sm3.bend

bend-osdev-hashes@0.1.0.0 · 570 lines · 13 definitions

1# SM3 (GB/T 32905-2016, Information security techniques - SM3 cryptographic
2# hash algorithm; in English, draft-shen-sm3-hash-01, S. Shen and X. Lee,
3# "SM3 Hash Function", 2014): a 256-bit digest of 64-byte blocks, a message
4# expansion to 68 + 64 words and 64 rounds (unrolled by gen/rounds.py).
5# Big-endian words; the length in bits is padded in big-endian, as SHA-256.
6#
7# bend-collections-laws-crypto@1.0.0.0 has no SM3 (it was checked file by
8# file), so it is written here, from the specification.
9#
10# The hash, as the crypto package's hash interface takes it:
11#   ~Hs.HsMdState<Hs.HsW8>, ~64n, ~32n, ~HsSm3.init(), ~HsSm3.update,
12#   ~HsSm3.final, ~HsSm3.digest
13import Base
14import bend-osdev-bytes@0.1.0.0/bytes.bend as B
15import bend-osdev-hashes@0.1.0.0/hashes.bend as Hs
16
17# the permutations P0 and P1
18def hs.sm3.p0(+x: U32) -> U32:
19  U32.xor(U32.xor(x, Hs.hs.rotl(x, 9n)), Hs.hs.rotl(x, 17n))
20
21def hs.sm3.p1(+x: U32) -> U32:
22  U32.xor(U32.xor(x, Hs.hs.rotl(x, 15n)), Hs.hs.rotl(x, 23n))
23
24# the boolean functions FF_j and GG_j: for rounds 0 to 15, and 16 to 63
25def hs.sm3.ff0(x: U32, y: U32, z: U32) -> U32:
26  U32.xor(U32.xor(x, y), z)
27
28def hs.sm3.ff1(+x: U32, +y: U32, +z: U32) -> U32:
29  U32.or(U32.or(U32.and(x, y), U32.and(x, z)), U32.and(y, z))
30
31def hs.sm3.gg0(x: U32, y: U32, z: U32) -> U32:
32  U32.xor(U32.xor(x, y), z)
33
34def hs.sm3.gg1(+x: U32, y: U32, z: U32) -> U32:
35  U32.or(U32.and(x, y), U32.and(U32.not(x), z))
36
37# BEGIN GENERATED by gen/rounds.py: sm3
38def hs.sm3.rounds(x: Hs.HsW16, cv: Hs.HsW8) -> Hs.HsW8:
39  match x cv:
40    case Hs.HsW16{+x0, +x1, +x2, +x3, +x4, +x5, +x6, +x7, +x8, +x9, +x10, +x11, +x12, +x13, +x14, +x15} Hs.HsW8{+a0, +b0, +c0, +d0, +e0, +f0, +g0, +h0}:
41      # rounds 0 to 15
42      +v1 = Hs.hs.rotl(a0, 12n)
43      +v2 = Hs.hs.rotl(U32.add(U32.add(v1, e0), 2043430169), 7n)
44      +v3 = U32.add(U32.add(U32.add(hs.sm3.ff0(a0, b0, c0), d0), U32.xor(v2, v1)), U32.xor(x0, x4))
45      +v4 = U32.add(U32.add(U32.add(hs.sm3.gg0(e0, f0, g0), h0), v2), x0)
46      +v5 = Hs.hs.rotl(b0, 9n)
47      +v6 = Hs.hs.rotl(f0, 19n)
48      +v7 = hs.sm3.p0(v4)
49      +v8 = Hs.hs.rotl(v3, 12n)
50      +v9 = Hs.hs.rotl(U32.add(U32.add(v8, v7), 4086860338), 7n)
51      +v10 = U32.add(U32.add(U32.add(hs.sm3.ff0(v3, a0, v5), c0), U32.xor(v9, v8)), U32.xor(x1, x5))
52      +v11 = U32.add(U32.add(U32.add(hs.sm3.gg0(v7, e0, v6), g0), v9), x1)
53      +v12 = Hs.hs.rotl(a0, 9n)
54      +v13 = Hs.hs.rotl(e0, 19n)
55      +v14 = hs.sm3.p0(v11)
56      +v15 = Hs.hs.rotl(v10, 12n)
57      +v16 = Hs.hs.rotl(U32.add(U32.add(v15, v14), 3878753381), 7n)
58      +v17 = U32.add(U32.add(U32.add(hs.sm3.ff0(v10, v3, v12), v5), U32.xor(v16, v15)), U32.xor(x2, x6))
59      +v18 = U32.add(U32.add(U32.add(hs.sm3.gg0(v14, v7, v13), v6), v16), x2)
60      +v19 = Hs.hs.rotl(v3, 9n)
61      +v20 = Hs.hs.rotl(v7, 19n)
62      +v21 = hs.sm3.p0(v18)
63      +v22 = Hs.hs.rotl(v17, 12n)
64      +v23 = Hs.hs.rotl(U32.add(U32.add(v22, v21), 3462539467), 7n)
65      +v24 = U32.add(U32.add(U32.add(hs.sm3.ff0(v17, v10, v19), v12), U32.xor(v23, v22)), U32.xor(x3, x7))
66      +v25 = U32.add(U32.add(U32.add(hs.sm3.gg0(v21, v14, v20), v13), v23), x3)
67      +v26 = Hs.hs.rotl(v10, 9n)
68      +v27 = Hs.hs.rotl(v14, 19n)
69      +v28 = hs.sm3.p0(v25)
70      +v29 = Hs.hs.rotl(v24, 12n)
71      +v30 = Hs.hs.rotl(U32.add(U32.add(v29, v28), 2630111639), 7n)
72      +v31 = U32.add(U32.add(U32.add(hs.sm3.ff0(v24, v17, v26), v19), U32.xor(v30, v29)), U32.xor(x4, x8))
73      +v32 = U32.add(U32.add(U32.add(hs.sm3.gg0(v28, v21, v27), v20), v30), x4)
74      +v33 = Hs.hs.rotl(v17, 9n)
75      +v34 = Hs.hs.rotl(v21, 19n)
76      +v35 = hs.sm3.p0(v32)
77      +v36 = Hs.hs.rotl(v31, 12n)
78      +v37 = Hs.hs.rotl(U32.add(U32.add(v36, v35), 965255983), 7n)
79      +v38 = U32.add(U32.add(U32.add(hs.sm3.ff0(v31, v24, v33), v26), U32.xor(v37, v36)), U32.xor(x5, x9))
80      +v39 = U32.add(U32.add(U32.add(hs.sm3.gg0(v35, v28, v34), v27), v37), x5)
81      +v40 = Hs.hs.rotl(v24, 9n)
82      +v41 = Hs.hs.rotl(v28, 19n)
83      +v42 = hs.sm3.p0(v39)
84      +v43 = Hs.hs.rotl(v38, 12n)
85      +v44 = Hs.hs.rotl(U32.add(U32.add(v43, v42), 1930511966), 7n)
86      +v45 = U32.add(U32.add(U32.add(hs.sm3.ff0(v38, v31, v40), v33), U32.xor(v44, v43)), U32.xor(x6, x10))
87      +v46 = U32.add(U32.add(U32.add(hs.sm3.gg0(v42, v35, v41), v34), v44), x6)
88      +v47 = Hs.hs.rotl(v31, 9n)
89      +v48 = Hs.hs.rotl(v35, 19n)
90      +v49 = hs.sm3.p0(v46)
91      +v50 = Hs.hs.rotl(v45, 12n)
