72\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = be0f6052baf658a3607d999b81401edf7e2afac2b143e1b908c8ea0ff38193d9\r\nMsg = e502f0b4710bfe517e783c4bbb85055c8471b04e12dd6776f276367fb5d36369\r\nMac = d409a879dccca77d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 73\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 7147b3c5ffb2660c45cd8d78a6fd44bdd5ba75349642b32ec88f6688a287297f\r\nMsg = cebe84df789c98dd125bf43cd993e2f089611b98d10be04904e2468d116dd2ab\r\nMac = 21cfc1e6c1c38df8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 74\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 205e751926038ef940c6599d84a9e1b4737bc826e9fcde544d43f2a10b5de931\r\nMsg = 86ffd5bd3bd1cae10706a61d247b2257b165f37cb53ff21761077a2295a9111b\r\nMac = 73d66ea826b84fc0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 75\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 8c8a502eafcfbb813dd1ea907b1660a41fcaa3f905aa93c22320f96ebfaf632a\r\nMsg = 626aed82974ef29a1ba0a6c6fefcbf34ca982e6214835183502f6a24ea2e500f\r\nMac = ca3d007ecd99be83\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 76\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 596db502a357e102566291b916b32b8a09e99d3739f5e6543a2cd8fb0c9a1cc2\r\nMsg = 22bade59214fa4b933cb5e3dc5f096e239af4c2f44f582b095c7fea6b8914bfd\r\nMac = ff4ec21d89d4762c\r\nResult = P\r\n\r\nCount = 77\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = f51f2fb4b3fd8045b70d34b600a2697cbf7503be0d8cfb5cdc60f9312e3e269",
+    "5\r\nMsg = 4d43702be4f0530319555d7f1a3356160f6cae48051f12e22a153d7e405c1149\r\nMac = 3d615ee77043d8b4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 78\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 80a4b14f951490618ce53d39abd3d786b425d4f76b26a25052d98ebdb7e9e666\r\nMsg = 0b2a77b0175ffafee40cf83bd19e785dc7ec4319786c49b3e7a741142aea901d\r\nMac = aedcaa2e26d2f5a7\r\nResult = F (1 - Message changed)\r\n\r\nCount = 79\r\nKlen = 32 \r\nMlen = 32\r\nTlen = 8\r\nKey = 39fb57fadff7cd9e1cfdba154422b71d693d08807d86da46ba63c929417ea549\r\nMsg = 567c7400f190d06e682b3dac5f751639a9007362b1a2a8b618800fbb9f6c08df\r\nMac = e29461fe8c6b3767\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 80\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 535ed61510eb268100be032b7a258e84bdb32448269d3000a76444ca74b4695c\r\nMsg = f7f28df82f910badc5f4b3860af28cbb6a1c7af3fafa6dae5398d8e0a14165def78be77ee6948f7a4d8a64167271ed0352203082368de1cd874bd3b2e351b281\r\nMac = 4a0fd541\r\nResult = F (1 - Message changed)\r\n\r\nCount = 81\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 713fd349c56d1086794eb20ed59ddc89b065bb8533b968c6dfa60bddd16646fd\r\nMsg = 4f3b91aeaaabfc7d4dd6821549d4eee2ea17f59aa196c67b422be2d46f3a2ec65494464c969b157985a6a30199a72dfb1c0b7be524e16ee9c43fd95e83e19192\r\nMac = bd4eab1e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 82\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 1f89d9ee93294aeaf3503d15a6dbef48708de48897a72b3545b9e3852eb7fe31\r\nMsg = ea0608b19f47676f0f342cc2742e003a6a74fa2850f41e0cf162235163887a3830dd8b13b45842b3c686ca239bdb9897e646ac9f440713a0d8c5b18532db3db2\r\nMac = 8bddd404\r\nResult = P\r\n\r\nCount = 83\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 2b50dbe8a5ed0c7cb69aa60a38d10cfa4553c73d58c0ce84b26504b0fd55038a\r\nMsg = 2586563b0102f662b5a8f9bfb0c1d107a4c27569d27bc066889213e3e830427ceafaae1ca543aecaca7f34c671fbadd518cc28d9e806bba43b2e220e5cf1aa45\r\nMac = 987514d4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 84\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 29a7ed3aa55c7eb7e5bf343ca0efbf8b2062ce67b086255551a8efa0ae16569f\r\nMsg = 2e6f2d21aa133a5061622f08ac64c6b3a3dc8154862033055c27c3a3d9e42dc885d2c9f91bd1d0212f301c3e140b2f5bfdd777be623bd162a6214ba8f60e2e49\r\nMac = 1bf45457\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 85\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = a16a2e741f1cd9717285b6d882c1fc53655e9773761ad697a7ee6410184c7982\r\nMsg = 65916ae3d88ab2add5c0c6910ea993d385cbd35c5077ea0d9db30e53f378abfcbb1e0649fe14204470d4dd53ae16650ec444cb4ef22fed86b0009b57ef71fb5e\r\nMac = 578f80b2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 86\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 47e49e5b57fbb834932fa32107697471119f1be3c3a6e71a8c474d4b1596e539\r\nMsg = b3cec7ad75e2bf6c87029a67365aa83cf797ae2f4d42e720ed4c48ba21ea08ee6aa3609f69a6909fff6222dbb45172d255146e4ce1c59b48a7895936a8646766\r\nMac = e6e64597\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 87\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = f0b0aaacc25a791c236aed0e9b537fad00a15efa9c89b5068ac52c64639fb1de\r\nMsg = 9a5a9560baed3b8e0e90b92655d4e5f33889e5d7253d9f6c5aff71ea4069224cfbdd19ae3f0ecdfa65c27dc3bed721712784a09fdde243c193ab6a0ac2417e8d\r\nMac = 990bb31e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 88\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 14db1ffc1c87117fc72981706c0f90404acc98aabe950839baeb6f0b727bd6d4\r\nMsg = 3d736aeca5720f5c7bbb16df61f6d785facfa070aaa89c2d9e8af9450d62490ebd6a29c7c8e521e4a00fcca7515439f006c09056cfb7f976a1e6b98b9f799e40\r\nMac = a6786e52\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 89\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = c6f0a3692c9280c48393b0dd763e5d0b90477f34ad69f192ae4dcab771aeeacf\r\nMsg = 8439ff717e1e15161119494d368d7f3812601588265bbefbc6d48e22cc8a51688dd021500cee38fe6ec402f9aeb0762f92b2a73adece96e1c7b24be2aa9924ef\r\nMac = 70126cfa\r\nResult = P\r\n\r\nCount = 90\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 75225a26d63e91281fb37ace46354f81de99dedfde8b770ea47f08503aea87d8\r\nMsg = d729d8cd1631aacfe485b1f408a4fb60256e7a8ed6e5b53afc34be7e57f1643b549fa9ba2677779318688ece225cc149babd6259ec37fbb4adc03e8f6dd63f03\r\nMac = 5112f762\r\nResult = P\r\n\r\nCount = 91\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = ab72eef2aba30205c986e2052d6e2c67881d24ae5fceaa8fa77969539152527e\r\nMsg = 5251a0aadbc92b76705eb053d09b25b5ad38eebabfe1980d143ac90aa81f7723353059824c8d9befa5ded6f5b4973f407c7a1f4aa85d8337d82d34fd3933e9c7\r\nMac = 52f7a014\r\nResult = F (1 - Message changed)\r\n\r\nCount = 92\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 6906d6533fbc33f56e38e6a639798005daa228ebd2fc8f93803d26fef30b8e95\r\nMsg = 6341370e126097f9721a13c977eb4875cf1286e15c3adfa4e7597e0e13d93b6a8ff66c809067fd5e7f40c358ee170d4ed1657c2deb3015b886e79589678e0452\r\nMac = 1b6a021e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 93\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = cd9072aeffebbdfcce95b569c34158d0e130ef24dc99e3f98a4dd246949be269\r\nMsg = f882339f93ff114bfead78044aab1c7fe109dbf1bb2d968ad476403fdd2034cd3168ccfb0cf02f1ff7646ae3875ec349478749edf300b08be7005cc0d6bebc15\r\nMac = d16bcdc7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 94\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 3005c0100dff59e5e4b0e3b95abbbc79749dc49ba29a79b1fcf7613ecb6aa9c8\r\nMsg = 4c2c670f3ac1c4e33a8d43063c8983e20f1ce6a73299fef1e70a42a5882c061b1ebaaa8330ee1181d946541b1d84b8d57df8de1ac9013ade36d2c682b172f8f8\r\nMac = e5689100\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 95\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = f32eefb301356fb1cad6dfa94864542b5f8cd8e98438bdbfbbb431f0c10f12b3\r\nMsg = dae6db62842a8a25123e50041b701ad17e2f63a0496443c3d905a9f943e6e4e2f3d369b693ddd0372ff11fe496af4b700378fc72fcc9915e7bc864b44c1d4f77\r\nMac = 280624c3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 96\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = b0212ca369c611b725eccc3daa58df412787a3475f418d820971af46773382c0\r\nMsg = 13ca022396285bf7b82a600b560208c54ee14f8496bce684895029027e6451a09f4eeb0af9b889dacfa4b7b934ae30c7d991523e23edd0528048a75bfc525335\r\nMac = 8e9759db\r\nResult = F (1 - Message changed)\r\n\r\nCount = 97\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 57a9d1ea216c69c6e360221f8c858a9d356598a8b253e2cf67f1116b5df5927f\r\nMsg = 77772e91be674abb0f496b47dbd632e5616177a0d16a8c11b271c2d381082f379b2cae385dd526b189cc10cdebbd33bf3d8db2b449ed49064d30d4b3a359110d\r\nMac = 41022947\r\nResult = P\r\n\r\nCount = 98\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 749f2fb720d321757473afc5d3a377a0eaacb425e5591026e3a1bae6a785b921\r\nMsg = 2e4f5149d67c955c409b63b04d95538808da6202e69a50ed4d3846da52fcbc76c7089a17758d9d94a63efd5ae7054dbc0bf5a28b7381f7e78debd0549bff1e11\r\nMac = 67b34b0a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 99\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = f8ebad761b9e73c77faae3fd9390093fef595e77e6d7f6b35e2dfccbde925c44\r\nMsg = 18430f34d5b5fddbd228a910cab9c48e1ba2b5f57819eacbde756cc0c993b736a778c8008d37776a2915077af8ecfc76b8cd2ca621e9195bd0b27e31843d2890\r\nMac = 7a446398\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 100\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5bb9fb83b6a85f017bde6c0ff3ced955b9f343cc71b680c6b591302f52759412\r\nMsg = ee7e6655424125462a96390e02bfee9d89cb271bd9bbf22a9de45f6b7e949343def818dfc93d777528f609cd38be0a013b1eef816eb1f9593a850bb7aec5b9a7\r\nMac = 5e1fa5b9c9dcd90e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 101\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 57a9d1ea216c69c6e360221f8c858a9d356598a8b253e2cf67f1116b5df5927f\r\nMsg = 77772e91be674abb0f496b47dbd632e5616177a0d16a8c11b271c2d381082f379b2cae385dd526b189cc10cdebbd33bf3d8db2b449ed49064d30d4b3a359110d\r\nMac = 430229471a1cf1b5\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 102\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 749f2fb720d321757473afc5d3a377a0eaacb425e5591026e3a1bae6a785b921\r\nMsg = 304f5149d67c955c409b63b04d95538808da6202e69a50ed4d3846da52fcbc76c7089a17758d9d94a63efd5ae7054dbc0bf5a28b7381f7e78debd0549bff1e11\r\nMac = 65b34b0ace2fc6bc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 103\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f8ebad761b9e73c77faae3fd9390093fef595e77e6d7f6b35e2dfccbde925c44\r\nMsg = 18430f34d5b5fddbd228a910cab9c48e1ba2b5f57819eacbde756cc0c993b736a778c8008d37776a2915077af8ecfc76b8cd2ca621e9195bd0b27e31843d2890\r\nMac = 7a446398a5c59ec6\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 104\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = b228c753292acd5df351000a591bf960d8555c3f6284afe7c6846cbb6c6f5445\r\nMsg = c66d322247ebf272e6a353f9940b00847cf78e27f2bc0c81a696db411e47c0e9630137d3fa860a71158e23d80b699e8006e52345fb7273b2e084407f19394258\r\nMac = 129",
+    "e40ed97c02ff9\r\nResult = P\r\n\r\nCount = 105\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 8ea05a5033ab8b009664fa2800c24e217488ce6888cad14774ad75b2696e9470\r\nMsg = b3f09d990c2f41c8707368bba007803621ecd76540cdb8705435d74f4300eee04710a936f241c034709e625b0dd5dae1f6e86d034426819c365a05f5be420cdf\r\nMac = 08e5d5b3facd3b01\r\nResult = P\r\n\r\nCount = 106\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 016b5537198ed152670c5fcfb70ade276de97ce0cb771c5f6f66fcfe1dfd945e\r\nMsg = 7ad591e67c6a3ce3c9f871e328fc4ce3b6e7048e80691da551efdfa4c96b06a3af53bb7a88ecc32869c8f776098df4d71af91393da239c24e50436e04d35a2d9\r\nMac = 36df9931a14dca9b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 107\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 22d5d4c3a3aa8d2fd5f25c08b83cea60e94058e8235ddd050646b02617f82854\r\nMsg = e86dd3216500273d0b6150227cf03adc20c8a5fed4a2799fdff759a327657a3ca554b6af16d9dc5cf3db4bf9a474bf1ef1996a06b9fe4794e634ab94a0141d44\r\nMac = f0246b4959d2fa89\r\nResult = F (1 - Message changed)\r\n\r\nCount = 108\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = c892b095173076a40e24522297be27fd3a765c8d417f24c71a9f03b3fe3d8e20\r\nMsg = a96c4d5c89a364263c97a453308b9360bc0ed868602b9ff54fe13f162ad31ab20f3fc51bd2346ae68a006afb50e846e8431dbf7bd0eb3c8f30326d26311a2eb8\r\nMac = 1d943a8b0c470221\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 109\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 2c87c0d64806fe303c5e97bccf48360f89374b6119319bfaf8defbe74adf58f1\r\nMsg = 37c6206e23163c39a13f19de48cc25dc26e6f83cb376e8d2048ad7c141fa503d594bd395f4d36c70aa1e8a5672910f735d4da49884574f833ef54760975b0790\r\nMac = 58cb614230d590f4\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 110\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 028600eebf6b3eb04d8fac18399965aa8fb5f3954d3a657e188ba17f2e3bfc70\r\nMsg = 5b80d1cf745b14cb71cbc8dfe0bc7c7358f721c00099b3e250c41c2e1c9455c5ce55ce69f3f31090f9b1a1b7361e27f92d46d1e00d25f37b7b61f0b191385dd4\r\nMac = 02587102e6450de1\r\nResult = P\r\n\r\nCount = 111\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = ea1a626b623e9440e3f6f5c0b8b63b9967374ee82c1957fca5cd195ccfb2840b\r\nMsg = d082b2aad7058c3142021457d47d51d8ebaab62ab452f6039e771a1b0f3bd03355fe0656dfc7b75fade505bb05d689706867e75ec41da5c5ebd43d0844a670b1\r\nMac = c874df0a8aa87c5f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 112\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = d1155265fe296f374366dbd11f14466df1ea210cc88b0d1876509347e64815c2\r\nMsg = 3e3d3a464b2e6030be877f8db4c1c42bd2b8247adcf792ee833675a57f21594ade5be4399cc30ce373f68874f41584b4d7c8992b9082fc892307f645382c9483\r\nMac = 6bfdc96378f0c8f2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 113\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 9bcf914f787fd3cf62c6315a12feee358eaacf1f63ac802932b933c86b098a29\r\nMsg = 02c8b892b13f04d99b875b8aaa32136d19dd6b9c2a10d8871c66993a57ee91e3ebd0568e38348634ee5f5af4391f7da0356a1e7ba8424441f0db61683a002ba6\r\nMac = 365da451a2787193\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 114\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 35d5df6d714e2ba5b307c4d1908e108bc6fece682a23aa35e2de0e80d4cb3c5b\r\nMsg = 963ef1899cff6e0a6dcd80a27b63c20fdb8e9fa1ee3e14ed40ddb7c6b0dff969d29ba8f89159b82a19ac4240f402cd3b7279cd4c4ff4698c906f81edae8ff070\r\nMac = 33995a3d9c470cf4\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 115\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 511ab5e28b6fda481fa5a0fb3709b249fbf29be56346378a4d3f67e1cd6f09a5\r\nMsg = e4cbbf14f27490843b0f9a17b4520d4bb2c89726f4c788cae4a3344a1a2198bc222e41907fd16a20ef5f6587f1ee3cb7850b97c633b0e0894e70a6647af53f60\r\nMac = 3b4aacb52525b58b\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 116\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5e79f14d5f687ce62b82f856695af9f7dd350543ec763de75b593f1859e44c2a\r\nMsg = c0dfcb62fbc3a67ceb792b3428d040ed5e50999296702472b709a44f4c0b9bb1876f6e80866cc4d2d6ee2f0236440e029d18b2f27ea5bff14a24d53337877053\r\nMac = af30acca71feba3c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 117\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = cf8a477434cc679e52dc3f3f3520eb108239dad5bb363034bf0768c790343e70\r\nMsg = b891b1ab5a6919e0b99013e40fa7c910e55a480bd043d3d85b0b7d1342d3f777e1d2a6a4eb3ff81f5f71f99bb845217765c0708778f5be17a2294c2d5f369e0f\r\nMac = dc10e268f5f73bbc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 118\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 67d77f50727c7cd5b38e0b175a888c88687c97f2ccaa3daecc519116a7c5683c\r\nMsg = 02c5c55e7677c84a199d6e534772123c4e5c933622cfa8ef536e74cb3d745b717f53138aae9bfec54a1cb71ff04feb61d2f26aea65f37dae598f7b7fcebb978c\r\nMac = 885050ec166faef6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 119\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0091d39f3478d2c59bf874b96db9ce0f7e8b85a9b805e07dc96b219819d51663\r\nMsg = 7207aa8fa87283f1f57019bf1c89645ff8fc36ab1102704e6d577671a9f7e098482573c64ab24fe8007c697020353c411566bccb98b38c7784607045e61405b3\r\nMac = 96f639a86a2d698e\r\nResult = P\r\n\r\nCount = 120\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 0e6d99ee5137c8f6b9bb45a961be8a29358a91189cf9974f5bcf20d3b64c3b04\r\nMsg = 543ef4638f1322131402172d193bd304b34e3745ecedb9db16f35c0f5fa6\r\nMac = 33f10660\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 121\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 82421ddaaa5767a496f2b78f816cd1e1e6699f6e9e6576c34c909ba5f8dc06ba\r\nMsg = 4e2f0f91990b855a00d27fbb2e8db7184cd82909de361b52e7a75b16547d\r\nMac = 3f5ed151\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 122\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 134f20cb62084a98601f0e69d257fd2064beb47248caa79720a71d461ed07ce0\r\nMsg = c248fa87a6e48cdfafd1e5ac00f95fb1dfda861465747265796654dcff54\r\nMac = e7b21645\r\nResult = P\r\n\r\nCount = 123\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 98505229c1927d13001b53850d0b7d56f49087afc6c2351190cc1b998e4d6883\r\nMsg = 9bee2e347f763c5c506876bb514b5ba1248abc6b3d17cd4c96537d4ea432\r\nMac = 2c212c7d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 124\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = cad710b48ea0bce4a897482a535aeeaeabebb42619578a9d1296927301b3bfa6\r\nMsg = c1db23e776272765a0fee49edcce28ff7702b9ff9b6e31a4c3ed0c497248\r\nMac = 7f27420d\r\nResult = F (1 - Message changed)\r\n\r\nCount = 125\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 0bbf4f77a9883733590a3cc7ee97f3c9b70f4db255620e88cd5080badc73684c\r\nMsg = 7ff9ca86f820e4d57995d450611009ffaa726e6fbe4ce1558ca1e775daed\r\nMac = b2e5a268\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 126\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 6efabed650ce05ff22b67768e3bcc88c7746952106ecea92a38707af2b8a64a4\r\nMsg = 9cbce402511b890c8c9fa215b59c813b3e51b5dce01e776327f145623002\r\nMac = 03728e46\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 127\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = ca2843847a1c9539917206d344161dc40b379fd45dfa6a73ba6fa14defc40920\r\nMsg = d9365304c4363fba73feaa69d4cbb343a76eb2d29de6782ebb34d873006b\r\nMac = a94841ee\r\nResult = F (1 - Message changed)\r\n\r\nCount = 128\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = e5a1108da9cf587bcbdf051e216231bc27f0e6c1e97729b324d23768a89e0e77\r\nMsg = 536d4b6182a698d456e1fd9d522aab38cf05656f41a5e02cbd5e6f8cb85d\r\nMac = f52a4ba3\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 129\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 008ee06bf9b19536190e87820af9cdddb40aac44b0c3b1e50074fc29fe5cdff2\r\nMsg = c1eb4c800c631d9f387d2e8e431677b7fc8f65235ad0cf9b118d2b0d67c8\r\nMac = ba255bd7\r\nResult = P\r\n\r\nCount = 130\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = ba0bfda3b03c736c121cf9a257db55060b621be5168619ec4182f13ef6a408c4\r\nMsg = 69be384eb107340d953753e6a860ea2710e662e8953de8eff8f465d086f3\r\nMac = 9f650d24\r\nResult = P\r\n\r\nCount = 131\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 7a88524accb59f1c6307a1719a011eff211df24645086c67710ef539f5d3f29a\r\nMsg = bebe346356681f27bc62f0b838a25268e3b04194b865bf83eef2c8928625\r\nMac = b2566e6a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 132\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 9c956d7bbe2028739d73a2f0a80af5f2f180de923d5571e65bee0b25b5dd890b\r\nMsg = e0d2ea49e3e4a5823efd1b229c705ec3bb5048a7658f10fba2671c5d2cf9\r\nMac = 480a14ab\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 133\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 2090b970a71ce2cf399a0d9e1d3d72c4eb500004abcba1303b24bf9af16707cc\r\nMsg = 0e0ef2cd18533bee01f19870f2fb22176c7e04748db4dcb98f7a65cc9104\r\nMac = ddb6f30c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 134\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 66921951731e95bbd45c014af5cf623933350dd9a90d1a36465716f8239bf887\r\nMsg = 0de1e090eb47dd4fca966e5f8fa5616618701164370d8a43fae2eeaf3016\r\nMac = b91b3131\r\nResult = F (1 - Message cha",
+    "nged)\r\n\r\nCount = 135\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 43c1142877d9f450e12d7b6db47a85baca7eea7fde595393fb394c1f34369aa4\r\nMsg = 77772e91be674abb0f496b47dbd632e5616177a0d16a8c11b271c2d38108\r\nMac = b2de16cc\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 136\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = db4b6206d001af121051cec70195055fc1fd0dc06ccc74549bc440152aded5e7\r\nMsg = 94394feda0528fcc67124dd1d77f0ec0b911f08c3e01e0c0dbc40c1d57d2\r\nMac = 5f72de94\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 137\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 4d658be9cfcdb19f79abc78f4d7f986d02b43a03098b37c8ca56ebb331e62d51\r\nMsg = e28660f57b044a44a19ca40ff7b6469a41523e8d1cef22f4edaba58917ab\r\nMac = 11fa4d1e\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 138\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = 70b4cf3883fea8c6cd852a4293c7e5cb0586a6cd71294883b760cdbbfd07aeda\r\nMsg = 4cb9aa069475e54b25e5688a52dd4acd134169c858105f01a0a1b134c72d\r\nMac = b6b60815\r\nResult = F (1 - Message changed)\r\n\r\nCount = 139\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 4\r\nKey = f75bb63d52c35137448c58383afe47e026d536f67e3afdff87f29b10d3d6d9e0\r\nMsg = 4259e4fdf10acd8da40accd6354f4baef4859a2f5ebada0d2c5b1b26905f\r\nMac = 336ee1e8\r\nResult = P\r\n\r\nCount = 140\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = c938f6bcdeca02939fef931c969a25edcc3daf338d8286016e3c7ee78f9d52c7\r\nMsg = 47179ddaa9d7ef6b9a53c646325c80db69128c6fc4f92ccd345078383b9e\r\nMac = 5cbd65df0ca36898\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 141\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 9540e4bdd8c7ab99f0b76dd9de24c340a60f7706f680448509d5dc35cb5930da\r\nMsg = 4715a9a66d10b2dc1869d90fcf9b7fa99e91b40abcb8fc356b5853c92024\r\nMac = dcbd4dae7cc60d46\r\nResult = P\r\n\r\nCount = 142\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = d5c396fc1ee960215e57cfeeea1e792fab9334f2c45dd93e74cc47023e6daa4c\r\nMsg = ce188965b4d347a6c36a6fa5a47296b32ff0fa27311266b16b1d56ebdda7\r\nMac = 1684fadaea17bc79\r\nResult = F (1 - Message changed)\r\n\r\nCount = 143\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 897193cbbccbead9957876b8b42a77b404aed32a3f63bb9ab5f08cfe4936f35a\r\nMsg = 87767f13bb4904d0df0d64eb22c9ddb65e81b5739baad86ad5e2c239ffde\r\nMac = 84ef6f59b770d42a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 144\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 86aa015253a7114e1770b6a48fdb3ef22e9d5abac25fdc145315c09f4e8b69bd\r\nMsg = 2595cb8d4d6aaa148596e8502ec80a030d82195f9e1d9a26ab0ec0101e67\r\nMac = 63e67c44ecc05dab\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 145\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = a082c12e97bddeb0c74c13aa4ba788f8a127c44fbac6682050271dbf7ad6cbc4\r\nMsg = 7fc97a698d7b0eed7d7602a5d13e956a538c71c4b45978a47439c05601ea\r\nMac = 3e1fe077fc7e903b\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 146\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 18716638a2f6b4fb8dd2849fa9aab80b8dc846ee7e6b3cb0926101a814d8dd8f\r\nMsg = 6593194b9970545c5a910b2b4fcd46f0ddc7aa0bf873f0a339d5958d310c\r\nMac = c4556a75b754f6c9\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 147\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 6237aa30f1e3df239c96e7e50b69496da9305951024fb83a6fd01e96f6b2578c\r\nMsg = 0c5b7d1ba68654cd24871964f1b31ef7900dabc025baa02d37b55b35b4c4\r\nMac = 22c74fc64489ca5e\r\nResult = P\r\n\r\nCount = 148\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 32f60011bec76a79d2e837c611fad1cad486ee6f2aeeb74f1ea32a7e3899bdaa\r\nMsg = cf772bac3e767534b13efd381119b66f8a99b91aa52c8d3ab5f0a60073c9\r\nMac = 08d02ce41d4964b9\r\nResult = F (1 - Message changed)\r\n\r\nCount = 149\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = cb6cee5ba7b799f16254a17b1870cdb85fe0ef3f42110c138742bd7734f0d504\r\nMsg = 40d3c65a00d9204b76e013975ffd729b351698105d47448da285a84de281\r\nMac = 4cc6718396dbe247\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 150\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 9b8cdf91e848eeded2598ccdf084bf591ec2eb668236f555ca61a9d6b49959fd\r\nMsg = 7b3cc6f18a27047f4cdc35404e44eb8e51b1855d4bcd54ccafd1fcfaeef7\r\nMac = faf72c383b56a4ef\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 151\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = e6fdbe9a1efe081bbcfeb25b844734fe60aa6b80a5b5f611982de1a331b88041\r\nMsg = 59a0f85349c3f378d56c509a0a45a1512b5072474b297f9c1a8c24890016\r\nMac = 020354f33df66723\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 152\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = da360852e8b8c3a1b65af9e8630ee5481aa91dce414166f8f3dacb75b142f12d\r\nMsg = 61d908e9663fb195afc259529fc229b14e87995f8d3591b125fcce816090\r\nMac = f8963157ef7c1ba3\r\nResult = P\r\n\r\nCount = 153\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = c9bf0e7e470d0ffc88593796c4cf9a61c6db81d343305ee06a0f0563bcc618c0\r\nMsg = 19378e17c41586b88523a6b6af738dc47e63ea64b4b83fa283f1e502add5\r\nMac = 550523c0347fbcf1\r\nResult = F (1 - Message changed)\r\n\r\nCount = 154\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 7129ca274190400720bba27651f1ee0d5aa79116af9929418e198f9928a715b7\r\nMsg = 891e73a81d7574ce6f73e09e08cbaa0b9db242963f4469cdd2234512c061\r\nMac = 9982a14d261a4060\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 155\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = dfaa73c82a978548c99c0f1c34e1edc2c4edd42b73613511e4e6648ba364f9df\r\nMsg = 18044ac51ea97341061ae7d5bce017fd5cfb1554a384a75aa3919a74ba59\r\nMac = fd3a17e8c51a004f\r\nResult = P\r\n\r\nCount = 156\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 6f0be1905d1b5b607574ad93a1e7b4a536020fc6798acae862253916a0562707\r\nMsg = 8e502d5af4701025787e5b251121676182a0b26cdf52847f4d56d2ca0983\r\nMac = 73d76950066c77d0\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 157\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = b9fe826b0138de8184a3002d8bb59d228862e4a14f8556f88282d8494d29068c\r\nMsg = c97ca1930b65064b70d12fc46af4d5e220e6009e729a28a13b0f9a11d3ca\r\nMac = b8bccd70bb90084f\r\nResult = F (1 - Message changed)\r\n\r\nCount = 158\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = 99c8f69fb91b17299461fd8d633bd516dcdb172760695ec476a5775377cdb7a4\r\nMsg = ef589e3b4ad9a7ba390574a2db5330baea64894f8f881cd67b842dd23393\r\nMac = 38e11613e67e0416\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 159\r\nKlen = 32 \r\nMlen = 30\r\nTlen = 8\r\nKey = a86e8b43a1e81dce7b26420c0409628d145445d1c512e1c3df3270839475c668\r\nMsg = c71a0d1e20a7dc8e7adea91a408ecf3d512bcb15a6d8fc1435c6a7f915bd\r\nMac = 101c06c22819404a\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 160\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = c5a850167a5bfdf56636ce9e56e2952855504e35cc4f5d24ee5e168853be82d8\r\nMsg = d4794f6f563d5f6445450b59c1ff95d24eadc9c02b68eaa5df64edf81475e5cba8d2bfab021a2fc8\r\nMac = bf99dc0b\r\nResult = P\r\n\r\nCount = 161\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 551e188cbb7c7d1ff33b4bd5bb6c60da184b18f44d68d5c30704df47d8be6fa2\r\nMsg = 2b421be47d07dcb12a0706f7490d05024fce8f433079e18ec78f4c8678f5f1551448c9a0fc70e8b9\r\nMac = 32aeb3d7\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 162\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 000da8307f0e6112f0b8a8b1f927f62e8a9e5aefc0d37995088dd32e867148ac\r\nMsg = b89266f3a33e5b6883206e44f8e8e0cb01275039c304960e8630f0aa011c5c19d769443061a060d9\r\nMac = 1b5e30f0\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 163\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = f4ae2113ce96435b27369fd4571ae2841a965c8ddbfe61023219eff9abd490e2\r\nMsg = 433ea4e1923267fe443e1e89d2472834b72ef97323ad6d82f3825ca9e1d06fbff8c232ed4c716ab4\r\nMac = 05b3c894\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 164\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = e7c78ef4c4b959ee00cb1a09d71221a43892ef8ad705edd27ed85d03a377907c\r\nMsg = 4da25d1e7064bc4b4903a77452952885a06ba0712544210d30c0182533182fcac90b71e9f71caf22\r\nMac = c15acf48\r\nResult = F (1 - Message changed)\r\n\r\nCount = 165\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 6f48b3bf240525adcb02985900fa29747e4b1265e5a8899abb0ee51cb0f90367\r\nMsg = 98bf67b6e342dd94c948e76aabb69e7d091d24fba54ae233e4181404768988963915a2495b42a4eb\r\nMac = 71bb5873\r\nResult = F (1 - Message changed)\r\n\r\nCount = 166\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = cb6cee5ba7b799f16254a17b1870cdb85fe0ef3f42110c138742bd7734f0d504\r\nMsg = 40d3c65a00d9204b76e013975ffd729b351698105d47448da285a84de281bc3307cfd80b39488213\r\nMac = 592e54d4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 167\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = bbab624862e268765e9e6a13df55cf7a2267520e4e66042ba0b4905dc554c3d0\r\nMsg = d43b841f174335f1347834590b0984a2cb35f7a00a0ee993157d2d4f8487489a12ceddd6ac5b69e0\r\nMac = 3480805a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 168\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 2fc9e8f409cc6c0156ccf9f00686ac7abba6cbe08982a737fa08c7035",
+    "6f54208\r\nMsg = c1cd63e24e41f69a146b448cee0a2107817c8105732745aed817541eede8ee6809e73ddbd0742d84\r\nMac = 91623558\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 169\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = c49dc812061fa4995aa7c160ed7cdf769dd1ef570d8fc9c7f8552101c5bdb711\r\nMsg = 74ec6f53d188be3bdb647f37619fa5848076c66d21bac164c381a4517b1dcd2a384a4fc44cab97e9\r\nMac = 07471b07\r\nResult = P\r\n\r\nCount = 170\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 84b6cd1c6618c42ba74e746075dc28700333578131ca6fde6971d2f0c6e31e6a\r\nMsg = dc79743d2360cc52cee202b9bde9abc7c09d9d0311d89c3722da36c7993feb42992e913744d2f74a\r\nMac = 3acba1e8\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 171\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = dd472b0bf50519020a182f122239d161d9659773b4df454eb378fedc250eb490\r\nMsg = bdf56403d5ff8df4ffca92eb40d54a79b5595abcd67b9e2ffcc5cbc621d7523be75a87a2dc360244\r\nMac = 3bb0894f\r\nResult = P\r\n\r\nCount = 172\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 00ebd245e8c0e0b60847da5c8f7a1f33604932b9cd47a845a1a44599645b62ba\r\nMsg = a238e542f1c22621aebbe331e71123ed7f2591e4192180ae378c2c24a31c42d10fcba3a3f82c65e6\r\nMac = 1d17d6ab\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 173\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 2ecddb226ae668315eecf107c344926330b94077e029ac3bb67e6a077ee05361\r\nMsg = 38ee97f0dc635c7416a024e3af5c95dd1d496db8a5a5c3bcc20b9093ca906dfbcf0b9ebec3b450e4\r\nMac = 08834104\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 174\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 0a2978b5f20d3b5e5ed7ed5a78a093a51d5aa6e728077346f429c27f1c79b635\r\nMsg = 28313dfdc449628f4e2d6c895381844559067823cebb56cd41493ac0d29d6408e7d78d4a21637b08\r\nMac = b2635d7b\r\nResult = F (1 - Message changed)\r\n\r\nCount = 175\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = 7f2286d42b4f9eefed1087f3eb3dc814145be4a110c0e74176f83e7d4068cb7e\r\nMsg = 6c1aa088d1a6086d0e72636744a6840c80ab8223409c61b733f7ef6a4199ed0ccbe96f6c3453866e\r\nMac = 10bf9789\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 176\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = bb0fabffbcc6935ca35755fd4bfbd192b6812cf75c4dc95bc3a175a1501be206\r\nMsg = 9801da81a6d9861f26900401aeaec89a74e3d5aec0a5d612a11b6bb4e03ac1db322e65afb1fb5afb\r\nMac = 9ad23631\r\nResult = P\r\n\r\nCount = 177\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = ed1d11cc4876f58feefc463b52d8d36e69c4c2c9227b32fe356d1e2a1bb88466\r\nMsg = b16e6c44f429efdc06a892cede56296e12bf185d4b3c6953f7d31b1c3d59bce136d93aa95a3af61f\r\nMac = 29b26a75\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 178\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = a6fd8382447181bd300ec1ef039d3f353446d01fde490509c3ef52a992bf6fe4\r\nMsg = d41f8fbb6f968dda0c1b2cadbec04a6c72124eb5dc40b8d2b180fd3b17af915b5a374597e036d38d\r\nMac = 2b343893\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 179\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 4\r\nKey = df0821c9ea6ab329c626d11b4bc1ba7351ca934ece6aae483e3d0bef48601f78\r\nMsg = 84b9c150a1df00ba29386197d79d29a2ceb42fe6390c9e763169f75fe15c55dbe817f5c7fe80f557\r\nMac = 3a5026ef\r\nResult = F (1 - Message changed)\r\n\r\nCount = 180\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 0f1b73e54f4571b2d42aa5ab673f3e99b44f6c37a07a5d4edc7d6b1fba349401\r\nMsg = 3918467effb5d5dc009aaefce84d8cb4fe8f80eb608f4c678f5d0de02ea11e59078d38b04f10de73\r\nMac = 1c207499e0877bb2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 181\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 25a152850b4b80b19d8f0b504b2a8a241824b3a1fca8d85c8713b2c0c84b5e02\r\nMsg = b06f6b3f197bae7d8cde9daf38530e25bc51b68f9aa23ec0e95199b14bca96c91f3db15bf8432f71\r\nMac = b860013252ae83a4\r\nResult = P\r\n\r\nCount = 182\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 849d861aa5a37c6389f7bc2fc3b4860fac9d2277fa5e1a1f9415a6aaa5106886\r\nMsg = 191b53e0c7d90161e5e2014e9b8aea315b4bddf5750aba4be69c944d71896361f210f961ee6b38f9\r\nMac = c9dc7e167c2e442b\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 183\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 29dd1ee0ffa12de3a1f2cb8e4e24d2e548794a5e7e372f946bfd733f3c564764\r\nMsg = 891c806e0700f6df72befe47ff088d917cc30763866810a2fcaa9f38b45953156c860b7303e8b15f\r\nMac = 2f7355b3994f45d9\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 184\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 6cd7349d96feffbcf6e95a96eacbbe8ddab702ef70052b7804f78518589df3f7\r\nMsg = bbe054fbef86db3ce7ad796e6d0add15455b9cff57fb787610b4e1ba05d5bcaed98564d16157ee70\r\nMac = 8a421387c53702d3\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 185\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = a32e186c29f6f1852b483a37b50c02defeb2ce81488198bc082c17fd47a741f4\r\nMsg = e687143dc4d98dcc6a2dfe6ee0f85d565d1f46bb0fafe62a17d01720d6f4ccd86754b0626c9d0af5\r\nMac = d44d78445c5ed8de\r\nResult = F (1 - Message changed)\r\n\r\nCount = 186\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 338f8054d58c26c49360c3e87af56523acf6d89d03e56ff2f868002bc3e431ed\r\nMsg = d42b10d3a688c39edf543ae7330466eeb9e3b678ef073967ff83038d40ded1c200c4f03481fc5aff\r\nMac = b25bf6993f18d503\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 187\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 96e04382027fffcaf779c984be80da16f8437db0e39a7123d9048ff71954acb7\r\nMsg = 494c8f931029a4919e2dcbc16512a8bfe275382e7d29c9abb1d14a006caec59ab9b52a3e9ce54ef7\r\nMac = 5a94a03591ee9cc7\r\nResult = P\r\n\r\nCount = 188\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 682f8bc1eafd4d369df384841a88db7b7fb96c9dd9abd6dedc9290a8d8d17d22\r\nMsg = 87b937b1d36e8a9ab33a1d3eed617030923acaabc7e620dfcb3c388936030fc67f647729c19e040b\r\nMac = 89347722a73d8bf9\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 189\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 954222a9cabaa5a0a91100b158a3aeb655c4473d0b00afe6a7a78e0d278a01a9\r\nMsg = b9197eb50c8168d16b8a12bd261d553ffcc521d979b26fee820376252e452213d736c21471cf0179\r\nMac = e5d175fa24cf0fd6\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 190\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 18349be2894d49290339b97f4db28c92b3e112ffac77100abbf9c093935b1a46\r\nMsg = 4b02fd5a46ac681a42424ac9723911af4e389ac73829f36f60916563e51cb2ec3d7d9b55d674a59f\r\nMac = 18c98fd13595f857\r\nResult = P\r\n\r\nCount = 191\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = f1f9fdfa9ae3ba8bc6fcdb2e15ae2c47e6292c2acb091fe03e325f298ffff3bd\r\nMsg = 75965cfbf66b0ba13274fce6537fd7aa4efa5d75195a400018bd38f7d8cd53fdffe88df1837fa06f\r\nMac = 935e4d4367aef07e\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 192\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 4652bacedb47faee1be641ebf433157f416b4c7d9e8c7c6f7b17b47e70156993\r\nMsg = 17e6acda3c05c9549eadad55d8918f4870aec63a18802fa33175cf838fa2b9b17cb43270ff2a1444\r\nMac = 7ce4adc343a4498a\r\nResult = F (1 - Message changed)\r\n\r\nCount = 193\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 200e4929c275557d9caab0ba3b0a153dd8010ff8f11ebc1f336dd0249d01dce6\r\nMsg = bd05d26ebfcb5f6e102e79976fbd038e02da6a64a6be90bb84bd092be5cb8ae447409e94afd89b8b\r\nMac = 5484fd10e83798c2\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 194\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 8c6a6e77534976b4d74a0972742989dbc0f753281a5ff10a862e9048b813b4a9\r\nMsg = 869c482db2b0825cd09d295749359b99fde85240e5ddaebef642f4d249e096b77af2b59b4e37e452\r\nMac = 9e640a86d55be78d\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 195\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = be3db75687360fc31c27752a5f32125cf04f8bbab694339ebcb57ff63fc7ba32\r\nMsg = 33dfb223c009001a7b3b81916bb094390c42c24a47884fc8a0410f05b2f57b67d8d9046b2ef4a8ea\r\nMac = c7666f25d2329fb6\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 196\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 29e7acc4facc2618f242ec9260a8ec36c4c9dabb89bb8092f00855234b0c505a\r\nMsg = 09bf4f77a9883733590a3cc7ee97f3c9b70f4db255620e88cd5080badc73684c8b80393302ca8803\r\nMac = 424535e20d082087\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 197\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 23f0d00daef3177fbcda6e9953a5a37d5da395204d8af5fb05c74e03f71343da\r\nMsg = 2222135e545f2af53be42d7a463719447e0a6a305fbe8e43e6279a91eb8f3c5db1fdf081bcb77711\r\nMac = 52c42541e2e93f3e\r\nResult = P\r\n\r\nCount = 198\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 6746d9a90e0e763679d5469a1bcffcc4f18f35f50c7714d14c7329b76ce7984e\r\nMsg = 68530f15423071410a349872c559669301096c827333adc4df9da477387c89870942d12513b7f475\r\nMac = 2bf36912e1139629\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 199\r\nKlen = 32 \r\nMlen = 40\r\nTlen = 8\r\nKey = 6b1d94bc0c6e45fc905c509ea667853e4b2c5a8848dd914efcef14d95b12247d\r\nMsg = 207b649c46c1963723624d8428d4b64c08cd4091cc055175223d3758f880614149a9cf7f3725c790\r\nMac = 34f46b361bddf55c\r\nResult = F (1 - Message changed)\r\n\r\nCount = 200\r\nKlen =",
+    " 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 5c77fe134af3fef72fcd16006097dc7dbc45ca10339ae3bc85e0993e4cdcefa1\r\nMsg = fab52c44379ae8083bdc7b827383df93cb1a7ecc21574730f9fe003b7302de237bed535d40832763e7a2cab5806de91d39aa3f38d167ae3250e48ed1f6ad45b5\r\nMac = 03f36c5a\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 201\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 997c6b4b513bbdeaf701867bbe81bdee63de0d0d18c870bcc1e9ff7f627f093e\r\nMsg = 4c23d92665e88a4f6f732de384034d493d5df37b767a8260557de05688e8d60dcd0eba9cb8cc4bceb174dcbd3c0ab5a37db3b6ecfb6a3d90a4f54a9f1117e11e\r\nMac = 9e798c73\r\nResult = F (1 - Message changed)\r\n\r\nCount = 202\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 64e390edd97c0af1ba5165900828e0630606f83d4df5240e1b05c307ee9153ff\r\nMsg = 1ae71094fc1b304adfa3378c4efa8fb290526bb314714c9613beca2a709c91f7e3f6aa74561bfc7b8fcd12f910941eea3b593e85ba2fffb31e7420c6c6199868\r\nMac = 1977347f\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 203\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 44e2f6d41e04b75f541e724c6f6325f27d7475b3676fa0247f28b36e58b6fdf5\r\nMsg = b9ac624288352617e4d375f33953b431cbf8f03f9ecbda9893330ff2d3c59db8705dc3ba4a6ef924309630ac48765b10b1c02ec0669126d76602c95012fa2f77\r\nMac = 2cba4713\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 204\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 8e0f75b7029d4afc2a86adb4a088b89ef9783965027c1176497ada0fdfd0cd99\r\nMsg = 21cd3ff946e2b3c1c61932205899502852b1333d1c79a3d4e5b6617996ffba17041e5b746ab967fb1632c7be62cbc2bbe60ecd5eec6ca4482424994f9a662cc6\r\nMac = b651d356\r\nResult = P\r\n\r\nCount = 205\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 35b1106d174acce103ecf5801b03d3c10d579c4ee491ebad25fb6f1f1787e0c8\r\nMsg = 960026395d0544975dffaaa2c56db1df5816cd80cde513dc76f6f81d21f15c383c97c7233c9af2423fb28922efed2f69aa47c30de17ae1c5be17acbd0ad6cb8e\r\nMac = 8a8f65a8\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 206\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 71efa75961dfd60ad533082a8cfe111214eb02573adc4591c5d0e961640a3ab2\r\nMsg = 6bafbd22b75e21e1fa5444af283e69d53ac2f0412f717a2153f74eb1c195fc5127d240dbc96d2833c9957920a55c505a016a05e4a7ee549bccdbbf1095502e93\r\nMac = 88fea081\r\nResult = F (1 - Message changed)\r\n\r\nCount = 207\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 11752eb8aeffa364c9947092c1612461cc19b6c3a3ddd1817b5e6f7f3745a942\r\nMsg = 2d9109e7eea21b2615c81c03182ce6033c93783b13d698624392bd2a8a202bd0ffc860f29b31afa2f71c2bb85752c66ce8dbba244671288a4135ffe2e1a0209b\r\nMac = b5a26c1c\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 208\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 279a6c226f6a48f3128626012baaa309d99065a59dc0a4c003a6e94d85e61638\r\nMsg = 9bff96ba07a52d9ea2415283321395cf57cb37c610fad7a482c74de9f5e3d7f520bf73d4a6fc8b5be023d774dd9680b6a7c68139c8a753a80d61c9978a493917\r\nMac = 5e281941\r\nResult = P\r\n\r\nCount = 209\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 0bcdcaa87ddf8bbe6db8411d14bb9064e4a121286cc8a6e97fce1844935f436b\r\nMsg = 3ec0aa8d30d5ed825b77dc7095f421b1e608158797a377ff8bed641bd387832f7c14818cabf9bd5ced6044cdc883ff7296272be693660ab234b2d870ba170131\r\nMac = 1da79d07\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 210\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 1b41d148e3c202d419ce16385139da196dede5be63987e6940a2bae86d62e567\r\nMsg = 13ecd70e2d76dd53a19b2e5fc0afe0c0793577ba8948b7d4ef3ab797a07a37927dbb33a18252b96f40e0f73a8d3298d67a6551f5854eb6a51019531a122ff8ae\r\nMac = 91bd49b2\r\nResult = F (1 - Message changed)\r\n\r\nCount = 211\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = a1ccc9c992c8a307ad39504854456696f8eafd7c8da0c0c53b3a4485570e985e\r\nMsg = f68b0c3b4556c7f8866b3fa873ed2014418d6421d3f224512e5dae8c2d8dd92175e09508acbcc66ae62d536260cf790671ef66a1bded0343ace4117c1b8d7764\r\nMac = b9317feb\r\nResult = P\r\n\r\nCount = 212\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 4d8d0264ae6d8f7a7440dd760e0ded25a3a94cb0491fe81e7b55221ac8ed24f7\r\nMsg = 5faaf6b8ee8ed5b56bfc1a7f886f9f91a6566ceb99c39462ab675a3ae3be98f68787626fdf77e6243c2e96d1396a8a43417b1f6a51f7e5b0ffaeb889bce02c4b\r\nMac = 3f610010\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 213\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = bcf95051ae2ae84ac32a763d5477ccc4659a9ed3e25de5932939826dc90e2464\r\nMsg = fce924dd27db3e07837694c34f576c16084e5b0a254ca3af0582bf6026c73b47973ac924b02992490032cae987a887932539d3fa53cdfff711b03bd11ff464bb\r\nMac = 7b7e89ef\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 214\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 45ce953ad31ee9b53a9c948883bc86f4bbe0f0744085a9943cbad1066cd7b4f3\r\nMsg = edb1aaa7e8ac37bca99ff8eff5516464aa33fc2bebef8a727d43abf971108bc604aef019c3837aa2f3d429f22fda1f305319a70d99ed77f902663298f855316f\r\nMac = cbf4addd\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 215\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = d60841cd71d7227ab56e767817760edba9ce2290f8da504b341ee2c1910b5018\r\nMsg = 365fea641559759d1e5b5581218486318b1c776de812b1aca6a9ba6b1c6e39c5cb6d5a44e3a474f709b8eac457e74f00a43ecd3d060cc7639696bd03730c70e7\r\nMac = 7406f935\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 216\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = d172f991eb697ffdefc57349dadbe51066d2744c39041cd55ca75024eead495d\r\nMsg = 6a91da64812b9bb41a026e727b4f77c384813da2948caed5a9846420c86a26b89f46b2fa6975b95d12452ca69bbfb65bc1c48a79d95c5e69ff4ab7316fe468e8\r\nMac = 6bd82bcc\r\nResult = F (1 - Message changed)\r\n\r\nCount = 217\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = 3725c7905bfaca415908c617b78f8deeeff286e0c2bba268d0de92c7664238a7\r\nMsg = fc4bbe329a86089ebe2a2f3320dad55a9bdac1133dd28ddc9ace9ed665885a2341ea9492d4cf4b7e1d0a95f308a9d613407b35b845cf515bbe7f2f35102d78a3\r\nMac = c8e11823\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 218\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = bb3087d1b5b0f6f14a532c3604c82874fb15e97a4b3883dfc50e71ffe5752d40\r\nMsg = 979a9f96112d1ea95eec2cdfdf48c55114472360aa7de24bb53761013af96b33f02b17ae470fece8aaf649d801b4040b7b5152f58a01e7852f565efc77b5dafe\r\nMac = 66466425\r\nResult = P\r\n\r\nCount = 219\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 4\r\nKey = eeb983439a03ee6a315ebf941e9368f90bb6845b03b31839d72a1946c17d2f19\r\nMsg = 6d5573c9279897d7d1602d8a95c04bb5ca3fad2dbe89a024b3651eb227e73bb559e7c0db08b215fd7efe64afcd24fb155989f2f8965d0e181389e6c4b8e244a9\r\nMac = 7f77d596\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 220\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 6f0353a0ad95df6d3190a251435f62c30ed6b9cc0dd024c3c316565cad83d2e1\r\nMsg = 83011a83db0524628b55589ba0165523ce7c916465eaf185805b97ec7f00fc01b82a3e356a6bbb44f2f8deb6425239ac8e26d4d94871c5cf4fe7017c649672f4\r\nMac = 9e56e4574dd01fe8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 221\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 777a22c5fa2f864a9233587e3e9634172ce25006daacbba97b68e7429c8266a8\r\nMsg = 1f7d58d65c36142620172fda3197d3c629bc7bc584e1aaa0f8b6dd320588becaccc39ad124b515adeb941de49ac31c851c5172c4e1c322e42e13cb5ab7f8db2f\r\nMac = 498dafe2807ba34e\r\nResult = P\r\n\r\nCount = 222\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = e17736560b1a13aa8e536500ea6cdb9a6757309aadf25a6a9189055a309c3f8b\r\nMsg = 1a6b80d506147c3c02c89f50892bd1f04d34f9f21e8307140df43835d17495c56a13be7a045be5441de01d84ea19d579f76e9ffa0f92376b5b13c0eacd3050c9\r\nMac = 52d3fbc6e5821f1d\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 223\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f31f2fb4b3fd8045b70d34b600a2697cbf7503be0d8cfb5cdc60f9312e3e2695\r\nMsg = 4f43702be4f0530319555d7f1a3356160f6cae48051f12e22a153d7e405c11494c31e6098e24225eb676094755c6d7e992ec0c8c1e2608e76a72d79d173a4e07\r\nMac = 71239a4c38fa04b3\r\nResult = F (1 - Message changed)\r\n\r\nCount = 224\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 10a678f591b4d87280f42d77a91635575e2e82ef610a7c9105c3a9418f932c24\r\nMsg = f7b577f1396b23c27eb637e53d3d92460270b001cc612fd3b4d68bcdd09c2d50571ea4350636324cc2428a087e7bd8785f8202791e3c2d2bafe084a1204e34dd\r\nMac = 5b11c1407904c15e\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 225\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = b8728441226558fa9764824597fe254bf8c2623789541feaf6c007efeb0dd2b1\r\nMsg = 80a2be15809f12738f305be3a210ba0c933599c4b24b48257c60e8e3aae189dc6ec58ff1f9085a15405b26a3001a2ff5ff7e1932961490676c6d2cda8417979b\r\nMac = e73ed6c4f81b0ecd\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 226\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 22a877d974cdf4d65bbd77958b2b77fc5ddb33a221aca3ecb6d5ae76596f9db4\r\nMsg = ce2ce41f76ca7477972d38a3e8fad1122db34ee80c379fa01f884cf648d1670445a8bfab8490563438c21537ac2dbfbcd7bb24a132d6973cc62ba14089adf7e5\r\nMac = 0ff91813a56b98dd\r\nResult = F (1 - Message",
+    " changed)\r\n\r\nCount = 227\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 03fa02c4df99b8295f502e3145e2edd3ff16722b87092e708bc8d126cc1ec894\r\nMsg = ec9a9babb68e09c38617c9b16e8a2d92e711030bcda4b9e0ab35c4c2392b41692312dde30c91f32cd39cf5fe15ea0deaf3aa04a8157262acee78d7f94204d93a\r\nMac = e50d9a04f79cf9b4\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 228\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0e12df1bf17e9645c5507bc2069ca4611dc0488c9996231dbcee1c73393b26c4\r\nMsg = 86814ce4a867f80ce9b618c6aecce37c89851508bbb095c8f7c055f569c47a30f79abe5ec75f12b601298718d6f96ea1c1ebbe7c0cb0b7fb973ec5e6d5c6a713\r\nMac = 05338bce9ed8f495\r\nResult = P\r\n\r\nCount = 229\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 51c88fd98a7d82043a1500fc3d8a66ba7ab7760467c7fd89cfeeb22dd25762a2\r\nMsg = 0e403cff47adee3ec5bb6b178dabfc7d53b60a04eaad33a2fedd9db705358a4c73ab2d982ddbbdc941f1c701d4cac89e5c56fbbe0f4170029ad25e931713ba63\r\nMac = 38c34175627b07e8\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 230\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0feb23c7e4a19bcbd70bd300d76ec9045d696f8c9687f49ec4154400e231d2f0\r\nMsg = 0330ed97e44e8b15a49f29c72a7997d05d398a9d45dae41a6cc635258beb824362124691e86cb7fea46e4ab85bdf79e4eb30c492770bf6f0c42ea9bde37a0c01\r\nMac = 271a7c2e687d84c5\r\nResult = P\r\n\r\nCount = 231\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 5d649799771f9074d18a2477ccd4d9e136e01451c1eb2e8bb370cb79e0486770\r\nMsg = d715bc0520dbb86543e76fede49dc6be2cce59d3c0db133ff31efcb63a85514fe080da88fa1e788b9e73feb0503c4142bdc67386ac0bacf9311ecada23ca7be8\r\nMac = 42de9f52567b4506\r\nResult = F (1 - Message changed)\r\n\r\nCount = 232\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 4c96d520d8d5a54eb73f8f558e328d1b3e5ba360161fb8444739a40a97a58a1b\r\nMsg = ee409b050346fbd319c8630e4bc9dd6d055355fbb961f018d3fda0c1eea6f61248f43709737fb18d4efc4faf34a96c2f73ece54200367292692e36870a0c94c5\r\nMac = 28610f524d88e727\r\nResult = F (2 - Key or Key2 changed)\r\n\r\nCount = 233\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = b186b9273d8cd77d68c05ec5389b2f6e2f267fe6cd6e7cb35a3233c0dfe0b1f4\r\nMsg = 0df3fc6396f851785fca9aa5ffb0cd98bdecf8bbae4c82641efcb34d319e7643ca9c5e22acbde800e0f700a95685c64ccf399173f9123438dc1181b676490cbf\r\nMac = 8d2f69b44614485a\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 234\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 1b1374648d93aadb186326e4ca2b82fd37f7234712816fe4feb339a3a16880df\r\nMsg = 9a661677f1e07153e1c9c661c91901757f5b4d9938031f01a802773d6a9863b2a169c44be0d4546c4780e828ef37f3b389f84c1a41473131e9c88bcd530c7334\r\nMac = 72838b59593c011c\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 235\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f70b8a4eee3518bba071af55f25f7b698a5b7dc8865cdaca6d1c7993657acc95\r\nMsg = 795ee1af7504621aac329f5081912de545fa11174f3979b14f11aa30df813a235b467fd8f3a14734fe5ac9e39105dcb25184673885cd19bc70ee5a53dd4e8149\r\nMac = 93542734d6cd43de\r\nResult = P\r\n\r\nCount = 236\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0c456d199abae4758734f506c4e9ccdb767e4fd156d5a4085726f3938a516d74\r\nMsg = 78f3bf568f1c3f2866eff8a246a70cf0faee4c3078f3fb27c4bdd53312bf50812bac2280118c0396e610b4110a22406084c18283a30ce7c0e49c769817170df9\r\nMac = c4c5be3c94fb7b9c\r\nResult = F (4 - Key or Key1 changed)\r\n\r\nCount = 237\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = 0a8725bd8c8eab9ed52ca47835837b9f00a6c8d834ab17105b01eb4eb30402e7\r\nMsg = d7867ff428c37836161a534d1d697fba43e86b0096c49b63d50afaf06ec772bda86eba7222796f087c5367d1547642b974d041cb496c5cf7984e8e126c9f741e\r\nMac = b5d40f8633965c33\r\nResult = F (3 - MAC changed)\r\n\r\nCount = 238\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = ce9ea80e7fb235486b5f1d0321c68a0e44cd5f15e21f27c402754a2f7c138772\r\nMsg = c246453f5d0f4957e6418b4d17b748f5c30e7ee672b4af2e4e41e145400be94056f4e94768871849fb44c1ee65378fce32d007e0c7ee5635453d4de6b0c2aa4b\r\nMac = 33ae4c66895989ee\r\nResult = F (1 - Message changed)\r\n\r\nCount = 239\r\nKlen = 32 \r\nMlen = 64\r\nTlen = 8\r\nKey = f26fad377bf7d6b35d8ea2e0621b678dad85826fadd3ee684d9215086b77e555\r\nMsg = 63539f949990883ac4f3ef9158b382a30254023c301de9fcd3cd4faa638a0ecb241a2573a9555a5c96da2435aa02c73cfc12c10f84b565bfdea9c6274bb8d67c\r\nMac = 8cda222f03f92913\r\nResult = F (2 - Key or Key2 changed)\r\n",
+};
 static const size_t kLen42 = 155170;
 
 static const char *kData42[] = {
@@ -4549,40 +4549,40 @@
   if (strcmp(path, "crypto/curve25519/ed25519_tests.txt") == 0) {
     return AssembleString(kData31, kLen31);
   }
-  if (strcmp(path, "crypto/cmac/cavp_3des_cmac_tests.txt") == 0) {
+  if (strcmp(path, "crypto/ecdh_extra/ecdh_tests.txt") == 0) {
     return AssembleString(kData32, kLen32);
   }
-  if (strcmp(path, "crypto/cmac/cavp_aes128_cmac_tests.txt") == 0) {
+  if (strcmp(path, "crypto/evp/evp_tests.txt") == 0) {
     return AssembleString(kData33, kLen33);
   }
-  if (strcmp(path, "crypto/cmac/cavp_aes192_cmac_tests.txt") == 0) {
+  if (strcmp(path, "crypto/evp/scrypt_tests.txt") == 0) {
     return AssembleString(kData34, kLen34);
   }
-  if (strcmp(path, "crypto/cmac/cavp_aes256_cmac_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/aes/aes_tests.txt") == 0) {
     return AssembleString(kData35, kLen35);
   }
-  if (strcmp(path, "crypto/ecdh_extra/ecdh_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/bn/bn_tests.txt") == 0) {
     return AssembleString(kData36, kLen36);
   }
-  if (strcmp(path, "crypto/evp/evp_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/bn/miller_rabin_tests.txt") == 0) {
     return AssembleString(kData37, kLen37);
   }
-  if (strcmp(path, "crypto/evp/scrypt_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/cmac/cavp_3des_cmac_tests.txt") == 0) {
     return AssembleString(kData38, kLen38);
   }
-  if (strcmp(path, "crypto/fipsmodule/aes/aes_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt") == 0) {
     return AssembleString(kData39, kLen39);
   }
-  if (strcmp(path, "crypto/fipsmodule/bn/bn_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt") == 0) {
     return AssembleString(kData40, kLen40);
   }
-  if (strcmp(path, "crypto/fipsmodule/bn/miller_rabin_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt") == 0) {
     return AssembleString(kData41, kLen41);
   }
   if (strcmp(path, "crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt") == 0) {
     return AssembleString(kData42, kLen42);
   }
-  if (strcmp(path, "crypto/fipsmodule/ec/p256-x86_64_tests.txt") == 0) {
+  if (strcmp(path, "crypto/fipsmodule/ec/p256-nistz_tests.txt") == 0) {
     return AssembleString(kData43, kLen43);
   }
   if (strcmp(path, "crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt") == 0) {
diff --git a/err_data.c b/err_data.c
index ec391d5..04b265d 100644
--- a/err_data.c
+++ b/err_data.c
@@ -76,54 +76,54 @@
     0xc3b00f7,
     0xc3b8921,
     0x10320892,
-    0x10329608,
-    0x10331614,
-    0x1033962d,
-    0x10341640,
+    0x10329620,
+    0x1033162c,
+    0x10339645,
+    0x10341658,
     0x10348f72,
     0x10350cab,
-    0x10359653,
-    0x1036167d,
-    0x10369690,
-    0x103716af,
-    0x103796c8,
-    0x103816dd,
-    0x103896fb,
-    0x1039170a,
-    0x10399726,
-    0x103a1741,
-    0x103a9750,
-    0x103b176c,
-    0x103b9787,
-    0x103c17ad,
+    0x1035966b,
+    0x10361695,
+    0x103696a8,
+    0x103716c7,
+    0x103796e0,
+    0x103816f5,
+    0x10389713,
+    0x10391722,
+    0x1039973e,
+    0x103a1759,
+    0x103a9768,
+    0x103b1784,
+    0x103b979f,
+    0x103c17c5,
     0x103c80f7,
-    0x103d17be,
-    0x103d97d2,
-    0x103e17f1,
-    0x103e9800,
-    0x103f1817,
-    0x103f982a,
+    0x103d17d6,
+    0x103d97ea,
+    0x103e1809,
+    0x103e9818,
+    0x103f182f,
+    0x103f9842,
     0x10400c6f,
-    0x1040983d,
-    0x1041185b,
-    0x1041986e,
-    0x10421888,
-    0x10429898,
-    0x104318ac,
-    0x104398c2,
-    0x104418da,
-    0x104498ef,
-    0x10451903,
-    0x10459915,
+    0x10409855,
+    0x10411873,
+    0x10419886,
+    0x104218a0,
+    0x104298b0,
+    0x104318c4,
+    0x104398da,
+    0x104418f2,
+    0x10449907,
+    0x1045191b,
+    0x1045992d,
     0x10460635,
     0x1046899a,
-    0x1047192a,
-    0x10479941,
-    0x10481956,
-    0x10489964,
+    0x10471942,
+    0x10479959,
+    0x1048196e,
+    0x1048997c,
     0x10490ebe,
-    0x1049979e,
-    0x104a1668,
+    0x104997b6,
+    0x104a1680,
     0x14320c52,
     0x14328c60,
     0x14330c6f,
@@ -193,50 +193,50 @@
     0x283480b9,
     0x283500f7,
     0x28358cb7,
-    0x2c3232a7,
+    0x2c3232bf,
     0x2c329351,
-    0x2c3332b5,
-    0x2c33b2c7,
-    0x2c3432db,
-    0x2c34b2ed,
-    0x2c353308,
-    0x2c35b31a,
-    0x2c36334a,
+    0x2c3332cd,
+    0x2c33b2df,
+    0x2c3432f3,
+    0x2c34b305,
+    0x2c353320,
+    0x2c35b332,
+    0x2c363362,
     0x2c36833a,
-    0x2c373357,
-    0x2c37b383,
-    0x2c3833a8,
-    0x2c38b3bf,
-    0x2c3933dd,
-    0x2c39b3ed,
-    0x2c3a33ff,
-    0x2c3ab413,
-    0x2c3b3424,
-    0x2c3bb443,
+    0x2c37336f,
+    0x2c37b39b,
+    0x2c3833c0,
+    0x2c38b3d7,
+    0x2c3933f5,
+    0x2c39b405,
+    0x2c3a3417,
+    0x2c3ab42b,
+    0x2c3b343c,
+    0x2c3bb45b,
     0x2c3c1363,
     0x2c3c9379,
-    0x2c3d3488,
+    0x2c3d34a0,
     0x2c3d9392,
-    0x2c3e34b2,
-    0x2c3eb4c0,
-    0x2c3f34d8,
-    0x2c3fb4f0,
-    0x2c40351a,
+    0x2c3e34ca,
+    0x2c3eb4d8,
+    0x2c3f34f0,
+    0x2c3fb508,
+    0x2c403532,
     0x2c409264,
-    0x2c41352b,
-    0x2c41b53e,
+    0x2c413543,
+    0x2c41b556,
     0x2c42122a,
-    0x2c42b54f,
+    0x2c42b567,
     0x2c43076d,
-    0x2c43b435,
-    0x2c443396,
-    0x2c44b4fd,
-    0x2c45332d,
-    0x2c45b369,
-    0x2c4633cd,
-    0x2c46b457,
-    0x2c47346c,
-    0x2c47b4a5,
+    0x2c43b44d,
+    0x2c4433ae,
+    0x2c44b515,
+    0x2c453345,
+    0x2c45b381,
+    0x2c4633e5,
+    0x2c46b46f,
+    0x2c473484,
+    0x2c47b4bd,
     0x30320000,
     0x30328015,
     0x3033001f,
@@ -375,261 +375,261 @@
     0x3c418db2,
     0x3c420ebe,
     0x3c428e48,
-    0x403219f6,
-    0x40329a0c,
-    0x40331a3a,
-    0x40339a44,
-    0x40341a5b,
-    0x40349a79,
-    0x40351a89,
-    0x40359a9b,
-    0x40361aa8,
-    0x40369ab4,
-    0x40371ac9,
-    0x40379adb,
-    0x40381ae6,
-    0x40389af8,
+    0x40321a0e,
+    0x40329a24,
+    0x40331a52,
+    0x40339a5c,
+    0x40341a73,
+    0x40349a91,
+    0x40351aa1,
+    0x40359ab3,
+    0x40361ac0,
+    0x40369acc,
+    0x40371ae1,
+    0x40379af3,
+    0x40381afe,
+    0x40389b10,
     0x40390f72,
-    0x40399b08,
-    0x403a1b1b,
-    0x403a9b3c,
-    0x403b1b4d,
-    0x403b9b5d,
+    0x40399b20,
+    0x403a1b33,
+    0x403a9b54,
+    0x403b1b65,
+    0x403b9b75,
     0x403c0071,
     0x403c8090,
-    0x403d1bbe,
-    0x403d9bd4,
-    0x403e1be3,
-    0x403e9c1b,
-    0x403f1c35,
-    0x403f9c5d,
-    0x40401c72,
-    0x40409c86,
-    0x40411cc1,
-    0x40419cdc,
-    0x40421cf5,
-    0x40429d08,
-    0x40431d1c,
-    0x40439d4a,
-    0x40441d61,
+    0x403d1bd6,
+    0x403d9bec,
+    0x403e1bfb,
+    0x403e9c33,
+    0x403f1c4d,
+    0x403f9c75,
+    0x40401c8a,
+    0x40409c9e,
+    0x40411cd9,
+    0x40419cf4,
+    0x40421d0d,
+    0x40429d20,
+    0x40431d34,
+    0x40439d62,
+    0x40441d79,
     0x404480b9,
-    0x40451d76,
-    0x40459d88,
-    0x40461dac,
-    0x40469dcc,
-    0x40471dda,
-    0x40479e01,
-    0x40481e72,
-    0x40489f2c,
-    0x40491f43,
-    0x40499f5d,
-    0x404a1f74,
-    0x404a9f92,
-    0x404b1faa,
-    0x404b9fd7,
-    0x404c1fed,
-    0x404c9fff,
-    0x404d2020,
-    0x404da059,
-    0x404e206d,
-    0x404ea07a,
-    0x404f2114,
-    0x404fa18a,
-    0x405021f9,
-    0x4050a20d,
-    0x40512240,
-    0x40522250,
-    0x4052a274,
-    0x4053228c,
-    0x4053a29f,
-    0x405422b4,
-    0x4054a2d7,
-    0x40552302,
-    0x4055a33f,
-    0x40562364,
-    0x4056a37d,
-    0x40572395,
-    0x4057a3a8,
-    0x405823bd,
-    0x4058a3e4,
-    0x40592413,
-    0x4059a440,
-    0x405a2454,
-    0x405aa464,
-    0x405b247c,
-    0x405ba48d,
-    0x405c24a0,
-    0x405ca4df,
-    0x405d24ec,
-    0x405da511,
-    0x405e254f,
+    0x40451d8e,
+    0x40459da0,
+    0x40461dc4,
+    0x40469de4,
+    0x40471df2,
+    0x40479e19,
+    0x40481e8a,
+    0x40489f44,
+    0x40491f5b,
+    0x40499f75,
+    0x404a1f8c,
+    0x404a9faa,
+    0x404b1fc2,
+    0x404b9fef,
+    0x404c2005,
+    0x404ca017,
+    0x404d2038,
+    0x404da071,
+    0x404e2085,
+    0x404ea092,
+    0x404f212c,
+    0x404fa1a2,
+    0x40502211,
+    0x4050a225,
+    0x40512258,
+    0x40522268,
+    0x4052a28c,
+    0x405322a4,
+    0x4053a2b7,
+    0x405422cc,
+    0x4054a2ef,
+    0x4055231a,
+    0x4055a357,
+    0x4056237c,
+    0x4056a395,
+    0x405723ad,
+    0x4057a3c0,
+    0x405823d5,
+    0x4058a3fc,
+    0x4059242b,
+    0x4059a458,
+    0x405a246c,
+    0x405aa47c,
+    0x405b2494,
+    0x405ba4a5,
+    0x405c24b8,
+    0x405ca4f7,
+    0x405d2504,
+    0x405da529,
+    0x405e2567,
     0x405e8afe,
-    0x405f2570,
-    0x405fa57d,
-    0x4060258b,
-    0x4060a5ad,
-    0x4061260e,
-    0x4061a646,
-    0x4062265d,
-    0x4062a66e,
-    0x406326bb,
-    0x4063a6d0,
-    0x406426e7,
-    0x4064a713,
-    0x4065272e,
-    0x4065a745,
-    0x4066275d,
-    0x4066a787,
-    0x406727b2,
-    0x4067a7f7,
-    0x4068283f,
-    0x4068a860,
-    0x40692892,
-    0x4069a8c0,
-    0x406a28e1,
-    0x406aa901,
-    0x406b2a89,
-    0x406baaac,
-    0x406c2ac2,
-    0x406cadcc,
-    0x406d2dfb,
-    0x406dae23,
-    0x406e2e51,
-    0x406eae9e,
-    0x406f2ef7,
-    0x406faf2f,
-    0x40702f42,
-    0x4070af5f,
+    0x405f2588,
+    0x405fa595,
+    0x406025a3,
+    0x4060a5c5,
+    0x40612626,
+    0x4061a65e,
+    0x40622675,
+    0x4062a686,
+    0x406326d3,
+    0x4063a6e8,
+    0x406426ff,
+    0x4064a72b,
+    0x40652746,
+    0x4065a75d,
+    0x40662775,
+    0x4066a79f,
+    0x406727ca,
+    0x4067a80f,
+    0x40682857,
+    0x4068a878,
+    0x406928aa,
+    0x4069a8d8,
+    0x406a28f9,
+    0x406aa919,
+    0x406b2aa1,
+    0x406baac4,
+    0x406c2ada,
+    0x406cade4,
+    0x406d2e13,
+    0x406dae3b,
+    0x406e2e69,
+    0x406eaeb6,
+    0x406f2f0f,
+    0x406faf47,
+    0x40702f5a,
+    0x4070af77,
     0x4071084d,
-    0x4071af71,
-    0x40722f84,
-    0x4072afba,
-    0x40732fd2,
-    0x40739563,
-    0x40742fe6,
-    0x4074b000,
-    0x40753011,
-    0x4075b025,
-    0x40763033,
+    0x4071af89,
+    0x40722f9c,
+    0x4072afd2,
+    0x40732fea,
+    0x4073957b,
+    0x40742ffe,
+    0x4074b018,
+    0x40753029,
+    0x4075b03d,
+    0x4076304b,
     0x40769327,
-    0x40773058,
-    0x4077b098,
-    0x407830b3,
-    0x4078b0ec,
-    0x40793103,
-    0x4079b119,
-    0x407a3145,
-    0x407ab158,
-    0x407b316d,
-    0x407bb17f,
-    0x407c31b0,
-    0x407cb1b9,
-    0x407d287b,
-    0x407da1b2,
-    0x407e30c8,
-    0x407ea3f4,
-    0x407f1dee,
-    0x407f9fc1,
-    0x40802124,
-    0x40809e16,
-    0x40812262,
-    0x4081a0c8,
-    0x40822e3c,
-    0x40829b69,
-    0x408323cf,
-    0x4083a6f8,
-    0x40841e2a,
-    0x4084a42c,
-    0x408524b1,
-    0x4085a5d5,
-    0x40862531,
-    0x4086a1cc,
-    0x40872e82,
-    0x4087a623,
-    0x40881ba7,
-    0x4088a80a,
-    0x40891bf6,
-    0x40899b83,
-    0x408a2afa,
-    0x408a997b,
-    0x408b3194,
-    0x408baf0c,
-    0x408c24c1,
-    0x408c99b3,
-    0x408d1f12,
-    0x408d9e5c,
-    0x408e2042,
-    0x408ea31f,
-    0x408f281e,
-    0x408fa5f1,
-    0x409027d3,
-    0x4090a503,
-    0x40912ae2,
-    0x409199d9,
-    0x40921c43,
-    0x4092aebd,
-    0x40932f9d,
-    0x4093a1dd,
-    0x40941e3e,
-    0x4094ab13,
-    0x4095267f,
-    0x4095b125,
-    0x40962e69,
-    0x4096a13d,
-    0x40972228,
-    0x4097a091,
-    0x40981ca3,
-    0x4098a693,
-    0x40992ed9,
-    0x4099a34c,
-    0x409a22e5,
-    0x409a9997,
-    0x409b1e98,
-    0x409b9ec3,
-    0x409c307a,
-    0x409c9eeb,
-    0x409d20f9,
-    0x409da0de,
-    0x409e1d34,
-    0x409ea172,
-    0x409f215a,
-    0x409f9e8b,
-    0x40a0219a,
-    0x40a0a0ab,
-    0x41f429b4,
-    0x41f92a46,
-    0x41fe2939,
-    0x41feabef,
-    0x41ff2d1d,
-    0x420329cd,
-    0x420829ef,
-    0x4208aa2b,
-    0x4209291d,
-    0x4209aa65,
-    0x420a2974,
-    0x420aa954,
-    0x420b2994,
-    0x420baa0d,
-    0x420c2d39,
-    0x420cab23,
-    0x420d2bd6,
-    0x420dac0d,
-    0x42122c40,
-    0x42172d00,
-    0x4217ac82,
-    0x421c2ca4,
-    0x421f2c5f,
-    0x42212db1,
-    0x42262ce3,
-    0x422b2d8f,
-    0x422babb1,
-    0x422c2d71,
-    0x422cab64,
-    0x422d2b3d,
-    0x422dad50,
-    0x422e2b90,
-    0x42302cbf,
-    0x4230ac27,
+    0x40773070,
+    0x4077b0b0,
+    0x407830cb,
+    0x4078b104,
+    0x4079311b,
+    0x4079b131,
+    0x407a315d,
+    0x407ab170,
+    0x407b3185,
+    0x407bb197,
+    0x407c31c8,
+    0x407cb1d1,
+    0x407d2893,
+    0x407da1ca,
+    0x407e30e0,
+    0x407ea40c,
+    0x407f1e06,
+    0x407f9fd9,
+    0x4080213c,
+    0x40809e2e,
+    0x4081227a,
+    0x4081a0e0,
+    0x40822e54,
+    0x40829b81,
+    0x408323e7,
+    0x4083a710,
+    0x40841e42,
+    0x4084a444,
+    0x408524c9,
+    0x4085a5ed,
+    0x40862549,
+    0x4086a1e4,
+    0x40872e9a,
+    0x4087a63b,
+    0x40881bbf,
+    0x4088a822,
+    0x40891c0e,
+    0x40899b9b,
+    0x408a2b12,
+    0x408a9993,
+    0x408b31ac,
+    0x408baf24,
+    0x408c24d9,
+    0x408c99cb,
+    0x408d1f2a,
+    0x408d9e74,
+    0x408e205a,
+    0x408ea337,
+    0x408f2836,
+    0x408fa609,
+    0x409027eb,
+    0x4090a51b,
+    0x40912afa,
+    0x409199f1,
+    0x40921c5b,
+    0x4092aed5,
+    0x40932fb5,
+    0x4093a1f5,
+    0x40941e56,
+    0x4094ab2b,
+    0x40952697,
+    0x4095b13d,
+    0x40962e81,
+    0x4096a155,
+    0x40972240,
+    0x4097a0a9,
+    0x40981cbb,
+    0x4098a6ab,
+    0x40992ef1,
+    0x4099a364,
+    0x409a22fd,
+    0x409a99af,
+    0x409b1eb0,
+    0x409b9edb,
+    0x409c3092,
+    0x409c9f03,
+    0x409d2111,
+    0x409da0f6,
+    0x409e1d4c,
+    0x409ea18a,
+    0x409f2172,
+    0x409f9ea3,
+    0x40a021b2,
+    0x40a0a0c3,
+    0x41f429cc,
+    0x41f92a5e,
+    0x41fe2951,
+    0x41feac07,
+    0x41ff2d35,
+    0x420329e5,
+    0x42082a07,
+    0x4208aa43,
+    0x42092935,
+    0x4209aa7d,
+    0x420a298c,
+    0x420aa96c,
+    0x420b29ac,
+    0x420baa25,
+    0x420c2d51,
+    0x420cab3b,
+    0x420d2bee,
+    0x420dac25,
+    0x42122c58,
+    0x42172d18,
+    0x4217ac9a,
+    0x421c2cbc,
+    0x421f2c77,
+    0x42212dc9,
+    0x42262cfb,
+    0x422b2da7,
+    0x422babc9,
+    0x422c2d89,
+    0x422cab7c,
+    0x422d2b55,
+    0x422dad68,
+    0x422e2ba8,
+    0x42302cd7,
+    0x4230ac3f,
     0x44320778,
     0x44328787,
     0x44330793,
@@ -651,104 +651,105 @@
     0x48329363,
     0x48331379,
     0x48339392,
-    0x4c3213b7,
-    0x4c3293c7,
-    0x4c3313da,
-    0x4c3393fa,
+    0x4c3213cf,
+    0x4c3293df,
+    0x4c3313f2,
+    0x4c339412,
     0x4c3400b9,
     0x4c3480f7,
-    0x4c351406,
-    0x4c359414,
-    0x4c361430,
-    0x4c369456,
-    0x4c371465,
-    0x4c379473,
-    0x4c381488,
-    0x4c389494,
-    0x4c3914b4,
-    0x4c3994de,
-    0x4c3a14f7,
-    0x4c3a9510,
+    0x4c35141e,
+    0x4c35942c,
+    0x4c361448,
+    0x4c36946e,
+    0x4c37147d,
+    0x4c37948b,
+    0x4c3814a0,
+    0x4c3894ac,
+    0x4c3914cc,
+    0x4c3994f6,
+    0x4c3a150f,
+    0x4c3a9528,
     0x4c3b0635,
-    0x4c3b9529,
-    0x4c3c153b,
-    0x4c3c954a,
-    0x4c3d1563,
+    0x4c3b9541,
+    0x4c3c1553,
+    0x4c3c9562,
+    0x4c3d157b,
     0x4c3d8c92,
-    0x4c3e15d0,
-    0x4c3e9572,
-    0x4c3f15f2,
+    0x4c3e15e8,
+    0x4c3e958a,
+    0x4c3f160a,
     0x4c3f9327,
-    0x4c401588,
-    0x4c4093a3,
-    0x4c4115c0,
-    0x4c419443,
-    0x4c4215ac,
-    0x50323561,
-    0x5032b570,
-    0x5033357b,
-    0x5033b58b,
-    0x503435a4,
-    0x5034b5be,
-    0x503535cc,
-    0x5035b5e2,
-    0x503635f4,
-    0x5036b60a,
-    0x50373623,
-    0x5037b636,
-    0x5038364e,
-    0x5038b65f,
-    0x50393674,
-    0x5039b688,
-    0x503a36a8,
-    0x503ab6be,
-    0x503b36d6,
-    0x503bb6e8,
-    0x503c3704,
-    0x503cb71b,
-    0x503d3734,
-    0x503db74a,
-    0x503e3757,
-    0x503eb76d,
-    0x503f377f,
+    0x4c4015a0,
+    0x4c4093bb,
+    0x4c4115d8,
+    0x4c41945b,
+    0x4c4215c4,
+    0x4c4293a3,
+    0x50323579,
+    0x5032b588,
+    0x50333593,
+    0x5033b5a3,
+    0x503435bc,
+    0x5034b5d6,
+    0x503535e4,
+    0x5035b5fa,
+    0x5036360c,
+    0x5036b622,
+    0x5037363b,
+    0x5037b64e,
+    0x50383666,
+    0x5038b677,
+    0x5039368c,
+    0x5039b6a0,
+    0x503a36c0,
+    0x503ab6d6,
+    0x503b36ee,
+    0x503bb700,
+    0x503c371c,
+    0x503cb733,
+    0x503d374c,
+    0x503db762,
+    0x503e376f,
+    0x503eb785,
+    0x503f3797,
     0x503f83b3,
-    0x50403792,
-    0x5040b7a2,
-    0x504137bc,
-    0x5041b7cb,
-    0x504237e5,
-    0x5042b802,
-    0x50433812,
-    0x5043b822,
-    0x5044383f,
+    0x504037aa,
+    0x5040b7ba,
+    0x504137d4,
+    0x5041b7e3,
+    0x504237fd,
+    0x5042b81a,
+    0x5043382a,
+    0x5043b83a,
+    0x50443857,
     0x50448469,
-    0x50453853,
-    0x5045b871,
-    0x50463884,
-    0x5046b89a,
-    0x504738ac,
-    0x5047b8c1,
-    0x504838e7,
-    0x5048b8f5,
-    0x50493908,
-    0x5049b91d,
-    0x504a3933,
-    0x504ab943,
-    0x504b3963,
-    0x504bb976,
-    0x504c3999,
-    0x504cb9c7,
-    0x504d39f4,
-    0x504dba11,
-    0x504e3a2c,
-    0x504eba48,
-    0x504f3a5a,
-    0x504fba71,
-    0x50503a80,
+    0x5045386b,
+    0x5045b889,
+    0x5046389c,
+    0x5046b8b2,
+    0x504738c4,
+    0x5047b8d9,
+    0x504838ff,
+    0x5048b90d,
+    0x50493920,
+    0x5049b935,
+    0x504a394b,
+    0x504ab95b,
+    0x504b397b,
+    0x504bb98e,
+    0x504c39b1,
+    0x504cb9df,
+    0x504d3a0c,
+    0x504dba29,
+    0x504e3a44,
+    0x504eba60,
+    0x504f3a72,
+    0x504fba89,
+    0x50503a98,
     0x50508729,
-    0x50513a93,
-    0x5051b831,
-    0x505239d9,
+    0x50513aab,
+    0x5051b849,
+    0x505239f1,
     0x58320fb0,
     0x68320f72,
     0x68328cca,
@@ -790,21 +791,21 @@
     0x783e0aed,
     0x783e8a9f,
     0x7c321240,
-    0x80321456,
+    0x8032146e,
     0x80328090,
-    0x80333276,
+    0x8033328e,
     0x803380b9,
-    0x80343285,
-    0x8034b1ed,
-    0x8035320b,
-    0x8035b299,
-    0x8036324d,
-    0x8036b1fc,
-    0x8037323f,
-    0x8037b1da,
-    0x80383260,
-    0x8038b21c,
-    0x80393231,
+    0x8034329d,
+    0x8034b205,
+    0x80353223,
+    0x8035b2b1,
+    0x80363265,
+    0x8036b214,
+    0x80373257,
+    0x8037b1f2,
+    0x80383278,
+    0x8038b234,
+    0x80393249,
 };
 
 const size_t kOpenSSLReasonValuesLen = sizeof(kOpenSSLReasonValues) / sizeof(kOpenSSLReasonValues[0]);
@@ -1073,6 +1074,7 @@
     "NOT_PKCS7_SIGNED_DATA\0"
     "NO_CERTIFICATES_INCLUDED\0"
     "NO_CRLS_INCLUDED\0"
+    "AMBIGUOUS_FRIENDLY_NAME\0"
     "BAD_ITERATION_COUNT\0"
     "BAD_PKCS12_DATA\0"
     "BAD_PKCS12_VERSION\0"
diff --git a/eureka.mk b/eureka.mk
index 9b500f8..939e62e 100644
--- a/eureka.mk
+++ b/eureka.mk
@@ -68,7 +68,6 @@
   src/crypto/chacha/chacha.c\
   src/crypto/cipher_extra/cipher_extra.c\
   src/crypto/cipher_extra/derive_key.c\
-  src/crypto/cipher_extra/e_aesccm.c\
   src/crypto/cipher_extra/e_aesctrhmac.c\
   src/crypto/cipher_extra/e_aesgcmsiv.c\
   src/crypto/cipher_extra/e_chacha20poly1305.c\
@@ -78,7 +77,6 @@
   src/crypto/cipher_extra/e_rc4.c\
   src/crypto/cipher_extra/e_tls.c\
   src/crypto/cipher_extra/tls_cbc.c\
-  src/crypto/cmac/cmac.c\
   src/crypto/conf/conf.c\
   src/crypto/cpu_aarch64_apple.c\
   src/crypto/cpu_aarch64_fuchsia.c\
@@ -308,10 +306,13 @@
 
