diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.32
+
+* All C symbols now have the "crypton_" prefix.
+  [#7](https://github.com/kazu-yamamoto/crypton/pull/7)
+  [#8](https://github.com/kazu-yamamoto/crypton/pull/8)
+
 ## 0.31
 
 * Crypton is forked from cryptonite with the original authors permission.
diff --git a/Crypto/Cipher/AES/Primitive.hs b/Crypto/Cipher/AES/Primitive.hs
--- a/Crypto/Cipher/AES/Primitive.hs
+++ b/Crypto/Cipher/AES/Primitive.hs
@@ -566,80 +566,80 @@
                         withCCMKeyAndCopySt ctx ccm (c_aes_ccm_finish (castPtr t)) >> return ()
 
 ------------------------------------------------------------------------
-foreign import ccall "cryptonite_aes.h cryptonite_aes_initkey"
+foreign import ccall "crypton_aes.h crypton_aes_initkey"
     c_aes_init :: Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_ecb"
+foreign import ccall "crypton_aes.h crypton_aes_encrypt_ecb"
     c_aes_encrypt_ecb :: CString -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_ecb"
+foreign import ccall "crypton_aes.h crypton_aes_decrypt_ecb"
     c_aes_decrypt_ecb :: CString -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_cbc"
+foreign import ccall "crypton_aes.h crypton_aes_encrypt_cbc"
     c_aes_encrypt_cbc :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_cbc"
+foreign import ccall "crypton_aes.h crypton_aes_decrypt_cbc"
     c_aes_decrypt_cbc :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_xts"
+foreign import ccall "crypton_aes.h crypton_aes_encrypt_xts"
     c_aes_encrypt_xts :: CString -> Ptr AES -> Ptr AES -> Ptr Word8 -> CUInt -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_decrypt_xts"
+foreign import ccall "crypton_aes.h crypton_aes_decrypt_xts"
     c_aes_decrypt_xts :: CString -> Ptr AES -> Ptr AES -> Ptr Word8 -> CUInt -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_gen_ctr"
+foreign import ccall "crypton_aes.h crypton_aes_gen_ctr"
     c_aes_gen_ctr :: CString -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()
 
-foreign import ccall unsafe "cryptonite_aes.h cryptonite_aes_gen_ctr_cont"
+foreign import ccall unsafe "crypton_aes.h crypton_aes_gen_ctr_cont"
     c_aes_gen_ctr_cont :: CString -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_ctr"
+foreign import ccall "crypton_aes.h crypton_aes_encrypt_ctr"
     c_aes_encrypt_ctr :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_encrypt_c32"
+foreign import ccall "crypton_aes.h crypton_aes_encrypt_c32"
     c_aes_encrypt_c32 :: CString -> Ptr AES -> Ptr Word8 -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_init"
+foreign import ccall "crypton_aes.h crypton_aes_gcm_init"
     c_aes_gcm_init :: Ptr AESGCM -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_aad"
+foreign import ccall "crypton_aes.h crypton_aes_gcm_aad"
     c_aes_gcm_aad :: Ptr AESGCM -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_encrypt"
+foreign import ccall "crypton_aes.h crypton_aes_gcm_encrypt"
     c_aes_gcm_encrypt :: CString -> Ptr AESGCM -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_decrypt"
+foreign import ccall "crypton_aes.h crypton_aes_gcm_decrypt"
     c_aes_gcm_decrypt :: CString -> Ptr AESGCM -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_gcm_finish"
+foreign import ccall "crypton_aes.h crypton_aes_gcm_finish"
     c_aes_gcm_finish :: CString -> Ptr AESGCM -> Ptr AES -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_init"
+foreign import ccall "crypton_aes.h crypton_aes_ocb_init"
     c_aes_ocb_init :: Ptr AESOCB -> Ptr AES -> Ptr Word8 -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_aad"
+foreign import ccall "crypton_aes.h crypton_aes_ocb_aad"
     c_aes_ocb_aad :: Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_encrypt"
+foreign import ccall "crypton_aes.h crypton_aes_ocb_encrypt"
     c_aes_ocb_encrypt :: CString -> Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_decrypt"
+foreign import ccall "crypton_aes.h crypton_aes_ocb_decrypt"
     c_aes_ocb_decrypt :: CString -> Ptr AESOCB -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ocb_finish"
+foreign import ccall "crypton_aes.h crypton_aes_ocb_finish"
     c_aes_ocb_finish :: CString -> Ptr AESOCB -> Ptr AES -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_init"
+foreign import ccall "crypton_aes.h crypton_aes_ccm_init"
     c_aes_ccm_init :: Ptr AESCCM -> Ptr AES -> Ptr Word8 -> CUInt -> CUInt -> CInt -> CInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_aad"
+foreign import ccall "crypton_aes.h crypton_aes_ccm_aad"
     c_aes_ccm_aad :: Ptr AESCCM -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_encrypt"
+foreign import ccall "crypton_aes.h crypton_aes_ccm_encrypt"
     c_aes_ccm_encrypt :: CString -> Ptr AESCCM -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_decrypt"
+foreign import ccall "crypton_aes.h crypton_aes_ccm_decrypt"
     c_aes_ccm_decrypt :: CString -> Ptr AESCCM -> Ptr AES -> CString -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_ccm_finish"
+foreign import ccall "crypton_aes.h crypton_aes_ccm_finish"
     c_aes_ccm_finish :: CString -> Ptr AESCCM -> Ptr AES -> IO ()
diff --git a/Crypto/Cipher/AESGCMSIV.hs b/Crypto/Cipher/AESGCMSIV.hs
--- a/Crypto/Cipher/AESGCMSIV.hs
+++ b/Crypto/Cipher/AESGCMSIV.hs
@@ -80,13 +80,13 @@
 polyvalFinalize (Polyval ctx) = B.alloc 16 $ \dst ->
     B.withByteArray ctx $ \pctx -> c_aes_polyval_finalize pctx dst
 
-foreign import ccall unsafe "cryptonite_aes.h cryptonite_aes_polyval_init"
+foreign import ccall unsafe "crypton_aes.h crypton_aes_polyval_init"
     c_aes_polyval_init :: Ptr Polyval -> CString -> IO ()
 
-foreign import ccall "cryptonite_aes.h cryptonite_aes_polyval_update"
+foreign import ccall "crypton_aes.h crypton_aes_polyval_update"
     c_aes_polyval_update :: Ptr Polyval -> CString -> CUInt -> IO ()
 
-foreign import ccall unsafe "cryptonite_aes.h cryptonite_aes_polyval_finalize"
+foreign import ccall unsafe "crypton_aes.h crypton_aes_polyval_finalize"
     c_aes_polyval_finalize :: Ptr Polyval -> CString -> IO ()
 
 
diff --git a/Crypto/Cipher/ChaCha.hs b/Crypto/Cipher/ChaCha.hs
--- a/Crypto/Cipher/ChaCha.hs
+++ b/Crypto/Cipher/ChaCha.hs
@@ -48,7 +48,7 @@
         stPtr <- B.alloc 132 $ \stPtr ->
             B.withByteArray nonce $ \noncePtr  ->
             B.withByteArray key   $ \keyPtr ->
-                ccryptonite_chacha_init stPtr  nbRounds kLen keyPtr nonceLen noncePtr
+                ccrypton_chacha_init stPtr  nbRounds kLen keyPtr nonceLen noncePtr
         return $ State stPtr
   where kLen     = B.length key
         nonceLen = B.length nonce
@@ -64,7 +64,7 @@
     | otherwise = unsafeDoIO $ do
         stPtr <- B.alloc 64 $ \stPtr ->
                     B.withByteArray seed $ \seedPtr ->
-                        ccryptonite_chacha_init_core stPtr 32 seedPtr 8 (seedPtr `plusPtr` 32)
+                        ccrypton_chacha_init_core stPtr 32 seedPtr 8 (seedPtr `plusPtr` 32)
         return $ StateSimple stPtr
   where
     sLen = B.length seed
@@ -81,7 +81,7 @@
         (out, st) <- B.copyRet prevStMem $ \ctx ->
             B.alloc (B.length src) $ \dstPtr ->
             B.withByteArray src    $ \srcPtr ->
-                ccryptonite_chacha_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)
+                ccrypton_chacha_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)
         return (out, State st)
 
 -- | Generate a number of bytes from the ChaCha output directly
@@ -94,7 +94,7 @@
     | otherwise = unsafeDoIO $ do
         (out, st) <- B.copyRet prevStMem $ \ctx ->
             B.alloc len $ \dstPtr ->
-                ccryptonite_chacha_generate dstPtr ctx (fromIntegral len)
+                ccrypton_chacha_generate dstPtr ctx (fromIntegral len)
         return (out, State st)
 
 -- | similar to 'generate' but assume certains values
@@ -106,21 +106,21 @@
     newSt  <- B.copy prevSt (\_ -> return ())
     output <- B.alloc nbBytes $ \dstPtr ->
         B.withByteArray newSt $ \stPtr ->
-            ccryptonite_chacha_random 8 dstPtr stPtr (fromIntegral nbBytes)
+            ccrypton_chacha_random 8 dstPtr stPtr (fromIntegral nbBytes)
     return (output, StateSimple newSt)
 
-foreign import ccall "cryptonite_chacha_init_core"
-    ccryptonite_chacha_init_core :: Ptr StateSimple -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
+foreign import ccall "crypton_chacha_init_core"
+    ccrypton_chacha_init_core :: Ptr StateSimple -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
 
-foreign import ccall "cryptonite_chacha_init"
-    ccryptonite_chacha_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
+foreign import ccall "crypton_chacha_init"
+    ccrypton_chacha_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
 
-foreign import ccall "cryptonite_chacha_combine"
-    ccryptonite_chacha_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()
+foreign import ccall "crypton_chacha_combine"
+    ccrypton_chacha_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_chacha_generate"
-    ccryptonite_chacha_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()
+foreign import ccall "crypton_chacha_generate"
+    ccrypton_chacha_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_chacha_random"
-    ccryptonite_chacha_random :: Int -> Ptr Word8 -> Ptr StateSimple -> CUInt -> IO ()
+foreign import ccall "crypton_chacha_random"
+    ccrypton_chacha_random :: Int -> Ptr Word8 -> Ptr StateSimple -> CUInt -> IO ()
 
diff --git a/Crypto/Cipher/RC4.hs b/Crypto/Cipher/RC4.hs
--- a/Crypto/Cipher/RC4.hs
+++ b/Crypto/Cipher/RC4.hs
@@ -39,13 +39,13 @@
     deriving (ByteArrayAccess,NFData)
 
 -- | C Call for initializing the encryptor
-foreign import ccall unsafe "cryptonite_rc4.h cryptonite_rc4_init"
+foreign import ccall unsafe "crypton_rc4.h crypton_rc4_init"
     c_rc4_init :: Ptr Word8 -- ^ The rc4 key
                -> Word32    -- ^ The key length
                -> Ptr State -- ^ The context
                -> IO ()
 
-foreign import ccall unsafe "cryptonite_rc4.h cryptonite_rc4_combine"
+foreign import ccall unsafe "crypton_rc4.h crypton_rc4_combine"
     c_rc4_combine :: Ptr State        -- ^ Pointer to the permutation
                   -> Ptr Word8      -- ^ Pointer to the clear text
                   -> Word32         -- ^ Length of the clear text
diff --git a/Crypto/Cipher/Salsa.hs b/Crypto/Cipher/Salsa.hs
--- a/Crypto/Cipher/Salsa.hs
+++ b/Crypto/Cipher/Salsa.hs
@@ -40,7 +40,7 @@
         stPtr <- B.alloc 132 $ \stPtr ->
             B.withByteArray nonce $ \noncePtr  ->
             B.withByteArray key   $ \keyPtr ->
-                ccryptonite_salsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr
+                ccrypton_salsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr
         return $ State stPtr
   where kLen     = B.length key
         nonceLen = B.length nonce
@@ -57,7 +57,7 @@
         (out, st) <- B.copyRet prevStMem $ \ctx ->
             B.alloc (B.length src) $ \dstPtr ->
             B.withByteArray src    $ \srcPtr -> do
-                ccryptonite_salsa_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)
+                ccrypton_salsa_combine dstPtr ctx srcPtr (fromIntegral $ B.length src)
         return (out, State st)
 
 -- | Generate a number of bytes from the Salsa output directly
@@ -70,14 +70,14 @@
     | otherwise = unsafeDoIO $ do
         (out, st) <- B.copyRet prevStMem $ \ctx ->
             B.alloc len $ \dstPtr ->
-                ccryptonite_salsa_generate dstPtr ctx (fromIntegral len)
+                ccrypton_salsa_generate dstPtr ctx (fromIntegral len)
         return (out, State st)
 
-foreign import ccall "cryptonite_salsa_init"
-    ccryptonite_salsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
+foreign import ccall "crypton_salsa_init"
+    ccrypton_salsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
 
-foreign import ccall "cryptonite_salsa_combine"
-    ccryptonite_salsa_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()
+foreign import ccall "crypton_salsa_combine"
+    ccrypton_salsa_combine :: Ptr Word8 -> Ptr State -> Ptr Word8 -> CUInt -> IO ()
 
-foreign import ccall "cryptonite_salsa_generate"
-    ccryptonite_salsa_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()
+foreign import ccall "crypton_salsa_generate"
+    ccrypton_salsa_generate :: Ptr Word8 -> Ptr State -> CUInt -> IO ()
diff --git a/Crypto/Cipher/XSalsa.hs b/Crypto/Cipher/XSalsa.hs
--- a/Crypto/Cipher/XSalsa.hs
+++ b/Crypto/Cipher/XSalsa.hs
@@ -40,7 +40,7 @@
         stPtr <- B.alloc 132 $ \stPtr ->
             B.withByteArray nonce $ \noncePtr  ->
             B.withByteArray key   $ \keyPtr ->
-                ccryptonite_xsalsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr
+                ccrypton_xsalsa_init stPtr nbRounds kLen keyPtr nonceLen noncePtr
         return $ State stPtr
   where kLen     = B.length key
         nonceLen = B.length nonce
@@ -64,12 +64,12 @@
     | otherwise = unsafeDoIO $ do
         stPtr <- B.copy stPtr' $ \stPtr ->
             B.withByteArray nonce $ \noncePtr  ->
-                ccryptonite_xsalsa_derive stPtr nonceLen noncePtr
+                ccrypton_xsalsa_derive stPtr nonceLen noncePtr
         return $ State stPtr
   where nonceLen = B.length nonce
 
-foreign import ccall "cryptonite_xsalsa_init"
-    ccryptonite_xsalsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
+foreign import ccall "crypton_xsalsa_init"
+    ccrypton_xsalsa_init :: Ptr State -> Int -> Int -> Ptr Word8 -> Int -> Ptr Word8 -> IO ()
 
-foreign import ccall "cryptonite_xsalsa_derive"
-    ccryptonite_xsalsa_derive :: Ptr State -> Int -> Ptr Word8 -> IO ()
+foreign import ccall "crypton_xsalsa_derive"
+    ccrypton_xsalsa_derive :: Ptr State -> Int -> Ptr Word8 -> IO ()
diff --git a/Crypto/ECC/Edwards25519.hs b/Crypto/ECC/Edwards25519.hs
--- a/Crypto/ECC/Edwards25519.hs
+++ b/Crypto/ECC/Edwards25519.hs
@@ -283,86 +283,86 @@
         withByteArray p  $ \pp  ->
              ed25519_base_double_scalarmul_vartime out ps1 pp ps2
 
-foreign import ccall unsafe "cryptonite_ed25519_scalar_eq"
+foreign import ccall unsafe "crypton_ed25519_scalar_eq"
     ed25519_scalar_eq :: Ptr Scalar
                       -> Ptr Scalar
                       -> IO CInt
 
-foreign import ccall unsafe "cryptonite_ed25519_scalar_encode"
+foreign import ccall unsafe "crypton_ed25519_scalar_encode"
     ed25519_scalar_encode :: Ptr Word8
                           -> Ptr Scalar
                           -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_scalar_decode_long"
+foreign import ccall unsafe "crypton_ed25519_scalar_decode_long"
     ed25519_scalar_decode_long :: Ptr Scalar
                                -> Ptr Word8
                                -> CSize
                                -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_scalar_add"
+foreign import ccall unsafe "crypton_ed25519_scalar_add"
     ed25519_scalar_add :: Ptr Scalar -- sum
                        -> Ptr Scalar -- a
                        -> Ptr Scalar -- b
                        -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_scalar_mul"
+foreign import ccall unsafe "crypton_ed25519_scalar_mul"
     ed25519_scalar_mul :: Ptr Scalar -- out
                        -> Ptr Scalar -- a
                        -> Ptr Scalar -- b
                        -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_point_encode"
+foreign import ccall unsafe "crypton_ed25519_point_encode"
     ed25519_point_encode :: Ptr Word8
                          -> Ptr Point
                          -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_point_decode_vartime"
+foreign import ccall unsafe "crypton_ed25519_point_decode_vartime"
     ed25519_point_decode_vartime :: Ptr Point
                                  -> Ptr Word8
                                  -> IO CInt
 
-foreign import ccall unsafe "cryptonite_ed25519_point_eq"
+foreign import ccall unsafe "crypton_ed25519_point_eq"
     ed25519_point_eq :: Ptr Point
                      -> Ptr Point
                      -> IO CInt
 
-foreign import ccall "cryptonite_ed25519_point_has_prime_order"
+foreign import ccall "crypton_ed25519_point_has_prime_order"
     ed25519_point_has_prime_order :: Ptr Point
                                   -> IO CInt
 
-foreign import ccall unsafe "cryptonite_ed25519_point_negate"
+foreign import ccall unsafe "crypton_ed25519_point_negate"
     ed25519_point_negate :: Ptr Point -- minus_a
                          -> Ptr Point -- a
                          -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_point_add"
+foreign import ccall unsafe "crypton_ed25519_point_add"
     ed25519_point_add :: Ptr Point -- sum
                       -> Ptr Point -- a
                       -> Ptr Point -- b
                       -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_point_double"
+foreign import ccall unsafe "crypton_ed25519_point_double"
     ed25519_point_double :: Ptr Point -- two_a
                          -> Ptr Point -- a
                          -> IO ()
 
-foreign import ccall unsafe "cryptonite_ed25519_point_mul_by_cofactor"
+foreign import ccall unsafe "crypton_ed25519_point_mul_by_cofactor"
     ed25519_point_mul_by_cofactor :: Ptr Point -- eight_a
                                   -> Ptr Point -- a
                                   -> IO ()
 
-foreign import ccall "cryptonite_ed25519_point_base_scalarmul"
+foreign import ccall "crypton_ed25519_point_base_scalarmul"
     ed25519_point_base_scalarmul :: Ptr Point  -- scaled
                                  -> Ptr Scalar -- scalar
                                  -> IO ()
 
-foreign import ccall "cryptonite_ed25519_point_scalarmul"
+foreign import ccall "crypton_ed25519_point_scalarmul"
     ed25519_point_scalarmul :: Ptr Point  -- scaled
                             -> Ptr Point  -- base
                             -> Ptr Scalar -- scalar
                             -> IO ()
 
-foreign import ccall "cryptonite_ed25519_base_double_scalarmul_vartime"
+foreign import ccall "crypton_ed25519_base_double_scalarmul_vartime"
     ed25519_base_double_scalarmul_vartime :: Ptr Point  -- combo
                                           -> Ptr Scalar -- scalar1
                                           -> Ptr Point  -- base2
diff --git a/Crypto/Hash/Blake2.hs b/Crypto/Hash/Blake2.hs
--- a/Crypto/Hash/Blake2.hs
+++ b/Crypto/Hash/Blake2.hs
@@ -72,11 +72,11 @@
     hashInternalUpdate        = c_blake2s_update
     hashInternalFinalize p    = c_blake2s_finalize p (integralNatVal (Proxy :: Proxy bitlen))
 
-foreign import ccall unsafe "cryptonite_blake2s_init"
+foreign import ccall unsafe "crypton_blake2s_init"
     c_blake2s_init :: Ptr (Context a) -> Word32 -> IO ()
-foreign import ccall "cryptonite_blake2s_update"
+foreign import ccall "crypton_blake2s_update"
     c_blake2s_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
-foreign import ccall unsafe "cryptonite_blake2s_finalize"
+foreign import ccall unsafe "crypton_blake2s_finalize"
     c_blake2s_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
 
 -- | Fast cryptographic hash.
@@ -107,11 +107,11 @@
     hashInternalUpdate        = c_blake2b_update
     hashInternalFinalize p    = c_blake2b_finalize p (integralNatVal (Proxy :: Proxy bitlen))
 
-foreign import ccall unsafe "cryptonite_blake2b_init"
+foreign import ccall unsafe "crypton_blake2b_init"
     c_blake2b_init :: Ptr (Context a) -> Word32 -> IO ()
-foreign import ccall "cryptonite_blake2b_update"
+foreign import ccall "crypton_blake2b_update"
     c_blake2b_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
-foreign import ccall unsafe "cryptonite_blake2b_finalize"
+foreign import ccall unsafe "crypton_blake2b_finalize"
     c_blake2b_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
 
 data Blake2sp (bitlen :: Nat) = Blake2sp
@@ -130,11 +130,11 @@
     hashInternalUpdate        = c_blake2sp_update
     hashInternalFinalize p    = c_blake2sp_finalize p (integralNatVal (Proxy :: Proxy bitlen))
 
-foreign import ccall unsafe "cryptonite_blake2sp_init"
+foreign import ccall unsafe "crypton_blake2sp_init"
     c_blake2sp_init :: Ptr (Context a) -> Word32 -> IO ()
-foreign import ccall "cryptonite_blake2sp_update"
+foreign import ccall "crypton_blake2sp_update"
     c_blake2sp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
-foreign import ccall unsafe "cryptonite_blake2sp_finalize"
+foreign import ccall unsafe "crypton_blake2sp_finalize"
     c_blake2sp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
 
 data Blake2bp (bitlen :: Nat) = Blake2bp
@@ -154,9 +154,9 @@
     hashInternalFinalize p    = c_blake2bp_finalize p (integralNatVal (Proxy :: Proxy bitlen))
 
 
-foreign import ccall unsafe "cryptonite_blake2bp_init"
+foreign import ccall unsafe "crypton_blake2bp_init"
     c_blake2bp_init :: Ptr (Context a) -> Word32 -> IO ()
-foreign import ccall "cryptonite_blake2bp_update"
+foreign import ccall "crypton_blake2bp_update"
     c_blake2bp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
-foreign import ccall unsafe "cryptonite_blake2bp_finalize"
+foreign import ccall unsafe "crypton_blake2bp_finalize"
     c_blake2bp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Blake2b.hs b/Crypto/Hash/Blake2b.hs
--- a/Crypto/Hash/Blake2b.hs
+++ b/Crypto/Hash/Blake2b.hs
@@ -98,11 +98,11 @@
     hashInternalFinalize p    = c_blake2b_finalize p 512
 
 
-foreign import ccall unsafe "cryptonite_blake2b_init"
+foreign import ccall unsafe "crypton_blake2b_init"
     c_blake2b_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_blake2b_update"
+foreign import ccall "crypton_blake2b_update"
     c_blake2b_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_blake2b_finalize"
+foreign import ccall unsafe "crypton_blake2b_finalize"
     c_blake2b_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Blake2bp.hs b/Crypto/Hash/Blake2bp.hs
--- a/Crypto/Hash/Blake2bp.hs
+++ b/Crypto/Hash/Blake2bp.hs
@@ -38,11 +38,11 @@
     hashInternalFinalize p    = c_blake2bp_finalize p 512
 
 
-foreign import ccall unsafe "cryptonite_blake2bp_init"
+foreign import ccall unsafe "crypton_blake2bp_init"
     c_blake2bp_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_blake2bp_update"
+foreign import ccall "crypton_blake2bp_update"
     c_blake2bp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_blake2bp_finalize"
+foreign import ccall unsafe "crypton_blake2bp_finalize"
     c_blake2bp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Blake2s.hs b/Crypto/Hash/Blake2s.hs
--- a/Crypto/Hash/Blake2s.hs
+++ b/Crypto/Hash/Blake2s.hs
@@ -68,11 +68,11 @@
     hashInternalFinalize p    = c_blake2s_finalize p 256
 
 
-foreign import ccall unsafe "cryptonite_blake2s_init"
+foreign import ccall unsafe "crypton_blake2s_init"
     c_blake2s_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_blake2s_update"
+foreign import ccall "crypton_blake2s_update"
     c_blake2s_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_blake2s_finalize"
+foreign import ccall unsafe "crypton_blake2s_finalize"
     c_blake2s_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Blake2sp.hs b/Crypto/Hash/Blake2sp.hs
--- a/Crypto/Hash/Blake2sp.hs
+++ b/Crypto/Hash/Blake2sp.hs
@@ -53,11 +53,11 @@
     hashInternalFinalize p    = c_blake2sp_finalize p 256
 
 
-foreign import ccall unsafe "cryptonite_blake2sp_init"
+foreign import ccall unsafe "crypton_blake2sp_init"
     c_blake2sp_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_blake2sp_update"
+foreign import ccall "crypton_blake2sp_update"
     c_blake2sp_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_blake2sp_finalize"
+foreign import ccall unsafe "crypton_blake2sp_finalize"
     c_blake2sp_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Keccak.hs b/Crypto/Hash/Keccak.hs
--- a/Crypto/Hash/Keccak.hs
+++ b/Crypto/Hash/Keccak.hs
@@ -83,11 +83,11 @@
     hashInternalFinalize p    = c_keccak_finalize p 512
 
 
-foreign import ccall unsafe "cryptonite_keccak_init"
+foreign import ccall unsafe "crypton_keccak_init"
     c_keccak_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_keccak_update"
+foreign import ccall "crypton_keccak_update"
     c_keccak_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_keccak_finalize"
+foreign import ccall unsafe "crypton_keccak_finalize"
     c_keccak_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/MD2.hs b/Crypto/Hash/MD2.hs
--- a/Crypto/Hash/MD2.hs
+++ b/Crypto/Hash/MD2.hs
@@ -34,11 +34,11 @@
     hashInternalUpdate        = c_md2_update
     hashInternalFinalize      = c_md2_finalize
 
-foreign import ccall unsafe "cryptonite_md2_init"
+foreign import ccall unsafe "crypton_md2_init"
     c_md2_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_md2_update"
+foreign import ccall "crypton_md2_update"
     c_md2_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_md2_finalize"
+foreign import ccall unsafe "crypton_md2_finalize"
     c_md2_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/MD4.hs b/Crypto/Hash/MD4.hs
--- a/Crypto/Hash/MD4.hs
+++ b/Crypto/Hash/MD4.hs
@@ -34,11 +34,11 @@
     hashInternalUpdate        = c_md4_update
     hashInternalFinalize      = c_md4_finalize
 
-foreign import ccall unsafe "cryptonite_md4_init"
+foreign import ccall unsafe "crypton_md4_init"
     c_md4_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_md4_update"
+foreign import ccall "crypton_md4_update"
     c_md4_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_md4_finalize"
+foreign import ccall unsafe "crypton_md4_finalize"
     c_md4_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/MD5.hs b/Crypto/Hash/MD5.hs
--- a/Crypto/Hash/MD5.hs
+++ b/Crypto/Hash/MD5.hs
@@ -37,14 +37,14 @@
 instance HashAlgorithmPrefix MD5 where
     hashInternalFinalizePrefix = c_md5_finalize_prefix
 
-foreign import ccall unsafe "cryptonite_md5_init"
+foreign import ccall unsafe "crypton_md5_init"
     c_md5_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_md5_update"
+foreign import ccall "crypton_md5_update"
     c_md5_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_md5_finalize"
+foreign import ccall unsafe "crypton_md5_finalize"
     c_md5_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
 
-foreign import ccall "cryptonite_md5_finalize_prefix"
+foreign import ccall "crypton_md5_finalize_prefix"
     c_md5_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/RIPEMD160.hs b/Crypto/Hash/RIPEMD160.hs
--- a/Crypto/Hash/RIPEMD160.hs
+++ b/Crypto/Hash/RIPEMD160.hs
@@ -34,11 +34,11 @@
     hashInternalUpdate        = c_ripemd160_update
     hashInternalFinalize      = c_ripemd160_finalize
 
-foreign import ccall unsafe "cryptonite_ripemd160_init"
+foreign import ccall unsafe "crypton_ripemd160_init"
     c_ripemd160_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_ripemd160_update"
+foreign import ccall "crypton_ripemd160_update"
     c_ripemd160_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_ripemd160_finalize"
+foreign import ccall unsafe "crypton_ripemd160_finalize"
     c_ripemd160_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHA1.hs b/Crypto/Hash/SHA1.hs
--- a/Crypto/Hash/SHA1.hs
+++ b/Crypto/Hash/SHA1.hs
@@ -37,14 +37,14 @@
 instance HashAlgorithmPrefix SHA1 where
     hashInternalFinalizePrefix = c_sha1_finalize_prefix
 
-foreign import ccall unsafe "cryptonite_sha1_init"
+foreign import ccall unsafe "crypton_sha1_init"
     c_sha1_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_sha1_update"
+foreign import ccall "crypton_sha1_update"
     c_sha1_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha1_finalize"
+foreign import ccall unsafe "crypton_sha1_finalize"
     c_sha1_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
 
-foreign import ccall "cryptonite_sha1_finalize_prefix"
+foreign import ccall "crypton_sha1_finalize_prefix"
     c_sha1_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHA224.hs b/Crypto/Hash/SHA224.hs
--- a/Crypto/Hash/SHA224.hs
+++ b/Crypto/Hash/SHA224.hs
@@ -37,14 +37,14 @@
 instance HashAlgorithmPrefix SHA224 where
     hashInternalFinalizePrefix = c_sha224_finalize_prefix
 
-foreign import ccall unsafe "cryptonite_sha224_init"
+foreign import ccall unsafe "crypton_sha224_init"
     c_sha224_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_sha224_update"
+foreign import ccall "crypton_sha224_update"
     c_sha224_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha224_finalize"
+foreign import ccall unsafe "crypton_sha224_finalize"
     c_sha224_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
 
-foreign import ccall "cryptonite_sha224_finalize_prefix"
+foreign import ccall "crypton_sha224_finalize_prefix"
     c_sha224_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHA256.hs b/Crypto/Hash/SHA256.hs
--- a/Crypto/Hash/SHA256.hs
+++ b/Crypto/Hash/SHA256.hs
@@ -37,14 +37,14 @@
 instance HashAlgorithmPrefix SHA256 where
     hashInternalFinalizePrefix = c_sha256_finalize_prefix
 
-foreign import ccall unsafe "cryptonite_sha256_init"
+foreign import ccall unsafe "crypton_sha256_init"
     c_sha256_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_sha256_update"
+foreign import ccall "crypton_sha256_update"
     c_sha256_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha256_finalize"
+foreign import ccall unsafe "crypton_sha256_finalize"
     c_sha256_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
 
-foreign import ccall "cryptonite_sha256_finalize_prefix"
+foreign import ccall "crypton_sha256_finalize_prefix"
     c_sha256_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHA3.hs b/Crypto/Hash/SHA3.hs
--- a/Crypto/Hash/SHA3.hs
+++ b/Crypto/Hash/SHA3.hs
@@ -83,11 +83,11 @@
     hashInternalFinalize p    = c_sha3_finalize p 512
 
 
-foreign import ccall unsafe "cryptonite_sha3_init"
+foreign import ccall unsafe "crypton_sha3_init"
     c_sha3_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_sha3_update"
+foreign import ccall "crypton_sha3_update"
     c_sha3_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha3_finalize"
+foreign import ccall unsafe "crypton_sha3_finalize"
     c_sha3_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHA384.hs b/Crypto/Hash/SHA384.hs
--- a/Crypto/Hash/SHA384.hs
+++ b/Crypto/Hash/SHA384.hs
@@ -37,14 +37,14 @@
 instance HashAlgorithmPrefix SHA384 where
     hashInternalFinalizePrefix = c_sha384_finalize_prefix
 
-foreign import ccall unsafe "cryptonite_sha384_init"
+foreign import ccall unsafe "crypton_sha384_init"
     c_sha384_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_sha384_update"
+foreign import ccall "crypton_sha384_update"
     c_sha384_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha384_finalize"
+foreign import ccall unsafe "crypton_sha384_finalize"
     c_sha384_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
 
-foreign import ccall "cryptonite_sha384_finalize_prefix"
+foreign import ccall "crypton_sha384_finalize_prefix"
     c_sha384_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHA512.hs b/Crypto/Hash/SHA512.hs
--- a/Crypto/Hash/SHA512.hs
+++ b/Crypto/Hash/SHA512.hs
@@ -37,14 +37,14 @@
 instance HashAlgorithmPrefix SHA512 where
     hashInternalFinalizePrefix = c_sha512_finalize_prefix
 
-foreign import ccall unsafe "cryptonite_sha512_init"
+foreign import ccall unsafe "crypton_sha512_init"
     c_sha512_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_sha512_update"
+foreign import ccall "crypton_sha512_update"
     c_sha512_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha512_finalize"
+foreign import ccall unsafe "crypton_sha512_finalize"
     c_sha512_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
 
-foreign import ccall "cryptonite_sha512_finalize_prefix"
+foreign import ccall "crypton_sha512_finalize_prefix"
     c_sha512_finalize_prefix :: Ptr (Context a) -> Ptr Word8 -> Word32 -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHA512t.hs b/Crypto/Hash/SHA512t.hs
--- a/Crypto/Hash/SHA512t.hs
+++ b/Crypto/Hash/SHA512t.hs
@@ -53,11 +53,11 @@
     hashInternalFinalize p    = c_sha512t_finalize p 256
 
 
-foreign import ccall unsafe "cryptonite_sha512t_init"
+foreign import ccall unsafe "crypton_sha512t_init"
     c_sha512t_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_sha512t_update"
+foreign import ccall "crypton_sha512t_update"
     c_sha512t_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha512t_finalize"
+foreign import ccall unsafe "crypton_sha512t_finalize"
     c_sha512t_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/SHAKE.hs b/Crypto/Hash/SHAKE.hs
--- a/Crypto/Hash/SHAKE.hs
+++ b/Crypto/Hash/SHAKE.hs
@@ -115,17 +115,17 @@
     mask = (1 `shiftL` bits) - 1
     (index, bits) = integralNatVal d `divMod` 8
 
-foreign import ccall unsafe "cryptonite_sha3_init"
+foreign import ccall unsafe "crypton_sha3_init"
     c_sha3_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_sha3_update"
+foreign import ccall "crypton_sha3_update"
     c_sha3_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha3_finalize_shake"
+foreign import ccall unsafe "crypton_sha3_finalize_shake"
     c_sha3_finalize_shake :: Ptr (Context a) -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha3_finalize_cshake"
+foreign import ccall unsafe "crypton_sha3_finalize_cshake"
     c_sha3_finalize_cshake :: Ptr (Context a) -> IO ()
 
-foreign import ccall unsafe "cryptonite_sha3_output"
+foreign import ccall unsafe "crypton_sha3_output"
     c_sha3_output :: Ptr (Context a) -> Ptr (Digest a) -> Word32 -> IO ()
diff --git a/Crypto/Hash/Skein256.hs b/Crypto/Hash/Skein256.hs
--- a/Crypto/Hash/Skein256.hs
+++ b/Crypto/Hash/Skein256.hs
@@ -53,11 +53,11 @@
     hashInternalFinalize p    = c_skein256_finalize p 256
 
 
-foreign import ccall unsafe "cryptonite_skein256_init"
+foreign import ccall unsafe "crypton_skein256_init"
     c_skein256_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_skein256_update"
+foreign import ccall "crypton_skein256_update"
     c_skein256_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_skein256_finalize"
+foreign import ccall unsafe "crypton_skein256_finalize"
     c_skein256_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Skein512.hs b/Crypto/Hash/Skein512.hs
--- a/Crypto/Hash/Skein512.hs
+++ b/Crypto/Hash/Skein512.hs
@@ -83,11 +83,11 @@
     hashInternalFinalize p    = c_skein512_finalize p 512
 
 
-foreign import ccall unsafe "cryptonite_skein512_init"
+foreign import ccall unsafe "crypton_skein512_init"
     c_skein512_init :: Ptr (Context a) -> Word32 -> IO ()
 
-foreign import ccall "cryptonite_skein512_update"
+foreign import ccall "crypton_skein512_update"
     c_skein512_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_skein512_finalize"
+foreign import ccall unsafe "crypton_skein512_finalize"
     c_skein512_finalize :: Ptr (Context a) -> Word32 -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Tiger.hs b/Crypto/Hash/Tiger.hs
--- a/Crypto/Hash/Tiger.hs
+++ b/Crypto/Hash/Tiger.hs
@@ -34,11 +34,11 @@
     hashInternalUpdate        = c_tiger_update
     hashInternalFinalize      = c_tiger_finalize
 
-foreign import ccall unsafe "cryptonite_tiger_init"
+foreign import ccall unsafe "crypton_tiger_init"
     c_tiger_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_tiger_update"
+foreign import ccall "crypton_tiger_update"
     c_tiger_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_tiger_finalize"
+foreign import ccall unsafe "crypton_tiger_finalize"
     c_tiger_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/Hash/Whirlpool.hs b/Crypto/Hash/Whirlpool.hs
--- a/Crypto/Hash/Whirlpool.hs
+++ b/Crypto/Hash/Whirlpool.hs
@@ -34,11 +34,11 @@
     hashInternalUpdate        = c_whirlpool_update
     hashInternalFinalize      = c_whirlpool_finalize
 
-foreign import ccall unsafe "cryptonite_whirlpool_init"
+foreign import ccall unsafe "crypton_whirlpool_init"
     c_whirlpool_init :: Ptr (Context a)-> IO ()
 
-foreign import ccall "cryptonite_whirlpool_update"
+foreign import ccall "crypton_whirlpool_update"
     c_whirlpool_update :: Ptr (Context a) -> Ptr Word8 -> Word32 -> IO ()
 
-foreign import ccall unsafe "cryptonite_whirlpool_finalize"
+foreign import ccall unsafe "crypton_whirlpool_finalize"
     c_whirlpool_finalize :: Ptr (Context a) -> Ptr (Digest a) -> IO ()
diff --git a/Crypto/KDF/Argon2.hs b/Crypto/KDF/Argon2.hs
--- a/Crypto/KDF/Argon2.hs
+++ b/Crypto/KDF/Argon2.hs
@@ -147,7 +147,7 @@
 csizeOfInt :: Int -> CSize
 csizeOfInt = fromIntegral
 
-foreign import ccall unsafe "cryptonite_argon2_hash"
+foreign import ccall unsafe "crypton_argon2_hash"
     argon2_hash :: Word32 -> Word32 -> Word32
                 -> Ptr Pass -> CSize
                 -> Ptr Salt -> CSize
diff --git a/Crypto/KDF/PBKDF2.hs b/Crypto/KDF/PBKDF2.hs
--- a/Crypto/KDF/PBKDF2.hs
+++ b/Crypto/KDF/PBKDF2.hs
@@ -116,7 +116,7 @@
     B.allocAndFreeze (outputLength params) $ \outPtr ->
     B.withByteArray password $ \passPtr ->
     B.withByteArray salt $ \saltPtr ->
-        c_cryptonite_fastpbkdf2_hmac_sha1
+        c_crypton_fastpbkdf2_hmac_sha1
             passPtr (fromIntegral $ B.length password)
             saltPtr (fromIntegral $ B.length salt)
             (fromIntegral $ iterCounts params)
@@ -131,7 +131,7 @@
     B.allocAndFreeze (outputLength params) $ \outPtr ->
     B.withByteArray password $ \passPtr ->
     B.withByteArray salt $ \saltPtr ->
-        c_cryptonite_fastpbkdf2_hmac_sha256
+        c_crypton_fastpbkdf2_hmac_sha256
             passPtr (fromIntegral $ B.length password)
             saltPtr (fromIntegral $ B.length salt)
             (fromIntegral $ iterCounts params)
@@ -146,29 +146,29 @@
     B.allocAndFreeze (outputLength params) $ \outPtr ->
     B.withByteArray password $ \passPtr ->
     B.withByteArray salt $ \saltPtr ->
-        c_cryptonite_fastpbkdf2_hmac_sha512
+        c_crypton_fastpbkdf2_hmac_sha512
             passPtr (fromIntegral $ B.length password)
             saltPtr (fromIntegral $ B.length salt)
             (fromIntegral $ iterCounts params)
             outPtr (fromIntegral $ outputLength params)
 
 
-foreign import ccall unsafe "cryptonite_pbkdf2.h cryptonite_fastpbkdf2_hmac_sha1"
-    c_cryptonite_fastpbkdf2_hmac_sha1 :: Ptr Word8 -> CSize
+foreign import ccall unsafe "crypton_pbkdf2.h crypton_fastpbkdf2_hmac_sha1"
+    c_crypton_fastpbkdf2_hmac_sha1 :: Ptr Word8 -> CSize
                                       -> Ptr Word8 -> CSize
                                       -> CUInt
                                       -> Ptr Word8 -> CSize
                                       -> IO ()
 
-foreign import ccall unsafe "cryptonite_pbkdf2.h cryptonite_fastpbkdf2_hmac_sha256"
-    c_cryptonite_fastpbkdf2_hmac_sha256 :: Ptr Word8 -> CSize
+foreign import ccall unsafe "crypton_pbkdf2.h crypton_fastpbkdf2_hmac_sha256"
+    c_crypton_fastpbkdf2_hmac_sha256 :: Ptr Word8 -> CSize
                                         -> Ptr Word8 -> CSize
                                         -> CUInt
                                         -> Ptr Word8 -> CSize
                                         -> IO ()
 
-foreign import ccall unsafe "cryptonite_pbkdf2.h cryptonite_fastpbkdf2_hmac_sha512"
-    c_cryptonite_fastpbkdf2_hmac_sha512 :: Ptr Word8 -> CSize
+foreign import ccall unsafe "crypton_pbkdf2.h crypton_fastpbkdf2_hmac_sha512"
+    c_crypton_fastpbkdf2_hmac_sha512 :: Ptr Word8 -> CSize
                                         -> Ptr Word8 -> CSize
                                         -> CUInt
                                         -> Ptr Word8 -> CSize
diff --git a/Crypto/KDF/Scrypt.hs b/Crypto/KDF/Scrypt.hs
--- a/Crypto/KDF/Scrypt.hs
+++ b/Crypto/KDF/Scrypt.hs
@@ -35,8 +35,8 @@
     , outputLength :: Int    -- ^ the number of bytes to generate out of Scrypt
     }
 
-foreign import ccall "cryptonite_scrypt_smix"
-    ccryptonite_scrypt_smix :: Ptr Word8 -> Word32 -> Word64 -> Ptr Word8 -> Ptr Word8 -> IO ()
+foreign import ccall "crypton_scrypt_smix"
+    ccrypton_scrypt_smix :: Ptr Word8 -> Word32 -> Word64 -> Ptr Word8 -> Ptr Word8 -> IO ()
 
 -- | Generate the scrypt key derivation data
 generate :: (ByteArrayAccess password, ByteArrayAccess salt, ByteArray output)
@@ -55,7 +55,7 @@
             allocaBytesAligned (128*(fromIntegral $ n params)*(r params)) 8 $ \v ->
             allocaBytesAligned (256*r params + 64) 8 $ \xy -> do
                 forM_ [0..(p params-1)] $ \i ->
-                    ccryptonite_scrypt_smix (bPtr `plusPtr` (i * 128 * (r params)))
+                    ccrypton_scrypt_smix (bPtr `plusPtr` (i * 128 * (r params)))
                                             (fromIntegral $ r params) (n params) v xy
 
         return $ PBKDF2.generate prf (PBKDF2.Parameters 1 (outputLength params)) password (newSalt :: B.Bytes)
diff --git a/Crypto/MAC/Poly1305.hs b/Crypto/MAC/Poly1305.hs
--- a/Crypto/MAC/Poly1305.hs
+++ b/Crypto/MAC/Poly1305.hs
@@ -57,13 +57,13 @@
 instance Eq Auth where
     (Auth a1) == (Auth a2) = B.constEq a1 a2
 
-foreign import ccall unsafe "cryptonite_poly1305.h cryptonite_poly1305_init"
+foreign import ccall unsafe "crypton_poly1305.h crypton_poly1305_init"
     c_poly1305_init :: Ptr State -> Ptr Word8 -> IO ()
 
-foreign import ccall "cryptonite_poly1305.h cryptonite_poly1305_update"
+foreign import ccall "crypton_poly1305.h crypton_poly1305_update"
     c_poly1305_update :: Ptr State -> Ptr Word8 -> CUInt -> IO ()
 
-foreign import ccall unsafe "cryptonite_poly1305.h cryptonite_poly1305_finalize"
+foreign import ccall unsafe "crypton_poly1305.h crypton_poly1305_finalize"
     c_poly1305_finalize :: Ptr Word8 -> Ptr State -> IO ()
 
 -- | initialize a Poly1305 context
diff --git a/Crypto/PubKey/Curve25519.hs b/Crypto/PubKey/Curve25519.hs
--- a/Crypto/PubKey/Curve25519.hs
+++ b/Crypto/PubKey/Curve25519.hs
@@ -100,7 +100,7 @@
     B.allocAndFreeze 32        $ \result ->
     withByteArray sec          $ \psec   ->
     withByteArray pub          $ \ppub   ->
-        ccryptonite_curve25519 result psec ppub
+        ccrypton_curve25519 result psec ppub
 {-# NOINLINE dh #-}
 
 -- | Create a public key from a secret key
@@ -108,7 +108,7 @@
 toPublic (SecretKey sec) = PublicKey <$>
     B.allocAndFreeze 32     $ \result ->
     withByteArray sec       $ \psec   ->
-        ccryptonite_curve25519 result psec basePoint
+        ccrypton_curve25519 result psec basePoint
   where
         basePoint = Ptr "\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"#
 {-# NOINLINE toPublic #-}
@@ -125,8 +125,8 @@
     modifyByte :: Ptr Word8 -> Int -> (Word8 -> Word8) -> IO ()
     modifyByte p n f = peekByteOff p n >>= pokeByteOff p n . f
 