92      +v51 = Hs.hs.rotl(U32.add(U32.add(v50, v49), 3861023932), 7n)
93      +v52 = U32.add(U32.add(U32.add(hs.sm3.ff0(v45, v38, v47), v40), U32.xor(v51, v50)), U32.xor(x7, x11))
94      +v53 = U32.add(U32.add(U32.add(hs.sm3.gg0(v49, v42, v48), v41), v51), x7)
95      +v54 = Hs.hs.rotl(v38, 9n)
96      +v55 = Hs.hs.rotl(v42, 19n)
97      +v56 = hs.sm3.p0(v53)
98      +v57 = Hs.hs.rotl(v52, 12n)
99      +v58 = Hs.hs.rotl(U32.add(U32.add(v57, v56), 3427080569), 7n)
100      +v59 = U32.add(U32.add(U32.add(hs.sm3.ff0(v52, v45, v54), v47), U32.xor(v58, v57)), U32.xor(x8, x12))
101      +v60 = U32.add(U32.add(U32.add(hs.sm3.gg0(v56, v49, v55), v48), v58), x8)
102      +v61 = Hs.hs.rotl(v45, 9n)
103      +v62 = Hs.hs.rotl(v49, 19n)
104      +v63 = hs.sm3.p0(v60)
105      +v64 = Hs.hs.rotl(v59, 12n)
106      +v65 = Hs.hs.rotl(U32.add(U32.add(v64, v63), 2559193843), 7n)
107      +v66 = U32.add(U32.add(U32.add(hs.sm3.ff0(v59, v52, v61), v54), U32.xor(v65, v64)), U32.xor(x9, x13))
108      +v67 = U32.add(U32.add(U32.add(hs.sm3.gg0(v63, v56, v62), v55), v65), x9)
109      +v68 = Hs.hs.rotl(v52, 9n)
110      +v69 = Hs.hs.rotl(v56, 19n)
111      +v70 = hs.sm3.p0(v67)
112      +v71 = Hs.hs.rotl(v66, 12n)
113      +v72 = Hs.hs.rotl(U32.add(U32.add(v71, v70), 823420391), 7n)
114      +v73 = U32.add(U32.add(U32.add(hs.sm3.ff0(v66, v59, v68), v61), U32.xor(v72, v71)), U32.xor(x10, x14))
115      +v74 = U32.add(U32.add(U32.add(hs.sm3.gg0(v70, v63, v69), v62), v72), x10)
116      +v75 = Hs.hs.rotl(v59, 9n)
117      +v76 = Hs.hs.rotl(v63, 19n)
118      +v77 = hs.sm3.p0(v74)
119      +v78 = Hs.hs.rotl(v73, 12n)
120      +v79 = Hs.hs.rotl(U32.add(U32.add(v78, v77), 1646840782), 7n)
121      +v80 = U32.add(U32.add(U32.add(hs.sm3.ff0(v73, v66, v75), v68), U32.xor(v79, v78)), U32.xor(x11, x15))
122      +v81 = U32.add(U32.add(U32.add(hs.sm3.gg0(v77, v70, v76), v69), v79), x11)
123      +v82 = Hs.hs.rotl(v66, 9n)
124      +v83 = Hs.hs.rotl(v70, 19n)
125      +v84 = hs.sm3.p0(v81)
126      +w16 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x0, x7), Hs.hs.rotl(x13, 15n))), Hs.hs.rotl(x3, 7n)), x10)
127      +v85 = Hs.hs.rotl(v80, 12n)
128      +v86 = Hs.hs.rotl(U32.add(U32.add(v85, v84), 3293681564), 7n)
129      +v87 = U32.add(U32.add(U32.add(hs.sm3.ff0(v80, v73, v82), v75), U32.xor(v86, v85)), U32.xor(x12, w16))
130      +v88 = U32.add(U32.add(U32.add(hs.sm3.gg0(v84, v77, v83), v76), v86), x12)
131      +v89 = Hs.hs.rotl(v73, 9n)
132      +v90 = Hs.hs.rotl(v77, 19n)
133      +v91 = hs.sm3.p0(v88)
134      +w17 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x1, x8), Hs.hs.rotl(x14, 15n))), Hs.hs.rotl(x4, 7n)), x11)
135      +v92 = Hs.hs.rotl(v87, 12n)
136      +v93 = Hs.hs.rotl(U32.add(U32.add(v92, v91), 2292395833), 7n)
137      +v94 = U32.add(U32.add(U32.add(hs.sm3.ff0(v87, v80, v89), v82), U32.xor(v93, v92)), U32.xor(x13, w17))
138      +v95 = U32.add(U32.add(U32.add(hs.sm3.gg0(v91, v84, v90), v83), v93), x13)
139      +v96 = Hs.hs.rotl(v80, 9n)
140      +v97 = Hs.hs.rotl(v84, 19n)
141      +v98 = hs.sm3.p0(v95)
142      +w18 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x2, x9), Hs.hs.rotl(x15, 15n))), Hs.hs.rotl(x5, 7n)), x12)
143      +v99 = Hs.hs.rotl(v94, 12n)
144      +v100 = Hs.hs.rotl(U32.add(U32.add(v99, v98), 289824371), 7n)
145      +v101 = U32.add(U32.add(U32.add(hs.sm3.ff0(v94, v87, v96), v89), U32.xor(v100, v99)), U32.xor(x14, w18))
146      +v102 = U32.add(U32.add(U32.add(hs.sm3.gg0(v98, v91, v97), v90), v100), x14)
147      +v103 = Hs.hs.rotl(v87, 9n)
148      +v104 = Hs.hs.rotl(v91, 19n)
149      +v105 = hs.sm3.p0(v102)
150      +w19 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x3, x10), Hs.hs.rotl(w16, 15n))), Hs.hs.rotl(x6, 7n)), x13)
151      +v106 = Hs.hs.rotl(v101, 12n)
152      +v107 = Hs.hs.rotl(U32.add(U32.add(v106, v105), 579648742), 7n)
153      +v108 = U32.add(U32.add(U32.add(hs.sm3.ff0(v101, v94, v103), v96), U32.xor(v107, v106)), U32.xor(x15, w19))
154      +v109 = U32.add(U32.add(U32.add(hs.sm3.gg0(v105, v98, v104), v97), v107), x15)
155      +v110 = Hs.hs.rotl(v94, 9n)
156      +v111 = Hs.hs.rotl(v98, 19n)
157      +v112 = hs.sm3.p0(v109)
158      # rounds 16 to 31
159      +w20 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x4, x11), Hs.hs.rotl(w17, 15n))), Hs.hs.rotl(x7, 7n)), x14)
160      +v113 = Hs.hs.rotl(v108, 12n)
161      +v114 = Hs.hs.rotl(U32.add(U32.add(v113, v112), 2643098247), 7n)
162      +v115 = U32.add(U32.add(U32.add(hs.sm3.ff1(v108, v101, v110), v103), U32.xor(v114, v113)), U32.xor(w16, w20))
163      +v116 = U32.add(U32.add(U32.add(hs.sm3.gg1(v112, v105, v111), v104), v114), w16)