 linux_aarch64_sources := \
   linux-aarch64/crypto/chacha/chacha-armv8.S\
+  linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S\
   linux-aarch64/crypto/fipsmodule/aesv8-armx64.S\
   linux-aarch64/crypto/fipsmodule/armv8-mont.S\
   linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S\
   linux-aarch64/crypto/fipsmodule/ghashv8-armx64.S\
+  linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S\
+  linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S\
   linux-aarch64/crypto/fipsmodule/sha1-armv8.S\
   linux-aarch64/crypto/fipsmodule/sha256-armv8.S\
   linux-aarch64/crypto/fipsmodule/sha512-armv8.S\
diff --git a/linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S b/linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
new file mode 100644
index 0000000..4aeaa06
--- /dev/null
+++ b/linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
@@ -0,0 +1,3020 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(__aarch64__)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include <openssl/arm_arch.h>
+.section	.rodata
+
+.align	7
+.Lchacha20_consts:
+.byte	'e','x','p','a','n','d',' ','3','2','-','b','y','t','e',' ','k'
+.Linc:
+.long	1,2,3,4
+.Lrol8:
+.byte	3,0,1,2, 7,4,5,6, 11,8,9,10, 15,12,13,14
+.Lclamp:
+.quad	0x0FFFFFFC0FFFFFFF, 0x0FFFFFFC0FFFFFFC
+
+.text
+
+.type	.Lpoly_hash_ad_internal,%function
+.align	6
+.Lpoly_hash_ad_internal:
+.cfi_startproc
+	cbnz	x4, .Lpoly_hash_intro
+	ret
+
+.Lpoly_hash_intro:
+	cmp	x4, #16
+	b.lt	.Lpoly_hash_ad_tail
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #16
+	b	.Lpoly_hash_ad_internal
+
+.Lpoly_hash_ad_tail:
+	cbz	x4, .Lpoly_hash_ad_ret
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the AAD
+	sub	x4, x4, #1
+
+.Lpoly_hash_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, x4]
+	mov	v20.b[0], w11
+	subs	x4, x4, #1
+	b.ge	.Lpoly_hash_tail_16_compose
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+.Lpoly_hash_ad_ret:
+	ret
+.cfi_endproc
+.size	.Lpoly_hash_ad_internal, .-.Lpoly_hash_ad_internal
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_seal(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *seal_data);
+//
+.globl	chacha20_poly1305_seal
+.hidden	chacha20_poly1305_seal
+.type	chacha20_poly1305_seal,%function
+.align	6
+chacha20_poly1305_seal:
+	AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+	stp	x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset	80
+.cfi_offset	w30, -72
+.cfi_offset	w29, -80
+	mov	x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+	stp	d8, d9, [sp, #16]
+	stp	d10, d11, [sp, #32]
+	stp	d12, d13, [sp, #48]
+	stp	d14, d15, [sp, #64]
+.cfi_offset	b15, -8
+.cfi_offset	b14, -16
+.cfi_offset	b13, -24
+.cfi_offset	b12, -32
+.cfi_offset	b11, -40
+.cfi_offset	b10, -48
+.cfi_offset	b9, -56
+.cfi_offset	b8, -64
+
+	adrp	x11, .Lchacha20_consts
+	add	x11, x11, :lo12:.Lchacha20_consts
+
+	ld1	{v24.16b - v27.16b}, [x11] // .Load the CONSTS, INC, ROL8 and CLAMP values
+	ld1	{v28.16b - v30.16b}, [x5]
+
+	mov	x15, #1 // Prepare the Poly1305 state
+	mov	x8, #0
+	mov	x9, #0
+	mov	x10, #0
+
+	ldr	x12, [x5, #56]   // The total cipher text length includes extra_in_len
+	add	x12, x12, x2
+	mov	v31.d[0], x4  // Store the input and aad lengths
+	mov	v31.d[1], x12
+
+	cmp	x2, #128
+	b.le	.Lseal_128 // Optimization for smaller buffers
+
+    // Initially we prepare 5 ChaCha20 blocks. Four to encrypt up to 4 blocks (256 bytes) of plaintext,
+    // and one for the Poly1305 R and S keys. The first four blocks (A0-A3..D0-D3) are computed vertically,
+    // the fifth block (A4-D4) horizontally.
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	sub	x5, x5, #32
+
+	mov	x6, #10
+
+.align	5
+.Lseal_init_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x6, x6, #1
+	b.hi	.Lseal_init_rounds
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #4
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	and	v4.16b, v4.16b, v27.16b
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	mov	x16, v4.d[0] // Move the R key to GPRs
+	mov	x17, v4.d[1]
+	mov	v27.16b, v9.16b // Store the S key
+
+	bl	.Lpoly_hash_ad_internal
+
+	mov	x3, x0
+	cmp	x2, #256
+	b.le	.Lseal_tail
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #256
+
+	mov	x6, #4 // In the first run of the loop we need to hash 256 bytes, therefore we hash one block for the first 4 rounds
+	mov	x7, #6 // and two blocks for the remaining 6, for a total of (1 * 4 + 2 * 6) * 16 = 256
+
+.Lseal_main_loop:
+	adrp	x11, .Lchacha20_consts
+	add	x11, x11, :lo12:.Lchacha20_consts
+
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	sub	x5, x5, #32
+.align	5
+.Lseal_main_loop_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x6, x6, #1
+	b.ge	.Lseal_main_loop_rounds
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	subs	x7, x7, #1
+	b.gt	.Lseal_main_loop_rounds
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #5
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	add	v14.4s, v14.4s, v29.4s
+	add	v19.4s, v19.4s, v30.4s
+
+	cmp	x2, #320
+	b.le	.Lseal_tail
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v4.16b
+	eor	v21.16b, v21.16b, v9.16b
+	eor	v22.16b, v22.16b, v14.16b
+	eor	v23.16b, v23.16b, v19.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #320
+
+	mov	x6, #0
+	mov	x7, #10 // For the remainder of the loop we always hash and encrypt 320 bytes per iteration
+
+	b	.Lseal_main_loop
+
+.Lseal_tail:
+    // This part of the function handles the storage and authentication of the last [0,320) bytes
+    // We assume A0-A4 ... D0-D4 hold at least inl (320 max) bytes of the stream data.
+	cmp	x2, #64
+	b.lt	.Lseal_tail_64
+
+    // Store and authenticate 64B blocks per iteration
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v22.d[0]
+	mov	x12, v22.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v23.d[0]
+	mov	x12, v23.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	st1	{v20.16b - v23.16b}, [x0], #64
+	sub	x2, x2, #64
+
+    // Shift the state left by 64 bytes for the next iteration of the loop
+	mov	v0.16b, v1.16b
+	mov	v5.16b, v6.16b
+	mov	v10.16b, v11.16b
+	mov	v15.16b, v16.16b
+
+	mov	v1.16b, v2.16b
+	mov	v6.16b, v7.16b
+	mov	v11.16b, v12.16b
+	mov	v16.16b, v17.16b
+
+	mov	v2.16b, v3.16b
+	mov	v7.16b, v8.16b
+	mov	v12.16b, v13.16b
+	mov	v17.16b, v18.16b
+
+	mov	v3.16b, v4.16b
+	mov	v8.16b, v9.16b
+	mov	v13.16b, v14.16b
+	mov	v18.16b, v19.16b
+
+	b	.Lseal_tail
+
+.Lseal_tail_64:
+	ldp	x3, x4, [x5, #48] // extra_in_len and extra_in_ptr
+
+    // Here we handle the last [0,64) bytes of plaintext
+	cmp	x2, #16
+	b.lt	.Lseal_tail_16
+    // Each iteration encrypt and authenticate a 16B block
+	ld1	{v20.16b}, [x1], #16
+	eor	v20.16b, v20.16b, v0.16b
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	st1	{v20.16b}, [x0], #16
+
+	sub	x2, x2, #16
+
+    // Shift the state left by 16 bytes for the next iteration of the loop
+	mov	v0.16b, v5.16b
+	mov	v5.16b, v10.16b
+	mov	v10.16b, v15.16b
+
+	b	.Lseal_tail_64
+
+.Lseal_tail_16:
+    // Here we handle the last [0,16) bytes of ciphertext that require a padded block
+	cbz	x2, .Lseal_hash_extra
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the plaintext/extra in
+	eor	v21.16b, v21.16b, v21.16b // Use T1 to generate an AND mask that will only mask the ciphertext bytes
+	not	v22.16b, v20.16b
+
+	mov	x6, x2
+	add	x1, x1, x2
+
+	cbz	x4, .Lseal_tail_16_compose // No extra data to pad with, zero padding
+
+	mov	x7, #16          // We need to load some extra_in first for padding
+	sub	x7, x7, x2
+	cmp	x4, x7
+	csel	x7, x4, x7, lt // .Load the minimum of extra_in_len and the amount needed to fill the register
+	mov	x12, x7
+	add	x3, x3, x7
+	sub	x4, x4, x7
+
+.Lseal_tail16_compose_extra_in:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, #-1]!
+	mov	v20.b[0], w11
+	subs	x7, x7, #1
+	b.gt	.Lseal_tail16_compose_extra_in
+
+	add	x3, x3, x12
+
+.Lseal_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x1, #-1]!
+	mov	v20.b[0], w11
+	ext	v21.16b, v22.16b, v21.16b, #15
+	subs	x2, x2, #1
+	b.gt	.Lseal_tail_16_compose
+
+	and	v0.16b, v0.16b, v21.16b
+	eor	v20.16b, v20.16b, v0.16b
+	mov	v21.16b, v20.16b
+
+.Lseal_tail_16_store:
+	umov	w11, v20.b[0]
+	strb	w11, [x0], #1
+	ext	v20.16b, v20.16b, v20.16b, #1
+	subs	x6, x6, #1
+	b.gt	.Lseal_tail_16_store
+
+    // Hash in the final ct block concatenated with extra_in
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+.Lseal_hash_extra:
+	cbz	x4, .Lseal_finalize
+
+.Lseal_hash_extra_loop:
+	cmp	x4, #16
+	b.lt	.Lseal_hash_extra_tail
+	ld1	{v20.16b}, [x3], #16
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #16
+	b	.Lseal_hash_extra_loop
+
+.Lseal_hash_extra_tail:
+	cbz	x4, .Lseal_finalize
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the remaining extra ciphertext
+	add	x3, x3, x4
+
+.Lseal_hash_extra_load:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, #-1]!
+	mov	v20.b[0], w11
+	subs	x4, x4, #1
+	b.gt	.Lseal_hash_extra_load
+
+    // Hash in the final padded extra_in blcok
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+.Lseal_finalize:
+	mov	x11, v31.d[0]
+	mov	x12, v31.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+    # Final reduction step
+	sub	x12, xzr, x15
+	orr	x13, xzr, #3
+	subs	x11, x8, #-5
+	sbcs	x12, x9, x12
+	sbcs	x13, x10, x13
+	csel	x8, x11, x8, cs
+	csel	x9, x12, x9, cs
+	csel	x10, x13, x10, cs
+	mov	x11, v27.d[0]
+	mov	x12, v27.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+
+	stp	x8, x9, [x5]
+
+	ldp	d8, d9, [sp, #16]
+	ldp	d10, d11, [sp, #32]
+	ldp	d12, d13, [sp, #48]
+	ldp	d14, d15, [sp, #64]
+.cfi_restore	b15
+.cfi_restore	b14
+.cfi_restore	b13
+.cfi_restore	b12
+.cfi_restore	b11
+.cfi_restore	b10
+.cfi_restore	b9
+.cfi_restore	b8
+	ldp	x29, x30, [sp], 80
+.cfi_restore	w29
+.cfi_restore	w30
+.cfi_def_cfa_offset	0
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+.Lseal_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+	eor	v25.16b, v25.16b, v25.16b
+	mov	x11, #1
+	mov	v25.s[0], w11
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v17.16b, v30.16b
+	add	v15.4s, v17.4s, v25.4s
+	add	v16.4s, v15.4s, v25.4s
+
+	mov	x6, #10
+
+.Lseal_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x6, x6, #1
+	b.hi	.Lseal_128_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+
+    // Only the first 32 bytes of the third block (counter = 0) are needed,
+    // so skip updating v12 and v17.
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+
+	add	v30.4s, v30.4s, v25.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v30.4s, v30.4s, v25.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	and	v2.16b, v2.16b, v27.16b
+	mov	x16, v2.d[0] // Move the R key to GPRs
+	mov	x17, v2.d[1]
+	mov	v27.16b, v7.16b // Store the S key
+
+	bl	.Lpoly_hash_ad_internal
+	b	.Lseal_tail
+.cfi_endproc
+.size	chacha20_poly1305_seal,.-chacha20_poly1305_seal
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_open(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *aead_data);
+//
+.globl	chacha20_poly1305_open
+.hidden	chacha20_poly1305_open
+.type	chacha20_poly1305_open,%function
+.align	6
+chacha20_poly1305_open:
+	AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+	stp	x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset	80
+.cfi_offset	w30, -72
+.cfi_offset	w29, -80
+	mov	x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+	stp	d8, d9, [sp, #16]
+	stp	d10, d11, [sp, #32]
+	stp	d12, d13, [sp, #48]
+	stp	d14, d15, [sp, #64]
+.cfi_offset	b15, -8
+.cfi_offset	b14, -16
+.cfi_offset	b13, -24
+.cfi_offset	b12, -32
+.cfi_offset	b11, -40
+.cfi_offset	b10, -48
+.cfi_offset	b9, -56
+.cfi_offset	b8, -64
+
+	adrp	x11, .Lchacha20_consts
+	add	x11, x11, :lo12:.Lchacha20_consts
+
+	ld1	{v24.16b - v27.16b}, [x11] // .Load the CONSTS, INC, ROL8 and CLAMP values
+	ld1	{v28.16b - v30.16b}, [x5]
+
+	mov	x15, #1 // Prepare the Poly1305 state
+	mov	x8, #0
+	mov	x9, #0
+	mov	x10, #0
+
+	mov	v31.d[0], x4  // Store the input and aad lengths
+	mov	v31.d[1], x2
+
+	cmp	x2, #128
+	b.le	.Lopen_128 // Optimization for smaller buffers
+
+    // Initially we prepare a single ChaCha20 block for the Poly1305 R and S keys
+	mov	v0.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v15.16b, v30.16b
+
+	mov	x6, #10
+
+.align	5
+.Lopen_init_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	subs	x6, x6, #1
+	b.hi	.Lopen_init_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+
+	and	v0.16b, v0.16b, v27.16b
+	mov	x16, v0.d[0] // Move the R key to GPRs
+	mov	x17, v0.d[1]
+	mov	v27.16b, v5.16b // Store the S key
+
+	bl	.Lpoly_hash_ad_internal
+
+.Lopen_ad_done:
+	mov	x3, x1
+
+// Each iteration of the loop hash 320 bytes, and prepare stream for 320 bytes
+.Lopen_main_loop:
+
+	cmp	x2, #192
+	b.lt	.Lopen_tail
+
+	adrp	x11, .Lchacha20_consts
+	add	x11, x11, :lo12:.Lchacha20_consts
+
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	sub	x5, x5, #32
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	lsr	x4, x2, #4 // How many whole blocks we have to hash, will always be at least 12
+	sub	x4, x4, #10
+
+	mov	x7, #10
+	subs	x6, x7, x4
+	subs	x6, x7, x4 // itr1 can be negative if we have more than 320 bytes to hash
+	csel	x7, x7, x4, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are full
+
+	cbz	x7, .Lopen_main_loop_rounds_short
+
+.align	5
+.Lopen_main_loop_rounds:
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+.Lopen_main_loop_rounds_short:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x7, x7, #1
+	b.gt	.Lopen_main_loop_rounds
+	subs	x6, x6, #1
+	b.ge	.Lopen_main_loop_rounds_short
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #5
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	add	v14.4s, v14.4s, v29.4s
+	add	v19.4s, v19.4s, v30.4s
+
+    // We can always safely store 192 bytes
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #192
+
+	mov	v0.16b, v3.16b
+	mov	v5.16b, v8.16b
+	mov	v10.16b, v13.16b
+	mov	v15.16b, v18.16b
+
+	cmp	x2, #64
+	b.lt	.Lopen_tail_64_store
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+
+	mov	v0.16b, v4.16b
+	mov	v5.16b, v9.16b
+	mov	v10.16b, v14.16b
+	mov	v15.16b, v19.16b
+
+	cmp	x2, #64
+	b.lt	.Lopen_tail_64_store
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v4.16b
+	eor	v21.16b, v21.16b, v9.16b
+	eor	v22.16b, v22.16b, v14.16b
+	eor	v23.16b, v23.16b, v19.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+	b	.Lopen_main_loop
+
+.Lopen_tail:
+
+	cbz	x2, .Lopen_finalize
+
+	lsr	x4, x2, #4 // How many whole blocks we have to hash
+
+	cmp	x2, #64
+	b.le	.Lopen_tail_64
+	cmp	x2, #128
+	b.le	.Lopen_tail_128
+
+.Lopen_tail_192:
+     // We need three more blocks
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v15.16b, v30.16b
+	mov	v16.16b, v30.16b
+	mov	v17.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	eor	v21.16b, v21.16b, v21.16b
+	ins	v23.s[0], v25.s[0]
+	ins	v21.d[0], x15
+
+	add	v22.4s, v23.4s, v21.4s
+	add	v21.4s, v22.4s, v21.4s
+
+	add	v15.4s, v15.4s, v21.4s
+	add	v16.4s, v16.4s, v23.4s
+	add	v17.4s, v17.4s, v22.4s
+
+	mov	x7, #10
+	subs	x6, x7, x4 // itr1 can be negative if we have more than 160 bytes to hash
+	csel	x7, x7, x4, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are hashing
+	sub	x4, x4, x7
+
+	cbz	x7, .Lopen_tail_192_rounds_no_hash
+
+.Lopen_tail_192_rounds:
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+.Lopen_tail_192_rounds_no_hash:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x7, x7, #1
+	b.gt	.Lopen_tail_192_rounds
+	subs	x6, x6, #1
+	b.ge	.Lopen_tail_192_rounds_no_hash
+
+    // We hashed 160 bytes at most, may still have 32 bytes left
+.Lopen_tail_192_hash:
+	cbz	x4, .Lopen_tail_192_hash_done
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #1
+	b	.Lopen_tail_192_hash
+
+.Lopen_tail_192_hash_done:
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v16.4s, v16.4s, v30.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v15.4s, v15.4s, v21.4s
+	add	v16.4s, v16.4s, v23.4s
+	add	v17.4s, v17.4s, v22.4s
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #128
+	b	.Lopen_tail_64_store
+
+.Lopen_tail_128:
+     // We need two more blocks
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v15.16b, v30.16b
+	mov	v16.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	eor	v22.16b, v22.16b, v22.16b
+	ins	v23.s[0], v25.s[0]
+	ins	v22.d[0], x15
+	add	v22.4s, v22.4s, v23.4s
+
+	add	v15.4s, v15.4s, v22.4s
+	add	v16.4s, v16.4s, v23.4s
+
+	mov	x6, #10
+	sub	x6, x6, x4
+
+.Lopen_tail_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v1.4s, v1.4s, v6.4s
+	eor	v16.16b, v16.16b, v1.16b
+	rev32	v16.8h, v16.8h
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v6.16b, v6.16b, v11.16b
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	add	v1.4s, v1.4s, v20.4s
+	eor	v16.16b, v16.16b, v1.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v20.16b, v20.16b, v11.16b
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v16.16b, v16.16b, v16.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	add	v1.4s, v1.4s, v6.4s
+	eor	v16.16b, v16.16b, v1.16b
+	rev32	v16.8h, v16.8h
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v6.16b, v6.16b, v11.16b
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	add	v1.4s, v1.4s, v20.4s
+	eor	v16.16b, v16.16b, v1.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v20.16b, v20.16b, v11.16b
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v16.16b, v16.16b, v16.16b, #4
+	subs	x6, x6, #1
+	b.gt	.Lopen_tail_128_rounds
+	cbz	x4, .Lopen_tail_128_rounds_done
+	subs	x4, x4, #1
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	b	.Lopen_tail_128_rounds
+
+.Lopen_tail_128_rounds_done:
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v16.4s, v16.4s, v30.4s
+	add	v15.4s, v15.4s, v22.4s
+	add	v16.4s, v16.4s, v23.4s
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+	sub	x2, x2, #64
+
+	b	.Lopen_tail_64_store
+
+.Lopen_tail_64:
+    // We just need a single block
+	mov	v0.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v15.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	ins	v23.s[0], v25.s[0]
+	add	v15.4s, v15.4s, v23.4s
+
+	mov	x6, #10
+	sub	x6, x6, x4
+
+.Lopen_tail_64_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	subs	x6, x6, #1
+	b.gt	.Lopen_tail_64_rounds
+	cbz	x4, .Lopen_tail_64_rounds_done
+	subs	x4, x4, #1
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	b	.Lopen_tail_64_rounds
+
+.Lopen_tail_64_rounds_done:
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v15.4s, v15.4s, v23.4s
+
+.Lopen_tail_64_store:
+	cmp	x2, #16
+	b.lt	.Lopen_tail_16
+
+	ld1	{v20.16b}, [x1], #16
+	eor	v20.16b, v20.16b, v0.16b
+	st1	{v20.16b}, [x0], #16
+	mov	v0.16b, v5.16b
+	mov	v5.16b, v10.16b
+	mov	v10.16b, v15.16b
+	sub	x2, x2, #16
+	b	.Lopen_tail_64_store
+
+.Lopen_tail_16:
+    // Here we handle the last [0,16) bytes that require a padded block
+	cbz	x2, .Lopen_finalize
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the ciphertext
+	eor	v21.16b, v21.16b, v21.16b // Use T1 to generate an AND mask
+	not	v22.16b, v20.16b
+
+	add	x7, x1, x2
+	mov	x6, x2
+
+.Lopen_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x7, #-1]!
+	mov	v20.b[0], w11
+	ext	v21.16b, v22.16b, v21.16b, #15
+	subs	x2, x2, #1
+	b.gt	.Lopen_tail_16_compose
+
+	and	v20.16b, v20.16b, v21.16b
+    // Hash in the final padded block
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	eor	v20.16b, v20.16b, v0.16b
+
+.Lopen_tail_16_store:
+	umov	w11, v20.b[0]
+	strb	w11, [x0], #1
+	ext	v20.16b, v20.16b, v20.16b, #1
+	subs	x6, x6, #1
+	b.gt	.Lopen_tail_16_store
+
+.Lopen_finalize:
+	mov	x11, v31.d[0]
+	mov	x12, v31.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+    # Final reduction step
+	sub	x12, xzr, x15
+	orr	x13, xzr, #3
+	subs	x11, x8, #-5
+	sbcs	x12, x9, x12
+	sbcs	x13, x10, x13
+	csel	x8, x11, x8, cs
+	csel	x9, x12, x9, cs
+	csel	x10, x13, x10, cs
+	mov	x11, v27.d[0]
+	mov	x12, v27.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+
+	stp	x8, x9, [x5]
+
+	ldp	d8, d9, [sp, #16]
+	ldp	d10, d11, [sp, #32]
+	ldp	d12, d13, [sp, #48]
+	ldp	d14, d15, [sp, #64]
+.cfi_restore	b15
+.cfi_restore	b14
+.cfi_restore	b13
+.cfi_restore	b12
+.cfi_restore	b11
+.cfi_restore	b10
+.cfi_restore	b9
+.cfi_restore	b8
+	ldp	x29, x30, [sp], 80
+.cfi_restore	w29
+.cfi_restore	w30
+.cfi_def_cfa_offset	0
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+.Lopen_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+	eor	v25.16b, v25.16b, v25.16b
+	mov	x11, #1
+	mov	v25.s[0], w11
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v17.16b, v30.16b
+	add	v15.4s, v17.4s, v25.4s
+	add	v16.4s, v15.4s, v25.4s
+
+	mov	x6, #10
+
+.Lopen_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x6, x6, #1
+	b.hi	.Lopen_128_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+
+	add	v30.4s, v30.4s, v25.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v30.4s, v30.4s, v25.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	and	v2.16b, v2.16b, v27.16b
+	mov	x16, v2.d[0] // Move the R key to GPRs
+	mov	x17, v2.d[1]
+	mov	v27.16b, v7.16b // Store the S key
+
+	bl	.Lpoly_hash_ad_internal
+
+.Lopen_128_store:
+	cmp	x2, #64
+	b.lt	.Lopen_128_store_64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v22.d[0]
+	mov	x12, v22.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v23.d[0]
+	mov	x12, v23.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+
+	mov	v0.16b, v1.16b
+	mov	v5.16b, v6.16b
+	mov	v10.16b, v11.16b
+	mov	v15.16b, v16.16b
+
+.Lopen_128_store_64:
+
+	lsr	x4, x2, #4
+	mov	x3, x1
+
+.Lopen_128_hash_64:
+	cbz	x4, .Lopen_tail_64_store
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #1
+	b	.Lopen_128_hash_64
+.cfi_endproc
+.size	chacha20_poly1305_open,.-chacha20_poly1305_open
+#endif
+#endif  // !OPENSSL_NO_ASM
+.section	.note.GNU-stack,"",%progbits
diff --git a/linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S b/linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S
new file mode 100644
index 0000000..2106b85
--- /dev/null
+++ b/linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S
@@ -0,0 +1,1765 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(__aarch64__)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include "openssl/arm_arch.h"
+
+.text
+.align	5
+.Lpoly:
+.quad	0xffffffffffffffff,0x00000000ffffffff,0x0000000000000000,0xffffffff00000001
+.LRR:	//	2^512 mod P precomputed for NIST P256 polynomial
+.quad	0x0000000000000003,0xfffffffbffffffff,0xfffffffffffffffe,0x00000004fffffffd
+.Lone_mont:
+.quad	0x0000000000000001,0xffffffff00000000,0xffffffffffffffff,0x00000000fffffffe
+.Lone:
+.quad	1,0,0,0
+.Lord:
+.quad	0xf3b9cac2fc632551,0xbce6faada7179e84,0xffffffffffffffff,0xffffffff00000000
+.LordK:
+.quad	0xccd1c8aaee00bc4f
+.byte	69,67,80,95,78,73,83,84,90,50,53,54,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
+.align	2
+
+// void	ecp_nistz256_to_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_to_mont
+.hidden	ecp_nistz256_to_mont
+.type	ecp_nistz256_to_mont,%function
+.align	6
+ecp_nistz256_to_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	x3,.LRR		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+	adr	x2,.LRR		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_to_mont,.-ecp_nistz256_to_mont
+
+// void	ecp_nistz256_from_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_from_mont
+.hidden	ecp_nistz256_from_mont
+.type	ecp_nistz256_from_mont,%function
+.align	4
+ecp_nistz256_from_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	mov	x3,#1			// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+	adr	x2,.Lone		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_from_mont,.-ecp_nistz256_from_mont
+
+// void	ecp_nistz256_mul_mont(BN_ULONG x0[4],const BN_ULONG x1[4],
+//					     const BN_ULONG x2[4]);
+.globl	ecp_nistz256_mul_mont
+.hidden	ecp_nistz256_mul_mont
+.type	ecp_nistz256_mul_mont,%function
+.align	4
+ecp_nistz256_mul_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	x3,[x2]		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_mul_mont,.-ecp_nistz256_mul_mont
+
+// void	ecp_nistz256_sqr_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_sqr_mont
+.hidden	ecp_nistz256_sqr_mont
+.type	ecp_nistz256_sqr_mont,%function
+.align	4
+ecp_nistz256_sqr_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+
+	bl	__ecp_nistz256_sqr_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_sqr_mont,.-ecp_nistz256_sqr_mont
+
+// void	ecp_nistz256_div_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_div_by_2
+.hidden	ecp_nistz256_div_by_2
+.type	ecp_nistz256_div_by_2,%function
+.align	4
+ecp_nistz256_div_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+
+	bl	__ecp_nistz256_div_by_2
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_div_by_2,.-ecp_nistz256_div_by_2
+
+// void	ecp_nistz256_mul_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_mul_by_2
+.hidden	ecp_nistz256_mul_by_2
+.type	ecp_nistz256_mul_by_2,%function
+.align	4
+ecp_nistz256_mul_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_mul_by_2,.-ecp_nistz256_mul_by_2
+
+// void	ecp_nistz256_mul_by_3(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_mul_by_3
+.hidden	ecp_nistz256_mul_by_3
+.type	ecp_nistz256_mul_by_3,%function
+.align	4
+ecp_nistz256_mul_by_3:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	mov	x4,x14
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	mov	x8,x4
+	mov	x9,x5
+	mov	x10,x6
+	mov	x11,x7
+
+	bl	__ecp_nistz256_add_to	// ret += a	// 2*a+a=3*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_mul_by_3,.-ecp_nistz256_mul_by_3
+
+// void	ecp_nistz256_sub(BN_ULONG x0[4],const BN_ULONG x1[4],
+//				        const BN_ULONG x2[4]);
+.globl	ecp_nistz256_sub
+.hidden	ecp_nistz256_sub
+.type	ecp_nistz256_sub,%function
+.align	4
+ecp_nistz256_sub:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_sub,.-ecp_nistz256_sub
+
+// void	ecp_nistz256_neg(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_neg
+.hidden	ecp_nistz256_neg
+.type	ecp_nistz256_neg,%function
+.align	4
+ecp_nistz256_neg:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	mov	x2,x1
+	mov	x14,xzr		// a = 0
+	mov	x15,xzr
+	mov	x16,xzr
+	mov	x17,xzr
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_neg,.-ecp_nistz256_neg
+
+// note that __ecp_nistz256_mul_mont expects a[0-3] input pre-loaded
+// to x4-x7 and b[0] - to x3
+.type	__ecp_nistz256_mul_mont,%function
+.align	4
+__ecp_nistz256_mul_mont:
+	mul	x14,x4,x3		// a[0]*b[0]
+	umulh	x8,x4,x3
+
+	mul	x15,x5,x3		// a[1]*b[0]
+	umulh	x9,x5,x3
+
+	mul	x16,x6,x3		// a[2]*b[0]
+	umulh	x10,x6,x3
+
+	mul	x17,x7,x3		// a[3]*b[0]
+	umulh	x11,x7,x3
+	ldr	x3,[x2,#8]		// b[1]
+
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adc	x19,xzr,x11
+	mov	x20,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	ldr	x3,[x2,#8*(1+1)]	// b[1+1]
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	ldr	x3,[x2,#8*(2+1)]	// b[2+1]
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	// last reduction
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	adcs	x17,x19,x11
+	adc	x19,x20,xzr
+
+	adds	x8,x14,#1		// subs	x8,x14,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x19,xzr		// did it borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+.size	__ecp_nistz256_mul_mont,.-__ecp_nistz256_mul_mont
+
+// note that __ecp_nistz256_sqr_mont expects a[0-3] input pre-loaded
+// to x4-x7
+.type	__ecp_nistz256_sqr_mont,%function
+.align	4
+__ecp_nistz256_sqr_mont:
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is , i.e. follow 
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	x15,x5,x4		// a[1]*a[0]
+	umulh	x9,x5,x4
+	mul	x16,x6,x4		// a[2]*a[0]
+	umulh	x10,x6,x4
+	mul	x17,x7,x4		// a[3]*a[0]
+	umulh	x19,x7,x4
+
+	adds	x16,x16,x9		// accumulate high parts of multiplication
+	mul	x8,x6,x5		// a[2]*a[1]
+	umulh	x9,x6,x5
+	adcs	x17,x17,x10
+	mul	x10,x7,x5		// a[3]*a[1]
+	umulh	x11,x7,x5
+	adc	x19,x19,xzr		// can't overflow
+
+	mul	x20,x7,x6		// a[3]*a[2]
+	umulh	x1,x7,x6
+
+	adds	x9,x9,x10		// accumulate high parts of multiplication
+	mul	x14,x4,x4		// a[0]*a[0]
+	adc	x10,x11,xzr		// can't overflow
+
+	adds	x17,x17,x8		// accumulate low parts of multiplication
+	umulh	x4,x4,x4
+	adcs	x19,x19,x9
+	mul	x9,x5,x5		// a[1]*a[1]
+	adcs	x20,x20,x10
+	umulh	x5,x5,x5
+	adc	x1,x1,xzr		// can't overflow
+
+	adds	x15,x15,x15	// acc[1-6]*=2
+	mul	x10,x6,x6		// a[2]*a[2]
+	adcs	x16,x16,x16
+	umulh	x6,x6,x6
+	adcs	x17,x17,x17
+	mul	x11,x7,x7		// a[3]*a[3]
+	adcs	x19,x19,x19
+	umulh	x7,x7,x7
+	adcs	x20,x20,x20
+	adcs	x1,x1,x1
+	adc	x2,xzr,xzr
+
+	adds	x15,x15,x4		// +a[i]*a[i]
+	adcs	x16,x16,x9
+	adcs	x17,x17,x5
+	adcs	x19,x19,x10
+	adcs	x20,x20,x6
+	lsl	x8,x14,#32
+	adcs	x1,x1,x11
+	lsr	x9,x14,#32
+	adc	x2,x2,x7
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	adc	x17,x11,xzr		// can't overflow
+
+	adds	x14,x14,x19	// accumulate upper half
+	adcs	x15,x15,x20
+	adcs	x16,x16,x1
+	adcs	x17,x17,x2
+	adc	x19,xzr,xzr
+
+	adds	x8,x14,#1		// subs	x8,x14,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x19,xzr		// did it borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+.size	__ecp_nistz256_sqr_mont,.-__ecp_nistz256_sqr_mont
+
+// Note that __ecp_nistz256_add_to expects both input vectors pre-loaded to
+// x4-x7 and x8-x11. This is done because it's used in multiple
+// contexts, e.g. in multiplication by 2 and 3...
+.type	__ecp_nistz256_add_to,%function
+.align	4
+__ecp_nistz256_add_to:
+	adds	x14,x14,x8		// ret = a+b
+	adcs	x15,x15,x9
+	adcs	x16,x16,x10
+	adcs	x17,x17,x11
+	adc	x1,xzr,xzr		// zap x1
+
+	adds	x8,x14,#1		// subs	x8,x4,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x1,xzr		// did subtraction borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+.size	__ecp_nistz256_add_to,.-__ecp_nistz256_add_to
+
+.type	__ecp_nistz256_sub_from,%function
+.align	4
+__ecp_nistz256_sub_from:
+	ldp	x8,x9,[x2]
+	ldp	x10,x11,[x2,#16]
+	subs	x14,x14,x8		// ret = a-b
+	sbcs	x15,x15,x9
+	sbcs	x16,x16,x10
+	sbcs	x17,x17,x11
+	sbc	x1,xzr,xzr		// zap x1
+
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = ret+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adc	x11,x17,x13
+	cmp	x1,xzr			// did subtraction borrow?
+
+	csel	x14,x14,x8,eq	// ret = borrow ? ret+modulus : ret
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,eq
+	stp	x16,x17,[x0,#16]
+
+	ret
+.size	__ecp_nistz256_sub_from,.-__ecp_nistz256_sub_from
+
+.type	__ecp_nistz256_sub_morf,%function
+.align	4
+__ecp_nistz256_sub_morf:
+	ldp	x8,x9,[x2]
+	ldp	x10,x11,[x2,#16]
+	subs	x14,x8,x14		// ret = b-a
+	sbcs	x15,x9,x15
+	sbcs	x16,x10,x16
+	sbcs	x17,x11,x17
+	sbc	x1,xzr,xzr		// zap x1
+
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = ret+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adc	x11,x17,x13
+	cmp	x1,xzr			// did subtraction borrow?
+
+	csel	x14,x14,x8,eq	// ret = borrow ? ret+modulus : ret
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,eq
+	stp	x16,x17,[x0,#16]
+
+	ret
+.size	__ecp_nistz256_sub_morf,.-__ecp_nistz256_sub_morf
+
+.type	__ecp_nistz256_div_by_2,%function
+.align	4
+__ecp_nistz256_div_by_2:
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = a+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adcs	x11,x17,x13
+	adc	x1,xzr,xzr		// zap x1
+	tst	x14,#1		// is a even?
+
+	csel	x14,x14,x8,eq	// ret = even ? a : a+modulus
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	csel	x17,x17,x11,eq
+	csel	x1,xzr,x1,eq
+
+	lsr	x14,x14,#1		// ret >>= 1
+	orr	x14,x14,x15,lsl#63
+	lsr	x15,x15,#1
+	orr	x15,x15,x16,lsl#63
+	lsr	x16,x16,#1
+	orr	x16,x16,x17,lsl#63
+	lsr	x17,x17,#1
+	stp	x14,x15,[x0]
+	orr	x17,x17,x1,lsl#63
+	stp	x16,x17,[x0,#16]
+
+	ret
+.size	__ecp_nistz256_div_by_2,.-__ecp_nistz256_div_by_2
+.globl	ecp_nistz256_point_double
+.hidden	ecp_nistz256_point_double
+.type	ecp_nistz256_point_double,%function
+.align	5
+ecp_nistz256_point_double:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	sub	sp,sp,#32*4
+
+.Ldouble_shortcut:
+	ldp	x14,x15,[x1,#32]
+	mov	x21,x0
+	ldp	x16,x17,[x1,#48]
+	mov	x22,x1
+	ldr	x12,.Lpoly+8
+	mov	x8,x14
+	ldr	x13,.Lpoly+24
+	mov	x9,x15
+	ldp	x4,x5,[x22,#64]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[x22,#64+16]
+	add	x0,sp,#0
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(S, in_y);
+
+	add	x0,sp,#64
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Zsqr, in_z);
+
+	ldp	x8,x9,[x22]
+	ldp	x10,x11,[x22,#16]
+	mov	x4,x14		// put Zsqr aside for p256_sub
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x0,sp,#32
+	bl	__ecp_nistz256_add_to	// p256_add(M, Zsqr, in_x);
+
+	add	x2,x22,#0
+	mov	x14,x4		// restore Zsqr
+	mov	x15,x5
+	ldp	x4,x5,[sp,#0]	// forward load for p256_sqr_mont
+	mov	x16,x6
+	mov	x17,x7
+	ldp	x6,x7,[sp,#0+16]
+	add	x0,sp,#64
+	bl	__ecp_nistz256_sub_morf	// p256_sub(Zsqr, in_x, Zsqr);
+
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(S, S);
+
+	ldr	x3,[x22,#32]
+	ldp	x4,x5,[x22,#64]
+	ldp	x6,x7,[x22,#64+16]
+	add	x2,x22,#32
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(tmp0, in_z, in_y);
+
+	mov	x8,x14
+	mov	x9,x15
+	ldp	x4,x5,[sp,#0]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[sp,#0+16]
+	add	x0,x21,#64
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(res_z, tmp0);
+
+	add	x0,sp,#96
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(tmp0, S);
+
+	ldr	x3,[sp,#64]		// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x0,x21,#32
+	bl	__ecp_nistz256_div_by_2	// p256_div_by_2(res_y, tmp0);
+
+	add	x2,sp,#64
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(M, M, Zsqr);
+
+	mov	x8,x14		// duplicate M
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	mov	x4,x14		// put M aside
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x0,sp,#32
+	bl	__ecp_nistz256_add_to
+	mov	x8,x4			// restore M
+	mov	x9,x5
+	ldr	x3,[x22]		// forward load for p256_mul_mont
+	mov	x10,x6
+	ldp	x4,x5,[sp,#0]
+	mov	x11,x7
+	ldp	x6,x7,[sp,#0+16]
+	bl	__ecp_nistz256_add_to	// p256_mul_by_3(M, M);
+
+	add	x2,x22,#0
+	add	x0,sp,#0
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, in_x);
+
+	mov	x8,x14
+	mov	x9,x15
+	ldp	x4,x5,[sp,#32]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[sp,#32+16]
+	add	x0,sp,#96
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(tmp0, S);
+
+	add	x0,x21,#0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(res_x, M);
+
+	add	x2,sp,#96
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_x, res_x, tmp0);
+
+	add	x2,sp,#0
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(S, S, res_x);
+
+	ldr	x3,[sp,#32]
+	mov	x4,x14		// copy S
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x2,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, M);
+
+	add	x2,x21,#32
+	add	x0,x21,#32
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, S, res_y);
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_point_double,.-ecp_nistz256_point_double
+.globl	ecp_nistz256_point_add
+.hidden	ecp_nistz256_point_add
+.type	ecp_nistz256_point_add,%function
+.align	5
+ecp_nistz256_point_add:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	stp	x27,x28,[sp,#80]
+	sub	sp,sp,#32*12
+
+	ldp	x4,x5,[x2,#64]	// in2_z
+	ldp	x6,x7,[x2,#64+16]
+	mov	x21,x0
+	mov	x22,x1
+	mov	x23,x2
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x25,x8,x10
+	cmp	x25,#0
+	csetm	x25,ne		// ~in2infty
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z2sqr, in2_z);
+
+	ldp	x4,x5,[x22,#64]	// in1_z
+	ldp	x6,x7,[x22,#64+16]
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x24,x8,x10
+	cmp	x24,#0
+	csetm	x24,ne		// ~in1infty
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	ldr	x3,[x23,#64]
+	ldp	x4,x5,[sp,#192]
+	ldp	x6,x7,[sp,#192+16]
+	add	x2,x23,#64
+	add	x0,sp,#320
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, Z2sqr, in2_z);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,x22,#64
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	x3,[x22,#32]
+	ldp	x4,x5,[sp,#320]
+	ldp	x6,x7,[sp,#320+16]
+	add	x2,x22,#32
+	add	x0,sp,#320
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, S1, in1_y);
+
+	ldr	x3,[x23,#32]
+	ldp	x4,x5,[sp,#352]
+	ldp	x6,x7,[sp,#352+16]
+	add	x2,x23,#32
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	x2,sp,#320
+	ldr	x3,[sp,#192]	// forward load for p256_mul_mont
+	ldp	x4,x5,[x22]
+	ldp	x6,x7,[x22,#16]
+	add	x0,sp,#160
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, S1);
+
+	orr	x14,x14,x15	// see if result is zero
+	orr	x16,x16,x17
+	orr	x26,x14,x16	// ~is_equal(S1,S2)
+
+	add	x2,sp,#192
+	add	x0,sp,#256
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U1, in1_x, Z2sqr);
+
+	ldr	x3,[sp,#128]
+	ldp	x4,x5,[x23]
+	ldp	x6,x7,[x23,#16]
+	add	x2,sp,#128
+	add	x0,sp,#288
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in2_x, Z1sqr);
+
+	add	x2,sp,#256
+	ldp	x4,x5,[sp,#160]	// forward load for p256_sqr_mont
+	ldp	x6,x7,[sp,#160+16]
+	add	x0,sp,#96
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, U1);
+
+	orr	x14,x14,x15	// see if result is zero
+	orr	x16,x16,x17
+	orr	x14,x14,x16	// ~is_equal(U1,U2)
+
+	mvn	x27,x24	// -1/0 -> 0/-1
+	mvn	x28,x25	// -1/0 -> 0/-1
+	orr	x14,x14,x27
+	orr	x14,x14,x28
+	orr	x14,x14,x26
+	cbnz	x14,.Ladd_proceed	// if(~is_equal(U1,U2) | in1infty | in2infty | ~is_equal(S1,S2))
+
+.Ladd_double:
+	mov	x1,x22
+	mov	x0,x21
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	add	sp,sp,#256	// #256 is from #32*(12-4). difference in stack frames
+	b	.Ldouble_shortcut
+
+.align	4
+.Ladd_proceed:
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#96]
+	ldp	x6,x7,[sp,#96+16]
+	add	x2,x22,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldp	x4,x5,[sp,#96]
+	ldp	x6,x7,[sp,#96+16]
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldr	x3,[x23,#64]
+	ldp	x4,x5,[sp,#64]
+	ldp	x6,x7,[sp,#64+16]
+	add	x2,x23,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, res_z, in2_z);
+
+	ldr	x3,[sp,#96]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,sp,#96
+	add	x0,sp,#224
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	x3,[sp,#128]
+	ldp	x4,x5,[sp,#256]
+	ldp	x6,x7,[sp,#256+16]
+	add	x2,sp,#128
+	add	x0,sp,#288
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, U1, Hsqr);
+
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	add	x0,sp,#128
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	x2,sp,#192
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	x2,sp,#224
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	x2,sp,#288
+	ldr	x3,[sp,#224]		// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#320]
+	ldp	x6,x7,[sp,#320+16]
+	add	x0,sp,#32
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	x2,sp,#224
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S1, Hcub);
+
+	ldr	x3,[sp,#160]
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x2,sp,#160
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	x2,sp,#352
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	x4,x5,[sp,#0]		// res
+	ldp	x6,x7,[sp,#0+16]
+	ldp	x8,x9,[x23]		// in2
+	ldp	x10,x11,[x23,#16]
+	ldp	x14,x15,[x22,#0]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#0+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+0+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+0+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#0+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#0+48]
+	stp	x14,x15,[x21,#0]
+	stp	x16,x17,[x21,#0+16]
+	ldp	x14,x15,[x22,#32]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#32+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+32+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+32+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#32+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#32+48]
+	stp	x14,x15,[x21,#32]
+	stp	x16,x17,[x21,#32+16]
+	ldp	x14,x15,[x22,#64]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#64+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	stp	x14,x15,[x21,#64]
+	stp	x16,x17,[x21,#64+16]
+
+.Ladd_done:
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_point_add,.-ecp_nistz256_point_add
+.globl	ecp_nistz256_point_add_affine
+.hidden	ecp_nistz256_point_add_affine
+.type	ecp_nistz256_point_add_affine,%function
+.align	5
+ecp_nistz256_point_add_affine:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-80]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	sub	sp,sp,#32*10
+
+	mov	x21,x0
+	mov	x22,x1
+	mov	x23,x2
+	ldr	x12,.Lpoly+8
+	ldr	x13,.Lpoly+24
+
+	ldp	x4,x5,[x1,#64]	// in1_z
+	ldp	x6,x7,[x1,#64+16]
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x24,x8,x10
+	cmp	x24,#0
+	csetm	x24,ne		// ~in1infty
+
+	ldp	x14,x15,[x2]	// in2_x
+	ldp	x16,x17,[x2,#16]
+	ldp	x8,x9,[x2,#32]	// in2_y
+	ldp	x10,x11,[x2,#48]
+	orr	x14,x14,x15
+	orr	x16,x16,x17
+	orr	x8,x8,x9
+	orr	x10,x10,x11
+	orr	x14,x14,x16
+	orr	x8,x8,x10
+	orr	x25,x14,x8
+	cmp	x25,#0
+	csetm	x25,ne		// ~in2infty
+
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	mov	x4,x14
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	ldr	x3,[x23]
+	add	x2,x23,#0
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, Z1sqr, in2_x);
+
+	add	x2,x22,#0
+	ldr	x3,[x22,#64]	// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x0,sp,#160
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, in1_x);
+
+	add	x2,x22,#64
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#160]
+	ldp	x6,x7,[sp,#160+16]
+	add	x2,x22,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldr	x3,[x23,#32]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,x23,#32
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	x2,x22,#32
+	ldp	x4,x5,[sp,#160]	// forward load for p256_sqr_mont
+	ldp	x6,x7,[sp,#160+16]
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, in1_y);
+
+	add	x0,sp,#224
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldp	x4,x5,[sp,#192]
+	ldp	x6,x7,[sp,#192+16]
+	add	x0,sp,#288
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	x3,[sp,#160]
+	ldp	x4,x5,[sp,#224]
+	ldp	x6,x7,[sp,#224+16]
+	add	x2,sp,#160
+	add	x0,sp,#256
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	x3,[x22]
+	ldp	x4,x5,[sp,#224]
+	ldp	x6,x7,[sp,#224+16]
+	add	x2,x22,#0
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in1_x, Hsqr);
+
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	add	x0,sp,#224
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	x2,sp,#288
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	x2,sp,#256
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	x2,sp,#96
+	ldr	x3,[x22,#32]	// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#256]
+	ldp	x6,x7,[sp,#256+16]
+	add	x0,sp,#32
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	x2,x22,#32
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, in1_y, Hcub);
+
+	ldr	x3,[sp,#192]
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x2,sp,#192
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	x2,sp,#128
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	x4,x5,[sp,#0]		// res
+	ldp	x6,x7,[sp,#0+16]
+	ldp	x8,x9,[x23]		// in2
+	ldp	x10,x11,[x23,#16]
+	ldp	x14,x15,[x22,#0]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#0+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+0+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+0+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#0+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#0+48]
+	stp	x14,x15,[x21,#0]
+	stp	x16,x17,[x21,#0+16]
+	adr	x23,.Lone_mont-64
+	ldp	x14,x15,[x22,#32]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#32+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+32+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+32+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#32+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#32+48]
+	stp	x14,x15,[x21,#32]
+	stp	x16,x17,[x21,#32+16]
+	ldp	x14,x15,[x22,#64]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#64+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	stp	x14,x15,[x21,#64]
+	stp	x16,x17,[x21,#64+16]
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x29,x30,[sp],#80
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_point_add_affine,.-ecp_nistz256_point_add_affine
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_mul_mont(uint64_t res[4], uint64_t a[4],
+//                                uint64_t b[4]);
+.globl	ecp_nistz256_ord_mul_mont
+.hidden	ecp_nistz256_ord_mul_mont
+.type	ecp_nistz256_ord_mul_mont,%function
+.align	4
+ecp_nistz256_ord_mul_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	x23,.Lord
+	ldr	x3,[x2]		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+
+	ldp	x12,x13,[x23,#0]
+	ldp	x21,x22,[x23,#16]
+	ldr	x23,[x23,#32]
+
+	mul	x14,x4,x3		// a[0]*b[0]
+	umulh	x8,x4,x3
+
+	mul	x15,x5,x3		// a[1]*b[0]
+	umulh	x9,x5,x3
+
+	mul	x16,x6,x3		// a[2]*b[0]
+	umulh	x10,x6,x3
+
+	mul	x17,x7,x3		// a[3]*b[0]
+	umulh	x19,x7,x3
+
+	mul	x24,x14,x23
+
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adc	x19,x19,xzr
+	mov	x20,xzr
+	ldr	x3,[x2,#8*1]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	ldr	x3,[x2,#8*2]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	ldr	x3,[x2,#8*3]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	lsl	x8,x24,#32		// last reduction
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	subs	x8,x14,x12		// ret -= modulus
+	sbcs	x9,x15,x13
+	sbcs	x10,x16,x21
+	sbcs	x11,x17,x22
+	sbcs	xzr,x19,xzr
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+.size	ecp_nistz256_ord_mul_mont,.-ecp_nistz256_ord_mul_mont
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_sqr_mont(uint64_t res[4], uint64_t a[4],
+//                                int rep);
+.globl	ecp_nistz256_ord_sqr_mont
+.hidden	ecp_nistz256_ord_sqr_mont
+.type	ecp_nistz256_ord_sqr_mont,%function
+.align	4
+ecp_nistz256_ord_sqr_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	x23,.Lord
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+
+	ldp	x12,x13,[x23,#0]
+	ldp	x21,x22,[x23,#16]
+	ldr	x23,[x23,#32]
+	b	.Loop_ord_sqr
+
+.align	4
+.Loop_ord_sqr:
+	sub	x2,x2,#1
+	////////////////////////////////////////////////////////////////
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is , i.e. follow 
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	x15,x5,x4		// a[1]*a[0]
+	umulh	x9,x5,x4
+	mul	x16,x6,x4		// a[2]*a[0]
+	umulh	x10,x6,x4
+	mul	x17,x7,x4		// a[3]*a[0]
+	umulh	x19,x7,x4
+
+	adds	x16,x16,x9		// accumulate high parts of multiplication
+	mul	x8,x6,x5		// a[2]*a[1]
+	umulh	x9,x6,x5
+	adcs	x17,x17,x10
+	mul	x10,x7,x5		// a[3]*a[1]
+	umulh	x11,x7,x5
+	adc	x19,x19,xzr		// can't overflow
+
+	mul	x20,x7,x6		// a[3]*a[2]
+	umulh	x1,x7,x6
+
+	adds	x9,x9,x10		// accumulate high parts of multiplication
+	mul	x14,x4,x4		// a[0]*a[0]
+	adc	x10,x11,xzr		// can't overflow
+
+	adds	x17,x17,x8		// accumulate low parts of multiplication
+	umulh	x4,x4,x4
+	adcs	x19,x19,x9
+	mul	x9,x5,x5		// a[1]*a[1]
+	adcs	x20,x20,x10
+	umulh	x5,x5,x5
+	adc	x1,x1,xzr		// can't overflow
+
+	adds	x15,x15,x15	// acc[1-6]*=2
+	mul	x10,x6,x6		// a[2]*a[2]
+	adcs	x16,x16,x16
+	umulh	x6,x6,x6
+	adcs	x17,x17,x17
+	mul	x11,x7,x7		// a[3]*a[3]
+	adcs	x19,x19,x19
+	umulh	x7,x7,x7
+	adcs	x20,x20,x20
+	adcs	x1,x1,x1
+	adc	x3,xzr,xzr
+
+	adds	x15,x15,x4		// +a[i]*a[i]
+	mul	x24,x14,x23
+	adcs	x16,x16,x9
+	adcs	x17,x17,x5
+	adcs	x19,x19,x10
+	adcs	x20,x20,x6
+	adcs	x1,x1,x11
+	adc	x3,x3,x7
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adc	x17,xzr,x24		// can't overflow
+	mul	x11,x14,x23
+	lsl	x8,x24,#32
+	subs	x15,x15,x24
+	lsr	x9,x24,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x11
+	mul	x10,x13,x11
+	umulh	x24,x13,x11
+
+	adcs	x10,x10,x9
+	adc	x24,x24,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x24
+	adcs	x16,x17,x11
+	adc	x17,xzr,x11		// can't overflow
+	mul	x24,x14,x23
+	lsl	x8,x11,#32
+	subs	x15,x15,x11
+	lsr	x9,x11,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adc	x17,xzr,x24		// can't overflow
+	mul	x11,x14,x23
+	lsl	x8,x24,#32
+	subs	x15,x15,x24
+	lsr	x9,x24,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x11
+	mul	x10,x13,x11
+	umulh	x24,x13,x11
+
+	adcs	x10,x10,x9
+	adc	x24,x24,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x24
+	adcs	x16,x17,x11
+	adc	x17,xzr,x11		// can't overflow
+	lsl	x8,x11,#32
+	subs	x15,x15,x11
+	lsr	x9,x11,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	adds	x14,x14,x19	// accumulate upper half
+	adcs	x15,x15,x20
+	adcs	x16,x16,x1
+	adcs	x17,x17,x3
+	adc	x19,xzr,xzr
+
+	subs	x8,x14,x12		// ret -= modulus
+	sbcs	x9,x15,x13
+	sbcs	x10,x16,x21
+	sbcs	x11,x17,x22
+	sbcs	xzr,x19,xzr
+
+	csel	x4,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x5,x15,x9,lo
+	csel	x6,x16,x10,lo
+	csel	x7,x17,x11,lo
+
+	cbnz	x2,.Loop_ord_sqr
+
+	stp	x4,x5,[x0]
+	stp	x6,x7,[x0,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+.size	ecp_nistz256_ord_sqr_mont,.-ecp_nistz256_ord_sqr_mont
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w5(uint64_t *val, uint64_t *in_t, int index);
+.globl	ecp_nistz256_select_w5
+.hidden	ecp_nistz256_select_w5
+.type	ecp_nistz256_select_w5,%function
+.align	4
+ecp_nistz256_select_w5:
+	AARCH64_VALID_CALL_TARGET
+
+    // x10 := x0
+    // w9 := 0; loop counter and incremented internal index
+	mov	x10, x0
+	mov	w9, #0
+
+    // [v16-v21] := 0
+	movi	v16.16b, #0
+	movi	v17.16b, #0
+	movi	v18.16b, #0
+	movi	v19.16b, #0
+	movi	v20.16b, #0
+	movi	v21.16b, #0
+
+.Lselect_w5_loop:
+    // Loop 16 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+	add	w9, w9, #1
+
+    // [v22-v27] := Load a (3*256-bit = 6*128-bit) table entry starting at x1
+    //  and advance x1 to point to the next entry
+	ld1	{v22.2d, v23.2d, v24.2d, v25.2d}, [x1],#64
+
+    // x11 := (w9 == w2)? All 1s : All 0s
+	cmp	w9, w2
+	csetm	x11, eq
+
+    // continue loading ...
+	ld1	{v26.2d, v27.2d}, [x1],#32
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+	dup	v3.2d, x11
+
+    // [v16-v19] := (Mask == all 1s)? [v22-v25] : [v16-v19]
+    // i.e., values in output registers will remain the same if w9 != w2
+	bit	v16.16b, v22.16b, v3.16b
+	bit	v17.16b, v23.16b, v3.16b
+
+	bit	v18.16b, v24.16b, v3.16b
+	bit	v19.16b, v25.16b, v3.16b
+
+	bit	v20.16b, v26.16b, v3.16b
+	bit	v21.16b, v27.16b, v3.16b
+
+    // If bit #4 is not 0 (i.e. idx_ctr < 16) loop back
+	tbz	w9, #4, .Lselect_w5_loop
+
+    // Write [v16-v21] to memory at the output pointer
+	st1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x10],#64
+	st1	{v20.2d, v21.2d}, [x10]
+
+	ret
+.size	ecp_nistz256_select_w5,.-ecp_nistz256_select_w5
+
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w7(uint64_t *val, uint64_t *in_t, int index);
+.globl	ecp_nistz256_select_w7
+.hidden	ecp_nistz256_select_w7
+.type	ecp_nistz256_select_w7,%function
+.align	4
+ecp_nistz256_select_w7:
+	AARCH64_VALID_CALL_TARGET
+
+    // w9 := 0; loop counter and incremented internal index
+	mov	w9, #0
+
+    // [v16-v21] := 0
+	movi	v16.16b, #0
+	movi	v17.16b, #0
+	movi	v18.16b, #0
+	movi	v19.16b, #0
+
+.Lselect_w7_loop:
+    // Loop 64 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+	add	w9, w9, #1
+
+    // [v22-v25] := Load a (2*256-bit = 4*128-bit) table entry starting at x1
+    //  and advance x1 to point to the next entry
+	ld1	{v22.2d, v23.2d, v24.2d, v25.2d}, [x1],#64
+
+    // x11 := (w9 == w2)? All 1s : All 0s
+	cmp	w9, w2
+	csetm	x11, eq
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+	dup	v3.2d, x11
+
+    // [v16-v19] := (Mask == all 1s)? [v22-v25] : [v16-v19]
+    // i.e., values in output registers will remain the same if w9 != w2
+	bit	v16.16b, v22.16b, v3.16b
+	bit	v17.16b, v23.16b, v3.16b
+
+	bit	v18.16b, v24.16b, v3.16b
+	bit	v19.16b, v25.16b, v3.16b
+
+    // If bit #6 is not 0 (i.e. idx_ctr < 64) loop back
+	tbz	w9, #6, .Lselect_w7_loop
+
+    // Write [v16-v19] to memory at the output pointer
+	st1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x0]
+
+	ret
+.size	ecp_nistz256_select_w7,.-ecp_nistz256_select_w7
+#endif
+#endif  // !OPENSSL_NO_ASM
+.section	.note.GNU-stack,"",%progbits
diff --git a/linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S b/linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
new file mode 100644
index 0000000..9243b8b
--- /dev/null
+++ b/linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
@@ -0,0 +1,320 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(__aarch64__)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include "openssl/arm_arch.h"
+
+.text
+.globl	beeu_mod_inverse_vartime
+.hidden	beeu_mod_inverse_vartime
+.type	beeu_mod_inverse_vartime, %function
+.align	4
+beeu_mod_inverse_vartime:
+    // Reserve enough space for 14 8-byte registers on the stack
+    // in the first stp call for x29, x30.
+    // Then store the remaining callee-saved registers.
+    //
+    //    | x29 | x30 | x19 | x20 | ... | x27 | x28 |  x0 |  x2 |
+    //    ^                                                     ^
+    //    sp  <------------------- 112 bytes ----------------> old sp
+    //   x29 (FP)
+    //
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-112]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	stp	x27,x28,[sp,#80]
+	stp	x0,x2,[sp,#96]
+
+    // B = b3..b0 := a
+	ldp	x25,x26,[x1]
+	ldp	x27,x28,[x1,#16]
+
+    // n3..n0 := n
+    // Note: the value of input params are changed in the following.
+	ldp	x0,x1,[x2]
+	ldp	x2,x30,[x2,#16]
+
+    // A = a3..a0 := n
+	mov	x21, x0
+	mov	x22, x1
+	mov	x23, x2
+	mov	x24, x30
+
+    // X = x4..x0 := 1
+	mov	x3, #1
+	eor	x4, x4, x4
+	eor	x5, x5, x5
+	eor	x6, x6, x6
+	eor	x7, x7, x7
+
+    // Y = y4..y0 := 0
+	eor	x8, x8, x8
+	eor	x9, x9, x9
+	eor	x10, x10, x10
+	eor	x11, x11, x11
+	eor	x12, x12, x12
+
+.Lbeeu_loop:
+    // if B == 0, jump to .Lbeeu_loop_end
+	orr	x14, x25, x26
+	orr	x14, x14, x27
+
+    // reverse the bit order of x25. This is needed for clz after this macro
+	rbit	x15, x25
+
+	orr	x14, x14, x28
+	cbz	x14,.Lbeeu_loop_end
+
+
+    // 0 < B < |n|,
+    // 0 < A <= |n|,
+    // (1)      X*a  ==  B   (mod |n|),
+    // (2) (-1)*Y*a  ==  A   (mod |n|)
+
+    // Now divide B by the maximum possible power of two in the
+    // integers, and divide X by the same value mod |n|.
+    // When we're done, (1) still holds.
+
+    // shift := number of trailing 0s in x25
+    // (      = number of leading 0s in x15; see the "rbit" instruction in TEST_B_ZERO)
+	clz	x13, x15
+
+    // If there is no shift, goto shift_A_Y
+	cbz	x13, .Lbeeu_shift_A_Y
+
+    // Shift B right by "x13" bits
+	neg	x14, x13
+	lsr	x25, x25, x13
+	lsl	x15, x26, x14
+
+	lsr	x26, x26, x13
+	lsl	x19, x27, x14
+
+	orr	x25, x25, x15
+
+	lsr	x27, x27, x13
+	lsl	x20, x28, x14
+
+	orr	x26, x26, x19
+
+	lsr	x28, x28, x13
+
+	orr	x27, x27, x20
+
+
+    // Shift X right by "x13" bits, adding n whenever X becomes odd.
+    // x13--;
+    // x14 := 0; needed in the addition to the most significant word in SHIFT1
+	eor	x14, x14, x14
+.Lbeeu_shift_loop_X:
+	tbz	x3, #0, .Lshift1_0
+	adds	x3, x3, x0
+	adcs	x4, x4, x1
+	adcs	x5, x5, x2
+	adcs	x6, x6, x30
+	adc	x7, x7, x14
+.Lshift1_0:
+    // var0 := [var1|var0]<64..1>;
+    // i.e. concatenate var1 and var0,
+    //      extract bits <64..1> from the resulting 128-bit value
+    //      and put them in var0
+	extr	x3, x4, x3, #1
+	extr	x4, x5, x4, #1
+	extr	x5, x6, x5, #1
+	extr	x6, x7, x6, #1
+	lsr	x7, x7, #1
+
+	subs	x13, x13, #1
+	bne	.Lbeeu_shift_loop_X
+
+    // Note: the steps above perform the same sequence as in p256_beeu-x86_64-asm.pl
+    // with the following differences:
+    // - "x13" is set directly to the number of trailing 0s in B
+    //   (using rbit and clz instructions)
+    // - The loop is only used to call SHIFT1(X)
+    //   and x13 is decreased while executing the X loop.
+    // - SHIFT256(B, x13) is performed before right-shifting X; they are independent
+
+.Lbeeu_shift_A_Y:
+    // Same for A and Y.
+    // Afterwards, (2) still holds.
+    // Reverse the bit order of x21
+    // x13 := number of trailing 0s in x21 (= number of leading 0s in x15)
+	rbit	x15, x21
+	clz	x13, x15
+
+    // If there is no shift, goto |B-A|, X+Y update
+	cbz	x13, .Lbeeu_update_B_X_or_A_Y
+
+    // Shift A right by "x13" bits
+	neg	x14, x13
+	lsr	x21, x21, x13
+	lsl	x15, x22, x14
+
+	lsr	x22, x22, x13
+	lsl	x19, x23, x14
+
+	orr	x21, x21, x15
+
+	lsr	x23, x23, x13
+	lsl	x20, x24, x14
+
+	orr	x22, x22, x19
+
+	lsr	x24, x24, x13
+
+	orr	x23, x23, x20
+
+
+    // Shift Y right by "x13" bits, adding n whenever Y becomes odd.
+    // x13--;
+    // x14 := 0; needed in the addition to the most significant word in SHIFT1
+	eor	x14, x14, x14
+.Lbeeu_shift_loop_Y:
+	tbz	x8, #0, .Lshift1_1
+	adds	x8, x8, x0
+	adcs	x9, x9, x1
+	adcs	x10, x10, x2
+	adcs	x11, x11, x30
+	adc	x12, x12, x14
+.Lshift1_1:
+    // var0 := [var1|var0]<64..1>;
+    // i.e. concatenate var1 and var0,
+    //      extract bits <64..1> from the resulting 128-bit value
+    //      and put them in var0
+	extr	x8, x9, x8, #1
+	extr	x9, x10, x9, #1
+	extr	x10, x11, x10, #1
+	extr	x11, x12, x11, #1
+	lsr	x12, x12, #1
+
+	subs	x13, x13, #1
+	bne	.Lbeeu_shift_loop_Y
+
+.Lbeeu_update_B_X_or_A_Y:
+    // Try T := B - A; if cs, continue with B > A (cs: carry set = no borrow)
+    // Note: this is a case of unsigned arithmetic, where T fits in 4 64-bit words
+    //       without taking a sign bit if generated. The lack of a carry would
+    //       indicate a negative result. See, for example,
+    //       https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/condition-codes-1-condition-flags-and-codes
+	subs	x14, x25, x21
+	sbcs	x15, x26, x22
+	sbcs	x19, x27, x23
+	sbcs	x20, x28, x24
+	bcs	.Lbeeu_B_greater_than_A
+
+    // Else A > B =>
+    // A := A - B; Y := Y + X; goto beginning of the loop
+	subs	x21, x21, x25
+	sbcs	x22, x22, x26
+	sbcs	x23, x23, x27
+	sbcs	x24, x24, x28
+
+	adds	x8, x8, x3
+	adcs	x9, x9, x4
+	adcs	x10, x10, x5
+	adcs	x11, x11, x6
+	adc	x12, x12, x7
+	b	.Lbeeu_loop
+
+.Lbeeu_B_greater_than_A:
+    // Continue with B > A =>
+    // B := B - A; X := X + Y; goto beginning of the loop
+	mov	x25, x14
+	mov	x26, x15
+	mov	x27, x19
+	mov	x28, x20
+
+	adds	x3, x3, x8
+	adcs	x4, x4, x9
+	adcs	x5, x5, x10
+	adcs	x6, x6, x11
+	adc	x7, x7, x12
+	b	.Lbeeu_loop
+
+.Lbeeu_loop_end:
+    // The Euclid's algorithm loop ends when A == gcd(a,n);
+    // this would be 1, when a and n are co-prime (i.e. do not have a common factor).
+    // Since (-1)*Y*a == A (mod |n|), Y>0
+    // then out = -Y mod n
+
+    // Verify that A = 1 ==> (-1)*Y*a = A = 1  (mod |n|)
+    // Is A-1 == 0?
+    // If not, fail.
+	sub	x14, x21, #1
+	orr	x14, x14, x22
+	orr	x14, x14, x23
+	orr	x14, x14, x24
+	cbnz	x14, .Lbeeu_err
+
+    // If Y>n ==> Y:=Y-n
+.Lbeeu_reduction_loop:
+    // x_i := y_i - n_i (X is no longer needed, use it as temp)
+    // (x14 = 0 from above)
+	subs	x3, x8, x0
+	sbcs	x4, x9, x1
+	sbcs	x5, x10, x2
+	sbcs	x6, x11, x30
+	sbcs	x7, x12, x14
+
+    // If result is non-negative (i.e., cs = carry set = no borrow),
+    // y_i := x_i; goto reduce again
+    // else
+    // y_i := y_i; continue
+	csel	x8, x3, x8, cs
+	csel	x9, x4, x9, cs
+	csel	x10, x5, x10, cs
+	csel	x11, x6, x11, cs
+	csel	x12, x7, x12, cs
+	bcs	.Lbeeu_reduction_loop
+
+    // Now Y < n (Y cannot be equal to n, since the inverse cannot be 0)
+    // out = -Y = n-Y
+	subs	x8, x0, x8
+	sbcs	x9, x1, x9
+	sbcs	x10, x2, x10
+	sbcs	x11, x30, x11
+
+    // Save Y in output (out (x0) was saved on the stack)
+	ldr	x3, [sp,#96]
+	stp	x8, x9, [x3]
+	stp	x10, x11, [x3,#16]
+    // return 1 (success)
+	mov	x0, #1
+	b	.Lbeeu_finish
+
+.Lbeeu_err:
+    // return 0 (error)
+	eor	x0, x0, x0
+
+.Lbeeu_finish:
+    // Restore callee-saved registers, except x0, x2
+	add	sp,x29,#0
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldp	x25,x26,[sp,#64]
+	ldp	x27,x28,[sp,#80]
+	ldp	x29,x30,[sp],#112
+
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	beeu_mod_inverse_vartime,.-beeu_mod_inverse_vartime
+#endif
+#endif  // !OPENSSL_NO_ASM
+.section	.note.GNU-stack,"",%progbits
diff --git a/sources.bp b/sources.bp
index 7e1293f..42d0471 100644
--- a/sources.bp
+++ b/sources.bp
@@ -70,7 +70,6 @@
         "src/crypto/chacha/chacha.c",
         "src/crypto/cipher_extra/cipher_extra.c",
         "src/crypto/cipher_extra/derive_key.c",
-        "src/crypto/cipher_extra/e_aesccm.c",
         "src/crypto/cipher_extra/e_aesctrhmac.c",
         "src/crypto/cipher_extra/e_aesgcmsiv.c",
         "src/crypto/cipher_extra/e_chacha20poly1305.c",
@@ -80,7 +79,6 @@
         "src/crypto/cipher_extra/e_rc4.c",
         "src/crypto/cipher_extra/e_tls.c",
         "src/crypto/cipher_extra/tls_cbc.c",
-        "src/crypto/cmac/cmac.c",
         "src/crypto/conf/conf.c",
         "src/crypto/cpu_aarch64_apple.c",
         "src/crypto/cpu_aarch64_fuchsia.c",
@@ -253,6 +251,7 @@
         linux_arm64: {
             srcs: [
                 "linux-aarch64/crypto/chacha/chacha-armv8.S",
+                "linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S",
                 "linux-aarch64/crypto/test/trampoline-armv8.S",
             ],
         },
@@ -294,6 +293,8 @@
                 "linux-aarch64/crypto/fipsmodule/armv8-mont.S",
                 "linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S",
                 "linux-aarch64/crypto/fipsmodule/ghashv8-armx64.S",
+                "linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S",
+                "linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S",
                 "linux-aarch64/crypto/fipsmodule/sha1-armv8.S",
                 "linux-aarch64/crypto/fipsmodule/sha256-armv8.S",
                 "linux-aarch64/crypto/fipsmodule/sha512-armv8.S",
@@ -440,7 +441,6 @@
         "src/crypto/chacha/chacha_test.cc",
         "src/crypto/cipher_extra/aead_test.cc",
         "src/crypto/cipher_extra/cipher_test.cc",
-        "src/crypto/cmac/cmac_test.cc",
         "src/crypto/compiler_test.cc",
         "src/crypto/conf/conf_test.cc",
         "src/crypto/constant_time_test.cc",
@@ -460,13 +460,15 @@
         "src/crypto/evp/scrypt_test.cc",
         "src/crypto/fipsmodule/aes/aes_test.cc",
         "src/crypto/fipsmodule/bn/bn_test.cc",
+        "src/crypto/fipsmodule/cmac/cmac_test.cc",
         "src/crypto/fipsmodule/ec/ec_test.cc",
-        "src/crypto/fipsmodule/ec/p256-x86_64_test.cc",
+        "src/crypto/fipsmodule/ec/p256-nistz_test.cc",
         "src/crypto/fipsmodule/ecdsa/ecdsa_test.cc",
         "src/crypto/fipsmodule/md5/md5_test.cc",
         "src/crypto/fipsmodule/modes/gcm_test.cc",
         "src/crypto/fipsmodule/rand/ctrdrbg_test.cc",
         "src/crypto/fipsmodule/rand/fork_detect_test.cc",
+        "src/crypto/fipsmodule/service_indicator/service_indicator_test.cc",
         "src/crypto/fipsmodule/sha/sha_test.cc",
         "src/crypto/hkdf/hkdf_test.cc",
         "src/crypto/hmac_extra/hmac_test.cc",
diff --git a/sources.mk b/sources.mk
index 1f1d08f..0873a7d 100644
--- a/sources.mk
+++ b/sources.mk
@@ -68,7 +68,6 @@
   src/crypto/chacha/chacha.c\
   src/crypto/cipher_extra/cipher_extra.c\
   src/crypto/cipher_extra/derive_key.c\
-  src/crypto/cipher_extra/e_aesccm.c\
   src/crypto/cipher_extra/e_aesctrhmac.c\
   src/crypto/cipher_extra/e_aesgcmsiv.c\
   src/crypto/cipher_extra/e_chacha20poly1305.c\
@@ -78,7 +77,6 @@
   src/crypto/cipher_extra/e_rc4.c\
   src/crypto/cipher_extra/e_tls.c\
   src/crypto/cipher_extra/tls_cbc.c\
-  src/crypto/cmac/cmac.c\
   src/crypto/conf/conf.c\
   src/crypto/cpu_aarch64_apple.c\
   src/crypto/cpu_aarch64_fuchsia.c\
@@ -250,10 +248,13 @@
 
 linux_aarch64_sources := \
   linux-aarch64/crypto/chacha/chacha-armv8.S\
+  linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S\
   linux-aarch64/crypto/fipsmodule/aesv8-armx64.S\
   linux-aarch64/crypto/fipsmodule/armv8-mont.S\
   linux-aarch64/crypto/fipsmodule/ghash-neon-armv8.S\
   linux-aarch64/crypto/fipsmodule/ghashv8-armx64.S\
+  linux-aarch64/crypto/fipsmodule/p256-armv8-asm.S\
+  linux-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S\
   linux-aarch64/crypto/fipsmodule/sha1-armv8.S\
   linux-aarch64/crypto/fipsmodule/sha256-armv8.S\
   linux-aarch64/crypto/fipsmodule/sha512-armv8.S\
diff --git a/src/.gitignore b/src/.gitignore
index 1a27c89..ab8580c 100644
--- a/src/.gitignore
+++ b/src/.gitignore
@@ -15,7 +15,6 @@
 util/bot/cmake-linux64
 util/bot/cmake-mac
 util/bot/cmake-win32
-util/bot/cmake-win32.zip
 util/bot/golang
 util/bot/libFuzzer
 util/bot/libcxx
diff --git a/src/BUILDING.md b/src/BUILDING.md
index e9a2b0c..e7dfd6e 100644
--- a/src/BUILDING.md
+++ b/src/BUILDING.md
@@ -30,7 +30,8 @@
     by CMake, it may be configured explicitly by setting
     `CMAKE_ASM_NASM_COMPILER`.
 
-  * C and C++ compilers with C++11 support are required. On Windows, MSVC from
+  * C and C++ compilers with C++14 support are required. If using a C compiler
+    other than MSVC, C11 support is also requried. On Windows, MSVC from
     Visual Studio 2017 or later with Platform SDK 8.1 or later are supported,
     but newer versions are recommended. Recent versions of GCC (6.1+) and Clang
     should work on non-Windows platforms, and maybe on Windows too.
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 35ff4c1..aadcb9b 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -3,6 +3,12 @@
 # Defer enabling C and CXX languages.
 project(BoringSSL NONE)
 
+# Don't install BoringSSL to system directories by default; it has no stable
+# ABI. Instead, default to an "install" directory under the source.
+if(CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT)
+  set(CMAKE_INSTALL_PREFIX ${CMAKE_SOURCE_DIR}/install CACHE PATH "" FORCE)
+endif()
+
 if(WIN32)
   # On Windows, prefer cl over gcc if both are available. By default most of
   # the CMake generators prefer gcc, even on Windows.
@@ -14,6 +20,8 @@
 enable_language(C)
 enable_language(CXX)
 
+include(GNUInstallDirs)
+
 # This is a dummy target which all other targets depend on (manually - see other
 # CMakeLists.txt files). This gives us a hook to add any targets which need to
 # run before all other targets.
@@ -114,6 +122,13 @@
   set(EMSCRIPTEN 1)
 endif()
 
+set(CMAKE_CXX_STANDARD 14)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+if(MSVC AND NOT CLANG)
+  set(CMAKE_C_STANDARD 11)
+  set(CMAKE_C_STANDARD_REQUIRED ON)
+endif()
+
 if(CMAKE_COMPILER_IS_GNUCXX OR CLANG)
   # Note clang-cl is odd and sets both CLANG and MSVC. We base our configuration
   # primarily on our normal Clang one.
@@ -156,14 +171,8 @@
   set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${C_CXX_FLAGS} -Wmissing-prototypes -Wold-style-definition -Wstrict-prototypes")
   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${C_CXX_FLAGS} -Wmissing-declarations")
 
-  if(NOT MSVC)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
-    if(APPLE)
-      set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -stdlib=libc++")
-    endif()
-    if(NOT BORINGSSL_ALLOW_CXX_RUNTIME)
-      set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-exceptions -fno-rtti")
-    endif()
+  if(NOT MSVC AND NOT BORINGSSL_ALLOW_CXX_RUNTIME)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-exceptions -fno-rtti")
   endif()
 
   # In GCC, -Wmissing-declarations is the C++ spelling of -Wmissing-prototypes
@@ -253,10 +262,6 @@
   add_definitions("-D_STL_EXTRA_DISABLED_WARNINGS=4774 4987")
 endif()
 
-if(CMAKE_COMPILER_IS_GNUCXX)
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=c11")
-endif()
-
 # pthread_rwlock_t on Linux requires a feature flag. We limit this to Linux
 # because, on Apple platforms, it instead disables APIs we use. See compat(5)
 # and sys/cdefs.h. Reportedly, FreeBSD also breaks when this is set. See
@@ -541,6 +546,7 @@
   set_target_properties(libcxxabi PROPERTIES COMPILE_FLAGS "-Wno-missing-prototypes -Wno-implicit-fallthrough")
   # libc++abi depends on libc++ internal headers.
   set_property(TARGET libcxxabi APPEND PROPERTY INCLUDE_DIRECTORIES "${CMAKE_SOURCE_DIR}/util/bot/libcxx/src")
+  install(TARGETS libcxxabi EXPORT OpenSSLTargets)
 
   add_library(libcxx ${LIBCXX_SOURCES})
   if(ASAN OR MSAN OR TSAN)
@@ -556,6 +562,7 @@
     -DLIBCXX_BUILDING_LIBCXXABI
   )
   target_link_libraries(libcxx libcxxabi)
+  install(TARGETS libcxx EXPORT OpenSSLTargets DESTINATION ${CMAKE_INSTALL_LIBDIR})
 endif()
 
 # Add minimal googletest targets. The provided one has many side-effects, and
@@ -656,3 +663,12 @@
     WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
     DEPENDS all_tests bssl_shim handshaker fips_specific_tests_if_any
     USES_TERMINAL)
+
+install(DIRECTORY include/ DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+
+install(EXPORT OpenSSLTargets
+  FILE OpenSSLTargets.cmake
+  NAMESPACE OpenSSL::
+  DESTINATION lib/cmake/OpenSSL
+)
+install(FILES OpenSSLConfig.cmake DESTINATION lib/cmake/OpenSSL)
diff --git a/src/OpenSSLConfig.cmake b/src/OpenSSLConfig.cmake
new file mode 100644
index 0000000..3ebaf19
--- /dev/null
+++ b/src/OpenSSLConfig.cmake
@@ -0,0 +1,32 @@
+include(${CMAKE_CURRENT_LIST_DIR}/OpenSSLTargets.cmake)
+
+# Recursively collect dependency locations for the imported targets.
+macro(_openssl_config_libraries libraries target)
+  get_property(_DEPS TARGET ${target} PROPERTY INTERFACE_LINK_LIBRARIES)
+  foreach(_DEP ${_DEPS})
+    if(TARGET ${_DEP})
+      _openssl_config_libraries(${libraries} ${_DEP})
+    else()
+      list(APPEND ${libraries} ${_DEP})
+    endif()
+  endforeach()
+  get_property(_LOC TARGET ${target} PROPERTY LOCATION)
+  list(APPEND ${libraries} ${_LOC})
+endmacro()
+
+set(OPENSSL_FOUND YES)
+get_property(OPENSSL_INCLUDE_DIR TARGET OpenSSL::SSL PROPERTY INTERFACE_INCLUDE_DIRECTORIES)
+get_property(OPENSSL_CRYPTO_LIBRARY TARGET OpenSSL::Crypto PROPERTY LOCATION)
+_openssl_config_libraries(OPENSSL_CRYPTO_LIBRARIES OpenSSL::Crypto)
+list(REMOVE_DUPLICATES OPENSSL_CRYPTO_LIBRARIES)
+
+get_property(OPENSSL_SSL_LIBRARY TARGET OpenSSL::Crypto PROPERTY LOCATION)
+_openssl_config_libraries(OPENSSL_SSL_LIBRARIES OpenSSL::SSL)
+list(REMOVE_DUPLICATES OPENSSL_SSL_LIBRARIES)
+
+set(OPENSSL_LIBRARIES ${OPENSSL_CRYPTO_LIBRARIES} ${OPENSSL_SSL_LIBRARIES})
+list(REMOVE_DUPLICATES OPENSSL_LIBRARIES)
+
+set(_DEP)
+set(_DEPS)
+set(_LOC)
diff --git a/src/crypto/CMakeLists.txt b/src/crypto/CMakeLists.txt
index 79802c6..99cb4b5 100644
--- a/src/crypto/CMakeLists.txt
+++ b/src/crypto/CMakeLists.txt
@@ -121,6 +121,7 @@
 
     chacha/chacha-armv8.${ASM_EXT}
     test/trampoline-armv8.${ASM_EXT}
+    cipher_extra/chacha20_poly1305_armv8.${ASM_EXT}
   )
 endif()
 
@@ -159,6 +160,7 @@
 perlasm(chacha/chacha-x86_64.${ASM_EXT} chacha/asm/chacha-x86_64.pl)
 perlasm(cipher_extra/aes128gcmsiv-x86_64.${ASM_EXT} cipher_extra/asm/aes128gcmsiv-x86_64.pl)
 perlasm(cipher_extra/chacha20_poly1305_x86_64.${ASM_EXT} cipher_extra/asm/chacha20_poly1305_x86_64.pl)
+perlasm(cipher_extra/chacha20_poly1305_armv8.${ASM_EXT} cipher_extra/asm/chacha20_poly1305_armv8.pl)
 perlasm(test/trampoline-armv4.${ASM_EXT} test/asm/trampoline-armv4.pl)
 perlasm(test/trampoline-armv8.${ASM_EXT} test/asm/trampoline-armv8.pl)
 perlasm(test/trampoline-ppc.${ASM_EXT} test/asm/trampoline-ppc.pl)
@@ -251,7 +253,6 @@
   chacha/chacha.c
   cipher_extra/cipher_extra.c
   cipher_extra/derive_key.c
-  cipher_extra/e_aesccm.c
   cipher_extra/e_aesctrhmac.c
   cipher_extra/e_aesgcmsiv.c
   cipher_extra/e_chacha20poly1305.c
@@ -261,7 +262,6 @@
   cipher_extra/e_rc4.c
   cipher_extra/e_tls.c
   cipher_extra/tls_cbc.c
-  cmac/cmac.c
   conf/conf.c
   cpu_aarch64_apple.c
   cpu_aarch64_fuchsia.c
@@ -435,19 +435,21 @@
   ${CRYPTO_ARCH_SOURCES}
   ${CRYPTO_FIPS_OBJECTS}
 )
+target_include_directories(crypto INTERFACE
+ $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/include>
+ $<INSTALL_INTERFACE:include>
+)
+install(TARGETS crypto EXPORT OpenSSLTargets DESTINATION ${CMAKE_INSTALL_LIBDIR})
+set_property(TARGET crypto PROPERTY EXPORT_NAME Crypto)
 
 if(FIPS_SHARED)
-  set(EXTRA_INJECT_HASH_ARGS)
-  if(ANDROID)
-    set(EXTRA_INJECT_HASH_ARGS "-sha256")
-  endif()
   # Rewrite libcrypto.so to inject the correct module hash value. This assumes
   # UNIX-style library naming, but we only support FIPS mode on Linux anyway.
   add_custom_command(
     TARGET crypto POST_BUILD
     COMMAND ${GO_EXECUTABLE} run
     ${CMAKE_CURRENT_SOURCE_DIR}/../util/fipstools/inject_hash/inject_hash.go
-    -o libcrypto.so -in-object libcrypto.so ${EXTRA_INJECT_HASH_ARGS}
+    -o libcrypto.so -in-object libcrypto.so
     # The DEPENDS argument to a POST_BUILD rule appears to be ignored. Thus
     # go_executable isn't used (as it doesn't get built), but we list this
     # dependency anyway in case it starts working in some CMake version.
@@ -501,7 +503,6 @@
   chacha/chacha_test.cc
   cipher_extra/aead_test.cc
   cipher_extra/cipher_test.cc
-  cmac/cmac_test.cc
   compiler_test.cc
   conf/conf_test.cc
   constant_time_test.cc
@@ -521,13 +522,15 @@
   evp/scrypt_test.cc
   fipsmodule/aes/aes_test.cc
   fipsmodule/bn/bn_test.cc
+  fipsmodule/cmac/cmac_test.cc
   fipsmodule/ec/ec_test.cc
-  fipsmodule/ec/p256-x86_64_test.cc
+  fipsmodule/ec/p256-nistz_test.cc
   fipsmodule/ecdsa/ecdsa_test.cc
   fipsmodule/md5/md5_test.cc
   fipsmodule/modes/gcm_test.cc
   fipsmodule/rand/ctrdrbg_test.cc
   fipsmodule/rand/fork_detect_test.cc
+  fipsmodule/service_indicator/service_indicator_test.cc
   fipsmodule/sha/sha_test.cc
   hkdf/hkdf_test.cc
   hpke/hpke_test.cc
diff --git a/src/crypto/asn1/a_strex.c b/src/crypto/asn1/a_strex.c
index 3732894..56aa033 100644
--- a/src/crypto/asn1/a_strex.c
+++ b/src/crypto/asn1/a_strex.c
@@ -56,6 +56,7 @@
 
 #include <openssl/asn1.h>
 
+#include <assert.h>
 #include <ctype.h>
 #include <inttypes.h>
 #include <string.h>
@@ -155,100 +156,98 @@
     return 1;
 }
 
-#define BUF_TYPE_WIDTH_MASK     0x7
-#define BUF_TYPE_CONVUTF8       0x8
-
 /*
  * This function sends each character in a buffer to do_esc_char(). It
  * interprets the content formats and converts to or from UTF8 as
  * appropriate.
  */
 
-static int do_buf(unsigned char *buf, int buflen,
-                  int type, unsigned char flags, char *quotes, BIO *out)
+static int do_buf(const unsigned char *buf, int buflen, int encoding,
+                  int utf8_convert, unsigned char flags, char *quotes, BIO *out)
 {
-    int i, outlen, len, charwidth;
-    unsigned char orflags, *p, *q;
-    uint32_t c;
-    p = buf;
-    q = buf + buflen;
-    outlen = 0;
-    charwidth = type & BUF_TYPE_WIDTH_MASK;
-
-    switch (charwidth) {
-    case 4:
+    /* Reject invalid UCS-4 and UCS-2 lengths without parsing. */
+    switch (encoding) {
+    case MBSTRING_UNIV:
         if (buflen & 3) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_UNIVERSALSTRING);
             return -1;
         }
         break;
-    case 2:
+    case MBSTRING_BMP:
         if (buflen & 1) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_BMPSTRING);
             return -1;
         }
         break;
-    default:
-        break;
     }
 
+    const unsigned char *p = buf;
+    const unsigned char *q = buf + buflen;
+    int outlen = 0;
     while (p != q) {
-        if (p == buf && flags & ASN1_STRFLGS_ESC_2253)
+        unsigned char orflags = 0;
+        if (p == buf && flags & ASN1_STRFLGS_ESC_2253) {
             orflags = CHARTYPE_FIRST_ESC_2253;
-        else
-            orflags = 0;
+        }
         /* TODO(davidben): Replace this with |cbs_get_ucs2_be|, etc., to check
-         * for invalid codepoints. */
-        switch (charwidth) {
-        case 4:
+         * for invalid codepoints. Before doing that, enforce it in the parser,
+         * https://crbug.com/boringssl/427, so these error cases are not
+         * reachable from parsed objects. */
+        uint32_t c;
+        switch (encoding) {
+        case MBSTRING_UNIV:
             c = ((uint32_t)*p++) << 24;
             c |= ((uint32_t)*p++) << 16;
             c |= ((uint32_t)*p++) << 8;
             c |= *p++;
             break;
 
-        case 2:
+        case MBSTRING_BMP:
             c = ((uint32_t)*p++) << 8;
             c |= *p++;
             break;
 
-        case 1:
+        case MBSTRING_ASC:
             c = *p++;
             break;
 
-        case 0:
-            i = UTF8_getc(p, buflen, &c);
-            if (i < 0)
+        case MBSTRING_UTF8: {
+            int consumed = UTF8_getc(p, buflen, &c);
+            if (consumed < 0)
                 return -1;      /* Invalid UTF8String */
-            buflen -= i;
-            p += i;
+            buflen -= consumed;
+            p += consumed;
             break;
+        }
+
         default:
-            return -1;          /* invalid width */
+            assert(0);
+            return -1;
         }
         if (p == q && flags & ASN1_STRFLGS_ESC_2253)
             orflags = CHARTYPE_LAST_ESC_2253;
-        if (type & BUF_TYPE_CONVUTF8) {
+        if (utf8_convert) {
             unsigned char utfbuf[6];
             int utflen;
             utflen = UTF8_putc(utfbuf, sizeof utfbuf, c);
-            for (i = 0; i < utflen; i++) {
+            for (int i = 0; i < utflen; i++) {
                 /*
                  * We don't need to worry about setting orflags correctly
                  * because if utflen==1 its value will be correct anyway
                  * otherwise each character will be > 0x7f and so the
                  * character will never be escaped on first and last.
                  */
-                len = do_esc_char(utfbuf[i], (unsigned char)(flags | orflags),
-                                  quotes, out);
-                if (len < 0)
+                int len = do_esc_char(utfbuf[i], flags | orflags, quotes, out);
+                if (len < 0) {
                     return -1;
+                }
                 outlen += len;
             }
         } else {
-            len = do_esc_char(c, (unsigned char)(flags | orflags), quotes, out);
-            if (len < 0)
+            int len = do_esc_char(c, flags | orflags, quotes, out);
+            if (len < 0) {
                 return -1;
+            }
             outlen += len;
         }
     }
@@ -331,22 +330,31 @@
     return outlen + 1;
 }
 
-/*
- * Lookup table to convert tags to character widths, 0 = UTF8 encoded, -1 is
- * used for non string types otherwise it is the number of bytes per
- * character
- */
-
-static const signed char tag2nbyte[] = {
-    -1, -1, -1, -1, -1,         /* 0-4 */
-    -1, -1, -1, -1, -1,         /* 5-9 */
-    -1, -1, 0, -1,              /* 10-13 */
-    -1, -1, -1, -1,             /* 15-17 */
-    1, 1, 1,                    /* 18-20 */
-    -1, 1, 1, 1,                /* 21-24 */
-    -1, 1, -1,                  /* 25-27 */
-    4, -1, 2                    /* 28-30 */
-};
+/* string_type_to_encoding returns the |MBSTRING_*| constant for the encoding
+ * used by the |ASN1_STRING| type |type|, or -1 if |tag| is not a string
+ * type. */
+static int string_type_to_encoding(int type) {
+    /* This function is sometimes passed ASN.1 universal types and sometimes
+     * passed |ASN1_STRING| type values */
+    switch (type) {
+    case V_ASN1_UTF8STRING:
+        return MBSTRING_UTF8;
+    case V_ASN1_NUMERICSTRING:
+    case V_ASN1_PRINTABLESTRING:
+    case V_ASN1_T61STRING:
+    case V_ASN1_IA5STRING:
+    case V_ASN1_UTCTIME:
+    case V_ASN1_GENERALIZEDTIME:
+    case V_ASN1_ISO64STRING:
+        /* |MBSTRING_ASC| refers to Latin-1, not ASCII. */
+        return MBSTRING_ASC;
+    case V_ASN1_UNIVERSALSTRING:
+        return MBSTRING_UNIV;
+    case V_ASN1_BMPSTRING:
+        return MBSTRING_BMP;
+    }
+    return -1;
+}
 
 /*
  * This is the main function, print out an ASN1_STRING taking note of various
@@ -356,79 +364,77 @@
 
 int ASN1_STRING_print_ex(BIO *out, const ASN1_STRING *str, unsigned long lflags)
 {
-    int outlen, len;
-    int type;
-    char quotes;
-    unsigned char flags;
-    quotes = 0;
     /* Keep a copy of escape flags */
-    flags = (unsigned char)(lflags & ESC_FLAGS);
-
-    type = str->type;
-
-    outlen = 0;
-
+    unsigned char flags = (unsigned char)(lflags & ESC_FLAGS);
+    int type = str->type;
+    int outlen = 0;
     if (lflags & ASN1_STRFLGS_SHOW_TYPE) {
-        const char *tagname;
-        tagname = ASN1_tag2str(type);
+        const char *tagname = ASN1_tag2str(type);
         outlen += strlen(tagname);
         if (!maybe_write(out, tagname, outlen) || !maybe_write(out, ":", 1))
             return -1;
         outlen++;
     }
 
-    /* Decide what to do with type, either dump content or display it */
-
-    /* Dump everything */
-    if (lflags & ASN1_STRFLGS_DUMP_ALL)
-        type = -1;
-    /* Ignore the string type */
-    else if (lflags & ASN1_STRFLGS_IGNORE_TYPE)
-        type = 1;
-    else {
-        /* Else determine width based on type */
-        if ((type > 0) && (type < 31))
-            type = tag2nbyte[type];
-        else
-            type = -1;
-        if ((type == -1) && !(lflags & ASN1_STRFLGS_DUMP_UNKNOWN))
-            type = 1;
+    /* Decide what to do with |str|, either dump the contents or display it. */
+    int encoding;
+    if (lflags & ASN1_STRFLGS_DUMP_ALL) {
+        /* Dump everything. */
+        encoding = -1;
+    } else if (lflags & ASN1_STRFLGS_IGNORE_TYPE) {
+        /* Ignore the string type and interpret the contents as Latin-1. */
+        encoding = MBSTRING_ASC;
+    } else {
+        encoding = string_type_to_encoding(type);
+        if (encoding == -1 && (lflags & ASN1_STRFLGS_DUMP_UNKNOWN) == 0) {
+            encoding = MBSTRING_ASC;
+        }
     }
 
-    if (type == -1) {
-        len = do_dump(lflags, out, str);
+    if (encoding == -1) {
+        int len = do_dump(lflags, out, str);
         if (len < 0)
             return -1;
         outlen += len;
         return outlen;
     }
 
+    int utf8_convert = 0;
     if (lflags & ASN1_STRFLGS_UTF8_CONVERT) {
-        /*
-         * Note: if string is UTF8 and we want to convert to UTF8 then we
-         * just interpret it as 1 byte per character to avoid converting
-         * twice.
-         */
-        if (!type)
-            type = 1;
-        else
-            type |= BUF_TYPE_CONVUTF8;
+        /* If the string is UTF-8, skip decoding and just interpret it as 1 byte
+         * per character to avoid converting twice.
+         *
+         * TODO(davidben): This is not quite a valid optimization if the input
+         * was invalid UTF-8. */
+        if (encoding == MBSTRING_UTF8) {
+            encoding = MBSTRING_ASC;
+        } else {
+            utf8_convert = 1;
+        }
     }
 
-    len = do_buf(str->data, str->length, type, flags, &quotes, NULL);
-    if (len < 0)
+    /* Measure the length. */
+    char quotes = 0;
+    int len = do_buf(str->data, str->length, encoding, utf8_convert, flags,
+                     &quotes, NULL);
+    if (len < 0) {
         return -1;
+    }
     outlen += len;
-    if (quotes)
+    if (quotes) {
         outlen += 2;
-    if (!out)
+    }
+    if (!out) {
         return outlen;
-    if (quotes && !maybe_write(out, "\"", 1))
+    }
+
+    /* Encode the value. */
+    if ((quotes && !maybe_write(out, "\"", 1)) ||
+        do_buf(str->data, str->length, encoding, utf8_convert, flags, NULL,
+               out) < 0 ||
+        (quotes && !maybe_write(out, "\"", 1))) {
         return -1;
-    if (do_buf(str->data, str->length, type, flags, NULL, out) < 0)
-        return -1;
-    if (quotes && !maybe_write(out, "\"", 1))
-        return -1;
+    }
     return outlen;
 }
 
@@ -451,22 +457,19 @@
 
 int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in)
 {
-    ASN1_STRING stmp, *str = &stmp;
-    int mbflag, type, ret;
     if (!in)
         return -1;
-    type = in->type;
-    if ((type < 0) || (type > 30))
+    int mbflag = string_type_to_encoding(in->type);
+    if (mbflag == -1) {
+        OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_TAG);
         return -1;
-    mbflag = tag2nbyte[type];
-    if (mbflag == -1)
-        return -1;
-    mbflag |= MBSTRING_FLAG;
+    }
+    ASN1_STRING stmp, *str = &stmp;
     stmp.data = NULL;
     stmp.length = 0;
     stmp.flags = 0;
-    ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag,
-                             B_ASN1_UTF8STRING);
+    int ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag,
+                                 B_ASN1_UTF8STRING);
     if (ret < 0)
         return ret;
     *out = stmp.data;
diff --git a/src/crypto/asn1/asn1_test.cc b/src/crypto/asn1/asn1_test.cc
index 7d69889..6087ef4 100644
--- a/src/crypto/asn1/asn1_test.cc
+++ b/src/crypto/asn1/asn1_test.cc
@@ -871,6 +871,8 @@
       {{0, 0, 0xfd, 0xd5}, V_ASN1_UNIVERSALSTRING, nullptr},
       // BMPString is UCS-2, not UTF-16, so surrogate pairs are invalid.
       {{0xd8, 0, 0xdc, 1}, V_ASN1_BMPSTRING, nullptr},
+      // INTEGERs are stored as strings, but cannot be converted to UTF-8.
+      {{0x01}, V_ASN1_INTEGER, nullptr},
   };
 
   for (const auto &test : kTests) {
@@ -2075,6 +2077,47 @@
                                   sizeof(kIndefinite)));
 }
 
+template <typename T>
+void ExpectNoParse(T *(*d2i)(T **, const uint8_t **, long),
+                   const std::vector<uint8_t> &in) {
+  SCOPED_TRACE(Bytes(in));
+  const uint8_t *ptr = in.data();
+  bssl::UniquePtr<T> obj(d2i(nullptr, &ptr, in.size()));
+  EXPECT_FALSE(obj);
+}
+
+// The zero tag, constructed or primitive, is reserved and should rejected by
+// the parser.
+TEST(ASN1Test, ZeroTag) {
+  ExpectNoParse(d2i_ASN1_TYPE, {0x00, 0x00});
+  ExpectNoParse(d2i_ASN1_TYPE, {0x00, 0x10, 0x00});
+  ExpectNoParse(d2i_ASN1_TYPE, {0x20, 0x00});
+  ExpectNoParse(d2i_ASN1_TYPE, {0x20, 0x00});
+  ExpectNoParse(d2i_ASN1_SEQUENCE_ANY, {0x30, 0x02, 0x00, 0x00});
+  ExpectNoParse(d2i_ASN1_SET_ANY, {0x31, 0x02, 0x00, 0x00});
+  // SEQUENCE {
+  //   OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.1 }
+  //   [UNIVERSAL 0 PRIMITIVE] {}
+  // }
+  ExpectNoParse(d2i_X509_ALGOR,
+                {0x30, 0x10, 0x06, 0x0c, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12,
+                 0x04, 0x01, 0x84, 0xb7, 0x09, 0x01, 0x00, 0x00});
+  // SEQUENCE {
+  //   OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.1 }
+  //   [UNIVERSAL 0 CONSTRUCTED] {}
+  // }
+  ExpectNoParse(d2i_X509_ALGOR,
+                {0x30, 0x10, 0x06, 0x0c, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12,
+                 0x04, 0x01, 0x84, 0xb7, 0x09, 0x01, 0x20, 0x00});
+  // SEQUENCE {
+  //   OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.1 }
+  //   [UNIVERSAL 0 PRIMITIVE] { "a" }
+  // }
+  ExpectNoParse(d2i_X509_ALGOR,
+                {0x30, 0x11, 0x06, 0x0c, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12,
+                 0x04, 0x01, 0x84, 0xb7, 0x09, 0x01, 0x00, 0x01, 0x61});
+}
+
 // The ASN.1 macros do not work on Windows shared library builds, where usage of
 // |OPENSSL_EXPORT| is a bit stricter.
 #if !defined(OPENSSL_WINDOWS) || !defined(BORINGSSL_SHARED_LIBRARY)
diff --git a/src/crypto/asn1/tasn_dec.c b/src/crypto/asn1/tasn_dec.c
index beb9a0b..5bfd930 100644
--- a/src/crypto/asn1/tasn_dec.c
+++ b/src/crypto/asn1/tasn_dec.c
@@ -74,27 +74,27 @@
  */
 #define ASN1_MAX_CONSTRUCTED_NEST 30
 
-static int asn1_check_eoc(const unsigned char **in, long len);
-
 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
                            char *cst, const unsigned char **in, long len,
-                           int exptag, int expclass, char opt, ASN1_TLC *ctx);
+                           int exptag, int expclass, char opt);
 
 static int asn1_template_ex_d2i(ASN1_VALUE **pval,
                                 const unsigned char **in, long len,
                                 const ASN1_TEMPLATE *tt, char opt,
-                                ASN1_TLC *ctx, int depth);
+                                int depth);
 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
                                    const unsigned char **in, long len,
                                    const ASN1_TEMPLATE *tt, char opt,
-                                   ASN1_TLC *ctx, int depth);
+                                   int depth);
 static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
                        int utype, const ASN1_ITEM *it);
 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
                                  const unsigned char **in, long len,
                                  const ASN1_ITEM *it,
-                                 int tag, int aclass, char opt,
-                                 ASN1_TLC *ctx);
+                                 int tag, int aclass, char opt);
+static int asn1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in,
+                            long len, const ASN1_ITEM *it, int tag, int aclass,
+                            char opt, int depth);
 
 /* Table to convert tags to bit values, used for MSTRING type */
 static const unsigned long tag2bit[32] = {
@@ -126,10 +126,6 @@
 
 /* Macro to initialize and invalidate the cache */
 
-#define asn1_tlc_clear(c)       if (c) (c)->valid = 0
-/* Version to avoid compiler warning about 'c' always non-NULL */
-#define asn1_tlc_clear_nc(c)    (c)->valid = 0
-
 /*
  * Decode an ASN1 item, this currently behaves just like a standard 'd2i'
  * function. 'in' points to a buffer to read the data from, in future we
@@ -141,12 +137,11 @@
                           const unsigned char **in, long len,
                           const ASN1_ITEM *it)
 {
-    ASN1_TLC c;
     ASN1_VALUE *ptmpval = NULL;
     if (!pval)
         pval = &ptmpval;
-    asn1_tlc_clear_nc(&c);
-    if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
+
+    if (asn1_item_ex_d2i(pval, in, len, it, -1, 0, 0, 0) > 0)
         return *pval;
     return NULL;
 }
@@ -158,7 +153,7 @@
 
 static int asn1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in,
                             long len, const ASN1_ITEM *it, int tag, int aclass,
-                            char opt, ASN1_TLC *ctx, int depth)
+                            char opt, int depth)
 {
     const ASN1_TEMPLATE *tt, *errtt = NULL;
     const ASN1_EXTERN_FUNCS *ef;
@@ -202,10 +197,10 @@
                 goto err;
             }
             return asn1_template_ex_d2i(pval, in, len,
-                                        it->templates, opt, ctx, depth);
+                                        it->templates, opt, depth);
         }
         return asn1_d2i_ex_primitive(pval, in, len, it,
-                                     tag, aclass, opt, ctx);
+                                     tag, aclass, opt);
         break;
 
     case ASN1_ITYPE_MSTRING:
@@ -221,7 +216,7 @@
         p = *in;
         /* Just read in tag and class */
         ret = asn1_check_tlen(NULL, &otag, &oclass, NULL,
-                              &p, len, -1, 0, 1, ctx);
+                              &p, len, -1, 0, 1);
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
             goto err;
@@ -243,12 +238,12 @@
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_MSTRING_WRONG_TAG);
             goto err;
         }
-        return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0, ctx);
+        return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0);
 
     case ASN1_ITYPE_EXTERN:
         /* Use new style d2i */
         ef = it->funcs;
-        return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx);
+        return ef->asn1_ex_d2i(pval, in, len, it, tag, aclass, opt, NULL);
 
     case ASN1_ITYPE_CHOICE: {
         /*
@@ -285,7 +280,7 @@
             /*
              * We mark field as OPTIONAL so its absence can be recognised.
              */
-            ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx, depth);
+            ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, depth);
             /* If field not present, try the next one */
             if (ret == -1)
                 continue;
@@ -327,7 +322,7 @@
         }
         /* Get SEQUENCE length and update len, p */
         ret = asn1_check_tlen(&len, NULL, NULL, &cst,
-                              &p, len, tag, aclass, opt, ctx);
+                              &p, len, tag, aclass, opt);
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
             goto err;
@@ -373,13 +368,6 @@
             if (!len)
                 break;
             q = p;
-            /* TODO(https://crbug.com/boringssl/455): Although we've removed
-             * indefinite-length support, this check is not quite a no-op.
-             * Reject [UNIVERSAL 0] in the tag parsers themselves. */
-            if (asn1_check_eoc(&p, len)) {
-                OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNEXPECTED_EOC);
-                goto err;
-            }
             /*
              * This determines the OPTIONAL flag value. The field cannot be
              * omitted if it is the last of a SEQUENCE and there is still
@@ -394,8 +382,7 @@
              * attempt to read in field, allowing each to be OPTIONAL
              */
 
-            ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, ctx,
-                                       depth);
+            ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, depth);
             if (!ret) {
                 errtt = seqtt;
                 goto err;
@@ -465,7 +452,7 @@
                      const ASN1_ITEM *it,
                      int tag, int aclass, char opt, ASN1_TLC *ctx)
 {
-    return asn1_item_ex_d2i(pval, in, len, it, tag, aclass, opt, ctx, 0);
+    return asn1_item_ex_d2i(pval, in, len, it, tag, aclass, opt, 0);
 }
 
 /*
@@ -476,7 +463,7 @@
 static int asn1_template_ex_d2i(ASN1_VALUE **val,
                                 const unsigned char **in, long inlen,
                                 const ASN1_TEMPLATE *tt, char opt,
-                                ASN1_TLC *ctx, int depth)
+                                int depth)
 {
     int flags, aclass;
     int ret;
@@ -497,7 +484,7 @@
          * where it starts: so read in EXPLICIT header to get the info.
          */
         ret = asn1_check_tlen(&len, NULL, NULL, &cst,
-                              &p, inlen, tt->tag, aclass, opt, ctx);
+                              &p, inlen, tt->tag, aclass, opt);
         q = p;
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
@@ -509,7 +496,7 @@
             return 0;
         }
         /* We've found the field so it can't be OPTIONAL now */
-        ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx, depth);
+        ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, depth);
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
             return 0;
@@ -522,7 +509,7 @@
             goto err;
         }
     } else
-        return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx, depth);
+        return asn1_template_noexp_d2i(val, in, inlen, tt, opt, depth);
 
     *in = p;
     return 1;
@@ -535,7 +522,7 @@
 static int asn1_template_noexp_d2i(ASN1_VALUE **val,
                                    const unsigned char **in, long len,
                                    const ASN1_TEMPLATE *tt, char opt,
-                                   ASN1_TLC *ctx, int depth)
+                                   int depth)
 {
     int flags, aclass;
     int ret;
@@ -563,7 +550,7 @@
         }
         /* Get the tag */
         ret = asn1_check_tlen(&len, NULL, NULL, NULL,
-                              &p, len, sktag, skaclass, opt, ctx);
+                              &p, len, sktag, skaclass, opt);
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
             return 0;
@@ -592,16 +579,9 @@
         while (len > 0) {
             ASN1_VALUE *skfield;
             const unsigned char *q = p;
-            /* TODO(https://crbug.com/boringssl/455): Although we've removed
-             * indefinite-length support, this check is not quite a no-op.
-             * Reject [UNIVERSAL 0] in the tag parsers themselves. */
-            if (asn1_check_eoc(&p, len)) {
-                OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNEXPECTED_EOC);
-                goto err;
-            }
             skfield = NULL;
              if (!asn1_item_ex_d2i(&skfield, &p, len, ASN1_ITEM_ptr(tt->item),
-                                   -1, 0, 0, ctx, depth)) {
+                                   -1, 0, 0, depth)) {
                 OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
                 goto err;
             }
@@ -615,7 +595,7 @@
     } else if (flags & ASN1_TFLG_IMPTAG) {
         /* IMPLICIT tagging */
         ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), tt->tag,
-                               aclass, opt, ctx, depth);
+                               aclass, opt, depth);
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
             goto err;
@@ -624,7 +604,7 @@
     } else {
         /* Nothing special */
         ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
-                               -1, tt->flags & ASN1_TFLG_COMBINE, opt, ctx,
+                               -1, tt->flags & ASN1_TFLG_COMBINE, opt,
                                depth);
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
@@ -644,7 +624,7 @@
 static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
                                  const unsigned char **in, long inlen,
                                  const ASN1_ITEM *it,
-                                 int tag, int aclass, char opt, ASN1_TLC *ctx)
+                                 int tag, int aclass, char opt)
 {
     int ret = 0, utype;
     long plen;
@@ -676,7 +656,7 @@
         }
         p = *in;
         ret = asn1_check_tlen(NULL, &utype, &oclass, NULL,
-                              &p, inlen, -1, 0, 0, ctx);
+                              &p, inlen, -1, 0, 0);
         if (!ret) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
             return 0;
@@ -691,7 +671,7 @@
     p = *in;
     /* Check header */
     ret = asn1_check_tlen(&plen, NULL, NULL, &cst,
-                          &p, inlen, tag, aclass, opt, ctx);
+                          &p, inlen, tag, aclass, opt);
     if (!ret) {
         OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR);
         return 0;
@@ -701,15 +681,8 @@
     /* SEQUENCE, SET and "OTHER" are left in encoded form */
     if ((utype == V_ASN1_SEQUENCE)
         || (utype == V_ASN1_SET) || (utype == V_ASN1_OTHER)) {
-        /*
-         * Clear context cache for type OTHER because the auto clear when we
-         * have a exact match wont work
-         */
-        if (utype == V_ASN1_OTHER) {
-            asn1_tlc_clear(ctx);
-        }
         /* SEQUENCE and SET must be constructed */
-        else if (!cst) {
+        if (utype != V_ASN1_OTHER && !cst) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_TYPE_NOT_CONSTRUCTED);
             return 0;
         }
@@ -868,70 +841,24 @@
     return ret;
 }
 
-/* Check for ASN1 EOC and swallow it if found */
-
-static int asn1_check_eoc(const unsigned char **in, long len)
-{
-    const unsigned char *p;
-    if (len < 2)
-        return 0;
-    p = *in;
-    if (!p[0] && !p[1]) {
-        *in += 2;
-        return 1;
-    }
-    return 0;
-}
-
 /*
- * Check an ASN1 tag and length: a bit like ASN1_get_object but it handles
- * the ASN1_TLC cache and checks the expected tag.
+ * Check an ASN1 tag and length: a bit like ASN1_get_object but it
+ * checks the expected tag.
  */
 
 static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
                            char *cst, const unsigned char **in, long len,
-                           int exptag, int expclass, char opt, ASN1_TLC *ctx)
+                           int exptag, int expclass, char opt)
 {
     int i;
     int ptag, pclass;
     long plen;
-    const unsigned char *p, *q;
+    const unsigned char *p;
     p = *in;
-    q = p;
 
-    if (ctx && ctx->valid) {
-        i = ctx->ret;
-        plen = ctx->plen;
-        pclass = ctx->pclass;
-        ptag = ctx->ptag;
-        p += ctx->hdrlen;
-    } else {
-        i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
-        if (ctx) {
-            ctx->ret = i;
-            ctx->plen = plen;
-            ctx->pclass = pclass;
-            ctx->ptag = ptag;
-            ctx->hdrlen = p - q;
-            ctx->valid = 1;
-            /*
-             * If no error, length + header can't exceed total amount of data
-             * available.
-             *
-             * TODO(davidben): Is this check necessary? |ASN1_get_object|
-             * should already guarantee this.
-             */
-            if (!(i & 0x80) && ((plen + ctx->hdrlen) > len)) {
-                OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);
-                asn1_tlc_clear(ctx);
-                return 0;
-            }
-        }
-    }
-
+    i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
     if (i & 0x80) {
         OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_OBJECT_HEADER);
-        asn1_tlc_clear(ctx);
         return 0;
     }
     if (exptag >= 0) {
@@ -941,15 +868,9 @@
              */
             if (opt)
                 return -1;
-            asn1_tlc_clear(ctx);
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TAG);
             return 0;
         }
-        /*
-         * We have a tag and class match: assume we are going to do something
-         * with it
-         */
-        asn1_tlc_clear(ctx);
     }
 
     if (cst)
diff --git a/src/crypto/asn1/time_support.c b/src/crypto/asn1/time_support.c
index e748ad7..68c6086 100644
--- a/src/crypto/asn1/time_support.c
+++ b/src/crypto/asn1/time_support.c
@@ -55,7 +55,7 @@
  * (eay@cryptsoft.com).  This product includes software written by Tim
  * Hudson (tjh@cryptsoft.com). */
 
-#if !defined(_POSIX_C_SOURCE)
+#if defined(__linux__) && !defined(_POSIX_C_SOURCE)
 #define _POSIX_C_SOURCE 201410L  /* for gmtime_r */
 #endif
 
diff --git a/src/crypto/bio/socket_helper.c b/src/crypto/bio/socket_helper.c
index fc751fd..4cd7825 100644
--- a/src/crypto/bio/socket_helper.c
+++ b/src/crypto/bio/socket_helper.c
@@ -12,8 +12,10 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
+#if defined(__linux__)
 #undef _POSIX_C_SOURCE
 #define _POSIX_C_SOURCE 200112L
+#endif
 
 #include <openssl/bio.h>
 #include <openssl/err.h>
diff --git a/src/crypto/bytestring/ber.c b/src/crypto/bytestring/ber.c
index d9b780f..dc707b9 100644
--- a/src/crypto/bytestring/ber.c
+++ b/src/crypto/bytestring/ber.c
@@ -93,11 +93,14 @@
   return 1;
 }
 
-// is_eoc returns true if |header_len| and |contents|, as returned by
-// |CBS_get_any_ber_asn1_element|, indicate an "end of contents" (EOC) value.
-static char is_eoc(size_t header_len, CBS *contents) {
-  return header_len == 2 && CBS_len(contents) == 2 &&
-         OPENSSL_memcmp(CBS_data(contents), "\x00\x00", 2) == 0;
+// cbs_get_eoc returns one if |cbs| begins with an "end of contents" (EOC) value
+// and zero otherwise. If an EOC was found, it advances |cbs| past it.
+static int cbs_get_eoc(CBS *cbs) {
+  if (CBS_len(cbs) >= 2 &&
+      CBS_data(cbs)[0] == 0 && CBS_data(cbs)[1] == 0) {
+    return CBS_skip(cbs, 2);
+  }
+  return 0;
 }
 
 // cbs_convert_ber reads BER data from |in| and writes DER data to |out|. If
@@ -116,21 +119,20 @@
   }
 
   while (CBS_len(in) > 0) {
+    if (looking_for_eoc && cbs_get_eoc(in)) {
+      return 1;
+    }
+
     CBS contents;
     unsigned tag, child_string_tag = string_tag;
     size_t header_len;
     int indefinite;
     CBB *out_contents, out_contents_storage;
-
     if (!CBS_get_any_ber_asn1_element(in, &contents, &tag, &header_len,
                                       /*out_ber_found=*/NULL, &indefinite)) {
       return 0;
     }
 
-    if (is_eoc(header_len, &contents)) {
-      return looking_for_eoc;
-    }
-
     if (string_tag != 0) {
       // This is part of a constructed string. All elements must match
       // |string_tag| up to the constructed bit and get appended to |out|
diff --git a/src/crypto/bytestring/bytestring_test.cc b/src/crypto/bytestring/bytestring_test.cc
index 77261a3..a8c1913 100644
--- a/src/crypto/bytestring/bytestring_test.cc
+++ b/src/crypto/bytestring/bytestring_test.cc
@@ -699,7 +699,6 @@
 
 static const BERTest kBERTests[] = {
     // Trivial cases, also valid DER.
-    {"0000", true, false, false, 0},
     {"0100", true, false, false, 1},
     {"020101", true, false, false, 2},
 
@@ -725,6 +724,12 @@
     {"1f4000", true, false, false, 0x40},
     // Non-minimal tags are invalid, even in BER.
     {"1f804000", false, false, false, 0},
+
+    // EOCs and other forms of tag [UNIVERSAL 0] are rejected as elements.
+    {"0000", false, false, false, 0},
+    {"000100", false, false, false, 0},
+    {"00800000", false, false, false, 0},
+    {"2000", false, false, false, 0},
 };
 
 TEST(CBSTest, BERElementTest) {
diff --git a/src/crypto/bytestring/cbs.c b/src/crypto/bytestring/cbs.c
index 293e66c..010897b 100644
--- a/src/crypto/bytestring/cbs.c
+++ b/src/crypto/bytestring/cbs.c
@@ -279,6 +279,13 @@
 
   tag |= tag_number;
 