-foreign import ccall "cryptonite_curve25519_donna"
-    ccryptonite_curve25519 :: Ptr Word8 -- ^ public
+foreign import ccall "crypton_curve25519_donna"
+    ccrypton_curve25519 :: Ptr Word8 -- ^ public
                            -> Ptr Word8 -- ^ secret
                            -> Ptr Word8 -- ^ basepoint
                            -> IO ()
diff --git a/Crypto/PubKey/Curve448.hs b/Crypto/PubKey/Curve448.hs
--- a/Crypto/PubKey/Curve448.hs
+++ b/Crypto/PubKey/Curve448.hs
@@ -104,13 +104,13 @@
 x448_bytes :: Int
 x448_bytes = 448 `quot` 8
 
-foreign import ccall "cryptonite_decaf_x448"
+foreign import ccall "crypton_decaf_x448"
     decaf_x448 :: Ptr Word8 -- ^ public
                -> Ptr Word8 -- ^ basepoint
                -> Ptr Word8 -- ^ secret
                -> IO ()
 
-foreign import ccall "cryptonite_decaf_x448_derive_public_key"
+foreign import ccall "crypton_decaf_x448_derive_public_key"
     decaf_x448_derive_public_key :: Ptr Word8 -- ^ public
                                  -> Ptr Word8 -- ^ secret
                                  -> IO ()
diff --git a/Crypto/PubKey/ECC/P256.hs b/Crypto/PubKey/ECC/P256.hs
--- a/Crypto/PubKey/ECC/P256.hs
+++ b/Crypto/PubKey/ECC/P256.hs
@@ -105,19 +105,19 @@
     | scalarIsZero s = error "cannot create point from zero"
     | otherwise      =
         withNewPoint $ \px py -> withScalar s $ \p ->
-            ccryptonite_p256_basepoint_mul p px py
+            ccrypton_p256_basepoint_mul p px py
 
 -- | Add a point to another point
 pointAdd :: Point -> Point -> Point
 pointAdd a b = withNewPoint $ \dx dy ->
     withPoint a $ \ax ay -> withPoint b $ \bx by ->
-        ccryptonite_p256e_point_add ax ay bx by dx dy
+        ccrypton_p256e_point_add ax ay bx by dx dy
 
 -- | Negate a point
 pointNegate :: Point -> Point
 pointNegate a = withNewPoint $ \dx dy ->
     withPoint a $ \ax ay ->
-        ccryptonite_p256e_point_negate ax ay dx dy
+        ccrypton_p256e_point_negate ax ay dx dy
 
 -- | Multiply a point by a scalar
 --
@@ -125,7 +125,7 @@
 pointMul :: Scalar -> Point -> Point
 pointMul scalar p = withNewPoint $ \dx dy ->
     withScalar scalar $ \n -> withPoint p $ \px py ->
-        ccryptonite_p256e_point_mul n px py dx dy
+        ccrypton_p256e_point_mul n px py dx dy
 
 -- | Similar to 'pointMul', serializing the x coordinate as binary.
 -- When scalar is multiple of point order the result is all zero.
@@ -133,8 +133,8 @@
 pointDh scalar p =
     B.unsafeCreate scalarSize $ \dst -> withTempPoint $ \dx dy -> do
         withScalar scalar $ \n -> withPoint p $ \px py ->
-            ccryptonite_p256e_point_mul n px py dx dy
-        ccryptonite_p256_to_bin (castPtr dx) dst
+            ccrypton_p256e_point_mul n px py dx dy
+        ccrypton_p256_to_bin (castPtr dx) dst
 
 -- | multiply the point @p with @n2 and add a lifted to curve value @n1
 --
@@ -144,12 +144,12 @@
 pointsMulVarTime :: Scalar -> Scalar -> Point -> Point
 pointsMulVarTime n1 n2 p = withNewPoint $ \dx dy ->
     withScalar n1 $ \pn1 -> withScalar n2 $ \pn2 -> withPoint p $ \px py ->
-        ccryptonite_p256_points_mul_vartime pn1 pn2 px py dx dy
+        ccrypton_p256_points_mul_vartime pn1 pn2 px py dx dy
 
 -- | Check if a 'Point' is valid
 pointIsValid :: Point -> Bool
 pointIsValid p = unsafeDoIO $ withPoint p $ \px py -> do
-    r <- ccryptonite_p256_is_valid_point px py
+    r <- ccrypton_p256_is_valid_point px py
     return (r /= 0)
 
 -- | Check if a 'Point' is the point at infinity
@@ -163,7 +163,7 @@
     | otherwise           = Just $
         withNewScalarFreeze $ \d    ->
         withPoint p         $ \px _ ->
-            ccryptonite_p256_mod ccryptonite_SECP256r1_n (castPtr px) (castPtr d)
+            ccrypton_p256_mod ccrypton_SECP256r1_n (castPtr px) (castPtr d)
 
 -- | Convert a point to (x,y) Integers
 pointToIntegers :: Point -> (Integer, Integer)
@@ -171,9 +171,9 @@
     allocTemp 32 (serialize (castPtr px) (castPtr py))
   where
     serialize px py temp = do
-        ccryptonite_p256_to_bin px temp
+        ccrypton_p256_to_bin px temp
         x <- os2ip temp scalarSize
-        ccryptonite_p256_to_bin py temp
+        ccrypton_p256_to_bin py temp
         y <- os2ip temp scalarSize
         return (x,y)
 
@@ -192,13 +192,13 @@
             then error "pointFromIntegers: filling failed"
             else return ()
         -- then fill dest with the P256 scalar from temp
-        ccryptonite_p256_from_bin temp dest
+        ccrypton_p256_from_bin temp dest
 
 -- | Convert a point to a binary representation
 pointToBinary :: ByteArray ba => Point -> ba
 pointToBinary p = B.unsafeCreate pointSize $ \dst -> withPoint p $ \px py -> do
-    ccryptonite_p256_to_bin (castPtr px) dst
-    ccryptonite_p256_to_bin (castPtr py) (dst `plusPtr` 32)
+    ccrypton_p256_to_bin (castPtr px) dst
+    ccrypton_p256_to_bin (castPtr py) (dst `plusPtr` 32)
 
 -- | Convert from binary to a valid point
 pointFromBinary :: ByteArrayAccess ba => ba -> CryptoFailable Point
@@ -215,8 +215,8 @@
     | B.length ba /= pointSize = CryptoFailed CryptoError_PublicKeySizeInvalid
     | otherwise                =
         CryptoPassed $ withNewPoint $ \px py -> B.withByteArray ba $ \src -> do
-            ccryptonite_p256_from_bin src                        (castPtr px)
-            ccryptonite_p256_from_bin (src `plusPtr` scalarSize) (castPtr py)
+            ccrypton_p256_from_bin src                        (castPtr px)
+            ccrypton_p256_from_bin (src `plusPtr` scalarSize) (castPtr py)
 
 ------------------------------------------------------------------------
 -- Scalar methods
@@ -233,7 +233,7 @@
 
 -- | The scalar representing 0
 scalarZero :: Scalar
-scalarZero = withNewScalarFreeze $ \d -> ccryptonite_p256_init d
+scalarZero = withNewScalarFreeze $ \d -> ccrypton_p256_init d
 
 -- | The scalar representing the curve order
 scalarN :: Scalar
@@ -242,7 +242,7 @@
 -- | Check if the scalar is 0
 scalarIsZero :: Scalar -> Bool
 scalarIsZero s = unsafeDoIO $ withScalar s $ \d -> do
-    result <- ccryptonite_p256_is_zero d
+    result <- ccrypton_p256_is_zero d
     return $ result /= 0
 
 -- | Perform addition between two scalars
@@ -251,7 +251,7 @@
 scalarAdd :: Scalar -> Scalar -> Scalar
 scalarAdd a b =
     withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb ->
-        ccryptonite_p256e_modadd ccryptonite_SECP256r1_n pa pb d
+        ccrypton_p256e_modadd ccrypton_SECP256r1_n pa pb d
 
 -- | Perform subtraction between two scalars
 --
@@ -259,7 +259,7 @@
 scalarSub :: Scalar -> Scalar -> Scalar
 scalarSub a b =
     withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb ->
-        ccryptonite_p256e_modsub ccryptonite_SECP256r1_n pa pb d
+        ccrypton_p256e_modsub ccrypton_SECP256r1_n pa pb d
 
 -- | Perform multiplication between two scalars
 --
@@ -267,7 +267,7 @@
 scalarMul :: Scalar -> Scalar -> Scalar
 scalarMul a b =
     withNewScalarFreeze $ \d -> withScalar a $ \pa -> withScalar b $ \pb ->
-         ccryptonite_p256_modmul ccryptonite_SECP256r1_n pa 0 pb d
+         ccrypton_p256_modmul ccrypton_SECP256r1_n pa 0 pb d
 
 -- | Give the inverse of the scalar
 --
@@ -277,7 +277,7 @@
 scalarInv :: Scalar -> Scalar
 scalarInv a =
     withNewScalarFreeze $ \b -> withScalar a $ \pa ->
-        ccryptonite_p256_modinv_vartime ccryptonite_SECP256r1_n pa b
+        ccrypton_p256_modinv_vartime ccrypton_SECP256r1_n pa b
 
 -- | Give the inverse of the scalar using safe exponentiation
 --
@@ -285,13 +285,13 @@
 scalarInvSafe :: Scalar -> Scalar
 scalarInvSafe a =
     withNewScalarFreeze $ \b -> withScalar a $ \pa ->
-        ccryptonite_p256e_scalar_invert pa b
+        ccrypton_p256e_scalar_invert pa b
 
 -- | Compare 2 Scalar
 scalarCmp :: Scalar -> Scalar -> Ordering
 scalarCmp a b = unsafeDoIO $
     withScalar a $ \pa -> withScalar b $ \pb -> do
-        v <- ccryptonite_p256_cmp pa pb
+        v <- ccrypton_p256_cmp pa pb
         return $ compare v 0
 
 -- | convert a scalar from binary
@@ -300,13 +300,13 @@
     | B.length ba /= scalarSize = CryptoFailed CryptoError_SecretKeySizeInvalid
     | otherwise                 =
         CryptoPassed $ withNewScalarFreeze $ \p -> B.withByteArray ba $ \b ->
-            ccryptonite_p256_from_bin b p
+            ccrypton_p256_from_bin b p
 {-# NOINLINE scalarFromBinary #-}
 
 -- | convert a scalar to binary
 scalarToBinary :: ByteArray ba => Scalar -> ba
 scalarToBinary s = B.unsafeCreate scalarSize $ \b -> withScalar s $ \p ->
-    ccryptonite_p256_to_bin p b
+    ccrypton_p256_to_bin p b
 {-# NOINLINE scalarToBinary #-}
 
 -- | Convert from an Integer to a P256 Scalar
@@ -356,72 +356,72 @@
 ------------------------------------------------------------------------
 -- Foreign bindings
 ------------------------------------------------------------------------
-foreign import ccall "&cryptonite_SECP256r1_n"
-    ccryptonite_SECP256r1_n :: Ptr P256Scalar
-foreign import ccall "&cryptonite_SECP256r1_p"
-    ccryptonite_SECP256r1_p :: Ptr P256Scalar
-foreign import ccall "&cryptonite_SECP256r1_b"
-    ccryptonite_SECP256r1_b :: Ptr P256Scalar
+foreign import ccall "&crypton_SECP256r1_n"
+    ccrypton_SECP256r1_n :: Ptr P256Scalar
+foreign import ccall "&crypton_SECP256r1_p"
+    ccrypton_SECP256r1_p :: Ptr P256Scalar
+foreign import ccall "&crypton_SECP256r1_b"
+    ccrypton_SECP256r1_b :: Ptr P256Scalar
 
-foreign import ccall "cryptonite_p256_init"
-    ccryptonite_p256_init :: Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256_is_zero"
-    ccryptonite_p256_is_zero :: Ptr P256Scalar -> IO CInt
-foreign import ccall "cryptonite_p256_clear"
-    ccryptonite_p256_clear :: Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256e_modadd"
-    ccryptonite_p256e_modadd :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256_add_d"
-    ccryptonite_p256_add_d :: Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> IO CInt
-foreign import ccall "cryptonite_p256e_modsub"
-    ccryptonite_p256e_modsub :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256_cmp"
-    ccryptonite_p256_cmp :: Ptr P256Scalar -> Ptr P256Scalar -> IO CInt
-foreign import ccall "cryptonite_p256_mod"
-    ccryptonite_p256_mod :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256_modmul"
-    ccryptonite_p256_modmul :: Ptr P256Scalar -> Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256e_scalar_invert"
-    ccryptonite_p256e_scalar_invert :: Ptr P256Scalar -> Ptr P256Scalar -> IO ()
---foreign import ccall "cryptonite_p256_modinv"
---    ccryptonite_p256_modinv :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256_modinv_vartime"
-    ccryptonite_p256_modinv_vartime :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
-foreign import ccall "cryptonite_p256_base_point_mul"
-    ccryptonite_p256_basepoint_mul :: Ptr P256Scalar
+foreign import ccall "crypton_p256_init"
+    ccrypton_p256_init :: Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256_is_zero"
+    ccrypton_p256_is_zero :: Ptr P256Scalar -> IO CInt
+foreign import ccall "crypton_p256_clear"
+    ccrypton_p256_clear :: Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256e_modadd"
+    ccrypton_p256e_modadd :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256_add_d"
+    ccrypton_p256_add_d :: Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> IO CInt
+foreign import ccall "crypton_p256e_modsub"
+    ccrypton_p256e_modsub :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256_cmp"
+    ccrypton_p256_cmp :: Ptr P256Scalar -> Ptr P256Scalar -> IO CInt
+foreign import ccall "crypton_p256_mod"
+    ccrypton_p256_mod :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256_modmul"
+    ccrypton_p256_modmul :: Ptr P256Scalar -> Ptr P256Scalar -> P256Digit -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256e_scalar_invert"
+    ccrypton_p256e_scalar_invert :: Ptr P256Scalar -> Ptr P256Scalar -> IO ()
+--foreign import ccall "crypton_p256_modinv"
+--    ccrypton_p256_modinv :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256_modinv_vartime"
+    ccrypton_p256_modinv_vartime :: Ptr P256Scalar -> Ptr P256Scalar -> Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256_base_point_mul"
+    ccrypton_p256_basepoint_mul :: Ptr P256Scalar
                                    -> Ptr P256X -> Ptr P256Y
                                    -> IO ()
 
-foreign import ccall "cryptonite_p256e_point_add"
-    ccryptonite_p256e_point_add :: Ptr P256X -> Ptr P256Y
+foreign import ccall "crypton_p256e_point_add"
+    ccrypton_p256e_point_add :: Ptr P256X -> Ptr P256Y
                                 -> Ptr P256X -> Ptr P256Y
                                 -> Ptr P256X -> Ptr P256Y
                                 -> IO ()
 
-foreign import ccall "cryptonite_p256e_point_negate"
-    ccryptonite_p256e_point_negate :: Ptr P256X -> Ptr P256Y
+foreign import ccall "crypton_p256e_point_negate"
+    ccrypton_p256e_point_negate :: Ptr P256X -> Ptr P256Y
                                    -> Ptr P256X -> Ptr P256Y
                                    -> IO ()
 
 -- compute (out_x,out_y) = n * (in_x,in_y)
-foreign import ccall "cryptonite_p256e_point_mul"
-    ccryptonite_p256e_point_mul :: Ptr P256Scalar -- n
+foreign import ccall "crypton_p256e_point_mul"
+    ccrypton_p256e_point_mul :: Ptr P256Scalar -- n
                                 -> Ptr P256X -> Ptr P256Y -- in_{x,y}
                                 -> Ptr P256X -> Ptr P256Y -- out_{x,y}
                                 -> IO ()
 
 -- compute (out_x,out,y) = n1 * G + n2 * (in_x,in_y)
-foreign import ccall "cryptonite_p256_points_mul_vartime"
-    ccryptonite_p256_points_mul_vartime :: Ptr P256Scalar -- n1
+foreign import ccall "crypton_p256_points_mul_vartime"
+    ccrypton_p256_points_mul_vartime :: Ptr P256Scalar -- n1
                                         -> Ptr P256Scalar -- n2
                                         -> Ptr P256X -> Ptr P256Y -- in_{x,y}
                                         -> Ptr P256X -> Ptr P256Y -- out_{x,y}
                                         -> IO ()
-foreign import ccall "cryptonite_p256_is_valid_point"
-    ccryptonite_p256_is_valid_point :: Ptr P256X -> Ptr P256Y -> IO CInt
+foreign import ccall "crypton_p256_is_valid_point"
+    ccrypton_p256_is_valid_point :: Ptr P256X -> Ptr P256Y -> IO CInt
 
-foreign import ccall "cryptonite_p256_to_bin"
-    ccryptonite_p256_to_bin :: Ptr P256Scalar -> Ptr Word8 -> IO ()
+foreign import ccall "crypton_p256_to_bin"
+    ccrypton_p256_to_bin :: Ptr P256Scalar -> Ptr Word8 -> IO ()
 
-foreign import ccall "cryptonite_p256_from_bin"
-    ccryptonite_p256_from_bin :: Ptr Word8 -> Ptr P256Scalar -> IO ()
+foreign import ccall "crypton_p256_from_bin"
+    ccrypton_p256_from_bin :: Ptr Word8 -> Ptr P256Scalar -> IO ()
diff --git a/Crypto/PubKey/Ed25519.hs b/Crypto/PubKey/Ed25519.hs
--- a/Crypto/PubKey/Ed25519.hs
+++ b/Crypto/PubKey/Ed25519.hs
@@ -88,7 +88,7 @@
 toPublic (SecretKey sec) = PublicKey <$>
     B.allocAndFreeze publicKeySize $ \result ->
     withByteArray sec              $ \psec   ->
-        ccryptonite_ed25519_publickey psec result
+        ccrypton_ed25519_publickey psec result
 {-# NOINLINE toPublic #-}
 
 -- | Sign a message using the key pair
@@ -98,7 +98,7 @@
         withByteArray secret  $ \sec ->
         withByteArray public  $ \pub ->
         withByteArray message $ \msg ->
-             ccryptonite_ed25519_sign msg (fromIntegral msgLen) sec pub sig
+             ccrypton_ed25519_sign msg (fromIntegral msgLen) sec pub sig
   where
     !msgLen = B.length message
 
@@ -108,7 +108,7 @@
     withByteArray signatureVal $ \sig ->
     withByteArray public       $ \pub ->
     withByteArray message      $ \msg -> do
-      r <- ccryptonite_ed25519_sign_open msg (fromIntegral msgLen) pub sig
+      r <- ccrypton_ed25519_sign_open msg (fromIntegral msgLen) pub sig
       return (r == 0)
   where
     !msgLen = B.length message
@@ -129,20 +129,20 @@
 signatureSize :: Int
 signatureSize = 64
 
-foreign import ccall "cryptonite_ed25519_publickey"
-    ccryptonite_ed25519_publickey :: Ptr SecretKey -- secret key
+foreign import ccall "crypton_ed25519_publickey"
+    ccrypton_ed25519_publickey :: Ptr SecretKey -- secret key
                                   -> Ptr PublicKey -- public key
                                   -> IO ()
 
-foreign import ccall "cryptonite_ed25519_sign_open"
-    ccryptonite_ed25519_sign_open :: Ptr Word8     -- message
+foreign import ccall "crypton_ed25519_sign_open"
+    ccrypton_ed25519_sign_open :: Ptr Word8     -- message
                                   -> CSize         -- message len
                                   -> Ptr PublicKey -- public
                                   -> Ptr Signature -- signature
                                   -> IO CInt
 
-foreign import ccall "cryptonite_ed25519_sign"
-    ccryptonite_ed25519_sign :: Ptr Word8     -- message
+foreign import ccall "crypton_ed25519_sign"
+    ccrypton_ed25519_sign :: Ptr Word8     -- message
                              -> CSize         -- message len
                              -> Ptr SecretKey -- secret
                              -> Ptr PublicKey -- public
diff --git a/Crypto/PubKey/Ed448.hs b/Crypto/PubKey/Ed448.hs
--- a/Crypto/PubKey/Ed448.hs
+++ b/Crypto/PubKey/Ed448.hs
@@ -136,12 +136,12 @@
 no_context :: Ptr Word8
 no_context = nullPtr -- not supported yet
 
-foreign import ccall "cryptonite_decaf_ed448_derive_public_key"
+foreign import ccall "crypton_decaf_ed448_derive_public_key"
     decaf_ed448_derive_public_key :: Ptr PublicKey -- public key
                                   -> Ptr SecretKey -- secret key
                                   -> IO ()
 
-foreign import ccall "cryptonite_decaf_ed448_sign"
+foreign import ccall "crypton_decaf_ed448_sign"
     decaf_ed448_sign :: Ptr Signature -- signature
                      -> Ptr SecretKey -- secret
                      -> Ptr PublicKey -- public
@@ -152,7 +152,7 @@
                      -> Word8         -- context len
                      -> IO ()
 
-foreign import ccall "cryptonite_decaf_ed448_verify"
+foreign import ccall "crypton_decaf_ed448_verify"
     decaf_ed448_verify :: Ptr Signature -- signature
                        -> Ptr PublicKey -- public
                        -> Ptr Word8     -- message
diff --git a/Crypto/Random/Entropy/RDRand.hs b/Crypto/Random/Entropy/RDRand.hs
--- a/Crypto/Random/Entropy/RDRand.hs
+++ b/Crypto/Random/Entropy/RDRand.hs
@@ -15,10 +15,10 @@
 import Data.Word (Word8)
 import Crypto.Random.Entropy.Source
 
-foreign import ccall unsafe "cryptonite_cpu_has_rdrand"
+foreign import ccall unsafe "crypton_cpu_has_rdrand"
    c_cpu_has_rdrand :: IO CInt
 
-foreign import ccall unsafe "cryptonite_get_rand_bytes"
+foreign import ccall unsafe "crypton_get_rand_bytes"
   c_get_rand_bytes :: Ptr Word8 -> CInt -> IO CInt
 
 -- | Fake handle to Intel RDRand entropy CPU instruction
diff --git a/Crypto/Random/Entropy/Unsafe.hs b/Crypto/Random/Entropy/Unsafe.hs
--- a/Crypto/Random/Entropy/Unsafe.hs
+++ b/Crypto/Random/Entropy/Unsafe.hs
@@ -22,11 +22,11 @@
 -- If the buffer cannot be refill after 3 loopings, this will raise
 -- an User Error exception
 replenish :: Int -> [EntropyBackend] -> Ptr Word8 -> IO ()
-replenish _        []       _   = fail "cryptonite: random: cannot get any source of entropy on this system"
+replenish _        []       _   = fail "crypton: random: cannot get any source of entropy on this system"
 replenish poolSize backends ptr = loop 0 backends ptr poolSize
   where loop :: Int -> [EntropyBackend] -> Ptr Word8 -> Int -> IO ()
         loop _     _  _ 0 = return ()
-        loop retry [] p n | retry == 3 = error "cryptonite: random: cannot fully replenish"
+        loop retry [] p n | retry == 3 = error "crypton: random: cannot fully replenish"
                           | otherwise  = loop (retry+1) backends p n
         loop retry (b:bs) p n = do
             r <- gatherBackend b p n
diff --git a/Crypto/System/CPU.hs b/Crypto/System/CPU.hs
--- a/Crypto/System/CPU.hs
+++ b/Crypto/System/CPU.hs
@@ -5,7 +5,7 @@
 -- Stability   : experimental
 -- Portability : unknown
 --
--- Gives information about cryptonite runtime environment.
+-- Gives information about crypton runtime environment.
 --
 {-# LANGUAGE CPP #-}
 {-# LANGUAGE DeriveDataTypeable #-}
@@ -42,7 +42,7 @@
 -- current CPU.
 processorOptions :: [ProcessorOption]
 processorOptions = unsafeDoIO $ do
-    p <- cryptonite_aes_cpu_init
+    p <- crypton_aes_cpu_init
     options <- traverse (getOption p) aesOptions
     rdrand  <- hasRDRand
     return (decodeOptions options ++ [ RDRAND | rdrand ])
@@ -60,5 +60,5 @@
 hasRDRand = return False
 #endif
 
-foreign import ccall unsafe "cryptonite_aes_cpu_init"
-    cryptonite_aes_cpu_init :: IO (Ptr Word8)
+foreign import ccall unsafe "crypton_aes_cpu_init"
+    crypton_aes_cpu_init :: IO (Ptr Word8)
diff --git a/Crypto/Tutorial.hs b/Crypto/Tutorial.hs
--- a/Crypto/Tutorial.hs
+++ b/Crypto/Tutorial.hs
@@ -1,4 +1,4 @@
--- | Examples of how to use @cryptonite@.
+-- | Examples of how to use @crypton@.
 module Crypto.Tutorial
     ( -- * API design
       -- $api_design
@@ -15,11 +15,11 @@
 
 -- $api_design
 --
--- APIs in cryptonite are often based on type classes from package
+-- APIs in crypton are often based on type classes from package
 -- <https://hackage.haskell.org/package/memory memory>, notably
 -- 'Data.ByteArray.ByteArrayAccess' and 'Data.ByteArray.ByteArray'.
 -- Module "Data.ByteArray" provides many primitives that are useful to
--- work with cryptonite types.  For example function 'Data.ByteArray.convert'
+-- work with crypton types.  For example function 'Data.ByteArray.convert'
 -- can transform one 'Data.ByteArray.ByteArrayAccess' concrete type like
 -- 'Crypto.Hash.Digest' to a 'Data.ByteString.ByteString'.
 --
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 crypton
 ==========
 
-Crypton is a fork from cryptonite with the original authoer's permission.
+Crypton is a fork from cryptonite with the original author's permission.
 
 Crypton is a haskell repository of cryptographic primitives. Each crypto
 algorithm has specificities that are hard to wrap in common APIs and types,
diff --git a/cbits/aes/block128.h b/cbits/aes/block128.h
--- a/cbits/aes/block128.h
+++ b/cbits/aes/block128.h
@@ -31,8 +31,8 @@
 #ifndef BLOCK128_H
 #define BLOCK128_H
 
-#include <cryptonite_bitfn.h>
-#include <cryptonite_align.h>
+#include <crypton_bitfn.h>
+#include <crypton_align.h>
 
 typedef union {
        uint64_t q[2];
diff --git a/cbits/aes/generic.c b/cbits/aes/generic.c
--- a/cbits/aes/generic.c
+++ b/cbits/aes/generic.c
@@ -32,8 +32,8 @@
 
 #include <stdint.h>
 #include <stdlib.h>
-#include <cryptonite_aes.h>
-#include <cryptonite_bitfn.h>
+#include <crypton_aes.h>
+#include <crypton_bitfn.h>
 
 static uint8_t sbox[256] = {
 	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe,
@@ -405,7 +405,7 @@
 	t[2] = f[8]; t[6] = f[9]; t[10] = f[10]; t[14] = f[11]; \
 	t[3] = f[12]; t[7] = f[13]; t[11] = f[14]; t[15] = f[15]
 
-void cryptonite_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input)
+void crypton_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input)
 {
 	uint32_t block[4];
 	uint8_t *iptr, *optr, *bptr;
@@ -418,7 +418,7 @@
 	swap_block(optr, bptr);
 }
 
-void cryptonite_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input)
+void crypton_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input)
 {
 	uint32_t block[4];
 	uint8_t *iptr, *optr, *bptr;
@@ -431,7 +431,7 @@
 	swap_block(optr, bptr);
 }
 
-void cryptonite_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size)
+void crypton_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size)
 {
 	int esz;
 
diff --git a/cbits/aes/generic.h b/cbits/aes/generic.h
--- a/cbits/aes/generic.h
+++ b/cbits/aes/generic.h
@@ -27,8 +27,8 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-#include "cryptonite_aes.h"
+#include "crypton_aes.h"
 
-void cryptonite_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input);
-void cryptonite_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input);
-void cryptonite_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size);
+void crypton_aes_generic_encrypt_block(aes_block *output, aes_key *key, aes_block *input);
+void crypton_aes_generic_decrypt_block(aes_block *output, aes_key *key, aes_block *input);
+void crypton_aes_generic_init(aes_key *key, uint8_t *origkey, uint8_t size);
diff --git a/cbits/aes/gf.c b/cbits/aes/gf.c
--- a/cbits/aes/gf.c
+++ b/cbits/aes/gf.c
@@ -30,12 +30,12 @@
 
 #include <stdio.h>
 #include <stdint.h>
-#include <cryptonite_cpu.h>
+#include <crypton_cpu.h>
 #include <aes/gf.h>
 #include <aes/x86ni.h>
 
 /* inplace GFMUL for xts mode */
-void cryptonite_aes_generic_gf_mulx(block128 *a)
+void crypton_aes_generic_gf_mulx(block128 *a)
 {
 	const uint64_t gf_mask = cpu_to_le64(0x8000000000000000ULL);
 	uint64_t r = ((a->q[1] & gf_mask) ? cpu_to_le64(0x87) : 0);
@@ -95,7 +95,7 @@
 }
 
 /* initialize the 4-bit table given H */
-void cryptonite_aes_generic_hinit(table_4bit htable, const block128 *h)
+void crypton_aes_generic_hinit(table_4bit htable, const block128 *h)
 {
 	block128 v, *p;
 	int i, j;
@@ -127,7 +127,7 @@
 }
 
 /* multiply a block with H */
-void cryptonite_aes_generic_gf_mul(block128 *a, const table_4bit htable)
+void crypton_aes_generic_gf_mul(block128 *a, const table_4bit htable)
 {
 	block128 b;
 	int i;
diff --git a/cbits/aes/gf.h b/cbits/aes/gf.h
--- a/cbits/aes/gf.h
+++ b/cbits/aes/gf.h
@@ -27,16 +27,16 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-#ifndef CRYPTONITE_AES_GF128MUL_H
-#define CRYPTONITE_AES_GF128MUL_H
+#ifndef CRYPTON_AES_GF128MUL_H
+#define CRYPTON_AES_GF128MUL_H
 
 #include "aes/block128.h"
 
 typedef block128 table_4bit[16];
 
-void cryptonite_aes_generic_gf_mulx(block128 *a);
+void crypton_aes_generic_gf_mulx(block128 *a);
 
-void cryptonite_aes_generic_hinit(table_4bit htable, const block128 *h);
-void cryptonite_aes_generic_gf_mul(block128 *a, const table_4bit htable);
+void crypton_aes_generic_hinit(table_4bit htable, const block128 *h);
+void crypton_aes_generic_gf_mul(block128 *a, const table_4bit htable);
 
 #endif
diff --git a/cbits/aes/x86ni.c b/cbits/aes/x86ni.c
--- a/cbits/aes/x86ni.c
+++ b/cbits/aes/x86ni.c
@@ -33,8 +33,8 @@
 #include <wmmintrin.h>
 #include <tmmintrin.h>
 #include <string.h>
-#include <cryptonite_aes.h>
-#include <cryptonite_cpu.h>
+#include <crypton_aes.h>
+#include <crypton_cpu.h>
 #include <aes/gf.h>
 #include <aes/x86ni.h>
 #include <aes/block128.h>
@@ -67,7 +67,7 @@
 }
 
 TARGET_AESNI
-void cryptonite_aesni_init(aes_key *key, uint8_t *ikey, uint8_t size)
+void crypton_aesni_init(aes_key *key, uint8_t *ikey, uint8_t size)
 {
 	__m128i k[28];
 	uint64_t *out = (uint64_t *) key->data;
@@ -167,7 +167,7 @@
 {
 	aes_block _t ALIGNMENT(16);
 	_mm_store_si128((__m128i *) &_t, tag);
-	cryptonite_aes_generic_gf_mul(&_t, htable);
+	crypton_aes_generic_gf_mul(&_t, htable);
 	tag = _mm_load_si128((__m128i *) &_t);
 	return tag;
 }
@@ -180,7 +180,7 @@
 /* See Intel carry-less-multiplication-instruction-in-gcm-mode-paper.pdf
  *
  * Adapted from figure 5, with additional byte swapping so that interface
- * is simimar to cryptonite_aes_generic_gf_mul.
+ * is simimar to crypton_aes_generic_gf_mul.
  */
 TARGET_AESNI_PCLMUL
 static __m128i gfmul_pclmuldq(__m128i a, const table_4bit htable)
@@ -236,7 +236,7 @@
 	return _mm_shuffle_epi8(tmp6, bswap_mask);
 }
 
-void cryptonite_aesni_hinit_pclmul(table_4bit htable, const block128 *h)
+void crypton_aesni_hinit_pclmul(table_4bit htable, const block128 *h)
 {
 	/* When pclmul is active we don't need to fill the table.  Instead we just
 	 * store H at index 0.  It is written in reverse order, so function
@@ -247,7 +247,7 @@
 }
 
 TARGET_AESNI_PCLMUL
-void cryptonite_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable)
+void crypton_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable)
 {
 	__m128i _a, _b;
 	_a = _mm_loadu_si128((__m128i *) a);
@@ -255,7 +255,7 @@
 	_mm_storeu_si128((__m128i *) a, _b);
 }
 
-void cryptonite_aesni_init_pclmul(void)
+void crypton_aesni_init_pclmul(void)
 {
 	gfmul_branch_ptr = gfmul_pclmuldq;
 }
diff --git a/cbits/aes/x86ni.h b/cbits/aes/x86ni.h
--- a/cbits/aes/x86ni.h
+++ b/cbits/aes/x86ni.h
@@ -37,7 +37,7 @@
 
 #include <wmmintrin.h>
 #include <tmmintrin.h>
-#include <cryptonite_aes.h>
+#include <crypton_aes.h>
 #include <aes/block128.h>
 
 #ifdef WITH_TARGET_ATTRIBUTES
@@ -58,35 +58,35 @@
 }
 #endif
 
-void cryptonite_aesni_init(aes_key *key, uint8_t *origkey, uint8_t size);
-void cryptonite_aesni_encrypt_block128(aes_block *out, aes_key *key, aes_block *in);
-void cryptonite_aesni_encrypt_block256(aes_block *out, aes_key *key, aes_block *in);
-void cryptonite_aesni_decrypt_block128(aes_block *out, aes_key *key, aes_block *in);
-void cryptonite_aesni_decrypt_block256(aes_block *out, aes_key *key, aes_block *in);
-void cryptonite_aesni_encrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_encrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_decrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_decrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_encrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_encrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_decrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_decrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_encrypt_ctr128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
-void cryptonite_aesni_encrypt_ctr256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
-void cryptonite_aesni_encrypt_c32_128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
-void cryptonite_aesni_encrypt_c32_256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
-void cryptonite_aesni_encrypt_xts128(aes_block *out, aes_key *key1, aes_key *key2,
+void crypton_aesni_init(aes_key *key, uint8_t *origkey, uint8_t size);
+void crypton_aesni_encrypt_block128(aes_block *out, aes_key *key, aes_block *in);
+void crypton_aesni_encrypt_block256(aes_block *out, aes_key *key, aes_block *in);
+void crypton_aesni_decrypt_block128(aes_block *out, aes_key *key, aes_block *in);
+void crypton_aesni_decrypt_block256(aes_block *out, aes_key *key, aes_block *in);
+void crypton_aesni_encrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
+void crypton_aesni_encrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
+void crypton_aesni_decrypt_ecb128(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
+void crypton_aesni_decrypt_ecb256(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks);
+void crypton_aesni_encrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
+void crypton_aesni_encrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
+void crypton_aesni_decrypt_cbc128(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
+void crypton_aesni_decrypt_cbc256(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks);
+void crypton_aesni_encrypt_ctr128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
+void crypton_aesni_encrypt_ctr256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
+void crypton_aesni_encrypt_c32_128(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
+void crypton_aesni_encrypt_c32_256(uint8_t *out, aes_key *key, aes_block *_iv, uint8_t *in, uint32_t length);
+void crypton_aesni_encrypt_xts128(aes_block *out, aes_key *key1, aes_key *key2,
                            aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks);
-void cryptonite_aesni_encrypt_xts256(aes_block *out, aes_key *key1, aes_key *key2,
+void crypton_aesni_encrypt_xts256(aes_block *out, aes_key *key1, aes_key *key2,
                            aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks);
 
-void cryptonite_aesni_gcm_encrypt128(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);
-void cryptonite_aesni_gcm_encrypt256(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);
+void crypton_aesni_gcm_encrypt128(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);
+void crypton_aesni_gcm_encrypt256(uint8_t *out, aes_gcm *gcm, aes_key *key, uint8_t *in, uint32_t length);
 
 #ifdef WITH_PCLMUL
-void cryptonite_aesni_init_pclmul(void);
-void cryptonite_aesni_hinit_pclmul(table_4bit htable, const block128 *h);
-void cryptonite_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable);
+void crypton_aesni_init_pclmul(void);
+void crypton_aesni_hinit_pclmul(table_4bit htable, const block128 *h);
+void crypton_aesni_gf_mul_pclmul(block128 *a, const table_4bit htable);
 #endif
 
 #endif
diff --git a/cbits/aes/x86ni_impl.c b/cbits/aes/x86ni_impl.c
--- a/cbits/aes/x86ni_impl.c
+++ b/cbits/aes/x86ni_impl.c
@@ -29,7 +29,7 @@
  */
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_encrypt_block)(aes_block *out, aes_key *key, aes_block *in)
+void SIZED(crypton_aesni_encrypt_block)(aes_block *out, aes_key *key, aes_block *in)
 {
 	__m128i *k = (__m128i *) key->data;
 	PRELOAD_ENC(k);
@@ -39,7 +39,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_decrypt_block)(aes_block *out, aes_key *key, aes_block *in)
+void SIZED(crypton_aesni_decrypt_block)(aes_block *out, aes_key *key, aes_block *in)
 {
 	__m128i *k = (__m128i *) key->data;
 	PRELOAD_DEC(k);
@@ -49,7 +49,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_encrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)
+void SIZED(crypton_aesni_encrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)
 {
 	__m128i *k = (__m128i *) key->data;
 
@@ -62,7 +62,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_decrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)
+void SIZED(crypton_aesni_decrypt_ecb)(aes_block *out, aes_key *key, aes_block *in, uint32_t blocks)
 {
 	__m128i *k = (__m128i *) key->data;
 
@@ -76,7 +76,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_encrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)
+void SIZED(crypton_aesni_encrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)
 {
 	__m128i *k = (__m128i *) key->data;
 	__m128i iv = _mm_loadu_si128((__m128i *) _iv);
@@ -93,7 +93,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_decrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)
+void SIZED(crypton_aesni_decrypt_cbc)(aes_block *out, aes_key *key, aes_block *_iv, aes_block *in, uint32_t blocks)
 {
 	__m128i *k = (__m128i *) key->data;
 	__m128i iv = _mm_loadu_si128((__m128i *) _iv);
@@ -113,7 +113,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_encrypt_ctr)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len)
+void SIZED(crypton_aesni_encrypt_ctr)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len)
 {
 	__m128i *k = (__m128i *) key->data;
 	__m128i bswap_mask = _mm_setr_epi8(7,6,5,4,3,2,1,0,15,14,13,12,11,10,9,8);
@@ -159,7 +159,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_encrypt_c32_)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len)
+void SIZED(crypton_aesni_encrypt_c32_)(uint8_t *output, aes_key *key, aes_block *_iv, uint8_t *input, uint32_t len)
 {
 	__m128i *k = (__m128i *) key->data;
 	__m128i one        = _mm_set_epi32(0,0,0,1);
@@ -201,7 +201,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_encrypt_xts)(aes_block *out, aes_key *key1, aes_key *key2,
+void SIZED(crypton_aesni_encrypt_xts)(aes_block *out, aes_key *key1, aes_key *key2,
                                aes_block *_tweak, uint32_t spoint, aes_block *in, uint32_t blocks)
 {
 	__m128i tweak = _mm_loadu_si128((__m128i *) _tweak);
@@ -232,7 +232,7 @@
 }
 
 TARGET_AESNI
-void SIZED(cryptonite_aesni_gcm_encrypt)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
+void SIZED(crypton_aesni_gcm_encrypt)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
 {
 	__m128i *k = (__m128i *) key->data;
 	__m128i bswap_mask = _mm_setr_epi8(7,6,5,4,3,2,1,0,15,14,13,12,11,10,9,8);
diff --git a/cbits/argon2/argon2.c b/cbits/argon2/argon2.c
--- a/cbits/argon2/argon2.c
+++ b/cbits/argon2/argon2.c
@@ -22,7 +22,7 @@
 #include "argon2.h"
 #include "core.c"
 
-int cryptonite_argon2_ctx(argon2_context *context, argon2_type type) {
+int crypton_argon2_ctx(argon2_context *context, argon2_type type) {
     /* 1. Validate all inputs */
     int result = validate_inputs(context);
     uint32_t memory_blocks, segment_length;
@@ -79,7 +79,7 @@
     return ARGON2_OK;
 }
 
-int cryptonite_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,
+int crypton_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,
                 const uint32_t parallelism, const void *pwd,
                 const size_t pwdlen, const void *salt, const size_t saltlen,
                 void *hash, const size_t hashlen, argon2_type type,
@@ -121,7 +121,7 @@
     context.flags = ARGON2_DEFAULT_FLAGS;
     context.version = version;
 
-    result = cryptonite_argon2_ctx(&context, type);
+    result = crypton_argon2_ctx(&context, type);
 
     if (result != ARGON2_OK) {
         clear_internal_memory(out, hashlen);
diff --git a/cbits/argon2/argon2.h b/cbits/argon2/argon2.h
--- a/cbits/argon2/argon2.h
+++ b/cbits/argon2/argon2.h
@@ -233,7 +233,7 @@
  * @param  context  Pointer to the Argon2 internal structure
  * @return Error code if smth is wrong, ARGON2_OK otherwise
  */
-ARGON2_PUBLIC int cryptonite_argon2_ctx(argon2_context *context, argon2_type type);
+ARGON2_PUBLIC int crypton_argon2_ctx(argon2_context *context, argon2_type type);
 
 /**
  * Hashes a password with Argon2i, producing a raw hash by allocating memory at
@@ -252,7 +252,7 @@
  */
 
 /* generic function underlying the above ones */
-ARGON2_PUBLIC int cryptonite_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,
+ARGON2_PUBLIC int crypton_argon2_hash(const uint32_t t_cost, const uint32_t m_cost,
                               const uint32_t parallelism, const void *pwd,
                               const size_t pwdlen, const void *salt,
                               const size_t saltlen, void *hash,
diff --git a/cbits/argon2/core.c b/cbits/argon2/core.c
--- a/cbits/argon2/core.c
+++ b/cbits/argon2/core.c
@@ -83,25 +83,25 @@
     } while ((void)0, 0)
 
     if (outlen <= BLAKE2B_OUTBYTES) {
-        TRY(_cryptonite_blake2b_init(&blake_state, outlen));
-        TRY(_cryptonite_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));
-        TRY(_cryptonite_blake2b_update(&blake_state, in, inlen));
-        TRY(_cryptonite_blake2b_final(&blake_state, out, outlen));
+        TRY(_crypton_blake2b_init(&blake_state, outlen));
+        TRY(_crypton_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));
+        TRY(_crypton_blake2b_update(&blake_state, in, inlen));
+        TRY(_crypton_blake2b_final(&blake_state, out, outlen));
     } else {
         uint32_t toproduce;
         uint8_t out_buffer[BLAKE2B_OUTBYTES];
         uint8_t in_buffer[BLAKE2B_OUTBYTES];
-        TRY(_cryptonite_blake2b_init(&blake_state, BLAKE2B_OUTBYTES));
-        TRY(_cryptonite_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));
-        TRY(_cryptonite_blake2b_update(&blake_state, in, inlen));
-        TRY(_cryptonite_blake2b_final(&blake_state, out_buffer, BLAKE2B_OUTBYTES));
+        TRY(_crypton_blake2b_init(&blake_state, BLAKE2B_OUTBYTES));
+        TRY(_crypton_blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes)));
+        TRY(_crypton_blake2b_update(&blake_state, in, inlen));
+        TRY(_crypton_blake2b_final(&blake_state, out_buffer, BLAKE2B_OUTBYTES));
         memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2);
         out += BLAKE2B_OUTBYTES / 2;
         toproduce = (uint32_t)outlen - BLAKE2B_OUTBYTES / 2;
 
         while (toproduce > BLAKE2B_OUTBYTES) {
             memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES);
-            TRY(_cryptonite_blake2b(out_buffer, BLAKE2B_OUTBYTES, in_buffer,
+            TRY(_crypton_blake2b(out_buffer, BLAKE2B_OUTBYTES, in_buffer,
                         BLAKE2B_OUTBYTES, NULL, 0));
             memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2);
             out += BLAKE2B_OUTBYTES / 2;
@@ -109,7 +109,7 @@
         }
 
         memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES);
-        TRY(_cryptonite_blake2b(out_buffer, toproduce, in_buffer, BLAKE2B_OUTBYTES, NULL,
+        TRY(_crypton_blake2b(out_buffer, toproduce, in_buffer, BLAKE2B_OUTBYTES, NULL,
                     0));
         memcpy(out, out_buffer, toproduce);
     }
@@ -597,31 +597,31 @@
         return;
     }
 
-    _cryptonite_blake2b_init(&BlakeHash, ARGON2_PREHASH_DIGEST_LENGTH);
+    _crypton_blake2b_init(&BlakeHash, ARGON2_PREHASH_DIGEST_LENGTH);
 
     store32(&value, context->lanes);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     store32(&value, context->outlen);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     store32(&value, context->m_cost);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     store32(&value, context->t_cost);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     store32(&value, context->version);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     store32(&value, (uint32_t)type);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     store32(&value, context->pwdlen);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     if (context->pwd != NULL) {
-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->pwd,
+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->pwd,
                        context->pwdlen);
 
         if (context->flags & ARGON2_FLAG_CLEAR_PASSWORD) {
@@ -631,18 +631,18 @@
     }
 
     store32(&value, context->saltlen);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     if (context->salt != NULL) {
-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->salt,
+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->salt,
                        context->saltlen);
     }
 
     store32(&value, context->secretlen);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     if (context->secret != NULL) {
-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->secret,
+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->secret,
                        context->secretlen);
 
         if (context->flags & ARGON2_FLAG_CLEAR_SECRET) {
@@ -652,14 +652,14 @@
     }
 
     store32(&value, context->adlen);
-    _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
+    _crypton_blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value));
 
     if (context->ad != NULL) {
-        _cryptonite_blake2b_update(&BlakeHash, (const uint8_t *)context->ad,
+        _crypton_blake2b_update(&BlakeHash, (const uint8_t *)context->ad,
                        context->adlen);
     }
 
