0x4329768b, 0x23c6dccb, 0xedfc68b6, 0xe4f163b8,
    0x31dccad7, 0x63851042, 0x97224013, 0xc6112084,
    0x4a247d85, 0xbb3df8d2, 0xf93211ae, 0x29a16dc7,
    0x9e2f4b1d, 0xb230f3dc, 0x8652ec0d, 0xc1e3d077,
    0xb3166c2b, 0x70b999a9, 0x9448fa11, 0xe9642247,
    0xfc8cc4a8, 0xf03f1aa0, 0x7d2cd856, 0x3390ef22,
    0x494ec787, 0x38d1c1d9, 0xcaa2fe8c, 0xd40b3698,
    0xf581cfa6, 0x7ade28a5, 0xb78e26da, 0xadbfa43f,
    0x3a9de42c, 0x78920d50, 0x5fcc9b6a, 0x7e466254,
    0x8d13c2f6, 0xd8b8e890, 0x39f75e2e, 0xc3aff582,
    0x5d80be9f, 0xd0937c69, 0xd52da96f, 0x2512b3cf,
    0xac993bc8, 0x187da710, 0x9c636ee8, 0x3bbb7bdb,
    0x267809cd, 0x5918f46e, 0x9ab701ec, 0x4f9aa883,
    0x956e65e6, 0xffe67eaa, 0xbccf0821, 0x15e8e6ef,
    0xe79bd9ba, 0x6f36ce4a, 0x9f09d4ea, 0xb07cd629,
    0xa4b2af31, 0x3f23312a, 0xa59430c6, 0xa266c035,
    0x4ebc3774, 0x82caa6fc, 0x90d0b0e0, 0xa7d81533,
    0x04984af1, 0xecdaf741, 0xcd500e7f, 0x91f62f17,
    0x4dd68d76, 0xefb04d43, 0xaa4d54cc, 0x9604dfe4,
    0xd1b5e39e, 0x6a881b4c, 0x2c1fb8c1, 0x65517f46,
    0x5eea049d, 0x8c355d01, 0x877473fa, 0x0b412efb,
    0x671d5ab3, 0xdbd25292, 0x105633e9, 0xd647136d,
    0xd7618c9a, 0xa10c7a37, 0xf8148e59, 0x133c89eb,
    0xa927eece, 0x61c935b7, 0x1ce5ede1, 0x47b13c7a,
    0xd2df599c, 0xf2733f55, 0x14ce7918, 0xc737bf73,
    0xf7cdea53, 0xfdaa5b5f, 0x3d6f14df, 0x44db8678,
    0xaff381ca, 0x68c43eb9, 0x24342c38, 0xa3405fc2,
    0x1dc37216, 0xe2250cbc, 0x3c498b28, 0x0d9541ff,
    0xa8017139, 0x0cb3de08, 0xb4e49cd8, 0x56c19064,
    0xcb84617b, 0x32b670d5, 0x6c5c7448, 0xb85742d0,
};

/*
 * Common macros in both the encryption and decryption routines.
 */
#define ADD_ROUND_KEY_4 (block[0]^=*keysched++, block[1]^=*keysched++, \
		         block[2]^=*keysched++, block[3]^=*keysched++)
#define ADD_ROUND_KEY_6 (block[0]^=*keysched++, block[1]^=*keysched++, \
		         block[2]^=*keysched++, block[3]^=*keysched++, \
		         block[4]^=*keysched++, block[5]^=*keysched++)
#define ADD_ROUND_KEY_8 (block[0]^=*keysched++, block[1]^=*keysched++, \
		         block[2]^=*keysched++, block[3]^=*keysched++, \
		         block[4]^=*keysched++, block[5]^=*keysched++, \
		         block[6]^=*keysched++, block[7]^=*keysched++)
#define MOVEWORD(i) ( block[i] = newstate[i] )

/*
 * Macros for the encryption routine. There are three encryption
 * cores, for Nb=4,6,8.
 */
#define MAKEWORD(i) ( newstate[i] = (E0[(block[i] >> 24) & 0xFF] ^ \
				     E1[(block[(i+C1)%Nb] >> 16) & 0xFF] ^ \
				     E2[(block[(i+C2)%Nb] >> 8) & 0xFF] ^ \
				     E3[block[(i+C3)%Nb] & 0xFF]) )
#define LASTWORD(i) ( newstate[i] = (Sbox[(block[i] >> 24) & 0xFF] << 24) | \
			    (Sbox[(block[(i+C1)%Nb] >> 16) & 0xFF] << 16) | \
			    (Sbox[(block[(i+C2)%Nb] >>  8) & 0xFF] <<  8) | \
			    (Sbox[(block[(i+C3)%Nb]      ) & 0xFF]      ) )

