PROOF.bend

bend-osdev-aes@0.1.0.0 · 2,233 lines · 89 definitions

1# Proofs of LAWS.bend (AES). The round trip is the generated region below
2# (gen/aes_proof.py); the two byte-layer facts it uses are mode-core's laws.
3import Base
4import bend-osdev-bytes@0.1.1.0/bytes.bend as B
5import bend-osdev-mode-core@0.1.0.0/mode_core.bend as M
6import bend-osdev-aes@0.1.0.0/aes.bend as X
7import bend-osdev-gf@0.1.1.0/gf.bend as G
8import bend-osdev-gf@0.1.1.0/LAWS.bend as GL
9import bend-osdev-gf@0.1.1.0/PROOF.bend as GP
10import bend-collections@1.0.0.0/src/crypto/aes/aes.bend as A
11import bend-collections@1.0.0.0/src/crypto/aes/types.bend as TT
12import bend-collections@1.0.0.0/src/crypto/aes/sbox.bend as SB
13import bend-osdev-mode-core@0.1.0.0/LAWS.bend as CoreL
14import bend-osdev-mode-core@0.1.0.0/PROOF.bend as CoreP
15import bend-osdev-aes@0.1.0.0/LAWS.bend as Laws
16
17# mode-core's laws, under the names these proofs use
18
19def sp.blk16g(z0: U32, z1: U32, z2: U32, z3: U32, z4: U32, z5: U32, z6: U32, z7: U32, z8: U32, z9: U32, z10: U32, z11: U32, z12: U32, z13: U32, z14: U32, z15: U32, rest: List<&2, U32>) -> {M.cm.bytes_onto(M.cm.block16(z0, z1, z2, z3, z4, z5, z6, z7, z8, z9, z10, z11, z12, z13, z14, z15), rest) == Con{B.byte(z0), Con{B.byte(z1), Con{B.byte(z2), Con{B.byte(z3), Con{B.byte(z4), Con{B.byte(z5), Con{B.byte(z6), Con{B.byte(z7), Con{B.byte(z8), Con{B.byte(z9), Con{B.byte(z10), Con{B.byte(z11), Con{B.byte(z12), Con{B.byte(z13), Con{B.byte(z14), Con{B.byte(z15), rest}}}}}}}}}}}}}}}} : List<&2, U32>}:
20  CoreL.bytes_onto_block16(z0, z1, z2, z3, z4, z5, z6, z7, z8, z9, z10, z11, z12, z13, z14, z15, rest)
21
22def bx.ru32(a: U32, b: U32) -> {U32.xor(U32.xor(a, b), b) == a : U32}:
23  CoreL.u32_xor_xor(a, b)
24
25# Vectors
26
27def Laws.aes128_fips197_c1():
28  {==}
29
30# AES: decryption undoes encryption, for every key and block
31
32# BEGIN GENERATED by gen/aes_proof.py: aes
33# Bytes: facts about one byte, on all 256 values
34
35def ap.nth(xs: List<&2, U32>, n: Nat) -> U32:
36  match xs n:
37    case Nil{} _:
38      0
39    case Con{x, t} 0n:
40      x
41    case Con{x, t} 1n+p:
42      ap.nth(t, p)
43
44def ap.pick(+n: Nat, +xs: List<&2, U32>, +ys: List<&2, U32>, e: {xs == ys : List<&2, U32>}) -> {ap.nth(xs, n) == ap.nth(ys, n) : U32}:
45  Equal.cong(List<&2, U32>, U32, l => ap.nth(l, n), xs, ys, e)
46
47def ap.bridge(+c0: Bool, +c1: Bool, +c2: Bool, +c3: Bool, +c4: Bool, +c5: Bool, +c6: Bool, +c7: Bool, +c8: Bool, +c9: Bool, +c10: Bool, +c11: Bool, +c12: Bool, +c13: Bool, +c14: Bool, +c15: Bool, +c16: Bool, +c17: Bool, +c18: Bool, +c19: Bool, +c20: Bool, +c21: Bool, +c22: Bool, +c23: Bool, +c24: Bool, +c25: Bool, +c26: Bool, +c27: Bool, +c28: Bool, +c29: Bool, +c30: Bool, +c31: Bool) -> {U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}} == U32.and(255, U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}) : U32}:
48  {==}
49
50def ap.e_sbl(c0: Bool, c1: Bool, c2: Bool, c3: Bool, c4: Bool, c5: Bool, c6: Bool, c7: Bool) -> {SB.sbox(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}) == U32.and(255, SB.sbox(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}})) : U32}:
51  match c0 c1 c2 c3 c4 c5 c6 c7:
52    case False{} False{} False{} False{} False{} False{} False{} False{}:
53      {==}
54    case True{} False{} False{} False{} False{} False{} False{} False{}:
55      {==}
56    case False{} True{} False{} False{} False{} False{} False{} False{}:
57      {==}
58    case True{} True{} False{} False{} False{} False{} False{} False{}:
59      {==}
60    case False{} False{} True{} False{} False{} False{} False{} False{}:
61      {==}
62    case True{} False{} True{} False{} False{} False{} False{} False{}:
63      {==}
64    case False{} True{} True{} False{} False{} False{} False{} False{}:
65      {==}
66    case True{} True{} True{} False{} False{} False{} False{} False{}:
67      {==}
68    case False{} False{} False{} True{} False{} False{} False{} False{}:
69      {==}
70    case True{} False{} False{} True{} False{} False{} False{} False{}:
71      {==}
72    case False{} True{} False{} True{} False{} False{} False{} False{}:
73      {==}
74    case True{} True{} False{} True{} False{} False{} False{} False{}:
75      {==}
76    case False{} False{} True{} True{} False{} False{} False{} False{}:
77      {==}
78    case True{} False{} True{} True{} False{} False{} False{} False{}:
79      {==}
80    case False{} True{} True{} True{} False{} False{} False{} False{}:
81      {==}
82    case True{} True{} True{} True{} False{} False{} False{} False{}:
83      {==}
84    case False{} False{} False{} False{} True{} False{} False{} False{}:
85      {==}
86    case True{} False{} False{} False{} True{} False{} False{} False{}:
87      {==}
88    case False{} True{} False{} False{} True{} False{} False{} False{}:
89      {==}
90    case True{} True{} False{} False{} True{} False{} False{} False{}:
91      {==}
92    case False{} False{} True{} False{} True{} False{} False{} False{}:
93      {==}
94    case True{} False{} True{} False{} True{} False{} False{} False{}:
95      {==}
96    case False{} True{} True{} False{} True{} False{} False{} False{}:
97      {==}
98    case True{} True{} True{} False{} True{} False{} False{} False{}:
99      {==}
100    case False{} False{} False{} True{} True{} False{} False{} False{}:
101      {==}
102    case True{} False{} False{} True{} True{} False{} False{} False{}:
103      {==}
104    case False{} True{} False{} True{} True{} False{} False{} False{}:
105      {==}
106    case True{} True{} False{} True{} True{} False{} False{} False{}:
107      {==}
108    case False{} False{} True{} True{} True{} False{} False{} False{}:
109      {==}
110    case True{} False{} True{} True{} True{} False{} False{} False{}:
111      {==}
112    case False{} True{} True{} True{} True{} False{} False{} False{}:
113      {==}
114    case True{} True{} True{} True{} True{} False{} False{} False{}:
115      {==}
116    case False{} False{} False{} False{} False{} True{} False{} False{}:
117      {==}
118    case True{} False{} False{} False{} False{} True{} False{} False{}:
119      {==}
120    case False{} True{} False{} False{} False{} True{} False{} False{}:
121      {==}
122    case True{} True{} False{} False{} False{} True{} False{} False{}:
123      {==}
124    case False{} False{} True{} False{} False{} True{} False{} False{}:
125      {==}
126    case True{} False{} True{} False{} False{} True{} False{} False{}:
127      {==}
128    case False{} True{} True{} False{} False{} True{} False{} False{}:
129      {==}
130    case True{} True{} True{} False{} False{} True{} False{} False{}:
131      {==}
132    case False{} False{} False{} True{} False{} True{} False{} False{}:
133      {==}
134    case True{} False{} False{} True{} False{} True{} False{} False{}:
135      {==}
136    case False{} True{} False{} True{} False{} True{} False{} False{}:
137      {==}
138    case True{} True{} False{} True{} False{} True{} False{} False{}:
139      {==}
140    case False{} False{} True{} True{} False{} True{} False{} False{}:
141      {==}
142    case True{} False{} True{} True{} False{} True{} False{} False{}:
143      {==}
144    case False{} True{} True{} True{} False{} True{} False{} False{}:
145      {==}
146    case True{} True{} True{} True{} False{} True{} False{} False{}:
147      {==}
148    case False{} False{} False{} False{} True{} True{} False{} False{}:
149      {==}
150    case True{} False{} False{} False{} True{} True{} False{} False{}:
151      {==}
152    case False{} True{} False{} False{} True{} True{} False{} False{}:
153      {==}
154    case True{} True{} False{} False{} True{} True{} False{} False{}:
155      {==}
156    case False{} False{} True{} False{} True{} True{} False{} False{}:
157      {==}
158    case True{} False{} True{} False{} True{} True{} False{} False{}:
159      {==}
160    case False{} True{} True{} False{} True{} True{} False{} False{}:
161      {==}
162    case True{} True{} True{} False{} True{} True{} False{} False{}:
163      {==}
164    case False{} False{} False{} True{} True{} True{} False{} False{}:
165      {==}
166    case True{} False{} False{} True{} True{} True{} False{} False{}:
167      {==}
168    case False{} True{} False{} True{} True{} True{} False{} False{}:
169      {==}
170    case True{} True{} False{} True{} True{} True{} False{} False{}:
171      {==}
172    case False{} False{} True{} True{} True{} True{} False{} False{}:
173      {==}
174    case True{} False{} True{} True{} True{} True{} False{} False{}:
175      {==}
176    case False{} True{} True{} True{} True{} True{} False{} False{}:
177      {==}
178    case True{} True{} True{} True{} True{} True{} False{} False{}:
179      {==}
180    case False{} False{} False{} False{} False{} False{} True{} False{}:
181      {==}
182    case True{} False{} False{} False{} False{} False{} True{} False{}:
183      {==}
184    case False{} True{} False{} False{} False{} False{} True{} False{}:
185      {==}
186    case True{} True{} False{} False{} False{} False{} True{} False{}:
187      {==}
188    case False{} False{} True{} False{} False{} False{} True{} False{}:
189      {==}
190    case True{} False{} True{} False{} False{} False{} True{} False{}:
191      {==}
192    case False{} True{} True{} False{} False{} False{} True{} False{}:
193      {==}
194    case True{} True{} True{} False{} False{} False{} True{} False{}:
195      {==}
196    case False{} False{} False{} True{} False{} False{} True{} False{}:
197      {==}
198    case True{} False{} False{} True{} False{} False{} True{} False{}:
199      {==}
200    case False{} True{} False{} True{} False{} False{} True{} False{}:
201      {==}
202    case True{} True{} False{} True{} False{} False{} True{} False{}:
203      {==}
204    case False{} False{} True{} True{} False{} False{} True{} False{}:
205      {==}
206    case True{} False{} True{} True{} False{} False{} True{} False{}:
207      {==}
208    case False{} True{} True{} True{} False{} False{} True{} False{}:
209      {==}
210    case True{} True{} True{} True{} False{} False{} True{} False{}:
211      {==}
212    case False{} False{} False{} False{} True{} False{} True{} False{}:
213      {==}
214    case True{} False{} False{} False{} True{} False{} True{} False{}:
215      {==}
216    case False{} True{} False{} False{} True{} False{} True{} False{}:
217      {==}
218    case True{} True{} False{} False{} True{} False{} True{} False{}:
219      {==}
220    case False{} False{} True{} False{} True{} False{} True{} False{}:
221      {==}
222    case True{} False{} True{} False{} True{} False{} True{} False{}:
223      {==}
224    case False{} True{} True{} False{} True{} False{} True{} False{}:
225      {==}
226    case True{} True{} True{} False{} True{} False{} True{} False{}:
227      {==}
228    case False{} False{} False{} True{} True{} False{} True{} False{}:
229      {==}
230    case True{} False{} False{} True{} True{} False{} True{} False{}:
231      {==}
232    case False{} True{} False{} True{} True{} False{} True{} False{}:
233      {==}
234    case True{} True{} False{} True{} True{} False{} True{} False{}:
235      {==}
236    case False{} False{} True{} True{} True{} False{} True{} False{}:
237      {==}
238    case True{} False{} True{} True{} True{} False{} True{} False{}:
239      {==}
240    case False{} True{} True{} True{} True{} False{} True{} False{}:
241      {==}
242    case True{} True{} True{} True{} True{} False{} True{} False{}:
243      {==}
244    case False{} False{} False{} False{} False{} True{} True{} False{}:
245      {==}
246    case True{} False{} False{} False{} False{} True{} True{} False{}:
247      {==}
248    case False{} True{} False{} False{} False{} True{} True{} False{}:
249      {==}
250    case True{} True{} False{} False{} False{} True{} True{} False{}:
251      {==}
252    case False{} False{} True{} False{} False{} True{} True{} False{}:
253      {==}
254    case True{} False{} True{} False{} False{} True{} True{} False{}:
255      {==}
256    case False{} True{} True{} False{} False{} True{} True{} False{}:
257      {==}
258    case True{} True{} True{} False{} False{} True{} True{} False{}:
259      {==}
260    case False{} False{} False{} True{} False{} True{} True{} False{}:
261      {==}
262    case True{} False{} False{} True{} False{} True{} True{} False{}:
263      {==}
264    case False{} True{} False{} True{} False{} True{} True{} False{}:
265      {==}
266    case True{} True{} False{} True{} False{} True{} True{} False{}:
267      {==}
268    case False{} False{} True{} True{} False{} True{} True{} False{}:
269      {==}
270    case True{} False{} True{} True{} False{} True{} True{} False{}:
271      {==}
272    case False{} True{} True{} True{} False{} True{} True{} False{}:
273      {==}
274    case True{} True{} True{} True{} False{} True{} True{} False{}:
275      {==}
276    case False{} False{} False{} False{} True{} True{} True{} False{}:
277      {==}
278    case True{} False{} False{} False{} True{} True{} True{} False{}:
279      {==}
280    case False{} True{} False{} False{} True{} True{} True{} False{}:
281      {==}
282    case True{} True{} False{} False{} True{} True{} True{} False{}:
283      {==}
284    case False{} False{} True{} False{} True{} True{} True{} False{}:
285      {==}
286    case True{} False{} True{} False{} True{} True{} True{} False{}:
287      {==}
288    case False{} True{} True{} False{} True{} True{} True{} False{}:
289      {==}
290    case True{} True{} True{} False{} True{} True{} True{} False{}:
291      {==}
292    case False{} False{} False{} True{} True{} True{} True{} False{}:
293      {==}
294    case True{} False{} False{} True{} True{} True{} True{} False{}:
295      {==}
296    case False{} True{} False{} True{} True{} True{} True{} False{}:
297      {==}
298    case True{} True{} False{} True{} True{} True{} True{} False{}:
299      {==}
300    case False{} False{} True{} True{} True{} True{} True{} False{}:
301      {==}
302    case True{} False{} True{} True{} True{} True{} True{} False{}:
303      {==}
304    case False{} True{} True{} True{} True{} True{} True{} False{}:
305      {==}
306    case True{} True{} True{} True{} True{} True{} True{} False{}:
307      {==}
308    case False{} False{} False{} False{} False{} False{} False{} True{}:
309      {==}
310    case True{} False{} False{} False{} False{} False{} False{} True{}:
311      {==}
312    case False{} True{} False{} False{} False{} False{} False{} True{}:
313      {==}
314    case True{} True{} False{} False{} False{} False{} False{} True{}:
315      {==}
316    case False{} False{} True{} False{} False{} False{} False{} True{}:
317      {==}
318    case True{} False{} True{} False{} False{} False{} False{} True{}:
319      {==}
320    case False{} True{} True{} False{} False{} False{} False{} True{}:
321      {==}
322    case True{} True{} True{} False{} False{} False{} False{} True{}:
323      {==}
324    case False{} False{} False{} True{} False{} False{} False{} True{}:
325      {==}
326    case True{} False{} False{} True{} False{} False{} False{} True{}:
327      {==}
328    case False{} True{} False{} True{} False{} False{} False{} True{}:
329      {==}
330    case True{} True{} False{} True{} False{} False{} False{} True{}:
331      {==}
332    case False{} False{} True{} True{} False{} False{} False{} True{}:
333      {==}
334    case True{} False{} True{} True{} False{} False{} False{} True{}:
335      {==}
336    case False{} True{} True{} True{} False{} False{} False{} True{}:
337      {==}
338    case True{} True{} True{} True{} False{} False{} False{} True{}:
339      {==}
340    case False{} False{} False{} False{} True{} False{} False{} True{}:
341      {==}
342    case True{} False{} False{} False{} True{} False{} False{} True{}:
343      {==}
344    case False{} True{} False{} False{} True{} False{} False{} True{}:
345      {==}
346    case True{} True{} False{} False{} True{} False{} False{} True{}:
347      {==}
348    case False{} False{} True{} False{} True{} False{} False{} True{}:
349      {==}
350    case True{} False{} True{} False{} True{} False{} False{} True{}:
351      {==}
352    case False{} True{} True{} False{} True{} False{} False{} True{}:
353      {==}
354    case True{} True{} True{} False{} True{} False{} False{} True{}:
355      {==}
356    case False{} False{} False{} True{} True{} False{} False{} True{}:
357      {==}
358    case True{} False{} False{} True{} True{} False{} False{} True{}:
359      {==}
360    case False{} True{} False{} True{} True{} False{} False{} True{}:
361      {==}
362    case True{} True{} False{} True{} True{} False{} False{} True{}:
363      {==}
364    case False{} False{} True{} True{} True{} False{} False{} True{}:
365      {==}
366    case True{} False{} True{} True{} True{} False{} False{} True{}:
367      {==}
368    case False{} True{} True{} True{} True{} False{} False{} True{}:
369      {==}
370    case True{} True{} True{} True{} True{} False{} False{} True{}:
371      {==}
372    case False{} False{} False{} False{} False{} True{} False{} True{}:
373      {==}
374    case True{} False{} False{} False{} False{} True{} False{} True{}:
375      {==}
376    case False{} True{} False{} False{} False{} True{} False{} True{}:
377      {==}
378    case True{} True{} False{} False{} False{} True{} False{} True{}:
379      {==}
380    case False{} False{} True{} False{} False{} True{} False{} True{}:
381      {==}
382    case True{} False{} True{} False{} False{} True{} False{} True{}:
383      {==}
384    case False{} True{} True{} False{} False{} True{} False{} True{}:
385      {==}
386    case True{} True{} True{} False{} False{} True{} False{} True{}:
387      {==}
388    case False{} False{} False{} True{} False{} True{} False{} True{}:
389      {==}
390    case True{} False{} False{} True{} False{} True{} False{} True{}:
391      {==}
392    case False{} True{} False{} True{} False{} True{} False{} True{}:
393      {==}
394    case True{} True{} False{} True{} False{} True{} False{} True{}:
395      {==}
396    case False{} False{} True{} True{} False{} True{} False{} True{}:
397      {==}
398    case True{} False{} True{} True{} False{} True{} False{} True{}:
399      {==}
400    case False{} True{} True{} True{} False{} True{} False{} True{}:
401      {==}
402    case True{} True{} True{} True{} False{} True{} False{} True{}:
403      {==}
404    case False{} False{} False{} False{} True{} True{} False{} True{}:
405      {==}
406    case True{} False{} False{} False{} True{} True{} False{} True{}:
407      {==}
408    case False{} True{} False{} False{} True{} True{} False{} True{}:
409      {==}
410    case True{} True{} False{} False{} True{} True{} False{} True{}:
411      {==}
412    case False{} False{} True{} False{} True{} True{} False{} True{}:
413      {==}
414    case True{} False{} True{} False{} True{} True{} False{} True{}:
415      {==}
416    case False{} True{} True{} False{} True{} True{} False{} True{}:
417      {==}
418    case True{} True{} True{} False{} True{} True{} False{} True{}:
419      {==}
420    case False{} False{} False{} True{} True{} True{} False{} True{}:
421      {==}
422    case True{} False{} False{} True{} True{} True{} False{} True{}:
423      {==}
424    case False{} True{} False{} True{} True{} True{} False{} True{}:
425      {==}
426    case True{} True{} False{} True{} True{} True{} False{} True{}:
427      {==}
428    case False{} False{} True{} True{} True{} True{} False{} True{}:
429      {==}
430    case True{} False{} True{} True{} True{} True{} False{} True{}:
431      {==}
432    case False{} True{} True{} True{} True{} True{} False{} True{}:
433      {==}
434    case True{} True{} True{} True{} True{} True{} False{} True{}:
435      {==}
436    case False{} False{} False{} False{} False{} False{} True{} True{}:
437      {==}
438    case True{} False{} False{} False{} False{} False{} True{} True{}:
439      {==}
440    case False{} True{} False{} False{} False{} False{} True{} True{}:
441      {==}
442    case True{} True{} False{} False{} False{} False{} True{} True{}:
443      {==}
444    case False{} False{} True{} False{} False{} False{} True{} True{}:
445      {==}
446    case True{} False{} True{} False{} False{} False{} True{} True{}:
447      {==}
448    case False{} True{} True{} False{} False{} False{} True{} True{}:
449      {==}
450    case True{} True{} True{} False{} False{} False{} True{} True{}:
451      {==}
452    case False{} False{} False{} True{} False{} False{} True{} True{}:
453      {==}
454    case True{} False{} False{} True{} False{} False{} True{} True{}:
455      {==}
456    case False{} True{} False{} True{} False{} False{} True{} True{}:
457      {==}
458    case True{} True{} False{} True{} False{} False{} True{} True{}:
459      {==}
460    case False{} False{} True{} True{} False{} False{} True{} True{}:
461      {==}
462    case True{} False{} True{} True{} False{} False{} True{} True{}:
463      {==}
464    case False{} True{} True{} True{} False{} False{} True{} True{}:
465      {==}
466    case True{} True{} True{} True{} False{} False{} True{} True{}:
467      {==}