-    _cryptonite_blake2b_final(&BlakeHash, blockhash, ARGON2_PREHASH_DIGEST_LENGTH);
+    _crypton_blake2b_final(&BlakeHash, blockhash, ARGON2_PREHASH_DIGEST_LENGTH);
 }
 static
 int initialize(argon2_instance_t *instance, argon2_context *context) {
diff --git a/cbits/blake2/ref/blake2.h b/cbits/blake2/ref/blake2.h
--- a/cbits/blake2/ref/blake2.h
+++ b/cbits/blake2/ref/blake2.h
@@ -142,51 +142,51 @@
   };
 
   /* Streaming API */
-  int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen );
-  int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P );
-  int _cryptonite_blake2s_update( blake2s_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen );
+  int _crypton_blake2s_init( blake2s_state *S, size_t outlen );
+  int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P );
+  int _crypton_blake2s_update( blake2s_state *S, const void *in, size_t inlen );
+  int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen );
 
-  int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen );
-  int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P );
-  int _cryptonite_blake2b_update( blake2b_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen );
+  int _crypton_blake2b_init( blake2b_state *S, size_t outlen );
+  int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P );
+  int _crypton_blake2b_update( blake2b_state *S, const void *in, size_t inlen );
+  int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen );
 
-  int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen );
-  int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen );
+  int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen );
+  int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );
+  int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen );
 
-  int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen );
-  int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );
+  int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen );
+  int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );
+  int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );
 
   /* Variable output length API */
-  int _cryptonite_blake2xs_init( blake2xs_state *S, const size_t outlen );
-  int _cryptonite_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2xs_final(blake2xs_state *S, void *out, size_t outlen);
+  int _crypton_blake2xs_init( blake2xs_state *S, const size_t outlen );
+  int _crypton_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );
+  int _crypton_blake2xs_final(blake2xs_state *S, void *out, size_t outlen);
 
-  int _cryptonite_blake2xb_init( blake2xb_state *S, const size_t outlen );
-  int _cryptonite_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);
+  int _crypton_blake2xb_init( blake2xb_state *S, const size_t outlen );
+  int _crypton_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );
+  int _crypton_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);
 
   /* Simple API */
-  int _cryptonite_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
-  int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
-  int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
-  int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
-  int _cryptonite_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
-  int _cryptonite_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
   /* This is simply an alias for blake2b */
-  int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
 #if defined(__cplusplus)
 }
diff --git a/cbits/blake2/ref/blake2b-ref.c b/cbits/blake2/ref/blake2b-ref.c
--- a/cbits/blake2/ref/blake2b-ref.c
+++ b/cbits/blake2/ref/blake2b-ref.c
@@ -78,7 +78,7 @@
 }
 
 /* init xors IV with input parameter block */
-int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P )
+int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P )
 {
   const uint8_t *p = ( const uint8_t * )( P );
   size_t i;
@@ -95,7 +95,7 @@
 
 
 
-int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen )
+int _crypton_blake2b_init( blake2b_state *S, size_t outlen )
 {
   blake2b_param P[1];
 
@@ -113,11 +113,11 @@
   memset( P->reserved, 0, sizeof( P->reserved ) );
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
-  return _cryptonite_blake2b_init_param( S, P );
+  return _crypton_blake2b_init_param( S, P );
 }
 
 
-int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen )
 {
   blake2b_param P[1];
 
@@ -138,13 +138,13 @@
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
 
-  if( _cryptonite_blake2b_init_param( S, P ) < 0 ) return -1;
+  if( _crypton_blake2b_init_param( S, P ) < 0 ) return -1;
 
   {
     uint8_t block[BLAKE2B_BLOCKBYTES];
     memset( block, 0, BLAKE2B_BLOCKBYTES );
     memcpy( block, key, keylen );
-    _cryptonite_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );
+    _crypton_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );
     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
   }
   return 0;
@@ -218,7 +218,7 @@
 #undef G
 #undef ROUND
 
-int _cryptonite_blake2b_update( blake2b_state *S, const void *pin, size_t inlen )
+int _crypton_blake2b_update( blake2b_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   if( inlen > 0 )
@@ -245,7 +245,7 @@
   return 0;
 }
 
-int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen )
+int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen )
 {
   uint8_t buffer[BLAKE2B_OUTBYTES] = {0};
   size_t i;
@@ -270,7 +270,7 @@
 }
 
 /* inlen, at least, should be uint64_t. Others can be size_t. */
-int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
+int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
 {
   blake2b_state S[1];
 
@@ -287,26 +287,26 @@
 
   if( keylen > 0 )
   {
-    if( _cryptonite_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;
+    if( _crypton_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;
   }
   else
   {
-    if( _cryptonite_blake2b_init( S, outlen ) < 0 ) return -1;
+    if( _crypton_blake2b_init( S, outlen ) < 0 ) return -1;
   }
 
-  _cryptonite_blake2b_update( S, ( const uint8_t * )in, inlen );
-  _cryptonite_blake2b_final( S, out, outlen );
+  _crypton_blake2b_update( S, ( const uint8_t * )in, inlen );
+  _crypton_blake2b_final( S, out, outlen );
   return 0;
 }
 
-int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {
-  return _cryptonite_blake2b(out, outlen, in, inlen, key, keylen);
+int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {
+  return _crypton_blake2b(out, outlen, in, inlen, key, keylen);
 }
 
 #if defined(SUPERCOP)
 int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen )
 {
-  return _cryptonite_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 );
+  return _crypton_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 );
 }
 #endif
 
@@ -329,9 +329,9 @@
   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
   {
     uint8_t hash[BLAKE2B_OUTBYTES];
-    _cryptonite_blake2b( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );
+    _crypton_blake2b( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );
 
-    if( 0 != memcmp( hash, _cryptonite_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES ) )
+    if( 0 != memcmp( hash, _crypton_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES ) )
     {
       goto fail;
     }
@@ -346,25 +346,25 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2b_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2b_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2b_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2b_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
         goto fail;
       }
 
-      if (0 != memcmp(hash, _cryptonite_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES)) {
+      if (0 != memcmp(hash, _crypton_blake2b_keyed_kat[i], BLAKE2B_OUTBYTES)) {
         goto fail;
       }
     }
diff --git a/cbits/blake2/ref/blake2bp-ref.c b/cbits/blake2/ref/blake2bp-ref.c
--- a/cbits/blake2/ref/blake2bp-ref.c
+++ b/cbits/blake2/ref/blake2bp-ref.c
@@ -36,7 +36,7 @@
 */
 static int blake2bp_init_leaf_param( blake2b_state *S, const blake2b_param *P )
 {
-  int err = _cryptonite_blake2b_init_param(S, P);
+  int err = _crypton_blake2b_init_param(S, P);
   S->outlen = P->inner_length;
   return err;
 }
@@ -74,11 +74,11 @@
   memset( P->reserved, 0, sizeof( P->reserved ) );
   memset( P->salt, 0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
-  return _cryptonite_blake2b_init_param( S, P );
+  return _crypton_blake2b_init_param( S, P );
 }
 
 
-int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen )
+int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen )
 {
   size_t i;
 
@@ -99,7 +99,7 @@
   return 0;
 }
 
-int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen )
 {
   size_t i;
 
@@ -125,7 +125,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -133,7 +133,7 @@
 }
 
 
-int _cryptonite_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen )
+int _crypton_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   size_t left = S->buflen;
@@ -145,7 +145,7 @@
     memcpy( S->buf + left, in, fill );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );
 
     in += fill;
     inlen -= fill;
@@ -168,7 +168,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )
     {
-      _cryptonite_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
     }
@@ -184,7 +184,7 @@
   return 0;
 }
 
-int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen )
+int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];
   size_t i;
@@ -201,19 +201,19 @@
 
       if( left > BLAKE2B_BLOCKBYTES ) left = BLAKE2B_BLOCKBYTES;
 
-      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );
+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );
     }
 
-    _cryptonite_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );
   }
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES );
 
-  return _cryptonite_blake2b_final( S->R, out, S->outlen );
+  return _crypton_blake2b_final( S->R, out, S->outlen );
 }
 
-int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
+int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];
   blake2b_state S[PARALLELISM_DEGREE][1];
@@ -243,7 +243,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -264,7 +264,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )
     {
-      _cryptonite_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
     }
@@ -273,10 +273,10 @@
     {
       const size_t left = inlen__ - i * BLAKE2B_BLOCKBYTES;
       const size_t len = left <= BLAKE2B_BLOCKBYTES ? left : BLAKE2B_BLOCKBYTES;
-      _cryptonite_blake2b_update( S[i], in__, len );
+      _crypton_blake2b_update( S[i], in__, len );
     }
 
-    _cryptonite_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );
   }
 
   if( blake2bp_init_root( FS, outlen, keylen ) < 0 )
@@ -285,9 +285,9 @@
   FS->last_node = 1; /* Mark as last node */
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES );
 
-  return _cryptonite_blake2b_final( FS, out, outlen );;
+  return _crypton_blake2b_final( FS, out, outlen );;
 }
 
 #if defined(BLAKE2BP_SELFTEST)
@@ -326,21 +326,21 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2bp_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2bp_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2bp_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2bp_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
         goto fail;
       }
 
diff --git a/cbits/blake2/ref/blake2s-ref.c b/cbits/blake2/ref/blake2s-ref.c
--- a/cbits/blake2/ref/blake2s-ref.c
+++ b/cbits/blake2/ref/blake2s-ref.c
@@ -73,7 +73,7 @@
 }
 
 /* init2 xors IV with input parameter block */
-int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P )
+int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P )
 {
   const unsigned char *p = ( const unsigned char * )( P );
   size_t i;
@@ -90,7 +90,7 @@
 
 
 /* Sequential blake2s initialization */
-int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen )
+int _crypton_blake2s_init( blake2s_state *S, size_t outlen )
 {
   blake2s_param P[1];
 
@@ -109,10 +109,10 @@
   /* memset(P->reserved, 0, sizeof(P->reserved) ); */
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
-  return _cryptonite_blake2s_init_param( S, P );
+  return _crypton_blake2s_init_param( S, P );
 }
 
-int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )
 {
   blake2s_param P[1];
 
@@ -133,13 +133,13 @@
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
 
-  if( _cryptonite_blake2s_init_param( S, P ) < 0 ) return -1;
+  if( _crypton_blake2s_init_param( S, P ) < 0 ) return -1;
 
   {
     uint8_t block[BLAKE2S_BLOCKBYTES];
     memset( block, 0, BLAKE2S_BLOCKBYTES );
     memcpy( block, key, keylen );
-    _cryptonite_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
+    _crypton_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
   }
   return 0;
@@ -211,7 +211,7 @@
 #undef G
 #undef ROUND
 
-int _cryptonite_blake2s_update( blake2s_state *S, const void *pin, size_t inlen )
+int _crypton_blake2s_update( blake2s_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   if( inlen > 0 )
@@ -238,7 +238,7 @@
   return 0;
 }
 
-int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen )
+int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen )
 {
   uint8_t buffer[BLAKE2S_OUTBYTES] = {0};
   size_t i;
@@ -262,7 +262,7 @@
   return 0;
 }
 
-int _cryptonite_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
+int _crypton_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
 {
   blake2s_state S[1];
 
@@ -279,22 +279,22 @@
 
   if( keylen > 0 )
   {
-    if( _cryptonite_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
+    if( _crypton_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
   }
   else
   {
-    if( _cryptonite_blake2s_init( S, outlen ) < 0 ) return -1;
+    if( _crypton_blake2s_init( S, outlen ) < 0 ) return -1;
   }
 
-  _cryptonite_blake2s_update( S, ( const uint8_t * )in, inlen );
-  _cryptonite_blake2s_final( S, out, outlen );
+  _crypton_blake2s_update( S, ( const uint8_t * )in, inlen );
+  _crypton_blake2s_final( S, out, outlen );
   return 0;
 }
 
 #if defined(SUPERCOP)
 int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen )
 {
-  return _cryptonite_blake2s( out, BLAKE2S_OUTBYTES, in, inlen, NULL, 0 );
+  return _crypton_blake2s( out, BLAKE2S_OUTBYTES, in, inlen, NULL, 0 );
 }
 #endif
 
@@ -317,7 +317,7 @@
   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
   {
     uint8_t hash[BLAKE2S_OUTBYTES];
-    _cryptonite_blake2s( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );
+    _crypton_blake2s( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );
 
     if( 0 != memcmp( hash, blake2s_keyed_kat[i], BLAKE2S_OUTBYTES ) )
     {
@@ -334,21 +334,21 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2s_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2s_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2s_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2s_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
         goto fail;
       }
 
diff --git a/cbits/blake2/ref/blake2sp-ref.c b/cbits/blake2/ref/blake2sp-ref.c
--- a/cbits/blake2/ref/blake2sp-ref.c
+++ b/cbits/blake2/ref/blake2sp-ref.c
@@ -35,7 +35,7 @@
 */
 static int blake2sp_init_leaf_param( blake2s_state *S, const blake2s_param *P )
 {
-  int err = _cryptonite_blake2s_init_param(S, P);
+  int err = _crypton_blake2s_init_param(S, P);
   S->outlen = P->inner_length;
   return err;
 }
@@ -71,11 +71,11 @@
   P->inner_length = BLAKE2S_OUTBYTES;
   memset( P->salt, 0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
-  return _cryptonite_blake2s_init_param( S, P );
+  return _crypton_blake2s_init_param( S, P );
 }
 
 
-int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen )
+int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen )
 {
   size_t i;
 
@@ -96,7 +96,7 @@
   return 0;
 }
 
-int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen )
 {
   size_t i;
 
@@ -122,7 +122,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -130,7 +130,7 @@
 }
 
 
-int _cryptonite_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen )
+int _crypton_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   size_t left = S->buflen;
@@ -142,7 +142,7 @@
     memcpy( S->buf + left, in, fill );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );
 
     in += fill;
     inlen -= fill;
@@ -164,7 +164,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )
     {
-      _cryptonite_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
     }
@@ -181,7 +181,7 @@
 }
 
 
-int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen )
+int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];
   size_t i;
@@ -198,20 +198,20 @@
 
       if( left > BLAKE2S_BLOCKBYTES ) left = BLAKE2S_BLOCKBYTES;
 
-      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );
+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );
     }
 
-    _cryptonite_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );
   }
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES );
 
-  return _cryptonite_blake2s_final( S->R, out, S->outlen );
+  return _crypton_blake2s_final( S->R, out, S->outlen );
 }
 
 
-int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
+int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];
   blake2s_state S[PARALLELISM_DEGREE][1];
@@ -241,7 +241,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -262,7 +262,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )
     {
-      _cryptonite_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
     }
@@ -271,10 +271,10 @@
     {
       const size_t left = inlen__ - i * BLAKE2S_BLOCKBYTES;
       const size_t len = left <= BLAKE2S_BLOCKBYTES ? left : BLAKE2S_BLOCKBYTES;
-      _cryptonite_blake2s_update( S[i], in__, len );
+      _crypton_blake2s_update( S[i], in__, len );
     }
 
-    _cryptonite_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );
   }
 
   if( blake2sp_init_root( FS, outlen, keylen ) < 0 )
@@ -283,9 +283,9 @@
   FS->last_node = 1;
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES );
 
-  return _cryptonite_blake2s_final( FS, out, outlen );
+  return _crypton_blake2s_final( FS, out, outlen );
 }
 
 
@@ -309,7 +309,7 @@
   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
   {
     uint8_t hash[BLAKE2S_OUTBYTES];
-    _cryptonite_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );
+    _crypton_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );
 
     if( 0 != memcmp( hash, blake2sp_keyed_kat[i], BLAKE2S_OUTBYTES ) )
     {
@@ -326,21 +326,21 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2sp_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2sp_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2sp_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2sp_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
         goto fail;
       }
 
diff --git a/cbits/blake2/sse/blake2.h b/cbits/blake2/sse/blake2.h
--- a/cbits/blake2/sse/blake2.h
+++ b/cbits/blake2/sse/blake2.h
@@ -142,51 +142,51 @@
   };
 
   /* Streaming API */
-  int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen );
-  int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P );
-  int _cryptonite_blake2s_update( blake2s_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen );
+  int _crypton_blake2s_init( blake2s_state *S, size_t outlen );
+  int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P );
+  int _crypton_blake2s_update( blake2s_state *S, const void *in, size_t inlen );
+  int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen );
 
-  int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen );
-  int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P );
-  int _cryptonite_blake2b_update( blake2b_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen );
+  int _crypton_blake2b_init( blake2b_state *S, size_t outlen );
+  int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P );
+  int _crypton_blake2b_update( blake2b_state *S, const void *in, size_t inlen );
+  int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen );
 
-  int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen );
-  int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen );
+  int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen );
+  int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2sp_update( blake2sp_state *S, const void *in, size_t inlen );
+  int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen );
 
-  int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen );
-  int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );
+  int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen );
+  int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2bp_update( blake2bp_state *S, const void *in, size_t inlen );
+  int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen );
 
   /* Variable output length API */
-  int _cryptonite_blake2xs_init( blake2xs_state *S, const size_t outlen );
-  int _cryptonite_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2xs_final(blake2xs_state *S, void *out, size_t outlen);
+  int _crypton_blake2xs_init( blake2xs_state *S, const size_t outlen );
+  int _crypton_blake2xs_init_key( blake2xs_state *S, const size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2xs_update( blake2xs_state *S, const void *in, size_t inlen );
+  int _crypton_blake2xs_final(blake2xs_state *S, void *out, size_t outlen);
 
-  int _cryptonite_blake2xb_init( blake2xb_state *S, const size_t outlen );
-  int _cryptonite_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );
-  int _cryptonite_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );
-  int _cryptonite_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);
+  int _crypton_blake2xb_init( blake2xb_state *S, const size_t outlen );
+  int _crypton_blake2xb_init_key( blake2xb_state *S, const size_t outlen, const void *key, size_t keylen );
+  int _crypton_blake2xb_update( blake2xb_state *S, const void *in, size_t inlen );
+  int _crypton_blake2xb_final(blake2xb_state *S, void *out, size_t outlen);
 
   /* Simple API */
-  int _cryptonite_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
-  int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
-  int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
-  int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
-  int _cryptonite_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
-  int _cryptonite_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2xs( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
   /* This is simply an alias for blake2b */
-  int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
 #if defined(__cplusplus)
 }
diff --git a/cbits/blake2/sse/blake2b.c b/cbits/blake2/sse/blake2b.c
--- a/cbits/blake2/sse/blake2b.c
+++ b/cbits/blake2/sse/blake2b.c
@@ -74,7 +74,7 @@
 }
 
 /* init xors IV with input parameter block */
-int _cryptonite_blake2b_init_param( blake2b_state *S, const blake2b_param *P )
+int _crypton_blake2b_init_param( blake2b_state *S, const blake2b_param *P )
 {
   size_t i;
   /*blake2b_init0( S ); */
@@ -92,7 +92,7 @@
 
 
 /* Some sort of default parameter block initialization, for sequential blake2b */
-int _cryptonite_blake2b_init( blake2b_state *S, size_t outlen )
+int _crypton_blake2b_init( blake2b_state *S, size_t outlen )
 {
   blake2b_param P[1];
 
@@ -111,10 +111,10 @@
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
 
-  return _cryptonite_blake2b_init_param( S, P );
+  return _crypton_blake2b_init_param( S, P );
 }
 
-int _cryptonite_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen )
 {
   blake2b_param P[1];
 
@@ -135,14 +135,14 @@
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
 
-  if( _cryptonite_blake2b_init_param( S, P ) < 0 )
+  if( _crypton_blake2b_init_param( S, P ) < 0 )
     return 0;
 
   {
     uint8_t block[BLAKE2B_BLOCKBYTES];
     memset( block, 0, BLAKE2B_BLOCKBYTES );
     memcpy( block, key, keylen );
-    _cryptonite_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );
+    _crypton_blake2b_update( S, block, BLAKE2B_BLOCKBYTES );
     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
   }
   return 0;
@@ -218,7 +218,7 @@
 }
 
 
-int _cryptonite_blake2b_update( blake2b_state *S, const void *pin, size_t inlen )
+int _crypton_blake2b_update( blake2b_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   if( inlen > 0 )
@@ -246,7 +246,7 @@
 }
 
 
-int _cryptonite_blake2b_final( blake2b_state *S, void *out, size_t outlen )
+int _crypton_blake2b_final( blake2b_state *S, void *out, size_t outlen )
 {
   if( out == NULL || outlen < S->outlen )
     return -1;
@@ -264,7 +264,7 @@
 }
 
 
-int _cryptonite_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
+int _crypton_blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
 {
   blake2b_state S[1];
 
@@ -281,26 +281,26 @@
 
   if( keylen )
   {
-    if( _cryptonite_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;
+    if( _crypton_blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;
   }
   else
   {
-    if( _cryptonite_blake2b_init( S, outlen ) < 0 ) return -1;
+    if( _crypton_blake2b_init( S, outlen ) < 0 ) return -1;
   }
 
-  _cryptonite_blake2b_update( S, ( const uint8_t * )in, inlen );
-  _cryptonite_blake2b_final( S, out, outlen );
+  _crypton_blake2b_update( S, ( const uint8_t * )in, inlen );
+  _crypton_blake2b_final( S, out, outlen );
   return 0;
 }
 
-int _cryptonite_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {
-  return _cryptonite_blake2b(out, outlen, in, inlen, key, keylen);
+int _crypton_blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen ) {
+  return _crypton_blake2b(out, outlen, in, inlen, key, keylen);
 }
 
 #if defined(SUPERCOP)
 int crypto_hash( unsigned char *out, unsigned char *in, unsigned long long inlen )
 {
-  return _cryptonite_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 );
+  return _crypton_blake2b( out, BLAKE2B_OUTBYTES, in, inlen, NULL, 0 );
 }
 #endif
 
@@ -340,21 +340,21 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2b_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2b_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2b_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2b_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2b_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2b_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
         goto fail;
       }
 
diff --git a/cbits/blake2/sse/blake2bp.c b/cbits/blake2/sse/blake2bp.c
--- a/cbits/blake2/sse/blake2bp.c
+++ b/cbits/blake2/sse/blake2bp.c
@@ -36,7 +36,7 @@
 */
 static int blake2bp_init_leaf_param( blake2b_state *S, const blake2b_param *P )
 {
-  int err = _cryptonite_blake2b_init_param(S, P);
+  int err = _crypton_blake2b_init_param(S, P);
   S->outlen = P->inner_length;
   return err;
 }
@@ -74,11 +74,11 @@
   memset( P->reserved, 0, sizeof( P->reserved ) );
   memset( P->salt, 0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
-  return _cryptonite_blake2b_init_param( S, P );
+  return _crypton_blake2b_init_param( S, P );
 }
 
 
-int _cryptonite_blake2bp_init( blake2bp_state *S, size_t outlen )
+int _crypton_blake2bp_init( blake2bp_state *S, size_t outlen )
 {
   size_t i;
   if( !outlen || outlen > BLAKE2B_OUTBYTES ) return -1;
@@ -98,7 +98,7 @@
   return 0;
 }
 
-int _cryptonite_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2bp_init_key( blake2bp_state *S, size_t outlen, const void *key, size_t keylen )
 {
   size_t i;
 
@@ -124,7 +124,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S->S[i], block, BLAKE2B_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -132,7 +132,7 @@
 }
 
 
-int _cryptonite_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen )
+int _crypton_blake2bp_update( blake2bp_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   size_t left = S->buflen;
@@ -144,7 +144,7 @@
     memcpy( S->buf + left, in, fill );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES );
 
     in += fill;
     inlen -= fill;
@@ -167,7 +167,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )
     {
-      _cryptonite_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S->S[i], in__, BLAKE2B_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
     }
@@ -185,7 +185,7 @@
 
 
 
-int _cryptonite_blake2bp_final( blake2bp_state *S, void *out, size_t outlen )
+int _crypton_blake2bp_final( blake2bp_state *S, void *out, size_t outlen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];
   size_t i;
@@ -202,19 +202,19 @@
 
       if( left > BLAKE2B_BLOCKBYTES ) left = BLAKE2B_BLOCKBYTES;
 
-      _cryptonite_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );
+      _crypton_blake2b_update( S->S[i], S->buf + i * BLAKE2B_BLOCKBYTES, left );
     }
 
-    _cryptonite_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_final( S->S[i], hash[i], BLAKE2B_OUTBYTES );
   }
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_update( S->R, hash[i], BLAKE2B_OUTBYTES );
 
-  return _cryptonite_blake2b_final( S->R, out, S->outlen );
+  return _crypton_blake2b_final( S->R, out, S->outlen );
 }
 
-int _cryptonite_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
+int _crypton_blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2B_OUTBYTES];
   blake2b_state S[PARALLELISM_DEGREE][1];
@@ -244,7 +244,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S[i], block, BLAKE2B_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -265,7 +265,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES )
     {
-      _cryptonite_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );
+      _crypton_blake2b_update( S[i], in__, BLAKE2B_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2B_BLOCKBYTES;
     }
@@ -274,10 +274,10 @@
     {
       const size_t left = inlen__ - i * BLAKE2B_BLOCKBYTES;
       const size_t len = left <= BLAKE2B_BLOCKBYTES ? left : BLAKE2B_BLOCKBYTES;
-      _cryptonite_blake2b_update( S[i], in__, len );
+      _crypton_blake2b_update( S[i], in__, len );
     }
 
-    _cryptonite_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_final( S[i], hash[i], BLAKE2B_OUTBYTES );
   }
 
   if( blake2bp_init_root( FS, outlen, keylen ) < 0 )
@@ -286,9 +286,9 @@
   FS->last_node = 1; /* Mark as last node */
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES );
+    _crypton_blake2b_update( FS, hash[i], BLAKE2B_OUTBYTES );
 
-  return _cryptonite_blake2b_final( FS, out, outlen );
+  return _crypton_blake2b_final( FS, out, outlen );
 }
 
 
@@ -311,7 +311,7 @@
   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
   {
     uint8_t hash[BLAKE2B_OUTBYTES];
-    _cryptonite_blake2bp( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );
+    _crypton_blake2bp( hash, BLAKE2B_OUTBYTES, buf, i, key, BLAKE2B_KEYBYTES );
 
     if( 0 != memcmp( hash, blake2bp_keyed_kat[i], BLAKE2B_OUTBYTES ) )
     {
@@ -328,21 +328,21 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2bp_init_key(&S, BLAKE2B_OUTBYTES, key, BLAKE2B_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2bp_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2bp_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2bp_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2bp_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2bp_final(&S, hash, BLAKE2B_OUTBYTES)) < 0) {
         goto fail;
       }
 
diff --git a/cbits/blake2/sse/blake2s.c b/cbits/blake2/sse/blake2s.c
--- a/cbits/blake2/sse/blake2s.c
+++ b/cbits/blake2/sse/blake2s.c
@@ -72,7 +72,7 @@
 }
 
 /* init2 xors IV with input parameter block */
-int _cryptonite_blake2s_init_param( blake2s_state *S, const blake2s_param *P )
+int _crypton_blake2s_init_param( blake2s_state *S, const blake2s_param *P )
 {
   size_t i;
   /*blake2s_init0( S ); */
@@ -90,7 +90,7 @@
 
 
 /* Some sort of default parameter block initialization, for sequential blake2s */
-int _cryptonite_blake2s_init( blake2s_state *S, size_t outlen )
+int _crypton_blake2s_init( blake2s_state *S, size_t outlen )
 {
   blake2s_param P[1];
 
@@ -110,11 +110,11 @@
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
 
-  return _cryptonite_blake2s_init_param( S, P );
+  return _crypton_blake2s_init_param( S, P );
 }
 
 
-int _cryptonite_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen )
 {
   blake2s_param P[1];
 
@@ -136,14 +136,14 @@
   memset( P->salt,     0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
 
-  if( _cryptonite_blake2s_init_param( S, P ) < 0 )
+  if( _crypton_blake2s_init_param( S, P ) < 0 )
     return -1;
 
   {
     uint8_t block[BLAKE2S_BLOCKBYTES];
     memset( block, 0, BLAKE2S_BLOCKBYTES );
     memcpy( block, key, keylen );
-    _cryptonite_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
+    _crypton_blake2s_update( S, block, BLAKE2S_BLOCKBYTES );
     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
   }
   return 0;
@@ -206,7 +206,7 @@
   STOREU( &S->h[4], _mm_xor_si128( ff1, _mm_xor_si128( row2, row4 ) ) );
 }
 
-int _cryptonite_blake2s_update( blake2s_state *S, const void *pin, size_t inlen )
+int _crypton_blake2s_update( blake2s_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   if( inlen > 0 )
@@ -233,7 +233,7 @@
   return 0;
 }
 
-int _cryptonite_blake2s_final( blake2s_state *S, void *out, size_t outlen )
+int _crypton_blake2s_final( blake2s_state *S, void *out, size_t outlen )
 {
   uint8_t buffer[BLAKE2S_OUTBYTES] = {0};
   size_t i;
@@ -275,15 +275,15 @@
 
   if( keylen > 0 )
   {
-    if( _cryptonite_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
+    if( _crypton_blake2s_init_key( S, outlen, key, keylen ) < 0 ) return -1;
   }
   else
   {
-    if( _cryptonite_blake2s_init( S, outlen ) < 0 ) return -1;
+    if( _crypton_blake2s_init( S, outlen ) < 0 ) return -1;
   }
 
-  _cryptonite_blake2s_update( S, ( const uint8_t * )in, inlen );
-  _cryptonite_blake2s_final( S, out, outlen );
+  _crypton_blake2s_update( S, ( const uint8_t * )in, inlen );
+  _crypton_blake2s_final( S, out, outlen );
   return 0;
 }
 
@@ -330,21 +330,21 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2s_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2s_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2s_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2s_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2s_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2s_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
         goto fail;
       }
 
diff --git a/cbits/blake2/sse/blake2sp.c b/cbits/blake2/sse/blake2sp.c
--- a/cbits/blake2/sse/blake2sp.c
+++ b/cbits/blake2/sse/blake2sp.c
@@ -35,7 +35,7 @@
 */
 static int blake2sp_init_leaf_param( blake2s_state *S, const blake2s_param *P )
 {
-  int err = _cryptonite_blake2s_init_param(S, P);
+  int err = _crypton_blake2s_init_param(S, P);
   S->outlen = P->inner_length;
   return err;
 }
@@ -71,11 +71,11 @@
   P->inner_length = BLAKE2S_OUTBYTES;
   memset( P->salt, 0, sizeof( P->salt ) );
   memset( P->personal, 0, sizeof( P->personal ) );
-  return _cryptonite_blake2s_init_param( S, P );
+  return _crypton_blake2s_init_param( S, P );
 }
 
 
-int _cryptonite_blake2sp_init( blake2sp_state *S, size_t outlen )
+int _crypton_blake2sp_init( blake2sp_state *S, size_t outlen )
 {
   size_t i;
 
@@ -96,7 +96,7 @@
   return 0;
 }
 
-int _cryptonite_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen )
+int _crypton_blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen )
 {
   size_t i;
 
@@ -122,7 +122,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S->S[i], block, BLAKE2S_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -130,7 +130,7 @@
 }
 
 
-int _cryptonite_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen )
+int _crypton_blake2sp_update( blake2sp_state *S, const void *pin, size_t inlen )
 {
   const unsigned char * in = (const unsigned char *)pin;
   size_t left = S->buflen;
@@ -142,7 +142,7 @@
     memcpy( S->buf + left, in, fill );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, BLAKE2S_BLOCKBYTES );
 
     in += fill;
     inlen -= fill;
@@ -165,7 +165,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )
     {
-      _cryptonite_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S->S[i], in__, BLAKE2S_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
     }
@@ -182,7 +182,7 @@
 }
 
 
-int _cryptonite_blake2sp_final( blake2sp_state *S, void *out, size_t outlen )
+int _crypton_blake2sp_final( blake2sp_state *S, void *out, size_t outlen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];
   size_t i;
@@ -199,20 +199,20 @@
 
       if( left > BLAKE2S_BLOCKBYTES ) left = BLAKE2S_BLOCKBYTES;
 
-      _cryptonite_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );
+      _crypton_blake2s_update( S->S[i], S->buf + i * BLAKE2S_BLOCKBYTES, left );
     }
 
-    _cryptonite_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_final( S->S[i], hash[i], BLAKE2S_OUTBYTES );
   }
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_update( S->R, hash[i], BLAKE2S_OUTBYTES );
 
-  return _cryptonite_blake2s_final( S->R, out, S->outlen );
+  return _crypton_blake2s_final( S->R, out, S->outlen );
 }
 
 
-int _cryptonite_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
+int _crypton_blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen )
 {
   uint8_t hash[PARALLELISM_DEGREE][BLAKE2S_OUTBYTES];
   blake2s_state S[PARALLELISM_DEGREE][1];
@@ -242,7 +242,7 @@
     memcpy( block, key, keylen );
 
     for( i = 0; i < PARALLELISM_DEGREE; ++i )
-      _cryptonite_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S[i], block, BLAKE2S_BLOCKBYTES );
 
     secure_zero_memory( block, BLAKE2S_BLOCKBYTES ); /* Burn the key from stack */
   }
@@ -263,7 +263,7 @@
 
     while( inlen__ >= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES )
     {
-      _cryptonite_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );
+      _crypton_blake2s_update( S[i], in__, BLAKE2S_BLOCKBYTES );
       in__ += PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
       inlen__ -= PARALLELISM_DEGREE * BLAKE2S_BLOCKBYTES;
     }
@@ -272,10 +272,10 @@
     {
       const size_t left = inlen__ - i * BLAKE2S_BLOCKBYTES;
       const size_t len = left <= BLAKE2S_BLOCKBYTES ? left : BLAKE2S_BLOCKBYTES;
-      _cryptonite_blake2s_update( S[i], in__, len );
+      _crypton_blake2s_update( S[i], in__, len );
     }
 
-    _cryptonite_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_final( S[i], hash[i], BLAKE2S_OUTBYTES );
   }
 
   if( blake2sp_init_root( FS, outlen, keylen ) < 0 )
@@ -284,9 +284,9 @@
   FS->last_node = 1;
 
   for( i = 0; i < PARALLELISM_DEGREE; ++i )
-    _cryptonite_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES );
+    _crypton_blake2s_update( FS, hash[i], BLAKE2S_OUTBYTES );
 
-  return _cryptonite_blake2s_final( FS, out, outlen );
+  return _crypton_blake2s_final( FS, out, outlen );
 }
 
 #if defined(BLAKE2SP_SELFTEST)
@@ -308,7 +308,7 @@
   for( i = 0; i < BLAKE2_KAT_LENGTH; ++i )
   {
     uint8_t hash[BLAKE2S_OUTBYTES];
-    _cryptonite_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );
+    _crypton_blake2sp( hash, BLAKE2S_OUTBYTES, buf, i, key, BLAKE2S_KEYBYTES );
 
     if( 0 != memcmp( hash, blake2sp_keyed_kat[i], BLAKE2S_OUTBYTES ) )
     {
@@ -325,21 +325,21 @@
       size_t mlen = i;
       int err = 0;
 
-      if( (err = _cryptonite_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
+      if( (err = _crypton_blake2sp_init_key(&S, BLAKE2S_OUTBYTES, key, BLAKE2S_KEYBYTES)) < 0 ) {
         goto fail;
       }
 
       while (mlen >= step) {
-        if ( (err = _cryptonite_blake2sp_update(&S, p, step)) < 0 ) {
+        if ( (err = _crypton_blake2sp_update(&S, p, step)) < 0 ) {
           goto fail;
         }
         mlen -= step;
         p += step;
       }
-      if ( (err = _cryptonite_blake2sp_update(&S, p, mlen)) < 0) {
+      if ( (err = _crypton_blake2sp_update(&S, p, mlen)) < 0) {
         goto fail;
       }
-      if ( (err = _cryptonite_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
+      if ( (err = _crypton_blake2sp_final(&S, hash, BLAKE2S_OUTBYTES)) < 0) {
         goto fail;
       }
 