+  // Tag [UNIVERSAL 0] is reserved for use by the encoding. Reject it here to
+  // avoid some ambiguity around ANY values and BER indefinite-length EOCs. See
+  // https://crbug.com/boringssl/455.
+  if ((tag & ~CBS_ASN1_CONSTRUCTED) == 0) {
+    return 0;
+  }
+
   *out = tag;
   return 1;
 }
diff --git a/src/crypto/cipher_extra/asm/chacha20_poly1305_armv8.pl b/src/crypto/cipher_extra/asm/chacha20_poly1305_armv8.pl
new file mode 100644
index 0000000..24b5c9b
--- /dev/null
+++ b/src/crypto/cipher_extra/asm/chacha20_poly1305_armv8.pl
@@ -0,0 +1,1644 @@
+#!/usr/bin/env perl
+
+# Copyright (c) 2020, CloudFlare Ltd.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+##############################################################################
+#                                                                            #
+# Author:  Vlad Krasnov                                                      #
+#                                                                            #
+##############################################################################
+
+$flavour = shift;
+while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
+
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
+die "can't locate arm-xlate.pl";
+
+open OUT,"| \"$^X\" $xlate $flavour $output";
+*STDOUT=*OUT;
+
+my ($oup,$inp,$inl,$adp,$adl,$keyp,$itr1,$itr2) = ("x0","x1","x2","x3","x4","x5","x6","x7");
+my ($acc0,$acc1,$acc2) = map("x$_",(8..10));
+my ($t0,$t1,$t2,$t3) = map("x$_",(11..14));
+my ($one, $r0, $r1) = ("x15","x16","x17");
+my ($t0w) = $t0 =~ s/x/w/r;
+
+my ($A0,$A1,$A2,$A3,$A4,$B0,$B1,$B2,$B3,$B4,$C0,$C1,$C2,$C3,$C4,$D0,$D1,$D2,$D3,$D4) = map("v$_",(0..19));
+my ($T0,$T1,$T2,$T3) = map("v$_",(20..23));
+
+my $CONSTS = "v24";
+my $INC = "v25";
+my $ROL8 = "v26";
+my $CLAMP = "v27";
+
+my ($B_STORE, $C_STORE, $D_STORE) = map("v$_",(28..30));
+
+my $S_STORE = $CLAMP;
+my $LEN_STORE = "v31";
+
+sub chacha_qr {
+my ($a,$b,$c,$d,$t,$dir)=@_;
+my ($shift_b,$shift_d) = $dir =~ /left/ ? ("#4","#12") : ("#12","#4");
+$code.=<<___;
+    add   $a.4s, $a.4s, $b.4s
+    eor   $d.16b, $d.16b, $a.16b
+    rev32 $d.8h, $d.8h
+
+    add   $c.4s, $c.4s, $d.4s
+    eor   $b.16b, $b.16b, $c.16b
+    ushr  $t.4s, $b.4s, #20
+    sli   $t.4s, $b.4s, #12
+___
+    ($t,$b) = ($b,$t);
+$code.=<<___;
+    add   $a.4s, $a.4s, $b.4s
+    eor   $d.16b, $d.16b, $a.16b
+    tbl   $d.16b, {$d.16b}, $ROL8.16b
+
+    add   $c.4s, $c.4s, $d.4s
+    eor   $b.16b, $b.16b, $c.16b
+    ushr  $t.4s, $b.4s, #25
+    sli   $t.4s, $b.4s, #7
+___
+    ($t,$b) = ($b,$t);
+$code.=<<___;
+    ext $b.16b, $b.16b, $b.16b, $shift_b
+    ext $c.16b, $c.16b, $c.16b, #8
+    ext $d.16b, $d.16b, $d.16b, $shift_d
+___
+}
+
+sub poly_add {
+my ($src)=@_;
+$code.="ldp  $t0, $t1, [$src], 16
+        adds $acc0, $acc0, $t0
+        adcs $acc1, $acc1, $t1
+        adc  $acc2, $acc2, $one\n";
+}
+
+sub poly_add_vec {
+my ($src)=@_;
+$code.="mov  $t0, $src.d[0]
+        mov  $t1, $src.d[1]
+        adds $acc0, $acc0, $t0
+        adcs $acc1, $acc1, $t1
+        adc  $acc2, $acc2, $one\n";
+}
+
+sub poly_stage1 {
+$code.="mul   $t0, $acc0, $r0     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+        umulh $t1, $acc0, $r0
+        mul   $t2, $acc1, $r0
+        umulh $t3, $acc1, $r0
+        adds  $t1, $t1, $t2
+        mul   $t2, $acc2, $r0
+        adc   $t2, $t2, $t3\n";
+}
+
+sub poly_stage2 {
+$code.="mul   $t3, $acc0, $r1       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+        umulh $acc0, $acc0, $r1
+        adds  $t1, $t1, $t3
+        mul   $t3, $acc1, $r1
+        umulh $acc1, $acc1, $r1
+        adcs  $t3, $t3, $acc0
+        mul   $acc2, $acc2, $r1
+        adc   $acc2, $acc2, $acc1
+        adds  $t2, $t2, $t3
+        adc   $t3, $acc2, xzr\n";
+}
+
+# At the beginning of the reduce stage t = [t3:t2:t1:t0] is a product of
+# r = [r1:r0] and acc = [acc2:acc1:acc0]
+# r is 124 bits at most (due to clamping) and acc is 131 bits at most
+# (acc2 is at most 4 before the addition and can be at most 6 when we add in
+# the next block) therefore t is at most 255 bits big, and t3 is 63 bits.
+sub poly_reduce_stage {
+$code.="and  $acc2, $t2, #3         // At this point acc2 is 2 bits at most (value of 3)
+        and  $acc0, $t2, #-4
+        extr $t2, $t3, $t2, #2
+        adds $acc0, $acc0, $t0
+        lsr  $t0, $t3, #2
+        adc  $acc1, $t3, $t0        // No carry out since t0 is 61 bits and t3 is 63 bits
+        adds $acc0, $acc0, $t2
+        adcs $acc1, $acc1, $t1
+        adc  $acc2, $acc2, xzr      // At this point acc2 has the value of 4 at most \n";
+}
+
+sub poly_mul {
+    &poly_stage1();
+    &poly_stage2();
+    &poly_reduce_stage();
+}
+
+sub chacha_qr_x3 {
+my ($dir)=@_;
+my ($shift_b,$shift_d) = $dir =~ /left/ ? ("#4","#12") : ("#12","#4");
+$code.=<<___;
+    add   $A0.4s, $A0.4s, $B0.4s
+    add   $A1.4s, $A1.4s, $B1.4s
+    add   $A2.4s, $A2.4s, $B2.4s
+    eor   $D0.16b, $D0.16b, $A0.16b
+    eor   $D1.16b, $D1.16b, $A1.16b
+    eor   $D2.16b, $D2.16b, $A2.16b
+    rev32 $D0.8h, $D0.8h
+    rev32 $D1.8h, $D1.8h
+    rev32 $D2.8h, $D2.8h
+
+    add   $C0.4s, $C0.4s, $D0.4s
+    add   $C1.4s, $C1.4s, $D1.4s
+    add   $C2.4s, $C2.4s, $D2.4s
+    eor   $B0.16b, $B0.16b, $C0.16b
+    eor   $B1.16b, $B1.16b, $C1.16b
+    eor   $B2.16b, $B2.16b, $C2.16b
+    ushr  $T0.4s, $B0.4s, #20
+    sli   $T0.4s, $B0.4s, #12
+    ushr  $B0.4s, $B1.4s, #20
+    sli   $B0.4s, $B1.4s, #12
+    ushr  $B1.4s, $B2.4s, #20
+    sli   $B1.4s, $B2.4s, #12
+
+    add   $A0.4s, $A0.4s, $T0.4s
+    add   $A1.4s, $A1.4s, $B0.4s
+    add   $A2.4s, $A2.4s, $B1.4s
+    eor   $D0.16b, $D0.16b, $A0.16b
+    eor   $D1.16b, $D1.16b, $A1.16b
+    eor   $D2.16b, $D2.16b, $A2.16b
+    tbl   $D0.16b, {$D0.16b}, $ROL8.16b
+    tbl   $D1.16b, {$D1.16b}, $ROL8.16b
+    tbl   $D2.16b, {$D2.16b}, $ROL8.16b
+
+    add   $C0.4s, $C0.4s, $D0.4s
+    add   $C1.4s, $C1.4s, $D1.4s
+    add   $C2.4s, $C2.4s, $D2.4s
+    eor   $T0.16b, $T0.16b, $C0.16b
+    eor   $B0.16b, $B0.16b, $C1.16b
+    eor   $B1.16b, $B1.16b, $C2.16b
+    ushr  $B2.4s, $B1.4s, #25
+    sli   $B2.4s, $B1.4s, #7
+    ushr  $B1.4s, $B0.4s, #25
+    sli   $B1.4s, $B0.4s, #7
+    ushr  $B0.4s, $T0.4s, #25
+    sli   $B0.4s, $T0.4s, #7
+
+    ext $B0.16b, $B0.16b, $B0.16b, $shift_b
+    ext $B1.16b, $B1.16b, $B1.16b, $shift_b
+    ext $B2.16b, $B2.16b, $B2.16b, $shift_b
+
+    ext $C0.16b, $C0.16b, $C0.16b, #8
+    ext $C1.16b, $C1.16b, $C1.16b, #8
+    ext $C2.16b, $C2.16b, $C2.16b, #8
+
+    ext $D0.16b, $D0.16b, $D0.16b, $shift_d
+    ext $D1.16b, $D1.16b, $D1.16b, $shift_d
+    ext $D2.16b, $D2.16b, $D2.16b, $shift_d
+___
+}
+
+# When preparing 5 ChaCha20 blocks in parallel, we operate on 4 blocks vertically as introduced by Andrew Moon
+# the fifth block is done horizontally
+sub chacha_qr_x5 {
+my ($dir)=@_;
+my ($a0,$a1,$a2,$a3) = $dir =~ /left/ ? ($A0,$A1,$A2,$A3) : ($A0,$A1,$A2,$A3);
+my ($b0,$b1,$b2,$b3) = $dir =~ /left/ ? ($B0,$B1,$B2,$B3) : ($B1,$B2,$B3,$B0);
+my ($c0,$c1,$c2,$c3) = $dir =~ /left/ ? ($C0,$C1,$C2,$C3) : ($C2,$C3,$C0,$C1);
+my ($d0,$d1,$d2,$d3) = $dir =~ /left/ ? ($D0,$D1,$D2,$D3) : ($D3,$D0,$D1,$D2);
+my ($shift_b,$shift_d) = $dir =~ /left/ ? ("#4","#12") : ("#12","#4");
+$code.=<<___;
+    add   $a0.4s, $a0.4s, $b0.4s
+    add   $a1.4s, $a1.4s, $b1.4s
+    add   $a2.4s, $a2.4s, $b2.4s
+    add   $a3.4s, $a3.4s, $b3.4s
+    add   $A4.4s, $A4.4s, $B4.4s
+
+    eor   $d0.16b, $d0.16b, $a0.16b
+    eor   $d1.16b, $d1.16b, $a1.16b
+    eor   $d2.16b, $d2.16b, $a2.16b
+    eor   $d3.16b, $d3.16b, $a3.16b
+    eor   $D4.16b, $D4.16b, $A4.16b
+
+    rev32 $d0.8h, $d0.8h
+    rev32 $d1.8h, $d1.8h
+    rev32 $d2.8h, $d2.8h
+    rev32 $d3.8h, $d3.8h
+    rev32 $D4.8h, $D4.8h
+
+    add   $c0.4s, $c0.4s, $d0.4s
+    add   $c1.4s, $c1.4s, $d1.4s
+    add   $c2.4s, $c2.4s, $d2.4s
+    add   $c3.4s, $c3.4s, $d3.4s
+    add   $C4.4s, $C4.4s, $D4.4s
+
+    eor   $b0.16b, $b0.16b, $c0.16b
+    eor   $b1.16b, $b1.16b, $c1.16b
+    eor   $b2.16b, $b2.16b, $c2.16b
+    eor   $b3.16b, $b3.16b, $c3.16b
+    eor   $B4.16b, $B4.16b, $C4.16b
+
+    ushr  $T0.4s, $b0.4s, #20
+    sli   $T0.4s, $b0.4s, #12
+    ushr  $b0.4s, $b1.4s, #20
+    sli   $b0.4s, $b1.4s, #12
+    ushr  $b1.4s, $b2.4s, #20
+    sli   $b1.4s, $b2.4s, #12
+    ushr  $b2.4s, $b3.4s, #20
+    sli   $b2.4s, $b3.4s, #12
+    ushr  $b3.4s, $B4.4s, #20
+    sli   $b3.4s, $B4.4s, #12
+
+    add   $a0.4s, $a0.4s, $T0.4s
+    add   $a1.4s, $a1.4s, $b0.4s
+    add   $a2.4s, $a2.4s, $b1.4s
+    add   $a3.4s, $a3.4s, $b2.4s
+    add   $A4.4s, $A4.4s, $b3.4s
+
+    eor   $d0.16b, $d0.16b, $a0.16b
+    eor   $d1.16b, $d1.16b, $a1.16b
+    eor   $d2.16b, $d2.16b, $a2.16b
+    eor   $d3.16b, $d3.16b, $a3.16b
+    eor   $D4.16b, $D4.16b, $A4.16b
+
+    tbl   $d0.16b, {$d0.16b}, $ROL8.16b
+    tbl   $d1.16b, {$d1.16b}, $ROL8.16b
+    tbl   $d2.16b, {$d2.16b}, $ROL8.16b
+    tbl   $d3.16b, {$d3.16b}, $ROL8.16b
+    tbl   $D4.16b, {$D4.16b}, $ROL8.16b
+
+    add   $c0.4s, $c0.4s, $d0.4s
+    add   $c1.4s, $c1.4s, $d1.4s
+    add   $c2.4s, $c2.4s, $d2.4s
+    add   $c3.4s, $c3.4s, $d3.4s
+    add   $C4.4s, $C4.4s, $D4.4s
+
+    eor   $T0.16b, $T0.16b, $c0.16b
+    eor   $b0.16b, $b0.16b, $c1.16b
+    eor   $b1.16b, $b1.16b, $c2.16b
+    eor   $b2.16b, $b2.16b, $c3.16b
+    eor   $b3.16b, $b3.16b, $C4.16b
+
+    ushr  $B4.4s, $b3.4s, #25
+    sli   $B4.4s, $b3.4s, #7
+    ushr  $b3.4s, $b2.4s, #25
+    sli   $b3.4s, $b2.4s, #7
+    ushr  $b2.4s, $b1.4s, #25
+    sli   $b2.4s, $b1.4s, #7
+    ushr  $b1.4s, $b0.4s, #25
+    sli   $b1.4s, $b0.4s, #7
+    ushr  $b0.4s, $T0.4s, #25
+    sli   $b0.4s, $T0.4s, #7
+
+    ext $B4.16b, $B4.16b, $B4.16b, $shift_b
+    ext $C4.16b, $C4.16b, $C4.16b, #8
+    ext $D4.16b, $D4.16b, $D4.16b, $shift_d
+___
+}
+
+{
+$code.=<<___;
+#include <openssl/arm_arch.h>
+.section .rodata
+
+.align 7
+.Lchacha20_consts:
+.byte 'e','x','p','a','n','d',' ','3','2','-','b','y','t','e',' ','k'
+.Linc:
+.long 1,2,3,4
+.Lrol8:
+.byte 3,0,1,2, 7,4,5,6, 11,8,9,10, 15,12,13,14
+.Lclamp:
+.quad 0x0FFFFFFC0FFFFFFF, 0x0FFFFFFC0FFFFFFC
+
+.text
+
+.type   .Lpoly_hash_ad_internal,%function
+.align  6
+.Lpoly_hash_ad_internal:
+    .cfi_startproc
+    cbnz $adl, .Lpoly_hash_intro
+    ret
+
+.Lpoly_hash_intro:
+    cmp $adl, #16
+    b.lt .Lpoly_hash_ad_tail
+___
+        &poly_add($adp);
+        &poly_mul();
+$code.=<<___;
+        sub $adl, $adl, #16
+        b .Lpoly_hash_ad_internal
+
+.Lpoly_hash_ad_tail:
+    cbz $adl, .Lpoly_hash_ad_ret
+
+    eor $T0.16b, $T0.16b, $T0.16b // Use T0 to load the AAD
+    sub $adl, $adl, #1
+
+.Lpoly_hash_tail_16_compose:
+        ext  $T0.16b, $T0.16b, $T0.16b, #15
+        ldrb $t0w, [$adp, $adl]
+        mov  $T0.b[0], $t0w
+        subs $adl, $adl, #1
+        b.ge .Lpoly_hash_tail_16_compose
+___
+    &poly_add_vec($T0);
+    &poly_mul();
+$code.=<<___;
+
+.Lpoly_hash_ad_ret:
+    ret
+    .cfi_endproc
+.size .Lpoly_hash_ad_internal, .-.Lpoly_hash_ad_internal
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_seal(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *seal_data);
+//
+.globl  chacha20_poly1305_seal
+.type   chacha20_poly1305_seal,%function
+.align  6
+chacha20_poly1305_seal:
+    AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+    stp x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset 80
+.cfi_offset w30, -72
+.cfi_offset w29, -80
+    mov x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+    stp d8, d9, [sp, #16]
+    stp d10, d11, [sp, #32]
+    stp d12, d13, [sp, #48]
+    stp d14, d15, [sp, #64]
+.cfi_offset b15, -8
+.cfi_offset b14, -16
+.cfi_offset b13, -24
+.cfi_offset b12, -32
+.cfi_offset b11, -40
+.cfi_offset b10, -48
+.cfi_offset b9, -56
+.cfi_offset b8, -64
+
+    adrp $t0, :pg_hi21:.Lchacha20_consts
+    add  $t0, $t0, :lo12:.Lchacha20_consts
+
+    ld1 {$CONSTS.16b - $CLAMP.16b}, [$t0] // Load the CONSTS, INC, ROL8 and CLAMP values
+    ld1 {$B_STORE.16b - $D_STORE.16b}, [$keyp]
+
+    mov $one, #1 // Prepare the Poly1305 state
+    mov $acc0, #0
+    mov $acc1, #0
+    mov $acc2, #0
+
+    ldr $t1, [$keyp, #56]   // The total cipher text length includes extra_in_len
+    add $t1, $t1, $inl
+    mov $LEN_STORE.d[0], $adl  // Store the input and aad lengths
+    mov $LEN_STORE.d[1], $t1
+
+    cmp $inl, #128
+    b.le .Lseal_128 // Optimization for smaller buffers
+
+    // Initially we prepare 5 ChaCha20 blocks. Four to encrypt up to 4 blocks (256 bytes) of plaintext,
+    // and one for the Poly1305 R and S keys. The first four blocks (A0-A3..D0-D3) are computed vertically,
+    // the fifth block (A4-D4) horizontally.
+    ld4r {$A0.4s-$A3.4s}, [$t0]
+    mov $A4.16b, $CONSTS.16b
+
+    ld4r {$B0.4s-$B3.4s}, [$keyp], #16
+    mov $B4.16b, $B_STORE.16b
+
+    ld4r {$C0.4s-$C3.4s}, [$keyp], #16
+    mov $C4.16b, $C_STORE.16b
+
+    ld4r {$D0.4s-$D3.4s}, [$keyp]
+    add $D0.4s, $D0.4s, $INC.4s
+    mov $D4.16b, $D_STORE.16b
+
+    sub $keyp, $keyp, #32
+
+    mov  $itr1, #10
+
+.align 5
+.Lseal_init_rounds:
+___
+        &chacha_qr_x5("left");
+        &chacha_qr_x5("right");
+$code.=<<___;
+        subs $itr1, $itr1, #1
+    b.hi .Lseal_init_rounds
+
+    add $D0.4s, $D0.4s, $INC.4s
+    mov $t0, #4
+    dup $T0.4s, $t0w
+    add $INC.4s, $INC.4s, $T0.4s
+
+    zip1 $T0.4s, $A0.4s, $A1.4s
+    zip2 $T1.4s, $A0.4s, $A1.4s
+    zip1 $T2.4s, $A2.4s, $A3.4s
+    zip2 $T3.4s, $A2.4s, $A3.4s
+
+    zip1 $A0.2d, $T0.2d, $T2.2d
+    zip2 $A1.2d, $T0.2d, $T2.2d
+    zip1 $A2.2d, $T1.2d, $T3.2d
+    zip2 $A3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $B0.4s, $B1.4s
+    zip2 $T1.4s, $B0.4s, $B1.4s
+    zip1 $T2.4s, $B2.4s, $B3.4s
+    zip2 $T3.4s, $B2.4s, $B3.4s
+
+    zip1 $B0.2d, $T0.2d, $T2.2d
+    zip2 $B1.2d, $T0.2d, $T2.2d
+    zip1 $B2.2d, $T1.2d, $T3.2d
+    zip2 $B3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $C0.4s, $C1.4s
+    zip2 $T1.4s, $C0.4s, $C1.4s
+    zip1 $T2.4s, $C2.4s, $C3.4s
+    zip2 $T3.4s, $C2.4s, $C3.4s
+
+    zip1 $C0.2d, $T0.2d, $T2.2d
+    zip2 $C1.2d, $T0.2d, $T2.2d
+    zip1 $C2.2d, $T1.2d, $T3.2d
+    zip2 $C3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $D0.4s, $D1.4s
+    zip2 $T1.4s, $D0.4s, $D1.4s
+    zip1 $T2.4s, $D2.4s, $D3.4s
+    zip2 $T3.4s, $D2.4s, $D3.4s
+
+    zip1 $D0.2d, $T0.2d, $T2.2d
+    zip2 $D1.2d, $T0.2d, $T2.2d
+    zip1 $D2.2d, $T1.2d, $T3.2d
+    zip2 $D3.2d, $T1.2d, $T3.2d
+
+    add $A4.4s, $A4.4s, $CONSTS.4s
+    add $B4.4s, $B4.4s, $B_STORE.4s
+    and $A4.16b, $A4.16b, $CLAMP.16b
+
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+
+    add $A1.4s, $A1.4s, $CONSTS.4s
+    add $B1.4s, $B1.4s, $B_STORE.4s
+    add $C1.4s, $C1.4s, $C_STORE.4s
+    add $D1.4s, $D1.4s, $D_STORE.4s
+
+    add $A2.4s, $A2.4s, $CONSTS.4s
+    add $B2.4s, $B2.4s, $B_STORE.4s
+    add $C2.4s, $C2.4s, $C_STORE.4s
+    add $D2.4s, $D2.4s, $D_STORE.4s
+
+    add $A3.4s, $A3.4s, $CONSTS.4s
+    add $B3.4s, $B3.4s, $B_STORE.4s
+    add $C3.4s, $C3.4s, $C_STORE.4s
+    add $D3.4s, $D3.4s, $D_STORE.4s
+
+    mov $r0, $A4.d[0] // Move the R key to GPRs
+    mov $r1, $A4.d[1]
+    mov $S_STORE.16b, $B4.16b // Store the S key
+
+    bl  .Lpoly_hash_ad_internal
+
+    mov $adp, $oup
+    cmp $inl, #256
+    b.le .Lseal_tail
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A0.16b
+    eor $T1.16b, $T1.16b, $B0.16b
+    eor $T2.16b, $T2.16b, $C0.16b
+    eor $T3.16b, $T3.16b, $D0.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A1.16b
+    eor $T1.16b, $T1.16b, $B1.16b
+    eor $T2.16b, $T2.16b, $C1.16b
+    eor $T3.16b, $T3.16b, $D1.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A2.16b
+    eor $T1.16b, $T1.16b, $B2.16b
+    eor $T2.16b, $T2.16b, $C2.16b
+    eor $T3.16b, $T3.16b, $D2.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A3.16b
+    eor $T1.16b, $T1.16b, $B3.16b
+    eor $T2.16b, $T2.16b, $C3.16b
+    eor $T3.16b, $T3.16b, $D3.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    sub $inl, $inl, #256
+
+    mov $itr1, #4 // In the first run of the loop we need to hash 256 bytes, therefore we hash one block for the first 4 rounds
+    mov $itr2, #6 // and two blocks for the remaining 6, for a total of (1 * 4 + 2 * 6) * 16 = 256
+
+.Lseal_main_loop:
+    adrp $t0, :pg_hi21:.Lchacha20_consts
+    add  $t0, $t0, :lo12:.Lchacha20_consts
+
+    ld4r {$A0.4s-$A3.4s}, [$t0]
+    mov $A4.16b, $CONSTS.16b
+
+    ld4r {$B0.4s-$B3.4s}, [$keyp], #16
+    mov $B4.16b, $B_STORE.16b
+
+    ld4r {$C0.4s-$C3.4s}, [$keyp], #16
+    mov $C4.16b, $C_STORE.16b
+
+    ld4r {$D0.4s-$D3.4s}, [$keyp]
+    add $D0.4s, $D0.4s, $INC.4s
+    mov $D4.16b, $D_STORE.16b
+
+    eor $T0.16b, $T0.16b, $T0.16b //zero
+    not $T1.16b, $T0.16b // -1
+    sub $T1.4s, $INC.4s, $T1.4s // Add +1
+    ext $T0.16b, $T1.16b, $T0.16b, #12 // Get the last element (counter)
+    add $D4.4s, $D4.4s, $T0.4s
+
+    sub $keyp, $keyp, #32
+.align 5
+.Lseal_main_loop_rounds:
+___
+        &chacha_qr_x5("left");
+        &poly_add($adp);
+        &poly_mul();
+        &chacha_qr_x5("right");
+$code.=<<___;
+        subs $itr1, $itr1, #1
+        b.ge .Lseal_main_loop_rounds
+___
+        &poly_add($adp);
+        &poly_mul();
+$code.=<<___;
+        subs $itr2, $itr2, #1
+        b.gt .Lseal_main_loop_rounds
+
+    eor $T0.16b, $T0.16b, $T0.16b //zero
+    not $T1.16b, $T0.16b // -1
+    sub $T1.4s, $INC.4s, $T1.4s // Add +1
+    ext $T0.16b, $T1.16b, $T0.16b, #12 // Get the last element (counter)
+    add $D4.4s, $D4.4s, $T0.4s
+
+    add $D0.4s, $D0.4s, $INC.4s
+    mov $t0, #5
+    dup $T0.4s, $t0w
+    add $INC.4s, $INC.4s, $T0.4s
+
+    zip1 $T0.4s, $A0.4s, $A1.4s
+    zip2 $T1.4s, $A0.4s, $A1.4s
+    zip1 $T2.4s, $A2.4s, $A3.4s
+    zip2 $T3.4s, $A2.4s, $A3.4s
+
+    zip1 $A0.2d, $T0.2d, $T2.2d
+    zip2 $A1.2d, $T0.2d, $T2.2d
+    zip1 $A2.2d, $T1.2d, $T3.2d
+    zip2 $A3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $B0.4s, $B1.4s
+    zip2 $T1.4s, $B0.4s, $B1.4s
+    zip1 $T2.4s, $B2.4s, $B3.4s
+    zip2 $T3.4s, $B2.4s, $B3.4s
+
+    zip1 $B0.2d, $T0.2d, $T2.2d
+    zip2 $B1.2d, $T0.2d, $T2.2d
+    zip1 $B2.2d, $T1.2d, $T3.2d
+    zip2 $B3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $C0.4s, $C1.4s
+    zip2 $T1.4s, $C0.4s, $C1.4s
+    zip1 $T2.4s, $C2.4s, $C3.4s
+    zip2 $T3.4s, $C2.4s, $C3.4s
+
+    zip1 $C0.2d, $T0.2d, $T2.2d
+    zip2 $C1.2d, $T0.2d, $T2.2d
+    zip1 $C2.2d, $T1.2d, $T3.2d
+    zip2 $C3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $D0.4s, $D1.4s
+    zip2 $T1.4s, $D0.4s, $D1.4s
+    zip1 $T2.4s, $D2.4s, $D3.4s
+    zip2 $T3.4s, $D2.4s, $D3.4s
+
+    zip1 $D0.2d, $T0.2d, $T2.2d
+    zip2 $D1.2d, $T0.2d, $T2.2d
+    zip1 $D2.2d, $T1.2d, $T3.2d
+    zip2 $D3.2d, $T1.2d, $T3.2d
+
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+
+    add $A1.4s, $A1.4s, $CONSTS.4s
+    add $B1.4s, $B1.4s, $B_STORE.4s
+    add $C1.4s, $C1.4s, $C_STORE.4s
+    add $D1.4s, $D1.4s, $D_STORE.4s
+
+    add $A2.4s, $A2.4s, $CONSTS.4s
+    add $B2.4s, $B2.4s, $B_STORE.4s
+    add $C2.4s, $C2.4s, $C_STORE.4s
+    add $D2.4s, $D2.4s, $D_STORE.4s
+
+    add $A3.4s, $A3.4s, $CONSTS.4s
+    add $B3.4s, $B3.4s, $B_STORE.4s
+    add $C3.4s, $C3.4s, $C_STORE.4s
+    add $D3.4s, $D3.4s, $D_STORE.4s
+
+    add $A4.4s, $A4.4s, $CONSTS.4s
+    add $B4.4s, $B4.4s, $B_STORE.4s
+    add $C4.4s, $C4.4s, $C_STORE.4s
+    add $D4.4s, $D4.4s, $D_STORE.4s
+
+    cmp $inl, #320
+    b.le .Lseal_tail
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A0.16b
+    eor $T1.16b, $T1.16b, $B0.16b
+    eor $T2.16b, $T2.16b, $C0.16b
+    eor $T3.16b, $T3.16b, $D0.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A1.16b
+    eor $T1.16b, $T1.16b, $B1.16b
+    eor $T2.16b, $T2.16b, $C1.16b
+    eor $T3.16b, $T3.16b, $D1.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A2.16b
+    eor $T1.16b, $T1.16b, $B2.16b
+    eor $T2.16b, $T2.16b, $C2.16b
+    eor $T3.16b, $T3.16b, $D2.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A3.16b
+    eor $T1.16b, $T1.16b, $B3.16b
+    eor $T2.16b, $T2.16b, $C3.16b
+    eor $T3.16b, $T3.16b, $D3.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A4.16b
+    eor $T1.16b, $T1.16b, $B4.16b
+    eor $T2.16b, $T2.16b, $C4.16b
+    eor $T3.16b, $T3.16b, $D4.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    sub $inl, $inl, #320
+
+    mov $itr1, #0
+    mov $itr2, #10 // For the remainder of the loop we always hash and encrypt 320 bytes per iteration
+
+    b .Lseal_main_loop
+
+.Lseal_tail:
+    // This part of the function handles the storage and authentication of the last [0,320) bytes
+    // We assume A0-A4 ... D0-D4 hold at least inl (320 max) bytes of the stream data.
+    cmp $inl, #64
+    b.lt .Lseal_tail_64
+
+    // Store and authenticate 64B blocks per iteration
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+
+    eor $T0.16b, $T0.16b, $A0.16b
+    eor $T1.16b, $T1.16b, $B0.16b
+    eor $T2.16b, $T2.16b, $C0.16b
+    eor $T3.16b, $T3.16b, $D0.16b
+___
+    &poly_add_vec($T0);
+    &poly_mul();
+    &poly_add_vec($T1);
+    &poly_mul();
+    &poly_add_vec($T2);
+    &poly_mul();
+    &poly_add_vec($T3);
+    &poly_mul();
+$code.=<<___;
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+    sub $inl, $inl, #64
+
+    // Shift the state left by 64 bytes for the next iteration of the loop
+    mov $A0.16b, $A1.16b
+    mov $B0.16b, $B1.16b
+    mov $C0.16b, $C1.16b
+    mov $D0.16b, $D1.16b
+
+    mov $A1.16b, $A2.16b
+    mov $B1.16b, $B2.16b
+    mov $C1.16b, $C2.16b
+    mov $D1.16b, $D2.16b
+
+    mov $A2.16b, $A3.16b
+    mov $B2.16b, $B3.16b
+    mov $C2.16b, $C3.16b
+    mov $D2.16b, $D3.16b
+
+    mov $A3.16b, $A4.16b
+    mov $B3.16b, $B4.16b
+    mov $C3.16b, $C4.16b
+    mov $D3.16b, $D4.16b
+
+    b .Lseal_tail
+
+.Lseal_tail_64:
+    ldp $adp, $adl, [$keyp, #48] // extra_in_len and extra_in_ptr
+
+    // Here we handle the last [0,64) bytes of plaintext
+    cmp $inl, #16
+    b.lt .Lseal_tail_16
+    // Each iteration encrypt and authenticate a 16B block
+    ld1 {$T0.16b}, [$inp], #16
+    eor $T0.16b, $T0.16b, $A0.16b
+___
+    &poly_add_vec($T0);
+    &poly_mul();
+$code.=<<___;
+    st1 {$T0.16b}, [$oup], #16
+
+    sub $inl, $inl, #16
+
+    // Shift the state left by 16 bytes for the next iteration of the loop
+    mov $A0.16b, $B0.16b
+    mov $B0.16b, $C0.16b
+    mov $C0.16b, $D0.16b
+
+    b .Lseal_tail_64
+
+.Lseal_tail_16:
+    // Here we handle the last [0,16) bytes of ciphertext that require a padded block
+    cbz $inl, .Lseal_hash_extra
+
+    eor $T0.16b, $T0.16b, $T0.16b // Use T0 to load the plaintext/extra in
+    eor $T1.16b, $T1.16b, $T1.16b // Use T1 to generate an AND mask that will only mask the ciphertext bytes
+    not $T2.16b, $T0.16b
+
+    mov $itr1, $inl
+    add $inp, $inp, $inl
+
+    cbz $adl, .Lseal_tail_16_compose // No extra data to pad with, zero padding
+
+    mov $itr2, #16          // We need to load some extra_in first for padding
+    sub $itr2, $itr2, $inl
+    cmp $adl, $itr2
+    csel $itr2, $adl, $itr2, lt // Load the minimum of extra_in_len and the amount needed to fill the register
+    mov $t1, $itr2
+    add $adp, $adp, $itr2
+    sub $adl, $adl, $itr2
+
+.Lseal_tail16_compose_extra_in:
+        ext  $T0.16b, $T0.16b, $T0.16b, #15
+        ldrb $t0w, [$adp, #-1]!
+        mov  $T0.b[0], $t0w
+        subs $itr2, $itr2, #1
+        b.gt .Lseal_tail16_compose_extra_in
+
+    add $adp, $adp, $t1
+
+.Lseal_tail_16_compose:
+        ext  $T0.16b, $T0.16b, $T0.16b, #15
+        ldrb $t0w, [$inp, #-1]!
+        mov  $T0.b[0], $t0w
+        ext  $T1.16b, $T2.16b, $T1.16b, #15
+        subs $inl, $inl, #1
+        b.gt .Lseal_tail_16_compose
+
+    and $A0.16b, $A0.16b, $T1.16b
+    eor $T0.16b, $T0.16b, $A0.16b
+    mov $T1.16b, $T0.16b
+
+.Lseal_tail_16_store:
+        umov $t0w, $T0.b[0]
+        strb $t0w, [$oup], #1
+        ext  $T0.16b, $T0.16b, $T0.16b, #1
+        subs $itr1, $itr1, #1
+        b.gt .Lseal_tail_16_store
+
+    // Hash in the final ct block concatenated with extra_in
+___
+    &poly_add_vec($T1);
+    &poly_mul();
+$code.=<<___;
+
+.Lseal_hash_extra:
+    cbz $adl, .Lseal_finalize
+
+.Lseal_hash_extra_loop:
+    cmp $adl, #16
+    b.lt .Lseal_hash_extra_tail
+    ld1 {$T0.16b}, [$adp], #16
+___
+    &poly_add_vec($T0);
+    &poly_mul();
+$code.=<<___;
+    sub $adl, $adl, #16
+    b .Lseal_hash_extra_loop
+
+.Lseal_hash_extra_tail:
+    cbz $adl, .Lseal_finalize
+    eor $T0.16b, $T0.16b, $T0.16b // Use T0 to load the remaining extra ciphertext
+    add $adp, $adp, $adl
+
+.Lseal_hash_extra_load:
+        ext  $T0.16b, $T0.16b, $T0.16b, #15
+        ldrb $t0w, [$adp, #-1]!
+        mov  $T0.b[0], $t0w
+        subs $adl, $adl, #1
+        b.gt .Lseal_hash_extra_load
+
+    // Hash in the final padded extra_in blcok
+___
+    &poly_add_vec($T0);
+    &poly_mul();
+$code.=<<___;
+
+.Lseal_finalize:
+___
+    &poly_add_vec($LEN_STORE);
+    &poly_mul();
+$code.=<<___;
+    # Final reduction step
+    sub  $t1, xzr, $one
+    orr  $t2, xzr, #3
+    subs $t0, $acc0, #-5
+    sbcs $t1, $acc1, $t1
+    sbcs $t2, $acc2, $t2
+    csel $acc0, $t0, $acc0, cs
+    csel $acc1, $t1, $acc1, cs
+    csel $acc2, $t2, $acc2, cs
+___
+    &poly_add_vec($S_STORE);
+$code.=<<___;
+
+    stp  $acc0, $acc1, [$keyp]
+
+    ldp d8, d9, [sp, #16]
+    ldp d10, d11, [sp, #32]
+    ldp d12, d13, [sp, #48]
+    ldp d14, d15, [sp, #64]
+.cfi_restore b15
+.cfi_restore b14
+.cfi_restore b13
+.cfi_restore b12
+.cfi_restore b11
+.cfi_restore b10
+.cfi_restore b9
+.cfi_restore b8
+    ldp x29, x30, [sp], 80
+.cfi_restore w29
+.cfi_restore w30
+.cfi_def_cfa_offset 0
+    AARCH64_VALIDATE_LINK_REGISTER
+    ret
+
+.Lseal_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+    eor $INC.16b, $INC.16b, $INC.16b
+    mov $t0, #1
+    mov $INC.s[0], $t0w
+    mov $A0.16b, $CONSTS.16b
+    mov $A1.16b, $CONSTS.16b
+    mov $A2.16b, $CONSTS.16b
+    mov $B0.16b, $B_STORE.16b
+    mov $B1.16b, $B_STORE.16b
+    mov $B2.16b, $B_STORE.16b
+    mov $C0.16b, $C_STORE.16b
+    mov $C1.16b, $C_STORE.16b
+    mov $C2.16b, $C_STORE.16b
+    mov $D2.16b, $D_STORE.16b
+    add $D0.4s, $D2.4s, $INC.4s
+    add $D1.4s, $D0.4s, $INC.4s
+
+    mov  $itr1, #10
+
+.Lseal_128_rounds:
+___
+        &chacha_qr_x3("left");
+        &chacha_qr_x3("right");
+$code.=<<___;
+        subs $itr1, $itr1, #1
+    b.hi .Lseal_128_rounds
+
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $A1.4s, $A1.4s, $CONSTS.4s
+    add $A2.4s, $A2.4s, $CONSTS.4s
+
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $B1.4s, $B1.4s, $B_STORE.4s
+    add $B2.4s, $B2.4s, $B_STORE.4s
+
+    // Only the first 32 bytes of the third block (counter = 0) are needed,
+    // so skip updating $C2 and $D2.
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $C1.4s, $C1.4s, $C_STORE.4s
+
+    add $D_STORE.4s, $D_STORE.4s, $INC.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+    add $D_STORE.4s, $D_STORE.4s, $INC.4s
+    add $D1.4s, $D1.4s, $D_STORE.4s
+
+    and $A2.16b, $A2.16b, $CLAMP.16b
+    mov $r0, $A2.d[0] // Move the R key to GPRs
+    mov $r1, $A2.d[1]
+    mov $S_STORE.16b, $B2.16b // Store the S key
+
+    bl  .Lpoly_hash_ad_internal
+    b   .Lseal_tail
+.cfi_endproc
+.size chacha20_poly1305_seal,.-chacha20_poly1305_seal
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_open(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *aead_data);
+//
+.globl	chacha20_poly1305_open
+.type	chacha20_poly1305_open,%function
+.align	6
+chacha20_poly1305_open:
+    AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+    stp x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset 80
+.cfi_offset w30, -72
+.cfi_offset w29, -80
+    mov x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+    stp	d8, d9, [sp, #16]
+    stp	d10, d11, [sp, #32]
+    stp	d12, d13, [sp, #48]
+    stp	d14, d15, [sp, #64]
+.cfi_offset b15, -8
+.cfi_offset b14, -16
+.cfi_offset b13, -24
+.cfi_offset b12, -32
+.cfi_offset b11, -40
+.cfi_offset b10, -48
+.cfi_offset b9, -56
+.cfi_offset b8, -64
+
+    adrp $t0, :pg_hi21:.Lchacha20_consts
+    add  $t0, $t0, :lo12:.Lchacha20_consts
+
+    ld1 {$CONSTS.16b - $CLAMP.16b}, [$t0] // Load the CONSTS, INC, ROL8 and CLAMP values
+    ld1 {$B_STORE.16b - $D_STORE.16b}, [$keyp]
+
+    mov $one, #1 // Prepare the Poly1305 state
+    mov $acc0, #0
+    mov $acc1, #0
+    mov $acc2, #0
+
+    mov $LEN_STORE.d[0], $adl  // Store the input and aad lengths
+    mov $LEN_STORE.d[1], $inl
+
+    cmp $inl, #128
+    b.le .Lopen_128 // Optimization for smaller buffers
+
+    // Initially we prepare a single ChaCha20 block for the Poly1305 R and S keys
+    mov $A0.16b, $CONSTS.16b
+    mov $B0.16b, $B_STORE.16b
+    mov $C0.16b, $C_STORE.16b
+    mov $D0.16b, $D_STORE.16b
+
+    mov  $itr1, #10
+
+.align 5
+.Lopen_init_rounds:
+___
+        &chacha_qr($A0, $B0, $C0, $D0, $T0, "left");
+        &chacha_qr($A0, $B0, $C0, $D0, $T0, "right");
+$code.=<<___;
+        subs $itr1, $itr1, #1
+    b.hi .Lopen_init_rounds
+
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $B0.4s, $B0.4s, $B_STORE.4s
+
+    and $A0.16b, $A0.16b, $CLAMP.16b
+    mov $r0, $A0.d[0] // Move the R key to GPRs
+    mov $r1, $A0.d[1]
+    mov $S_STORE.16b, $B0.16b // Store the S key
+
+    bl  .Lpoly_hash_ad_internal
+
+.Lopen_ad_done:
+    mov $adp, $inp
+
+// Each iteration of the loop hash 320 bytes, and prepare stream for 320 bytes
+.Lopen_main_loop:
+
+    cmp $inl, #192
+    b.lt .Lopen_tail
+
+    adrp $t0, :pg_hi21:.Lchacha20_consts
+    add  $t0, $t0, :lo12:.Lchacha20_consts
+
+    ld4r {$A0.4s-$A3.4s}, [$t0]
+    mov $A4.16b, $CONSTS.16b
+
+    ld4r {$B0.4s-$B3.4s}, [$keyp], #16
+    mov $B4.16b, $B_STORE.16b
+
+    ld4r {$C0.4s-$C3.4s}, [$keyp], #16
+    mov $C4.16b, $C_STORE.16b
+
+    ld4r {$D0.4s-$D3.4s}, [$keyp]
+    sub $keyp, $keyp, #32
+    add $D0.4s, $D0.4s, $INC.4s
+    mov $D4.16b, $D_STORE.16b
+
+    eor $T0.16b, $T0.16b, $T0.16b //zero
+    not $T1.16b, $T0.16b // -1
+    sub $T1.4s, $INC.4s, $T1.4s // Add +1
+    ext $T0.16b, $T1.16b, $T0.16b, #12 // Get the last element (counter)
+    add $D4.4s, $D4.4s, $T0.4s
+
+    lsr $adl, $inl, #4 // How many whole blocks we have to hash, will always be at least 12
+    sub $adl, $adl, #10
+
+    mov $itr2, #10
+    subs $itr1, $itr2, $adl
+    subs $itr1, $itr2, $adl // itr1 can be negative if we have more than 320 bytes to hash
+    csel $itr2, $itr2, $adl, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are full
+
+    cbz $itr2, .Lopen_main_loop_rounds_short
+
+.align 5
+.Lopen_main_loop_rounds:
+___
+        &poly_add($adp);
+        &poly_mul();
+$code.=<<___;
+.Lopen_main_loop_rounds_short:
+___
+        &chacha_qr_x5("left");
+        &poly_add($adp);
+        &poly_mul();
+        &chacha_qr_x5("right");
+$code.=<<___;
+        subs $itr2, $itr2, #1
+        b.gt .Lopen_main_loop_rounds
+        subs $itr1, $itr1, #1
+        b.ge .Lopen_main_loop_rounds_short
+___
+$code.=<<___;
+
+    eor $T0.16b, $T0.16b, $T0.16b //zero
+    not $T1.16b, $T0.16b // -1
+    sub $T1.4s, $INC.4s, $T1.4s // Add +1
+    ext $T0.16b, $T1.16b, $T0.16b, #12 // Get the last element (counter)
+    add $D4.4s, $D4.4s, $T0.4s
+
+    add $D0.4s, $D0.4s, $INC.4s
+    mov $t0, #5
+    dup $T0.4s, $t0w
+    add $INC.4s, $INC.4s, $T0.4s
+
+    zip1 $T0.4s, $A0.4s, $A1.4s
+    zip2 $T1.4s, $A0.4s, $A1.4s
+    zip1 $T2.4s, $A2.4s, $A3.4s
+    zip2 $T3.4s, $A2.4s, $A3.4s
+
+    zip1 $A0.2d, $T0.2d, $T2.2d
+    zip2 $A1.2d, $T0.2d, $T2.2d
+    zip1 $A2.2d, $T1.2d, $T3.2d
+    zip2 $A3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $B0.4s, $B1.4s
+    zip2 $T1.4s, $B0.4s, $B1.4s
+    zip1 $T2.4s, $B2.4s, $B3.4s
+    zip2 $T3.4s, $B2.4s, $B3.4s
+
+    zip1 $B0.2d, $T0.2d, $T2.2d
+    zip2 $B1.2d, $T0.2d, $T2.2d
+    zip1 $B2.2d, $T1.2d, $T3.2d
+    zip2 $B3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $C0.4s, $C1.4s
+    zip2 $T1.4s, $C0.4s, $C1.4s
+    zip1 $T2.4s, $C2.4s, $C3.4s
+    zip2 $T3.4s, $C2.4s, $C3.4s
+
+    zip1 $C0.2d, $T0.2d, $T2.2d
+    zip2 $C1.2d, $T0.2d, $T2.2d
+    zip1 $C2.2d, $T1.2d, $T3.2d
+    zip2 $C3.2d, $T1.2d, $T3.2d
+
+    zip1 $T0.4s, $D0.4s, $D1.4s
+    zip2 $T1.4s, $D0.4s, $D1.4s
+    zip1 $T2.4s, $D2.4s, $D3.4s
+    zip2 $T3.4s, $D2.4s, $D3.4s
+
+    zip1 $D0.2d, $T0.2d, $T2.2d
+    zip2 $D1.2d, $T0.2d, $T2.2d
+    zip1 $D2.2d, $T1.2d, $T3.2d
+    zip2 $D3.2d, $T1.2d, $T3.2d
+
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+
+    add $A1.4s, $A1.4s, $CONSTS.4s
+    add $B1.4s, $B1.4s, $B_STORE.4s
+    add $C1.4s, $C1.4s, $C_STORE.4s
+    add $D1.4s, $D1.4s, $D_STORE.4s
+
+    add $A2.4s, $A2.4s, $CONSTS.4s
+    add $B2.4s, $B2.4s, $B_STORE.4s
+    add $C2.4s, $C2.4s, $C_STORE.4s
+    add $D2.4s, $D2.4s, $D_STORE.4s
+
+    add $A3.4s, $A3.4s, $CONSTS.4s
+    add $B3.4s, $B3.4s, $B_STORE.4s
+    add $C3.4s, $C3.4s, $C_STORE.4s
+    add $D3.4s, $D3.4s, $D_STORE.4s
+
+    add $A4.4s, $A4.4s, $CONSTS.4s
+    add $B4.4s, $B4.4s, $B_STORE.4s
+    add $C4.4s, $C4.4s, $C_STORE.4s
+    add $D4.4s, $D4.4s, $D_STORE.4s
+
+    // We can always safely store 192 bytes
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A0.16b
+    eor $T1.16b, $T1.16b, $B0.16b
+    eor $T2.16b, $T2.16b, $C0.16b
+    eor $T3.16b, $T3.16b, $D0.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A1.16b
+    eor $T1.16b, $T1.16b, $B1.16b
+    eor $T2.16b, $T2.16b, $C1.16b
+    eor $T3.16b, $T3.16b, $D1.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A2.16b
+    eor $T1.16b, $T1.16b, $B2.16b
+    eor $T2.16b, $T2.16b, $C2.16b
+    eor $T3.16b, $T3.16b, $D2.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    sub $inl, $inl, #192
+
+    mov $A0.16b, $A3.16b
+    mov $B0.16b, $B3.16b
+    mov $C0.16b, $C3.16b
+    mov $D0.16b, $D3.16b
+
+    cmp $inl, #64
+    b.lt .Lopen_tail_64_store
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A3.16b
+    eor $T1.16b, $T1.16b, $B3.16b
+    eor $T2.16b, $T2.16b, $C3.16b
+    eor $T3.16b, $T3.16b, $D3.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    sub $inl, $inl, #64
+
+    mov $A0.16b, $A4.16b
+    mov $B0.16b, $B4.16b
+    mov $C0.16b, $C4.16b
+    mov $D0.16b, $D4.16b
+
+    cmp $inl, #64
+    b.lt .Lopen_tail_64_store
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+    eor $T0.16b, $T0.16b, $A4.16b
+    eor $T1.16b, $T1.16b, $B4.16b
+    eor $T2.16b, $T2.16b, $C4.16b
+    eor $T3.16b, $T3.16b, $D4.16b
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    sub $inl, $inl, #64
+    b .Lopen_main_loop
+
+.Lopen_tail:
+
+    cbz $inl, .Lopen_finalize
+
+    lsr $adl, $inl, #4 // How many whole blocks we have to hash
+
+    cmp $inl, #64
+    b.le .Lopen_tail_64
+    cmp $inl, #128
+    b.le .Lopen_tail_128
+
+.Lopen_tail_192:
+     // We need three more blocks
+    mov $A0.16b, $CONSTS.16b
+    mov $A1.16b, $CONSTS.16b
+    mov $A2.16b, $CONSTS.16b
+    mov $B0.16b, $B_STORE.16b
+    mov $B1.16b, $B_STORE.16b
+    mov $B2.16b, $B_STORE.16b
+    mov $C0.16b, $C_STORE.16b
+    mov $C1.16b, $C_STORE.16b
+    mov $C2.16b, $C_STORE.16b
+    mov $D0.16b, $D_STORE.16b
+    mov $D1.16b, $D_STORE.16b
+    mov $D2.16b, $D_STORE.16b
+    eor $T3.16b, $T3.16b, $T3.16b
+    eor $T1.16b, $T1.16b, $T1.16b
+    ins $T3.s[0], $INC.s[0]
+    ins $T1.d[0], $one
+
+    add $T2.4s, $T3.4s, $T1.4s
+    add $T1.4s, $T2.4s, $T1.4s
+
+    add $D0.4s, $D0.4s, $T1.4s
+    add $D1.4s, $D1.4s, $T3.4s
+    add $D2.4s, $D2.4s, $T2.4s
+
+    mov $itr2, #10
+    subs $itr1, $itr2, $adl // itr1 can be negative if we have more than 160 bytes to hash
+    csel $itr2, $itr2, $adl, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are hashing
+    sub $adl, $adl, $itr2
+
+    cbz $itr2, .Lopen_tail_192_rounds_no_hash
+
+.Lopen_tail_192_rounds:
+___
+        &poly_add($adp);
+        &poly_mul();
+$code.=<<___;
+.Lopen_tail_192_rounds_no_hash:
+___
+        &chacha_qr_x3("left");
+        &chacha_qr_x3("right");
+$code.=<<___;
+        subs $itr2, $itr2, #1
+        b.gt .Lopen_tail_192_rounds
+        subs $itr1, $itr1, #1
+        b.ge .Lopen_tail_192_rounds_no_hash
+
+    // We hashed 160 bytes at most, may still have 32 bytes left
+.Lopen_tail_192_hash:
+    cbz $adl, .Lopen_tail_192_hash_done
+___
+        &poly_add($adp);
+        &poly_mul();
+$code.=<<___;
+    sub $adl, $adl, #1
+    b .Lopen_tail_192_hash
+
+.Lopen_tail_192_hash_done:
+
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $A1.4s, $A1.4s, $CONSTS.4s
+    add $A2.4s, $A2.4s, $CONSTS.4s
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $B1.4s, $B1.4s, $B_STORE.4s
+    add $B2.4s, $B2.4s, $B_STORE.4s
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $C1.4s, $C1.4s, $C_STORE.4s
+    add $C2.4s, $C2.4s, $C_STORE.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+    add $D1.4s, $D1.4s, $D_STORE.4s
+    add $D2.4s, $D2.4s, $D_STORE.4s
+
+    add $D0.4s, $D0.4s, $T1.4s
+    add $D1.4s, $D1.4s, $T3.4s
+    add $D2.4s, $D2.4s, $T2.4s
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+
+    eor $T0.16b, $T0.16b, $A1.16b
+    eor $T1.16b, $T1.16b, $B1.16b
+    eor $T2.16b, $T2.16b, $C1.16b
+    eor $T3.16b, $T3.16b, $D1.16b
+
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+
+    eor $T0.16b, $T0.16b, $A2.16b
+    eor $T1.16b, $T1.16b, $B2.16b
+    eor $T2.16b, $T2.16b, $C2.16b
+    eor $T3.16b, $T3.16b, $D2.16b
+
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    sub $inl, $inl, #128
+    b .Lopen_tail_64_store
+
+.Lopen_tail_128:
+     // We need two more blocks
+    mov $A0.16b, $CONSTS.16b
+    mov $A1.16b, $CONSTS.16b
+    mov $B0.16b, $B_STORE.16b
+    mov $B1.16b, $B_STORE.16b
+    mov $C0.16b, $C_STORE.16b
+    mov $C1.16b, $C_STORE.16b
+    mov $D0.16b, $D_STORE.16b
+    mov $D1.16b, $D_STORE.16b
+    eor $T3.16b, $T3.16b, $T3.16b
+    eor $T2.16b, $T2.16b, $T2.16b
+    ins $T3.s[0], $INC.s[0]
+    ins $T2.d[0], $one
+    add $T2.4s, $T2.4s, $T3.4s
+
+    add $D0.4s, $D0.4s, $T2.4s
+    add $D1.4s, $D1.4s, $T3.4s
+
+    mov $itr1, #10
+    sub $itr1, $itr1, $adl
+
+.Lopen_tail_128_rounds:
+___
+        &chacha_qr($A0, $B0, $C0, $D0, $T0, "left");
+        &chacha_qr($A1, $B1, $C1, $D1, $T0, "left");
+        &chacha_qr($A0, $B0, $C0, $D0, $T0, "right");
+        &chacha_qr($A1, $B1, $C1, $D1, $T0, "right");
+$code.=<<___;
+        subs $itr1, $itr1, #1
+        b.gt .Lopen_tail_128_rounds
+        cbz $adl, .Lopen_tail_128_rounds_done
+        subs $adl, $adl, #1
+___
+        &poly_add($adp);
+        &poly_mul();
+$code.=<<___;
+    b .Lopen_tail_128_rounds
+
+.Lopen_tail_128_rounds_done:
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $A1.4s, $A1.4s, $CONSTS.4s
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $B1.4s, $B1.4s, $B_STORE.4s
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $C1.4s, $C1.4s, $C_STORE.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+    add $D1.4s, $D1.4s, $D_STORE.4s
+    add $D0.4s, $D0.4s, $T2.4s
+    add $D1.4s, $D1.4s, $T3.4s
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+
+    eor $T0.16b, $T0.16b, $A1.16b
+    eor $T1.16b, $T1.16b, $B1.16b
+    eor $T2.16b, $T2.16b, $C1.16b
+    eor $T3.16b, $T3.16b, $D1.16b
+
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+    sub $inl, $inl, #64
+
+    b .Lopen_tail_64_store
+
+.Lopen_tail_64:
+    // We just need a single block
+    mov $A0.16b, $CONSTS.16b
+    mov $B0.16b, $B_STORE.16b
+    mov $C0.16b, $C_STORE.16b
+    mov $D0.16b, $D_STORE.16b
+    eor $T3.16b, $T3.16b, $T3.16b
+    ins $T3.s[0], $INC.s[0]
+    add $D0.4s, $D0.4s, $T3.4s
+
+    mov $itr1, #10
+    sub $itr1, $itr1, $adl
+
+.Lopen_tail_64_rounds:
+___
+        &chacha_qr($A0, $B0, $C0, $D0, $T0, "left");
+        &chacha_qr($A0, $B0, $C0, $D0, $T0, "right");
+$code.=<<___;
+        subs $itr1, $itr1, #1
+        b.gt .Lopen_tail_64_rounds
+        cbz $adl, .Lopen_tail_64_rounds_done
+        subs $adl, $adl, #1
+___
+        &poly_add($adp);
+        &poly_mul();
+$code.=<<___;
+    b .Lopen_tail_64_rounds
+
+.Lopen_tail_64_rounds_done:
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+    add $D0.4s, $D0.4s, $T3.4s
+
+.Lopen_tail_64_store:
+    cmp $inl, #16
+    b.lt .Lopen_tail_16
+
+    ld1 {$T0.16b}, [$inp], #16
+    eor $T0.16b, $T0.16b, $A0.16b
+    st1 {$T0.16b}, [$oup], #16
+    mov $A0.16b, $B0.16b
+    mov $B0.16b, $C0.16b
+    mov $C0.16b, $D0.16b
+    sub $inl, $inl, #16
+    b .Lopen_tail_64_store
+
+.Lopen_tail_16:
+    // Here we handle the last [0,16) bytes that require a padded block
+    cbz $inl, .Lopen_finalize
+
+    eor $T0.16b, $T0.16b, $T0.16b // Use T0 to load the ciphertext
+    eor $T1.16b, $T1.16b, $T1.16b // Use T1 to generate an AND mask
+    not $T2.16b, $T0.16b
+
+    add $itr2, $inp, $inl
+    mov $itr1, $inl
+
+.Lopen_tail_16_compose:
+    ext  $T0.16b, $T0.16b, $T0.16b, #15
+    ldrb $t0w, [$itr2, #-1]!
+    mov  $T0.b[0], $t0w
+    ext  $T1.16b, $T2.16b, $T1.16b, #15
+    subs $inl, $inl, #1
+    b.gt .Lopen_tail_16_compose
+
+    and $T0.16b, $T0.16b, $T1.16b
+    // Hash in the final padded block
+___
+    &poly_add_vec($T0);
+    &poly_mul();
+$code.=<<___;
+    eor $T0.16b, $T0.16b, $A0.16b
+
+.Lopen_tail_16_store:
+    umov $t0w, $T0.b[0]
+    strb $t0w, [$oup], #1
+    ext  $T0.16b, $T0.16b, $T0.16b, #1
+    subs $itr1, $itr1, #1
+    b.gt .Lopen_tail_16_store
+
+.Lopen_finalize:
+___
+    &poly_add_vec($LEN_STORE);
+    &poly_mul();
+$code.=<<___;
+    # Final reduction step
+    sub  $t1, xzr, $one
+    orr  $t2, xzr, #3
+    subs $t0, $acc0, #-5
+    sbcs $t1, $acc1, $t1
+    sbcs $t2, $acc2, $t2
+    csel $acc0, $t0, $acc0, cs
+    csel $acc1, $t1, $acc1, cs
+    csel $acc2, $t2, $acc2, cs
+___
+    &poly_add_vec($S_STORE);
+$code.=<<___;
+
+    stp  $acc0, $acc1, [$keyp]
+
+    ldp	d8, d9, [sp, #16]
+    ldp	d10, d11, [sp, #32]
+    ldp	d12, d13, [sp, #48]
+    ldp	d14, d15, [sp, #64]
+.cfi_restore b15
+.cfi_restore b14
+.cfi_restore b13
+.cfi_restore b12
+.cfi_restore b11
+.cfi_restore b10
+.cfi_restore b9
+.cfi_restore b8
+    ldp x29, x30, [sp], 80
+.cfi_restore w29
+.cfi_restore w30
+.cfi_def_cfa_offset 0
+    AARCH64_VALIDATE_LINK_REGISTER
+    ret
+
+.Lopen_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+    eor $INC.16b, $INC.16b, $INC.16b
+    mov $t0, #1
+    mov $INC.s[0], $t0w
+    mov $A0.16b, $CONSTS.16b
+    mov $A1.16b, $CONSTS.16b
+    mov $A2.16b, $CONSTS.16b
+    mov $B0.16b, $B_STORE.16b
+    mov $B1.16b, $B_STORE.16b
+    mov $B2.16b, $B_STORE.16b
+    mov $C0.16b, $C_STORE.16b
+    mov $C1.16b, $C_STORE.16b
+    mov $C2.16b, $C_STORE.16b
+    mov $D2.16b, $D_STORE.16b
+    add $D0.4s, $D2.4s, $INC.4s
+    add $D1.4s, $D0.4s, $INC.4s
+
+    mov  $itr1, #10
+
+.Lopen_128_rounds:
+___
+        &chacha_qr_x3("left");
+        &chacha_qr_x3("right");
+$code.=<<___;
+        subs $itr1, $itr1, #1
+    b.hi .Lopen_128_rounds
+
+    add $A0.4s, $A0.4s, $CONSTS.4s
+    add $A1.4s, $A1.4s, $CONSTS.4s
+    add $A2.4s, $A2.4s, $CONSTS.4s
+
+    add $B0.4s, $B0.4s, $B_STORE.4s
+    add $B1.4s, $B1.4s, $B_STORE.4s
+    add $B2.4s, $B2.4s, $B_STORE.4s
+
+    add $C0.4s, $C0.4s, $C_STORE.4s
+    add $C1.4s, $C1.4s, $C_STORE.4s
+
+    add $D_STORE.4s, $D_STORE.4s, $INC.4s
+    add $D0.4s, $D0.4s, $D_STORE.4s
+    add $D_STORE.4s, $D_STORE.4s, $INC.4s
+    add $D1.4s, $D1.4s, $D_STORE.4s
+
+    and $A2.16b, $A2.16b, $CLAMP.16b
+    mov $r0, $A2.d[0] // Move the R key to GPRs
+    mov $r1, $A2.d[1]
+    mov $S_STORE.16b, $B2.16b // Store the S key
+
+    bl  .Lpoly_hash_ad_internal
+
+.Lopen_128_store:
+    cmp $inl, #64
+    b.lt .Lopen_128_store_64
+
+    ld1 {$T0.16b - $T3.16b}, [$inp], #64
+
+___
+    &poly_add_vec($T0);
+    &poly_mul();
+    &poly_add_vec($T1);
+    &poly_mul();
+    &poly_add_vec($T2);
+    &poly_mul();
+    &poly_add_vec($T3);
+    &poly_mul();
+$code.=<<___;
+
+    eor $T0.16b, $T0.16b, $A0.16b
+    eor $T1.16b, $T1.16b, $B0.16b
+    eor $T2.16b, $T2.16b, $C0.16b
+    eor $T3.16b, $T3.16b, $D0.16b
+
+    st1 {$T0.16b - $T3.16b}, [$oup], #64
+
+    sub $inl, $inl, #64
+
+    mov $A0.16b, $A1.16b
+    mov $B0.16b, $B1.16b
+    mov $C0.16b, $C1.16b
+    mov $D0.16b, $D1.16b
+
+.Lopen_128_store_64:
+
+    lsr $adl, $inl, #4
+    mov $adp, $inp
+
+.Lopen_128_hash_64:
+    cbz $adl, .Lopen_tail_64_store
+___
+    &poly_add($adp);
+    &poly_mul();
+$code.=<<___;
+    sub $adl, $adl, #1
+    b .Lopen_128_hash_64
+.cfi_endproc
+.size chacha20_poly1305_open,.-chacha20_poly1305_open
+___
+}
+
+foreach (split("\n",$code)) {
+	s/\`([^\`]*)\`/eval $1/ge;
+
+	print $_,"\n";
+}
+close STDOUT or die "error closing STDOUT";
diff --git a/src/crypto/cipher_extra/internal.h b/src/crypto/cipher_extra/internal.h
index 4e8fa46..0fd0755 100644
--- a/src/crypto/cipher_extra/internal.h
+++ b/src/crypto/cipher_extra/internal.h
@@ -163,7 +163,8 @@
   } out;
 };
 
-#if defined(OPENSSL_X86_64) && !defined(OPENSSL_NO_ASM)
+#if (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&  \
+    !defined(OPENSSL_NO_ASM)
 
 OPENSSL_STATIC_ASSERT(sizeof(union chacha20_poly1305_open_data) == 48,
                       "wrong chacha20_poly1305_open_data size");
@@ -171,10 +172,14 @@
                       "wrong chacha20_poly1305_seal_data size");
 
 OPENSSL_INLINE int chacha20_poly1305_asm_capable(void) {
+#if defined(OPENSSL_X86_64)
   return CRYPTO_is_SSE4_1_capable();
+#elif defined(OPENSSL_AARCH64)
+  return CRYPTO_is_NEON_capable();
+#endif
 }
 
-// chacha20_poly1305_open is defined in chacha20_poly1305_x86_64.pl. It decrypts
+// chacha20_poly1305_open is defined in chacha20_poly1305_*.pl. It decrypts
 // |plaintext_len| bytes from |ciphertext| and writes them to |out_plaintext|.
 // Additional input parameters are passed in |aead_data->in|. On exit, it will
 // write calculated tag value to |aead_data->out.tag|, which the caller must
@@ -185,7 +190,7 @@
                                    size_t ad_len,
                                    union chacha20_poly1305_open_data *data);
 
-// chacha20_poly1305_open is defined in chacha20_poly1305_x86_64.pl. It encrypts
+// chacha20_poly1305_open is defined in chacha20_poly1305_*.pl. It encrypts
 // |plaintext_len| bytes from |plaintext| and writes them to |out_ciphertext|.
 // Additional input parameters are passed in |aead_data->in|. The calculated tag
 // value is over the computed ciphertext concatenated with |extra_ciphertext|
diff --git a/src/crypto/err/pkcs8.errordata b/src/crypto/err/pkcs8.errordata
index 9aac7e2..02a3fe3 100644
--- a/src/crypto/err/pkcs8.errordata
+++ b/src/crypto/err/pkcs8.errordata
@@ -1,3 +1,4 @@
+PKCS8,133,AMBIGUOUS_FRIENDLY_NAME
 PKCS8,129,BAD_ITERATION_COUNT
 PKCS8,100,BAD_PKCS12_DATA
 PKCS8,101,BAD_PKCS12_VERSION
diff --git a/src/crypto/evp/digestsign.c b/src/crypto/evp/digestsign.c
index 6e4d305..ec9322b 100644
--- a/src/crypto/evp/digestsign.c
+++ b/src/crypto/evp/digestsign.c
@@ -59,6 +59,9 @@
 
 #include "internal.h"
 #include "../fipsmodule/digest/internal.h"
+#include "../fipsmodule/service_indicator/internal.h"
+
+// TODO(agl): this will have to be moved into the FIPS module.
 
 
 enum evp_sign_verify_t {
@@ -159,11 +162,17 @@
     uint8_t md[EVP_MAX_MD_SIZE];
     unsigned int mdlen;
 
+    FIPS_service_indicator_lock_state();
     EVP_MD_CTX_init(&tmp_ctx);
     ret = EVP_MD_CTX_copy_ex(&tmp_ctx, ctx) &&
           EVP_DigestFinal_ex(&tmp_ctx, md, &mdlen) &&
           EVP_PKEY_sign(ctx->pctx, out_sig, out_sig_len, md, mdlen);
     EVP_MD_CTX_cleanup(&tmp_ctx);
+    FIPS_service_indicator_unlock_state();
+
+    if (ret) {
+      EVP_DigestSign_verify_service_indicator(ctx);
+    }
 
     return ret;
   } else {
@@ -184,48 +193,76 @@
   uint8_t md[EVP_MAX_MD_SIZE];
   unsigned int mdlen;
 
+  FIPS_service_indicator_lock_state();
   EVP_MD_CTX_init(&tmp_ctx);
   ret = EVP_MD_CTX_copy_ex(&tmp_ctx, ctx) &&
         EVP_DigestFinal_ex(&tmp_ctx, md, &mdlen) &&
         EVP_PKEY_verify(ctx->pctx, sig, sig_len, md, mdlen);
+  FIPS_service_indicator_unlock_state();
   EVP_MD_CTX_cleanup(&tmp_ctx);
 
+  if (ret) {
+    EVP_DigestVerify_verify_service_indicator(ctx);
+  }
+
   return ret;
 }
 
 int EVP_DigestSign(EVP_MD_CTX *ctx, uint8_t *out_sig, size_t *out_sig_len,
                    const uint8_t *data, size_t data_len) {
+  FIPS_service_indicator_lock_state();
+  int ret = 0;
+
   if (uses_prehash(ctx, evp_sign)) {
     // If |out_sig| is NULL, the caller is only querying the maximum output
     // length. |data| should only be incorporated in the final call.
     if (out_sig != NULL &&
         !EVP_DigestSignUpdate(ctx, data, data_len)) {
-      return 0;
+      goto end;
     }
 
-    return EVP_DigestSignFinal(ctx, out_sig, out_sig_len);
+    ret = EVP_DigestSignFinal(ctx, out_sig, out_sig_len);
+    goto end;
   }
 
   if (ctx->pctx->pmeth->sign_message == NULL) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
-    return 0;
+    goto end;
   }
 
-  return ctx->pctx->pmeth->sign_message(ctx->pctx, out_sig, out_sig_len, data,
-                                        data_len);
+  ret = ctx->pctx->pmeth->sign_message(ctx->pctx, out_sig, out_sig_len, data,
+                                       data_len);
+
+end:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    EVP_DigestSign_verify_service_indicator(ctx);
+  }
+  return ret;
 }
 
 int EVP_DigestVerify(EVP_MD_CTX *ctx, const uint8_t *sig, size_t sig_len,
                      const uint8_t *data, size_t len) {
+  FIPS_service_indicator_lock_state();
+  int ret = 0;
+
   if (uses_prehash(ctx, evp_verify)) {
-    return EVP_DigestVerifyUpdate(ctx, data, len) &&
-           EVP_DigestVerifyFinal(ctx, sig, sig_len);
+    ret = EVP_DigestVerifyUpdate(ctx, data, len) &&
+          EVP_DigestVerifyFinal(ctx, sig, sig_len);
+    goto end;
   }
 
   if (ctx->pctx->pmeth->verify_message == NULL) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE);
-    return 0;
+    goto end;
   }
 
-  return ctx->pctx->pmeth->verify_message(ctx->pctx, sig, sig_len, data, len);
+  ret = ctx->pctx->pmeth->verify_message(ctx->pctx, sig, sig_len, data, len);
+
+end:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    EVP_DigestVerify_verify_service_indicator(ctx);
+  }
+  return ret;
 }
diff --git a/src/crypto/evp/p_ec.c b/src/crypto/evp/p_ec.c
index 9767541..ddb64a4 100644
--- a/src/crypto/evp/p_ec.c
+++ b/src/crypto/evp/p_ec.c
@@ -179,18 +179,18 @@
   EC_PKEY_CTX *dctx = ctx->data;
 
   switch (type) {
-    case EVP_PKEY_CTRL_MD:
-      if (EVP_MD_type((const EVP_MD *)p2) != NID_sha1 &&
-          EVP_MD_type((const EVP_MD *)p2) != NID_ecdsa_with_SHA1 &&
-          EVP_MD_type((const EVP_MD *)p2) != NID_sha224 &&
-          EVP_MD_type((const EVP_MD *)p2) != NID_sha256 &&
-          EVP_MD_type((const EVP_MD *)p2) != NID_sha384 &&
-          EVP_MD_type((const EVP_MD *)p2) != NID_sha512) {
+    case EVP_PKEY_CTRL_MD: {
+      const EVP_MD *md = p2;
+      int md_type = EVP_MD_type(md);
+      if (md_type != NID_sha1 && md_type != NID_sha224 &&
+          md_type != NID_sha256 && md_type != NID_sha384 &&
+          md_type != NID_sha512) {
         OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_DIGEST_TYPE);
         return 0;
       }
-      dctx->md = p2;
+      dctx->md = md;
       return 1;
+    }
 
     case EVP_PKEY_CTRL_GET_MD:
       *(const EVP_MD **)p2 = dctx->md;
diff --git a/src/crypto/fipsmodule/CMakeLists.txt b/src/crypto/fipsmodule/CMakeLists.txt
index 73f8a02..b99ebc7 100644
--- a/src/crypto/fipsmodule/CMakeLists.txt
+++ b/src/crypto/fipsmodule/CMakeLists.txt
@@ -64,6 +64,8 @@
     armv8-mont.${ASM_EXT}
     ghash-neon-armv8.${ASM_EXT}
     ghashv8-armx.${ASM_EXT}
+    p256-armv8-asm.${ASM_EXT}
+    p256_beeu-armv8-asm.${ASM_EXT}
     sha1-armv8.${ASM_EXT}
     sha256-armv8.${ASM_EXT}
     sha512-armv8.${ASM_EXT}
@@ -102,6 +104,8 @@
 perlasm(md5-x86_64.${ASM_EXT} md5/asm/md5-x86_64.pl)
 perlasm(p256-x86_64-asm.${ASM_EXT} ec/asm/p256-x86_64-asm.pl)
 perlasm(p256_beeu-x86_64-asm.${ASM_EXT} ec/asm/p256_beeu-x86_64-asm.pl)
+perlasm(p256-armv8-asm.${ASM_EXT} ec/asm/p256-armv8-asm.pl)
+perlasm(p256_beeu-armv8-asm.${ASM_EXT} ec/asm/p256_beeu-armv8-asm.pl)
 perlasm(rdrand-x86_64.${ASM_EXT} rand/asm/rdrand-x86_64.pl)
 perlasm(rsaz-avx2.${ASM_EXT} bn/asm/rsaz-avx2.pl)
 perlasm(sha1-586.${ASM_EXT} sha/asm/sha1-586.pl)
diff --git a/src/crypto/fipsmodule/aes/aes_test.cc b/src/crypto/fipsmodule/aes/aes_test.cc
index eef2567..a38bf9c 100644
--- a/src/crypto/fipsmodule/aes/aes_test.cc
+++ b/src/crypto/fipsmodule/aes/aes_test.cc
@@ -559,6 +559,10 @@
 
 
 TEST(AESTest, VPAESToBSAESConvert) {
+  if (!vpaes_capable()) {
+    GTEST_SKIP();
+  }
+
   const int kNumIterations = 1000;
   for (int i = 0; i < kNumIterations; i++) {
     uint8_t key[256 / 8];
diff --git a/src/crypto/fipsmodule/aes/key_wrap.c b/src/crypto/fipsmodule/aes/key_wrap.c
index 9a5b28d..0ec5f26 100644
--- a/src/crypto/fipsmodule/aes/key_wrap.c
+++ b/src/crypto/fipsmodule/aes/key_wrap.c
@@ -55,6 +55,7 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
 
 
 // kDefaultIV is the default IV value given in RFC 3394, 2.2.3.1.
@@ -98,6 +99,7 @@
   }
 
   OPENSSL_memcpy(out, A, 8);
+  FIPS_service_indicator_update_state();
   return (int)in_len + 8;
 }
 
@@ -151,6 +153,7 @@
     return -1;
   }
 
+  FIPS_service_indicator_update_state();
   return (int)in_len - 8;
 }
 
@@ -190,12 +193,15 @@
   assert(padded_len >= 8);
   memset(padded_in + padded_len - 8, 0, 8);
   memcpy(padded_in, in, in_len);
+  FIPS_service_indicator_lock_state();
   const int ret = AES_wrap_key(key, block, out, padded_in, padded_len);
+  FIPS_service_indicator_unlock_state();
   OPENSSL_free(padded_in);
   if (ret < 0) {
     return 0;
   }
   *out_len = ret;
+  FIPS_service_indicator_update_state();
   return 1;
 }
 
@@ -232,5 +238,9 @@
   }
 
   *out_len = constant_time_select_w(ok, claimed_len, 0);
-  return ok & 1;
+  const int ret = ok & 1;
+  if (ret) {
+    FIPS_service_indicator_update_state();
+  }
+  return ret;
 }
diff --git a/src/crypto/fipsmodule/aes/mode_wrappers.c b/src/crypto/fipsmodule/aes/mode_wrappers.c
index d29fb27..10d98a6 100644
--- a/src/crypto/fipsmodule/aes/mode_wrappers.c
+++ b/src/crypto/fipsmodule/aes/mode_wrappers.c
@@ -52,6 +52,7 @@
 
 #include "../aes/internal.h"
 #include "../modes/internal.h"
+#include "../service_indicator/internal.h"
 
 
 void AES_ctr128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
@@ -74,6 +75,8 @@
     CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, ivec, ecount_buf, num,
                                 aes_nohw_ctr32_encrypt_blocks);
   }
+
+  FIPS_service_indicator_update_state();
 }
 
 void AES_ecb_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key,
@@ -86,24 +89,23 @@
   } else {
     AES_decrypt(in, out, key);
   }
+
+  FIPS_service_indicator_update_state();
 }
 
 void AES_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                      const AES_KEY *key, uint8_t *ivec, const int enc) {
   if (hwaes_capable()) {
     aes_hw_cbc_encrypt(in, out, len, key, ivec, enc);
-    return;
-  }
-
-  if (!vpaes_capable()) {
+  } else if (!vpaes_capable()) {
     aes_nohw_cbc_encrypt(in, out, len, key, ivec, enc);
-    return;
-  }
-  if (enc) {
+  } else if (enc) {
     CRYPTO_cbc128_encrypt(in, out, len, key, ivec, AES_encrypt);
   } else {
     CRYPTO_cbc128_decrypt(in, out, len, key, ivec, AES_decrypt);
   }
+
+  FIPS_service_indicator_update_state();
 }
 
 void AES_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t length,
diff --git a/src/crypto/fipsmodule/bcm.c b/src/crypto/fipsmodule/bcm.c
index faff6c4..cc80b51 100644
--- a/src/crypto/fipsmodule/bcm.c
+++ b/src/crypto/fipsmodule/bcm.c
@@ -58,6 +58,8 @@
 #include "cipher/aead.c"
 #include "cipher/cipher.c"
 #include "cipher/e_aes.c"
+#include "cipher/e_aesccm.c"
+#include "cmac/cmac.c"
 #include "dh/check.c"
 #include "dh/dh.c"
 #include "digest/digest.c"
@@ -71,7 +73,7 @@
 #include "ec/oct.c"
 #include "ec/p224-64.c"
 #include "ec/p256.c"
-#include "ec/p256-x86_64.c"
+#include "ec/p256-nistz.c"
 #include "ec/scalar.c"
 #include "ec/simple.c"
 #include "ec/simple_mul.c"
@@ -97,6 +99,7 @@
 #include "rsa/rsa_impl.c"
 #include "self_check/fips.c"
 #include "self_check/self_check.c"
+#include "service_indicator/service_indicator.c"
 #include "sha/sha1-altivec.c"
 #include "sha/sha1.c"
 #include "sha/sha256.c"
@@ -210,21 +213,12 @@
   assert_within(rodata_start, kP256Params, rodata_end);
   assert_within(rodata_start, kPKCS1SigPrefixes, rodata_end);
 
-#if defined(OPENSSL_AARCH64) || defined(OPENSSL_ANDROID)
   uint8_t result[SHA256_DIGEST_LENGTH];
   const EVP_MD *const kHashFunction = EVP_sha256();
   if (!boringssl_self_test_sha256() ||
       !boringssl_self_test_hmac_sha256()) {
     return 0;
   }
-#else
-  uint8_t result[SHA512_DIGEST_LENGTH];
-  const EVP_MD *const kHashFunction = EVP_sha512();
-  if (!boringssl_self_test_sha512() ||
-      !boringssl_self_test_hmac_sha256()) {
-    return 0;
-  }
-#endif
 
   static const uint8_t kHMACKey[64] = {0};
   unsigned result_len;
diff --git a/src/crypto/fipsmodule/bn/bytes.c b/src/crypto/fipsmodule/bn/bytes.c
index 56241e3..38d71a3 100644
--- a/src/crypto/fipsmodule/bn/bytes.c
+++ b/src/crypto/fipsmodule/bn/bytes.c
@@ -61,19 +61,38 @@
 
 #include "internal.h"
 
+void bn_big_endian_to_words(BN_ULONG *out, size_t out_len, const uint8_t *in,
+                            size_t in_len) {
+  for (size_t i = 0; i < out_len; i++) {
+    if (in_len < sizeof(BN_ULONG)) {
+      // Load the last partial word.
+      BN_ULONG word = 0;
+      for (size_t j = 0; j < in_len; j++) {
+        word = (word << 8) | in[j];
+      }
+      in_len = 0;
+      out[i] = word;
+      // Fill the remainder with zeros.
+      OPENSSL_memset(out + i + 1, 0, (out_len - i - 1) * sizeof(BN_ULONG));
+      break;
+    }
 
-BIGNUM *BN_bin2bn(const uint8_t *in, size_t len, BIGNUM *ret) {
-  size_t num_words;
-  unsigned m;
-  BN_ULONG word = 0;
-  BIGNUM *bn = NULL;
-
-  if (ret == NULL) {
-    ret = bn = BN_new();
+    in_len -= sizeof(BN_ULONG);
+    out[i] = CRYPTO_load_word_be(in + in_len);
   }
 
+  // The caller should have sized the output to avoid truncation.
+  assert(in_len == 0);
+}
+
+BIGNUM *BN_bin2bn(const uint8_t *in, size_t len, BIGNUM *ret) {
+  BIGNUM *bn = NULL;
   if (ret == NULL) {
-    return NULL;
+    bn = BN_new();
+    if (bn == NULL) {
+      return NULL;
+    }
+    ret = bn;
   }
 
   if (len == 0) {
@@ -81,12 +100,9 @@
     return ret;
   }
 
-  num_words = ((len - 1) / BN_BYTES) + 1;
-  m = (len - 1) % BN_BYTES;
+  size_t num_words = ((len - 1) / BN_BYTES) + 1;
   if (!bn_wexpand(ret, num_words)) {
-    if (bn) {
-      BN_free(bn);
-    }
+    BN_free(bn);
     return NULL;
   }
 
@@ -96,15 +112,7 @@
   ret->width = (int)num_words;
   ret->neg = 0;
 
-  while (len--) {
-    word = (word << 8) | *(in++);
-    if (m-- == 0) {
-      ret->d[--num_words] = word;
-      word = 0;
-      m = BN_BYTES - 1;
-    }
-  }
-
+  bn_big_endian_to_words(ret->d, ret->width, in, len);
   return ret;
 }
 
@@ -112,13 +120,12 @@
   BIGNUM *bn = NULL;
   if (ret == NULL) {
     bn = BN_new();
+    if (bn == NULL) {
+      return NULL;
+    }
     ret = bn;
   }
 
-  if (ret == NULL) {
-    return NULL;
-  }
-
   if (len == 0) {
     ret->width = 0;
     ret->neg = 0;
@@ -142,38 +149,58 @@
   return ret;
 }
 
-size_t BN_bn2bin(const BIGNUM *in, uint8_t *out) {
-  size_t n, i;
-  BN_ULONG l;
-
-  n = i = BN_num_bytes(in);
-  while (i--) {
-    l = in->d[i / BN_BYTES];
-    *(out++) = (unsigned char)(l >> (8 * (i % BN_BYTES))) & 0xff;
-  }
-  return n;
-}
-
-static int fits_in_bytes(const uint8_t *bytes, size_t num_bytes, size_t len) {
+// fits_in_bytes returns one if the |num_words| words in |words| can be
+// represented in |num_bytes| bytes.
+static int fits_in_bytes(const BN_ULONG *words, size_t num_words,
+                         size_t num_bytes) {
+  const uint8_t *bytes = (const uint8_t *)words;
+  size_t tot_bytes = num_words * sizeof(BN_ULONG);
   uint8_t mask = 0;
-  for (size_t i = len; i < num_bytes; i++) {
+  for (size_t i = num_bytes; i < tot_bytes; i++) {
     mask |= bytes[i];
   }
   return mask == 0;
 }
 
+void bn_words_to_big_endian(uint8_t *out, size_t out_len, const BN_ULONG *in,
+                            size_t in_len) {
+  // The caller should have selected an output length without truncation.
+  assert(fits_in_bytes(in, in_len, out_len));
+
+  // We only support little-endian platforms, so the internal representation is
+  // also little-endian as bytes. We can simply copy it in reverse.
+  const uint8_t *bytes = (const uint8_t *)in;
+  size_t num_bytes = in_len * sizeof(BN_ULONG);
+  if (out_len < num_bytes) {
+    num_bytes = out_len;
+  }
+
+  for (size_t i = 0; i < num_bytes; i++) {
+    out[out_len - i - 1] = bytes[i];
+  }
+  // Pad out the rest of the buffer with zeroes.
+  OPENSSL_memset(out, 0, out_len - num_bytes);
+}
+
+size_t BN_bn2bin(const BIGNUM *in, uint8_t *out) {
+  size_t n = BN_num_bytes(in);
+  bn_words_to_big_endian(out, n, in->d, in->width);
+  return n;
+}
+
 int BN_bn2le_padded(uint8_t *out, size_t len, const BIGNUM *in) {
-  const uint8_t *bytes = (const uint8_t *)in->d;
-  size_t num_bytes = in->width * BN_BYTES;
-  if (len < num_bytes) {
-    if (!fits_in_bytes(bytes, num_bytes, len)) {
-      return 0;
-    }
-    num_bytes = len;
+  if (!fits_in_bytes(in->d, in->width, len)) {
+    return 0;
   }
 
   // We only support little-endian platforms, so we can simply memcpy into the
   // internal representation.
+  const uint8_t *bytes = (const uint8_t *)in->d;
+  size_t num_bytes = in->width * BN_BYTES;
+  if (len < num_bytes) {
+    num_bytes = len;
+  }
+
   OPENSSL_memcpy(out, bytes, num_bytes);
   // Pad out the rest of the buffer with zeroes.
   OPENSSL_memset(out + num_bytes, 0, len - num_bytes);
@@ -181,22 +208,11 @@
 }
 
 int BN_bn2bin_padded(uint8_t *out, size_t len, const BIGNUM *in) {
-  const uint8_t *bytes = (const uint8_t *)in->d;
-  size_t num_bytes = in->width * BN_BYTES;
-  if (len < num_bytes) {
-    if (!fits_in_bytes(bytes, num_bytes, len)) {
-      return 0;
-    }
-    num_bytes = len;
+  if (!fits_in_bytes(in->d, in->width, len)) {
+    return 0;
   }
 
-  // We only support little-endian platforms, so we can simply write the buffer
-  // in reverse.
-  for (size_t i = 0; i < num_bytes; i++) {
-    out[len - i - 1] = bytes[i];
-  }
-  // Pad out the rest of the buffer with zeroes.
-  OPENSSL_memset(out, 0, len - num_bytes);
+  bn_words_to_big_endian(out, len, in->d, in->width);
   return 1;
 }
 
diff --git a/src/crypto/fipsmodule/bn/internal.h b/src/crypto/fipsmodule/bn/internal.h
index cab9a81..d6eb684 100644
--- a/src/crypto/fipsmodule/bn/internal.h
+++ b/src/crypto/fipsmodule/bn/internal.h
@@ -708,6 +708,25 @@
                                       size_t num, const BN_MONT_CTX *mont);
 
 
+// Word-based byte conversion functions.
+
+// bn_big_endian_to_words interprets |in_len| bytes from |in| as a big-endian,
+// unsigned integer and writes the result to |out_len| words in |out|. |out_len|
+// must be large enough to represent any |in_len|-byte value. That is, |out_len|
+// must be at least |BN_BYTES * in_len|.
+void bn_big_endian_to_words(BN_ULONG *out, size_t out_len, const uint8_t *in,
+                            size_t in_len);
+
+// bn_words_to_big_endian represents |in_len| words from |in| as a big-endian,
+// unsigned integer in |out_len| bytes. It writes the result to |out|. |out_len|
+// must be large enough to represent |in| without truncation.
+//
+// Note |out_len| may be less than |BN_BYTES * in_len| if |in| is known to have
+// leading zeros.
+void bn_words_to_big_endian(uint8_t *out, size_t out_len, const BN_ULONG *in,
+                            size_t in_len);
+
+
 #if defined(__cplusplus)
 }  // extern C
 #endif
diff --git a/src/crypto/fipsmodule/bn/random.c b/src/crypto/fipsmodule/bn/random.c
index f6812f1..36ad679 100644
--- a/src/crypto/fipsmodule/bn/random.c
+++ b/src/crypto/fipsmodule/bn/random.c
@@ -115,9 +115,10 @@
 #include <openssl/rand.h>
 #include <openssl/type_check.h>
 
-#include "internal.h"
 #include "../../internal.h"
 #include "../rand/internal.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
 
 
 int BN_rand(BIGNUM *rnd, int bits, int top, int bottom) {
@@ -155,7 +156,10 @@
     return 0;
   }
 
+  FIPS_service_indicator_lock_state();
   RAND_bytes((uint8_t *)rnd->d, words * sizeof(BN_ULONG));
+  FIPS_service_indicator_unlock_state();
+
   rnd->d[words - 1] &= mask;
   if (top != BN_RAND_TOP_ANY) {
     if (top == BN_RAND_TOP_TWO && bits > 1) {
@@ -270,8 +274,10 @@
 
     // Steps 4 and 5. Use |words| and |mask| together to obtain a string of N
     // bits, where N is the bit length of |max_exclusive|.
+    FIPS_service_indicator_lock_state();
     RAND_bytes_with_additional_data((uint8_t *)out, words * sizeof(BN_ULONG),
                                     additional_data);
+    FIPS_service_indicator_unlock_state();
     out[words - 1] &= mask;
 
     // If out >= max_exclusive or out < min_inclusive, retry. This implements
@@ -313,7 +319,9 @@
   }
 
   // Select a uniform random number with num_bits(max_exclusive) bits.
+  FIPS_service_indicator_lock_state();
   RAND_bytes((uint8_t *)r->d, words * sizeof(BN_ULONG));
+  FIPS_service_indicator_unlock_state();
   r->d[words - 1] &= mask;
 
   // Check, in constant-time, if the value is in range.
diff --git a/src/crypto/fipsmodule/cipher/cipher.c b/src/crypto/fipsmodule/cipher/cipher.c
index 64ee544..a126986 100644
--- a/src/crypto/fipsmodule/cipher/cipher.c
+++ b/src/crypto/fipsmodule/cipher/cipher.c
@@ -65,6 +65,7 @@
 #include <openssl/nid.h>
 
 #include "internal.h"
+#include "../service_indicator/internal.h"
 #include "../../internal.h"
 
 
@@ -322,24 +323,26 @@
 }
 
 int EVP_EncryptFinal_ex(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len) {
-  int n, ret;
+  int n;
   unsigned int i, b, bl;
 
   if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {
-    ret = ctx->cipher->cipher(ctx, out, NULL, 0);
-    if (ret < 0) {
+    // When EVP_CIPH_FLAG_CUSTOM_CIPHER is set, the return value of |cipher| is
+    // the number of bytes written, or -1 on error. Otherwise the return value
+    // is one on success and zero on error.
+    const int num_bytes = ctx->cipher->cipher(ctx, out, NULL, 0);
+    if (num_bytes < 0) {
       return 0;
-    } else {
-      *out_len = ret;
     }
-    return 1;
+    *out_len = num_bytes;
+    goto out;
   }
 
   b = ctx->cipher->block_size;
   assert(b <= sizeof(ctx->buf));
   if (b == 1) {
     *out_len = 0;
-    return 1;
+    goto out;
   }
 
   bl = ctx->buf_len;
@@ -349,20 +352,21 @@
       return 0;
     }
     *out_len = 0;
-    return 1;
+    goto out;
   }
 
   n = b - bl;
   for (i = bl; i < b; i++) {
     ctx->buf[i] = n;
   }
-  ret = ctx->cipher->cipher(ctx, out, ctx->buf, b);
-
-  if (ret) {
-    *out_len = b;
+  if (!ctx->cipher->cipher(ctx, out, ctx->buf, b)) {
+    return 0;
   }
+  *out_len = b;
 
-  return ret;
+out:
+  EVP_Cipher_verify_service_indicator(ctx);
+  return 1;
 }
 
 int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len,
@@ -436,7 +440,7 @@
     } else {
       *out_len = i;
     }
-    return 1;
+    goto out;
   }
 
   b = ctx->cipher->block_size;
@@ -446,7 +450,7 @@
       return 0;
     }
     *out_len = 0;
-    return 1;
+    goto out;
   }
 
   if (b > 1) {
@@ -480,12 +484,30 @@
     *out_len = 0;
   }
 
+out:
+  EVP_Cipher_verify_service_indicator(ctx);
   return 1;
 }
 
 int EVP_Cipher(EVP_CIPHER_CTX *ctx, uint8_t *out, const uint8_t *in,
                size_t in_len) {
-  return ctx->cipher->cipher(ctx, out, in, in_len);
+  const int ret = ctx->cipher->cipher(ctx, out, in, in_len);
+
+  // |EVP_CIPH_FLAG_CUSTOM_CIPHER| never sets the FIPS indicator via
+  // |EVP_Cipher| because it's complicated whether the operation has completed
+  // or not. E.g. AES-GCM with a non-NULL |in| argument hasn't completed an
+  // operation. Callers should use the |EVP_AEAD| API or, at least,
+  // |EVP_CipherUpdate| etc.
+  //
+  // This call can't be pushed into |EVP_Cipher_verify_service_indicator|
+  // because whether |ret| indicates success or not depends on whether
+  // |EVP_CIPH_FLAG_CUSTOM_CIPHER| is set. (This unreasonable, but matches
+  // OpenSSL.)
+  if (!(ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) && ret) {
+    EVP_Cipher_verify_service_indicator(ctx);
+  }
+
+  return ret;
 }
 
 int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len,
diff --git a/src/crypto/fipsmodule/cipher/e_aes.c b/src/crypto/fipsmodule/cipher/e_aes.c
index 7e7c1a8..ec441e8 100644
--- a/src/crypto/fipsmodule/cipher/e_aes.c
+++ b/src/crypto/fipsmodule/cipher/e_aes.c
@@ -61,6 +61,7 @@
 #include "../../internal.h"
 #include "../aes/internal.h"
 #include "../modes/internal.h"
+#include "../service_indicator/internal.h"
 #include "../delocate.h"
 
 
@@ -485,8 +486,13 @@
       if (arg) {
         OPENSSL_memcpy(gctx->iv, ptr, arg);
       }
-      if (c->encrypt && !RAND_bytes(gctx->iv + arg, gctx->ivlen - arg)) {
-        return 0;
+      if (c->encrypt) {
+        // |RAND_bytes| calls within the fipsmodule should be wrapped with state
+        // lock functions to avoid updating the service indicator with the DRBG
+        // functions.
+        FIPS_service_indicator_lock_state();
+        RAND_bytes(gctx->iv + arg, gctx->ivlen - arg);
+        FIPS_service_indicator_unlock_state();
       }
       gctx->iv_gen = 1;
       return 1;
@@ -1099,9 +1105,14 @@
                                     const uint8_t *in_tag, size_t in_tag_len,
                                     const uint8_t *ad, size_t ad_len) {
   struct aead_aes_gcm_ctx *gcm_ctx = (struct aead_aes_gcm_ctx *)&ctx->state;
-  return aead_aes_gcm_open_gather_impl(gcm_ctx, out, nonce, nonce_len, in,
-                                       in_len, in_tag, in_tag_len, ad, ad_len,
-                                       ctx->tag_len);
+  if (!aead_aes_gcm_open_gather_impl(gcm_ctx, out, nonce, nonce_len, in, in_len,
+                                     in_tag, in_tag_len, ad, ad_len,
+                                     ctx->tag_len)) {
+    return 0;
+  }
+
+  AEAD_GCM_verify_service_indicator(ctx);
+  return 1;
 }
 
 DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm) {
@@ -1186,7 +1197,12 @@
     return 0;
   }
 
+  // |RAND_bytes| calls within the fipsmodule should be wrapped with state lock
+  // functions to avoid updating the service indicator with the DRBG functions.
+  FIPS_service_indicator_lock_state();
   RAND_bytes(nonce, sizeof(nonce));
+  FIPS_service_indicator_unlock_state();
+
   const struct aead_aes_gcm_ctx *gcm_ctx =
       (const struct aead_aes_gcm_ctx *)&ctx->state;
   if (!aead_aes_gcm_seal_scatter_impl(gcm_ctx, out, out_tag, out_tag_len,
@@ -1201,6 +1217,7 @@
   memcpy(out_tag + *out_tag_len, nonce, sizeof(nonce));
   *out_tag_len += sizeof(nonce);
 
+  AEAD_GCM_verify_service_indicator(ctx);
   return 1;
 }
 
@@ -1223,10 +1240,15 @@
 
   const struct aead_aes_gcm_ctx *gcm_ctx =
       (const struct aead_aes_gcm_ctx *)&ctx->state;
-  return aead_aes_gcm_open_gather_impl(
+  if (!aead_aes_gcm_open_gather_impl(
       gcm_ctx, out, nonce, AES_GCM_NONCE_LENGTH, in, in_len, in_tag,
       in_tag_len - AES_GCM_NONCE_LENGTH, ad, ad_len,
-      ctx->tag_len - AES_GCM_NONCE_LENGTH);
+      ctx->tag_len - AES_GCM_NONCE_LENGTH)) {
+    return 0;
+  }
+
+  AEAD_GCM_verify_service_indicator(ctx);
+  return 1;
 }
 
 DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_randnonce) {
@@ -1316,9 +1338,14 @@
 
   gcm_ctx->min_next_nonce = given_counter + 1;
 
-  return aead_aes_gcm_seal_scatter(ctx, out, out_tag, out_tag_len,
-                                   max_out_tag_len, nonce, nonce_len, in,
-                                   in_len, extra_in, extra_in_len, ad, ad_len);
+  if (!aead_aes_gcm_seal_scatter(ctx, out, out_tag, out_tag_len,
+                                 max_out_tag_len, nonce, nonce_len, in, in_len,
+                                 extra_in, extra_in_len, ad, ad_len)) {
+    return 0;
+  }
+
+  AEAD_GCM_verify_service_indicator(ctx);
+  return 1;
 }
 
 DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_tls12) {
@@ -1422,9 +1449,14 @@
 
   gcm_ctx->min_next_nonce = given_counter + 1;
 
-  return aead_aes_gcm_seal_scatter(ctx, out, out_tag, out_tag_len,
-                                   max_out_tag_len, nonce, nonce_len, in,
-                                   in_len, extra_in, extra_in_len, ad, ad_len);
+  if (!aead_aes_gcm_seal_scatter(ctx, out, out_tag, out_tag_len,
+                                 max_out_tag_len, nonce, nonce_len, in, in_len,
+                                 extra_in, extra_in_len, ad, ad_len)) {
+    return 0;
+  }
+
+  AEAD_GCM_verify_service_indicator(ctx);
+  return 1;
 }
 
 DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_tls13) {
diff --git a/src/crypto/cipher_extra/e_aesccm.c b/src/crypto/fipsmodule/cipher/e_aesccm.c
similarity index 92%
rename from src/crypto/cipher_extra/e_aesccm.c
rename to src/crypto/fipsmodule/cipher/e_aesccm.c
index 844b9b9..8fb72cb 100644
--- a/src/crypto/cipher_extra/e_aesccm.c
+++ b/src/crypto/fipsmodule/cipher/e_aesccm.c
@@ -54,7 +54,8 @@
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
-#include "../fipsmodule/cipher/internal.h"
+#include "internal.h"
+#include "../service_indicator/internal.h"
 
 
 struct ccm128_context {
@@ -350,6 +351,7 @@
   }
 
   *out_tag_len = ctx->tag_len;
+  AEAD_CCM_verify_service_indicator(ctx);
   return 1;
 }
 
@@ -390,6 +392,7 @@
     return 0;
   }
 
+  AEAD_CCM_verify_service_indicator(ctx);
   return 1;
 }
 
@@ -398,25 +401,18 @@
   return aead_aes_ccm_init(ctx, key, key_len, tag_len, 4, 2);
 }
 
-static const EVP_AEAD aead_aes_128_ccm_bluetooth = {
-    16,  // key length (AES-128)
-    13,  // nonce length
-    4,   // overhead
-    4,   // max tag length
-    0,   // seal_scatter_supports_extra_in
+DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_ccm_bluetooth) {
+  memset(out, 0, sizeof(EVP_AEAD));
 
-    aead_aes_ccm_bluetooth_init,
-    NULL /* init_with_direction */,
-    aead_aes_ccm_cleanup,
-    NULL /* open */,
-    aead_aes_ccm_seal_scatter,
-    aead_aes_ccm_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
-};
+  out->key_len = 16;
+  out->nonce_len = 13;
+  out->overhead = 4;
+  out->max_tag_len = 4;
 
-const EVP_AEAD *EVP_aead_aes_128_ccm_bluetooth(void) {
-  return &aead_aes_128_ccm_bluetooth;
+  out->init = aead_aes_ccm_bluetooth_init;
+  out->cleanup = aead_aes_ccm_cleanup;
+  out->seal_scatter = aead_aes_ccm_seal_scatter;
+  out->open_gather = aead_aes_ccm_open_gather;
 }
 
 static int aead_aes_ccm_bluetooth_8_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
@@ -424,23 +420,16 @@
   return aead_aes_ccm_init(ctx, key, key_len, tag_len, 8, 2);
 }
 
-static const EVP_AEAD aead_aes_128_ccm_bluetooth_8 = {
-    16,  // key length (AES-128)
-    13,  // nonce length
-    8,   // overhead
-    8,   // max tag length
-    0,   // seal_scatter_supports_extra_in
+DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_ccm_bluetooth_8) {
+  memset(out, 0, sizeof(EVP_AEAD));
 
-    aead_aes_ccm_bluetooth_8_init,
-    NULL /* init_with_direction */,
-    aead_aes_ccm_cleanup,
-    NULL /* open */,
-    aead_aes_ccm_seal_scatter,
-    aead_aes_ccm_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
-};
+  out->key_len = 16;
+  out->nonce_len = 13;
+  out->overhead = 8;
+  out->max_tag_len = 8;
 
-const EVP_AEAD *EVP_aead_aes_128_ccm_bluetooth_8(void) {
-  return &aead_aes_128_ccm_bluetooth_8;
+  out->init = aead_aes_ccm_bluetooth_8_init;
+  out->cleanup = aead_aes_ccm_cleanup;
+  out->seal_scatter = aead_aes_ccm_seal_scatter;
+  out->open_gather = aead_aes_ccm_open_gather;
 }
diff --git a/src/crypto/cmac/cavp_3des_cmac_tests.txt b/src/crypto/fipsmodule/cmac/cavp_3des_cmac_tests.txt
similarity index 100%
rename from src/crypto/cmac/cavp_3des_cmac_tests.txt
rename to src/crypto/fipsmodule/cmac/cavp_3des_cmac_tests.txt
diff --git a/src/crypto/cmac/cavp_aes128_cmac_tests.txt b/src/crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt
similarity index 100%
rename from src/crypto/cmac/cavp_aes128_cmac_tests.txt
rename to src/crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt
diff --git a/src/crypto/cmac/cavp_aes192_cmac_tests.txt b/src/crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt
similarity index 100%
rename from src/crypto/cmac/cavp_aes192_cmac_tests.txt
rename to src/crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt
diff --git a/src/crypto/cmac/cavp_aes256_cmac_tests.txt b/src/crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt
similarity index 100%
rename from src/crypto/cmac/cavp_aes256_cmac_tests.txt
rename to src/crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt
diff --git a/src/crypto/cmac/cmac.c b/src/crypto/fipsmodule/cmac/cmac.c
similarity index 85%
rename from src/crypto/cmac/cmac.c
rename to src/crypto/fipsmodule/cmac/cmac.c
index b6a10f7..f5c805d 100644
--- a/src/crypto/cmac/cmac.c
+++ b/src/crypto/fipsmodule/cmac/cmac.c
@@ -55,7 +55,8 @@
 #include <openssl/cipher.h>
 #include <openssl/mem.h>
 
-#include "../internal.h"
+#include "../../internal.h"
+#include "../service_indicator/internal.h"
 
 
 struct cmac_ctx_st {
@@ -85,6 +86,8 @@
              const uint8_t *in, size_t in_len) {
   const EVP_CIPHER *cipher;
   switch (key_len) {
+    // WARNING: this code assumes that all supported key sizes are FIPS
+    // Approved.
     case 16:
       cipher = EVP_aes_128_cbc();
       break;
@@ -99,10 +102,17 @@
   CMAC_CTX ctx;
   CMAC_CTX_init(&ctx);
 
+  // We have to verify that all the CMAC services actually succeed before
+  // updating the indicator state, so we lock the state here.
+  FIPS_service_indicator_lock_state();
   const int ok = CMAC_Init(&ctx, key, key_len, cipher, NULL /* engine */) &&
                  CMAC_Update(&ctx, in, in_len) &&
                  CMAC_Final(&ctx, out, &scratch_out_len);
+  FIPS_service_indicator_unlock_state();
 
+  if (ok) {
+    FIPS_service_indicator_update_state();
+  }
   CMAC_CTX_cleanup(&ctx);
   return ok;
 }
@@ -173,8 +183,13 @@
 
 int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t key_len,
               const EVP_CIPHER *cipher, ENGINE *engine) {
+  int ret = 0;
   uint8_t scratch[AES_BLOCK_SIZE];
 
+  // We have to avoid the underlying AES-CBC |EVP_CIPHER| services updating the
+  // indicator state, so we lock the state here.
+  FIPS_service_indicator_lock_state();
+
   size_t block_size = EVP_CIPHER_block_size(cipher);
   if ((block_size != AES_BLOCK_SIZE && block_size != 8 /* 3-DES */) ||
       EVP_CIPHER_key_length(cipher) != key_len ||
@@ -182,7 +197,7 @@
       !EVP_Cipher(&ctx->cipher_ctx, scratch, kZeroIV, block_size) ||
       // Reset context again ready for first data.
       !EVP_EncryptInit_ex(&ctx->cipher_ctx, NULL, NULL, NULL, kZeroIV)) {
-    return 0;
+    goto out;
   }
 
   if (block_size == AES_BLOCK_SIZE) {
@@ -193,8 +208,11 @@
     binary_field_mul_x_64(ctx->k2, ctx->k1);
   }
   ctx->block_used = 0;
+  ret = 1;
 
-  return 1;
+out:
+  FIPS_service_indicator_unlock_state();
+  return ret;
 }
 
 int CMAC_Reset(CMAC_CTX *ctx) {
@@ -203,6 +221,12 @@
 }
 
 int CMAC_Update(CMAC_CTX *ctx, const uint8_t *in, size_t in_len) {
+  int ret = 0;
+
+  // We have to avoid the underlying AES-CBC |EVP_Cipher| services updating the
+  // indicator state, so we lock the state here.
+  FIPS_service_indicator_lock_state();
+
   size_t block_size = EVP_CIPHER_CTX_block_size(&ctx->cipher_ctx);
   assert(block_size <= AES_BLOCK_SIZE);
   uint8_t scratch[AES_BLOCK_SIZE];
@@ -224,20 +248,21 @@
     // case we don't want to process this block now because it might be the last
     // block and that block is treated specially.
     if (in_len == 0) {
-      return 1;
+      ret = 1;
+      goto out;
     }
 
     assert(ctx->block_used == block_size);
 
     if (!EVP_Cipher(&ctx->cipher_ctx, scratch, ctx->block, block_size)) {
-      return 0;
+      goto out;
     }
   }
 
   // Encrypt all but one of the remaining blocks.
   while (in_len > block_size) {
     if (!EVP_Cipher(&ctx->cipher_ctx, scratch, in, block_size)) {
-      return 0;
+      goto out;
     }
     in += block_size;
     in_len -= block_size;
@@ -245,17 +270,26 @@
 
   OPENSSL_memcpy(ctx->block, in, in_len);
   ctx->block_used = in_len;
+  ret = 1;
 
-  return 1;
+out:
+  FIPS_service_indicator_unlock_state();
+  return ret;
 }
 
 int CMAC_Final(CMAC_CTX *ctx, uint8_t *out, size_t *out_len) {
+  int ret = 0;
   size_t block_size = EVP_CIPHER_CTX_block_size(&ctx->cipher_ctx);
   assert(block_size <= AES_BLOCK_SIZE);
 
+  // We have to avoid the underlying AES-CBC |EVP_Cipher| services updating the
+  // indicator state, so we lock the state here.
+  FIPS_service_indicator_lock_state();
+
   *out_len = block_size;
   if (out == NULL) {
-    return 1;
+    ret = 1;
+    goto out;
   }
 
   const uint8_t *mask = ctx->k1;
@@ -273,6 +307,12 @@
   for (unsigned i = 0; i < block_size; i++) {
     out[i] = ctx->block[i] ^ mask[i];
   }
+  ret = EVP_Cipher(&ctx->cipher_ctx, out, out, block_size);
 
-  return EVP_Cipher(&ctx->cipher_ctx, out, out, block_size);
+out:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    FIPS_service_indicator_update_state();
+  }
+  return ret;
 }
diff --git a/src/crypto/cmac/cmac_test.cc b/src/crypto/fipsmodule/cmac/cmac_test.cc
similarity index 94%
rename from src/crypto/cmac/cmac_test.cc
rename to src/crypto/fipsmodule/cmac/cmac_test.cc
index e8a220a..9e3744e 100644
--- a/src/crypto/cmac/cmac_test.cc
+++ b/src/crypto/fipsmodule/cmac/cmac_test.cc
@@ -23,9 +23,9 @@
 #include <openssl/cmac.h>
 #include <openssl/mem.h>
 
-#include "../test/file_test.h"
-#include "../test/test_util.h"
-#include "../test/wycheproof_util.h"
+#include "../../test/file_test.h"
+#include "../../test/test_util.h"
+#include "../../test/wycheproof_util.h"
 
 
 static void test(const char *name, const uint8_t *key, size_t key_len,
@@ -248,20 +248,21 @@
 }
 
 TEST(CMACTest, CAVPAES128) {
-  RunCAVPTest("crypto/cmac/cavp_aes128_cmac_tests.txt", EVP_aes_128_cbc(),
-              false);
+  RunCAVPTest("crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt",
+              EVP_aes_128_cbc(), false);
 }
 
 TEST(CMACTest, CAVPAES192) {
-  RunCAVPTest("crypto/cmac/cavp_aes192_cmac_tests.txt", EVP_aes_192_cbc(),
-              false);
+  RunCAVPTest("crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt",
+              EVP_aes_192_cbc(), false);
 }
 
 TEST(CMACTest, CAVPAES256) {
-  RunCAVPTest("crypto/cmac/cavp_aes256_cmac_tests.txt", EVP_aes_256_cbc(),
-              false);
+  RunCAVPTest("crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt",
+              EVP_aes_256_cbc(), false);
 }
 
 TEST(CMACTest, CAVP3DES) {
-  RunCAVPTest("crypto/cmac/cavp_3des_cmac_tests.txt", EVP_des_ede3_cbc(), true);
+  RunCAVPTest("crypto/fipsmodule/cmac/cavp_3des_cmac_tests.txt",
+              EVP_des_ede3_cbc(), true);
 }
diff --git a/src/crypto/fipsmodule/dh/dh.c b/src/crypto/fipsmodule/dh/dh.c
index b59afc6..8b04117 100644
--- a/src/crypto/fipsmodule/dh/dh.c
+++ b/src/crypto/fipsmodule/dh/dh.c
@@ -64,9 +64,10 @@
 #include <openssl/mem.h>
 #include <openssl/thread.h>
 
-#include "internal.h"
 #include "../../internal.h"
 #include "../bn/internal.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
 
 
 #define OPENSSL_DH_MAX_MODULUS_BITS 10000
@@ -383,6 +384,8 @@
     return 0;
   }
 