164      +v117 = Hs.hs.rotl(v101, 9n)
165      +v118 = Hs.hs.rotl(v105, 19n)
166      +v119 = hs.sm3.p0(v116)
167      +w21 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x5, x12), Hs.hs.rotl(w18, 15n))), Hs.hs.rotl(x8, 7n)), x15)
168      +v120 = Hs.hs.rotl(v115, 12n)
169      +v121 = Hs.hs.rotl(U32.add(U32.add(v120, v119), 991229199), 7n)
170      +v122 = U32.add(U32.add(U32.add(hs.sm3.ff1(v115, v108, v117), v110), U32.xor(v121, v120)), U32.xor(w17, w21))
171      +v123 = U32.add(U32.add(U32.add(hs.sm3.gg1(v119, v112, v118), v111), v121), w17)
172      +v124 = Hs.hs.rotl(v108, 9n)
173      +v125 = Hs.hs.rotl(v112, 19n)
174      +v126 = hs.sm3.p0(v123)
175      +w22 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x6, x13), Hs.hs.rotl(w19, 15n))), Hs.hs.rotl(x9, 7n)), w16)
176      +v127 = Hs.hs.rotl(v122, 12n)
177      +v128 = Hs.hs.rotl(U32.add(U32.add(v127, v126), 1982458398), 7n)
178      +v129 = U32.add(U32.add(U32.add(hs.sm3.ff1(v122, v115, v124), v117), U32.xor(v128, v127)), U32.xor(w18, w22))
179      +v130 = U32.add(U32.add(U32.add(hs.sm3.gg1(v126, v119, v125), v118), v128), w18)
180      +v131 = Hs.hs.rotl(v115, 9n)
181      +v132 = Hs.hs.rotl(v119, 19n)
182      +v133 = hs.sm3.p0(v130)
183      +w23 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x7, x14), Hs.hs.rotl(w20, 15n))), Hs.hs.rotl(x10, 7n)), w17)
184      +v134 = Hs.hs.rotl(v129, 12n)
185      +v135 = Hs.hs.rotl(U32.add(U32.add(v134, v133), 3964916796), 7n)
186      +v136 = U32.add(U32.add(U32.add(hs.sm3.ff1(v129, v122, v131), v124), U32.xor(v135, v134)), U32.xor(w19, w23))
187      +v137 = U32.add(U32.add(U32.add(hs.sm3.gg1(v133, v126, v132), v125), v135), w19)
188      +v138 = Hs.hs.rotl(v122, 9n)
189      +v139 = Hs.hs.rotl(v126, 19n)
190      +v140 = hs.sm3.p0(v137)
191      +w24 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x8, x15), Hs.hs.rotl(w21, 15n))), Hs.hs.rotl(x11, 7n)), w18)
192      +v141 = Hs.hs.rotl(v136, 12n)
193      +v142 = Hs.hs.rotl(U32.add(U32.add(v141, v140), 3634866297), 7n)
194      +v143 = U32.add(U32.add(U32.add(hs.sm3.ff1(v136, v129, v138), v131), U32.xor(v142, v141)), U32.xor(w20, w24))
195      +v144 = U32.add(U32.add(U32.add(hs.sm3.gg1(v140, v133, v139), v132), v142), w20)
196      +v145 = Hs.hs.rotl(v129, 9n)
197      +v146 = Hs.hs.rotl(v133, 19n)
198      +v147 = hs.sm3.p0(v144)
199      +w25 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x9, w16), Hs.hs.rotl(w22, 15n))), Hs.hs.rotl(x12, 7n)), w19)
200      +v148 = Hs.hs.rotl(v143, 12n)
201      +v149 = Hs.hs.rotl(U32.add(U32.add(v148, v147), 2974765299), 7n)
202      +v150 = U32.add(U32.add(U32.add(hs.sm3.ff1(v143, v136, v145), v138), U32.xor(v149, v148)), U32.xor(w21, w25))
203      +v151 = U32.add(U32.add(U32.add(hs.sm3.gg1(v147, v140, v146), v139), v149), w21)
204      +v152 = Hs.hs.rotl(v136, 9n)
205      +v153 = Hs.hs.rotl(v140, 19n)
206      +v154 = hs.sm3.p0(v151)
207      +w26 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x10, w17), Hs.hs.rotl(w23, 15n))), Hs.hs.rotl(x13, 7n)), w20)
208      +v155 = Hs.hs.rotl(v150, 12n)
209      +v156 = Hs.hs.rotl(U32.add(U32.add(v155, v154), 1654563303), 7n)
210      +v157 = U32.add(U32.add(U32.add(hs.sm3.ff1(v150, v143, v152), v145), U32.xor(v156, v155)), U32.xor(w22, w26))
211      +v158 = U32.add(U32.add(U32.add(hs.sm3.gg1(v154, v147, v153), v146), v156), w22)
212      +v159 = Hs.hs.rotl(v143, 9n)
213      +v160 = Hs.hs.rotl(v147, 19n)
214      +v161 = hs.sm3.p0(v158)
215      +w27 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x11, w18), Hs.hs.rotl(w24, 15n))), Hs.hs.rotl(x14, 7n)), w21)
216      +v162 = Hs.hs.rotl(v157, 12n)
217      +v163 = Hs.hs.rotl(U32.add(U32.add(v162, v161), 3309126606), 7n)
218      +v164 = U32.add(U32.add(U32.add(hs.sm3.ff1(v157, v150, v159), v152), U32.xor(v163, v162)), U32.xor(w23, w27))
219      +v165 = U32.add(U32.add(U32.add(hs.sm3.gg1(v161, v154, v160), v153), v163), w23)
220      +v166 = Hs.hs.rotl(v150, 9n)
221      +v167 = Hs.hs.rotl(v154, 19n)
222      +v168 = hs.sm3.p0(v165)
223      +w28 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x12, w19), Hs.hs.rotl(w25, 15n))), Hs.hs.rotl(x15, 7n)), w22)
224      +v169 = Hs.hs.rotl(v164, 12n)
225      +v170 = Hs.hs.rotl(U32.add(U32.add(v169, v168), 2323285917), 7n)
226      +v171 = U32.add(U32.add(U32.add(hs.sm3.ff1(v164, v157, v166), v159), U32.xor(v170, v169)), U32.xor(w24, w28))
227      +v172 = U32.add(U32.add(U32.add(hs.sm3.gg1(v168, v161, v167), v160), v170), w24)
228      +v173 = Hs.hs.rotl(v157, 9n)
229      +v174 = Hs.hs.rotl(v161, 19n)
230      +v175 = hs.sm3.p0(v172)