diff --git a/cbits/crypton_aes.c b/cbits/crypton_aes.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_aes.c
@@ -0,0 +1,1109 @@
+/*
+ * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include <stdio.h>
+
+#include <crypton_cpu.h>
+#include <crypton_aes.h>
+#include <crypton_bitfn.h>
+
+#include <aes/generic.h>
+#include <aes/gf.h>
+#include <aes/x86ni.h>
+
+void crypton_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);
+void crypton_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);
+void crypton_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
+
+enum {
+	/* init */
+	INIT_128, INIT_192, INIT_256,
+	/* single block */
+	ENCRYPT_BLOCK_128, ENCRYPT_BLOCK_192, ENCRYPT_BLOCK_256,
+	DECRYPT_BLOCK_128, DECRYPT_BLOCK_192, DECRYPT_BLOCK_256,
+	/* ecb */
+	ENCRYPT_ECB_128, ENCRYPT_ECB_192, ENCRYPT_ECB_256,
+	DECRYPT_ECB_128, DECRYPT_ECB_192, DECRYPT_ECB_256,
+	/* cbc */
+	ENCRYPT_CBC_128, ENCRYPT_CBC_192, ENCRYPT_CBC_256,
+	DECRYPT_CBC_128, DECRYPT_CBC_192, DECRYPT_CBC_256,
+	/* ctr */
+	ENCRYPT_CTR_128, ENCRYPT_CTR_192, ENCRYPT_CTR_256,
+	/* ctr with 32-bit wrapping */
+	ENCRYPT_C32_128, ENCRYPT_C32_192, ENCRYPT_C32_256,
+	/* xts */
+	ENCRYPT_XTS_128, ENCRYPT_XTS_192, ENCRYPT_XTS_256,
+	DECRYPT_XTS_128, DECRYPT_XTS_192, DECRYPT_XTS_256,
+	/* gcm */
+	ENCRYPT_GCM_128, ENCRYPT_GCM_192, ENCRYPT_GCM_256,
+	DECRYPT_GCM_128, DECRYPT_GCM_192, DECRYPT_GCM_256,
+	/* ocb */
+	ENCRYPT_OCB_128, ENCRYPT_OCB_192, ENCRYPT_OCB_256,
+	DECRYPT_OCB_128, DECRYPT_OCB_192, DECRYPT_OCB_256,
+	/* ccm */
+	ENCRYPT_CCM_128, ENCRYPT_CCM_192, ENCRYPT_CCM_256,
+	DECRYPT_CCM_128, DECRYPT_CCM_192, DECRYPT_CCM_256,
+	/* ghash */
+	GHASH_HINIT, GHASH_GF_MUL,
+};
+
+void *crypton_aes_branch_table[] = {
+	/* INIT */
+	[INIT_128]          = crypton_aes_generic_init,
+	[INIT_192]          = crypton_aes_generic_init,
+	[INIT_256]          = crypton_aes_generic_init,
+	/* BLOCK */
+	[ENCRYPT_BLOCK_128] = crypton_aes_generic_encrypt_block,
+	[ENCRYPT_BLOCK_192] = crypton_aes_generic_encrypt_block,
+	[ENCRYPT_BLOCK_256] = crypton_aes_generic_encrypt_block,
+	[DECRYPT_BLOCK_128] = crypton_aes_generic_decrypt_block,
+	[DECRYPT_BLOCK_192] = crypton_aes_generic_decrypt_block,
+	[DECRYPT_BLOCK_256] = crypton_aes_generic_decrypt_block,
+	/* ECB */
+	[ENCRYPT_ECB_128]   = crypton_aes_generic_encrypt_ecb,
+	[ENCRYPT_ECB_192]   = crypton_aes_generic_encrypt_ecb,
+	[ENCRYPT_ECB_256]   = crypton_aes_generic_encrypt_ecb,
+	[DECRYPT_ECB_128]   = crypton_aes_generic_decrypt_ecb,
+	[DECRYPT_ECB_192]   = crypton_aes_generic_decrypt_ecb,
+	[DECRYPT_ECB_256]   = crypton_aes_generic_decrypt_ecb,
+	/* CBC */
+	[ENCRYPT_CBC_128]   = crypton_aes_generic_encrypt_cbc,
+	[ENCRYPT_CBC_192]   = crypton_aes_generic_encrypt_cbc,
+	[ENCRYPT_CBC_256]   = crypton_aes_generic_encrypt_cbc,
+	[DECRYPT_CBC_128]   = crypton_aes_generic_decrypt_cbc,
+	[DECRYPT_CBC_192]   = crypton_aes_generic_decrypt_cbc,
+	[DECRYPT_CBC_256]   = crypton_aes_generic_decrypt_cbc,
+	/* CTR */
+	[ENCRYPT_CTR_128]   = crypton_aes_generic_encrypt_ctr,
+	[ENCRYPT_CTR_192]   = crypton_aes_generic_encrypt_ctr,
+	[ENCRYPT_CTR_256]   = crypton_aes_generic_encrypt_ctr,
+	/* CTR with 32-bit wrapping */
+	[ENCRYPT_C32_128]   = crypton_aes_generic_encrypt_c32,
+	[ENCRYPT_C32_192]   = crypton_aes_generic_encrypt_c32,
+	[ENCRYPT_C32_256]   = crypton_aes_generic_encrypt_c32,
+	/* XTS */
+	[ENCRYPT_XTS_128]   = crypton_aes_generic_encrypt_xts,
+	[ENCRYPT_XTS_192]   = crypton_aes_generic_encrypt_xts,
+	[ENCRYPT_XTS_256]   = crypton_aes_generic_encrypt_xts,
+	[DECRYPT_XTS_128]   = crypton_aes_generic_decrypt_xts,
+	[DECRYPT_XTS_192]   = crypton_aes_generic_decrypt_xts,
+	[DECRYPT_XTS_256]   = crypton_aes_generic_decrypt_xts,
+	/* GCM */
+	[ENCRYPT_GCM_128]   = crypton_aes_generic_gcm_encrypt,
+	[ENCRYPT_GCM_192]   = crypton_aes_generic_gcm_encrypt,
+	[ENCRYPT_GCM_256]   = crypton_aes_generic_gcm_encrypt,
+	[DECRYPT_GCM_128]   = crypton_aes_generic_gcm_decrypt,
+	[DECRYPT_GCM_192]   = crypton_aes_generic_gcm_decrypt,
+	[DECRYPT_GCM_256]   = crypton_aes_generic_gcm_decrypt,
+	/* OCB */
+	[ENCRYPT_OCB_128]   = crypton_aes_generic_ocb_encrypt,
+	[ENCRYPT_OCB_192]   = crypton_aes_generic_ocb_encrypt,
+	[ENCRYPT_OCB_256]   = crypton_aes_generic_ocb_encrypt,
+	[DECRYPT_OCB_128]   = crypton_aes_generic_ocb_decrypt,
+	[DECRYPT_OCB_192]   = crypton_aes_generic_ocb_decrypt,
+	[DECRYPT_OCB_256]   = crypton_aes_generic_ocb_decrypt,
+	/* CCM */
+	[ENCRYPT_CCM_128]   = crypton_aes_generic_ccm_encrypt,
+	[ENCRYPT_CCM_192]   = crypton_aes_generic_ccm_encrypt,
+	[ENCRYPT_CCM_256]   = crypton_aes_generic_ccm_encrypt,
+	[DECRYPT_CCM_128]   = crypton_aes_generic_ccm_decrypt,
+	[DECRYPT_CCM_192]   = crypton_aes_generic_ccm_decrypt,
+	[DECRYPT_CCM_256]   = crypton_aes_generic_ccm_decrypt,
+	/* GHASH */
+	[GHASH_HINIT]       = crypton_aes_generic_hinit,
+	[GHASH_GF_MUL]      = crypton_aes_generic_gf_mul,
+};
+
+typedef void (*init_f)(aes_key *, uint8_t *, uint8_t);
+typedef void (*ecb_f)(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
+typedef void (*cbc_f)(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
+typedef void (*ctr_f)(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);
+typedef void (*xts_f)(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit, uint32_t spoint, aes_block *input, uint32_t nb_blocks);
+typedef void (*gcm_crypt_f)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
+typedef void (*ocb_crypt_f)(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
+typedef void (*ccm_crypt_f)(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
+typedef void (*block_f)(aes_block *output, aes_key *key, aes_block *input);
+typedef void (*hinit_f)(table_4bit htable, const block128 *h);
+typedef void (*gf_mul_f)(block128 *a, const table_4bit htable);
+
+#ifdef WITH_AESNI
+#define GET_INIT(strength) \
+	((init_f) (crypton_aes_branch_table[INIT_128 + strength]))
+#define GET_ECB_ENCRYPT(strength) \
+	((ecb_f) (crypton_aes_branch_table[ENCRYPT_ECB_128 + strength]))
+#define GET_ECB_DECRYPT(strength) \
+	((ecb_f) (crypton_aes_branch_table[DECRYPT_ECB_128 + strength]))
+#define GET_CBC_ENCRYPT(strength) \
+	((cbc_f) (crypton_aes_branch_table[ENCRYPT_CBC_128 + strength]))
+#define GET_CBC_DECRYPT(strength) \
+	((cbc_f) (crypton_aes_branch_table[DECRYPT_CBC_128 + strength]))
+#define GET_CTR_ENCRYPT(strength) \
+	((ctr_f) (crypton_aes_branch_table[ENCRYPT_CTR_128 + strength]))
+#define GET_C32_ENCRYPT(strength) \
+	((ctr_f) (crypton_aes_branch_table[ENCRYPT_C32_128 + strength]))
+#define GET_XTS_ENCRYPT(strength) \
+	((xts_f) (crypton_aes_branch_table[ENCRYPT_XTS_128 + strength]))
+#define GET_XTS_DECRYPT(strength) \
+	((xts_f) (crypton_aes_branch_table[DECRYPT_XTS_128 + strength]))
+#define GET_GCM_ENCRYPT(strength) \
+	((gcm_crypt_f) (crypton_aes_branch_table[ENCRYPT_GCM_128 + strength]))
+#define GET_GCM_DECRYPT(strength) \
+	((gcm_crypt_f) (crypton_aes_branch_table[DECRYPT_GCM_128 + strength]))
+#define GET_OCB_ENCRYPT(strength) \
+	((ocb_crypt_f) (crypton_aes_branch_table[ENCRYPT_OCB_128 + strength]))
+#define GET_OCB_DECRYPT(strength) \
+	((ocb_crypt_f) (crypton_aes_branch_table[DECRYPT_OCB_128 + strength]))
+#define GET_CCM_ENCRYPT(strength) \
+	((ccm_crypt_f) (crypton_aes_branch_table[ENCRYPT_CCM_128 + strength]))
+#define GET_CCM_DECRYPT(strength) \
+	((ccm_crypt_f) (crypton_aes_branch_table[DECRYPT_CCM_128 + strength]))
+#define crypton_aes_encrypt_block(o,k,i) \
+	(((block_f) (crypton_aes_branch_table[ENCRYPT_BLOCK_128 + k->strength]))(o,k,i))
+#define crypton_aes_decrypt_block(o,k,i) \
+	(((block_f) (crypton_aes_branch_table[DECRYPT_BLOCK_128 + k->strength]))(o,k,i))
+#define crypton_hinit(t,h) \
+	(((hinit_f) (crypton_aes_branch_table[GHASH_HINIT]))(t,h))
+#define crypton_gf_mul(a,t) \
+	(((gf_mul_f) (crypton_aes_branch_table[GHASH_GF_MUL]))(a,t))
+#else
+#define GET_INIT(strenght) crypton_aes_generic_init
+#define GET_ECB_ENCRYPT(strength) crypton_aes_generic_encrypt_ecb
+#define GET_ECB_DECRYPT(strength) crypton_aes_generic_decrypt_ecb
+#define GET_CBC_ENCRYPT(strength) crypton_aes_generic_encrypt_cbc
+#define GET_CBC_DECRYPT(strength) crypton_aes_generic_decrypt_cbc
+#define GET_CTR_ENCRYPT(strength) crypton_aes_generic_encrypt_ctr
+#define GET_C32_ENCRYPT(strength) crypton_aes_generic_encrypt_c32
+#define GET_XTS_ENCRYPT(strength) crypton_aes_generic_encrypt_xts
+#define GET_XTS_DECRYPT(strength) crypton_aes_generic_decrypt_xts
+#define GET_GCM_ENCRYPT(strength) crypton_aes_generic_gcm_encrypt
+#define GET_GCM_DECRYPT(strength) crypton_aes_generic_gcm_decrypt
+#define GET_OCB_ENCRYPT(strength) crypton_aes_generic_ocb_encrypt
+#define GET_OCB_DECRYPT(strength) crypton_aes_generic_ocb_decrypt
+#define GET_CCM_ENCRYPT(strength) crypton_aes_generic_ccm_encrypt
+#define GET_CCM_DECRYPT(strength) crypton_aes_generic_ccm_decrypt
+#define crypton_aes_encrypt_block(o,k,i) crypton_aes_generic_encrypt_block(o,k,i)
+#define crypton_aes_decrypt_block(o,k,i) crypton_aes_generic_decrypt_block(o,k,i)
+#define crypton_hinit(t,h) crypton_aes_generic_hinit(t,h)
+#define crypton_gf_mul(a,t) crypton_aes_generic_gf_mul(a,t)
+#endif
+
+#define CPU_AESNI        0
+#define CPU_PCLMUL       1
+#define CPU_OPTION_COUNT 2
+
+static uint8_t crypton_aes_cpu_options[CPU_OPTION_COUNT] = {};
+
+#if defined(ARCH_X86) && defined(WITH_AESNI)
+static void initialize_table_ni(int aesni, int pclmul)
+{
+	if (!aesni)
+		return;
+	crypton_aes_cpu_options[CPU_AESNI] = 1;
+
+	crypton_aes_branch_table[INIT_128] = crypton_aesni_init;
+	crypton_aes_branch_table[INIT_256] = crypton_aesni_init;
+
+	crypton_aes_branch_table[ENCRYPT_BLOCK_128] = crypton_aesni_encrypt_block128;
+	crypton_aes_branch_table[DECRYPT_BLOCK_128] = crypton_aesni_decrypt_block128;
+	crypton_aes_branch_table[ENCRYPT_BLOCK_256] = crypton_aesni_encrypt_block256;
+	crypton_aes_branch_table[DECRYPT_BLOCK_256] = crypton_aesni_decrypt_block256;
+	/* ECB */
+	crypton_aes_branch_table[ENCRYPT_ECB_128] = crypton_aesni_encrypt_ecb128;
+	crypton_aes_branch_table[DECRYPT_ECB_128] = crypton_aesni_decrypt_ecb128;
+	crypton_aes_branch_table[ENCRYPT_ECB_256] = crypton_aesni_encrypt_ecb256;
+	crypton_aes_branch_table[DECRYPT_ECB_256] = crypton_aesni_decrypt_ecb256;
+	/* CBC */
+	crypton_aes_branch_table[ENCRYPT_CBC_128] = crypton_aesni_encrypt_cbc128;
+	crypton_aes_branch_table[DECRYPT_CBC_128] = crypton_aesni_decrypt_cbc128;
+	crypton_aes_branch_table[ENCRYPT_CBC_256] = crypton_aesni_encrypt_cbc256;
+	crypton_aes_branch_table[DECRYPT_CBC_256] = crypton_aesni_decrypt_cbc256;
+	/* CTR */
+	crypton_aes_branch_table[ENCRYPT_CTR_128] = crypton_aesni_encrypt_ctr128;
+	crypton_aes_branch_table[ENCRYPT_CTR_256] = crypton_aesni_encrypt_ctr256;
+	/* CTR with 32-bit wrapping */
+	crypton_aes_branch_table[ENCRYPT_C32_128] = crypton_aesni_encrypt_c32_128;
+	crypton_aes_branch_table[ENCRYPT_C32_256] = crypton_aesni_encrypt_c32_256;
+	/* XTS */
+	crypton_aes_branch_table[ENCRYPT_XTS_128] = crypton_aesni_encrypt_xts128;
+	crypton_aes_branch_table[ENCRYPT_XTS_256] = crypton_aesni_encrypt_xts256;
+	/* GCM */
+	crypton_aes_branch_table[ENCRYPT_GCM_128] = crypton_aesni_gcm_encrypt128;
+	crypton_aes_branch_table[ENCRYPT_GCM_256] = crypton_aesni_gcm_encrypt256;
+	/* OCB */
+	/*
+	crypton_aes_branch_table[ENCRYPT_OCB_128] = crypton_aesni_ocb_encrypt128;
+	crypton_aes_branch_table[ENCRYPT_OCB_256] = crypton_aesni_ocb_encrypt256;
+	*/
+#ifdef WITH_PCLMUL
+	if (!pclmul)
+		return;
+	crypton_aes_cpu_options[CPU_PCLMUL] = 1;
+
+	/* GHASH */
+	crypton_aes_branch_table[GHASH_HINIT]     = crypton_aesni_hinit_pclmul,
+	crypton_aes_branch_table[GHASH_GF_MUL]    = crypton_aesni_gf_mul_pclmul,
+	crypton_aesni_init_pclmul();
+#endif
+}
+#endif
+
+uint8_t *crypton_aes_cpu_init(void)
+{
+#if defined(ARCH_X86) && defined(WITH_AESNI)
+	crypton_aesni_initialize_hw(initialize_table_ni);
+#endif
+	return crypton_aes_cpu_options;
+}
+
+void crypton_aes_initkey(aes_key *key, uint8_t *origkey, uint8_t size)
+{
+	switch (size) {
+	case 16: key->nbr = 10; key->strength = 0; break;
+	case 24: key->nbr = 12; key->strength = 1; break;
+	case 32: key->nbr = 14; key->strength = 2; break;
+	}
+	crypton_aes_cpu_init();
+	init_f _init = GET_INIT(key->strength);
+	_init(key, origkey, size);
+}
+
+void crypton_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
+{
+	ecb_f e = GET_ECB_ENCRYPT(key->strength);
+	e(output, key, input, nb_blocks);
+}
+
+void crypton_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
+{
+	ecb_f d = GET_ECB_DECRYPT(key->strength);
+	d(output, key, input, nb_blocks);
+}
+
+void crypton_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)
+{
+	cbc_f e = GET_CBC_ENCRYPT(key->strength);
+	e(output, key, iv, input, nb_blocks);
+}
+
+void crypton_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)
+{
+	cbc_f d = GET_CBC_DECRYPT(key->strength);
+	d(output, key, iv, input, nb_blocks);
+}
+
+void crypton_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks)
+{
+	aes_block block;
+
+	/* preload IV in block */
+	block128_copy(&block, iv);
+
+	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {
+		crypton_aes_encrypt_block(output, key, &block);
+	}
+}
+
+void crypton_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks)
+{
+	aes_block block;
+
+	/* preload IV in block */
+	block128_copy(&block, iv);
+
+	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {
+		crypton_aes_encrypt_block(output, key, &block);
+	}
+
+	/* copy back the IV */
+	block128_copy(iv, &block);
+}
+
+void crypton_aes_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
+{
+	ctr_f e = GET_CTR_ENCRYPT(key->strength);
+	e(output, key, iv, input, len);
+}
+
+void crypton_aes_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
+{
+	ctr_f e = GET_C32_ENCRYPT(key->strength);
+	e(output, key, iv, input, len);
+}
+
+void crypton_aes_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)
+{
+	xts_f e = GET_XTS_ENCRYPT(k1->strength);
+	e(output, k1, k2, dataunit, spoint, input, nb_blocks);
+}
+
+void crypton_aes_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)
+{
+	crypton_aes_generic_decrypt_xts(output, k1, k2, dataunit, spoint, input, nb_blocks);
+}
+
+void crypton_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	gcm_crypt_f e = GET_GCM_ENCRYPT(key->strength);
+	e(output, gcm, key, input, length);
+}
+
+void crypton_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	gcm_crypt_f d = GET_GCM_DECRYPT(key->strength);
+	d(output, gcm, key, input, length);
+}
+
+void crypton_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	ccm_crypt_f e = GET_CCM_ENCRYPT(key->strength);
+	e(output, ccm, key, input, length);
+}
+
+void crypton_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	ccm_crypt_f d = GET_CCM_DECRYPT(key->strength);
+	d(output, ccm, key, input, length);
+}
+
+void crypton_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
+{
+	ocb_crypt_f e = GET_OCB_ENCRYPT(key->strength);
+	e(output, ocb, key, input, length);
+}
+
+void crypton_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
+{
+	ocb_crypt_f d = GET_OCB_DECRYPT(key->strength);
+	d(output, ocb, key, input, length);
+}
+
+static void gcm_ghash_add(aes_gcm *gcm, block128 *b)
+{
+	block128_xor(&gcm->tag, b);
+	crypton_gf_mul(&gcm->tag, gcm->htable);
+}
+
+void crypton_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len)
+{
+	block128 h;
+	gcm->length_aad = 0;
+	gcm->length_input = 0;
+
+	block128_zero(&h);
+	block128_zero(&gcm->tag);
+	block128_zero(&gcm->iv);
+
+	/* prepare H : encrypt_K(0^128) */
+	crypton_aes_encrypt_block(&h, key, &h);
+	crypton_hinit(gcm->htable, &h);
+
+	if (len == 12) {
+		block128_copy_bytes(&gcm->iv, iv, 12);
+		gcm->iv.b[15] = 0x01;
+	} else {
+		uint32_t origlen = len << 3;
+		int i;
+		for (; len >= 16; len -= 16, iv += 16) {
+			block128_xor(&gcm->iv, (block128 *) iv);
+			crypton_gf_mul(&gcm->iv, gcm->htable);
+		}
+		if (len > 0) {
+			block128_xor_bytes(&gcm->iv, iv, len);
+			crypton_gf_mul(&gcm->iv, gcm->htable);
+		}
+		for (i = 15; origlen; --i, origlen >>= 8)
+			gcm->iv.b[i] ^= (uint8_t) origlen;
+		crypton_gf_mul(&gcm->iv, gcm->htable);
+	}
+
+	block128_copy_aligned(&gcm->civ, &gcm->iv);
+}
+
+void crypton_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length)
+{
+	gcm->length_aad += length;
+	for (; length >= 16; input += 16, length -= 16) {
+		gcm_ghash_add(gcm, (block128 *) input);
+	}
+	if (length > 0) {
+		aes_block tmp;
+		block128_zero(&tmp);
+		block128_copy_bytes(&tmp, input, length);
+		gcm_ghash_add(gcm, &tmp);
+	}
+
+}
+
+void crypton_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key)
+{
+	aes_block lblock;
+	int i;
+
+	/* tag = (tag-1 xor (lenbits(a) | lenbits(c)) ) . H */
+	lblock.q[0] = cpu_to_be64(gcm->length_aad << 3);
+	lblock.q[1] = cpu_to_be64(gcm->length_input << 3);
+	gcm_ghash_add(gcm, &lblock);
+
+	crypton_aes_encrypt_block(&lblock, key, &gcm->iv);
+	block128_xor_aligned(&gcm->tag, &lblock);
+
+	for (i = 0; i < 16; i++) {
+		tag[i] = gcm->tag.b[i];
+	}
+}
+
+static inline uint8_t ccm_b0_flags(uint32_t has_adata, uint32_t m, uint32_t l)
+{
+	return 8*m + l + (has_adata? 64: 0);
+}
+
+/* depends on input size */
+static void ccm_encode_b0(block128* output, aes_ccm* ccm, uint32_t has_adata)
+{
+	int last = 15;
+	uint32_t m = ccm->length_M;
+	uint32_t l = ccm->length_L;
+	uint32_t msg_len = ccm->length_input;
+
+	block128_zero(output);
+	block128_copy_aligned(output, &ccm->nonce);
+	output->b[0] = ccm_b0_flags(has_adata, (m-2)/2, l-1);
+	while (msg_len > 0) {
+		output->b[last--] = msg_len & 0xff;
+		msg_len >>= 8;
+	}
+}
+
+/* encode adata length */
+static int ccm_encode_la(block128* output, uint32_t la)
+{
+	if (la < ( (1 << 16) - (1 << 8)) ) {
+		output->b[0] = (la >> 8) & 0xff;
+		output->b[1] = la        & 0xff;
+		return 2;
+	} else {
+		output->b[0] = 0xff;
+		output->b[1] = 0xfe;
+		output->b[2] = (la >> 24) & 0xff;
+		output->b[3] = (la >> 16) & 0xff;
+		output->b[4] = (la >>  8) & 0xff;
+		output->b[5] = la         & 0xff;
+		return 6;
+	}
+}
+
+static void ccm_encode_ctr(block128* out, aes_ccm* ccm, unsigned int cnt)
+{
+	int last = 15;
+	block128_copy_aligned(out, &ccm->nonce);
+	out->b[0] = ccm->length_L - 1;
+
+	while (cnt > 0) {
+		out->b[last--] = cnt & 0xff;
+		cnt >>= 8;
+	}
+}
+
+static void ccm_cbcmac_add(aes_ccm* ccm, aes_key* key, block128* bi)
+{
+	block128_xor_aligned(&ccm->xi, bi);
+	crypton_aes_encrypt_block(&ccm->xi, key, &ccm->xi);
+}
+
+/* even though it is possible to support message size as large as 2^64, we support up to 2^32 only */
+void crypton_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t nonce_len, uint32_t input_size, int m, int l)
+{
+	memset(ccm, 0, sizeof(aes_ccm));
+
+	if (l < 2 || l > 4) return;
+	if (m != 4 && m != 6 && m != 8 && m != 10
+		   && m != 12 && m != 14 && m != 16) return;
+
+	if (nonce_len > 15 - l) {
+		nonce_len = 15 - l;
+	}
+
+	if (l <= 4) {
+		if (input_size >= (1ull << (8*l))) return;
+	}
+
+	ccm->length_L = l;
+	ccm->length_M = m;
+	ccm->length_input = input_size;
+
+	memcpy(&ccm->nonce.b[1], nonce, nonce_len);
+
+	ccm_encode_b0(&ccm->b0, ccm, 1); /* assume aad is present */
+	crypton_aes_encrypt_block(&ccm->xi, key, &ccm->b0);
+}
+
+/* even though l(a) can be as large as 2^64, we only handle aad up to 2 ^ 32 for practical reasons.
+  Also we don't support incremental aad add, because the 1st encoded adata has length information
+ */
+void crypton_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	block128 tmp;
+
+	if (ccm->length_aad != 0) return;
+
+	ccm->length_aad = length;
+	int len_len;
+
+	block128_zero(&tmp);
+	len_len = ccm_encode_la(&tmp, length);
+
+	if (length < 16 - len_len) {
+		memcpy(&tmp.b[len_len], input, length);
+		length = 0;
+	} else {
+		memcpy(&tmp.b[len_len], input, 16 - len_len);
+		input += 16 - len_len;
+		length -= 16 - len_len;
+	}
+
+	ccm_cbcmac_add(ccm, key, &tmp);
+
+	for (; length >= 16; input += 16, length -= 16) {
+		block128_copy(&tmp, (block128*)input);
+		ccm_cbcmac_add(ccm, key, &tmp);
+
+	}
+	if (length > 0) {
+		block128_zero(&tmp);
+		block128_copy_bytes(&tmp, input, length);
+		ccm_cbcmac_add(ccm, key, &tmp);
+	}
+	block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);
+}
+
+void crypton_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key)
+{
+	block128 iv, s0;
+
+	block128_zero(&iv);
+	ccm_encode_ctr(&iv, ccm, 0);
+	crypton_aes_encrypt_block(&s0, key, &iv);
+	block128_vxor((block128*)tag, &ccm->xi, &s0);
+}
+
+static inline void ocb_block_double(block128 *d, block128 *s)
+{
+	unsigned int i;
+	uint8_t tmp = s->b[0];
+
+	for (i=0; i<15; i++)
+		d->b[i] = (s->b[i] << 1) | (s->b[i+1] >> 7);
+	d->b[15] = (s->b[15] << 1) ^ ((tmp >> 7) * 0x87);
+}
+
+static void ocb_get_L_i(block128 *l, block128 *lis, unsigned int i)
+{
+#define L_CACHED 4
+	i = bitfn_ntz(i);
+	if (i < L_CACHED) {
+		block128_copy(l, &lis[i]);
+	} else {
+		i -= (L_CACHED - 1);
+		block128_copy(l, &lis[L_CACHED - 1]);
+		while (i--) {
+			ocb_block_double(l, l);
+		}
+	}
+#undef L_CACHED
+}
+
+void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len)
+{
+	block128 tmp, nonce, ktop;
+	unsigned char stretch[24];
+	unsigned bottom, byteshift, bitshift, i;
+
+	/* we don't accept more than 15 bytes, any bytes higher will be ignored. */
+	if (len > 15) {
+		len = 15;
+	}
+
+	/* create L*, and L$,L0,L1,L2,L3 */
+	block128_zero(&tmp);
+	crypton_aes_encrypt_block(&ocb->lstar, key, &tmp);
+
+	ocb_block_double(&ocb->ldollar, &ocb->lstar);
+	ocb_block_double(&ocb->li[0], &ocb->ldollar);
+	ocb_block_double(&ocb->li[1], &ocb->li[0]);
+	ocb_block_double(&ocb->li[2], &ocb->li[1]);
+	ocb_block_double(&ocb->li[3], &ocb->li[2]);
+
+	/* create strech from the nonce */
+	block128_zero(&nonce);
+	memcpy(nonce.b + 4, iv, 12);
+	nonce.b[0] = (unsigned char)(((16 * 8) % 128) << 1);
+	nonce.b[16-12-1] |= 0x01;
+	bottom = nonce.b[15] & 0x3F;
+	nonce.b[15] &= 0xC0;
+	crypton_aes_encrypt_block(&ktop, key, &nonce);
+	memcpy(stretch, ktop.b, 16);
+
+	memcpy(tmp.b, ktop.b + 1, 8);
+	block128_xor_aligned(&tmp, &ktop);
+	memcpy(stretch + 16, tmp.b, 8);
+
+	/* initialize the encryption offset from stretch */
+	byteshift = bottom / 8;
+	bitshift = bottom % 8;
+	if (bitshift != 0)
+		for (i = 0; i < 16; i++)
+			ocb->offset_enc.b[i] = (stretch[i+byteshift] << bitshift)
+			                     | (stretch[i+byteshift+1] >> (8-bitshift));
+	else
+		for (i = 0; i < 16; i++)
+			ocb->offset_enc.b[i] = stretch[i+byteshift];
+	/* initialize checksum for aad and encryption, and the aad offset */
+	block128_zero(&ocb->sum_aad);
+	block128_zero(&ocb->sum_enc);
+	block128_zero(&ocb->offset_aad);
+}
+
+void crypton_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
+{
+	block128 tmp;
+	unsigned int i;
+
+	for (i=1; i<= length/16; i++, input=input+16) {
+		ocb_get_L_i(&tmp, ocb->li, i);
+		block128_xor_aligned(&ocb->offset_aad, &tmp);
+
+		block128_vxor(&tmp, &ocb->offset_aad, (block128 *) input);
+		crypton_aes_encrypt_block(&tmp, key, &tmp);
+		block128_xor_aligned(&ocb->sum_aad, &tmp);
+	}
+
+	length = length % 16; /* Bytes in final block */
+	if (length > 0) {
+		block128_xor_aligned(&ocb->offset_aad, &ocb->lstar);
+		block128_zero(&tmp);
+		block128_copy_bytes(&tmp, input, length);
+		tmp.b[length] = 0x80;
+		block128_xor_aligned(&tmp, &ocb->offset_aad);
+		crypton_aes_encrypt_block(&tmp, key, &tmp);
+		block128_xor_aligned(&ocb->sum_aad, &tmp);
+	}
+}
+
+void crypton_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key)
+{
+	block128 tmp;
+
+	block128_vxor_aligned(&tmp, &ocb->sum_enc, &ocb->offset_enc);
+	block128_xor_aligned(&tmp, &ocb->ldollar);
+	crypton_aes_encrypt_block((block128 *) tag, key, &tmp);
+	block128_xor((block128 *) tag, &ocb->sum_aad);
+}
+
+void crypton_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
+{
+	for ( ; nb_blocks-- > 0; input++, output++) {
+		crypton_aes_generic_encrypt_block(output, key, input);
+	}
+}
+
+void crypton_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
+{
+	for ( ; nb_blocks-- > 0; input++, output++) {
+		crypton_aes_generic_decrypt_block(output, key, input);
+	}
+}
+
+void crypton_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)
+{
+	aes_block block;
+
+	/* preload IV in block */
+	block128_copy(&block, iv);
+	for ( ; nb_blocks-- > 0; input++, output++) {
+		block128_xor(&block, (block128 *) input);
+		crypton_aes_generic_encrypt_block(&block, key, &block);
+		block128_copy((block128 *) output, &block);
+	}
+}
+
+void crypton_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *ivini, aes_block *input, uint32_t nb_blocks)
+{
+	aes_block block, blocko;
+	aes_block iv;
+
+	/* preload IV in block */
+	block128_copy(&iv, ivini);
+	for ( ; nb_blocks-- > 0; input++, output++) {
+		block128_copy(&block, (block128 *) input);
+		crypton_aes_generic_decrypt_block(&blocko, key, &block);
+		block128_vxor((block128 *) output, &blocko, &iv);
+		block128_copy(&iv, &block);
+	}
+}
+
+void crypton_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
+{
+	aes_block block, o;
+	uint32_t nb_blocks = len / 16;
+	int i;
+
+	/* preload IV in block */
+	block128_copy(&block, iv);
+
+	for ( ; nb_blocks-- > 0; block128_inc_be(&block), output += 16, input += 16) {
+		crypton_aes_encrypt_block(&o, key, &block);
+		block128_vxor((block128 *) output, &o, (block128 *) input);
+	}
+
+	if ((len % 16) != 0) {
+		crypton_aes_encrypt_block(&o, key, &block);
+		for (i = 0; i < (len % 16); i++) {
+			*output = ((uint8_t *) &o)[i] ^ *input;
+			output++;
+			input++;
+		}
+	}
+}
+
+void crypton_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
+{
+	aes_block block, o;
+	uint32_t nb_blocks = len / 16;
+	int i;
+
+	/* preload IV in block */
+	block128_copy(&block, iv);
+
+	for ( ; nb_blocks-- > 0; block128_inc32_le(&block), output += 16, input += 16) {
+		crypton_aes_encrypt_block(&o, key, &block);
+		block128_vxor((block128 *) output, &o, (block128 *) input);
+	}
+
+	if ((len % 16) != 0) {
+		crypton_aes_encrypt_block(&o, key, &block);
+		for (i = 0; i < (len % 16); i++) {
+			*output = ((uint8_t *) &o)[i] ^ *input;
+			output++;
+			input++;
+		}
+	}
+}
+
+void crypton_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)
+{
+	aes_block block, tweak;
+
+	/* load IV and encrypt it using k2 as the tweak */
+	block128_copy(&tweak, dataunit);
+	crypton_aes_encrypt_block(&tweak, k2, &tweak);
+
+	/* TO OPTIMISE: this is really inefficient way to do that */
+	while (spoint-- > 0)
+		crypton_aes_generic_gf_mulx(&tweak);
+
+	for ( ; nb_blocks-- > 0; input++, output++, crypton_aes_generic_gf_mulx(&tweak)) {
+		block128_vxor(&block, input, &tweak);
+		crypton_aes_encrypt_block(&block, k1, &block);
+		block128_vxor(output, &block, &tweak);
+	}
+}
+
+void crypton_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
+                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)
+{
+	aes_block block, tweak;
+
+	/* load IV and encrypt it using k2 as the tweak */
+	block128_copy(&tweak, dataunit);
+	crypton_aes_encrypt_block(&tweak, k2, &tweak);
+
+	/* TO OPTIMISE: this is really inefficient way to do that */
+	while (spoint-- > 0)
+		crypton_aes_generic_gf_mulx(&tweak);
+
+	for ( ; nb_blocks-- > 0; input++, output++, crypton_aes_generic_gf_mulx(&tweak)) {
+		block128_vxor(&block, input, &tweak);
+		crypton_aes_decrypt_block(&block, k1, &block);
+		block128_vxor(output, &block, &tweak);
+	}
+}
+
+void crypton_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	aes_block out;
+
+	gcm->length_input += length;
+	for (; length >= 16; input += 16, output += 16, length -= 16) {
+		block128_inc32_be(&gcm->civ);
+
+		crypton_aes_encrypt_block(&out, key, &gcm->civ);
+		block128_xor(&out, (block128 *) input);
+		gcm_ghash_add(gcm, &out);
+		block128_copy((block128 *) output, &out);
+	}
+	if (length > 0) {
+		aes_block tmp;
+		int i;
+
+		block128_inc32_be(&gcm->civ);
+		/* create e(civ) in out */
+		crypton_aes_encrypt_block(&out, key, &gcm->civ);
+		/* initialize a tmp as input and xor it to e(civ) */
+		block128_zero(&tmp);
+		block128_copy_bytes(&tmp, input, length);
+		block128_xor_bytes(&tmp, out.b, length);
+
+		gcm_ghash_add(gcm, &tmp);
+
+		for (i = 0; i < length; i++) {
+			output[i] = tmp.b[i];
+		}
+	}
+}
+
+void crypton_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	aes_block out;
+
+	gcm->length_input += length;
+	for (; length >= 16; input += 16, output += 16, length -= 16) {
+		block128_inc32_be(&gcm->civ);
+
+		crypton_aes_encrypt_block(&out, key, &gcm->civ);
+		gcm_ghash_add(gcm, (block128 *) input);
+		block128_xor(&out, (block128 *) input);
+		block128_copy((block128 *) output, &out);
+	}
+	if (length > 0) {
+		aes_block tmp;
+		int i;
+
+		block128_inc32_be(&gcm->civ);
+
+		block128_zero(&tmp);
+		block128_copy_bytes(&tmp, input, length);
+		gcm_ghash_add(gcm, &tmp);
+
+		crypton_aes_encrypt_block(&out, key, &gcm->civ);
+		block128_xor_bytes(&tmp, out.b, length);
+
+		for (i = 0; i < length; i++) {
+			output[i] = tmp.b[i];
+		}
+	}
+}
+
+static void ocb_generic_crypt(uint8_t *output, aes_ocb *ocb, aes_key *key,
+                              uint8_t *input, uint32_t length, int encrypt)
+{
+	block128 tmp, pad;
+	unsigned int i;
+
+	for (i = 1; i <= length/16; i++, input += 16, output += 16) {
+		/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
+		ocb_get_L_i(&tmp, ocb->li, i);
+		block128_xor_aligned(&ocb->offset_enc, &tmp);
+
+		block128_vxor(&tmp, &ocb->offset_enc, (block128 *) input);
+		if (encrypt) {
+			crypton_aes_encrypt_block(&tmp, key, &tmp);
+			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);
+			block128_xor(&ocb->sum_enc, (block128 *) input);
+		} else {
+			crypton_aes_decrypt_block(&tmp, key, &tmp);
+			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);
+			block128_xor(&ocb->sum_enc, (block128 *) output);
+		}
+	}
+
+	/* process the last partial block if any */
+	length = length % 16;
+	if (length > 0) {
+		block128_xor_aligned(&ocb->offset_enc, &ocb->lstar);
+		crypton_aes_encrypt_block(&pad, key, &ocb->offset_enc);
+
+		if (encrypt) {
+			block128_zero(&tmp);
+			block128_copy_bytes(&tmp, input, length);
+			tmp.b[length] = 0x80;
+			block128_xor_aligned(&ocb->sum_enc, &tmp);
+			block128_xor_aligned(&pad, &tmp);
+			memcpy(output, pad.b, length);
+			output += length;
+		} else {
+			block128_copy_aligned(&tmp, &pad);
+			block128_copy_bytes(&tmp, input, length);
+			block128_xor_aligned(&tmp, &pad);
+			tmp.b[length] = 0x80;
+			memcpy(output, tmp.b, length);
+			block128_xor_aligned(&ocb->sum_enc, &tmp);
+			input += length;
+		}
+	}
+}
+
+void crypton_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	block128 tmp, ctr;
+
+	/* when aad is absent, reset b0 block */
+	if (ccm->length_aad == 0) {
+		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */
+		crypton_aes_encrypt_block(&ccm->xi, key, &ccm->b0);
+		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);
+	}
+
+	if (length != ccm->length_input) {
+		return;
+	}
+
+	ccm_encode_ctr(&ctr, ccm, 1);
+	crypton_aes_encrypt_ctr(output, key, &ctr, input, length);
+
+	for (;length >= 16; input += 16, length -= 16) {
+		block128_copy(&tmp, (block128*)input);
+		ccm_cbcmac_add(ccm, key, &tmp);
+	}
+	if (length > 0) {
+		block128_zero(&tmp);
+		block128_copy_bytes(&tmp, input, length);
+		ccm_cbcmac_add(ccm, key, &tmp);
+	}
+}
+
+void crypton_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
+{
+	block128 tmp, ctr;
+
+	if (length != ccm->length_input) {
+		return;
+	}
+
+	/* when aad is absent, reset b0 block */
+	if (ccm->length_aad == 0) {
+		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */
+		crypton_aes_encrypt_block(&ccm->xi, key, &ccm->b0);
+		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);
+	}
+
+	ccm_encode_ctr(&ctr, ccm, 1);
+	crypton_aes_encrypt_ctr(output, key, &ctr, input, length);
+	block128_copy_aligned(&ccm->xi, &ccm->header_cbcmac);
+	input = output;
+
+	for (;length >= 16; input += 16, length -= 16) {
+		block128_copy(&tmp, (block128*)input);
+		ccm_cbcmac_add(ccm, key, &tmp);
+	}
+	if (length > 0) {
+		block128_zero(&tmp);
+		block128_copy_bytes(&tmp, input, length);
+		ccm_cbcmac_add(ccm, key, &tmp);
+	}
+}
+
+void crypton_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
+{
+	ocb_generic_crypt(output, ocb, key, input, length, 1);
+}
+
+void crypton_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
+{
+	ocb_generic_crypt(output, ocb, key, input, length, 0);
+}
+
+static inline void gf_mulx_rev(block128 *a, const block128 *h)
+{
+	uint64_t v1 = cpu_to_le64(h->q[0]);
+	uint64_t v0 = cpu_to_le64(h->q[1]);
+	a->q[1] = cpu_to_be64(v1 >> 1 | v0 << 63);
+	a->q[0] = cpu_to_be64(v0 >> 1 ^ ((0-(v1 & 1)) & 0xe100000000000000ULL));
+}
+
+void crypton_aes_polyval_init(aes_polyval *ctx, const aes_block *h)
+{
+	aes_block r;
+
+	/* ByteReverse(S_0) = 0 */
+	block128_zero(&ctx->s);
+
+	/* ByteReverse(H) * x */
+	gf_mulx_rev(&r, h);
+	crypton_hinit(ctx->htable, &r);
+}
+
+void crypton_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length)
+{
+	aes_block r;
+	const uint8_t *p;
+	uint32_t sz;
+
+	/* This automatically pads with zeros if input is not a multiple of the
+	   block size. */
+	for (p = input; length > 0; p += 16, length -= sz)
+	{
+		sz = length < 16 ? length : 16;
+
+		/* ByteReverse(X_j) */
+		block128_zero(&r);
+		memcpy(&r, p, sz);
+		block128_byte_reverse(&r);
+
+		/* ByteReverse(S_{j-1}) + ByteReverse(X_j) */
+		block128_xor_aligned(&ctx->s, &r);
+
+		/* ByteReverse(S_j) */
+		crypton_gf_mul(&ctx->s, ctx->htable);
+	}
+}
+
+void crypton_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst)
+{
+	/* S_s */
+	block128_copy_aligned(dst, &ctx->s);
+	block128_byte_reverse(dst);
+}
diff --git a/cbits/crypton_aes.h b/cbits/crypton_aes.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_aes.h
@@ -0,0 +1,130 @@
+/*
+ *	Copyright (C) 2008 Vincent Hanquez <tab@snarc.org>
+ *
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * AES implementation
+ */
+#ifndef CRYPTON_AES_H
+#define CRYPTON_AES_H
+
+#include <stdint.h>
+#include "aes/block128.h"
+
+typedef block128 aes_block;
+
+/* size = 456 */
+typedef struct {
+	uint8_t nbr; /* number of rounds: 10 (128), 12 (192), 14 (256) */
+	uint8_t strength; /* 128 = 0, 192 = 1, 256 = 2 */
+	uint8_t _padding[6];
+	uint8_t data[16*14*2];
+} aes_key;
+
+/* size = 19*16+2*8= 320 */
+typedef struct {
+	aes_block tag;
+	aes_block htable[16];
+	aes_block iv;
+	aes_block civ;
+	uint64_t length_aad;
+	uint64_t length_input;
+} aes_gcm;
+
+/* size = 4*16+4*4= 80 */
+typedef struct {
+	aes_block xi;
+	aes_block header_cbcmac;
+	aes_block b0;
+	aes_block nonce;
+	uint32_t length_aad;
+	uint32_t length_input;
+	uint32_t length_M;
+	uint32_t length_L;
+} aes_ccm;
+
+typedef struct {
+	block128 offset_aad;
+	block128 offset_enc;
+	block128 sum_aad;
+	block128 sum_enc;
+	block128 lstar;
+	block128 ldollar;
+	block128 li[4];
+} aes_ocb;
+
+/* size = 17*16= 272 */
+typedef struct {
+	aes_block htable[16];
+	aes_block s;
+} aes_polyval;
+
+/* in bytes: either 16,24,32 */
+void crypton_aes_initkey(aes_key *ctx, uint8_t *key, uint8_t size);
+
+void crypton_aes_encrypt(aes_block *output, aes_key *key, aes_block *input);
+void crypton_aes_decrypt(aes_block *output, aes_key *key, aes_block *input);
+
+void crypton_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
+
+void crypton_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
+
+void crypton_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks);
+void crypton_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks);
+
+void crypton_aes_encrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,
+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);
+void crypton_aes_decrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,
+                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);
+
+void crypton_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len);
+void crypton_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length);
+void crypton_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key);
+
+void crypton_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len);
+void crypton_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key);
+
+void crypton_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t len, uint32_t msg_size, int m, int l);
+void crypton_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
+void crypton_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key);
+
+uint8_t *crypton_aes_cpu_init(void);
+
+void crypton_aes_polyval_init(aes_polyval *ctx, const aes_block *h);
+void crypton_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length);
+void crypton_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst);
+
+#endif
diff --git a/cbits/crypton_align.h b/cbits/crypton_align.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_align.h
@@ -0,0 +1,140 @@
+#ifndef CRYPTON_ALIGN_H
+#define CRYPTON_ALIGN_H
+
+#include "crypton_bitfn.h"
+
+#if (defined(__i386__))
+# define UNALIGNED_ACCESS_OK
+#elif defined(__x86_64__)
+# define UNALIGNED_ACCESS_OK
+#else
+# define UNALIGNED_ACCESS_FAULT
+#endif
+
+/* n need to be power of 2.
+ * IS_ALIGNED(p,8) */
+#define IS_ALIGNED(p,alignment) (((uintptr_t) (p)) & ((alignment)-1))
+
+#ifdef WITH_ASSERT_ALIGNMENT
+#include <stdio.h>
+#include <stdlib.h>
+#include <inttypes.h>
+# define ASSERT_ALIGNMENT(up, alignment) \
+	do { if (IS_ALIGNED(up, alignment)) \
+	{ printf("ALIGNMENT-ASSERT-FAILURE: %s:%d: ptr=%p alignment=%d\n", __FILE__, __LINE__, (void *) up, (alignment)); \
+	  exit(99); \
+	}; } while (0)
+#else
+# define ASSERT_ALIGNMENT(p, n) do {} while (0)
+#endif
+
+#ifdef UNALIGNED_ACCESS_OK
+#define need_alignment(p,n) (0)
+#else
+#define need_alignment(p,n) IS_ALIGNED(p,n)
+#endif
+
+static inline uint32_t load_le32_aligned(const uint8_t *p)
+{
+	return le32_to_cpu(*((uint32_t *) p));		
+}
+
+static inline void store_le32_aligned(uint8_t *dst, const uint32_t v)
+{
+	*((uint32_t *) dst) = cpu_to_le32(v);
+}
+
+static inline void xor_le32_aligned(uint8_t *dst, const uint32_t v)
+{
+	*((uint32_t *) dst) ^= cpu_to_le32(v);
+}
+
+static inline void store_be32_aligned(uint8_t *dst, const uint32_t v)
+{
