def xtime_word
import bend-collections@1.0.0.0/src/crypto/aes/sbox.bend as Sboximport Base
146# {02} * x in GF(2^8) (FIPS 197 section 4.2.1, xtime): shift left and, when
147# bit 7 was set, add x^8 = {1b}; the reduction mask is 0 - bit7, not a branch.
148def xtime_word(+x: U32) -> U32:
149 U32.xor(U32.and(254, U32.shln(x, 1n)), U32.and(27, U32.sub(0, U32.and(1, U32.shrn(x, 7n)))))