231      +w29 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x13, w20), Hs.hs.rotl(w26, 15n))), Hs.hs.rotl(w16, 7n)), w23)
232      +v176 = Hs.hs.rotl(v171, 12n)
233      +v177 = Hs.hs.rotl(U32.add(U32.add(v176, v175), 351604539), 7n)
234      +v178 = U32.add(U32.add(U32.add(hs.sm3.ff1(v171, v164, v173), v166), U32.xor(v177, v176)), U32.xor(w25, w29))
235      +v179 = U32.add(U32.add(U32.add(hs.sm3.gg1(v175, v168, v174), v167), v177), w25)
236      +v180 = Hs.hs.rotl(v164, 9n)
237      +v181 = Hs.hs.rotl(v168, 19n)
238      +v182 = hs.sm3.p0(v179)
239      +w30 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x14, w21), Hs.hs.rotl(w27, 15n))), Hs.hs.rotl(w17, 7n)), w24)
240      +v183 = Hs.hs.rotl(v178, 12n)
241      +v184 = Hs.hs.rotl(U32.add(U32.add(v183, v182), 703209078), 7n)
242      +v185 = U32.add(U32.add(U32.add(hs.sm3.ff1(v178, v171, v180), v173), U32.xor(v184, v183)), U32.xor(w26, w30))
243      +v186 = U32.add(U32.add(U32.add(hs.sm3.gg1(v182, v175, v181), v174), v184), w26)
244      +v187 = Hs.hs.rotl(v171, 9n)
245      +v188 = Hs.hs.rotl(v175, 19n)
246      +v189 = hs.sm3.p0(v186)
247      +w31 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(x15, w22), Hs.hs.rotl(w28, 15n))), Hs.hs.rotl(w18, 7n)), w25)
248      +v190 = Hs.hs.rotl(v185, 12n)
249      +v191 = Hs.hs.rotl(U32.add(U32.add(v190, v189), 1406418156), 7n)
250      +v192 = U32.add(U32.add(U32.add(hs.sm3.ff1(v185, v178, v187), v180), U32.xor(v191, v190)), U32.xor(w27, w31))
251      +v193 = U32.add(U32.add(U32.add(hs.sm3.gg1(v189, v182, v188), v181), v191), w27)
252      +v194 = Hs.hs.rotl(v178, 9n)
253      +v195 = Hs.hs.rotl(v182, 19n)
254      +v196 = hs.sm3.p0(v193)
255      +w32 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w16, w23), Hs.hs.rotl(w29, 15n))), Hs.hs.rotl(w19, 7n)), w26)
256      +v197 = Hs.hs.rotl(v192, 12n)
257      +v198 = Hs.hs.rotl(U32.add(U32.add(v197, v196), 2812836312), 7n)
258      +v199 = U32.add(U32.add(U32.add(hs.sm3.ff1(v192, v185, v194), v187), U32.xor(v198, v197)), U32.xor(w28, w32))
259      +v200 = U32.add(U32.add(U32.add(hs.sm3.gg1(v196, v189, v195), v188), v198), w28)
260      +v201 = Hs.hs.rotl(v185, 9n)
261      +v202 = Hs.hs.rotl(v189, 19n)
262      +v203 = hs.sm3.p0(v200)
263      +w33 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w17, w24), Hs.hs.rotl(w30, 15n))), Hs.hs.rotl(w20, 7n)), w27)
264      +v204 = Hs.hs.rotl(v199, 12n)
265      +v205 = Hs.hs.rotl(U32.add(U32.add(v204, v203), 1330705329), 7n)
266      +v206 = U32.add(U32.add(U32.add(hs.sm3.ff1(v199, v192, v201), v194), U32.xor(v205, v204)), U32.xor(w29, w33))
267      +v207 = U32.add(U32.add(U32.add(hs.sm3.gg1(v203, v196, v202), v195), v205), w29)
268      +v208 = Hs.hs.rotl(v192, 9n)
269      +v209 = Hs.hs.rotl(v196, 19n)
270      +v210 = hs.sm3.p0(v207)
271      +w34 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w18, w25), Hs.hs.rotl(w31, 15n))), Hs.hs.rotl(w21, 7n)), w28)
272      +v211 = Hs.hs.rotl(v206, 12n)
273      +v212 = Hs.hs.rotl(U32.add(U32.add(v211, v210), 2661410658), 7n)
274      +v213 = U32.add(U32.add(U32.add(hs.sm3.ff1(v206, v199, v208), v201), U32.xor(v212, v211)), U32.xor(w30, w34))
275      +v214 = U32.add(U32.add(U32.add(hs.sm3.gg1(v210, v203, v209), v202), v212), w30)
276      +v215 = Hs.hs.rotl(v199, 9n)
277      +v216 = Hs.hs.rotl(v203, 19n)
278      +v217 = hs.sm3.p0(v214)
279      +w35 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w19, w26), Hs.hs.rotl(w32, 15n))), Hs.hs.rotl(w22, 7n)), w29)
280      +v218 = Hs.hs.rotl(v213, 12n)
281      +v219 = Hs.hs.rotl(U32.add(U32.add(v218, v217), 1027854021), 7n)
282      +v220 = U32.add(U32.add(U32.add(hs.sm3.ff1(v213, v206, v215), v208), U32.xor(v219, v218)), U32.xor(w31, w35))
283      +v221 = U32.add(U32.add(U32.add(hs.sm3.gg1(v217, v210, v216), v209), v219), w31)
284      +v222 = Hs.hs.rotl(v206, 9n)
285      +v223 = Hs.hs.rotl(v210, 19n)
286      +v224 = hs.sm3.p0(v221)
287      # rounds 32 to 47
288      +w36 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w20, w27), Hs.hs.rotl(w33, 15n))), Hs.hs.rotl(w23, 7n)), w30)
289      +v225 = Hs.hs.rotl(v220, 12n)
290      +v226 = Hs.hs.rotl(U32.add(U32.add(v225, v224), 2055708042), 7n)
291      +v227 = U32.add(U32.add(U32.add(hs.sm3.ff1(v220, v213, v222), v215), U32.xor(v226, v225)), U32.xor(w32, w36))
292      +v228 = U32.add(U32.add(U32.add(hs.sm3.gg1(v224, v217, v223), v216), v226), w32)
293      +v229 = Hs.hs.rotl(v213, 9n)
294      +v230 = Hs.hs.rotl(v217, 19n)
295      +v231 = hs.sm3.p0(v228)
296      +w37 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w21, w28), Hs.hs.rotl(w34, 15n))), Hs.hs.rotl(w24, 7n)), w31)