+	*((uint32_t *) dst) = cpu_to_be32(v);
+}
+
+static inline void xor_be32_aligned(uint8_t *dst, const uint32_t v)
+{
+	*((uint32_t *) dst) ^= cpu_to_be32(v);
+}
+
+static inline void store_le64_aligned(uint8_t *dst, const uint64_t v)
+{
+	*((uint64_t *) dst) = cpu_to_le64(v);
+}
+
+static inline void store_be64_aligned(uint8_t *dst, const uint64_t v)
+{
+	*((uint64_t *) dst) = cpu_to_be64(v);
+}
+
+static inline void xor_be64_aligned(uint8_t *dst, const uint64_t v)
+{
+	*((uint64_t *) dst) ^= cpu_to_be64(v);
+}
+
+#ifdef UNALIGNED_ACCESS_OK
+#define load_le32(a) load_le32_aligned(a)
+#else
+static inline uint32_t load_le32(const uint8_t *p)
+{
+	return ((uint32_t)p[0]) | ((uint32_t)p[1] <<  8) | ((uint32_t)p[2] << 16) | ((uint32_t)p[3] << 24);
+}
+#endif
+
+#ifdef UNALIGNED_ACCESS_OK
+#define store_le32(a, b) store_le32_aligned(a, b)
+#define xor_le32(a, b) xor_le32_aligned(a, b)
+#else
+static inline void store_le32(uint8_t *dst, const uint32_t v)
+{
+	dst[0] = v; dst[1] = v >> 8; dst[2] = v >> 16; dst[3] = v >> 24;
+}
+static inline void xor_le32(uint8_t *dst, const uint32_t v)
+{
+	dst[0] ^= v; dst[1] ^= v >> 8; dst[2] ^= v >> 16; dst[3] ^= v >> 24;
+}
+#endif
+
+#ifdef UNALIGNED_ACCESS_OK
+#define store_be32(a, b) store_be32_aligned(a, b)
+#define xor_be32(a, b) xor_be32_aligned(a, b)
+#else
+static inline void store_be32(uint8_t *dst, const uint32_t v)
+{
+	dst[3] = v; dst[2] = v >> 8; dst[1] = v >> 16; dst[0] = v >> 24;
+}
+static inline void xor_be32(uint8_t *dst, const uint32_t v)
+{
+	dst[3] ^= v; dst[2] ^= v >> 8; dst[1] ^= v >> 16; dst[0] ^= v >> 24;
+}
+#endif
+
+#ifdef UNALIGNED_ACCESS_OK
+#define store_le64(a, b) store_le64_aligned(a, b)
+#else
+static inline void store_le64(uint8_t *dst, const uint64_t v)
+{
+	dst[0] = v      ; dst[1] = v >> 8 ; dst[2] = v >> 16; dst[3] = v >> 24;
+	dst[4] = v >> 32; dst[5] = v >> 40; dst[6] = v >> 48; dst[7] = v >> 56;
+}
+#endif
+
+#ifdef UNALIGNED_ACCESS_OK
+#define store_be64(a, b) store_be64_aligned(a, b)
+#define xor_be64(a, b) xor_be64_aligned(a, b)
+#else
+static inline void store_be64(uint8_t *dst, const uint64_t v)
+{
+	dst[7] = v      ; dst[6] = v >> 8 ; dst[5] = v >> 16; dst[4] = v >> 24;
+	dst[3] = v >> 32; dst[2] = v >> 40; dst[1] = v >> 48; dst[0] = v >> 56;
+}
+static inline void xor_be64(uint8_t *dst, const uint64_t v)
+{
+	dst[7] ^= v      ; dst[6] ^= v >> 8 ; dst[5] ^= v >> 16; dst[4] ^= v >> 24;
+	dst[3] ^= v >> 32; dst[2] ^= v >> 40; dst[1] ^= v >> 48; dst[0] ^= v >> 56;
+}
+#endif
+
+#endif
diff --git a/cbits/crypton_bitfn.h b/cbits/crypton_bitfn.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_bitfn.h
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2006-2014 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BITFN_H
+#define BITFN_H
+#include <stdint.h>
+
+#ifndef NO_INLINE_ASM
+/**********************************************************/
+# if (defined(__i386__))
+#  define ARCH_HAS_SWAP32
+static inline uint32_t bitfn_swap32(uint32_t a)
+{
+	asm ("bswap %0" : "=r" (a) : "0" (a));
+	return a;
+}
+/**********************************************************/
+# elif (defined(__arm__))
+#  define ARCH_HAS_SWAP32
+static inline uint32_t bitfn_swap32(uint32_t a)
+{
+	uint32_t tmp = a;
+	asm volatile ("eor %1, %0, %0, ror #16\n"
+	              "bic %1, %1, #0xff0000\n"
+	              "mov %0, %0, ror #8\n"
+	              "eor %0, %0, %1, lsr #8\n"
+	             : "=r" (a), "=r" (tmp) : "0" (a), "1" (tmp));
+	return a;
+}
+/**********************************************************/
+# elif defined(__x86_64__)
+#  define ARCH_HAS_SWAP32
+#  define ARCH_HAS_SWAP64
+static inline uint32_t bitfn_swap32(uint32_t a)
+{
+	asm ("bswap %0" : "=r" (a) : "0" (a));
+	return a;
+}
+
+static inline uint64_t bitfn_swap64(uint64_t a)
+{
+	asm ("bswap %0" : "=r" (a) : "0" (a));
+	return a;
+}
+
+# endif
+#endif /* NO_INLINE_ASM */
+/**********************************************************/
+
+#ifndef ARCH_HAS_ROL32
+static inline uint32_t rol32(uint32_t word, uint32_t shift)
+{
+	return (word << shift) | (word >> (32 - shift));
+}
+#endif
+
+#ifndef ARCH_HAS_ROR32
+static inline uint32_t ror32(uint32_t word, uint32_t shift)
+{
+	return (word >> shift) | (word << (32 - shift));
+}
+#endif
+
+#ifndef ARCH_HAS_ROL64
+static inline uint64_t rol64(uint64_t word, uint32_t shift)
+{
+	return (word << shift) | (word >> (64 - shift));
+}
+#endif
+
+#ifndef ARCH_HAS_ROR64
+static inline uint64_t ror64(uint64_t word, uint32_t shift)
+{
+	return (word >> shift) | (word << (64 - shift));
+}
+#endif
+
+#ifndef ARCH_HAS_SWAP32
+static inline uint32_t bitfn_swap32(uint32_t a)
+{
+	return (a << 24) | ((a & 0xff00) << 8) | ((a >> 8) & 0xff00) | (a >> 24);
+}
+#endif
+
+#ifndef ARCH_HAS_ARRAY_SWAP32
+static inline void array_swap32(uint32_t *d, uint32_t *s, uint32_t nb)
+{
+	while (nb--)
+		*d++ = bitfn_swap32(*s++);
+}
+#endif
+
+#ifndef ARCH_HAS_SWAP64
+static inline uint64_t bitfn_swap64(uint64_t a)
+{
+	return ((uint64_t) bitfn_swap32((uint32_t) (a >> 32))) |
+	       (((uint64_t) bitfn_swap32((uint32_t) a)) << 32);
+}
+#endif
+
+#ifndef ARCH_HAS_ARRAY_SWAP64
+static inline void array_swap64(uint64_t *d, uint64_t *s, uint32_t nb)
+{
+	while (nb--)
+		*d++ = bitfn_swap64(*s++);
+}
+#endif
+
+#ifndef ARCH_HAS_MEMORY_ZERO
+static inline void memory_zero(void *ptr, uint32_t len)
+{
+	uint32_t *ptr32 = ptr;
+	uint8_t *ptr8;
+	int i;
+
+	for (i = 0; i < len / 4; i++)
+		*ptr32++ = 0;
+	if (len % 4) {
+		ptr8 = (uint8_t *) ptr32;
+		for (i = len % 4; i >= 0; i--)
+			ptr8[i] = 0;
+	}
+}
+#endif
+
+#ifndef ARCH_HAS_ARRAY_COPY32
+static inline void array_copy32(uint32_t *d, uint32_t *s, uint32_t nb)
+{
+	while (nb--) *d++ = *s++;
+}
+#endif
+
+#ifndef ARCH_HAS_ARRAY_XOR32
+static inline void array_xor32(uint32_t *d, uint32_t *s, uint32_t nb)
+{
+	while (nb--) *d++ ^= *s++;
+}
+#endif
+
+#ifndef ARCH_HAS_ARRAY_COPY64
+static inline void array_copy64(uint64_t *d, uint64_t *s, uint32_t nb)
+{
+	while (nb--) *d++ = *s++;
+}
+#endif
+
+#ifdef __GNUC__
+#define bitfn_ntz(n) __builtin_ctz(n)
+#else
+#error "define ntz for your platform"
+#endif
+
+#ifdef __MINGW32__
+  # define LITTLE_ENDIAN 1234
+  # define BYTE_ORDER    LITTLE_ENDIAN
+#elif defined(__FreeBSD__) || defined(__DragonFly__) || defined(__NetBSD__)
+  # include <sys/endian.h>
+#elif defined(__OpenBSD__) || defined(__SVR4)
+  # include <sys/types.h>
+#elif defined(__APPLE__)
+  # include <machine/endian.h>
+#elif defined( BSD ) && ( BSD >= 199103 )
+  # include <machine/endian.h>
+#elif defined( __QNXNTO__ ) && defined( __LITTLEENDIAN__ )
+  # define LITTLE_ENDIAN 1234
+  # define BYTE_ORDER    LITTLE_ENDIAN
+#elif defined( __QNXNTO__ ) && defined( __BIGENDIAN__ )
+  # define BIG_ENDIAN 1234
+  # define BYTE_ORDER    BIG_ENDIAN
+#elif defined( _AIX )
+  # include <sys/machine.h>
+#else
+  # include <endian.h>
+#endif
+/* big endian to cpu */
+#if LITTLE_ENDIAN == BYTE_ORDER
+
+# define be32_to_cpu(a) bitfn_swap32(a)
+# define cpu_to_be32(a) bitfn_swap32(a)
+# define le32_to_cpu(a) (a)
+# define cpu_to_le32(a) (a)
+# define be64_to_cpu(a) bitfn_swap64(a)
+# define cpu_to_be64(a) bitfn_swap64(a)
+# define le64_to_cpu(a) (a)
+# define cpu_to_le64(a) (a)
+
+# define cpu_to_le32_array(d, s, l) array_copy32(d, s, l)
+# define le32_to_cpu_array(d, s, l) array_copy32(d, s, l)
+# define cpu_to_be32_array(d, s, l) array_swap32(d, s, l)
+# define be32_to_cpu_array(d, s, l) array_swap32(d, s, l)
+
+# define cpu_to_le64_array(d, s, l) array_copy64(d, s, l)
+# define le64_to_cpu_array(d, s, l) array_copy64(d, s, l)
+# define cpu_to_be64_array(d, s, l) array_swap64(d, s, l)
+# define be64_to_cpu_array(d, s, l) array_swap64(d, s, l)
+
+# define ror32_be(a, s) rol32(a, s)
+# define rol32_be(a, s) ror32(a, s)
+
+# define ARCH_IS_LITTLE_ENDIAN
+
+#elif BIG_ENDIAN == BYTE_ORDER
+
+# define be32_to_cpu(a) (a)
+# define cpu_to_be32(a) (a)
+# define be64_to_cpu(a) (a)
+# define cpu_to_be64(a) (a)
+# define le64_to_cpu(a) bitfn_swap64(a)
+# define cpu_to_le64(a) bitfn_swap64(a)
+# define le32_to_cpu(a) bitfn_swap32(a)
+# define cpu_to_le32(a) bitfn_swap32(a)
+
+# define cpu_to_le32_array(d, s, l) array_swap32(d, s, l)
+# define le32_to_cpu_array(d, s, l) array_swap32(d, s, l)
+# define cpu_to_be32_array(d, s, l) array_copy32(d, s, l)
+# define be32_to_cpu_array(d, s, l) array_copy32(d, s, l)
+
+# define cpu_to_le64_array(d, s, l) array_swap64(d, s, l)
+# define le64_to_cpu_array(d, s, l) array_swap64(d, s, l)
+# define cpu_to_be64_array(d, s, l) array_copy64(d, s, l)
+# define be64_to_cpu_array(d, s, l) array_copy64(d, s, l)
+
+# define ror32_be(a, s) ror32(a, s)
+# define rol32_be(a, s) rol32(a, s)
+
+# define ARCH_IS_BIG_ENDIAN
+
+#else
+# error "endian not supported"
+#endif
+
+#endif /* !BITFN_H */
diff --git a/cbits/crypton_blake2b.c b/cbits/crypton_blake2b.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2b.c
@@ -0,0 +1,16 @@
+#include "crypton_blake2b.h"
+
+void crypton_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen)
+{
+	_crypton_blake2b_init(ctx, hashlen / 8);
+}
+
+void crypton_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	_crypton_blake2b_update(ctx, data, len);
+}
+
+void crypton_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	_crypton_blake2b_final(ctx, out, hashlen / 8);
+}
diff --git a/cbits/crypton_blake2b.h b/cbits/crypton_blake2b.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2b.h
@@ -0,0 +1,12 @@
+#ifndef CRYPTOHASH_BLAKE2B_H
+#define CRYPTOHASH_BLAKE2B_H
+
+#include "blake2.h"
+
+typedef blake2b_state blake2b_ctx;
+
+void crypton_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen);
+void crypton_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_blake2bp.c b/cbits/crypton_blake2bp.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2bp.c
@@ -0,0 +1,16 @@
+#include "crypton_blake2bp.h"
+
+void crypton_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen)
+{
+	_crypton_blake2bp_init(ctx, hashlen / 8);
+}
+
+void crypton_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	_crypton_blake2bp_update(ctx, data, len);
+}
+
+void crypton_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	_crypton_blake2bp_final(ctx, out, hashlen / 8);
+}
diff --git a/cbits/crypton_blake2bp.h b/cbits/crypton_blake2bp.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2bp.h
@@ -0,0 +1,12 @@
+#ifndef CRYPTOHASH_BLAKE2BP_H
+#define CRYPTOHASH_BLAKE2BP_H
+
+#include "blake2.h"
+
+typedef blake2bp_state blake2bp_ctx;
+
+void crypton_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen);
+void crypton_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_blake2s.c b/cbits/crypton_blake2s.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2s.c
@@ -0,0 +1,16 @@
+#include "crypton_blake2s.h"
+
+void crypton_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen)
+{
+	_crypton_blake2s_init(ctx, hashlen / 8);
+}
+
+void crypton_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	_crypton_blake2s_update(ctx, data, len);
+}
+
+void crypton_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	_crypton_blake2s_final(ctx, out, hashlen / 8);
+}
diff --git a/cbits/crypton_blake2s.h b/cbits/crypton_blake2s.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2s.h
@@ -0,0 +1,12 @@
+#ifndef CRYPTOHASH_BLAKE2S_H
+#define CRYPTOHASH_BLAKE2S_H
+
+#include "blake2.h"
+
+typedef blake2s_state blake2s_ctx;
+
+void crypton_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen);
+void crypton_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_blake2sp.c b/cbits/crypton_blake2sp.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2sp.c
@@ -0,0 +1,16 @@
+#include "crypton_blake2sp.h"
+
+void crypton_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen)
+{
+	_crypton_blake2sp_init(ctx, hashlen / 8);
+}
+
+void crypton_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	_crypton_blake2sp_update(ctx, data, len);
+}
+
+void crypton_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	_crypton_blake2sp_final(ctx, out, hashlen / 8);
+}
diff --git a/cbits/crypton_blake2sp.h b/cbits/crypton_blake2sp.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_blake2sp.h
@@ -0,0 +1,12 @@
+#ifndef CRYPTOHASH_BLAKE2SP_H
+#define CRYPTOHASH_BLAKE2SP_H
+
+#include "blake2.h"
+
+typedef blake2sp_state blake2sp_ctx;
+
+void crypton_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen);
+void crypton_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_chacha.c b/cbits/crypton_chacha.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_chacha.c
@@ -0,0 +1,288 @@
+/*
+ * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "crypton_chacha.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include <stdio.h>
+
+#define QR(a,b,c,d) \
+	a += b; d = rol32(d ^ a,16); \
+	c += d; b = rol32(b ^ c,12); \
+	a += b; d = rol32(d ^ a, 8); \
+	c += d; b = rol32(b ^ c, 7);
+
+#define ALIGNED64(PTR) \
+	(((uintptr_t)(const void *)(PTR)) % 8 == 0)
+
+static const uint8_t sigma[16] = "expand 32-byte k";
+static const uint8_t tau[16] = "expand 16-byte k";
+
+static void chacha_core(int rounds, block *out, const crypton_chacha_state *in)
+{
+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+	int i;
+
+	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];
+	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];
+	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];
+	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];
+
+	for (i = rounds; i > 0; i -= 2) {
+		QR(x0, x4, x8, x12);
+		QR(x1, x5, x9, x13);
+		QR(x2, x6, x10, x14);
+		QR(x3, x7, x11, x15);
+
+		QR(x0, x5, x10, x15);
+		QR(x1, x6, x11, x12);
+		QR(x2, x7, x8, x13);
+		QR(x3, x4, x9, x14);
+	}
+
+	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];
+	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];
+	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];
+	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];
+
+	out->d[0] = cpu_to_le32(x0);
+	out->d[1] = cpu_to_le32(x1);
+	out->d[2] = cpu_to_le32(x2);
+	out->d[3] = cpu_to_le32(x3);
+	out->d[4] = cpu_to_le32(x4);
+	out->d[5] = cpu_to_le32(x5);
+	out->d[6] = cpu_to_le32(x6);
+	out->d[7] = cpu_to_le32(x7);
+	out->d[8] = cpu_to_le32(x8);
+	out->d[9] = cpu_to_le32(x9);
+	out->d[10] = cpu_to_le32(x10);
+	out->d[11] = cpu_to_le32(x11);
+	out->d[12] = cpu_to_le32(x12);
+	out->d[13] = cpu_to_le32(x13);
+	out->d[14] = cpu_to_le32(x14);
+	out->d[15] = cpu_to_le32(x15);
+}
+
+/* only 2 valids values are 256 (32) and 128 (16) */
+void crypton_chacha_init_core(crypton_chacha_state *st,
+                                 uint32_t keylen, const uint8_t *key,
+                                 uint32_t ivlen, const uint8_t *iv)
+{
+	const uint8_t *constants = (keylen == 32) ? sigma : tau;
+
+	ASSERT_ALIGNMENT(constants, 4);
+
+	st->d[0] = load_le32_aligned(constants + 0);
+	st->d[1] = load_le32_aligned(constants + 4);
+	st->d[2] = load_le32_aligned(constants + 8);
+	st->d[3] = load_le32_aligned(constants + 12);
+
+	st->d[4] = load_le32(key + 0);
+	st->d[5] = load_le32(key + 4);
+	st->d[6] = load_le32(key + 8);
+	st->d[7] = load_le32(key + 12);
+	/* we repeat the key on 128 bits */
+	if (keylen == 32)
+		key += 16;
+	st->d[8] = load_le32(key + 0);
+	st->d[9] = load_le32(key + 4);
+	st->d[10] = load_le32(key + 8);
+	st->d[11] = load_le32(key + 12);
+	st->d[12] = 0;
+	switch (ivlen) {
+	case 8:
+		st->d[13] = 0;
+		st->d[14] = load_le32(iv + 0);
+		st->d[15] = load_le32(iv + 4);
+		break;
+	case 12:
+		st->d[13] = load_le32(iv + 0);
+		st->d[14] = load_le32(iv + 4);
+		st->d[15] = load_le32(iv + 8);
+	default:
+		return;
+	}
+}
+
+void crypton_chacha_init(crypton_chacha_context *ctx, uint8_t nb_rounds,
+                            uint32_t keylen, const uint8_t *key,
+                            uint32_t ivlen, const uint8_t *iv)
+{
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->nb_rounds = nb_rounds;
+	crypton_chacha_init_core(&ctx->st, keylen, key, ivlen, iv);
+}
+
+void crypton_chacha_combine(uint8_t *dst, crypton_chacha_context *ctx, const uint8_t *src, uint32_t bytes)
+{
+	block out;
+	crypton_chacha_state *st;
+	int i;
+
+	if (!bytes)
+		return;
+
+	/* xor the previous buffer first (if any) */
+	if (ctx->prev_len > 0) {
+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
+		for (i = 0; i < to_copy; i++)
+			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];
+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
+		ctx->prev_len -= to_copy;
+		ctx->prev_ofs += to_copy;
+		src += to_copy;
+		dst += to_copy;
+		bytes -= to_copy;
+	}
+
+	if (bytes == 0)
+		return;
+
+	st = &ctx->st;
+
+	/* xor new 64-bytes chunks and store the left over if any */
+	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {
+		/* generate new chunk and update state */
+		chacha_core(ctx->nb_rounds, &out, st);
+		st->d[12] += 1;
+		if (st->d[12] == 0)
+			st->d[13] += 1;
+
+		for (i = 0; i < 64; ++i)
+			dst[i] = src[i] ^ out.b[i];
+	}
+
+	if (bytes > 0) {
+		/* generate new chunk and update state */
+		chacha_core(ctx->nb_rounds, &out, st);
+		st->d[12] += 1;
+		if (st->d[12] == 0)
+			st->d[13] += 1;
+
+		/* xor as much as needed */
+		for (i = 0; i < bytes; i++)
+			dst[i] = src[i] ^ out.b[i];
+		
+		/* copy the left over in the buffer */
+		ctx->prev_len = 64 - bytes;
+		ctx->prev_ofs = i;
+		for (; i < 64; i++) {
+			ctx->prev[i] = out.b[i];
+		}
+	}
+}
+
+void crypton_chacha_generate(uint8_t *dst, crypton_chacha_context *ctx, uint32_t bytes)
+{
+	crypton_chacha_state *st;
+	block out;
+	int i;
+
+	if (!bytes)
+		return;
+
+	/* xor the previous buffer first (if any) */
+	if (ctx->prev_len > 0) {
+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
+		for (i = 0; i < to_copy; i++)
+			dst[i] = ctx->prev[ctx->prev_ofs+i];
+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
+		ctx->prev_len -= to_copy;
+		ctx->prev_ofs += to_copy;
+		dst += to_copy;
+		bytes -= to_copy;
+	}
+
+	if (bytes == 0)
+		return;
+
+	st = &ctx->st;
+
+	if (ALIGNED64(dst)) {
+		/* xor new 64-bytes chunks and store the left over if any */
+		for (; bytes >= 64; bytes -= 64, dst += 64) {
+			/* generate new chunk and update state */
+			chacha_core(ctx->nb_rounds, (block *) dst, st);
+			st->d[12] += 1;
+			if (st->d[12] == 0)
+				st->d[13] += 1;
+		}
+	} else {
+		/* xor new 64-bytes chunks and store the left over if any */
+		for (; bytes >= 64; bytes -= 64, dst += 64) {
+			/* generate new chunk and update state */
+			chacha_core(ctx->nb_rounds, &out, st);
+			st->d[12] += 1;
+			if (st->d[12] == 0)
+				st->d[13] += 1;
+
+			for (i = 0; i < 64; ++i)
+				dst[i] = out.b[i];
+		}
+	}
+
+	if (bytes > 0) {
+		/* generate new chunk and update state */
+		chacha_core(ctx->nb_rounds, &out, st);
+		st->d[12] += 1;
+		if (st->d[12] == 0)
+			st->d[13] += 1;
+
+		/* xor as much as needed */
+		for (i = 0; i < bytes; i++)
+			dst[i] = out.b[i];
+		
+		/* copy the left over in the buffer */
+		ctx->prev_len = 64 - bytes;
+		ctx->prev_ofs = i;
+		for (; i < 64; i++)
+			ctx->prev[i] = out.b[i];
+	}
+}
+
+void crypton_chacha_random(uint32_t rounds, uint8_t *dst, crypton_chacha_state *st, uint32_t bytes)
+{
+	block out;
+
+	if (!bytes)
+		return;
+	for (; bytes >= 16; bytes -= 16, dst += 16) {
+		chacha_core(rounds, &out, st);
+		memcpy(dst, out.b + 40, 16);
+		crypton_chacha_init_core(st, 32, out.b, 8, out.b + 32);
+	}
+	if (bytes) {
+		chacha_core(rounds, &out, st);
+		memcpy(dst, out.b + 40, bytes);
+		crypton_chacha_init_core(st, 32, out.b, 8, out.b + 32);
+	}
+}
diff --git a/cbits/crypton_chacha.h b/cbits/crypton_chacha.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_chacha.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#ifndef CRYPTON_CHACHA
+#define CRYPTON_CHACHA
+
+typedef union {
+	uint64_t q[8];
+	uint32_t d[16];
+	uint8_t  b[64];
+} block;
+
+typedef block crypton_chacha_state;
+
+typedef struct {
+	crypton_chacha_state st;
+	uint8_t prev[64];
+	uint8_t prev_ofs;
+	uint8_t prev_len;
+	uint8_t nb_rounds;
+} crypton_chacha_context;
+
+void crypton_chacha_init_core(crypton_chacha_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
+void crypton_chacha_init(crypton_chacha_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
+void crypton_chacha_combine(uint8_t *dst, crypton_chacha_context *st, const uint8_t *src, uint32_t bytes);
+void crypton_chacha_generate(uint8_t *dst, crypton_chacha_context *st, uint32_t bytes);
+
+#endif
diff --git a/cbits/crypton_cpu.c b/cbits/crypton_cpu.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_cpu.c
@@ -0,0 +1,75 @@
+/*
+ *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>
+ *
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+#include "crypton_cpu.h"
+#include <stdint.h>
+
+#ifdef ARCH_X86
+static void cpuid(uint32_t info, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)
+{
+	*eax = info;
+	asm volatile
+		(
+#ifdef __x86_64__
+		 "mov %%rbx, %%rdi;"
+#else
+		 "mov %%ebx, %%edi;"
+#endif
+		 "cpuid;"
+		 "mov %%ebx, %%esi;"
+#ifdef __x86_64__
+		 "mov %%rdi, %%rbx;"
+#else
+		 "mov %%edi, %%ebx;"
+#endif
+		 :"+a" (*eax), "=S" (*ebx), "=c" (*ecx), "=d" (*edx)
+		 : :"edi");
+}
+
+#ifdef USE_AESNI
+void crypton_aesni_initialize_hw(void (*init_table)(int, int))
+{
+	static int inited = 0;
+	if (inited == 0) {
+		uint32_t eax, ebx, ecx, edx;
+		int aesni, pclmul;
+
+		inited = 1;
+		cpuid(1, &eax, &ebx, &ecx, &edx);
+		aesni = (ecx & 0x02000000);
+		pclmul = (ecx & 0x00000001);
+		init_table(aesni, pclmul);
+	}
+}
+#else
+#define crypton_aesni_initialize_hw(init_table) 	(0)
+#endif
+
+#endif
diff --git a/cbits/crypton_cpu.h b/cbits/crypton_cpu.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_cpu.h
@@ -0,0 +1,45 @@
+/*
+ *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>
+ *
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+#ifndef CPU_H
+#define CPU_H
+
+#if defined(__i386__) || defined(__x86_64__)
+#define ARCH_X86
+#define USE_AESNI
+#endif
+
+#ifdef USE_AESNI
+void crypton_aesni_initialize_hw(void (*init_table)(int, int));
+#else
+#define crypton_aesni_initialize_hw(init_table) 	(0)
+#endif
+
+#endif
diff --git a/cbits/crypton_curve25519.h b/cbits/crypton_curve25519.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_curve25519.h
@@ -0,0 +1,6 @@
+#ifndef CRYPTON_CURVE25519_H
+#define CRYPTON_CURVE25519_H
+
+int crypton_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint);
+
+#endif
diff --git a/cbits/crypton_hash_prefix.c b/cbits/crypton_hash_prefix.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_hash_prefix.c
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <crypton_hash_prefix.h>
+
+void CRYPTON_HASHED(finalize_prefix)(struct HASHED_LOWER(ctx) *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)
+{
+	uint64_t bits[HASHED(BITS_ELEMS)];
+	uint8_t *p = (uint8_t *) &bits;
+	uint32_t index, padidx, padlen, pos, out_mask;
+	static const uint32_t cut_off = HASHED(BLOCK_SIZE) - sizeof(bits);
+
+	/* Make sure n <= len */
+	n += (len - n) & constant_time_lt(len, n);
+
+	/* Initial index, based on current context state */
+	index = CRYPTON_HASHED(get_index)(ctx);
+
+	/* Final size after n bytes */
+	CRYPTON_HASHED(incr_sz)(ctx, bits, n);
+
+	/* Padding index and length */
+	padidx = CRYPTON_HASHED(get_index)(ctx);
+	padlen = HASHED(BLOCK_SIZE) + cut_off - padidx;
+	padlen -= HASHED(BLOCK_SIZE) & constant_time_lt(padidx, cut_off);
+
+	/* Initialize buffers because we will XOR into them */
+	memset(ctx->buf + index, 0, HASHED(BLOCK_SIZE) - index);
+	memset(out, 0, HASHED(DIGEST_SIZE));
+	pos = 0;
+
+	/* Iterate based on the full buffer length, regardless of n, and include
+	 * the maximum overhead with padding and size bytes
+	 */
+	while (pos < len + HASHED(BLOCK_SIZE) + sizeof(bits)) {
+		uint8_t b;
+
+		/* Take as many bytes from the input buffer as possible */
+		if (pos < len)
+			b = *(data++) & (uint8_t) constant_time_lt(pos, n);
+		else
+			b = 0;
+
+		/* First padding byte */
+		b |= 0x80 & (uint8_t) constant_time_eq(pos, n);
+
+		/* Size bytes are always at the end of a block */
+		if (index >= cut_off)
+			b |= p[index - cut_off] & (uint8_t) constant_time_ge(pos, n + padlen);
+
+		/* Store this byte into the buffer */
+		ctx->buf[index++] ^= b;
+		pos++;
+
+		/* Process a full block, at a boundary which is independent from n */
+		if (index >= HASHED(BLOCK_SIZE)) {
+			index = 0;
+			HASHED_LOWER(do_chunk)(ctx, (void *) ctx->buf);
+			memset(ctx->buf, 0, HASHED(BLOCK_SIZE));
+
+			/* Try to store the result: this is a no-op except when we reach the
+			 * actual size based on n, more iterations may continue after that
+			 * when len is really larger
+			 */
+			out_mask = constant_time_eq(pos, n + padlen + sizeof(bits));
+			CRYPTON_HASHED(select_digest)(ctx, out, out_mask);
+		}
+	}
+}
diff --git a/cbits/crypton_hash_prefix.h b/cbits/crypton_hash_prefix.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_hash_prefix.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *	notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *	notice, this list of conditions and the following disclaimer in the
+ *	documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CRYPTON_HASH_PREFIX_H
+#define CRYPTON_HASH_PREFIX_H
+
+#include <stdint.h>
+
+static inline uint32_t constant_time_msb(uint32_t a)
+{
+	return 0 - (a >> 31);
+}
+
+static inline uint32_t constant_time_lt(uint32_t a, uint32_t b)
+{
+	return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
+}
+
+static inline uint32_t constant_time_ge(uint32_t a, uint32_t b)
+{
+	return ~constant_time_lt(a, b);
+}
+
+static inline uint32_t constant_time_is_zero(uint32_t a)
+{
+	return constant_time_msb(~a & (a - 1));
+}
+
+static inline uint32_t constant_time_eq(uint32_t a, uint32_t b)
+{
+	return constant_time_is_zero(a ^ b);
+}
+
+static inline uint64_t constant_time_msb_64(uint64_t a)
+{
+	return 0 - (a >> 63);
+}
+
+static inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b)
+{
+	return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b)));
+}
+
+#endif
diff --git a/cbits/crypton_md2.c b/cbits/crypton_md2.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_md2.c
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include <stdio.h>
+#include "crypton_bitfn.h"
+#include "crypton_md2.h"
+
+void crypton_md2_init(struct md2_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->sz = 0ULL;
+}
+
+static uint8_t S_table[]  = {
+	0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01, 0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13, 
+	0x62, 0xA7, 0x05, 0xF3, 0xC0, 0xC7, 0x73, 0x8C, 0x98, 0x93, 0x2B, 0xD9, 0xBC, 0x4C, 0x82, 0xCA, 
+	0x1E, 0x9B, 0x57, 0x3C, 0xFD, 0xD4, 0xE0, 0x16, 0x67, 0x42, 0x6F, 0x18, 0x8A, 0x17, 0xE5, 0x12, 
+	0xBE, 0x4E, 0xC4, 0xD6, 0xDA, 0x9E, 0xDE, 0x49, 0xA0, 0xFB, 0xF5, 0x8E, 0xBB, 0x2F, 0xEE, 0x7A, 
+	0xA9, 0x68, 0x79, 0x91, 0x15, 0xB2, 0x07, 0x3F, 0x94, 0xC2, 0x10, 0x89, 0x0B, 0x22, 0x5F, 0x21,
+	0x80, 0x7F, 0x5D, 0x9A, 0x5A, 0x90, 0x32, 0x27, 0x35, 0x3E, 0xCC, 0xE7, 0xBF, 0xF7, 0x97, 0x03, 
+	0xFF, 0x19, 0x30, 0xB3, 0x48, 0xA5, 0xB5, 0xD1, 0xD7, 0x5E, 0x92, 0x2A, 0xAC, 0x56, 0xAA, 0xC6, 
+	0x4F, 0xB8, 0x38, 0xD2, 0x96, 0xA4, 0x7D, 0xB6, 0x76, 0xFC, 0x6B, 0xE2, 0x9C, 0x74, 0x04, 0xF1, 
+	0x45, 0x9D, 0x70, 0x59, 0x64, 0x71, 0x87, 0x20, 0x86, 0x5B, 0xCF, 0x65, 0xE6, 0x2D, 0xA8, 0x02, 
+	0x1B, 0x60, 0x25, 0xAD, 0xAE, 0xB0, 0xB9, 0xF6, 0x1C, 0x46, 0x61, 0x69, 0x34, 0x40, 0x7E, 0x0F, 
+	0x55, 0x47, 0xA3, 0x23, 0xDD, 0x51, 0xAF, 0x3A, 0xC3, 0x5C, 0xF9, 0xCE, 0xBA, 0xC5, 0xEA, 0x26, 
+	0x2C, 0x53, 0x0D, 0x6E, 0x85, 0x28, 0x84, 0x09, 0xD3, 0xDF, 0xCD, 0xF4, 0x41, 0x81, 0x4D, 0x52, 
+	0x6A, 0xDC, 0x37, 0xC8, 0x6C, 0xC1, 0xAB, 0xFA, 0x24, 0xE1, 0x7B, 0x08, 0x0C, 0xBD, 0xB1, 0x4A, 
+	0x78, 0x88, 0x95, 0x8B, 0xE3, 0x63, 0xE8, 0x6D, 0xE9, 0xCB, 0xD5, 0xFE, 0x3B, 0x00, 0x1D, 0x39, 
+	0xF2, 0xEF, 0xB7, 0x0E, 0x66, 0x58, 0xD0, 0xE4, 0xA6, 0x77, 0x72, 0xF8, 0xEB, 0x75, 0x4B, 0x0A, 
+	0x31, 0x44, 0x50, 0xB4, 0x8F, 0xED, 0x1F, 0x1A, 0xDB, 0x99, 0x8D, 0x33, 0x9F, 0x11, 0x83, 0x14
+};
+
+#define UBYTES(s) ((uint8_t *) s)
+static uint8_t *padding_table[] = {
+	UBYTES(""),
+	UBYTES("\x1"),
+	UBYTES("\x2\x2"),
+	UBYTES("\x3\x3\x3"),
+	UBYTES("\x4\x4\x4\x4"),
+	UBYTES("\x5\x5\x5\x5\x5"),
+	UBYTES("\x6\x6\x6\x6\x6\x6"),
+	UBYTES("\x7\x7\x7\x7\x7\x7\x7"),
+	UBYTES("\x8\x8\x8\x8\x8\x8\x8\x8"),
+	UBYTES("\x9\x9\x9\x9\x9\x9\x9\x9\x9"),
+	UBYTES("\xa\xa\xa\xa\xa\xa\xa\xa\xa\xa"),
+	UBYTES("\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb"),
+	UBYTES("\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc"),
+	UBYTES("\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd"),
+	UBYTES("\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe"),
+	UBYTES("\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf"),
+	UBYTES("\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10")
+};
+
+static void md2_do_chunk(struct md2_ctx *ctx, const uint8_t *buf)
+{
+	uint8_t i, j, t;
+	uint8_t x[48];
+
+	memcpy(x, ctx->h, 16);
+	memcpy(x+16, buf, 16);
+
+	for (i = 0; i < 16; i++)
+		x[i+32] = ctx->h[i] ^ buf[i];
+
+	for (t = i = 0; i < 18; i++) {
+		for (j = 0; j < 48; j++)
+			t = x[j] ^= S_table[t];
+		t = (t + i) & 0xff;
+	}
+
+	memcpy(ctx->h, x, 16);
+
+	t = ctx->cksum[15];
+	for (i = 0; i < 16; i++)
+		t = ctx->cksum[i] ^= S_table[buf[i] ^ t];
+}
+
+void crypton_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t index, to_fill;
+
+	index = (uint32_t) (ctx->sz & 0xf);
+	to_fill = 16 - index;
+
+	ctx->sz += len;
+
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		md2_do_chunk(ctx, ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	/* process as much 16-block as possible */
+	for (; len >= 16; len -= 16, data += 16)
+		md2_do_chunk(ctx, data);
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_md2_finalize(struct md2_ctx *ctx, uint8_t *out)
+{
+	uint32_t index, padlen;
+
+	index = ctx->sz & 0xf;
+	padlen = 16 - index;
+
+	crypton_md2_update(ctx, padding_table[padlen], padlen);
+	crypton_md2_update(ctx, ctx->cksum, 16);
+	memcpy(out, ctx->h, 16);
+}
diff --git a/cbits/crypton_md2.h b/cbits/crypton_md2.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_md2.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_MD2_H
+#define CRYPTOHASH_MD2_H
+
+#include <stdint.h>
+
+struct md2_ctx
+{
+	uint64_t sz;
+	uint8_t  buf[16];
+	uint8_t  h[16];
+	uint8_t  cksum[16];
+};
+
+#define MD2_DIGEST_SIZE		16
+#define MD2_CTX_SIZE		sizeof(struct md2_ctx)
+
+void crypton_md2_init(struct md2_ctx *ctx);
+void crypton_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_md2_finalize(struct md2_ctx *ctx, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_md4.c b/cbits/crypton_md4.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_md4.c
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include <stdio.h>
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include "crypton_md4.h"
+
+void crypton_md4_init(struct md4_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->sz = 0ULL;
+	ctx->h[0] = 0x67452301;
+	ctx->h[1] = 0xefcdab89;
+	ctx->h[2] = 0x98badcfe;
+	ctx->h[3] = 0x10325476;
+}
+
+#define f1(x, y, z)	((x & y) | ((~x) & z))
+#define f2(x, y, z)	((x & y) | (x & z) | (y & z))
+#define f3(x, y, z)	(x ^ y ^ z)
+
+#define K1 	0x00000000
+#define K2 	0x5A827999
+#define K3 	0x6ED9EBA1
+#define R(a,b,c,d,f,k,s,i) (a = rol32(a + f(b,c,d) + w[i] + k, s))
+
+static void md4_do_chunk(struct md4_ctx *ctx, uint32_t *buf)
+{
+	uint32_t a, b, c, d;
+#ifdef ARCH_IS_BIG_ENDIAN
+	uint32_t w[16];
+	cpu_to_le32_array(w, (uint32_t *) buf, 16);
+#else
+	uint32_t *w = buf;
+#endif
+
+	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
+
+	R(a, b, c, d, f1, K1, 3, 0);
+	R(d, a, b, c, f1, K1, 7, 1);
+	R(c, d, a, b, f1, K1, 11, 2);
+	R(b, c, d, a, f1, K1, 19, 3);
+	R(a, b, c, d, f1, K1, 3, 4);
+	R(d, a, b, c, f1, K1, 7, 5);
+	R(c, d, a, b, f1, K1, 11, 6);
+	R(b, c, d, a, f1, K1, 19, 7);
+	R(a, b, c, d, f1, K1, 3, 8);
+	R(d, a, b, c, f1, K1, 7, 9);
+	R(c, d, a, b, f1, K1, 11, 10);
+	R(b, c, d, a, f1, K1, 19, 11);
+	R(a, b, c, d, f1, K1, 3, 12);
+	R(d, a, b, c, f1, K1, 7, 13);
+	R(c, d, a, b, f1, K1, 11, 14);
+	R(b, c, d, a, f1, K1, 19, 15);
+
+	R(a, b, c, d, f2, K2, 3, 0);
+	R(d, a, b, c, f2, K2, 5, 4);
+	R(c, d, a, b, f2, K2, 9, 8);
+	R(b, c, d, a, f2, K2, 13, 12);
+	R(a, b, c, d, f2, K2, 3, 1);
+	R(d, a, b, c, f2, K2, 5, 5);
+	R(c, d, a, b, f2, K2, 9, 9);
+	R(b, c, d, a, f2, K2, 13, 13);
+	R(a, b, c, d, f2, K2, 3, 2);
+	R(d, a, b, c, f2, K2, 5, 6);
+	R(c, d, a, b, f2, K2, 9, 10);
+	R(b, c, d, a, f2, K2, 13, 14);
+	R(a, b, c, d, f2, K2, 3, 3);
+	R(d, a, b, c, f2, K2, 5, 7);
+	R(c, d, a, b, f2, K2, 9, 11);
+	R(b, c, d, a, f2, K2, 13, 15);
+
+	R(a, b, c, d, f3, K3, 3, 0);
+	R(d, a, b, c, f3, K3, 9, 8);
+	R(c, d, a, b, f3, K3, 11, 4);
+	R(b, c, d, a, f3, K3, 15, 12);
+	R(a, b, c, d, f3, K3, 3, 2);
+	R(d, a, b, c, f3, K3, 9, 10);
+	R(c, d, a, b, f3, K3, 11, 6);
+	R(b, c, d, a, f3, K3, 15, 14);
+	R(a, b, c, d, f3, K3, 3, 1);
+	R(d, a, b, c, f3, K3, 9, 9);
+	R(c, d, a, b, f3, K3, 11, 5);
+	R(b, c, d, a, f3, K3, 15, 13);
+	R(a, b, c, d, f3, K3, 3, 3);
+	R(d, a, b, c, f3, K3, 9, 11);
+	R(c, d, a, b, f3, K3, 11, 7);
+	R(b, c, d, a, f3, K3, 15, 15);
+
+	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+}
+
+void crypton_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t index, to_fill;
+
+	index = (uint32_t) (ctx->sz & 0x3f);
+	to_fill = 64 - index;
+
+	ctx->sz += len;
+
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		md4_do_chunk(ctx, (uint32_t *) ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	if (need_alignment(data, 4)) {
+		uint32_t tramp[16];
+		ASSERT_ALIGNMENT(tramp, 4);
+		for (; len >= 64; len -= 64, data += 64) {
+			memcpy(tramp, data, 64);
+			md4_do_chunk(ctx, tramp);
+		}
+	} else {
+		/* process as much 64-block as possible */
+		for (; len >= 64; len -= 64, data += 64)
+			md4_do_chunk(ctx, (uint32_t *) data);
+	}
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_md4_finalize(struct md4_ctx *ctx, uint8_t *out)
+{
+	static uint8_t padding[64] = { 0x80, };
+	uint64_t bits;
+	uint32_t index, padlen;
+
+	/* add padding and update data with it */
+	bits = cpu_to_le64(ctx->sz << 3);
+
+	/* pad out to 56 */
+	index = (uint32_t) (ctx->sz & 0x3f);
+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
+	crypton_md4_update(ctx, padding, padlen);
+
+	/* append length */
+	crypton_md4_update(ctx, (uint8_t *) &bits, sizeof(bits));
+
+	/* output hash */
+	store_le32(out   , ctx->h[0]);
+	store_le32(out+ 4, ctx->h[1]);
+	store_le32(out+ 8, ctx->h[2]);
+	store_le32(out+12, ctx->h[3]);
+}
diff --git a/cbits/crypton_md4.h b/cbits/crypton_md4.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_md4.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_MD4_H
+#define CRYPTOHASH_MD4_H
+
+#include <stdint.h>
+
+struct md4_ctx
+{
+	uint64_t sz;
+	uint8_t  buf[64];
+	uint32_t h[4];
+};
+
+#define MD4_DIGEST_SIZE		16
+#define MD4_CTX_SIZE		sizeof(struct md4_ctx)
+
+void crypton_md4_init(struct md4_ctx *ctx);
+void crypton_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_md4_finalize(struct md4_ctx *ctx, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_md5.c b/cbits/crypton_md5.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_md5.c
@@ -0,0 +1,214 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include <stdio.h>
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include "crypton_md5.h"
+
+void crypton_md5_init(struct md5_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->sz = 0ULL;
+	ctx->h[0] = 0x67452301;
+	ctx->h[1] = 0xefcdab89;
+	ctx->h[2] = 0x98badcfe;
+	ctx->h[3] = 0x10325476;
+}
+
+#define f1(x, y, z)	(z ^ (x & (y ^ z)))
+#define f2(x, y, z)	f1(z, x, y)
+#define f3(x, y, z)	(x ^ y ^ z)
+#define f4(x, y, z)	(y ^ (x | ~z))
+#define R(f, a, b, c, d, i, k, s) a += f(b, c, d) + w[i] + k; a = rol32(a, s); a += b
+
+static void md5_do_chunk(struct md5_ctx *ctx, uint32_t *buf)
+{
+	uint32_t a, b, c, d;
+#ifdef ARCH_IS_BIG_ENDIAN
+	uint32_t w[16];
+	cpu_to_le32_array(w, buf, 16);
+#else
+	uint32_t *w = buf;
+#endif
+	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
+
+	R(f1, a, b, c, d, 0, 0xd76aa478, 7);
+	R(f1, d, a, b, c, 1, 0xe8c7b756, 12);
+	R(f1, c, d, a, b, 2, 0x242070db, 17);
+	R(f1, b, c, d, a, 3, 0xc1bdceee, 22);
+	R(f1, a, b, c, d, 4, 0xf57c0faf, 7);
+	R(f1, d, a, b, c, 5, 0x4787c62a, 12);
+	R(f1, c, d, a, b, 6, 0xa8304613, 17);
+	R(f1, b, c, d, a, 7, 0xfd469501, 22);
+	R(f1, a, b, c, d, 8, 0x698098d8, 7);
+	R(f1, d, a, b, c, 9, 0x8b44f7af, 12);
+	R(f1, c, d, a, b, 10, 0xffff5bb1, 17);
+	R(f1, b, c, d, a, 11, 0x895cd7be, 22);
+	R(f1, a, b, c, d, 12, 0x6b901122, 7);
+	R(f1, d, a, b, c, 13, 0xfd987193, 12);
+	R(f1, c, d, a, b, 14, 0xa679438e, 17);
+	R(f1, b, c, d, a, 15, 0x49b40821, 22);
+
+	R(f2, a, b, c, d, 1, 0xf61e2562, 5);
+	R(f2, d, a, b, c, 6, 0xc040b340, 9);
+	R(f2, c, d, a, b, 11, 0x265e5a51, 14);
+	R(f2, b, c, d, a, 0, 0xe9b6c7aa, 20);
+	R(f2, a, b, c, d, 5, 0xd62f105d, 5);
+	R(f2, d, a, b, c, 10, 0x02441453, 9);
+	R(f2, c, d, a, b, 15, 0xd8a1e681, 14);
+	R(f2, b, c, d, a, 4, 0xe7d3fbc8, 20);
+	R(f2, a, b, c, d, 9, 0x21e1cde6, 5);
+	R(f2, d, a, b, c, 14, 0xc33707d6, 9);
+	R(f2, c, d, a, b, 3, 0xf4d50d87, 14);
+	R(f2, b, c, d, a, 8, 0x455a14ed, 20);
+	R(f2, a, b, c, d, 13, 0xa9e3e905, 5);
+	R(f2, d, a, b, c, 2, 0xfcefa3f8, 9);
+	R(f2, c, d, a, b, 7, 0x676f02d9, 14);
+	R(f2, b, c, d, a, 12, 0x8d2a4c8a, 20);
+
+	R(f3, a, b, c, d, 5, 0xfffa3942, 4);
+	R(f3, d, a, b, c, 8, 0x8771f681, 11);
+	R(f3, c, d, a, b, 11, 0x6d9d6122, 16);
+	R(f3, b, c, d, a, 14, 0xfde5380c, 23);
+	R(f3, a, b, c, d, 1, 0xa4beea44, 4);
+	R(f3, d, a, b, c, 4, 0x4bdecfa9, 11);
+	R(f3, c, d, a, b, 7, 0xf6bb4b60, 16);
+	R(f3, b, c, d, a, 10, 0xbebfbc70, 23);
+	R(f3, a, b, c, d, 13, 0x289b7ec6, 4);
+	R(f3, d, a, b, c, 0, 0xeaa127fa, 11);
+	R(f3, c, d, a, b, 3, 0xd4ef3085, 16);
+	R(f3, b, c, d, a, 6, 0x04881d05, 23);
+	R(f3, a, b, c, d, 9, 0xd9d4d039, 4);
+	R(f3, d, a, b, c, 12, 0xe6db99e5, 11);
+	R(f3, c, d, a, b, 15, 0x1fa27cf8, 16);
+	R(f3, b, c, d, a, 2, 0xc4ac5665, 23);
+
+	R(f4, a, b, c, d, 0, 0xf4292244, 6);
+	R(f4, d, a, b, c, 7, 0x432aff97, 10);
+	R(f4, c, d, a, b, 14, 0xab9423a7, 15);
+	R(f4, b, c, d, a, 5, 0xfc93a039, 21);