468    case False{} False{} False{} False{} True{} False{} True{} True{}:
469      {==}
470    case True{} False{} False{} False{} True{} False{} True{} True{}:
471      {==}
472    case False{} True{} False{} False{} True{} False{} True{} True{}:
473      {==}
474    case True{} True{} False{} False{} True{} False{} True{} True{}:
475      {==}
476    case False{} False{} True{} False{} True{} False{} True{} True{}:
477      {==}
478    case True{} False{} True{} False{} True{} False{} True{} True{}:
479      {==}
480    case False{} True{} True{} False{} True{} False{} True{} True{}:
481      {==}
482    case True{} True{} True{} False{} True{} False{} True{} True{}:
483      {==}
484    case False{} False{} False{} True{} True{} False{} True{} True{}:
485      {==}
486    case True{} False{} False{} True{} True{} False{} True{} True{}:
487      {==}
488    case False{} True{} False{} True{} True{} False{} True{} True{}:
489      {==}
490    case True{} True{} False{} True{} True{} False{} True{} True{}:
491      {==}
492    case False{} False{} True{} True{} True{} False{} True{} True{}:
493      {==}
494    case True{} False{} True{} True{} True{} False{} True{} True{}:
495      {==}
496    case False{} True{} True{} True{} True{} False{} True{} True{}:
497      {==}
498    case True{} True{} True{} True{} True{} False{} True{} True{}:
499      {==}
500    case False{} False{} False{} False{} False{} True{} True{} True{}:
501      {==}
502    case True{} False{} False{} False{} False{} True{} True{} True{}:
503      {==}
504    case False{} True{} False{} False{} False{} True{} True{} True{}:
505      {==}
506    case True{} True{} False{} False{} False{} True{} True{} True{}:
507      {==}
508    case False{} False{} True{} False{} False{} True{} True{} True{}:
509      {==}
510    case True{} False{} True{} False{} False{} True{} True{} True{}:
511      {==}
512    case False{} True{} True{} False{} False{} True{} True{} True{}:
513      {==}
514    case True{} True{} True{} False{} False{} True{} True{} True{}:
515      {==}
516    case False{} False{} False{} True{} False{} True{} True{} True{}:
517      {==}
518    case True{} False{} False{} True{} False{} True{} True{} True{}:
519      {==}
520    case False{} True{} False{} True{} False{} True{} True{} True{}:
521      {==}
522    case True{} True{} False{} True{} False{} True{} True{} True{}:
523      {==}
524    case False{} False{} True{} True{} False{} True{} True{} True{}:
525      {==}
526    case True{} False{} True{} True{} False{} True{} True{} True{}:
527      {==}
528    case False{} True{} True{} True{} False{} True{} True{} True{}:
529      {==}
530    case True{} True{} True{} True{} False{} True{} True{} True{}:
531      {==}
532    case False{} False{} False{} False{} True{} True{} True{} True{}:
533      {==}
534    case True{} False{} False{} False{} True{} True{} True{} True{}:
535      {==}
536    case False{} True{} False{} False{} True{} True{} True{} True{}:
537      {==}
538    case True{} True{} False{} False{} True{} True{} True{} True{}:
539      {==}
540    case False{} False{} True{} False{} True{} True{} True{} True{}:
541      {==}
542    case True{} False{} True{} False{} True{} True{} True{} True{}:
543      {==}
544    case False{} True{} True{} False{} True{} True{} True{} True{}:
545      {==}
546    case True{} True{} True{} False{} True{} True{} True{} True{}:
547      {==}
548    case False{} False{} False{} True{} True{} True{} True{} True{}:
549      {==}
550    case True{} False{} False{} True{} True{} True{} True{} True{}:
551      {==}
552    case False{} True{} False{} True{} True{} True{} True{} True{}:
553      {==}
554    case True{} True{} False{} True{} True{} True{} True{} True{}:
555      {==}
556    case False{} False{} True{} True{} True{} True{} True{} True{}:
557      {==}
558    case True{} False{} True{} True{} True{} True{} True{} True{}:
559      {==}
560    case False{} True{} True{} True{} True{} True{} True{} True{}:
561      {==}
562    case True{} True{} True{} True{} True{} True{} True{} True{}:
563      {==}
564
565def ap.sbl(+x: U32) -> {SB.sbox(U32.and(255, x)) == U32.and(255, SB.sbox(U32.and(255, x))) : U32}:
566  match x:
567    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
568      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {SB.sbox(_) == U32.and(255, SB.sbox(_)) : U32}
569      ap.e_sbl(c0, c1, c2, c3, c4, c5, c6, c7)
570
571def ap.e_sbi(c0: Bool, c1: Bool, c2: Bool, c3: Bool, c4: Bool, c5: Bool, c6: Bool, c7: Bool) -> {X.aes.isbox(SB.sbox(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}})) == U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}} : U32}:
572  match c0 c1 c2 c3 c4 c5 c6 c7:
573    case False{} False{} False{} False{} False{} False{} False{} False{}:
574      {==}
575    case True{} False{} False{} False{} False{} False{} False{} False{}:
576      {==}
577    case False{} True{} False{} False{} False{} False{} False{} False{}:
578      {==}
579    case True{} True{} False{} False{} False{} False{} False{} False{}:
580      {==}
581    case False{} False{} True{} False{} False{} False{} False{} False{}:
582      {==}
583    case True{} False{} True{} False{} False{} False{} False{} False{}:
584      {==}
585    case False{} True{} True{} False{} False{} False{} False{} False{}:
586      {==}
587    case True{} True{} True{} False{} False{} False{} False{} False{}:
588      {==}
589    case False{} False{} False{} True{} False{} False{} False{} False{}:
590      {==}
591    case True{} False{} False{} True{} False{} False{} False{} False{}:
592      {==}
593    case False{} True{} False{} True{} False{} False{} False{} False{}:
594      {==}
595    case True{} True{} False{} True{} False{} False{} False{} False{}:
596      {==}
597    case False{} False{} True{} True{} False{} False{} False{} False{}:
598      {==}
599    case True{} False{} True{} True{} False{} False{} False{} False{}:
600      {==}
601    case False{} True{} True{} True{} False{} False{} False{} False{}:
602      {==}
603    case True{} True{} True{} True{} False{} False{} False{} False{}:
604      {==}
605    case False{} False{} False{} False{} True{} False{} False{} False{}:
606      {==}
607    case True{} False{} False{} False{} True{} False{} False{} False{}:
608      {==}
609    case False{} True{} False{} False{} True{} False{} False{} False{}:
610      {==}
611    case True{} True{} False{} False{} True{} False{} False{} False{}:
612      {==}
613    case False{} False{} True{} False{} True{} False{} False{} False{}:
614      {==}
615    case True{} False{} True{} False{} True{} False{} False{} False{}:
616      {==}
617    case False{} True{} True{} False{} True{} False{} False{} False{}:
618      {==}
619    case True{} True{} True{} False{} True{} False{} False{} False{}:
620      {==}
621    case False{} False{} False{} True{} True{} False{} False{} False{}:
622      {==}
623    case True{} False{} False{} True{} True{} False{} False{} False{}:
624      {==}
625    case False{} True{} False{} True{} True{} False{} False{} False{}:
626      {==}
627    case True{} True{} False{} True{} True{} False{} False{} False{}:
628      {==}
629    case False{} False{} True{} True{} True{} False{} False{} False{}:
630      {==}
631    case True{} False{} True{} True{} True{} False{} False{} False{}:
632      {==}
633    case False{} True{} True{} True{} True{} False{} False{} False{}:
634      {==}
635    case True{} True{} True{} True{} True{} False{} False{} False{}:
636      {==}
637    case False{} False{} False{} False{} False{} True{} False{} False{}:
638      {==}
639    case True{} False{} False{} False{} False{} True{} False{} False{}:
640      {==}
641    case False{} True{} False{} False{} False{} True{} False{} False{}:
642      {==}
643    case True{} True{} False{} False{} False{} True{} False{} False{}:
644      {==}
645    case False{} False{} True{} False{} False{} True{} False{} False{}:
646      {==}
647    case True{} False{} True{} False{} False{} True{} False{} False{}:
648      {==}
649    case False{} True{} True{} False{} False{} True{} False{} False{}:
650      {==}
651    case True{} True{} True{} False{} False{} True{} False{} False{}:
652      {==}
653    case False{} False{} False{} True{} False{} True{} False{} False{}:
654      {==}
655    case True{} False{} False{} True{} False{} True{} False{} False{}:
656      {==}
657    case False{} True{} False{} True{} False{} True{} False{} False{}:
658      {==}
659    case True{} True{} False{} True{} False{} True{} False{} False{}:
660      {==}
661    case False{} False{} True{} True{} False{} True{} False{} False{}:
662      {==}
663    case True{} False{} True{} True{} False{} True{} False{} False{}:
664      {==}
665    case False{} True{} True{} True{} False{} True{} False{} False{}:
666      {==}
667    case True{} True{} True{} True{} False{} True{} False{} False{}:
668      {==}
669    case False{} False{} False{} False{} True{} True{} False{} False{}:
670      {==}
671    case True{} False{} False{} False{} True{} True{} False{} False{}:
672      {==}
673    case False{} True{} False{} False{} True{} True{} False{} False{}:
674      {==}
675    case True{} True{} False{} False{} True{} True{} False{} False{}:
676      {==}
677    case False{} False{} True{} False{} True{} True{} False{} False{}:
678      {==}
679    case True{} False{} True{} False{} True{} True{} False{} False{}:
680      {==}
681    case False{} True{} True{} False{} True{} True{} False{} False{}:
682      {==}
683    case True{} True{} True{} False{} True{} True{} False{} False{}:
684      {==}
685    case False{} False{} False{} True{} True{} True{} False{} False{}:
686      {==}
687    case True{} False{} False{} True{} True{} True{} False{} False{}:
688      {==}
689    case False{} True{} False{} True{} True{} True{} False{} False{}:
690      {==}
691    case True{} True{} False{} True{} True{} True{} False{} False{}:
692      {==}
693    case False{} False{} True{} True{} True{} True{} False{} False{}:
694      {==}
695    case True{} False{} True{} True{} True{} True{} False{} False{}:
696      {==}
697    case False{} True{} True{} True{} True{} True{} False{} False{}:
698      {==}
699    case True{} True{} True{} True{} True{} True{} False{} False{}:
700      {==}
701    case False{} False{} False{} False{} False{} False{} True{} False{}:
702      {==}
703    case True{} False{} False{} False{} False{} False{} True{} False{}:
704      {==}
705    case False{} True{} False{} False{} False{} False{} True{} False{}:
706      {==}
707    case True{} True{} False{} False{} False{} False{} True{} False{}:
708      {==}
709    case False{} False{} True{} False{} False{} False{} True{} False{}:
710      {==}
711    case True{} False{} True{} False{} False{} False{} True{} False{}:
712      {==}
713    case False{} True{} True{} False{} False{} False{} True{} False{}:
714      {==}
715    case True{} True{} True{} False{} False{} False{} True{} False{}:
716      {==}
717    case False{} False{} False{} True{} False{} False{} True{} False{}:
718      {==}
719    case True{} False{} False{} True{} False{} False{} True{} False{}:
720      {==}
721    case False{} True{} False{} True{} False{} False{} True{} False{}:
722      {==}
723    case True{} True{} False{} True{} False{} False{} True{} False{}:
724      {==}
725    case False{} False{} True{} True{} False{} False{} True{} False{}:
726      {==}
727    case True{} False{} True{} True{} False{} False{} True{} False{}:
728      {==}
729    case False{} True{} True{} True{} False{} False{} True{} False{}:
730      {==}
731    case True{} True{} True{} True{} False{} False{} True{} False{}:
732      {==}
733    case False{} False{} False{} False{} True{} False{} True{} False{}:
734      {==}
735    case True{} False{} False{} False{} True{} False{} True{} False{}:
736      {==}
737    case False{} True{} False{} False{} True{} False{} True{} False{}:
738      {==}
739    case True{} True{} False{} False{} True{} False{} True{} False{}:
740      {==}
741    case False{} False{} True{} False{} True{} False{} True{} False{}:
742      {==}
743    case True{} False{} True{} False{} True{} False{} True{} False{}:
744      {==}
745    case False{} True{} True{} False{} True{} False{} True{} False{}:
746      {==}
747    case True{} True{} True{} False{} True{} False{} True{} False{}:
748      {==}
749    case False{} False{} False{} True{} True{} False{} True{} False{}:
750      {==}
751    case True{} False{} False{} True{} True{} False{} True{} False{}:
752      {==}
753    case False{} True{} False{} True{} True{} False{} True{} False{}:
754      {==}
755    case True{} True{} False{} True{} True{} False{} True{} False{}:
756      {==}
757    case False{} False{} True{} True{} True{} False{} True{} False{}:
758      {==}
759    case True{} False{} True{} True{} True{} False{} True{} False{}:
760      {==}
761    case False{} True{} True{} True{} True{} False{} True{} False{}:
762      {==}
763    case True{} True{} True{} True{} True{} False{} True{} False{}:
764      {==}
765    case False{} False{} False{} False{} False{} True{} True{} False{}:
766      {==}
767    case True{} False{} False{} False{} False{} True{} True{} False{}:
768      {==}
769    case False{} True{} False{} False{} False{} True{} True{} False{}:
770      {==}
771    case True{} True{} False{} False{} False{} True{} True{} False{}:
772      {==}
773    case False{} False{} True{} False{} False{} True{} True{} False{}:
774      {==}
775    case True{} False{} True{} False{} False{} True{} True{} False{}:
776      {==}
777    case False{} True{} True{} False{} False{} True{} True{} False{}:
778      {==}
779    case True{} True{} True{} False{} False{} True{} True{} False{}:
780      {==}
781    case False{} False{} False{} True{} False{} True{} True{} False{}:
782      {==}
783    case True{} False{} False{} True{} False{} True{} True{} False{}:
784      {==}
785    case False{} True{} False{} True{} False{} True{} True{} False{}:
786      {==}
787    case True{} True{} False{} True{} False{} True{} True{} False{}:
788      {==}
789    case False{} False{} True{} True{} False{} True{} True{} False{}:
790      {==}
791    case True{} False{} True{} True{} False{} True{} True{} False{}:
792      {==}
793    case False{} True{} True{} True{} False{} True{} True{} False{}:
794      {==}
795    case True{} True{} True{} True{} False{} True{} True{} False{}:
796      {==}
797    case False{} False{} False{} False{} True{} True{} True{} False{}:
798      {==}
799    case True{} False{} False{} False{} True{} True{} True{} False{}:
800      {==}
801    case False{} True{} False{} False{} True{} True{} True{} False{}:
802      {==}
803    case True{} True{} False{} False{} True{} True{} True{} False{}:
804      {==}
805    case False{} False{} True{} False{} True{} True{} True{} False{}:
806      {==}
807    case True{} False{} True{} False{} True{} True{} True{} False{}:
808      {==}
809    case False{} True{} True{} False{} True{} True{} True{} False{}:
810      {==}
811    case True{} True{} True{} False{} True{} True{} True{} False{}:
812      {==}
813    case False{} False{} False{} True{} True{} True{} True{} False{}:
814      {==}
815    case True{} False{} False{} True{} True{} True{} True{} False{}:
816      {==}
817    case False{} True{} False{} True{} True{} True{} True{} False{}:
818      {==}
819    case True{} True{} False{} True{} True{} True{} True{} False{}:
820      {==}
821    case False{} False{} True{} True{} True{} True{} True{} False{}:
822      {==}
823    case True{} False{} True{} True{} True{} True{} True{} False{}:
824      {==}
825    case False{} True{} True{} True{} True{} True{} True{} False{}:
826      {==}
827    case True{} True{} True{} True{} True{} True{} True{} False{}:
828      {==}
829    case False{} False{} False{} False{} False{} False{} False{} True{}:
830      {==}
831    case True{} False{} False{} False{} False{} False{} False{} True{}:
832      {==}
833    case False{} True{} False{} False{} False{} False{} False{} True{}:
834      {==}
835    case True{} True{} False{} False{} False{} False{} False{} True{}:
836      {==}
837    case False{} False{} True{} False{} False{} False{} False{} True{}:
838      {==}
839    case True{} False{} True{} False{} False{} False{} False{} True{}:
840      {==}
841    case False{} True{} True{} False{} False{} False{} False{} True{}:
842      {==}
843    case True{} True{} True{} False{} False{} False{} False{} True{}:
844      {==}
845    case False{} False{} False{} True{} False{} False{} False{} True{}:
846      {==}
847    case True{} False{} False{} True{} False{} False{} False{} True{}:
848      {==}
849    case False{} True{} False{} True{} False{} False{} False{} True{}:
850      {==}
851    case True{} True{} False{} True{} False{} False{} False{} True{}:
852      {==}
853    case False{} False{} True{} True{} False{} False{} False{} True{}:
854      {==}
855    case True{} False{} True{} True{} False{} False{} False{} True{}:
856      {==}
857    case False{} True{} True{} True{} False{} False{} False{} True{}:
858      {==}
859    case True{} True{} True{} True{} False{} False{} False{} True{}:
860      {==}
861    case False{} False{} False{} False{} True{} False{} False{} True{}:
862      {==}
863    case True{} False{} False{} False{} True{} False{} False{} True{}:
864      {==}
865    case False{} True{} False{} False{} True{} False{} False{} True{}:
866      {==}
867    case True{} True{} False{} False{} True{} False{} False{} True{}:
868      {==}
869    case False{} False{} True{} False{} True{} False{} False{} True{}:
870      {==}
871    case True{} False{} True{} False{} True{} False{} False{} True{}:
872      {==}
873    case False{} True{} True{} False{} True{} False{} False{} True{}:
874      {==}
875    case True{} True{} True{} False{} True{} False{} False{} True{}:
876      {==}
877    case False{} False{} False{} True{} True{} False{} False{} True{}:
878      {==}
879    case True{} False{} False{} True{} True{} False{} False{} True{}:
880      {==}
881    case False{} True{} False{} True{} True{} False{} False{} True{}:
882      {==}
883    case True{} True{} False{} True{} True{} False{} False{} True{}:
884      {==}
885    case False{} False{} True{} True{} True{} False{} False{} True{}:
886      {==}
887    case True{} False{} True{} True{} True{} False{} False{} True{}:
888      {==}
889    case False{} True{} True{} True{} True{} False{} False{} True{}:
890      {==}
891    case True{} True{} True{} True{} True{} False{} False{} True{}:
892      {==}
893    case False{} False{} False{} False{} False{} True{} False{} True{}:
894      {==}
895    case True{} False{} False{} False{} False{} True{} False{} True{}:
896      {==}
897    case False{} True{} False{} False{} False{} True{} False{} True{}:
898      {==}
899    case True{} True{} False{} False{} False{} True{} False{} True{}:
900      {==}
901    case False{} False{} True{} False{} False{} True{} False{} True{}:
902      {==}
903    case True{} False{} True{} False{} False{} True{} False{} True{}:
904      {==}
905    case False{} True{} True{} False{} False{} True{} False{} True{}:
906      {==}
907    case True{} True{} True{} False{} False{} True{} False{} True{}:
908      {==}
909    case False{} False{} False{} True{} False{} True{} False{} True{}:
910      {==}
911    case True{} False{} False{} True{} False{} True{} False{} True{}:
912      {==}
913    case False{} True{} False{} True{} False{} True{} False{} True{}:
914      {==}
915    case True{} True{} False{} True{} False{} True{} False{} True{}:
916      {==}
917    case False{} False{} True{} True{} False{} True{} False{} True{}:
918      {==}
919    case True{} False{} True{} True{} False{} True{} False{} True{}:
920      {==}
921    case False{} True{} True{} True{} False{} True{} False{} True{}:
922      {==}
923    case True{} True{} True{} True{} False{} True{} False{} True{}:
924      {==}
925    case False{} False{} False{} False{} True{} True{} False{} True{}:
926      {==}
927    case True{} False{} False{} False{} True{} True{} False{} True{}:
928      {==}
929    case False{} True{} False{} False{} True{} True{} False{} True{}:
930      {==}
931    case True{} True{} False{} False{} True{} True{} False{} True{}:
932      {==}
933    case False{} False{} True{} False{} True{} True{} False{} True{}:
934      {==}
935    case True{} False{} True{} False{} True{} True{} False{} True{}:
936      {==}
937    case False{} True{} True{} False{} True{} True{} False{} True{}:
938      {==}
939    case True{} True{} True{} False{} True{} True{} False{} True{}:
940      {==}
941    case False{} False{} False{} True{} True{} True{} False{} True{}:
942      {==}
943    case True{} False{} False{} True{} True{} True{} False{} True{}:
944      {==}
945    case False{} True{} False{} True{} True{} True{} False{} True{}:
946      {==}
947    case True{} True{} False{} True{} True{} True{} False{} True{}:
948      {==}
949    case False{} False{} True{} True{} True{} True{} False{} True{}:
950      {==}
951    case True{} False{} True{} True{} True{} True{} False{} True{}:
952      {==}
953    case False{} True{} True{} True{} True{} True{} False{} True{}:
954      {==}
955    case True{} True{} True{} True{} True{} True{} False{} True{}:
956      {==}
957    case False{} False{} False{} False{} False{} False{} True{} True{}:
958      {==}
959    case True{} False{} False{} False{} False{} False{} True{} True{}:
960      {==}
961    case False{} True{} False{} False{} False{} False{} True{} True{}:
962      {==}
963    case True{} True{} False{} False{} False{} False{} True{} True{}:
964      {==}
965    case False{} False{} True{} False{} False{} False{} True{} True{}:
966      {==}
967    case True{} False{} True{} False{} False{} False{} True{} True{}:
968      {==}
969    case False{} True{} True{} False{} False{} False{} True{} True{}:
970      {==}
971    case True{} True{} True{} False{} False{} False{} True{} True{}:
972      {==}
973    case False{} False{} False{} True{} False{} False{} True{} True{}:
974      {==}
975    case True{} False{} False{} True{} False{} False{} True{} True{}:
976      {==}
977    case False{} True{} False{} True{} False{} False{} True{} True{}:
978      {==}
979    case True{} True{} False{} True{} False{} False{} True{} True{}:
980      {==}
981    case False{} False{} True{} True{} False{} False{} True{} True{}:
982      {==}
983    case True{} False{} True{} True{} False{} False{} True{} True{}:
984      {==}
985    case False{} True{} True{} True{} False{} False{} True{} True{}:
986      {==}
987    case True{} True{} True{} True{} False{} False{} True{} True{}:
988      {==}
989    case False{} False{} False{} False{} True{} False{} True{} True{}:
990      {==}
991    case True{} False{} False{} False{} True{} False{} True{} True{}:
992      {==}
993    case False{} True{} False{} False{} True{} False{} True{} True{}:
994      {==}
995    case True{} True{} False{} False{} True{} False{} True{} True{}:
996      {==}
997    case False{} False{} True{} False{} True{} False{} True{} True{}:
998      {==}
999    case True{} False{} True{} False{} True{} False{} True{} True{}:
1000      {==}
1001    case False{} True{} True{} False{} True{} False{} True{} True{}:
1002      {==}
1003    case True{} True{} True{} False{} True{} False{} True{} True{}:
1004      {==}
1005    case False{} False{} False{} True{} True{} False{} True{} True{}:
1006      {==}
1007    case True{} False{} False{} True{} True{} False{} True{} True{}:
1008      {==}
1009    case False{} True{} False{} True{} True{} False{} True{} True{}:
1010      {==}
1011    case True{} True{} False{} True{} True{} False{} True{} True{}:
1012      {==}
1013    case False{} False{} True{} True{} True{} False{} True{} True{}:
1014      {==}
1015    case True{} False{} True{} True{} True{} False{} True{} True{}:
1016      {==}
1017    case False{} True{} True{} True{} True{} False{} True{} True{}:
1018      {==}
1019    case True{} True{} True{} True{} True{} False{} True{} True{}:
1020      {==}
1021    case False{} False{} False{} False{} False{} True{} True{} True{}:
1022      {==}
1023    case True{} False{} False{} False{} False{} True{} True{} True{}:
1024      {==}
1025    case False{} True{} False{} False{} False{} True{} True{} True{}:
1026      {==}
1027    case True{} True{} False{} False{} False{} True{} True{} True{}:
1028      {==}
1029    case False{} False{} True{} False{} False{} True{} True{} True{}:
1030      {==}
1031    case True{} False{} True{} False{} False{} True{} True{} True{}:
1032      {==}
1033    case False{} True{} True{} False{} False{} True{} True{} True{}:
1034      {==}
1035    case True{} True{} True{} False{} False{} True{} True{} True{}:
1036      {==}
1037    case False{} False{} False{} True{} False{} True{} True{} True{}:
1038      {==}
1039    case True{} False{} False{} True{} False{} True{} True{} True{}:
1040      {==}
1041    case False{} True{} False{} True{} False{} True{} True{} True{}:
1042      {==}
1043    case True{} True{} False{} True{} False{} True{} True{} True{}:
1044      {==}
1045    case False{} False{} True{} True{} False{} True{} True{} True{}:
1046      {==}
1047    case True{} False{} True{} True{} False{} True{} True{} True{}:
1048      {==}
1049    case False{} True{} True{} True{} False{} True{} True{} True{}:
1050      {==}
1051    case True{} True{} True{} True{} False{} True{} True{} True{}:
1052      {==}
1053    case False{} False{} False{} False{} True{} True{} True{} True{}:
1054      {==}
1055    case True{} False{} False{} False{} True{} True{} True{} True{}:
1056      {==}
1057    case False{} True{} False{} False{} True{} True{} True{} True{}:
1058      {==}
1059    case True{} True{} False{} False{} True{} True{} True{} True{}:
1060      {==}
1061    case False{} False{} True{} False{} True{} True{} True{} True{}:
1062      {==}
1063    case True{} False{} True{} False{} True{} True{} True{} True{}:
1064      {==}
1065    case False{} True{} True{} False{} True{} True{} True{} True{}:
1066      {==}
1067    case True{} True{} True{} False{} True{} True{} True{} True{}:
1068      {==}
1069    case False{} False{} False{} True{} True{} True{} True{} True{}:
1070      {==}
1071    case True{} False{} False{} True{} True{} True{} True{} True{}:
1072      {==}
1073    case False{} True{} False{} True{} True{} True{} True{} True{}:
1074      {==}
1075    case True{} True{} False{} True{} True{} True{} True{} True{}:
1076      {==}
1077    case False{} False{} True{} True{} True{} True{} True{} True{}:
1078      {==}
1079    case True{} False{} True{} True{} True{} True{} True{} True{}:
1080      {==}
1081    case False{} True{} True{} True{} True{} True{} True{} True{}:
1082      {==}
1083    case True{} True{} True{} True{} True{} True{} True{} True{}:
1084      {==}
1085
1086def ap.sbi(+x: U32) -> {X.aes.isbox(SB.sbox(U32.and(255, x))) == U32.and(255, x) : U32}:
1087  match x:
1088    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1089      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {X.aes.isbox(SB.sbox(_)) == _ : U32}
1090      ap.e_sbi(c0, c1, c2, c3, c4, c5, c6, c7)
1091
1092def ap.ex2.l(+x: U32) -> List<&2, U32>:
1093  [SB.xtime(x), SB.mul3(x), X.aes.m9(x), X.aes.m11(x), X.aes.m13(x), X.aes.m14(x), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(x)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(x)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(x)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(x)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(x)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(x)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 9, x))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, x), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(x)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(x)), G.Gf8.mul(G.Gf8.aes(), 11, x)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(x)))), G.Gf8.add(G.Gf8.add(x, 0), G.Gf8.add(0, 0)), G.Gf8.add(G.Gf8.add(0, x), G.Gf8.add(0, 0)), G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(x, 0)), G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(0, x))]
1094
1095def ap.ex2.r(+x: U32) -> List<&2, U32>:
1096  [U32.and(255, SB.xtime(x)), U32.and(255, SB.mul3(x)), G.Gf8.mul(G.Gf8.aes(), 9, x), G.Gf8.mul(G.Gf8.aes(), 11, x), G.Gf8.mul(G.Gf8.aes(), 13, x), G.Gf8.mul(G.Gf8.aes(), 14, x), x, 0, 0, 0, 0, x, 0, 0, 0, 0, x, 0, 0, 0, 0, x, x, x, x, x]
1097
1098def ap.ex2(c0: Bool, c1: Bool, c2: Bool, c3: Bool, c4: Bool, c5: Bool, c6: Bool, c7: Bool) -> {ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}) == ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}) : List<&2, U32>}:
1099  match c0 c1 c2 c3 c4 c5 c6 c7:
1100    case False{} False{} False{} False{} False{} False{} False{} False{}:
1101      {==}
1102    case True{} False{} False{} False{} False{} False{} False{} False{}:
1103      {==}
1104    case False{} True{} False{} False{} False{} False{} False{} False{}:
1105      {==}
1106    case True{} True{} False{} False{} False{} False{} False{} False{}:
1107      {==}
1108    case False{} False{} True{} False{} False{} False{} False{} False{}:
1109      {==}
1110    case True{} False{} True{} False{} False{} False{} False{} False{}:
1111      {==}
1112    case False{} True{} True{} False{} False{} False{} False{} False{}:
1113      {==}
1114    case True{} True{} True{} False{} False{} False{} False{} False{}:
1115      {==}
1116    case False{} False{} False{} True{} False{} False{} False{} False{}:
1117      {==}
1118    case True{} False{} False{} True{} False{} False{} False{} False{}:
1119      {==}
1120    case False{} True{} False{} True{} False{} False{} False{} False{}:
1121      {==}
1122    case True{} True{} False{} True{} False{} False{} False{} False{}:
1123      {==}
1124    case False{} False{} True{} True{} False{} False{} False{} False{}:
1125      {==}
1126    case True{} False{} True{} True{} False{} False{} False{} False{}:
1127      {==}
1128    case False{} True{} True{} True{} False{} False{} False{} False{}:
1129      {==}
1130    case True{} True{} True{} True{} False{} False{} False{} False{}:
1131      {==}
1132    case False{} False{} False{} False{} True{} False{} False{} False{}:
1133      {==}
1134    case True{} False{} False{} False{} True{} False{} False{} False{}:
1135      {==}
1136    case False{} True{} False{} False{} True{} False{} False{} False{}:
1137      {==}
1138    case True{} True{} False{} False{} True{} False{} False{} False{}:
1139      {==}
1140    case False{} False{} True{} False{} True{} False{} False{} False{}:
1141      {==}
1142    case True{} False{} True{} False{} True{} False{} False{} False{}:
1143      {==}
1144    case False{} True{} True{} False{} True{} False{} False{} False{}:
1145      {==}
1146    case True{} True{} True{} False{} True{} False{} False{} False{}:
1147      {==}
1148    case False{} False{} False{} True{} True{} False{} False{} False{}:
1149      {==}
1150    case True{} False{} False{} True{} True{} False{} False{} False{}:
1151      {==}
1152    case False{} True{} False{} True{} True{} False{} False{} False{}:
1153      {==}
1154    case True{} True{} False{} True{} True{} False{} False{} False{}:
1155      {==}
1156    case False{} False{} True{} True{} True{} False{} False{} False{}:
1157      {==}
1158    case True{} False{} True{} True{} True{} False{} False{} False{}:
1159      {==}
1160    case False{} True{} True{} True{} True{} False{} False{} False{}:
1161      {==}
1162    case True{} True{} True{} True{} True{} False{} False{} False{}:
1163      {==}
1164    case False{} False{} False{} False{} False{} True{} False{} False{}:
1165      {==}
1166    case True{} False{} False{} False{} False{} True{} False{} False{}:
1167      {==}
1168    case False{} True{} False{} False{} False{} True{} False{} False{}:
1169      {==}
1170    case True{} True{} False{} False{} False{} True{} False{} False{}:
1171      {==}
1172    case False{} False{} True{} False{} False{} True{} False{} False{}:
1173      {==}
1174    case True{} False{} True{} False{} False{} True{} False{} False{}:
1175      {==}
1176    case False{} True{} True{} False{} False{} True{} False{} False{}:
1177      {==}
1178    case True{} True{} True{} False{} False{} True{} False{} False{}:
1179      {==}
1180    case False{} False{} False{} True{} False{} True{} False{} False{}:
1181      {==}
1182    case True{} False{} False{} True{} False{} True{} False{} False{}:
1183      {==}
1184    case False{} True{} False{} True{} False{} True{} False{} False{}:
1185      {==}
1186    case True{} True{} False{} True{} False{} True{} False{} False{}:
1187      {==}
1188    case False{} False{} True{} True{} False{} True{} False{} False{}:
1189      {==}
1190    case True{} False{} True{} True{} False{} True{} False{} False{}:
1191      {==}
1192    case False{} True{} True{} True{} False{} True{} False{} False{}:
1193      {==}
1194    case True{} True{} True{} True{} False{} True{} False{} False{}:
1195      {==}
1196    case False{} False{} False{} False{} True{} True{} False{} False{}:
1197      {==}
1198    case True{} False{} False{} False{} True{} True{} False{} False{}:
1199      {==}
1200    case False{} True{} False{} False{} True{} True{} False{} False{}:
1201      {==}
1202    case True{} True{} False{} False{} True{} True{} False{} False{}:
1203      {==}
1204    case False{} False{} True{} False{} True{} True{} False{} False{}:
1205      {==}
1206    case True{} False{} True{} False{} True{} True{} False{} False{}:
1207      {==}
1208    case False{} True{} True{} False{} True{} True{} False{} False{}:
1209      {==}
1210    case True{} True{} True{} False{} True{} True{} False{} False{}:
1211      {==}
1212    case False{} False{} False{} True{} True{} True{} False{} False{}:
1213      {==}
1214    case True{} False{} False{} True{} True{} True{} False{} False{}:
1215      {==}
1216    case False{} True{} False{} True{} True{} True{} False{} False{}:
1217      {==}
1218    case True{} True{} False{} True{} True{} True{} False{} False{}:
1219      {==}
1220    case False{} False{} True{} True{} True{} True{} False{} False{}:
1221      {==}
1222    case True{} False{} True{} True{} True{} True{} False{} False{}:
1223      {==}
1224    case False{} True{} True{} True{} True{} True{} False{} False{}:
1225      {==}
1226    case True{} True{} True{} True{} True{} True{} False{} False{}:
1227      {==}
1228    case False{} False{} False{} False{} False{} False{} True{} False{}:
1229      {==}
1230    case True{} False{} False{} False{} False{} False{} True{} False{}:
1231      {==}
1232    case False{} True{} False{} False{} False{} False{} True{} False{}:
1233      {==}
1234    case True{} True{} False{} False{} False{} False{} True{} False{}:
1235      {==}
1236    case False{} False{} True{} False{} False{} False{} True{} False{}:
1237      {==}
1238    case True{} False{} True{} False{} False{} False{} True{} False{}:
1239      {==}
1240    case False{} True{} True{} False{} False{} False{} True{} False{}:
1241      {==}
1242    case True{} True{} True{} False{} False{} False{} True{} False{}:
1243      {==}
1244    case False{} False{} False{} True{} False{} False{} True{} False{}:
1245      {==}
1246    case True{} False{} False{} True{} False{} False{} True{} False{}:
1247      {==}
1248    case False{} True{} False{} True{} False{} False{} True{} False{}:
1249      {==}
1250    case True{} True{} False{} True{} False{} False{} True{} False{}:
1251      {==}
1252    case False{} False{} True{} True{} False{} False{} True{} False{}:
1253      {==}
1254    case True{} False{} True{} True{} False{} False{} True{} False{}:
1255      {==}
1256    case False{} True{} True{} True{} False{} False{} True{} False{}:
1257      {==}
1258    case True{} True{} True{} True{} False{} False{} True{} False{}:
1259      {==}
1260    case False{} False{} False{} False{} True{} False{} True{} False{}:
1261      {==}
1262    case True{} False{} False{} False{} True{} False{} True{} False{}:
1263      {==}
1264    case False{} True{} False{} False{} True{} False{} True{} False{}:
1265      {==}
1266    case True{} True{} False{} False{} True{} False{} True{} False{}:
1267      {==}
1268    case False{} False{} True{} False{} True{} False{} True{} False{}:
1269      {==}
1270    case True{} False{} True{} False{} True{} False{} True{} False{}:
1271      {==}
1272    case False{} True{} True{} False{} True{} False{} True{} False{}:
1273      {==}
1274    case True{} True{} True{} False{} True{} False{} True{} False{}:
1275      {==}
1276    case False{} False{} False{} True{} True{} False{} True{} False{}:
1277      {==}
1278    case True{} False{} False{} True{} True{} False{} True{} False{}:
1279      {==}
1280    case False{} True{} False{} True{} True{} False{} True{} False{}:
1281      {==}
1282    case True{} True{} False{} True{} True{} False{} True{} False{}:
1283      {==}
1284    case False{} False{} True{} True{} True{} False{} True{} False{}:
1285      {==}
1286    case True{} False{} True{} True{} True{} False{} True{} False{}:
1287      {==}
1288    case False{} True{} True{} True{} True{} False{} True{} False{}:
1289      {==}
1290    case True{} True{} True{} True{} True{} False{} True{} False{}:
1291      {==}
1292    case False{} False{} False{} False{} False{} True{} True{} False{}:
1293      {==}
1294    case True{} False{} False{} False{} False{} True{} True{} False{}:
1295      {==}
1296    case False{} True{} False{} False{} False{} True{} True{} False{}:
1297      {==}
1298    case True{} True{} False{} False{} False{} True{} True{} False{}:
1299      {==}
1300    case False{} False{} True{} False{} False{} True{} True{} False{}:
1301      {==}
1302    case True{} False{} True{} False{} False{} True{} True{} False{}:
1303      {==}
1304    case False{} True{} True{} False{} False{} True{} True{} False{}:
1305      {==}
1306    case True{} True{} True{} False{} False{} True{} True{} False{}:
1307      {==}
1308    case False{} False{} False{} True{} False{} True{} True{} False{}:
1309      {==}
1310    case True{} False{} False{} True{} False{} True{} True{} False{}:
1311      {==}
1312    case False{} True{} False{} True{} False{} True{} True{} False{}:
1313      {==}
1314    case True{} True{} False{} True{} False{} True{} True{} False{}:
1315      {==}
1316    case False{} False{} True{} True{} False{} True{} True{} False{}:
1317      {==}
1318    case True{} False{} True{} True{} False{} True{} True{} False{}:
1319      {==}
1320    case False{} True{} True{} True{} False{} True{} True{} False{}:
1321      {==}
1322    case True{} True{} True{} True{} False{} True{} True{} False{}:
1323      {==}
1324    case False{} False{} False{} False{} True{} True{} True{} False{}:
1325      {==}
1326    case True{} False{} False{} False{} True{} True{} True{} False{}:
1327      {==}
1328    case False{} True{} False{} False{} True{} True{} True{} False{}:
1329      {==}
1330    case True{} True{} False{} False{} True{} True{} True{} False{}:
1331      {==}
1332    case False{} False{} True{} False{} True{} True{} True{} False{}:
1333      {==}
1334    case True{} False{} True{} False{} True{} True{} True{} False{}:
1335      {==}
1336    case False{} True{} True{} False{} True{} True{} True{} False{}:
1337      {==}
1338    case True{} True{} True{} False{} True{} True{} True{} False{}:
1339      {==}
1340    case False{} False{} False{} True{} True{} True{} True{} False{}:
1341      {==}
1342    case True{} False{} False{} True{} True{} True{} True{} False{}:
1343      {==}
1344    case False{} True{} False{} True{} True{} True{} True{} False{}:
1345      {==}
1346    case True{} True{} False{} True{} True{} True{} True{} False{}:
1347      {==}
1348    case False{} False{} True{} True{} True{} True{} True{} False{}:
1349      {==}
1350    case True{} False{} True{} True{} True{} True{} True{} False{}:
1351      {==}
1352    case False{} True{} True{} True{} True{} True{} True{} False{}:
1353      {==}
1354    case True{} True{} True{} True{} True{} True{} True{} False{}:
1355      {==}
1356    case False{} False{} False{} False{} False{} False{} False{} True{}:
1357      {==}
1358    case True{} False{} False{} False{} False{} False{} False{} True{}:
1359      {==}
1360    case False{} True{} False{} False{} False{} False{} False{} True{}:
1361      {==}
1362    case True{} True{} False{} False{} False{} False{} False{} True{}:
1363      {==}
1364    case False{} False{} True{} False{} False{} False{} False{} True{}:
1365      {==}
1366    case True{} False{} True{} False{} False{} False{} False{} True{}:
1367      {==}
1368    case False{} True{} True{} False{} False{} False{} False{} True{}:
1369      {==}
1370    case True{} True{} True{} False{} False{} False{} False{} True{}:
1371      {==}
1372    case False{} False{} False{} True{} False{} False{} False{} True{}:
1373      {==}
1374    case True{} False{} False{} True{} False{} False{} False{} True{}:
1375      {==}
1376    case False{} True{} False{} True{} False{} False{} False{} True{}:
1377      {==}
1378    case True{} True{} False{} True{} False{} False{} False{} True{}:
1379      {==}
1380    case False{} False{} True{} True{} False{} False{} False{} True{}:
1381      {==}
1382    case True{} False{} True{} True{} False{} False{} False{} True{}:
1383      {==}
1384    case False{} True{} True{} True{} False{} False{} False{} True{}:
1385      {==}
1386    case True{} True{} True{} True{} False{} False{} False{} True{}:
1387      {==}
1388    case False{} False{} False{} False{} True{} False{} False{} True{}:
1389      {==}
1390    case True{} False{} False{} False{} True{} False{} False{} True{}:
1391      {==}
1392    case False{} True{} False{} False{} True{} False{} False{} True{}:
1393      {==}
1394    case True{} True{} False{} False{} True{} False{} False{} True{}:
1395      {==}
1396    case False{} False{} True{} False{} True{} False{} False{} True{}:
1397      {==}
1398    case True{} False{} True{} False{} True{} False{} False{} True{}:
1399      {==}
1400    case False{} True{} True{} False{} True{} False{} False{} True{}:
1401      {==}
1402    case True{} True{} True{} False{} True{} False{} False{} True{}:
1403      {==}
1404    case False{} False{} False{} True{} True{} False{} False{} True{}:
1405      {==}
1406    case True{} False{} False{} True{} True{} False{} False{} True{}:
1407      {==}
1408    case False{} True{} False{} True{} True{} False{} False{} True{}:
1409      {==}
1410    case True{} True{} False{} True{} True{} False{} False{} True{}:
1411      {==}
1412    case False{} False{} True{} True{} True{} False{} False{} True{}:
1413      {==}
1414    case True{} False{} True{} True{} True{} False{} False{} True{}:
1415      {==}
1416    case False{} True{} True{} True{} True{} False{} False{} True{}:
1417      {==}
1418    case True{} True{} True{} True{} True{} False{} False{} True{}:
1419      {==}
1420    case False{} False{} False{} False{} False{} True{} False{} True{}:
1421      {==}
1422    case True{} False{} False{} False{} False{} True{} False{} True{}:
1423      {==}
1424    case False{} True{} False{} False{} False{} True{} False{} True{}:
1425      {==}
1426    case True{} True{} False{} False{} False{} True{} False{} True{}:
1427      {==}
1428    case False{} False{} True{} False{} False{} True{} False{} True{}:
1429      {==}
1430    case True{} False{} True{} False{} False{} True{} False{} True{}:
1431      {==}
1432    case False{} True{} True{} False{} False{} True{} False{} True{}:
1433      {==}
1434    case True{} True{} True{} False{} False{} True{} False{} True{}:
1435      {==}
1436    case False{} False{} False{} True{} False{} True{} False{} True{}:
1437      {==}
1438    case True{} False{} False{} True{} False{} True{} False{} True{}:
1439      {==}
1440    case False{} True{} False{} True{} False{} True{} False{} True{}:
1441      {==}
1442    case True{} True{} False{} True{} False{} True{} False{} True{}:
1443      {==}
1444    case False{} False{} True{} True{} False{} True{} False{} True{}:
1445      {==}
1446    case True{} False{} True{} True{} False{} True{} False{} True{}:
1447      {==}
1448    case False{} True{} True{} True{} False{} True{} False{} True{}:
1449      {==}
1450    case True{} True{} True{} True{} False{} True{} False{} True{}:
1451      {==}
1452    case False{} False{} False{} False{} True{} True{} False{} True{}:
1453      {==}
1454    case True{} False{} False{} False{} True{} True{} False{} True{}:
1455      {==}
1456    case False{} True{} False{} False{} True{} True{} False{} True{}:
1457      {==}
1458    case True{} True{} False{} False{} True{} True{} False{} True{}:
1459      {==}
1460    case False{} False{} True{} False{} True{} True{} False{} True{}:
1461      {==}
1462    case True{} False{} True{} False{} True{} True{} False{} True{}:
1463      {==}
1464    case False{} True{} True{} False{} True{} True{} False{} True{}:
1465      {==}
1466    case True{} True{} True{} False{} True{} True{} False{} True{}:
1467      {==}
1468    case False{} False{} False{} True{} True{} True{} False{} True{}:
1469      {==}
1470    case True{} False{} False{} True{} True{} True{} False{} True{}:
1471      {==}
1472    case False{} True{} False{} True{} True{} True{} False{} True{}:
1473      {==}
1474    case True{} True{} False{} True{} True{} True{} False{} True{}:
1475      {==}
1476    case False{} False{} True{} True{} True{} True{} False{} True{}:
1477      {==}
1478    case True{} False{} True{} True{} True{} True{} False{} True{}:
1479      {==}
1480    case False{} True{} True{} True{} True{} True{} False{} True{}:
1481      {==}
1482    case True{} True{} True{} True{} True{} True{} False{} True{}:
1483      {==}
1484    case False{} False{} False{} False{} False{} False{} True{} True{}:
1485      {==}
1486    case True{} False{} False{} False{} False{} False{} True{} True{}:
1487      {==}
1488    case False{} True{} False{} False{} False{} False{} True{} True{}:
1489      {==}
1490    case True{} True{} False{} False{} False{} False{} True{} True{}:
1491      {==}
1492    case False{} False{} True{} False{} False{} False{} True{} True{}:
1493      {==}
1494    case True{} False{} True{} False{} False{} False{} True{} True{}:
1495      {==}
1496    case False{} True{} True{} False{} False{} False{} True{} True{}:
1497      {==}
1498    case True{} True{} True{} False{} False{} False{} True{} True{}:
1499      {==}
1500    case False{} False{} False{} True{} False{} False{} True{} True{}:
1501      {==}
1502    case True{} False{} False{} True{} False{} False{} True{} True{}:
1503      {==}
1504    case False{} True{} False{} True{} False{} False{} True{} True{}:
1505      {==}
1506    case True{} True{} False{} True{} False{} False{} True{} True{}:
1507      {==}
1508    case False{} False{} True{} True{} False{} False{} True{} True{}:
1509      {==}
1510    case True{} False{} True{} True{} False{} False{} True{} True{}:
1511      {==}
1512    case False{} True{} True{} True{} False{} False{} True{} True{}:
1513      {==}
1514    case True{} True{} True{} True{} False{} False{} True{} True{}:
1515      {==}
1516    case False{} False{} False{} False{} True{} False{} True{} True{}:
1517      {==}
1518    case True{} False{} False{} False{} True{} False{} True{} True{}:
1519      {==}
1520    case False{} True{} False{} False{} True{} False{} True{} True{}:
1521      {==}
1522    case True{} True{} False{} False{} True{} False{} True{} True{}:
1523      {==}
1524    case False{} False{} True{} False{} True{} False{} True{} True{}:
1525      {==}
1526    case True{} False{} True{} False{} True{} False{} True{} True{}:
1527      {==}
1528    case False{} True{} True{} False{} True{} False{} True{} True{}:
1529      {==}
1530    case True{} True{} True{} False{} True{} False{} True{} True{}:
1531      {==}
1532    case False{} False{} False{} True{} True{} False{} True{} True{}:
1533      {==}
1534    case True{} False{} False{} True{} True{} False{} True{} True{}:
1535      {==}
1536    case False{} True{} False{} True{} True{} False{} True{} True{}:
1537      {==}
1538    case True{} True{} False{} True{} True{} False{} True{} True{}:
1539      {==}
1540    case False{} False{} True{} True{} True{} False{} True{} True{}:
1541      {==}
1542    case True{} False{} True{} True{} True{} False{} True{} True{}:
1543      {==}
1544    case False{} True{} True{} True{} True{} False{} True{} True{}:
1545      {==}
1546    case True{} True{} True{} True{} True{} False{} True{} True{}:
1547      {==}
1548    case False{} False{} False{} False{} False{} True{} True{} True{}:
1549      {==}
1550    case True{} False{} False{} False{} False{} True{} True{} True{}:
1551      {==}
1552    case False{} True{} False{} False{} False{} True{} True{} True{}:
1553      {==}
1554    case True{} True{} False{} False{} False{} True{} True{} True{}:
1555      {==}
1556    case False{} False{} True{} False{} False{} True{} True{} True{}:
1557      {==}
1558    case True{} False{} True{} False{} False{} True{} True{} True{}:
1559      {==}
1560    case False{} True{} True{} False{} False{} True{} True{} True{}:
1561      {==}
1562    case True{} True{} True{} False{} False{} True{} True{} True{}:
1563      {==}
1564    case False{} False{} False{} True{} False{} True{} True{} True{}:
1565      {==}
1566    case True{} False{} False{} True{} False{} True{} True{} True{}:
1567      {==}
1568    case False{} True{} False{} True{} False{} True{} True{} True{}:
1569      {==}
1570    case True{} True{} False{} True{} False{} True{} True{} True{}:
1571      {==}
1572    case False{} False{} True{} True{} False{} True{} True{} True{}:
1573      {==}
1574    case True{} False{} True{} True{} False{} True{} True{} True{}:
1575      {==}
1576    case False{} True{} True{} True{} False{} True{} True{} True{}:
1577      {==}
1578    case True{} True{} True{} True{} False{} True{} True{} True{}:
1579      {==}
1580    case False{} False{} False{} False{} True{} True{} True{} True{}:
1581      {==}
1582    case True{} False{} False{} False{} True{} True{} True{} True{}:
1583      {==}
1584    case False{} True{} False{} False{} True{} True{} True{} True{}:
1585      {==}
1586    case True{} True{} False{} False{} True{} True{} True{} True{}:
1587      {==}
1588    case False{} False{} True{} False{} True{} True{} True{} True{}:
1589      {==}
1590    case True{} False{} True{} False{} True{} True{} True{} True{}:
1591      {==}
1592    case False{} True{} True{} False{} True{} True{} True{} True{}:
1593      {==}
1594    case True{} True{} True{} False{} True{} True{} True{} True{}:
1595      {==}
1596    case False{} False{} False{} True{} True{} True{} True{} True{}:
1597      {==}
1598    case True{} False{} False{} True{} True{} True{} True{} True{}:
1599      {==}
1600    case False{} True{} False{} True{} True{} True{} True{} True{}:
1601      {==}
1602    case True{} True{} False{} True{} True{} True{} True{} True{}:
1603      {==}
1604    case False{} False{} True{} True{} True{} True{} True{} True{}:
1605      {==}
1606    case True{} False{} True{} True{} True{} True{} True{} True{}:
1607      {==}
1608    case False{} True{} True{} True{} True{} True{} True{} True{}:
1609      {==}
1610    case True{} True{} True{} True{} True{} True{} True{} True{}:
1611      {==}
1612
1613def ap.xtb(+x: U32) -> {SB.xtime(U32.and(255, x)) == U32.and(255, SB.xtime(U32.and(255, x))) : U32}:
1614  match x:
1615    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1616      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {SB.xtime(_) == U32.and(255, SB.xtime(_)) : U32}
1617      ap.pick(0n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1618
1619def ap.m3b(+x: U32) -> {SB.mul3(U32.and(255, x)) == U32.and(255, SB.mul3(U32.and(255, x))) : U32}:
1620  match x:
1621    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1622      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {SB.mul3(_) == U32.and(255, SB.mul3(_)) : U32}
1623      ap.pick(1n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1624
1625def ap.m9b(+x: U32) -> {X.aes.m9(U32.and(255, x)) == G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)) : U32}:
1626  match x:
1627    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1628      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {X.aes.m9(_) == G.Gf8.mul(G.Gf8.aes(), 9, _) : U32}
1629      ap.pick(2n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1630
1631def ap.m11b(+x: U32) -> {X.aes.m11(U32.and(255, x)) == G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x)) : U32}:
1632  match x:
1633    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1634      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {X.aes.m11(_) == G.Gf8.mul(G.Gf8.aes(), 11, _) : U32}
1635      ap.pick(3n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1636
1637def ap.m13b(+x: U32) -> {X.aes.m13(U32.and(255, x)) == G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)) : U32}:
1638  match x:
1639    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1640      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {X.aes.m13(_) == G.Gf8.mul(G.Gf8.aes(), 13, _) : U32}
1641      ap.pick(4n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1642
1643def ap.m14b(+x: U32) -> {X.aes.m14(U32.and(255, x)) == G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)) : U32}:
1644  match x:
1645    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1646      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {X.aes.m14(_) == G.Gf8.mul(G.Gf8.aes(), 14, _) : U32}
1647      ap.pick(5n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1648
1649def ap.col00(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, x))))) == U32.and(255, x) : U32}:
1650  match x:
1651    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1652      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(_)))) == _ : U32}
1653      ap.pick(6n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1654
1655def ap.col01(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1656  match x:
1657    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1658      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1659      ap.pick(7n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1660
1661def ap.col02(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1662  match x:
1663    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1664      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1665      ap.pick(8n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1666
1667def ap.col03(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, x))))) == 0 : U32}:
1668  match x:
1669    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1670      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(_)))) == 0 : U32}
1671      ap.pick(9n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1672
1673def ap.col10(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, x))))) == 0 : U32}:
1674  match x:
1675    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1676      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(_)))) == 0 : U32}
1677      ap.pick(10n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1678
1679def ap.col11(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, x))))) == U32.and(255, x) : U32}:
1680  match x:
1681    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1682      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(_)))) == _ : U32}
1683      ap.pick(11n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1684
1685def ap.col12(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1686  match x:
1687    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1688      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1689      ap.pick(12n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1690
1691def ap.col13(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1692  match x:
1693    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1694      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1695      ap.pick(13n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1696
1697def ap.col20(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1698  match x:
1699    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1700      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1701      ap.pick(14n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1702
1703def ap.col21(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, x))))) == 0 : U32}:
1704  match x:
1705    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1706      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(_)))) == 0 : U32}
1707      ap.pick(15n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1708
1709def ap.col22(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, x))))) == U32.and(255, x) : U32}:
1710  match x:
1711    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1712      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(_)))) == _ : U32}
1713      ap.pick(16n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1714
1715def ap.col23(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1716  match x:
1717    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1718      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1719      ap.pick(17n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1720
1721def ap.col30(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1722  match x:
1723    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1724      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1725      ap.pick(18n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1726
1727def ap.col31(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, x)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, x)))) == 0 : U32}:
1728  match x:
1729    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1730      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(_))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 9, _))) == 0 : U32}
1731      ap.pick(19n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1732
1733def ap.col32(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, x))))) == 0 : U32}:
1734  match x:
1735    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1736      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, _), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(_)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(_)))) == 0 : U32}
1737      ap.pick(20n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1738
1739def ap.col33(+x: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, x))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, x))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, x)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, x))))) == U32.and(255, x) : U32}:
1740  match x:
1741    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1742      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(_)), G.Gf8.mul(G.Gf8.aes(), 11, _)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, _), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(_)))) == _ : U32}
1743      ap.pick(21n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1744
1745def ap.fin0(+x: U32) -> {G.Gf8.add(G.Gf8.add(U32.and(255, x), 0), G.Gf8.add(0, 0)) == U32.and(255, x) : U32}:
1746  match x:
1747    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1748      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(_, 0), G.Gf8.add(0, 0)) == _ : U32}
1749      ap.pick(22n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1750
1751def ap.fin1(+x: U32) -> {G.Gf8.add(G.Gf8.add(0, U32.and(255, x)), G.Gf8.add(0, 0)) == U32.and(255, x) : U32}:
1752  match x:
1753    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1754      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(0, _), G.Gf8.add(0, 0)) == _ : U32}
1755      ap.pick(23n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1756
1757def ap.fin2(+x: U32) -> {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(U32.and(255, x), 0)) == U32.and(255, x) : U32}:
1758  match x:
1759    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1760      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(_, 0)) == _ : U32}
1761      ap.pick(24n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1762
1763def ap.fin3(+x: U32) -> {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(0, U32.and(255, x))) == U32.and(255, x) : U32}:
1764  match x:
1765    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1766      %ap.bridge(c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, c10, c11, c12, c13, c14, c15, c16, c17, c18, c19, c20, c21, c22, c23, c24, c25, c26, c27, c28, c29, c30, c31) : {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(0, _)) == _ : U32}
1767      ap.pick(25n, ap.ex2.l(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2.r(U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, Word.zero(24n)}}}}}}}}}), ap.ex2(c0, c1, c2, c3, c4, c5, c6, c7))
1768
1769def ap.bb(+x: U32) -> {U32.and(255, U32.and(255, x)) == U32.and(255, x) : U32}:
1770  match x:
1771    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1772      {==}
1773
1774def ap.xorb(+a: U32, +b: U32) -> {U32.xor(U32.and(255, a), U32.and(255, b)) == U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))) : U32}:
1775  match a b:
1776    case U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, WCon{a8, WCon{a9, WCon{a10, WCon{a11, WCon{a12, WCon{a13, WCon{a14, WCon{a15, WCon{a16, WCon{a17, WCon{a18, WCon{a19, WCon{a20, WCon{a21, WCon{a22, WCon{a23, WCon{a24, WCon{a25, WCon{a26, WCon{a27, WCon{a28, WCon{a29, WCon{a30, WCon{a31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}} U32{WCon{b0, WCon{b1, WCon{b2, WCon{b3, WCon{b4, WCon{b5, WCon{b6, WCon{b7, WCon{b8, WCon{b9, WCon{b10, WCon{b11, WCon{b12, WCon{b13, WCon{b14, WCon{b15, WCon{b16, WCon{b17, WCon{b18, WCon{b19, WCon{b20, WCon{b21, WCon{b22, WCon{b23, WCon{b24, WCon{b25, WCon{b26, WCon{b27, WCon{b28, WCon{b29, WCon{b30, WCon{b31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1777      {==}
1778
1779def ap.bylo(+x: U32) -> {B.byte(x) == U32.and(255, x) : U32}:
1780  match x:
1781    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1782      {==}
1783
1784def ap.isb(+x: U32, +y: U32, +e: {x == U32.and(255, y) : U32}) -> {x == U32.and(255, x) : U32}:
1785  %Equal.sym(U32, x, U32.and(255, y), e) : {_ == U32.and(255, _) : U32}
1786  Equal.sym(U32, U32.and(255, U32.and(255, y)), U32.and(255, y), ap.bb(y))
1787
1788def ap.gx(+k: U32, +u: U32, +v: U32) -> {G.Gf8.mul(G.Gf8.aes(), k, U32.xor(u, v)) == G.Gf8.mul(G.Gf8.aes(), k, G.Gf8.add(u, v)) : U32}:
1789  match u v:
1790    case U32{WCon{a0, WCon{a1, WCon{a2, WCon{a3, WCon{a4, WCon{a5, WCon{a6, WCon{a7, ra}}}}}}}}} U32{WCon{b0, WCon{b1, WCon{b2, WCon{b3, WCon{b4, WCon{b5, WCon{b6, WCon{b7, rb}}}}}}}}}:
1791      {==}
1792
1793def ap.mx(+k: U32, +u: U32, +v: U32) -> {G.Gf8.mul(G.Gf8.aes(), k, U32.xor(u, v)) == G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, u), G.Gf8.mul(G.Gf8.aes(), k, v)) : U32}:
1794  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), k, U32.xor(u, v)), G.Gf8.mul(G.Gf8.aes(), k, G.Gf8.add(u, v)), ap.gx(k, u, v)) : {_ == G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, u), G.Gf8.mul(G.Gf8.aes(), k, v)) : U32}
1795  GL.mul_distrib(G.Gf8.aes(), k, u, v)
1796