297      +v232 = Hs.hs.rotl(v227, 12n)
298      +v233 = Hs.hs.rotl(U32.add(U32.add(v232, v231), 4111416084), 7n)
299      +v234 = U32.add(U32.add(U32.add(hs.sm3.ff1(v227, v220, v229), v222), U32.xor(v233, v232)), U32.xor(w33, w37))
300      +v235 = U32.add(U32.add(U32.add(hs.sm3.gg1(v231, v224, v230), v223), v233), w33)
301      +v236 = Hs.hs.rotl(v220, 9n)
302      +v237 = Hs.hs.rotl(v224, 19n)
303      +v238 = hs.sm3.p0(v235)
304      +w38 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w22, w29), Hs.hs.rotl(w35, 15n))), Hs.hs.rotl(w25, 7n)), w32)
305      +v239 = Hs.hs.rotl(v234, 12n)
306      +v240 = Hs.hs.rotl(U32.add(U32.add(v239, v238), 3927864873), 7n)
307      +v241 = U32.add(U32.add(U32.add(hs.sm3.ff1(v234, v227, v236), v229), U32.xor(v240, v239)), U32.xor(w34, w38))
308      +v242 = U32.add(U32.add(U32.add(hs.sm3.gg1(v238, v231, v237), v230), v240), w34)
309      +v243 = Hs.hs.rotl(v227, 9n)
310      +v244 = Hs.hs.rotl(v231, 19n)
311      +v245 = hs.sm3.p0(v242)
312      +w39 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w23, w30), Hs.hs.rotl(w36, 15n))), Hs.hs.rotl(w26, 7n)), w33)
313      +v246 = Hs.hs.rotl(v241, 12n)
314      +v247 = Hs.hs.rotl(U32.add(U32.add(v246, v245), 3560762451), 7n)
315      +v248 = U32.add(U32.add(U32.add(hs.sm3.ff1(v241, v234, v243), v236), U32.xor(v247, v246)), U32.xor(w35, w39))
316      +v249 = U32.add(U32.add(U32.add(hs.sm3.gg1(v245, v238, v244), v237), v247), w35)
317      +v250 = Hs.hs.rotl(v234, 9n)
318      +v251 = Hs.hs.rotl(v238, 19n)
319      +v252 = hs.sm3.p0(v249)
320      +w40 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w24, w31), Hs.hs.rotl(w37, 15n))), Hs.hs.rotl(w27, 7n)), w34)
321      +v253 = Hs.hs.rotl(v248, 12n)
322      +v254 = Hs.hs.rotl(U32.add(U32.add(v253, v252), 2826557607), 7n)
323      +v255 = U32.add(U32.add(U32.add(hs.sm3.ff1(v248, v241, v250), v243), U32.xor(v254, v253)), U32.xor(w36, w40))
324      +v256 = U32.add(U32.add(U32.add(hs.sm3.gg1(v252, v245, v251), v244), v254), w36)
325      +v257 = Hs.hs.rotl(v241, 9n)
326      +v258 = Hs.hs.rotl(v245, 19n)
327      +v259 = hs.sm3.p0(v256)
328      +w41 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w25, w32), Hs.hs.rotl(w38, 15n))), Hs.hs.rotl(w28, 7n)), w35)
329      +v260 = Hs.hs.rotl(v255, 12n)
330      +v261 = Hs.hs.rotl(U32.add(U32.add(v260, v259), 1358147919), 7n)
331      +v262 = U32.add(U32.add(U32.add(hs.sm3.ff1(v255, v248, v257), v250), U32.xor(v261, v260)), U32.xor(w37, w41))
332      +v263 = U32.add(U32.add(U32.add(hs.sm3.gg1(v259, v252, v258), v251), v261), w37)
333      +v264 = Hs.hs.rotl(v248, 9n)
334      +v265 = Hs.hs.rotl(v252, 19n)
335      +v266 = hs.sm3.p0(v263)
336      +w42 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w26, w33), Hs.hs.rotl(w39, 15n))), Hs.hs.rotl(w29, 7n)), w36)
337      +v267 = Hs.hs.rotl(v262, 12n)
338      +v268 = Hs.hs.rotl(U32.add(U32.add(v267, v266), 2716295838), 7n)
339      +v269 = U32.add(U32.add(U32.add(hs.sm3.ff1(v262, v255, v264), v257), U32.xor(v268, v267)), U32.xor(w38, w42))
340      +v270 = U32.add(U32.add(U32.add(hs.sm3.gg1(v266, v259, v265), v258), v268), w38)
341      +v271 = Hs.hs.rotl(v255, 9n)
342      +v272 = Hs.hs.rotl(v259, 19n)
343      +v273 = hs.sm3.p0(v270)
344      +w43 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w27, w34), Hs.hs.rotl(w40, 15n))), Hs.hs.rotl(w30, 7n)), w37)
345      +v274 = Hs.hs.rotl(v269, 12n)
346      +v275 = Hs.hs.rotl(U32.add(U32.add(v274, v273), 1137624381), 7n)
347      +v276 = U32.add(U32.add(U32.add(hs.sm3.ff1(v269, v262, v271), v264), U32.xor(v275, v274)), U32.xor(w39, w43))
348      +v277 = U32.add(U32.add(U32.add(hs.sm3.gg1(v273, v266, v272), v265), v275), w39)
349      +v278 = Hs.hs.rotl(v262, 9n)
350      +v279 = Hs.hs.rotl(v266, 19n)
351      +v280 = hs.sm3.p0(v277)
352      +w44 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w28, w35), Hs.hs.rotl(w41, 15n))), Hs.hs.rotl(w31, 7n)), w38)
353      +v281 = Hs.hs.rotl(v276, 12n)
354      +v282 = Hs.hs.rotl(U32.add(U32.add(v281, v280), 2275248762), 7n)
355      +v283 = U32.add(U32.add(U32.add(hs.sm3.ff1(v276, v269, v278), v271), U32.xor(v282, v281)), U32.xor(w40, w44))
356      +v284 = U32.add(U32.add(U32.add(hs.sm3.gg1(v280, v273, v279), v272), v282), w40)
357      +v285 = Hs.hs.rotl(v269, 9n)
358      +v286 = Hs.hs.rotl(v273, 19n)
359      +v287 = hs.sm3.p0(v284)
360      +w45 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w29, w36), Hs.hs.rotl(w42, 15n))), Hs.hs.rotl(w32, 7n)), w39)
361      +v288 = Hs.hs.rotl(v283, 12n)
362      +v289 = Hs.hs.rotl(U32.add(U32.add(v288, v287), 255530229), 7n)