/*
 * Core encrypt routines, expecting word32 inputs read big-endian
 * from the byte-oriented input stream.
 */
static void aes_encrypt_nb_4(AESContext * ctx, word32 * block)
{
    int i;
    static const int C1 = 1, C2 = 2, C3 = 3, Nb = 4;
    word32 *keysched = ctx->keysched;
    word32 newstate[4];
    for (i = 0; i < ctx->Nr - 1; i++) {
	ADD_ROUND_KEY_4;
	MAKEWORD(0);
	MAKEWORD(1);
	MAKEWORD(2);
	MAKEWORD(3);
	MOVEWORD(0);
	MOVEWORD(1);
	MOVEWORD(2);
	MOVEWORD(3);
    }
    ADD_ROUND_KEY_4;
    LASTWORD(0);
    LASTWORD(1);
    LASTWORD(2);
    LASTWORD(3);
    MOVEWORD(0);
    MOVEWORD(1);
    MOVEWORD(2);
    MOVEWORD(3);
    ADD_ROUND_KEY_4;
}
static void aes_encrypt_nb_6(AESContext * ctx, word32 * block)
{
    int i;
    static const int C1 = 1, C2 = 2, C3 = 3, Nb = 6;
    word32 *keysched = ctx->keysched;
    word32 newstate[6];
    for (i = 0; i < ctx->Nr - 1; i++) {
	ADD_ROUND_KEY_6;
	MAKEWORD(0);
	MAKEWORD(1);
	MAKEWORD(2);
	MAKEWORD(3);
	MAKEWORD(4);
	MAKEWORD(5);
	MOVEWORD(0);
	MOVEWORD(1);
	MOVEWORD(2);
	MOVEWORD(3);
	MOVEWORD(4);
	MOVEWORD(5);
    }
    ADD_ROUND_KEY_6;
    LASTWORD(0);
    LASTWORD(1);
    LASTWORD(2);
    LASTWORD(3);
    LASTWORD(4);
    LASTWORD(5);
    MOVEWORD(0);
    MOVEWORD(1);
    MOVEWORD(2);
    MOVEWORD(3);
    MOVEWORD(4);
    MOVEWORD(5);
    ADD_ROUND_KEY_6;
}
static void aes_encrypt_nb_8(AESContext * ctx, word32 * block)
{
    int i;
    static const int C1 = 1, C2 = 3, C3 = 4, Nb = 8;
    word32 *keysched = ctx->keysched;
    word32 newstate[8];
    for (i = 0; i < ctx->Nr - 1; i++) {
	ADD_ROUND_KEY_8;
	MAKEWORD(0);
	MAKEWORD(1);
	MAKEWORD(2);
	MAKEWORD(3);
	MAKEWORD(4);
	MAKEWORD(5);
	MAKEWORD(6);
	MAKEWORD(7);
	MOVEWORD(0);
	MOVEWORD(1);
	MOVEWORD(2);
	MOVEWORD(3);
	MOVEWORD(4);
	MOVEWORD(5);
	MOVEWORD(6);
	MOVEWORD(7);
    }
    ADD_ROUND_KEY_8;
    LASTWORD(0);
    LASTWORD(1);
    LASTWORD(2);
    LASTWORD(3);
    LASTWORD(4);
    LASTWORD(5);
    LASTWORD(6);
    LASTWORD(7);
    MOVEWORD(0);
    MOVEWORD(1);
    MOVEWORD(2);
    MOVEWORD(3);
    MOVEWORD(4);
    MOVEWORD(5);
    MOVEWORD(6);
    MOVEWORD(7);
    ADD_ROUND_KEY_8;
}

#undef MAKEWORD
#undef LASTWORD

/*
 * Macros for the decryption routine. There are three decryption
 * cores, for Nb=4,6,8.
 */
#define MAKEWORD(i) ( newstate[i] = (D0[(block[i] >> 24) & 0xFF] ^ \
				     D1[(block[(i+C1)%Nb] >> 16) & 0xFF] ^ \
				     D2[(block[(i+C2)%Nb] >> 8) & 0xFF] ^ \
				     D3[block[(i+C3)%Nb] & 0xFF]) )
#define LASTWORD(i) (newstate[i] = (Sboxinv[(block[i] >> 24) & 0xFF] << 24) | \
			   (Sboxinv[(block[(i+C1)%Nb] >> 16) & 0xFF] << 16) | \
			   (Sboxinv[(block[(i+C2)%Nb] >>  8) & 0xFF] <<  8) | \
			   (Sboxinv[(block[(i+C3)%Nb]      ) & 0xFF]      ) )