1797def ap.glo(+k: U32, +x: U32) -> {G.Gf8.mul(G.Gf8.aes(), k, U32.and(255, x)) == G.Gf8.mul(G.Gf8.aes(), k, x) : U32}:
1798  match x:
1799    case U32{WCon{c0, WCon{c1, WCon{c2, WCon{c3, WCon{c4, WCon{c5, WCon{c6, WCon{c7, WCon{c8, WCon{c9, WCon{c10, WCon{c11, WCon{c12, WCon{c13, WCon{c14, WCon{c15, WCon{c16, WCon{c17, WCon{c18, WCon{c19, WCon{c20, WCon{c21, WCon{c22, WCon{c23, WCon{c24, WCon{c25, WCon{c26, WCon{c27, WCon{c28, WCon{c29, WCon{c30, WCon{c31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
1800      {==}
1801
1802def ap.m9(+x: U32) -> {X.aes.m9(x) == G.Gf8.mul(G.Gf8.aes(), 9, x) : U32}:
1803  %Equal.sym(U32, U32.and(255, x), U32.and(255, U32.and(255, x)), Equal.sym(U32, U32.and(255, U32.and(255, x)), U32.and(255, x), ap.bb(x))) : {X.aes.c9(_) == G.Gf8.mul(G.Gf8.aes(), 9, x) : U32}
1804  %ap.glo(9, x) : {X.aes.c9(U32.and(255, U32.and(255, x))) == _ : U32}
1805  ap.m9b(x)
1806
1807def ap.m11(+x: U32) -> {X.aes.m11(x) == G.Gf8.mul(G.Gf8.aes(), 11, x) : U32}:
1808  %Equal.sym(U32, U32.and(255, x), U32.and(255, U32.and(255, x)), Equal.sym(U32, U32.and(255, U32.and(255, x)), U32.and(255, x), ap.bb(x))) : {X.aes.c11(_) == G.Gf8.mul(G.Gf8.aes(), 11, x) : U32}
1809  %ap.glo(11, x) : {X.aes.c11(U32.and(255, U32.and(255, x))) == _ : U32}
1810  ap.m11b(x)
1811
1812def ap.m13(+x: U32) -> {X.aes.m13(x) == G.Gf8.mul(G.Gf8.aes(), 13, x) : U32}:
1813  %Equal.sym(U32, U32.and(255, x), U32.and(255, U32.and(255, x)), Equal.sym(U32, U32.and(255, U32.and(255, x)), U32.and(255, x), ap.bb(x))) : {X.aes.c13(_) == G.Gf8.mul(G.Gf8.aes(), 13, x) : U32}
1814  %ap.glo(13, x) : {X.aes.c13(U32.and(255, U32.and(255, x))) == _ : U32}
1815  ap.m13b(x)
1816
1817def ap.m14(+x: U32) -> {X.aes.m14(x) == G.Gf8.mul(G.Gf8.aes(), 14, x) : U32}:
1818  %Equal.sym(U32, U32.and(255, x), U32.and(255, U32.and(255, x)), Equal.sym(U32, U32.and(255, U32.and(255, x)), U32.and(255, x), ap.bb(x))) : {X.aes.c14(_) == G.Gf8.mul(G.Gf8.aes(), 14, x) : U32}
1819  %ap.glo(14, x) : {X.aes.c14(U32.and(255, U32.and(255, x))) == _ : U32}
1820  ap.m14b(x)
1821
1822def ap.xg0(m1: G.Gf8Bits, m2: G.Gf8Bits) -> {U32.xor(G.Gf8Bits.to(m1), G.Gf8Bits.to(m2)) == G.Gf8.add(G.Gf8Bits.to(m1), G.Gf8Bits.to(m2)) : U32}:
1823  match m1 m2:
1824    case G.Gf8Bits{a0, a1, a2, a3, a4, a5, a6, a7} G.Gf8Bits{b0, b1, b2, b3, b4, b5, b6, b7}:
1825      {==}
1826
1827def ap.xg(+k1: U32, +k2: U32, +u: U32, +v: U32) -> {U32.xor(G.Gf8.mul(G.Gf8.aes(), k1, u), G.Gf8.mul(G.Gf8.aes(), k2, v)) == G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k1, u), G.Gf8.mul(G.Gf8.aes(), k2, v)) : U32}:
1828  ap.xg0(G.Gf8Bits.mul(G.Gf8Bits.of(k1), G.Gf8Bits.of(u), G.Gf8Bits.of(283)), G.Gf8Bits.mul(G.Gf8Bits.of(k2), G.Gf8Bits.of(v), G.Gf8Bits.of(283)))
1829
1830def ap.imixg(+p: U32, +q: U32, +r: U32, +s: U32) -> {X.aes.imix0(p, q, r, s) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) : U32}:
1831  %Equal.sym(U32, X.aes.m14(p), G.Gf8.mul(G.Gf8.aes(), 14, p), ap.m14(p)) : {U32.xor(U32.xor(_, X.aes.m11(q)), U32.xor(X.aes.m13(r), X.aes.m9(s))) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) : U32}
1832  %Equal.sym(U32, X.aes.m11(q), G.Gf8.mul(G.Gf8.aes(), 11, q), ap.m11(q)) : {U32.xor(U32.xor(G.Gf8.mul(G.Gf8.aes(), 14, p), _), U32.xor(X.aes.m13(r), X.aes.m9(s))) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) : U32}
1833  %Equal.sym(U32, X.aes.m13(r), G.Gf8.mul(G.Gf8.aes(), 13, r), ap.m13(r)) : {U32.xor(U32.xor(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), U32.xor(_, X.aes.m9(s))) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) : U32}
1834  %Equal.sym(U32, X.aes.m9(s), G.Gf8.mul(G.Gf8.aes(), 9, s), ap.m9(s)) : {U32.xor(U32.xor(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), U32.xor(G.Gf8.mul(G.Gf8.aes(), 13, r), _)) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) : U32}
1835  %Equal.sym(U32, U32.xor(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), ap.xg(14, 11, p, q)) : {U32.xor(_, U32.xor(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) : U32}
1836  %Equal.sym(U32, U32.xor(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s)), ap.xg(13, 9, r, s)) : {U32.xor(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), _) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, p), G.Gf8.mul(G.Gf8.aes(), 11, q)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, r), G.Gf8.mul(G.Gf8.aes(), 9, s))) : U32}
1837  ap.xg0(G.Gf8Bits.xor(G.Gf8Bits.of(G.Gf8.mul(G.Gf8.aes(), 14, p)), G.Gf8Bits.of(G.Gf8.mul(G.Gf8.aes(), 11, q))), G.Gf8Bits.xor(G.Gf8Bits.of(G.Gf8.mul(G.Gf8.aes(), 13, r)), G.Gf8Bits.of(G.Gf8.mul(G.Gf8.aes(), 9, s))))
1838
1839# MixColumns undone, a column at a time
1840
1841def ap.swap4(+a: U32, +b: U32, +c: U32, +d: U32) -> {G.Gf8.add(G.Gf8.add(a, b), G.Gf8.add(c, d)) == G.Gf8.add(G.Gf8.add(a, c), G.Gf8.add(b, d)) : U32}:
1842  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(a, b), G.Gf8.add(c, d)), G.Gf8.add(a, G.Gf8.add(b, G.Gf8.add(c, d))), GL.add_assoc(a, b, G.Gf8.add(c, d))) : {_ == G.Gf8.add(G.Gf8.add(a, c), G.Gf8.add(b, d)) : U32}
1843  %GL.add_assoc(b, c, d) : {G.Gf8.add(a, _) == G.Gf8.add(G.Gf8.add(a, c), G.Gf8.add(b, d)) : U32}
1844  %Equal.sym(U32, G.Gf8.add(b, c), G.Gf8.add(c, b), GL.add_comm(b, c)) : {G.Gf8.add(a, G.Gf8.add(_, d)) == G.Gf8.add(G.Gf8.add(a, c), G.Gf8.add(b, d)) : U32}
1845  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(c, b), d), G.Gf8.add(c, G.Gf8.add(b, d)), GL.add_assoc(c, b, d)) : {G.Gf8.add(a, _) == G.Gf8.add(G.Gf8.add(a, c), G.Gf8.add(b, d)) : U32}
1846  %GL.add_assoc(a, c, G.Gf8.add(b, d)) : {_ == G.Gf8.add(G.Gf8.add(a, c), G.Gf8.add(b, d)) : U32}
1847  {==}
1848
1849def ap.trans(+t00: U32, +t01: U32, +t02: U32, +t03: U32, +t10: U32, +t11: U32, +t12: U32, +t13: U32, +t20: U32, +t21: U32, +t22: U32, +t23: U32, +t30: U32, +t31: U32, +t32: U32, +t33: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t02, t03)), G.Gf8.add(G.Gf8.add(t10, t11), G.Gf8.add(t12, t13))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t22, t23)), G.Gf8.add(G.Gf8.add(t30, t31), G.Gf8.add(t32, t33)))) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}:
1850  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t02, t03)), G.Gf8.add(G.Gf8.add(t10, t11), G.Gf8.add(t12, t13))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t10, t11)), G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13))), ap.swap4(G.Gf8.add(t00, t01), G.Gf8.add(t02, t03), G.Gf8.add(t10, t11), G.Gf8.add(t12, t13))) : {G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t22, t23)), G.Gf8.add(G.Gf8.add(t30, t31), G.Gf8.add(t32, t33)))) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1851  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t22, t23)), G.Gf8.add(G.Gf8.add(t30, t31), G.Gf8.add(t32, t33))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t30, t31)), G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33))), ap.swap4(G.Gf8.add(t20, t21), G.Gf8.add(t22, t23), G.Gf8.add(t30, t31), G.Gf8.add(t32, t33))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t10, t11)), G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13))), _) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1852  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t10, t11)), G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t30, t31)), G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t10, t11)), G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t30, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13)), G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)))), ap.swap4(G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t10, t11)), G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13)), G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t30, t31)), G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)))) : {_ == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1853  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(t00, t01), G.Gf8.add(t10, t11)), G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t01, t11)), ap.swap4(t00, t01, t10, t11)) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t30, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13)), G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)))) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1854  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(t20, t21), G.Gf8.add(t30, t31)), G.Gf8.add(G.Gf8.add(t20, t30), G.Gf8.add(t21, t31)), ap.swap4(t20, t21, t30, t31)) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t01, t11)), _), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13)), G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)))) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1855  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t01, t11)), G.Gf8.add(G.Gf8.add(t20, t30), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), ap.swap4(G.Gf8.add(t00, t10), G.Gf8.add(t01, t11), G.Gf8.add(t20, t30), G.Gf8.add(t21, t31))) : {G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13)), G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)))) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1856  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(t02, t03), G.Gf8.add(t12, t13)), G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t03, t13)), ap.swap4(t02, t03, t12, t13)) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(_, G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)))) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1857  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(t22, t23), G.Gf8.add(t32, t33)), G.Gf8.add(G.Gf8.add(t22, t32), G.Gf8.add(t23, t33)), ap.swap4(t22, t23, t32, t33)) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t03, t13)), _)) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1858  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t03, t13)), G.Gf8.add(G.Gf8.add(t22, t32), G.Gf8.add(t23, t33))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33))), ap.swap4(G.Gf8.add(t02, t12), G.Gf8.add(t03, t13), G.Gf8.add(t22, t32), G.Gf8.add(t23, t33))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), _) == G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(t00, t10), G.Gf8.add(t20, t30)), G.Gf8.add(G.Gf8.add(t01, t11), G.Gf8.add(t21, t31))), G.Gf8.add(G.Gf8.add(G.Gf8.add(t02, t12), G.Gf8.add(t22, t32)), G.Gf8.add(G.Gf8.add(t03, t13), G.Gf8.add(t23, t33)))) : U32}
1859  {==}
1860
1861def ap.row(+k: U32, +x1: U32, +x2: U32, +x3: U32, +x4: U32) -> {G.Gf8.mul(G.Gf8.aes(), k, U32.xor(U32.xor(U32.xor(x1, x2), x3), x4)) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x1), G.Gf8.mul(G.Gf8.aes(), k, x2)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x3), G.Gf8.mul(G.Gf8.aes(), k, x4))) : U32}:
1862  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), k, U32.xor(U32.xor(U32.xor(x1, x2), x3), x4)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, U32.xor(U32.xor(x1, x2), x3)), G.Gf8.mul(G.Gf8.aes(), k, x4)), ap.mx(k, U32.xor(U32.xor(x1, x2), x3), x4)) : {_ == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x1), G.Gf8.mul(G.Gf8.aes(), k, x2)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x3), G.Gf8.mul(G.Gf8.aes(), k, x4))) : U32}
1863  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), k, U32.xor(U32.xor(x1, x2), x3)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, U32.xor(x1, x2)), G.Gf8.mul(G.Gf8.aes(), k, x3)), ap.mx(k, U32.xor(x1, x2), x3)) : {G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), k, x4)) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x1), G.Gf8.mul(G.Gf8.aes(), k, x2)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x3), G.Gf8.mul(G.Gf8.aes(), k, x4))) : U32}
1864  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), k, U32.xor(x1, x2)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x1), G.Gf8.mul(G.Gf8.aes(), k, x2)), ap.mx(k, x1, x2)) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), k, x3)), G.Gf8.mul(G.Gf8.aes(), k, x4)) == G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x1), G.Gf8.mul(G.Gf8.aes(), k, x2)), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x3), G.Gf8.mul(G.Gf8.aes(), k, x4))) : U32}
1865  GL.add_assoc(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), k, x1), G.Gf8.mul(G.Gf8.aes(), k, x2)), G.Gf8.mul(G.Gf8.aes(), k, x3), G.Gf8.mul(G.Gf8.aes(), k, x4))
1866
1867def ap.out0(+a: U32, +b: U32, +c: U32, +d: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))))) == U32.and(255, a) : U32}:
1868  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), ap.row(14, SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b)), U32.and(255, c), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))))) == U32.and(255, a) : U32}
1869  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d)))), ap.row(11, U32.and(255, a), SB.xtime(U32.and(255, b)), SB.mul3(U32.and(255, c)), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), _), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))))) == U32.and(255, a) : U32}
1870  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))))), ap.row(13, U32.and(255, a), U32.and(255, b), SB.xtime(U32.and(255, c)), SB.mul3(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))))), G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))))) == U32.and(255, a) : U32}
1871  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))), ap.row(9, SB.mul3(U32.and(255, a)), U32.and(255, b), U32.and(255, c), SB.xtime(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))))), _)) == U32.and(255, a) : U32}
1872  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, a))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))))), ap.trans(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))) : {_ == U32.and(255, a) : U32}
1873  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, a))))), U32.and(255, a), ap.col00(a)) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))))) == U32.and(255, a) : U32}
1874  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b)))), 0, ap.col01(b)) : {G.Gf8.add(G.Gf8.add(U32.and(255, a), _), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))))) == U32.and(255, a) : U32}
1875  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), 0, ap.col02(c)) : {G.Gf8.add(G.Gf8.add(U32.and(255, a), 0), G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))))) == U32.and(255, a) : U32}
1876  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, d))))), 0, ap.col03(d)) : {G.Gf8.add(G.Gf8.add(U32.and(255, a), 0), G.Gf8.add(0, _)) == U32.and(255, a) : U32}
1877  ap.fin0(a)
1878
1879def ap.out1(+a: U32, +b: U32, +c: U32, +d: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))))) == U32.and(255, b) : U32}:
1880  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), ap.row(14, U32.and(255, a), SB.xtime(U32.and(255, b)), SB.mul3(U32.and(255, c)), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))))) == U32.and(255, b) : U32}
1881  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d))))), ap.row(11, U32.and(255, a), U32.and(255, b), SB.xtime(U32.and(255, c)), SB.mul3(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), _), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))))) == U32.and(255, b) : U32}
1882  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))))), ap.row(13, SB.mul3(U32.and(255, a)), U32.and(255, b), U32.and(255, c), SB.xtime(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))))), G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))))) == U32.and(255, b) : U32}
1883  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))), ap.row(9, SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b)), U32.and(255, c), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))))), _)) == U32.and(255, b) : U32}
1884  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, a))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, b)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))), ap.trans(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))) : {_ == U32.and(255, b) : U32}
1885  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, a))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, a))))), 0, ap.col10(a)) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, b)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))) == U32.and(255, b) : U32}
1886  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, b))))), U32.and(255, b), ap.col11(b)) : {G.Gf8.add(G.Gf8.add(0, _), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))) == U32.and(255, b) : U32}
1887  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, c)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, c)))), 0, ap.col12(c)) : {G.Gf8.add(G.Gf8.add(0, U32.and(255, b)), G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))) == U32.and(255, b) : U32}
1888  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))), 0, ap.col13(d)) : {G.Gf8.add(G.Gf8.add(0, U32.and(255, b)), G.Gf8.add(0, _)) == U32.and(255, b) : U32}
1889  ap.fin1(b)
1890
1891def ap.out2(+a: U32, +b: U32, +c: U32, +d: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))))) == U32.and(255, c) : U32}:
1892  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))))), ap.row(14, U32.and(255, a), U32.and(255, b), SB.xtime(U32.and(255, c)), SB.mul3(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))))) == U32.and(255, c) : U32}
1893  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d))))), ap.row(11, SB.mul3(U32.and(255, a)), U32.and(255, b), U32.and(255, c), SB.xtime(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))))), _), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))))) == U32.and(255, c) : U32}
1894  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)))), ap.row(13, SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b)), U32.and(255, c), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))))), G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))))) == U32.and(255, c) : U32}
1895  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))), ap.row(9, U32.and(255, a), SB.xtime(U32.and(255, b)), SB.mul3(U32.and(255, c)), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)))), _)) == U32.and(255, c) : U32}
1896  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, a)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, b)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, c))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))), ap.trans(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))) : {_ == U32.and(255, c) : U32}
1897  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, a)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)))), 0, ap.col20(a)) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, b)))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, c))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))) == U32.and(255, c) : U32}
1898  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, b))))), 0, ap.col21(b)) : {G.Gf8.add(G.Gf8.add(0, _), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, c))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))) == U32.and(255, c) : U32}
1899  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, c))))), U32.and(255, c), ap.col22(c)) : {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))))) == U32.and(255, c) : U32}
1900  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, d)))), 0, ap.col23(d)) : {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(U32.and(255, c), _)) == U32.and(255, c) : U32}
1901  ap.fin2(c)
1902
1903def ap.out3(+a: U32, +b: U32, +c: U32, +d: U32) -> {G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))))) == U32.and(255, d) : U32}:
1904  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))))), ap.row(14, SB.mul3(U32.and(255, a)), U32.and(255, b), U32.and(255, c), SB.xtime(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))))) == U32.and(255, d) : U32}
1905  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d)))), ap.row(11, SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b)), U32.and(255, c), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))))), _), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))))) == U32.and(255, d) : U32}
1906  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)))), ap.row(13, U32.and(255, a), SB.xtime(U32.and(255, b)), SB.mul3(U32.and(255, c)), U32.and(255, d))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))))), G.Gf8.add(_, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))))) == U32.and(255, d) : U32}
1907  %Equal.sym(U32, G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))), ap.row(9, U32.and(255, a), U32.and(255, b), SB.xtime(U32.and(255, c)), SB.mul3(U32.and(255, d)))) : {G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)))), _)) == U32.and(255, d) : U32}
1908  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, a)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, c))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))))), ap.trans(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))) : {_ == U32.and(255, d) : U32}
1909  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.mul3(U32.and(255, a))), G.Gf8.mul(G.Gf8.aes(), 11, SB.xtime(U32.and(255, a)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, a)), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, a)))), 0, ap.col30(a)) : {G.Gf8.add(G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b))))), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, c))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))))) == U32.and(255, d) : U32}