363      +v290 = U32.add(U32.add(U32.add(hs.sm3.ff1(v283, v276, v285), v278), U32.xor(v289, v288)), U32.xor(w41, w45))
364      +v291 = U32.add(U32.add(U32.add(hs.sm3.gg1(v287, v280, v286), v279), v289), w41)
365      +v292 = Hs.hs.rotl(v276, 9n)
366      +v293 = Hs.hs.rotl(v280, 19n)
367      +v294 = hs.sm3.p0(v291)
368      +w46 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w30, w37), Hs.hs.rotl(w43, 15n))), Hs.hs.rotl(w33, 7n)), w40)
369      +v295 = Hs.hs.rotl(v290, 12n)
370      +v296 = Hs.hs.rotl(U32.add(U32.add(v295, v294), 511060458), 7n)
371      +v297 = U32.add(U32.add(U32.add(hs.sm3.ff1(v290, v283, v292), v285), U32.xor(v296, v295)), U32.xor(w42, w46))
372      +v298 = U32.add(U32.add(U32.add(hs.sm3.gg1(v294, v287, v293), v286), v296), w42)
373      +v299 = Hs.hs.rotl(v283, 9n)
374      +v300 = Hs.hs.rotl(v287, 19n)
375      +v301 = hs.sm3.p0(v298)
376      +w47 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w31, w38), Hs.hs.rotl(w44, 15n))), Hs.hs.rotl(w34, 7n)), w41)
377      +v302 = Hs.hs.rotl(v297, 12n)
378      +v303 = Hs.hs.rotl(U32.add(U32.add(v302, v301), 1022120916), 7n)
379      +v304 = U32.add(U32.add(U32.add(hs.sm3.ff1(v297, v290, v299), v292), U32.xor(v303, v302)), U32.xor(w43, w47))
380      +v305 = U32.add(U32.add(U32.add(hs.sm3.gg1(v301, v294, v300), v293), v303), w43)
381      +v306 = Hs.hs.rotl(v290, 9n)
382      +v307 = Hs.hs.rotl(v294, 19n)
383      +v308 = hs.sm3.p0(v305)
384      +w48 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w32, w39), Hs.hs.rotl(w45, 15n))), Hs.hs.rotl(w35, 7n)), w42)
385      +v309 = Hs.hs.rotl(v304, 12n)
386      +v310 = Hs.hs.rotl(U32.add(U32.add(v309, v308), 2044241832), 7n)
387      +v311 = U32.add(U32.add(U32.add(hs.sm3.ff1(v304, v297, v306), v299), U32.xor(v310, v309)), U32.xor(w44, w48))
388      +v312 = U32.add(U32.add(U32.add(hs.sm3.gg1(v308, v301, v307), v300), v310), w44)
389      +v313 = Hs.hs.rotl(v297, 9n)
390      +v314 = Hs.hs.rotl(v301, 19n)
391      +v315 = hs.sm3.p0(v312)
392      +w49 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w33, w40), Hs.hs.rotl(w46, 15n))), Hs.hs.rotl(w36, 7n)), w43)
393      +v316 = Hs.hs.rotl(v311, 12n)
394      +v317 = Hs.hs.rotl(U32.add(U32.add(v316, v315), 4088483664), 7n)
395      +v318 = U32.add(U32.add(U32.add(hs.sm3.ff1(v311, v304, v313), v306), U32.xor(v317, v316)), U32.xor(w45, w49))
396      +v319 = U32.add(U32.add(U32.add(hs.sm3.gg1(v315, v308, v314), v307), v317), w45)
397      +v320 = Hs.hs.rotl(v304, 9n)
398      +v321 = Hs.hs.rotl(v308, 19n)
399      +v322 = hs.sm3.p0(v319)
400      +w50 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w34, w41), Hs.hs.rotl(w47, 15n))), Hs.hs.rotl(w37, 7n)), w44)
401      +v323 = Hs.hs.rotl(v318, 12n)
402      +v324 = Hs.hs.rotl(U32.add(U32.add(v323, v322), 3882000033), 7n)
403      +v325 = U32.add(U32.add(U32.add(hs.sm3.ff1(v318, v311, v320), v313), U32.xor(v324, v323)), U32.xor(w46, w50))
404      +v326 = U32.add(U32.add(U32.add(hs.sm3.gg1(v322, v315, v321), v314), v324), w46)
405      +v327 = Hs.hs.rotl(v311, 9n)
406      +v328 = Hs.hs.rotl(v315, 19n)
407      +v329 = hs.sm3.p0(v326)
408      +w51 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w35, w42), Hs.hs.rotl(w48, 15n))), Hs.hs.rotl(w38, 7n)), w45)
409      +v330 = Hs.hs.rotl(v325, 12n)
410      +v331 = Hs.hs.rotl(U32.add(U32.add(v330, v329), 3469032771), 7n)
411      +v332 = U32.add(U32.add(U32.add(hs.sm3.ff1(v325, v318, v327), v320), U32.xor(v331, v330)), U32.xor(w47, w51))
412      +v333 = U32.add(U32.add(U32.add(hs.sm3.gg1(v329, v322, v328), v321), v331), w47)
413      +v334 = Hs.hs.rotl(v318, 9n)
414      +v335 = Hs.hs.rotl(v322, 19n)
415      +v336 = hs.sm3.p0(v333)
416      # rounds 48 to 63
417      +w52 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w36, w43), Hs.hs.rotl(w49, 15n))), Hs.hs.rotl(w39, 7n)), w46)
418      +v337 = Hs.hs.rotl(v332, 12n)
419      +v338 = Hs.hs.rotl(U32.add(U32.add(v337, v336), 2643098247), 7n)
420      +v339 = U32.add(U32.add(U32.add(hs.sm3.ff1(v332, v325, v334), v327), U32.xor(v338, v337)), U32.xor(w48, w52))
421      +v340 = U32.add(U32.add(U32.add(hs.sm3.gg1(v336, v329, v335), v328), v338), w48)
422      +v341 = Hs.hs.rotl(v325, 9n)
423      +v342 = Hs.hs.rotl(v329, 19n)
424      +v343 = hs.sm3.p0(v340)
425      +w53 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w37, w44), Hs.hs.rotl(w50, 15n))), Hs.hs.rotl(w40, 7n)), w47)
426      +v344 = Hs.hs.rotl(v339, 12n)
427      +v345 = Hs.hs.rotl(U32.add(U32.add(v344, v343), 991229199), 7n)
428      +v346 = U32.add(U32.add(U32.add(hs.sm3.ff1(v339, v332, v341), v334), U32.xor(v345, v344)), U32.xor(w49, w53))