+  FIPS_service_indicator_lock_state();
+
   int ret = 0;
   const size_t dh_len = DH_size(dh);
   uint8_t *shared_bytes = OPENSSL_malloc(dh_len);
@@ -404,6 +407,7 @@
   ret = 1;
 
  err:
+  FIPS_service_indicator_unlock_state();
   OPENSSL_free(shared_bytes);
   return ret;
 }
diff --git a/src/crypto/fipsmodule/ec/asm/p256-armv8-asm.pl b/src/crypto/fipsmodule/ec/asm/p256-armv8-asm.pl
new file mode 100644
index 0000000..f2926b8
--- /dev/null
+++ b/src/crypto/fipsmodule/ec/asm/p256-armv8-asm.pl
@@ -0,0 +1,1702 @@
+#! /usr/bin/env perl
+# Copyright 2015-2020 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the OpenSSL license (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+
+# ====================================================================
+# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+# project. The module is, however, dual licensed under OpenSSL and
+# CRYPTOGAMS licenses depending on where you obtain it. For further
+# details see http://www.openssl.org/~appro/cryptogams/.
+# ====================================================================
+#
+# ECP_NISTZ256 module for ARMv8.
+#
+# February 2015.
+#
+# Original ECP_NISTZ256 submission targeting x86_64 is detailed in
+# http://eprint.iacr.org/2013/816.
+#
+#			with/without -DECP_NISTZ256_ASM
+# Apple A7		+190-360%
+# Cortex-A53		+190-400%
+# Cortex-A57		+190-350%
+# Denver		+230-400%
+#
+# Ranges denote minimum and maximum improvement coefficients depending
+# on benchmark. Lower coefficients are for ECDSA sign, server-side
+# operation. Keep in mind that +400% means 5x improvement.
+
+# The first two arguments should always be the flavour and output file path.
+if ($#ARGV < 1) { die "Not enough arguments provided.
+  Two arguments are necessary: the flavour and the output file path."; }
+
+$flavour = shift;
+$output = shift;
+
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}../../../perlasm/arm-xlate.pl" and -f $xlate) or
+die "can't locate arm-xlate.pl";
+
+open OUT,"| \"$^X\" $xlate $flavour $output";
+*STDOUT=*OUT;
+
+{
+my ($rp,$ap,$bp,$bi,$a0,$a1,$a2,$a3,$t0,$t1,$t2,$t3,$poly1,$poly3,
+    $acc0,$acc1,$acc2,$acc3,$acc4,$acc5) =
+    map("x$_",(0..17,19,20));
+
+my ($acc6,$acc7)=($ap,$bp);	# used in __ecp_nistz256_sqr_mont
+
+$code.=<<___;
+#include "openssl/arm_arch.h"
+
+.text
+.align	5
+.Lpoly:
+.quad	0xffffffffffffffff,0x00000000ffffffff,0x0000000000000000,0xffffffff00000001
+.LRR:	// 2^512 mod P precomputed for NIST P256 polynomial
+.quad	0x0000000000000003,0xfffffffbffffffff,0xfffffffffffffffe,0x00000004fffffffd
+.Lone_mont:
+.quad	0x0000000000000001,0xffffffff00000000,0xffffffffffffffff,0x00000000fffffffe
+.Lone:
+.quad	1,0,0,0
+.Lord:
+.quad	0xf3b9cac2fc632551,0xbce6faada7179e84,0xffffffffffffffff,0xffffffff00000000
+.LordK:
+.quad	0xccd1c8aaee00bc4f
+.asciz	"ECP_NISTZ256 for ARMv8, CRYPTOGAMS by <appro\@openssl.org>"
+
+// void	ecp_nistz256_to_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_to_mont
+.type	ecp_nistz256_to_mont,%function
+.align	6
+ecp_nistz256_to_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	$bi,.LRR		// bp[0]
+	ldp	$a0,$a1,[$ap]
+	ldp	$a2,$a3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+	adr	$bp,.LRR		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_to_mont,.-ecp_nistz256_to_mont
+
+// void	ecp_nistz256_from_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_from_mont
+.type	ecp_nistz256_from_mont,%function
+.align	4
+ecp_nistz256_from_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	mov	$bi,#1			// bp[0]
+	ldp	$a0,$a1,[$ap]
+	ldp	$a2,$a3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+	adr	$bp,.Lone		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_from_mont,.-ecp_nistz256_from_mont
+
+// void	ecp_nistz256_mul_mont(BN_ULONG x0[4],const BN_ULONG x1[4],
+//					     const BN_ULONG x2[4]);
+.globl	ecp_nistz256_mul_mont
+.type	ecp_nistz256_mul_mont,%function
+.align	4
+ecp_nistz256_mul_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	$bi,[$bp]		// bp[0]
+	ldp	$a0,$a1,[$ap]
+	ldp	$a2,$a3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_mul_mont,.-ecp_nistz256_mul_mont
+
+// void	ecp_nistz256_sqr_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_sqr_mont
+.type	ecp_nistz256_sqr_mont,%function
+.align	4
+ecp_nistz256_sqr_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldp	$a0,$a1,[$ap]
+	ldp	$a2,$a3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+
+	bl	__ecp_nistz256_sqr_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_sqr_mont,.-ecp_nistz256_sqr_mont
+
+// void	ecp_nistz256_div_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_div_by_2
+.type	ecp_nistz256_div_by_2,%function
+.align	4
+ecp_nistz256_div_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	$acc0,$acc1,[$ap]
+	ldp	$acc2,$acc3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+
+	bl	__ecp_nistz256_div_by_2
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_div_by_2,.-ecp_nistz256_div_by_2
+
+// void	ecp_nistz256_mul_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_mul_by_2
+.type	ecp_nistz256_mul_by_2,%function
+.align	4
+ecp_nistz256_mul_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	$acc0,$acc1,[$ap]
+	ldp	$acc2,$acc3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+	mov	$t0,$acc0
+	mov	$t1,$acc1
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_mul_by_2,.-ecp_nistz256_mul_by_2
+
+// void	ecp_nistz256_mul_by_3(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_mul_by_3
+.type	ecp_nistz256_mul_by_3,%function
+.align	4
+ecp_nistz256_mul_by_3:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	$acc0,$acc1,[$ap]
+	ldp	$acc2,$acc3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+	mov	$t0,$acc0
+	mov	$t1,$acc1
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+	mov	$a0,$acc0
+	mov	$a1,$acc1
+	mov	$a2,$acc2
+	mov	$a3,$acc3
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	mov	$t0,$a0
+	mov	$t1,$a1
+	mov	$t2,$a2
+	mov	$t3,$a3
+
+	bl	__ecp_nistz256_add_to	// ret += a	// 2*a+a=3*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_mul_by_3,.-ecp_nistz256_mul_by_3
+
+// void	ecp_nistz256_sub(BN_ULONG x0[4],const BN_ULONG x1[4],
+//				        const BN_ULONG x2[4]);
+.globl	ecp_nistz256_sub
+.type	ecp_nistz256_sub,%function
+.align	4
+ecp_nistz256_sub:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	$acc0,$acc1,[$ap]
+	ldp	$acc2,$acc3,[$ap,#16]
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_sub,.-ecp_nistz256_sub
+
+// void	ecp_nistz256_neg(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_neg
+.type	ecp_nistz256_neg,%function
+.align	4
+ecp_nistz256_neg:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	mov	$bp,$ap
+	mov	$acc0,xzr		// a = 0
+	mov	$acc1,xzr
+	mov	$acc2,xzr
+	mov	$acc3,xzr
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_neg,.-ecp_nistz256_neg
+
+// note that __ecp_nistz256_mul_mont expects a[0-3] input pre-loaded
+// to $a0-$a3 and b[0] - to $bi
+.type	__ecp_nistz256_mul_mont,%function
+.align	4
+__ecp_nistz256_mul_mont:
+	mul	$acc0,$a0,$bi		// a[0]*b[0]
+	umulh	$t0,$a0,$bi
+
+	mul	$acc1,$a1,$bi		// a[1]*b[0]
+	umulh	$t1,$a1,$bi
+
+	mul	$acc2,$a2,$bi		// a[2]*b[0]
+	umulh	$t2,$a2,$bi
+
+	mul	$acc3,$a3,$bi		// a[3]*b[0]
+	umulh	$t3,$a3,$bi
+	ldr	$bi,[$bp,#8]		// b[1]
+
+	adds	$acc1,$acc1,$t0		// accumulate high parts of multiplication
+	 lsl	$t0,$acc0,#32
+	adcs	$acc2,$acc2,$t1
+	 lsr	$t1,$acc0,#32
+	adcs	$acc3,$acc3,$t2
+	adc	$acc4,xzr,$t3
+	mov	$acc5,xzr
+___
+for($i=1;$i<4;$i++) {
+        # Reduction iteration is normally performed by accumulating
+        # result of multiplication of modulus by "magic" digit [and
+        # omitting least significant word, which is guaranteed to
+        # be 0], but thanks to special form of modulus and "magic"
+        # digit being equal to least significant word, it can be
+        # performed with additions and subtractions alone. Indeed:
+        #
+        #            ffff0001.00000000.0000ffff.ffffffff
+        # *                                     abcdefgh
+        # + xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.abcdefgh
+        #
+        # Now observing that ff..ff*x = (2^n-1)*x = 2^n*x-x, we
+        # rewrite above as:
+        #
+        #   xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.abcdefgh
+        # + abcdefgh.abcdefgh.0000abcd.efgh0000.00000000
+        # - 0000abcd.efgh0000.00000000.00000000.abcdefgh
+        #
+        # or marking redundant operations:
+        #
+        #   xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.--------
+        # + abcdefgh.abcdefgh.0000abcd.efgh0000.--------
+        # - 0000abcd.efgh0000.--------.--------.--------
+
+$code.=<<___;
+	subs	$t2,$acc0,$t0		// "*0xffff0001"
+	sbc	$t3,$acc0,$t1
+	adds	$acc0,$acc1,$t0		// +=acc[0]<<96 and omit acc[0]
+	 mul	$t0,$a0,$bi		// lo(a[0]*b[i])
+	adcs	$acc1,$acc2,$t1
+	 mul	$t1,$a1,$bi		// lo(a[1]*b[i])
+	adcs	$acc2,$acc3,$t2		// +=acc[0]*0xffff0001
+	 mul	$t2,$a2,$bi		// lo(a[2]*b[i])
+	adcs	$acc3,$acc4,$t3
+	 mul	$t3,$a3,$bi		// lo(a[3]*b[i])
+	adc	$acc4,$acc5,xzr
+
+	adds	$acc0,$acc0,$t0		// accumulate low parts of multiplication
+	 umulh	$t0,$a0,$bi		// hi(a[0]*b[i])
+	adcs	$acc1,$acc1,$t1
+	 umulh	$t1,$a1,$bi		// hi(a[1]*b[i])
+	adcs	$acc2,$acc2,$t2
+	 umulh	$t2,$a2,$bi		// hi(a[2]*b[i])
+	adcs	$acc3,$acc3,$t3
+	 umulh	$t3,$a3,$bi		// hi(a[3]*b[i])
+	adc	$acc4,$acc4,xzr
+___
+$code.=<<___	if ($i<3);
+	ldr	$bi,[$bp,#8*($i+1)]	// b[$i+1]
+___
+$code.=<<___;
+	adds	$acc1,$acc1,$t0		// accumulate high parts of multiplication
+	 lsl	$t0,$acc0,#32
+	adcs	$acc2,$acc2,$t1
+	 lsr	$t1,$acc0,#32
+	adcs	$acc3,$acc3,$t2
+	adcs	$acc4,$acc4,$t3
+	adc	$acc5,xzr,xzr
+___
+}
+$code.=<<___;
+	// last reduction
+	subs	$t2,$acc0,$t0		// "*0xffff0001"
+	sbc	$t3,$acc0,$t1
+	adds	$acc0,$acc1,$t0		// +=acc[0]<<96 and omit acc[0]
+	adcs	$acc1,$acc2,$t1
+	adcs	$acc2,$acc3,$t2		// +=acc[0]*0xffff0001
+	adcs	$acc3,$acc4,$t3
+	adc	$acc4,$acc5,xzr
+
+	adds	$t0,$acc0,#1		// subs	$t0,$acc0,#-1 // tmp = ret-modulus
+	sbcs	$t1,$acc1,$poly1
+	sbcs	$t2,$acc2,xzr
+	sbcs	$t3,$acc3,$poly3
+	sbcs	xzr,$acc4,xzr		// did it borrow?
+
+	csel	$acc0,$acc0,$t0,lo	// ret = borrow ? ret : ret-modulus
+	csel	$acc1,$acc1,$t1,lo
+	csel	$acc2,$acc2,$t2,lo
+	stp	$acc0,$acc1,[$rp]
+	csel	$acc3,$acc3,$t3,lo
+	stp	$acc2,$acc3,[$rp,#16]
+
+	ret
+.size	__ecp_nistz256_mul_mont,.-__ecp_nistz256_mul_mont
+
+// note that __ecp_nistz256_sqr_mont expects a[0-3] input pre-loaded
+// to $a0-$a3
+.type	__ecp_nistz256_sqr_mont,%function
+.align	4
+__ecp_nistz256_sqr_mont:
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is $accx, i.e. follow $accx
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	$acc1,$a1,$a0		// a[1]*a[0]
+	umulh	$t1,$a1,$a0
+	mul	$acc2,$a2,$a0		// a[2]*a[0]
+	umulh	$t2,$a2,$a0
+	mul	$acc3,$a3,$a0		// a[3]*a[0]
+	umulh	$acc4,$a3,$a0
+
+	adds	$acc2,$acc2,$t1		// accumulate high parts of multiplication
+	 mul	$t0,$a2,$a1		// a[2]*a[1]
+	 umulh	$t1,$a2,$a1
+	adcs	$acc3,$acc3,$t2
+	 mul	$t2,$a3,$a1		// a[3]*a[1]
+	 umulh	$t3,$a3,$a1
+	adc	$acc4,$acc4,xzr		// can't overflow
+
+	mul	$acc5,$a3,$a2		// a[3]*a[2]
+	umulh	$acc6,$a3,$a2
+
+	adds	$t1,$t1,$t2		// accumulate high parts of multiplication
+	 mul	$acc0,$a0,$a0		// a[0]*a[0]
+	adc	$t2,$t3,xzr		// can't overflow
+
+	adds	$acc3,$acc3,$t0		// accumulate low parts of multiplication
+	 umulh	$a0,$a0,$a0
+	adcs	$acc4,$acc4,$t1
+	 mul	$t1,$a1,$a1		// a[1]*a[1]
+	adcs	$acc5,$acc5,$t2
+	 umulh	$a1,$a1,$a1
+	adc	$acc6,$acc6,xzr		// can't overflow
+
+	adds	$acc1,$acc1,$acc1	// acc[1-6]*=2
+	 mul	$t2,$a2,$a2		// a[2]*a[2]
+	adcs	$acc2,$acc2,$acc2
+	 umulh	$a2,$a2,$a2
+	adcs	$acc3,$acc3,$acc3
+	 mul	$t3,$a3,$a3		// a[3]*a[3]
+	adcs	$acc4,$acc4,$acc4
+	 umulh	$a3,$a3,$a3
+	adcs	$acc5,$acc5,$acc5
+	adcs	$acc6,$acc6,$acc6
+	adc	$acc7,xzr,xzr
+
+	adds	$acc1,$acc1,$a0		// +a[i]*a[i]
+	adcs	$acc2,$acc2,$t1
+	adcs	$acc3,$acc3,$a1
+	adcs	$acc4,$acc4,$t2
+	adcs	$acc5,$acc5,$a2
+	 lsl	$t0,$acc0,#32
+	adcs	$acc6,$acc6,$t3
+	 lsr	$t1,$acc0,#32
+	adc	$acc7,$acc7,$a3
+___
+for($i=0;$i<3;$i++) {			# reductions, see commentary in
+					# multiplication for details
+$code.=<<___;
+	subs	$t2,$acc0,$t0		// "*0xffff0001"
+	sbc	$t3,$acc0,$t1
+	adds	$acc0,$acc1,$t0		// +=acc[0]<<96 and omit acc[0]
+	adcs	$acc1,$acc2,$t1
+	 lsl	$t0,$acc0,#32
+	adcs	$acc2,$acc3,$t2		// +=acc[0]*0xffff0001
+	 lsr	$t1,$acc0,#32
+	adc	$acc3,$t3,xzr		// can't overflow
+___
+}
+$code.=<<___;
+	subs	$t2,$acc0,$t0		// "*0xffff0001"
+	sbc	$t3,$acc0,$t1
+	adds	$acc0,$acc1,$t0		// +=acc[0]<<96 and omit acc[0]
+	adcs	$acc1,$acc2,$t1
+	adcs	$acc2,$acc3,$t2		// +=acc[0]*0xffff0001
+	adc	$acc3,$t3,xzr		// can't overflow
+
+	adds	$acc0,$acc0,$acc4	// accumulate upper half
+	adcs	$acc1,$acc1,$acc5
+	adcs	$acc2,$acc2,$acc6
+	adcs	$acc3,$acc3,$acc7
+	adc	$acc4,xzr,xzr
+
+	adds	$t0,$acc0,#1		// subs	$t0,$acc0,#-1 // tmp = ret-modulus
+	sbcs	$t1,$acc1,$poly1
+	sbcs	$t2,$acc2,xzr
+	sbcs	$t3,$acc3,$poly3
+	sbcs	xzr,$acc4,xzr		// did it borrow?
+
+	csel	$acc0,$acc0,$t0,lo	// ret = borrow ? ret : ret-modulus
+	csel	$acc1,$acc1,$t1,lo
+	csel	$acc2,$acc2,$t2,lo
+	stp	$acc0,$acc1,[$rp]
+	csel	$acc3,$acc3,$t3,lo
+	stp	$acc2,$acc3,[$rp,#16]
+
+	ret
+.size	__ecp_nistz256_sqr_mont,.-__ecp_nistz256_sqr_mont
+
+// Note that __ecp_nistz256_add_to expects both input vectors pre-loaded to
+// $a0-$a3 and $t0-$t3. This is done because it's used in multiple
+// contexts, e.g. in multiplication by 2 and 3...
+.type	__ecp_nistz256_add_to,%function
+.align	4
+__ecp_nistz256_add_to:
+	adds	$acc0,$acc0,$t0		// ret = a+b
+	adcs	$acc1,$acc1,$t1
+	adcs	$acc2,$acc2,$t2
+	adcs	$acc3,$acc3,$t3
+	adc	$ap,xzr,xzr		// zap $ap
+
+	adds	$t0,$acc0,#1		// subs	$t0,$a0,#-1 // tmp = ret-modulus
+	sbcs	$t1,$acc1,$poly1
+	sbcs	$t2,$acc2,xzr
+	sbcs	$t3,$acc3,$poly3
+	sbcs	xzr,$ap,xzr		// did subtraction borrow?
+
+	csel	$acc0,$acc0,$t0,lo	// ret = borrow ? ret : ret-modulus
+	csel	$acc1,$acc1,$t1,lo
+	csel	$acc2,$acc2,$t2,lo
+	stp	$acc0,$acc1,[$rp]
+	csel	$acc3,$acc3,$t3,lo
+	stp	$acc2,$acc3,[$rp,#16]
+
+	ret
+.size	__ecp_nistz256_add_to,.-__ecp_nistz256_add_to
+
+.type	__ecp_nistz256_sub_from,%function
+.align	4
+__ecp_nistz256_sub_from:
+	ldp	$t0,$t1,[$bp]
+	ldp	$t2,$t3,[$bp,#16]
+	subs	$acc0,$acc0,$t0		// ret = a-b
+	sbcs	$acc1,$acc1,$t1
+	sbcs	$acc2,$acc2,$t2
+	sbcs	$acc3,$acc3,$t3
+	sbc	$ap,xzr,xzr		// zap $ap
+
+	subs	$t0,$acc0,#1		// adds	$t0,$a0,#-1 // tmp = ret+modulus
+	adcs	$t1,$acc1,$poly1
+	adcs	$t2,$acc2,xzr
+	adc	$t3,$acc3,$poly3
+	cmp	$ap,xzr			// did subtraction borrow?
+
+	csel	$acc0,$acc0,$t0,eq	// ret = borrow ? ret+modulus : ret
+	csel	$acc1,$acc1,$t1,eq
+	csel	$acc2,$acc2,$t2,eq
+	stp	$acc0,$acc1,[$rp]
+	csel	$acc3,$acc3,$t3,eq
+	stp	$acc2,$acc3,[$rp,#16]
+
+	ret
+.size	__ecp_nistz256_sub_from,.-__ecp_nistz256_sub_from
+
+.type	__ecp_nistz256_sub_morf,%function
+.align	4
+__ecp_nistz256_sub_morf:
+	ldp	$t0,$t1,[$bp]
+	ldp	$t2,$t3,[$bp,#16]
+	subs	$acc0,$t0,$acc0		// ret = b-a
+	sbcs	$acc1,$t1,$acc1
+	sbcs	$acc2,$t2,$acc2
+	sbcs	$acc3,$t3,$acc3
+	sbc	$ap,xzr,xzr		// zap $ap
+
+	subs	$t0,$acc0,#1		// adds	$t0,$a0,#-1 // tmp = ret+modulus
+	adcs	$t1,$acc1,$poly1
+	adcs	$t2,$acc2,xzr
+	adc	$t3,$acc3,$poly3
+	cmp	$ap,xzr			// did subtraction borrow?
+
+	csel	$acc0,$acc0,$t0,eq	// ret = borrow ? ret+modulus : ret
+	csel	$acc1,$acc1,$t1,eq
+	csel	$acc2,$acc2,$t2,eq
+	stp	$acc0,$acc1,[$rp]
+	csel	$acc3,$acc3,$t3,eq
+	stp	$acc2,$acc3,[$rp,#16]
+
+	ret
+.size	__ecp_nistz256_sub_morf,.-__ecp_nistz256_sub_morf
+
+.type	__ecp_nistz256_div_by_2,%function
+.align	4
+__ecp_nistz256_div_by_2:
+	subs	$t0,$acc0,#1		// adds	$t0,$a0,#-1 // tmp = a+modulus
+	adcs	$t1,$acc1,$poly1
+	adcs	$t2,$acc2,xzr
+	adcs	$t3,$acc3,$poly3
+	adc	$ap,xzr,xzr		// zap $ap
+	tst	$acc0,#1		// is a even?
+
+	csel	$acc0,$acc0,$t0,eq	// ret = even ? a : a+modulus
+	csel	$acc1,$acc1,$t1,eq
+	csel	$acc2,$acc2,$t2,eq
+	csel	$acc3,$acc3,$t3,eq
+	csel	$ap,xzr,$ap,eq
+
+	lsr	$acc0,$acc0,#1		// ret >>= 1
+	orr	$acc0,$acc0,$acc1,lsl#63
+	lsr	$acc1,$acc1,#1
+	orr	$acc1,$acc1,$acc2,lsl#63
+	lsr	$acc2,$acc2,#1
+	orr	$acc2,$acc2,$acc3,lsl#63
+	lsr	$acc3,$acc3,#1
+	stp	$acc0,$acc1,[$rp]
+	orr	$acc3,$acc3,$ap,lsl#63
+	stp	$acc2,$acc3,[$rp,#16]
+
+	ret
+.size	__ecp_nistz256_div_by_2,.-__ecp_nistz256_div_by_2
+___
+########################################################################
+# following subroutines are "literal" implementation of those found in
+# ecp_nistz256.c
+#
+########################################################################
+# void ecp_nistz256_point_double(P256_POINT *out,const P256_POINT *inp);
+#
+{
+my ($S,$M,$Zsqr,$tmp0)=map(32*$_,(0..3));
+# above map() describes stack layout with 4 temporary
+# 256-bit vectors on top.
+my ($rp_real,$ap_real) = map("x$_",(21,22));
+
+$code.=<<___;
+.globl	ecp_nistz256_point_double
+.type	ecp_nistz256_point_double,%function
+.align	5
+ecp_nistz256_point_double:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	sub	sp,sp,#32*4
+
+.Ldouble_shortcut:
+	ldp	$acc0,$acc1,[$ap,#32]
+	 mov	$rp_real,$rp
+	ldp	$acc2,$acc3,[$ap,#48]
+	 mov	$ap_real,$ap
+	 ldr	$poly1,.Lpoly+8
+	mov	$t0,$acc0
+	 ldr	$poly3,.Lpoly+24
+	mov	$t1,$acc1
+	 ldp	$a0,$a1,[$ap_real,#64]	// forward load for p256_sqr_mont
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+	 ldp	$a2,$a3,[$ap_real,#64+16]
+	add	$rp,sp,#$S
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(S, in_y);
+
+	add	$rp,sp,#$Zsqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Zsqr, in_z);
+
+	ldp	$t0,$t1,[$ap_real]
+	ldp	$t2,$t3,[$ap_real,#16]
+	mov	$a0,$acc0		// put Zsqr aside for p256_sub
+	mov	$a1,$acc1
+	mov	$a2,$acc2
+	mov	$a3,$acc3
+	add	$rp,sp,#$M
+	bl	__ecp_nistz256_add_to	// p256_add(M, Zsqr, in_x);
+
+	add	$bp,$ap_real,#0
+	mov	$acc0,$a0		// restore Zsqr
+	mov	$acc1,$a1
+	 ldp	$a0,$a1,[sp,#$S]	// forward load for p256_sqr_mont
+	mov	$acc2,$a2
+	mov	$acc3,$a3
+	 ldp	$a2,$a3,[sp,#$S+16]
+	add	$rp,sp,#$Zsqr
+	bl	__ecp_nistz256_sub_morf	// p256_sub(Zsqr, in_x, Zsqr);
+
+	add	$rp,sp,#$S
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(S, S);
+
+	ldr	$bi,[$ap_real,#32]
+	ldp	$a0,$a1,[$ap_real,#64]
+	ldp	$a2,$a3,[$ap_real,#64+16]
+	add	$bp,$ap_real,#32
+	add	$rp,sp,#$tmp0
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(tmp0, in_z, in_y);
+
+	mov	$t0,$acc0
+	mov	$t1,$acc1
+	 ldp	$a0,$a1,[sp,#$S]	// forward load for p256_sqr_mont
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+	 ldp	$a2,$a3,[sp,#$S+16]
+	add	$rp,$rp_real,#64
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(res_z, tmp0);
+
+	add	$rp,sp,#$tmp0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(tmp0, S);
+
+	 ldr	$bi,[sp,#$Zsqr]		// forward load for p256_mul_mont
+	 ldp	$a0,$a1,[sp,#$M]
+	 ldp	$a2,$a3,[sp,#$M+16]
+	add	$rp,$rp_real,#32
+	bl	__ecp_nistz256_div_by_2	// p256_div_by_2(res_y, tmp0);
+
+	add	$bp,sp,#$Zsqr
+	add	$rp,sp,#$M
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(M, M, Zsqr);
+
+	mov	$t0,$acc0		// duplicate M
+	mov	$t1,$acc1
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+	mov	$a0,$acc0		// put M aside
+	mov	$a1,$acc1
+	mov	$a2,$acc2
+	mov	$a3,$acc3
+	add	$rp,sp,#$M
+	bl	__ecp_nistz256_add_to
+	mov	$t0,$a0			// restore M
+	mov	$t1,$a1
+	 ldr	$bi,[$ap_real]		// forward load for p256_mul_mont
+	mov	$t2,$a2
+	 ldp	$a0,$a1,[sp,#$S]
+	mov	$t3,$a3
+	 ldp	$a2,$a3,[sp,#$S+16]
+	bl	__ecp_nistz256_add_to	// p256_mul_by_3(M, M);
+
+	add	$bp,$ap_real,#0
+	add	$rp,sp,#$S
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, in_x);
+
+	mov	$t0,$acc0
+	mov	$t1,$acc1
+	 ldp	$a0,$a1,[sp,#$M]	// forward load for p256_sqr_mont
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+	 ldp	$a2,$a3,[sp,#$M+16]
+	add	$rp,sp,#$tmp0
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(tmp0, S);
+
+	add	$rp,$rp_real,#0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(res_x, M);
+
+	add	$bp,sp,#$tmp0
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_x, res_x, tmp0);
+
+	add	$bp,sp,#$S
+	add	$rp,sp,#$S
+	bl	__ecp_nistz256_sub_morf	// p256_sub(S, S, res_x);
+
+	ldr	$bi,[sp,#$M]
+	mov	$a0,$acc0		// copy S
+	mov	$a1,$acc1
+	mov	$a2,$acc2
+	mov	$a3,$acc3
+	add	$bp,sp,#$M
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, M);
+
+	add	$bp,$rp_real,#32
+	add	$rp,$rp_real,#32
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, S, res_y);
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_point_double,.-ecp_nistz256_point_double
+___
+}
+
+########################################################################
+# void ecp_nistz256_point_add(P256_POINT *out,const P256_POINT *in1,
+#			      const P256_POINT *in2);
+{
+my ($res_x,$res_y,$res_z,
+    $H,$Hsqr,$R,$Rsqr,$Hcub,
+    $U1,$U2,$S1,$S2)=map(32*$_,(0..11));
+my ($Z1sqr, $Z2sqr) = ($Hsqr, $Rsqr);
+# above map() describes stack layout with 12 temporary
+# 256-bit vectors on top.
+my ($rp_real,$ap_real,$bp_real,$in1infty,$in2infty,$temp0,$temp1,$temp2)=map("x$_",(21..28));
+
+$code.=<<___;
+.globl	ecp_nistz256_point_add
+.type	ecp_nistz256_point_add,%function
+.align	5
+ecp_nistz256_point_add:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	stp	x27,x28,[sp,#80]
+	sub	sp,sp,#32*12
+
+	ldp	$a0,$a1,[$bp,#64]	// in2_z
+	ldp	$a2,$a3,[$bp,#64+16]
+	 mov	$rp_real,$rp
+	 mov	$ap_real,$ap
+	 mov	$bp_real,$bp
+	 ldr	$poly1,.Lpoly+8
+	 ldr	$poly3,.Lpoly+24
+	orr	$t0,$a0,$a1
+	orr	$t2,$a2,$a3
+	orr	$in2infty,$t0,$t2
+	cmp	$in2infty,#0
+	csetm	$in2infty,ne		// ~in2infty
+	add	$rp,sp,#$Z2sqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z2sqr, in2_z);
+
+	ldp	$a0,$a1,[$ap_real,#64]	// in1_z
+	ldp	$a2,$a3,[$ap_real,#64+16]
+	orr	$t0,$a0,$a1
+	orr	$t2,$a2,$a3
+	orr	$in1infty,$t0,$t2
+	cmp	$in1infty,#0
+	csetm	$in1infty,ne		// ~in1infty
+	add	$rp,sp,#$Z1sqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	ldr	$bi,[$bp_real,#64]
+	ldp	$a0,$a1,[sp,#$Z2sqr]
+	ldp	$a2,$a3,[sp,#$Z2sqr+16]
+	add	$bp,$bp_real,#64
+	add	$rp,sp,#$S1
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, Z2sqr, in2_z);
+
+	ldr	$bi,[$ap_real,#64]
+	ldp	$a0,$a1,[sp,#$Z1sqr]
+	ldp	$a2,$a3,[sp,#$Z1sqr+16]
+	add	$bp,$ap_real,#64
+	add	$rp,sp,#$S2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	$bi,[$ap_real,#32]
+	ldp	$a0,$a1,[sp,#$S1]
+	ldp	$a2,$a3,[sp,#$S1+16]
+	add	$bp,$ap_real,#32
+	add	$rp,sp,#$S1
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, S1, in1_y);
+
+	ldr	$bi,[$bp_real,#32]
+	ldp	$a0,$a1,[sp,#$S2]
+	ldp	$a2,$a3,[sp,#$S2+16]
+	add	$bp,$bp_real,#32
+	add	$rp,sp,#$S2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	$bp,sp,#$S1
+	 ldr	$bi,[sp,#$Z2sqr]	// forward load for p256_mul_mont
+	 ldp	$a0,$a1,[$ap_real]
+	 ldp	$a2,$a3,[$ap_real,#16]
+	add	$rp,sp,#$R
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, S1);
+
+	orr	$acc0,$acc0,$acc1	// see if result is zero
+	orr	$acc2,$acc2,$acc3
+	orr	$temp0,$acc0,$acc2	// ~is_equal(S1,S2)
+
+	add	$bp,sp,#$Z2sqr
+	add	$rp,sp,#$U1
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U1, in1_x, Z2sqr);
+
+	ldr	$bi,[sp,#$Z1sqr]
+	ldp	$a0,$a1,[$bp_real]
+	ldp	$a2,$a3,[$bp_real,#16]
+	add	$bp,sp,#$Z1sqr
+	add	$rp,sp,#$U2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in2_x, Z1sqr);
+
+	add	$bp,sp,#$U1
+	 ldp	$a0,$a1,[sp,#$R]	// forward load for p256_sqr_mont
+	 ldp	$a2,$a3,[sp,#$R+16]
+	add	$rp,sp,#$H
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, U1);
+
+	orr	$acc0,$acc0,$acc1	// see if result is zero
+	orr	$acc2,$acc2,$acc3
+	orr	$acc0,$acc0,$acc2	// ~is_equal(U1,U2)
+
+	mvn	$temp1,$in1infty	// -1/0 -> 0/-1
+	mvn	$temp2,$in2infty	// -1/0 -> 0/-1
+	orr	$acc0,$acc0,$temp1
+	orr	$acc0,$acc0,$temp2
+	orr	$acc0,$acc0,$temp0
+	cbnz	$acc0,.Ladd_proceed	// if(~is_equal(U1,U2) | in1infty | in2infty | ~is_equal(S1,S2))
+
+.Ladd_double:
+	mov	$ap,$ap_real
+	mov	$rp,$rp_real
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	add	sp,sp,#256	// #256 is from #32*(12-4). difference in stack frames
+	b	.Ldouble_shortcut
+
+.align	4
+.Ladd_proceed:
+	add	$rp,sp,#$Rsqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	$bi,[$ap_real,#64]
+	ldp	$a0,$a1,[sp,#$H]
+	ldp	$a2,$a3,[sp,#$H+16]
+	add	$bp,$ap_real,#64
+	add	$rp,sp,#$res_z
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldp	$a0,$a1,[sp,#$H]
+	ldp	$a2,$a3,[sp,#$H+16]
+	add	$rp,sp,#$Hsqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldr	$bi,[$bp_real,#64]
+	ldp	$a0,$a1,[sp,#$res_z]
+	ldp	$a2,$a3,[sp,#$res_z+16]
+	add	$bp,$bp_real,#64
+	add	$rp,sp,#$res_z
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, res_z, in2_z);
+
+	ldr	$bi,[sp,#$H]
+	ldp	$a0,$a1,[sp,#$Hsqr]
+	ldp	$a2,$a3,[sp,#$Hsqr+16]
+	add	$bp,sp,#$H
+	add	$rp,sp,#$Hcub
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	$bi,[sp,#$Hsqr]
+	ldp	$a0,$a1,[sp,#$U1]
+	ldp	$a2,$a3,[sp,#$U1+16]
+	add	$bp,sp,#$Hsqr
+	add	$rp,sp,#$U2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, U1, Hsqr);
+
+	mov	$t0,$acc0
+	mov	$t1,$acc1
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+	add	$rp,sp,#$Hsqr
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	$bp,sp,#$Rsqr
+	add	$rp,sp,#$res_x
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	$bp,sp,#$Hcub
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	$bp,sp,#$U2
+	 ldr	$bi,[sp,#$Hcub]		// forward load for p256_mul_mont
+	 ldp	$a0,$a1,[sp,#$S1]
+	 ldp	$a2,$a3,[sp,#$S1+16]
+	add	$rp,sp,#$res_y
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	$bp,sp,#$Hcub
+	add	$rp,sp,#$S2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S1, Hcub);
+
+	ldr	$bi,[sp,#$R]
+	ldp	$a0,$a1,[sp,#$res_y]
+	ldp	$a2,$a3,[sp,#$res_y+16]
+	add	$bp,sp,#$R
+	add	$rp,sp,#$res_y
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	$bp,sp,#$S2
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	$a0,$a1,[sp,#$res_x]		// res
+	ldp	$a2,$a3,[sp,#$res_x+16]
+	ldp	$t0,$t1,[$bp_real]		// in2
+	ldp	$t2,$t3,[$bp_real,#16]
+___
+for($i=0;$i<64;$i+=32) {		# conditional moves
+$code.=<<___;
+	ldp	$acc0,$acc1,[$ap_real,#$i]	// in1
+	cmp	$in1infty,#0			// ~$in1intfy, remember?
+	ldp	$acc2,$acc3,[$ap_real,#$i+16]
+	csel	$t0,$a0,$t0,ne
+	csel	$t1,$a1,$t1,ne
+	ldp	$a0,$a1,[sp,#$res_x+$i+32]	// res
+	csel	$t2,$a2,$t2,ne
+	csel	$t3,$a3,$t3,ne
+	cmp	$in2infty,#0			// ~$in2intfy, remember?
+	ldp	$a2,$a3,[sp,#$res_x+$i+48]
+	csel	$acc0,$t0,$acc0,ne
+	csel	$acc1,$t1,$acc1,ne
+	ldp	$t0,$t1,[$bp_real,#$i+32]	// in2
+	csel	$acc2,$t2,$acc2,ne
+	csel	$acc3,$t3,$acc3,ne
+	ldp	$t2,$t3,[$bp_real,#$i+48]
+	stp	$acc0,$acc1,[$rp_real,#$i]
+	stp	$acc2,$acc3,[$rp_real,#$i+16]
+___
+}
+$code.=<<___;
+	ldp	$acc0,$acc1,[$ap_real,#$i]	// in1
+	cmp	$in1infty,#0			// ~$in1intfy, remember?
+	ldp	$acc2,$acc3,[$ap_real,#$i+16]
+	csel	$t0,$a0,$t0,ne
+	csel	$t1,$a1,$t1,ne
+	csel	$t2,$a2,$t2,ne
+	csel	$t3,$a3,$t3,ne
+	cmp	$in2infty,#0			// ~$in2intfy, remember?
+	csel	$acc0,$t0,$acc0,ne
+	csel	$acc1,$t1,$acc1,ne
+	csel	$acc2,$t2,$acc2,ne
+	csel	$acc3,$t3,$acc3,ne
+	stp	$acc0,$acc1,[$rp_real,#$i]
+	stp	$acc2,$acc3,[$rp_real,#$i+16]
+
+.Ladd_done:
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_point_add,.-ecp_nistz256_point_add
+___
+}
+
+########################################################################
+# void ecp_nistz256_point_add_affine(P256_POINT *out,const P256_POINT *in1,
+#				     const P256_POINT_AFFINE *in2);
+{
+my ($res_x,$res_y,$res_z,
+    $U2,$S2,$H,$R,$Hsqr,$Hcub,$Rsqr)=map(32*$_,(0..9));
+my $Z1sqr = $S2;
+# above map() describes stack layout with 10 temporary
+# 256-bit vectors on top.
+my ($rp_real,$ap_real,$bp_real,$in1infty,$in2infty,$temp)=map("x$_",(21..26));
+
+$code.=<<___;
+.globl	ecp_nistz256_point_add_affine
+.type	ecp_nistz256_point_add_affine,%function
+.align	5
+ecp_nistz256_point_add_affine:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-80]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	sub	sp,sp,#32*10
+
+	mov	$rp_real,$rp
+	mov	$ap_real,$ap
+	mov	$bp_real,$bp
+	ldr	$poly1,.Lpoly+8
+	ldr	$poly3,.Lpoly+24
+
+	ldp	$a0,$a1,[$ap,#64]	// in1_z
+	ldp	$a2,$a3,[$ap,#64+16]
+	orr	$t0,$a0,$a1
+	orr	$t2,$a2,$a3
+	orr	$in1infty,$t0,$t2
+	cmp	$in1infty,#0
+	csetm	$in1infty,ne		// ~in1infty
+
+	ldp	$acc0,$acc1,[$bp]	// in2_x
+	ldp	$acc2,$acc3,[$bp,#16]
+	ldp	$t0,$t1,[$bp,#32]	// in2_y
+	ldp	$t2,$t3,[$bp,#48]
+	orr	$acc0,$acc0,$acc1
+	orr	$acc2,$acc2,$acc3
+	orr	$t0,$t0,$t1
+	orr	$t2,$t2,$t3
+	orr	$acc0,$acc0,$acc2
+	orr	$t0,$t0,$t2
+	orr	$in2infty,$acc0,$t0
+	cmp	$in2infty,#0
+	csetm	$in2infty,ne		// ~in2infty
+
+	add	$rp,sp,#$Z1sqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	mov	$a0,$acc0
+	mov	$a1,$acc1
+	mov	$a2,$acc2
+	mov	$a3,$acc3
+	ldr	$bi,[$bp_real]
+	add	$bp,$bp_real,#0
+	add	$rp,sp,#$U2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, Z1sqr, in2_x);
+
+	add	$bp,$ap_real,#0
+	 ldr	$bi,[$ap_real,#64]	// forward load for p256_mul_mont
+	 ldp	$a0,$a1,[sp,#$Z1sqr]
+	 ldp	$a2,$a3,[sp,#$Z1sqr+16]
+	add	$rp,sp,#$H
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, in1_x);
+
+	add	$bp,$ap_real,#64
+	add	$rp,sp,#$S2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	$bi,[$ap_real,#64]
+	ldp	$a0,$a1,[sp,#$H]
+	ldp	$a2,$a3,[sp,#$H+16]
+	add	$bp,$ap_real,#64
+	add	$rp,sp,#$res_z
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldr	$bi,[$bp_real,#32]
+	ldp	$a0,$a1,[sp,#$S2]
+	ldp	$a2,$a3,[sp,#$S2+16]
+	add	$bp,$bp_real,#32
+	add	$rp,sp,#$S2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	$bp,$ap_real,#32
+	 ldp	$a0,$a1,[sp,#$H]	// forward load for p256_sqr_mont
+	 ldp	$a2,$a3,[sp,#$H+16]
+	add	$rp,sp,#$R
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, in1_y);
+
+	add	$rp,sp,#$Hsqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldp	$a0,$a1,[sp,#$R]
+	ldp	$a2,$a3,[sp,#$R+16]
+	add	$rp,sp,#$Rsqr
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	$bi,[sp,#$H]
+	ldp	$a0,$a1,[sp,#$Hsqr]
+	ldp	$a2,$a3,[sp,#$Hsqr+16]
+	add	$bp,sp,#$H
+	add	$rp,sp,#$Hcub
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	$bi,[$ap_real]
+	ldp	$a0,$a1,[sp,#$Hsqr]
+	ldp	$a2,$a3,[sp,#$Hsqr+16]
+	add	$bp,$ap_real,#0
+	add	$rp,sp,#$U2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in1_x, Hsqr);
+
+	mov	$t0,$acc0
+	mov	$t1,$acc1
+	mov	$t2,$acc2
+	mov	$t3,$acc3
+	add	$rp,sp,#$Hsqr
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	$bp,sp,#$Rsqr
+	add	$rp,sp,#$res_x
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	$bp,sp,#$Hcub
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	$bp,sp,#$U2
+	 ldr	$bi,[$ap_real,#32]	// forward load for p256_mul_mont
+	 ldp	$a0,$a1,[sp,#$Hcub]
+	 ldp	$a2,$a3,[sp,#$Hcub+16]
+	add	$rp,sp,#$res_y
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	$bp,$ap_real,#32
+	add	$rp,sp,#$S2
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, in1_y, Hcub);
+
+	ldr	$bi,[sp,#$R]
+	ldp	$a0,$a1,[sp,#$res_y]
+	ldp	$a2,$a3,[sp,#$res_y+16]
+	add	$bp,sp,#$R
+	add	$rp,sp,#$res_y
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	$bp,sp,#$S2
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	$a0,$a1,[sp,#$res_x]		// res
+	ldp	$a2,$a3,[sp,#$res_x+16]
+	ldp	$t0,$t1,[$bp_real]		// in2
+	ldp	$t2,$t3,[$bp_real,#16]
+___
+for($i=0;$i<64;$i+=32) {		# conditional moves
+$code.=<<___;
+	ldp	$acc0,$acc1,[$ap_real,#$i]	// in1
+	cmp	$in1infty,#0			// ~$in1intfy, remember?
+	ldp	$acc2,$acc3,[$ap_real,#$i+16]
+	csel	$t0,$a0,$t0,ne
+	csel	$t1,$a1,$t1,ne
+	ldp	$a0,$a1,[sp,#$res_x+$i+32]	// res
+	csel	$t2,$a2,$t2,ne
+	csel	$t3,$a3,$t3,ne
+	cmp	$in2infty,#0			// ~$in2intfy, remember?
+	ldp	$a2,$a3,[sp,#$res_x+$i+48]
+	csel	$acc0,$t0,$acc0,ne
+	csel	$acc1,$t1,$acc1,ne
+	ldp	$t0,$t1,[$bp_real,#$i+32]	// in2
+	csel	$acc2,$t2,$acc2,ne
+	csel	$acc3,$t3,$acc3,ne
+	ldp	$t2,$t3,[$bp_real,#$i+48]
+	stp	$acc0,$acc1,[$rp_real,#$i]
+	stp	$acc2,$acc3,[$rp_real,#$i+16]
+___
+$code.=<<___	if ($i == 0);
+	adr	$bp_real,.Lone_mont-64
+___
+}
+$code.=<<___;
+	ldp	$acc0,$acc1,[$ap_real,#$i]	// in1
+	cmp	$in1infty,#0			// ~$in1intfy, remember?
+	ldp	$acc2,$acc3,[$ap_real,#$i+16]
+	csel	$t0,$a0,$t0,ne
+	csel	$t1,$a1,$t1,ne
+	csel	$t2,$a2,$t2,ne
+	csel	$t3,$a3,$t3,ne
+	cmp	$in2infty,#0			// ~$in2intfy, remember?
+	csel	$acc0,$t0,$acc0,ne
+	csel	$acc1,$t1,$acc1,ne
+	csel	$acc2,$t2,$acc2,ne
+	csel	$acc3,$t3,$acc3,ne
+	stp	$acc0,$acc1,[$rp_real,#$i]
+	stp	$acc2,$acc3,[$rp_real,#$i+16]
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x29,x30,[sp],#80
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+.size	ecp_nistz256_point_add_affine,.-ecp_nistz256_point_add_affine
+___
+}
+if (1) {
+my ($ord0,$ord1) = ($poly1,$poly3);
+my ($ord2,$ord3,$ordk,$t4) = map("x$_",(21..24));
+my $acc7 = $bi;
+
+$code.=<<___;
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_mul_mont(uint64_t res[4], uint64_t a[4],
+//                                uint64_t b[4]);
+.globl	ecp_nistz256_ord_mul_mont
+.type	ecp_nistz256_ord_mul_mont,%function
+.align	4
+ecp_nistz256_ord_mul_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	$ordk,.Lord
+	ldr	$bi,[$bp]		// bp[0]
+	ldp	$a0,$a1,[$ap]
+	ldp	$a2,$a3,[$ap,#16]
+
+	ldp	$ord0,$ord1,[$ordk,#0]
+	ldp	$ord2,$ord3,[$ordk,#16]
+	ldr	$ordk,[$ordk,#32]
+
+	mul	$acc0,$a0,$bi		// a[0]*b[0]
+	umulh	$t0,$a0,$bi
+
+	mul	$acc1,$a1,$bi		// a[1]*b[0]
+	umulh	$t1,$a1,$bi
+
+	mul	$acc2,$a2,$bi		// a[2]*b[0]
+	umulh	$t2,$a2,$bi
+
+	mul	$acc3,$a3,$bi		// a[3]*b[0]
+	umulh	$acc4,$a3,$bi
+
+	mul	$t4,$acc0,$ordk
+
+	adds	$acc1,$acc1,$t0		// accumulate high parts of multiplication
+	adcs	$acc2,$acc2,$t1
+	adcs	$acc3,$acc3,$t2
+	adc	$acc4,$acc4,xzr
+	mov	$acc5,xzr
+___
+for ($i=1;$i<4;$i++) {
+	################################################################
+	#            ffff0000.ffffffff.yyyyyyyy.zzzzzzzz
+	# *                                     abcdefgh
+	# + xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx
+	#
+	# Now observing that ff..ff*x = (2^n-1)*x = 2^n*x-x, we
+	# rewrite above as:
+	#
+	#   xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx
+	# - 0000abcd.efgh0000.abcdefgh.00000000.00000000
+	# + abcdefgh.abcdefgh.yzayzbyz.cyzdyzey.zfyzgyzh
+$code.=<<___;
+	ldr	$bi,[$bp,#8*$i]		// b[i]
+
+	lsl	$t0,$t4,#32
+	subs	$acc2,$acc2,$t4
+	lsr	$t1,$t4,#32
+	sbcs	$acc3,$acc3,$t0
+	sbcs	$acc4,$acc4,$t1
+	sbc	$acc5,$acc5,xzr
+
+	subs	xzr,$acc0,#1
+	umulh	$t1,$ord0,$t4
+	mul	$t2,$ord1,$t4
+	umulh	$t3,$ord1,$t4
+
+	adcs	$t2,$t2,$t1
+	 mul	$t0,$a0,$bi
+	adc	$t3,$t3,xzr
+	 mul	$t1,$a1,$bi
+
+	adds	$acc0,$acc1,$t2
+	 mul	$t2,$a2,$bi
+	adcs	$acc1,$acc2,$t3
+	 mul	$t3,$a3,$bi
+	adcs	$acc2,$acc3,$t4
+	adcs	$acc3,$acc4,$t4
+	adc	$acc4,$acc5,xzr
+
+	adds	$acc0,$acc0,$t0		// accumulate low parts
+	umulh	$t0,$a0,$bi
+	adcs	$acc1,$acc1,$t1
+	umulh	$t1,$a1,$bi
+	adcs	$acc2,$acc2,$t2
+	umulh	$t2,$a2,$bi
+	adcs	$acc3,$acc3,$t3
+	umulh	$t3,$a3,$bi
+	adc	$acc4,$acc4,xzr
+	mul	$t4,$acc0,$ordk
+	adds	$acc1,$acc1,$t0		// accumulate high parts
+	adcs	$acc2,$acc2,$t1
+	adcs	$acc3,$acc3,$t2
+	adcs	$acc4,$acc4,$t3
+	adc	$acc5,xzr,xzr
+___
+}
+$code.=<<___;
+	lsl	$t0,$t4,#32		// last reduction
+	subs	$acc2,$acc2,$t4
+	lsr	$t1,$t4,#32
+	sbcs	$acc3,$acc3,$t0
+	sbcs	$acc4,$acc4,$t1
+	sbc	$acc5,$acc5,xzr
+
+	subs	xzr,$acc0,#1
+	umulh	$t1,$ord0,$t4
+	mul	$t2,$ord1,$t4
+	umulh	$t3,$ord1,$t4
+
+	adcs	$t2,$t2,$t1
+	adc	$t3,$t3,xzr
+
+	adds	$acc0,$acc1,$t2
+	adcs	$acc1,$acc2,$t3
+	adcs	$acc2,$acc3,$t4
+	adcs	$acc3,$acc4,$t4
+	adc	$acc4,$acc5,xzr
+
+	subs	$t0,$acc0,$ord0		// ret -= modulus
+	sbcs	$t1,$acc1,$ord1
+	sbcs	$t2,$acc2,$ord2
+	sbcs	$t3,$acc3,$ord3
+	sbcs	xzr,$acc4,xzr
+
+	csel	$acc0,$acc0,$t0,lo	// ret = borrow ? ret : ret-modulus
+	csel	$acc1,$acc1,$t1,lo
+	csel	$acc2,$acc2,$t2,lo
+	stp	$acc0,$acc1,[$rp]
+	csel	$acc3,$acc3,$t3,lo
+	stp	$acc2,$acc3,[$rp,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+.size	ecp_nistz256_ord_mul_mont,.-ecp_nistz256_ord_mul_mont
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_sqr_mont(uint64_t res[4], uint64_t a[4],
+//                                int rep);
+.globl	ecp_nistz256_ord_sqr_mont
+.type	ecp_nistz256_ord_sqr_mont,%function
+.align	4
+ecp_nistz256_ord_sqr_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	$ordk,.Lord
+	ldp	$a0,$a1,[$ap]
+	ldp	$a2,$a3,[$ap,#16]
+
+	ldp	$ord0,$ord1,[$ordk,#0]
+	ldp	$ord2,$ord3,[$ordk,#16]
+	ldr	$ordk,[$ordk,#32]
+	b	.Loop_ord_sqr
+
+.align	4
+.Loop_ord_sqr:
+	sub	$bp,$bp,#1
+	////////////////////////////////////////////////////////////////
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is $accx, i.e. follow $accx
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	$acc1,$a1,$a0		// a[1]*a[0]
+	umulh	$t1,$a1,$a0
+	mul	$acc2,$a2,$a0		// a[2]*a[0]
+	umulh	$t2,$a2,$a0
+	mul	$acc3,$a3,$a0		// a[3]*a[0]
+	umulh	$acc4,$a3,$a0
+
+	adds	$acc2,$acc2,$t1		// accumulate high parts of multiplication
+	 mul	$t0,$a2,$a1		// a[2]*a[1]
+	 umulh	$t1,$a2,$a1
+	adcs	$acc3,$acc3,$t2
+	 mul	$t2,$a3,$a1		// a[3]*a[1]
+	 umulh	$t3,$a3,$a1
+	adc	$acc4,$acc4,xzr		// can't overflow
+
+	mul	$acc5,$a3,$a2		// a[3]*a[2]
+	umulh	$acc6,$a3,$a2
+
+	adds	$t1,$t1,$t2		// accumulate high parts of multiplication
+	 mul	$acc0,$a0,$a0		// a[0]*a[0]
+	adc	$t2,$t3,xzr		// can't overflow
+
+	adds	$acc3,$acc3,$t0		// accumulate low parts of multiplication
+	 umulh	$a0,$a0,$a0
+	adcs	$acc4,$acc4,$t1
+	 mul	$t1,$a1,$a1		// a[1]*a[1]
+	adcs	$acc5,$acc5,$t2
+	 umulh	$a1,$a1,$a1
+	adc	$acc6,$acc6,xzr		// can't overflow
+
+	adds	$acc1,$acc1,$acc1	// acc[1-6]*=2
+	 mul	$t2,$a2,$a2		// a[2]*a[2]
+	adcs	$acc2,$acc2,$acc2
+	 umulh	$a2,$a2,$a2
+	adcs	$acc3,$acc3,$acc3
+	 mul	$t3,$a3,$a3		// a[3]*a[3]
+	adcs	$acc4,$acc4,$acc4
+	 umulh	$a3,$a3,$a3
+	adcs	$acc5,$acc5,$acc5
+	adcs	$acc6,$acc6,$acc6
+	adc	$acc7,xzr,xzr
+
+	adds	$acc1,$acc1,$a0		// +a[i]*a[i]
+	 mul	$t4,$acc0,$ordk
+	adcs	$acc2,$acc2,$t1
+	adcs	$acc3,$acc3,$a1
+	adcs	$acc4,$acc4,$t2
+	adcs	$acc5,$acc5,$a2
+	adcs	$acc6,$acc6,$t3
+	adc	$acc7,$acc7,$a3
+___
+for($i=0; $i<4; $i++) {			# reductions
+$code.=<<___;
+	subs	xzr,$acc0,#1
+	umulh	$t1,$ord0,$t4
+	mul	$t2,$ord1,$t4
+	umulh	$t3,$ord1,$t4
+
+	adcs	$t2,$t2,$t1
+	adc	$t3,$t3,xzr
+
+	adds	$acc0,$acc1,$t2
+	adcs	$acc1,$acc2,$t3
+	adcs	$acc2,$acc3,$t4
+	adc	$acc3,xzr,$t4		// can't overflow
+___
+$code.=<<___	if ($i<3);
+	mul	$t3,$acc0,$ordk
+___
+$code.=<<___;
+	lsl	$t0,$t4,#32
+	subs	$acc1,$acc1,$t4
+	lsr	$t1,$t4,#32
+	sbcs	$acc2,$acc2,$t0
+	sbc	$acc3,$acc3,$t1		// can't borrow
+___
+	($t3,$t4) = ($t4,$t3);
+}
+$code.=<<___;
+	adds	$acc0,$acc0,$acc4	// accumulate upper half
+	adcs	$acc1,$acc1,$acc5
+	adcs	$acc2,$acc2,$acc6
+	adcs	$acc3,$acc3,$acc7
+	adc	$acc4,xzr,xzr
+
+	subs	$t0,$acc0,$ord0		// ret -= modulus
+	sbcs	$t1,$acc1,$ord1
+	sbcs	$t2,$acc2,$ord2
+	sbcs	$t3,$acc3,$ord3
+	sbcs	xzr,$acc4,xzr
+
+	csel	$a0,$acc0,$t0,lo	// ret = borrow ? ret : ret-modulus
+	csel	$a1,$acc1,$t1,lo
+	csel	$a2,$acc2,$t2,lo
+	csel	$a3,$acc3,$t3,lo
+
+	cbnz	$bp,.Loop_ord_sqr
+
+	stp	$a0,$a1,[$rp]
+	stp	$a2,$a3,[$rp,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+.size	ecp_nistz256_ord_sqr_mont,.-ecp_nistz256_ord_sqr_mont
+___
+}	}
+
+########################################################################
+# select subroutines
+# These select functions are similar to those in p256-x86_64-asm.pl
+# They load all points in the lookup table
+# keeping in the output only the one corresponding to the input index.
+{
+my ($val,$in_t)=map("x$_",(0..1));
+my ($index)=("w2");
+my ($Idx_ctr,$Val_in, $Mask_64)=("w9", "x10", "x11");
+my ($Mask)=("v3");
+my ($Ra,$Rb,$Rc,$Rd,$Re,$Rf)=map("v$_",(16..21));
+my ($T0a,$T0b,$T0c,$T0d,$T0e,$T0f)=map("v$_",(22..27));
+$code.=<<___;
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w5(uint64_t *val, uint64_t *in_t, int index);
+.globl	ecp_nistz256_select_w5
+.type	ecp_nistz256_select_w5,%function
+.align	4
+ecp_nistz256_select_w5:
+    AARCH64_VALID_CALL_TARGET
+
+    // $Val_in := $val
+    // $Idx_ctr := 0; loop counter and incremented internal index
+    mov     $Val_in, $val
+    mov     $Idx_ctr, #0
+
+    // [$Ra-$Rf] := 0
+    movi    $Ra.16b, #0
+    movi    $Rb.16b, #0
+    movi    $Rc.16b, #0
+    movi    $Rd.16b, #0
+    movi    $Re.16b, #0
+    movi    $Rf.16b, #0
+
+.Lselect_w5_loop:
+    // Loop 16 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+    add $Idx_ctr, $Idx_ctr, #1
+
+    // [$T0a-$T0f] := Load a (3*256-bit = 6*128-bit) table entry starting at $in_t
+    //  and advance $in_t to point to the next entry
+    ld1     {$T0a.2d, $T0b.2d, $T0c.2d, $T0d.2d}, [$in_t],#64
+
+    // $Mask_64 := ($Idx_ctr == $index)? All 1s : All 0s
+    cmp     $Idx_ctr, $index
+    csetm   $Mask_64, eq
+
+    // continue loading ...
+    ld1     {$T0e.2d, $T0f.2d}, [$in_t],#32
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+    dup     $Mask.2d, $Mask_64
+
+    // [$Ra-$Rd] := (Mask == all 1s)? [$T0a-$T0d] : [$Ra-$Rd]
+    // i.e., values in output registers will remain the same if $Idx_ctr != $index
+    bit     $Ra.16b, $T0a.16b, $Mask.16b
+    bit     $Rb.16b, $T0b.16b, $Mask.16b
+
+    bit     $Rc.16b, $T0c.16b, $Mask.16b
+    bit     $Rd.16b, $T0d.16b, $Mask.16b
+
+    bit     $Re.16b, $T0e.16b, $Mask.16b
+    bit     $Rf.16b, $T0f.16b, $Mask.16b
+
+    // If bit #4 is not 0 (i.e. idx_ctr < 16) loop back
+    tbz    $Idx_ctr, #4, .Lselect_w5_loop
+
+    // Write [$Ra-$Rf] to memory at the output pointer
+    st1     {$Ra.2d, $Rb.2d, $Rc.2d, $Rd.2d}, [$Val_in],#64
+    st1     {$Re.2d, $Rf.2d}, [$Val_in]
+
+	ret
+.size	ecp_nistz256_select_w5,.-ecp_nistz256_select_w5
+
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w7(uint64_t *val, uint64_t *in_t, int index);
+.globl	ecp_nistz256_select_w7
+.type	ecp_nistz256_select_w7,%function
+.align	4
+ecp_nistz256_select_w7:
+    AARCH64_VALID_CALL_TARGET
+
+    // $Idx_ctr := 0; loop counter and incremented internal index
+    mov     $Idx_ctr, #0
+
+    // [$Ra-$Rf] := 0
+    movi    $Ra.16b, #0
+    movi    $Rb.16b, #0
+    movi    $Rc.16b, #0
+    movi    $Rd.16b, #0
+
+.Lselect_w7_loop:
+    // Loop 64 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+    add $Idx_ctr, $Idx_ctr, #1
+
+    // [$T0a-$T0d] := Load a (2*256-bit = 4*128-bit) table entry starting at $in_t
+    //  and advance $in_t to point to the next entry
+    ld1     {$T0a.2d, $T0b.2d, $T0c.2d, $T0d.2d}, [$in_t],#64
+
+    // $Mask_64 := ($Idx_ctr == $index)? All 1s : All 0s
+    cmp     $Idx_ctr, $index
+    csetm   $Mask_64, eq
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+    dup     $Mask.2d, $Mask_64
+
+    // [$Ra-$Rd] := (Mask == all 1s)? [$T0a-$T0d] : [$Ra-$Rd]
+    // i.e., values in output registers will remain the same if $Idx_ctr != $index
+    bit     $Ra.16b, $T0a.16b, $Mask.16b
+    bit     $Rb.16b, $T0b.16b, $Mask.16b
+
+    bit     $Rc.16b, $T0c.16b, $Mask.16b
+    bit     $Rd.16b, $T0d.16b, $Mask.16b
+
+    // If bit #6 is not 0 (i.e. idx_ctr < 64) loop back
+    tbz    $Idx_ctr, #6, .Lselect_w7_loop
+
+    // Write [$Ra-$Rd] to memory at the output pointer
+    st1     {$Ra.2d, $Rb.2d, $Rc.2d, $Rd.2d}, [$val]
+
+	ret
+.size	ecp_nistz256_select_w7,.-ecp_nistz256_select_w7
+___
+}
+
+foreach (split("\n",$code)) {
+	s/\`([^\`]*)\`/eval $1/ge;
+
+	print $_,"\n";
+}
+close STDOUT or die "error closing STDOUT: $!";	# enforce flush
diff --git a/src/crypto/fipsmodule/ec/asm/p256_beeu-armv8-asm.pl b/src/crypto/fipsmodule/ec/asm/p256_beeu-armv8-asm.pl
new file mode 100644
index 0000000..e259aef
--- /dev/null
+++ b/src/crypto/fipsmodule/ec/asm/p256_beeu-armv8-asm.pl
@@ -0,0 +1,455 @@
+# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+# SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+# OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+# CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+#
+#
+# This code is based on p256_beeu-x86_64-asm.pl (which is based on BN_mod_inverse_odd).
+#
+
+# The first two arguments should always be the flavour and output file path.
+if ($#ARGV < 1) { die "Not enough arguments provided.
+  Two arguments are necessary: the flavour and the output file path."; }
+
+$flavour = shift;
+$output  = shift;
+
+$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
+( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
+( $xlate="${dir}../../../perlasm/arm-xlate.pl" and -f $xlate) or
+die "can't locate arm-xlate.pl";
+
+open OUT,"| \"$^X\" $xlate $flavour $output";
+*STDOUT=*OUT;
+#############################################################################
+# extern int beeu_mod_inverse_vartime(BN_ULONG out[P256_LIMBS],
+#                                     BN_ULONG a[P256_LIMBS],
+#                                     BN_ULONG n[P256_LIMBS]);
+#
+# (Binary Extended GCD (Euclidean) Algorithm.
+#  See A. Menezes, P. vanOorschot, and S. Vanstone's Handbook of Applied Cryptography,
+#  Chapter 14, Algorithm 14.61 and Note 14.64
+#  http://cacr.uwaterloo.ca/hac/about/chap14.pdf)
+
+# Assumption 1: n is odd for the BEEU
+# Assumption 2: 1 < a < n < 2^256
+
+# Details
+# The inverse of x modulo y can be calculated using Alg. 14.61, where "a" would be that inverse.
+# In other words,
+# ax == 1 (mod y) (where the symbol “==“ denotes ”congruent“)
+#  a == x^{-1} (mod y)
+#
+# It can be shown that throughout all the iterations of the algorithm, the following holds:
+#    u = Ax + By
+#    v = Cx + Dy
+# The values B and D are not of interest in this case, so they need not be computed by the algorithm.
+# This means the following congruences hold through the iterations of the algorithm.
+#    Ax == u (mod y)
+#    Cx == v (mod y)
+
+# Now we will modify the notation to match that of BN_mod_inverse_odd()
+# on which beeu_mod_inverse_vartime() in `p256_beeu-x86_64-asm` is based.
+# In those functions:
+#    x, y -> a, n
+#    u, v -> B, A
+#    A, C -> X, Y’, where Y’ = -Y
+# Hence, the following holds throughout the algorithm iterations
+#    Xa == B (mod n)
+#   -Ya == A (mod n)
+#
+# Same algorithm in Python:
+# def beeu(a, n):
+#     X = 1
+#     Y = 0
+#     B = a
+#     A = n
+#     while (B != 0):
+#         while (B % 2) == 0:
+#             B >>= 1
+#             if (X % 2) == 1:
+#                 X = X + n
+#             X >>= 1
+#         while (A % 2) == 0:
+#             A >>= 1
+#             if (Y % 2) == 1:
+#                 Y = Y + n
+#             Y >>= 1
+#         if (B >= A):
+#             B = B - A
+#             X = X + Y
+#         else:
+#             A = A - B
+#             Y = Y + X
+#     if (A != 1):
+#         # error
+#         return 0
+#     else:
+#         while (Y > n):
+#             Y = Y - n
+#         Y = n - Y
+#         return Y
+
+
+# For the internal variables,
+# x0-x2, x30 are used to hold the modulus n. The input parameters passed in
+# x1,x2 are copied first before corrupting them. x0 (out) is stored on the stack.
+# x3-x7 are used for parameters, which is not the case in this function, so they are corruptible
+# x8 is corruptible here
+# (the function doesn't return a struct, hence x8 doesn't contain a passed-in address
+#  for that struct).
+# x9-x15 are corruptible registers
+# x19-x28 are callee-saved registers
+
+# X/Y will hold the inverse parameter
+# Assumption: a,n,X,Y < 2^(256)
+# Initially, X := 1, Y := 0
+#            A := n, B := a
+
+# Function parameters (as per the Procedure Call Standard)
+my($out, $a_in, $n_in)=map("x$_",(0..2));
+# Internal variables
+my($n0, $n1, $n2, $n3)=map("x$_",(0..2,30));
+my($x0, $x1, $x2, $x3, $x4)=map("x$_",(3..7));
+my($y0, $y1, $y2, $y3, $y4)=map("x$_",(8..12));
+my($shift)=("x13");
+my($t0, $t1, $t2, $t3)=map("x$_",(14,15,19,20));
+my($a0, $a1, $a2, $a3)=map("x$_",(21..24));
+my($b0, $b1, $b2, $b3)=map("x$_",(25..28));
+
+# if B == 0, jump to end of loop
+sub TEST_B_ZERO {
+  return <<___;
+    orr     $t0, $b0, $b1
+    orr     $t0, $t0, $b2
+
+    // reverse the bit order of $b0. This is needed for clz after this macro
+    rbit     $t1, $b0
+
+    orr     $t0, $t0, $b3
+    cbz     $t0,.Lbeeu_loop_end
+___
+}
+
+# Shift right by 1 bit, adding the modulus first if the variable is odd
+# if least_sig_bit(var0) == 0,
+#     goto shift1_<ctr>
+# else
+#     add n and goto shift1_<ctr>
+# Prerequisite: t0 = 0
+$g_next_label = 0;
+sub SHIFT1 {
+  my ($var0, $var1, $var2, $var3, $var4) = @_;
+  my $label = ".Lshift1_${g_next_label}";
+  $g_next_label++;
+  return <<___;
+    tbz     $var0, #0, $label
+    adds    $var0, $var0, $n0
+    adcs    $var1, $var1, $n1
+    adcs    $var2, $var2, $n2
+    adcs    $var3, $var3, $n3
+    adc     $var4, $var4, $t0
+$label:
+    // var0 := [var1|var0]<64..1>;
+    // i.e. concatenate var1 and var0,
+    //      extract bits <64..1> from the resulting 128-bit value
+    //      and put them in var0
+    extr    $var0, $var1, $var0, #1
+    extr    $var1, $var2, $var1, #1
+    extr    $var2, $var3, $var2, #1
+    extr    $var3, $var4, $var3, #1
+    lsr     $var4, $var4, #1
+___
+}
+
+# compilation by clang 10.0.0 with -O2/-O3 of
+#      a[0] = (a[0] >> count) | (a[1] << (64-count));
+#      a[1] = (a[1] >> count) | (a[2] << (64-count));
+#      a[2] = (a[2] >> count) | (a[3] << (64-count));
+#      a[3] >>= count;
+# Note: EXTR instruction used in SHIFT1 is similar to x86_64's SHRDQ
+# except that the second source operand of EXTR is only immediate;
+# that's why it cannot be used here where $shift is a variable
+#
+# In the following,
+# t0 := 0 - shift
+#
+# then var0, for example, will be shifted right as follows:
+# var0 := (var0 >> (uint(shift) mod 64)) | (var1 << (uint(t0) mod 64))
+# "uint() mod 64" is from the definition of LSL and LSR instructions.
+#
+# What matters here is the order of instructions relative to certain other
+# instructions, i.e.
+# - lsr and lsl must precede orr of the corresponding registers.
+# - lsl must preced the lsr of the same register afterwards.
+# The chosen order of the instructions overall is to try and maximize
+# the pipeline usage.
+sub SHIFT256 {
+  my ($var0, $var1, $var2, $var3) = @_;
+  return <<___;
+    neg $t0, $shift
+    lsr $var0, $var0, $shift
+    lsl $t1, $var1, $t0
+
+    lsr $var1, $var1, $shift
+    lsl $t2, $var2, $t0
+
+    orr $var0, $var0, $t1
+
+    lsr $var2, $var2, $shift
+    lsl $t3, $var3, $t0
+
+    orr $var1, $var1, $t2
+
+    lsr $var3, $var3, $shift
+
+    orr $var2, $var2, $t3
+___
+}
+
+$code.=<<___;
+#include "openssl/arm_arch.h"
+
+.text
+.globl  beeu_mod_inverse_vartime
+.type   beeu_mod_inverse_vartime, %function
+.align  4
+beeu_mod_inverse_vartime:
+    // Reserve enough space for 14 8-byte registers on the stack
+    // in the first stp call for x29, x30.
+    // Then store the remaining callee-saved registers.
+    //
+    //    | x29 | x30 | x19 | x20 | ... | x27 | x28 |  x0 |  x2 |
+    //    ^                                                     ^
+    //    sp  <------------------- 112 bytes ----------------> old sp
+    //   x29 (FP)
+    //
+    AARCH64_SIGN_LINK_REGISTER
+    stp     x29,x30,[sp,#-112]!
+    add     x29,sp,#0
+    stp     x19,x20,[sp,#16]
+    stp     x21,x22,[sp,#32]
+    stp     x23,x24,[sp,#48]
+    stp     x25,x26,[sp,#64]
+    stp     x27,x28,[sp,#80]
+    stp     x0,x2,[sp,#96]
+
+    // B = b3..b0 := a
+    ldp     $b0,$b1,[$a_in]
+    ldp     $b2,$b3,[$a_in,#16]
+
+    // n3..n0 := n
+    // Note: the value of input params are changed in the following.
+    ldp     $n0,$n1,[$n_in]
+    ldp     $n2,$n3,[$n_in,#16]
+
+    // A = a3..a0 := n
+    mov     $a0, $n0
+    mov     $a1, $n1
+    mov     $a2, $n2
+    mov     $a3, $n3
+
+    // X = x4..x0 := 1
+    mov     $x0, #1
+    eor     $x1, $x1, $x1
+    eor     $x2, $x2, $x2
+    eor     $x3, $x3, $x3
+    eor     $x4, $x4, $x4
+
+    // Y = y4..y0 := 0
+    eor     $y0, $y0, $y0
+    eor     $y1, $y1, $y1
+    eor     $y2, $y2, $y2
+    eor     $y3, $y3, $y3
+    eor     $y4, $y4, $y4
+
+.Lbeeu_loop:
+    // if B == 0, jump to .Lbeeu_loop_end
+    ${\TEST_B_ZERO}
+
+    // 0 < B < |n|,
+    // 0 < A <= |n|,
+    // (1)      X*a  ==  B   (mod |n|),
+    // (2) (-1)*Y*a  ==  A   (mod |n|)
+
+    // Now divide B by the maximum possible power of two in the
+    // integers, and divide X by the same value mod |n|.
+    // When we're done, (1) still holds.
+
+    // shift := number of trailing 0s in $b0
+    // (      = number of leading 0s in $t1; see the "rbit" instruction in TEST_B_ZERO)
+    clz     $shift, $t1
+
+    // If there is no shift, goto shift_A_Y
+    cbz     $shift, .Lbeeu_shift_A_Y
+
+    // Shift B right by "$shift" bits
+    ${\SHIFT256($b0, $b1, $b2, $b3)}
+
+    // Shift X right by "$shift" bits, adding n whenever X becomes odd.
+    // $shift--;
+    // $t0 := 0; needed in the addition to the most significant word in SHIFT1
+    eor     $t0, $t0, $t0
+.Lbeeu_shift_loop_X:
+    ${\SHIFT1($x0, $x1, $x2, $x3, $x4)}
+    subs    $shift, $shift, #1
+    bne     .Lbeeu_shift_loop_X
+
+    // Note: the steps above perform the same sequence as in p256_beeu-x86_64-asm.pl
+    // with the following differences:
+    // - "$shift" is set directly to the number of trailing 0s in B
+    //   (using rbit and clz instructions)
+    // - The loop is only used to call SHIFT1(X)
+    //   and $shift is decreased while executing the X loop.
+    // - SHIFT256(B, $shift) is performed before right-shifting X; they are independent
+
+.Lbeeu_shift_A_Y:
+    // Same for A and Y.
+    // Afterwards, (2) still holds.
+    // Reverse the bit order of $a0
+    // $shift := number of trailing 0s in $a0 (= number of leading 0s in $t1)
+    rbit    $t1, $a0
+    clz     $shift, $t1
+
+    // If there is no shift, goto |B-A|, X+Y update
+    cbz     $shift, .Lbeeu_update_B_X_or_A_Y
+
+    // Shift A right by "$shift" bits
+    ${\SHIFT256($a0, $a1, $a2, $a3)}
+
+    // Shift Y right by "$shift" bits, adding n whenever Y becomes odd.
+    // $shift--;
+    // $t0 := 0; needed in the addition to the most significant word in SHIFT1
+    eor     $t0, $t0, $t0
+.Lbeeu_shift_loop_Y:
+    ${\SHIFT1($y0, $y1, $y2, $y3, $y4)}
+    subs    $shift, $shift, #1
+    bne     .Lbeeu_shift_loop_Y
+
+.Lbeeu_update_B_X_or_A_Y:
+    // Try T := B - A; if cs, continue with B > A (cs: carry set = no borrow)
+    // Note: this is a case of unsigned arithmetic, where T fits in 4 64-bit words
+    //       without taking a sign bit if generated. The lack of a carry would
+    //       indicate a negative result. See, for example,
+    //       https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/condition-codes-1-condition-flags-and-codes
+    subs    $t0, $b0, $a0
+    sbcs    $t1, $b1, $a1
+    sbcs    $t2, $b2, $a2
+    sbcs    $t3, $b3, $a3
+    bcs     .Lbeeu_B_greater_than_A
+
+    // Else A > B =>
+    // A := A - B; Y := Y + X; goto beginning of the loop
+    subs    $a0, $a0, $b0
+    sbcs    $a1, $a1, $b1
+    sbcs    $a2, $a2, $b2
+    sbcs    $a3, $a3, $b3
+
+    adds    $y0, $y0, $x0
+    adcs    $y1, $y1, $x1
+    adcs    $y2, $y2, $x2
+    adcs    $y3, $y3, $x3
+    adc     $y4, $y4, $x4
+    b       .Lbeeu_loop
+
+.Lbeeu_B_greater_than_A:
+    // Continue with B > A =>
+    // B := B - A; X := X + Y; goto beginning of the loop
+    mov     $b0, $t0
+    mov     $b1, $t1
+    mov     $b2, $t2
+    mov     $b3, $t3
+
+    adds    $x0, $x0, $y0
+    adcs    $x1, $x1, $y1
+    adcs    $x2, $x2, $y2
+    adcs    $x3, $x3, $y3
+    adc     $x4, $x4, $y4
+    b       .Lbeeu_loop
+
+.Lbeeu_loop_end:
+    // The Euclid's algorithm loop ends when A == gcd(a,n);
+    // this would be 1, when a and n are co-prime (i.e. do not have a common factor).
+    // Since (-1)*Y*a == A (mod |n|), Y>0
+    // then out = -Y mod n
+
+    // Verify that A = 1 ==> (-1)*Y*a = A = 1  (mod |n|)
+    // Is A-1 == 0?
+    // If not, fail.
+    sub     $t0, $a0, #1
+    orr     $t0, $t0, $a1
+    orr     $t0, $t0, $a2
+    orr     $t0, $t0, $a3
+    cbnz    $t0, .Lbeeu_err
+
+    // If Y>n ==> Y:=Y-n
+.Lbeeu_reduction_loop:
+    // x_i := y_i - n_i (X is no longer needed, use it as temp)
+    // ($t0 = 0 from above)
+    subs    $x0, $y0, $n0
+    sbcs    $x1, $y1, $n1
+    sbcs    $x2, $y2, $n2
+    sbcs    $x3, $y3, $n3
+    sbcs    $x4, $y4, $t0
+
+    // If result is non-negative (i.e., cs = carry set = no borrow),
+    // y_i := x_i; goto reduce again
+    // else
+    // y_i := y_i; continue
+    csel    $y0, $x0, $y0, cs
+    csel    $y1, $x1, $y1, cs
+    csel    $y2, $x2, $y2, cs
+    csel    $y3, $x3, $y3, cs
+    csel    $y4, $x4, $y4, cs
+    bcs     .Lbeeu_reduction_loop
+
+    // Now Y < n (Y cannot be equal to n, since the inverse cannot be 0)
+    // out = -Y = n-Y
+    subs    $y0, $n0, $y0
+    sbcs    $y1, $n1, $y1
+    sbcs    $y2, $n2, $y2
+    sbcs    $y3, $n3, $y3
+
+    // Save Y in output (out (x0) was saved on the stack)
+    ldr     x3, [sp,#96]
+    stp     $y0, $y1, [x3]
+    stp     $y2, $y3, [x3,#16]
+    // return 1 (success)
+    mov     x0, #1
+    b       .Lbeeu_finish
+
+.Lbeeu_err:
+    // return 0 (error)
+    eor     x0, x0, x0
+
+.Lbeeu_finish:
+    // Restore callee-saved registers, except x0, x2
+    add     sp,x29,#0
+    ldp     x19,x20,[sp,#16]
+    ldp     x21,x22,[sp,#32]
+    ldp     x23,x24,[sp,#48]
+    ldp     x25,x26,[sp,#64]
+    ldp     x27,x28,[sp,#80]
+    ldp     x29,x30,[sp],#112
+
+    AARCH64_VALIDATE_LINK_REGISTER
+    ret
+.size beeu_mod_inverse_vartime,.-beeu_mod_inverse_vartime
+___
+
+
+foreach (split("\n",$code)) {
+    s/\`([^\`]*)\`/eval $1/ge;
+
+    print $_,"\n";
+}
+close STDOUT or die "error closing STDOUT: $!"; # enforce flush
diff --git a/src/crypto/fipsmodule/ec/ec.c b/src/crypto/fipsmodule/ec/ec.c
index 93fdcfc..c70fb11 100644
--- a/src/crypto/fipsmodule/ec/ec.c
+++ b/src/crypto/fipsmodule/ec/ec.c
@@ -246,7 +246,8 @@
   out->curves[2].param_len = 32;
   out->curves[2].params = kP256Params;
   out->curves[2].method =
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
+#if !defined(OPENSSL_NO_ASM) && \
+    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&   \
     !defined(OPENSSL_SMALL)
       EC_GFp_nistz256_method();
 #else
@@ -1174,15 +1175,12 @@
     return 0;
   }
 
-  // For simplicity, in case of width mismatches between |group->field| and
-  // |group->order|, zero any untouched words in |out|.
-  OPENSSL_memset(out, 0, sizeof(EC_SCALAR));
-  for (size_t i = 0; i < len; i++) {
-    out->bytes[len - i - 1] = bytes[i];
-  }
-
-  // We must have p < 2×order, assuming p is not tiny (p >= 17). Thus rather we
-  // can reduce by performing at most one subtraction.
+  // The x-coordinate is bounded by p, but we need a scalar, bounded by the
+  // order. These may not have the same size. However, we must have p < 2×order,
+  // assuming p is not tiny (p >= 17).
+  //
+  // Thus |bytes| will fit in |order.width + 1| words, and we can reduce by
+  // performing at most one subtraction.
   //
   // Proof: We only work with prime order curves, so the number of points on
   // the curve is the order. Thus Hasse's theorem gives:
@@ -1196,14 +1194,11 @@
   //
   // Additionally, one can manually check this property for built-in curves. It
   // is enforced for legacy custom curves in |EC_GROUP_set_generator|.
-
-  // The above does not guarantee |group->field| is not one word larger than
-  // |group->order|, so read one extra carry word.
-  BN_ULONG tmp[EC_MAX_WORDS];
-  BN_ULONG carry =
-      group->order.width < EC_MAX_WORDS ? out->words[group->order.width] : 0;
-  bn_reduce_once_in_place(out->words, carry, group->order.d, tmp,
-                          group->order.width);
+  const BIGNUM *order = &group->order;
+  BN_ULONG words[EC_MAX_WORDS + 1];
+  bn_big_endian_to_words(words, order->width + 1, bytes, len);
+  bn_reduce_once(out->words, words, /*carry=*/words[order->width], order->d,
+                 order->width);
   return 1;
 }
 
diff --git a/src/crypto/fipsmodule/ec/ec_key.c b/src/crypto/fipsmodule/ec/ec_key.c
index 2d04d13..8b89dc2 100644
--- a/src/crypto/fipsmodule/ec/ec_key.c
+++ b/src/crypto/fipsmodule/ec/ec_key.c
@@ -329,14 +329,17 @@
 }
 
 int EC_KEY_check_fips(const EC_KEY *key) {
+  int ret = 0;
+  FIPS_service_indicator_lock_state();
+
   if (EC_KEY_is_opaque(key)) {
     // Opaque keys can't be checked.
     OPENSSL_PUT_ERROR(EC, EC_R_PUBLIC_KEY_VALIDATION_FAILED);
-    return 0;
+    goto end;
   }
 
   if (!EC_KEY_check_key(key)) {
-    return 0;
+    goto end;
   }
 
   if (key->priv_key) {
@@ -350,11 +353,19 @@
     ECDSA_SIG_free(sig);
     if (!ok) {
       OPENSSL_PUT_ERROR(EC, EC_R_PUBLIC_KEY_VALIDATION_FAILED);
-      return 0;
+      goto end;
     }
   }
 
-  return 1;
+  ret = 1;
+
+end:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    EC_KEY_keygen_verify_service_indicator(key);
+  }
+
+  return ret;
 }
 
 int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, const BIGNUM *x,
diff --git a/src/crypto/fipsmodule/ec/internal.h b/src/crypto/fipsmodule/ec/internal.h
index 488adb8..522c8d9 100644
--- a/src/crypto/fipsmodule/ec/internal.h
+++ b/src/crypto/fipsmodule/ec/internal.h
@@ -100,9 +100,7 @@
 // An EC_SCALAR is an integer fully reduced modulo the order. Only the first
 // |order->width| words are used. An |EC_SCALAR| is specific to an |EC_GROUP|
 // and must not be mixed between groups.
-typedef union {
-  // bytes is the representation of the scalar in little-endian order.
-  uint8_t bytes[EC_MAX_BYTES];
+typedef struct {
   BN_ULONG words[EC_MAX_WORDS];
 } EC_SCALAR;
 
@@ -192,9 +190,7 @@
 // are used. An |EC_FELEM| is specific to an |EC_GROUP| and must not be mixed
 // between groups. Additionally, the representation (whether or not elements are
 // represented in Montgomery-form) may vary between |EC_METHOD|s.
-typedef union {
-  // bytes is the representation of the field element in little-endian order.
-  uint8_t bytes[EC_MAX_BYTES];
+typedef struct {
   BN_ULONG words[EC_MAX_WORDS];
 } EC_FELEM;
 
diff --git a/src/crypto/fipsmodule/ec/make_p256-x86_64-tests.go b/src/crypto/fipsmodule/ec/make_p256-nistz-tests.go
similarity index 96%
rename from src/crypto/fipsmodule/ec/make_p256-x86_64-tests.go
rename to src/crypto/fipsmodule/ec/make_p256-nistz-tests.go
index 958a97a..36194e6 100644
--- a/src/crypto/fipsmodule/ec/make_p256-x86_64-tests.go
+++ b/src/crypto/fipsmodule/ec/make_p256-nistz-tests.go
@@ -69,7 +69,7 @@
 
 func isAffineInfinity(x, y *big.Int) bool {
 	// Infinity, in affine coordinates, is represented as (0, 0) by
-	// both Go and p256-x86_64-asm.pl.
+	// both Go, p256-x86_64-asm.pl and p256-armv8-asm.pl.
 	return x.Sign() == 0 && y.Sign() == 0
 }
 
@@ -107,8 +107,8 @@
 		// arbitrary X and Y and include the special case. We also have
 		// not verified that add and double preserve this
 		// property. Thus, generate test vectors with unrelated X and Y,
-		// to test that p256-x86_64-asm.pl correctly handles
-		// unconstrained representations of infinity.
+		// to test that p256-x86_64-asm.pl and p256-armv8-asm.pl correctly
+		// handle unconstrained representations of infinity.
 		x = randNonZeroInt(p)
 		y = randNonZeroInt(p)
 		z = zero
diff --git a/src/crypto/fipsmodule/ec/make_tables.go b/src/crypto/fipsmodule/ec/make_tables.go
index 34e8c23..dbcaab0 100644
--- a/src/crypto/fipsmodule/ec/make_tables.go
+++ b/src/crypto/fipsmodule/ec/make_tables.go
@@ -23,8 +23,8 @@
 )
 
 func main() {
-	if err := writeP256X86_64Table("p256-x86_64-table.h"); err != nil {
-		fmt.Fprintf(os.Stderr, "Error writing p256-x86_64-table.h: %s\n", err)
+	if err := writeP256NistzTable("p256-nistz-table.h"); err != nil {
+		fmt.Fprintf(os.Stderr, "Error writing p256-nistz-table.h: %s\n", err)
 		os.Exit(1)
 	}
 
@@ -34,7 +34,7 @@
 	}
 }
 
-func writeP256X86_64Table(path string) error {
+func writeP256NistzTable(path string) error {
 	curve := elliptic.P256()
 	tables := make([][][2]*big.Int, 0, 37)
 	for shift := 0; shift < 256; shift += 7 {
@@ -59,7 +59,7 @@
  */
 
 // This is the precomputed constant time access table for the code in
-// p256-x86_64.c, for the default generator. The table consists of 37
+// p256-nistz.c, for the default generator. The table consists of 37
 // subtables, each subtable contains 64 affine points. The affine points are
 // encoded as eight uint64's, four for the x coordinate and four for the y.
 // Both values are in little-endian order. There are 37 tables because a
diff --git a/src/crypto/fipsmodule/ec/p224-64.c b/src/crypto/fipsmodule/ec/p224-64.c
index da4308c..0f51970 100644
--- a/src/crypto/fipsmodule/ec/p224-64.c
+++ b/src/crypto/fipsmodule/ec/p224-64.c
@@ -52,11 +52,6 @@
 typedef p224_limb p224_felem[4];
 typedef p224_widelimb p224_widefelem[7];
 
-// Field element represented as a byte arrary. 28*8 = 224 bits is also the
-// group order size for the elliptic curve, and we also use this type for
-// scalars for point multiplication.
-typedef uint8_t p224_felem_bytearray[28];
-
 // Precomputed multiples of the standard generator
 // Points are given in coordinates (X, Y, Z) where Z normally is 1
 // (0 for the point at infinity).
@@ -180,31 +175,16 @@
       {0x32477c61b6e8c6, 0xb46a97570f018b, 0x91176d0a7e95d1, 0x3df90fbc4c7d0e},
       {1, 0, 0, 0}}}};
 
-static uint64_t p224_load_u64(const uint8_t in[8]) {
-  uint64_t ret;
-  OPENSSL_memcpy(&ret, in, sizeof(ret));
-  return ret;
-}
 
 // Helper functions to convert field elements to/from internal representation
-static void p224_bin28_to_felem(p224_felem out, const uint8_t in[28]) {
-  out[0] = p224_load_u64(in) & 0x00ffffffffffffff;
-  out[1] = p224_load_u64(in + 7) & 0x00ffffffffffffff;
-  out[2] = p224_load_u64(in + 14) & 0x00ffffffffffffff;
-  out[3] = p224_load_u64(in + 20) >> 8;
-}
-
-static void p224_felem_to_bin28(uint8_t out[28], const p224_felem in) {
-  for (size_t i = 0; i < 7; ++i) {
-    out[i] = in[0] >> (8 * i);
-    out[i + 7] = in[1] >> (8 * i);
-    out[i + 14] = in[2] >> (8 * i);
-    out[i + 21] = in[3] >> (8 * i);
-  }
-}
 
 static void p224_generic_to_felem(p224_felem out, const EC_FELEM *in) {
-  p224_bin28_to_felem(out, in->bytes);
+  // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM|
+  // uses four 64-bit words. (The top-most word only has 32 bits.)
+  out[0] = in->words[0] & 0x00ffffffffffffff;
+  out[1] = ((in->words[0] >> 56) | (in->words[1] << 8)) & 0x00ffffffffffffff;
+  out[2] = ((in->words[1] >> 48) | (in->words[2] << 16)) & 0x00ffffffffffffff;
+  out[3] = ((in->words[2] >> 40) | (in->words[3] << 24)) & 0x00ffffffffffffff;
 }
 
 // Requires 0 <= in < 2*p (always call p224_felem_reduce first)
@@ -256,9 +236,12 @@
   tmp2[2] = tmp[2];
   tmp2[3] = tmp[3];
 
-  p224_felem_to_bin28(out->bytes, tmp2);
-  // 224 is not a multiple of 64, so zero the remaining bytes.
-  OPENSSL_memset(out->bytes + 28, 0, 32 - 28);
+  // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM|
+  // uses four 64-bit words. (The top-most word only has 32 bits.)
+  out->words[0] = tmp2[0] | (tmp2[1] << 56);
+  out->words[1] = (tmp2[1] >> 8) | (tmp2[2] << 48);
+  out->words[2] = (tmp2[2] >> 16) | (tmp2[3] << 40);
+  out->words[3] = tmp2[3] >> 24;
 }
 
 
@@ -865,12 +848,13 @@
   }
 }
 
-// p224_get_bit returns the |i|th bit in |in|
-static crypto_word_t p224_get_bit(const p224_felem_bytearray in, size_t i) {
+// p224_get_bit returns the |i|th bit in |in|.
+static crypto_word_t p224_get_bit(const EC_SCALAR *in, size_t i) {
   if (i >= 224) {
     return 0;
   }
-  return (in[i >> 3] >> (i & 7)) & 1;
+  static_assert(sizeof(in->words[0]) == 8, "BN_ULONG is not 64-bit");
+  return (in->words[i >> 6] >> (i & 63)) & 1;
 }
 
 // Takes the Jacobian coordinates (X, Y, Z) of a point and returns
@@ -977,12 +961,12 @@
 
     // Add every 5 doublings.
     if (i % 5 == 0) {
-      crypto_word_t bits = p224_get_bit(scalar->bytes, i + 4) << 5;
-      bits |= p224_get_bit(scalar->bytes, i + 3) << 4;
-      bits |= p224_get_bit(scalar->bytes, i + 2) << 3;
-      bits |= p224_get_bit(scalar->bytes, i + 1) << 2;
-      bits |= p224_get_bit(scalar->bytes, i) << 1;
-      bits |= p224_get_bit(scalar->bytes, i - 1);
+      crypto_word_t bits = p224_get_bit(scalar, i + 4) << 5;
+      bits |= p224_get_bit(scalar, i + 3) << 4;
+      bits |= p224_get_bit(scalar, i + 2) << 3;
+      bits |= p224_get_bit(scalar, i + 1) << 2;
+      bits |= p224_get_bit(scalar, i) << 1;
+      bits |= p224_get_bit(scalar, i - 1);
       crypto_word_t sign, digit;
       ec_GFp_nistp_recode_scalar_bits(&sign, &digit, bits);
 
@@ -1022,10 +1006,10 @@
     }
 
     // First, look 28 bits upwards.
-    crypto_word_t bits = p224_get_bit(scalar->bytes, i + 196) << 3;
-    bits |= p224_get_bit(scalar->bytes, i + 140) << 2;
-    bits |= p224_get_bit(scalar->bytes, i + 84) << 1;
-    bits |= p224_get_bit(scalar->bytes, i + 28);
+    crypto_word_t bits = p224_get_bit(scalar, i + 196) << 3;
+    bits |= p224_get_bit(scalar, i + 140) << 2;
+    bits |= p224_get_bit(scalar, i + 84) << 1;
+    bits |= p224_get_bit(scalar, i + 28);
     // Select the point to add, in constant time.
     p224_select_point(bits, 16, g_p224_pre_comp[1], tmp);
 
@@ -1038,10 +1022,10 @@
     }
 
     // Second, look at the current position/
-    bits = p224_get_bit(scalar->bytes, i + 168) << 3;
-    bits |= p224_get_bit(scalar->bytes, i + 112) << 2;
-    bits |= p224_get_bit(scalar->bytes, i + 56) << 1;
-    bits |= p224_get_bit(scalar->bytes, i);
+    bits = p224_get_bit(scalar, i + 168) << 3;
+    bits |= p224_get_bit(scalar, i + 112) << 2;
+    bits |= p224_get_bit(scalar, i + 56) << 1;
+    bits |= p224_get_bit(scalar, i);
     // Select the point to add, in constant time.
     p224_select_point(bits, 16, g_p224_pre_comp[0], tmp);
     p224_point_add(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2], 1 /* mixed */,
@@ -1080,10 +1064,10 @@
     // Add multiples of the generator.
     if (i <= 27) {
       // First, look 28 bits upwards.
-      crypto_word_t bits = p224_get_bit(g_scalar->bytes, i + 196) << 3;
-      bits |= p224_get_bit(g_scalar->bytes, i + 140) << 2;
-      bits |= p224_get_bit(g_scalar->bytes, i + 84) << 1;
-      bits |= p224_get_bit(g_scalar->bytes, i + 28);
+      crypto_word_t bits = p224_get_bit(g_scalar, i + 196) << 3;
+      bits |= p224_get_bit(g_scalar, i + 140) << 2;
+      bits |= p224_get_bit(g_scalar, i + 84) << 1;
+      bits |= p224_get_bit(g_scalar, i + 28);
 
       size_t index = (size_t)bits;
       p224_point_add(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2], 1 /* mixed */,
@@ -1092,10 +1076,10 @@
       assert(!skip);
 
       // Second, look at the current position.
-      bits = p224_get_bit(g_scalar->bytes, i + 168) << 3;
-      bits |= p224_get_bit(g_scalar->bytes, i + 112) << 2;
-      bits |= p224_get_bit(g_scalar->bytes, i + 56) << 1;
-      bits |= p224_get_bit(g_scalar->bytes, i);
+      bits = p224_get_bit(g_scalar, i + 168) << 3;
+      bits |= p224_get_bit(g_scalar, i + 112) << 2;
+      bits |= p224_get_bit(g_scalar, i + 56) << 1;
+      bits |= p224_get_bit(g_scalar, i);
       index = (size_t)bits;
       p224_point_add(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2], 1 /* mixed */,
                      g_p224_pre_comp[0][index][0], g_p224_pre_comp[0][index][1],
@@ -1104,12 +1088,12 @@
 
     // Incorporate |p_scalar| every 5 doublings.
     if (i % 5 == 0) {
-      crypto_word_t bits = p224_get_bit(p_scalar->bytes, i + 4) << 5;
-      bits |= p224_get_bit(p_scalar->bytes, i + 3) << 4;
-      bits |= p224_get_bit(p_scalar->bytes, i + 2) << 3;
-      bits |= p224_get_bit(p_scalar->bytes, i + 1) << 2;
-      bits |= p224_get_bit(p_scalar->bytes, i) << 1;
-      bits |= p224_get_bit(p_scalar->bytes, i - 1);
+      crypto_word_t bits = p224_get_bit(p_scalar, i + 4) << 5;
+      bits |= p224_get_bit(p_scalar, i + 3) << 4;
+      bits |= p224_get_bit(p_scalar, i + 2) << 3;
+      bits |= p224_get_bit(p_scalar, i + 1) << 2;
+      bits |= p224_get_bit(p_scalar, i) << 1;
+      bits |= p224_get_bit(p_scalar, i - 1);
       crypto_word_t sign, digit;
       ec_GFp_nistp_recode_scalar_bits(&sign, &digit, bits);
 
diff --git a/src/crypto/fipsmodule/ec/p256-x86_64-table.h b/src/crypto/fipsmodule/ec/p256-nistz-table.h
similarity index 99%
rename from src/crypto/fipsmodule/ec/p256-x86_64-table.h
rename to src/crypto/fipsmodule/ec/p256-nistz-table.h
index 3af0b01..b81480b 100644
--- a/src/crypto/fipsmodule/ec/p256-x86_64-table.h
+++ b/src/crypto/fipsmodule/ec/p256-nistz-table.h
@@ -9,7 +9,7 @@
  */
 
 // This is the precomputed constant time access table for the code in
-// p256-x86_64.c, for the default generator. The table consists of 37
+// p256-nistz.c, for the default generator. The table consists of 37
 // subtables, each subtable contains 64 affine points. The affine points are
 // encoded as eight uint64's, four for the x coordinate and four for the y.
 // Both values are in little-endian order. There are 37 tables because a
diff --git a/src/crypto/fipsmodule/ec/p256-x86_64.c b/src/crypto/fipsmodule/ec/p256-nistz.c
similarity index 97%
rename from src/crypto/fipsmodule/ec/p256-x86_64.c
rename to src/crypto/fipsmodule/ec/p256-nistz.c
index 506b7d2..1d56dcf 100644
--- a/src/crypto/fipsmodule/ec/p256-x86_64.c
+++ b/src/crypto/fipsmodule/ec/p256-nistz.c
@@ -30,10 +30,10 @@
 #include "../delocate.h"
 #include "../../internal.h"
 #include "internal.h"
-#include "p256-x86_64.h"
+#include "p256-nistz.h"
 
-
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
+#if !defined(OPENSSL_NO_ASM) &&  \
+    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&    \
     !defined(OPENSSL_SMALL)
 
 typedef P256_POINT_AFFINE PRECOMP256_ROW[64];
@@ -45,7 +45,7 @@
 };
 
 // Precomputed tables for the default generator
-#include "p256-x86_64-table.h"
+#include "p256-nistz-table.h"
 
 // Recode window to a signed digit, see |ec_GFp_nistp_recode_scalar_bits| in
 // util.c for details
@@ -201,7 +201,7 @@
   // ~1599 ((96 * 16) + 63) bytes of stack space.
   alignas(64) P256_POINT table[16];
   uint8_t p_str[33];
-  OPENSSL_memcpy(p_str, p_scalar->bytes, 32);
+  OPENSSL_memcpy(p_str, p_scalar->words, 32);
   p_str[32] = 0;
 
   // table[0] is implicitly (0,0,0) (the point at infinity), therefore it is
@@ -321,7 +321,7 @@
   alignas(32) p256_point_union_t t, p;
 
   uint8_t p_str[33];
-  OPENSSL_memcpy(p_str, scalar->bytes, 32);
+  OPENSSL_memcpy(p_str, scalar->words, 32);
   p_str[32] = 0;
 
   // First window
@@ -366,7 +366,7 @@
 
   alignas(32) p256_point_union_t t, p;
   uint8_t p_str[33];
-  OPENSSL_memcpy(p_str, g_scalar->bytes, 32);
+  OPENSSL_memcpy(p_str, g_scalar->words, 32);
   p_str[32] = 0;
 
   // First window
@@ -554,10 +554,12 @@
 static int ecp_nistz256_scalar_to_montgomery_inv_vartime(const EC_GROUP *group,
                                                  EC_SCALAR *out,
                                                  const EC_SCALAR *in) {
+#if defined(OPENSSL_X86_64)
   if (!CRYPTO_is_AVX_capable()) {
     // No AVX support; fallback to generic code.
     return ec_simple_scalar_to_montgomery_inv_vartime(group, out, in);
   }
+#endif
 
   assert(group->order.width == P256_LIMBS);
   if (!beeu_mod_inverse_vartime(out->words, in->words, group->order.d)) {
@@ -628,5 +630,6 @@
   out->cmp_x_coordinate = ecp_nistz256_cmp_x_coordinate;
 }
 
-#endif /* !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
+#endif /* !defined(OPENSSL_NO_ASM) && \
+          (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&  \
           !defined(OPENSSL_SMALL) */
diff --git a/src/crypto/fipsmodule/ec/p256-x86_64.h b/src/crypto/fipsmodule/ec/p256-nistz.h
similarity index 95%
rename from src/crypto/fipsmodule/ec/p256-x86_64.h
rename to src/crypto/fipsmodule/ec/p256-nistz.h
index 5deb81a..0d0a6be 100644
--- a/src/crypto/fipsmodule/ec/p256-x86_64.h
+++ b/src/crypto/fipsmodule/ec/p256-nistz.h
@@ -30,7 +30,8 @@
 #endif
 
 
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
+#if !defined(OPENSSL_NO_ASM) && \
+    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&   \
     !defined(OPENSSL_SMALL)
 
 // P-256 field operations.
@@ -142,8 +143,9 @@
 void ecp_nistz256_point_add_affine(P256_POINT *r, const P256_POINT *a,
                                    const P256_POINT_AFFINE *b);
 
-#endif /* !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
-           !defined(OPENSSL_SMALL) */
+#endif /* !defined(OPENSSL_NO_ASM) && \
+          (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&   \
+          !defined(OPENSSL_SMALL) */
 
 
 #if defined(__cplusplus)
diff --git a/src/crypto/fipsmodule/ec/p256-x86_64_test.cc b/src/crypto/fipsmodule/ec/p256-nistz_test.cc
similarity index 97%
rename from src/crypto/fipsmodule/ec/p256-x86_64_test.cc
rename to src/crypto/fipsmodule/ec/p256-nistz_test.cc
index f6f070a..6aa51e8 100644
--- a/src/crypto/fipsmodule/ec/p256-x86_64_test.cc
+++ b/src/crypto/fipsmodule/ec/p256-nistz_test.cc
@@ -30,15 +30,16 @@
 #include "../../test/abi_test.h"
 #include "../../test/file_test.h"
 #include "../../test/test_util.h"
-#include "p256-x86_64.h"
+#include "p256-nistz.h"
 
 
 // Disable tests if BORINGSSL_SHARED_LIBRARY is defined. These tests need access
 // to internal functions.
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
+#if !defined(OPENSSL_NO_ASM) &&  \
+    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&  \
     !defined(OPENSSL_SMALL) && !defined(BORINGSSL_SHARED_LIBRARY)
 
-TEST(P256_X86_64Test, SelectW5) {
+TEST(P256_NistzTest, SelectW5) {
   // Fill a table with some garbage input.
   alignas(64) P256_POINT table[16];
   for (size_t i = 0; i < 16; i++) {
@@ -68,7 +69,7 @@
   CHECK_ABI(ecp_nistz256_select_w5, &val, table, 7);
 }
 
-TEST(P256_X86_64Test, SelectW7) {
+TEST(P256_NistzTest, SelectW7) {
   // Fill a table with some garbage input.
   alignas(64) P256_POINT_AFFINE table[64];
   for (size_t i = 0; i < 64; i++) {
@@ -97,11 +98,13 @@
   CHECK_ABI(ecp_nistz256_select_w7, &val, table, 42);
 }
 
-TEST(P256_X86_64Test, BEEU) {
+TEST(P256_NistzTest, BEEU) {
+#if defined(OPENSSL_X86_64)
   if (!CRYPTO_is_AVX_capable()) {
     // No AVX support; cannot run the BEEU code.
     return;
   }
+#endif
 
   bssl::UniquePtr<EC_GROUP> group(
       EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1));
@@ -146,8 +149,8 @@
     EXPECT_TRUE(bn_less_than_words(out, order_words, P256_LIMBS));
 
     // Calculate out*in and confirm that it equals one, modulo the order.
-    OPENSSL_memcpy(in_scalar.bytes, in, sizeof(in));
-    OPENSSL_memcpy(out_scalar.bytes, out, sizeof(out));
+    OPENSSL_memcpy(in_scalar.words, in, sizeof(in));
+    OPENSSL_memcpy(out_scalar.words, out, sizeof(out));
     ec_scalar_to_montgomery(group.get(), &in_scalar, &in_scalar);
     ec_scalar_to_montgomery(group.get(), &out_scalar, &out_scalar);
     ec_scalar_mul_montgomery(group.get(), &result, &in_scalar, &out_scalar);
@@ -483,8 +486,8 @@
   }
 }
 
-TEST(P256_X86_64Test, TestVectors) {
-  return FileTestGTest("crypto/fipsmodule/ec/p256-x86_64_tests.txt",
+TEST(P256_NistzTest, TestVectors) {
+  return FileTestGTest("crypto/fipsmodule/ec/p256-nistz_tests.txt",
                        [](FileTest *t) {
     if (t->GetParameter() == "Negate") {
       TestNegate(t);
@@ -503,7 +506,7 @@
 }
 
 // Instrument the functions covered in TestVectors for ABI checking.
-TEST(P256_X86_64Test, ABI) {
+TEST(P256_NistzTest, ABI) {
   BN_ULONG a[P256_LIMBS], b[P256_LIMBS], c[P256_LIMBS];
   OPENSSL_memset(a, 0x01, sizeof(a));
   // These functions are all constant-time, so it is only necessary to
diff --git a/src/crypto/fipsmodule/ec/p256-x86_64_tests.txt b/src/crypto/fipsmodule/ec/p256-nistz_tests.txt
similarity index 100%
rename from src/crypto/fipsmodule/ec/p256-x86_64_tests.txt
rename to src/crypto/fipsmodule/ec/p256-nistz_tests.txt
diff --git a/src/crypto/fipsmodule/ec/p256.c b/src/crypto/fipsmodule/ec/p256.c
index 0d0e766..b3ee9d4 100644
--- a/src/crypto/fipsmodule/ec/p256.c
+++ b/src/crypto/fipsmodule/ec/p256.c
@@ -81,17 +81,22 @@
   fiat_p256_selectznz(out, !!t, z, nz);
 }
 
+static void fiat_p256_from_words(fiat_p256_felem out,
+                                 const BN_ULONG in[32 / sizeof(BN_ULONG)]) {
+  // Typically, |BN_ULONG| and |fiat_p256_limb_t| will be the same type, but on
+  // 64-bit platforms without |uint128_t|, they are different. However, on
+  // little-endian systems, |uint64_t[4]| and |uint32_t[8]| have the same
+  // layout.
+  OPENSSL_memcpy(out, in, 32);
+}
+
 static void fiat_p256_from_generic(fiat_p256_felem out, const EC_FELEM *in) {
-  fiat_p256_from_bytes(out, in->bytes);
+  fiat_p256_from_words(out, in->words);
 }
 
 static void fiat_p256_to_generic(EC_FELEM *out, const fiat_p256_felem in) {
-  // This works because 256 is a multiple of 64, so there are no excess bytes to
-  // zero when rounding up to |BN_ULONG|s.
-  OPENSSL_STATIC_ASSERT(
-      256 / 8 == sizeof(BN_ULONG) * ((256 + BN_BITS2 - 1) / BN_BITS2),
-      "fiat_p256_to_bytes leaves bytes uninitialized");
-  fiat_p256_to_bytes(out->bytes, in);
+  // See |fiat_p256_from_words|.
+  OPENSSL_memcpy(out->words, in, 32);
 }
 
 // fiat_p256_inv_square calculates |out| = |in|^{-2}
@@ -394,12 +399,18 @@
   }
 }
 
-// fiat_p256_get_bit returns the |i|th bit in |in|
-static crypto_word_t fiat_p256_get_bit(const uint8_t *in, int i) {
+// fiat_p256_get_bit returns the |i|th bit in |in|.
+static crypto_word_t fiat_p256_get_bit(const EC_SCALAR *in, int i) {
   if (i < 0 || i >= 256) {
     return 0;
   }
-  return (in[i >> 3] >> (i & 7)) & 1;
+#if defined(OPENSSL_64_BIT)
+  static_assert(sizeof(BN_ULONG) == 8, "BN_ULONG was not 64-bit");
+  return (in->words[i >> 6] >> (i & 63)) & 1;
+#else
+  static_assert(sizeof(BN_ULONG) == 4, "BN_ULONG was not 32-bit");
+  return (in->words[i >> 5] >> (i & 31)) & 1;
+#endif
 }
 
 // OPENSSL EC_METHOD FUNCTIONS
@@ -500,12 +511,12 @@
 
     // do other additions every 5 doublings
     if (i % 5 == 0) {
-      crypto_word_t bits = fiat_p256_get_bit(scalar->bytes, i + 4) << 5;
-      bits |= fiat_p256_get_bit(scalar->bytes, i + 3) << 4;
-      bits |= fiat_p256_get_bit(scalar->bytes, i + 2) << 3;
-      bits |= fiat_p256_get_bit(scalar->bytes, i + 1) << 2;
-      bits |= fiat_p256_get_bit(scalar->bytes, i) << 1;
-      bits |= fiat_p256_get_bit(scalar->bytes, i - 1);
+      crypto_word_t bits = fiat_p256_get_bit(scalar, i + 4) << 5;
+      bits |= fiat_p256_get_bit(scalar, i + 3) << 4;
+      bits |= fiat_p256_get_bit(scalar, i + 2) << 3;
+      bits |= fiat_p256_get_bit(scalar, i + 1) << 2;
+      bits |= fiat_p256_get_bit(scalar, i) << 1;
+      bits |= fiat_p256_get_bit(scalar, i - 1);
       crypto_word_t sign, digit;
       ec_GFp_nistp_recode_scalar_bits(&sign, &digit, bits);
 
@@ -545,10 +556,10 @@
     }
 
     // First, look 32 bits upwards.
-    crypto_word_t bits = fiat_p256_get_bit(scalar->bytes, i + 224) << 3;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 160) << 2;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 96) << 1;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 32);
+    crypto_word_t bits = fiat_p256_get_bit(scalar, i + 224) << 3;
+    bits |= fiat_p256_get_bit(scalar, i + 160) << 2;
+    bits |= fiat_p256_get_bit(scalar, i + 96) << 1;
+    bits |= fiat_p256_get_bit(scalar, i + 32);
     // Select the point to add, in constant time.
     fiat_p256_select_point_affine((fiat_p256_limb_t)bits, 15,
                                   fiat_p256_g_pre_comp[1], tmp);
@@ -564,10 +575,10 @@
     }
 
     // Second, look at the current position.
-    bits = fiat_p256_get_bit(scalar->bytes, i + 192) << 3;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 128) << 2;
-    bits |= fiat_p256_get_bit(scalar->bytes, i + 64) << 1;
-    bits |= fiat_p256_get_bit(scalar->bytes, i);
+    bits = fiat_p256_get_bit(scalar, i + 192) << 3;
+    bits |= fiat_p256_get_bit(scalar, i + 128) << 2;
+    bits |= fiat_p256_get_bit(scalar, i + 64) << 1;
+    bits |= fiat_p256_get_bit(scalar, i);
     // Select the point to add, in constant time.
     fiat_p256_select_point_affine((fiat_p256_limb_t)bits, 15,
                                   fiat_p256_g_pre_comp[0], tmp);
@@ -617,10 +628,10 @@
     // constant-time lookup.
     if (i <= 31) {
       // First, look 32 bits upwards.
-      crypto_word_t bits = fiat_p256_get_bit(g_scalar->bytes, i + 224) << 3;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 160) << 2;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 96) << 1;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 32);
+      crypto_word_t bits = fiat_p256_get_bit(g_scalar, i + 224) << 3;
+      bits |= fiat_p256_get_bit(g_scalar, i + 160) << 2;
+      bits |= fiat_p256_get_bit(g_scalar, i + 96) << 1;
+      bits |= fiat_p256_get_bit(g_scalar, i + 32);
       if (bits != 0) {
         size_t index = (size_t)(bits - 1);
         fiat_p256_point_add(ret[0], ret[1], ret[2], ret[0], ret[1], ret[2],
@@ -631,10 +642,10 @@
       }
 
       // Second, look at the current position.
-      bits = fiat_p256_get_bit(g_scalar->bytes, i + 192) << 3;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 128) << 2;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i + 64) << 1;
-      bits |= fiat_p256_get_bit(g_scalar->bytes, i);
+      bits = fiat_p256_get_bit(g_scalar, i + 192) << 3;
+      bits |= fiat_p256_get_bit(g_scalar, i + 128) << 2;
+      bits |= fiat_p256_get_bit(g_scalar, i + 64) << 1;
+      bits |= fiat_p256_get_bit(g_scalar, i);
       if (bits != 0) {
         size_t index = (size_t)(bits - 1);
         fiat_p256_point_add(ret[0], ret[1], ret[2], ret[0], ret[1], ret[2],
@@ -687,7 +698,7 @@
   fiat_p256_mul(Z2_mont, Z2_mont, Z2_mont);
 
   fiat_p256_felem r_Z2;
-  fiat_p256_from_bytes(r_Z2, r->bytes);  // r < order < p, so this is valid.
+  fiat_p256_from_words(r_Z2, r->words);  // r < order < p, so this is valid.
   fiat_p256_mul(r_Z2, r_Z2, Z2_mont);
 
   fiat_p256_felem X;
diff --git a/src/crypto/fipsmodule/ec/scalar.c b/src/crypto/fipsmodule/ec/scalar.c
index e4ae9d7..036049e 100644
--- a/src/crypto/fipsmodule/ec/scalar.c
+++ b/src/crypto/fipsmodule/ec/scalar.c
@@ -54,9 +54,7 @@
 void ec_scalar_to_bytes(const EC_GROUP *group, uint8_t *out, size_t *out_len,
                         const EC_SCALAR *in) {
   size_t len = BN_num_bytes(&group->order);
-  for (size_t i = 0; i < len; i++) {
-    out[len - i - 1] = in->bytes[i];
-  }
+  bn_words_to_big_endian(out, len, in->words, group->order.width);
   *out_len = len;
 }
 
@@ -67,11 +65,7 @@
     return 0;
   }
 
-  OPENSSL_memset(out, 0, sizeof(EC_SCALAR));
-
-  for (size_t i = 0; i < len; i++) {
-    out->bytes[i] = in[len - i - 1];
-  }
+  bn_big_endian_to_words(out->words, group->order.width, in, len);
 
   if (!bn_less_than_words(out->words, group->order.d, group->order.width)) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR);
diff --git a/src/crypto/fipsmodule/ec/simple.c b/src/crypto/fipsmodule/ec/simple.c
index b6d9312..58d8121 100644
--- a/src/crypto/fipsmodule/ec/simple.c
+++ b/src/crypto/fipsmodule/ec/simple.c
@@ -330,9 +330,7 @@
 void ec_GFp_simple_felem_to_bytes(const EC_GROUP *group, uint8_t *out,
                                   size_t *out_len, const EC_FELEM *in) {
   size_t len = BN_num_bytes(&group->field);
-  for (size_t i = 0; i < len; i++) {
-    out[i] = in->bytes[len - 1 - i];
-  }
+  bn_words_to_big_endian(out, len, in->words, group->field.width);
   *out_len = len;
 }
 
@@ -343,10 +341,7 @@
     return 0;
   }
 
-  OPENSSL_memset(out, 0, sizeof(EC_FELEM));
-  for (size_t i = 0; i < len; i++) {
-    out->bytes[i] = in[len - 1 - i];
-  }
+  bn_big_endian_to_words(out->words, group->field.width, in, len);
 
   if (!bn_less_than_words(out->words, group->field.d, group->field.width)) {
     OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
diff --git a/src/crypto/fipsmodule/ecdh/ecdh.c b/src/crypto/fipsmodule/ecdh/ecdh.c
index 36fbadc..dfea1e1 100644
--- a/src/crypto/fipsmodule/ecdh/ecdh.c
+++ b/src/crypto/fipsmodule/ecdh/ecdh.c
@@ -103,6 +103,7 @@
     return 0;
   }
 