+	R(f4, a, b, c, d, 12, 0x655b59c3, 6);
+	R(f4, d, a, b, c, 3, 0x8f0ccc92, 10);
+	R(f4, c, d, a, b, 10, 0xffeff47d, 15);
+	R(f4, b, c, d, a, 1, 0x85845dd1, 21);
+	R(f4, a, b, c, d, 8, 0x6fa87e4f, 6);
+	R(f4, d, a, b, c, 15, 0xfe2ce6e0, 10);
+	R(f4, c, d, a, b, 6, 0xa3014314, 15);
+	R(f4, b, c, d, a, 13, 0x4e0811a1, 21);
+	R(f4, a, b, c, d, 4, 0xf7537e82, 6);
+	R(f4, d, a, b, c, 11, 0xbd3af235, 10);
+	R(f4, c, d, a, b, 2, 0x2ad7d2bb, 15);
+	R(f4, b, c, d, a, 9, 0xeb86d391, 21);
+
+	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+}
+
+void crypton_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t index, to_fill;
+
+	index = (uint32_t) (ctx->sz & 0x3f);
+	to_fill = 64 - index;
+
+	ctx->sz += len;
+
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		md5_do_chunk(ctx, (uint32_t *) ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	if (need_alignment(data, 4)) {
+		uint32_t tramp[16];
+		ASSERT_ALIGNMENT(tramp, 4);
+		for (; len >= 64; len -= 64, data += 64) {
+			memcpy(tramp, data, 64);
+			md5_do_chunk(ctx, tramp);
+		}
+	} else {
+		/* process as much 64-block as possible */
+		for (; len >= 64; len -= 64, data += 64)
+			md5_do_chunk(ctx, (uint32_t *) data);
+	}
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_md5_finalize(struct md5_ctx *ctx, uint8_t *out)
+{
+	static uint8_t padding[64] = { 0x80, };
+	uint64_t bits;
+	uint32_t index, padlen;
+
+	/* add padding and update data with it */
+	bits = cpu_to_le64(ctx->sz << 3);
+
+	/* pad out to 56 */
+	index = (uint32_t) (ctx->sz & 0x3f);
+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
+	crypton_md5_update(ctx, padding, padlen);
+
+	/* append length */
+	crypton_md5_update(ctx, (uint8_t *) &bits, sizeof(bits));
+
+	/* output hash */
+	store_le32(out   , ctx->h[0]);
+	store_le32(out+ 4, ctx->h[1]);
+	store_le32(out+ 8, ctx->h[2]);
+	store_le32(out+12, ctx->h[3]);
+}
+
+#define HASHED(m) MD5_##m
+#define HASHED_LOWER(m) md5_##m
+#define CRYPTON_HASHED(m) crypton_md5_##m
+#define MD5_BLOCK_SIZE 64
+#define MD5_BITS_ELEMS 1
+
+static inline uint32_t crypton_md5_get_index(const struct md5_ctx *ctx)
+{
+	return (uint32_t) (ctx->sz & 0x3f);
+}
+
+static inline void crypton_md5_incr_sz(struct md5_ctx *ctx, uint64_t *bits, uint32_t n)
+{
+	ctx->sz += n;
+	*bits = cpu_to_le64(ctx->sz << 3);
+}
+
+static inline void crypton_md5_select_digest(const struct md5_ctx *ctx, uint8_t *out, uint32_t out_mask)
+{
+	xor_le32(out   , ctx->h[0] & out_mask);
+	xor_le32(out+ 4, ctx->h[1] & out_mask);
+	xor_le32(out+ 8, ctx->h[2] & out_mask);
+	xor_le32(out+12, ctx->h[3] & out_mask);
+}
+
+#include <crypton_hash_prefix.c>
diff --git a/cbits/crypton_md5.h b/cbits/crypton_md5.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_md5.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_MD5_H
+#define CRYPTOHASH_MD5_H
+
+#include <stdint.h>
+
+struct md5_ctx
+{
+	uint64_t sz;
+	uint8_t  buf[64];
+	uint32_t h[4];
+};
+
+#define MD5_DIGEST_SIZE		16
+#define MD5_CTX_SIZE		sizeof(struct md5_ctx)
+
+void crypton_md5_init(struct md5_ctx *ctx);
+void crypton_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_md5_finalize(struct md5_ctx *ctx, uint8_t *out);
+void crypton_md5_finalize_prefix(struct md5_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_pbkdf2.c b/cbits/crypton_pbkdf2.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_pbkdf2.c
@@ -0,0 +1,390 @@
+/*
+ * fast-pbkdf2 - Optimal PBKDF2-HMAC calculation
+ * Written in 2015 by Joseph Birr-Pixton <jpixton@gmail.com>
+ * Ported to crypton in 2017 by Nicolas Di Prima <nicolas@primetype.co.uk>
+ *
+ * To the extent possible under law, the author(s) have dedicated all
+ * copyright and related and neighboring rights to this software to the
+ * public domain worldwide. This software is distributed without any
+ * warranty.
+ *
+ * You should have received a copy of the CC0 Public Domain Dedication
+ * along with this software. If not, see
+ * <http://creativecommons.org/publicdomain/zero/1.0/>.
+ */
+
+#include <assert.h>
+#include <string.h>
+
+#include "crypton_pbkdf2.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include "crypton_sha1.h"
+#include "crypton_sha256.h"
+#include "crypton_sha512.h"
+
+/* --- MSVC doesn't support C99 --- */
+#ifdef _MSC_VER
+#define restrict
+#define _Pragma __pragma
+#endif
+
+/* --- Common useful things --- */
+#define MIN(a, b) ((a) > (b)) ? (b) : (a)
+
+/* Prepare block (of blocksz bytes) to contain md padding denoting a msg-size
+ * message (in bytes).  block has a prefix of used bytes.
+ *
+ * Message length is expressed in 32 bits (so suitable for sha1, sha256, sha512). */
+static inline void md_pad(uint8_t *block, size_t blocksz, size_t used, size_t msg)
+{
+  memset(block + used, 0, blocksz - used - 4);
+  block[used] = 0x80;
+  block += blocksz - 4;
+  store_be32(block, (uint32_t) (msg * 8));
+}
+
+/* Internal function/type names for hash-specific things. */
+#define HMAC_CTX(_name) HMAC_ ## _name ## _ctx
+#define HMAC_INIT(_name) HMAC_ ## _name ## _init
+#define HMAC_UPDATE(_name) HMAC_ ## _name ## _update
+#define HMAC_FINAL(_name) HMAC_ ## _name ## _final
+
+#define PBKDF2_F(_name) pbkdf2_f_ ## _name
+#define PBKDF2(_name) pbkdf2_ ## _name
+
+/* This macro expands to decls for the whole implementation for a given
+ * hash function.  Arguments are:
+ *
+ * _name like 'sha1', added to symbol names
+ * _blocksz block size, in bytes
+ * _hashsz digest output, in bytes
+ * _ctx hash context type
+ * _init hash context initialisation function
+ *    args: (_ctx *c)
+ * _update hash context update function
+ *    args: (_ctx *c, const void *data, size_t ndata)
+ * _final hash context finish function
+ *    args: (void *out, _ctx *c)
+ * _xform hash context raw block update function
+ *    args: (_ctx *c, const void *data)
+ * _xcpy hash context raw copy function (only need copy hash state)
+ *    args: (_ctx * restrict out, const _ctx *restrict in)
+ * _xtract hash context state extraction
+ *    args: args (_ctx *restrict c, uint8_t *restrict out)
+ * _xxor hash context xor function (only need xor hash state)
+ *    args: (_ctx *restrict out, const _ctx *restrict in)
+ *
+ * The resulting function is named PBKDF2(_name).
+ */
+#define DECL_PBKDF2(_name, _blocksz, _hashsz, _ctx,                           \
+                    _init, _update, _xform, _final, _xcpy, _xtract, _xxor)    \
+  typedef struct {                                                            \
+    _ctx inner;                                                               \
+    _ctx outer;                                                               \
+  } HMAC_CTX(_name);                                                          \
+                                                                              \
+  static inline void HMAC_INIT(_name)(HMAC_CTX(_name) *ctx,                   \
+                                      const uint8_t *key, size_t nkey)        \
+  {                                                                           \
+    /* Prepare key: */                                                        \
+    uint8_t k[_blocksz];                                                      \
+                                                                              \
+    /* Shorten long keys. */                                                  \
+    if (nkey > _blocksz)                                                      \
+    {                                                                         \
+      _init(&ctx->inner);                                                     \
+      _update(&ctx->inner, key, nkey);                                        \
+      _final(&ctx->inner, k);                                                 \
+                                                                              \
+      key = k;                                                                \
+      nkey = _hashsz;                                                         \
+    }                                                                         \
+                                                                              \
+    /* Standard doesn't cover case where blocksz < hashsz. */                 \
+    assert(nkey <= _blocksz);                                                 \
+                                                                              \
+    /* Right zero-pad short keys. */                                          \
+    if (k != key)                                                             \
+      memcpy(k, key, nkey);                                                   \
+    if (_blocksz > nkey)                                                      \
+      memset(k + nkey, 0, _blocksz - nkey);                                   \
+                                                                              \
+    /* Start inner hash computation */                                        \
+    uint8_t blk_inner[_blocksz];                                              \
+    uint8_t blk_outer[_blocksz];                                              \
+                                                                              \
+    for (size_t i = 0; i < _blocksz; i++)                                     \
+    {                                                                         \
+      blk_inner[i] = 0x36 ^ k[i];                                             \
+      blk_outer[i] = 0x5c ^ k[i];                                             \
+    }                                                                         \
+                                                                              \
+    _init(&ctx->inner);                                                       \
+    _update(&ctx->inner, blk_inner, sizeof blk_inner);                        \
+                                                                              \
+    /* And outer. */                                                          \
+    _init(&ctx->outer);                                                       \
+    _update(&ctx->outer, blk_outer, sizeof blk_outer);                        \
+  }                                                                           \
+                                                                              \
+  static inline void HMAC_UPDATE(_name)(HMAC_CTX(_name) *ctx,                 \
+                                        const void *data, size_t ndata)       \
+  {                                                                           \
+    _update(&ctx->inner, data, ndata);                                        \
+  }                                                                           \
+                                                                              \
+  static inline void HMAC_FINAL(_name)(HMAC_CTX(_name) *ctx,                  \
+                                       uint8_t out[_hashsz])                  \
+  {                                                                           \
+    _final(&ctx->inner, out);                                                 \
+    _update(&ctx->outer, out, _hashsz);                                       \
+    _final(&ctx->outer, out);                                                 \
+  }                                                                           \
+                                                                              \
+                                                                              \
+  /* --- PBKDF2 --- */                                                        \
+  static inline void PBKDF2_F(_name)(const HMAC_CTX(_name) *startctx,         \
+                                     uint32_t counter,                        \
+                                     const uint8_t *salt, size_t nsalt,       \
+                                     uint32_t iterations,                     \
+                                     uint8_t *out)                            \
+  {                                                                           \
+    uint8_t countbuf[4];                                                      \
+    store_be32(countbuf, counter);                                            \
+                                                                              \
+    /* Prepare loop-invariant padding block. */                               \
+    uint8_t Ublock[_blocksz];                                                 \
+    md_pad(Ublock, _blocksz, _hashsz, _blocksz + _hashsz);                    \
+                                                                              \
+    /* First iteration:                                                       \
+     *   U_1 = PRF(P, S || INT_32_BE(i))                                      \
+     */                                                                       \
+    HMAC_CTX(_name) ctx = *startctx;                                          \
+    HMAC_UPDATE(_name)(&ctx, salt, nsalt);                                    \
+    HMAC_UPDATE(_name)(&ctx, countbuf, sizeof countbuf);                      \
+    HMAC_FINAL(_name)(&ctx, Ublock);                                          \
+    _ctx result = ctx.outer;                                                  \
+                                                                              \
+    /* Subsequent iterations:                                                 \
+     *   U_c = PRF(P, U_{c-1})                                                \
+     */                                                                       \
+    for (uint32_t i = 1; i < iterations; i++)                                 \
+    {                                                                         \
+      /* Complete inner hash with previous U */                               \
+      _xcpy(&ctx.inner, &startctx->inner);                                    \
+      _xform(&ctx.inner, Ublock);                                             \
+      _xtract(&ctx.inner, Ublock);                                            \
+      /* Complete outer hash with inner output */                             \
+      _xcpy(&ctx.outer, &startctx->outer);                                    \
+      _xform(&ctx.outer, Ublock);                                             \
+      _xtract(&ctx.outer, Ublock);                                            \
+      _xxor(&result, &ctx.outer);                                             \
+    }                                                                         \
+                                                                              \
+    /* Reform result into output buffer. */                                   \
+    _xtract(&result, out);                                                    \
+  }                                                                           \
+                                                                              \
+  static inline void PBKDF2(_name)(const uint8_t *pw, size_t npw,             \
+                     const uint8_t *salt, size_t nsalt,                       \
+                     uint32_t iterations,                                     \
+                     uint8_t *out, size_t nout)                               \
+  {                                                                           \
+    assert(iterations);                                                       \
+    assert(out && nout);                                                      \
+                                                                              \
+    /* Starting point for inner loop. */                                      \
+    HMAC_CTX(_name) ctx;                                                      \
+    HMAC_INIT(_name)(&ctx, pw, npw);                                          \
+                                                                              \
+    /* How many blocks do we need? */                                         \
+    uint32_t blocks_needed = (uint32_t)(nout + _hashsz - 1) / _hashsz;        \
+                                                                              \
+    for (uint32_t counter = 1; counter <= blocks_needed; counter++)           \
+    {                                                                         \
+      uint8_t block[_hashsz];                                                 \
+      PBKDF2_F(_name)(&ctx, counter, salt, nsalt, iterations, block);         \
+                                                                              \
+      size_t offset = (counter - 1) * _hashsz;                                \
+      size_t taken = MIN(nout - offset, _hashsz);                             \
+      memcpy(out + offset, block, taken);                                     \
+    }                                                                         \
+  }
+
+static inline void sha1_extract(struct sha1_ctx *restrict ctx, uint8_t *restrict out)
+{
+	store_be32(out   , ctx->h[0]);
+	store_be32(out+4 , ctx->h[1]);
+	store_be32(out+8 , ctx->h[2]);
+	store_be32(out+12, ctx->h[3]);
+	store_be32(out+16, ctx->h[4]);
+}
+
+static inline void sha1_cpy(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)
+{
+  out->h[0] = in->h[0];
+  out->h[1] = in->h[1];
+  out->h[2] = in->h[2];
+  out->h[3] = in->h[3];
+  out->h[4] = in->h[4];
+}
+
+static inline void sha1_xor(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)
+{
+  out->h[0] ^= in->h[0];
+  out->h[1] ^= in->h[1];
+  out->h[2] ^= in->h[2];
+  out->h[3] ^= in->h[3];
+  out->h[4] ^= in->h[4];
+}
+
+void crypton_sha1_transform(struct sha1_ctx* ctx, uint8_t block[SHA1_BLOCK_SIZE])
+{
+  crypton_sha1_update(ctx, block, SHA1_BLOCK_SIZE);
+}
+
+DECL_PBKDF2(sha1,
+            SHA1_BLOCK_SIZE,
+            SHA1_DIGEST_SIZE,
+            struct sha1_ctx,
+            crypton_sha1_init,
+            crypton_sha1_update,
+            crypton_sha1_transform,
+            crypton_sha1_finalize,
+            sha1_cpy,
+            sha1_extract,
+            sha1_xor);
+
+static inline void sha256_extract(struct sha256_ctx *restrict ctx, uint8_t *restrict out)
+{
+	store_be32(out   , ctx->h[0]);
+	store_be32(out+4 , ctx->h[1]);
+	store_be32(out+8 , ctx->h[2]);
+	store_be32(out+12, ctx->h[3]);
+	store_be32(out+16, ctx->h[4]);
+	store_be32(out+20, ctx->h[5]);
+	store_be32(out+24, ctx->h[6]);
+	store_be32(out+28, ctx->h[7]);
+}
+
+static inline void sha256_cpy(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)
+{
+	out->h[0] = in->h[0];
+	out->h[1] = in->h[1];
+	out->h[2] = in->h[2];
+	out->h[3] = in->h[3];
+	out->h[4] = in->h[4];
+	out->h[5] = in->h[5];
+	out->h[6] = in->h[6];
+	out->h[7] = in->h[7];
+}
+
+static inline void sha256_xor(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)
+{
+	out->h[0] ^= in->h[0];
+	out->h[1] ^= in->h[1];
+	out->h[2] ^= in->h[2];
+	out->h[3] ^= in->h[3];
+	out->h[4] ^= in->h[4];
+	out->h[5] ^= in->h[5];
+	out->h[6] ^= in->h[6];
+	out->h[7] ^= in->h[7];
+}
+
+void crypton_sha256_transform(struct sha256_ctx* ctx, uint8_t block[SHA256_BLOCK_SIZE])
+{
+  crypton_sha256_update(ctx, block, SHA256_BLOCK_SIZE);
+}
+
+DECL_PBKDF2(sha256,
+            SHA256_BLOCK_SIZE,
+            SHA256_DIGEST_SIZE,
+            struct sha256_ctx,
+            crypton_sha256_init,
+            crypton_sha256_update,
+            crypton_sha256_transform,
+            crypton_sha256_finalize,
+            sha256_cpy,
+            sha256_extract,
+            sha256_xor);
+
+static inline void sha512_extract(struct sha512_ctx *restrict ctx, uint8_t *restrict out)
+{
+	store_be64(out   , ctx->h[0]);
+	store_be64(out+8 , ctx->h[1]);
+	store_be64(out+16, ctx->h[2]);
+	store_be64(out+24, ctx->h[3]);
+	store_be64(out+32, ctx->h[4]);
+	store_be64(out+40, ctx->h[5]);
+	store_be64(out+48, ctx->h[6]);
+	store_be64(out+56, ctx->h[7]);
+}
+
+static inline void sha512_cpy(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)
+{
+	out->h[0] = in->h[0];
+	out->h[1] = in->h[1];
+	out->h[2] = in->h[2];
+	out->h[3] = in->h[3];
+	out->h[4] = in->h[4];
+	out->h[5] = in->h[5];
+	out->h[6] = in->h[6];
+	out->h[7] = in->h[7];
+}
+
+static inline void sha512_xor(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)
+{
+	out->h[0] ^= in->h[0];
+	out->h[1] ^= in->h[1];
+	out->h[2] ^= in->h[2];
+	out->h[3] ^= in->h[3];
+	out->h[4] ^= in->h[4];
+	out->h[5] ^= in->h[5];
+	out->h[6] ^= in->h[6];
+	out->h[7] ^= in->h[7];
+}
+
+void crypton_sha512_transform(struct sha512_ctx* ctx, uint8_t block[SHA512_BLOCK_SIZE])
+{
+	crypton_sha512_update(ctx, block, SHA512_BLOCK_SIZE);
+}
+
+DECL_PBKDF2(sha512,
+            SHA512_BLOCK_SIZE,
+            SHA512_DIGEST_SIZE,
+            struct sha512_ctx,
+            crypton_sha512_init,
+            crypton_sha512_update,
+            crypton_sha512_transform,
+            crypton_sha512_finalize,
+            sha512_cpy,
+            sha512_extract,
+            sha512_xor);
+
+void crypton_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw
+                                    , const uint8_t *salt, size_t nsalt
+                                    , uint32_t iterations
+                                    , uint8_t *out, size_t nout
+                                    )
+{
+  PBKDF2(sha1)(pw, npw, salt, nsalt, iterations, out, nout);
+}
+
+void crypton_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw
+                                      , const uint8_t *salt, size_t nsalt
+                                      , uint32_t iterations
+                                      , uint8_t *out, size_t nout
+                                      )
+{
+  PBKDF2(sha256)(pw, npw, salt, nsalt, iterations, out, nout);
+}
+
+void crypton_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw
+                                      , const uint8_t *salt, size_t nsalt
+                                      , uint32_t iterations
+                                      , uint8_t *out, size_t nout
+                                      )
+{
+  PBKDF2(sha512)(pw, npw, salt, nsalt, iterations, out, nout);
+}
diff --git a/cbits/crypton_pbkdf2.h b/cbits/crypton_pbkdf2.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_pbkdf2.h
@@ -0,0 +1,31 @@
+#ifndef CRYPTON_PBKDF2_H_
+#define CRYPTON_PBKDF2_H_
+
+#include <stdlib.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+void crypton_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw
+                                    , const uint8_t *salt, size_t nsalt
+                                    , uint32_t iterations
+                                    , uint8_t *out, size_t nout
+                                    );
+void crypton_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw
+                                      , const uint8_t *salt, size_t nsalt
+                                      , uint32_t iterations
+                                      , uint8_t *out, size_t nout
+                                      );
+void crypton_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw
+                                      , const uint8_t *salt, size_t nsalt
+                                      , uint32_t iterations
+                                      , uint8_t *out, size_t nout
+                                      );
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/cbits/crypton_poly1305.c b/cbits/crypton_poly1305.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_poly1305.c
@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The following code contains some code copied from and inspired by poly1305-donna
+ * in poly1305_do_chunk and poly1305_finalize which is licensed under MIT or PUBLIC DOMAIN.
+ * see [poly1305-donna](https://github.com/floodyberry/poly1305-donna)
+ *
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "crypton_poly1305.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+
+static void poly1305_do_chunk(poly1305_ctx *ctx, uint8_t *data, int blocks, int final)
+{
+	/* following is a cleanup copy of code available poly1305-donna */
+	const uint32_t hibit = (final) ? 0 : (1 << 24); /* 1 << 128 */
+	uint32_t r0,r1,r2,r3,r4;
+	uint32_t s1,s2,s3,s4;
+	uint32_t h0,h1,h2,h3,h4;
+	uint64_t d0,d1,d2,d3,d4;
+	uint32_t c;
+
+	/* load r[i], h[i] */
+	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];
+	r0 = ctx->r[0]; r1 = ctx->r[1]; r2 = ctx->r[2]; r3 = ctx->r[3]; r4 = ctx->r[4];
+
+	/* s[i] = r[i] * 5 */
+	s1 = r1 * 5; s2 = r2 * 5; s3 = r3 * 5; s4 = r4 * 5;
+
+	while (blocks--) {
+		h0 += (load_le32(data+ 0)     ) & 0x3ffffff;
+		h1 += (load_le32(data+ 3) >> 2) & 0x3ffffff;
+		h2 += (load_le32(data+ 6) >> 4) & 0x3ffffff;
+		h3 += (load_le32(data+ 9) >> 6) & 0x3ffffff;
+		h4 += (load_le32(data+12) >> 8) | hibit;
+
+		d0 = ((uint64_t)h0 * r0) + ((uint64_t)h1 * s4) + ((uint64_t)h2 * s3) + ((uint64_t)h3 * s2) + ((uint64_t)h4 * s1);
+		d1 = ((uint64_t)h0 * r1) + ((uint64_t)h1 * r0) + ((uint64_t)h2 * s4) + ((uint64_t)h3 * s3) + ((uint64_t)h4 * s2);
+		d2 = ((uint64_t)h0 * r2) + ((uint64_t)h1 * r1) + ((uint64_t)h2 * r0) + ((uint64_t)h3 * s4) + ((uint64_t)h4 * s3);
+		d3 = ((uint64_t)h0 * r3) + ((uint64_t)h1 * r2) + ((uint64_t)h2 * r1) + ((uint64_t)h3 * r0) + ((uint64_t)h4 * s4);
+		d4 = ((uint64_t)h0 * r4) + ((uint64_t)h1 * r3) + ((uint64_t)h2 * r2) + ((uint64_t)h3 * r1) + ((uint64_t)h4 * r0);
+
+		c = (uint32_t)(d0 >> 26); h0 = (uint32_t)d0 & 0x3ffffff;
+		d1 += c;      c = (uint32_t)(d1 >> 26); h1 = (uint32_t)d1 & 0x3ffffff;
+		d2 += c;      c = (uint32_t)(d2 >> 26); h2 = (uint32_t)d2 & 0x3ffffff;
+		d3 += c;      c = (uint32_t)(d3 >> 26); h3 = (uint32_t)d3 & 0x3ffffff;
+		d4 += c;      c = (uint32_t)(d4 >> 26); h4 = (uint32_t)d4 & 0x3ffffff;
+		h0 += c * 5;  c =           (h0 >> 26); h0 = h0 & 0x3ffffff;
+		h1 += c;
+
+		data += 16;
+	}
+
+	/* store h[i] */
+	ctx->h[0] = h0; ctx->h[1] = h1; ctx->h[2] = h2; ctx->h[3] = h3; ctx->h[4] = h4;
+}
+
+void crypton_poly1305_init(poly1305_ctx *ctx, poly1305_key *key)
+{
+	uint8_t *k = (uint8_t *) key;
+
+	memset(ctx, 0, sizeof(poly1305_ctx));
+
+	ctx->r[0] = (load_le32(&k[ 0])     ) & 0x3ffffff;
+	ctx->r[1] = (load_le32(&k[ 3]) >> 2) & 0x3ffff03;
+	ctx->r[2] = (load_le32(&k[ 6]) >> 4) & 0x3ffc0ff;
+	ctx->r[3] = (load_le32(&k[ 9]) >> 6) & 0x3f03fff;
+	ctx->r[4] = (load_le32(&k[12]) >> 8) & 0x00fffff;
+
+	ctx->pad[0] = load_le32(&k[16]);
+	ctx->pad[1] = load_le32(&k[20]);
+	ctx->pad[2] = load_le32(&k[24]);
+	ctx->pad[3] = load_le32(&k[28]);
+
+	ctx->index = 0;
+}
+
+void crypton_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length)
+{
+	uint32_t to_fill, nb_blocks_bytes;
+
+	to_fill = 16 - ctx->index;
+
+	/* process partial buffer if there's enough data to make a block */
+	if (ctx->index && length >= to_fill) {
+		memcpy(ctx->buf + ctx->index, data, to_fill);
+		poly1305_do_chunk(ctx, ctx->buf, 1, 0);
+		ctx->index = 0;
+		length -= to_fill;
+		data += to_fill;
+	}
+
+	/* process as much 16-block as possible */
+	nb_blocks_bytes = length & ~(16 - 1);
+	poly1305_do_chunk(ctx, data, nb_blocks_bytes >> 4, 0);
+	data += nb_blocks_bytes;
+	length &= 0xf;
+
+	/* fill the remaining bytes in the partial buffer */
+	if (length) {
+		memcpy(ctx->buf + ctx->index, data, length);
+		ctx->index += length;
+	}
+}
+
+void crypton_poly1305_finalize(poly1305_mac mac8, poly1305_ctx *ctx)
+{
+	uint32_t h0,h1,h2,h3,h4,c;
+	uint32_t g0,g1,g2,g3,g4;
+	uint64_t f;
+	uint32_t mask;
+	uint32_t *mac = (uint32_t *) mac8;
+	int i;
+
+	if (ctx->index) {
+		/* append partial final buffer with 10* then process */
+		ctx->buf[ctx->index] = 0x1;
+		for (i = ctx->index + 1; i < 16; i++)
+			ctx->buf[i] = 0x0;
+		poly1305_do_chunk(ctx, ctx->buf, 1, 1);
+	}
+
+	/* following is a cleanup copy of code available poly1305-donna */
+
+	/* fully carry h */
+	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];
+
+	             c = h1 >> 26; h1 = h1 & 0x3ffffff;
+	h2 +=     c; c = h2 >> 26; h2 = h2 & 0x3ffffff;
+	h3 +=     c; c = h3 >> 26; h3 = h3 & 0x3ffffff;
+	h4 +=     c; c = h4 >> 26; h4 = h4 & 0x3ffffff;
+	h0 += c * 5; c = h0 >> 26; h0 = h0 & 0x3ffffff;
+	h1 +=     c;
+
+	/* compute h + -p */
+	g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;
+	g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;
+	g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;
+	g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;
+	g4 = h4 + c - (1 << 26);
+
+	/* select h if h < p, or h + -p if h >= p */
+	mask = (g4 >> ((sizeof(uint32_t) * 8) - 1)) - 1;
+	g0 &= mask;
+	g1 &= mask;
+	g2 &= mask;
+	g3 &= mask;
+	g4 &= mask;
+	mask = ~mask;
+	h0 = (h0 & mask) | g0;
+	h1 = (h1 & mask) | g1;
+	h2 = (h2 & mask) | g2;
+	h3 = (h3 & mask) | g3;
+	h4 = (h4 & mask) | g4;
+
+	/* h = h % (2^128) */
+	h0 = ((h0      ) | (h1 << 26)) & 0xffffffff;
+	h1 = ((h1 >>  6) | (h2 << 20)) & 0xffffffff;
+	h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;
+	h3 = ((h3 >> 18) | (h4 <<  8)) & 0xffffffff;
+
+	/* mac = (h + pad) % (2^128) */
+	f = (uint64_t)h0 + ctx->pad[0];
+	mac[0] = cpu_to_le32((uint32_t) f);
+
+	f = (uint64_t)h1 + ctx->pad[1] + (f >> 32);
+	mac[1] = cpu_to_le32((uint32_t) f);
+
+	f = (uint64_t)h2 + ctx->pad[2] + (f >> 32);
+	mac[2] = cpu_to_le32((uint32_t) f);
+
+	f = (uint64_t)h3 + ctx->pad[3] + (f >> 32);
+	mac[3] = cpu_to_le32((uint32_t) f);
+}
diff --git a/cbits/crypton_poly1305.h b/cbits/crypton_poly1305.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_poly1305.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#ifndef CRYPTON_POLY1305_H
+# define CRYPTON_POLY1305_H
+
+/* 8*8+1*16+1*4 = 84 */
+typedef struct
+{
+	uint32_t r[5];
+	uint32_t h[5];
+	uint32_t pad[4];
+	uint32_t index;
+	uint8_t buf[16]; /* previous partial block */
+} poly1305_ctx;
+
+typedef uint8_t poly1305_mac[16];
+typedef uint8_t poly1305_key[32];
+
+void crypton_poly1305_init(poly1305_ctx *ctx, poly1305_key *key);
+void crypton_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length);
+void crypton_poly1305_finalize(poly1305_mac mac, poly1305_ctx *ctx);
+
+#endif
diff --git a/cbits/crypton_rc4.c b/cbits/crypton_rc4.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_rc4.c
@@ -0,0 +1,63 @@
+/* initial implementation by
+ *   Peter White <peter@janrain.com>
+ */
+
+/* C Standard includes */
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+
+/* Local include */
+#include "crypton_rc4.h"
+
+/* Swap array elements i=State[i] and b=State[j]. */
+static void swap(uint8_t *i, uint8_t *j)
+{
+	uint8_t temp;
+
+	temp = *i;
+	*i = *j;
+	*j = temp;
+}
+
+/* Key scheduling algorithm. Swap array elements based on the key. */
+void crypton_rc4_init(uint8_t *key, uint32_t keylen, struct rc4_ctx *ctx)
+{
+	uint32_t i, j;
+	memset(ctx, 0, sizeof(struct rc4_ctx));
+
+	/* initialize context */
+	for (i = 0; i < 256; i++)
+		ctx->state[i] = i;
+	for (i = j = 0; i < 256; i++) {
+		j = (j + ctx->state[i] + key[i % keylen]) % 256;
+		swap(&ctx->state[i], &ctx->state[j]);
+	}
+}
+
+/* Combine the stream generated by the rc4 with some input */
+void crypton_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output)
+{
+	uint32_t i = ctx->i;
+	uint32_t j = ctx->j;
+	uint32_t m;
+	uint8_t si, sj;
+
+	/* The RC4 algorithm */
+	for (m = 0; m < len; m++) {
+		i = (i + 1) & 0xff;
+		si = ctx->state[i];
+		j = (j + si) & 0xff;
+		sj = ctx->state[j];
+		/* swap(&state[i], &state[j]); */
+		ctx->state[i] = sj;
+		ctx->state[j] = si;
+		/* Xor the key stream value into the input */
+		*output++ = *input++ ^ (ctx->state[(si + sj) & 0xff]);
+	}
+
+	/* Output new S-box indices */
+	ctx->i = i;
+	ctx->j = j;
+}
diff --git a/cbits/crypton_rc4.h b/cbits/crypton_rc4.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_rc4.h
@@ -0,0 +1,14 @@
+#ifndef CRYPTON_RC4_H
+# define CRYPTON_RC4_H
+
+struct rc4_ctx
+{
+	uint8_t state[256];
+	uint32_t i;
+	uint32_t j;
+};
+
+void crypton_rc4_init(uint8_t * key, uint32_t keylen, struct rc4_ctx *ctx);
+void crypton_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output);
+
+#endif
diff --git a/cbits/crypton_rdrand.c b/cbits/crypton_rdrand.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_rdrand.c
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) Thomas DuBuisson
+ * Copyright (C) 2013 Vincent Hanquez <tab@snarc.org>
+ *
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+int crypton_cpu_has_rdrand()
+{
+	uint32_t ax,bx,cx,dx,func=1;
+#if defined(__PIC__) && defined(__i386__)
+	__asm__ volatile ("mov %%ebx, %%edi;" "cpuid;" "xchgl %%ebx, %%edi;"
+		: "=a" (ax), "=D" (bx), "=c" (cx), "=d" (dx) : "a" (func));
+#else
+	__asm__ volatile ("cpuid": "=a" (ax), "=b" (bx), "=c" (cx), "=d" (dx) : "a" (func));
+#endif
+	return (cx & 0x40000000);
+}
+
+/* inline encoding of 'rdrand %rax' to cover old binutils
+ * - no inputs
+ * - 'cc' to the clobber list as we modify condition code.
+ * - output of rdrand in rax and have a 8 bit error condition
+ */
+#define inline_rdrand_rax(val, err) \
+	asm(".byte 0x48,0x0f,0xc7,0xf0; setc %1" \
+	   : "=a" (val), "=q" (err) \
+	   : \
+	   : "cc")
+
+/* inline encoding of 'rdrand %eax' to cover old binutils
+ * - no inputs
+ * - 'cc' to the clobber list as we modify condition code.
+ * - output of rdrand in eax and have a 8 bit error condition
+ */
+#define inline_rdrand_eax(val, err) \
+	asm(".byte 0x0f,0xc7,0xf0; setc %1" \
+	   : "=a" (val), "=q" (err) \
+	   : \
+	   : "cc")
+
+#ifdef __x86_64__
+# define RDRAND_SZ 8
+# define RDRAND_T  uint64_t
+#define inline_rdrand(val, err) err = crypton_rdrand_step(&val)
+#else
+# define RDRAND_SZ 4
+# define RDRAND_T  uint32_t
+#define inline_rdrand(val, err) err = crypton_rdrand_step(&val)
+#endif
+
+/* sadly many people are still using an old binutils,
+ * leading to report that instruction is not recognized.
+ */
+#if 1
+/* Returns 1 on success */
+static inline int crypton_rdrand_step(RDRAND_T *buffer)
+{
+	unsigned char err;
+	asm volatile ("rdrand %0; setc %1" : "=r" (*buffer), "=qm" (err));
+	return (int) err;
+}
+#endif
+
+/* Returns the number of bytes successfully generated */
+int crypton_get_rand_bytes(uint8_t *buffer, size_t len)
+{
+	RDRAND_T tmp;
+	int aligned = (intptr_t) buffer % RDRAND_SZ;
+	int orig_len = len;
+	int to_alignment = RDRAND_SZ - aligned;
+	uint8_t ok;
+
+	if (aligned != 0) {
+		inline_rdrand(tmp, ok);
+		if (!ok)
+			return 0;
+		memcpy(buffer, (uint8_t *) &tmp, to_alignment);
+		buffer += to_alignment;
+		len -= to_alignment;
+	}
+
+	for (; len >= RDRAND_SZ; buffer += RDRAND_SZ, len -= RDRAND_SZ) {
+		inline_rdrand(tmp, ok);
+		if (!ok)
+			return (orig_len - len);
+		*((RDRAND_T *) buffer) = tmp;
+	}
+
+	if (len > 0) {
+		inline_rdrand(tmp, ok);
+		if (!ok)
+			return (orig_len - len);
+		memcpy(buffer, (uint8_t *) &tmp, len);
+	}
+	return orig_len;
+}
diff --git a/cbits/crypton_ripemd.c b/cbits/crypton_ripemd.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_ripemd.c
@@ -0,0 +1,310 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "crypton_ripemd.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include <string.h>
+
+void crypton_ripemd160_init(struct ripemd160_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->h[0] = 0x67452301;
+	ctx->h[1] = 0xefcdab89;
+	ctx->h[2] = 0x98badcfe;
+	ctx->h[3] = 0x10325476;
+	ctx->h[4] = 0xc3d2e1f0;
+}
+
+#define K1  0x00000000
+#define K2  0x5a827999
+#define K3  0x6ed9eba1
+#define K4  0x8f1bbcdc
+#define K5  0xa953fd4e
+#define K6  0x50a28be6
+#define K7  0x5c4dd124
+#define K8  0x6d703ef3
+#define K9  0x7a6d76e9
+
+#define f1(x, y, z) (x ^ y ^ z)
+#define f2(x, y, z) (z ^ (x & (y ^ z)))
+#define f3(x, y, z) ((x | ~y) ^ z)
+#define f4(x, y, z) (y ^ (z & (x ^ y)))
+#define f5(x, y, z) (x ^ (y | ~z))
+
+#define R(a, b, c, d, e, f, k, i, s)	\
+	a += f(b, c, d) + w[i] + k; a = rol32(a, s) + e; c = rol32(c, 10)
+
+static void ripemd160_do_chunk(struct ripemd160_ctx *ctx, uint32_t *buf)
+{
+	uint32_t a1, b1, c1, d1, e1, a2, b2, c2, d2, e2;
+#ifdef ARCH_IS_BIG_ENDIAN
+	uint32_t w[16];
+	cpu_to_le32_array(w, buf, 16);
+#else
+	uint32_t *w = buf;
+#endif
+
+	a1 = ctx->h[0]; b1 = ctx->h[1]; c1 = ctx->h[2]; d1 = ctx->h[3]; e1 = ctx->h[4];
+	a2 = ctx->h[0]; b2 = ctx->h[1]; c2 = ctx->h[2]; d2 = ctx->h[3]; e2 = ctx->h[4];
+
+	/* 5 passes on first state copy */
+	R(a1, b1, c1, d1, e1, f1, K1, 0, 11);
+	R(e1, a1, b1, c1, d1, f1, K1, 1, 14);
+	R(d1, e1, a1, b1, c1, f1, K1, 2, 15);
+	R(c1, d1, e1, a1, b1, f1, K1, 3, 12);
+	R(b1, c1, d1, e1, a1, f1, K1, 4, 5);
+	R(a1, b1, c1, d1, e1, f1, K1, 5, 8);
+	R(e1, a1, b1, c1, d1, f1, K1, 6, 7);
+	R(d1, e1, a1, b1, c1, f1, K1, 7, 9);
+	R(c1, d1, e1, a1, b1, f1, K1, 8, 11);
+	R(b1, c1, d1, e1, a1, f1, K1, 9, 13);
+	R(a1, b1, c1, d1, e1, f1, K1, 10, 14);
+	R(e1, a1, b1, c1, d1, f1, K1, 11, 15);
+	R(d1, e1, a1, b1, c1, f1, K1, 12, 6);
+	R(c1, d1, e1, a1, b1, f1, K1, 13, 7);
+	R(b1, c1, d1, e1, a1, f1, K1, 14, 9);
+	R(a1, b1, c1, d1, e1, f1, K1, 15, 8);
+	
+	R(e1, a1, b1, c1, d1, f2, K2, 7, 7);
+	R(d1, e1, a1, b1, c1, f2, K2, 4, 6);
+	R(c1, d1, e1, a1, b1, f2, K2, 13, 8);
+	R(b1, c1, d1, e1, a1, f2, K2, 1, 13);
+	R(a1, b1, c1, d1, e1, f2, K2, 10, 11);
+	R(e1, a1, b1, c1, d1, f2, K2, 6, 9);
+	R(d1, e1, a1, b1, c1, f2, K2, 15, 7);
+	R(c1, d1, e1, a1, b1, f2, K2, 3, 15);
+	R(b1, c1, d1, e1, a1, f2, K2, 12, 7);
+	R(a1, b1, c1, d1, e1, f2, K2, 0, 12);
+	R(e1, a1, b1, c1, d1, f2, K2, 9, 15);
+	R(d1, e1, a1, b1, c1, f2, K2, 5, 9);
+	R(c1, d1, e1, a1, b1, f2, K2, 2, 11);
+	R(b1, c1, d1, e1, a1, f2, K2, 14, 7);
+	R(a1, b1, c1, d1, e1, f2, K2, 11, 13);
+	R(e1, a1, b1, c1, d1, f2, K2, 8, 12);
+
+	R(d1, e1, a1, b1, c1, f3, K3, 3, 11);
+	R(c1, d1, e1, a1, b1, f3, K3, 10, 13);
+	R(b1, c1, d1, e1, a1, f3, K3, 14, 6);
+	R(a1, b1, c1, d1, e1, f3, K3, 4, 7);
+	R(e1, a1, b1, c1, d1, f3, K3, 9, 14);
+	R(d1, e1, a1, b1, c1, f3, K3, 15, 9);
+	R(c1, d1, e1, a1, b1, f3, K3, 8, 13);
+	R(b1, c1, d1, e1, a1, f3, K3, 1, 15);
+	R(a1, b1, c1, d1, e1, f3, K3, 2, 14);
+	R(e1, a1, b1, c1, d1, f3, K3, 7, 8);
+	R(d1, e1, a1, b1, c1, f3, K3, 0, 13);