/*
 * Core decrypt routines, expecting word32 inputs read big-endian
 * from the byte-oriented input stream.
 */
static void aes_decrypt_nb_4(AESContext * ctx, word32 * block)
{
    int i;
    static const int C1 = 4 - 1, C2 = 4 - 2, C3 = 4 - 3, Nb = 4;
    word32 *keysched = ctx->invkeysched;
    word32 newstate[4];
    for (i = 0; i < ctx->Nr - 1; i++) {
	ADD_ROUND_KEY_4;
	MAKEWORD(0);
	MAKEWORD(1);
	MAKEWORD(2);
	MAKEWORD(3);
	MOVEWORD(0);
	MOVEWORD(1);
	MOVEWORD(2);
	MOVEWORD(3);
    }
    ADD_ROUND_KEY_4;
    LASTWORD(0);
    LASTWORD(1);
    LASTWORD(2);
    LASTWORD(3);
    MOVEWORD(0);
    MOVEWORD(1);
    MOVEWORD(2);
    MOVEWORD(3);
    ADD_ROUND_KEY_4;
}
static void aes_decrypt_nb_6(AESContext * ctx, word32 * block)
{
    int i;
    static const int C1 = 6 - 1, C2 = 6 - 2, C3 = 6 - 3, Nb = 6;
    word32 *keysched = ctx->invkeysched;
    word32 newstate[6];
    for (i = 0; i < ctx->Nr - 1; i++) {
	ADD_ROUND_KEY_6;
	MAKEWORD(0);
	MAKEWORD(1);
	MAKEWORD(2);
	MAKEWORD(3);
	MAKEWORD(4);
	MAKEWORD(5);
	MOVEWORD(0);
	MOVEWORD(1);
	MOVEWORD(2);
	MOVEWORD(3);
	MOVEWORD(4);
	MOVEWORD(5);
    }
    ADD_ROUND_KEY_6;
    LASTWORD(0);
    LASTWORD(1);
    LASTWORD(2);
    LASTWORD(3);
    LASTWORD(4);
    LASTWORD(5);
    MOVEWORD(0);
    MOVEWORD(1);
    MOVEWORD(2);
    MOVEWORD(3);
    MOVEWORD(4);
    MOVEWORD(5);
    ADD_ROUND_KEY_6;
}
static void aes_decrypt_nb_8(AESContext * ctx, word32 * block)
{
    int i;
    static const int C1 = 8 - 1, C2 = 8 - 3, C3 = 8 - 4, Nb = 8;
    word32 *keysched = ctx->invkeysched;
    word32 newstate[8];
    for (i = 0; i < ctx->Nr - 1; i++) {
	ADD_ROUND_KEY_8;
	MAKEWORD(0);
	MAKEWORD(1);
	MAKEWORD(2);
	MAKEWORD(3);
	MAKEWORD(4);
	MAKEWORD(5);
	MAKEWORD(6);
	MAKEWORD(7);
	MOVEWORD(0);
	MOVEWORD(1);
	MOVEWORD(2);
	MOVEWORD(3);
	MOVEWORD(4);
	MOVEWORD(5);
	MOVEWORD(6);
	MOVEWORD(7);
    }
    ADD_ROUND_KEY_8;
    LASTWORD(0);
    LASTWORD(1);
    LASTWORD(2);
    LASTWORD(3);
    LASTWORD(4);
    LASTWORD(5);
    LASTWORD(6);
    LASTWORD(7);
    MOVEWORD(0);
    MOVEWORD(1);
    MOVEWORD(2);
    MOVEWORD(3);
    MOVEWORD(4);
    MOVEWORD(5);
    MOVEWORD(6);
    MOVEWORD(7);
    ADD_ROUND_KEY_8;
}

#undef MAKEWORD
#undef LASTWORD


/*
 * Set up an AESContext. `keylen' and `blocklen' are measured in
 * bytes; each can be either 16 (128-bit), 24 (192-bit), or 32
 * (256-bit).