+  FIPS_service_indicator_lock_state();
   switch (out_len) {
     case SHA224_DIGEST_LENGTH:
       SHA224(buf, buflen, out);
@@ -118,8 +119,11 @@
       break;
     default:
       OPENSSL_PUT_ERROR(ECDH, ECDH_R_UNKNOWN_DIGEST_LENGTH);
+      FIPS_service_indicator_unlock_state();
       return 0;
   }
+  FIPS_service_indicator_unlock_state();
 
+  ECDH_verify_service_indicator(priv_key);
   return 1;
 }
diff --git a/src/crypto/fipsmodule/ecdsa/ecdsa.c b/src/crypto/fipsmodule/ecdsa/ecdsa.c
index db0c6e5..ef77e42 100644
--- a/src/crypto/fipsmodule/ecdsa/ecdsa.c
+++ b/src/crypto/fipsmodule/ecdsa/ecdsa.c
@@ -78,10 +78,7 @@
   if (digest_len > num_bytes) {
     digest_len = num_bytes;
   }
-  OPENSSL_memset(out, 0, sizeof(EC_SCALAR));
-  for (size_t i = 0; i < digest_len; i++) {
-    out->bytes[i] = digest[digest_len - 1 - i];
-  }
+  bn_big_endian_to_words(out->words, order->width, digest, digest_len);
 
   // If it is still too long, truncate remaining bits with a shift.
   if (8 * digest_len > num_bits) {
@@ -326,6 +323,9 @@
   // into the RBG. This is a hardening measure against entropy failure.
   OPENSSL_STATIC_ASSERT(SHA512_DIGEST_LENGTH >= 32,
                         "additional_data is too large for SHA-512");
+
+  FIPS_service_indicator_lock_state();
+
   SHA512_CTX sha;
   uint8_t additional_data[SHA512_DIGEST_LENGTH];
   SHA512_Init(&sha);
@@ -333,17 +333,22 @@
   SHA512_Update(&sha, digest, digest_len);
   SHA512_Final(additional_data, &sha);
 
+  ECDSA_SIG *ret = NULL;
   for (;;) {
     EC_SCALAR k;
     if (!ec_random_nonzero_scalar(group, &k, additional_data)) {
-      return NULL;
+      ret = NULL;
+      goto out;
     }
 
     int retry;
-    ECDSA_SIG *sig =
-        ecdsa_sign_impl(group, &retry, priv_key, &k, digest, digest_len);
-    if (sig != NULL || !retry) {
-      return sig;
+    ret = ecdsa_sign_impl(group, &retry, priv_key, &k, digest, digest_len);
+    if (ret != NULL || !retry) {
+      goto out;
     }
   }
+
+out:
+  FIPS_service_indicator_unlock_state();
+  return ret;
 }
diff --git a/src/crypto/fipsmodule/hmac/hmac.c b/src/crypto/fipsmodule/hmac/hmac.c
index d37cec8..454d0c0 100644
--- a/src/crypto/fipsmodule/hmac/hmac.c
+++ b/src/crypto/fipsmodule/hmac/hmac.c
@@ -70,13 +70,22 @@
               unsigned int *out_len) {
   HMAC_CTX ctx;
   HMAC_CTX_init(&ctx);
-  if (!HMAC_Init_ex(&ctx, key, key_len, evp_md, NULL) ||
-      !HMAC_Update(&ctx, data, data_len) ||
-      !HMAC_Final(&ctx, out, out_len)) {
-    out = NULL;
-  }
+
+  // The underlying hash functions should not set the FIPS service indicator
+  // until all operations have completed.
+  FIPS_service_indicator_lock_state();
+  const int ok = HMAC_Init_ex(&ctx, key, key_len, evp_md, NULL) &&
+                 HMAC_Update(&ctx, data, data_len) &&
+                 HMAC_Final(&ctx, out, out_len);
+  FIPS_service_indicator_unlock_state();
 
   HMAC_CTX_cleanup(&ctx);
+
+  if (!ok) {
+    return NULL;
+  }
+
+  HMAC_verify_service_indicator(evp_md);
   return out;
 }
 
@@ -120,6 +129,9 @@
 
 int HMAC_Init_ex(HMAC_CTX *ctx, const void *key, size_t key_len,
                  const EVP_MD *md, ENGINE *impl) {
+  int ret = 0;
+  FIPS_service_indicator_lock_state();
+
   if (md == NULL) {
     md = ctx->md;
   }
@@ -143,7 +155,7 @@
       if (!EVP_DigestInit_ex(&ctx->md_ctx, md, impl) ||
           !EVP_DigestUpdate(&ctx->md_ctx, key, key_len) ||
           !EVP_DigestFinal_ex(&ctx->md_ctx, key_block, &key_block_len)) {
-        return 0;
+        goto out;
       }
     } else {
       assert(key_len <= sizeof(key_block));
@@ -160,7 +172,7 @@
     }
     if (!EVP_DigestInit_ex(&ctx->i_ctx, md, impl) ||
         !EVP_DigestUpdate(&ctx->i_ctx, pad, EVP_MD_block_size(md))) {
-      return 0;
+      goto out;
     }
 
     for (size_t i = 0; i < EVP_MAX_MD_BLOCK_SIZE; i++) {
@@ -168,17 +180,17 @@
     }
     if (!EVP_DigestInit_ex(&ctx->o_ctx, md, impl) ||
         !EVP_DigestUpdate(&ctx->o_ctx, pad, EVP_MD_block_size(md))) {
-      return 0;
+      goto out;
     }
 
     ctx->md = md;
   }
 
-  if (!EVP_MD_CTX_copy_ex(&ctx->md_ctx, &ctx->i_ctx)) {
-    return 0;
-  }
+  ret = EVP_MD_CTX_copy_ex(&ctx->md_ctx, &ctx->i_ctx);
 
-  return 1;
+out:
+  FIPS_service_indicator_unlock_state();
+  return ret;
 }
 
 int HMAC_Update(HMAC_CTX *ctx, const uint8_t *data, size_t data_len) {
@@ -186,9 +198,11 @@
 }
 
 int HMAC_Final(HMAC_CTX *ctx, uint8_t *out, unsigned int *out_len) {
+  int ret = 0;
   unsigned int i;
   uint8_t buf[EVP_MAX_MD_SIZE];
 
+  FIPS_service_indicator_lock_state();
   // TODO(davidben): The only thing that can officially fail here is
   // |EVP_MD_CTX_copy_ex|, but even that should be impossible in this case.
   if (!EVP_DigestFinal_ex(&ctx->md_ctx, buf, &i) ||
@@ -196,10 +210,17 @@
       !EVP_DigestUpdate(&ctx->md_ctx, buf, i) ||
       !EVP_DigestFinal_ex(&ctx->md_ctx, out, out_len)) {
     *out_len = 0;
-    return 0;
+    goto out;
   }
 
-  return 1;
+  ret = 1;
+
+ out:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    HMAC_verify_service_indicator(ctx->md);
+  }
+  return ret;
 }
 
 size_t HMAC_size(const HMAC_CTX *ctx) {
diff --git a/src/crypto/fipsmodule/rand/ctrdrbg.c b/src/crypto/fipsmodule/rand/ctrdrbg.c
index b2fda1d..83e7f5b 100644
--- a/src/crypto/fipsmodule/rand/ctrdrbg.c
+++ b/src/crypto/fipsmodule/rand/ctrdrbg.c
@@ -19,6 +19,7 @@
 
 #include "internal.h"
 #include "../cipher/internal.h"
+#include "../service_indicator/internal.h"
 
 
 // Section references in this file refer to SP 800-90Ar1:
@@ -194,6 +195,7 @@
   }
 
   drbg->reseed_counter++;
+  FIPS_service_indicator_update_state();
   return 1;
 }
 
diff --git a/src/crypto/fipsmodule/rand/urandom.c b/src/crypto/fipsmodule/rand/urandom.c
index fa0a333..508d441 100644
--- a/src/crypto/fipsmodule/rand/urandom.c
+++ b/src/crypto/fipsmodule/rand/urandom.c
@@ -135,7 +135,7 @@
   }
 
   value[length] = 0;
-  if (strcasecmp(value, "true") == 0) {
+  if (OPENSSL_strcasecmp(value, "true") == 0) {
     *extra_getrandom_flags_for_seed_bss_get() = GRND_RANDOM;
   }
 #endif
diff --git a/src/crypto/fipsmodule/rsa/padding.c b/src/crypto/fipsmodule/rsa/padding.c
index 28f1b45..605647a 100644
--- a/src/crypto/fipsmodule/rsa/padding.c
+++ b/src/crypto/fipsmodule/rsa/padding.c
@@ -67,6 +67,7 @@
 #include <openssl/sha.h>
 
 #include "internal.h"
+#include "../service_indicator/internal.h"
 #include "../../internal.h"
 
 
@@ -145,20 +146,17 @@
   return 1;
 }
 
-static int rand_nonzero(uint8_t *out, size_t len) {
-  if (!RAND_bytes(out, len)) {
-    return 0;
-  }
+static void rand_nonzero(uint8_t *out, size_t len) {
+  FIPS_service_indicator_lock_state();
+  RAND_bytes(out, len);
 
   for (size_t i = 0; i < len; i++) {
     while (out[i] == 0) {
-      if (!RAND_bytes(out + i, 1)) {
-        return 0;
-      }
+      RAND_bytes(out + i, 1);
     }
   }
 
-  return 1;
+  FIPS_service_indicator_unlock_state();
 }
 
 int RSA_padding_add_PKCS1_type_2(uint8_t *to, size_t to_len,
@@ -178,10 +176,7 @@
   to[1] = 2;
 
   size_t padding_len = to_len - 3 - from_len;
-  if (!rand_nonzero(to + 2, padding_len)) {
-    return 0;
-  }
-
+  rand_nonzero(to + 2, padding_len);
   to[2 + padding_len] = 0;
   OPENSSL_memcpy(to + to_len - from_len, from, from_len);
   return 1;
@@ -275,6 +270,7 @@
   int ret = 0;
   EVP_MD_CTX ctx;
   EVP_MD_CTX_init(&ctx);
+  FIPS_service_indicator_lock_state();
 
   size_t md_len = EVP_MD_size(md);
 
@@ -310,6 +306,7 @@
 
 err:
   EVP_MD_CTX_cleanup(&ctx);
+  FIPS_service_indicator_unlock_state();
   return ret;
 }
 
@@ -346,23 +343,25 @@
   uint8_t *seed = to + 1;
   uint8_t *db = to + mdlen + 1;
 
+  uint8_t *dbmask = NULL;
+  int ret = 0;
+  FIPS_service_indicator_lock_state();
   if (!EVP_Digest(param, param_len, db, NULL, md, NULL)) {
-    return 0;
+    goto out;
   }
   OPENSSL_memset(db + mdlen, 0, emlen - from_len - 2 * mdlen - 1);
   db[emlen - from_len - mdlen - 1] = 0x01;
   OPENSSL_memcpy(db + emlen - from_len - mdlen, from, from_len);
   if (!RAND_bytes(seed, mdlen)) {
-    return 0;
+    goto out;
   }
 
-  uint8_t *dbmask = OPENSSL_malloc(emlen - mdlen);
+  dbmask = OPENSSL_malloc(emlen - mdlen);
   if (dbmask == NULL) {
     OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);
-    return 0;
+    goto out;
   }
 
-  int ret = 0;
   if (!PKCS1_MGF1(dbmask, emlen - mdlen, seed, mdlen, mgf1md)) {
     goto out;
   }
@@ -381,6 +380,7 @@
 
 out:
   OPENSSL_free(dbmask);
+  FIPS_service_indicator_unlock_state();
   return ret;
 }
 
@@ -410,6 +410,7 @@
   }
 
   size_t dblen = from_len - mdlen - 1;
+  FIPS_service_indicator_lock_state();
   db = OPENSSL_malloc(dblen);
   if (db == NULL) {
     OPENSSL_PUT_ERROR(RSA, ERR_R_MALLOC_FAILURE);
@@ -470,6 +471,7 @@
   OPENSSL_memcpy(out, db + one_index, mlen);
   *out_len = mlen;
   OPENSSL_free(db);
+  FIPS_service_indicator_unlock_state();
   return 1;
 
 decoding_err:
@@ -478,6 +480,7 @@
   OPENSSL_PUT_ERROR(RSA, RSA_R_OAEP_DECODING_ERROR);
  err:
   OPENSSL_free(db);
+  FIPS_service_indicator_unlock_state();
   return 0;
 }
 
@@ -501,6 +504,7 @@
   }
 
   hLen = EVP_MD_size(Hash);
+  FIPS_service_indicator_lock_state();
 
   // Negative sLen has special meanings:
   //	-1	sLen == hLen
@@ -578,6 +582,7 @@
 err:
   OPENSSL_free(DB);
   EVP_MD_CTX_cleanup(&ctx);
+  FIPS_service_indicator_unlock_state();
 
   return ret;
 }
@@ -595,6 +600,7 @@
     mgf1Hash = Hash;
   }
 
+  FIPS_service_indicator_lock_state();
   hLen = EVP_MD_size(Hash);
 
   if (BN_is_zero(rsa->n)) {
@@ -690,6 +696,7 @@
 
 err:
   OPENSSL_free(salt);
+  FIPS_service_indicator_unlock_state();
 
   return ret;
 }
diff --git a/src/crypto/fipsmodule/rsa/rsa_impl.c b/src/crypto/fipsmodule/rsa/rsa_impl.c
index 1046f35..0958961 100644
--- a/src/crypto/fipsmodule/rsa/rsa_impl.c
+++ b/src/crypto/fipsmodule/rsa/rsa_impl.c
@@ -66,11 +66,12 @@
 #include <openssl/thread.h>
 #include <openssl/type_check.h>
 
-#include "internal.h"
-#include "../bn/internal.h"
 #include "../../internal.h"
+#include "../bn/internal.h"
 #include "../delocate.h"
 #include "../rand/fork_detect.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
 
 
 int rsa_check_public_key(const RSA *rsa) {
@@ -1419,6 +1420,10 @@
             BN_set_word(e, RSA_F4) &&
             RSA_generate_key_ex_maybe_fips(rsa, bits, e, cb, /*check_fips=*/1);
   BN_free(e);
+
+  if (ret) {
+    FIPS_service_indicator_update_state();
+  }
   return ret;
 }
 
diff --git a/src/crypto/fipsmodule/self_check/fips.c b/src/crypto/fipsmodule/self_check/fips.c
index 11c9309..ce03957 100644
--- a/src/crypto/fipsmodule/self_check/fips.c
+++ b/src/crypto/fipsmodule/self_check/fips.c
@@ -28,6 +28,8 @@
 
 int FIPS_mode_set(int on) { return on == FIPS_mode(); }
 
+const char *FIPS_module_name(void) { return "BoringCrypto"; }
+
 uint32_t FIPS_version(void) {
   return 0;
 }
diff --git a/src/crypto/fipsmodule/self_check/self_check.c b/src/crypto/fipsmodule/self_check/self_check.c
index b248789..fe9c914 100644
--- a/src/crypto/fipsmodule/self_check/self_check.c
+++ b/src/crypto/fipsmodule/self_check/self_check.c
@@ -36,6 +36,7 @@
 #include "../ecdsa/internal.h"
 #include "../rand/internal.h"
 #include "../rsa/internal.h"
+#include "../service_indicator/internal.h"
 #include "../tls/internal.h"
 
 
@@ -616,9 +617,11 @@
 #if defined(BORINGSSL_FIPS)
 
 static void run_self_test_rsa(void) {
+  FIPS_service_indicator_lock_state();
   if (!boringssl_self_test_rsa()) {
     BORINGSSL_FIPS_abort();
   }
+  FIPS_service_indicator_unlock_state();
 }
 
 DEFINE_STATIC_ONCE(g_self_test_once_rsa);
@@ -628,9 +631,11 @@
 }
 
 static void run_self_test_ecc(void) {
+  FIPS_service_indicator_lock_state();
   if (!boringssl_self_test_ecc()) {
     BORINGSSL_FIPS_abort();
   }
+  FIPS_service_indicator_unlock_state();
 }
 
 DEFINE_STATIC_ONCE(g_self_test_once_ecc);
@@ -640,9 +645,11 @@
 }
 
 static void run_self_test_ffdh(void) {
+  FIPS_service_indicator_lock_state();
   if (!boringssl_self_test_ffdh()) {
     BORINGSSL_FIPS_abort();
   }
+  FIPS_service_indicator_unlock_state();
 }
 
 DEFINE_STATIC_ONCE(g_self_test_once_ffdh);
diff --git a/src/crypto/fipsmodule/service_indicator/internal.h b/src/crypto/fipsmodule/service_indicator/internal.h
new file mode 100644
index 0000000..bbc4e4e
--- /dev/null
+++ b/src/crypto/fipsmodule/service_indicator/internal.h
@@ -0,0 +1,89 @@
+/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H
+#define OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H
+
+#include <openssl/base.h>
+#include <openssl/service_indicator.h>
+
+#if defined(BORINGSSL_FIPS)
+
+// FIPS_service_indicator_update_state records that an approved service has been
+// invoked.
+void FIPS_service_indicator_update_state(void);
+
+// FIPS_service_indicator_lock_state and |FIPS_service_indicator_unlock_state|
+// stop |FIPS_service_indicator_update_state| from actually updating the service
+// indicator. This is used when a primitive calls a potentially approved
+// primitive to avoid false positives. For example, just because a key
+// generation calls |RAND_bytes| (and thus the approved DRBG) doesn't mean that
+// the key generation operation itself is approved.
+//
+// This lock nests: i.e. locking twice is fine so long as each lock is paired
+// with an unlock. If the (64-bit) counter overflows, the process aborts.
+void FIPS_service_indicator_lock_state(void);
+void FIPS_service_indicator_unlock_state(void);
+
+// The following functions may call |FIPS_service_indicator_update_state| if
+// their parameter specifies an approved operation.
+
+void AEAD_GCM_verify_service_indicator(const EVP_AEAD_CTX *ctx);
+void AEAD_CCM_verify_service_indicator(const EVP_AEAD_CTX *ctx);
+void EC_KEY_keygen_verify_service_indicator(const EC_KEY *eckey);
+void ECDH_verify_service_indicator(const EC_KEY *ec_key);
+void EVP_Cipher_verify_service_indicator(const EVP_CIPHER_CTX *ctx);
+void EVP_DigestSign_verify_service_indicator(const EVP_MD_CTX *ctx);
+void EVP_DigestVerify_verify_service_indicator(const EVP_MD_CTX *ctx);
+void HMAC_verify_service_indicator(const EVP_MD *evp_md);
+void TLSKDF_verify_service_indicator(const EVP_MD *dgst);
+
+#else
+
+// Service indicator functions are no-ops in non-FIPS builds.
+
+OPENSSL_INLINE void FIPS_service_indicator_update_state(void) {}
+OPENSSL_INLINE void FIPS_service_indicator_lock_state(void) {}
+OPENSSL_INLINE void FIPS_service_indicator_unlock_state(void) {}
+
+OPENSSL_INLINE void AEAD_GCM_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_AEAD_CTX *ctx) {}
+
+OPENSSL_INLINE void AEAD_CCM_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_AEAD_CTX *ctx) {}
+
+OPENSSL_INLINE void EC_KEY_keygen_verify_service_indicator(
+    OPENSSL_UNUSED const EC_KEY *eckey) {}
+
+OPENSSL_INLINE void ECDH_verify_service_indicator(
+    OPENSSL_UNUSED const EC_KEY *ec_key) {}
+
+OPENSSL_INLINE void EVP_Cipher_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_CIPHER_CTX *ctx) {}
+
+OPENSSL_INLINE void EVP_DigestSign_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD_CTX *ctx) {}
+
+OPENSSL_INLINE void EVP_DigestVerify_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD_CTX *ctx) {}
+
+OPENSSL_INLINE void HMAC_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD *evp_md) {}
+
+OPENSSL_INLINE void TLSKDF_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD *dgst) {}
+
+#endif  // BORINGSSL_FIPS
+
+#endif  // OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H
diff --git a/src/crypto/fipsmodule/service_indicator/service_indicator.c b/src/crypto/fipsmodule/service_indicator/service_indicator.c
new file mode 100644
index 0000000..eb4669b
--- /dev/null
+++ b/src/crypto/fipsmodule/service_indicator/service_indicator.c
@@ -0,0 +1,333 @@
+/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/crypto.h>
+#include <openssl/ec.h>
+#include <openssl/ec_key.h>
+#include <openssl/evp.h>
+#include <openssl/service_indicator.h>
+
+#include "../../evp/internal.h"
+#include "../../internal.h"
+#include "internal.h"
+
+#if defined(BORINGSSL_FIPS)
+
+#define STATE_UNLOCKED 0
+
+// fips_service_indicator_state is a thread-local structure that stores the
+// state of the FIPS service indicator.
+struct fips_service_indicator_state {
+  // lock_state records the number of times the indicator has been locked.
+  // When it is zero (i.e. |STATE_UNLOCKED|) then the indicator can be updated.
+  uint64_t lock_state;
+  // counter is the indicator state. It is incremented when an approved service
+  // completes.
+  uint64_t counter;
+};
+
+// service_indicator_get returns a pointer to the |fips_service_indicator_state|
+// for the current thread. It returns NULL on error.
+//
+// FIPS 140-3 requires that the module should provide the service indicator
+// for approved services irrespective of whether the user queries it or not.
+// Hence, it is lazily initialized in any call to an approved service.
+static struct fips_service_indicator_state *service_indicator_get(void) {
+  struct fips_service_indicator_state *indicator = CRYPTO_get_thread_local(
+      OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE);
+
+  if (indicator == NULL) {
+    indicator = OPENSSL_malloc(sizeof(struct fips_service_indicator_state));
+    if (indicator == NULL) {
+      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE);
+      return NULL;
+    }
+
+    indicator->lock_state = STATE_UNLOCKED;
+    indicator->counter = 0;
+
+    if (!CRYPTO_set_thread_local(
+            OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE, indicator,
+            OPENSSL_free)) {
+      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_INTERNAL_ERROR);
+      return NULL;
+    }
+  }
+
+  return indicator;
+}
+
+static uint64_t service_indicator_get_counter(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator == NULL) {
+    return 0;
+  }
+  return indicator->counter;
+}
+
+uint64_t FIPS_service_indicator_before_call(void) {
+  return service_indicator_get_counter();
+}
+
+uint64_t FIPS_service_indicator_after_call(void) {
+  return service_indicator_get_counter();
+}
+
+void FIPS_service_indicator_update_state(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator && indicator->lock_state == STATE_UNLOCKED) {
+    indicator->counter++;
+  }
+}
+
+void FIPS_service_indicator_lock_state(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator == NULL) {
+    return;
+  }
+
+  // |FIPS_service_indicator_lock_state| and
+  // |FIPS_service_indicator_unlock_state| should not under/overflow in normal
+  // operation. They are still checked and errors added to facilitate testing in
+  // service_indicator_test.cc. This should only happen if lock/unlock are
+  // called in an incorrect order or multiple times in the same function.
+  const uint64_t new_state = indicator->lock_state + 1;
+  if (new_state < indicator->lock_state) {
+    // Overflow. This would imply that our call stack length has exceeded a
+    // |uint64_t| which impossible on a 64-bit system.
+    abort();
+  }
+
+  indicator->lock_state = new_state;
+}
+
+void FIPS_service_indicator_unlock_state(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator == NULL) {
+    return;
+  }
+
+  if (indicator->lock_state == 0) {
+    abort();
+  }
+
+  indicator->lock_state--;
+}
+
+void AEAD_GCM_verify_service_indicator(const EVP_AEAD_CTX *ctx) {
+  const size_t key_len = EVP_AEAD_key_length(ctx->aead);
+  if (key_len == 16 || key_len == 32) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+void AEAD_CCM_verify_service_indicator(const EVP_AEAD_CTX *ctx) {
+  if (EVP_AEAD_key_length(ctx->aead) == 16 && ctx->tag_len == 4) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+// is_ec_fips_approved returns one if the curve corresponding to the given NID
+// is FIPS approved, and zero otherwise.
+static int is_ec_fips_approved(int curve_nid) {
+  switch (curve_nid) {
+    case NID_secp224r1:
+    case NID_X9_62_prime256v1:
+    case NID_secp384r1:
+    case NID_secp521r1:
+      return 1;
+    default:
+      return 0;
+  }
+}
+
+// is_md_fips_approved_for_signing returns one if the given message digest type
+// is FIPS approved for signing, and zero otherwise.
+static int is_md_fips_approved_for_signing(int md_type) {
+  switch (md_type) {
+    case NID_sha224:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+    case NID_sha512_256:
+      return 1;
+    default:
+      return 0;
+  }
+}
+
+// is_md_fips_approved_for_verifying returns one if the given message digest
+// type is FIPS approved for verifying, and zero otherwise.
+static int is_md_fips_approved_for_verifying(int md_type) {
+  switch (md_type) {
+    case NID_sha1:
+    case NID_sha224:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+    case NID_sha512_256:
+      return 1;
+    default:
+      return 0;
+  }
+}
+
+static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
+                                                int rsa_1024_ok,
+                                                int (*md_ok)(int md_type)) {
+  if (EVP_MD_CTX_md(ctx) == NULL) {
+    // Signature schemes without a prehash are currently never FIPS approved.
+    goto err;
+  }
+
+  EVP_PKEY_CTX *const pctx = ctx->pctx;
+  const EVP_PKEY *const pkey = EVP_PKEY_CTX_get0_pkey(pctx);
+  const int pkey_type = EVP_PKEY_id(pkey);
+  const int md_type = EVP_MD_CTX_type(ctx);
+
+  // EVP_PKEY_RSA_PSS SPKIs aren't supported.
+  if (pkey_type == EVP_PKEY_RSA) {
+    // Message digest used in the private key should be of the same type
+    // as the given one, so we extract the MD type from the |EVP_PKEY|
+    // and compare it with the type in |ctx|.
+    const EVP_MD *pctx_md;
+    if (!EVP_PKEY_CTX_get_signature_md(pctx, &pctx_md)) {
+      goto err;
+    }
+    if (EVP_MD_type(pctx_md) != md_type) {
+      goto err;
+    }
+
+    int padding;
+    if (!EVP_PKEY_CTX_get_rsa_padding(pctx, &padding)) {
+      goto err;
+    }
+    if (padding == RSA_PKCS1_PSS_PADDING) {
+      int salt_len;
+      const EVP_MD *mgf1_md;
+      if (!EVP_PKEY_CTX_get_rsa_pss_saltlen(pctx, &salt_len) ||
+          !EVP_PKEY_CTX_get_rsa_mgf1_md(pctx, &mgf1_md) ||
+          (salt_len != -1 && salt_len != (int)EVP_MD_size(pctx_md)) ||
+          EVP_MD_type(mgf1_md) != md_type) {
+        // Only PSS where saltLen == hashLen is tested with ACVP. Cases with
+        // non-standard padding functions are also excluded.
+        goto err;
+      }
+    }
+
+    // The approved RSA key sizes for signing are 2048, 3072 and 4096 bits.
+    // Note: |EVP_PKEY_size| returns the size in bytes.
+    size_t pkey_size = EVP_PKEY_size(ctx->pctx->pkey);
+
+    // Check if the MD type and the RSA key size are approved.
+    if (md_ok(md_type) &&
+        ((rsa_1024_ok && pkey_size == 128) || pkey_size == 256 ||
+         pkey_size == 384 || pkey_size == 512)) {
+      FIPS_service_indicator_update_state();
+    }
+  } else if (pkey_type == EVP_PKEY_EC) {
+    // Check if the MD type and the elliptic curve are approved.
+    if (md_ok(md_type) && is_ec_fips_approved(EC_GROUP_get_curve_name(
+                              ctx->pctx->pkey->pkey.ec->group))) {
+      FIPS_service_indicator_update_state();
+    }
+  }
+
+ err:
+  // Ensure that junk errors aren't left on the queue.
+  ERR_clear_error();
+}
+
+void EC_KEY_keygen_verify_service_indicator(const EC_KEY *eckey) {
+  if (is_ec_fips_approved(EC_GROUP_get_curve_name(eckey->group))) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+void ECDH_verify_service_indicator(const EC_KEY *ec_key) {
+  if (is_ec_fips_approved(EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)))) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+void EVP_Cipher_verify_service_indicator(const EVP_CIPHER_CTX *ctx) {
+  switch (EVP_CIPHER_CTX_nid(ctx)) {
+    case NID_aes_128_ecb:
+    case NID_aes_192_ecb:
+    case NID_aes_256_ecb:
+
+    case NID_aes_128_cbc:
+    case NID_aes_192_cbc:
+    case NID_aes_256_cbc:
+
+    case NID_aes_128_ctr:
+    case NID_aes_192_ctr:
+    case NID_aes_256_ctr:
+      FIPS_service_indicator_update_state();
+  }
+}
+
+void EVP_DigestVerify_verify_service_indicator(const EVP_MD_CTX *ctx) {
+  return evp_md_ctx_verify_service_indicator(ctx, /*rsa_1024_ok=*/1,
+                                             is_md_fips_approved_for_verifying);
+}
+
+void EVP_DigestSign_verify_service_indicator(const EVP_MD_CTX *ctx) {
+  return evp_md_ctx_verify_service_indicator(ctx, /*rsa_1024_ok=*/0,
+                                             is_md_fips_approved_for_signing);
+}
+
+void HMAC_verify_service_indicator(const EVP_MD *evp_md) {
+  switch (evp_md->type) {
+    case NID_sha1:
+    case NID_sha224:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+    case NID_sha512_256:
+      FIPS_service_indicator_update_state();
+      break;
+  }
+}
+
+void TLSKDF_verify_service_indicator(const EVP_MD *md) {
+  // HMAC-MD5, HMAC-SHA1, and HMAC-MD5/HMAC-SHA1 (both used concurrently) are
+  // approved for use in the KDF in TLS 1.0/1.1.
+  // HMAC-SHA{256, 384, 512} are approved for use in the KDF in TLS 1.2.
+  // These Key Derivation functions are to be used in the context of the TLS
+  // protocol.
+  switch (EVP_MD_type(md)) {
+    case NID_md5:
+    case NID_sha1:
+    case NID_md5_sha1:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+      FIPS_service_indicator_update_state();
+      break;
+  }
+}
+
+#else
+
+uint64_t FIPS_service_indicator_before_call(void) { return 0; }
+
+uint64_t FIPS_service_indicator_after_call(void) {
+  // One is returned so that the return value is always greater than zero, the
+  // return value of |FIPS_service_indicator_before_call|. This makes everything
+  // report as "approved" in non-FIPS builds.
+  return 1;
+}
+
+#endif  // BORINGSSL_FIPS
diff --git a/src/crypto/fipsmodule/service_indicator/service_indicator_test.cc b/src/crypto/fipsmodule/service_indicator/service_indicator_test.cc
new file mode 100644
index 0000000..d0da9c9
--- /dev/null
+++ b/src/crypto/fipsmodule/service_indicator/service_indicator_test.cc
@@ -0,0 +1,2410 @@
+/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <gtest/gtest.h>
+
+#include <openssl/aead.h>
+#include <openssl/aes.h>
+#include <openssl/bn.h>
+#include <openssl/cipher.h>
+#include <openssl/cmac.h>
+#include <openssl/crypto.h>
+#include <openssl/dh.h>
+#include <openssl/digest.h>
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/md4.h>
+#include <openssl/md5.h>
+#include <openssl/rand.h>
+#include <openssl/rsa.h>
+#include <openssl/service_indicator.h>
+
+#include "../../test/abi_test.h"
+#include "../../test/test_util.h"
+#include "../bn/internal.h"
+#include "../rand/internal.h"
+#include "../tls/internal.h"
+
+
+using bssl::FIPSStatus;
+
+static const uint8_t kAESKey[16] = {'A', 'W', 'S', '-', 'L', 'C', 'C', 'r',
+                                    'y', 'p', 't', 'o', ' ', 'K', 'e', 'y'};
+
+static const uint8_t kPlaintext[64] = {
+    'A', 'W', 'S', '-', 'L', 'C', 'C', 'r', 'y', 'p', 't', 'o', 'M',
+    'o', 'd', 'u', 'l', 'e', ' ', 'F', 'I', 'P', 'S', ' ', 'K', 'A',
+    'T', ' ', 'E', 'n', 'c', 'r', 'y', 'p', 't', 'i', 'o', 'n', ' ',
+    'a', 'n', 'd', ' ', 'D', 'e', 'c', 'r', 'y', 'p', 't', 'i', 'o',
+    'n', ' ', 'P', 'l', 'a', 'i', 'n', 't', 'e', 'x', 't', '!'};
+
+#if defined(BORINGSSL_FIPS)
+
+// kEVPKeyGenShouldCallFIPSFunctions determines whether |EVP_PKEY_keygen_*|
+// functions should call the FIPS versions of the key-generation functions.
+static const bool kEVPKeyGenShouldCallFIPSFunctions = false;
+
+// kCurveSecp256k1Supported determines whether secp256k1 tests should be run.
+static const bool kCurveSecp256k1Supported = false;
+
+// kEVPDeriveSetsServiceIndicator is true if `EVP_PKEY_derive` should set the
+// service indicator for some algorithms.
+static const bool kEVPDeriveSetsServiceIndicator = false;
+
+template <typename T>
+class TestWithNoErrors : public testing::TestWithParam<T> {
+  void TearDown() override {
+    if (ERR_peek_error() != 0) {
+      auto f = [](const char *str, size_t len, void *unused) -> int {
+        fprintf(stderr, "%s\n", str);
+        return 1;
+      };
+      ERR_print_errors_cb(f, nullptr);
+      ADD_FAILURE();
+    }
+  }
+};
+
+static const uint8_t kAESKey_192[24] = {'A', 'W', 'S', '-', 'L', 'C', 'C', 'r',
+                                        'y', 'p', 't', 'o', ' ', '1', '9', '2',
+                                        '-', 'b', 'i', 't', ' ', 'K', 'e', 'y'};
+
+static const uint8_t kAESKey_256[32] = {'A', 'W', 'S', '-', 'L', 'C', 'C', 'r',
+                                        'y', 'p', 't', 'o', ' ', '2', '5', '6',
+                                        '-', 'b', 'i', 't', ' ', 'L', 'o', 'n',
+                                        'g', ' ', 'K', 'e', 'y', '!', '!', '!'};
+
+static const uint8_t kAESIV[AES_BLOCK_SIZE] = {0};
+
+static bssl::UniquePtr<DH> GetDH() {
+  // kFFDHE2048PrivateKeyData is a 225-bit value. (225 because that's the
+  // minimum private key size in
+  // https://tools.ietf.org/html/rfc7919#appendix-A.1.)
+  static const uint8_t kFFDHE2048PrivateKey[] = {
+      0x01, 0x91, 0x17, 0x3f, 0x2a, 0x05, 0x70, 0x18, 0x7e, 0xc4,
+      0x22, 0xee, 0xb7, 0x0a, 0x15, 0x2f, 0x39, 0x64, 0x58, 0xf3,
+      0xb8, 0x18, 0x7b, 0xe3, 0x6b, 0xd3, 0x8a, 0x4f, 0xa1};
+  bssl::UniquePtr<BIGNUM> priv(
+      BN_bin2bn(kFFDHE2048PrivateKey, sizeof(kFFDHE2048PrivateKey), nullptr));
+  if (!priv) {
+    return nullptr;
+  }
+  bssl::UniquePtr<DH> dh(DH_get_rfc7919_2048());
+  if (!dh || !DH_set0_key(dh.get(), nullptr, priv.get())) {
+    return nullptr;
+  }
+  priv.release();  // |DH_set0_key| takes ownership on success.
+  return dh;
+}
+
+static void DoCipherFinal(EVP_CIPHER_CTX *ctx, std::vector<uint8_t> *out,
+                          bssl::Span<const uint8_t> in,
+                          FIPSStatus expect_approved) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  size_t max_out = in.size();
+  if (EVP_CIPHER_CTX_encrypting(ctx)) {
+    unsigned block_size = EVP_CIPHER_CTX_block_size(ctx);
+    max_out += block_size - (max_out % block_size);
+  }
+  out->resize(max_out);
+
+  size_t total = 0;
+  int len;
+  ASSERT_TRUE(EVP_CipherUpdate(ctx, out->data(), &len, in.data(), in.size()));
+  total += static_cast<size_t>(len);
+  // Check if the overall service is approved by checking |EVP_CipherFinal_ex|,
+  // which should be the last part of the service.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_CipherFinal_ex(ctx, out->data() + total, &len)));
+  total += static_cast<size_t>(len);
+  ASSERT_LE(total, max_out);
+  out->resize(total);
+
+  EXPECT_EQ(approved, expect_approved);
+}
+
+static const uint8_t kTDES_EDE3_CipherText[64] = {
+    0x2a, 0x17, 0x79, 0x5a, 0x9b, 0x1d, 0xd8, 0x72, 0x06, 0xc6, 0xe7,
+    0x55, 0x14, 0xaa, 0x7b, 0x2a, 0x6e, 0xfc, 0x71, 0x29, 0xff, 0x9b,
+    0x67, 0x73, 0x7c, 0x9e, 0x15, 0x74, 0x80, 0xc8, 0x2f, 0xca, 0x93,
+    0xaa, 0x8e, 0xba, 0x2c, 0x48, 0x88, 0x51, 0xc7, 0xa4, 0xf4, 0xe3,
+    0x2b, 0x33, 0xe5, 0xa1, 0x58, 0x0a, 0x08, 0x3c, 0xb9, 0xf6, 0xf1,
+    0x20, 0x67, 0x02, 0x49, 0xa0, 0x92, 0x18, 0xde, 0x2b};
+
+static const uint8_t kTDES_EDE3_CBCCipherText[64] = {
+    0x2a, 0x17, 0x79, 0x5a, 0x9b, 0x1d, 0xd8, 0x72, 0xbf, 0x3f, 0xfd,
+    0xe4, 0x0d, 0x66, 0x33, 0x49, 0x3b, 0x8c, 0xa6, 0xd0, 0x0a, 0x66,
+    0xae, 0xf1, 0xd9, 0xa7, 0xd6, 0xfb, 0xa2, 0x39, 0x6f, 0xf6, 0x1b,
+    0x8f, 0x67, 0xe1, 0x2b, 0x58, 0x1c, 0xb6, 0xa2, 0xec, 0xb3, 0xc2,
+    0xe6, 0xd1, 0xcc, 0x11, 0x05, 0xdd, 0xee, 0x9d, 0x87, 0x95, 0xe9,
+    0x58, 0xc7, 0xef, 0xa4, 0x6d, 0x5e, 0xd6, 0x57, 0x01};
+
+// AES-OFB is not an approved service, and is only used to test we are not
+// validating un-approved services correctly.
+static const uint8_t kAESOFBCiphertext[64] = {
+    0x49, 0xf5, 0x6a, 0x7d, 0x3e, 0xd7, 0xb2, 0x47, 0x35, 0xca, 0x54,
+    0xf5, 0xf1, 0xb8, 0xd1, 0x48, 0x8e, 0x47, 0x09, 0x95, 0xd5, 0xa0,
+    0xc6, 0xa3, 0xe4, 0x94, 0xaf, 0xd4, 0x1b, 0x64, 0x25, 0x65, 0x28,
+    0x9e, 0x82, 0xba, 0x92, 0xca, 0x75, 0xb3, 0xf3, 0x78, 0x44, 0x87,
+    0xd6, 0x11, 0xf9, 0x22, 0xa3, 0xf3, 0xc6, 0x1d, 0x30, 0x00, 0x5b,
+    0x77, 0x18, 0x38, 0x39, 0x08, 0x5e, 0x0a, 0x56, 0x6b};
+
+static const uint8_t kAESECBCiphertext[64] = {
+    0xa4, 0xc1, 0x5c, 0x51, 0x2a, 0x2e, 0x2a, 0xda, 0xd9, 0x02, 0x23,
+    0xe7, 0xa9, 0x34, 0x9d, 0xd8, 0x15, 0xc5, 0xf5, 0x55, 0x8e, 0xb0,
+    0x29, 0x95, 0x48, 0x6c, 0x7f, 0xa9, 0x47, 0x19, 0x0b, 0x54, 0xe5,
+    0x0f, 0x05, 0x76, 0xbb, 0xd0, 0x1a, 0x6c, 0xab, 0xe9, 0xfd, 0x5b,
+    0xd8, 0x0b, 0x0a, 0xbd, 0x7f, 0xea, 0xda, 0x52, 0x07, 0x65, 0x13,
+    0x6c, 0xbe, 0xfc, 0x36, 0x82, 0x4b, 0x6a, 0xc3, 0xd5};
+
+static const uint8_t kAESECBCiphertext_192[64] = {
+    0x1d, 0xc8, 0xaa, 0xa7, 0x29, 0x01, 0x17, 0x09, 0x72, 0xc6, 0xe9,
+    0x63, 0x02, 0x9d, 0xeb, 0x01, 0xeb, 0xc0, 0xda, 0x82, 0x6c, 0x30,
+    0x7d, 0x60, 0x1b, 0x3e, 0xc7, 0x7b, 0xe3, 0x18, 0xa2, 0x43, 0x59,
+    0x15, 0x4a, 0xe4, 0x8a, 0x84, 0xda, 0x16, 0x90, 0x7b, 0xfa, 0x64,
+    0x37, 0x62, 0x19, 0xf1, 0x95, 0x11, 0x61, 0x84, 0xb0, 0x70, 0x49,
+    0x72, 0x9f, 0xe7, 0x3a, 0x18, 0x99, 0x01, 0xba, 0xb0};
+
+static const uint8_t kAESECBCiphertext_256[64] = {
+    0x6f, 0x2d, 0x6d, 0x7a, 0xc1, 0x8f, 0x00, 0x9f, 0x2d, 0xcf, 0xba,
+    0xe6, 0x4f, 0xdd, 0xe0, 0x09, 0x5b, 0xf3, 0xa4, 0xaf, 0xce, 0x45,
+    0x49, 0x6e, 0x28, 0x7b, 0x48, 0x57, 0xb5, 0xf5, 0xd8, 0x05, 0x16,
+    0x0f, 0xea, 0x21, 0x0c, 0x39, 0x78, 0xee, 0x9e, 0x57, 0x3c, 0x40,
+    0x11, 0x9c, 0xd9, 0x34, 0x97, 0xb9, 0xa6, 0x06, 0x40, 0x60, 0xa2,
+    0x0c, 0x01, 0xe3, 0x9c, 0xda, 0x3e, 0xad, 0x99, 0x3d};
+
+static const uint8_t kAESCBCCiphertext[64] = {
+    0xa4, 0xc1, 0x5c, 0x51, 0x2a, 0x2e, 0x2a, 0xda, 0xd9, 0x02, 0x23,
+    0xe7, 0xa9, 0x34, 0x9d, 0xd8, 0x5c, 0xb3, 0x65, 0x54, 0x72, 0xc8,
+    0x06, 0xf1, 0x36, 0xc3, 0x97, 0x73, 0x87, 0xca, 0x44, 0x99, 0x21,
+    0xb8, 0xdb, 0x93, 0x22, 0x00, 0x89, 0x7c, 0x1c, 0xea, 0x36, 0x23,
+    0x18, 0xdb, 0xc1, 0x52, 0x8c, 0x23, 0x66, 0x11, 0x0d, 0xa8, 0xe9,
+    0xb8, 0x08, 0x8b, 0xaa, 0x81, 0x47, 0x01, 0xa4, 0x4f};
+
+static const uint8_t kAESCBCCiphertext_192[64] = {
+    0x1d, 0xc8, 0xaa, 0xa7, 0x29, 0x01, 0x17, 0x09, 0x72, 0xc6, 0xe9,
+    0x63, 0x02, 0x9d, 0xeb, 0x01, 0xb4, 0x48, 0xa8, 0x00, 0x94, 0x46,
+    0x7f, 0xe3, 0xc1, 0x24, 0xea, 0x41, 0xa0, 0x2b, 0x47, 0x2f, 0xae,
+    0x19, 0xce, 0x0d, 0xfa, 0x90, 0x45, 0x85, 0xce, 0xc4, 0x21, 0x0c,
+    0x74, 0x38, 0x13, 0xfd, 0x64, 0xba, 0x58, 0x10, 0x37, 0x53, 0x48,
+    0x66, 0x02, 0x76, 0xfb, 0xb1, 0x3a, 0x19, 0xce, 0x61};
+
+static const uint8_t kAESCBCCiphertext_256[64] = {
+    0x6f, 0x2d, 0x6d, 0x7a, 0xc1, 0x8f, 0x00, 0x9f, 0x2d, 0xcf, 0xba,
+    0xe6, 0x4f, 0xdd, 0xe0, 0x09, 0x9e, 0xa8, 0x28, 0xdc, 0x27, 0xde,
+    0x89, 0x26, 0xc7, 0x94, 0x6a, 0xbf, 0xb6, 0x94, 0x05, 0x08, 0x6c,
+    0x39, 0x07, 0x52, 0xfa, 0x7b, 0xca, 0x7d, 0x9b, 0xbf, 0xb2, 0x43,
+    0x2b, 0x69, 0xee, 0xc5, 0x68, 0x4c, 0xdd, 0x62, 0xae, 0x8d, 0x7e,
+    0x71, 0x0c, 0x8f, 0x11, 0xce, 0x1d, 0x8b, 0xee, 0x94};
+
+static const uint8_t kAESCTRCiphertext[64] = {
+    0x49, 0xf5, 0x6a, 0x7d, 0x3e, 0xd7, 0xb2, 0x47, 0x35, 0xca, 0x54,
+    0xf5, 0xf1, 0xb8, 0xd1, 0x48, 0xb0, 0x18, 0xc4, 0x5e, 0xeb, 0x42,
+    0xfd, 0x10, 0x49, 0x1f, 0x2b, 0x11, 0xe9, 0xb0, 0x07, 0xa4, 0x00,
+    0x56, 0xec, 0x25, 0x53, 0x4d, 0x70, 0x98, 0x38, 0x85, 0x5d, 0x54,
+    0xab, 0x2c, 0x19, 0x13, 0x6d, 0xf3, 0x0e, 0x6f, 0x48, 0x2f, 0xab,
+    0xe1, 0x82, 0xd4, 0x30, 0xa9, 0x16, 0x73, 0x93, 0xc3};
+
+static const uint8_t kAESCTRCiphertext_192[64] = {
+    0x72, 0x7d, 0xbb, 0xd4, 0x8b, 0x16, 0x8b, 0x19, 0xa4, 0xeb, 0xa6,
+    0xfa, 0xa0, 0xd0, 0x2b, 0xbb, 0x9b, 0x1f, 0xbf, 0x4d, 0x67, 0xfb,
+    0xea, 0x89, 0x16, 0xd7, 0xa4, 0xb6, 0xbe, 0x1a, 0x78, 0x1c, 0x3d,
+    0x44, 0x49, 0xa0, 0xf2, 0xb2, 0xb3, 0x82, 0x0f, 0xdd, 0xac, 0xd6,
+    0xea, 0x6e, 0x1f, 0x09, 0x8d, 0xa5, 0xdb, 0x4f, 0x3f, 0x97, 0x90,
+    0x26, 0xed, 0xf6, 0xbb, 0x62, 0xb3, 0x6f, 0x52, 0x67};
+
+static const uint8_t kAESCTRCiphertext_256[64] = {
+    0x4a, 0x87, 0x44, 0x09, 0xf4, 0x1d, 0x80, 0x94, 0x51, 0x9a, 0xe4,
+    0x89, 0x49, 0xcb, 0x98, 0x0d, 0x27, 0xc5, 0xba, 0x20, 0x00, 0x45,
+    0xbb, 0x29, 0x75, 0xc0, 0xb7, 0x23, 0x0d, 0x81, 0x9f, 0x43, 0xaa,
+    0x78, 0x89, 0xc0, 0xc4, 0x6d, 0x99, 0x0d, 0xb8, 0x9b, 0xc3, 0x25,
+    0xa6, 0xd1, 0x7c, 0x98, 0x3e, 0xff, 0x06, 0x59, 0x41, 0xcf, 0xb2,
+    0xd5, 0x2f, 0x95, 0xea, 0x83, 0xb1, 0x42, 0xb8, 0xb2};
+
+static const uint8_t kAESCFBCiphertext[64] = {
+    0x49, 0xf5, 0x6a, 0x7d, 0x3e, 0xd7, 0xb2, 0x47, 0x35, 0xca, 0x54,
+    0xf5, 0xf1, 0xb8, 0xd1, 0x48, 0x01, 0xdc, 0xba, 0x43, 0x3a, 0x7b,
+    0xbf, 0x84, 0x91, 0x49, 0xc5, 0xc9, 0xd6, 0xcf, 0x6a, 0x2c, 0x3a,
+    0x66, 0x99, 0x68, 0xe3, 0xd0, 0x56, 0x05, 0xe7, 0x99, 0x7f, 0xc3,
+    0xbc, 0x09, 0x13, 0xa6, 0xf0, 0xde, 0x17, 0xf4, 0x85, 0x9a, 0xee,
+    0x29, 0xc3, 0x77, 0xab, 0xc4, 0xf6, 0xdb, 0xae, 0x24};
+
+static const uint8_t kAESCCMCiphertext[64 + 4] = {
+    0x7a, 0x02, 0x5d, 0x48, 0x02, 0x44, 0x78, 0x7f, 0xb4, 0x71, 0x74, 0x7b,
+    0xec, 0x4d, 0x90, 0x29, 0x7b, 0xa7, 0x65, 0xbb, 0x3e, 0x80, 0x41, 0x7e,
+    0xab, 0xb4, 0x58, 0x22, 0x4f, 0x86, 0xcd, 0xcc, 0xc2, 0x12, 0xeb, 0x36,
+    0x39, 0x89, 0xe3, 0x66, 0x2a, 0xbf, 0xe3, 0x6c, 0x95, 0x60, 0x13, 0x9e,
+    0x93, 0xcc, 0xb4, 0x06, 0xbe, 0xaf, 0x3f, 0xba, 0x13, 0x73, 0x09, 0x92,
+    0xd1, 0x80, 0x73, 0xb3, 0xc3, 0xa3, 0xa4, 0x8b,
+};
+
+static const uint8_t kAESKWCiphertext[72] = {
+    0x44, 0xec, 0x7d, 0x92, 0x2c, 0x9f, 0xf3, 0xe8, 0xac, 0xb1, 0xea, 0x3d,
+    0x0a, 0xc7, 0x51, 0x27, 0xe8, 0x03, 0x11, 0x78, 0xe5, 0xaf, 0x8d, 0xb1,
+    0x70, 0x96, 0x2e, 0xfa, 0x05, 0x48, 0x48, 0x99, 0x1a, 0x58, 0xcc, 0xfe,
+    0x11, 0x36, 0x5d, 0x49, 0x98, 0x1e, 0xbb, 0xd6, 0x0b, 0xf5, 0xb9, 0x64,
+    0xa4, 0x30, 0x3e, 0x60, 0xf6, 0xc5, 0xff, 0x82, 0x30, 0x9a, 0xa7, 0x48,
+    0x82, 0xe2, 0x00, 0xc1, 0xe9, 0xc2, 0x73, 0x6f, 0xbc, 0x89, 0x66, 0x9d};
+
+static const uint8_t kAESKWPCiphertext[72] = {
+    0x29, 0x5e, 0xb9, 0xea, 0x96, 0xa7, 0xa5, 0xca, 0xfa, 0xeb, 0xda, 0x78,
+    0x13, 0xea, 0x83, 0xca, 0x41, 0xdb, 0x4d, 0x36, 0x7d, 0x39, 0x8a, 0xd6,
+    0xef, 0xd3, 0xd2, 0x2d, 0x3a, 0xc8, 0x55, 0xc8, 0x73, 0xd7, 0x79, 0x55,
+    0xad, 0xc0, 0xce, 0xad, 0x12, 0x54, 0x51, 0xf0, 0x70, 0x76, 0xff, 0xe7,
+    0x0c, 0xb2, 0x8e, 0xdd, 0xb6, 0x9a, 0x27, 0x74, 0x98, 0x28, 0xe0, 0xfa,
+    0x11, 0xe6, 0x3f, 0x86, 0x93, 0x23, 0xf8, 0x0d, 0xcb, 0xaf, 0x2b, 0xb7};
+
+static const uint8_t kAESCMACOutput[16] = {0xe7, 0x32, 0x43, 0xb4, 0xae, 0x79,
+                                           0x08, 0x86, 0xe7, 0x9f, 0x0d, 0x3f,
+                                           0x88, 0x3f, 0x1a, 0xfd};
+
+const uint8_t kDHOutput[2048 / 8] = {
+    0x83, 0xf0, 0xd8, 0x4f, 0xdb, 0xe7, 0x65, 0xb6, 0x80, 0x6f, 0xa3, 0x22,
+    0x9b, 0x33, 0x1c, 0x87, 0x89, 0xc8, 0x1d, 0x2c, 0xa1, 0xba, 0xa3, 0xb8,
+    0xdf, 0xad, 0x42, 0xea, 0x9a, 0x75, 0xfe, 0xbf, 0xc1, 0xa8, 0xf6, 0xda,
+    0xec, 0xdf, 0x48, 0x61, 0x7d, 0x7f, 0x3d, 0xab, 0xbd, 0xda, 0xd1, 0xd3,
+    0xd8, 0xaf, 0x44, 0x4a, 0xba, 0x3f, 0x0e, 0x99, 0x8d, 0x11, 0xdc, 0x63,
+    0xb1, 0xe0, 0x65, 0xf2, 0xb9, 0x82, 0x81, 0x8c, 0x88, 0x75, 0x8f, 0xa0,
+    0x94, 0x52, 0x2a, 0x2f, 0x2d, 0x10, 0xb1, 0xf4, 0xd2, 0xdd, 0x0f, 0x8a,
+    0x7e, 0x49, 0x7b, 0x1e, 0xfd, 0x8c, 0x78, 0xf9, 0x11, 0xdf, 0x80, 0x8b,
+    0x2e, 0x86, 0x34, 0xbf, 0x4b, 0xca, 0x13, 0x3e, 0x85, 0x63, 0xeb, 0xe4,
+    0xff, 0xec, 0xb0, 0xe8, 0x83, 0xf6, 0x2c, 0x45, 0x21, 0x90, 0x34, 0x9c,
+    0x9d, 0x9d, 0xfe, 0x1a, 0x48, 0x53, 0xef, 0x97, 0xd5, 0xea, 0x6a, 0x65,
+    0xf5, 0xe9, 0x9f, 0x91, 0x4f, 0xb4, 0x43, 0xe7, 0x1f, 0x0a, 0x2e, 0xdb,
+    0xe6, 0x84, 0x30, 0xdb, 0xad, 0xe4, 0xaf, 0x2c, 0xf9, 0x93, 0xe8, 0x0a,
+    0xab, 0x7f, 0x1c, 0xde, 0xb3, 0x80, 0xb6, 0x02, 0x42, 0xba, 0x18, 0x0d,
+    0x0f, 0xc2, 0x1d, 0xa4, 0x4b, 0x2b, 0x84, 0x74, 0x10, 0x97, 0x6d, 0xdc,
+    0xfa, 0x99, 0xdc, 0xba, 0xf2, 0xcb, 0x1b, 0xe8, 0x1a, 0xba, 0x0c, 0x67,
+    0x60, 0x07, 0x87, 0xcc, 0xc6, 0x0d, 0xef, 0x56, 0x07, 0x80, 0x55, 0xae,
+    0x03, 0xa3, 0x62, 0x31, 0x4c, 0x50, 0xf7, 0xf6, 0x87, 0xb3, 0x8d, 0xe2,
+    0x11, 0x86, 0xe7, 0x9d, 0x98, 0x3c, 0x2a, 0x6c, 0x8a, 0xf0, 0xa7, 0x73,
+    0x33, 0x07, 0x4e, 0x70, 0xee, 0x14, 0x4b, 0xa3, 0xf7, 0x4f, 0x8f, 0x1a,
+    0xa2, 0xf6, 0xd1, 0xeb, 0x4d, 0x04, 0xf9, 0x4c, 0x07, 0x36, 0xb1, 0x46,
+    0x53, 0x55, 0xb1, 0x23};
+
+static const uint8_t kOutput_md4[MD4_DIGEST_LENGTH] = {
+    0xab, 0x6b, 0xda, 0x84, 0xc0, 0x6b, 0xd0, 0x1d,
+    0x19, 0xc0, 0x08, 0x11, 0x07, 0x8d, 0xce, 0x0e};
+
+static const uint8_t kOutput_md5[MD5_DIGEST_LENGTH] = {
+    0xe9, 0x70, 0xa2, 0xf7, 0x9c, 0x55, 0x57, 0xac,
+    0x4e, 0x7f, 0x6b, 0xbc, 0xa3, 0xb9, 0xb7, 0xdb};
+
+static const uint8_t kOutput_sha1[SHA_DIGEST_LENGTH] = {
+    0xaa, 0x18, 0x71, 0x34, 0x00, 0x71, 0x67, 0x9f, 0xa1, 0x6d,
+    0x20, 0x82, 0x91, 0x0f, 0x53, 0x0a, 0xcd, 0x6e, 0xa4, 0x34};
+
+static const uint8_t kOutput_sha224[SHA224_DIGEST_LENGTH] = {
+    0x5f, 0x1a, 0x9e, 0x68, 0x4c, 0xb7, 0x42, 0x68, 0xa0, 0x8b,
+    0x87, 0xd7, 0x96, 0xb6, 0xcf, 0x1e, 0x4f, 0x85, 0x1c, 0x47,
+    0xe9, 0x29, 0xb3, 0xb2, 0x73, 0x72, 0xd2, 0x69};
+
+static const uint8_t kOutput_sha256[SHA256_DIGEST_LENGTH] = {
+    0xe7, 0x63, 0x1c, 0xbb, 0x12, 0xb5, 0xbf, 0x4f, 0x99, 0x05, 0x9d,
+    0x40, 0x15, 0x55, 0x34, 0x9c, 0x26, 0x36, 0xd2, 0xfe, 0x6a, 0xd6,
+    0x26, 0xb4, 0x9d, 0x33, 0x07, 0xf5, 0xe6, 0x29, 0x13, 0x92};
+
+static const uint8_t kOutput_sha384[SHA384_DIGEST_LENGTH] = {
+    0x15, 0x81, 0x48, 0x8d, 0x95, 0xf2, 0x66, 0x84, 0x65, 0x94, 0x3e, 0xb9,
+    0x8c, 0xda, 0x36, 0x30, 0x2a, 0x85, 0xc0, 0xcd, 0xec, 0x38, 0xa0, 0x1f,
+    0x72, 0xe2, 0x68, 0xfe, 0x4e, 0xdb, 0x27, 0x8b, 0x50, 0x15, 0xe0, 0x24,
+    0xc3, 0x65, 0xd1, 0x66, 0x2a, 0x3e, 0xe7, 0x00, 0x16, 0x51, 0xf5, 0x18};
+
+static const uint8_t kOutput_sha512[SHA512_DIGEST_LENGTH] = {
+    0x71, 0xcc, 0xec, 0x03, 0xf8, 0x76, 0xf4, 0x0b, 0xf1, 0x1b, 0x89,
+    0x27, 0x83, 0xa1, 0x70, 0x02, 0x00, 0x2b, 0xe9, 0x3c, 0x3c, 0x65,
+    0x12, 0xb9, 0xa8, 0x8c, 0xc5, 0x9d, 0xae, 0x3c, 0x73, 0x43, 0x76,
+    0x4d, 0x98, 0xed, 0xd0, 0xbe, 0xb4, 0xf9, 0x0b, 0x5c, 0x5d, 0x34,
+    0x46, 0x30, 0x18, 0xc2, 0x05, 0x88, 0x8a, 0x3c, 0x25, 0xcc, 0x06,
+    0xf8, 0x73, 0xb9, 0xe4, 0x18, 0xa8, 0xc2, 0xf0, 0xe5};
+
+static const uint8_t kOutput_sha512_256[SHA512_256_DIGEST_LENGTH] = {
+    0x1a, 0x78, 0x68, 0x6b, 0x69, 0x6d, 0x28, 0x14, 0x6b, 0x37, 0x11,
+    0x2d, 0xfb, 0x72, 0x35, 0xfa, 0xc1, 0xc4, 0x5f, 0x5c, 0x49, 0x91,
+    0x08, 0x95, 0x0b, 0x0f, 0xc9, 0x88, 0x44, 0x12, 0x01, 0x6a};
+
+static const uint8_t kHMACOutput_sha1[SHA_DIGEST_LENGTH] = {
+    0x34, 0xac, 0x50, 0x9b, 0xa9, 0x4c, 0x39, 0xef, 0x45, 0xa0,
+    0x6b, 0xdc, 0xfc, 0xbd, 0x3d, 0x42, 0xe8, 0x0a, 0x97, 0x86};
+
+static const uint8_t kHMACOutput_sha224[SHA224_DIGEST_LENGTH] = {
+    0x30, 0x62, 0x97, 0x45, 0x9e, 0xea, 0x62, 0xe4, 0x5d, 0xbb,
+    0x7d, 0x25, 0x3f, 0x77, 0x0f, 0x9d, 0xa4, 0xbd, 0x17, 0x96,
+    0x23, 0x53, 0xe1, 0x76, 0xf3, 0xf8, 0x9b, 0x74};
+
+static const uint8_t kHMACOutput_sha256[SHA256_DIGEST_LENGTH] = {
+    0x68, 0x33, 0x3e, 0x74, 0x9a, 0x49, 0xab, 0x77, 0xb4, 0x1a, 0x40,
+    0xd8, 0x55, 0x07, 0xa7, 0xb6, 0x48, 0xa1, 0xa5, 0xa9, 0xd1, 0x7b,
+    0x85, 0xe9, 0x33, 0x09, 0x16, 0x79, 0xcc, 0xe9, 0x29, 0x97};
+
+static const uint8_t kHMACOutput_sha384[SHA384_DIGEST_LENGTH] = {
+    0xcc, 0x39, 0x22, 0x0e, 0x9f, 0x2e, 0x26, 0x4a, 0xb5, 0xf8, 0x4a, 0x0f,
+    0x73, 0x51, 0x26, 0x1a, 0xf2, 0xef, 0x15, 0xf3, 0x5f, 0x77, 0xce, 0xbb,
+    0x4c, 0x69, 0x86, 0x0e, 0x1f, 0x5c, 0x4d, 0xc9, 0x96, 0xd9, 0xed, 0x74,
+    0x6c, 0x45, 0x05, 0x7a, 0x0e, 0x3f, 0x36, 0x8a, 0xda, 0x2a, 0x35, 0xf9};
+
+static const uint8_t kHMACOutput_sha512[SHA512_DIGEST_LENGTH] = {
+    0x4c, 0x09, 0x46, 0x50, 0x7c, 0xb3, 0xa1, 0xfa, 0xbc, 0xf2, 0xc4,
+    0x4f, 0x1e, 0x3d, 0xa9, 0x0b, 0x29, 0x4e, 0x12, 0x09, 0x09, 0x32,
+    0xde, 0x82, 0xa0, 0xab, 0xf6, 0x5e, 0x66, 0x19, 0xd0, 0x86, 0x9a,
+    0x92, 0xe3, 0xf9, 0x13, 0xa7, 0xe6, 0xfc, 0x1a, 0x2e, 0x50, 0xda,
+    0xf6, 0x8f, 0xb2, 0xd5, 0xb2, 0x6e, 0x97, 0x82, 0x25, 0x5a, 0x1e,
+    0xbf, 0x9b, 0x99, 0x8c, 0xf0, 0x37, 0xe6, 0x3d, 0x40};
+
+static const uint8_t kHMACOutput_sha512_256[SHA512_256_DIGEST_LENGTH] = {
+    0x9c, 0x95, 0x9c, 0x03, 0xc9, 0x8c, 0x90, 0xee, 0x7a, 0xff, 0xed,
+    0x26, 0xba, 0x75, 0x90, 0xd0, 0xb9, 0xd4, 0x09, 0xf5, 0x22, 0xd6,
+    0xb6, 0xab, 0xa8, 0xb9, 0xae, 0x01, 0x06, 0x37, 0x8f, 0xd1};
+
+static const uint8_t kDRBGEntropy[48] = {
+    'B', 'C', 'M', ' ', 'K', 'n', 'o', 'w', 'n', ' ', 'A', 'n',
+    's', 'w', 'e', 'r', ' ', 'T', 'e', 's', 't', ' ', 'D', 'B',
+    'R', 'G', ' ', 'I', 'n', 'i', 't', 'i', 'a', 'l', ' ', 'E',
+    'n', 't', 'r', 'o', 'p', 'y', ' ', ' ', ' ', ' ', ' ', ' '};
+
+static const uint8_t kDRBGPersonalization[18] = {'B', 'C', 'M', 'P', 'e', 'r',
+                                                 's', 'o', 'n', 'a', 'l', 'i',
+                                                 'z', 'a', 't', 'i', 'o', 'n'};
+
+static const uint8_t kDRBGAD[16] = {'B', 'C', 'M', ' ', 'D', 'R', 'B', 'G',
+                                    ' ', 'K', 'A', 'T', ' ', 'A', 'D', ' '};
+
+const uint8_t kDRBGOutput[64] = {
+    0x1d, 0x63, 0xdf, 0x05, 0x51, 0x49, 0x22, 0x46, 0xcd, 0x9b, 0xc5,
+    0xbb, 0xf1, 0x5d, 0x44, 0xae, 0x13, 0x78, 0xb1, 0xe4, 0x7c, 0xf1,
+    0x96, 0x33, 0x3d, 0x60, 0xb6, 0x29, 0xd4, 0xbb, 0x6b, 0x44, 0xf9,
+    0xef, 0xd9, 0xf4, 0xa2, 0xba, 0x48, 0xea, 0x39, 0x75, 0x59, 0x32,
+    0xf7, 0x31, 0x2c, 0x98, 0x14, 0x2b, 0x49, 0xdf, 0x02, 0xb6, 0x5d,
+    0x71, 0x09, 0x50, 0xdb, 0x23, 0xdb, 0xe5, 0x22, 0x95};
+
+static const uint8_t kDRBGEntropy2[48] = {
+    'B', 'C', 'M', ' ', 'K', 'n', 'o', 'w', 'n', ' ', 'A', 'n',
+    's', 'w', 'e', 'r', ' ', 'T', 'e', 's', 't', ' ', 'D', 'B',
+    'R', 'G', ' ', 'R', 'e', 's', 'e', 'e', 'd', ' ', 'E', 'n',
+    't', 'r', 'o', 'p', 'y', ' ', ' ', ' ', ' ', ' ', ' ', ' '};
+
+static const uint8_t kDRBGReseedOutput[64] = {
+    0xa4, 0x77, 0x05, 0xdb, 0x14, 0x11, 0x76, 0x71, 0x42, 0x5b, 0xd8,
+    0xd7, 0xa5, 0x4f, 0x8b, 0x39, 0xf2, 0x10, 0x4a, 0x50, 0x5b, 0xa2,
+    0xc8, 0xf0, 0xbb, 0x3e, 0xa1, 0xa5, 0x90, 0x7d, 0x54, 0xd9, 0xc6,
+    0xb0, 0x96, 0xc0, 0x2b, 0x7e, 0x9b, 0xc9, 0xa1, 0xdd, 0x78, 0x2e,
+    0xd5, 0xa8, 0x66, 0x16, 0xbd, 0x18, 0x3c, 0xf2, 0xaa, 0x7a, 0x2b,
+    0x37, 0xf9, 0xab, 0x35, 0x64, 0x15, 0x01, 0x3f, 0xc4,
+};
+
+static const uint8_t kTLSSecret[32] = {
+    0xbf, 0xe4, 0xb7, 0xe0, 0x26, 0x55, 0x5f, 0x6a, 0xdf, 0x5d, 0x27,
+    0xd6, 0x89, 0x99, 0x2a, 0xd6, 0xf7, 0x65, 0x66, 0x07, 0x4b, 0x55,
+    0x5f, 0x64, 0x55, 0xcd, 0xd5, 0x77, 0xa4, 0xc7, 0x09, 0x61,
+};
+static const char kTLSLabel[] = "FIPS self test";
+static const uint8_t kTLSSeed1[16] = {
+    0x8f, 0x0d, 0xe8, 0xb6, 0x90, 0x8f, 0xb1, 0xd2,
+    0x6d, 0x51, 0xf4, 0x79, 0x18, 0x63, 0x51, 0x65,
+};
+static const uint8_t kTLSSeed2[16] = {
+    0x7d, 0x24, 0x1a, 0x9d, 0x3c, 0x59, 0xbf, 0x3c,
+    0x31, 0x1e, 0x2b, 0x21, 0x41, 0x8d, 0x32, 0x81,
+};
+
+static const uint8_t kTLSOutput_mdsha1[32] = {
+    0x36, 0xa9, 0x31, 0xb0, 0x43, 0xe3, 0x64, 0x72, 0xb9, 0x47, 0x54,
+    0x0d, 0x8a, 0xfc, 0xe3, 0x5c, 0x1c, 0x15, 0x67, 0x7e, 0xa3, 0x5d,
+    0xf2, 0x3a, 0x57, 0xfd, 0x50, 0x16, 0xe1, 0xa4, 0xa6, 0x37,
+};
+
+static const uint8_t kTLSOutput_md[32] = {
+    0x79, 0xef, 0x46, 0xc4, 0x35, 0xbc, 0xe5, 0xda, 0xd3, 0x66, 0x91,
+    0xdc, 0x86, 0x09, 0x41, 0x66, 0xf2, 0x0c, 0xeb, 0xe6, 0xab, 0x5c,
+    0x58, 0xf4, 0x65, 0xce, 0x2f, 0x5f, 0x4b, 0x34, 0x1e, 0xa1,
+};
+
+static const uint8_t kTLSOutput_sha1[32] = {
+    0xbb, 0x0a, 0x73, 0x52, 0xf8, 0x85, 0xd7, 0xbd, 0x12, 0x34, 0x78,
+    0x3b, 0x54, 0x4c, 0x75, 0xfe, 0xd7, 0x23, 0x6e, 0x22, 0x3f, 0x42,
+    0x34, 0x99, 0x57, 0x6b, 0x14, 0xc4, 0xc8, 0xae, 0x9f, 0x4c,
+};
+
+static const uint8_t kTLSOutput_sha224[32] = {
+    0xdd, 0xaf, 0x6f, 0xaa, 0xd9, 0x2b, 0x3d, 0xb9, 0x46, 0x4c, 0x55,
+    0x8a, 0xf7, 0xa6, 0x9b, 0x0b, 0x35, 0xcc, 0x07, 0xa7, 0x55, 0x5b,
+    0x5e, 0x39, 0x12, 0xc0, 0xd4, 0x30, 0xdf, 0x0c, 0xdf, 0x6b,
+};
+
+static const uint8_t kTLSOutput_sha256[32] = {
+    0x67, 0x85, 0xde, 0x60, 0xfc, 0x0a, 0x83, 0xe9, 0xa2, 0x2a, 0xb3,
+    0xf0, 0x27, 0x0c, 0xba, 0xf7, 0xfa, 0x82, 0x3d, 0x14, 0x77, 0x1d,
+    0x86, 0x29, 0x79, 0x39, 0x77, 0x8a, 0xd5, 0x0e, 0x9d, 0x32,
+};
+
+static const uint8_t kTLSOutput_sha384[32] = {
+    0x75, 0x15, 0x3f, 0x44, 0x7a, 0xfd, 0x34, 0xed, 0x2b, 0x67, 0xbc,
+    0xd8, 0x57, 0x96, 0xab, 0xff, 0xf4, 0x0c, 0x05, 0x94, 0x02, 0x23,
+    0x81, 0xbf, 0x0e, 0xd2, 0xec, 0x7c, 0xe0, 0xa7, 0xc3, 0x7d,
+};
+
+static const uint8_t kTLSOutput_sha512[32] = {
+    0x68, 0xb9, 0xc8, 0x4c, 0xf5, 0x51, 0xfc, 0x7a, 0x1f, 0x6c, 0xe5,
+    0x43, 0x73, 0x80, 0x53, 0x7c, 0xae, 0x76, 0x55, 0x67, 0xe0, 0x79,
+    0xbf, 0x3a, 0x53, 0x71, 0xb7, 0x9c, 0xb5, 0x03, 0x15, 0x3f,
+};
+
+static const uint8_t kAESGCMCiphertext_128[64 + 16] = {
+    0x38, 0x71, 0xcb, 0x61, 0x70, 0x60, 0x13, 0x8b, 0x2f, 0x91, 0x09, 0x7f,
+    0x83, 0x20, 0x0f, 0x1f, 0x71, 0xe2, 0x47, 0x46, 0x6f, 0x5f, 0xa8, 0xad,
+    0xa8, 0xfc, 0x0a, 0xfd, 0x36, 0x65, 0x84, 0x90, 0x28, 0x2b, 0xcb, 0x4f,
+    0x68, 0xae, 0x09, 0xba, 0xae, 0xdd, 0xdb, 0x91, 0xcc, 0x38, 0xb3, 0xad,
+    0x10, 0x84, 0xb8, 0x45, 0x36, 0xf3, 0x96, 0xb4, 0xef, 0xba, 0xda, 0x10,
+    0xf8, 0x8b, 0xf3, 0xda, 0x91, 0x1f, 0x8c, 0xd8, 0x39, 0x7b, 0x1c, 0xfd,
+    0xe7, 0x99, 0x7d, 0xb7, 0x22, 0x69, 0x67, 0xbd,
+};
+
+static const uint8_t kAESGCMCiphertext_192[64 + 16] = {
+    0x05, 0x63, 0x6e, 0xe4, 0xd1, 0x9f, 0xd0, 0x91, 0x18, 0xc9, 0xf8, 0xfd,
+    0xc2, 0x62, 0x09, 0x05, 0x91, 0xb4, 0x92, 0x66, 0x18, 0xe7, 0x93, 0x6a,
+    0xc7, 0xde, 0x81, 0x36, 0x93, 0x79, 0x45, 0x34, 0xc0, 0x6d, 0x14, 0x94,
+    0x93, 0x39, 0x2b, 0x7f, 0x4f, 0x10, 0x1c, 0xa5, 0xfe, 0x3b, 0x37, 0xd7,
+    0x0a, 0x98, 0xd7, 0xb5, 0xe0, 0xdc, 0xe4, 0x9f, 0x36, 0x40, 0xad, 0x03,
+    0xbf, 0x53, 0xe0, 0x7c, 0x3f, 0x57, 0x4f, 0x80, 0x99, 0xe6, 0x90, 0x4e,
+    0x59, 0x2e, 0xe0, 0x76, 0x53, 0x09, 0xc3, 0xd3,
+};
+
+static const uint8_t kAESGCMCiphertext_256[64 + 16] = {
+    0x92, 0x5f, 0xae, 0x84, 0xe7, 0x40, 0xfa, 0x1e, 0xaf, 0x8f, 0x97, 0x0e,
+    0x8e, 0xdd, 0x6a, 0x94, 0x22, 0xee, 0x4f, 0x70, 0x66, 0xbf, 0xb1, 0x99,
+    0x05, 0xbd, 0xd0, 0xd7, 0x91, 0x54, 0xaf, 0xe1, 0x52, 0xc9, 0x4e, 0x55,
+    0xa5, 0x23, 0x62, 0x8b, 0x23, 0x40, 0x90, 0x56, 0xe0, 0x68, 0x63, 0xe5,
+    0x7e, 0x5b, 0xbe, 0x96, 0x7b, 0xc4, 0x16, 0xf9, 0xbe, 0x18, 0x06, 0x79,
+    0x8f, 0x99, 0x35, 0xe3, 0x2a, 0x82, 0xb5, 0x5e, 0x8a, 0x06, 0xbe, 0x99,
+    0x57, 0xb1, 0x76, 0xe1, 0xc5, 0xaa, 0x82, 0xe7,
+};
+
+static const struct AEADTestVector {
+  const char *name;
+  const EVP_AEAD *aead;
+  const uint8_t *key;
+  const int key_length;
+  const uint8_t *expected_ciphertext;
+  const int cipher_text_length;
+  const FIPSStatus expect_approved;
+  const bool test_repeat_nonce;
+} kAEADTestVectors[] = {
+    // Internal IV usage of AES-GCM is approved.
+    {
+        "AES-GCM 128-bit key internal iv test",
+        EVP_aead_aes_128_gcm_randnonce(),
+        kAESKey,
+        sizeof(kAESKey),
+        nullptr,
+        0,
+        FIPSStatus::APPROVED,
+        false,
+    },
+    {
+        "AES-GCM 256-bit key internal iv test",
+        EVP_aead_aes_256_gcm_randnonce(),
+        kAESKey_256,
+        sizeof(kAESKey_256),
+        nullptr,
+        0,
+        FIPSStatus::APPROVED,
+        false,
+    },
+    // External IV usage of AES-GCM is not approved unless used within a TLS
+    // context.
+    {
+        "Generic AES-GCM 128-bit key external iv test",
+        EVP_aead_aes_128_gcm(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESGCMCiphertext_128,
+        sizeof(kAESGCMCiphertext_128),
+        FIPSStatus::NOT_APPROVED,
+        false,
+    },
+    {
+        "Generic AES-GCM 192-bit key external iv test",
+        EVP_aead_aes_192_gcm(),
+        kAESKey_192,
+        24,
+        kAESGCMCiphertext_192,
+        sizeof(kAESGCMCiphertext_192),
+        FIPSStatus::NOT_APPROVED,
+        false,
+    },
+    {
+        "Generic AES-GCM 256-bit key external iv test",
+        EVP_aead_aes_256_gcm(),
+        kAESKey_256,
+        sizeof(kAESKey_256),
+        kAESGCMCiphertext_256,
+        sizeof(kAESGCMCiphertext_256),
+        FIPSStatus::NOT_APPROVED,
+        false,
+    },
+    // External IV usage of AEAD AES-GCM APIs specific for TLS is approved.
+    {
+        "TLS1.2 AES-GCM 128-bit key external iv test",
+        EVP_aead_aes_128_gcm_tls12(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESGCMCiphertext_128,
+        sizeof(kAESGCMCiphertext_128),
+        FIPSStatus::APPROVED,
+        true,
+    },
+    {
+        "TLS1.2 AES-GCM 256-bit key external iv test",
+        EVP_aead_aes_256_gcm_tls12(),
+        kAESKey_256,
+        sizeof(kAESKey_256),
+        kAESGCMCiphertext_256,
+        sizeof(kAESGCMCiphertext_256),
+        FIPSStatus::APPROVED,
+        true,
+    },
+    {
+        "TLS1.3 AES-GCM 128-bit key external iv test",
+        EVP_aead_aes_128_gcm_tls13(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESGCMCiphertext_128,
+        sizeof(kAESGCMCiphertext_128),
+        FIPSStatus::APPROVED,
+        true,
+    },
+    {
+        "TLS1.3 AES-GCM 256-bit key external iv test",
+        EVP_aead_aes_256_gcm_tls13(),
+        kAESKey_256,
+        sizeof(kAESKey_256),
+        kAESGCMCiphertext_256,
+        sizeof(kAESGCMCiphertext_256),
+        FIPSStatus::APPROVED,
+        true,
+    },
+    // 128 bit keys with 32 bit tag lengths are approved for AES-CCM.
+    {
+        "AES-CCM 128-bit key test",
+        EVP_aead_aes_128_ccm_bluetooth(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESCCMCiphertext,
+        sizeof(kAESCCMCiphertext),
+        FIPSStatus::APPROVED,
+        false,
+    },
+};
+
+class AEADServiceIndicatorTest : public TestWithNoErrors<AEADTestVector> {};
+
+INSTANTIATE_TEST_SUITE_P(All, AEADServiceIndicatorTest,
+                         testing::ValuesIn(kAEADTestVectors));
+
+TEST_P(AEADServiceIndicatorTest, EVP_AEAD) {
+  const AEADTestVector &test = GetParam();
+  SCOPED_TRACE(test.name);
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  bssl::ScopedEVP_AEAD_CTX aead_ctx;
+  std::vector<uint8_t> nonce(EVP_AEAD_nonce_length(test.aead), 0);
+  std::vector<uint8_t> encrypt_output(256);
+  std::vector<uint8_t> decrypt_output(256);
+  size_t out_len;
+
+  // Test running the EVP_AEAD_CTX interfaces one by one directly, and check
+  // |EVP_AEAD_CTX_seal| and |EVP_AEAD_CTX_open| for approval at the end.
+  // |EVP_AEAD_CTX_init| should not be approved because the function does not
+  // indicate that a service has been fully completed yet.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_AEAD_CTX_init(aead_ctx.get(), test.aead, test.key,
+                                  test.key_length, 0, nullptr)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_AEAD_CTX_seal(aead_ctx.get(), encrypt_output.data(),
+                                  &out_len, encrypt_output.size(), nonce.data(),
+                                  EVP_AEAD_nonce_length(test.aead), kPlaintext,
+                                  sizeof(kPlaintext), nullptr, 0)));
+  EXPECT_EQ(approved, test.expect_approved);
+  encrypt_output.resize(out_len);
+  if (test.expected_ciphertext) {
+    EXPECT_EQ(Bytes(test.expected_ciphertext, test.cipher_text_length),
+              Bytes(encrypt_output));
+  }
+
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_AEAD_CTX_open(aead_ctx.get(), decrypt_output.data(), &out_len,
+                        decrypt_output.size(), nonce.data(), nonce.size(),
+                        encrypt_output.data(), out_len, nullptr, 0)));
+  // Decryption doesn't have nonce uniqueness requirements and so is always
+  // approved for approved key lengths.
+  EXPECT_EQ(approved, test.key_length != 24 ? FIPSStatus::APPROVED
+                                            : FIPSStatus::NOT_APPROVED);
+  decrypt_output.resize(out_len);
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(decrypt_output));
+
+  // Second call when encrypting using the same nonce for AES-GCM TLS specific
+  // functions should fail and return |FIPSStatus::NOT_APPROVED|.
+  if (test.test_repeat_nonce) {
+    ASSERT_FALSE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved,
+        EVP_AEAD_CTX_seal(aead_ctx.get(), encrypt_output.data(), &out_len,
+                          encrypt_output.size(), nonce.data(), nonce.size(),
+                          kPlaintext, sizeof(kPlaintext), nullptr, 0)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+    EXPECT_EQ(ERR_GET_REASON(ERR_get_error()), CIPHER_R_INVALID_NONCE);
+  }
+}
+
+static const struct CipherTestVector {
+  const EVP_CIPHER *cipher;
+  const uint8_t *key;
+  const int key_length;
+  const uint8_t *expected_ciphertext;
+  const int cipher_text_length;
+  const bool has_iv;
+  const FIPSStatus expect_approved;
+} kTestVectors[] = {
+    {
+        EVP_aes_128_ecb(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESECBCiphertext,
+        sizeof(kAESECBCiphertext),
+        false,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_192_ecb(),
+        kAESKey_192,
+        sizeof(kAESKey_192),
+        kAESECBCiphertext_192,
+        sizeof(kAESECBCiphertext_192),
+        false,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_256_ecb(),
+        kAESKey_256,
+        sizeof(kAESKey_256),
+        kAESECBCiphertext_256,
+        sizeof(kAESECBCiphertext_256),
+        false,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_128_cbc(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESCBCCiphertext,
+        sizeof(kAESCBCCiphertext),
+        true,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_192_cbc(),
+        kAESKey_192,
+        sizeof(kAESKey_192),
+        kAESCBCCiphertext_192,
+        sizeof(kAESCBCCiphertext_192),
+        true,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_256_cbc(),
+        kAESKey_256,
+        sizeof(kAESKey_256),
+        kAESCBCCiphertext_256,
+        sizeof(kAESCBCCiphertext_256),
+        true,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_128_ctr(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESCTRCiphertext,
+        sizeof(kAESCTRCiphertext),
+        true,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_192_ctr(),
+        kAESKey_192,
+        sizeof(kAESKey_192),
+        kAESCTRCiphertext_192,
+        sizeof(kAESCTRCiphertext_192),
+        true,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_256_ctr(),
+        kAESKey_256,
+        sizeof(kAESKey_256),
+        kAESCTRCiphertext_256,
+        sizeof(kAESCTRCiphertext_256),
+        true,
+        FIPSStatus::APPROVED,
+    },
+    {
+        EVP_aes_128_ofb(),
+        kAESKey,
+        sizeof(kAESKey),
+        kAESOFBCiphertext,
+        sizeof(kAESOFBCiphertext),
+        true,
+        FIPSStatus::NOT_APPROVED,
+    },
+    {
+        EVP_des_ede3(),
+        kAESKey_192,
+        sizeof(kAESKey_192),
+        kTDES_EDE3_CipherText,
+        sizeof(kTDES_EDE3_CipherText),
+        false,
+        FIPSStatus::NOT_APPROVED,
+    },
+    {
+        EVP_des_ede3_cbc(),
+        kAESKey_192,
+        sizeof(kAESKey_192),
+        kTDES_EDE3_CBCCipherText,
+        sizeof(kTDES_EDE3_CBCCipherText),
+        false,
+        FIPSStatus::NOT_APPROVED,
+    },
+};
+
+class EVPServiceIndicatorTest : public TestWithNoErrors<CipherTestVector> {};
+
+static void TestOperation(const EVP_CIPHER *cipher, bool encrypt,
+                          const bssl::Span<const uint8_t> key,
+                          const bssl::Span<const uint8_t> plaintext,
+                          const bssl::Span<const uint8_t> ciphertext,
+                          FIPSStatus expect_approved) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  bssl::Span<const uint8_t> in, out;
+  if (encrypt) {
+    in = plaintext;
+    out = ciphertext;
+  } else {
+    in = ciphertext;
+    out = plaintext;
+  }
+
+  bssl::ScopedEVP_CIPHER_CTX ctx;
+  // Test running the EVP_Cipher interfaces one by one directly, and check
+  // |EVP_EncryptFinal_ex| and |EVP_DecryptFinal_ex| for approval at the end.
+  ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), cipher, nullptr, nullptr, nullptr,
+                                encrypt ? 1 : 0));
+  ASSERT_LE(EVP_CIPHER_CTX_iv_length(ctx.get()), sizeof(kAESIV));
+
+  ASSERT_TRUE(EVP_CIPHER_CTX_set_key_length(ctx.get(), key.size()));
+  ASSERT_TRUE(EVP_CipherInit_ex(ctx.get(), cipher, nullptr, key.data(), kAESIV,
+                                encrypt ? 1 : 0));
+  ASSERT_TRUE(EVP_CIPHER_CTX_set_padding(ctx.get(), 0));
+  std::vector<uint8_t> encrypt_result;
+  DoCipherFinal(ctx.get(), &encrypt_result, in, expect_approved);
+  EXPECT_EQ(Bytes(out), Bytes(encrypt_result));
+
+  // Test using the one-shot |EVP_Cipher| function for approval.
+  bssl::ScopedEVP_CIPHER_CTX ctx2;
+  uint8_t output[256];
+  ASSERT_TRUE(EVP_CipherInit_ex(ctx2.get(), cipher, nullptr, key.data(), kAESIV,
+                                encrypt ? 1 : 0));
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_Cipher(ctx2.get(), output, in.data(), in.size()));
+  EXPECT_EQ(approved, expect_approved);
+  EXPECT_EQ(Bytes(out), Bytes(output, in.size()));
+}
+
+INSTANTIATE_TEST_SUITE_P(All, EVPServiceIndicatorTest,
+                         testing::ValuesIn(kTestVectors));
+
+TEST_P(EVPServiceIndicatorTest, EVP_Ciphers) {
+  const CipherTestVector &test = GetParam();
+
+  const EVP_CIPHER *cipher = test.cipher;
+  std::vector<uint8_t> key(test.key, test.key + test.key_length);
+  std::vector<uint8_t> plaintext(kPlaintext, kPlaintext + sizeof(kPlaintext));
+  std::vector<uint8_t> ciphertext(
+      test.expected_ciphertext,
+      test.expected_ciphertext + test.cipher_text_length);
+
+  TestOperation(cipher, true /* encrypt */, key, plaintext, ciphertext,
+                test.expect_approved);
+  TestOperation(cipher, false /* decrypt */, key, plaintext, ciphertext,
+                test.expect_approved);
+}
+
+static const struct DigestTestVector {
+  // name is the name of the digest test.
+  const char *name;
+  // length of digest.
+  const int length;
+  // func is the digest to test.
+  const EVP_MD *(*func)();
+  // one_shot_func is the convenience one-shot version of the digest.
+  uint8_t *(*one_shot_func)(const uint8_t *, size_t, uint8_t *);
+  // expected_digest is the expected digest.
+  const uint8_t *expected_digest;
+  // expected to be approved or not.
+  const FIPSStatus expect_approved;
+} kDigestTestVectors[] = {
+    {
+        "MD4",
+        MD4_DIGEST_LENGTH,
+        &EVP_md4,
+        &MD4,
+        kOutput_md4,
+        FIPSStatus::NOT_APPROVED,
+    },
+    {
+        "MD5",
+        MD5_DIGEST_LENGTH,
+        &EVP_md5,
+        &MD5,
+        kOutput_md5,
+        FIPSStatus::NOT_APPROVED,
+    },
+    {
+        "SHA-1",
+        SHA_DIGEST_LENGTH,
+        &EVP_sha1,
+        &SHA1,
+        kOutput_sha1,
+        FIPSStatus::APPROVED,
+    },
+    {
+        "SHA-224",
+        SHA224_DIGEST_LENGTH,
+        &EVP_sha224,
+        &SHA224,
+        kOutput_sha224,
+        FIPSStatus::APPROVED,
+    },
+    {
+        "SHA-256",
+        SHA256_DIGEST_LENGTH,
+        &EVP_sha256,
+        &SHA256,
+        kOutput_sha256,
+        FIPSStatus::APPROVED,
+    },
+    {
+        "SHA-384",
+        SHA384_DIGEST_LENGTH,
+        &EVP_sha384,
+        &SHA384,
+        kOutput_sha384,
+        FIPSStatus::APPROVED,
+    },
+    {
+        "SHA-512",
+        SHA512_DIGEST_LENGTH,
+        &EVP_sha512,
+        &SHA512,
+        kOutput_sha512,
+        FIPSStatus::APPROVED,
+    },
+    {
+        "SHA-512/256",
+        SHA512_256_DIGEST_LENGTH,
+        &EVP_sha512_256,
+        &SHA512_256,
+        kOutput_sha512_256,
+        FIPSStatus::APPROVED,
+    },
+};
+
+class EVPMDServiceIndicatorTest : public TestWithNoErrors<DigestTestVector> {};
+
+INSTANTIATE_TEST_SUITE_P(All, EVPMDServiceIndicatorTest,
+                         testing::ValuesIn(kDigestTestVectors));
+
+TEST_P(EVPMDServiceIndicatorTest, EVP_Digests) {
+  const DigestTestVector &test = GetParam();
+  SCOPED_TRACE(test.name);
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  bssl::ScopedEVP_MD_CTX ctx;
+  std::vector<uint8_t> digest(test.length);
+  unsigned digest_len;
+
+  // Test running the EVP_Digest interfaces one by one directly, and check
+  // |EVP_DigestFinal_ex| for approval at the end. |EVP_DigestInit_ex| and
+  // |EVP_DigestUpdate| should not be approved, because the functions do not
+  // indicate that a service has been fully completed yet.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestInit_ex(ctx.get(), test.func(), nullptr)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestUpdate(ctx.get(), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestFinal_ex(ctx.get(), digest.data(), &digest_len)));
+  EXPECT_EQ(approved, test.expect_approved);
+  EXPECT_EQ(Bytes(test.expected_digest, digest_len), Bytes(digest));
+
+  // Test using the one-shot |EVP_Digest| function for approval.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_Digest(kPlaintext, sizeof(kPlaintext), digest.data(),
+                           &digest_len, test.func(), nullptr)));
+  EXPECT_EQ(approved, test.expect_approved);
+  EXPECT_EQ(Bytes(test.expected_digest, test.length), Bytes(digest));
+
+  // Test using the one-shot API for approval.
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      test.one_shot_func(kPlaintext, sizeof(kPlaintext), digest.data()));
+  EXPECT_EQ(approved, test.expect_approved);
+  EXPECT_EQ(Bytes(test.expected_digest, test.length), Bytes(digest));
+}
+
+static const struct HMACTestVector {
+  // func is the hash function for HMAC to test.
+  const EVP_MD *(*func)(void);
+  // expected_digest is the expected digest.
+  const uint8_t *expected_digest;
+  // expected to be approved or not.
+  const FIPSStatus expect_approved;
+} kHMACTestVectors[] = {
+    {EVP_sha1, kHMACOutput_sha1, FIPSStatus::APPROVED},
+    {EVP_sha224, kHMACOutput_sha224, FIPSStatus::APPROVED},
+    {EVP_sha256, kHMACOutput_sha256, FIPSStatus::APPROVED},
+    {EVP_sha384, kHMACOutput_sha384, FIPSStatus::APPROVED},
+    {EVP_sha512, kHMACOutput_sha512, FIPSStatus::APPROVED},
+    {EVP_sha512_256, kHMACOutput_sha512_256, FIPSStatus::APPROVED},
+};
+
+class HMACServiceIndicatorTest : public TestWithNoErrors<HMACTestVector> {};
+
+INSTANTIATE_TEST_SUITE_P(All, HMACServiceIndicatorTest,
+                         testing::ValuesIn(kHMACTestVectors));
+
+TEST_P(HMACServiceIndicatorTest, HMACTest) {
+  const HMACTestVector &test = GetParam();
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  // The key is deliberately long in order to trigger digesting it down to a
+  // block size. This tests that doing so does not cause the indicator to be
+  // mistakenly set in |HMAC_Init_ex|.
+  const uint8_t kHMACKey[512] = {0};
+  const EVP_MD *const digest = test.func();
+  const unsigned expected_mac_len = EVP_MD_size(digest);
+  std::vector<uint8_t> mac(expected_mac_len);
+
+  // Test running the HMAC interfaces one by one directly, and check
+  // |HMAC_Final| for approval at the end. |HMAC_Init_ex| and |HMAC_Update|
+  // should not be approved, because the functions do not indicate that a
+  // service has been fully completed yet.
+  unsigned mac_len;
+  bssl::ScopedHMAC_CTX ctx;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      HMAC_Init_ex(ctx.get(), kHMACKey, sizeof(kHMACKey), digest, nullptr)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, HMAC_Update(ctx.get(), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, HMAC_Final(ctx.get(), mac.data(), &mac_len)));
+  EXPECT_EQ(approved, test.expect_approved);
+  EXPECT_EQ(Bytes(test.expected_digest, expected_mac_len),
+            Bytes(mac.data(), mac_len));
+
+  // Test using the one-shot API for approval.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, HMAC(digest, kHMACKey, sizeof(kHMACKey), kPlaintext,
+                     sizeof(kPlaintext), mac.data(), &mac_len)));
+  EXPECT_EQ(approved, test.expect_approved);
+  EXPECT_EQ(Bytes(test.expected_digest, expected_mac_len),
+            Bytes(mac.data(), mac_len));
+}
+
+// RSA tests are not parameterized with the |kRSATestVectors| as key
+// generation for RSA is time consuming.
+TEST(ServiceIndicatorTest, RSAKeyGen) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  bssl::UniquePtr<RSA> rsa(RSA_new());
+  ASSERT_TRUE(rsa);
+
+  // |RSA_generate_key_fips| may only be used for 2048-, 3072-, and 4096-bit
+  // keys.
+  for (const size_t bits : {512, 1024, 3071, 4095}) {
+    SCOPED_TRACE(bits);
+
+    rsa.reset(RSA_new());
+    EXPECT_FALSE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, RSA_generate_key_fips(rsa.get(), bits, nullptr)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  }
+
+  // Test that we can generate keys of the supported lengths:
+  for (const size_t bits : {2048, 3072, 4096}) {
+    SCOPED_TRACE(bits);
+
+    rsa.reset(RSA_new());
+    EXPECT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, RSA_generate_key_fips(rsa.get(), bits, nullptr)));
+    EXPECT_EQ(approved, FIPSStatus::APPROVED);
+    EXPECT_EQ(bits, BN_num_bits(rsa->n));
+  }
+
+  // Test running the EVP_PKEY_keygen interfaces one by one directly, and check
+  // |EVP_PKEY_keygen| for approval at the end. |EVP_PKEY_keygen_init| should
+  // not be approved because it does not indicate an entire service has been
+  // completed.
+  bssl::UniquePtr<EVP_PKEY_CTX> ctx(EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, nullptr));
+  EVP_PKEY *raw = nullptr;
+  bssl::UniquePtr<EVP_PKEY> pkey(raw);
+  ASSERT_TRUE(ctx);
+
+  if (kEVPKeyGenShouldCallFIPSFunctions) {
+    // Test unapproved key sizes of RSA.
+    for (const size_t bits : {512, 1024, 3071, 4095}) {
+      SCOPED_TRACE(bits);
+      ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+          approved, EVP_PKEY_keygen_init(ctx.get())));
+      EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+      ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx.get(), bits));
+      ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+          approved, EVP_PKEY_keygen(ctx.get(), &raw)));
+      EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+      pkey.reset(raw);
+      raw = nullptr;
+    }
+
+    // Test approved key sizes of RSA.
+    for (const size_t bits : {2048, 3072, 4096}) {
+      SCOPED_TRACE(bits);
+      ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+          approved, EVP_PKEY_keygen_init(ctx.get())));
+      EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+      ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_keygen_bits(ctx.get(), bits));
+      ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+          approved, EVP_PKEY_keygen(ctx.get(), &raw)));
+      EXPECT_EQ(approved, FIPSStatus::APPROVED);
+      pkey.reset(raw);
+      raw = nullptr;
+    }
+  }
+}
+
+struct RSATestVector {
+  // key_size is the input rsa key size.
+  int key_size;
+  // md_func is the digest to test.
+  const EVP_MD *(*func)();
+  // whether to use pss testing or not.
+  bool use_pss;
+  // expected to be approved or not for signature generation.
+  FIPSStatus sig_gen_expect_approved;
+  // expected to be approved or not for signature verification.
+  FIPSStatus sig_ver_expect_approved;
+};
+
+static const struct RSATestVector kRSATestVectors[] = {
+    // RSA test cases that are not approved in any case.
+    {512, &EVP_sha1, false, FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    // PSS with hashLen == saltLen is not possible for 512-bit modulus.
+    {1024, &EVP_md5, false, FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    {1536, &EVP_sha256, false, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED},
+    {1536, &EVP_sha512, true, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED},
+    {2048, &EVP_md5, false, FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    {3071, &EVP_md5, true, FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    {3071, &EVP_sha256, false, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED},
+    {3071, &EVP_sha512, true, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED},
+    {4096, &EVP_md5, false, FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+
+    // RSA test cases that are approved.
+    {1024, &EVP_sha1, false, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {1024, &EVP_sha256, false, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {1024, &EVP_sha512, false, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {1024, &EVP_sha1, true, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {1024, &EVP_sha256, true, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    // PSS with hashLen == saltLen is not possible for 1024-bit modulus and
+    // SHA-512.
+
+    {2048, &EVP_sha1, false, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha224, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha256, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha384, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha512, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha1, true, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha224, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha256, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha384, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {2048, &EVP_sha512, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+
+    {3072, &EVP_sha1, false, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha224, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha256, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha384, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha512, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha1, true, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha224, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha256, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha384, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {3072, &EVP_sha512, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+
+    {4096, &EVP_sha1, false, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha224, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha256, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha384, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha512, false, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha1, true, FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha224, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha256, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha384, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {4096, &EVP_sha512, true, FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+};
+
+class RSAServiceIndicatorTest : public TestWithNoErrors<RSATestVector> {};
+
+INSTANTIATE_TEST_SUITE_P(All, RSAServiceIndicatorTest,
+                         testing::ValuesIn(kRSATestVectors));
+
+static std::map<unsigned, bssl::UniquePtr<RSA>> &CachedRSAKeys() {
+  static std::map<unsigned, bssl::UniquePtr<RSA>> keys;
+  return keys;
+}
+
+static RSA *GetRSAKey(unsigned bits) {
+  auto it = CachedRSAKeys().find(bits);
+  if (it != CachedRSAKeys().end()) {
+    return it->second.get();
+  }
+
+  bssl::UniquePtr<BIGNUM> e(BN_new());
+  if (!e || !BN_set_word(e.get(), RSA_F4)) {
+    abort();
+  }
+
+  bssl::UniquePtr<RSA> key(RSA_new());
+  if (!key || !RSA_generate_key_ex(key.get(), bits, e.get(), nullptr)) {
+    abort();
+  }
+
+  RSA *const ret = key.get();
+  CachedRSAKeys().emplace(static_cast<unsigned>(bits), std::move(key));
+
+  return ret;
+}
+
+TEST_P(RSAServiceIndicatorTest, RSASigGen) {
+  const RSATestVector &test = GetParam();
+  SCOPED_TRACE(test.key_size);
+
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  ASSERT_TRUE(pkey);
+
+  RSA *const rsa = GetRSAKey(test.key_size);
+  ASSERT_TRUE(EVP_PKEY_set1_RSA(pkey.get(), rsa));
+
+  // Test running the EVP_DigestSign interfaces one by one directly, and check
+  // |EVP_DigestSignFinal| for approval at the end. |EVP_DigestSignInit|, and
+  // |EVP_DigestSignUpdate| should not be approved because they do not indicate
+  // an entire service has been completed.
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  bssl::ScopedEVP_MD_CTX md_ctx;
+  EVP_PKEY_CTX *pctx = nullptr;
+  size_t sig_len;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignInit(md_ctx.get(), &pctx, test.func(), nullptr,
+                                   pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  if (test.use_pss) {
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  }
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestSignUpdate(md_ctx.get(), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  // Determine the size of the signature. The first call of
+  // |EVP_DigestSignFinal| should not return an approval check because no crypto
+  // is being done when |nullptr| is inputted in the |*out_sig| field.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignFinal(md_ctx.get(), nullptr, &sig_len)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  std::vector<uint8_t> signature(sig_len);
+  // The second call performs the actual operation.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignFinal(md_ctx.get(), signature.data(), &sig_len)));
+  EXPECT_EQ(approved, test.sig_gen_expect_approved);
+
+  // Test using the one-shot |EVP_DigestSign| function for approval.
+  md_ctx.Reset();
+  std::vector<uint8_t> oneshot_output(sig_len);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignInit(md_ctx.get(), &pctx, test.func(), nullptr,
+                                   pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  if (test.use_pss) {
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  }
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSign(md_ctx.get(), oneshot_output.data(), &sig_len,
+                               kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, test.sig_gen_expect_approved);
+
+  if (test.use_pss) {
+    // Odd configurations of PSS, for example where the salt length is not equal
+    // to the hash length, are not approved.
+    md_ctx.Reset();
+    ASSERT_TRUE(EVP_DigestSignInit(md_ctx.get(), &pctx, test.func(), nullptr,
+                                   pkey.get()));
+    ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING));
+    ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, 10));
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_DigestSign(md_ctx.get(), oneshot_output.data(), &sig_len,
+                                 kPlaintext, sizeof(kPlaintext))));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  }
+}
+
+TEST_P(RSAServiceIndicatorTest, RSASigVer) {
+  const RSATestVector &test = GetParam();
+
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  RSA *const rsa = GetRSAKey(test.key_size);
+
+  ASSERT_TRUE(pkey);
+  ASSERT_TRUE(EVP_PKEY_set1_RSA(pkey.get(), rsa));
+
+  std::vector<uint8_t> signature;
+  size_t sig_len;
+  bssl::ScopedEVP_MD_CTX md_ctx;
+  EVP_PKEY_CTX *pctx = nullptr;
+  ASSERT_TRUE(EVP_DigestSignInit(md_ctx.get(), &pctx, test.func(), nullptr,
+                                 pkey.get()));
+  if (test.use_pss) {
+    ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING));
+    ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1));
+  }
+  ASSERT_TRUE(EVP_DigestSign(md_ctx.get(), nullptr, &sig_len, nullptr, 0));
+  signature.resize(sig_len);
+  ASSERT_TRUE(EVP_DigestSign(md_ctx.get(), signature.data(), &sig_len,
+                             kPlaintext, sizeof(kPlaintext)));
+  signature.resize(sig_len);
+
+  // Service Indicator approval checks for RSA signature verification.
+
+  // Test running the EVP_DigestVerify interfaces one by one directly, and check
+  // |EVP_DigestVerifyFinal| for approval at the end. |EVP_DigestVerifyInit|,
+  // |EVP_DigestVerifyUpdate| should not be approved because they do not
+  // indicate an entire service has been done.
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  md_ctx.Reset();
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestVerifyInit(md_ctx.get(), &pctx, test.func(), nullptr,
+                                     pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  if (test.use_pss) {
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+    ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1));
+  }
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestVerifyUpdate(md_ctx.get(), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestVerifyFinal(md_ctx.get(), signature.data(), signature.size())));
+  EXPECT_EQ(approved, test.sig_ver_expect_approved);
+
+  // Test using the one-shot |EVP_DigestVerify| function for approval.
+  md_ctx.Reset();
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestVerifyInit(md_ctx.get(), &pctx, test.func(), nullptr,
+                                     pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  if (test.use_pss) {
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING)));
+    EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+    ASSERT_TRUE(EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1));
+  }
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestVerify(md_ctx.get(), signature.data(), signature.size(),
+                       kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, test.sig_ver_expect_approved);
+}
+
+struct ECDSATestVector {
+  // nid is the input curve nid.
+  int nid;
+  // md_func is the digest to test.
+  const EVP_MD *(*func)();
+  // expected to be approved or not for signature generation.
+  FIPSStatus key_check_expect_approved;
+  // expected to be approved or not for signature generation.
+  FIPSStatus sig_gen_expect_approved;
+  // expected to be approved or not for signature verification.
+  FIPSStatus sig_ver_expect_approved;
+};
+
+static const struct ECDSATestVector kECDSATestVectors[] = {
+    // Only the following NIDs for |EC_GROUP| are creatable with
+    // |EC_GROUP_new_by_curve_name|, and |NID_secp256k1| will only work if
+    // |kCurveSecp256k1Supported| is true.
+    {NID_secp224r1, &EVP_sha1, FIPSStatus::APPROVED, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp224r1, &EVP_sha224, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp224r1, &EVP_sha256, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp224r1, &EVP_sha384, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp224r1, &EVP_sha512, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+
+    {NID_X9_62_prime256v1, &EVP_sha1, FIPSStatus::APPROVED,
+     FIPSStatus::NOT_APPROVED, FIPSStatus::APPROVED},
+    {NID_X9_62_prime256v1, &EVP_sha224, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {NID_X9_62_prime256v1, &EVP_sha256, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {NID_X9_62_prime256v1, &EVP_sha384, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+    {NID_X9_62_prime256v1, &EVP_sha512, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED, FIPSStatus::APPROVED},
+
+    {NID_secp384r1, &EVP_sha1, FIPSStatus::APPROVED, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp384r1, &EVP_sha224, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp384r1, &EVP_sha256, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp384r1, &EVP_sha384, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp384r1, &EVP_sha512, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+
+    {NID_secp521r1, &EVP_sha1, FIPSStatus::APPROVED, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp521r1, &EVP_sha224, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp521r1, &EVP_sha256, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp521r1, &EVP_sha384, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+    {NID_secp521r1, &EVP_sha512, FIPSStatus::APPROVED, FIPSStatus::APPROVED,
+     FIPSStatus::APPROVED},
+
+    {NID_secp256k1, &EVP_sha1, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    {NID_secp256k1, &EVP_sha224, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    {NID_secp256k1, &EVP_sha256, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    {NID_secp256k1, &EVP_sha384, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+    {NID_secp256k1, &EVP_sha512, FIPSStatus::NOT_APPROVED,
+     FIPSStatus::NOT_APPROVED, FIPSStatus::NOT_APPROVED},
+};
+
+class ECDSAServiceIndicatorTest : public TestWithNoErrors<ECDSATestVector> {};
+
+INSTANTIATE_TEST_SUITE_P(All, ECDSAServiceIndicatorTest,
+                         testing::ValuesIn(kECDSATestVectors));
+
+TEST_P(ECDSAServiceIndicatorTest, ECDSAKeyCheck) {
+  const ECDSATestVector &test = GetParam();
+  if (test.nid == NID_secp256k1 && !kCurveSecp256k1Supported) {
+    GTEST_SKIP();
+  }
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  // Test service indicator approval for |EC_KEY_generate_key_fips| and
+  // |EC_KEY_check_fips|.
+  bssl::UniquePtr<EC_KEY> key(EC_KEY_new_by_curve_name(test.nid));
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EC_KEY_generate_key_fips(key.get())));
+  EXPECT_EQ(approved, test.key_check_expect_approved);
+  ASSERT_TRUE(
+      CALL_SERVICE_AND_CHECK_APPROVED(approved, EC_KEY_check_fips(key.get())));
+  EXPECT_EQ(approved, test.key_check_expect_approved);
+
+  // See if |EC_KEY_check_fips| still returns approval with only the public
+  // component.
+  bssl::UniquePtr<EC_KEY> key_only_public(EC_KEY_new_by_curve_name(test.nid));
+  ASSERT_TRUE(EC_KEY_set_public_key(key_only_public.get(),
+                                    EC_KEY_get0_public_key(key.get())));
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EC_KEY_check_fips(key_only_public.get())));
+  EXPECT_EQ(approved, test.key_check_expect_approved);
+
+  if (kEVPKeyGenShouldCallFIPSFunctions) {
+    // Test running the EVP_PKEY_keygen interfaces one by one directly, and
+    // check |EVP_PKEY_keygen| for approval at the end. |EVP_PKEY_keygen_init|
+    // should not be approved because it does not indicate that an entire
+    // service has been completed.
+    bssl::UniquePtr<EVP_PKEY_CTX> ctx(
+        EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr));
+    EVP_PKEY *raw = nullptr;
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(EVP_PKEY_keygen_init(ctx.get()));
+    ASSERT_TRUE(EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), test.nid));
+    ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+        approved, EVP_PKEY_keygen(ctx.get(), &raw)));
+    EXPECT_EQ(approved, test.key_check_expect_approved);
+
+    EVP_PKEY_free(raw);
+  }
+}
+
+TEST_P(ECDSAServiceIndicatorTest, ECDSASigGen) {
+  const ECDSATestVector &test = GetParam();
+  if (test.nid == NID_secp256k1 && !kCurveSecp256k1Supported) {
+    GTEST_SKIP();
+  }
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  bssl::UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(test.nid));
+  bssl::UniquePtr<EC_KEY> eckey(EC_KEY_new());
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  bssl::ScopedEVP_MD_CTX md_ctx;
+  ASSERT_TRUE(eckey);
+  ASSERT_TRUE(EC_KEY_set_group(eckey.get(), group.get()));
+
+  // Generate a generic EC key.
+  ASSERT_TRUE(EC_KEY_generate_key(eckey.get()));
+  ASSERT_TRUE(EVP_PKEY_set1_EC_KEY(pkey.get(), eckey.get()));
+
+  // Test running the EVP_DigestSign interfaces one by one directly, and check
+  // |EVP_DigestSignFinal| for approval at the end. |EVP_DigestSignInit|,
+  // |EVP_DigestSignUpdate| should not be approved because they do not indicate
+  // an entire service has been done.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignInit(md_ctx.get(), nullptr, test.func(), nullptr,
+                                   pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestSignUpdate(md_ctx.get(), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  // Determine the size of the signature. The first call of
+  // |EVP_DigestSignFinal| should not return an approval check because no crypto
+  // is being done when |nullptr| is given as the |out_sig| field.
+  size_t max_sig_len;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignFinal(md_ctx.get(), nullptr, &max_sig_len)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  std::vector<uint8_t> signature(max_sig_len);
+  // The second call performs the actual operation.
+  size_t sig_len = max_sig_len;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignFinal(md_ctx.get(), signature.data(), &sig_len)));
+  ASSERT_LE(sig_len, signature.size());
+  EXPECT_EQ(approved, test.sig_gen_expect_approved);
+
+  // Test using the one-shot |EVP_DigestSign| function for approval.
+  md_ctx.Reset();
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSignInit(md_ctx.get(), nullptr, test.func(), nullptr,
+                                   pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  sig_len = max_sig_len;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestSign(md_ctx.get(), signature.data(), &sig_len,
+                               kPlaintext, sizeof(kPlaintext))));
+  ASSERT_LE(sig_len, signature.size());
+  EXPECT_EQ(approved, test.sig_gen_expect_approved);
+}
+
+TEST_P(ECDSAServiceIndicatorTest, ECDSASigVer) {
+  const ECDSATestVector &test = GetParam();
+  if (test.nid == NID_secp256k1 && !kCurveSecp256k1Supported) {
+    GTEST_SKIP();
+  }
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  bssl::UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(test.nid));
+  bssl::UniquePtr<EC_KEY> eckey(EC_KEY_new());
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  bssl::ScopedEVP_MD_CTX md_ctx;
+  ASSERT_TRUE(eckey);
+  ASSERT_TRUE(EC_KEY_set_group(eckey.get(), group.get()));
+
+  // Generate ECDSA signatures for ECDSA verification.
+  ASSERT_TRUE(EC_KEY_generate_key(eckey.get()));
+  ASSERT_TRUE(EVP_PKEY_set1_EC_KEY(pkey.get(), eckey.get()));
+  std::vector<uint8_t> signature;
+  size_t sig_len = 0;
+  ASSERT_TRUE(EVP_DigestSignInit(md_ctx.get(), nullptr, test.func(), nullptr,
+                                 pkey.get()));
+  ASSERT_TRUE(EVP_DigestSignFinal(md_ctx.get(), nullptr, &sig_len));
+  signature.resize(sig_len);
+  ASSERT_TRUE(EVP_DigestSign(md_ctx.get(), signature.data(), &sig_len,
+                             kPlaintext, sizeof(kPlaintext)));
+  signature.resize(sig_len);
+
+  // Service Indicator approval checks for ECDSA signature verification.
+
+  // Test running the EVP_DigestVerify interfaces one by one directly, and check
+  // |EVP_DigestVerifyFinal| for approval at the end. |EVP_DigestVerifyInit|,
+  // |EVP_DigestVerifyUpdate| should not be approved because they do not
+  // indicate an entire service has been done.
+  md_ctx.Reset();
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestVerifyInit(md_ctx.get(), nullptr, test.func(),
+                                     nullptr, pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestVerifyUpdate(md_ctx.get(), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestVerifyFinal(md_ctx.get(), signature.data(), signature.size())));
+  EXPECT_EQ(approved, test.sig_ver_expect_approved);
+
+  // Test using the one-shot |EVP_DigestVerify| function for approval.
+  md_ctx.Reset();
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_DigestVerifyInit(md_ctx.get(), nullptr, test.func(),
+                                     nullptr, pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_DigestVerify(md_ctx.get(), signature.data(), signature.size(),
+                       kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, test.sig_ver_expect_approved);
+}
+
+#if defined(AWSLC_FIPS)
+
+// Test that |EVP_DigestSignFinal| and |EVP_DigestSignVerify| are approved with
+// manually constructing using the context setting functions.
+TEST_P(ECDSAServiceIndicatorTest, ManualECDSASignVerify) {
+  const ECDSATestVector &test = GetParam();
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  bssl::ScopedEVP_MD_CTX ctx;
+  ASSERT_TRUE(EVP_DigestInit(ctx.get(), test.func()));
+  ASSERT_TRUE(EVP_DigestUpdate(ctx.get(), kPlaintext, sizeof(kPlaintext)));
+
+  bssl::UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(test.nid));
+  bssl::UniquePtr<EC_KEY> eckey(EC_KEY_new());
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  bssl::ScopedEVP_MD_CTX md_ctx;
+  ASSERT_TRUE(eckey);
+  ASSERT_TRUE(EC_KEY_set_group(eckey.get(), group.get()));
+
+  // Generate a generic ec key.
+  EC_KEY_generate_key(eckey.get());
+  ASSERT_TRUE(EVP_PKEY_set1_EC_KEY(pkey.get(), eckey.get()));
+
+  // Manual construction for signing.
+  bssl::UniquePtr<EVP_PKEY_CTX> pctx(EVP_PKEY_CTX_new(pkey.get(), nullptr));
+  ASSERT_TRUE(EVP_PKEY_sign_init(pctx.get()));
+  ASSERT_TRUE(EVP_PKEY_CTX_set_signature_md(pctx.get(), test.func()));
+  EVP_MD_CTX_set_pkey_ctx(ctx.get(), pctx.get());
+  // Determine the size of the signature.
+  size_t sig_len = 0;
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, ASSERT_TRUE(EVP_DigestSignFinal(ctx.get(), nullptr, &sig_len)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+
+  std::vector<uint8_t> sig;
+  sig.resize(sig_len);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      ASSERT_TRUE(EVP_DigestSignFinal(ctx.get(), sig.data(), &sig_len)));
+  EXPECT_EQ(approved, test.sig_gen_expect_approved);
+  sig.resize(sig_len);
+
+  // Manual construction for verification.
+  ASSERT_TRUE(EVP_PKEY_verify_init(pctx.get()));
+  ASSERT_TRUE(EVP_PKEY_CTX_set_signature_md(pctx.get(), test.func()));
+  EVP_MD_CTX_set_pkey_ctx(ctx.get(), pctx.get());
+
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      ASSERT_TRUE(EVP_DigestVerifyFinal(ctx.get(), sig.data(), sig_len)));
+  EXPECT_EQ(approved, test.sig_ver_expect_approved);
+}
+
+#endif  // AWSLC_FIPS
+
+struct ECDHTestVector {
+  // nid is the input curve nid.
+  const int nid;
+  // digest_length is the length of the hash output to test with.
+  const int digest_length;
+  // expect_approved to be approved or not.
+  const FIPSStatus expect_approved;
+};
+
+static const struct ECDHTestVector kECDHTestVectors[] = {
+    // Only the following NIDs for |EC_GROUP| are creatable with
+    // |EC_GROUP_new_by_curve_name|.
+    // |ECDH_compute_key_fips| fails directly when an invalid hash length is
+    // inputted.
+    {NID_secp224r1, SHA224_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp224r1, SHA256_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp224r1, SHA384_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp224r1, SHA512_DIGEST_LENGTH, FIPSStatus::APPROVED},
+
+    {NID_X9_62_prime256v1, SHA224_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_X9_62_prime256v1, SHA256_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_X9_62_prime256v1, SHA384_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_X9_62_prime256v1, SHA512_DIGEST_LENGTH, FIPSStatus::APPROVED},
+
+    {NID_secp384r1, SHA224_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp384r1, SHA256_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp384r1, SHA384_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp384r1, SHA512_DIGEST_LENGTH, FIPSStatus::APPROVED},
+
+    {NID_secp521r1, SHA224_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp521r1, SHA256_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp521r1, SHA384_DIGEST_LENGTH, FIPSStatus::APPROVED},
+    {NID_secp521r1, SHA512_DIGEST_LENGTH, FIPSStatus::APPROVED},
+
+    {NID_secp256k1, SHA224_DIGEST_LENGTH, FIPSStatus::NOT_APPROVED},
+    {NID_secp256k1, SHA256_DIGEST_LENGTH, FIPSStatus::NOT_APPROVED},
+    {NID_secp256k1, SHA384_DIGEST_LENGTH, FIPSStatus::NOT_APPROVED},
+    {NID_secp256k1, SHA512_DIGEST_LENGTH, FIPSStatus::NOT_APPROVED},
+};
+
+class ECDH_ServiceIndicatorTest : public TestWithNoErrors<ECDHTestVector> {};
+
+INSTANTIATE_TEST_SUITE_P(All, ECDH_ServiceIndicatorTest,
+                         testing::ValuesIn(kECDHTestVectors));
+
+TEST_P(ECDH_ServiceIndicatorTest, ECDH) {
+  const ECDHTestVector &test = GetParam();
+  if (test.nid == NID_secp256k1 && !kCurveSecp256k1Supported) {
+    GTEST_SKIP();
+  }
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  bssl::UniquePtr<EC_GROUP> group(EC_GROUP_new_by_curve_name(test.nid));
+  bssl::UniquePtr<EC_KEY> our_key(EC_KEY_new());
+  bssl::UniquePtr<EC_KEY> peer_key(EC_KEY_new());
+  bssl::ScopedEVP_MD_CTX md_ctx;
+  ASSERT_TRUE(our_key);
+  ASSERT_TRUE(peer_key);
+
+  // Generate two generic ec key pairs.
+  ASSERT_TRUE(EC_KEY_set_group(our_key.get(), group.get()));
+  ASSERT_TRUE(EC_KEY_generate_key(our_key.get()));
+  ASSERT_TRUE(EC_KEY_check_key(our_key.get()));
+
+  ASSERT_TRUE(EC_KEY_set_group(peer_key.get(), group.get()));
+  ASSERT_TRUE(EC_KEY_generate_key(peer_key.get()));
+  ASSERT_TRUE(EC_KEY_check_key(peer_key.get()));
+
+  // Test that |ECDH_compute_key_fips| has service indicator approval as
+  // expected.
+  std::vector<uint8_t> digest(test.digest_length);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, ECDH_compute_key_fips(digest.data(), digest.size(),
+                                      EC_KEY_get0_public_key(peer_key.get()),
+                                      our_key.get())));
+  EXPECT_EQ(approved, test.expect_approved);
+
+  // Test running the EVP_PKEY_derive interfaces one by one directly, and check
+  // |EVP_PKEY_derive| for approval at the end. |EVP_PKEY_derive_init| and
+  // |EVP_PKEY_derive_set_peer| should not be approved because they do not
+  // indicate an entire service has been done.
+  bssl::UniquePtr<EVP_PKEY> our_pkey(EVP_PKEY_new());
+  ASSERT_TRUE(EVP_PKEY_set1_EC_KEY(our_pkey.get(), our_key.get()));
+  bssl::UniquePtr<EVP_PKEY_CTX> our_ctx(
+      EVP_PKEY_CTX_new(our_pkey.get(), nullptr));
+  bssl::UniquePtr<EVP_PKEY> peer_pkey(EVP_PKEY_new());
+  ASSERT_TRUE(EVP_PKEY_set1_EC_KEY(peer_pkey.get(), peer_key.get()));
+
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_PKEY_derive_init(our_ctx.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_PKEY_derive_set_peer(our_ctx.get(), peer_pkey.get())));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  // Determine the size of the output key. The first call of |EVP_PKEY_derive|
+  // should not return an approval check because no crypto is being done when
+  // |nullptr| is inputted in the |*key| field
+  size_t out_len = 0;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_PKEY_derive(our_ctx.get(), nullptr, &out_len)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  std::vector<uint8_t> derive_output(out_len);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_PKEY_derive(our_ctx.get(), derive_output.data(), &out_len)));
+  EXPECT_EQ(approved, kEVPDeriveSetsServiceIndicator
+                          ? test.expect_approved
+                          : FIPSStatus::NOT_APPROVED);
+}
+
+static const struct KDFTestVector {
+  // func is the hash function for KDF to test.
+  const EVP_MD *(*func)();
+  const uint8_t *expected_output;
+  const FIPSStatus expect_approved;
+} kKDFTestVectors[] = {
+    {EVP_md5, kTLSOutput_md, FIPSStatus::APPROVED},
+    {EVP_sha1, kTLSOutput_sha1, FIPSStatus::APPROVED},
+    {EVP_md5_sha1, kTLSOutput_mdsha1, FIPSStatus::APPROVED},
+    {EVP_sha224, kTLSOutput_sha224, FIPSStatus::NOT_APPROVED},
+    {EVP_sha256, kTLSOutput_sha256, FIPSStatus::APPROVED},
+    {EVP_sha384, kTLSOutput_sha384, FIPSStatus::APPROVED},
+    {EVP_sha512, kTLSOutput_sha512, FIPSStatus::APPROVED},
+};
+
+class KDF_ServiceIndicatorTest : public TestWithNoErrors<KDFTestVector> {};
+
+INSTANTIATE_TEST_SUITE_P(All, KDF_ServiceIndicatorTest,
+                         testing::ValuesIn(kKDFTestVectors));
+
+TEST_P(KDF_ServiceIndicatorTest, TLSKDF) {
+  const KDFTestVector &test = GetParam();
+
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  uint8_t output[32];
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, CRYPTO_tls1_prf(test.func(), output, sizeof(output), kTLSSecret,
+                                sizeof(kTLSSecret), kTLSLabel,
+                                sizeof(kTLSLabel), kTLSSeed1, sizeof(kTLSSeed1),
+                                kTLSSeed2, sizeof(kTLSSeed2))));
+  EXPECT_EQ(Bytes(test.expected_output, sizeof(output)),
+            Bytes(output, sizeof(output)));
+  EXPECT_EQ(approved, test.expect_approved);
+}
+
+TEST(ServiceIndicatorTest, CMAC) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  bssl::UniquePtr<CMAC_CTX> ctx(CMAC_CTX_new());
+  ASSERT_TRUE(ctx);
+
+  // Test running the CMAC interfaces one by one directly, and check
+  // |CMAC_Final| for approval at the end. |CMAC_Init| and |CMAC_Update|
+  // should not be approved, because the functions do not indicate that a
+  // service has been fully completed yet.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, CMAC_Init(ctx.get(), kAESKey, sizeof(kAESKey),
+                          EVP_aes_128_cbc(), nullptr)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, CMAC_Update(ctx.get(), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+
+  uint8_t mac[16];
+  size_t out_len;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, CMAC_Final(ctx.get(), mac, &out_len)));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  EXPECT_EQ(Bytes(kAESCMACOutput), Bytes(mac));
+
+  // Test using the one-shot API for approval.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      AES_CMAC(mac, kAESKey, sizeof(kAESKey), kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(Bytes(kAESCMACOutput), Bytes(mac));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+TEST(ServiceIndicatorTest, BasicTest) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  bssl::ScopedEVP_AEAD_CTX aead_ctx;
+  ASSERT_TRUE(EVP_AEAD_CTX_init(aead_ctx.get(),
+                                EVP_aead_aes_128_gcm_randnonce(), kAESKey,
+                                sizeof(kAESKey), 0, nullptr));
+  // This test ensures that the counter gets incremented once, i.e. it was
+  // locked through the internal calls.
+  const int counter_before = FIPS_service_indicator_after_call();
+  size_t out_len;
+  uint8_t output[256];
+  EVP_AEAD_CTX_seal(aead_ctx.get(), output, &out_len, sizeof(output), nullptr,
+                    0, kPlaintext, sizeof(kPlaintext), nullptr, 0);
+  const int counter_after = FIPS_service_indicator_after_call();
+  EXPECT_EQ(counter_after, counter_before + 1);
+
+  // Call an approved service.
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_AEAD_CTX_seal(aead_ctx.get(), output, &out_len,
+                                  sizeof(output), nullptr, 0, kPlaintext,
+                                  sizeof(kPlaintext), nullptr, 0));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // Fail an approved service on purpose.
+  ASSERT_FALSE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_AEAD_CTX_seal(aead_ctx.get(), output, &out_len, 0, nullptr, 0,
+                        kPlaintext, sizeof(kPlaintext), nullptr, 0)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+
+  // Call a non-approved service.
+  uint8_t aes_iv[sizeof(kAESIV)];
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  AES_KEY aes_key;
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  int num = 0;
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_ofb128_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                   &aes_key, aes_iv, &num));
+  EXPECT_EQ(Bytes(kAESOFBCiphertext), Bytes(output, sizeof(kAESOFBCiphertext)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+}
+
+// Test the SHA interfaces one by one and check that only |*_Final| does the
+// approval at the end.
+TEST(ServiceIndicatorTest, SHA) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  std::vector<uint8_t> digest;
+
+  digest.resize(MD4_DIGEST_LENGTH);
+  MD4_CTX md4_ctx;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(approved, MD4_Init(&md4_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, MD4_Update(&md4_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, MD4_Final(digest.data(), &md4_ctx)));
+  EXPECT_EQ(Bytes(kOutput_md4), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+
+  digest.resize(MD5_DIGEST_LENGTH);
+  MD5_CTX md5_ctx;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(approved, MD5_Init(&md5_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, MD5_Update(&md5_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, MD5_Final(digest.data(), &md5_ctx)));
+  EXPECT_EQ(Bytes(kOutput_md5), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+
+  digest.resize(SHA_DIGEST_LENGTH);
+  SHA_CTX sha_ctx;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(approved, SHA1_Init(&sha_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA1_Update(&sha_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA1_Final(digest.data(), &sha_ctx)));
+  EXPECT_EQ(Bytes(kOutput_sha1), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  digest.resize(SHA224_DIGEST_LENGTH);
+  SHA256_CTX sha224_ctx;
+  ASSERT_TRUE(
+      CALL_SERVICE_AND_CHECK_APPROVED(approved, SHA224_Init(&sha224_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA224_Update(&sha224_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA224_Final(digest.data(), &sha224_ctx)));
+  EXPECT_EQ(Bytes(kOutput_sha224), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  digest.resize(SHA256_DIGEST_LENGTH);
+  SHA256_CTX sha256_ctx;
+  ASSERT_TRUE(
+      CALL_SERVICE_AND_CHECK_APPROVED(approved, SHA256_Init(&sha256_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA256_Update(&sha256_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA256_Final(digest.data(), &sha256_ctx)));
+  EXPECT_EQ(Bytes(kOutput_sha256), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  digest.resize(SHA384_DIGEST_LENGTH);
+  SHA512_CTX sha384_ctx;
+  ASSERT_TRUE(
+      CALL_SERVICE_AND_CHECK_APPROVED(approved, SHA384_Init(&sha384_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA384_Update(&sha384_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA384_Final(digest.data(), &sha384_ctx)));
+  EXPECT_EQ(Bytes(kOutput_sha384), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  digest.resize(SHA512_DIGEST_LENGTH);
+  SHA512_CTX sha512_ctx;
+  ASSERT_TRUE(
+      CALL_SERVICE_AND_CHECK_APPROVED(approved, SHA512_Init(&sha512_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA512_Update(&sha512_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA512_Final(digest.data(), &sha512_ctx)));
+  EXPECT_EQ(Bytes(kOutput_sha512), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  digest.resize(SHA512_256_DIGEST_LENGTH);
+  SHA512_CTX sha512_256_ctx;
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA512_256_Init(&sha512_256_ctx)));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      SHA512_256_Update(&sha512_256_ctx, kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, SHA512_256_Final(digest.data(), &sha512_256_ctx)));
+  EXPECT_EQ(Bytes(kOutput_sha512_256), Bytes(digest));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+TEST(ServiceIndicatorTest, AESECB) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  AES_KEY aes_key;
+  uint8_t output[256];
+
+  // AES-ECB Encryption KAT for 128 bit key.
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  // AES_ecb_encrypt encrypts (or decrypts) a single, 16 byte block from in to
+  // out.
+  for (size_t i = 0; i < sizeof(kPlaintext) / AES_BLOCK_SIZE; i++) {
+    CALL_SERVICE_AND_CHECK_APPROVED(
+        approved,
+        AES_ecb_encrypt(&kPlaintext[i * AES_BLOCK_SIZE],
+                        &output[i * AES_BLOCK_SIZE], &aes_key, AES_ENCRYPT));
+    EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  }
+  EXPECT_EQ(Bytes(kAESECBCiphertext), Bytes(output, sizeof(kAESECBCiphertext)));
+
+  // AES-ECB Decryption KAT for 128 bit key.
+  ASSERT_TRUE(AES_set_decrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  for (size_t i = 0; i < sizeof(kPlaintext) / AES_BLOCK_SIZE; i++) {
+    CALL_SERVICE_AND_CHECK_APPROVED(
+        approved,
+        AES_ecb_encrypt(&kAESECBCiphertext[i * AES_BLOCK_SIZE],
+                        &output[i * AES_BLOCK_SIZE], &aes_key, AES_DECRYPT));
+    EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  }
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output, sizeof(kPlaintext)));
+
+  // AES-ECB Encryption KAT for 192 bit key.
+  ASSERT_TRUE(
+      AES_set_encrypt_key(kAESKey_192, 8 * sizeof(kAESKey_192), &aes_key) == 0);
+  for (size_t i = 0; i < sizeof(kPlaintext) / AES_BLOCK_SIZE; i++) {
+    CALL_SERVICE_AND_CHECK_APPROVED(
+        approved,
+        AES_ecb_encrypt(&kPlaintext[i * AES_BLOCK_SIZE],
+                        &output[i * AES_BLOCK_SIZE], &aes_key, AES_ENCRYPT));
+    EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  }
+  EXPECT_EQ(Bytes(kAESECBCiphertext_192),
+            Bytes(output, sizeof(kAESECBCiphertext_192)));
+
+  // AES-ECB Decryption KAT for 192 bit key.
+  ASSERT_TRUE(
+      AES_set_decrypt_key(kAESKey_192, 8 * sizeof(kAESKey_192), &aes_key) == 0);
+  for (size_t i = 0; i < sizeof(kPlaintext) / AES_BLOCK_SIZE; i++) {
+    CALL_SERVICE_AND_CHECK_APPROVED(
+        approved,
+        AES_ecb_encrypt(&kAESECBCiphertext_192[i * AES_BLOCK_SIZE],
+                        &output[i * AES_BLOCK_SIZE], &aes_key, AES_DECRYPT));
+    EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  }
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output, sizeof(kPlaintext)));
+
+  // AES-ECB Encryption KAT for 256 bit key.
+  ASSERT_TRUE(
+      AES_set_encrypt_key(kAESKey_256, 8 * sizeof(kAESKey_256), &aes_key) == 0);
+  for (size_t i = 0; i < sizeof(kPlaintext) / AES_BLOCK_SIZE; i++) {
+    CALL_SERVICE_AND_CHECK_APPROVED(
+        approved,
+        AES_ecb_encrypt(&kPlaintext[i * AES_BLOCK_SIZE],
+                        &output[i * AES_BLOCK_SIZE], &aes_key, AES_ENCRYPT));
+    EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  }
+  EXPECT_EQ(Bytes(kAESECBCiphertext_256),
+            Bytes(output, sizeof(kAESECBCiphertext_256)));
+
+  // AES-ECB Decryption KAT for 256 bit key.
+  ASSERT_TRUE(
+      AES_set_decrypt_key(kAESKey_256, 8 * sizeof(kAESKey_256), &aes_key) == 0);
+  for (size_t i = 0; i < sizeof(kPlaintext) / AES_BLOCK_SIZE; i++) {
+    CALL_SERVICE_AND_CHECK_APPROVED(
+        approved,
+        AES_ecb_encrypt(&kAESECBCiphertext_256[i * AES_BLOCK_SIZE],
+                        &output[i * AES_BLOCK_SIZE], &aes_key, AES_DECRYPT));
+    EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  }
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output, sizeof(kPlaintext)));
+}
+
+TEST(ServiceIndicatorTest, AESCBC) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  AES_KEY aes_key;
+  uint8_t aes_iv[sizeof(kAESIV)];
+  uint8_t output[sizeof(kPlaintext)];
+
+  // AES-CBC Encryption KAT for 128 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_cbc_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                &aes_key, aes_iv, AES_ENCRYPT));
+  EXPECT_EQ(Bytes(kAESCBCCiphertext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CBC Decryption KAT for 128 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(AES_set_decrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      AES_cbc_encrypt(kAESCBCCiphertext, output, sizeof(kAESCBCCiphertext),
+                      &aes_key, aes_iv, AES_DECRYPT));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CBC Encryption KAT for 192 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(
+      AES_set_encrypt_key(kAESKey_192, 8 * sizeof(kAESKey_192), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_cbc_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                &aes_key, aes_iv, AES_ENCRYPT));
+  EXPECT_EQ(Bytes(kAESCBCCiphertext_192), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CBC Decryption KAT for 192 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(
+      AES_set_decrypt_key(kAESKey_192, 8 * sizeof(kAESKey_192), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_cbc_encrypt(kAESCBCCiphertext_192, output,
+                                sizeof(kAESCBCCiphertext_192), &aes_key, aes_iv,
+                                AES_DECRYPT));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CBC Encryption KAT for 256 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(
+      AES_set_encrypt_key(kAESKey_256, 8 * sizeof(kAESKey_256), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_cbc_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                &aes_key, aes_iv, AES_ENCRYPT));
+  EXPECT_EQ(Bytes(kAESCBCCiphertext_256), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CBC Decryption KAT for 256 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(
+      AES_set_decrypt_key(kAESKey_256, 8 * sizeof(kAESKey_256), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_cbc_encrypt(kAESCBCCiphertext_256, output,
+                                sizeof(kAESCBCCiphertext_256), &aes_key, aes_iv,
+                                AES_DECRYPT));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+TEST(ServiceIndicatorTest, AESCTR) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  AES_KEY aes_key;
+  uint8_t aes_iv[sizeof(kAESIV)];
+  uint8_t output[sizeof(kPlaintext)];
+  unsigned num = 0;
+  uint8_t ecount_buf[AES_BLOCK_SIZE];
+
+  // AES-CTR Encryption KAT
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_ctr128_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                   &aes_key, aes_iv, ecount_buf, &num));
+  EXPECT_EQ(Bytes(kAESCTRCiphertext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CTR Decryption KAT
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      AES_ctr128_encrypt(kAESCTRCiphertext, output, sizeof(kAESCTRCiphertext),
+                         &aes_key, aes_iv, ecount_buf, &num));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CTR Encryption KAT for 192 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(
+      AES_set_encrypt_key(kAESKey_192, 8 * sizeof(kAESKey_192), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_ctr128_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                   &aes_key, aes_iv, ecount_buf, &num));
+  EXPECT_EQ(Bytes(kAESCTRCiphertext_192), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CTR Decryption KAT for 192 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_ctr128_encrypt(kAESCTRCiphertext_192, output,
+                                   sizeof(kAESCTRCiphertext_192), &aes_key,
+                                   aes_iv, ecount_buf, &num));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CTR Encryption KAT for 256 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(
+      AES_set_encrypt_key(kAESKey_256, 8 * sizeof(kAESKey_256), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_ctr128_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                   &aes_key, aes_iv, ecount_buf, &num));
+  EXPECT_EQ(Bytes(kAESCTRCiphertext_256), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-CTR Decryption KAT for 256 bit key.
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_ctr128_encrypt(kAESCTRCiphertext_256, output,
+                                   sizeof(kAESCTRCiphertext_256), &aes_key,
+                                   aes_iv, ecount_buf, &num));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+TEST(ServiceIndicatorTest, AESOFB) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  AES_KEY aes_key;
+  uint8_t aes_iv[sizeof(kAESIV)];
+  uint8_t output[sizeof(kPlaintext)];
+  int num = 0;
+
+  // AES-OFB Encryption KAT
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_ofb128_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                   &aes_key, aes_iv, &num));
+  EXPECT_EQ(Bytes(kAESOFBCiphertext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+
+  // AES-OFB Decryption KAT
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      AES_ofb128_encrypt(kAESOFBCiphertext, output, sizeof(kAESOFBCiphertext),
+                         &aes_key, aes_iv, &num));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+}
+
+TEST(ServiceIndicatorTest, AESCFB) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  AES_KEY aes_key;
+  uint8_t aes_iv[sizeof(kAESIV)];
+  uint8_t output[sizeof(kPlaintext)];
+  int num = 0;
+
+  // AES-CFB Encryption KAT
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_cfb128_encrypt(kPlaintext, output, sizeof(kPlaintext),
+                                   &aes_key, aes_iv, &num, AES_ENCRYPT));
+  EXPECT_EQ(Bytes(kAESCFBCiphertext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+
+  // AES-CFB Decryption KAT
+  memcpy(aes_iv, kAESIV, sizeof(aes_iv));
+  CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      AES_cfb128_encrypt(kAESCFBCiphertext, output, sizeof(kAESCFBCiphertext),
+                         &aes_key, aes_iv, &num, AES_DECRYPT));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+}
+
+TEST(ServiceIndicatorTest, AESKW) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  AES_KEY aes_key;
+  uint8_t output[sizeof(kPlaintext) + 8];
+  size_t outlen;
+
+  // AES-KW Encryption KAT
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  outlen = CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      AES_wrap_key(&aes_key, nullptr, output, kPlaintext, sizeof(kPlaintext)));
+  ASSERT_EQ(outlen, sizeof(kAESKWCiphertext));
+  EXPECT_EQ(Bytes(kAESKWCiphertext), Bytes(output));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-KW Decryption KAT
+  ASSERT_TRUE(AES_set_decrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  outlen = CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_unwrap_key(&aes_key, nullptr, output, kAESKWCiphertext,
+                               sizeof(kAESKWCiphertext)));
+  ASSERT_EQ(outlen, sizeof(kPlaintext));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output, sizeof(kPlaintext)));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+TEST(ServiceIndicatorTest, AESKWP) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  AES_KEY aes_key;
+  uint8_t output[sizeof(kPlaintext) + 15];
+  size_t outlen;
+
+  // AES-KWP Encryption KAT
+  ASSERT_TRUE(AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, AES_wrap_key_padded(&aes_key, output, &outlen, sizeof(output),
+                                    kPlaintext, sizeof(kPlaintext))));
+  EXPECT_EQ(Bytes(kAESKWPCiphertext), Bytes(output, outlen));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // AES-KWP Decryption KAT
+  ASSERT_TRUE(AES_set_decrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) == 0);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      AES_unwrap_key_padded(&aes_key, output, &outlen, sizeof(output),
+                            kAESKWPCiphertext, sizeof(kAESKWPCiphertext))));
+  EXPECT_EQ(Bytes(kPlaintext), Bytes(output, outlen));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+TEST(ServiceIndicatorTest, FFDH) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+
+  // |DH_compute_key_padded| should be a non-approved service.
+  bssl::UniquePtr<DH> dh(GetDH());
+  uint8_t dh_out[sizeof(kDHOutput)];
+  ASSERT_EQ(DH_size(dh.get()), static_cast<int>(sizeof(dh_out)));
+  ASSERT_EQ(CALL_SERVICE_AND_CHECK_APPROVED(
+                approved, DH_compute_key_padded(
+                              dh_out, DH_get0_priv_key(dh.get()), dh.get())),
+            static_cast<int>(sizeof(dh_out)));
+  EXPECT_EQ(Bytes(kDHOutput), Bytes(dh_out));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+}
+
+TEST(ServiceIndicatorTest, DRBG) {
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  CTR_DRBG_STATE drbg;
+  uint8_t output[sizeof(kDRBGOutput)];
+
+  // Test running the DRBG interfaces and check |CTR_DRBG_generate| for approval
+  // at the end since it indicates a service is being done. |CTR_DRBG_init| and
+  // |CTR_DRBG_reseed| should not be approved, because the functions do not
+  // indicate that a service has been fully completed yet.
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, CTR_DRBG_init(&drbg, kDRBGEntropy, kDRBGPersonalization,
+                              sizeof(kDRBGPersonalization))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, CTR_DRBG_generate(&drbg, output, sizeof(kDRBGOutput), kDRBGAD,
+                                  sizeof(kDRBGAD))));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  EXPECT_EQ(Bytes(kDRBGOutput), Bytes(output));
+
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      CTR_DRBG_reseed(&drbg, kDRBGEntropy2, kDRBGAD, sizeof(kDRBGAD))));
+  EXPECT_EQ(approved, FIPSStatus::NOT_APPROVED);
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, CTR_DRBG_generate(&drbg, output, sizeof(kDRBGReseedOutput),
+                                  kDRBGAD, sizeof(kDRBGAD))));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+  EXPECT_EQ(Bytes(kDRBGReseedOutput), Bytes(output));
+
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, RAND_bytes(output, sizeof(output))));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+#else  // !BORINGSSL_FIPS
+
+// Service indicator calls should not be used in non-FIPS builds. However, if
+// used, the macro |CALL_SERVICE_AND_CHECK_APPROVED| will return
+// |FIPSStatus::APPROVED|, but the direct calls to
+// |FIPS_service_indicator_xxx| will not indicate an approved state.
+TEST(ServiceIndicatorTest, BasicTest) {
+  // Reset and check the initial state and counter.
+  FIPSStatus approved = FIPSStatus::NOT_APPROVED;
+  uint64_t before = FIPS_service_indicator_before_call();
+  ASSERT_EQ(before, (uint64_t)0);
+
+  // Call an approved service.
+  bssl::ScopedEVP_AEAD_CTX aead_ctx;
+  uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH] = {0};
+  uint8_t output[256];
+  size_t out_len;
+  ASSERT_TRUE(EVP_AEAD_CTX_init(aead_ctx.get(),
+                                EVP_aead_aes_128_gcm_randnonce(), kAESKey,
+                                sizeof(kAESKey), 0, nullptr));
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved, EVP_AEAD_CTX_seal(aead_ctx.get(), output, &out_len,
+                                  sizeof(output), nullptr, 0, kPlaintext,
+                                  sizeof(kPlaintext), nullptr, 0)));
+  // Macro should return true, to ensure FIPS/non-FIPS compatibility.
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+
+  // Call a non-approved service.
+  ASSERT_TRUE(EVP_AEAD_CTX_init(aead_ctx.get(), EVP_aead_aes_128_gcm(), kAESKey,
+                                sizeof(kAESKey), 0, nullptr));
+  ASSERT_TRUE(CALL_SERVICE_AND_CHECK_APPROVED(
+      approved,
+      EVP_AEAD_CTX_seal(aead_ctx.get(), output, &out_len, sizeof(output), nonce,
+                        EVP_AEAD_nonce_length(EVP_aead_aes_128_gcm()),
+                        kPlaintext, sizeof(kPlaintext), nullptr, 0)));
+  EXPECT_EQ(approved, FIPSStatus::APPROVED);
+}
+
+#endif  // BORINGSSL_FIPS
diff --git a/src/crypto/fipsmodule/sha/sha1.c b/src/crypto/fipsmodule/sha/sha1.c
index e482c77..f921e31 100644
--- a/src/crypto/fipsmodule/sha/sha1.c
+++ b/src/crypto/fipsmodule/sha/sha1.c
@@ -62,6 +62,7 @@
 