429      +v347 = U32.add(U32.add(U32.add(hs.sm3.gg1(v343, v336, v342), v335), v345), w49)
430      +v348 = Hs.hs.rotl(v332, 9n)
431      +v349 = Hs.hs.rotl(v336, 19n)
432      +v350 = hs.sm3.p0(v347)
433      +w54 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w38, w45), Hs.hs.rotl(w51, 15n))), Hs.hs.rotl(w41, 7n)), w48)
434      +v351 = Hs.hs.rotl(v346, 12n)
435      +v352 = Hs.hs.rotl(U32.add(U32.add(v351, v350), 1982458398), 7n)
436      +v353 = U32.add(U32.add(U32.add(hs.sm3.ff1(v346, v339, v348), v341), U32.xor(v352, v351)), U32.xor(w50, w54))
437      +v354 = U32.add(U32.add(U32.add(hs.sm3.gg1(v350, v343, v349), v342), v352), w50)
438      +v355 = Hs.hs.rotl(v339, 9n)
439      +v356 = Hs.hs.rotl(v343, 19n)
440      +v357 = hs.sm3.p0(v354)
441      +w55 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w39, w46), Hs.hs.rotl(w52, 15n))), Hs.hs.rotl(w42, 7n)), w49)
442      +v358 = Hs.hs.rotl(v353, 12n)
443      +v359 = Hs.hs.rotl(U32.add(U32.add(v358, v357), 3964916796), 7n)
444      +v360 = U32.add(U32.add(U32.add(hs.sm3.ff1(v353, v346, v355), v348), U32.xor(v359, v358)), U32.xor(w51, w55))
445      +v361 = U32.add(U32.add(U32.add(hs.sm3.gg1(v357, v350, v356), v349), v359), w51)
446      +v362 = Hs.hs.rotl(v346, 9n)
447      +v363 = Hs.hs.rotl(v350, 19n)
448      +v364 = hs.sm3.p0(v361)
449      +w56 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w40, w47), Hs.hs.rotl(w53, 15n))), Hs.hs.rotl(w43, 7n)), w50)
450      +v365 = Hs.hs.rotl(v360, 12n)
451      +v366 = Hs.hs.rotl(U32.add(U32.add(v365, v364), 3634866297), 7n)
452      +v367 = U32.add(U32.add(U32.add(hs.sm3.ff1(v360, v353, v362), v355), U32.xor(v366, v365)), U32.xor(w52, w56))
453      +v368 = U32.add(U32.add(U32.add(hs.sm3.gg1(v364, v357, v363), v356), v366), w52)
454      +v369 = Hs.hs.rotl(v353, 9n)
455      +v370 = Hs.hs.rotl(v357, 19n)
456      +v371 = hs.sm3.p0(v368)
457      +w57 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w41, w48), Hs.hs.rotl(w54, 15n))), Hs.hs.rotl(w44, 7n)), w51)
458      +v372 = Hs.hs.rotl(v367, 12n)
459      +v373 = Hs.hs.rotl(U32.add(U32.add(v372, v371), 2974765299), 7n)
460      +v374 = U32.add(U32.add(U32.add(hs.sm3.ff1(v367, v360, v369), v362), U32.xor(v373, v372)), U32.xor(w53, w57))
461      +v375 = U32.add(U32.add(U32.add(hs.sm3.gg1(v371, v364, v370), v363), v373), w53)
462      +v376 = Hs.hs.rotl(v360, 9n)
463      +v377 = Hs.hs.rotl(v364, 19n)
464      +v378 = hs.sm3.p0(v375)
465      +w58 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w42, w49), Hs.hs.rotl(w55, 15n))), Hs.hs.rotl(w45, 7n)), w52)
466      +v379 = Hs.hs.rotl(v374, 12n)
467      +v380 = Hs.hs.rotl(U32.add(U32.add(v379, v378), 1654563303), 7n)
468      +v381 = U32.add(U32.add(U32.add(hs.sm3.ff1(v374, v367, v376), v369), U32.xor(v380, v379)), U32.xor(w54, w58))
469      +v382 = U32.add(U32.add(U32.add(hs.sm3.gg1(v378, v371, v377), v370), v380), w54)
470      +v383 = Hs.hs.rotl(v367, 9n)
471      +v384 = Hs.hs.rotl(v371, 19n)
472      +v385 = hs.sm3.p0(v382)
473      +w59 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w43, w50), Hs.hs.rotl(w56, 15n))), Hs.hs.rotl(w46, 7n)), w53)
474      +v386 = Hs.hs.rotl(v381, 12n)
475      +v387 = Hs.hs.rotl(U32.add(U32.add(v386, v385), 3309126606), 7n)
476      +v388 = U32.add(U32.add(U32.add(hs.sm3.ff1(v381, v374, v383), v376), U32.xor(v387, v386)), U32.xor(w55, w59))
477      +v389 = U32.add(U32.add(U32.add(hs.sm3.gg1(v385, v378, v384), v377), v387), w55)
478      +v390 = Hs.hs.rotl(v374, 9n)
479      +v391 = Hs.hs.rotl(v378, 19n)
480      +v392 = hs.sm3.p0(v389)
481      +w60 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w44, w51), Hs.hs.rotl(w57, 15n))), Hs.hs.rotl(w47, 7n)), w54)
482      +v393 = Hs.hs.rotl(v388, 12n)
483      +v394 = Hs.hs.rotl(U32.add(U32.add(v393, v392), 2323285917), 7n)
484      +v395 = U32.add(U32.add(U32.add(hs.sm3.ff1(v388, v381, v390), v383), U32.xor(v394, v393)), U32.xor(w56, w60))
485      +v396 = U32.add(U32.add(U32.add(hs.sm3.gg1(v392, v385, v391), v384), v394), w56)
486      +v397 = Hs.hs.rotl(v381, 9n)
487      +v398 = Hs.hs.rotl(v385, 19n)
488      +v399 = hs.sm3.p0(v396)
489      +w61 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w45, w52), Hs.hs.rotl(w58, 15n))), Hs.hs.rotl(w48, 7n)), w55)
490      +v400 = Hs.hs.rotl(v395, 12n)
491      +v401 = Hs.hs.rotl(U32.add(U32.add(v400, v399), 351604539), 7n)
492      +v402 = U32.add(U32.add(U32.add(hs.sm3.ff1(v395, v388, v397), v390), U32.xor(v401, v400)), U32.xor(w57, w61))
493      +v403 = U32.add(U32.add(U32.add(hs.sm3.gg1(v399, v392, v398), v391), v401), w57)
494      +v404 = Hs.hs.rotl(v388, 9n)