1910  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, b)), G.Gf8.mul(G.Gf8.aes(), 11, SB.mul3(U32.and(255, b)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.xtime(U32.and(255, b))), G.Gf8.mul(G.Gf8.aes(), 9, U32.and(255, b)))), 0, ap.col31(b)) : {G.Gf8.add(G.Gf8.add(0, _), G.Gf8.add(G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, c))))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))))) == U32.and(255, d) : U32}
1911  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.and(255, c)), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, c))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, SB.mul3(U32.and(255, c))), G.Gf8.mul(G.Gf8.aes(), 9, SB.xtime(U32.and(255, c))))), 0, ap.col32(c)) : {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(_, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))))) == U32.and(255, d) : U32}
1912  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, SB.xtime(U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.and(255, d))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.and(255, d)), G.Gf8.mul(G.Gf8.aes(), 9, SB.mul3(U32.and(255, d))))), U32.and(255, d), ap.col33(d)) : {G.Gf8.add(G.Gf8.add(0, 0), G.Gf8.add(0, _)) == U32.and(255, d) : U32}
1913  ap.fin3(d)
1914
1915def ap.mixc(+a: U32, +b: U32, +c: U32, +d: U32) -> {X.aes.imix_w(A.mix_column(TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)})) == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}:
1916  %Equal.sym(U32, X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))))), ap.imixg(U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))))) : {TT.W{_, X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1917  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))))), U32.and(255, a), ap.out0(a, b, c, d)) : {TT.W{_, X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1918  %Equal.sym(U32, X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))))), ap.imixg(U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)))) : {TT.W{U32.and(255, a), _, X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1919  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))))), U32.and(255, b), ap.out1(a, b, c, d)) : {TT.W{U32.and(255, a), _, X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1920  %Equal.sym(U32, X.aes.imix0(U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))))), ap.imixg(U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)))) : {TT.W{U32.and(255, a), U32.and(255, b), _, X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1921  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))))), U32.and(255, c), ap.out2(a, b, c, d)) : {TT.W{U32.and(255, a), U32.and(255, b), _, X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1922  %Equal.sym(U32, X.aes.imix0(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))))), ap.imixg(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))))) : {TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), _} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1923  %Equal.sym(U32, G.Gf8.add(G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 14, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), G.Gf8.mul(G.Gf8.aes(), 11, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)))), G.Gf8.add(G.Gf8.mul(G.Gf8.aes(), 13, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), G.Gf8.mul(G.Gf8.aes(), 9, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))))), U32.and(255, d), ap.out3(a, b, c, d)) : {TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), _} == TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)} : TT.Quad}
1924  {==}
1925
1926def ap.rowb0(+a: U32, +b: U32, +c: U32, +d: U32) -> {U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d))) : U32}:
1927  %Equal.sym(U32, SB.xtime(U32.and(255, a)), U32.and(255, SB.xtime(U32.and(255, a))), ap.xtb(a)) : {U32.xor(U32.xor(U32.xor(_, SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d))) : U32}
1928  %Equal.sym(U32, SB.mul3(U32.and(255, b)), U32.and(255, SB.mul3(U32.and(255, b))), ap.m3b(b)) : {U32.xor(U32.xor(U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), _), U32.and(255, c)), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d))) : U32}
1929  %Equal.sym(U32, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b)))), U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), ap.xorb(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b)))) : {U32.xor(U32.xor(_, U32.and(255, c)), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d))) : U32}
1930  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c)), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), ap.xorb(U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b)))), c)) : {U32.xor(_, U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d))) : U32}
1931  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d)), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d))), ap.xorb(U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c)), d)) : {_ == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d))) : U32}
1932  {==}
1933
1934def ap.rowb1(+a: U32, +b: U32, +c: U32, +d: U32) -> {U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d))) : U32}:
1935  %Equal.sym(U32, SB.xtime(U32.and(255, b)), U32.and(255, SB.xtime(U32.and(255, b))), ap.xtb(b)) : {U32.xor(U32.xor(U32.xor(U32.and(255, a), _), SB.mul3(U32.and(255, c))), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d))) : U32}
1936  %Equal.sym(U32, SB.mul3(U32.and(255, c)), U32.and(255, SB.mul3(U32.and(255, c))), ap.m3b(c)) : {U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b)))), _), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d))) : U32}
1937  %Equal.sym(U32, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b)))), U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), ap.xorb(a, SB.xtime(U32.and(255, b)))) : {U32.xor(U32.xor(_, U32.and(255, SB.mul3(U32.and(255, c)))), U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d))) : U32}
1938  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c)))), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), ap.xorb(U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b)))), SB.mul3(U32.and(255, c)))) : {U32.xor(_, U32.and(255, d)) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d))) : U32}
1939  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d)), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d))), ap.xorb(U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c)))), d)) : {_ == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d))) : U32}
1940  {==}
1941
1942def ap.rowb2(+a: U32, +b: U32, +c: U32, +d: U32) -> {U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d))))) : U32}:
1943  %Equal.sym(U32, SB.xtime(U32.and(255, c)), U32.and(255, SB.xtime(U32.and(255, c))), ap.xtb(c)) : {U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), _), SB.mul3(U32.and(255, d))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d))))) : U32}
1944  %Equal.sym(U32, SB.mul3(U32.and(255, d)), U32.and(255, SB.mul3(U32.and(255, d))), ap.m3b(d)) : {U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), U32.and(255, SB.xtime(U32.and(255, c)))), _) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d))))) : U32}
1945  %Equal.sym(U32, U32.xor(U32.and(255, a), U32.and(255, b)), U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), ap.xorb(a, b)) : {U32.xor(U32.xor(_, U32.and(255, SB.xtime(U32.and(255, c)))), U32.and(255, SB.mul3(U32.and(255, d)))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d))))) : U32}
1946  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c)))), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), ap.xorb(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c)))) : {U32.xor(_, U32.and(255, SB.mul3(U32.and(255, d)))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d))))) : U32}
1947  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d)))), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d))))), ap.xorb(U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c)))), SB.mul3(U32.and(255, d)))) : {_ == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d))))) : U32}
1948  {==}
1949
1950def ap.rowb3(+a: U32, +b: U32, +c: U32, +d: U32) -> {U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d))))) : U32}:
1951  %Equal.sym(U32, SB.mul3(U32.and(255, a)), U32.and(255, SB.mul3(U32.and(255, a))), ap.m3b(a)) : {U32.xor(U32.xor(U32.xor(_, U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d))))) : U32}
1952  %Equal.sym(U32, SB.xtime(U32.and(255, d)), U32.and(255, SB.xtime(U32.and(255, d))), ap.xtb(d)) : {U32.xor(U32.xor(U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b)), U32.and(255, c)), _) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d))))) : U32}
1953  %Equal.sym(U32, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b)), U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), ap.xorb(SB.mul3(U32.and(255, a)), b)) : {U32.xor(U32.xor(_, U32.and(255, c)), U32.and(255, SB.xtime(U32.and(255, d)))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d))))) : U32}
1954  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c)), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), ap.xorb(U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b)), c)) : {U32.xor(_, U32.and(255, SB.xtime(U32.and(255, d)))) == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d))))) : U32}
1955  %Equal.sym(U32, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d)))), U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d))))), ap.xorb(U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c)), SB.xtime(U32.and(255, d)))) : {_ == U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d))))) : U32}
1956  {==}
1957
1958def ap.mixcb(+a: U32, +b: U32, +c: U32, +d: U32) -> {A.mix_column(TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)}) == X.aes.mask_w(A.mix_column(TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)})) : TT.Quad}:
1959  %Equal.sym(U32, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.and(255, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), ap.isb(U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d)), U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.xtime(U32.and(255, a))), U32.and(255, SB.mul3(U32.and(255, b))))), U32.and(255, c))), U32.and(255, d)), ap.rowb0(a, b, c, d))) : {TT.W{_, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))} == X.aes.mask_w(A.mix_column(TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)})) : TT.Quad}
1960  %Equal.sym(U32, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.and(255, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), ap.isb(U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d)), U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, SB.xtime(U32.and(255, b))))), U32.and(255, SB.mul3(U32.and(255, c))))), U32.and(255, d)), ap.rowb1(a, b, c, d))) : {TT.W{U32.and(255, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), _, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))} == X.aes.mask_w(A.mix_column(TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)})) : TT.Quad}
1961  %Equal.sym(U32, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.and(255, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), ap.isb(U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d))), U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, a), U32.and(255, b))), U32.and(255, SB.xtime(U32.and(255, c))))), U32.and(255, SB.mul3(U32.and(255, d)))), ap.rowb2(a, b, c, d))) : {TT.W{U32.and(255, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), U32.and(255, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), _, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))} == X.aes.mask_w(A.mix_column(TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)})) : TT.Quad}
1962  %Equal.sym(U32, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.and(255, U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d)))), ap.isb(U32.xor(U32.xor(U32.xor(SB.mul3(U32.and(255, a)), U32.and(255, b)), U32.and(255, c)), SB.xtime(U32.and(255, d))), U32.xor(U32.and(255, U32.xor(U32.and(255, U32.xor(U32.and(255, SB.mul3(U32.and(255, a))), U32.and(255, b))), U32.and(255, c))), U32.and(255, SB.xtime(U32.and(255, d)))), ap.rowb3(a, b, c, d))) : {TT.W{U32.and(255, U32.xor(U32.xor(U32.xor(SB.xtime(U32.and(255, a)), SB.mul3(U32.and(255, b))), U32.and(255, c)), U32.and(255, d))), U32.and(255, U32.xor(U32.xor(U32.xor(U32.and(255, a), SB.xtime(U32.and(255, b))), SB.mul3(U32.and(255, c))), U32.and(255, d))), U32.and(255, U32.xor(U32.xor(U32.xor(U32.and(255, a), U32.and(255, b)), SB.xtime(U32.and(255, c))), SB.mul3(U32.and(255, d)))), _} == X.aes.mask_w(A.mix_column(TT.W{U32.and(255, a), U32.and(255, b), U32.and(255, c), U32.and(255, d)})) : TT.Quad}
1963  {==}
1964
1965# States: each step of a round undone, or made of bytes again
1966
1967def ap.ark2(+m: TT.State, +k: TT.State) -> {A.add_round_key(A.add_round_key(m, k), k) == m : TT.State}:
1968  match m k:
1969    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}:
1970      %Equal.sym(U32, U32.xor(U32.xor(z0, k0), k0), z0, bx.ru32(z0, k0)) : {TT.S{TT.W{_, U32.xor(U32.xor(z1, k1), k1), U32.xor(U32.xor(z2, k2), k2), U32.xor(U32.xor(z3, k3), k3)}, TT.W{U32.xor(U32.xor(z4, k4), k4), U32.xor(U32.xor(z5, k5), k5), U32.xor(U32.xor(z6, k6), k6), U32.xor(U32.xor(z7, k7), k7)}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1971      %Equal.sym(U32, U32.xor(U32.xor(z1, k1), k1), z1, bx.ru32(z1, k1)) : {TT.S{TT.W{z0, _, U32.xor(U32.xor(z2, k2), k2), U32.xor(U32.xor(z3, k3), k3)}, TT.W{U32.xor(U32.xor(z4, k4), k4), U32.xor(U32.xor(z5, k5), k5), U32.xor(U32.xor(z6, k6), k6), U32.xor(U32.xor(z7, k7), k7)}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1972      %Equal.sym(U32, U32.xor(U32.xor(z2, k2), k2), z2, bx.ru32(z2, k2)) : {TT.S{TT.W{z0, z1, _, U32.xor(U32.xor(z3, k3), k3)}, TT.W{U32.xor(U32.xor(z4, k4), k4), U32.xor(U32.xor(z5, k5), k5), U32.xor(U32.xor(z6, k6), k6), U32.xor(U32.xor(z7, k7), k7)}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1973      %Equal.sym(U32, U32.xor(U32.xor(z3, k3), k3), z3, bx.ru32(z3, k3)) : {TT.S{TT.W{z0, z1, z2, _}, TT.W{U32.xor(U32.xor(z4, k4), k4), U32.xor(U32.xor(z5, k5), k5), U32.xor(U32.xor(z6, k6), k6), U32.xor(U32.xor(z7, k7), k7)}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1974      %Equal.sym(U32, U32.xor(U32.xor(z4, k4), k4), z4, bx.ru32(z4, k4)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{_, U32.xor(U32.xor(z5, k5), k5), U32.xor(U32.xor(z6, k6), k6), U32.xor(U32.xor(z7, k7), k7)}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1975      %Equal.sym(U32, U32.xor(U32.xor(z5, k5), k5), z5, bx.ru32(z5, k5)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, _, U32.xor(U32.xor(z6, k6), k6), U32.xor(U32.xor(z7, k7), k7)}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1976      %Equal.sym(U32, U32.xor(U32.xor(z6, k6), k6), z6, bx.ru32(z6, k6)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, _, U32.xor(U32.xor(z7, k7), k7)}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1977      %Equal.sym(U32, U32.xor(U32.xor(z7, k7), k7), z7, bx.ru32(z7, k7)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, _}, TT.W{U32.xor(U32.xor(z8, k8), k8), U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1978      %Equal.sym(U32, U32.xor(U32.xor(z8, k8), k8), z8, bx.ru32(z8, k8)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{_, U32.xor(U32.xor(z9, k9), k9), U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1979      %Equal.sym(U32, U32.xor(U32.xor(z9, k9), k9), z9, bx.ru32(z9, k9)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, _, U32.xor(U32.xor(z10, k10), k10), U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1980      %Equal.sym(U32, U32.xor(U32.xor(z10, k10), k10), z10, bx.ru32(z10, k10)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, _, U32.xor(U32.xor(z11, k11), k11)}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1981      %Equal.sym(U32, U32.xor(U32.xor(z11, k11), k11), z11, bx.ru32(z11, k11)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, _}, TT.W{U32.xor(U32.xor(z12, k12), k12), U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1982      %Equal.sym(U32, U32.xor(U32.xor(z12, k12), k12), z12, bx.ru32(z12, k12)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{_, U32.xor(U32.xor(z13, k13), k13), U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1983      %Equal.sym(U32, U32.xor(U32.xor(z13, k13), k13), z13, bx.ru32(z13, k13)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, _, U32.xor(U32.xor(z14, k14), k14), U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1984      %Equal.sym(U32, U32.xor(U32.xor(z14, k14), k14), z14, bx.ru32(z14, k14)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, _, U32.xor(U32.xor(z15, k15), k15)}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1985      %Equal.sym(U32, U32.xor(U32.xor(z15, k15), k15), z15, bx.ru32(z15, k15)) : {TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, _}} == TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} : TT.State}
1986      {==}
1987
1988def ap.shift(+s: TT.State) -> {X.aes.inv_shift(A.shift_rows(s)) == s : TT.State}:
1989  match s:
1990    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}:
1991      {==}
1992
1993def ap.shm(+s: TT.State) -> {A.shift_rows(X.aes.mask(s)) == X.aes.mask(A.shift_rows(s)) : TT.State}:
1994  match s:
1995    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}:
1996      {==}
1997
1998def ap.mm(+s: TT.State) -> {X.aes.mask(X.aes.mask(s)) == X.aes.mask(s) : TT.State}:
1999  match s:
2000    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}:
2001      %Equal.sym(U32, U32.and(255, U32.and(255, z0)), U32.and(255, z0), ap.bb(z0)) : {TT.S{TT.W{_, U32.and(255, U32.and(255, z1)), U32.and(255, U32.and(255, z2)), U32.and(255, U32.and(255, z3))}, TT.W{U32.and(255, U32.and(255, z4)), U32.and(255, U32.and(255, z5)), U32.and(255, U32.and(255, z6)), U32.and(255, U32.and(255, z7))}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2002      %Equal.sym(U32, U32.and(255, U32.and(255, z1)), U32.and(255, z1), ap.bb(z1)) : {TT.S{TT.W{U32.and(255, z0), _, U32.and(255, U32.and(255, z2)), U32.and(255, U32.and(255, z3))}, TT.W{U32.and(255, U32.and(255, z4)), U32.and(255, U32.and(255, z5)), U32.and(255, U32.and(255, z6)), U32.and(255, U32.and(255, z7))}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2003      %Equal.sym(U32, U32.and(255, U32.and(255, z2)), U32.and(255, z2), ap.bb(z2)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), _, U32.and(255, U32.and(255, z3))}, TT.W{U32.and(255, U32.and(255, z4)), U32.and(255, U32.and(255, z5)), U32.and(255, U32.and(255, z6)), U32.and(255, U32.and(255, z7))}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2004      %Equal.sym(U32, U32.and(255, U32.and(255, z3)), U32.and(255, z3), ap.bb(z3)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), _}, TT.W{U32.and(255, U32.and(255, z4)), U32.and(255, U32.and(255, z5)), U32.and(255, U32.and(255, z6)), U32.and(255, U32.and(255, z7))}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2005      %Equal.sym(U32, U32.and(255, U32.and(255, z4)), U32.and(255, z4), ap.bb(z4)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{_, U32.and(255, U32.and(255, z5)), U32.and(255, U32.and(255, z6)), U32.and(255, U32.and(255, z7))}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2006      %Equal.sym(U32, U32.and(255, U32.and(255, z5)), U32.and(255, z5), ap.bb(z5)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), _, U32.and(255, U32.and(255, z6)), U32.and(255, U32.and(255, z7))}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2007      %Equal.sym(U32, U32.and(255, U32.and(255, z6)), U32.and(255, z6), ap.bb(z6)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), _, U32.and(255, U32.and(255, z7))}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2008      %Equal.sym(U32, U32.and(255, U32.and(255, z7)), U32.and(255, z7), ap.bb(z7)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), _}, TT.W{U32.and(255, U32.and(255, z8)), U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2009      %Equal.sym(U32, U32.and(255, U32.and(255, z8)), U32.and(255, z8), ap.bb(z8)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{_, U32.and(255, U32.and(255, z9)), U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2010      %Equal.sym(U32, U32.and(255, U32.and(255, z9)), U32.and(255, z9), ap.bb(z9)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), _, U32.and(255, U32.and(255, z10)), U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2011      %Equal.sym(U32, U32.and(255, U32.and(255, z10)), U32.and(255, z10), ap.bb(z10)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), _, U32.and(255, U32.and(255, z11))}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2012      %Equal.sym(U32, U32.and(255, U32.and(255, z11)), U32.and(255, z11), ap.bb(z11)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), _}, TT.W{U32.and(255, U32.and(255, z12)), U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2013      %Equal.sym(U32, U32.and(255, U32.and(255, z12)), U32.and(255, z12), ap.bb(z12)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{_, U32.and(255, U32.and(255, z13)), U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2014      %Equal.sym(U32, U32.and(255, U32.and(255, z13)), U32.and(255, z13), ap.bb(z13)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{U32.and(255, z12), _, U32.and(255, U32.and(255, z14)), U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2015      %Equal.sym(U32, U32.and(255, U32.and(255, z14)), U32.and(255, z14), ap.bb(z14)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{U32.and(255, z12), U32.and(255, z13), _, U32.and(255, U32.and(255, z15))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2016      %Equal.sym(U32, U32.and(255, U32.and(255, z15)), U32.and(255, z15), ap.bb(z15)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), _}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2017      {==}