 #include "../../internal.h"
 #include "../digest/md32_common.h"
+#include "../service_indicator/internal.h"
 #include "internal.h"
 
 
@@ -108,6 +109,7 @@
   CRYPTO_store_u32_be(out + 8, c->h[2]);
   CRYPTO_store_u32_be(out + 12, c->h[3]);
   CRYPTO_store_u32_be(out + 16, c->h[4]);
+  FIPS_service_indicator_update_state();
   return 1;
 }
 
diff --git a/src/crypto/fipsmodule/sha/sha256.c b/src/crypto/fipsmodule/sha/sha256.c
index c187c4a..454b947 100644
--- a/src/crypto/fipsmodule/sha/sha256.c
+++ b/src/crypto/fipsmodule/sha/sha256.c
@@ -62,6 +62,7 @@
 
 #include "../../internal.h"
 #include "../digest/md32_common.h"
+#include "../service_indicator/internal.h"
 #include "internal.h"
 
 
@@ -150,6 +151,8 @@
     CRYPTO_store_u32_be(out, c->h[i]);
     out += 4;
   }
+
+  FIPS_service_indicator_update_state();
   return 1;
 }
 
@@ -161,6 +164,7 @@
   // TODO(davidben): Add an assert and fix code to match them up.
   return sha256_final_impl(out, c);
 }
+
 int SHA224_Final(uint8_t out[SHA224_DIGEST_LENGTH], SHA256_CTX *ctx) {
   // SHA224_Init sets |ctx->md_len| to |SHA224_DIGEST_LENGTH|, so this has a
   // smaller output.
diff --git a/src/crypto/fipsmodule/sha/sha512.c b/src/crypto/fipsmodule/sha/sha512.c
index d94de28..708358e 100644
--- a/src/crypto/fipsmodule/sha/sha512.c
+++ b/src/crypto/fipsmodule/sha/sha512.c
@@ -60,8 +60,9 @@
 
 #include <openssl/mem.h>
 
-#include "internal.h"
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
 
 
 // The 32-bit hash algorithms share a common byte-order neutral collector and
@@ -274,6 +275,7 @@
     out += 8;
   }
 
+  FIPS_service_indicator_update_state();
   return 1;
 }
 
diff --git a/src/crypto/fipsmodule/tls/kdf.c b/src/crypto/fipsmodule/tls/kdf.c
index 347e998..6f2b68b 100644
--- a/src/crypto/fipsmodule/tls/kdf.c
+++ b/src/crypto/fipsmodule/tls/kdf.c
@@ -58,6 +58,7 @@
 
 #include "internal.h"
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
 
 
 // tls1_P_hash computes the TLS P_<hash> function as described in RFC 5246,
@@ -146,12 +147,16 @@
 
   OPENSSL_memset(out, 0, out_len);
 
+  const EVP_MD *const original_digest = digest;
+  FIPS_service_indicator_lock_state();
+  int ret = 0;
+
   if (digest == EVP_md5_sha1()) {
     // If using the MD5/SHA1 PRF, |secret| is partitioned between MD5 and SHA-1.
     size_t secret_half = secret_len - (secret_len / 2);
     if (!tls1_P_hash(out, out_len, EVP_md5(), secret, secret_half, label,
                      label_len, seed1, seed1_len, seed2, seed2_len)) {
-      return 0;
+      goto end;
     }
 
     // Note that, if |secret_len| is odd, the two halves share a byte.
@@ -160,6 +165,13 @@
     digest = EVP_sha1();
   }
 
-  return tls1_P_hash(out, out_len, digest, secret, secret_len, label, label_len,
-                     seed1, seed1_len, seed2, seed2_len);
+  ret = tls1_P_hash(out, out_len, digest, secret, secret_len, label, label_len,
+                    seed1, seed1_len, seed2, seed2_len);
+
+end:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    TLSKDF_verify_service_indicator(original_digest);
+  }
+  return ret;
 }
diff --git a/src/crypto/hrss/hrss.c b/src/crypto/hrss/hrss.c
index 388c9a9..dd6e970 100644
--- a/src/crypto/hrss/hrss.c
+++ b/src/crypto/hrss/hrss.c
@@ -926,6 +926,20 @@
 #endif
 };
 
+// poly_normalize zeros out the excess elements of |x| which are included only
+// for alignment.
+static void poly_normalize(struct poly *x) {
+  OPENSSL_memset(&x->v[N], 0, 3 * sizeof(uint16_t));
+}
+
+// poly_assert_normalized asserts that the excess elements of |x| are zeroed out
+// for the cases that case. (E.g. |poly_mul_vec|.)
+static void poly_assert_normalized(const struct poly *x) {
+  assert(x->v[N] == 0);
+  assert(x->v[N + 1] == 0);
+  assert(x->v[N + 2] == 0);
+}
+
 OPENSSL_UNUSED static void poly_print(const struct poly *p) {
   printf("[");
   for (unsigned i = 0; i < N; i++) {
@@ -1212,13 +1226,12 @@
 // poly_mul_vec sets |*out| to |x|×|y| mod (𝑥^n - 1).
 static void poly_mul_vec(struct POLY_MUL_SCRATCH *scratch, struct poly *out,
                          const struct poly *x, const struct poly *y) {
-  OPENSSL_memset((uint16_t *)&x->v[N], 0, 3 * sizeof(uint16_t));
-  OPENSSL_memset((uint16_t *)&y->v[N], 0, 3 * sizeof(uint16_t));
-
   OPENSSL_STATIC_ASSERT(sizeof(out->v) == sizeof(vec_t) * VECS_PER_POLY,
                         "struct poly is the wrong size");
   OPENSSL_STATIC_ASSERT(alignof(struct poly) == alignof(vec_t),
                         "struct poly has incorrect alignment");
+  poly_assert_normalized(x);
+  poly_assert_normalized(y);
 
   vec_t *const prod = scratch->u.vec.prod;
   vec_t *const aux_scratch = scratch->u.vec.scratch;
@@ -1316,19 +1329,22 @@
 #if defined(POLY_RQ_MUL_ASM)
   if (CRYPTO_is_AVX2_capable()) {
     poly_Rq_mul(r->v, a->v, b->v, scratch->u.rq);
-    return;
-  }
+    poly_normalize(r);
+  } else
 #endif
 
 #if defined(HRSS_HAVE_VECTOR_UNIT)
   if (vec_capable()) {
     poly_mul_vec(scratch, r, a, b);
-    return;
-  }
+  } else
 #endif
 
   // Fallback, non-vector case.
-  poly_mul_novec(scratch, r, a, b);
+  {
+    poly_mul_novec(scratch, r, a, b);
+  }
+
+  poly_assert_normalized(r);
 }
 
 // poly_mul_x_minus_1 sets |p| to |p|×(𝑥 - 1) mod (𝑥^n - 1).
@@ -1493,6 +1509,8 @@
       shift = 0;
     }
   }
+
+  poly_normalize(out);
 }
 
 static void poly_from_poly3(struct poly *out, const struct poly3 *in) {
@@ -1517,6 +1535,8 @@
       shift = 0;
     }
   }
+
+  poly_normalize(out);
 }
 
 // Polynomial inversion
@@ -1570,6 +1590,7 @@
   assert(f.v[0] & 1);
   poly2_reverse_700(&v, &v);
   poly_from_poly2(out, &v);
+  poly_assert_normalized(out);
 }
 
 // poly_invert sets |*out| to |in^-1| (i.e. such that |*out|×|in| = 1 mod Φ(N)).
@@ -1583,6 +1604,7 @@
   for (unsigned i = 0; i < N; i++) {
     a.v[i] = -in->v[i];
   }
+  poly_normalize(&a);
 
   // b = in^-1 mod 2.
   b = out;
@@ -1595,6 +1617,8 @@
     tmp.v[0] += 2;
     poly_mul(scratch, b, b, &tmp);
   }
+
+  poly_assert_normalized(out);
 }
 
 // Marshal and unmarshal functions for various basic types.
@@ -1684,6 +1708,7 @@
   }
 
   out->v[N - 1] = (uint16_t)(0u - sum);
+  poly_normalize(out);
 
   return 1;
 }
@@ -1735,6 +1760,7 @@
     out->v[i] = v;
   }
   out->v[N - 1] = 0;
+  poly_normalize(out);
 }
 
 // poly_short_sample_plus performs the T+ sample as defined in [HRSSNIST],
@@ -1757,6 +1783,7 @@
   for (unsigned i = 0; i < N; i += 2) {
     out->v[i] = (unsigned) out->v[i] * scale;
   }
+  poly_assert_normalized(out);
 }
 
 // poly_lift computes the function discussed in [HRSS], appendix B.
@@ -1872,6 +1899,7 @@
   }
 
   poly_mul_x_minus_1(out);
+  poly_normalize(out);
 }
 
 struct public_key {
@@ -1951,6 +1979,10 @@
     return 0;
   }
 
+#if !defined(NDEBUG)
+  OPENSSL_memset(vars, 0xff, sizeof(struct vars));
+#endif
+
   OPENSSL_memcpy(priv->hmac_key, in + 2 * HRSS_SAMPLE_BYTES,
                  sizeof(priv->hmac_key));
 
@@ -2010,6 +2042,10 @@
     return 0;
   }
 
+#if !defined(NDEBUG)
+  OPENSSL_memset(vars, 0xff, sizeof(struct vars));
+#endif
+
   poly_short_sample(&vars->m, in);
   poly_short_sample(&vars->r, in + HRSS_SAMPLE_BYTES);
   poly_lift(&vars->m_lifted, &vars->m);
@@ -2067,6 +2103,10 @@
     return 0;
   }
 
+#if !defined(NDEBUG)
+  OPENSSL_memset(vars, 0xff, sizeof(struct vars));
+#endif
+
   // This is HMAC, expanded inline rather than using the |HMAC| function so that
   // we can avoid dealing with possible allocation failures and so keep this
   // function infallible.
@@ -2117,6 +2157,7 @@
   for (unsigned i = 0; i < N; i++) {
     vars->r.v[i] = vars->c.v[i] - vars->m_lifted.v[i];
   }
+  poly_normalize(&vars->r);
   poly_mul(&vars->scratch, &vars->r, &vars->r, &priv->ph_inverse);
   poly_mod_phiN(&vars->r);
   poly_clamp(&vars->r);
diff --git a/src/crypto/hrss/hrss_test.cc b/src/crypto/hrss/hrss_test.cc
index bab968c..31a1560 100644
--- a/src/crypto/hrss/hrss_test.cc
+++ b/src/crypto/hrss/hrss_test.cc
@@ -201,6 +201,33 @@
   }
 }
 
+TEST(HRSS, NoWritesToConstData) {
+  // Normalisation of some polynomials used to write into the generated keys.
+  // This is fine in a purely ephemeral setting, but triggers TSAN warnings in
+  // more complex ones.
+  uint8_t generate_key_entropy[HRSS_GENERATE_KEY_BYTES];
+  RAND_bytes(generate_key_entropy, sizeof(generate_key_entropy));
+  HRSS_public_key pub, pub_orig;
+  HRSS_private_key priv, priv_orig;
+  OPENSSL_memset(&pub, 0xa3, sizeof(pub));
+  OPENSSL_memset(&priv, 0x3a, sizeof(priv));
+  ASSERT_TRUE(HRSS_generate_key(&pub, &priv, generate_key_entropy));
+  OPENSSL_memcpy(&priv_orig, &priv, sizeof(priv));
+  OPENSSL_memcpy(&pub_orig, &pub, sizeof(pub));
+
+  uint8_t ciphertext[HRSS_CIPHERTEXT_BYTES];
+  uint8_t shared_key[HRSS_KEY_BYTES];
+  uint8_t encap_entropy[HRSS_ENCAP_BYTES];
+  RAND_bytes(encap_entropy, sizeof(encap_entropy));
+  ASSERT_TRUE(HRSS_encap(ciphertext, shared_key, &pub, encap_entropy));
+
+  ASSERT_EQ(OPENSSL_memcmp(&pub, &pub_orig, sizeof(pub)), 0);
+
+  ASSERT_TRUE(HRSS_decap(shared_key, &priv, ciphertext, sizeof(ciphertext)));
+
+  ASSERT_EQ(OPENSSL_memcmp(&priv, &priv_orig, sizeof(priv)), 0);
+}
+
 TEST(HRSS, Golden) {
   uint8_t generate_key_entropy[HRSS_GENERATE_KEY_BYTES];
   for (unsigned i = 0; i < HRSS_SAMPLE_BYTES; i++) {
diff --git a/src/crypto/internal.h b/src/crypto/internal.h
index 78dbbbf..c9b5e8e 100644
--- a/src/crypto/internal.h
+++ b/src/crypto/internal.h
@@ -126,10 +126,18 @@
 #endif
 
 #if !defined(__cplusplus)
-#if defined(_MSC_VER)
+#if defined(_MSC_VER) && !defined(__clang__)
 #define alignas(x) __declspec(align(x))
 #define alignof __alignof
 #else
+// With the exception of MSVC, we require C11 to build the library. C11 is a
+// prerequisite for improved refcounting performance. All our supported C
+// compilers have long implemented C11 and made it default. The most likely
+// cause of pre-C11 modes is stale -std=c99 or -std=gnu99 flags in build
+// configuration. Such flags can be removed.
+#if __STDC_VERSION__ < 201112L
+#error "BoringSSL must be built in C11 mode or higher."
+#endif
 #include <stdalign.h>
 #endif
 #endif
@@ -640,6 +648,7 @@
   OPENSSL_THREAD_LOCAL_ERR = 0,
   OPENSSL_THREAD_LOCAL_RAND,
   OPENSSL_THREAD_LOCAL_FIPS_COUNTERS,
+  OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE,
   OPENSSL_THREAD_LOCAL_TEST,
   NUM_OPENSSL_THREAD_LOCALS,
 } thread_local_data_t;
@@ -893,6 +902,18 @@
   OPENSSL_memcpy(out, &v, sizeof(v));
 }
 
+static inline crypto_word_t CRYPTO_load_word_be(const void *in) {
+  crypto_word_t v;
+  OPENSSL_memcpy(&v, in, sizeof(v));
+#if defined(OPENSSL_64_BIT)
+  static_assert(sizeof(v) == 8, "crypto_word_t has unexpected size");
+  return CRYPTO_bswap8(v);
+#else
+  static_assert(sizeof(v) == 4, "crypto_word_t has unexpected size");
+  return CRYPTO_bswap4(v);
+#endif
+}
+
 
 // Bit rotation functions.
 //
diff --git a/src/crypto/pkcs8/pkcs12_test.cc b/src/crypto/pkcs8/pkcs12_test.cc
index 958bd8d..79ebae3 100644
--- a/src/crypto/pkcs8/pkcs12_test.cc
+++ b/src/crypto/pkcs8/pkcs12_test.cc
@@ -599,3 +599,45 @@
   ASSERT_TRUE(PKCS12CreateVector(&p12, key1.get(), {cert2.get(), cert3.get()}));
   ExpectPKCS12Parse(p12, key1.get(), nullptr, {cert2.get(), cert3.get()});
 }
+
+TEST(PKCS12Test, CreateWithAlias) {
+  bssl::UniquePtr<EVP_PKEY> key = MakeTestKey();
+  ASSERT_TRUE(key);
+  bssl::UniquePtr<X509> cert1 = MakeTestCert(key.get());
+  ASSERT_TRUE(cert1);
+  bssl::UniquePtr<X509> cert2 = MakeTestCert(key.get());
+  ASSERT_TRUE(cert2);
+
+  std::string alias = "I'm an alias";
+  int res = X509_alias_set1(
+      cert1.get(), reinterpret_cast<const unsigned char *>(alias.data()),
+      alias.size());
+  ASSERT_EQ(res, 1);
+
+  std::vector<X509 *> certs = {cert1.get(), cert2.get()};
+  std::vector<uint8_t> der;
+  ASSERT_TRUE(PKCS12CreateVector(&der, key.get(), certs));
+
+  bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(der.data(), der.size()));
+  ASSERT_TRUE(bio);
+  bssl::UniquePtr<PKCS12> p12(d2i_PKCS12_bio(bio.get(), nullptr));
+  ASSERT_TRUE(p12);
+
+  EVP_PKEY *parsed_key = nullptr;
+  X509 *parsed_cert = nullptr;
+  STACK_OF(X509) *ca_certs = nullptr;
+  ASSERT_TRUE(
+      PKCS12_parse(p12.get(), kPassword, &parsed_key, &parsed_cert, &ca_certs));
+
+  bssl::UniquePtr<EVP_PKEY> delete_key(parsed_key);
+  bssl::UniquePtr<X509> delete_cert(parsed_cert);
+  bssl::UniquePtr<STACK_OF(X509)> delete_ca_certs(ca_certs);
+  ASSERT_EQ(sk_X509_num(ca_certs), 1UL);
+
+  int alias_len = 0;
+  const unsigned char *parsed_alias =
+      X509_alias_get0(sk_X509_value(ca_certs, 0), &alias_len);
+  ASSERT_TRUE(parsed_alias);
+  ASSERT_EQ(alias, std::string(reinterpret_cast<const char *>(parsed_alias),
+                               static_cast<size_t>(alias_len)));
+}
diff --git a/src/crypto/pkcs8/pkcs8_x509.c b/src/crypto/pkcs8/pkcs8_x509.c
index e2a02e8..1ea83e7 100644
--- a/src/crypto/pkcs8/pkcs8_x509.c
+++ b/src/crypto/pkcs8/pkcs8_x509.c
@@ -993,8 +993,8 @@
 
 // add_bag_attributes adds the bagAttributes field of a SafeBag structure,
 // containing the specified friendlyName and localKeyId attributes.
-static int add_bag_attributes(CBB *bag, const char *name, const uint8_t *key_id,
-                              size_t key_id_len) {
+static int add_bag_attributes(CBB *bag, const char *name, size_t name_len,
+                              const uint8_t *key_id, size_t key_id_len) {
   if (name == NULL && key_id_len == 0) {
     return 1;  // Omit the OPTIONAL SET.
   }
@@ -1003,7 +1003,7 @@
   if (!CBB_add_asn1(bag, &attrs, CBS_ASN1_SET)) {
     return 0;
   }
-  if (name != NULL) {
+  if (name_len != 0) {
     // See https://tools.ietf.org/html/rfc2985, section 5.5.1.
     if (!CBB_add_asn1(&attrs, &attr, CBS_ASN1_SEQUENCE) ||
         !CBB_add_asn1(&attr, &oid, CBS_ASN1_OBJECT) ||
@@ -1014,7 +1014,7 @@
     }
     // Convert the friendly name to a BMPString.
     CBS name_cbs;
-    CBS_init(&name_cbs, (const uint8_t *)name, strlen(name));
+    CBS_init(&name_cbs, (const uint8_t *)name, name_len);
     while (CBS_len(&name_cbs) != 0) {
       uint32_t c;
       if (!cbs_get_utf8(&name_cbs, &c) ||
@@ -1059,10 +1059,24 @@
   }
   uint8_t *buf;
   int len = i2d_X509(cert, NULL);
+
+  int int_name_len = 0;
+  const char *cert_name = (const char *)X509_alias_get0(cert, &int_name_len);
+  size_t name_len = int_name_len;
+  if (name) {
+    if (name_len != 0) {
+      OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_AMBIGUOUS_FRIENDLY_NAME);
+      return 0;
+    }
+    name_len = strlen(name);
+  } else {
+    name = cert_name;
+  }
+
   if (len < 0 ||
       !CBB_add_space(&cert_value, &buf, (size_t)len) ||
       i2d_X509(cert, &buf) < 0 ||
-      !add_bag_attributes(&bag, name, key_id, key_id_len) ||
+      !add_bag_attributes(&bag, name, name_len, key_id, key_id_len) ||
       !CBB_flush(cbb)) {
     return 0;
   }
@@ -1323,7 +1337,11 @@
         goto err;
       }
     }
-    if (!add_bag_attributes(&bag, name, key_id, key_id_len) ||
+    size_t name_len = 0;
+    if (name) {
+      name_len = strlen(name);
+    }
+    if (!add_bag_attributes(&bag, name, name_len, key_id, key_id_len) ||
         !CBB_flush(&content_infos)) {
       goto err;
     }
diff --git a/src/crypto/test/abi_test.h b/src/crypto/test/abi_test.h
index ffe4479..1ba82b1 100644
--- a/src/crypto/test/abi_test.h
+++ b/src/crypto/test/abi_test.h
@@ -380,9 +380,9 @@
 // CheckImpl implementation. It must be specialized for void returns because we
 // call |func| directly.
 template <typename R, typename... Args>
-inline typename std::enable_if<!std::is_void<R>::value, crypto_word_t>::type
-CheckImpl(Result *out, bool /* unwind */, R (*func)(Args...),
-          typename DeductionGuard<Args>::Type... args) {
+inline std::enable_if_t<!std::is_void<R>::value, crypto_word_t> CheckImpl(
+    Result *out, bool /* unwind */, R (*func)(Args...),
+    typename DeductionGuard<Args>::Type... args) {
   *out = Result();
   return func(args...);
 }
diff --git a/src/crypto/trust_token/trust_token_test.cc b/src/crypto/trust_token/trust_token_test.cc
index f9f183d..72d555b 100644
--- a/src/crypto/trust_token/trust_token_test.cc
+++ b/src/crypto/trust_token/trust_token_test.cc
@@ -854,7 +854,7 @@
                           &key->key.y1, &key->key.xs, &key->key.ys};
 
   // Corrupt private key scalar.
-  scalars[corrupted_key()]->bytes[0] ^= 42;
+  scalars[corrupted_key()]->words[0] ^= 42;
 
   size_t tokens_issued;
   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
diff --git a/src/crypto/x509/internal.h b/src/crypto/x509/internal.h
index ff8288f..78275ae 100644
--- a/src/crypto/x509/internal.h
+++ b/src/crypto/x509/internal.h
@@ -221,8 +221,6 @@
   ASN1_INTEGER *base_crl_number;
   unsigned char crl_hash[SHA256_DIGEST_LENGTH];
   STACK_OF(GENERAL_NAMES) *issuers;
-  const X509_CRL_METHOD *meth;
-  void *meth_data;
 } /* X509_CRL */;
 
 struct X509_VERIFY_PARAM_st {
diff --git a/src/crypto/x509/t_crl.c b/src/crypto/x509/t_crl.c
index 0e6140d..2aee83d 100644
--- a/src/crypto/x509/t_crl.c
+++ b/src/crypto/x509/t_crl.c
@@ -54,6 +54,8 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.] */
 
+#include <assert.h>
+
 #include <openssl/asn1.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
@@ -76,13 +78,11 @@
 int X509_CRL_print(BIO *out, X509_CRL *x)
 {
     long version = X509_CRL_get_version(x);
+    assert(X509_CRL_VERSION_1 <= version && version <= X509_CRL_VERSION_2);
     const X509_ALGOR *sig_alg;
     const ASN1_BIT_STRING *signature;
     X509_CRL_get0_signature(x, &signature, &sig_alg);
     if (BIO_printf(out, "Certificate Revocation List (CRL):\n") <= 0 ||
-        // TODO(https://crbug.com/boringssl/467): This loses information on some
-        // invalid versions, but we should fix this by making invalid versions
-        // impossible.
         BIO_printf(out, "%8sVersion %ld (0x%lx)\n", "", version + 1,
                    (unsigned long)version) <= 0 ||
         // Note this and the other |X509_signature_print| call both print the
diff --git a/src/crypto/x509/t_req.c b/src/crypto/x509/t_req.c
index 92ded49..9e3ce26 100644
--- a/src/crypto/x509/t_req.c
+++ b/src/crypto/x509/t_req.c
@@ -54,6 +54,7 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.] */
 
+#include <assert.h>
 #include <stdio.h>
 
 #include <openssl/bn.h>
@@ -103,10 +104,8 @@
     }
   }
   if (!(cflag & X509_FLAG_NO_VERSION)) {
-    /* TODO(https://crbug.com/boringssl/467): This loses information on some
-     * invalid versions, but we should fix this by making invalid versions
-     * impossible. */
     l = X509_REQ_get_version(x);
+    assert(l == X509_REQ_VERSION_1);
     if (BIO_printf(bio, "%8sVersion: %ld (0x%lx)\n", "", l + 1,
                    (unsigned long)l) <= 0) {
       goto err;
diff --git a/src/crypto/x509/t_x509.c b/src/crypto/x509/t_x509.c
index 4f9d409..955d1cd 100644
--- a/src/crypto/x509/t_x509.c
+++ b/src/crypto/x509/t_x509.c
@@ -119,10 +119,8 @@
             goto err;
     }
     if (!(cflag & X509_FLAG_NO_VERSION)) {
-        /* TODO(https://crbug.com/boringssl/467): This loses information on some
-         * invalid versions, but we should fix this by making invalid versions
-         * impossible. */
         l = X509_get_version(x);
+        assert(X509_VERSION_1 <= l && l <= X509_VERSION_3);
         if (BIO_printf(bp, "%8sVersion: %ld (0x%lx)\n", "", l + 1,
                        (unsigned long)l) <= 0) {
             goto err;
@@ -142,6 +140,7 @@
               goto err;
             }
         } else {
+            ERR_clear_error();  /* Clear |ASN1_INTEGER_get_uint64|'s error. */
             neg = (serial->type == V_ASN1_NEG_INTEGER) ? " (Negative)" : "";
             if (BIO_printf(bp, "\n%12s%s", "", neg) <= 0) {
                 goto err;
@@ -322,9 +321,7 @@
 int X509_NAME_print(BIO *bp, const X509_NAME *name, int obase)
 {
     char *s, *c, *b;
-    int ret = 0, l, i;
-
-    l = 80 - 2 - obase;
+    int ret = 0, i;
 
     b = X509_NAME_oneline(name, NULL, 0);
     if (!b)
@@ -351,12 +348,10 @@
                 if (BIO_write(bp, ", ", 2) != 2)
                     goto err;
             }
-            l--;
         }
         if (*s == '\0')
             break;
         s++;
-        l--;
     }
 
     ret = 1;
diff --git a/src/crypto/x509/x509_cmp.c b/src/crypto/x509/x509_cmp.c
index e9e1d8c..80590e2 100644
--- a/src/crypto/x509/x509_cmp.c
+++ b/src/crypto/x509/x509_cmp.c
@@ -165,18 +165,7 @@
     x509v3_cache_extensions((X509 *)a);
     x509v3_cache_extensions((X509 *)b);
 
-    int rv = OPENSSL_memcmp(a->cert_hash, b->cert_hash, SHA256_DIGEST_LENGTH);
-    if (rv)
-        return rv;
-    /* Check for match against stored encoding too */
-    if (!a->cert_info->enc.modified && !b->cert_info->enc.modified) {
-        rv = (int)(a->cert_info->enc.len - b->cert_info->enc.len);
-        if (rv)
-            return rv;
-        return OPENSSL_memcmp(a->cert_info->enc.enc, b->cert_info->enc.enc,
-                              a->cert_info->enc.len);
-    }
-    return rv;
+    return OPENSSL_memcmp(a->cert_hash, b->cert_hash, SHA256_DIGEST_LENGTH);
 }
 
 int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
diff --git a/src/crypto/x509/x509_req.c b/src/crypto/x509/x509_req.c
index 99eabfe..5a69a5f 100644
--- a/src/crypto/x509/x509_req.c
+++ b/src/crypto/x509/x509_req.c
@@ -68,48 +68,6 @@
 #include "internal.h"
 
 
-X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
-{
-    X509_REQ *ret;
-    X509_REQ_INFO *ri;
-    int i;
-    EVP_PKEY *pktmp;
-
-    ret = X509_REQ_new();
-    if (ret == NULL) {
-        OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    ri = ret->req_info;
-
-    ri->version->length = 1;
-    ri->version->data = (unsigned char *)OPENSSL_malloc(1);
-    if (ri->version->data == NULL)
-        goto err;
-    ri->version->data[0] = 0;   /* version == 0 */
-
-    if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
-        goto err;
-
-    pktmp = X509_get_pubkey(x);
-    if (pktmp == NULL)
-        goto err;
-    i = X509_REQ_set_pubkey(ret, pktmp);
-    EVP_PKEY_free(pktmp);
-    if (!i)
-        goto err;
-
-    if (pkey != NULL) {
-        if (!X509_REQ_sign(ret, pkey, md))
-            goto err;
-    }
-    return (ret);
- err:
-    X509_REQ_free(ret);
-    return (NULL);
-}
-
 long X509_REQ_get_version(const X509_REQ *req)
 {
     return ASN1_INTEGER_get(req->req_info->version);
diff --git a/src/crypto/x509/x509_set.c b/src/crypto/x509/x509_set.c
index 5cbd00d..6a58322 100644
--- a/src/crypto/x509/x509_set.c
+++ b/src/crypto/x509/x509_set.c
@@ -74,19 +74,29 @@
 
 int X509_set_version(X509 *x, long version)
 {
-    // TODO(https://crbug.com/boringssl/467): Reject invalid version numbers.
-    if (x == NULL)
-        return (0);
-    if (version == 0) {
+    if (x == NULL) {
+        return 0;
+    }
+
+    if (version < X509_VERSION_1 || version > X509_VERSION_3) {
+        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+        return 0;
+    }
+
+    /* v1(0) is default and is represented by omitting the version. */
+    if (version == X509_VERSION_1) {
         ASN1_INTEGER_free(x->cert_info->version);
         x->cert_info->version = NULL;
-        return (1);
+        return 1;
     }
+
     if (x->cert_info->version == NULL) {
-        if ((x->cert_info->version = ASN1_INTEGER_new()) == NULL)
-            return (0);
+        x->cert_info->version = ASN1_INTEGER_new();
+        if (x->cert_info->version == NULL) {
+            return 0;
+        }
     }
-    return (ASN1_INTEGER_set(x->cert_info->version, version));
+    return ASN1_INTEGER_set(x->cert_info->version, version);
 }
 
 int X509_set_serialNumber(X509 *x, const ASN1_INTEGER *serial)
diff --git a/src/crypto/x509/x509_test.cc b/src/crypto/x509/x509_test.cc
index b201afe..ce70ae3 100644
--- a/src/crypto/x509/x509_test.cc
+++ b/src/crypto/x509/x509_test.cc
@@ -1047,7 +1047,7 @@
 -----END CERTIFICATE-----
 )";
 
-// CertFromPEM parses the given, NUL-terminated pem block and returns an
+// CertFromPEM parses the given, NUL-terminated PEM block and returns an
 // |X509*|.
 static bssl::UniquePtr<X509> CertFromPEM(const char *pem) {
   bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(pem, strlen(pem)));
@@ -1055,7 +1055,7 @@
       PEM_read_bio_X509(bio.get(), nullptr, nullptr, nullptr));
 }
 
-// CRLFromPEM parses the given, NUL-terminated pem block and returns an
+// CRLFromPEM parses the given, NUL-terminated PEM block and returns an
 // |X509_CRL*|.
 static bssl::UniquePtr<X509_CRL> CRLFromPEM(const char *pem) {
   bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(pem, strlen(pem)));
@@ -1063,7 +1063,15 @@
       PEM_read_bio_X509_CRL(bio.get(), nullptr, nullptr, nullptr));
 }
 
-// PrivateKeyFromPEM parses the given, NUL-terminated pem block and returns an
+// CSRFromPEM parses the given, NUL-terminated PEM block and returns an
+// |X509_REQ*|.
+static bssl::UniquePtr<X509_REQ> CSRFromPEM(const char *pem) {
+  bssl::UniquePtr<BIO> bio(BIO_new_mem_buf(pem, strlen(pem)));
+  return bssl::UniquePtr<X509_REQ>(
+      PEM_read_bio_X509_REQ(bio.get(), nullptr, nullptr, nullptr));
+}
+
+// PrivateKeyFromPEM parses the given, NUL-terminated PEM block and returns an
 // |EVP_PKEY*|.
 static bssl::UniquePtr<EVP_PKEY> PrivateKeyFromPEM(const char *pem) {
   bssl::UniquePtr<BIO> bio(
@@ -2871,12 +2879,70 @@
 -----END CERTIFICATE-----
 )";
 
-// Test that the X.509 parser enforces versions are valid and match the fields
+// kV1CRLWithExtensionsPEM is a v1 CRL with extensions.
+static const char kV1CRLWithExtensionsPEM[] = R"(
+-----BEGIN X509 CRL-----
+MIIBpDCBjTANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UECAwK
+Q2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJQm9y
+aW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNVHRQE
+AwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LNZEAc
++a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWoeOkq
+0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4osdsAR
+eBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vvdiyu
+0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho/vBb
+hl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==
+-----END X509 CRL-----
+)";
+
+// kExplicitDefaultVersionCRLPEM is a v1 CRL with an explicitly-encoded version
+// field.
+static const char kExplicitDefaultVersionCRLPEM[] = R"(
+-----BEGIN X509 CRL-----
+MIIBlzCBgAIBADANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE
+CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ
+Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaMA0GCSqGSIb3
+DQEBCwUAA4IBAQCesEoqC933H3PAr2u1S9V4V4nv4s1kQBz5rmjGk80SwnHqFegC
+lgRvNczG5YFCgKzmIQHJxIa51y3bUv4xV/bszfwqtah46SrRrayKpWJBk7YVv9JQ
+VHST3NvzGXzpl/rmWA+mUAu6fRtX8dPswlyXThNziix2wBF4GzmepMY0R3kCULWI
+oe9BmQz/8wPnUOykqcOmwOJRWLniH0LVKl9mZfwfZW92LK7R9n9s8AzdUAZrBq1/
+9LJZ8EzIqmg9cQbf2gDOaOM6Px6fzamyfubjvggZqGj+8FuGXWazmpCItg+ObhgQ
+u2ddCgXILva0GNt0V39kT2TgI0oNvEVRcVuT
+-----END X509 CRL-----
+)";
+
+// kV3CRLPEM is a v3 CRL. CRL versions only go up to v2.
+static const char kV3CRLPEM[] = R"(
+-----BEGIN X509 CRL-----
+MIIBpzCBkAIBAjANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJVUzETMBEGA1UE
+CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzESMBAGA1UECgwJ
+Qm9yaW5nU1NMFw0xNjA5MjYxNTEwNTVaFw0xNjEwMjYxNTEwNTVaoA4wDDAKBgNV
+HRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAnrBKKgvd9x9zwK9rtUvVeFeJ7+LN
+ZEAc+a5oxpPNEsJx6hXoApYEbzXMxuWBQoCs5iEBycSGudct21L+MVf27M38KrWo
+eOkq0a2siqViQZO2Fb/SUFR0k9zb8xl86Zf65lgPplALun0bV/HT7MJcl04Tc4os
+dsAReBs5nqTGNEd5AlC1iKHvQZkM//MD51DspKnDpsDiUVi54h9C1SpfZmX8H2Vv
+diyu0fZ/bPAM3VAGawatf/SyWfBMyKpoPXEG39oAzmjjOj8en82psn7m474IGaho
+/vBbhl1ms5qQiLYPjm4YELtnXQoFyC72tBjbdFd/ZE9k4CNKDbxFUXFbkw==
+-----END X509 CRL-----
+)";
+
+// kV2CSRPEM is a v2 CSR. CSR versions only go up to v1.
+static const char kV2CSRPEM[] = R"(
+-----BEGIN CERTIFICATE REQUEST-----
+MIHJMHECAQEwDzENMAsGA1UEAwwEVGVzdDBZMBMGByqGSM49AgEGCCqGSM49AwEH
+A0IABJjsayyAQod1J7UJYNT8AH4WWxLdKV0ozhrIz6hCzBAze7AqXWOSH8G+1EWC
+pSfL3oMQNtBdJS0kpXXaUqEAgTSgADAKBggqhkjOPQQDAgNIADBFAiAUXVaEYATg
+4Cc917T73KBImxh6xyhsA5pKuYpq1S4m9wIhAK+G93HR4ur7Ghel6+zUTvIAsj9e
+rsn4lSYsqI4OI4ei
+-----END CERTIFICATE REQUEST-----
+)";
+
+// Test that the library enforces versions are valid and match the fields
 // present.
 TEST(X509Test, InvalidVersion) {
   // kExplicitDefaultVersionPEM is invalid but, for now, we accept it. See
   // https://crbug.com/boringssl/364.
   EXPECT_TRUE(CertFromPEM(kExplicitDefaultVersionPEM));
+  EXPECT_TRUE(CRLFromPEM(kExplicitDefaultVersionCRLPEM));
 
   EXPECT_FALSE(CertFromPEM(kNegativeVersionPEM));
   EXPECT_FALSE(CertFromPEM(kFutureVersionPEM));
@@ -2885,6 +2951,27 @@
   EXPECT_FALSE(CertFromPEM(kV2WithExtensionsPEM));
   EXPECT_FALSE(CertFromPEM(kV1WithIssuerUniqueIDPEM));
   EXPECT_FALSE(CertFromPEM(kV1WithSubjectUniqueIDPEM));
+  EXPECT_FALSE(CRLFromPEM(kV1CRLWithExtensionsPEM));
+  EXPECT_FALSE(CRLFromPEM(kV3CRLPEM));
+  EXPECT_FALSE(CSRFromPEM(kV2CSRPEM));
+
+  bssl::UniquePtr<X509> x509(X509_new());
+  ASSERT_TRUE(x509);
+  EXPECT_FALSE(X509_set_version(x509.get(), -1));
+  EXPECT_FALSE(X509_set_version(x509.get(), X509_VERSION_3 + 1));
+  EXPECT_FALSE(X509_set_version(x509.get(), 9999));
+
+  bssl::UniquePtr<X509_CRL> crl(X509_CRL_new());
+  ASSERT_TRUE(crl);
+  EXPECT_FALSE(X509_CRL_set_version(crl.get(), -1));
+  EXPECT_FALSE(X509_CRL_set_version(crl.get(), X509_CRL_VERSION_2 + 1));
+  EXPECT_FALSE(X509_CRL_set_version(crl.get(), 9999));
+
+  bssl::UniquePtr<X509_REQ> req(X509_REQ_new());
+  ASSERT_TRUE(req);
+  EXPECT_FALSE(X509_REQ_set_version(req.get(), -1));
+  EXPECT_FALSE(X509_REQ_set_version(req.get(), X509_REQ_VERSION_1 + 1));
+  EXPECT_FALSE(X509_REQ_set_version(req.get(), 9999));
 }
 
 // Unlike upstream OpenSSL, we require a non-null store in
@@ -3911,3 +3998,378 @@
     EXPECT_STREQ(hex.get(), t.hex);
   }
 }
+
+TEST(X509Test, NamePrint) {
+  // kTestName is a DER-encoded X.509 that covers many cases.
+  //
+  // SEQUENCE {
+  //   SET {
+  //     SEQUENCE {
+  //       # countryName
+  //       OBJECT_IDENTIFIER { 2.5.4.6 }
+  //       PrintableString { "US" }
+  //     }
+  //   }
+  //   # Sets may be multi-valued, with different attributes. Try to keep this
+  //   # in DER set order, in case we ever enforce this in the parser.
+  //   SET {
+  //     SEQUENCE {
+  //       # stateOrProvinceName
+  //       OBJECT_IDENTIFIER { 2.5.4.8 }
+  //       PrintableString { "Some State" }
+  //     }
+  //     SEQUENCE {
+  //       # stateOrProvinceName
+  //       OBJECT_IDENTIFIER { 2.5.4.8 }
+  //       UTF8String { "Some Other State \xe2\x98\x83" }
+  //     }
+  //     SEQUENCE {
+  //       # stateOrProvinceName
+  //       OBJECT_IDENTIFIER { 2.5.4.8 }
+  //       BMPString { u"Another State \u2603" }
+  //     }
+  //     SEQUENCE {
+  //       # A custom OID
+  //       OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.2 }
+  //       UniversalString { U"\u2603" }
+  //     }
+  //   }
+  //   # Custom OIDs may have non-string values.
+  //   SET {
+  //     SEQUENCE {
+  //       OBJECT_IDENTIFIER { 1.2.840.113554.4.1.72585.3 }
+  //       SEQUENCE { INTEGER { 1 } INTEGER { 2 } }
+  //     }
+  //   }
+  //   SET {
+  //     SEQUENCE {
+  //       # organizationName
+  //       OBJECT_IDENTIFIER { 2.5.4.10 }
+  //       PrintableString { "Org Name" }
+  //     }
+  //   }
+  //   SET {
+  //     SEQUENCE {
+  //       # commonName
+  //       OBJECT_IDENTIFIER { 2.5.4.3 }
+  //       # Embed common delimiter forms to test how well they get escaped.
+  //       UTF8String { "Common
+  //       Name/CN=A/CN=B,CN=A,CN=B+CN=A+CN=B;CN=A;CN=B\nCN=A\n" }
+  //     }
+  //   }
+  //   SET {
+  //   SEQUENCE {
+  //     # commonName
+  //     OBJECT_IDENTIFIER { 2.5.4.3 }
+  //     # Test escaping of leading and trailing spaces.
+  //     UTF8String { " spaces " }
+  //   }
+  // }
+  static const uint8_t kTestName[] = {
+      0x30, 0x82, 0x01, 0x00, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
+      0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x6d, 0x30, 0x11, 0x06, 0x03, 0x55,
+      0x04, 0x08, 0x13, 0x0a, 0x53, 0x6f, 0x6d, 0x65, 0x20, 0x53, 0x74, 0x61,
+      0x74, 0x65, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x14, 0x53,
+      0x6f, 0x6d, 0x65, 0x20, 0x4f, 0x74, 0x68, 0x65, 0x72, 0x20, 0x53, 0x74,
+      0x61, 0x74, 0x65, 0x20, 0xe2, 0x98, 0x83, 0x30, 0x25, 0x06, 0x03, 0x55,
+      0x04, 0x08, 0x1e, 0x1e, 0x00, 0x41, 0x00, 0x6e, 0x00, 0x6f, 0x00, 0x74,
+      0x00, 0x68, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x53, 0x00, 0x74,
+      0x00, 0x61, 0x00, 0x74, 0x00, 0x65, 0x00, 0x20, 0x26, 0x03, 0x30, 0x14,
+      0x06, 0x0c, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04, 0x01, 0x84, 0xb7,
+      0x09, 0x02, 0x1c, 0x04, 0x00, 0x00, 0x26, 0x03, 0x31, 0x18, 0x30, 0x16,
+      0x06, 0x0c, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x12, 0x04, 0x01, 0x84, 0xb7,
+      0x09, 0x03, 0x30, 0x06, 0x02, 0x01, 0x01, 0x02, 0x01, 0x02, 0x31, 0x11,
+      0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x08, 0x4f, 0x72, 0x67,
+      0x20, 0x4e, 0x61, 0x6d, 0x65, 0x31, 0x42, 0x30, 0x40, 0x06, 0x03, 0x55,
+      0x04, 0x03, 0x0c, 0x39, 0x43, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x20, 0x4e,
+      0x61, 0x6d, 0x65, 0x2f, 0x43, 0x4e, 0x3d, 0x41, 0x2f, 0x43, 0x4e, 0x3d,
+      0x42, 0x2c, 0x43, 0x4e, 0x3d, 0x41, 0x2c, 0x43, 0x4e, 0x3d, 0x42, 0x2b,
+      0x43, 0x4e, 0x3d, 0x41, 0x2b, 0x43, 0x4e, 0x3d, 0x42, 0x3b, 0x43, 0x4e,
+      0x3d, 0x41, 0x3b, 0x43, 0x4e, 0x3d, 0x42, 0x0a, 0x43, 0x4e, 0x3d, 0x41,
+      0x0a, 0x31, 0x11, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x08,
+      0x20, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x20};
+
+  const uint8_t *ptr = kTestName;
+  bssl::UniquePtr<X509_NAME> name(
+      d2i_X509_NAME(nullptr, &ptr, sizeof(kTestName)));
+  ASSERT_TRUE(name);
+  EXPECT_EQ(ptr, kTestName + sizeof(kTestName));
+
+  struct {
+    int indent;
+    unsigned long flags;
+    std::string printed;
+  } kTests[] = {
+      // RFC 2253 uses , and + separators and encodes the RDNs in reverse.
+      // OpenSSL's implementation additionally happens to reverse the values
+      // within each RDN. RFC 2253 says any order is permissible.
+      {/*indent=*/0,
+       /*flags=*/XN_FLAG_RFC2253,
+       "CN=\\ spaces\\ ,"
+       "CN=Common "
+       "Name/CN=A/CN=B\\,CN=A\\,CN=B\\+CN=A\\+CN=B\\;CN=A\\;CN=B\\0ACN=A\\0A,"
+       "O=Org Name,"
+       "1.2.840.113554.4.1.72585.3=#3006020101020102,"
+       "1.2.840.113554.4.1.72585.2=#1C0400002603+"
+       "ST=Another State \\E2\\98\\83+"
+       "ST=Some Other State \\E2\\98\\83+"
+       "ST=Some State,"
+       "C=US"},
+      {/*indent=*/2,
+       /*flags=*/XN_FLAG_RFC2253,
+       "  "
+       "CN=\\ spaces\\ ,"
+       "CN=Common "
+       "Name/CN=A/CN=B\\,CN=A\\,CN=B\\+CN=A\\+CN=B\\;CN=A\\;CN=B\\0ACN=A\\0A,"
+       "O=Org Name,"
+       "1.2.840.113554.4.1.72585.3=#3006020101020102,"
+       "1.2.840.113554.4.1.72585.2=#1C0400002603+"
+       "ST=Another State \\E2\\98\\83+"
+       "ST=Some Other State \\E2\\98\\83+"
+       "ST=Some State,"
+       "C=US"},
+      // |XN_FLAG_ONELINE| is an OpenSSL-specific single-line format. It also
+      // omits |XN_FLAG_DUMP_UNKNOWN_FIELDS|, so unknown OIDs that use known
+      // string types will still be decoded. (This may drop important
+      // information if the unknown OID distinguishes between string types.) It
+      // also passes |ASN1_STRFLGS_ESC_QUOTE|.
+      {/*indent=*/0,
+       /*flags=*/XN_FLAG_ONELINE,
+       "C = US, "
+       "ST = Some State + "
+       "ST = Some Other State \\E2\\98\\83 + "
+       "ST = Another State \\E2\\98\\83 + "
+       "1.2.840.113554.4.1.72585.2 = \\E2\\98\\83, "
+       "1.2.840.113554.4.1.72585.3 = #3006020101020102, "
+       "O = Org Name, "
+       "CN = \"Common "
+       "Name/CN=A/CN=B,CN=A,CN=B+CN=A+CN=B;CN=A;CN=B\\0ACN=A\\0A\", "
+       "CN = \" spaces \""},
+      // |XN_FLAG_MULTILINE| is an OpenSSL-specific multi-line format that tries
+      // to vertically align the equal sizes. The vertical alignment doesn't
+      // quite handle multi-valued RDNs right and uses a non-RFC-2253 escaping.
+      {/*indent=*/0,
+       /*flags=*/XN_FLAG_MULTILINE,
+       "countryName               = US\n"
+       "stateOrProvinceName       = Some State + "
+       "stateOrProvinceName       = Some Other State \\U2603 + "
+       "stateOrProvinceName       = Another State \\U2603 + "
+       "1.2.840.113554.4.1.72585.2 = \\U2603\n"
+       "1.2.840.113554.4.1.72585.3 = 0\\06\\02\\01\\01\\02\\01\\02\n"
+       "organizationName          = Org Name\n"
+       "commonName                = Common "
+       "Name/CN=A/CN=B,CN=A,CN=B+CN=A+CN=B;CN=A;CN=B\\0ACN=A\\0A\n"
+       "commonName                =  spaces "},
+      // The multiline format indents every line.
+      {/*indent=*/2,
+       /*flags=*/XN_FLAG_MULTILINE,
+       "  countryName               = US\n"
+       "  stateOrProvinceName       = Some State + "
+       "stateOrProvinceName       = Some Other State \\U2603 + "
+       "stateOrProvinceName       = Another State \\U2603 + "
+       "1.2.840.113554.4.1.72585.2 = \\U2603\n"
+       "  1.2.840.113554.4.1.72585.3 = 0\\06\\02\\01\\01\\02\\01\\02\n"
+       "  organizationName          = Org Name\n"
+       "  commonName                = Common "
+       "Name/CN=A/CN=B,CN=A,CN=B+CN=A+CN=B;CN=A;CN=B\\0ACN=A\\0A\n"
+       "  commonName                =  spaces "},
+      // Callers can also customize the output, wuith both |XN_FLAG_*| and
+      // |ASN1_STRFLGS_*|. |XN_FLAG_SEP_SPLUS_SPC| uses semicolon separators and
+      // |XN_FLAG_FN_OID| forces OIDs.
+      {/*indent=*/0,
+       /*flags=*/XN_FLAG_SEP_SPLUS_SPC | XN_FLAG_FN_OID | ASN1_STRFLGS_RFC2253 |
+           ASN1_STRFLGS_ESC_QUOTE,
+       "2.5.4.6=US; "
+       "2.5.4.8=Some State + "
+       "2.5.4.8=Some Other State \\E2\\98\\83 + "
+       "2.5.4.8=Another State \\E2\\98\\83 + "
+       "1.2.840.113554.4.1.72585.2=\\E2\\98\\83; "
+       "1.2.840.113554.4.1.72585.3=#3006020101020102; "
+       "2.5.4.10=Org Name; "
+       "2.5.4.3=\"Common "
+       "Name/CN=A/CN=B,CN=A,CN=B+CN=A+CN=B;CN=A;CN=B\\0ACN=A\\0A\"; "
+       "2.5.4.3=\" spaces \""},
+      // |XN_FLAG_COMPAT| matches |X509_NAME_print|, rather than
+      // |X509_NAME_print_ex|.
+      //
+      // TODO(davidben): This works by post-processing the output of
+      // |X509_NAME_oneline|, which uses "/"" separators, and replacing with
+      // ", ". The escaping is ambiguous and the post-processing is buggy, so
+      // some of the trailing slashes are still present and some internal
+      // slashes are mis-converted.
+      {/*indent=*/0,
+       /*flags=*/XN_FLAG_COMPAT,
+       "C=US, "
+       "ST=Some State, "
+       "ST=Some Other State \\xE2\\x98\\x83, "
+       "ST=\\x00A\\x00n\\x00o\\x00t\\x00h\\x00e\\x00r\\x00 "
+       "\\x00S\\x00t\\x00a\\x00t\\x00e\\x00 &\\x03/"
+       "1.2.840.113554.4.1.72585.2=\\x00\\x00&\\x03/"
+       "1.2.840.113554.4.1.72585.3=0\\x06\\x02\\x01\\x01\\x02\\x01\\x02, "
+       "O=Org Name, "
+       "CN=Common Name, "
+       "CN=A, CN=B,CN=A,CN=B+CN=A+CN=B;CN=A;CN=B\\x0ACN=A\\x0A, "
+       "CN= spaces "},
+  };
+  for (const auto &t : kTests) {
+    SCOPED_TRACE(t.printed);
+    bssl::UniquePtr<BIO> bio(BIO_new(BIO_s_mem()));
+    ASSERT_TRUE(bio);
+    int len = X509_NAME_print_ex(bio.get(), name.get(), t.indent, t.flags);
+    ASSERT_GT(len, 0);
+
+    const uint8_t *printed;
+    size_t printed_len;
+    ASSERT_TRUE(BIO_mem_contents(bio.get(), &printed, &printed_len));
+    EXPECT_EQ(std::string(printed, printed + printed_len), t.printed);
+    if (t.flags != XN_FLAG_COMPAT) {
+      // TODO(davidben): |XN_FLAG_COMPAT| does not return the length.
+      EXPECT_EQ(static_cast<size_t>(len), printed_len);
+
+      // Passing a null |BIO| measures the output instead.
+      len = X509_NAME_print_ex(nullptr, name.get(), t.indent, t.flags);
+      EXPECT_GT(len, 0);
+      EXPECT_EQ(static_cast<size_t>(len), printed_len);
+    }
+  }
+
+  // TODO(davidben): This escapes the underlying bytes in the string, but that
+  // is ambiguous without capturing the type. Should this escape like
+  // |ASN1_STRFLGS_UTF8_CONVERT| instead?
+  static const char *kOnelineComponents[] = {
+      "/C=US",
+      "/ST=Some State",
+      "/ST=Some Other State \\xE2\\x98\\x83",
+      "/ST=\\x00A\\x00n\\x00o\\x00t\\x00h\\x00e\\x00r\\x00 "
+      "\\x00S\\x00t\\x00a\\x00t\\x00e\\x00 &\\x03",
+      "/1.2.840.113554.4.1.72585.2=\\x00\\x00&\\x03",
+      "/1.2.840.113554.4.1.72585.3=0\\x06\\x02\\x01\\x01\\x02\\x01\\x02",
+      "/O=Org Name",
+      "/CN=Common Name/CN=A/CN=B,CN=A,CN=B+CN=A+CN=B;CN=A;CN=B\\x0ACN=A\\x0A",
+      "/CN= spaces ",
+  };
+  std::string oneline_expected;
+  for (const auto& component : kOnelineComponents) {
+    oneline_expected += component;
+  }
+
+  // Given null buffer, |X509_NAME_oneline| allocates a new output.
+  bssl::UniquePtr<char> oneline(X509_NAME_oneline(name.get(), nullptr, 0));
+  ASSERT_TRUE(oneline);
+  EXPECT_EQ(oneline.get(), oneline_expected);
+
+  // Otherwise it writes to the specified buffer. Note one extra byte is needed
+  // for the trailing NUL.
+  char buf[1024];
+  ASSERT_GE(sizeof(buf), oneline_expected.size() + 2);
+  ASSERT_EQ(buf,
+            X509_NAME_oneline(name.get(), buf, oneline_expected.size() + 1));
+  EXPECT_EQ(buf, oneline_expected);
+
+  memset(buf, 'a', sizeof(buf));
+  ASSERT_EQ(buf,
+            X509_NAME_oneline(name.get(), buf, oneline_expected.size() + 2));
+  EXPECT_EQ(buf, oneline_expected);
+
+  // If the length is too small, |X509_NAME_oneline| truncates at name
+  // entry boundaries.
+  EXPECT_EQ(nullptr, X509_NAME_oneline(name.get(), buf, 0));
+  for (size_t len = 1; len < oneline_expected.size(); len++) {
+    SCOPED_TRACE(len);
+    memset(buf, 'a', sizeof(buf));
+    EXPECT_EQ(buf, X509_NAME_oneline(name.get(), buf, len));
+
+    std::string truncated;
+    for (const auto& component : kOnelineComponents) {
+      if (truncated.size() + strlen(component) + 1 > len) {
+        break;
+      }
+      truncated += component;
+    }
+    EXPECT_EQ(buf, truncated);
+  }
+}
+
+// kLargeSerialPEM is a certificate with a large serial number.
+static const char kLargeSerialPEM[] = R"(
+-----BEGIN CERTIFICATE-----
+MIICZjCCAc+gAwIBAgIQASNFZ4mrze8BI0VniavN7zANBgkqhkiG9w0BAQsFADA2
+MRowGAYDVQQKExFCb3JpbmdTU0wgVEVTVElORzEYMBYGA1UEAxMPSW50ZXJtZWRp
+YXRlIENBMCAXDTE1MDEwMTAwMDAwMFoYDzIxMDAwMTAxMDAwMDAwWjAyMRowGAYD
+VQQKExFCb3JpbmdTU0wgVEVTVElORzEUMBIGA1UEAxMLZXhhbXBsZS5jb20wgZ8w
+DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMPRTRliCpKEnug6OzI0rJVcQep5p+aT
+9sCg+pj+HVyg/DYTwqZ6qJRKhM+MbkhdJuU7FyqlsBeCeM/OjwMjcY0yEB/xJg1i
+ygfuBztTLuPnHxtSuKwae5MeqSofp3j97sRMnuLcKlHxu8rXoOCAS9BO50uKnPwU
+Ee1iEVqR92FPAgMBAAGjdzB1MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggr
+BgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAZBgNVHQ4EEgQQo3mm9u6v
+uaVeN4wRgDTidTAbBgNVHSMEFDASgBCMGmiotXbbXVd7H40UsgajMA0GCSqGSIb3
+DQEBCwUAA4GBAGP+n4kKGn/8uddYLWTXbUsz+KLuEXNDMyu3vRufLjTpIbP2MCNo
+85fhLeC3fzKuGOk+6QGVLOBBcWDrrLqrmqnWdBMPULDo2QoF71a4GVjeJh+ax/tZ
+PyeGVPUK21TE0LDIxf2a11d1CJw582MgZQIPk4tXk+AcU9EqIceKgECG
+-----END CERTIFICATE-----
+)";
+
+TEST(X509Test, Print) {
+  bssl::UniquePtr<X509> cert(CertFromPEM(kLargeSerialPEM));
+  ASSERT_TRUE(cert);
+
+  bssl::UniquePtr<BIO> bio(BIO_new(BIO_s_mem()));
+  ASSERT_TRUE(bio);
+  EXPECT_TRUE(X509_print_ex(bio.get(), cert.get(), 0, 0));
+  // Nothing should be left in the error queue.
+  EXPECT_EQ(0u, ERR_peek_error());
+
+  // This output is not guaranteed to be stable, but we assert on it to make
+  // sure something is printed.
+  const uint8_t *data;
+  size_t data_len;
+  ASSERT_TRUE(BIO_mem_contents(bio.get(), &data, &data_len));
+  std::string print(reinterpret_cast<const char*>(data), data_len);
+  EXPECT_EQ(print, R"(Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            01:23:45:67:89:ab:cd:ef:01:23:45:67:89:ab:cd:ef
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=BoringSSL TESTING, CN=Intermediate CA
+        Validity
+            Not Before: Jan  1 00:00:00 2015 GMT
+            Not After : Jan  1 00:00:00 2100 GMT
+        Subject: O=BoringSSL TESTING, CN=example.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (1024 bit)
+                Modulus:
+                    00:c3:d1:4d:19:62:0a:92:84:9e:e8:3a:3b:32:34:
+                    ac:95:5c:41:ea:79:a7:e6:93:f6:c0:a0:fa:98:fe:
+                    1d:5c:a0:fc:36:13:c2:a6:7a:a8:94:4a:84:cf:8c:
+                    6e:48:5d:26:e5:3b:17:2a:a5:b0:17:82:78:cf:ce:
+                    8f:03:23:71:8d:32:10:1f:f1:26:0d:62:ca:07:ee:
+                    07:3b:53:2e:e3:e7:1f:1b:52:b8:ac:1a:7b:93:1e:
+                    a9:2a:1f:a7:78:fd:ee:c4:4c:9e:e2:dc:2a:51:f1:
+                    bb:ca:d7:a0:e0:80:4b:d0:4e:e7:4b:8a:9c:fc:14:
+                    11:ed:62:11:5a:91:f7:61:4f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Subject Key Identifier: 
+                A3:79:A6:F6:EE:AF:B9:A5:5E:37:8C:11:80:34:E2:75
+            X509v3 Authority Key Identifier: 
+                keyid:8C:1A:68:A8:B5:76:DB:5D:57:7B:1F:8D:14:B2:06:A3
+
+    Signature Algorithm: sha256WithRSAEncryption
+         63:fe:9f:89:0a:1a:7f:fc:b9:d7:58:2d:64:d7:6d:4b:33:f8:
+         a2:ee:11:73:43:33:2b:b7:bd:1b:9f:2e:34:e9:21:b3:f6:30:
+         23:68:f3:97:e1:2d:e0:b7:7f:32:ae:18:e9:3e:e9:01:95:2c:
+         e0:41:71:60:eb:ac:ba:ab:9a:a9:d6:74:13:0f:50:b0:e8:d9:
+         0a:05:ef:56:b8:19:58:de:26:1f:9a:c7:fb:59:3f:27:86:54:
+         f5:0a:db:54:c4:d0:b0:c8:c5:fd:9a:d7:57:75:08:9c:39:f3:
+         63:20:65:02:0f:93:8b:57:93:e0:1c:53:d1:2a:21:c7:8a:80:
+         40:86
+)");
+}
diff --git a/src/crypto/x509/x509_vfy.c b/src/crypto/x509/x509_vfy.c
index 2dfdce2..f41ae6e 100644
--- a/src/crypto/x509/x509_vfy.c
+++ b/src/crypto/x509/x509_vfy.c
@@ -190,8 +190,8 @@
     X509_VERIFY_PARAM *param = ctx->param;
     int depth, i, ok = 0;
     int num, j, retry, trust;
-    int (*cb) (int xok, X509_STORE_CTX *xctx);
     STACK_OF(X509) *sktmp = NULL;
+
     if (ctx->cert == NULL) {
         OPENSSL_PUT_ERROR(X509, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY);
         ctx->error = X509_V_ERR_INVALID_CALL;
@@ -207,8 +207,6 @@
         return -1;
     }
 
-    cb = ctx->verify_cb;
-
     /*
      * first we make sure the chain we are going to build is present and that
      * the first entry is in place
@@ -331,7 +329,7 @@
                     if (ok == 1)
                         X509_free(xtmp);
                     bad_chain = 1;
-                    ok = cb(0, ctx);
+                    ok = ctx->verify_cb(0, ctx);
                     if (!ok)
                         goto end;
                 } else {
@@ -457,7 +455,7 @@
 
         ctx->error_depth = num - 1;
         bad_chain = 1;
-        ok = cb(0, ctx);
+        ok = ctx->verify_cb(0, ctx);
         if (!ok)
             goto end;
     }
@@ -487,7 +485,7 @@
     if (err != X509_V_OK) {
         ctx->error = err;
         ctx->current_cert = sk_X509_value(ctx->chain, ctx->error_depth);
-        ok = cb(0, ctx);
+        ok = ctx->verify_cb(0, ctx);
         if (!ok)
             goto end;
     }
@@ -577,11 +575,9 @@
 {
     int i, ok = 0, plen = 0;
     X509 *x;
-    int (*cb) (int xok, X509_STORE_CTX *xctx);
     int proxy_path_length = 0;
     int purpose;
     int allow_proxy_certs;
-    cb = ctx->verify_cb;
 
     enum {
         // ca_or_leaf allows either type of certificate so that direct use of
@@ -612,7 +608,7 @@
             ctx->error = X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION;
             ctx->error_depth = i;
             ctx->current_cert = x;
-            ok = cb(0, ctx);
+            ok = ctx->verify_cb(0, ctx);
             if (!ok)
                 goto end;
         }
@@ -620,7 +616,7 @@
             ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
             ctx->error_depth = i;
             ctx->current_cert = x;
-            ok = cb(0, ctx);
+            ok = ctx->verify_cb(0, ctx);
             if (!ok)
                 goto end;
         }
@@ -651,7 +647,7 @@
         if (ret == 0) {
             ctx->error_depth = i;
             ctx->current_cert = x;
-            ok = cb(0, ctx);
+            ok = ctx->verify_cb(0, ctx);
             if (!ok)
                 goto end;
         }
@@ -662,7 +658,7 @@
                 ctx->error = X509_V_ERR_INVALID_PURPOSE;
                 ctx->error_depth = i;
                 ctx->current_cert = x;
-                ok = cb(0, ctx);
+                ok = ctx->verify_cb(0, ctx);
                 if (!ok)
                     goto end;
             }
@@ -674,7 +670,7 @@
             ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
             ctx->error_depth = i;
             ctx->current_cert = x;
-            ok = cb(0, ctx);
+            ok = ctx->verify_cb(0, ctx);
             if (!ok)
                 goto end;
         }
@@ -691,7 +687,7 @@
                 ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
                 ctx->error_depth = i;
                 ctx->current_cert = x;
-                ok = cb(0, ctx);
+                ok = ctx->verify_cb(0, ctx);
                 if (!ok)
                     goto end;
             }
@@ -859,8 +855,6 @@
     size_t i;
     int ok;
     X509 *x = NULL;
-    int (*cb) (int xok, X509_STORE_CTX *xctx);
-    cb = ctx->verify_cb;
     /* Check all trusted certificates in chain */
     for (i = ctx->last_untrusted; i < sk_X509_num(ctx->chain); i++) {
         x = sk_X509_value(ctx->chain, i);
@@ -876,7 +870,7 @@
             ctx->error_depth = i;
             ctx->current_cert = x;
             ctx->error = X509_V_ERR_CERT_REJECTED;
-            ok = cb(0, ctx);
+            ok = ctx->verify_cb(0, ctx);
             if (!ok)
                 return X509_TRUST_REJECTED;
         }
@@ -1792,9 +1786,6 @@
     int ok = 0, n;
     X509 *xs, *xi;
     EVP_PKEY *pkey = NULL;
-    int (*cb) (int xok, X509_STORE_CTX *xctx);
-
-    cb = ctx->verify_cb;
 
     n = sk_X509_num(ctx->chain);
     ctx->error_depth = n - 1;
@@ -1811,7 +1802,7 @@
         if (n <= 0) {
             ctx->error = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;
             ctx->current_cert = xi;
-            ok = cb(0, ctx);
+            ok = ctx->verify_cb(0, ctx);
             goto end;
         } else {
             n--;
@@ -1833,13 +1824,13 @@
             if ((pkey = X509_get_pubkey(xi)) == NULL) {
                 ctx->error = X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY;
                 ctx->current_cert = xi;
-                ok = (*cb) (0, ctx);
+                ok = ctx->verify_cb(0, ctx);
                 if (!ok)
                     goto end;
             } else if (X509_verify(xs, pkey) <= 0) {
                 ctx->error = X509_V_ERR_CERT_SIGNATURE_FAILURE;
                 ctx->current_cert = xs;
-                ok = (*cb) (0, ctx);
+                ok = ctx->verify_cb(0, ctx);
                 if (!ok) {
                     EVP_PKEY_free(pkey);
                     goto end;
@@ -1857,7 +1848,7 @@
         /* The last error (if any) is still in the error value */
         ctx->current_issuer = xi;
         ctx->current_cert = xs;
-        ok = (*cb) (1, ctx);
+        ok = ctx->verify_cb(1, ctx);
         if (!ok)
             goto end;
 
diff --git a/src/crypto/x509/x509cset.c b/src/crypto/x509/x509cset.c
index de32e30..1671f35 100644
--- a/src/crypto/x509/x509cset.c
+++ b/src/crypto/x509/x509cset.c
@@ -64,16 +64,29 @@
 
 int X509_CRL_set_version(X509_CRL *x, long version)
 {
-    /* TODO(https://crbug.com/boringssl/467): Reject invalid version
-     * numbers. Also correctly handle |X509_CRL_VERSION_1|, which should omit
-     * the encoding. */
-    if (x == NULL)
-        return (0);
-    if (x->crl->version == NULL) {
-        if ((x->crl->version = ASN1_INTEGER_new()) == NULL)
-            return (0);
+    if (x == NULL) {
+        return 0;
     }
-    return (ASN1_INTEGER_set(x->crl->version, version));
+
+    if (version < X509_CRL_VERSION_1 || version > X509_CRL_VERSION_2) {
+        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+        return 0;
+    }
+
+    /* v1(0) is default and is represented by omitting the version. */
+    if (version == X509_CRL_VERSION_1) {
+        ASN1_INTEGER_free(x->crl->version);
+        x->crl->version = NULL;
+        return 1;
+    }
+
+    if (x->crl->version == NULL) {
+        x->crl->version = ASN1_INTEGER_new();
+        if (x->crl->version == NULL) {
+            return 0;
+        }
+    }
+    return ASN1_INTEGER_set(x->crl->version, version);
 }
 
 int X509_CRL_set_issuer_name(X509_CRL *x, X509_NAME *name)
diff --git a/src/crypto/x509/x509rset.c b/src/crypto/x509/x509rset.c
index 5526b23..c69f8cb 100644
--- a/src/crypto/x509/x509rset.c
+++ b/src/crypto/x509/x509rset.c
@@ -64,11 +64,14 @@
 
 int X509_REQ_set_version(X509_REQ *x, long version)
 {
-    /* TODO(https://crbug.com/boringssl/467): Reject invalid version
-     * numbers. */
-    if (x == NULL)
-        return (0);
-    return (ASN1_INTEGER_set(x->req_info->version, version));
+    if (x == NULL) {
+        return 0;
+    }
+    if (version != X509_REQ_VERSION_1) {
+        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+        return 0;
+    }
+    return ASN1_INTEGER_set(x->req_info->version, version);
 }
 
 int X509_REQ_set_subject_name(X509_REQ *x, X509_NAME *name)
diff --git a/src/crypto/x509/x_crl.c b/src/crypto/x509/x_crl.c
index ab2a039..6701963 100644
--- a/src/crypto/x509/x_crl.c
+++ b/src/crypto/x509/x_crl.c
@@ -68,24 +68,6 @@
 #include "../internal.h"
 #include "internal.h"
 
-/*
- * Method to handle CRL access. In general a CRL could be very large (several
- * Mb) and can consume large amounts of resources if stored in memory by
- * multiple processes. This method allows general CRL operations to be
- * redirected to more efficient callbacks: for example a CRL entry database.
- */
-
-#define X509_CRL_METHOD_DYNAMIC         1
-
-struct x509_crl_method_st {
-    int flags;
-    int (*crl_init) (X509_CRL *crl);
-    int (*crl_free) (X509_CRL *crl);
-    int (*crl_lookup) (X509_CRL *crl, X509_REVOKED **ret,
-                       ASN1_INTEGER *ser, X509_NAME *issuer);
-    int (*crl_verify) (X509_CRL *crl, EVP_PKEY *pk);
-};
-
 static int X509_REVOKED_cmp(const X509_REVOKED **a, const X509_REVOKED **b);
 static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp);
 
@@ -95,19 +77,8 @@
         ASN1_SEQUENCE_OF_OPT(X509_REVOKED,extensions, X509_EXTENSION)
 } ASN1_SEQUENCE_END(X509_REVOKED)
 
-static int def_crl_verify(X509_CRL *crl, EVP_PKEY *r);
-static int def_crl_lookup(X509_CRL *crl,
-                          X509_REVOKED **ret, ASN1_INTEGER *serial,
-                          X509_NAME *issuer);
-
-static const X509_CRL_METHOD int_crl_meth = {
-    0,
-    0, 0,
-    def_crl_lookup,
-    def_crl_verify
-};
-
-static const X509_CRL_METHOD *default_crl_method = &int_crl_meth;
+static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial,
+                      X509_NAME *issuer);
 
 /*
  * The X509_CRL_INFO structure needs a bit of customisation. Since we cache
@@ -127,12 +98,6 @@
          * affect the output of X509_CRL_print().
          */
     case ASN1_OP_D2I_POST:
-        /* TODO(https://crbug.com/boringssl/467): Reject invalid version
-         * numbers.
-         *
-         * TODO(davidben): Check that default |versions| are never encoded and
-         * that |extensions| is only present in v2. */
-
         (void)sk_X509_REVOKED_set_cmp_func(a->revoked, X509_REVOKED_cmp);
         break;
     }
@@ -243,14 +208,31 @@
         crl->flags = 0;
         crl->idp_flags = 0;
         crl->idp_reasons = CRLDP_ALL_REASONS;
-        crl->meth = default_crl_method;
-        crl->meth_data = NULL;
         crl->issuers = NULL;
         crl->crl_number = NULL;
         crl->base_crl_number = NULL;
         break;
 
-    case ASN1_OP_D2I_POST:
+    case ASN1_OP_D2I_POST: {
+        /* The version must be one of v1(0) or v2(1). */
+        long version = X509_CRL_VERSION_1;
+        if (crl->crl->version != NULL) {
+            version = ASN1_INTEGER_get(crl->crl->version);
+            /* TODO(https://crbug.com/boringssl/364): |X509_CRL_VERSION_1|
+             * should also be rejected. This means an explicitly-encoded X.509v1
+             * version. v1 is DEFAULT, so DER requires it be omitted. */
+            if (version < X509_CRL_VERSION_1 || version > X509_CRL_VERSION_2) {
+                OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+                return 0;
+            }
+        }
+
+        /* Per RFC 5280, section 5.1.2.1, extensions require v2. */
+        if (version != X509_CRL_VERSION_2 && crl->crl->extensions != NULL) {
+            OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
+            return 0;
+        }
+
         if (!X509_CRL_digest(crl, EVP_sha256(), crl->crl_hash, NULL)) {
             return 0;
         }
@@ -319,23 +301,12 @@
         if (!crl_set_issuers(crl))
             return 0;
 