495      +v405 = Hs.hs.rotl(v392, 19n)
496      +v406 = hs.sm3.p0(v403)
497      +w62 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w46, w53), Hs.hs.rotl(w59, 15n))), Hs.hs.rotl(w49, 7n)), w56)
498      +v407 = Hs.hs.rotl(v402, 12n)
499      +v408 = Hs.hs.rotl(U32.add(U32.add(v407, v406), 703209078), 7n)
500      +v409 = U32.add(U32.add(U32.add(hs.sm3.ff1(v402, v395, v404), v397), U32.xor(v408, v407)), U32.xor(w58, w62))
501      +v410 = U32.add(U32.add(U32.add(hs.sm3.gg1(v406, v399, v405), v398), v408), w58)
502      +v411 = Hs.hs.rotl(v395, 9n)
503      +v412 = Hs.hs.rotl(v399, 19n)
504      +v413 = hs.sm3.p0(v410)
505      +w63 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w47, w54), Hs.hs.rotl(w60, 15n))), Hs.hs.rotl(w50, 7n)), w57)
506      +v414 = Hs.hs.rotl(v409, 12n)
507      +v415 = Hs.hs.rotl(U32.add(U32.add(v414, v413), 1406418156), 7n)
508      +v416 = U32.add(U32.add(U32.add(hs.sm3.ff1(v409, v402, v411), v404), U32.xor(v415, v414)), U32.xor(w59, w63))
509      +v417 = U32.add(U32.add(U32.add(hs.sm3.gg1(v413, v406, v412), v405), v415), w59)
510      +v418 = Hs.hs.rotl(v402, 9n)
511      +v419 = Hs.hs.rotl(v406, 19n)
512      +v420 = hs.sm3.p0(v417)
513      +w64 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w48, w55), Hs.hs.rotl(w61, 15n))), Hs.hs.rotl(w51, 7n)), w58)
514      +v421 = Hs.hs.rotl(v416, 12n)
515      +v422 = Hs.hs.rotl(U32.add(U32.add(v421, v420), 2812836312), 7n)
516      +v423 = U32.add(U32.add(U32.add(hs.sm3.ff1(v416, v409, v418), v411), U32.xor(v422, v421)), U32.xor(w60, w64))
517      +v424 = U32.add(U32.add(U32.add(hs.sm3.gg1(v420, v413, v419), v412), v422), w60)
518      +v425 = Hs.hs.rotl(v409, 9n)
519      +v426 = Hs.hs.rotl(v413, 19n)
520      +v427 = hs.sm3.p0(v424)
521      +w65 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w49, w56), Hs.hs.rotl(w62, 15n))), Hs.hs.rotl(w52, 7n)), w59)
522      +v428 = Hs.hs.rotl(v423, 12n)
523      +v429 = Hs.hs.rotl(U32.add(U32.add(v428, v427), 1330705329), 7n)
524      +v430 = U32.add(U32.add(U32.add(hs.sm3.ff1(v423, v416, v425), v418), U32.xor(v429, v428)), U32.xor(w61, w65))
525      +v431 = U32.add(U32.add(U32.add(hs.sm3.gg1(v427, v420, v426), v419), v429), w61)
526      +v432 = Hs.hs.rotl(v416, 9n)
527      +v433 = Hs.hs.rotl(v420, 19n)
528      +v434 = hs.sm3.p0(v431)
529      +w66 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w50, w57), Hs.hs.rotl(w63, 15n))), Hs.hs.rotl(w53, 7n)), w60)
530      +v435 = Hs.hs.rotl(v430, 12n)
531      +v436 = Hs.hs.rotl(U32.add(U32.add(v435, v434), 2661410658), 7n)
532      +v437 = U32.add(U32.add(U32.add(hs.sm3.ff1(v430, v423, v432), v425), U32.xor(v436, v435)), U32.xor(w62, w66))
533      +v438 = U32.add(U32.add(U32.add(hs.sm3.gg1(v434, v427, v433), v426), v436), w62)
534      +v439 = Hs.hs.rotl(v423, 9n)
535      +v440 = Hs.hs.rotl(v427, 19n)
536      +v441 = hs.sm3.p0(v438)
537      +w67 = U32.xor(U32.xor(hs.sm3.p1(U32.xor(U32.xor(w51, w58), Hs.hs.rotl(w64, 15n))), Hs.hs.rotl(w54, 7n)), w61)
538      +v442 = Hs.hs.rotl(v437, 12n)
539      +v443 = Hs.hs.rotl(U32.add(U32.add(v442, v441), 1027854021), 7n)
540      +v444 = U32.add(U32.add(U32.add(hs.sm3.ff1(v437, v430, v439), v432), U32.xor(v443, v442)), U32.xor(w63, w67))
541      +v445 = U32.add(U32.add(U32.add(hs.sm3.gg1(v441, v434, v440), v433), v443), w63)
542      +v446 = Hs.hs.rotl(v430, 9n)
543      +v447 = Hs.hs.rotl(v434, 19n)
544      +v448 = hs.sm3.p0(v445)
545      Hs.HsW8{U32.xor(a0, v444), U32.xor(b0, v437), U32.xor(c0, v446), U32.xor(d0, v439), U32.xor(e0, v448), U32.xor(f0, v441), U32.xor(g0, v447), U32.xor(h0, v440)}
546# END GENERATED: sm3
547
548# The chaining value before any block (IV)
549def HsSm3.iv() -> Hs.HsW8:
550  Hs.HsW8{1937774191, 1226093241, 388252375, 3666478592, 2842636476, 372324522, 3817729613, 2969243214}
551
552# One 64-byte block (a list of another length is read as zero words: the
553# engine passes only whole blocks)
554def HsSm3.compress(cv: Hs.HsW8, blk: List<&2, U32>) -> Hs.HsW8:
555  hs.sm3.rounds(Hs.hs.block.be(blk), cv)
556
557def HsSm3.init() -> Hs.HsMdState<Hs.HsW8>:
558  Hs.HsMd.start(~Hs.HsW8, HsSm3.iv())
559
560def HsSm3.update(s: Hs.HsMdState<Hs.HsW8>, o: B.Octets) -> Hs.HsMdState<Hs.HsW8>:
561  Hs.HsMd.update(~Hs.HsW8, ~HsSm3.compress, ~63, s, o)
562
563# the digest of the bytes so far: the padding, then the eight words
564# big-endian
565def HsSm3.final(s: Hs.HsMdState<Hs.HsW8>) -> B.Octets:
566  Hs.HsMd.final_md(~Hs.HsW8, ~HsSm3.compress, ~63, ~Hs.hs.len.be, ~Hs.HsW8.be, s)
567
568# The digest in one call
569def HsSm3.digest(o: B.Octets) -> B.Octets:
570  HsSm3.final(HsSm3.update(HsSm3.init(), o))