+	R(c1, d1, e1, a1, b1, f3, K3, 6, 6);
+	R(b1, c1, d1, e1, a1, f3, K3, 13, 5);
+	R(a1, b1, c1, d1, e1, f3, K3, 11, 12);
+	R(e1, a1, b1, c1, d1, f3, K3, 5, 7);
+	R(d1, e1, a1, b1, c1, f3, K3, 12, 5);
+
+	R(c1, d1, e1, a1, b1, f4, K4, 1, 11);
+	R(b1, c1, d1, e1, a1, f4, K4, 9, 12);
+	R(a1, b1, c1, d1, e1, f4, K4, 11, 14);
+	R(e1, a1, b1, c1, d1, f4, K4, 10, 15);
+	R(d1, e1, a1, b1, c1, f4, K4, 0, 14);
+	R(c1, d1, e1, a1, b1, f4, K4, 8, 15);
+	R(b1, c1, d1, e1, a1, f4, K4, 12, 9);
+	R(a1, b1, c1, d1, e1, f4, K4, 4, 8);
+	R(e1, a1, b1, c1, d1, f4, K4, 13, 9);
+	R(d1, e1, a1, b1, c1, f4, K4, 3, 14);
+	R(c1, d1, e1, a1, b1, f4, K4, 7, 5);
+	R(b1, c1, d1, e1, a1, f4, K4, 15, 6);
+	R(a1, b1, c1, d1, e1, f4, K4, 14, 8);
+	R(e1, a1, b1, c1, d1, f4, K4, 5, 6);
+	R(d1, e1, a1, b1, c1, f4, K4, 6, 5);
+	R(c1, d1, e1, a1, b1, f4, K4, 2, 12);
+
+	R(b1, c1, d1, e1, a1, f5, K5, 4, 9);
+	R(a1, b1, c1, d1, e1, f5, K5, 0, 15);
+	R(e1, a1, b1, c1, d1, f5, K5, 5, 5);
+	R(d1, e1, a1, b1, c1, f5, K5, 9, 11);
+	R(c1, d1, e1, a1, b1, f5, K5, 7, 6);
+	R(b1, c1, d1, e1, a1, f5, K5, 12, 8);
+	R(a1, b1, c1, d1, e1, f5, K5, 2, 13);
+	R(e1, a1, b1, c1, d1, f5, K5, 10, 12);
+	R(d1, e1, a1, b1, c1, f5, K5, 14, 5);
+	R(c1, d1, e1, a1, b1, f5, K5, 1, 12);
+	R(b1, c1, d1, e1, a1, f5, K5, 3, 13);
+	R(a1, b1, c1, d1, e1, f5, K5, 8, 14);
+	R(e1, a1, b1, c1, d1, f5, K5, 11, 11);
+	R(d1, e1, a1, b1, c1, f5, K5, 6, 8);
+	R(c1, d1, e1, a1, b1, f5, K5, 15, 5);
+	R(b1, c1, d1, e1, a1, f5, K5, 13, 6);
+
+	/* 5 passes on second state copy */
+	R(a2, b2, c2, d2, e2, f5, K6, 5, 8);
+	R(e2, a2, b2, c2, d2, f5, K6, 14, 9);
+	R(d2, e2, a2, b2, c2, f5, K6, 7, 9);
+	R(c2, d2, e2, a2, b2, f5, K6, 0, 11);
+	R(b2, c2, d2, e2, a2, f5, K6, 9, 13);
+	R(a2, b2, c2, d2, e2, f5, K6, 2, 15);
+	R(e2, a2, b2, c2, d2, f5, K6, 11, 15);
+	R(d2, e2, a2, b2, c2, f5, K6, 4, 5);
+	R(c2, d2, e2, a2, b2, f5, K6, 13, 7);
+	R(b2, c2, d2, e2, a2, f5, K6, 6, 7);
+	R(a2, b2, c2, d2, e2, f5, K6, 15, 8);
+	R(e2, a2, b2, c2, d2, f5, K6, 8, 11);
+	R(d2, e2, a2, b2, c2, f5, K6, 1, 14);
+	R(c2, d2, e2, a2, b2, f5, K6, 10, 14);
+	R(b2, c2, d2, e2, a2, f5, K6, 3, 12);
+	R(a2, b2, c2, d2, e2, f5, K6, 12, 6);
+
+	R(e2, a2, b2, c2, d2, f4, K7, 6, 9);
+	R(d2, e2, a2, b2, c2, f4, K7, 11, 13);
+	R(c2, d2, e2, a2, b2, f4, K7, 3, 15);
+	R(b2, c2, d2, e2, a2, f4, K7, 7, 7);
+	R(a2, b2, c2, d2, e2, f4, K7, 0, 12);
+	R(e2, a2, b2, c2, d2, f4, K7, 13, 8);
+	R(d2, e2, a2, b2, c2, f4, K7, 5, 9);
+	R(c2, d2, e2, a2, b2, f4, K7, 10, 11);
+	R(b2, c2, d2, e2, a2, f4, K7, 14, 7);
+	R(a2, b2, c2, d2, e2, f4, K7, 15, 7);
+	R(e2, a2, b2, c2, d2, f4, K7, 8, 12);
+	R(d2, e2, a2, b2, c2, f4, K7, 12, 7);
+	R(c2, d2, e2, a2, b2, f4, K7, 4, 6);
+	R(b2, c2, d2, e2, a2, f4, K7, 9, 15);
+	R(a2, b2, c2, d2, e2, f4, K7, 1, 13);
+	R(e2, a2, b2, c2, d2, f4, K7, 2, 11);
+
+	R(d2, e2, a2, b2, c2, f3, K8, 15, 9);
+	R(c2, d2, e2, a2, b2, f3, K8, 5, 7);
+	R(b2, c2, d2, e2, a2, f3, K8, 1, 15);
+	R(a2, b2, c2, d2, e2, f3, K8, 3, 11);
+	R(e2, a2, b2, c2, d2, f3, K8, 7, 8);
+	R(d2, e2, a2, b2, c2, f3, K8, 14, 6);
+	R(c2, d2, e2, a2, b2, f3, K8, 6, 6);
+	R(b2, c2, d2, e2, a2, f3, K8, 9, 14);
+	R(a2, b2, c2, d2, e2, f3, K8, 11, 12);
+	R(e2, a2, b2, c2, d2, f3, K8, 8, 13);
+	R(d2, e2, a2, b2, c2, f3, K8, 12, 5);
+	R(c2, d2, e2, a2, b2, f3, K8, 2, 14);
+	R(b2, c2, d2, e2, a2, f3, K8, 10, 13);
+	R(a2, b2, c2, d2, e2, f3, K8, 0, 13);
+	R(e2, a2, b2, c2, d2, f3, K8, 4, 7);
+	R(d2, e2, a2, b2, c2, f3, K8, 13, 5);
+
+	R(c2, d2, e2, a2, b2, f2, K9, 8, 15);
+	R(b2, c2, d2, e2, a2, f2, K9, 6, 5);
+	R(a2, b2, c2, d2, e2, f2, K9, 4, 8);
+	R(e2, a2, b2, c2, d2, f2, K9, 1, 11);
+	R(d2, e2, a2, b2, c2, f2, K9, 3, 14);
+	R(c2, d2, e2, a2, b2, f2, K9, 11, 14);
+	R(b2, c2, d2, e2, a2, f2, K9, 15, 6);
+	R(a2, b2, c2, d2, e2, f2, K9, 0, 14);
+	R(e2, a2, b2, c2, d2, f2, K9, 5, 6);
+	R(d2, e2, a2, b2, c2, f2, K9, 12, 9);
+	R(c2, d2, e2, a2, b2, f2, K9, 2, 12);
+	R(b2, c2, d2, e2, a2, f2, K9, 13, 9);
+	R(a2, b2, c2, d2, e2, f2, K9, 9, 12);
+	R(e2, a2, b2, c2, d2, f2, K9, 7, 5);
+	R(d2, e2, a2, b2, c2, f2, K9, 10, 15);
+	R(c2, d2, e2, a2, b2, f2, K9, 14, 8);
+
+	R(b2, c2, d2, e2, a2, f1, K1, 12, 8);
+	R(a2, b2, c2, d2, e2, f1, K1, 15, 5);
+	R(e2, a2, b2, c2, d2, f1, K1, 10, 12);
+	R(d2, e2, a2, b2, c2, f1, K1, 4, 9);
+	R(c2, d2, e2, a2, b2, f1, K1, 1, 12);
+	R(b2, c2, d2, e2, a2, f1, K1, 5, 5);
+	R(a2, b2, c2, d2, e2, f1, K1, 8, 14);
+	R(e2, a2, b2, c2, d2, f1, K1, 7, 6);
+	R(d2, e2, a2, b2, c2, f1, K1, 6, 8);
+	R(c2, d2, e2, a2, b2, f1, K1, 2, 13);
+	R(b2, c2, d2, e2, a2, f1, K1, 13, 6);
+	R(a2, b2, c2, d2, e2, f1, K1, 14, 5);
+	R(e2, a2, b2, c2, d2, f1, K1, 0, 15);
+	R(d2, e2, a2, b2, c2, f1, K1, 3, 13);
+	R(c2, d2, e2, a2, b2, f1, K1, 9, 11);
+	R(b2, c2, d2, e2, a2, f1, K1, 11, 11);
+
+	d2 += c1 + ctx->h[1];
+	ctx->h[1] = ctx->h[2] + d1 + e2;
+	ctx->h[2] = ctx->h[3] + e1 + a2;
+	ctx->h[3] = ctx->h[4] + a1 + b2;
+	ctx->h[4] = ctx->h[0] + b1 + c2;
+	ctx->h[0] = d2;
+}
+
+void crypton_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t index, to_fill;
+
+	index = (uint32_t) (ctx->sz & 0x3f);
+	to_fill = 64 - index;
+
+	ctx->sz += len;
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		ripemd160_do_chunk(ctx, (uint32_t *) ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	if (need_alignment(data, 4)) {
+		uint32_t tramp[16];
+		ASSERT_ALIGNMENT(tramp, 4);
+		for (; len >= 64; len -= 64, data += 64) {
+			memcpy(tramp, data, 64);
+			ripemd160_do_chunk(ctx, tramp);
+		}
+	} else {
+		/* process as much 64-block as possible */
+		for (; len >= 64; len -= 64, data += 64)
+			ripemd160_do_chunk(ctx, (uint32_t *) data);
+	}
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out)
+{
+	static uint8_t padding[64] = { 0x80, };
+	uint64_t bits;
+	uint32_t index, padlen;
+
+	/* add padding and update data with it */
+	bits = cpu_to_le64(ctx->sz << 3);
+
+	/* pad out to 56 */
+	index = (uint32_t) (ctx->sz & 0x3f);
+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
+	crypton_ripemd160_update(ctx, padding, padlen);
+
+	/* append length */
+	crypton_ripemd160_update(ctx, (uint8_t *) &bits, sizeof(bits));
+
+	/* output digest */
+	store_le32(out   , ctx->h[0]);
+	store_le32(out+ 4, ctx->h[1]);
+	store_le32(out+ 8, ctx->h[2]);
+	store_le32(out+12, ctx->h[3]);
+	store_le32(out+16, ctx->h[4]);
+}
diff --git a/cbits/crypton_ripemd.h b/cbits/crypton_ripemd.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_ripemd.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_RIPEMD_H
+#define CRYPTOHASH_RIPEMD_H
+
+#include <stdint.h>
+
+struct ripemd160_ctx
+{
+	uint64_t sz;
+	uint8_t  buf[64];
+	uint32_t h[5];
+};
+
+#define RIPEMD160_DIGEST_SIZE	20
+#define RIPEMD160_CTX_SIZE	sizeof(struct ripemd160_ctx)
+
+void crypton_ripemd160_init(struct ripemd160_ctx *ctx);
+void crypton_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_salsa.c b/cbits/crypton_salsa.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_salsa.c
@@ -0,0 +1,292 @@
+/*
+ * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+#include "crypton_salsa.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+
+static const uint8_t sigma[16] = "expand 32-byte k";
+static const uint8_t tau[16] = "expand 16-byte k";
+
+#define QR(a,b,c,d) \
+	b ^= rol32(a+d, 7); \
+	c ^= rol32(b+a, 9); \
+	d ^= rol32(c+b, 13); \
+	a ^= rol32(d+c, 18);
+
+#define ALIGNED64(PTR) \
+	(((uintptr_t)(const void *)(PTR)) % 8 == 0)
+
+#define SALSA_CORE_LOOP \
+	for (i = rounds; i > 0; i -= 2) { \
+		QR (x0,x4,x8,x12); \
+		QR (x5,x9,x13,x1); \
+		QR (x10,x14,x2,x6); \
+		QR (x15,x3,x7,x11); \
+		QR (x0,x1,x2,x3); \
+		QR (x5,x6,x7,x4); \
+		QR (x10,x11,x8,x9); \
+		QR (x15,x12,x13,x14); \
+	}
+
+static void salsa_core(int rounds, block *out, const crypton_salsa_state *in)
+{
+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+	int i;
+
+	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];
+	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];
+	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];
+	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];
+
+	SALSA_CORE_LOOP;
+
+	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];
+	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];
+	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];
+	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];
+
+	out->d[0] = cpu_to_le32(x0);
+	out->d[1] = cpu_to_le32(x1);
+	out->d[2] = cpu_to_le32(x2);
+	out->d[3] = cpu_to_le32(x3);
+	out->d[4] = cpu_to_le32(x4);
+	out->d[5] = cpu_to_le32(x5);
+	out->d[6] = cpu_to_le32(x6);
+	out->d[7] = cpu_to_le32(x7);
+	out->d[8] = cpu_to_le32(x8);
+	out->d[9] = cpu_to_le32(x9);
+	out->d[10] = cpu_to_le32(x10);
+	out->d[11] = cpu_to_le32(x11);
+	out->d[12] = cpu_to_le32(x12);
+	out->d[13] = cpu_to_le32(x13);
+	out->d[14] = cpu_to_le32(x14);
+	out->d[15] = cpu_to_le32(x15);
+}
+
+void crypton_salsa_core_xor(int rounds, block *out, block *in)
+{
+	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+	int i;
+
+#define LOAD(i) (out->d[i] ^= in->d[i])
+	x0 = LOAD(0); x1 = LOAD(1); x2 = LOAD(2); x3 = LOAD(3);
+	x4 = LOAD(4); x5 = LOAD(5); x6 = LOAD(6); x7 = LOAD(7);
+	x8 = LOAD(8); x9 = LOAD(9); x10 = LOAD(10); x11 = LOAD(11);
+	x12 = LOAD(12); x13 = LOAD(13); x14 = LOAD(14); x15 = LOAD(15);
+#undef LOAD
+
+	SALSA_CORE_LOOP;
+
+	out->d[0] += x0; out->d[1] += x1; out->d[2] += x2; out->d[3] += x3;
+	out->d[4] += x4; out->d[5] += x5; out->d[6] += x6; out->d[7] += x7;
+	out->d[8] += x8; out->d[9] += x9; out->d[10] += x10; out->d[11] += x11;
+	out->d[12] += x12; out->d[13] += x13; out->d[14] += x14; out->d[15] += x15;
+}
+
+/* only 2 valid values for keylen are 256 (32) and 128 (16) */
+void crypton_salsa_init_core(crypton_salsa_state *st,
+                                uint32_t keylen, const uint8_t *key,
+                                uint32_t ivlen, const uint8_t *iv)
+{
+	const uint8_t *constants = (keylen == 32) ? sigma : tau;
+
+	st->d[0] = load_le32_aligned(constants + 0);
+	st->d[5] = load_le32_aligned(constants + 4);
+	st->d[10] = load_le32_aligned(constants + 8);
+	st->d[15] = load_le32_aligned(constants + 12);
+
+	st->d[1] = load_le32(key + 0);
+	st->d[2] = load_le32(key + 4);
+	st->d[3] = load_le32(key + 8);
+	st->d[4] = load_le32(key + 12);
+	/* we repeat the key on 128 bits */
+	if (keylen == 32)
+		key += 16;
+	st->d[11] = load_le32(key + 0);
+	st->d[12] = load_le32(key + 4);
+	st->d[13] = load_le32(key + 8);
+	st->d[14] = load_le32(key + 12);
+
+	st->d[9] = 0;
+	switch (ivlen) {
+	case 8:
+		st->d[6] = load_le32(iv + 0);
+		st->d[7] = load_le32(iv + 4);
+		st->d[8] = 0;
+		break;
+	case 12:
+		st->d[6] = load_le32(iv + 0);
+		st->d[7] = load_le32(iv + 4);
+		st->d[8] = load_le32(iv + 8);
+	default:
+		return;
+	}
+}
+
+void crypton_salsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds,
+                           uint32_t keylen, const uint8_t *key,
+                           uint32_t ivlen, const uint8_t *iv)
+{
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->nb_rounds = nb_rounds;
+	crypton_salsa_init_core(&ctx->st, keylen, key, ivlen, iv);
+}
+
+void crypton_salsa_combine(uint8_t *dst, crypton_salsa_context *ctx, const uint8_t *src, uint32_t bytes)
+{
+	block out;
+	crypton_salsa_state *st;
+	int i;
+
+	if (!bytes)
+		return;
+
+	/* xor the previous buffer first (if any) */
+	if (ctx->prev_len > 0) {
+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
+		for (i = 0; i < to_copy; i++)
+			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];
+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
+		ctx->prev_len -= to_copy;
+		ctx->prev_ofs += to_copy;
+		src += to_copy;
+		dst += to_copy;
+		bytes -= to_copy;
+	}
+
+	if (bytes == 0)
+		return;
+
+	st = &ctx->st;
+
+	/* xor new 64-bytes chunks and store the left over if any */
+	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {
+		/* generate new chunk and update state */
+		salsa_core(ctx->nb_rounds, &out, st);
+		st->d[8] += 1;
+		if (st->d[8] == 0)
+			st->d[9] += 1;
+
+		for (i = 0; i < 64; ++i)
+			dst[i] = src[i] ^ out.b[i];
+	}
+
+	if (bytes > 0) {
+		/* generate new chunk and update state */
+		salsa_core(ctx->nb_rounds, &out, st);
+		st->d[8] += 1;
+		if (st->d[8] == 0)
+			st->d[9] += 1;
+
+		/* xor as much as needed */
+		for (i = 0; i < bytes; i++)
+			dst[i] = src[i] ^ out.b[i];
+		
+		/* copy the left over in the buffer */
+		ctx->prev_len = 64 - bytes;
+		ctx->prev_ofs = i;
+		for (; i < 64; i++) {
+			ctx->prev[i] = out.b[i];
+		}
+	}
+}
+
+void crypton_salsa_generate(uint8_t *dst, crypton_salsa_context *ctx, uint32_t bytes)
+{
+	crypton_salsa_state *st;
+	block out;
+	int i;
+
+	if (!bytes)
+		return;
+
+	/* xor the previous buffer first (if any) */
+	if (ctx->prev_len > 0) {
+		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
+		for (i = 0; i < to_copy; i++)
+			dst[i] = ctx->prev[ctx->prev_ofs+i];
+		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
+		ctx->prev_len -= to_copy;
+		ctx->prev_ofs += to_copy;
+		dst += to_copy;
+		bytes -= to_copy;
+	}
+
+	if (bytes == 0)
+		return;
+
+	st = &ctx->st;
+
+	if (ALIGNED64(dst)) {
+		/* xor new 64-bytes chunks and store the left over if any */
+		for (; bytes >= 64; bytes -= 64, dst += 64) {
+			/* generate new chunk and update state */
+			salsa_core(ctx->nb_rounds, (block *) dst, st);
+			st->d[8] += 1;
+			if (st->d[8] == 0)
+				st->d[9] += 1;
+		}
+	} else {
+		/* xor new 64-bytes chunks and store the left over if any */
+		for (; bytes >= 64; bytes -= 64, dst += 64) {
+			/* generate new chunk and update state */
+			salsa_core(ctx->nb_rounds, &out, st);
+			st->d[8] += 1;
+			if (st->d[8] == 0)
+				st->d[9] += 1;
+
+			for (i = 0; i < 64; ++i)
+				dst[i] = out.b[i];
+		}
+	}
+
+	if (bytes > 0) {
+		/* generate new chunk and update state */
+		salsa_core(ctx->nb_rounds, &out, st);
+		st->d[8] += 1;
+		if (st->d[8] == 0)
+			st->d[9] += 1;
+
+		/* xor as much as needed */
+		for (i = 0; i < bytes; i++)
+			dst[i] = out.b[i];
+		
+		/* copy the left over in the buffer */
+		ctx->prev_len = 64 - bytes;
+		ctx->prev_ofs = i;
+		for (; i < 64; i++)
+			ctx->prev[i] = out.b[i];
+	}
+}
+
diff --git a/cbits/crypton_salsa.h b/cbits/crypton_salsa.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_salsa.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#ifndef CRYPTON_SALSA
+#define CRYPTON_SALSA
+
+typedef union {
+	uint64_t q[8];
+	uint32_t d[16];
+	uint8_t  b[64];
+} block;
+
+typedef block crypton_salsa_state;
+
+typedef struct {
+	crypton_salsa_state st;
+	uint8_t prev[64];
+	uint8_t prev_ofs;
+	uint8_t prev_len;
+	uint8_t nb_rounds;
+} crypton_salsa_context;
+
+/* for scrypt */
+void crypton_salsa_core_xor(int rounds, block *out, block *in);
+
+void crypton_salsa_init_core(crypton_salsa_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
+void crypton_salsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
+void crypton_salsa_combine(uint8_t *dst, crypton_salsa_context *st, const uint8_t *src, uint32_t bytes);
+void crypton_salsa_generate(uint8_t *dst, crypton_salsa_context *st, uint32_t bytes);
+
+#endif
diff --git a/cbits/crypton_scrypt.c b/cbits/crypton_scrypt.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_scrypt.c
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2014 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * Based on scrypt from Colin Percival's paper
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include "crypton_salsa.h"
+
+static void blockmix_salsa8(uint32_t *in, uint32_t *out, uint32_t *X, const uint32_t r)
+{
+	int i;
+
+	array_copy32(X, &in[(2 * r - 1) * 16], 16);
+
+	for (i = 0; i < 2 * r; i += 2) {
+		crypton_salsa_core_xor(8, (block *) X, (block *) &in[i*16]);
+		array_copy32(&out[i * 8], X, 16);
+
+		crypton_salsa_core_xor(8, (block *) X, (block *) &in[i*16+16]);
+		array_copy32(&out[i * 8 + r * 16], X, 16);
+	}
+}
+
+static inline uint64_t integerify(uint32_t *B, const uint32_t r)
+{
+	return B[(2*r-1) * 16] | (uint64_t)B[(2*r-1) * 16 + 1] << 32;
+}
+
+void crypton_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint32_t *V, uint32_t *XY)
+{
+	uint32_t *X = XY;
+	uint32_t *Y = &XY[32 * r];
+	uint32_t *Z = &XY[64 * r];
+	uint64_t i, j;
+	int k;
+	const int r32 = 32*r;
+
+	for (k = 0; k < r32; k++)
+		X[k] = load_le32_aligned(&B[4 * k]);
+	for (i = 0; i < N; i += 2) {
+		array_copy32(&V[i * r32], X, r32);
+		blockmix_salsa8(X, Y, Z, r);
+		array_copy32(&V[(i + 1) * r32], Y, r32);
+		blockmix_salsa8(Y, X, Z, r);
+	}
+	for (i = 0; i < N; i += 2) {
+		j = integerify(X, r) & (N - 1);
+		array_xor32(X, &V[j * r32], r32);
+		blockmix_salsa8(X, Y, Z, r);
+
+		j = integerify(Y, r) & (N - 1);
+		array_xor32(Y, &V[j * r32], r32);
+		blockmix_salsa8(Y, X, Z, r);
+	}
+	for (k = 0; k < r32; k++)
+		store_le32_aligned(&B[4*k], X[k]);
+}
diff --git a/cbits/crypton_sha1.c b/cbits/crypton_sha1.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha1.c
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include "crypton_sha1.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+
+void crypton_sha1_init(struct sha1_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->h[0] = 0x67452301;
+	ctx->h[1] = 0xefcdab89;
+	ctx->h[2] = 0x98badcfe;
+	ctx->h[3] = 0x10325476;
+	ctx->h[4] = 0xc3d2e1f0;
+}
+
+#define f1(x, y, z)   (z ^ (x & (y ^ z)))
+#define f2(x, y, z)   (x ^ y ^ z)
+#define f3(x, y, z)   ((x & y) + (z & (x ^ y)))
+#define f4(x, y, z)   f2(x, y, z)
+
+#define K1  0x5a827999
+#define K2  0x6ed9eba1
+#define K3  0x8f1bbcdc
+#define K4  0xca62c1d6
+
+#define R(a, b, c, d, e, f, k, w)  \
+	e += rol32(a, 5) + f(b, c, d) + k + w; b = rol32(b, 30)
+
+#define M(i)  (w[i & 0x0f] = rol32(w[i & 0x0f] ^ w[(i - 14) & 0x0f] \
+              ^ w[(i - 8) & 0x0f] ^ w[(i - 3) & 0x0f], 1))
+
+static inline void sha1_do_chunk(struct sha1_ctx *ctx, uint32_t *buf)
+{
+	uint32_t a, b, c, d, e;
+	uint32_t w[16];
+#define CPY(i)	w[i] = be32_to_cpu(buf[i])
+	CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7);
+	CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15);
+#undef CPY
+
+	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; e = ctx->h[4];
+
+	R(a, b, c, d, e, f1, K1, w[0]);
+	R(e, a, b, c, d, f1, K1, w[1]);
+	R(d, e, a, b, c, f1, K1, w[2]);
+	R(c, d, e, a, b, f1, K1, w[3]);
+	R(b, c, d, e, a, f1, K1, w[4]);
+	R(a, b, c, d, e, f1, K1, w[5]);
+	R(e, a, b, c, d, f1, K1, w[6]);
+	R(d, e, a, b, c, f1, K1, w[7]);
+	R(c, d, e, a, b, f1, K1, w[8]);
+	R(b, c, d, e, a, f1, K1, w[9]);
+	R(a, b, c, d, e, f1, K1, w[10]);
+	R(e, a, b, c, d, f1, K1, w[11]);
+	R(d, e, a, b, c, f1, K1, w[12]);
+	R(c, d, e, a, b, f1, K1, w[13]);
+	R(b, c, d, e, a, f1, K1, w[14]);
+	R(a, b, c, d, e, f1, K1, w[15]);
+	R(e, a, b, c, d, f1, K1, M(16));
+	R(d, e, a, b, c, f1, K1, M(17));
+	R(c, d, e, a, b, f1, K1, M(18));
+	R(b, c, d, e, a, f1, K1, M(19));
+
+	R(a, b, c, d, e, f2, K2, M(20));
+	R(e, a, b, c, d, f2, K2, M(21));
+	R(d, e, a, b, c, f2, K2, M(22));
+	R(c, d, e, a, b, f2, K2, M(23));
+	R(b, c, d, e, a, f2, K2, M(24));
+	R(a, b, c, d, e, f2, K2, M(25));
+	R(e, a, b, c, d, f2, K2, M(26));
+	R(d, e, a, b, c, f2, K2, M(27));
+	R(c, d, e, a, b, f2, K2, M(28));
+	R(b, c, d, e, a, f2, K2, M(29));
+	R(a, b, c, d, e, f2, K2, M(30));
+	R(e, a, b, c, d, f2, K2, M(31));
+	R(d, e, a, b, c, f2, K2, M(32));
+	R(c, d, e, a, b, f2, K2, M(33));
+	R(b, c, d, e, a, f2, K2, M(34));
+	R(a, b, c, d, e, f2, K2, M(35));
+	R(e, a, b, c, d, f2, K2, M(36));
+	R(d, e, a, b, c, f2, K2, M(37));
+	R(c, d, e, a, b, f2, K2, M(38));
+	R(b, c, d, e, a, f2, K2, M(39));
+
+	R(a, b, c, d, e, f3, K3, M(40));
+	R(e, a, b, c, d, f3, K3, M(41));
+	R(d, e, a, b, c, f3, K3, M(42));
+	R(c, d, e, a, b, f3, K3, M(43));
+	R(b, c, d, e, a, f3, K3, M(44));
+	R(a, b, c, d, e, f3, K3, M(45));
+	R(e, a, b, c, d, f3, K3, M(46));
+	R(d, e, a, b, c, f3, K3, M(47));
+	R(c, d, e, a, b, f3, K3, M(48));
+	R(b, c, d, e, a, f3, K3, M(49));
+	R(a, b, c, d, e, f3, K3, M(50));
+	R(e, a, b, c, d, f3, K3, M(51));
+	R(d, e, a, b, c, f3, K3, M(52));
+	R(c, d, e, a, b, f3, K3, M(53));
+	R(b, c, d, e, a, f3, K3, M(54));
+	R(a, b, c, d, e, f3, K3, M(55));
+	R(e, a, b, c, d, f3, K3, M(56));
+	R(d, e, a, b, c, f3, K3, M(57));
+	R(c, d, e, a, b, f3, K3, M(58));
+	R(b, c, d, e, a, f3, K3, M(59));
+
+	R(a, b, c, d, e, f4, K4, M(60));
+	R(e, a, b, c, d, f4, K4, M(61));
+	R(d, e, a, b, c, f4, K4, M(62));
+	R(c, d, e, a, b, f4, K4, M(63));
+	R(b, c, d, e, a, f4, K4, M(64));
+	R(a, b, c, d, e, f4, K4, M(65));
+	R(e, a, b, c, d, f4, K4, M(66));
+	R(d, e, a, b, c, f4, K4, M(67));
+	R(c, d, e, a, b, f4, K4, M(68));
+	R(b, c, d, e, a, f4, K4, M(69));
+	R(a, b, c, d, e, f4, K4, M(70));
+	R(e, a, b, c, d, f4, K4, M(71));
+	R(d, e, a, b, c, f4, K4, M(72));
+	R(c, d, e, a, b, f4, K4, M(73));
+	R(b, c, d, e, a, f4, K4, M(74));
+	R(a, b, c, d, e, f4, K4, M(75));
+	R(e, a, b, c, d, f4, K4, M(76));
+	R(d, e, a, b, c, f4, K4, M(77));
+	R(c, d, e, a, b, f4, K4, M(78));
+	R(b, c, d, e, a, f4, K4, M(79));
+
+	ctx->h[0] += a;
+	ctx->h[1] += b;
+	ctx->h[2] += c;
+	ctx->h[3] += d;
+	ctx->h[4] += e;
+}
+
+void crypton_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t index, to_fill;
+
+	index = (uint32_t) (ctx->sz & 0x3f);
+	to_fill = 64 - index;
+
+	ctx->sz += len;
+
+	/* process partial buffer if there's enough data to make a block */
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		sha1_do_chunk(ctx, (uint32_t *) ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	if (need_alignment(data, 4)) {
+		uint32_t tramp[16];
+		ASSERT_ALIGNMENT(tramp, 4);
+		for (; len >= 64; len -= 64, data += 64) {
+			memcpy(tramp, data, 64);
+			sha1_do_chunk(ctx, tramp);
+		}
+	} else {
+		/* process as much 64-block as possible */
+		for (; len >= 64; len -= 64, data += 64)
+			sha1_do_chunk(ctx, (uint32_t *) data);
+	}
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out)
+{
+	static uint8_t padding[64] = { 0x80, };
+	uint64_t bits;
+	uint32_t index, padlen;
+
+	/* add padding and update data with it */
+	bits = cpu_to_be64(ctx->sz << 3);
+
+	/* pad out to 56 */
+	index = (uint32_t) (ctx->sz & 0x3f);
+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
+	crypton_sha1_update(ctx, padding, padlen);
+
+	/* append length */
+	crypton_sha1_update(ctx, (uint8_t *) &bits, sizeof(bits));
+
+	/* output hash */
+	store_be32(out   , ctx->h[0]);
+	store_be32(out+ 4, ctx->h[1]);
+	store_be32(out+ 8, ctx->h[2]);
+	store_be32(out+12, ctx->h[3]);
+	store_be32(out+16, ctx->h[4]);
+}
+
+#define HASHED(m) SHA1_##m
+#define HASHED_LOWER(m) sha1_##m
+#define CRYPTON_HASHED(m) crypton_sha1_##m
+#define SHA1_BLOCK_SIZE 64
+#define SHA1_BITS_ELEMS 1
+
+static inline uint32_t crypton_sha1_get_index(const struct sha1_ctx *ctx)
+{
+	return (uint32_t) (ctx->sz & 0x3f);
+}
+
+static inline void crypton_sha1_incr_sz(struct sha1_ctx *ctx, uint64_t *bits, uint32_t n)
+{
+	ctx->sz += n;
+	*bits = cpu_to_be64(ctx->sz << 3);
+}
+
+static inline void crypton_sha1_select_digest(const struct sha1_ctx *ctx, uint8_t *out, uint32_t out_mask)
+{
+	xor_be32(out   , ctx->h[0] & out_mask);
+	xor_be32(out+ 4, ctx->h[1] & out_mask);
+	xor_be32(out+ 8, ctx->h[2] & out_mask);
+	xor_be32(out+12, ctx->h[3] & out_mask);
+	xor_be32(out+16, ctx->h[4] & out_mask);
+}
+
+#include <crypton_hash_prefix.c>
diff --git a/cbits/crypton_sha1.h b/cbits/crypton_sha1.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha1.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_SHA1_H
+#define CRYPTOHASH_SHA1_H
+
+#include <stdint.h>
+
+# define SHA1_BLOCK_SIZE 64
+
+struct sha1_ctx
+{
+	uint64_t sz;
+	uint8_t  buf[SHA1_BLOCK_SIZE];
+	uint32_t h[5];
+};
+
+#define SHA1_DIGEST_SIZE	20
+#define SHA1_CTX_SIZE 		(sizeof(struct sha1_ctx))
+
+void crypton_sha1_init(struct sha1_ctx *ctx);
+void crypton_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out);
+void crypton_sha1_finalize_prefix(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_sha256.c b/cbits/crypton_sha256.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha256.c
@@ -0,0 +1,218 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include "crypton_sha256.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+
+void crypton_sha224_init(struct sha224_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->h[0] = 0xc1059ed8;
+	ctx->h[1] = 0x367cd507;
+	ctx->h[2] = 0x3070dd17;
+	ctx->h[3] = 0xf70e5939;
+	ctx->h[4] = 0xffc00b31;
+	ctx->h[5] = 0x68581511;
+	ctx->h[6] = 0x64f98fa7;
+	ctx->h[7] = 0xbefa4fa4;
+}
+
+void crypton_sha256_init(struct sha256_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->h[0] = 0x6a09e667;
+	ctx->h[1] = 0xbb67ae85;
+	ctx->h[2] = 0x3c6ef372;
+	ctx->h[3] = 0xa54ff53a;
+	ctx->h[4] = 0x510e527f;
+	ctx->h[5] = 0x9b05688c;
+	ctx->h[6] = 0x1f83d9ab;
+	ctx->h[7] = 0x5be0cd19;
+}
+
+/* 232 times the cube root of the first 64 primes 2..311 */
+static const uint32_t k[] = {
+	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+	0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+	0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+	0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+	0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+	0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+};
+
+#define e0(x)       (ror32(x, 2) ^ ror32(x,13) ^ ror32(x,22))
+#define e1(x)       (ror32(x, 6) ^ ror32(x,11) ^ ror32(x,25))
+#define s0(x)       (ror32(x, 7) ^ ror32(x,18) ^ (x >> 3))
+#define s1(x)       (ror32(x,17) ^ ror32(x,19) ^ (x >> 10))
+
+static void sha256_do_chunk(struct sha256_ctx *ctx, uint32_t buf[])
+{
+	uint32_t a, b, c, d, e, f, g, h, t1, t2;
+	int i;
+	uint32_t w[64];
+
+	cpu_to_be32_array(w, buf, 16);
+	for (i = 16; i < 64; i++)
+		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];
+
+	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
+	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];
+
+#define R(a, b, c, d, e, f, g, h, k, w)			\
+	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w; 	\
+	t2 = e0(a) + ((a & b) | (c & (a | b)));		\
+	d += t1;					\
+	h = t1 + t2;
+
+	for (i = 0; i < 64; i += 8) {
+		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);
+		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);
+		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);
+		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);
+		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);
+		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);
+		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);
+		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);
+	}
+
+#undef R
+
+	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
+}
+
+void crypton_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	return crypton_sha256_update(ctx, data, len);
+}
+
+void crypton_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t index, to_fill;
+
+	/* check for partial buffer */
+	index = (uint32_t) (ctx->sz & 0x3f);
+	to_fill = 64 - index;
+
+	ctx->sz += len;
+
+	/* process partial buffer if there's enough data to make a block */
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		sha256_do_chunk(ctx, (uint32_t *) ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	if (need_alignment(data, 4)) {
+		uint32_t tramp[16];
+		ASSERT_ALIGNMENT(tramp, 4);
+		for (; len >= 64; len -= 64, data += 64) {
+			memcpy(tramp, data, 64);
+			sha256_do_chunk(ctx, tramp);
+		}
+	} else {
+		/* process as much 64-block as possible */
+		for (; len >= 64; len -= 64, data += 64)
+			sha256_do_chunk(ctx, (uint32_t *) data);
+	}
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out)
+{
+	uint8_t intermediate[SHA256_DIGEST_SIZE];
+
+	crypton_sha256_finalize(ctx, intermediate);
+	memcpy(out, intermediate, SHA224_DIGEST_SIZE);
+}
+
+void crypton_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)
+{
+	uint8_t intermediate[SHA256_DIGEST_SIZE];
+
+	crypton_sha256_finalize_prefix(ctx, data, len, n, intermediate);
+	memcpy(out, intermediate, SHA224_DIGEST_SIZE);
+}
+
+void crypton_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out)
+{
+	static uint8_t padding[64] = { 0x80, };
+	uint64_t bits;
+	uint32_t i, index, padlen;
+
+	/* cpu -> big endian */
+	bits = cpu_to_be64(ctx->sz << 3);
+
+	/* pad out to 56 */
+	index = (uint32_t) (ctx->sz & 0x3f);
+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
+	crypton_sha256_update(ctx, padding, padlen);
+
+	/* append length */
+	crypton_sha256_update(ctx, (uint8_t *) &bits, sizeof(bits));
+
+	/* store to digest */
+	for (i = 0; i < 8; i++)
+		store_be32(out+4*i, ctx->h[i]);
+}
+
+#define HASHED(m) SHA256_##m
+#define HASHED_LOWER(m) sha256_##m
+#define CRYPTON_HASHED(m) crypton_sha256_##m
+#define SHA256_BLOCK_SIZE 64
+#define SHA256_BITS_ELEMS 1
+
+static inline uint32_t crypton_sha256_get_index(const struct sha256_ctx *ctx)
+{
+	return (uint32_t) (ctx->sz & 0x3f);
+}
+
+static inline void crypton_sha256_incr_sz(struct sha256_ctx *ctx, uint64_t *bits, uint32_t n)
+{
+	ctx->sz += n;
+	*bits = cpu_to_be64(ctx->sz << 3);
+}
+
+static inline void crypton_sha256_select_digest(const struct sha256_ctx *ctx, uint8_t *out, uint32_t out_mask)
+{
+	uint32_t i;
+	for (i = 0; i < 8; i++)
+		xor_be32(out+4*i, ctx->h[i] & out_mask);
+}
+
+#include <crypton_hash_prefix.c>
diff --git a/cbits/crypton_sha256.h b/cbits/crypton_sha256.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha256.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CRYPTOHASH_SHA256_H
+#define CRYPTOHASH_SHA256_H
+
+#include <stdint.h>
+
+#define SHA256_BLOCK_SIZE 64
+
+struct sha256_ctx
+{
+	uint64_t sz;
+	uint8_t  buf[128];
+	uint32_t h[8];
+};
+
+#define sha224_ctx 		sha256_ctx
+
+#define SHA224_DIGEST_SIZE	28
+#define SHA224_CTX_SIZE		sizeof(struct sha224_ctx)
+
+#define SHA256_DIGEST_SIZE	32
+#define SHA256_CTX_SIZE		sizeof(struct sha256_ctx)
+
+void crypton_sha224_init(struct sha224_ctx *ctx);
+void crypton_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out);
+void crypton_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
+
+void crypton_sha256_init(struct sha256_ctx *ctx);
+void crypton_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out);
+void crypton_sha256_finalize_prefix(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_sha3.c b/cbits/crypton_sha3.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha3.c
@@ -0,0 +1,252 @@
+/*
+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include "crypton_sha3.h"
+
+#define KECCAK_NB_ROUNDS 24
+
+/* rounds constants */
+static const uint64_t keccak_rndc[24] =
+{
+	0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,
+	0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,
+	0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,
+	0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
+	0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,
+	0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,
+	0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,
+	0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,
+};
+
+/* triangular numbers constants */
+static const int keccak_rotc[24] =
+	{ 1,3,6,10,15,21,28,36,45,55,2,14,27,41,56,8,25,43,62,18,39,61,20,44 };
+
+static const int keccak_piln[24] =
+	{ 10,7,11,17,18,3,5,16,8,21,24,4,15,23,19,13,12,2,20,14,22,9,6,1 };
+
+static inline void sha3_do_chunk(uint64_t state[25], uint64_t buf[], int bufsz)
+{
+	int i, j, r;
+	uint64_t tmp, bc[5];
+
+	/* merge buf with state */
+	for (i = 0; i < bufsz; i++)
+		state[i] ^= le64_to_cpu(buf[i]);
+
+	/* run keccak rounds */
+	for (r = 0; r < KECCAK_NB_ROUNDS; r++) {
+		/* compute the parity of each columns */
+		for (i = 0; i < 5; i++)
+			bc[i] = state[i] ^ state[i+5] ^ state[i+10] ^ state[i+15] ^ state[i+20];
+
+		for (i = 0; i < 5; i++) {
+			tmp = bc[(i + 4) % 5] ^ rol64(bc[(i + 1) % 5], 1);
+			for (j = 0; j < 25; j += 5)
+				state[j + i] ^= tmp;
+		}
+
+		/* rho pi */
+		tmp = state[1];
+		for (i = 0; i < 24; i++) {
+			j = keccak_piln[i];
+			bc[0] = state[j];
+			state[j] = rol64(tmp, keccak_rotc[i]);
+			tmp = bc[0];
+		}
+
+		/* bitwise combine along rows using a = a xor (not b and c) */
+		for (j = 0; j < 25; j += 5) {
+			for (i = 0; i < 5; i++)
+				bc[i] = state[j + i];
+			#define andn(b,c) (~(b) & (c))
+			state[j + 0] ^= andn(bc[1], bc[2]);
+			state[j + 1] ^= andn(bc[2], bc[3]);
+			state[j + 2] ^= andn(bc[3], bc[4]);
+			state[j + 3] ^= andn(bc[4], bc[0]);
+			state[j + 4] ^= andn(bc[0], bc[1]);
+			#undef andn
+		}
+
+		/* xor the round constant */
+		state[0] ^= keccak_rndc[r];
+	}
+}
+
+/*
+ * Initialize a SHA-3 / SHAKE / cSHAKE context: hashlen is the security level
+ * (and half the capacity) in bits.
+ *
+ * In case of cSHAKE, the message prefix with encoded N and S must be added with
+ * crypton_sha3_update.
+ */
+void crypton_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen)
+{
+	/* assert(hashlen >= SHA3_BITSIZE_MIN && hashlen <= SHA3_BITSIZE_MAX) */
+	int bufsz = SHA3_BUF_SIZE(hashlen);
+	memset(ctx, 0, sizeof(*ctx) + bufsz);
+	ctx->bufsz = bufsz;
+}
+
+/* Update a SHA-3 / SHAKE / cSHAKE context */
+void crypton_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t to_fill;
+
+	to_fill = ctx->bufsz - ctx->bufindex;
+
+	if (ctx->bufindex == ctx->bufsz) {
+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
+		ctx->bufindex = 0;
+	}
+
+	/* process partial buffer if there's enough data to make a block */
+	if (ctx->bufindex && len >= to_fill) {
+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);
+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
+		len -= to_fill;
+		data += to_fill;
+		ctx->bufindex = 0;
+	}
+
+	if (need_alignment(data, 8)) {
+		uint64_t tramp[SHA3_BUF_SIZE_MAX/8];
+		ASSERT_ALIGNMENT(tramp, 8);
+		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz) {
+			memcpy(tramp, data, ctx->bufsz);
+			sha3_do_chunk(ctx->state, tramp, ctx->bufsz / 8);
+		}
+	} else {
+		/* process as much ctx->bufsz-block */
+		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz)
+			sha3_do_chunk(ctx->state, (uint64_t *) data, ctx->bufsz / 8);
+	}
+
+
+	/* append data into buf */
+	if (len) {
+		memcpy(ctx->buf + ctx->bufindex, data, len);
+		ctx->bufindex += len;
+	}
+}
+
+void crypton_sha3_finalize_with_pad_byte(struct sha3_ctx *ctx, uint8_t pad_byte)
+{
+	/* process full buffer if needed */
+	if (ctx->bufindex == ctx->bufsz) {
+		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
+		ctx->bufindex = 0;
+	}
+
+	/* add the 10*1 padding */
+	ctx->buf[ctx->bufindex++] = pad_byte;
+	memset(ctx->buf + ctx->bufindex, 0, ctx->bufsz - ctx->bufindex);
+	ctx->buf[ctx->bufsz - 1] |= 0x80;
+
+	/* process */
+	sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
+	ctx->bufindex = 0;
+}
+
+/*
+ * Extract some bytes from a finalized SHA-3 / SHAKE / cSHAKE context.
+ * May be called multiple times.
+ */
+void crypton_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len)
+{
+	uint64_t w[25];
+	uint8_t *wptr = (uint8_t *) w;
+	uint32_t still_avail;
+
+	still_avail = ctx->bufsz - ctx->bufindex;
+
+	if (ctx->bufindex == ctx->bufsz) {
+		/* squeeze the sponge again, without any input */
+		sha3_do_chunk(ctx->state, NULL, 0);
+		ctx->bufindex = 0;
+	}
+
+	/* use bytes already available if this block is fully consumed */
+	if (ctx->bufindex && len >= still_avail) {
+		cpu_to_le64_array(w, ctx->state, 25);
+		memcpy(out, wptr + ctx->bufindex, still_avail);
+		sha3_do_chunk(ctx->state, NULL, 0);
+		len -= still_avail;
+		out += still_avail;
+		ctx->bufindex = 0;
+	}
+
+	/* output as much ctx->bufsz-block */
+	for (; len > ctx->bufsz; len -= ctx->bufsz, out += ctx->bufsz) {
+		cpu_to_le64_array(w, ctx->state, 25);
+		memcpy(out, w, ctx->bufsz);
+		sha3_do_chunk(ctx->state, NULL, 0);
+	}
+
+	/* output from partial buffer */
+	if (len) {
+		cpu_to_le64_array(w, ctx->state, 25);
+		memcpy(out, wptr + ctx->bufindex, len);
+		ctx->bufindex += len;
+	}
+}
+
+/* Finalize a SHA-3 context and return the digest value */
+void crypton_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	crypton_sha3_finalize_with_pad_byte(ctx, 0x06);
+	crypton_sha3_output(ctx, out, hashlen / 8);
+}
+
+/* Finalize a SHAKE context. Output is read using crypton_sha3_output. */
+void crypton_sha3_finalize_shake(struct sha3_ctx *ctx)
+{
+	crypton_sha3_finalize_with_pad_byte(ctx, 0x1F);
+}
+
+/* Finalize a cSHAKE context. Output is read using crypton_sha3_output. */
+void crypton_sha3_finalize_cshake(struct sha3_ctx *ctx)
+{
+	crypton_sha3_finalize_with_pad_byte(ctx, 0x04);
+}
+
+void crypton_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen)
+{
+	crypton_sha3_init(ctx, hashlen);
+}
+
+void crypton_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len)
+{
+	crypton_sha3_update(ctx, data, len);
+}
+
+void crypton_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	crypton_sha3_finalize_with_pad_byte(ctx, 1);
+	crypton_sha3_output(ctx, out, hashlen / 8);
+}
diff --git a/cbits/crypton_sha3.h b/cbits/crypton_sha3.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha3.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_SHA3_H
+#define CRYPTOHASH_SHA3_H
+
+#include <stdint.h>
+
+struct sha3_ctx
+{
+	uint32_t bufindex;
+	uint32_t bufsz;
+	uint64_t state[25];
+	uint8_t  buf[0]; /* maximum SHAKE128 is 168 bytes, otherwise buffer can be decreased */
+};
+
+#define SHA3_CTX_SIZE		sizeof(struct sha3_ctx)
+#define SHA3_CTX_BUF_MAX_SIZE   (SHA3_CTX_SIZE + SHA3_BUF_SIZE_MAX)
+#define SHA3_BITSIZE_MIN   	128
+#define SHA3_BITSIZE_MAX    	512
+
+#define SHA3_BUF_SIZE(bitsize)  (200 - 2 * ((bitsize) / 8))
+
+#define SHA3_BUF_SIZE_MIN       SHA3_BUF_SIZE(SHA3_BITSIZE_MAX)
+#define SHA3_BUF_SIZE_MAX       SHA3_BUF_SIZE(SHA3_BITSIZE_MIN)
+
+/*
+ * buffer size:
+ *
+ * 128 bits (shake 128 bits) => 200 - 2 * (128 / 8) = 200 - 2*16 = 200 - 32  = 168 bytes
+ * 224 bits (SHA3 224 bits)  => 200 - 2 * (224 / 8) = 200 - 2*28 = 200 - 56  = 144 bytes
+ * 512 bits (SHA3 512 bits)  => 200 - 2 * (512 / 8) = 200 - 2*64 = 200 - 128 = 72 bytes
+ */
+
+void crypton_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen);
+void crypton_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+void crypton_sha3_finalize_shake(struct sha3_ctx *ctx);
+void crypton_sha3_finalize_cshake(struct sha3_ctx *ctx);
+void crypton_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len);
+