-        if (crl->meth->crl_init) {
-            if (crl->meth->crl_init(crl) == 0)
-                return 0;
-        }
         break;
+    }
 
     case ASN1_OP_FREE_POST:
-        /* |crl->meth| may be NULL if constructing the object failed before
-         * |ASN1_OP_NEW_POST| was run. */
-        if (crl->meth && crl->meth->crl_free) {
-            if (!crl->meth->crl_free(crl))
-                return 0;
-        }
-        if (crl->akid)
-            AUTHORITY_KEYID_free(crl->akid);
-        if (crl->idp)
-            ISSUING_DIST_POINT_free(crl->idp);
+        AUTHORITY_KEYID_free(crl->akid);
+        ISSUING_DIST_POINT_free(crl->idp);
         ASN1_INTEGER_free(crl->crl_number);
         ASN1_INTEGER_free(crl->base_crl_number);
         sk_GENERAL_NAMES_pop_free(crl->issuers, GENERAL_NAMES_free);
@@ -417,37 +388,25 @@
 
 int X509_CRL_verify(X509_CRL *crl, EVP_PKEY *pkey)
 {
-    if (crl->meth->crl_verify)
-        return crl->meth->crl_verify(crl, pkey);
-    return 0;
-}
-
-int X509_CRL_get0_by_serial(X509_CRL *crl,
-                            X509_REVOKED **ret, ASN1_INTEGER *serial)
-{
-    if (crl->meth->crl_lookup)
-        return crl->meth->crl_lookup(crl, ret, serial, NULL);
-    return 0;
-}
-
-int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x)
-{
-    if (crl->meth->crl_lookup)
-        return crl->meth->crl_lookup(crl, ret,
-                                     X509_get_serialNumber(x),
-                                     X509_get_issuer_name(x));
-    return 0;
-}
-
-static int def_crl_verify(X509_CRL *crl, EVP_PKEY *r)
-{
     if (X509_ALGOR_cmp(crl->sig_alg, crl->crl->sig_alg) != 0) {
         OPENSSL_PUT_ERROR(X509, X509_R_SIGNATURE_ALGORITHM_MISMATCH);
         return 0;
     }
 
-    return (ASN1_item_verify(ASN1_ITEM_rptr(X509_CRL_INFO),
-                             crl->sig_alg, crl->signature, crl->crl, r));
+    return ASN1_item_verify(ASN1_ITEM_rptr(X509_CRL_INFO),
+                            crl->sig_alg, crl->signature, crl->crl, pkey);
+}
+
+int X509_CRL_get0_by_serial(X509_CRL *crl,
+                            X509_REVOKED **ret, ASN1_INTEGER *serial)
+{
+    return crl_lookup(crl, ret, serial, NULL);
+}
+
+int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x)
+{
+    return crl_lookup(crl, ret, X509_get_serialNumber(x),
+                      X509_get_issuer_name(x));
 }
 
 static int crl_revoked_issuer_match(X509_CRL *crl, X509_NAME *nm,
@@ -479,9 +438,8 @@
 
 static struct CRYPTO_STATIC_MUTEX g_crl_sort_lock = CRYPTO_STATIC_MUTEX_INIT;
 
-static int def_crl_lookup(X509_CRL *crl,
-                          X509_REVOKED **ret, ASN1_INTEGER *serial,
-                          X509_NAME *issuer)
+static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial,
+                      X509_NAME *issuer)
 {
     X509_REVOKED rtmp, *rev;
     size_t idx;
@@ -520,49 +478,3 @@
     }
     return 0;
 }
-
-void X509_CRL_set_default_method(const X509_CRL_METHOD *meth)
-{
-    if (meth == NULL)
-        default_crl_method = &int_crl_meth;
-    else
-        default_crl_method = meth;
-}
-
-X509_CRL_METHOD *X509_CRL_METHOD_new(int (*crl_init) (X509_CRL *crl),
-                                     int (*crl_free) (X509_CRL *crl),
-                                     int (*crl_lookup) (X509_CRL *crl,
-                                                        X509_REVOKED **ret,
-                                                        ASN1_INTEGER *ser,
-                                                        X509_NAME *issuer),
-                                     int (*crl_verify) (X509_CRL *crl,
-                                                        EVP_PKEY *pk))
-{
-    X509_CRL_METHOD *m;
-    m = OPENSSL_malloc(sizeof(X509_CRL_METHOD));
-    if (!m)
-        return NULL;
-    m->crl_init = crl_init;
-    m->crl_free = crl_free;
-    m->crl_lookup = crl_lookup;
-    m->crl_verify = crl_verify;
-    m->flags = X509_CRL_METHOD_DYNAMIC;
-    return m;
-}
-
-void X509_CRL_METHOD_free(X509_CRL_METHOD *m)
-{
-    if (!(m->flags & X509_CRL_METHOD_DYNAMIC))
-        return;
-    OPENSSL_free(m);
-}
-
-void X509_CRL_set_meth_data(X509_CRL *crl, void *dat)
-{
-    crl->meth_data = dat;
-}
-
-void *X509_CRL_get_meth_data(X509_CRL *crl)
-{
-    return crl->meth_data;
-}
diff --git a/src/crypto/x509/x_req.c b/src/crypto/x509/x_req.c
index 590f84d..0893918 100644
--- a/src/crypto/x509/x_req.c
+++ b/src/crypto/x509/x_req.c
@@ -83,8 +83,13 @@
             return 0;
     }
 
-    /* TODO(https://crbug.com/boringssl/467): Add an |ASN1_OP_D2I_POST| callback
-     * and check the version. */
+    if (operation == ASN1_OP_D2I_POST) {
+        if (ASN1_INTEGER_get(rinf->version) != X509_REQ_VERSION_1) {
+            OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+            return 0;
+        }
+    }
+
     return 1;
 }
 
diff --git a/src/crypto/x509/x_x509.c b/src/crypto/x509/x_x509.c
index 9d350bd..6586b4c 100644
--- a/src/crypto/x509/x_x509.c
+++ b/src/crypto/x509/x_x509.c
@@ -117,27 +117,27 @@
 
     case ASN1_OP_D2I_POST: {
         /* The version must be one of v1(0), v2(1), or v3(2). */
-        long version = 0;
+        long version = X509_VERSION_1;
         if (ret->cert_info->version != NULL) {
             version = ASN1_INTEGER_get(ret->cert_info->version);
-            /* TODO(https://crbug.com/boringssl/364): |version| = 0 should also
-             * be rejected. This means an explicitly-encoded X.509v1 version.
-             * v1 is DEFAULT, so DER requires it be omitted. */
-            if (version < 0 || version > 2) {
+            /* TODO(https://crbug.com/boringssl/364): |X509_VERSION_1| should
+             * also be rejected here. This means an explicitly-encoded X.509v1
+             * version. v1 is DEFAULT, so DER requires it be omitted. */
+            if (version < X509_VERSION_1 || version > X509_VERSION_3) {
                 OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
                 return 0;
             }
         }
 
         /* Per RFC 5280, section 4.1.2.8, these fields require v2 or v3. */
-        if (version == 0 && (ret->cert_info->issuerUID != NULL ||
-                             ret->cert_info->subjectUID != NULL)) {
+        if (version == X509_VERSION_1 && (ret->cert_info->issuerUID != NULL ||
+                                          ret->cert_info->subjectUID != NULL)) {
             OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
             return 0;
         }
 
         /* Per RFC 5280, section 4.1.2.9, extensions require v3. */
-        if (version != 2 && ret->cert_info->extensions != NULL) {
+        if (version != X509_VERSION_3 && ret->cert_info->extensions != NULL) {
             OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
             return 0;
         }
diff --git a/src/include/openssl/aead.h b/src/include/openssl/aead.h
index 38eb076..5486b4b 100644
--- a/src/include/openssl/aead.h
+++ b/src/include/openssl/aead.h
@@ -212,15 +212,15 @@
   uint64_t alignment;
 };
 
-// An EVP_AEAD_CTX represents an AEAD algorithm configured with a specific key
-// and message-independent IV.
-typedef struct evp_aead_ctx_st {
+// An evp_aead_ctx_st (typedefed as |EVP_AEAD_CTX| in base.h) represents an AEAD
+// algorithm configured with a specific key and message-independent IV.
+struct evp_aead_ctx_st {
   const EVP_AEAD *aead;
   union evp_aead_ctx_st_state state;
   // tag_len may contain the actual length of the authentication tag if it is
   // known at initialization time.
   uint8_t tag_len;
-} EVP_AEAD_CTX;
+};
 
 // EVP_AEAD_MAX_KEY_LENGTH contains the maximum key length used by
 // any AEAD defined in this header.
diff --git a/src/include/openssl/asn1.h b/src/include/openssl/asn1.h
index d6fa2f7..5ae0064 100644
--- a/src/include/openssl/asn1.h
+++ b/src/include/openssl/asn1.h
@@ -1650,6 +1650,8 @@
 // replaced with '.'.
 OPENSSL_EXPORT int ASN1_STRING_print(BIO *out, const ASN1_STRING *str);
 
+// The following flags must not collide with |XN_FLAG_*|.
+
 // ASN1_STRFLGS_ESC_2253 causes characters to be escaped as in RFC 2253, section
 // 2.4.
 #define ASN1_STRFLGS_ESC_2253 1
diff --git a/src/include/openssl/asn1t.h b/src/include/openssl/asn1t.h
index b65272d..75bc6f0 100644
--- a/src/include/openssl/asn1t.h
+++ b/src/include/openssl/asn1t.h
@@ -509,19 +509,8 @@
 
 #define ASN1_ITYPE_MSTRING		0x5
 
-/* Cache for ASN1 tag and length, so we
- * don't keep re-reading it for things
- * like CHOICE
- */
-
-struct ASN1_TLC_st{
-	char valid;	/* Values below are valid */
-	int ret;	/* return value */
-	long plen;	/* length */
-	int ptag;	/* class value */
-	int pclass;	/* class value */
-	int hdrlen;	/* header length */
-};
+/* Deprecated tag and length cache */
+struct ASN1_TLC_st;
 
 /* Typedefs for ASN1 function pointers */
 
diff --git a/src/include/openssl/base.h b/src/include/openssl/base.h
index b630236..4ab9eca 100644
--- a/src/include/openssl/base.h
+++ b/src/include/openssl/base.h
@@ -402,6 +402,7 @@
 typedef struct env_md_ctx_st EVP_MD_CTX;
 typedef struct env_md_st EVP_MD;
 typedef struct evp_aead_st EVP_AEAD;
+typedef struct evp_aead_ctx_st EVP_AEAD_CTX;
 typedef struct evp_cipher_ctx_st EVP_CIPHER_CTX;
 typedef struct evp_cipher_st EVP_CIPHER;
 typedef struct evp_encode_ctx_st EVP_ENCODE_CTX;
@@ -448,7 +449,6 @@
 typedef struct trust_token_method_st TRUST_TOKEN_METHOD;
 typedef struct v3_ext_ctx X509V3_CTX;
 typedef struct x509_attributes_st X509_ATTRIBUTE;
-typedef struct x509_crl_method_st X509_CRL_METHOD;
 typedef struct x509_lookup_st X509_LOOKUP;
 typedef struct x509_lookup_method_st X509_LOOKUP_METHOD;
 typedef struct x509_object_st X509_OBJECT;
diff --git a/src/include/openssl/bytestring.h b/src/include/openssl/bytestring.h
index 199d89c..68c1ba4 100644
--- a/src/include/openssl/bytestring.h
+++ b/src/include/openssl/bytestring.h
@@ -265,6 +265,10 @@
 // also true for empty elements so |*out_indefinite| should be checked). If
 // |out_ber_found| is not NULL then it is set to one if any case of invalid DER
 // but valid BER is found, and to zero otherwise.
+//
+// This function will not successfully parse an end-of-contents (EOC) as an
+// element. Callers parsing indefinite-length encoding must check for EOC
+// separately.
 OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
                                                 unsigned *out_tag,
                                                 size_t *out_header_len,
diff --git a/src/include/openssl/crypto.h b/src/include/openssl/crypto.h
index 117b347..b1f696f 100644
--- a/src/include/openssl/crypto.h
+++ b/src/include/openssl/crypto.h
@@ -178,6 +178,9 @@
 // |BORINGSSL_FIPS| and zero otherwise.
 OPENSSL_EXPORT int FIPS_mode_set(int on);
 
+// FIPS_module_name returns the name of the FIPS module.
+OPENSSL_EXPORT const char *FIPS_module_name(void);
+
 // FIPS_version returns the version of the FIPS module, or zero if the build
 // isn't exactly at a verified version. The version, expressed in base 10, will
 // be a date in the form yyyymmddXX where XX is often "00", but can be
diff --git a/src/include/openssl/pkcs8.h b/src/include/openssl/pkcs8.h
index 968640b..8774681 100644
--- a/src/include/openssl/pkcs8.h
+++ b/src/include/openssl/pkcs8.h
@@ -122,6 +122,8 @@
 // and decrypts it using |password|, sets |*out_key| to the included private
 // key and appends the included certificates to |out_certs|. It returns one on
 // success and zero on error. The caller takes ownership of the outputs.
+// Any friendlyName attributes (RFC 2985) in the PKCS#12 structure will be
+// returned on the |X509| objects as aliases. See also |X509_alias_get0|.
 OPENSSL_EXPORT int PKCS12_get_key_and_certs(EVP_PKEY **out_key,
                                             STACK_OF(X509) *out_certs,
                                             CBS *in, const char *password);
@@ -219,6 +221,11 @@
 // implemented for compatibility with external packages. Note the output still
 // requires a password for the MAC. Unencrypted keys in PKCS#12 are also not
 // widely supported and may not open in other implementations.
+//
+// If |cert| or |chain| have associated aliases (see |X509_alias_set1|), they
+// will be included in the output as friendlyName attributes (RFC 2985). It is
+// an error to specify both an alias on |cert| and a non-NULL |name|
+// parameter.
 OPENSSL_EXPORT PKCS12 *PKCS12_create(const char *password, const char *name,
                                      const EVP_PKEY *pkey, X509 *cert,
                                      const STACK_OF(X509) *chain, int key_nid,
@@ -278,5 +285,6 @@
 #define PKCS8_R_UNSUPPORTED_PRF 130
 #define PKCS8_R_INVALID_CHARACTERS 131
 #define PKCS8_R_UNSUPPORTED_OPTIONS 132
+#define PKCS8_R_AMBIGUOUS_FRIENDLY_NAME 133
 
 #endif  // OPENSSL_HEADER_PKCS8_H
diff --git a/src/include/openssl/service_indicator.h b/src/include/openssl/service_indicator.h
new file mode 100644
index 0000000..33b38b2
--- /dev/null
+++ b/src/include/openssl/service_indicator.h
@@ -0,0 +1,96 @@
+/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_SERVICE_INDICATOR_H
+#define OPENSSL_HEADER_SERVICE_INDICATOR_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+// FIPS_service_indicator_before_call and |FIPS_service_indicator_after_call|
+// both currently return the same local thread counter which is slowly
+// incremented whenever approved services are called. The
+// |CALL_SERVICE_AND_CHECK_APPROVED| macro is strongly recommended over calling
+// these functions directly.
+//
+// |FIPS_service_indicator_before_call| is intended to be called immediately
+// before an approved service, while |FIPS_service_indicator_after_call| should
+// be called immediately after. If the values returned from these two functions
+// are not equal, this means that the service called inbetween is deemed to be
+// approved. If the values are still the same, this means the counter has not
+// been incremented, and the service called is not approved for FIPS.
+//
+// In non-FIPS builds, |FIPS_service_indicator_before_call| always returns zero
+// and |FIPS_service_indicator_after_call| always returns one. Thus calls always
+// appear to be approved. This is intended to simplify testing.
+OPENSSL_EXPORT uint64_t FIPS_service_indicator_before_call(void);
+OPENSSL_EXPORT uint64_t FIPS_service_indicator_after_call(void);
+
+#if defined(__cplusplus)
+}
+
+#if !defined(BORINGSSL_NO_CXX)
+
+extern "C++" {
+
+// CALL_SERVICE_AND_CHECK_APPROVED runs |func| and sets |approved| to one of the
+// |FIPSStatus*| values, above, depending on whether |func| invoked an
+// approved service. The result of |func| becomes the result of this macro.
+#define CALL_SERVICE_AND_CHECK_APPROVED(approved, func)         \
+  [&] {                                                       \
+    bssl::FIPSIndicatorHelper fips_indicator_helper(&approved); \
+    return func;                                                \
+  }()
+
+namespace bssl {
+
+enum class FIPSStatus {
+  NOT_APPROVED = 0,
+  APPROVED = 1,
+};
+
+// FIPSIndicatorHelper records whether the service indicator counter advanced
+// during its lifetime.
+class FIPSIndicatorHelper {
+ public:
+  FIPSIndicatorHelper(FIPSStatus *result)
+      : result_(result), before_(FIPS_service_indicator_before_call()) {
+    *result_ = FIPSStatus::NOT_APPROVED;
+  }
+
+  ~FIPSIndicatorHelper() {
+    uint64_t after = FIPS_service_indicator_after_call();
+    if (after != before_) {
+      *result_ = FIPSStatus::APPROVED;
+    }
+  }
+
+  FIPSIndicatorHelper(const FIPSIndicatorHelper&) = delete;
+  FIPSIndicatorHelper &operator=(const FIPSIndicatorHelper &) = delete;
+
+ private:
+  FIPSStatus *const result_;
+  const uint64_t before_;
+};
+
+}  // namespace bssl
+}  // extern "C++"
+
+#endif  // !BORINGSSL_NO_CXX
+#endif  // __cplusplus
+
+#endif  // OPENSSL_HEADER_SERVICE_INDICATOR_H
diff --git a/src/include/openssl/span.h b/src/include/openssl/span.h
index 38e9a96..67a1a5c 100644
--- a/src/include/openssl/span.h
+++ b/src/include/openssl/span.h
@@ -99,12 +99,11 @@
   // Heuristically test whether C is a container type that can be converted into
   // a Span by checking for data() and size() member functions.
   //
-  // TODO(davidben): Require C++14 support and switch to std::enable_if_t.
-  // Perhaps even C++17 now?
+  // TODO(davidben): Require C++17 support for std::is_convertible_v, etc.
   template <typename C>
-  using EnableIfContainer = typename std::enable_if<
+  using EnableIfContainer = std::enable_if_t<
       std::is_convertible<decltype(std::declval<C>().data()), T *>::value &&
-      std::is_integral<decltype(std::declval<C>().size())>::value>::type;
+      std::is_integral<decltype(std::declval<C>().size())>::value>;
 
  public:
   constexpr Span() : Span(nullptr, 0) {}
@@ -113,14 +112,12 @@
   template <size_t N>
   constexpr Span(T (&array)[N]) : Span(array, N) {}
 
-  template <
-      typename C, typename = EnableIfContainer<C>,
-      typename = typename std::enable_if<std::is_const<T>::value, C>::type>
+  template <typename C, typename = EnableIfContainer<C>,
+            typename = std::enable_if_t<std::is_const<T>::value, C>>
   Span(const C &container) : data_(container.data()), size_(container.size()) {}
 
-  template <
-      typename C, typename = EnableIfContainer<C>,
-      typename = typename std::enable_if<!std::is_const<T>::value, C>::type>
+  template <typename C, typename = EnableIfContainer<C>,
+            typename = std::enable_if_t<!std::is_const<T>::value, C>>
   explicit Span(C &container)
       : data_(container.data()), size_(container.size()) {}
 
diff --git a/src/include/openssl/ssl.h b/src/include/openssl/ssl.h
index a3b530e..f0ca7f7 100644
--- a/src/include/openssl/ssl.h
+++ b/src/include/openssl/ssl.h
@@ -2281,6 +2281,13 @@
 OPENSSL_EXPORT SSL_SESSION *SSL_process_tls13_new_session_ticket(
     SSL *ssl, const uint8_t *buf, size_t buf_len);
 
+// SSL_CTX_set_num_tickets configures |ctx| to send |num_tickets| immediately
+// after a successful TLS 1.3 handshake as a server. It returns one. Large
+// values of |num_tickets| will be capped within the library.
+//
+// By default, BoringSSL sends two tickets.
+OPENSSL_EXPORT int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets);
+
 
 // Elliptic curve Diffie-Hellman.
 //
diff --git a/src/include/openssl/stack.h b/src/include/openssl/stack.h
index 04e942c..df54713 100644
--- a/src/include/openssl/stack.h
+++ b/src/include/openssl/stack.h
@@ -443,16 +443,14 @@
 
 // Stacks defined with |DEFINE_CONST_STACK_OF| are freed with |sk_free|.
 template <typename Stack>
-struct DeleterImpl<
-    Stack, typename std::enable_if<StackTraits<Stack>::kIsConst>::type> {
+struct DeleterImpl<Stack, std::enable_if_t<StackTraits<Stack>::kIsConst>> {
   static void Free(Stack *sk) { sk_free(reinterpret_cast<_STACK *>(sk)); }
 };
 
 // Stacks defined with |DEFINE_STACK_OF| are freed with |sk_pop_free| and the
 // corresponding type's deleter.
 template <typename Stack>
-struct DeleterImpl<
-    Stack, typename std::enable_if<!StackTraits<Stack>::kIsConst>::type> {
+struct DeleterImpl<Stack, std::enable_if_t<!StackTraits<Stack>::kIsConst>> {
   static void Free(Stack *sk) {
     // sk_FOO_pop_free is defined by macros and bound by name, so we cannot
     // access it from C++ here.
@@ -502,18 +500,17 @@
 };
 
 template <typename Stack>
-using StackIterator = typename std::enable_if<StackTraits<Stack>::kIsStack,
-                                              StackIteratorImpl<Stack>>::type;
+using StackIterator =
+    std::enable_if_t<StackTraits<Stack>::kIsStack, StackIteratorImpl<Stack>>;
 
 }  // namespace internal
 
 // PushToStack pushes |elem| to |sk|. It returns true on success and false on
 // allocation failure.
 template <typename Stack>
-inline
-    typename std::enable_if<!internal::StackTraits<Stack>::kIsConst, bool>::type
-    PushToStack(Stack *sk,
-                UniquePtr<typename internal::StackTraits<Stack>::Type> elem) {
+inline std::enable_if_t<!internal::StackTraits<Stack>::kIsConst, bool>
+PushToStack(Stack *sk,
+            UniquePtr<typename internal::StackTraits<Stack>::Type> elem) {
   if (!sk_push(reinterpret_cast<_STACK *>(sk), elem.get())) {
     return false;
   }
diff --git a/src/include/openssl/type_check.h b/src/include/openssl/type_check.h
index c267938..41de895 100644
--- a/src/include/openssl/type_check.h
+++ b/src/include/openssl/type_check.h
@@ -71,7 +71,12 @@
 // C11 defines the |_Static_assert| keyword and the |static_assert| macro in
 // assert.h. While the former is available at all versions in Clang and GCC, the
 // later depends on libc and, in glibc, depends on being built in C11 mode. We
-// do not require this, for now, so use |_Static_assert| directly.
+// require C11 mode to build the library but, for now, do not require it in
+// public headers. Use |_Static_assert| directly.
+//
+// TODO(davidben): In July 2022, if the C11 change has not been reverted, switch
+// all uses of this macro within the library to C11 |static_assert|. This macro
+// will only be necessary in public headers.
 #define OPENSSL_STATIC_ASSERT(cond, msg) _Static_assert(cond, msg)
 #endif
 
diff --git a/src/include/openssl/x509.h b/src/include/openssl/x509.h
index 3633186..4d312c7 100644
--- a/src/include/openssl/x509.h
+++ b/src/include/openssl/x509.h
@@ -199,7 +199,8 @@
 #define X509_FLAG_NO_ATTRIBUTES (1L << 11)
 #define X509_FLAG_NO_IDS (1L << 12)
 
-// Flags specific to X509_NAME_print_ex()
+// Flags specific to X509_NAME_print_ex(). These flags must not collide with
+// |ASN1_STRFLGS_*|.
 
 // The field separator information
 
@@ -311,11 +312,8 @@
 #define X509_VERSION_2 1
 #define X509_VERSION_3 2
 
-// X509_get_version returns the numerical value of |x509|'s version. Callers may
-// compare the result to the |X509_VERSION_*| constants. Unknown versions are
-// rejected by the parser, but a manually-created |X509| object may encode
-// invalid versions. In that case, the function will return the invalid version,
-// or -1 on overflow.
+// X509_get_version returns the numerical value of |x509|'s version, which will
+// be one of the |X509_VERSION_*| constants.
 OPENSSL_EXPORT long X509_get_version(const X509 *x509);
 
 // X509_set_version sets |x509|'s version to |version|, which should be one of
@@ -393,15 +391,12 @@
 // |EXFLAG_INVALID| bit.
 OPENSSL_EXPORT long X509_get_pathlen(X509 *x509);
 
-// X509_REQ_VERSION_1 is the version constant for |X509_REQ| objects. Note no
-// other versions are defined.
+// X509_REQ_VERSION_1 is the version constant for |X509_REQ| objects. No other
+// versions are defined.
 #define X509_REQ_VERSION_1 0
 
 // X509_REQ_get_version returns the numerical value of |req|'s version. This
-// will be |X509_REQ_VERSION_1| for valid certificate requests. If |req| is
-// invalid, it may return another value, or -1 on overflow.
-//
-// TODO(davidben): Enforce the version number in the parser.
+// will always be |X509_REQ_VERSION_1|.
 OPENSSL_EXPORT long X509_REQ_get_version(const X509_REQ *req);
 
 // X509_REQ_get_subject_name returns |req|'s subject name. Note this function is
@@ -417,11 +412,8 @@
 #define X509_CRL_VERSION_1 0
 #define X509_CRL_VERSION_2 1
 
-// X509_CRL_get_version returns the numerical value of |crl|'s version. Callers
-// may compare the result to |X509_CRL_VERSION_*| constants. If |crl| is
-// invalid, it may return another value, or -1 on overflow.
-//
-// TODO(davidben): Enforce the version number in the parser.
+// X509_CRL_get_version returns the numerical value of |crl|'s version, which
+// will be one of the |X509_CRL_VERSION_*| constants.
 OPENSSL_EXPORT long X509_CRL_get_version(const X509_CRL *crl);
 
 // X509_CRL_get0_lastUpdate returns |crl|'s lastUpdate time.
@@ -480,17 +472,6 @@
 OPENSSL_EXPORT void X509_SIG_getm(X509_SIG *sig, X509_ALGOR **out_alg,
                                   ASN1_OCTET_STRING **out_digest);
 
-OPENSSL_EXPORT void X509_CRL_set_default_method(const X509_CRL_METHOD *meth);
-OPENSSL_EXPORT X509_CRL_METHOD *X509_CRL_METHOD_new(
-    int (*crl_init)(X509_CRL *crl), int (*crl_free)(X509_CRL *crl),
-    int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *ser,
-                      X509_NAME *issuer),
-    int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk));
-OPENSSL_EXPORT void X509_CRL_METHOD_free(X509_CRL_METHOD *m);
-
-OPENSSL_EXPORT void X509_CRL_set_meth_data(X509_CRL *crl, void *dat);
-OPENSSL_EXPORT void *X509_CRL_get_meth_data(X509_CRL *crl);
-
 // X509_get_X509_PUBKEY returns the public key of |x509|. Note this function is
 // not const-correct for legacy reasons. Callers should not modify the returned
 // object.
@@ -816,9 +797,6 @@
 OPENSSL_EXPORT const char *X509_get_default_cert_file_env(void);
 OPENSSL_EXPORT const char *X509_get_default_private_dir(void);
 
-OPENSSL_EXPORT X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey,
-                                          const EVP_MD *md);
-
 DECLARE_ASN1_ENCODE_FUNCTIONS(X509_ALGORS, X509_ALGORS, X509_ALGORS)
 
 DECLARE_ASN1_FUNCTIONS(X509_PUBKEY)
@@ -1087,7 +1065,8 @@
 // X509_REQ_set_version sets |req|'s version to |version|, which should be
 // |X509_REQ_VERSION_1|. It returns one on success and zero on error.
 //
-// Note no versions other than |X509_REQ_VERSION_1| are defined for CSRs.
+// The only defined CSR version is |X509_REQ_VERSION_1|, so there is no need to
+// call this function.
 OPENSSL_EXPORT int X509_REQ_set_version(X509_REQ *req, long version);
 
 // X509_REQ_set_subject_name sets |req|'s subject to a copy of |name|. It
@@ -2398,7 +2377,6 @@
 BORINGSSL_MAKE_DELETER(X509_ATTRIBUTE, X509_ATTRIBUTE_free)
 BORINGSSL_MAKE_DELETER(X509_CRL, X509_CRL_free)
 BORINGSSL_MAKE_UP_REF(X509_CRL, X509_CRL_up_ref)
-BORINGSSL_MAKE_DELETER(X509_CRL_METHOD, X509_CRL_METHOD_free)
 BORINGSSL_MAKE_DELETER(X509_EXTENSION, X509_EXTENSION_free)
 BORINGSSL_MAKE_DELETER(X509_INFO, X509_INFO_free)
 BORINGSSL_MAKE_DELETER(X509_LOOKUP, X509_LOOKUP_free)
diff --git a/src/sources.cmake b/src/sources.cmake
index 3d3465f..4cbc4c5 100644
--- a/src/sources.cmake
+++ b/src/sources.cmake
@@ -38,18 +38,18 @@
   crypto/cipher_extra/test/nist_cavp/tdes_cbc.txt
   crypto/cipher_extra/test/nist_cavp/tdes_ecb.txt
   crypto/curve25519/ed25519_tests.txt
-  crypto/cmac/cavp_3des_cmac_tests.txt
-  crypto/cmac/cavp_aes128_cmac_tests.txt
-  crypto/cmac/cavp_aes192_cmac_tests.txt
-  crypto/cmac/cavp_aes256_cmac_tests.txt
   crypto/ecdh_extra/ecdh_tests.txt
   crypto/evp/evp_tests.txt
   crypto/evp/scrypt_tests.txt
   crypto/fipsmodule/aes/aes_tests.txt
   crypto/fipsmodule/bn/bn_tests.txt
   crypto/fipsmodule/bn/miller_rabin_tests.txt
+  crypto/fipsmodule/cmac/cavp_3des_cmac_tests.txt
+  crypto/fipsmodule/cmac/cavp_aes128_cmac_tests.txt
+  crypto/fipsmodule/cmac/cavp_aes192_cmac_tests.txt
+  crypto/fipsmodule/cmac/cavp_aes256_cmac_tests.txt
   crypto/fipsmodule/ec/ec_scalar_base_mult_tests.txt
-  crypto/fipsmodule/ec/p256-x86_64_tests.txt
+  crypto/fipsmodule/ec/p256-nistz_tests.txt
   crypto/fipsmodule/ecdsa/ecdsa_sign_tests.txt
   crypto/fipsmodule/ecdsa/ecdsa_verify_tests.txt
   crypto/fipsmodule/modes/gcm_tests.txt
diff --git a/src/ssl/CMakeLists.txt b/src/ssl/CMakeLists.txt
index 4f4abf8..67a72ae 100644
--- a/src/ssl/CMakeLists.txt
+++ b/src/ssl/CMakeLists.txt
@@ -41,6 +41,12 @@
   tls13_enc.cc
   tls13_server.cc
 )
+target_include_directories(ssl INTERFACE
+  $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/include>
+  $<INSTALL_INTERFACE:include>
+)
+install(TARGETS ssl EXPORT OpenSSLTargets DESTINATION ${CMAKE_INSTALL_LIBDIR})
+set_property(TARGET ssl PROPERTY EXPORT_NAME SSL)
 
 add_dependencies(ssl global_target)
 
diff --git a/src/ssl/internal.h b/src/ssl/internal.h
index 0087e7f..fbf9745 100644
--- a/src/ssl/internal.h
+++ b/src/ssl/internal.h
@@ -216,7 +216,7 @@
 // may be C structs which require a |BORINGSSL_MAKE_DELETER| registration.
 namespace internal {
 template <typename T>
-struct DeleterImpl<T, typename std::enable_if<T::kAllowUniquePtr>::type> {
+struct DeleterImpl<T, std::enable_if_t<T::kAllowUniquePtr>> {
   static void Free(T *t) { Delete(t); }
 };
 }  // namespace internal
@@ -2056,6 +2056,11 @@
   uint8_t grease_seed[ssl_grease_last_index + 1] = {0};
 };
 
+// kMaxTickets is the maximum number of tickets to send immediately after the
+// handshake. We use a one-byte ticket nonce, and there is no point in sending
+// so many tickets.
+constexpr size_t kMaxTickets = 16;
+
 UniquePtr<SSL_HANDSHAKE> ssl_handshake_new(SSL *ssl);
 
 // ssl_check_message_type checks if |msg| has type |type|. If so it returns
@@ -3416,6 +3421,11 @@
   // and is further constrainted by |SSL_OP_NO_*|.
   uint16_t conf_min_version = 0;
 
+  // num_tickets is the number of tickets to send immediately after the TLS 1.3
+  // handshake. TLS 1.3 recommends single-use tickets so, by default, issue two
+  /// in case the client makes several connections before getting a renewal.
+  uint8_t num_tickets = 2;
+
   // quic_method is the method table corresponding to the QUIC hooks.
   const SSL_QUIC_METHOD *quic_method = nullptr;
 
diff --git a/src/ssl/ssl_cipher.cc b/src/ssl/ssl_cipher.cc
index 60b3e2c..628dddc 100644
--- a/src/ssl/ssl_cipher.cc
+++ b/src/ssl/ssl_cipher.cc
@@ -1327,34 +1327,33 @@
 
 using namespace bssl;
 
-static constexpr int ssl_cipher_id_cmp_inner(const SSL_CIPHER *a,
-                                             const SSL_CIPHER *b) {
-  // C++11's constexpr functions must have a body consisting of just a
-  // return-statement.
-  return (a->id > b->id) ? 1 : ((a->id < b->id) ? -1 : 0);
+static constexpr int ssl_cipher_id_cmp(const SSL_CIPHER *a,
+                                       const SSL_CIPHER *b) {
+  if (a->id > b->id) {
+    return 1;
+  }
+  if (a->id < b->id) {
+    return -1;
+  }
+  return 0;
 }
 
-static int ssl_cipher_id_cmp(const void *in_a, const void *in_b) {
-  return ssl_cipher_id_cmp_inner(reinterpret_cast<const SSL_CIPHER *>(in_a),
-                                 reinterpret_cast<const SSL_CIPHER *>(in_b));
+static int ssl_cipher_id_cmp_void(const void *in_a, const void *in_b) {
+  return ssl_cipher_id_cmp(reinterpret_cast<const SSL_CIPHER *>(in_a),
+                           reinterpret_cast<const SSL_CIPHER *>(in_b));
 }
 
-template <typename T, size_t N>
-static constexpr size_t countof(T const (&)[N]) {
-  return N;
+template <size_t N>
+static constexpr bool ssl_ciphers_sorted(const SSL_CIPHER (&ciphers)[N]) {
+  for (size_t i = 1; i < N; i++) {
+    if (ssl_cipher_id_cmp(&ciphers[i - 1], &ciphers[i]) >= 0) {
+      return false;
+    }
+  }
+  return true;
 }
 
-template <typename T, size_t I>
-static constexpr int check_order(const T (&arr)[I], size_t N) {
-  // C++11's constexpr functions must have a body consisting of just a
-  // return-statement.
-  return N > 1 ? ((ssl_cipher_id_cmp_inner(&arr[N - 2], &arr[N - 1]) < 0)
-                      ? check_order(arr, N - 1)
-                      : 0)
-               : 1;
-}
-
-static_assert(check_order(kCiphers, countof(kCiphers)) == 1,
+static_assert(ssl_ciphers_sorted(kCiphers),
               "Ciphers are not sorted, bsearch won't work");
 
 const SSL_CIPHER *SSL_get_cipher_by_value(uint16_t value) {
@@ -1363,7 +1362,7 @@
   c.id = 0x03000000L | value;
   return reinterpret_cast<const SSL_CIPHER *>(bsearch(
       &c, kCiphers, OPENSSL_ARRAY_SIZE(kCiphers), sizeof(SSL_CIPHER),
-      ssl_cipher_id_cmp));
+      ssl_cipher_id_cmp_void));
 }
 
 uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *cipher) { return cipher->id; }
diff --git a/src/ssl/ssl_lib.cc b/src/ssl/ssl_lib.cc
index e2e2436..5e96bef 100644
--- a/src/ssl/ssl_lib.cc
+++ b/src/ssl/ssl_lib.cc
@@ -140,6 +140,8 @@
 
 #include <openssl/ssl.h>
 
+#include <algorithm>
+
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
@@ -3025,6 +3027,13 @@
   return session.release();
 }
 
+int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets) {
+  num_tickets = std::min(num_tickets, kMaxTickets);
+  static_assert(kMaxTickets <= 0xff, "Too many tickets.");
+  ctx->num_tickets = static_cast<uint8_t>(num_tickets);
+  return 1;
+}
+
 int SSL_set_tlsext_status_type(SSL *ssl, int type) {
   if (!ssl->config) {
     return 0;
diff --git a/src/ssl/ssl_test.cc b/src/ssl/ssl_test.cc
index 567d206..e2db5a4 100644
--- a/src/ssl/ssl_test.cc
+++ b/src/ssl/ssl_test.cc
@@ -8113,5 +8113,51 @@
   }
 }
 
+TEST(SSLTest, NumTickets) {
+  bssl::UniquePtr<SSL_CTX> server_ctx(SSL_CTX_new(TLS_method()));
+  ASSERT_TRUE(server_ctx);
+  bssl::UniquePtr<SSL_CTX> client_ctx(SSL_CTX_new(TLS_method()));
+  ASSERT_TRUE(client_ctx);
+  bssl::UniquePtr<X509> cert = GetTestCertificate();
+  ASSERT_TRUE(cert);
+  bssl::UniquePtr<EVP_PKEY> key = GetTestKey();
+  ASSERT_TRUE(key);
+  ASSERT_TRUE(SSL_CTX_use_certificate(server_ctx.get(), cert.get()));
+  ASSERT_TRUE(SSL_CTX_use_PrivateKey(server_ctx.get(), key.get()));
+  SSL_CTX_set_session_cache_mode(server_ctx.get(), SSL_SESS_CACHE_BOTH);
+
+  SSL_CTX_set_session_cache_mode(client_ctx.get(), SSL_SESS_CACHE_BOTH);
+  static size_t ticket_count;
+  SSL_CTX_sess_set_new_cb(client_ctx.get(), [](SSL *, SSL_SESSION *) -> int {
+    ticket_count++;
+    return 0;
+  });
+
+  auto count_tickets = [&]() -> size_t {
+    ticket_count = 0;
+    bssl::UniquePtr<SSL> client, server;
+    if (!ConnectClientAndServer(&client, &server, client_ctx.get(),
+                                server_ctx.get()) ||
+        !FlushNewSessionTickets(client.get(), server.get())) {
+      ADD_FAILURE() << "Could not run handshake";
+      return 0;
+    }
+    return ticket_count;
+  };
+
+  // By default, we should send two tickets.
+  EXPECT_EQ(count_tickets(), 2u);
+
+  for (size_t num_tickets : {0, 1, 2, 3, 4, 5}) {
+    SCOPED_TRACE(num_tickets);
+    ASSERT_TRUE(SSL_CTX_set_num_tickets(server_ctx.get(), num_tickets));
+    EXPECT_EQ(count_tickets(), num_tickets);
+  }
+
+  // Configuring too many tickets causes us to stop at some point.
+  ASSERT_TRUE(SSL_CTX_set_num_tickets(server_ctx.get(), 100000));
+  EXPECT_EQ(count_tickets(), 16u);
+}
+
 }  // namespace
 BSSL_NAMESPACE_END
diff --git a/src/ssl/tls13_server.cc b/src/ssl/tls13_server.cc
index dbf239d..9a65e0f 100644
--- a/src/ssl/tls13_server.cc
+++ b/src/ssl/tls13_server.cc
@@ -131,15 +131,12 @@
     return true;
   }
 
-  // TLS 1.3 recommends single-use tickets, so issue multiple tickets in case
-  // the client makes several connections before getting a renewal.
-  static const int kNumTickets = 2;
-
   // Rebase the session timestamp so that it is measured from ticket
   // issuance.
   ssl_session_rebase_time(ssl, hs->new_session.get());
 
-  for (int i = 0; i < kNumTickets; i++) {
+  assert(ssl->session_ctx->num_tickets <= kMaxTickets);
+  for (size_t i = 0; i < ssl->session_ctx->num_tickets; i++) {
     UniquePtr<SSL_SESSION> session(
         SSL_SESSION_dup(hs->new_session.get(), SSL_SESSION_INCLUDE_NONAUTH));
     if (!session) {
@@ -160,7 +157,8 @@
           ssl->quic_method != nullptr ? 0xffffffff : kMaxEarlyDataAccepted;
     }
 
-    static_assert(kNumTickets < 256, "Too many tickets");
+    static_assert(kMaxTickets < 256, "Too many tickets");
+    assert(i < 256);
     uint8_t nonce[] = {static_cast<uint8_t>(i)};
 
     ScopedCBB cbb;
diff --git a/src/tool/CMakeLists.txt b/src/tool/CMakeLists.txt
index a591b7d..f98e96e 100644
--- a/src/tool/CMakeLists.txt
+++ b/src/tool/CMakeLists.txt
@@ -21,6 +21,7 @@
   tool.cc
   transport_common.cc
 )
+install(TARGETS bssl DESTINATION ${CMAKE_INSTALL_BINDIR})
 
 add_dependencies(bssl global_target)
 
diff --git a/src/tool/digest.cc b/src/tool/digest.cc
index 3c8fd5a..d810928 100644
--- a/src/tool/digest.cc
+++ b/src/tool/digest.cc
@@ -226,7 +226,6 @@
   unsigned bad_lines = 0;
   unsigned parsed_lines = 0;
   unsigned error_lines = 0;
-  unsigned bad_hash_lines = 0;
   unsigned line_no = 0;
   bool ok = true;
   bool draining_overlong_line = false;
@@ -297,7 +296,6 @@
     }
 
     if (calculated_hex_digest != std::string(line, hex_size)) {
-      bad_hash_lines++;
       if (!args.status) {
         printf("%s: FAILED\n", target_filename.c_str());
       }
diff --git a/src/util/BUILD.toplevel b/src/util/BUILD.toplevel
index cfa695a..1ec2bdf 100644
--- a/src/util/BUILD.toplevel
+++ b/src/util/BUILD.toplevel
@@ -137,9 +137,9 @@
     "//conditions:default": [],
 })
 
-# For C++ targets only (not C), compile with C++11 support.
+# For C++ targets only (not C), compile with C++14 support.
 posix_copts_cxx = [
-    "-std=c++11",
+    "-std=c++14",
     "-Wmissing-declarations",
 ]
 
diff --git a/src/util/bot/DEPS b/src/util/bot/DEPS
index b9d42ef..1efc55a 100644
--- a/src/util/bot/DEPS
+++ b/src/util/bot/DEPS
@@ -25,14 +25,14 @@
   #  cipd describe PACKAGE_NAME -version latest
 
   # infra/3pp/tools/cmake/linux-amd64
-  'cmake_version': 'version:2@3.21.3',
+  'cmake_version': 'version:2@3.23.1',
   # infra/3pp/tools/go/linux-amd64
-  'go_version': 'version:2@1.17.2',
+  'go_version': 'version:2@1.18.2',
 
   # Update the following from
-  # https://chromium.googlesource.com/chromium/src/+/master/DEPS
+  # https://chromium.googlesource.com/chromium/src/+/main/DEPS
   'android_sdk_platform-tools_version': 'g7n_-r6yJd_SGRklujGB1wEt8iyr77FZTUJVS9w6O34C',
-  'android_ndk_revision': '401019bf85744311b26c88ced255cd53401af8b7',
+  'android_ndk_revision': '8388a2be5421311dc75c5f937aae13d821a27f3d',
   'libfuzzer_revision': 'debe7d2d1982e540fbd6bd78604bf001753f9e74',
   'libcxx_revision': '79a2e924d96e2fc1e4b937c42efd08898fa472d7',
   'libcxxabi_revision': '9b8228b4a9be26e0881f36089d9a8d62df851acc',
@@ -53,7 +53,7 @@
     'dep_type': 'cipd',
   },
 
-  # TODO(davidben): Merge cmake-linux64 and cmake-mac. Now that we use CIPD,
+  # TODO(davidben): Merge the three CMake directories. Now that we use CIPD,
   # which supports a ${{platform}} marker, there is nothing platform-specific
   # about this anymore. However, the recipe still expects CMake to be found at
   # these directories, so this needs to be coordinated with a change there.
@@ -75,6 +75,15 @@
     'dep_type': 'cipd',
   },
 
+  'boringssl/util/bot/cmake-win32': {
+    'packages': [{
+      'package': 'infra/3pp/tools/cmake/${{platform}}',
+      'version': Var('cmake_version'),
+    }],
+    'condition': 'host_os == "win"',
+    'dep_type': 'cipd',
+  },
+
   'boringssl/util/bot/golang': {
     'packages': [{
       'package': 'infra/3pp/tools/go/${{platform}}',
@@ -106,28 +115,6 @@
 hooks = [
   # TODO(https://crbug.com/1180257): Use CIPD for CMake on Windows.
   {
-    'name': 'cmake_win32',
-    'pattern': '.',
-    'condition': 'host_os == "win"',
-    'action': [ 'download_from_google_storage',
-                '--no_resume',
-                '--platform=win32',
-                '--no_auth',
-                '--bucket', 'chromium-tools',
-                '-s', 'boringssl/util/bot/cmake-win32.zip.sha1',
-    ],
-  },
-  {
-    'name': 'cmake_win32_extract',
-    'pattern': '.',
-    'condition': 'host_os == "win"',
-    'action': [ 'python3',
-                'boringssl/util/bot/extract.py',
-                'boringssl/util/bot/cmake-win32.zip',
-                'boringssl/util/bot/cmake-win32/',
-    ],
-  },
-  {
     'name': 'perl_win32',
     'pattern': '.',
     'condition': 'host_os == "win"',
diff --git a/src/util/bot/UPDATING b/src/util/bot/UPDATING
index dad6192..1543ed6 100644
--- a/src/util/bot/UPDATING
+++ b/src/util/bot/UPDATING
@@ -12,10 +12,10 @@
 
 update_clang.py: Set CLANG_REVISION and CLANG_SUB_REVISION to the values used in
     Chromium, found at
-    https://chromium.googlesource.com/chromium/src/+/master/tools/clang/scripts/update.py
+    https://chromium.googlesource.com/chromium/src/+/main/tools/clang/scripts/update.py
 
 vs_toolchain.py: Update _GetDesiredVsToolchainHashes from Chromium, found at
-    https://chromium.googlesource.com/chromium/src/+/master/build/vs_toolchain.py
+    https://chromium.googlesource.com/chromium/src/+/main/build/vs_toolchain.py
     This may require taking other updates to that file. (Don't remove MSVC
     versions if BoringSSL still needs to support them.)
 
@@ -24,15 +24,9 @@
 
     upload_to_google_storage.py -b chromium-tools FILE
 
-cmake-win32.zip: Update to the latest prebuilt release of CMake, found at
-    https://cmake.org/download/. Use the file labeled "Windows win64-x64
-    ZIP". The download will be named cmake-VERSION-win64-x64.zip.
-
-    The current revision is cmake-3.19.5-win64-x64.zip
-
 nasm-win32.exe: Update to the appropriate release of NASM, found at
     https://www.nasm.us/. Use the same version as Chromium, found at
-    https://chromium.googlesource.com/chromium/src/+/master/third_party/nasm/README.chromium
+    https://chromium.googlesource.com/chromium/src/+/main/third_party/nasm/README.chromium
     Extract nasm.exe from the download named nasm-VERSION-win64.zip.
 
     The current revision is nasm-2.13.03-win64.zip.
diff --git a/src/util/bot/cmake-win32.zip.sha1 b/src/util/bot/cmake-win32.zip.sha1
deleted file mode 100644
index d641c17..0000000
--- a/src/util/bot/cmake-win32.zip.sha1
+++ /dev/null
@@ -1 +0,0 @@
-b106d66bcdc8a71ea2cdf5446091327bfdb1bcd7
\ No newline at end of file
diff --git a/src/util/bot/update_clang.py b/src/util/bot/update_clang.py
index 6d9f68b..59b0cad 100644
--- a/src/util/bot/update_clang.py
+++ b/src/util/bot/update_clang.py
@@ -28,7 +28,7 @@
 # CLANG_REVISION and CLANG_SUB_REVISION determine the build of clang
 # to use. These should be synced with tools/clang/scripts/update.py in
 # Chromium.
-CLANG_REVISION = 'llvmorg-14-init-6722-g0fbd3aad'
+CLANG_REVISION = 'llvmorg-15-init-10168-gc2a7904a'
 CLANG_SUB_REVISION = 2
 
 PACKAGE_VERSION = '%s-%s' % (CLANG_REVISION, CLANG_SUB_REVISION)
diff --git a/src/util/bot/vs_toolchain.py b/src/util/bot/vs_toolchain.py
index 09f407d..df4637f 100644
--- a/src/util/bot/vs_toolchain.py
+++ b/src/util/bot/vs_toolchain.py
@@ -68,9 +68,9 @@
     # libraries.
     return ['418b3076791776573a815eb298c8aa590307af63']
   if version == '2019':
-    # VS 2019 16.61 with 10.0.19041 SDK, and 10.0.20348 version of
-    # d3dcompiler_47.dll, with ARM64 libraries and UWP support.
-    return ['3bda71a11e']
+    # VS 2019 16.61 with 10.0.20348.0 SDK, 10.0.19041 version of Debuggers
+    # with ARM64 libraries and UWP support.
+    return ['1023ce2e82']
   raise Exception('Unsupported VS version %s' % version)
 
 
diff --git a/src/util/fipstools/acvp/acvptool/acvp.go b/src/util/fipstools/acvp/acvptool/acvp.go
index f477d65..4c7e07c 100644
--- a/src/util/fipstools/acvp/acvptool/acvp.go
+++ b/src/util/fipstools/acvp/acvptool/acvp.go
@@ -185,7 +185,7 @@
 // it's a header.
 func looksLikeHeaderElement(element json.RawMessage) bool {
 	var headerFields struct {
-		URL string `json:"url"`
+		URL       string `json:"url"`
 		Algorithm string `json:"algorithm"`
 	}
 	if err := json.Unmarshal(element, &headerFields); err != nil {
diff --git a/src/util/fipstools/acvp/acvptool/interactive.go b/src/util/fipstools/acvp/acvptool/interactive.go
index b13a549..ee992f1 100644
--- a/src/util/fipstools/acvp/acvptool/interactive.go
+++ b/src/util/fipstools/acvp/acvptool/interactive.go
@@ -12,6 +12,7 @@
 // OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 // CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
+//go:build interactive
 // +build interactive
 
 package main
diff --git a/src/util/fipstools/acvp/acvptool/nointeractive.go b/src/util/fipstools/acvp/acvptool/nointeractive.go
index 06c8890..8aa0839 100644
--- a/src/util/fipstools/acvp/acvptool/nointeractive.go
+++ b/src/util/fipstools/acvp/acvptool/nointeractive.go
@@ -12,6 +12,7 @@
 // OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 // CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
+//go:build !interactive
 // +build !interactive
 
 package main
diff --git a/src/util/fipstools/acvp/acvptool/subprocess/block.go b/src/util/fipstools/acvp/acvptool/subprocess/block.go
index 1b1e93b..f979c86 100644
--- a/src/util/fipstools/acvp/acvptool/subprocess/block.go
+++ b/src/util/fipstools/acvp/acvptool/subprocess/block.go
@@ -18,7 +18,6 @@
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
-	"math/bits"
 )
 
 // aesKeyShuffle is the "AES Monte Carlo Key Shuffle" from the ACVP
@@ -119,113 +118,6 @@
 	return mctResults
 }
 
-// xorKeyWithOddParityLSB XORs value into key while setting the LSB of each bit
-// to establish odd parity. This embedding of a parity check in a DES key is an
-// old tradition and something that NIST's tests require (despite being
-// undocumented).
-func xorKeyWithOddParityLSB(key, value []byte) {
-	for i := range key {
-		v := key[i] ^ value[i]
-		// Use LSB to establish odd parity.
-		v ^= byte((bits.OnesCount8(v) & 1)) ^ 1
-		key[i] = v
-	}
-}
-
-// desKeyShuffle implements the manipulation of the Key arrays in the "TDES
-// Monte Carlo Test - ECB mode" algorithm from the ACVP specification.
-func keyShuffle3DES(key, result, prevResult, prevPrevResult []byte) {
-	xorKeyWithOddParityLSB(key[:8], result)
-	xorKeyWithOddParityLSB(key[8:16], prevResult)
-	xorKeyWithOddParityLSB(key[16:], prevPrevResult)
-}
-
-// iterate3DES implements "TDES Monte Carlo Test - ECB mode" from the ACVP
-// specification.
-func iterate3DES(transact func(n int, args ...[]byte) ([][]byte, error), encrypt bool, key, input, iv []byte) (mctResults []blockCipherMCTResult) {
-	for i := 0; i < 400; i++ {
-		var iteration blockCipherMCTResult
-		keyHex := hex.EncodeToString(key)
-		iteration.Key1Hex = keyHex[:16]
-		iteration.Key2Hex = keyHex[16:32]
-		iteration.Key3Hex = keyHex[32:]
-
-		if encrypt {
-			iteration.PlaintextHex = hex.EncodeToString(input)
-		} else {
-			iteration.CiphertextHex = hex.EncodeToString(input)
-		}
-
-		results, err := transact(3, key, input, uint32le(10000))
-		if err != nil {
-			panic("block operation failed")
-		}
-		result := results[0]
-		prevResult := results[1]
-		prevPrevResult := results[2]
-
-		if encrypt {
-			iteration.CiphertextHex = hex.EncodeToString(result)
-		} else {
-			iteration.PlaintextHex = hex.EncodeToString(result)
-		}
-
-		keyShuffle3DES(key, result, prevResult, prevPrevResult)
-		mctResults = append(mctResults, iteration)
-		input = result
-	}
-
-	return mctResults
-}
-
-// iterate3DESCBC implements "TDES Monte Carlo Test - CBC mode" from the ACVP
-// specification.
-func iterate3DESCBC(transact func(n int, args ...[]byte) ([][]byte, error), encrypt bool, key, input, iv []byte) (mctResults []blockCipherMCTResult) {
-	for i := 0; i < 400; i++ {
-		var iteration blockCipherMCTResult
-		keyHex := hex.EncodeToString(key)
-		iteration.Key1Hex = keyHex[:16]
-		iteration.Key2Hex = keyHex[16:32]
-		iteration.Key3Hex = keyHex[32:]
-
-		if encrypt {
-			iteration.PlaintextHex = hex.EncodeToString(input)
-		} else {
-			iteration.CiphertextHex = hex.EncodeToString(input)
-		}
-		iteration.IVHex = hex.EncodeToString(iv)
-
-		results, err := transact(3, key, input, iv, uint32le(10000))
-		if err != nil {
-			panic("block operation failed")
-		}
-
-		result := results[0]
-		prevResult := results[1]
-		prevPrevResult := results[2]
-
-		if encrypt {
-			iteration.CiphertextHex = hex.EncodeToString(result)
-		} else {
-			iteration.PlaintextHex = hex.EncodeToString(result)
-		}
-
-		keyShuffle3DES(key, result, prevResult, prevPrevResult)
-
-		if encrypt {
-			input = prevResult
-			iv = result
-		} else {
-			iv = prevResult
-			input = result
-		}
-
-		mctResults = append(mctResults, iteration)
-	}
-
-	return mctResults
-}
-
 // blockCipher implements an ACVP algorithm by making requests to the subprocess
 // to encrypt and decrypt with a block cipher.
 type blockCipher struct {
@@ -256,11 +148,6 @@
 		CiphertextHex string  `json:"ct"`
 		IVHex         string  `json:"iv"`
 		KeyHex        string  `json:"key"`
-
-		// 3DES tests serialise the key differently.
-		Key1Hex string `json:"key1"`
-		Key2Hex string `json:"key2"`
-		Key3Hex string `json:"key3"`
 	} `json:"tests"`
 }
 
@@ -281,11 +168,6 @@
 	PlaintextHex  string `json:"pt"`
 	CiphertextHex string `json:"ct"`
 	IVHex         string `json:"iv,omitempty"`
-
-	// 3DES tests serialise the key differently.
-	Key1Hex string `json:"key1,omitempty"`
-	Key2Hex string `json:"key2,omitempty"`
-	Key3Hex string `json:"key3,omitempty"`
 }
 
 func (b *blockCipher) Process(vectorSet []byte, m Transactable) (interface{}, error) {
@@ -331,11 +213,6 @@
 			return nil, fmt.Errorf("test group %d has unknown type %q", group.ID, group.Type)
 		}
 
-		if group.KeyBits == 0 {
-			// 3DES tests fail to set this parameter.
-			group.KeyBits = 192
-		}
-
 		if group.KeyBits%8 != 0 {
 			return nil, fmt.Errorf("test group %d contains non-byte-multiple key length %d", group.ID, group.KeyBits)
 		}
@@ -346,11 +223,6 @@
 		}
 
 		for _, test := range group.Tests {
-			if len(test.KeyHex) == 0 && len(test.Key1Hex) > 0 {
-				// 3DES encodes the key differently.
-				test.KeyHex = test.Key1Hex + test.Key2Hex + test.Key3Hex
-			}
-
 			if len(test.KeyHex) != keyBytes*2 {
 				return nil, fmt.Errorf("test case %d/%d contains key %q of length %d, but expected %d-bit key", group.ID, test.ID, test.KeyHex, len(test.KeyHex), group.KeyBits)
 			}
diff --git a/src/util/fipstools/acvp/acvptool/subprocess/subprocess.go b/src/util/fipstools/acvp/acvptool/subprocess/subprocess.go
index 844c9c4..c5003e1 100644
--- a/src/util/fipstools/acvp/acvptool/subprocess/subprocess.go
+++ b/src/util/fipstools/acvp/acvptool/subprocess/subprocess.go
@@ -71,38 +71,37 @@
 	}
 
 	m.primitives = map[string]primitive{
-		"SHA-1":            &hashPrimitive{"SHA-1", 20},
-		"SHA2-224":         &hashPrimitive{"SHA2-224", 28},
-		"SHA2-256":         &hashPrimitive{"SHA2-256", 32},
-		"SHA2-384":         &hashPrimitive{"SHA2-384", 48},
-		"SHA2-512":         &hashPrimitive{"SHA2-512", 64},
-		"SHA2-512/256":     &hashPrimitive{"SHA2-512/256", 32},
-		"ACVP-AES-ECB":     &blockCipher{"AES", 16, 2, true, false, iterateAES},
-		"ACVP-AES-CBC":     &blockCipher{"AES-CBC", 16, 2, true, true, iterateAESCBC},
-		"ACVP-AES-CBC-CS3": &blockCipher{"AES-CBC-CS3", 16, 1, false, true, iterateAESCBC},
-		"ACVP-AES-CTR":     &blockCipher{"AES-CTR", 16, 1, false, true, nil},
-		"ACVP-AES-XTS":     &xts{},
-		"ACVP-TDES-ECB":    &blockCipher{"3DES-ECB", 8, 3, true, false, iterate3DES},
-		"ACVP-TDES-CBC":    &blockCipher{"3DES-CBC", 8, 3, true, true, iterate3DESCBC},
-		"ACVP-AES-GCM":     &aead{"AES-GCM", false},
-		"ACVP-AES-GMAC":    &aead{"AES-GCM", false},
-		"ACVP-AES-CCM":     &aead{"AES-CCM", true},
-		"ACVP-AES-KW":      &aead{"AES-KW", false},
-		"ACVP-AES-KWP":     &aead{"AES-KWP", false},
-		"HMAC-SHA-1":       &hmacPrimitive{"HMAC-SHA-1", 20},
-		"HMAC-SHA2-224":    &hmacPrimitive{"HMAC-SHA2-224", 28},
-		"HMAC-SHA2-256":    &hmacPrimitive{"HMAC-SHA2-256", 32},
-		"HMAC-SHA2-384":    &hmacPrimitive{"HMAC-SHA2-384", 48},
-		"HMAC-SHA2-512":    &hmacPrimitive{"HMAC-SHA2-512", 64},
-		"ctrDRBG":          &drbg{"ctrDRBG", map[string]bool{"AES-128": true, "AES-192": true, "AES-256": true}},
-		"hmacDRBG":         &drbg{"hmacDRBG", map[string]bool{"SHA-1": true, "SHA2-224": true, "SHA2-256": true, "SHA2-384": true, "SHA2-512": true}},
-		"KDF":              &kdfPrimitive{},
-		"KAS-KDF":          &hkdf{},
-		"CMAC-AES":         &keyedMACPrimitive{"CMAC-AES"},
-		"RSA":              &rsa{},
-		"kdf-components":   &tlsKDF{},
-		"KAS-ECC-SSC":      &kas{},
-		"KAS-FFC-SSC":      &kasDH{},
+		"SHA-1":             &hashPrimitive{"SHA-1", 20},
+		"SHA2-224":          &hashPrimitive{"SHA2-224", 28},
+		"SHA2-256":          &hashPrimitive{"SHA2-256", 32},
+		"SHA2-384":          &hashPrimitive{"SHA2-384", 48},
+		"SHA2-512":          &hashPrimitive{"SHA2-512", 64},
+		"SHA2-512/256":      &hashPrimitive{"SHA2-512/256", 32},
+		"ACVP-AES-ECB":      &blockCipher{"AES", 16, 2, true, false, iterateAES},
+		"ACVP-AES-CBC":      &blockCipher{"AES-CBC", 16, 2, true, true, iterateAESCBC},
+		"ACVP-AES-CBC-CS3":  &blockCipher{"AES-CBC-CS3", 16, 1, false, true, iterateAESCBC},
+		"ACVP-AES-CTR":      &blockCipher{"AES-CTR", 16, 1, false, true, nil},
+		"ACVP-AES-XTS":      &xts{},
+		"ACVP-AES-GCM":      &aead{"AES-GCM", false},
+		"ACVP-AES-GMAC":     &aead{"AES-GCM", false},
+		"ACVP-AES-CCM":      &aead{"AES-CCM", true},
+		"ACVP-AES-KW":       &aead{"AES-KW", false},
+		"ACVP-AES-KWP":      &aead{"AES-KWP", false},
+		"HMAC-SHA-1":        &hmacPrimitive{"HMAC-SHA-1", 20},
+		"HMAC-SHA2-224":     &hmacPrimitive{"HMAC-SHA2-224", 28},
+		"HMAC-SHA2-256":     &hmacPrimitive{"HMAC-SHA2-256", 32},
+		"HMAC-SHA2-384":     &hmacPrimitive{"HMAC-SHA2-384", 48},
+		"HMAC-SHA2-512":     &hmacPrimitive{"HMAC-SHA2-512", 64},
+		"HMAC-SHA2-512/256": &hmacPrimitive{"HMAC-SHA2-512/256", 32},
+		"ctrDRBG":           &drbg{"ctrDRBG", map[string]bool{"AES-128": true, "AES-192": true, "AES-256": true}},
+		"hmacDRBG":          &drbg{"hmacDRBG", map[string]bool{"SHA-1": true, "SHA2-224": true, "SHA2-256": true, "SHA2-384": true, "SHA2-512": true}},
+		"KDF":               &kdfPrimitive{},
+		"KAS-KDF":           &hkdf{},
+		"CMAC-AES":          &keyedMACPrimitive{"CMAC-AES"},
+		"RSA":               &rsa{},
+		"kdf-components":    &tlsKDF{},
+		"KAS-ECC-SSC":       &kas{},
+		"KAS-FFC-SSC":       &kasDH{},
 	}
 	m.primitives["ECDSA"] = &ecdsa{"ECDSA", map[string]bool{"P-224": true, "P-256": true, "P-384": true, "P-521": true}, m.primitives}
 
diff --git a/src/util/fipstools/acvp/acvptool/test/expected/ACVP-TDES-CBC.bz2 b/src/util/fipstools/acvp/acvptool/test/expected/ACVP-TDES-CBC.bz2
deleted file mode 100644
index 4c2832c..0000000
--- a/src/util/fipstools/acvp/acvptool/test/expected/ACVP-TDES-CBC.bz2
+++ /dev/null
Binary files differ
diff --git a/src/util/fipstools/acvp/acvptool/test/expected/ACVP-TDES-ECB.bz2 b/src/util/fipstools/acvp/acvptool/test/expected/ACVP-TDES-ECB.bz2
deleted file mode 100644
index 1128b49..0000000
--- a/src/util/fipstools/acvp/acvptool/test/expected/ACVP-TDES-ECB.bz2
+++ /dev/null
Binary files differ
diff --git a/src/util/fipstools/acvp/acvptool/test/expected/HMAC-SHA2-512-256.bz2 b/src/util/fipstools/acvp/acvptool/test/expected/HMAC-SHA2-512-256.bz2
new file mode 100644
index 0000000..6984115
--- /dev/null
+++ b/src/util/fipstools/acvp/acvptool/test/expected/HMAC-SHA2-512-256.bz2
Binary files differ
diff --git a/src/util/fipstools/acvp/acvptool/test/expected/ctrDRBG.bz2 b/src/util/fipstools/acvp/acvptool/test/expected/ctrDRBG.bz2
index 9f6e487..c3bd2a1 100644
--- a/src/util/fipstools/acvp/acvptool/test/expected/ctrDRBG.bz2
+++ b/src/util/fipstools/acvp/acvptool/test/expected/ctrDRBG.bz2
Binary files differ
diff --git a/src/util/fipstools/acvp/acvptool/test/tests.json b/src/util/fipstools/acvp/acvptool/test/tests.json
index f613917..5765de1 100644
--- a/src/util/fipstools/acvp/acvptool/test/tests.json
+++ b/src/util/fipstools/acvp/acvptool/test/tests.json
@@ -9,8 +9,6 @@
 {"Wrapper": "modulewrapper", "In": "vectors/ACVP-AES-KW.bz2", "Out": "expected/ACVP-AES-KW.bz2"},
 {"Wrapper": "modulewrapper", "In": "vectors/ACVP-AES-KWP.bz2", "Out": "expected/ACVP-AES-KWP.bz2"},
 {"Wrapper": "testmodulewrapper", "In": "vectors/ACVP-AES-XTS.bz2", "Out": "expected/ACVP-AES-XTS.bz2"},
-{"Wrapper": "modulewrapper", "In": "vectors/ACVP-TDES-CBC.bz2", "Out": "expected/ACVP-TDES-CBC.bz2"},
-{"Wrapper": "modulewrapper", "In": "vectors/ACVP-TDES-ECB.bz2", "Out": "expected/ACVP-TDES-ECB.bz2"},
 {"Wrapper": "modulewrapper", "In": "vectors/CMAC-AES.bz2", "Out": "expected/CMAC-AES.bz2"},
 {"Wrapper": "modulewrapper", "In": "vectors/ctrDRBG.bz2", "Out": "expected/ctrDRBG.bz2"},
 {"Wrapper": "modulewrapper", "In": "vectors/ECDSA.bz2", "Out": "expected/ECDSA.bz2"},
@@ -19,6 +17,7 @@
 {"Wrapper": "modulewrapper", "In": "vectors/HMAC-SHA2-256.bz2", "Out": "expected/HMAC-SHA2-256.bz2"},
 {"Wrapper": "modulewrapper", "In": "vectors/HMAC-SHA2-384.bz2", "Out": "expected/HMAC-SHA2-384.bz2"},
 {"Wrapper": "modulewrapper", "In": "vectors/HMAC-SHA2-512.bz2", "Out": "expected/HMAC-SHA2-512.bz2"},
+{"Wrapper": "modulewrapper", "In": "vectors/HMAC-SHA2-512-256.bz2", "Out": "expected/HMAC-SHA2-512-256.bz2"},
 {"Wrapper": "testmodulewrapper", "In": "vectors/hmacDRBG.bz2", "Out": "expected/hmacDRBG.bz2"},
 {"Wrapper": "testmodulewrapper", "In": "vectors/KAS-KDF.bz2", "Out": "expected/KAS-KDF.bz2"},
 {"Wrapper": "modulewrapper", "In": "vectors/KAS-ECC-SSC.bz2"},
diff --git a/src/util/fipstools/acvp/acvptool/test/vectors/ACVP-TDES-CBC.bz2 b/src/util/fipstools/acvp/acvptool/test/vectors/ACVP-TDES-CBC.bz2
deleted file mode 100644
index 33fdbf3..0000000
--- a/src/util/fipstools/acvp/acvptool/test/vectors/ACVP-TDES-CBC.bz2
+++ /dev/null
Binary files differ
diff --git a/src/util/fipstools/acvp/acvptool/test/vectors/ACVP-TDES-ECB.bz2 b/src/util/fipstools/acvp/acvptool/test/vectors/ACVP-TDES-ECB.bz2
deleted file mode 100644
index c8853ed..0000000
--- a/src/util/fipstools/acvp/acvptool/test/vectors/ACVP-TDES-ECB.bz2
+++ /dev/null
Binary files differ
diff --git a/src/util/fipstools/acvp/acvptool/test/vectors/HMAC-SHA2-512-256.bz2 b/src/util/fipstools/acvp/acvptool/test/vectors/HMAC-SHA2-512-256.bz2
new file mode 100644
index 0000000..d981300
--- /dev/null
+++ b/src/util/fipstools/acvp/acvptool/test/vectors/HMAC-SHA2-512-256.bz2
Binary files differ
diff --git a/src/util/fipstools/acvp/acvptool/test/vectors/ctrDRBG.bz2 b/src/util/fipstools/acvp/acvptool/test/vectors/ctrDRBG.bz2
index 16f447f..1231272 100644
--- a/src/util/fipstools/acvp/acvptool/test/vectors/ctrDRBG.bz2
+++ b/src/util/fipstools/acvp/acvptool/test/vectors/ctrDRBG.bz2
Binary files differ
diff --git a/src/util/fipstools/acvp/modulewrapper/CMakeLists.txt b/src/util/fipstools/acvp/modulewrapper/CMakeLists.txt
index 267f82c..f13f6df 100644
--- a/src/util/fipstools/acvp/modulewrapper/CMakeLists.txt
+++ b/src/util/fipstools/acvp/modulewrapper/CMakeLists.txt
@@ -7,6 +7,7 @@
     main.cc
     modulewrapper.cc
   )
+  install(TARGETS modulewrapper)
 
   add_dependencies(modulewrapper global_target)
 
diff --git a/src/util/fipstools/acvp/modulewrapper/modulewrapper.cc b/src/util/fipstools/acvp/modulewrapper/modulewrapper.cc
index 7188029..628944a 100644
--- a/src/util/fipstools/acvp/modulewrapper/modulewrapper.cc
+++ b/src/util/fipstools/acvp/modulewrapper/modulewrapper.cc
@@ -367,20 +367,6 @@
         "aadLen": [{"min": 0, "max": 1024, "increment": 8}]
       },
       {
-        "algorithm": "ACVP-TDES-ECB",
-        "revision": "1.0",
-        "direction": ["encrypt", "decrypt"],
-        "keyLen": [192],
-        "keyingOption": [1]
-      },
-      {
-        "algorithm": "ACVP-TDES-CBC",
-        "revision": "1.0",
-        "direction": ["encrypt", "decrypt"],
-        "keyLen": [192],
-        "keyingOption": [1]
-      },
-      {
         "algorithm": "HMAC-SHA-1",
         "revision": "1.0",
         "keyLen": [{
@@ -431,10 +417,20 @@
         }]
       },
       {
+        "algorithm": "HMAC-SHA2-512/256",
+        "revision": "1.0",
+        "keyLen": [{
+          "min": 8, "max": 2048, "increment": 8
+        }],
+        "macLen": [{
+          "min": 32, "max": 256, "increment": 8
+        }]
+      },
+      {
         "algorithm": "ctrDRBG",
         "revision": "1.0",
         "predResistanceEnabled": [false],
-        "reseedImplemented": false,
+        "reseedImplemented": true,
         "capabilities": [{
           "mode": "AES-256",
           "derFuncEnabled": false,
@@ -487,7 +483,8 @@
             "SHA2-224",
             "SHA2-256",
             "SHA2-384",
-            "SHA2-512"
+            "SHA2-512",
+            "SHA2-512/256"
           ]
         }]
       },
@@ -507,7 +504,8 @@
             "SHA2-224",
             "SHA2-256",
             "SHA2-384",
-            "SHA2-512"
+            "SHA2-512",
+            "SHA2-512/256"
           ]
         }]
       },
@@ -601,6 +599,9 @@
             }, {
               "hashAlg": "SHA2-512",
               "saltLen": 64
+            }, {
+              "hashAlg": "SHA2-512/256",
+              "saltLen": 32
             }]
           }]
         },{
@@ -619,6 +620,9 @@
             }, {
               "hashAlg": "SHA2-512",
               "saltLen": 64
+            }, {
+              "hashAlg": "SHA2-512/256",
+              "saltLen": 32
             }]
           }]
         },{
@@ -637,6 +641,9 @@
             }, {
               "hashAlg": "SHA2-512",
               "saltLen": 64
+            }, {
+              "hashAlg": "SHA2-512/256",
+              "saltLen": 32
             }]
           }]
         }]
@@ -714,6 +721,27 @@
         },{
           "sigType": "pss",
           "properties": [{
+            "modulo": 1024,
+            "hashPair": [{
+              "hashAlg": "SHA2-224",
+              "saltLen": 28
+            }, {
+              "hashAlg": "SHA2-256",
+              "saltLen": 32
+            }, {
+              "hashAlg": "SHA2-384",
+              "saltLen": 48
+            }, {
+              "hashAlg": "SHA2-512/256",
+              "saltLen": 32
+            }, {
+              "hashAlg": "SHA-1",
+              "saltLen": 20
+            }]
+          }]
+        },{
+          "sigType": "pss",
+          "properties": [{
             "modulo": 2048,
             "hashPair": [{
               "hashAlg": "SHA2-224",
@@ -728,6 +756,9 @@
               "hashAlg": "SHA2-512",
               "saltLen": 64
             }, {
+              "hashAlg": "SHA2-512/256",
+              "saltLen": 32
+            }, {
               "hashAlg": "SHA-1",
               "saltLen": 20
             }]
@@ -749,6 +780,9 @@
               "hashAlg": "SHA2-512",
               "saltLen": 64
             }, {
+              "hashAlg": "SHA2-512/256",
+              "saltLen": 32
+            }, {
               "hashAlg": "SHA-1",
               "saltLen": 20
             }]
@@ -770,6 +804,9 @@
               "hashAlg": "SHA2-512",
               "saltLen": 64
             }, {
+              "hashAlg": "SHA2-512/256",
+              "saltLen": 32
+            }, {
               "hashAlg": "SHA-1",
               "saltLen": 20
             }]
@@ -1382,17 +1419,31 @@
   return write_reply({Span<const uint8_t>(digest, digest_len)});
 }
 
+template <bool WithReseed>
 static bool DRBG(const Span<const uint8_t> args[], ReplyCallback write_reply) {
   const auto out_len_bytes = args[0];
   const auto entropy = args[1];
   const auto personalisation = args[2];
-  const auto additional_data1 = args[3];
-  const auto additional_data2 = args[4];
-  const auto nonce = args[5];
+
+  Span<const uint8_t> reseed_additional_data, reseed_entropy, additional_data1,
+      additional_data2, nonce;
+  if (!WithReseed) {
+    additional_data1 = args[3];
+    additional_data2 = args[4];
+    nonce = args[5];
+  } else {
+    reseed_additional_data = args[3];
+    reseed_entropy = args[4];
+    additional_data1 = args[5];
+    additional_data2 = args[6];
+    nonce = args[7];
+  }
 
   uint32_t out_len;
   if (out_len_bytes.size() != sizeof(out_len) ||
       entropy.size() != CTR_DRBG_ENTROPY_LEN ||
+      (!reseed_entropy.empty() &&
+       reseed_entropy.size() != CTR_DRBG_ENTROPY_LEN) ||
       // nonces are not supported
       nonce.size() != 0) {
     return false;
@@ -1406,6 +1457,10 @@
   CTR_DRBG_STATE drbg;
   if (!CTR_DRBG_init(&drbg, entropy.data(), personalisation.data(),
                      personalisation.size()) ||
+      (!reseed_entropy.empty() &&
+       !CTR_DRBG_reseed(&drbg, reseed_entropy.data(),
+                        reseed_additional_data.data(),
+                        reseed_additional_data.size())) ||
       !CTR_DRBG_generate(&drbg, out.data(), out_len, additional_data1.data(),
                          additional_data1.size()) ||
       !CTR_DRBG_generate(&drbg, out.data(), out_len, additional_data2.data(),
@@ -1517,6 +1572,8 @@
     return EVP_sha384();
   } else if (StringEq(name, "SHA2-512")) {
     return EVP_sha512();
+  } else if (StringEq(name, "SHA2-512/256")) {
+    return EVP_sha512_256();
   } else {
     return nullptr;
   }
@@ -1915,7 +1972,9 @@
     {"HMAC-SHA2-256", 2, HMAC<EVP_sha256>},
     {"HMAC-SHA2-384", 2, HMAC<EVP_sha384>},
     {"HMAC-SHA2-512", 2, HMAC<EVP_sha512>},
-    {"ctrDRBG/AES-256", 6, DRBG},
+    {"HMAC-SHA2-512/256", 2, HMAC<EVP_sha512_256>},
+    {"ctrDRBG/AES-256", 6, DRBG<false>},
+    {"ctrDRBG-reseed/AES-256", 8, DRBG<true>},
     {"ECDSA/keyGen", 1, ECDSAKeyGen},
     {"ECDSA/keyVer", 3, ECDSAKeyVer},
     {"ECDSA/sigGen", 4, ECDSASigGen},
@@ -1932,6 +1991,7 @@
     {"RSA/sigGen/SHA2-256/pss", 2, RSASigGen<EVP_sha256, true>},
     {"RSA/sigGen/SHA2-384/pss", 2, RSASigGen<EVP_sha384, true>},
     {"RSA/sigGen/SHA2-512/pss", 2, RSASigGen<EVP_sha512, true>},
+    {"RSA/sigGen/SHA2-512/256/pss", 2, RSASigGen<EVP_sha512_256, true>},
     {"RSA/sigGen/SHA-1/pss", 2, RSASigGen<EVP_sha1, true>},
     {"RSA/sigVer/SHA2-224/pkcs1v1.5", 4, RSASigVer<EVP_sha224, false>},
     {"RSA/sigVer/SHA2-256/pkcs1v1.5", 4, RSASigVer<EVP_sha256, false>},
@@ -1942,6 +2002,7 @@
     {"RSA/sigVer/SHA2-256/pss", 4, RSASigVer<EVP_sha256, true>},
     {"RSA/sigVer/SHA2-384/pss", 4, RSASigVer<EVP_sha384, true>},
     {"RSA/sigVer/SHA2-512/pss", 4, RSASigVer<EVP_sha512, true>},
+    {"RSA/sigVer/SHA2-512/256/pss", 4, RSASigVer<EVP_sha512_256, true>},
     {"RSA/sigVer/SHA-1/pss", 4, RSASigVer<EVP_sha1, true>},
     {"TLSKDF/1.0/SHA-1", 5, TLSKDF<EVP_md5_sha1>},
     {"TLSKDF/1.2/SHA2-256", 5, TLSKDF<EVP_sha256>},
diff --git a/src/util/fipstools/acvp/modulewrapper/modulewrapper.h b/src/util/fipstools/acvp/modulewrapper/modulewrapper.h
index 0472800..cb8f9f3 100644
--- a/src/util/fipstools/acvp/modulewrapper/modulewrapper.h
+++ b/src/util/fipstools/acvp/modulewrapper/modulewrapper.h
@@ -26,7 +26,7 @@
 
 // kMaxArgs is the maximum number of arguments (including the function name)
 // that an ACVP request can contain.
-constexpr size_t kMaxArgs = 8;
+constexpr size_t kMaxArgs = 9;
 // kMaxNameLength is the maximum length of a function name in an ACVP request.
 constexpr size_t kMaxNameLength = 30;
 
diff --git a/src/util/fipstools/delocate/delocate.go b/src/util/fipstools/delocate/delocate.go
index 2d92520..55c8671 100644
--- a/src/util/fipstools/delocate/delocate.go
+++ b/src/util/fipstools/delocate/delocate.go
@@ -509,7 +509,7 @@
 				// This is a branch. Either the target needs to be written to a local
 				// version of the symbol to ensure that no relocations are emitted, or
 				// it needs to jump to a redirector function.
-				symbol, _, _, didChange, symbolIsLocal, _ := d.parseMemRef(arg.up)
+				symbol, offset, _, didChange, symbolIsLocal, _ := d.parseMemRef(arg.up)
 				changed = didChange
 
 				if _, knownSymbol := d.symbols[symbol]; knownSymbol {
@@ -520,6 +520,13 @@
 					d.redirectors[symbol] = redirector
 					symbol = redirector
 					changed = true
+				} else if didChange && symbolIsLocal && len(offset) > 0 {
+					// didChange is set when the inputFile index is not 0; which is the index of the
+					// first file copied to the output, which is the generated assembly of bcm.c.
+					// In subsequently copied assembly files, local symbols are changed by appending (BCM_ + index)
+					// in order to ensure they don't collide. `index` gets incremented per file.
+					// If there is offset after the symbol, append the `offset`.
+					symbol = symbol + offset
 				}
 
 				args = append(args, symbol)
@@ -1940,7 +1947,7 @@
 	}
 
 	w.WriteString(".type BORINGSSL_bcm_text_hash, @object\n")
-	w.WriteString(".size BORINGSSL_bcm_text_hash, 64\n")
+	w.WriteString(".size BORINGSSL_bcm_text_hash, 32\n")
 	w.WriteString("BORINGSSL_bcm_text_hash:\n")
 	for _, b := range fipscommon.UninitHashValue {
 		w.WriteString(".byte 0x" + strconv.FormatUint(uint64(b), 16) + "\n")
diff --git a/src/util/fipstools/delocate/delocate.peg b/src/util/fipstools/delocate/delocate.peg
index c253a48..8267065 100644
--- a/src/util/fipstools/delocate/delocate.peg
+++ b/src/util/fipstools/delocate/delocate.peg
@@ -94,7 +94,7 @@
               BaseIndexScale)
 SymbolRef <- (Offset* '+')? (LocalSymbol / SymbolName) Offset* ('@' Section Offset*)?
 Low12BitsSymbolRef <- ":lo12:" (LocalSymbol / SymbolName) Offset?
-ARMBaseIndexScale <- '[' ARMRegister (',' WS? (('#' Offset ('*' [0-9]+)? ) / ARMGOTLow12 / Low12BitsSymbolRef / ARMRegister) (',' WS? ARMConstantTweak)?)? ']' ARMPostincrement?
+ARMBaseIndexScale <- '[' ARMRegister (',' WS? (('#' Offset (('*' [0-9]+) / ('*' '(' [0-9]+ Operator [0-9]+ ')') / (('+' [0-9]+)*))? ) / ARMGOTLow12 / Low12BitsSymbolRef / ARMRegister) (',' WS? ARMConstantTweak)?)? ']' ARMPostincrement?
 ARMGOTLow12 <- ":got_lo12:" SymbolName
 ARMPostincrement <- '!'
 BaseIndexScale <- '(' RegisterOrConstant? WS? (',' WS? RegisterOrConstant WS? (',' [0-9]+)? )? ')'
diff --git a/src/util/fipstools/delocate/delocate.peg.go b/src/util/fipstools/delocate/delocate.peg.go
index ea7c195..6f5c654 100644
--- a/src/util/fipstools/delocate/delocate.peg.go
+++ b/src/util/fipstools/delocate/delocate.peg.go
@@ -1,10 +1,14 @@
 package main
 
+// Code generated by ./peg/peg delocate.peg DO NOT EDIT.
+
 import (
 	"fmt"
-	"math"
+	"io"
+	"os"
 	"sort"
 	"strconv"
+	"strings"
 )
 
 const endSymbol rune = 1114112
@@ -142,19 +146,19 @@
 	up, next *node32
 }
 
-func (node *node32) print(pretty bool, buffer string) {
+func (node *node32) print(w io.Writer, pretty bool, buffer string) {
 	var print func(node *node32, depth int)
 	print = func(node *node32, depth int) {
 		for node != nil {
 			for c := 0; c < depth; c++ {
-				fmt.Printf(" ")
+				fmt.Fprintf(w, " ")
 			}
 			rule := rul3s[node.pegRule]
 			quote := strconv.Quote(string(([]rune(buffer)[node.begin:node.end])))
 			if !pretty {
-				fmt.Printf("%v %v\n", rule, quote)
+				fmt.Fprintf(w, "%v %v\n", rule, quote)
 			} else {
-				fmt.Printf("\x1B[34m%v\x1B[m %v\n", rule, quote)
+				fmt.Fprintf(w, "\x1B[36m%v\x1B[m %v\n", rule, quote)
 			}
 			if node.up != nil {
 				print(node.up, depth+1)
@@ -165,12 +169,12 @@
 	print(node, 0)
 }
 
-func (node *node32) Print(buffer string) {
-	node.print(false, buffer)
+func (node *node32) Print(w io.Writer, buffer string) {
+	node.print(w, false, buffer)
 }
 
-func (node *node32) PrettyPrint(buffer string) {
-	node.print(true, buffer)
+func (node *node32) PrettyPrint(w io.Writer, buffer string) {
+	node.print(w, true, buffer)
 }
 
 type tokens32 struct {
@@ -213,24 +217,24 @@
 }
 
 func (t *tokens32) PrintSyntaxTree(buffer string) {
-	t.AST().Print(buffer)
+	t.AST().Print(os.Stdout, buffer)
+}
+
+func (t *tokens32) WriteSyntaxTree(w io.Writer, buffer string) {
+	t.AST().Print(w, buffer)
 }
 
 func (t *tokens32) PrettyPrintSyntaxTree(buffer string) {
-	t.AST().PrettyPrint(buffer)
+	t.AST().PrettyPrint(os.Stdout, buffer)
 }
 
 func (t *tokens32) Add(rule pegRule, begin, end, index uint32) {
-	if tree := t.tree; int(index) >= len(tree) {
-		expanded := make([]token32, 2*len(tree))
-		copy(expanded, tree)
-		t.tree = expanded
+	tree, i := t.tree, int(index)
+	if i >= len(tree) {
+		t.tree = append(tree, token32{pegRule: rule, begin: begin, end: end})
+		return
 	}
-	t.tree[index] = token32{
-		pegRule: rule,
-		begin:   begin,
-		end:     end,
-	}
+	tree[i] = token32{pegRule: rule, begin: begin, end: end}
 }
 
 func (t *tokens32) Tokens() []token32 {
@@ -292,7 +296,7 @@
 }
 
 func (e *parseError) Error() string {
-	tokens, error := []token32{e.max}, "\n"
+	tokens, err := []token32{e.max}, "\n"
 	positions, p := make([]int, 2*len(tokens)), 0
 	for _, token := range tokens {
 		positions[p], p = int(token.begin), p+1
@@ -305,14 +309,14 @@
 	}
 	for _, token := range tokens {
 		begin, end := int(token.begin), int(token.end)
-		error += fmt.Sprintf(format,
+		err += fmt.Sprintf(format,
 			rul3s[token.pegRule],
 			translations[begin].line, translations[begin].symbol,
 			translations[end].line, translations[end].symbol,
 			strconv.Quote(string(e.p.buffer[begin:end])))
 	}
 
-	return error
+	return err
 }
 
 func (p *Asm) PrintSyntaxTree() {
@@ -323,12 +327,41 @@
 	}
 }
 
-func (p *Asm) Init() {
+func (p *Asm) WriteSyntaxTree(w io.Writer) {
+	p.tokens32.WriteSyntaxTree(w, p.Buffer)
+}
+
+func (p *Asm) SprintSyntaxTree() string {
+	var bldr strings.Builder
+	p.WriteSyntaxTree(&bldr)
+	return bldr.String()
+}
+
+func Pretty(pretty bool) func(*Asm) error {
+	return func(p *Asm) error {
+		p.Pretty = pretty
+		return nil
+	}
+}
+
+func Size(size int) func(*Asm) error {
+	return func(p *Asm) error {
+		p.tokens32 = tokens32{tree: make([]token32, 0, size)}
+		return nil
+	}
+}
+func (p *Asm) Init(options ...func(*Asm) error) error {
 	var (
 		max                  token32
 		position, tokenIndex uint32
 		buffer               []rune
 	)
+	for _, option := range options {
+		err := option(p)
+		if err != nil {
+			return err
+		}
+	}
 	p.reset = func() {
 		max = token32{}
 		position, tokenIndex = 0, 0
@@ -342,7 +375,7 @@
 	p.reset()
 
 	_rules := p.rules
-	tree := tokens32{tree: make([]token32, math.MaxInt16)}
+	tree := p.tokens32
 	p.parse = func(rule ...int) error {
 		r := 1
 		if len(rule) > 0 {
@@ -5708,7 +5741,7 @@
 			position, tokenIndex = position727, tokenIndex727
 			return false
 		},
-		/* 46 ARMBaseIndexScale <- <('[' ARMRegister (',' WS? (('#' Offset ('*' [0-9]+)?) / ARMGOTLow12 / Low12BitsSymbolRef / ARMRegister) (',' WS? ARMConstantTweak)?)? ']' ARMPostincrement?)> */
+		/* 46 ARMBaseIndexScale <- <('[' ARMRegister (',' WS? (('#' Offset (('*' [0-9]+) / ('*' '(' [0-9]+ Operator [0-9]+ ')') / ('+' [0-9]+)*)?) / ARMGOTLow12 / Low12BitsSymbolRef / ARMRegister) (',' WS? ARMConstantTweak)?)? ']' ARMPostincrement?)> */
 		func() bool {
 			position737, tokenIndex737 := position, tokenIndex
 			{
@@ -5747,27 +5780,108 @@
 						}
 						{
 							position745, tokenIndex745 := position, tokenIndex
-							if buffer[position] != rune('*') {
-								goto l745
-							}
-							position++
-							if c := buffer[position]; c < rune('0') || c > rune('9') {
-								goto l745
-							}
-							position++
-						l747:
 							{
-								position748, tokenIndex748 := position, tokenIndex
+								position747, tokenIndex747 := position, tokenIndex
+								if buffer[position] != rune('*') {
+									goto l748
+								}
+								position++
 								if c := buffer[position]; c < rune('0') || c > rune('9') {
 									goto l748
 								}
 								position++
+							l749:
+								{
+									position750, tokenIndex750 := position, tokenIndex
+									if c := buffer[position]; c < rune('0') || c > rune('9') {
+										goto l750
+									}
+									position++
+									goto l749
+								l750:
+									position, tokenIndex = position750, tokenIndex750
+								}
 								goto l747
 							l748:
-								position, tokenIndex = position748, tokenIndex748
+								position, tokenIndex = position747, tokenIndex747
+								if buffer[position] != rune('*') {
+									goto l751
+								}
+								position++
+								if buffer[position] != rune('(') {
+									goto l751
+								}
+								position++
+								if c := buffer[position]; c < rune('0') || c > rune('9') {
+									goto l751
+								}
+								position++
+							l752:
+								{
+									position753, tokenIndex753 := position, tokenIndex
+									if c := buffer[position]; c < rune('0') || c > rune('9') {
+										goto l753
+									}
+									position++
+									goto l752
+								l753:
+									position, tokenIndex = position753, tokenIndex753
+								}
+								if !_rules[ruleOperator]() {
+									goto l751
+								}
+								if c := buffer[position]; c < rune('0') || c > rune('9') {
+									goto l751
+								}
+								position++
+							l754:
+								{
+									position755, tokenIndex755 := position, tokenIndex
+									if c := buffer[position]; c < rune('0') || c > rune('9') {
+										goto l755
+									}
+									position++
+									goto l754
+								l755:
+									position, tokenIndex = position755, tokenIndex755
+								}
+								if buffer[position] != rune(')') {
+									goto l751
+								}
+								position++
+								goto l747
+							l751:
+								position, tokenIndex = position747, tokenIndex747
+							l756:
+								{
+									position757, tokenIndex757 := position, tokenIndex
+									if buffer[position] != rune('+') {
+										goto l757
+									}
+									position++
+									if c := buffer[position]; c < rune('0') || c > rune('9') {
+										goto l757
+									}
+									position++
+								l758:
+									{
+										position759, tokenIndex759 := position, tokenIndex
+										if c := buffer[position]; c < rune('0') || c > rune('9') {
+											goto l759
+										}
+										position++
+										goto l758
+									l759:
+										position, tokenIndex = position759, tokenIndex759
+									}
+									goto l756
+								l757:
+									position, tokenIndex = position757, tokenIndex757
+								}
 							}
+						l747:
 							goto l746
-						l745:
+
 							position, tokenIndex = position745, tokenIndex745
 						}
 					l746:
@@ -5775,16 +5889,16 @@
 					l744:
 						position, tokenIndex = position743, tokenIndex743
 						if !_rules[ruleARMGOTLow12]() {
-							goto l749
+							goto l760
 						}
 						goto l743
-					l749:
+					l760:
 						position, tokenIndex = position743, tokenIndex743
 						if !_rules[ruleLow12BitsSymbolRef]() {
-							goto l750
+							goto l761
 						}
 						goto l743
-					l750:
+					l761:
 						position, tokenIndex = position743, tokenIndex743
 						if !_rules[ruleARMRegister]() {
 							goto l739
@@ -5792,29 +5906,29 @@
 					}
 				l743:
 					{
-						position751, tokenIndex751 := position, tokenIndex
+						position762, tokenIndex762 := position, tokenIndex
 						if buffer[position] != rune(',') {
-							goto l751
+							goto l762
 						}
 						position++
 						{
-							position753, tokenIndex753 := position, tokenIndex
+							position764, tokenIndex764 := position, tokenIndex
 							if !_rules[ruleWS]() {
-								goto l753
+								goto l764
 							}
-							goto l754
-						l753:
-							position, tokenIndex = position753, tokenIndex753
+							goto l765
+						l764:
+							position, tokenIndex = position764, tokenIndex764
 						}
-					l754:
+					l765:
 						if !_rules[ruleARMConstantTweak]() {
-							goto l751
+							goto l762
 						}
-						goto l752
-					l751:
-						position, tokenIndex = position751, tokenIndex751
+						goto l763
+					l762:
+						position, tokenIndex = position762, tokenIndex762
 					}
-				l752:
+				l763:
 					goto l740
 				l739:
 					position, tokenIndex = position739, tokenIndex739
@@ -5825,15 +5939,15 @@
 				}
 				position++
 				{
-					position755, tokenIndex755 := position, tokenIndex
+					position766, tokenIndex766 := position, tokenIndex
 					if !_rules[ruleARMPostincrement]() {
-						goto l755
+						goto l766
 					}
-					goto l756
-				l755:
-					position, tokenIndex = position755, tokenIndex755
+					goto l767
+				l766:
+					position, tokenIndex = position766, tokenIndex766
 				}
-			l756:
+			l767:
 				add(ruleARMBaseIndexScale, position738)
 			}
 			return true
@@ -5843,566 +5957,567 @@
 		},
 		/* 47 ARMGOTLow12 <- <(':' ('g' / 'G') ('o' / 'O') ('t' / 'T') '_' ('l' / 'L') ('o' / 'O') '1' '2' ':' SymbolName)> */
 		func() bool {
-			position757, tokenIndex757 := position, tokenIndex
+			position768, tokenIndex768 := position, tokenIndex
 			{
-				position758 := position
+				position769 := position
 				if buffer[position] != rune(':') {
-					goto l757
+					goto l768
 				}
 				position++
 				{
-					position759, tokenIndex759 := position, tokenIndex
+					position770, tokenIndex770 := position, tokenIndex
 					if buffer[position] != rune('g') {
-						goto l760
+						goto l771
 					}
 					position++
-					goto l759
-				l760:
-					position, tokenIndex = position759, tokenIndex759
+					goto l770
+				l771:
+					position, tokenIndex = position770, tokenIndex770
 					if buffer[position] != rune('G') {
-						goto l757
-					}
-					position++
-				}
-			l759:
-				{
-					position761, tokenIndex761 := position, tokenIndex
-					if buffer[position] != rune('o') {
-						goto l762
-					}
-					position++
-					goto l761
-				l762:
-					position, tokenIndex = position761, tokenIndex761
-					if buffer[position] != rune('O') {
-						goto l757
-					}
-					position++
-				}
-			l761:
-				{
-					position763, tokenIndex763 := position, tokenIndex
-					if buffer[position] != rune('t') {
-						goto l764
-					}
-					position++
-					goto l763
-				l764:
-					position, tokenIndex = position763, tokenIndex763
-					if buffer[position] != rune('T') {
-						goto l757
-					}
-					position++
-				}
-			l763:
-				if buffer[position] != rune('_') {
-					goto l757
-				}
-				position++
-				{
-					position765, tokenIndex765 := position, tokenIndex
-					if buffer[position] != rune('l') {
-						goto l766
-					}
-					position++
-					goto l765
-				l766:
-					position, tokenIndex = position765, tokenIndex765
-					if buffer[position] != rune('L') {
-						goto l757
-					}
-					position++
-				}
-			l765:
-				{
-					position767, tokenIndex767 := position, tokenIndex
-					if buffer[position] != rune('o') {
 						goto l768
 					}
 					position++
-					goto l767
-				l768:
-					position, tokenIndex = position767, tokenIndex767
+				}
+			l770:
+				{
+					position772, tokenIndex772 := position, tokenIndex
+					if buffer[position] != rune('o') {
+						goto l773
+					}
+					position++
+					goto l772
+				l773:
+					position, tokenIndex = position772, tokenIndex772
 					if buffer[position] != rune('O') {
-						goto l757
+						goto l768
 					}
 					position++
 				}
-			l767:
+			l772:
+				{
+					position774, tokenIndex774 := position, tokenIndex
+					if buffer[position] != rune('t') {
+						goto l775
+					}
+					position++
+					goto l774
+				l775:
+					position, tokenIndex = position774, tokenIndex774
+					if buffer[position] != rune('T') {
+						goto l768
+					}
+					position++
+				}
+			l774:
+				if buffer[position] != rune('_') {
+					goto l768
+				}
+				position++
+				{
+					position776, tokenIndex776 := position, tokenIndex
+					if buffer[position] != rune('l') {
+						goto l777
+					}
+					position++
+					goto l776
+				l777:
+					position, tokenIndex = position776, tokenIndex776
+					if buffer[position] != rune('L') {
+						goto l768
+					}
+					position++
+				}
+			l776:
+				{
+					position778, tokenIndex778 := position, tokenIndex
+					if buffer[position] != rune('o') {
+						goto l779
+					}
+					position++
+					goto l778
+				l779:
+					position, tokenIndex = position778, tokenIndex778
+					if buffer[position] != rune('O') {
+						goto l768
+					}
+					position++
+				}
+			l778:
 				if buffer[position] != rune('1') {
-					goto l757
+					goto l768
 				}
 				position++
 				if buffer[position] != rune('2') {
-					goto l757
+					goto l768
 				}
 				position++
 				if buffer[position] != rune(':') {
-					goto l757
+					goto l768
 				}
 				position++
 				if !_rules[ruleSymbolName]() {
-					goto l757
+					goto l768
 				}
-				add(ruleARMGOTLow12, position758)
+				add(ruleARMGOTLow12, position769)
 			}
 			return true
-		l757:
-			position, tokenIndex = position757, tokenIndex757
+		l768:
+			position, tokenIndex = position768, tokenIndex768
 			return false
 		},
 		/* 48 ARMPostincrement <- <'!'> */
 		func() bool {
-			position769, tokenIndex769 := position, tokenIndex
+			position780, tokenIndex780 := position, tokenIndex
 			{
-				position770 := position
+				position781 := position
 				if buffer[position] != rune('!') {
-					goto l769
+					goto l780
 				}
 				position++
-				add(ruleARMPostincrement, position770)
+				add(ruleARMPostincrement, position781)
 			}
 			return true
-		l769:
-			position, tokenIndex = position769, tokenIndex769
+		l780:
+			position, tokenIndex = position780, tokenIndex780
 			return false
 		},
 		/* 49 BaseIndexScale <- <('(' RegisterOrConstant? WS? (',' WS? RegisterOrConstant WS? (',' [0-9]+)?)? ')')> */
 		func() bool {
-			position771, tokenIndex771 := position, tokenIndex
+			position782, tokenIndex782 := position, tokenIndex
 			{
-				position772 := position
+				position783 := position
 				if buffer[position] != rune('(') {
-					goto l771
+					goto l782
 				}
 				position++
 				{
-					position773, tokenIndex773 := position, tokenIndex
+					position784, tokenIndex784 := position, tokenIndex
 					if !_rules[ruleRegisterOrConstant]() {
-						goto l773
+						goto l784
 					}
-					goto l774
-				l773:
-					position, tokenIndex = position773, tokenIndex773
+					goto l785
+				l784:
+					position, tokenIndex = position784, tokenIndex784
 				}
-			l774:
+			l785:
 				{
-					position775, tokenIndex775 := position, tokenIndex
+					position786, tokenIndex786 := position, tokenIndex
 					if !_rules[ruleWS]() {
-						goto l775
+						goto l786
 					}
-					goto l776
-				l775:
-					position, tokenIndex = position775, tokenIndex775
+					goto l787
+				l786:
+					position, tokenIndex = position786, tokenIndex786
 				}
-			l776:
+			l787:
 				{
-					position777, tokenIndex777 := position, tokenIndex
+					position788, tokenIndex788 := position, tokenIndex
 					if buffer[position] != rune(',') {
-						goto l777
+						goto l788
 					}
 					position++
 					{
-						position779, tokenIndex779 := position, tokenIndex
+						position790, tokenIndex790 := position, tokenIndex
 						if !_rules[ruleWS]() {
-							goto l779
+							goto l790
 						}
-						goto l780
-					l779:
-						position, tokenIndex = position779, tokenIndex779
+						goto l791
+					l790:
+						position, tokenIndex = position790, tokenIndex790
 					}
-				l780:
+				l791:
 					if !_rules[ruleRegisterOrConstant]() {
-						goto l777
+						goto l788
 					}
 					{
-						position781, tokenIndex781 := position, tokenIndex
+						position792, tokenIndex792 := position, tokenIndex
 						if !_rules[ruleWS]() {
-							goto l781
+							goto l792
 						}
-						goto l782
-					l781:
-						position, tokenIndex = position781, tokenIndex781
+						goto l793
+					l792:
+						position, tokenIndex = position792, tokenIndex792
 					}
-				l782:
+				l793:
 					{
-						position783, tokenIndex783 := position, tokenIndex
+						position794, tokenIndex794 := position, tokenIndex
 						if buffer[position] != rune(',') {
-							goto l783
+							goto l794
 						}
 						position++
 						if c := buffer[position]; c < rune('0') || c > rune('9') {
-							goto l783
+							goto l794
 						}
 						position++
-					l785:
+					l796:
 						{
-							position786, tokenIndex786 := position, tokenIndex
+							position797, tokenIndex797 := position, tokenIndex
 							if c := buffer[position]; c < rune('0') || c > rune('9') {
-								goto l786
+								goto l797
 							}
 							position++
-							goto l785
-						l786:
-							position, tokenIndex = position786, tokenIndex786
+							goto l796
+						l797:
+							position, tokenIndex = position797, tokenIndex797
 						}
-						goto l784
-					l783:
-						position, tokenIndex = position783, tokenIndex783
+						goto l795
+					l794:
+						position, tokenIndex = position794, tokenIndex794
 					}
-				l784:
-					goto l778
-				l777:
-					position, tokenIndex = position777, tokenIndex777
+				l795:
+					goto l789
+				l788:
+					position, tokenIndex = position788, tokenIndex788
 				}
-			l778:
+			l789:
 				if buffer[position] != rune(')') {
-					goto l771
+					goto l782
 				}
 				position++
-				add(ruleBaseIndexScale, position772)
+				add(ruleBaseIndexScale, position783)
 			}
 			return true
-		l771:
-			position, tokenIndex = position771, tokenIndex771
+		l782:
+			position, tokenIndex = position782, tokenIndex782
 			return false
 		},
 		/* 50 Operator <- <('+' / '-')> */
 		func() bool {
-			position787, tokenIndex787 := position, tokenIndex
+			position798, tokenIndex798 := position, tokenIndex
 			{
-				position788 := position
+				position799 := position
 				{
-					position789, tokenIndex789 := position, tokenIndex
+					position800, tokenIndex800 := position, tokenIndex
 					if buffer[position] != rune('+') {
-						goto l790
+						goto l801
 					}
 					position++
-					goto l789
-				l790:
-					position, tokenIndex = position789, tokenIndex789
+					goto l800
+				l801:
+					position, tokenIndex = position800, tokenIndex800
 					if buffer[position] != rune('-') {
-						goto l787
+						goto l798
 					}
 					position++
 				}
-			l789:
-				add(ruleOperator, position788)
+			l800:
+				add(ruleOperator, position799)
 			}
 			return true
-		l787:
-			position, tokenIndex = position787, tokenIndex787
+		l798:
+			position, tokenIndex = position798, tokenIndex798
 			return false
 		},
 		/* 51 Offset <- <('+'? '-'? (('0' ('b' / 'B') ('0' / '1')+) / ('0' ('x' / 'X') ([0-9] / [0-9] / ([a-f] / [A-F]))+) / [0-9]+))> */
 		func() bool {
-			position791, tokenIndex791 := position, tokenIndex
+			position802, tokenIndex802 := position, tokenIndex
 			{
-				position792 := position
+				position803 := position
 				{
-					position793, tokenIndex793 := position, tokenIndex
+					position804, tokenIndex804 := position, tokenIndex
 					if buffer[position] != rune('+') {
-						goto l793
+						goto l804
 					}
 					position++
-					goto l794
-				l793:
-					position, tokenIndex = position793, tokenIndex793
+					goto l805
+				l804:
+					position, tokenIndex = position804, tokenIndex804
 				}
-			l794:
+			l805:
 				{
-					position795, tokenIndex795 := position, tokenIndex
+					position806, tokenIndex806 := position, tokenIndex
 					if buffer[position] != rune('-') {
-						goto l795
+						goto l806
 					}
 					position++
-					goto l796
-				l795:
-					position, tokenIndex = position795, tokenIndex795
+					goto l807
+				l806:
+					position, tokenIndex = position806, tokenIndex806
 				}
-			l796:
+			l807:
 				{
-					position797, tokenIndex797 := position, tokenIndex
+					position808, tokenIndex808 := position, tokenIndex
 					if buffer[position] != rune('0') {
-						goto l798
+						goto l809
 					}
 					position++
 					{
-						position799, tokenIndex799 := position, tokenIndex
+						position810, tokenIndex810 := position, tokenIndex
 						if buffer[position] != rune('b') {
-							goto l800
+							goto l811
 						}
 						position++
-						goto l799
-					l800:
-						position, tokenIndex = position799, tokenIndex799
+						goto l810
+					l811:
+						position, tokenIndex = position810, tokenIndex810
 						if buffer[position] != rune('B') {
-							goto l798
-						}
-						position++
-					}
-				l799:
-					{
-						position803, tokenIndex803 := position, tokenIndex
-						if buffer[position] != rune('0') {
-							goto l804
-						}
-						position++
-						goto l803
-					l804:
-						position, tokenIndex = position803, tokenIndex803
-						if buffer[position] != rune('1') {
-							goto l798
-						}
-						position++
-					}
-				l803:
-				l801:
-					{
-						position802, tokenIndex802 := position, tokenIndex
-						{
-							position805, tokenIndex805 := position, tokenIndex
-							if buffer[position] != rune('0') {
-								goto l806
-							}
-							position++
-							goto l805
-						l806:
-							position, tokenIndex = position805, tokenIndex805
-							if buffer[position] != rune('1') {
-								goto l802
-							}
-							position++
-						}
-					l805:
-						goto l801
-					l802:
-						position, tokenIndex = position802, tokenIndex802
-					}
-					goto l797
-				l798:
-					position, tokenIndex = position797, tokenIndex797
-					if buffer[position] != rune('0') {
-						goto l807
-					}
-					position++
-					{
-						position808, tokenIndex808 := position, tokenIndex
-						if buffer[position] != rune('x') {
 							goto l809
 						}
 						position++
-						goto l808
-					l809:
-						position, tokenIndex = position808, tokenIndex808
-						if buffer[position] != rune('X') {
-							goto l807
-						}
-						position++
 					}
-				l808:
-					{
-						position812, tokenIndex812 := position, tokenIndex
-						if c := buffer[position]; c < rune('0') || c > rune('9') {
-							goto l813
-						}
-						position++
-						goto l812
-					l813:
-						position, tokenIndex = position812, tokenIndex812
-						if c := buffer[position]; c < rune('0') || c > rune('9') {
-							goto l814
-						}
-						position++
-						goto l812
-					l814:
-						position, tokenIndex = position812, tokenIndex812
-						{
-							position815, tokenIndex815 := position, tokenIndex
-							if c := buffer[position]; c < rune('a') || c > rune('f') {
-								goto l816
-							}
-							position++
-							goto l815
-						l816:
-							position, tokenIndex = position815, tokenIndex815
-							if c := buffer[position]; c < rune('A') || c > rune('F') {
-								goto l807
-							}
-							position++
-						}
-					l815:
-					}
-				l812:
 				l810:
 					{
-						position811, tokenIndex811 := position, tokenIndex
-						{
-							position817, tokenIndex817 := position, tokenIndex
-							if c := buffer[position]; c < rune('0') || c > rune('9') {
-								goto l818
-							}
-							position++
-							goto l817
-						l818:
-							position, tokenIndex = position817, tokenIndex817
-							if c := buffer[position]; c < rune('0') || c > rune('9') {
-								goto l819
-							}
-							position++
-							goto l817
-						l819:
-							position, tokenIndex = position817, tokenIndex817
-							{
-								position820, tokenIndex820 := position, tokenIndex
-								if c := buffer[position]; c < rune('a') || c > rune('f') {
-									goto l821
-								}
-								position++
-								goto l820
-							l821:
-								position, tokenIndex = position820, tokenIndex820
-								if c := buffer[position]; c < rune('A') || c > rune('F') {
-									goto l811
-								}
-								position++
-							}
-						l820:
+						position814, tokenIndex814 := position, tokenIndex
+						if buffer[position] != rune('0') {
+							goto l815
 						}
-					l817:
-						goto l810
-					l811:
-						position, tokenIndex = position811, tokenIndex811
+						position++
+						goto l814
+					l815:
+						position, tokenIndex = position814, tokenIndex814
+						if buffer[position] != rune('1') {
+							goto l809
+						}
+						position++
 					}
-					goto l797
-				l807:
-					position, tokenIndex = position797, tokenIndex797
-					if c := buffer[position]; c < rune('0') || c > rune('9') {
-						goto l791
+				l814:
+				l812:
+					{
+						position813, tokenIndex813 := position, tokenIndex
+						{
+							position816, tokenIndex816 := position, tokenIndex
+							if buffer[position] != rune('0') {
+								goto l817
+							}
+							position++
+							goto l816
+						l817:
+							position, tokenIndex = position816, tokenIndex816
+							if buffer[position] != rune('1') {
+								goto l813
+							}
+							position++
+						}
+					l816:
+						goto l812
+					l813:
+						position, tokenIndex = position813, tokenIndex813
+					}
+					goto l808
+				l809:
+					position, tokenIndex = position808, tokenIndex808
+					if buffer[position] != rune('0') {
+						goto l818
 					}
 					position++
-				l822:
+					{
+						position819, tokenIndex819 := position, tokenIndex
+						if buffer[position] != rune('x') {
+							goto l820
+						}
+						position++
+						goto l819
+					l820:
+						position, tokenIndex = position819, tokenIndex819
+						if buffer[position] != rune('X') {
+							goto l818
+						}
+						position++
+					}
+				l819:
 					{
 						position823, tokenIndex823 := position, tokenIndex
 						if c := buffer[position]; c < rune('0') || c > rune('9') {
-							goto l823
+							goto l824
 						}
 						position++
-						goto l822
-					l823:
+						goto l823
+					l824:
 						position, tokenIndex = position823, tokenIndex823
+						if c := buffer[position]; c < rune('0') || c > rune('9') {
+							goto l825
+						}
+						position++
+						goto l823
+					l825:
+						position, tokenIndex = position823, tokenIndex823
+						{
+							position826, tokenIndex826 := position, tokenIndex
+							if c := buffer[position]; c < rune('a') || c > rune('f') {
+								goto l827
+							}
+							position++
+							goto l826
+						l827:
+							position, tokenIndex = position826, tokenIndex826
+							if c := buffer[position]; c < rune('A') || c > rune('F') {
+								goto l818
+							}
+							position++
+						}
+					l826:
+					}
+				l823:
+				l821:
+					{
+						position822, tokenIndex822 := position, tokenIndex
+						{
+							position828, tokenIndex828 := position, tokenIndex
+							if c := buffer[position]; c < rune('0') || c > rune('9') {
+								goto l829
+							}
+							position++
+							goto l828
+						l829:
+							position, tokenIndex = position828, tokenIndex828
+							if c := buffer[position]; c < rune('0') || c > rune('9') {
+								goto l830
+							}
+							position++
+							goto l828
+						l830:
+							position, tokenIndex = position828, tokenIndex828
+							{
+								position831, tokenIndex831 := position, tokenIndex
+								if c := buffer[position]; c < rune('a') || c > rune('f') {
+									goto l832
+								}
+								position++
+								goto l831
+							l832:
+								position, tokenIndex = position831, tokenIndex831
+								if c := buffer[position]; c < rune('A') || c > rune('F') {
+									goto l822
+								}
+								position++
+							}
+						l831:
+						}
+					l828:
+						goto l821
+					l822:
+						position, tokenIndex = position822, tokenIndex822
+					}
+					goto l808
+				l818:
+					position, tokenIndex = position808, tokenIndex808
+					if c := buffer[position]; c < rune('0') || c > rune('9') {
+						goto l802
+					}
+					position++
+				l833:
+					{
+						position834, tokenIndex834 := position, tokenIndex
+						if c := buffer[position]; c < rune('0') || c > rune('9') {
+							goto l834
+						}
+						position++
+						goto l833
+					l834:
+						position, tokenIndex = position834, tokenIndex834
 					}
 				}
-			l797:
-				add(ruleOffset, position792)
+			l808:
+				add(ruleOffset, position803)
 			}
 			return true
-		l791:
-			position, tokenIndex = position791, tokenIndex791
+		l802:
+			position, tokenIndex = position802, tokenIndex802
 			return false
 		},
 		/* 52 Section <- <([a-z] / [A-Z] / '@')+> */
 		func() bool {
-			position824, tokenIndex824 := position, tokenIndex
+			position835, tokenIndex835 := position, tokenIndex
 			{
-				position825 := position
+				position836 := position
 				{
-					position828, tokenIndex828 := position, tokenIndex
+					position839, tokenIndex839 := position, tokenIndex
 					if c := buffer[position]; c < rune('a') || c > rune('z') {
-						goto l829
+						goto l840
 					}
 					position++
-					goto l828
-				l829:
-					position, tokenIndex = position828, tokenIndex828
+					goto l839
+				l840:
+					position, tokenIndex = position839, tokenIndex839
 					if c := buffer[position]; c < rune('A') || c > rune('Z') {
-						goto l830
+						goto l841
 					}
 					position++
-					goto l828
-				l830:
-					position, tokenIndex = position828, tokenIndex828
+					goto l839
+				l841:
+					position, tokenIndex = position839, tokenIndex839
 					if buffer[position] != rune('@') {
-						goto l824
+						goto l835
 					}
 					position++
 				}
-			l828:
-			l826:
+			l839:
+			l837:
 				{
-					position827, tokenIndex827 := position, tokenIndex
+					position838, tokenIndex838 := position, tokenIndex
 					{
-						position831, tokenIndex831 := position, tokenIndex
+						position842, tokenIndex842 := position, tokenIndex
 						if c := buffer[position]; c < rune('a') || c > rune('z') {
-							goto l832
+							goto l843
 						}
 						position++
-						goto l831
-					l832:
-						position, tokenIndex = position831, tokenIndex831
+						goto l842
+					l843:
+						position, tokenIndex = position842, tokenIndex842
 						if c := buffer[position]; c < rune('A') || c > rune('Z') {
-							goto l833
+							goto l844
 						}
 						position++
-						goto l831
-					l833:
-						position, tokenIndex = position831, tokenIndex831
+						goto l842
+					l844:
+						position, tokenIndex = position842, tokenIndex842
 						if buffer[position] != rune('@') {
-							goto l827
+							goto l838
 						}
 						position++
 					}
-				l831:
-					goto l826
-				l827:
-					position, tokenIndex = position827, tokenIndex827
+				l842:
+					goto l837
+				l838:
+					position, tokenIndex = position838, tokenIndex838
 				}
-				add(ruleSection, position825)
+				add(ruleSection, position836)
 			}
 			return true
-		l824:
-			position, tokenIndex = position824, tokenIndex824
+		l835:
+			position, tokenIndex = position835, tokenIndex835
 			return false
 		},
 		/* 53 SegmentRegister <- <('%' ([c-g] / 's') ('s' ':'))> */
 		func() bool {
-			position834, tokenIndex834 := position, tokenIndex
+			position845, tokenIndex845 := position, tokenIndex
 			{
-				position835 := position
+				position846 := position
 				if buffer[position] != rune('%') {
-					goto l834
+					goto l845
 				}
 				position++
 				{
-					position836, tokenIndex836 := position, tokenIndex
+					position847, tokenIndex847 := position, tokenIndex
 					if c := buffer[position]; c < rune('c') || c > rune('g') {
-						goto l837
+						goto l848
 					}
 					position++
-					goto l836
-				l837:
-					position, tokenIndex = position836, tokenIndex836
+					goto l847
+				l848:
+					position, tokenIndex = position847, tokenIndex847
 					if buffer[position] != rune('s') {
-						goto l834
+						goto l845
 					}
 					position++
 				}
-			l836:
+			l847:
 				if buffer[position] != rune('s') {
-					goto l834
+					goto l845
 				}
 				position++
 				if buffer[position] != rune(':') {
-					goto l834
+					goto l845
 				}
 				position++
-				add(ruleSegmentRegister, position835)
+				add(ruleSegmentRegister, position846)
 			}
 			return true
-		l834:
-			position, tokenIndex = position834, tokenIndex834
+		l845:
+			position, tokenIndex = position845, tokenIndex845
 			return false
 		},
 	}
 	p.rules = _rules
+	return nil
 }
diff --git a/src/util/fipstools/delocate/testdata/aarch64-Basic/out.s b/src/util/fipstools/delocate/testdata/aarch64-Basic/out.s
index 12b408d..96eb778 100644
--- a/src/util/fipstools/delocate/testdata/aarch64-Basic/out.s
+++ b/src/util/fipstools/delocate/testdata/aarch64-Basic/out.s
@@ -145,7 +145,7 @@
 .cfi_endproc
 .size .LOPENSSL_armcap_P_addr, .-.LOPENSSL_armcap_P_addr
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -179,35 +179,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/generic-FileDirectives/out.s b/src/util/fipstools/delocate/testdata/generic-FileDirectives/out.s
index bb33e52..84b5134 100644
--- a/src/util/fipstools/delocate/testdata/generic-FileDirectives/out.s
+++ b/src/util/fipstools/delocate/testdata/generic-FileDirectives/out.s
@@ -23,7 +23,7 @@
 OPENSSL_ia32cap_addr_delta:
 .quad OPENSSL_ia32cap_P-OPENSSL_ia32cap_addr_delta
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -57,35 +57,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s b/src/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s
index 304f697..d75e2c7 100644
--- a/src/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s
+++ b/src/util/fipstools/delocate/testdata/ppc64le-GlobalEntry/out.s
@@ -26,7 +26,7 @@
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -60,35 +60,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s b/src/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s
index 5fdbeb8..dad7603 100644
--- a/src/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s
+++ b/src/util/fipstools/delocate/testdata/ppc64le-LoadToR0/out.s
@@ -36,7 +36,7 @@
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -70,35 +70,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/ppc64le-Sample/out.s b/src/util/fipstools/delocate/testdata/ppc64le-Sample/out.s
index e3d682e..798bcf5 100644
--- a/src/util/fipstools/delocate/testdata/ppc64le-Sample/out.s
+++ b/src/util/fipstools/delocate/testdata/ppc64le-Sample/out.s
@@ -516,7 +516,7 @@
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -550,35 +550,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s b/src/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s
index 54cbd6f..6439740 100644
--- a/src/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s
+++ b/src/util/fipstools/delocate/testdata/ppc64le-Sample2/out.s
@@ -641,7 +641,7 @@
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -675,35 +675,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s b/src/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s
index 2fff0ef..fc55ef2 100644
--- a/src/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s
+++ b/src/util/fipstools/delocate/testdata/ppc64le-TOCWithOffset/out.s
@@ -142,7 +142,7 @@
 .LBORINGSSL_external_toc:
 .quad .TOC.-.LBORINGSSL_external_toc
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -176,35 +176,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/x86_64-BSS/out.s b/src/util/fipstools/delocate/testdata/x86_64-BSS/out.s
index e8cd56e..2bb54a8 100644
--- a/src/util/fipstools/delocate/testdata/x86_64-BSS/out.s
+++ b/src/util/fipstools/delocate/testdata/x86_64-BSS/out.s
@@ -77,7 +77,7 @@
 OPENSSL_ia32cap_addr_delta:
 .quad OPENSSL_ia32cap_P-OPENSSL_ia32cap_addr_delta
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -111,35 +111,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/x86_64-Basic/out.s b/src/util/fipstools/delocate/testdata/x86_64-Basic/out.s
index a55e852..657d090 100644
--- a/src/util/fipstools/delocate/testdata/x86_64-Basic/out.s
+++ b/src/util/fipstools/delocate/testdata/x86_64-Basic/out.s
@@ -71,7 +71,7 @@
 OPENSSL_ia32cap_addr_delta:
 .quad OPENSSL_ia32cap_P-OPENSSL_ia32cap_addr_delta
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -105,35 +105,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s b/src/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s
index 467db65..f118e4f 100644
--- a/src/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s
+++ b/src/util/fipstools/delocate/testdata/x86_64-GOTRewrite/out.s
@@ -303,7 +303,7 @@
 OPENSSL_ia32cap_addr_delta:
 .quad OPENSSL_ia32cap_P-OPENSSL_ia32cap_addr_delta
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -337,35 +337,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s b/src/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s
index feb9a43..6549db7 100644
--- a/src/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s
+++ b/src/util/fipstools/delocate/testdata/x86_64-LabelRewrite/out.s
@@ -113,7 +113,7 @@
 OPENSSL_ia32cap_addr_delta:
 .quad OPENSSL_ia32cap_P-OPENSSL_ia32cap_addr_delta
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -147,35 +147,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s b/src/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s
index d4534f8..091e8b7 100644
--- a/src/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s
+++ b/src/util/fipstools/delocate/testdata/x86_64-LargeMemory/out.s
@@ -59,7 +59,7 @@
 .Lboringssl_gotoff__Z1gv:
 	.quad _Z1gv@GOTOFF
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -93,35 +93,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/x86_64-Sections/out.s b/src/util/fipstools/delocate/testdata/x86_64-Sections/out.s
index ab3e3d9..1112387 100644
--- a/src/util/fipstools/delocate/testdata/x86_64-Sections/out.s
+++ b/src/util/fipstools/delocate/testdata/x86_64-Sections/out.s
@@ -59,7 +59,7 @@
 OPENSSL_ia32cap_addr_delta:
 .quad OPENSSL_ia32cap_P-OPENSSL_ia32cap_addr_delta
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -93,35 +93,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s b/src/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s
index 7ad8f76..7a57ed4 100644
--- a/src/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s
+++ b/src/util/fipstools/delocate/testdata/x86_64-ThreeArg/out.s
@@ -46,7 +46,7 @@
 OPENSSL_ia32cap_addr_delta:
 .quad OPENSSL_ia32cap_P-OPENSSL_ia32cap_addr_delta
 .type BORINGSSL_bcm_text_hash, @object
-.size BORINGSSL_bcm_text_hash, 64
+.size BORINGSSL_bcm_text_hash, 32
 BORINGSSL_bcm_text_hash:
 .byte 0xae
 .byte 0x2c
@@ -80,35 +80,3 @@
 .byte 0xff
 .byte 0x31
 .byte 0x80
-.byte 0xa2
-.byte 0xd4
-.byte 0xc3
-.byte 0x66
-.byte 0xf
-.byte 0xc2
-.byte 0x6a
-.byte 0x7b
-.byte 0xf4
-.byte 0xbe
-.byte 0x39
-.byte 0xa2
-.byte 0xd7
-.byte 0x25
-.byte 0xdb
-.byte 0x21
-.byte 0x98
-.byte 0xe9
-.byte 0xd5
-.byte 0x53
-.byte 0xbf
-.byte 0x5c
-.byte 0x32
-.byte 0x6
-.byte 0x83
-.byte 0x34
-.byte 0xc
-.byte 0x65
-.byte 0x89
-.byte 0x52
-.byte 0xbd
-.byte 0x1f
diff --git a/src/util/fipstools/fipscommon/const.go b/src/util/fipstools/fipscommon/const.go
index 5693414..f4c0b75 100644
--- a/src/util/fipstools/fipscommon/const.go
+++ b/src/util/fipstools/fipscommon/const.go
@@ -17,6 +17,6 @@
 // UninitHashValue is the default hash value that we inject into the module.
 // This value need only be distinct, i.e. so that we can safely
 // search-and-replace it in an object file.
-var UninitHashValue = [64]byte{
-	0xae, 0x2c, 0xea, 0x2a, 0xbd, 0xa6, 0xf3, 0xec, 0x97, 0x7f, 0x9b, 0xf6, 0x94, 0x9a, 0xfc, 0x83, 0x68, 0x27, 0xcb, 0xa0, 0xa0, 0x9f, 0x6b, 0x6f, 0xde, 0x52, 0xcd, 0xe2, 0xcd, 0xff, 0x31, 0x80, 0xa2, 0xd4, 0xc3, 0x66, 0x0f, 0xc2, 0x6a, 0x7b, 0xf4, 0xbe, 0x39, 0xa2, 0xd7, 0x25, 0xdb, 0x21, 0x98, 0xe9, 0xd5, 0x53, 0xbf, 0x5c, 0x32, 0x06, 0x83, 0x34, 0x0c, 0x65, 0x89, 0x52, 0xbd, 0x1f,
+var UninitHashValue = [32]byte{
+	0xae, 0x2c, 0xea, 0x2a, 0xbd, 0xa6, 0xf3, 0xec, 0x97, 0x7f, 0x9b, 0xf6, 0x94, 0x9a, 0xfc, 0x83, 0x68, 0x27, 0xcb, 0xa0, 0xa0, 0x9f, 0x6b, 0x6f, 0xde, 0x52, 0xcd, 0xe2, 0xcd, 0xff, 0x31, 0x80,
 }
diff --git a/src/util/fipstools/inject_hash/inject_hash.go b/src/util/fipstools/inject_hash/inject_hash.go
index dbd5fb7..6f14982 100644
--- a/src/util/fipstools/inject_hash/inject_hash.go
+++ b/src/util/fipstools/inject_hash/inject_hash.go
@@ -21,7 +21,6 @@
 	"bytes"
 	"crypto/hmac"
 	"crypto/sha256"
-	"crypto/sha512"
 	"debug/elf"
 	"encoding/binary"
 	"errors"
@@ -36,7 +35,7 @@
 	"boringssl.googlesource.com/boringssl/util/fipstools/fipscommon"
 )
 