2018
2019def ap.subl(+s: TT.State) -> {A.sub_bytes(X.aes.mask(s)) == X.aes.mask(A.sub_bytes(X.aes.mask(s))) : TT.State}:
2020  match s:
2021    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}:
2022      %Equal.sym(U32, SB.sbox(U32.and(255, z0)), U32.and(255, SB.sbox(U32.and(255, z0))), ap.sbl(z0)) : {TT.S{TT.W{_, SB.sbox(U32.and(255, z1)), SB.sbox(U32.and(255, z2)), SB.sbox(U32.and(255, z3))}, TT.W{SB.sbox(U32.and(255, z4)), SB.sbox(U32.and(255, z5)), SB.sbox(U32.and(255, z6)), SB.sbox(U32.and(255, z7))}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2023      %Equal.sym(U32, SB.sbox(U32.and(255, z1)), U32.and(255, SB.sbox(U32.and(255, z1))), ap.sbl(z1)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), _, SB.sbox(U32.and(255, z2)), SB.sbox(U32.and(255, z3))}, TT.W{SB.sbox(U32.and(255, z4)), SB.sbox(U32.and(255, z5)), SB.sbox(U32.and(255, z6)), SB.sbox(U32.and(255, z7))}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2024      %Equal.sym(U32, SB.sbox(U32.and(255, z2)), U32.and(255, SB.sbox(U32.and(255, z2))), ap.sbl(z2)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), _, SB.sbox(U32.and(255, z3))}, TT.W{SB.sbox(U32.and(255, z4)), SB.sbox(U32.and(255, z5)), SB.sbox(U32.and(255, z6)), SB.sbox(U32.and(255, z7))}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2025      %Equal.sym(U32, SB.sbox(U32.and(255, z3)), U32.and(255, SB.sbox(U32.and(255, z3))), ap.sbl(z3)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), _}, TT.W{SB.sbox(U32.and(255, z4)), SB.sbox(U32.and(255, z5)), SB.sbox(U32.and(255, z6)), SB.sbox(U32.and(255, z7))}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2026      %Equal.sym(U32, SB.sbox(U32.and(255, z4)), U32.and(255, SB.sbox(U32.and(255, z4))), ap.sbl(z4)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{_, SB.sbox(U32.and(255, z5)), SB.sbox(U32.and(255, z6)), SB.sbox(U32.and(255, z7))}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2027      %Equal.sym(U32, SB.sbox(U32.and(255, z5)), U32.and(255, SB.sbox(U32.and(255, z5))), ap.sbl(z5)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), _, SB.sbox(U32.and(255, z6)), SB.sbox(U32.and(255, z7))}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2028      %Equal.sym(U32, SB.sbox(U32.and(255, z6)), U32.and(255, SB.sbox(U32.and(255, z6))), ap.sbl(z6)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), _, SB.sbox(U32.and(255, z7))}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2029      %Equal.sym(U32, SB.sbox(U32.and(255, z7)), U32.and(255, SB.sbox(U32.and(255, z7))), ap.sbl(z7)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), _}, TT.W{SB.sbox(U32.and(255, z8)), SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2030      %Equal.sym(U32, SB.sbox(U32.and(255, z8)), U32.and(255, SB.sbox(U32.and(255, z8))), ap.sbl(z8)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{_, SB.sbox(U32.and(255, z9)), SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2031      %Equal.sym(U32, SB.sbox(U32.and(255, z9)), U32.and(255, SB.sbox(U32.and(255, z9))), ap.sbl(z9)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z8))), _, SB.sbox(U32.and(255, z10)), SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2032      %Equal.sym(U32, SB.sbox(U32.and(255, z10)), U32.and(255, SB.sbox(U32.and(255, z10))), ap.sbl(z10)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z8))), U32.and(255, SB.sbox(U32.and(255, z9))), _, SB.sbox(U32.and(255, z11))}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2033      %Equal.sym(U32, SB.sbox(U32.and(255, z11)), U32.and(255, SB.sbox(U32.and(255, z11))), ap.sbl(z11)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z8))), U32.and(255, SB.sbox(U32.and(255, z9))), U32.and(255, SB.sbox(U32.and(255, z10))), _}, TT.W{SB.sbox(U32.and(255, z12)), SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2034      %Equal.sym(U32, SB.sbox(U32.and(255, z12)), U32.and(255, SB.sbox(U32.and(255, z12))), ap.sbl(z12)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z8))), U32.and(255, SB.sbox(U32.and(255, z9))), U32.and(255, SB.sbox(U32.and(255, z10))), U32.and(255, SB.sbox(U32.and(255, z11)))}, TT.W{_, SB.sbox(U32.and(255, z13)), SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2035      %Equal.sym(U32, SB.sbox(U32.and(255, z13)), U32.and(255, SB.sbox(U32.and(255, z13))), ap.sbl(z13)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z8))), U32.and(255, SB.sbox(U32.and(255, z9))), U32.and(255, SB.sbox(U32.and(255, z10))), U32.and(255, SB.sbox(U32.and(255, z11)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z12))), _, SB.sbox(U32.and(255, z14)), SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2036      %Equal.sym(U32, SB.sbox(U32.and(255, z14)), U32.and(255, SB.sbox(U32.and(255, z14))), ap.sbl(z14)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z8))), U32.and(255, SB.sbox(U32.and(255, z9))), U32.and(255, SB.sbox(U32.and(255, z10))), U32.and(255, SB.sbox(U32.and(255, z11)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z12))), U32.and(255, SB.sbox(U32.and(255, z13))), _, SB.sbox(U32.and(255, z15))}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2037      %Equal.sym(U32, SB.sbox(U32.and(255, z15)), U32.and(255, SB.sbox(U32.and(255, z15))), ap.sbl(z15)) : {TT.S{TT.W{U32.and(255, SB.sbox(U32.and(255, z0))), U32.and(255, SB.sbox(U32.and(255, z1))), U32.and(255, SB.sbox(U32.and(255, z2))), U32.and(255, SB.sbox(U32.and(255, z3)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z4))), U32.and(255, SB.sbox(U32.and(255, z5))), U32.and(255, SB.sbox(U32.and(255, z6))), U32.and(255, SB.sbox(U32.and(255, z7)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z8))), U32.and(255, SB.sbox(U32.and(255, z9))), U32.and(255, SB.sbox(U32.and(255, z10))), U32.and(255, SB.sbox(U32.and(255, z11)))}, TT.W{U32.and(255, SB.sbox(U32.and(255, z12))), U32.and(255, SB.sbox(U32.and(255, z13))), U32.and(255, SB.sbox(U32.and(255, z14))), _}} == X.aes.mask(A.sub_bytes(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2038      {==}
2039
2040def ap.subi(+s: TT.State) -> {X.aes.inv_sub(A.sub_bytes(X.aes.mask(s))) == X.aes.mask(s) : TT.State}:
2041  match s:
2042    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}:
2043      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z0))), U32.and(255, z0), ap.sbi(z0)) : {TT.S{TT.W{_, X.aes.isbox(SB.sbox(U32.and(255, z1))), X.aes.isbox(SB.sbox(U32.and(255, z2))), X.aes.isbox(SB.sbox(U32.and(255, z3)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z4))), X.aes.isbox(SB.sbox(U32.and(255, z5))), X.aes.isbox(SB.sbox(U32.and(255, z6))), X.aes.isbox(SB.sbox(U32.and(255, z7)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2044      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z1))), U32.and(255, z1), ap.sbi(z1)) : {TT.S{TT.W{U32.and(255, z0), _, X.aes.isbox(SB.sbox(U32.and(255, z2))), X.aes.isbox(SB.sbox(U32.and(255, z3)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z4))), X.aes.isbox(SB.sbox(U32.and(255, z5))), X.aes.isbox(SB.sbox(U32.and(255, z6))), X.aes.isbox(SB.sbox(U32.and(255, z7)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2045      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z2))), U32.and(255, z2), ap.sbi(z2)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), _, X.aes.isbox(SB.sbox(U32.and(255, z3)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z4))), X.aes.isbox(SB.sbox(U32.and(255, z5))), X.aes.isbox(SB.sbox(U32.and(255, z6))), X.aes.isbox(SB.sbox(U32.and(255, z7)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2046      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z3))), U32.and(255, z3), ap.sbi(z3)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), _}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z4))), X.aes.isbox(SB.sbox(U32.and(255, z5))), X.aes.isbox(SB.sbox(U32.and(255, z6))), X.aes.isbox(SB.sbox(U32.and(255, z7)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2047      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z4))), U32.and(255, z4), ap.sbi(z4)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{_, X.aes.isbox(SB.sbox(U32.and(255, z5))), X.aes.isbox(SB.sbox(U32.and(255, z6))), X.aes.isbox(SB.sbox(U32.and(255, z7)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2048      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z5))), U32.and(255, z5), ap.sbi(z5)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), _, X.aes.isbox(SB.sbox(U32.and(255, z6))), X.aes.isbox(SB.sbox(U32.and(255, z7)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2049      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z6))), U32.and(255, z6), ap.sbi(z6)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), _, X.aes.isbox(SB.sbox(U32.and(255, z7)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2050      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z7))), U32.and(255, z7), ap.sbi(z7)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), _}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z8))), X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2051      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z8))), U32.and(255, z8), ap.sbi(z8)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{_, X.aes.isbox(SB.sbox(U32.and(255, z9))), X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2052      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z9))), U32.and(255, z9), ap.sbi(z9)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), _, X.aes.isbox(SB.sbox(U32.and(255, z10))), X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2053      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z10))), U32.and(255, z10), ap.sbi(z10)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), _, X.aes.isbox(SB.sbox(U32.and(255, z11)))}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2054      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z11))), U32.and(255, z11), ap.sbi(z11)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), _}, TT.W{X.aes.isbox(SB.sbox(U32.and(255, z12))), X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2055      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z12))), U32.and(255, z12), ap.sbi(z12)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{_, X.aes.isbox(SB.sbox(U32.and(255, z13))), X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2056      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z13))), U32.and(255, z13), ap.sbi(z13)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{U32.and(255, z12), _, X.aes.isbox(SB.sbox(U32.and(255, z14))), X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2057      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z14))), U32.and(255, z14), ap.sbi(z14)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{U32.and(255, z12), U32.and(255, z13), _, X.aes.isbox(SB.sbox(U32.and(255, z15)))}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2058      %Equal.sym(U32, X.aes.isbox(SB.sbox(U32.and(255, z15))), U32.and(255, z15), ap.sbi(z15)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), _}} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2059      {==}
2060
2061def ap.mixl(+s: TT.State) -> {A.mix_columns(X.aes.mask(s)) == X.aes.mask(A.mix_columns(X.aes.mask(s))) : TT.State}:
2062  match s:
2063    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}:
2064      %Equal.sym(TT.Quad, A.mix_column(TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}), X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)})), ap.mixcb(z0, z1, z2, z3)) : {TT.S{_, A.mix_column(TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}), A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}), A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)})} == X.aes.mask(A.mix_columns(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2065      %Equal.sym(TT.Quad, A.mix_column(TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}), X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)})), ap.mixcb(z4, z5, z6, z7)) : {TT.S{X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)})), _, A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}), A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)})} == X.aes.mask(A.mix_columns(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2066      %Equal.sym(TT.Quad, A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}), X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)})), ap.mixcb(z8, z9, z10, z11)) : {TT.S{X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)})), X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)})), _, A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)})} == X.aes.mask(A.mix_columns(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2067      %Equal.sym(TT.Quad, A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)}), X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)})), ap.mixcb(z12, z13, z14, z15)) : {TT.S{X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)})), X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)})), X.aes.mask_w(A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)})), _} == X.aes.mask(A.mix_columns(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}))) : TT.State}
2068      {==}
2069
2070def ap.mixi(+s: TT.State) -> {X.aes.inv_mix(A.mix_columns(X.aes.mask(s))) == X.aes.mask(s) : TT.State}:
2071  match s:
2072    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}:
2073      %Equal.sym(TT.Quad, X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)})), TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, ap.mixc(z0, z1, z2, z3)) : {TT.S{_, X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)})), X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)})), X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)}))} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2074      %Equal.sym(TT.Quad, X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)})), TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, ap.mixc(z4, z5, z6, z7)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, _, X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)})), X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)}))} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2075      %Equal.sym(TT.Quad, X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)})), TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, ap.mixc(z8, z9, z10, z11)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, _, X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)}))} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2076      %Equal.sym(TT.Quad, X.aes.imix_w(A.mix_column(TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)})), TT.W{U32.and(255, z12), U32.and(255, z13), U32.and(255, z14), U32.and(255, z15)}, ap.mixc(z12, z13, z14, z15)) : {TT.S{TT.W{U32.and(255, z0), U32.and(255, z1), U32.and(255, z2), U32.and(255, z3)}, TT.W{U32.and(255, z4), U32.and(255, z5), U32.and(255, z6), U32.and(255, z7)}, TT.W{U32.and(255, z8), U32.and(255, z9), U32.and(255, z10), U32.and(255, z11)}, _} == X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}) : TT.State}
2077      {==}
2078
2079def ap.arkl(+m: TT.State, +k: TT.State) -> {A.add_round_key(X.aes.mask(m), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(m), X.aes.mask(k))) : TT.State}:
2080  match m k:
2081    case TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}} TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}:
2082      %Equal.sym(U32, U32.xor(U32.and(255, z0), U32.and(255, k0)), U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), ap.xorb(z0, k0)) : {TT.S{TT.W{_, U32.xor(U32.and(255, z1), U32.and(255, k1)), U32.xor(U32.and(255, z2), U32.and(255, k2)), U32.xor(U32.and(255, z3), U32.and(255, k3))}, TT.W{U32.xor(U32.and(255, z4), U32.and(255, k4)), U32.xor(U32.and(255, z5), U32.and(255, k5)), U32.xor(U32.and(255, z6), U32.and(255, k6)), U32.xor(U32.and(255, z7), U32.and(255, k7))}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2083      %Equal.sym(U32, U32.xor(U32.and(255, z1), U32.and(255, k1)), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), ap.xorb(z1, k1)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), _, U32.xor(U32.and(255, z2), U32.and(255, k2)), U32.xor(U32.and(255, z3), U32.and(255, k3))}, TT.W{U32.xor(U32.and(255, z4), U32.and(255, k4)), U32.xor(U32.and(255, z5), U32.and(255, k5)), U32.xor(U32.and(255, z6), U32.and(255, k6)), U32.xor(U32.and(255, z7), U32.and(255, k7))}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2084      %Equal.sym(U32, U32.xor(U32.and(255, z2), U32.and(255, k2)), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), ap.xorb(z2, k2)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), _, U32.xor(U32.and(255, z3), U32.and(255, k3))}, TT.W{U32.xor(U32.and(255, z4), U32.and(255, k4)), U32.xor(U32.and(255, z5), U32.and(255, k5)), U32.xor(U32.and(255, z6), U32.and(255, k6)), U32.xor(U32.and(255, z7), U32.and(255, k7))}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2085      %Equal.sym(U32, U32.xor(U32.and(255, z3), U32.and(255, k3)), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3))), ap.xorb(z3, k3)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), _}, TT.W{U32.xor(U32.and(255, z4), U32.and(255, k4)), U32.xor(U32.and(255, z5), U32.and(255, k5)), U32.xor(U32.and(255, z6), U32.and(255, k6)), U32.xor(U32.and(255, z7), U32.and(255, k7))}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2086      %Equal.sym(U32, U32.xor(U32.and(255, z4), U32.and(255, k4)), U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), ap.xorb(z4, k4)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{_, U32.xor(U32.and(255, z5), U32.and(255, k5)), U32.xor(U32.and(255, z6), U32.and(255, k6)), U32.xor(U32.and(255, z7), U32.and(255, k7))}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2087      %Equal.sym(U32, U32.xor(U32.and(255, z5), U32.and(255, k5)), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), ap.xorb(z5, k5)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), _, U32.xor(U32.and(255, z6), U32.and(255, k6)), U32.xor(U32.and(255, z7), U32.and(255, k7))}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2088      %Equal.sym(U32, U32.xor(U32.and(255, z6), U32.and(255, k6)), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), ap.xorb(z6, k6)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), _, U32.xor(U32.and(255, z7), U32.and(255, k7))}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2089      %Equal.sym(U32, U32.xor(U32.and(255, z7), U32.and(255, k7)), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7))), ap.xorb(z7, k7)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), _}, TT.W{U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2090      %Equal.sym(U32, U32.xor(U32.and(255, z8), U32.and(255, k8)), U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), ap.xorb(z8, k8)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{_, U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2091      %Equal.sym(U32, U32.xor(U32.and(255, z9), U32.and(255, k9)), U32.and(255, U32.xor(U32.and(255, z9), U32.and(255, k9))), ap.xorb(z9, k9)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), _, U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2092      %Equal.sym(U32, U32.xor(U32.and(255, z10), U32.and(255, k10)), U32.and(255, U32.xor(U32.and(255, z10), U32.and(255, k10))), ap.xorb(z10, k10)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), U32.and(255, U32.xor(U32.and(255, z9), U32.and(255, k9))), _, U32.xor(U32.and(255, z11), U32.and(255, k11))}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2093      %Equal.sym(U32, U32.xor(U32.and(255, z11), U32.and(255, k11)), U32.and(255, U32.xor(U32.and(255, z11), U32.and(255, k11))), ap.xorb(z11, k11)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), U32.and(255, U32.xor(U32.and(255, z9), U32.and(255, k9))), U32.and(255, U32.xor(U32.and(255, z10), U32.and(255, k10))), _}, TT.W{U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2094      %Equal.sym(U32, U32.xor(U32.and(255, z12), U32.and(255, k12)), U32.and(255, U32.xor(U32.and(255, z12), U32.and(255, k12))), ap.xorb(z12, k12)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), U32.and(255, U32.xor(U32.and(255, z9), U32.and(255, k9))), U32.and(255, U32.xor(U32.and(255, z10), U32.and(255, k10))), U32.and(255, U32.xor(U32.and(255, z11), U32.and(255, k11)))}, TT.W{_, U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2095      %Equal.sym(U32, U32.xor(U32.and(255, z13), U32.and(255, k13)), U32.and(255, U32.xor(U32.and(255, z13), U32.and(255, k13))), ap.xorb(z13, k13)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), U32.and(255, U32.xor(U32.and(255, z9), U32.and(255, k9))), U32.and(255, U32.xor(U32.and(255, z10), U32.and(255, k10))), U32.and(255, U32.xor(U32.and(255, z11), U32.and(255, k11)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z12), U32.and(255, k12))), _, U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2096      %Equal.sym(U32, U32.xor(U32.and(255, z14), U32.and(255, k14)), U32.and(255, U32.xor(U32.and(255, z14), U32.and(255, k14))), ap.xorb(z14, k14)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), U32.and(255, U32.xor(U32.and(255, z9), U32.and(255, k9))), U32.and(255, U32.xor(U32.and(255, z10), U32.and(255, k10))), U32.and(255, U32.xor(U32.and(255, z11), U32.and(255, k11)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z12), U32.and(255, k12))), U32.and(255, U32.xor(U32.and(255, z13), U32.and(255, k13))), _, U32.xor(U32.and(255, z15), U32.and(255, k15))}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2097      %Equal.sym(U32, U32.xor(U32.and(255, z15), U32.and(255, k15)), U32.and(255, U32.xor(U32.and(255, z15), U32.and(255, k15))), ap.xorb(z15, k15)) : {TT.S{TT.W{U32.and(255, U32.xor(U32.and(255, z0), U32.and(255, k0))), U32.and(255, U32.xor(U32.and(255, z1), U32.and(255, k1))), U32.and(255, U32.xor(U32.and(255, z2), U32.and(255, k2))), U32.and(255, U32.xor(U32.and(255, z3), U32.and(255, k3)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z4), U32.and(255, k4))), U32.and(255, U32.xor(U32.and(255, z5), U32.and(255, k5))), U32.and(255, U32.xor(U32.and(255, z6), U32.and(255, k6))), U32.and(255, U32.xor(U32.and(255, z7), U32.and(255, k7)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z8), U32.and(255, k8))), U32.and(255, U32.xor(U32.and(255, z9), U32.and(255, k9))), U32.and(255, U32.xor(U32.and(255, z10), U32.and(255, k10))), U32.and(255, U32.xor(U32.and(255, z11), U32.and(255, k11)))}, TT.W{U32.and(255, U32.xor(U32.and(255, z12), U32.and(255, k12))), U32.and(255, U32.xor(U32.and(255, z13), U32.and(255, k13))), U32.and(255, U32.xor(U32.and(255, z14), U32.and(255, k14))), _}} == X.aes.mask(A.add_round_key(X.aes.mask(TT.S{TT.W{z0, z1, z2, z3}, TT.W{z4, z5, z6, z7}, TT.W{z8, z9, z10, z11}, TT.W{z12, z13, z14, z15}}), X.aes.mask(TT.S{TT.W{k0, k1, k2, k3}, TT.W{k4, k5, k6, k7}, TT.W{k8, k9, k10, k11}, TT.W{k12, k13, k14, k15}}))) : TT.State}