-func do(outPath, oInput string, arInput string, useSHA256 bool) error {
+func do(outPath, oInput string, arInput string) error {
 	var objectBytes []byte
 	var isStatic bool
 	var perm os.FileMode
@@ -216,11 +215,7 @@
 	}
 
 	var zeroKey [64]byte
-	hashFunc := sha512.New
-	if useSHA256 {
-		hashFunc = sha256.New
-	}
-	mac := hmac.New(hashFunc, zeroKey[:])
+	mac := hmac.New(sha256.New, zeroKey[:])
 
 	if moduleROData != nil {
 		var lengthBytes [8]byte
@@ -257,11 +252,10 @@
 	arInput := flag.String("in-archive", "", "Path to a .a file")
 	oInput := flag.String("in-object", "", "Path to a .o file")
 	outPath := flag.String("o", "", "Path to output object")
-	sha256 := flag.Bool("sha256", false, "Whether to use SHA-256 over SHA-512. This must match what the compiled module expects.")
 
 	flag.Parse()
 
-	if err := do(*outPath, *oInput, *arInput, *sha256); err != nil {
+	if err := do(*outPath, *oInput, *arInput); err != nil {
 		fmt.Fprintf(os.Stderr, "%s\n", err)
 		os.Exit(1)
 	}
diff --git a/src/util/generate_build_files.py b/src/util/generate_build_files.py
index 3263d9b..186fb59 100644
--- a/src/util/generate_build_files.py
+++ b/src/util/generate_build_files.py
@@ -437,7 +437,7 @@
 endif()
 
 if(CMAKE_COMPILER_IS_GNUCXX OR CLANG)
-  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11 -fvisibility=hidden -fno-common -fno-exceptions -fno-rtti")
+  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++14 -fvisibility=hidden -fno-common -fno-exceptions -fno-rtti")
   if(APPLE)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -stdlib=libc++")
   endif()
diff --git a/win-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S b/win-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
new file mode 100644
index 0000000..c647223
--- /dev/null
+++ b/win-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S
@@ -0,0 +1,3025 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(__aarch64__)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include <openssl/arm_arch.h>
+.section	.rodata
+
+.align	7
+Lchacha20_consts:
+.byte	'e','x','p','a','n','d',' ','3','2','-','b','y','t','e',' ','k'
+Linc:
+.long	1,2,3,4
+Lrol8:
+.byte	3,0,1,2, 7,4,5,6, 11,8,9,10, 15,12,13,14
+Lclamp:
+.quad	0x0FFFFFFC0FFFFFFF, 0x0FFFFFFC0FFFFFFC
+
+.text
+
+.def Lpoly_hash_ad_internal
+   .type 32
+.endef
+.align	6
+Lpoly_hash_ad_internal:
+.cfi_startproc
+	cbnz	x4, Lpoly_hash_intro
+	ret
+
+Lpoly_hash_intro:
+	cmp	x4, #16
+	b.lt	Lpoly_hash_ad_tail
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #16
+	b	Lpoly_hash_ad_internal
+
+Lpoly_hash_ad_tail:
+	cbz	x4, Lpoly_hash_ad_ret
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the AAD
+	sub	x4, x4, #1
+
+Lpoly_hash_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, x4]
+	mov	v20.b[0], w11
+	subs	x4, x4, #1
+	b.ge	Lpoly_hash_tail_16_compose
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+Lpoly_hash_ad_ret:
+	ret
+.cfi_endproc
+
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_seal(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *seal_data);
+//
+.globl	chacha20_poly1305_seal
+
+.def chacha20_poly1305_seal
+   .type 32
+.endef
+.align	6
+chacha20_poly1305_seal:
+	AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+	stp	x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset	80
+.cfi_offset	w30, -72
+.cfi_offset	w29, -80
+	mov	x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+	stp	d8, d9, [sp, #16]
+	stp	d10, d11, [sp, #32]
+	stp	d12, d13, [sp, #48]
+	stp	d14, d15, [sp, #64]
+.cfi_offset	b15, -8
+.cfi_offset	b14, -16
+.cfi_offset	b13, -24
+.cfi_offset	b12, -32
+.cfi_offset	b11, -40
+.cfi_offset	b10, -48
+.cfi_offset	b9, -56
+.cfi_offset	b8, -64
+
+	adrp	x11, Lchacha20_consts
+	add	x11, x11, :lo12:Lchacha20_consts
+
+	ld1	{v24.16b - v27.16b}, [x11] // Load the CONSTS, INC, ROL8 and CLAMP values
+	ld1	{v28.16b - v30.16b}, [x5]
+
+	mov	x15, #1 // Prepare the Poly1305 state
+	mov	x8, #0
+	mov	x9, #0
+	mov	x10, #0
+
+	ldr	x12, [x5, #56]   // The total cipher text length includes extra_in_len
+	add	x12, x12, x2
+	mov	v31.d[0], x4  // Store the input and aad lengths
+	mov	v31.d[1], x12
+
+	cmp	x2, #128
+	b.le	Lseal_128 // Optimization for smaller buffers
+
+    // Initially we prepare 5 ChaCha20 blocks. Four to encrypt up to 4 blocks (256 bytes) of plaintext,
+    // and one for the Poly1305 R and S keys. The first four blocks (A0-A3..D0-D3) are computed vertically,
+    // the fifth block (A4-D4) horizontally.
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	sub	x5, x5, #32
+
+	mov	x6, #10
+
+.align	5
+Lseal_init_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lseal_init_rounds
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #4
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	and	v4.16b, v4.16b, v27.16b
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	mov	x16, v4.d[0] // Move the R key to GPRs
+	mov	x17, v4.d[1]
+	mov	v27.16b, v9.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+
+	mov	x3, x0
+	cmp	x2, #256
+	b.le	Lseal_tail
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #256
+
+	mov	x6, #4 // In the first run of the loop we need to hash 256 bytes, therefore we hash one block for the first 4 rounds
+	mov	x7, #6 // and two blocks for the remaining 6, for a total of (1 * 4 + 2 * 6) * 16 = 256
+
+Lseal_main_loop:
+	adrp	x11, Lchacha20_consts
+	add	x11, x11, :lo12:Lchacha20_consts
+
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	sub	x5, x5, #32
+.align	5
+Lseal_main_loop_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x6, x6, #1
+	b.ge	Lseal_main_loop_rounds
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	subs	x7, x7, #1
+	b.gt	Lseal_main_loop_rounds
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #5
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	add	v14.4s, v14.4s, v29.4s
+	add	v19.4s, v19.4s, v30.4s
+
+	cmp	x2, #320
+	b.le	Lseal_tail
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v4.16b
+	eor	v21.16b, v21.16b, v9.16b
+	eor	v22.16b, v22.16b, v14.16b
+	eor	v23.16b, v23.16b, v19.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #320
+
+	mov	x6, #0
+	mov	x7, #10 // For the remainder of the loop we always hash and encrypt 320 bytes per iteration
+
+	b	Lseal_main_loop
+
+Lseal_tail:
+    // This part of the function handles the storage and authentication of the last [0,320) bytes
+    // We assume A0-A4 ... D0-D4 hold at least inl (320 max) bytes of the stream data.
+	cmp	x2, #64
+	b.lt	Lseal_tail_64
+
+    // Store and authenticate 64B blocks per iteration
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v22.d[0]
+	mov	x12, v22.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v23.d[0]
+	mov	x12, v23.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	st1	{v20.16b - v23.16b}, [x0], #64
+	sub	x2, x2, #64
+
+    // Shift the state left by 64 bytes for the next iteration of the loop
+	mov	v0.16b, v1.16b
+	mov	v5.16b, v6.16b
+	mov	v10.16b, v11.16b
+	mov	v15.16b, v16.16b
+
+	mov	v1.16b, v2.16b
+	mov	v6.16b, v7.16b
+	mov	v11.16b, v12.16b
+	mov	v16.16b, v17.16b
+
+	mov	v2.16b, v3.16b
+	mov	v7.16b, v8.16b
+	mov	v12.16b, v13.16b
+	mov	v17.16b, v18.16b
+
+	mov	v3.16b, v4.16b
+	mov	v8.16b, v9.16b
+	mov	v13.16b, v14.16b
+	mov	v18.16b, v19.16b
+
+	b	Lseal_tail
+
+Lseal_tail_64:
+	ldp	x3, x4, [x5, #48] // extra_in_len and extra_in_ptr
+
+    // Here we handle the last [0,64) bytes of plaintext
+	cmp	x2, #16
+	b.lt	Lseal_tail_16
+    // Each iteration encrypt and authenticate a 16B block
+	ld1	{v20.16b}, [x1], #16
+	eor	v20.16b, v20.16b, v0.16b
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	st1	{v20.16b}, [x0], #16
+
+	sub	x2, x2, #16
+
+    // Shift the state left by 16 bytes for the next iteration of the loop
+	mov	v0.16b, v5.16b
+	mov	v5.16b, v10.16b
+	mov	v10.16b, v15.16b
+
+	b	Lseal_tail_64
+
+Lseal_tail_16:
+    // Here we handle the last [0,16) bytes of ciphertext that require a padded block
+	cbz	x2, Lseal_hash_extra
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the plaintext/extra in
+	eor	v21.16b, v21.16b, v21.16b // Use T1 to generate an AND mask that will only mask the ciphertext bytes
+	not	v22.16b, v20.16b
+
+	mov	x6, x2
+	add	x1, x1, x2
+
+	cbz	x4, Lseal_tail_16_compose // No extra data to pad with, zero padding
+
+	mov	x7, #16          // We need to load some extra_in first for padding
+	sub	x7, x7, x2
+	cmp	x4, x7
+	csel	x7, x4, x7, lt // Load the minimum of extra_in_len and the amount needed to fill the register
+	mov	x12, x7
+	add	x3, x3, x7
+	sub	x4, x4, x7
+
+Lseal_tail16_compose_extra_in:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, #-1]!
+	mov	v20.b[0], w11
+	subs	x7, x7, #1
+	b.gt	Lseal_tail16_compose_extra_in
+
+	add	x3, x3, x12
+
+Lseal_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x1, #-1]!
+	mov	v20.b[0], w11
+	ext	v21.16b, v22.16b, v21.16b, #15
+	subs	x2, x2, #1
+	b.gt	Lseal_tail_16_compose
+
+	and	v0.16b, v0.16b, v21.16b
+	eor	v20.16b, v20.16b, v0.16b
+	mov	v21.16b, v20.16b
+
+Lseal_tail_16_store:
+	umov	w11, v20.b[0]
+	strb	w11, [x0], #1
+	ext	v20.16b, v20.16b, v20.16b, #1
+	subs	x6, x6, #1
+	b.gt	Lseal_tail_16_store
+
+    // Hash in the final ct block concatenated with extra_in
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+Lseal_hash_extra:
+	cbz	x4, Lseal_finalize
+
+Lseal_hash_extra_loop:
+	cmp	x4, #16
+	b.lt	Lseal_hash_extra_tail
+	ld1	{v20.16b}, [x3], #16
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #16
+	b	Lseal_hash_extra_loop
+
+Lseal_hash_extra_tail:
+	cbz	x4, Lseal_finalize
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the remaining extra ciphertext
+	add	x3, x3, x4
+
+Lseal_hash_extra_load:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x3, #-1]!
+	mov	v20.b[0], w11
+	subs	x4, x4, #1
+	b.gt	Lseal_hash_extra_load
+
+    // Hash in the final padded extra_in blcok
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+Lseal_finalize:
+	mov	x11, v31.d[0]
+	mov	x12, v31.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+    # Final reduction step
+	sub	x12, xzr, x15
+	orr	x13, xzr, #3
+	subs	x11, x8, #-5
+	sbcs	x12, x9, x12
+	sbcs	x13, x10, x13
+	csel	x8, x11, x8, cs
+	csel	x9, x12, x9, cs
+	csel	x10, x13, x10, cs
+	mov	x11, v27.d[0]
+	mov	x12, v27.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+
+	stp	x8, x9, [x5]
+
+	ldp	d8, d9, [sp, #16]
+	ldp	d10, d11, [sp, #32]
+	ldp	d12, d13, [sp, #48]
+	ldp	d14, d15, [sp, #64]
+.cfi_restore	b15
+.cfi_restore	b14
+.cfi_restore	b13
+.cfi_restore	b12
+.cfi_restore	b11
+.cfi_restore	b10
+.cfi_restore	b9
+.cfi_restore	b8
+	ldp	x29, x30, [sp], 80
+.cfi_restore	w29
+.cfi_restore	w30
+.cfi_def_cfa_offset	0
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+Lseal_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+	eor	v25.16b, v25.16b, v25.16b
+	mov	x11, #1
+	mov	v25.s[0], w11
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v17.16b, v30.16b
+	add	v15.4s, v17.4s, v25.4s
+	add	v16.4s, v15.4s, v25.4s
+
+	mov	x6, #10
+
+Lseal_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lseal_128_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+
+    // Only the first 32 bytes of the third block (counter = 0) are needed,
+    // so skip updating v12 and v17.
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+
+	add	v30.4s, v30.4s, v25.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v30.4s, v30.4s, v25.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	and	v2.16b, v2.16b, v27.16b
+	mov	x16, v2.d[0] // Move the R key to GPRs
+	mov	x17, v2.d[1]
+	mov	v27.16b, v7.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+	b	Lseal_tail
+.cfi_endproc
+
+
+/////////////////////////////////
+//
+// void chacha20_poly1305_open(uint8_t *pt, uint8_t *ct, size_t len_in, uint8_t *ad, size_t len_ad, union open_data *aead_data);
+//
+.globl	chacha20_poly1305_open
+
+.def chacha20_poly1305_open
+   .type 32
+.endef
+.align	6
+chacha20_poly1305_open:
+	AARCH64_SIGN_LINK_REGISTER
+.cfi_startproc
+	stp	x29, x30, [sp, #-80]!
+.cfi_def_cfa_offset	80
+.cfi_offset	w30, -72
+.cfi_offset	w29, -80
+	mov	x29, sp
+# We probably could do .cfi_def_cfa w29, 80 at this point, but since
+# we don't actually use the frame pointer like that, it's probably not
+# worth bothering.
+	stp	d8, d9, [sp, #16]
+	stp	d10, d11, [sp, #32]
+	stp	d12, d13, [sp, #48]
+	stp	d14, d15, [sp, #64]
+.cfi_offset	b15, -8
+.cfi_offset	b14, -16
+.cfi_offset	b13, -24
+.cfi_offset	b12, -32
+.cfi_offset	b11, -40
+.cfi_offset	b10, -48
+.cfi_offset	b9, -56
+.cfi_offset	b8, -64
+
+	adrp	x11, Lchacha20_consts
+	add	x11, x11, :lo12:Lchacha20_consts
+
+	ld1	{v24.16b - v27.16b}, [x11] // Load the CONSTS, INC, ROL8 and CLAMP values
+	ld1	{v28.16b - v30.16b}, [x5]
+
+	mov	x15, #1 // Prepare the Poly1305 state
+	mov	x8, #0
+	mov	x9, #0
+	mov	x10, #0
+
+	mov	v31.d[0], x4  // Store the input and aad lengths
+	mov	v31.d[1], x2
+
+	cmp	x2, #128
+	b.le	Lopen_128 // Optimization for smaller buffers
+
+    // Initially we prepare a single ChaCha20 block for the Poly1305 R and S keys
+	mov	v0.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v15.16b, v30.16b
+
+	mov	x6, #10
+
+.align	5
+Lopen_init_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lopen_init_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+
+	and	v0.16b, v0.16b, v27.16b
+	mov	x16, v0.d[0] // Move the R key to GPRs
+	mov	x17, v0.d[1]
+	mov	v27.16b, v5.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+
+Lopen_ad_done:
+	mov	x3, x1
+
+// Each iteration of the loop hash 320 bytes, and prepare stream for 320 bytes
+Lopen_main_loop:
+
+	cmp	x2, #192
+	b.lt	Lopen_tail
+
+	adrp	x11, Lchacha20_consts
+	add	x11, x11, :lo12:Lchacha20_consts
+
+	ld4r	{v0.4s,v1.4s,v2.4s,v3.4s}, [x11]
+	mov	v4.16b, v24.16b
+
+	ld4r	{v5.4s,v6.4s,v7.4s,v8.4s}, [x5], #16
+	mov	v9.16b, v28.16b
+
+	ld4r	{v10.4s,v11.4s,v12.4s,v13.4s}, [x5], #16
+	mov	v14.16b, v29.16b
+
+	ld4r	{v15.4s,v16.4s,v17.4s,v18.4s}, [x5]
+	sub	x5, x5, #32
+	add	v15.4s, v15.4s, v25.4s
+	mov	v19.16b, v30.16b
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	lsr	x4, x2, #4 // How many whole blocks we have to hash, will always be at least 12
+	sub	x4, x4, #10
+
+	mov	x7, #10
+	subs	x6, x7, x4
+	subs	x6, x7, x4 // itr1 can be negative if we have more than 320 bytes to hash
+	csel	x7, x7, x4, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are full
+
+	cbz	x7, Lopen_main_loop_rounds_short
+
+.align	5
+Lopen_main_loop_rounds:
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+Lopen_main_loop_rounds_short:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v18.8h, v18.8h
+	rev32	v19.8h, v19.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	eor	v8.16b, v8.16b, v13.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v9.4s, #20
+	sli	v8.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	add	v4.4s, v4.4s, v8.4s
+
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	eor	v18.16b, v18.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	add	v13.4s, v13.4s, v18.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v14.16b
+
+	ushr	v9.4s, v8.4s, #25
+	sli	v9.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #4
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #12
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	add	v0.4s, v0.4s, v6.4s
+	add	v1.4s, v1.4s, v7.4s
+	add	v2.4s, v2.4s, v8.4s
+	add	v3.4s, v3.4s, v5.4s
+	add	v4.4s, v4.4s, v9.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	rev32	v18.8h, v18.8h
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+	rev32	v19.8h, v19.8h
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v6.16b, v6.16b, v12.16b
+	eor	v7.16b, v7.16b, v13.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v9.16b, v9.16b, v14.16b
+
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+	ushr	v7.4s, v8.4s, #20
+	sli	v7.4s, v8.4s, #12
+	ushr	v8.4s, v5.4s, #20
+	sli	v8.4s, v5.4s, #12
+	ushr	v5.4s, v9.4s, #20
+	sli	v5.4s, v9.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v8.4s
+	add	v4.4s, v4.4s, v5.4s
+
+	eor	v18.16b, v18.16b, v0.16b
+	eor	v15.16b, v15.16b, v1.16b
+	eor	v16.16b, v16.16b, v2.16b
+	eor	v17.16b, v17.16b, v3.16b
+	eor	v19.16b, v19.16b, v4.16b
+
+	tbl	v18.16b, {v18.16b}, v26.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+	tbl	v19.16b, {v19.16b}, v26.16b
+
+	add	v12.4s, v12.4s, v18.4s
+	add	v13.4s, v13.4s, v15.4s
+	add	v10.4s, v10.4s, v16.4s
+	add	v11.4s, v11.4s, v17.4s
+	add	v14.4s, v14.4s, v19.4s
+
+	eor	v20.16b, v20.16b, v12.16b
+	eor	v6.16b, v6.16b, v13.16b
+	eor	v7.16b, v7.16b, v10.16b
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v5.16b, v5.16b, v14.16b
+
+	ushr	v9.4s, v5.4s, #25
+	sli	v9.4s, v5.4s, #7
+	ushr	v5.4s, v8.4s, #25
+	sli	v5.4s, v8.4s, #7
+	ushr	v8.4s, v7.4s, #25
+	sli	v8.4s, v7.4s, #7
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+
+	ext	v9.16b, v9.16b, v9.16b, #12
+	ext	v14.16b, v14.16b, v14.16b, #8
+	ext	v19.16b, v19.16b, v19.16b, #4
+	subs	x7, x7, #1
+	b.gt	Lopen_main_loop_rounds
+	subs	x6, x6, #1
+	b.ge	Lopen_main_loop_rounds_short
+
+	eor	v20.16b, v20.16b, v20.16b //zero
+	not	v21.16b, v20.16b // -1
+	sub	v21.4s, v25.4s, v21.4s // Add +1
+	ext	v20.16b, v21.16b, v20.16b, #12 // Get the last element (counter)
+	add	v19.4s, v19.4s, v20.4s
+
+	add	v15.4s, v15.4s, v25.4s
+	mov	x11, #5
+	dup	v20.4s, w11
+	add	v25.4s, v25.4s, v20.4s
+
+	zip1	v20.4s, v0.4s, v1.4s
+	zip2	v21.4s, v0.4s, v1.4s
+	zip1	v22.4s, v2.4s, v3.4s
+	zip2	v23.4s, v2.4s, v3.4s
+
+	zip1	v0.2d, v20.2d, v22.2d
+	zip2	v1.2d, v20.2d, v22.2d
+	zip1	v2.2d, v21.2d, v23.2d
+	zip2	v3.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v5.4s, v6.4s
+	zip2	v21.4s, v5.4s, v6.4s
+	zip1	v22.4s, v7.4s, v8.4s
+	zip2	v23.4s, v7.4s, v8.4s
+
+	zip1	v5.2d, v20.2d, v22.2d
+	zip2	v6.2d, v20.2d, v22.2d
+	zip1	v7.2d, v21.2d, v23.2d
+	zip2	v8.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v10.4s, v11.4s
+	zip2	v21.4s, v10.4s, v11.4s
+	zip1	v22.4s, v12.4s, v13.4s
+	zip2	v23.4s, v12.4s, v13.4s
+
+	zip1	v10.2d, v20.2d, v22.2d
+	zip2	v11.2d, v20.2d, v22.2d
+	zip1	v12.2d, v21.2d, v23.2d
+	zip2	v13.2d, v21.2d, v23.2d
+
+	zip1	v20.4s, v15.4s, v16.4s
+	zip2	v21.4s, v15.4s, v16.4s
+	zip1	v22.4s, v17.4s, v18.4s
+	zip2	v23.4s, v17.4s, v18.4s
+
+	zip1	v15.2d, v20.2d, v22.2d
+	zip2	v16.2d, v20.2d, v22.2d
+	zip1	v17.2d, v21.2d, v23.2d
+	zip2	v18.2d, v21.2d, v23.2d
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+
+	add	v1.4s, v1.4s, v24.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	add	v2.4s, v2.4s, v24.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v3.4s, v3.4s, v24.4s
+	add	v8.4s, v8.4s, v28.4s
+	add	v13.4s, v13.4s, v29.4s
+	add	v18.4s, v18.4s, v30.4s
+
+	add	v4.4s, v4.4s, v24.4s
+	add	v9.4s, v9.4s, v28.4s
+	add	v14.4s, v14.4s, v29.4s
+	add	v19.4s, v19.4s, v30.4s
+
+    // We can always safely store 192 bytes
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #192
+
+	mov	v0.16b, v3.16b
+	mov	v5.16b, v8.16b
+	mov	v10.16b, v13.16b
+	mov	v15.16b, v18.16b
+
+	cmp	x2, #64
+	b.lt	Lopen_tail_64_store
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v3.16b
+	eor	v21.16b, v21.16b, v8.16b
+	eor	v22.16b, v22.16b, v13.16b
+	eor	v23.16b, v23.16b, v18.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+
+	mov	v0.16b, v4.16b
+	mov	v5.16b, v9.16b
+	mov	v10.16b, v14.16b
+	mov	v15.16b, v19.16b
+
+	cmp	x2, #64
+	b.lt	Lopen_tail_64_store
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+	eor	v20.16b, v20.16b, v4.16b
+	eor	v21.16b, v21.16b, v9.16b
+	eor	v22.16b, v22.16b, v14.16b
+	eor	v23.16b, v23.16b, v19.16b
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+	b	Lopen_main_loop
+
+Lopen_tail:
+
+	cbz	x2, Lopen_finalize
+
+	lsr	x4, x2, #4 // How many whole blocks we have to hash
+
+	cmp	x2, #64
+	b.le	Lopen_tail_64
+	cmp	x2, #128
+	b.le	Lopen_tail_128
+
+Lopen_tail_192:
+     // We need three more blocks
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v15.16b, v30.16b
+	mov	v16.16b, v30.16b
+	mov	v17.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	eor	v21.16b, v21.16b, v21.16b
+	ins	v23.s[0], v25.s[0]
+	ins	v21.d[0], x15
+
+	add	v22.4s, v23.4s, v21.4s
+	add	v21.4s, v22.4s, v21.4s
+
+	add	v15.4s, v15.4s, v21.4s
+	add	v16.4s, v16.4s, v23.4s
+	add	v17.4s, v17.4s, v22.4s
+
+	mov	x7, #10
+	subs	x6, x7, x4 // itr1 can be negative if we have more than 160 bytes to hash
+	csel	x7, x7, x4, le // if itr1 is zero or less, itr2 should be 10 to indicate all 10 rounds are hashing
+	sub	x4, x4, x7
+
+	cbz	x7, Lopen_tail_192_rounds_no_hash
+
+Lopen_tail_192_rounds:
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+Lopen_tail_192_rounds_no_hash:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x7, x7, #1
+	b.gt	Lopen_tail_192_rounds
+	subs	x6, x6, #1
+	b.ge	Lopen_tail_192_rounds_no_hash
+
+    // We hashed 160 bytes at most, may still have 32 bytes left
+Lopen_tail_192_hash:
+	cbz	x4, Lopen_tail_192_hash_done
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #1
+	b	Lopen_tail_192_hash
+
+Lopen_tail_192_hash_done:
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v12.4s, v12.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v16.4s, v16.4s, v30.4s
+	add	v17.4s, v17.4s, v30.4s
+
+	add	v15.4s, v15.4s, v21.4s
+	add	v16.4s, v16.4s, v23.4s
+	add	v17.4s, v17.4s, v22.4s
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v2.16b
+	eor	v21.16b, v21.16b, v7.16b
+	eor	v22.16b, v22.16b, v12.16b
+	eor	v23.16b, v23.16b, v17.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #128
+	b	Lopen_tail_64_store
+
+Lopen_tail_128:
+     // We need two more blocks
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v15.16b, v30.16b
+	mov	v16.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	eor	v22.16b, v22.16b, v22.16b
+	ins	v23.s[0], v25.s[0]
+	ins	v22.d[0], x15
+	add	v22.4s, v22.4s, v23.4s
+
+	add	v15.4s, v15.4s, v22.4s
+	add	v16.4s, v16.4s, v23.4s
+
+	mov	x6, #10
+	sub	x6, x6, x4
+
+Lopen_tail_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v1.4s, v1.4s, v6.4s
+	eor	v16.16b, v16.16b, v1.16b
+	rev32	v16.8h, v16.8h
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v6.16b, v6.16b, v11.16b
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	add	v1.4s, v1.4s, v20.4s
+	eor	v16.16b, v16.16b, v1.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v20.16b, v20.16b, v11.16b
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v16.16b, v16.16b, v16.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	add	v1.4s, v1.4s, v6.4s
+	eor	v16.16b, v16.16b, v1.16b
+	rev32	v16.8h, v16.8h
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v6.16b, v6.16b, v11.16b
+	ushr	v20.4s, v6.4s, #20
+	sli	v20.4s, v6.4s, #12
+	add	v1.4s, v1.4s, v20.4s
+	eor	v16.16b, v16.16b, v1.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+
+	add	v11.4s, v11.4s, v16.4s
+	eor	v20.16b, v20.16b, v11.16b
+	ushr	v6.4s, v20.4s, #25
+	sli	v6.4s, v20.4s, #7
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v16.16b, v16.16b, v16.16b, #4
+	subs	x6, x6, #1
+	b.gt	Lopen_tail_128_rounds
+	cbz	x4, Lopen_tail_128_rounds_done
+	subs	x4, x4, #1
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	b	Lopen_tail_128_rounds
+
+Lopen_tail_128_rounds_done:
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v16.4s, v16.4s, v30.4s
+	add	v15.4s, v15.4s, v22.4s
+	add	v16.4s, v16.4s, v23.4s
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	eor	v20.16b, v20.16b, v1.16b
+	eor	v21.16b, v21.16b, v6.16b
+	eor	v22.16b, v22.16b, v11.16b
+	eor	v23.16b, v23.16b, v16.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+	sub	x2, x2, #64
+
+	b	Lopen_tail_64_store
+
+Lopen_tail_64:
+    // We just need a single block
+	mov	v0.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v15.16b, v30.16b
+	eor	v23.16b, v23.16b, v23.16b
+	ins	v23.s[0], v25.s[0]
+	add	v15.4s, v15.4s, v23.4s
+
+	mov	x6, #10
+	sub	x6, x6, x4
+
+Lopen_tail_64_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	eor	v15.16b, v15.16b, v0.16b
+	rev32	v15.8h, v15.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v5.16b, v5.16b, v10.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	add	v0.4s, v0.4s, v20.4s
+	eor	v15.16b, v15.16b, v0.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	eor	v20.16b, v20.16b, v10.16b
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v15.16b, v15.16b, v15.16b, #4
+	subs	x6, x6, #1
+	b.gt	Lopen_tail_64_rounds
+	cbz	x4, Lopen_tail_64_rounds_done
+	subs	x4, x4, #1
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	b	Lopen_tail_64_rounds
+
+Lopen_tail_64_rounds_done:
+	add	v0.4s, v0.4s, v24.4s
+	add	v5.4s, v5.4s, v28.4s
+	add	v10.4s, v10.4s, v29.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v15.4s, v15.4s, v23.4s
+
+Lopen_tail_64_store:
+	cmp	x2, #16
+	b.lt	Lopen_tail_16
+
+	ld1	{v20.16b}, [x1], #16
+	eor	v20.16b, v20.16b, v0.16b
+	st1	{v20.16b}, [x0], #16
+	mov	v0.16b, v5.16b
+	mov	v5.16b, v10.16b
+	mov	v10.16b, v15.16b
+	sub	x2, x2, #16
+	b	Lopen_tail_64_store
+
+Lopen_tail_16:
+    // Here we handle the last [0,16) bytes that require a padded block
+	cbz	x2, Lopen_finalize
+
+	eor	v20.16b, v20.16b, v20.16b // Use T0 to load the ciphertext
+	eor	v21.16b, v21.16b, v21.16b // Use T1 to generate an AND mask
+	not	v22.16b, v20.16b
+
+	add	x7, x1, x2
+	mov	x6, x2
+
+Lopen_tail_16_compose:
+	ext	v20.16b, v20.16b, v20.16b, #15
+	ldrb	w11, [x7, #-1]!
+	mov	v20.b[0], w11
+	ext	v21.16b, v22.16b, v21.16b, #15
+	subs	x2, x2, #1
+	b.gt	Lopen_tail_16_compose
+
+	and	v20.16b, v20.16b, v21.16b
+    // Hash in the final padded block
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	eor	v20.16b, v20.16b, v0.16b
+
+Lopen_tail_16_store:
+	umov	w11, v20.b[0]
+	strb	w11, [x0], #1
+	ext	v20.16b, v20.16b, v20.16b, #1
+	subs	x6, x6, #1
+	b.gt	Lopen_tail_16_store
+
+Lopen_finalize:
+	mov	x11, v31.d[0]
+	mov	x12, v31.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+    # Final reduction step
+	sub	x12, xzr, x15
+	orr	x13, xzr, #3
+	subs	x11, x8, #-5
+	sbcs	x12, x9, x12
+	sbcs	x13, x10, x13
+	csel	x8, x11, x8, cs
+	csel	x9, x12, x9, cs
+	csel	x10, x13, x10, cs
+	mov	x11, v27.d[0]
+	mov	x12, v27.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+
+	stp	x8, x9, [x5]
+
+	ldp	d8, d9, [sp, #16]
+	ldp	d10, d11, [sp, #32]
+	ldp	d12, d13, [sp, #48]
+	ldp	d14, d15, [sp, #64]
+.cfi_restore	b15
+.cfi_restore	b14
+.cfi_restore	b13
+.cfi_restore	b12
+.cfi_restore	b11
+.cfi_restore	b10
+.cfi_restore	b9
+.cfi_restore	b8
+	ldp	x29, x30, [sp], 80
+.cfi_restore	w29
+.cfi_restore	w30
+.cfi_def_cfa_offset	0
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+Lopen_128:
+    // On some architectures preparing 5 blocks for small buffers is wasteful
+	eor	v25.16b, v25.16b, v25.16b
+	mov	x11, #1
+	mov	v25.s[0], w11
+	mov	v0.16b, v24.16b
+	mov	v1.16b, v24.16b
+	mov	v2.16b, v24.16b
+	mov	v5.16b, v28.16b
+	mov	v6.16b, v28.16b
+	mov	v7.16b, v28.16b
+	mov	v10.16b, v29.16b
+	mov	v11.16b, v29.16b
+	mov	v12.16b, v29.16b
+	mov	v17.16b, v30.16b
+	add	v15.4s, v17.4s, v25.4s
+	add	v16.4s, v15.4s, v25.4s
+
+	mov	x6, #10
+
+Lopen_128_rounds:
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v6.16b, v6.16b, v6.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #12
+	ext	v16.16b, v16.16b, v16.16b, #12
+	ext	v17.16b, v17.16b, v17.16b, #12
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	rev32	v15.8h, v15.8h
+	rev32	v16.8h, v16.8h
+	rev32	v17.8h, v17.8h
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v5.16b, v5.16b, v10.16b
+	eor	v6.16b, v6.16b, v11.16b
+	eor	v7.16b, v7.16b, v12.16b
+	ushr	v20.4s, v5.4s, #20
+	sli	v20.4s, v5.4s, #12
+	ushr	v5.4s, v6.4s, #20
+	sli	v5.4s, v6.4s, #12
+	ushr	v6.4s, v7.4s, #20
+	sli	v6.4s, v7.4s, #12
+
+	add	v0.4s, v0.4s, v20.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v16.16b, v16.16b, v1.16b
+	eor	v17.16b, v17.16b, v2.16b
+	tbl	v15.16b, {v15.16b}, v26.16b
+	tbl	v16.16b, {v16.16b}, v26.16b
+	tbl	v17.16b, {v17.16b}, v26.16b
+
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v16.4s
+	add	v12.4s, v12.4s, v17.4s
+	eor	v20.16b, v20.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v6.16b, v6.16b, v12.16b
+	ushr	v7.4s, v6.4s, #25
+	sli	v7.4s, v6.4s, #7
+	ushr	v6.4s, v5.4s, #25
+	sli	v6.4s, v5.4s, #7
+	ushr	v5.4s, v20.4s, #25
+	sli	v5.4s, v20.4s, #7
+
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v6.16b, v6.16b, v6.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+
+	ext	v10.16b, v10.16b, v10.16b, #8
+	ext	v11.16b, v11.16b, v11.16b, #8
+	ext	v12.16b, v12.16b, v12.16b, #8
+
+	ext	v15.16b, v15.16b, v15.16b, #4
+	ext	v16.16b, v16.16b, v16.16b, #4
+	ext	v17.16b, v17.16b, v17.16b, #4
+	subs	x6, x6, #1
+	b.hi	Lopen_128_rounds
+
+	add	v0.4s, v0.4s, v24.4s
+	add	v1.4s, v1.4s, v24.4s
+	add	v2.4s, v2.4s, v24.4s
+
+	add	v5.4s, v5.4s, v28.4s
+	add	v6.4s, v6.4s, v28.4s
+	add	v7.4s, v7.4s, v28.4s
+
+	add	v10.4s, v10.4s, v29.4s
+	add	v11.4s, v11.4s, v29.4s
+
+	add	v30.4s, v30.4s, v25.4s
+	add	v15.4s, v15.4s, v30.4s
+	add	v30.4s, v30.4s, v25.4s
+	add	v16.4s, v16.4s, v30.4s
+
+	and	v2.16b, v2.16b, v27.16b
+	mov	x16, v2.d[0] // Move the R key to GPRs
+	mov	x17, v2.d[1]
+	mov	v27.16b, v7.16b // Store the S key
+
+	bl	Lpoly_hash_ad_internal
+
+Lopen_128_store:
+	cmp	x2, #64
+	b.lt	Lopen_128_store_64
+
+	ld1	{v20.16b - v23.16b}, [x1], #64
+
+	mov	x11, v20.d[0]
+	mov	x12, v20.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v21.d[0]
+	mov	x12, v21.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v22.d[0]
+	mov	x12, v22.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	mov	x11, v23.d[0]
+	mov	x12, v23.d[1]
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+
+	eor	v20.16b, v20.16b, v0.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v10.16b
+	eor	v23.16b, v23.16b, v15.16b
+
+	st1	{v20.16b - v23.16b}, [x0], #64
+
+	sub	x2, x2, #64
+
+	mov	v0.16b, v1.16b
+	mov	v5.16b, v6.16b
+	mov	v10.16b, v11.16b
+	mov	v15.16b, v16.16b
+
+Lopen_128_store_64:
+
+	lsr	x4, x2, #4
+	mov	x3, x1
+
+Lopen_128_hash_64:
+	cbz	x4, Lopen_tail_64_store
+	ldp	x11, x12, [x3], 16
+	adds	x8, x8, x11
+	adcs	x9, x9, x12
+	adc	x10, x10, x15
+	mul	x11, x8, x16     // [t2:t1:t0] = [acc2:acc1:acc0] * r0
+	umulh	x12, x8, x16
+	mul	x13, x9, x16
+	umulh	x14, x9, x16
+	adds	x12, x12, x13
+	mul	x13, x10, x16
+	adc	x13, x13, x14
+	mul	x14, x8, x17       // [t3:t2:t1:t0] = [acc2:acc1:acc0] * [r1:r0]
+	umulh	x8, x8, x17
+	adds	x12, x12, x14
+	mul	x14, x9, x17
+	umulh	x9, x9, x17
+	adcs	x14, x14, x8
+	mul	x10, x10, x17
+	adc	x10, x10, x9
+	adds	x13, x13, x14
+	adc	x14, x10, xzr
+	and	x10, x13, #3         // At this point acc2 is 2 bits at most (value of 3)
+	and	x8, x13, #-4
+	extr	x13, x14, x13, #2
+	adds	x8, x8, x11
+	lsr	x11, x14, #2
+	adc	x9, x14, x11        // No carry out since t0 is 61 bits and t3 is 63 bits
+	adds	x8, x8, x13
+	adcs	x9, x9, x12
+	adc	x10, x10, xzr      // At this point acc2 has the value of 4 at most
+	sub	x4, x4, #1
+	b	Lopen_128_hash_64
+.cfi_endproc
+
+#endif
+#endif  // !OPENSSL_NO_ASM
diff --git a/win-aarch64/crypto/fipsmodule/p256-armv8-asm.S b/win-aarch64/crypto/fipsmodule/p256-armv8-asm.S
new file mode 100644
index 0000000..4ebf3ab
--- /dev/null
+++ b/win-aarch64/crypto/fipsmodule/p256-armv8-asm.S
@@ -0,0 +1,1808 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(__aarch64__)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include "openssl/arm_arch.h"
+
+.text
+.align	5
+Lpoly:
+.quad	0xffffffffffffffff,0x00000000ffffffff,0x0000000000000000,0xffffffff00000001
+LRR:	//	2^512 mod P precomputed for NIST P256 polynomial
+.quad	0x0000000000000003,0xfffffffbffffffff,0xfffffffffffffffe,0x00000004fffffffd
+Lone_mont:
+.quad	0x0000000000000001,0xffffffff00000000,0xffffffffffffffff,0x00000000fffffffe
+Lone:
+.quad	1,0,0,0
+Lord:
+.quad	0xf3b9cac2fc632551,0xbce6faada7179e84,0xffffffffffffffff,0xffffffff00000000
+LordK:
+.quad	0xccd1c8aaee00bc4f
+.byte	69,67,80,95,78,73,83,84,90,50,53,54,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
+.align	2
+
+// void	ecp_nistz256_to_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_to_mont
+
+.def ecp_nistz256_to_mont
+   .type 32
+.endef
+.align	6
+ecp_nistz256_to_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	x3,LRR		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	adr	x2,LRR		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_from_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_from_mont
+
+.def ecp_nistz256_from_mont
+   .type 32
+.endef
+.align	4
+ecp_nistz256_from_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	mov	x3,#1			// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	adr	x2,Lone		// &bp[0]
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_mul_mont(BN_ULONG x0[4],const BN_ULONG x1[4],
+//					     const BN_ULONG x2[4]);
+.globl	ecp_nistz256_mul_mont
+
+.def ecp_nistz256_mul_mont
+   .type 32
+.endef
+.align	4
+ecp_nistz256_mul_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldr	x3,[x2]		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_mul_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_sqr_mont(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_sqr_mont
+
+.def ecp_nistz256_sqr_mont
+   .type 32
+.endef
+.align	4
+ecp_nistz256_sqr_mont:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-32]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_sqr_mont
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x29,x30,[sp],#32
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_div_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_div_by_2
+
+.def ecp_nistz256_div_by_2
+   .type 32
+.endef
+.align	4
+ecp_nistz256_div_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_div_by_2
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_mul_by_2(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_mul_by_2
+
+.def ecp_nistz256_mul_by_2
+   .type 32
+.endef
+.align	4
+ecp_nistz256_mul_by_2:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_mul_by_3(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_mul_by_3
+
+.def ecp_nistz256_mul_by_3
+   .type 32
+.endef
+.align	4
+ecp_nistz256_mul_by_3:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	mov	x4,x14
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+
+	bl	__ecp_nistz256_add_to	// ret = a+a	// 2*a
+
+	mov	x8,x4
+	mov	x9,x5
+	mov	x10,x6
+	mov	x11,x7
+
+	bl	__ecp_nistz256_add_to	// ret += a	// 2*a+a=3*a
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_sub(BN_ULONG x0[4],const BN_ULONG x1[4],
+//				        const BN_ULONG x2[4]);
+.globl	ecp_nistz256_sub
+
+.def ecp_nistz256_sub
+   .type 32
+.endef
+.align	4
+ecp_nistz256_sub:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	ldp	x14,x15,[x1]
+	ldp	x16,x17,[x1,#16]
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// void	ecp_nistz256_neg(BN_ULONG x0[4],const BN_ULONG x1[4]);
+.globl	ecp_nistz256_neg
+
+.def ecp_nistz256_neg
+   .type 32
+.endef
+.align	4
+ecp_nistz256_neg:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-16]!
+	add	x29,sp,#0
+
+	mov	x2,x1
+	mov	x14,xzr		// a = 0
+	mov	x15,xzr
+	mov	x16,xzr
+	mov	x17,xzr
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	bl	__ecp_nistz256_sub_from
+
+	ldp	x29,x30,[sp],#16
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+
+// note that __ecp_nistz256_mul_mont expects a[0-3] input pre-loaded
+// to x4-x7 and b[0] - to x3
+.def __ecp_nistz256_mul_mont
+   .type 32
+.endef
+.align	4
+__ecp_nistz256_mul_mont:
+	mul	x14,x4,x3		// a[0]*b[0]
+	umulh	x8,x4,x3
+
+	mul	x15,x5,x3		// a[1]*b[0]
+	umulh	x9,x5,x3
+
+	mul	x16,x6,x3		// a[2]*b[0]
+	umulh	x10,x6,x3
+
+	mul	x17,x7,x3		// a[3]*b[0]
+	umulh	x11,x7,x3
+	ldr	x3,[x2,#8]		// b[1]
+
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adc	x19,xzr,x11
+	mov	x20,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	ldr	x3,[x2,#8*(1+1)]	// b[1+1]
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	ldr	x3,[x2,#8*(2+1)]	// b[2+1]
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	mul	x8,x4,x3		// lo(a[0]*b[i])
+	adcs	x15,x16,x9
+	mul	x9,x5,x3		// lo(a[1]*b[i])
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	mul	x10,x6,x3		// lo(a[2]*b[i])
+	adcs	x17,x19,x11
+	mul	x11,x7,x3		// lo(a[3]*b[i])
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts of multiplication
+	umulh	x8,x4,x3		// hi(a[0]*b[i])
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3		// hi(a[1]*b[i])
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3		// hi(a[2]*b[i])
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3		// hi(a[3]*b[i])
+	adc	x19,x19,xzr
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	lsl	x8,x14,#32
+	adcs	x16,x16,x9
+	lsr	x9,x14,#32
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	// last reduction
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	adcs	x17,x19,x11
+	adc	x19,x20,xzr
+
+	adds	x8,x14,#1		// subs	x8,x14,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x19,xzr		// did it borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+// note that __ecp_nistz256_sqr_mont expects a[0-3] input pre-loaded
+// to x4-x7
+.def __ecp_nistz256_sqr_mont
+   .type 32
+.endef
+.align	4
+__ecp_nistz256_sqr_mont:
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is , i.e. follow 
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	x15,x5,x4		// a[1]*a[0]
+	umulh	x9,x5,x4
+	mul	x16,x6,x4		// a[2]*a[0]
+	umulh	x10,x6,x4
+	mul	x17,x7,x4		// a[3]*a[0]
+	umulh	x19,x7,x4
+
+	adds	x16,x16,x9		// accumulate high parts of multiplication
+	mul	x8,x6,x5		// a[2]*a[1]
+	umulh	x9,x6,x5
+	adcs	x17,x17,x10
+	mul	x10,x7,x5		// a[3]*a[1]
+	umulh	x11,x7,x5
+	adc	x19,x19,xzr		// can't overflow
+
+	mul	x20,x7,x6		// a[3]*a[2]
+	umulh	x1,x7,x6
+
+	adds	x9,x9,x10		// accumulate high parts of multiplication
+	mul	x14,x4,x4		// a[0]*a[0]
+	adc	x10,x11,xzr		// can't overflow
+
+	adds	x17,x17,x8		// accumulate low parts of multiplication
+	umulh	x4,x4,x4
+	adcs	x19,x19,x9
+	mul	x9,x5,x5		// a[1]*a[1]
+	adcs	x20,x20,x10
+	umulh	x5,x5,x5
+	adc	x1,x1,xzr		// can't overflow
+
+	adds	x15,x15,x15	// acc[1-6]*=2
+	mul	x10,x6,x6		// a[2]*a[2]
+	adcs	x16,x16,x16
+	umulh	x6,x6,x6
+	adcs	x17,x17,x17
+	mul	x11,x7,x7		// a[3]*a[3]
+	adcs	x19,x19,x19
+	umulh	x7,x7,x7
+	adcs	x20,x20,x20
+	adcs	x1,x1,x1
+	adc	x2,xzr,xzr
+
+	adds	x15,x15,x4		// +a[i]*a[i]
+	adcs	x16,x16,x9
+	adcs	x17,x17,x5
+	adcs	x19,x19,x10
+	adcs	x20,x20,x6
+	lsl	x8,x14,#32
+	adcs	x1,x1,x11
+	lsr	x9,x14,#32
+	adc	x2,x2,x7
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	lsl	x8,x14,#32
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	lsr	x9,x14,#32
+	adc	x17,x11,xzr		// can't overflow
+	subs	x10,x14,x8		// "*0xffff0001"
+	sbc	x11,x14,x9
+	adds	x14,x15,x8		// +=acc[0]<<96 and omit acc[0]
+	adcs	x15,x16,x9
+	adcs	x16,x17,x10		// +=acc[0]*0xffff0001
+	adc	x17,x11,xzr		// can't overflow
+
+	adds	x14,x14,x19	// accumulate upper half
+	adcs	x15,x15,x20
+	adcs	x16,x16,x1
+	adcs	x17,x17,x2
+	adc	x19,xzr,xzr
+
+	adds	x8,x14,#1		// subs	x8,x14,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x19,xzr		// did it borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+// Note that __ecp_nistz256_add_to expects both input vectors pre-loaded to
+// x4-x7 and x8-x11. This is done because it's used in multiple
+// contexts, e.g. in multiplication by 2 and 3...
+.def __ecp_nistz256_add_to
+   .type 32
+.endef
+.align	4
+__ecp_nistz256_add_to:
+	adds	x14,x14,x8		// ret = a+b
+	adcs	x15,x15,x9
+	adcs	x16,x16,x10
+	adcs	x17,x17,x11
+	adc	x1,xzr,xzr		// zap x1
+
+	adds	x8,x14,#1		// subs	x8,x4,#-1 // tmp = ret-modulus
+	sbcs	x9,x15,x12
+	sbcs	x10,x16,xzr
+	sbcs	x11,x17,x13
+	sbcs	xzr,x1,xzr		// did subtraction borrow?
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+.def __ecp_nistz256_sub_from
+   .type 32
+.endef
+.align	4
+__ecp_nistz256_sub_from:
+	ldp	x8,x9,[x2]
+	ldp	x10,x11,[x2,#16]
+	subs	x14,x14,x8		// ret = a-b
+	sbcs	x15,x15,x9
+	sbcs	x16,x16,x10
+	sbcs	x17,x17,x11
+	sbc	x1,xzr,xzr		// zap x1
+
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = ret+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adc	x11,x17,x13
+	cmp	x1,xzr			// did subtraction borrow?
+
+	csel	x14,x14,x8,eq	// ret = borrow ? ret+modulus : ret
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,eq
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+.def __ecp_nistz256_sub_morf
+   .type 32
+.endef
+.align	4
+__ecp_nistz256_sub_morf:
+	ldp	x8,x9,[x2]
+	ldp	x10,x11,[x2,#16]
+	subs	x14,x8,x14		// ret = b-a
+	sbcs	x15,x9,x15
+	sbcs	x16,x10,x16
+	sbcs	x17,x11,x17
+	sbc	x1,xzr,xzr		// zap x1
+
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = ret+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adc	x11,x17,x13
+	cmp	x1,xzr			// did subtraction borrow?
+
+	csel	x14,x14,x8,eq	// ret = borrow ? ret+modulus : ret
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,eq
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+
+.def __ecp_nistz256_div_by_2
+   .type 32
+.endef
+.align	4
+__ecp_nistz256_div_by_2:
+	subs	x8,x14,#1		// adds	x8,x4,#-1 // tmp = a+modulus
+	adcs	x9,x15,x12
+	adcs	x10,x16,xzr
+	adcs	x11,x17,x13
+	adc	x1,xzr,xzr		// zap x1
+	tst	x14,#1		// is a even?
+
+	csel	x14,x14,x8,eq	// ret = even ? a : a+modulus
+	csel	x15,x15,x9,eq
+	csel	x16,x16,x10,eq
+	csel	x17,x17,x11,eq
+	csel	x1,xzr,x1,eq
+
+	lsr	x14,x14,#1		// ret >>= 1
+	orr	x14,x14,x15,lsl#63
+	lsr	x15,x15,#1
+	orr	x15,x15,x16,lsl#63
+	lsr	x16,x16,#1
+	orr	x16,x16,x17,lsl#63
+	lsr	x17,x17,#1
+	stp	x14,x15,[x0]
+	orr	x17,x17,x1,lsl#63
+	stp	x16,x17,[x0,#16]
+
+	ret
+
+.globl	ecp_nistz256_point_double
+
+.def ecp_nistz256_point_double
+   .type 32
+.endef
+.align	5
+ecp_nistz256_point_double:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	sub	sp,sp,#32*4
+
+Ldouble_shortcut:
+	ldp	x14,x15,[x1,#32]
+	mov	x21,x0
+	ldp	x16,x17,[x1,#48]
+	mov	x22,x1
+	ldr	x12,Lpoly+8
+	mov	x8,x14
+	ldr	x13,Lpoly+24
+	mov	x9,x15
+	ldp	x4,x5,[x22,#64]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[x22,#64+16]
+	add	x0,sp,#0
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(S, in_y);
+
+	add	x0,sp,#64
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Zsqr, in_z);
+
+	ldp	x8,x9,[x22]
+	ldp	x10,x11,[x22,#16]
+	mov	x4,x14		// put Zsqr aside for p256_sub
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x0,sp,#32
+	bl	__ecp_nistz256_add_to	// p256_add(M, Zsqr, in_x);
+
+	add	x2,x22,#0
+	mov	x14,x4		// restore Zsqr
+	mov	x15,x5
+	ldp	x4,x5,[sp,#0]	// forward load for p256_sqr_mont
+	mov	x16,x6
+	mov	x17,x7
+	ldp	x6,x7,[sp,#0+16]
+	add	x0,sp,#64
+	bl	__ecp_nistz256_sub_morf	// p256_sub(Zsqr, in_x, Zsqr);
+
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(S, S);
+
+	ldr	x3,[x22,#32]
+	ldp	x4,x5,[x22,#64]
+	ldp	x6,x7,[x22,#64+16]
+	add	x2,x22,#32
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(tmp0, in_z, in_y);
+
+	mov	x8,x14
+	mov	x9,x15
+	ldp	x4,x5,[sp,#0]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[sp,#0+16]
+	add	x0,x21,#64
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(res_z, tmp0);
+
+	add	x0,sp,#96
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(tmp0, S);
+
+	ldr	x3,[sp,#64]		// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x0,x21,#32
+	bl	__ecp_nistz256_div_by_2	// p256_div_by_2(res_y, tmp0);
+
+	add	x2,sp,#64
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(M, M, Zsqr);
+
+	mov	x8,x14		// duplicate M
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	mov	x4,x14		// put M aside
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x0,sp,#32
+	bl	__ecp_nistz256_add_to
+	mov	x8,x4			// restore M
+	mov	x9,x5
+	ldr	x3,[x22]		// forward load for p256_mul_mont
+	mov	x10,x6
+	ldp	x4,x5,[sp,#0]
+	mov	x11,x7
+	ldp	x6,x7,[sp,#0+16]
+	bl	__ecp_nistz256_add_to	// p256_mul_by_3(M, M);
+
+	add	x2,x22,#0
+	add	x0,sp,#0
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, in_x);
+
+	mov	x8,x14
+	mov	x9,x15
+	ldp	x4,x5,[sp,#32]	// forward load for p256_sqr_mont
+	mov	x10,x16
+	mov	x11,x17
+	ldp	x6,x7,[sp,#32+16]
+	add	x0,sp,#96
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(tmp0, S);
+
+	add	x0,x21,#0
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(res_x, M);
+
+	add	x2,sp,#96
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_x, res_x, tmp0);
+
+	add	x2,sp,#0
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(S, S, res_x);
+
+	ldr	x3,[sp,#32]
+	mov	x4,x14		// copy S
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	add	x2,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S, S, M);
+
+	add	x2,x21,#32
+	add	x0,x21,#32
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, S, res_y);
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+.globl	ecp_nistz256_point_add
+
+.def ecp_nistz256_point_add
+   .type 32
+.endef
+.align	5
+ecp_nistz256_point_add:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-96]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	stp	x27,x28,[sp,#80]
+	sub	sp,sp,#32*12
+
+	ldp	x4,x5,[x2,#64]	// in2_z
+	ldp	x6,x7,[x2,#64+16]
+	mov	x21,x0
+	mov	x22,x1
+	mov	x23,x2
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x25,x8,x10
+	cmp	x25,#0
+	csetm	x25,ne		// ~in2infty
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z2sqr, in2_z);
+
+	ldp	x4,x5,[x22,#64]	// in1_z
+	ldp	x6,x7,[x22,#64+16]
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x24,x8,x10
+	cmp	x24,#0
+	csetm	x24,ne		// ~in1infty
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	ldr	x3,[x23,#64]
+	ldp	x4,x5,[sp,#192]
+	ldp	x6,x7,[sp,#192+16]
+	add	x2,x23,#64
+	add	x0,sp,#320
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, Z2sqr, in2_z);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,x22,#64
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	x3,[x22,#32]
+	ldp	x4,x5,[sp,#320]
+	ldp	x6,x7,[sp,#320+16]
+	add	x2,x22,#32
+	add	x0,sp,#320
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S1, S1, in1_y);
+
+	ldr	x3,[x23,#32]
+	ldp	x4,x5,[sp,#352]
+	ldp	x6,x7,[sp,#352+16]
+	add	x2,x23,#32
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	x2,sp,#320
+	ldr	x3,[sp,#192]	// forward load for p256_mul_mont
+	ldp	x4,x5,[x22]
+	ldp	x6,x7,[x22,#16]
+	add	x0,sp,#160
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, S1);
+
+	orr	x14,x14,x15	// see if result is zero
+	orr	x16,x16,x17
+	orr	x26,x14,x16	// ~is_equal(S1,S2)
+
+	add	x2,sp,#192
+	add	x0,sp,#256
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U1, in1_x, Z2sqr);
+
+	ldr	x3,[sp,#128]
+	ldp	x4,x5,[x23]
+	ldp	x6,x7,[x23,#16]
+	add	x2,sp,#128
+	add	x0,sp,#288
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in2_x, Z1sqr);
+
+	add	x2,sp,#256
+	ldp	x4,x5,[sp,#160]	// forward load for p256_sqr_mont
+	ldp	x6,x7,[sp,#160+16]
+	add	x0,sp,#96
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, U1);
+
+	orr	x14,x14,x15	// see if result is zero
+	orr	x16,x16,x17
+	orr	x14,x14,x16	// ~is_equal(U1,U2)
+
+	mvn	x27,x24	// -1/0 -> 0/-1
+	mvn	x28,x25	// -1/0 -> 0/-1
+	orr	x14,x14,x27
+	orr	x14,x14,x28
+	orr	x14,x14,x26
+	cbnz	x14,Ladd_proceed	// if(~is_equal(U1,U2) | in1infty | in2infty | ~is_equal(S1,S2))
+
+Ladd_double:
+	mov	x1,x22
+	mov	x0,x21
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	add	sp,sp,#256	// #256 is from #32*(12-4). difference in stack frames
+	b	Ldouble_shortcut
+
+.align	4
+Ladd_proceed:
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#96]
+	ldp	x6,x7,[sp,#96+16]
+	add	x2,x22,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldp	x4,x5,[sp,#96]
+	ldp	x6,x7,[sp,#96+16]
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldr	x3,[x23,#64]
+	ldp	x4,x5,[sp,#64]
+	ldp	x6,x7,[sp,#64+16]
+	add	x2,x23,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, res_z, in2_z);
+
+	ldr	x3,[sp,#96]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,sp,#96
+	add	x0,sp,#224
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	x3,[sp,#128]
+	ldp	x4,x5,[sp,#256]
+	ldp	x6,x7,[sp,#256+16]
+	add	x2,sp,#128
+	add	x0,sp,#288
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, U1, Hsqr);
+
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	add	x0,sp,#128
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	x2,sp,#192
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	x2,sp,#224
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	x2,sp,#288
+	ldr	x3,[sp,#224]		// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#320]
+	ldp	x6,x7,[sp,#320+16]
+	add	x0,sp,#32
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	x2,sp,#224
+	add	x0,sp,#352
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S1, Hcub);
+
+	ldr	x3,[sp,#160]
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x2,sp,#160
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	x2,sp,#352
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	x4,x5,[sp,#0]		// res
+	ldp	x6,x7,[sp,#0+16]
+	ldp	x8,x9,[x23]		// in2
+	ldp	x10,x11,[x23,#16]
+	ldp	x14,x15,[x22,#0]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#0+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+0+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+0+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#0+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#0+48]
+	stp	x14,x15,[x21,#0]
+	stp	x16,x17,[x21,#0+16]
+	ldp	x14,x15,[x22,#32]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#32+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+32+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+32+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#32+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#32+48]
+	stp	x14,x15,[x21,#32]
+	stp	x16,x17,[x21,#32+16]
+	ldp	x14,x15,[x22,#64]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#64+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	stp	x14,x15,[x21,#64]
+	stp	x16,x17,[x21,#64+16]
+
+Ladd_done:
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x27,x28,[x29,#80]
+	ldp	x29,x30,[sp],#96
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+.globl	ecp_nistz256_point_add_affine
+
+.def ecp_nistz256_point_add_affine
+   .type 32
+.endef
+.align	5
+ecp_nistz256_point_add_affine:
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-80]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	sub	sp,sp,#32*10
+
+	mov	x21,x0
+	mov	x22,x1
+	mov	x23,x2
+	ldr	x12,Lpoly+8
+	ldr	x13,Lpoly+24
+
+	ldp	x4,x5,[x1,#64]	// in1_z
+	ldp	x6,x7,[x1,#64+16]
+	orr	x8,x4,x5
+	orr	x10,x6,x7
+	orr	x24,x8,x10
+	cmp	x24,#0
+	csetm	x24,ne		// ~in1infty
+
+	ldp	x14,x15,[x2]	// in2_x
+	ldp	x16,x17,[x2,#16]
+	ldp	x8,x9,[x2,#32]	// in2_y
+	ldp	x10,x11,[x2,#48]
+	orr	x14,x14,x15
+	orr	x16,x16,x17
+	orr	x8,x8,x9
+	orr	x10,x10,x11
+	orr	x14,x14,x16
+	orr	x8,x8,x10
+	orr	x25,x14,x8
+	cmp	x25,#0
+	csetm	x25,ne		// ~in2infty
+
+	add	x0,sp,#128
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Z1sqr, in1_z);
+
+	mov	x4,x14
+	mov	x5,x15
+	mov	x6,x16
+	mov	x7,x17
+	ldr	x3,[x23]
+	add	x2,x23,#0
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, Z1sqr, in2_x);
+
+	add	x2,x22,#0
+	ldr	x3,[x22,#64]	// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x0,sp,#160
+	bl	__ecp_nistz256_sub_from	// p256_sub(H, U2, in1_x);
+
+	add	x2,x22,#64
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, Z1sqr, in1_z);
+
+	ldr	x3,[x22,#64]
+	ldp	x4,x5,[sp,#160]
+	ldp	x6,x7,[sp,#160+16]
+	add	x2,x22,#64
+	add	x0,sp,#64
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_z, H, in1_z);
+
+	ldr	x3,[x23,#32]
+	ldp	x4,x5,[sp,#128]
+	ldp	x6,x7,[sp,#128+16]
+	add	x2,x23,#32
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, S2, in2_y);
+
+	add	x2,x22,#32
+	ldp	x4,x5,[sp,#160]	// forward load for p256_sqr_mont
+	ldp	x6,x7,[sp,#160+16]
+	add	x0,sp,#192
+	bl	__ecp_nistz256_sub_from	// p256_sub(R, S2, in1_y);
+
+	add	x0,sp,#224
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Hsqr, H);
+
+	ldp	x4,x5,[sp,#192]
+	ldp	x6,x7,[sp,#192+16]
+	add	x0,sp,#288
+	bl	__ecp_nistz256_sqr_mont	// p256_sqr_mont(Rsqr, R);
+
+	ldr	x3,[sp,#160]
+	ldp	x4,x5,[sp,#224]
+	ldp	x6,x7,[sp,#224+16]
+	add	x2,sp,#160
+	add	x0,sp,#256
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(Hcub, Hsqr, H);
+
+	ldr	x3,[x22]
+	ldp	x4,x5,[sp,#224]
+	ldp	x6,x7,[sp,#224+16]
+	add	x2,x22,#0
+	add	x0,sp,#96
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(U2, in1_x, Hsqr);
+
+	mov	x8,x14
+	mov	x9,x15
+	mov	x10,x16
+	mov	x11,x17
+	add	x0,sp,#224
+	bl	__ecp_nistz256_add_to	// p256_mul_by_2(Hsqr, U2);
+
+	add	x2,sp,#288
+	add	x0,sp,#0
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_x, Rsqr, Hsqr);
+
+	add	x2,sp,#256
+	bl	__ecp_nistz256_sub_from	//  p256_sub(res_x, res_x, Hcub);
+
+	add	x2,sp,#96
+	ldr	x3,[x22,#32]	// forward load for p256_mul_mont
+	ldp	x4,x5,[sp,#256]
+	ldp	x6,x7,[sp,#256+16]
+	add	x0,sp,#32
+	bl	__ecp_nistz256_sub_morf	// p256_sub(res_y, U2, res_x);
+
+	add	x2,x22,#32
+	add	x0,sp,#128
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(S2, in1_y, Hcub);
+
+	ldr	x3,[sp,#192]
+	ldp	x4,x5,[sp,#32]
+	ldp	x6,x7,[sp,#32+16]
+	add	x2,sp,#192
+	add	x0,sp,#32
+	bl	__ecp_nistz256_mul_mont	// p256_mul_mont(res_y, res_y, R);
+
+	add	x2,sp,#128
+	bl	__ecp_nistz256_sub_from	// p256_sub(res_y, res_y, S2);
+
+	ldp	x4,x5,[sp,#0]		// res
+	ldp	x6,x7,[sp,#0+16]
+	ldp	x8,x9,[x23]		// in2
+	ldp	x10,x11,[x23,#16]
+	ldp	x14,x15,[x22,#0]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#0+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+0+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+0+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#0+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#0+48]
+	stp	x14,x15,[x21,#0]
+	stp	x16,x17,[x21,#0+16]
+	adr	x23,Lone_mont-64
+	ldp	x14,x15,[x22,#32]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#32+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	ldp	x4,x5,[sp,#0+32+32]	// res
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	ldp	x6,x7,[sp,#0+32+48]
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	ldp	x8,x9,[x23,#32+32]	// in2
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	ldp	x10,x11,[x23,#32+48]
+	stp	x14,x15,[x21,#32]
+	stp	x16,x17,[x21,#32+16]
+	ldp	x14,x15,[x22,#64]	// in1
+	cmp	x24,#0			// ~, remember?
+	ldp	x16,x17,[x22,#64+16]
+	csel	x8,x4,x8,ne
+	csel	x9,x5,x9,ne
+	csel	x10,x6,x10,ne
+	csel	x11,x7,x11,ne
+	cmp	x25,#0			// ~, remember?
+	csel	x14,x8,x14,ne
+	csel	x15,x9,x15,ne
+	csel	x16,x10,x16,ne
+	csel	x17,x11,x17,ne
+	stp	x14,x15,[x21,#64]
+	stp	x16,x17,[x21,#64+16]
+
+	add	sp,x29,#0		// destroy frame
+	ldp	x19,x20,[x29,#16]
+	ldp	x21,x22,[x29,#32]
+	ldp	x23,x24,[x29,#48]
+	ldp	x25,x26,[x29,#64]
+	ldp	x29,x30,[sp],#80
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_mul_mont(uint64_t res[4], uint64_t a[4],
+//                                uint64_t b[4]);
+.globl	ecp_nistz256_ord_mul_mont
+
+.def ecp_nistz256_ord_mul_mont
+   .type 32
+.endef
+.align	4
+ecp_nistz256_ord_mul_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	x23,Lord
+	ldr	x3,[x2]		// bp[0]
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+
+	ldp	x12,x13,[x23,#0]
+	ldp	x21,x22,[x23,#16]
+	ldr	x23,[x23,#32]
+
+	mul	x14,x4,x3		// a[0]*b[0]
+	umulh	x8,x4,x3
+
+	mul	x15,x5,x3		// a[1]*b[0]
+	umulh	x9,x5,x3
+
+	mul	x16,x6,x3		// a[2]*b[0]
+	umulh	x10,x6,x3
+
+	mul	x17,x7,x3		// a[3]*b[0]
+	umulh	x19,x7,x3
+
+	mul	x24,x14,x23
+
+	adds	x15,x15,x8		// accumulate high parts of multiplication
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adc	x19,x19,xzr
+	mov	x20,xzr
+	ldr	x3,[x2,#8*1]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	ldr	x3,[x2,#8*2]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	ldr	x3,[x2,#8*3]		// b[i]
+
+	lsl	x8,x24,#32
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	mul	x8,x4,x3
+	adc	x11,x11,xzr
+	mul	x9,x5,x3
+
+	adds	x14,x15,x10
+	mul	x10,x6,x3
+	adcs	x15,x16,x11
+	mul	x11,x7,x3
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	adds	x14,x14,x8		// accumulate low parts
+	umulh	x8,x4,x3
+	adcs	x15,x15,x9
+	umulh	x9,x5,x3
+	adcs	x16,x16,x10
+	umulh	x10,x6,x3
+	adcs	x17,x17,x11
+	umulh	x11,x7,x3
+	adc	x19,x19,xzr
+	mul	x24,x14,x23
+	adds	x15,x15,x8		// accumulate high parts
+	adcs	x16,x16,x9
+	adcs	x17,x17,x10
+	adcs	x19,x19,x11
+	adc	x20,xzr,xzr
+	lsl	x8,x24,#32		// last reduction
+	subs	x16,x16,x24
+	lsr	x9,x24,#32
+	sbcs	x17,x17,x8
+	sbcs	x19,x19,x9
+	sbc	x20,x20,xzr
+
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adcs	x17,x19,x24
+	adc	x19,x20,xzr
+
+	subs	x8,x14,x12		// ret -= modulus
+	sbcs	x9,x15,x13
+	sbcs	x10,x16,x21
+	sbcs	x11,x17,x22
+	sbcs	xzr,x19,xzr
+
+	csel	x14,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x15,x15,x9,lo
+	csel	x16,x16,x10,lo
+	stp	x14,x15,[x0]
+	csel	x17,x17,x11,lo
+	stp	x16,x17,[x0,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_ord_sqr_mont(uint64_t res[4], uint64_t a[4],
+//                                int rep);
+.globl	ecp_nistz256_ord_sqr_mont
+
+.def ecp_nistz256_ord_sqr_mont
+   .type 32
+.endef
+.align	4
+ecp_nistz256_ord_sqr_mont:
+	AARCH64_VALID_CALL_TARGET
+	// Armv8.3-A PAuth: even though x30 is pushed to stack it is not popped later.
+	stp	x29,x30,[sp,#-64]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+
+	adr	x23,Lord
+	ldp	x4,x5,[x1]
+	ldp	x6,x7,[x1,#16]
+
+	ldp	x12,x13,[x23,#0]
+	ldp	x21,x22,[x23,#16]
+	ldr	x23,[x23,#32]
+	b	Loop_ord_sqr
+
+.align	4
+Loop_ord_sqr:
+	sub	x2,x2,#1
+	////////////////////////////////////////////////////////////////
+	//  |  |  |  |  |  |a1*a0|  |
+	//  |  |  |  |  |a2*a0|  |  |
+	//  |  |a3*a2|a3*a0|  |  |  |
+	//  |  |  |  |a2*a1|  |  |  |
+	//  |  |  |a3*a1|  |  |  |  |
+	// *|  |  |  |  |  |  |  | 2|
+	// +|a3*a3|a2*a2|a1*a1|a0*a0|
+	//  |--+--+--+--+--+--+--+--|
+	//  |A7|A6|A5|A4|A3|A2|A1|A0|, where Ax is , i.e. follow 
+	//
+	//  "can't overflow" below mark carrying into high part of
+	//  multiplication result, which can't overflow, because it
+	//  can never be all ones.
+
+	mul	x15,x5,x4		// a[1]*a[0]
+	umulh	x9,x5,x4
+	mul	x16,x6,x4		// a[2]*a[0]
+	umulh	x10,x6,x4
+	mul	x17,x7,x4		// a[3]*a[0]
+	umulh	x19,x7,x4
+
+	adds	x16,x16,x9		// accumulate high parts of multiplication
+	mul	x8,x6,x5		// a[2]*a[1]
+	umulh	x9,x6,x5
+	adcs	x17,x17,x10
+	mul	x10,x7,x5		// a[3]*a[1]
+	umulh	x11,x7,x5
+	adc	x19,x19,xzr		// can't overflow
+
+	mul	x20,x7,x6		// a[3]*a[2]
+	umulh	x1,x7,x6
+
+	adds	x9,x9,x10		// accumulate high parts of multiplication
+	mul	x14,x4,x4		// a[0]*a[0]
+	adc	x10,x11,xzr		// can't overflow
+
+	adds	x17,x17,x8		// accumulate low parts of multiplication
+	umulh	x4,x4,x4
+	adcs	x19,x19,x9
+	mul	x9,x5,x5		// a[1]*a[1]
+	adcs	x20,x20,x10
+	umulh	x5,x5,x5
+	adc	x1,x1,xzr		// can't overflow
+
+	adds	x15,x15,x15	// acc[1-6]*=2
+	mul	x10,x6,x6		// a[2]*a[2]
+	adcs	x16,x16,x16
+	umulh	x6,x6,x6
+	adcs	x17,x17,x17
+	mul	x11,x7,x7		// a[3]*a[3]
+	adcs	x19,x19,x19
+	umulh	x7,x7,x7
+	adcs	x20,x20,x20
+	adcs	x1,x1,x1
+	adc	x3,xzr,xzr
+
+	adds	x15,x15,x4		// +a[i]*a[i]
+	mul	x24,x14,x23
+	adcs	x16,x16,x9
+	adcs	x17,x17,x5
+	adcs	x19,x19,x10
+	adcs	x20,x20,x6
+	adcs	x1,x1,x11
+	adc	x3,x3,x7
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adc	x17,xzr,x24		// can't overflow
+	mul	x11,x14,x23
+	lsl	x8,x24,#32
+	subs	x15,x15,x24
+	lsr	x9,x24,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x11
+	mul	x10,x13,x11
+	umulh	x24,x13,x11
+
+	adcs	x10,x10,x9
+	adc	x24,x24,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x24
+	adcs	x16,x17,x11
+	adc	x17,xzr,x11		// can't overflow
+	mul	x24,x14,x23
+	lsl	x8,x11,#32
+	subs	x15,x15,x11
+	lsr	x9,x11,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x24
+	mul	x10,x13,x24
+	umulh	x11,x13,x24
+
+	adcs	x10,x10,x9
+	adc	x11,x11,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x11
+	adcs	x16,x17,x24
+	adc	x17,xzr,x24		// can't overflow
+	mul	x11,x14,x23
+	lsl	x8,x24,#32
+	subs	x15,x15,x24
+	lsr	x9,x24,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	subs	xzr,x14,#1
+	umulh	x9,x12,x11
+	mul	x10,x13,x11
+	umulh	x24,x13,x11
+
+	adcs	x10,x10,x9
+	adc	x24,x24,xzr
+
+	adds	x14,x15,x10
+	adcs	x15,x16,x24
+	adcs	x16,x17,x11
+	adc	x17,xzr,x11		// can't overflow
+	lsl	x8,x11,#32
+	subs	x15,x15,x11
+	lsr	x9,x11,#32
+	sbcs	x16,x16,x8
+	sbc	x17,x17,x9		// can't borrow
+	adds	x14,x14,x19	// accumulate upper half
+	adcs	x15,x15,x20
+	adcs	x16,x16,x1
+	adcs	x17,x17,x3
+	adc	x19,xzr,xzr
+
+	subs	x8,x14,x12		// ret -= modulus
+	sbcs	x9,x15,x13
+	sbcs	x10,x16,x21
+	sbcs	x11,x17,x22
+	sbcs	xzr,x19,xzr
+
+	csel	x4,x14,x8,lo	// ret = borrow ? ret : ret-modulus
+	csel	x5,x15,x9,lo
+	csel	x6,x16,x10,lo
+	csel	x7,x17,x11,lo
+
+	cbnz	x2,Loop_ord_sqr
+
+	stp	x4,x5,[x0]
+	stp	x6,x7,[x0,#16]
+
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldr	x29,[sp],#64
+	ret
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w5(uint64_t *val, uint64_t *in_t, int index);
+.globl	ecp_nistz256_select_w5
+
+.def ecp_nistz256_select_w5
+   .type 32
+.endef
+.align	4
+ecp_nistz256_select_w5:
+	AARCH64_VALID_CALL_TARGET
+
+    // x10 := x0
+    // w9 := 0; loop counter and incremented internal index
+	mov	x10, x0
+	mov	w9, #0
+
+    // [v16-v21] := 0
+	movi	v16.16b, #0
+	movi	v17.16b, #0
+	movi	v18.16b, #0
+	movi	v19.16b, #0
+	movi	v20.16b, #0
+	movi	v21.16b, #0
+
+Lselect_w5_loop:
+    // Loop 16 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+	add	w9, w9, #1
+
+    // [v22-v27] := Load a (3*256-bit = 6*128-bit) table entry starting at x1
+    //  and advance x1 to point to the next entry
+	ld1	{v22.2d, v23.2d, v24.2d, v25.2d}, [x1],#64
+
+    // x11 := (w9 == w2)? All 1s : All 0s
+	cmp	w9, w2
+	csetm	x11, eq
+
+    // continue loading ...
+	ld1	{v26.2d, v27.2d}, [x1],#32
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+	dup	v3.2d, x11
+
+    // [v16-v19] := (Mask == all 1s)? [v22-v25] : [v16-v19]
+    // i.e., values in output registers will remain the same if w9 != w2
+	bit	v16.16b, v22.16b, v3.16b
+	bit	v17.16b, v23.16b, v3.16b
+
+	bit	v18.16b, v24.16b, v3.16b
+	bit	v19.16b, v25.16b, v3.16b
+
+	bit	v20.16b, v26.16b, v3.16b
+	bit	v21.16b, v27.16b, v3.16b
+
+    // If bit #4 is not 0 (i.e. idx_ctr < 16) loop back
+	tbz	w9, #4, Lselect_w5_loop
+
+    // Write [v16-v21] to memory at the output pointer
+	st1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x10],#64
+	st1	{v20.2d, v21.2d}, [x10]
+
+	ret
+
+
+
+////////////////////////////////////////////////////////////////////////
+// void ecp_nistz256_select_w7(uint64_t *val, uint64_t *in_t, int index);
+.globl	ecp_nistz256_select_w7
+
+.def ecp_nistz256_select_w7
+   .type 32
+.endef
+.align	4
+ecp_nistz256_select_w7:
+	AARCH64_VALID_CALL_TARGET
+
+    // w9 := 0; loop counter and incremented internal index
+	mov	w9, #0
+
+    // [v16-v21] := 0
+	movi	v16.16b, #0
+	movi	v17.16b, #0
+	movi	v18.16b, #0
+	movi	v19.16b, #0
+
+Lselect_w7_loop:
+    // Loop 64 times.
+
+    // Increment index (loop counter); tested at the end of the loop
+	add	w9, w9, #1
+
+    // [v22-v25] := Load a (2*256-bit = 4*128-bit) table entry starting at x1
+    //  and advance x1 to point to the next entry
+	ld1	{v22.2d, v23.2d, v24.2d, v25.2d}, [x1],#64
+
+    // x11 := (w9 == w2)? All 1s : All 0s
+	cmp	w9, w2
+	csetm	x11, eq
+
+    // duplicate mask_64 into Mask (all 0s or all 1s)
+	dup	v3.2d, x11
+
+    // [v16-v19] := (Mask == all 1s)? [v22-v25] : [v16-v19]
+    // i.e., values in output registers will remain the same if w9 != w2
+	bit	v16.16b, v22.16b, v3.16b
+	bit	v17.16b, v23.16b, v3.16b
+
+	bit	v18.16b, v24.16b, v3.16b
+	bit	v19.16b, v25.16b, v3.16b
+
+    // If bit #6 is not 0 (i.e. idx_ctr < 64) loop back
+	tbz	w9, #6, Lselect_w7_loop
+
+    // Write [v16-v19] to memory at the output pointer
+	st1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x0]
+
+	ret
+
+#endif
+#endif  // !OPENSSL_NO_ASM
diff --git a/win-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S b/win-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
new file mode 100644
index 0000000..0a3121f
--- /dev/null
+++ b/win-aarch64/crypto/fipsmodule/p256_beeu-armv8-asm.S
@@ -0,0 +1,319 @@
+// This file is generated from a similarly-named Perl script in the BoringSSL
+// source tree. Do not edit by hand.
+
+#if !defined(__has_feature)
+#define __has_feature(x) 0
+#endif
+#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
+#define OPENSSL_NO_ASM
+#endif
+
+#if !defined(OPENSSL_NO_ASM)
+#if defined(__aarch64__)
+#if defined(BORINGSSL_PREFIX)
+#include <boringssl_prefix_symbols_asm.h>
+#endif
+#include "openssl/arm_arch.h"
+
+.text
+.globl	beeu_mod_inverse_vartime
+
+
+.align	4
+beeu_mod_inverse_vartime:
+    // Reserve enough space for 14 8-byte registers on the stack
+    // in the first stp call for x29, x30.
+    // Then store the remaining callee-saved registers.
+    //
+    //    | x29 | x30 | x19 | x20 | ... | x27 | x28 |  x0 |  x2 |
+    //    ^                                                     ^
+    //    sp  <------------------- 112 bytes ----------------> old sp
+    //   x29 (FP)
+    //
+	AARCH64_SIGN_LINK_REGISTER
+	stp	x29,x30,[sp,#-112]!
+	add	x29,sp,#0
+	stp	x19,x20,[sp,#16]
+	stp	x21,x22,[sp,#32]
+	stp	x23,x24,[sp,#48]
+	stp	x25,x26,[sp,#64]
+	stp	x27,x28,[sp,#80]
+	stp	x0,x2,[sp,#96]
+
+    // B = b3..b0 := a
+	ldp	x25,x26,[x1]
+	ldp	x27,x28,[x1,#16]
+
+    // n3..n0 := n
+    // Note: the value of input params are changed in the following.
+	ldp	x0,x1,[x2]
+	ldp	x2,x30,[x2,#16]
+
+    // A = a3..a0 := n
+	mov	x21, x0
+	mov	x22, x1
+	mov	x23, x2
+	mov	x24, x30
+
+    // X = x4..x0 := 1
+	mov	x3, #1
+	eor	x4, x4, x4
+	eor	x5, x5, x5
+	eor	x6, x6, x6
+	eor	x7, x7, x7
+
+    // Y = y4..y0 := 0
+	eor	x8, x8, x8
+	eor	x9, x9, x9
+	eor	x10, x10, x10
+	eor	x11, x11, x11
+	eor	x12, x12, x12
+
+Lbeeu_loop:
+    // if B == 0, jump to .Lbeeu_loop_end
+	orr	x14, x25, x26
+	orr	x14, x14, x27
+
+    // reverse the bit order of x25. This is needed for clz after this macro
+	rbit	x15, x25
+
+	orr	x14, x14, x28
+	cbz	x14,Lbeeu_loop_end
+
+
+    // 0 < B < |n|,
+    // 0 < A <= |n|,
+    // (1)      X*a  ==  B   (mod |n|),
+    // (2) (-1)*Y*a  ==  A   (mod |n|)
+
+    // Now divide B by the maximum possible power of two in the
+    // integers, and divide X by the same value mod |n|.
+    // When we're done, (1) still holds.
+
+    // shift := number of trailing 0s in x25
+    // (      = number of leading 0s in x15; see the "rbit" instruction in TEST_B_ZERO)
+	clz	x13, x15
+
+    // If there is no shift, goto shift_A_Y
+	cbz	x13, Lbeeu_shift_A_Y
+
+    // Shift B right by "x13" bits
+	neg	x14, x13
+	lsr	x25, x25, x13
+	lsl	x15, x26, x14
+
+	lsr	x26, x26, x13
+	lsl	x19, x27, x14
+
+	orr	x25, x25, x15
+
+	lsr	x27, x27, x13
+	lsl	x20, x28, x14
+
+	orr	x26, x26, x19
+
+	lsr	x28, x28, x13
+
+	orr	x27, x27, x20
+
+
+    // Shift X right by "x13" bits, adding n whenever X becomes odd.
+    // x13--;
+    // x14 := 0; needed in the addition to the most significant word in SHIFT1
+	eor	x14, x14, x14
+Lbeeu_shift_loop_X:
+	tbz	x3, #0, Lshift1_0
+	adds	x3, x3, x0
+	adcs	x4, x4, x1
+	adcs	x5, x5, x2
+	adcs	x6, x6, x30
+	adc	x7, x7, x14
+Lshift1_0:
+    // var0 := [var1|var0]<64..1>;
+    // i.e. concatenate var1 and var0,
+    //      extract bits <64..1> from the resulting 128-bit value
+    //      and put them in var0
+	extr	x3, x4, x3, #1
+	extr	x4, x5, x4, #1
+	extr	x5, x6, x5, #1
+	extr	x6, x7, x6, #1
+	lsr	x7, x7, #1
+
+	subs	x13, x13, #1
+	bne	Lbeeu_shift_loop_X
+
+    // Note: the steps above perform the same sequence as in p256_beeu-x86_64-asm.pl
+    // with the following differences:
+    // - "x13" is set directly to the number of trailing 0s in B
+    //   (using rbit and clz instructions)
+    // - The loop is only used to call SHIFT1(X)
+    //   and x13 is decreased while executing the X loop.
+    // - SHIFT256(B, x13) is performed before right-shifting X; they are independent
+
+Lbeeu_shift_A_Y:
+    // Same for A and Y.
+    // Afterwards, (2) still holds.
+    // Reverse the bit order of x21
+    // x13 := number of trailing 0s in x21 (= number of leading 0s in x15)
+	rbit	x15, x21
+	clz	x13, x15
+
+    // If there is no shift, goto |B-A|, X+Y update
+	cbz	x13, Lbeeu_update_B_X_or_A_Y
+
+    // Shift A right by "x13" bits
+	neg	x14, x13
+	lsr	x21, x21, x13
+	lsl	x15, x22, x14
+
+	lsr	x22, x22, x13
+	lsl	x19, x23, x14
+
+	orr	x21, x21, x15
+
+	lsr	x23, x23, x13
+	lsl	x20, x24, x14
+
+	orr	x22, x22, x19
+
+	lsr	x24, x24, x13
+
+	orr	x23, x23, x20
+
+
+    // Shift Y right by "x13" bits, adding n whenever Y becomes odd.
+    // x13--;
+    // x14 := 0; needed in the addition to the most significant word in SHIFT1
+	eor	x14, x14, x14
+Lbeeu_shift_loop_Y:
+	tbz	x8, #0, Lshift1_1
+	adds	x8, x8, x0
+	adcs	x9, x9, x1
+	adcs	x10, x10, x2
+	adcs	x11, x11, x30
+	adc	x12, x12, x14
+Lshift1_1:
+    // var0 := [var1|var0]<64..1>;
+    // i.e. concatenate var1 and var0,
+    //      extract bits <64..1> from the resulting 128-bit value
+    //      and put them in var0
+	extr	x8, x9, x8, #1
+	extr	x9, x10, x9, #1
+	extr	x10, x11, x10, #1
+	extr	x11, x12, x11, #1
+	lsr	x12, x12, #1
+
+	subs	x13, x13, #1
+	bne	Lbeeu_shift_loop_Y
+
+Lbeeu_update_B_X_or_A_Y:
+    // Try T := B - A; if cs, continue with B > A (cs: carry set = no borrow)
+    // Note: this is a case of unsigned arithmetic, where T fits in 4 64-bit words
+    //       without taking a sign bit if generated. The lack of a carry would
+    //       indicate a negative result. See, for example,
+    //       https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/condition-codes-1-condition-flags-and-codes
+	subs	x14, x25, x21
+	sbcs	x15, x26, x22
+	sbcs	x19, x27, x23
+	sbcs	x20, x28, x24
+	bcs	Lbeeu_B_greater_than_A
+
+    // Else A > B =>
+    // A := A - B; Y := Y + X; goto beginning of the loop
+	subs	x21, x21, x25
+	sbcs	x22, x22, x26
+	sbcs	x23, x23, x27
+	sbcs	x24, x24, x28
+
+	adds	x8, x8, x3
+	adcs	x9, x9, x4
+	adcs	x10, x10, x5
+	adcs	x11, x11, x6
+	adc	x12, x12, x7
+	b	Lbeeu_loop
+
+Lbeeu_B_greater_than_A:
+    // Continue with B > A =>
+    // B := B - A; X := X + Y; goto beginning of the loop
+	mov	x25, x14
+	mov	x26, x15
+	mov	x27, x19
+	mov	x28, x20
+
+	adds	x3, x3, x8
+	adcs	x4, x4, x9
+	adcs	x5, x5, x10
+	adcs	x6, x6, x11
+	adc	x7, x7, x12
+	b	Lbeeu_loop
+
+Lbeeu_loop_end:
+    // The Euclid's algorithm loop ends when A == gcd(a,n);
+    // this would be 1, when a and n are co-prime (i.e. do not have a common factor).
+    // Since (-1)*Y*a == A (mod |n|), Y>0
+    // then out = -Y mod n
+
+    // Verify that A = 1 ==> (-1)*Y*a = A = 1  (mod |n|)
+    // Is A-1 == 0?
+    // If not, fail.
+	sub	x14, x21, #1
+	orr	x14, x14, x22
+	orr	x14, x14, x23
+	orr	x14, x14, x24
+	cbnz	x14, Lbeeu_err
+
+    // If Y>n ==> Y:=Y-n
+Lbeeu_reduction_loop:
+    // x_i := y_i - n_i (X is no longer needed, use it as temp)
+    // (x14 = 0 from above)
+	subs	x3, x8, x0
+	sbcs	x4, x9, x1
+	sbcs	x5, x10, x2
+	sbcs	x6, x11, x30
+	sbcs	x7, x12, x14
+
+    // If result is non-negative (i.e., cs = carry set = no borrow),
+    // y_i := x_i; goto reduce again
+    // else
+    // y_i := y_i; continue
+	csel	x8, x3, x8, cs
+	csel	x9, x4, x9, cs
+	csel	x10, x5, x10, cs
+	csel	x11, x6, x11, cs
+	csel	x12, x7, x12, cs
+	bcs	Lbeeu_reduction_loop
+
+    // Now Y < n (Y cannot be equal to n, since the inverse cannot be 0)
+    // out = -Y = n-Y
+	subs	x8, x0, x8
+	sbcs	x9, x1, x9
+	sbcs	x10, x2, x10
+	sbcs	x11, x30, x11
+
+    // Save Y in output (out (x0) was saved on the stack)
+	ldr	x3, [sp,#96]
+	stp	x8, x9, [x3]
+	stp	x10, x11, [x3,#16]
+    // return 1 (success)
+	mov	x0, #1
+	b	Lbeeu_finish
+
+Lbeeu_err:
+    // return 0 (error)
+	eor	x0, x0, x0
+
+Lbeeu_finish:
+    // Restore callee-saved registers, except x0, x2
+	add	sp,x29,#0
+	ldp	x19,x20,[sp,#16]
+	ldp	x21,x22,[sp,#32]
+	ldp	x23,x24,[sp,#48]
+	ldp	x25,x26,[sp,#64]
+	ldp	x27,x28,[sp,#80]
+	ldp	x29,x30,[sp],#112
+
+	AARCH64_VALIDATE_LINK_REGISTER
+	ret
+
+#endif
+#endif  // !OPENSSL_NO_ASM