2098      {==}
2099
2100def ap.ismask(+x: TT.State, +v: TT.State, +e: {x == X.aes.mask(v) : TT.State}) -> {x == X.aes.mask(x) : TT.State}:
2101  %Equal.sym(TT.State, x, X.aes.mask(v), e) : {_ == X.aes.mask(_) : TT.State}
2102  Equal.sym(TT.State, X.aes.mask(X.aes.mask(v)), X.aes.mask(v), ap.mm(v))
2103
2104# A round, the last round and the first AddRoundKey undone, on states of
2105# bytes, and their outputs bytes again
2106
2107def ap.round_inv(+z: TT.State, +k: TT.State) -> {X.aes.inv_round(A.round(X.aes.mask(z), X.aes.mask(k)), X.aes.mask(k)) == X.aes.mask(z) : TT.State}:
2108  %Equal.sym(TT.State, A.add_round_key(A.add_round_key(A.mix_columns(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k)), X.aes.mask(k)), A.mix_columns(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), ap.ark2(A.mix_columns(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k))) : {X.aes.inv_sub(X.aes.inv_shift(X.aes.inv_mix(_))) == X.aes.mask(z) : TT.State}
2109  %Equal.sym(TT.State, A.sub_bytes(X.aes.mask(z)), X.aes.mask(A.sub_bytes(X.aes.mask(z))), ap.subl(z)) : {X.aes.inv_sub(X.aes.inv_shift(X.aes.inv_mix(A.mix_columns(A.shift_rows(_))))) == X.aes.mask(z) : TT.State}
2110  %Equal.sym(TT.State, A.shift_rows(X.aes.mask(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), ap.shm(A.sub_bytes(X.aes.mask(z)))) : {X.aes.inv_sub(X.aes.inv_shift(X.aes.inv_mix(A.mix_columns(_)))) == X.aes.mask(z) : TT.State}
2111  %Equal.sym(TT.State, X.aes.inv_mix(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))))), X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), ap.mixi(A.shift_rows(A.sub_bytes(X.aes.mask(z))))) : {X.aes.inv_sub(X.aes.inv_shift(_)) == X.aes.mask(z) : TT.State}
2112  %ap.shm(A.sub_bytes(X.aes.mask(z))) : {X.aes.inv_sub(X.aes.inv_shift(_)) == X.aes.mask(z) : TT.State}
2113  %Equal.sym(TT.State, X.aes.inv_shift(A.shift_rows(X.aes.mask(A.sub_bytes(X.aes.mask(z))))), X.aes.mask(A.sub_bytes(X.aes.mask(z))), ap.shift(X.aes.mask(A.sub_bytes(X.aes.mask(z))))) : {X.aes.inv_sub(_) == X.aes.mask(z) : TT.State}
2114  %ap.subl(z) : {X.aes.inv_sub(_) == X.aes.mask(z) : TT.State}
2115  ap.subi(z)
2116
2117def ap.round_eq(+z: TT.State, +k: TT.State) -> {A.round(X.aes.mask(z), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))))), X.aes.mask(k))) : TT.State}:
2118  %Equal.sym(TT.State, A.sub_bytes(X.aes.mask(z)), X.aes.mask(A.sub_bytes(X.aes.mask(z))), ap.subl(z)) : {A.add_round_key(A.mix_columns(A.shift_rows(_)), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))))), X.aes.mask(k))) : TT.State}
2119  %Equal.sym(TT.State, A.shift_rows(X.aes.mask(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), ap.shm(A.sub_bytes(X.aes.mask(z)))) : {A.add_round_key(A.mix_columns(_), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))))), X.aes.mask(k))) : TT.State}
2120  %Equal.sym(TT.State, A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z))))), X.aes.mask(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))))), ap.mixl(A.shift_rows(A.sub_bytes(X.aes.mask(z))))) : {A.add_round_key(_, X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))))), X.aes.mask(k))) : TT.State}
2121  ap.arkl(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z))))), k)
2122
2123def ap.round_out(+z: TT.State, +k: TT.State) -> {A.round(X.aes.mask(z), X.aes.mask(k)) == X.aes.mask(A.round(X.aes.mask(z), X.aes.mask(k))) : TT.State}:
2124  ap.ismask(A.round(X.aes.mask(z), X.aes.mask(k)), A.add_round_key(X.aes.mask(A.mix_columns(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))))), X.aes.mask(k)), ap.round_eq(z, k))
2125
2126def ap.last_inv(+z: TT.State, +k: TT.State) -> {X.aes.inv_last(A.last_round(X.aes.mask(z), X.aes.mask(k)), X.aes.mask(k)) == X.aes.mask(z) : TT.State}:
2127  %Equal.sym(TT.State, A.add_round_key(A.add_round_key(A.shift_rows(A.sub_bytes(X.aes.mask(z))), X.aes.mask(k)), X.aes.mask(k)), A.shift_rows(A.sub_bytes(X.aes.mask(z))), ap.ark2(A.shift_rows(A.sub_bytes(X.aes.mask(z))), X.aes.mask(k))) : {X.aes.inv_sub(X.aes.inv_shift(_)) == X.aes.mask(z) : TT.State}
2128  %Equal.sym(TT.State, X.aes.inv_shift(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), A.sub_bytes(X.aes.mask(z)), ap.shift(A.sub_bytes(X.aes.mask(z)))) : {X.aes.inv_sub(_) == X.aes.mask(z) : TT.State}
2129  ap.subi(z)
2130
2131def ap.last_eq(+z: TT.State, +k: TT.State) -> {A.last_round(X.aes.mask(z), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k))) : TT.State}:
2132  %Equal.sym(TT.State, A.sub_bytes(X.aes.mask(z)), X.aes.mask(A.sub_bytes(X.aes.mask(z))), ap.subl(z)) : {A.add_round_key(A.shift_rows(_), X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k))) : TT.State}
2133  %Equal.sym(TT.State, A.shift_rows(X.aes.mask(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), ap.shm(A.sub_bytes(X.aes.mask(z)))) : {A.add_round_key(_, X.aes.mask(k)) == X.aes.mask(A.add_round_key(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k))) : TT.State}
2134  ap.arkl(A.shift_rows(A.sub_bytes(X.aes.mask(z))), k)
2135
2136def ap.last_out(+z: TT.State, +k: TT.State) -> {A.last_round(X.aes.mask(z), X.aes.mask(k)) == X.aes.mask(A.last_round(X.aes.mask(z), X.aes.mask(k))) : TT.State}:
2137  ap.ismask(A.last_round(X.aes.mask(z), X.aes.mask(k)), A.add_round_key(X.aes.mask(A.shift_rows(A.sub_bytes(X.aes.mask(z)))), X.aes.mask(k)), ap.last_eq(z, k))
2138
2139# The rounds and the cipher, by induction on the round keys
2140
2141def ap.rounds_out(n: Nat, ks: List<&2, TT.State>, +z: TT.State) -> {A.rounds(n, X.aes.mask(z), X.aes.mask_keys(ks)) == X.aes.mask(A.rounds(n, X.aes.mask(z), X.aes.mask_keys(ks))) : TT.State}:
2142  match n ks:
2143    case 0n Con{+k, rest}:
2144      ap.last_out(z, k)
2145    case 1n+p Con{+k, rest}:
2146      %Equal.sym(TT.State, A.round(X.aes.mask(z), X.aes.mask(k)), X.aes.mask(A.round(X.aes.mask(z), X.aes.mask(k))), ap.round_out(z, k)) : {A.rounds(p, _, X.aes.mask_keys(rest)) == X.aes.mask(A.rounds(p, _, X.aes.mask_keys(rest))) : TT.State}
2147      ap.rounds_out(p, rest, A.round(X.aes.mask(z), X.aes.mask(k)))
2148    case 0n Nil{}:
2149      Equal.sym(TT.State, X.aes.mask(X.aes.mask(z)), X.aes.mask(z), ap.mm(z))
2150    case 1n+p Nil{}:
2151      Equal.sym(TT.State, X.aes.mask(X.aes.mask(z)), X.aes.mask(z), ap.mm(z))
2152
2153def ap.rounds_inv(n: Nat, ks: List<&2, TT.State>, +z: TT.State) -> {X.aes.inv_rounds(n, X.aes.mask_keys(ks), A.rounds(n, X.aes.mask(z), X.aes.mask_keys(ks))) == X.aes.mask(z) : TT.State}:
2154  match n ks:
2155    case 0n Con{+k, rest}:
2156      ap.last_inv(z, k)
2157    case 1n+p Con{+k, rest}:
2158      %Equal.sym(TT.State, A.round(X.aes.mask(z), X.aes.mask(k)), X.aes.mask(A.round(X.aes.mask(z), X.aes.mask(k))), ap.round_out(z, k)) : {X.aes.inv_round(X.aes.inv_rounds(p, X.aes.mask_keys(rest), A.rounds(p, _, X.aes.mask_keys(rest))), X.aes.mask(k)) == X.aes.mask(z) : TT.State}
2159      %Equal.sym(TT.State, X.aes.inv_rounds(p, X.aes.mask_keys(rest), A.rounds(p, X.aes.mask(A.round(X.aes.mask(z), X.aes.mask(k))), X.aes.mask_keys(rest))), X.aes.mask(A.round(X.aes.mask(z), X.aes.mask(k))), ap.rounds_inv(p, rest, A.round(X.aes.mask(z), X.aes.mask(k)))) : {X.aes.inv_round(_, X.aes.mask(k)) == X.aes.mask(z) : TT.State}
2160      %ap.round_out(z, k) : {X.aes.inv_round(_, X.aes.mask(k)) == X.aes.mask(z) : TT.State}
2161      ap.round_inv(z, k)
2162    case 0n Nil{}:
2163      ap.mm(z)
2164    case 1n+p Nil{}:
2165      ap.mm(z)
2166
2167def ap.cipher_out(+nr: Nat, ks: List<&2, TT.State>, +s: TT.State) -> {A.cipher(nr, X.aes.mask(s), X.aes.mask_keys(ks)) == X.aes.mask(A.cipher(nr, X.aes.mask(s), X.aes.mask_keys(ks))) : TT.State}:
2168  match ks:
2169    case Con{+k, rest}:
2170      %Equal.sym(TT.State, A.add_round_key(X.aes.mask(s), X.aes.mask(k)), X.aes.mask(A.add_round_key(X.aes.mask(s), X.aes.mask(k))), ap.arkl(s, k)) : {A.rounds(Nat.sub(nr, 1n), _, X.aes.mask_keys(rest)) == X.aes.mask(A.rounds(Nat.sub(nr, 1n), _, X.aes.mask_keys(rest))) : TT.State}
2171      ap.rounds_out(Nat.sub(nr, 1n), rest, A.add_round_key(X.aes.mask(s), X.aes.mask(k)))
2172    case Nil{}:
2173      Equal.sym(TT.State, X.aes.mask(X.aes.mask(s)), X.aes.mask(s), ap.mm(s))
2174
2175def ap.cipher_inv(+nr: Nat, ks: List<&2, TT.State>, +s: TT.State) -> {X.aes.inv_cipher(nr, X.aes.mask_keys(ks), A.cipher(nr, X.aes.mask(s), X.aes.mask_keys(ks))) == X.aes.mask(s) : TT.State}:
2176  match ks:
2177    case Con{+k, rest}:
2178      %Equal.sym(TT.State, A.add_round_key(X.aes.mask(s), X.aes.mask(k)), X.aes.mask(A.add_round_key(X.aes.mask(s), X.aes.mask(k))), ap.arkl(s, k)) : {X.aes.mask(A.add_round_key(X.aes.inv_rounds(Nat.sub(nr, 1n), X.aes.mask_keys(rest), A.rounds(Nat.sub(nr, 1n), _, X.aes.mask_keys(rest))), X.aes.mask(k))) == X.aes.mask(s) : TT.State}
2179      %Equal.sym(TT.State, X.aes.inv_rounds(Nat.sub(nr, 1n), X.aes.mask_keys(rest), A.rounds(Nat.sub(nr, 1n), X.aes.mask(A.add_round_key(X.aes.mask(s), X.aes.mask(k))), X.aes.mask_keys(rest))), X.aes.mask(A.add_round_key(X.aes.mask(s), X.aes.mask(k))), ap.rounds_inv(Nat.sub(nr, 1n), rest, A.add_round_key(X.aes.mask(s), X.aes.mask(k)))) : {X.aes.mask(A.add_round_key(_, X.aes.mask(k))) == X.aes.mask(s) : TT.State}
2180      %ap.arkl(s, k) : {X.aes.mask(A.add_round_key(_, X.aes.mask(k))) == X.aes.mask(s) : TT.State}
2181      %Equal.sym(TT.State, A.add_round_key(A.add_round_key(X.aes.mask(s), X.aes.mask(k)), X.aes.mask(k)), X.aes.mask(s), ap.ark2(X.aes.mask(s), X.aes.mask(k))) : {X.aes.mask(_) == X.aes.mask(s) : TT.State}
2182      ap.mm(s)
2183    case Nil{}:
2184      ap.mm(s)
2185
2186# The block: its bytes into the state and back
2187
2188def ap.state_back(+e: TT.State) -> {X.aes.state16(M.cm.bytes_of(M.cm.block_of(A.bytes_of(e)))) == X.aes.mask(e) : TT.State}:
2189  match e:
2190    case TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}:
2191      %Equal.sym(List<&2, U32>, M.cm.bytes_onto(M.cm.block16(e0, e1, e2, e3, e4, e5, e6, e7, e8, e9, e10, e11, e12, e13, e14, e15), Nil{}), Con{B.byte(e0), Con{B.byte(e1), Con{B.byte(e2), Con{B.byte(e3), Con{B.byte(e4), Con{B.byte(e5), Con{B.byte(e6), Con{B.byte(e7), Con{B.byte(e8), Con{B.byte(e9), Con{B.byte(e10), Con{B.byte(e11), Con{B.byte(e12), Con{B.byte(e13), Con{B.byte(e14), Con{B.byte(e15), Nil{}}}}}}}}}}}}}}}}}, sp.blk16g(e0, e1, e2, e3, e4, e5, e6, e7, e8, e9, e10, e11, e12, e13, e14, e15, Nil{})) : {X.aes.state16(_) == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2192      %Equal.sym(U32, B.byte(e0), U32.and(255, e0), ap.bylo(e0)) : {TT.S{TT.W{_, B.byte(e1), B.byte(e2), B.byte(e3)}, TT.W{B.byte(e4), B.byte(e5), B.byte(e6), B.byte(e7)}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2193      %Equal.sym(U32, B.byte(e1), U32.and(255, e1), ap.bylo(e1)) : {TT.S{TT.W{U32.and(255, e0), _, B.byte(e2), B.byte(e3)}, TT.W{B.byte(e4), B.byte(e5), B.byte(e6), B.byte(e7)}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2194      %Equal.sym(U32, B.byte(e2), U32.and(255, e2), ap.bylo(e2)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), _, B.byte(e3)}, TT.W{B.byte(e4), B.byte(e5), B.byte(e6), B.byte(e7)}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2195      %Equal.sym(U32, B.byte(e3), U32.and(255, e3), ap.bylo(e3)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), _}, TT.W{B.byte(e4), B.byte(e5), B.byte(e6), B.byte(e7)}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2196      %Equal.sym(U32, B.byte(e4), U32.and(255, e4), ap.bylo(e4)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{_, B.byte(e5), B.byte(e6), B.byte(e7)}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2197      %Equal.sym(U32, B.byte(e5), U32.and(255, e5), ap.bylo(e5)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), _, B.byte(e6), B.byte(e7)}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2198      %Equal.sym(U32, B.byte(e6), U32.and(255, e6), ap.bylo(e6)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), _, B.byte(e7)}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2199      %Equal.sym(U32, B.byte(e7), U32.and(255, e7), ap.bylo(e7)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), _}, TT.W{B.byte(e8), B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2200      %Equal.sym(U32, B.byte(e8), U32.and(255, e8), ap.bylo(e8)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{_, B.byte(e9), B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2201      %Equal.sym(U32, B.byte(e9), U32.and(255, e9), ap.bylo(e9)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{U32.and(255, e8), _, B.byte(e10), B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2202      %Equal.sym(U32, B.byte(e10), U32.and(255, e10), ap.bylo(e10)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{U32.and(255, e8), U32.and(255, e9), _, B.byte(e11)}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2203      %Equal.sym(U32, B.byte(e11), U32.and(255, e11), ap.bylo(e11)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{U32.and(255, e8), U32.and(255, e9), U32.and(255, e10), _}, TT.W{B.byte(e12), B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2204      %Equal.sym(U32, B.byte(e12), U32.and(255, e12), ap.bylo(e12)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{U32.and(255, e8), U32.and(255, e9), U32.and(255, e10), U32.and(255, e11)}, TT.W{_, B.byte(e13), B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2205      %Equal.sym(U32, B.byte(e13), U32.and(255, e13), ap.bylo(e13)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{U32.and(255, e8), U32.and(255, e9), U32.and(255, e10), U32.and(255, e11)}, TT.W{U32.and(255, e12), _, B.byte(e14), B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2206      %Equal.sym(U32, B.byte(e14), U32.and(255, e14), ap.bylo(e14)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{U32.and(255, e8), U32.and(255, e9), U32.and(255, e10), U32.and(255, e11)}, TT.W{U32.and(255, e12), U32.and(255, e13), _, B.byte(e15)}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2207      %Equal.sym(U32, B.byte(e15), U32.and(255, e15), ap.bylo(e15)) : {TT.S{TT.W{U32.and(255, e0), U32.and(255, e1), U32.and(255, e2), U32.and(255, e3)}, TT.W{U32.and(255, e4), U32.and(255, e5), U32.and(255, e6), U32.and(255, e7)}, TT.W{U32.and(255, e8), U32.and(255, e9), U32.and(255, e10), U32.and(255, e11)}, TT.W{U32.and(255, e12), U32.and(255, e13), U32.and(255, e14), _}} == X.aes.mask(TT.S{TT.W{e0, e1, e2, e3}, TT.W{e4, e5, e6, e7}, TT.W{e8, e9, e10, e11}, TT.W{e12, e13, e14, e15}}) : TT.State}
2208      {==}
2209
2210def ap.in_mask(+b: M.CmBlock) -> {X.aes.state_in(b) == X.aes.mask(X.aes.state_in(b)) : TT.State}:
2211  match b:
2212    case M.CmBlock{U32{WCon{p0, WCon{p1, WCon{p2, WCon{p3, WCon{p4, WCon{p5, WCon{p6, WCon{p7, WCon{p8, WCon{p9, WCon{p10, WCon{p11, WCon{p12, WCon{p13, WCon{p14, WCon{p15, WCon{p16, WCon{p17, WCon{p18, WCon{p19, WCon{p20, WCon{p21, WCon{p22, WCon{p23, WCon{p24, WCon{p25, WCon{p26, WCon{p27, WCon{p28, WCon{p29, WCon{p30, WCon{p31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{q0, WCon{q1, WCon{q2, WCon{q3, WCon{q4, WCon{q5, WCon{q6, WCon{q7, WCon{q8, WCon{q9, WCon{q10, WCon{q11, WCon{q12, WCon{q13, WCon{q14, WCon{q15, WCon{q16, WCon{q17, WCon{q18, WCon{q19, WCon{q20, WCon{q21, WCon{q22, WCon{q23, WCon{q24, WCon{q25, WCon{q26, WCon{q27, WCon{q28, WCon{q29, WCon{q30, WCon{q31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{r0, WCon{r1, WCon{r2, WCon{r3, WCon{r4, WCon{r5, WCon{r6, WCon{r7, WCon{r8, WCon{r9, WCon{r10, WCon{r11, WCon{r12, WCon{r13, WCon{r14, WCon{r15, WCon{r16, WCon{r17, WCon{r18, WCon{r19, WCon{r20, WCon{r21, WCon{r22, WCon{r23, WCon{r24, WCon{r25, WCon{r26, WCon{r27, WCon{r28, WCon{r29, WCon{r30, WCon{r31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{s0, WCon{s1, WCon{s2, WCon{s3, WCon{s4, WCon{s5, WCon{s6, WCon{s7, WCon{s8, WCon{s9, WCon{s10, WCon{s11, WCon{s12, WCon{s13, WCon{s14, WCon{s15, WCon{s16, WCon{s17, WCon{s18, WCon{s19, WCon{s20, WCon{s21, WCon{s22, WCon{s23, WCon{s24, WCon{s25, WCon{s26, WCon{s27, WCon{s28, WCon{s29, WCon{s30, WCon{s31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
2213      {==}
2214
2215def ap.out_in(+b: M.CmBlock) -> {X.aes.out(X.aes.mask(X.aes.state_in(b))) == b : M.CmBlock}:
2216  match b:
2217    case M.CmBlock{U32{WCon{p0, WCon{p1, WCon{p2, WCon{p3, WCon{p4, WCon{p5, WCon{p6, WCon{p7, WCon{p8, WCon{p9, WCon{p10, WCon{p11, WCon{p12, WCon{p13, WCon{p14, WCon{p15, WCon{p16, WCon{p17, WCon{p18, WCon{p19, WCon{p20, WCon{p21, WCon{p22, WCon{p23, WCon{p24, WCon{p25, WCon{p26, WCon{p27, WCon{p28, WCon{p29, WCon{p30, WCon{p31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{q0, WCon{q1, WCon{q2, WCon{q3, WCon{q4, WCon{q5, WCon{q6, WCon{q7, WCon{q8, WCon{q9, WCon{q10, WCon{q11, WCon{q12, WCon{q13, WCon{q14, WCon{q15, WCon{q16, WCon{q17, WCon{q18, WCon{q19, WCon{q20, WCon{q21, WCon{q22, WCon{q23, WCon{q24, WCon{q25, WCon{q26, WCon{q27, WCon{q28, WCon{q29, WCon{q30, WCon{q31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{r0, WCon{r1, WCon{r2, WCon{r3, WCon{r4, WCon{r5, WCon{r6, WCon{r7, WCon{r8, WCon{r9, WCon{r10, WCon{r11, WCon{r12, WCon{r13, WCon{r14, WCon{r15, WCon{r16, WCon{r17, WCon{r18, WCon{r19, WCon{r20, WCon{r21, WCon{r22, WCon{r23, WCon{r24, WCon{r25, WCon{r26, WCon{r27, WCon{r28, WCon{r29, WCon{r30, WCon{r31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}, U32{WCon{s0, WCon{s1, WCon{s2, WCon{s3, WCon{s4, WCon{s5, WCon{s6, WCon{s7, WCon{s8, WCon{s9, WCon{s10, WCon{s11, WCon{s12, WCon{s13, WCon{s14, WCon{s15, WCon{s16, WCon{s17, WCon{s18, WCon{s19, WCon{s20, WCon{s21, WCon{s22, WCon{s23, WCon{s24, WCon{s25, WCon{s26, WCon{s27, WCon{s28, WCon{s29, WCon{s30, WCon{s31, WNil{}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}:
2218      {==}
2219
2220def ap.top(+nr: Nat, +ks: List<&2, TT.State>, +b: M.CmBlock) -> {X.aes.out(X.aes.inv_cipher(nr, X.aes.mask_keys(ks), X.aes.state16(M.cm.bytes_of(M.cm.block_of(A.bytes_of(A.cipher(nr, X.aes.state_in(b), X.aes.mask_keys(ks)))))))) == b : M.CmBlock}:
2221  %Equal.sym(TT.State, X.aes.state_in(b), X.aes.mask(X.aes.state_in(b)), ap.in_mask(b)) : {X.aes.out(X.aes.inv_cipher(nr, X.aes.mask_keys(ks), X.aes.state16(M.cm.bytes_of(M.cm.block_of(A.bytes_of(A.cipher(nr, _, X.aes.mask_keys(ks)))))))) == b : M.CmBlock}
2222  %Equal.sym(TT.State, X.aes.state16(M.cm.bytes_of(M.cm.block_of(A.bytes_of(A.cipher(nr, X.aes.mask(X.aes.state_in(b)), X.aes.mask_keys(ks)))))), X.aes.mask(A.cipher(nr, X.aes.mask(X.aes.state_in(b)), X.aes.mask_keys(ks))), ap.state_back(A.cipher(nr, X.aes.mask(X.aes.state_in(b)), X.aes.mask_keys(ks)))) : {X.aes.out(X.aes.inv_cipher(nr, X.aes.mask_keys(ks), _)) == b : M.CmBlock}
2223  %ap.cipher_out(nr, ks, X.aes.state_in(b)) : {X.aes.out(X.aes.inv_cipher(nr, X.aes.mask_keys(ks), _)) == b : M.CmBlock}
2224  %Equal.sym(TT.State, X.aes.inv_cipher(nr, X.aes.mask_keys(ks), A.cipher(nr, X.aes.mask(X.aes.state_in(b)), X.aes.mask_keys(ks))), X.aes.mask(X.aes.state_in(b)), ap.cipher_inv(nr, ks, X.aes.state_in(b))) : {X.aes.out(_) == b : M.CmBlock}
2225  ap.out_in(b)
2226
2227def Laws.aes_round_trip(k, b):
2228  match k:
2229    case X.CmAesKey{sched}:
2230      match sched:
2231        case A.Schedule{+nr, +ks}:
2232          ap.top(nr, ks, b)
2233# END GENERATED: aes