+void crypton_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen);
+void crypton_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len);
+void crypton_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_sha512.c b/cbits/crypton_sha512.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha512.c
@@ -0,0 +1,307 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+#include "crypton_sha512.h"
+
+void crypton_sha384_init(struct sha512_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->h[0] = 0xcbbb9d5dc1059ed8ULL;
+	ctx->h[1] = 0x629a292a367cd507ULL;
+	ctx->h[2] = 0x9159015a3070dd17ULL;
+	ctx->h[3] = 0x152fecd8f70e5939ULL;
+	ctx->h[4] = 0x67332667ffc00b31ULL;
+	ctx->h[5] = 0x8eb44a8768581511ULL;
+	ctx->h[6] = 0xdb0c2e0d64f98fa7ULL;
+	ctx->h[7] = 0x47b5481dbefa4fa4ULL;
+}
+
+void crypton_sha512_init(struct sha512_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->h[0] = 0x6a09e667f3bcc908ULL;
+	ctx->h[1] = 0xbb67ae8584caa73bULL;
+	ctx->h[2] = 0x3c6ef372fe94f82bULL;
+	ctx->h[3] = 0xa54ff53a5f1d36f1ULL;
+	ctx->h[4] = 0x510e527fade682d1ULL;
+	ctx->h[5] = 0x9b05688c2b3e6c1fULL;
+	ctx->h[6] = 0x1f83d9abfb41bd6bULL;
+	ctx->h[7] = 0x5be0cd19137e2179ULL;
+}
+
+/* 232 times the cube root of the first 64 primes 2..311 */
+static const uint64_t k[] = {
+	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,
+	0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
+	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 0xd807aa98a3030242ULL,
+	0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
+	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL,
+	0xc19bf174cf692694ULL, 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
+	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL,
+	0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
+	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL,
+	0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
+	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 0x27b70a8546d22ffcULL,
+	0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
+	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL,
+	0x92722c851482353bULL, 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
+	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL,
+	0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
+	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL,
+	0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
+	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 0x748f82ee5defb2fcULL,
+	0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
+	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL,
+	0xc67178f2e372532bULL, 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
+	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL,
+	0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
+	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL,
+	0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
+	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,
+};
+
+#define e0(x)       (ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39))
+#define e1(x)       (ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41))
+#define s0(x)       (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7))
+#define s1(x)       (ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6))
+
+static void sha512_do_chunk(struct sha512_ctx *ctx, uint64_t *buf)
+{
+	uint64_t a, b, c, d, e, f, g, h, t1, t2;
+	int i;
+	uint64_t w[80];
+
+	cpu_to_be64_array(w, buf, 16);
+
+	for (i = 16; i < 80; i++)
+		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];
+
+	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
+	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];
+
+#define R(a, b, c, d, e, f, g, h, k, w)			\
+	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w;	\
+	t2 = e0(a) + ((a & b) | (c & (a | b)));		\
+	d += t1;					\
+	h = t1 + t2
+
+	for (i = 0; i < 80; i += 8) {
+		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);
+		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);
+		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);
+		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);
+		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);
+		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);
+		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);
+		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);
+	}
+
+#undef R
+
+	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
+	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
+}
+
+void crypton_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	return crypton_sha512_update(ctx, data, len);
+}
+
+void crypton_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	unsigned int index, to_fill;
+
+	/* check for partial buffer */
+	index = (unsigned int) (ctx->sz[0] & 0x7f);
+	to_fill = 128 - index;
+
+	ctx->sz[0] += len;
+	if (ctx->sz[0] < len)
+		ctx->sz[1]++;
+
+	/* process partial buffer if there's enough data to make a block */
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		sha512_do_chunk(ctx, (uint64_t *) ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	if (need_alignment(data, 8)) {
+		uint64_t tramp[16];
+		ASSERT_ALIGNMENT(tramp, 8);
+		for (; len >= 128; len -= 128, data += 128) {
+			memcpy(tramp, data, 128);
+			sha512_do_chunk(ctx, tramp);
+		}
+	} else {
+		/* process as much 128-block as possible */
+		for (; len >= 128; len -= 128, data += 128)
+			sha512_do_chunk(ctx, (uint64_t *) data);
+	}
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out)
+{
+	uint8_t intermediate[SHA512_DIGEST_SIZE];
+
+	crypton_sha512_finalize(ctx, intermediate);
+	memcpy(out, intermediate, SHA384_DIGEST_SIZE);
+}
+
+void crypton_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)
+{
+	uint8_t intermediate[SHA512_DIGEST_SIZE];
+
+	crypton_sha512_finalize_prefix(ctx, data, len, n, intermediate);
+	memcpy(out, intermediate, SHA384_DIGEST_SIZE);
+}
+
+void crypton_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out)
+{
+	static uint8_t padding[128] = { 0x80, };
+	uint32_t i, index, padlen;
+	uint64_t bits[2];
+
+	/* cpu -> big endian */
+	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));
+	bits[1] = cpu_to_be64((ctx->sz[0] << 3));
+
+	/* pad out to 56 */
+	index = (unsigned int) (ctx->sz[0] & 0x7f);
+	padlen = (index < 112) ? (112 - index) : ((128 + 112) - index);
+	crypton_sha512_update(ctx, padding, padlen);
+
+	/* append length */
+	crypton_sha512_update(ctx, (uint8_t *) bits, sizeof(bits));
+
+	/* store to digest */
+	for (i = 0; i < 8; i++)
+		store_be64(out+8*i, ctx->h[i]);
+}
+
+#define HASHED(m) SHA512_##m
+#define HASHED_LOWER(m) sha512_##m
+#define CRYPTON_HASHED(m) crypton_sha512_##m
+#define SHA512_BLOCK_SIZE 128
+#define SHA512_BITS_ELEMS 2
+
+#include <crypton_hash_prefix.h>
+
+static inline uint32_t crypton_sha512_get_index(const struct sha512_ctx *ctx)
+{
+	return (uint32_t) (ctx->sz[0] & 0x7f);
+}
+
+static inline void crypton_sha512_incr_sz(struct sha512_ctx *ctx, uint64_t *bits, uint32_t n)
+{
+	ctx->sz[0] += n;
+	ctx->sz[1] += 1 & constant_time_lt_64(ctx->sz[0], n);
+	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));
+	bits[1] = cpu_to_be64((ctx->sz[0] << 3));
+}
+
+static inline void crypton_sha512_select_digest(const struct sha512_ctx *ctx, uint8_t *out, uint32_t out_mask)
+{
+	uint32_t i;
+	uint64_t out_mask_64 = out_mask;
+	out_mask_64 |= out_mask_64 << 32;
+	for (i = 0; i < 8; i++)
+		xor_be64(out+8*i, ctx->h[i] & out_mask_64);
+}
+
+#include <crypton_hash_prefix.c>
+
+#include <stdio.h>
+
+void crypton_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen)
+{
+	memset(ctx, 0, sizeof(*ctx));
+	if (hashlen >= 512)
+		return;
+	switch (hashlen) {
+	case 224:
+		ctx->h[0] = 0x8c3d37c819544da2ULL;
+		ctx->h[1] = 0x73e1996689dcd4d6ULL;
+		ctx->h[2] = 0x1dfab7ae32ff9c82ULL;
+		ctx->h[3] = 0x679dd514582f9fcfULL;
+		ctx->h[4] = 0x0f6d2b697bd44da8ULL;
+		ctx->h[5] = 0x77e36f7304c48942ULL;
+		ctx->h[6] = 0x3f9d85a86a1d36c8ULL;
+		ctx->h[7] = 0x1112e6ad91d692a1ULL;
+		break;
+	case 256:
+		ctx->h[0] = 0x22312194fc2bf72cULL;
+		ctx->h[1] = 0x9f555fa3c84c64c2ULL;
+		ctx->h[2] = 0x2393b86b6f53b151ULL;
+		ctx->h[3] = 0x963877195940eabdULL;
+		ctx->h[4] = 0x96283ee2a88effe3ULL;
+		ctx->h[5] = 0xbe5e1e2553863992ULL;
+		ctx->h[6] = 0x2b0199fc2c85b8aaULL;
+		ctx->h[7] = 0x0eb72ddc81c52ca2ULL;
+		break;
+	default: {
+		char buf[8+4];
+		uint8_t out[64];
+		int i;
+
+		crypton_sha512_init(ctx);
+		for (i = 0; i < 8; i++)
+			ctx->h[i] ^= 0xa5a5a5a5a5a5a5a5ULL;
+
+		i = sprintf(buf, "SHA-512/%d", hashlen);
+		crypton_sha512_update(ctx, (uint8_t *) buf, i);
+		crypton_sha512_finalize(ctx, out);
+
+		/* re-init the context, otherwise len is changed */
+		memset(ctx, 0, sizeof(*ctx));
+		for (i = 0; i < 8; i++)
+			ctx->h[i] = cpu_to_be64(((uint64_t *) out)[i]);
+		}
+	}
+}
+
+void crypton_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	return crypton_sha512_update(ctx, data, len);
+}
+
+void crypton_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	uint8_t intermediate[SHA512_DIGEST_SIZE];
+
+	crypton_sha512_finalize(ctx, intermediate);
+	memcpy(out, intermediate, hashlen / 8);
+}
+
diff --git a/cbits/crypton_sha512.h b/cbits/crypton_sha512.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_sha512.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_SHA512_H
+#define CRYPTOHASH_SHA512_H
+
+#include <stdint.h>
+
+# define SHA512_BLOCK_SIZE 128
+
+struct sha512_ctx
+{
+	uint64_t sz[2];
+	uint8_t  buf[SHA512_BLOCK_SIZE];
+	uint64_t h[8];
+};
+
+#define sha384_ctx sha512_ctx
+
+#define SHA384_DIGEST_SIZE	48
+#define SHA384_CTX_SIZE		sizeof(struct sha384_ctx)
+
+#define SHA512_DIGEST_SIZE	64
+#define SHA512_CTX_SIZE		sizeof(struct sha512_ctx)
+
+void crypton_sha384_init(struct sha384_ctx *ctx);
+void crypton_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out);
+void crypton_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
+
+void crypton_sha512_init(struct sha512_ctx *ctx);
+void crypton_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out);
+void crypton_sha512_finalize_prefix(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
+
+/* only multiples of 8 are supported as valid t values */
+void crypton_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen);
+void crypton_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_skein.h b/cbits/crypton_skein.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_skein.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_SKEIN_H
+#define CRYPTOHASH_SKEIN_H
+
+#define SKEIN_VERSION 1ULL
+#define SKEIN_IDSTRING 0x33414853ULL
+
+/*
+t0 0-63 || t1 64-127
+0-95      96-111      112-118    119     120-125  126    127
+Position  reserved    TreeLevel  BitPad  Type     First  Final
+*/
+#define FLAG_FIRST   (1ULL << 62)
+#define FLAG_FINAL   (1ULL << 63)
+#define FLAG_TYPE(x) (((uint64_t) ((x) & 0x3f)) << 56)
+
+#define TYPE_KEY     0x00
+#define TYPE_CFG     0x04
+#define TYPE_MSG     0x30
+#define TYPE_OUT     0x3f
+
+#define SET_TYPE(ctx, ty) ctx->t0 = 0; ctx->t1 = (ty)
+
+#endif
diff --git a/cbits/crypton_skein256.c b/cbits/crypton_skein256.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_skein256.c
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include "crypton_skein.h"
+#include "crypton_skein256.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+
+static const uint8_t K256_0[2] = { 14, 16, };
+static const uint8_t K256_1[2] = { 52, 57, };
+static const uint8_t K256_2[2] = { 23, 40, };
+static const uint8_t K256_3[2] = {  5, 37, };
+static const uint8_t K256_4[2] = { 25, 33, };
+static const uint8_t K256_5[2] = { 46, 12, };
+static const uint8_t K256_6[2] = { 58, 22, };
+static const uint8_t K256_7[2] = { 32, 32, };
+
+static inline void skein256_do_chunk(struct skein256_ctx *ctx, uint64_t *buf, uint32_t len)
+{
+	uint64_t x[4];
+	uint64_t ts[3];
+	uint64_t ks[4+1];
+
+	ks[4] = 0x1bd11bdaa9fc1a22ULL;
+	ks[0] = ctx->h[0]; ks[4] ^= ctx->h[0];
+	ks[1] = ctx->h[1]; ks[4] ^= ctx->h[1];
+	ks[2] = ctx->h[2]; ks[4] ^= ctx->h[2];
+	ks[3] = ctx->h[3]; ks[4] ^= ctx->h[3];
+
+	ts[0] = ctx->t0;
+	ts[1] = ctx->t1;
+
+	ts[0] += len;
+
+	ts[2] = ts[0] ^ ts[1];
+
+#define INJECTKEY(r) \
+	x[0] += ks[((r)+0) % (4+1)];                   \
+	x[1] += ks[((r)+1) % (4+1)] + ts[((r)+0) % 3]; \
+	x[2] += ks[((r)+2) % (4+1)] + ts[((r)+1) % 3]; \
+	x[3] += ks[((r)+3) % (4+1)] + (r)
+
+#define ROUND(a,b,c,d,k) \
+	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \
+	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c];
+
+#define PASS(i) \
+	ROUND(0,1,2,3,K256_0); \
+	ROUND(0,3,2,1,K256_1); \
+	ROUND(0,1,2,3,K256_2); \
+	ROUND(0,3,2,1,K256_3); \
+	INJECTKEY((i*2) + 1);          \
+	ROUND(0,1,2,3,K256_4); \
+	ROUND(0,3,2,1,K256_5); \
+	ROUND(0,1,2,3,K256_6); \
+	ROUND(0,3,2,1,K256_7); \
+	INJECTKEY((i*2) + 2)
+
+	x[0] = le64_to_cpu(buf[0]) + ks[0];
+	x[1] = le64_to_cpu(buf[1]) + ks[1] + ts[0];
+	x[2] = le64_to_cpu(buf[2]) + ks[2] + ts[1];
+	x[3] = le64_to_cpu(buf[3]) + ks[3];
+
+	/* 9 pass of 8 rounds = 72 rounds */
+	PASS(0);
+	PASS(1);
+	PASS(2);
+	PASS(3);
+	PASS(4);
+	PASS(5);
+	PASS(6);
+	PASS(7);
+	PASS(8);
+
+	ts[1] &= ~FLAG_FIRST;
+	ctx->t0 = ts[0];
+	ctx->t1 = ts[1];
+
+	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);
+        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);
+        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);
+        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);
+}
+
+void crypton_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen)
+{
+	uint64_t buf[4];
+	memset(ctx, 0, sizeof(*ctx));
+
+	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));
+	
+	memset(buf, '\0', sizeof(buf));
+	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);
+	buf[1] = cpu_to_le64(hashlen);
+	buf[2] = 0; /* tree info, not implemented */
+	skein256_do_chunk(ctx, buf, 4*8);
+
+	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));
+}
+
+void crypton_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t to_fill;
+
+	if (!len)
+		return;
+
+	to_fill = 32 - ctx->bufindex;
+
+	if (ctx->bufindex == 32) {
+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);
+		ctx->bufindex = 0;
+	}
+
+	/* process partial buffer if there's enough data to make a block
+	 * and there's without doubt further blocks */
+	if (ctx->bufindex && len > to_fill) {
+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);
+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);
+		len -= to_fill;
+		data += to_fill;
+		ctx->bufindex = 0;
+	}
+
+	if (need_alignment(data, 8)) {
+		uint64_t tramp[4];
+		ASSERT_ALIGNMENT(tramp, 8);
+		for (; len > 32; len -= 32, data += 32) {
+			memcpy(tramp, data, 32);
+			skein256_do_chunk(ctx, tramp, 32);
+		}
+	} else {
+		/* process as much 32-block as possible except the last one in case we finalize */
+		for (; len > 32; len -= 32, data += 32)
+			skein256_do_chunk(ctx, (uint64_t *) data, 32);
+	}
+
+	/* append data into buf */
+	if (len) {
+		memcpy(ctx->buf + ctx->bufindex, data, len);
+		ctx->bufindex += len;
+	}
+}
+
+void crypton_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	uint32_t outsize;
+	uint64_t x[4];
+	int i, j, n;
+
+	ctx->t1 |= FLAG_FINAL;
+	/* if buf is not complete pad with 0 bytes */
+	if (ctx->bufindex < 32)
+		memset(ctx->buf + ctx->bufindex, '\0', 32 - ctx->bufindex);
+	skein256_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);
+
+	memset(ctx->buf, '\0', 32);
+
+	/* make sure we have a 8 bit up rounded value */
+	outsize = (hashlen + 7) >> 3;
+
+	/* backup h[0--4] */
+	for (j = 0; j < 4; j++)
+		x[j] = ctx->h[j];
+	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */
+	for (i = 0; i*32 < outsize; i++) {
+		uint64_t w[4];
+		*((uint64_t *) ctx->buf) = cpu_to_le64(i);
+		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));
+		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));
+
+		n = outsize - i * 32;
+		if (n >= 32) n = 32;
+
+		cpu_to_le64_array(w, ctx->h, 4);
+		memcpy(out + i*32, w, n);
+
+		/* restore h[0--4] */
+		for (j = 0; j < 4; j++)
+			ctx->h[j] = x[j];
+	}
+}
diff --git a/cbits/crypton_skein256.h b/cbits/crypton_skein256.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_skein256.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_SKEIN256_H
+#define CRYPTOHASH_SKEIN256_H
+
+#include <stdint.h>
+
+struct skein256_ctx
+{
+	uint8_t  buf[32];
+	uint64_t h[4];
+	uint64_t t0;
+	uint64_t t1;
+	uint32_t bufindex;
+};
+
+#define SKEIN256_CTX_SIZE		sizeof(struct skein256_ctx)
+
+void cryponite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen);
+void cryponite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len);
+void cryponite_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_skein512.c b/cbits/crypton_skein512.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_skein512.c
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include "crypton_skein.h"
+#include "crypton_skein512.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+
+static const uint8_t K512_0[4] = { 46, 36, 19, 37, };
+static const uint8_t K512_1[4] = { 33, 27, 14, 42, };
+static const uint8_t K512_2[4] = { 17, 49, 36, 39, };
+static const uint8_t K512_3[4] = { 44,  9, 54, 56, };
+static const uint8_t K512_4[4] = { 39, 30, 34, 24, };
+static const uint8_t K512_5[4] = { 13, 50, 10, 17, };
+static const uint8_t K512_6[4] = { 25, 29, 39, 43, };
+static const uint8_t K512_7[4] = {  8, 35, 56, 22, };
+
+static inline void skein512_do_chunk(struct skein512_ctx *ctx, uint64_t *buf, uint32_t len)
+{
+	uint64_t x[8];
+	uint64_t ts[3];
+	uint64_t ks[8+1];
+
+	ks[8] = 0x1bd11bdaa9fc1a22ULL;
+	ks[0] = ctx->h[0]; ks[8] ^= ctx->h[0];
+	ks[1] = ctx->h[1]; ks[8] ^= ctx->h[1];
+	ks[2] = ctx->h[2]; ks[8] ^= ctx->h[2];
+	ks[3] = ctx->h[3]; ks[8] ^= ctx->h[3];
+	ks[4] = ctx->h[4]; ks[8] ^= ctx->h[4];
+	ks[5] = ctx->h[5]; ks[8] ^= ctx->h[5];
+	ks[6] = ctx->h[6]; ks[8] ^= ctx->h[6];
+	ks[7] = ctx->h[7]; ks[8] ^= ctx->h[7];
+
+	ts[0] = ctx->t0;
+	ts[1] = ctx->t1;
+
+	ts[0] += len;
+
+	ts[2] = ts[0] ^ ts[1];
+
+#define INJECTKEY(r) \
+	x[0] += ks[((r)+0) % (8+1)];                   \
+	x[1] += ks[((r)+1) % (8+1)];                   \
+	x[2] += ks[((r)+2) % (8+1)];                   \
+	x[3] += ks[((r)+3) % (8+1)];                   \
+	x[4] += ks[((r)+4) % (8+1)];                   \
+	x[5] += ks[((r)+5) % (8+1)] + ts[((r)+0) % 3]; \
+	x[6] += ks[((r)+6) % (8+1)] + ts[((r)+1) % 3]; \
+	x[7] += ks[((r)+7) % (8+1)] + (r)
+
+#define ROUND(a,b,c,d,e,f,g,h,k) \
+	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \
+	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c]; \
+	x[e] += x[f]; x[f] = rol64(x[f],k[2]); x[f] ^= x[e]; \
+	x[g] += x[h]; x[h] = rol64(x[h],k[3]); x[h] ^= x[g];
+
+#define PASS(i) \
+	ROUND(0,1,2,3,4,5,6,7,K512_0); \
+	ROUND(2,1,4,7,6,5,0,3,K512_1); \
+	ROUND(4,1,6,3,0,5,2,7,K512_2); \
+	ROUND(6,1,0,7,2,5,4,3,K512_3); \
+	INJECTKEY((i*2) + 1);          \
+	ROUND(0,1,2,3,4,5,6,7,K512_4); \
+	ROUND(2,1,4,7,6,5,0,3,K512_5); \
+	ROUND(4,1,6,3,0,5,2,7,K512_6); \
+	ROUND(6,1,0,7,2,5,4,3,K512_7); \
+	INJECTKEY((i*2) + 2)
+
+	x[0] = le64_to_cpu(buf[0]) + ks[0];
+	x[1] = le64_to_cpu(buf[1]) + ks[1];
+	x[2] = le64_to_cpu(buf[2]) + ks[2];
+	x[3] = le64_to_cpu(buf[3]) + ks[3];
+	x[4] = le64_to_cpu(buf[4]) + ks[4];
+	x[5] = le64_to_cpu(buf[5]) + ks[5] + ts[0];
+	x[6] = le64_to_cpu(buf[6]) + ks[6] + ts[1];
+	x[7] = le64_to_cpu(buf[7]) + ks[7];
+
+	/* 9 pass of 8 rounds = 72 rounds */
+	PASS(0);
+	PASS(1);
+	PASS(2);
+	PASS(3);
+	PASS(4);
+	PASS(5);
+	PASS(6);
+	PASS(7);
+	PASS(8);
+
+	ts[1] &= ~FLAG_FIRST;
+	ctx->t0 = ts[0];
+	ctx->t1 = ts[1];
+
+	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);
+        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);
+        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);
+        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);
+        ctx->h[4] = x[4] ^ cpu_to_le64(buf[4]);
+        ctx->h[5] = x[5] ^ cpu_to_le64(buf[5]);
+        ctx->h[6] = x[6] ^ cpu_to_le64(buf[6]);
+        ctx->h[7] = x[7] ^ cpu_to_le64(buf[7]);
+}
+
+void crypton_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen)
+{
+	uint64_t buf[8];
+	memset(ctx, 0, sizeof(*ctx));
+
+	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));
+	
+	memset(buf, '\0', sizeof(buf));
+	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);
+	buf[1] = cpu_to_le64(hashlen);
+	buf[2] = 0; /* tree info, not implemented */
+	skein512_do_chunk(ctx, buf, 4*8);
+
+	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));
+}
+
+void crypton_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t to_fill;
+
+	if (!len)
+		return;
+
+	to_fill = 64 - ctx->bufindex;
+
+	if (ctx->bufindex == 64) {
+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);
+		ctx->bufindex = 0;
+	}
+
+	/* process partial buffer if there's enough data to make a block
+	 * and there's without doubt further blocks */
+	if (ctx->bufindex && len > to_fill) {
+		memcpy(ctx->buf + ctx->bufindex, data, to_fill);
+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);
+		len -= to_fill;
+		data += to_fill;
+		ctx->bufindex = 0;
+	}
+
+	if (need_alignment(data, 8)) {
+		uint64_t tramp[8];
+		ASSERT_ALIGNMENT(tramp, 8);
+		for (; len > 64; len -= 64, data += 64) {
+			memcpy(tramp, data, 64);
+			skein512_do_chunk(ctx, tramp, 64);
+		}
+	} else {
+		/* process as much 64-block as possible except the last one in case we finalize */
+		for (; len > 64; len -= 64, data += 64)
+			skein512_do_chunk(ctx, (uint64_t *) data, 64);
+	}
+
+	/* append data into buf */
+	if (len) {
+		memcpy(ctx->buf + ctx->bufindex, data, len);
+		ctx->bufindex += len;
+	}
+}
+
+void crypton_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out)
+{
+	uint32_t outsize;
+	uint64_t x[8];
+	int i, j, n;
+
+	ctx->t1 |= FLAG_FINAL;
+	/* if buf is not complete pad with 0 bytes */
+	if (ctx->bufindex < 64)
+		memset(ctx->buf + ctx->bufindex, '\0', 64 - ctx->bufindex);
+	skein512_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);
+
+	memset(ctx->buf, '\0', 64);
+
+	/* make sure we have a 8 bit rounded value */
+	outsize = (hashlen + 7) >> 3;
+
+	/* backup h[0--7] */
+	for (j = 0; j < 8; j++)
+		x[j] = ctx->h[j];
+	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */
+	for (i = 0; i*64 < outsize; i++) {
+		uint64_t w[8];
+		*((uint64_t *) ctx->buf) = cpu_to_le64(i);
+		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));
+		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));
+
+		n = outsize - i * 64;
+		if (n >= 64) n = 64;
+
+		cpu_to_le64_array(w, ctx->h, 8);
+		memcpy(out + i*64, w, n);
+
+		/* restore h[0--7] */
+		for (j = 0; j < 8; j++)
+			ctx->h[j] = x[j];
+	}
+}
diff --git a/cbits/crypton_skein512.h b/cbits/crypton_skein512.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_skein512.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_SKEIN512_H
+#define CRYPTOHASH_SKEIN512_H
+
+#include <stdint.h>
+
+struct skein512_ctx
+{
+	uint8_t  buf[64];
+	uint64_t h[8];
+	uint64_t t0;
+	uint64_t t1;
+	uint32_t bufindex;
+};
+
+#define SKEIN512_CTX_SIZE		sizeof(struct skein512_ctx)
+
+void cryponite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen);
+void cryponite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len);
+void cryponite_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_tiger.c b/cbits/crypton_tiger.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_tiger.c
@@ -0,0 +1,424 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include "crypton_tiger.h"
+#include "crypton_bitfn.h"
+#include "crypton_align.h"
+
+static const uint64_t t1[256] = {
+	0x02aab17cf7e90c5eULL,0xac424b03e243a8ecULL,0x72cd5be30dd5fcd3ULL,0x6d019b93f6f97f3aULL,
+	0xcd9978ffd21f9193ULL,0x7573a1c9708029e2ULL,0xb164326b922a83c3ULL,0x46883eee04915870ULL,
+	0xeaace3057103ece6ULL,0xc54169b808a3535cULL,0x4ce754918ddec47cULL,0x0aa2f4dfdc0df40cULL,
+	0x10b76f18a74dbefaULL,0xc6ccb6235ad1ab6aULL,0x13726121572fe2ffULL,0x1a488c6f199d921eULL,
+	0x4bc9f9f4da0007caULL,0x26f5e6f6e85241c7ULL,0x859079dbea5947b6ULL,0x4f1885c5c99e8c92ULL,
+	0xd78e761ea96f864bULL,0x8e36428c52b5c17dULL,0x69cf6827373063c1ULL,0xb607c93d9bb4c56eULL,
+	0x7d820e760e76b5eaULL,0x645c9cc6f07fdc42ULL,0xbf38a078243342e0ULL,0x5f6b343c9d2e7d04ULL,
+	0xf2c28aeb600b0ec6ULL,0x6c0ed85f7254bcacULL,0x71592281a4db4fe5ULL,0x1967fa69ce0fed9fULL,
+	0xfd5293f8b96545dbULL,0xc879e9d7f2a7600bULL,0x860248920193194eULL,0xa4f9533b2d9cc0b3ULL,
+	0x9053836c15957613ULL,0xdb6dcf8afc357bf1ULL,0x18beea7a7a370f57ULL,0x037117ca50b99066ULL,
+	0x6ab30a9774424a35ULL,0xf4e92f02e325249bULL,0x7739db07061ccae1ULL,0xd8f3b49ceca42a05ULL,
+	0xbd56be3f51382f73ULL,0x45faed5843b0bb28ULL,0x1c813d5c11bf1f83ULL,0x8af0e4b6d75fa169ULL,
+	0x33ee18a487ad9999ULL,0x3c26e8eab1c94410ULL,0xb510102bc0a822f9ULL,0x141eef310ce6123bULL,
+	0xfc65b90059ddb154ULL,0xe0158640c5e0e607ULL,0x884e079826c3a3cfULL,0x930d0d9523c535fdULL,
+	0x35638d754e9a2b00ULL,0x4085fccf40469dd5ULL,0xc4b17ad28be23a4cULL,0xcab2f0fc6a3e6a2eULL,
+	0x2860971a6b943fcdULL,0x3dde6ee212e30446ULL,0x6222f32ae01765aeULL,0x5d550bb5478308feULL,
+	0xa9efa98da0eda22aULL,0xc351a71686c40da7ULL,0x1105586d9c867c84ULL,0xdcffee85fda22853ULL,
+	0xccfbd0262c5eef76ULL,0xbaf294cb8990d201ULL,0xe69464f52afad975ULL,0x94b013afdf133e14ULL,
+	0x06a7d1a32823c958ULL,0x6f95fe5130f61119ULL,0xd92ab34e462c06c0ULL,0xed7bde33887c71d2ULL,
+	0x79746d6e6518393eULL,0x5ba419385d713329ULL,0x7c1ba6b948a97564ULL,0x31987c197bfdac67ULL,
+	0xde6c23c44b053d02ULL,0x581c49fed002d64dULL,0xdd474d6338261571ULL,0xaa4546c3e473d062ULL,
+	0x928fce349455f860ULL,0x48161bbacaab94d9ULL,0x63912430770e6f68ULL,0x6ec8a5e602c6641cULL,
+	0x87282515337ddd2bULL,0x2cda6b42034b701bULL,0xb03d37c181cb096dULL,0xe108438266c71c6fULL,
+	0x2b3180c7eb51b255ULL,0xdf92b82f96c08bbcULL,0x5c68c8c0a632f3baULL,0x5504cc861c3d0556ULL,
+	0xabbfa4e55fb26b8fULL,0x41848b0ab3baceb4ULL,0xb334a273aa445d32ULL,0xbca696f0a85ad881ULL,
+	0x24f6ec65b528d56cULL,0x0ce1512e90f4524aULL,0x4e9dd79d5506d35aULL,0x258905fac6ce9779ULL,
+	0x2019295b3e109b33ULL,0xf8a9478b73a054ccULL,0x2924f2f934417eb0ULL,0x3993357d536d1bc4ULL,
+	0x38a81ac21db6ff8bULL,0x47c4fbf17d6016bfULL,0x1e0faadd7667e3f5ULL,0x7abcff62938beb96ULL,
+	0xa78dad948fc179c9ULL,0x8f1f98b72911e50dULL,0x61e48eae27121a91ULL,0x4d62f7ad31859808ULL,
+	0xeceba345ef5ceaebULL,0xf5ceb25ebc9684ceULL,0xf633e20cb7f76221ULL,0xa32cdf06ab8293e4ULL,
+	0x985a202ca5ee2ca4ULL,0xcf0b8447cc8a8fb1ULL,0x9f765244979859a3ULL,0xa8d516b1a1240017ULL,
+	0x0bd7ba3ebb5dc726ULL,0xe54bca55b86adb39ULL,0x1d7a3afd6c478063ULL,0x519ec608e7669eddULL,
+	0x0e5715a2d149aa23ULL,0x177d4571848ff194ULL,0xeeb55f3241014c22ULL,0x0f5e5ca13a6e2ec2ULL,
+	0x8029927b75f5c361ULL,0xad139fabc3d6e436ULL,0x0d5df1a94ccf402fULL,0x3e8bd948bea5dfc8ULL,
+	0xa5a0d357bd3ff77eULL,0xa2d12e251f74f645ULL,0x66fd9e525e81a082ULL,0x2e0c90ce7f687a49ULL,
+	0xc2e8bcbeba973bc5ULL,0x000001bce509745fULL,0x423777bbe6dab3d6ULL,0xd1661c7eaef06eb5ULL,
+	0xa1781f354daacfd8ULL,0x2d11284a2b16affcULL,0xf1fc4f67fa891d1fULL,0x73ecc25dcb920adaULL,
+	0xae610c22c2a12651ULL,0x96e0a810d356b78aULL,0x5a9a381f2fe7870fULL,0xd5ad62ede94e5530ULL,
+	0xd225e5e8368d1427ULL,0x65977b70c7af4631ULL,0x99f889b2de39d74fULL,0x233f30bf54e1d143ULL,
+	0x9a9675d3d9a63c97ULL,0x5470554ff334f9a8ULL,0x166acb744a4f5688ULL,0x70c74caab2e4aeadULL,
+	0xf0d091646f294d12ULL,0x57b82a89684031d1ULL,0xefd95a5a61be0b6bULL,0x2fbd12e969f2f29aULL,
+	0x9bd37013feff9fe8ULL,0x3f9b0404d6085a06ULL,0x4940c1f3166cfe15ULL,0x09542c4dcdf3defbULL,
+	0xb4c5218385cd5ce3ULL,0xc935b7dc4462a641ULL,0x3417f8a68ed3b63fULL,0xb80959295b215b40ULL,
+	0xf99cdaef3b8c8572ULL,0x018c0614f8fcb95dULL,0x1b14accd1a3acdf3ULL,0x84d471f200bb732dULL,
+	0xc1a3110e95e8da16ULL,0x430a7220bf1a82b8ULL,0xb77e090d39df210eULL,0x5ef4bd9f3cd05e9dULL,
+	0x9d4ff6da7e57a444ULL,0xda1d60e183d4a5f8ULL,0xb287c38417998e47ULL,0xfe3edc121bb31886ULL,
+	0xc7fe3ccc980ccbefULL,0xe46fb590189bfd03ULL,0x3732fd469a4c57dcULL,0x7ef700a07cf1ad65ULL,
+	0x59c64468a31d8859ULL,0x762fb0b4d45b61f6ULL,0x155baed099047718ULL,0x68755e4c3d50baa6ULL,
+	0xe9214e7f22d8b4dfULL,0x2addbf532eac95f4ULL,0x32ae3909b4bd0109ULL,0x834df537b08e3450ULL,
+	0xfa209da84220728dULL,0x9e691d9b9efe23f7ULL,0x0446d288c4ae8d7fULL,0x7b4cc524e169785bULL,
+	0x21d87f0135ca1385ULL,0xcebb400f137b8aa5ULL,0x272e2b66580796beULL,0x3612264125c2b0deULL,
+	0x057702bdad1efbb2ULL,0xd4babb8eacf84be9ULL,0x91583139641bc67bULL,0x8bdc2de08036e024ULL,
+	0x603c8156f49f68edULL,0xf7d236f7dbef5111ULL,0x9727c4598ad21e80ULL,0xa08a0896670a5fd7ULL,
+	0xcb4a8f4309eba9cbULL,0x81af564b0f7036a1ULL,0xc0b99aa778199abdULL,0x959f1ec83fc8e952ULL,
+	0x8c505077794a81b9ULL,0x3acaaf8f056338f0ULL,0x07b43f50627a6778ULL,0x4a44ab49f5eccc77ULL,
+	0x3bc3d6e4b679ee98ULL,0x9cc0d4d1cf14108cULL,0x4406c00b206bc8a0ULL,0x82a18854c8d72d89ULL,
+	0x67e366b35c3c432cULL,0xb923dd61102b37f2ULL,0x56ab2779d884271dULL,0xbe83e1b0ff1525afULL,
+	0xfb7c65d4217e49a9ULL,0x6bdbe0e76d48e7d4ULL,0x08df828745d9179eULL,0x22ea6a9add53bd34ULL,
+	0xe36e141c5622200aULL,0x7f805d1b8cb750eeULL,0xafe5c7a59f58e837ULL,0xe27f996a4fb1c23cULL,
+	0xd3867dfb0775f0d0ULL,0xd0e673de6e88891aULL,0x123aeb9eafb86c25ULL,0x30f1d5d5c145b895ULL,
+	0xbb434a2dee7269e7ULL,0x78cb67ecf931fa38ULL,0xf33b0372323bbf9cULL,0x52d66336fb279c74ULL,
+	0x505f33ac0afb4eaaULL,0xe8a5cd99a2cce187ULL,0x534974801e2d30bbULL,0x8d2d5711d5876d90ULL,
+	0x1f1a412891bc038eULL,0xd6e2e71d82e56648ULL,0x74036c3a497732b7ULL,0x89b67ed96361f5abULL,
+	0xffed95d8f1ea02a2ULL,0xe72b3bd61464d43dULL,0xa6300f170bdc4820ULL,0xebc18760ed78a77aULL,
+};
+
+static const uint64_t t2[256] =
+{
+	0xe6a6be5a05a12138ULL,0xb5a122a5b4f87c98ULL,0x563c6089140b6990ULL,0x4c46cb2e391f5dd5ULL,
+	0xd932addbc9b79434ULL,0x08ea70e42015aff5ULL,0xd765a6673e478cf1ULL,0xc4fb757eab278d99ULL,
+	0xdf11c6862d6e0692ULL,0xddeb84f10d7f3b16ULL,0x6f2ef604a665ea04ULL,0x4a8e0f0ff0e0dfb3ULL,
+	0xa5edeef83dbcba51ULL,0xfc4f0a2a0ea4371eULL,0xe83e1da85cb38429ULL,0xdc8ff882ba1b1ce2ULL,
+	0xcd45505e8353e80dULL,0x18d19a00d4db0717ULL,0x34a0cfeda5f38101ULL,0x0be77e518887caf2ULL,
+	0x1e341438b3c45136ULL,0xe05797f49089ccf9ULL,0xffd23f9df2591d14ULL,0x543dda228595c5cdULL,
+	0x661f81fd99052a33ULL,0x8736e641db0f7b76ULL,0x15227725418e5307ULL,0xe25f7f46162eb2faULL,
+	0x48a8b2126c13d9feULL,0xafdc541792e76eeaULL,0x03d912bfc6d1898fULL,0x31b1aafa1b83f51bULL,
+	0xf1ac2796e42ab7d9ULL,0x40a3a7d7fcd2ebacULL,0x1056136d0afbbcc5ULL,0x7889e1dd9a6d0c85ULL,
+	0xd33525782a7974aaULL,0xa7e25d09078ac09bULL,0xbd4138b3eac6edd0ULL,0x920abfbe71eb9e70ULL,
+	0xa2a5d0f54fc2625cULL,0xc054e36b0b1290a3ULL,0xf6dd59ff62fe932bULL,0x3537354511a8ac7dULL,
+	0xca845e9172fadcd4ULL,0x84f82b60329d20dcULL,0x79c62ce1cd672f18ULL,0x8b09a2add124642cULL,
+	0xd0c1e96a19d9e726ULL,0x5a786a9b4ba9500cULL,0x0e020336634c43f3ULL,0xc17b474aeb66d822ULL,
+	0x6a731ae3ec9baac2ULL,0x8226667ae0840258ULL,0x67d4567691caeca5ULL,0x1d94155c4875adb5ULL,
+	0x6d00fd985b813fdfULL,0x51286efcb774cd06ULL,0x5e8834471fa744afULL,0xf72ca0aee761ae2eULL,
+	0xbe40e4cdaee8e09aULL,0xe9970bbb5118f665ULL,0x726e4beb33df1964ULL,0x703b000729199762ULL,
+	0x4631d816f5ef30a7ULL,0xb880b5b51504a6beULL,0x641793c37ed84b6cULL,0x7b21ed77f6e97d96ULL,
+	0x776306312ef96b73ULL,0xae528948e86ff3f4ULL,0x53dbd7f286a3f8f8ULL,0x16cadce74cfc1063ULL,
+	0x005c19bdfa52c6ddULL,0x68868f5d64d46ad3ULL,0x3a9d512ccf1e186aULL,0x367e62c2385660aeULL,
+	0xe359e7ea77dcb1d7ULL,0x526c0773749abe6eULL,0x735ae5f9d09f734bULL,0x493fc7cc8a558ba8ULL,
+	0xb0b9c1533041ab45ULL,0x321958ba470a59bdULL,0x852db00b5f46c393ULL,0x91209b2bd336b0e5ULL,
+	0x6e604f7d659ef19fULL,0xb99a8ae2782ccb24ULL,0xccf52ab6c814c4c7ULL,0x4727d9afbe11727bULL,
+	0x7e950d0c0121b34dULL,0x756f435670ad471fULL,0xf5add442615a6849ULL,0x4e87e09980b9957aULL,
+	0x2acfa1df50aee355ULL,0xd898263afd2fd556ULL,0xc8f4924dd80c8fd6ULL,0xcf99ca3d754a173aULL,
+	0xfe477bacaf91bf3cULL,0xed5371f6d690c12dULL,0x831a5c285e687094ULL,0xc5d3c90a3708a0a4ULL,
+	0x0f7f903717d06580ULL,0x19f9bb13b8fdf27fULL,0xb1bd6f1b4d502843ULL,0x1c761ba38fff4012ULL,
+	0x0d1530c4e2e21f3bULL,0x8943ce69a7372c8aULL,0xe5184e11feb5ce66ULL,0x618bdb80bd736621ULL,
+	0x7d29bad68b574d0bULL,0x81bb613e25e6fe5bULL,0x071c9c10bc07913fULL,0xc7beeb7909ac2d97ULL,
+	0xc3e58d353bc5d757ULL,0xeb017892f38f61e8ULL,0xd4effb9c9b1cc21aULL,0x99727d26f494f7abULL,
+	0xa3e063a2956b3e03ULL,0x9d4a8b9a4aa09c30ULL,0x3f6ab7d500090fb4ULL,0x9cc0f2a057268ac0ULL,
+	0x3dee9d2dedbf42d1ULL,0x330f49c87960a972ULL,0xc6b2720287421b41ULL,0x0ac59ec07c00369cULL,
+	0xef4eac49cb353425ULL,0xf450244eef0129d8ULL,0x8acc46e5caf4deb6ULL,0x2ffeab63989263f7ULL,
+	0x8f7cb9fe5d7a4578ULL,0x5bd8f7644e634635ULL,0x427a7315bf2dc900ULL,0x17d0c4aa2125261cULL,
+	0x3992486c93518e50ULL,0xb4cbfee0a2d7d4c3ULL,0x7c75d6202c5ddd8dULL,0xdbc295d8e35b6c61ULL,
+	0x60b369d302032b19ULL,0xce42685fdce44132ULL,0x06f3ddb9ddf65610ULL,0x8ea4d21db5e148f0ULL,
+	0x20b0fce62fcd496fULL,0x2c1b912358b0ee31ULL,0xb28317b818f5a308ULL,0xa89c1e189ca6d2cfULL,
+	0x0c6b18576aaadbc8ULL,0xb65deaa91299fae3ULL,0xfb2b794b7f1027e7ULL,0x04e4317f443b5bebULL,
+	0x4b852d325939d0a6ULL,0xd5ae6beefb207ffcULL,0x309682b281c7d374ULL,0xbae309a194c3b475ULL,
+	0x8cc3f97b13b49f05ULL,0x98a9422ff8293967ULL,0x244b16b01076ff7cULL,0xf8bf571c663d67eeULL,
+	0x1f0d6758eee30da1ULL,0xc9b611d97adeb9b7ULL,0xb7afd5887b6c57a2ULL,0x6290ae846b984fe1ULL,
+	0x94df4cdeacc1a5fdULL,0x058a5bd1c5483affULL,0x63166cc142ba3c37ULL,0x8db8526eb2f76f40ULL,
+	0xe10880036f0d6d4eULL,0x9e0523c9971d311dULL,0x45ec2824cc7cd691ULL,0x575b8359e62382c9ULL,
+	0xfa9e400dc4889995ULL,0xd1823ecb45721568ULL,0xdafd983b8206082fULL,0xaa7d29082386a8cbULL,
+	0x269fcd4403b87588ULL,0x1b91f5f728bdd1e0ULL,0xe4669f39040201f6ULL,0x7a1d7c218cf04adeULL,
+	0x65623c29d79ce5ceULL,0x2368449096c00bb1ULL,0xab9bf1879da503baULL,0xbc23ecb1a458058eULL,
+	0x9a58df01bb401eccULL,0xa070e868a85f143dULL,0x4ff188307df2239eULL,0x14d565b41a641183ULL,
+	0xee13337452701602ULL,0x950e3dcf3f285e09ULL,0x59930254b9c80953ULL,0x3bf299408930da6dULL,
+	0xa955943f53691387ULL,0xa15edecaa9cb8784ULL,0x29142127352be9a0ULL,0x76f0371fff4e7afbULL,
+	0x0239f450274f2228ULL,0xbb073af01d5e868bULL,0xbfc80571c10e96c1ULL,0xd267088568222e23ULL,
+	0x9671a3d48e80b5b0ULL,0x55b5d38ae193bb81ULL,0x693ae2d0a18b04b8ULL,0x5c48b4ecadd5335fULL,
+	0xfd743b194916a1caULL,0x2577018134be98c4ULL,0xe77987e83c54a4adULL,0x28e11014da33e1b9ULL,
+	0x270cc59e226aa213ULL,0x71495f756d1a5f60ULL,0x9be853fb60afef77ULL,0xadc786a7f7443dbfULL,
+	0x0904456173b29a82ULL,0x58bc7a66c232bd5eULL,0xf306558c673ac8b2ULL,0x41f639c6b6c9772aULL,
+	0x216defe99fda35daULL,0x11640cc71c7be615ULL,0x93c43694565c5527ULL,0xea038e6246777839ULL,
+	0xf9abf3ce5a3e2469ULL,0x741e768d0fd312d2ULL,0x0144b883ced652c6ULL,0xc20b5a5ba33f8552ULL,
+	0x1ae69633c3435a9dULL,0x97a28ca4088cfdecULL,0x8824a43c1e96f420ULL,0x37612fa66eeea746ULL,
+	0x6b4cb165f9cf0e5aULL,0x43aa1c06a0abfb4aULL,0x7f4dc26ff162796bULL,0x6cbacc8e54ed9b0fULL,
+	0xa6b7ffefd2bb253eULL,0x2e25bc95b0a29d4fULL,0x86d6a58bdef1388cULL,0xded74ac576b6f054ULL,
+	0x8030bdbc2b45805dULL,0x3c81af70e94d9289ULL,0x3eff6dda9e3100dbULL,0xb38dc39fdfcc8847ULL,
+	0x123885528d17b87eULL,0xf2da0ed240b1b642ULL,0x44cefadcd54bf9a9ULL,0x1312200e433c7ee6ULL,
+	0x9ffcc84f3a78c748ULL,0xf0cd1f72248576bbULL,0xec6974053638cfe4ULL,0x2ba7b67c0cec4e4cULL,
+	0xac2f4df3e5ce32edULL,0xcb33d14326ea4c11ULL,0xa4e9044cc77e58bcULL,0x5f513293d934fcefULL,
+	0x5dc9645506e55444ULL,0x50de418f317de40aULL,0x388cb31a69dde259ULL,0x2db4a83455820a86ULL,
+	0x9010a91e84711ae9ULL,0x4df7f0b7b1498371ULL,0xd62a2eabc0977179ULL,0x22fac097aa8d5c0eULL,
+}; 
+
+static const uint64_t t3[256]= {
+	0xf49fcc2ff1daf39bULL,0x487fd5c66ff29281ULL,0xe8a30667fcdca83fULL,0x2c9b4be3d2fcce63ULL,
+	0xda3ff74b93fbbbc2ULL,0x2fa165d2fe70ba66ULL,0xa103e279970e93d4ULL,0xbecdec77b0e45e71ULL,
+	0xcfb41e723985e497ULL,0xb70aaa025ef75017ULL,0xd42309f03840b8e0ULL,0x8efc1ad035898579ULL,
+	0x96c6920be2b2abc5ULL,0x66af4163375a9172ULL,0x2174abdcca7127fbULL,0xb33ccea64a72ff41ULL,
+	0xf04a4933083066a5ULL,0x8d970acdd7289af5ULL,0x8f96e8e031c8c25eULL,0xf3fec02276875d47ULL,
+	0xec7bf310056190ddULL,0xf5adb0aebb0f1491ULL,0x9b50f8850fd58892ULL,0x4975488358b74de8ULL,
+	0xa3354ff691531c61ULL,0x0702bbe481d2c6eeULL,0x89fb24057deded98ULL,0xac3075138596e902ULL,
+	0x1d2d3580172772edULL,0xeb738fc28e6bc30dULL,0x5854ef8f63044326ULL,0x9e5c52325add3bbeULL,
+	0x90aa53cf325c4623ULL,0xc1d24d51349dd067ULL,0x2051cfeea69ea624ULL,0x13220f0a862e7e4fULL,
+	0xce39399404e04864ULL,0xd9c42ca47086fcb7ULL,0x685ad2238a03e7ccULL,0x066484b2ab2ff1dbULL,
+	0xfe9d5d70efbf79ecULL,0x5b13b9dd9c481854ULL,0x15f0d475ed1509adULL,0x0bebcd060ec79851ULL,
+	0xd58c6791183ab7f8ULL,0xd1187c5052f3eee4ULL,0xc95d1192e54e82ffULL,0x86eea14cb9ac6ca2ULL,
+	0x3485beb153677d5dULL,0xdd191d781f8c492aULL,0xf60866baa784ebf9ULL,0x518f643ba2d08c74ULL,
+	0x8852e956e1087c22ULL,0xa768cb8dc410ae8dULL,0x38047726bfec8e1aULL,0xa67738b4cd3b45aaULL,
+	0xad16691cec0dde19ULL,0xc6d4319380462e07ULL,0xc5a5876d0ba61938ULL,0x16b9fa1fa58fd840ULL,
+	0x188ab1173ca74f18ULL,0xabda2f98c99c021fULL,0x3e0580ab134ae816ULL,0x5f3b05b773645abbULL,
+	0x2501a2be5575f2f6ULL,0x1b2f74004e7e8ba9ULL,0x1cd7580371e8d953ULL,0x7f6ed89562764e30ULL,
+	0xb15926ff596f003dULL,0x9f65293da8c5d6b9ULL,0x6ecef04dd690f84cULL,0x4782275fff33af88ULL,
+	0xe41433083f820801ULL,0xfd0dfe409a1af9b5ULL,0x4325a3342cdb396bULL,0x8ae77e62b301b252ULL,
+	0xc36f9e9f6655615aULL,0x85455a2d92d32c09ULL,0xf2c7dea949477485ULL,0x63cfb4c133a39ebaULL,
+	0x83b040cc6ebc5462ULL,0x3b9454c8fdb326b0ULL,0x56f56a9e87ffd78cULL,0x2dc2940d99f42bc6ULL,
+	0x98f7df096b096e2dULL,0x19a6e01e3ad852bfULL,0x42a99ccbdbd4b40bULL,0xa59998af45e9c559ULL,
+	0x366295e807d93186ULL,0x6b48181bfaa1f773ULL,0x1fec57e2157a0a1dULL,0x4667446af6201ad5ULL,
+	0xe615ebcacfb0f075ULL,0xb8f31f4f68290778ULL,0x22713ed6ce22d11eULL,0x3057c1a72ec3c93bULL,
+	0xcb46acc37c3f1f2fULL,0xdbb893fd02aaf50eULL,0x331fd92e600b9fcfULL,0xa498f96148ea3ad6ULL,
+	0xa8d8426e8b6a83eaULL,0xa089b274b7735cdcULL,0x87f6b3731e524a11ULL,0x118808e5cbc96749ULL,
+	0x9906e4c7b19bd394ULL,0xafed7f7e9b24a20cULL,0x6509eadeeb3644a7ULL,0x6c1ef1d3e8ef0edeULL,
+	0xb9c97d43e9798fb4ULL,0xa2f2d784740c28a3ULL,0x7b8496476197566fULL,0x7a5be3e6b65f069dULL,
+	0xf96330ed78be6f10ULL,0xeee60de77a076a15ULL,0x2b4bee4aa08b9bd0ULL,0x6a56a63ec7b8894eULL,
+	0x02121359ba34fef4ULL,0x4cbf99f8283703fcULL,0x398071350caf30c8ULL,0xd0a77a89f017687aULL,
+	0xf1c1a9eb9e423569ULL,0x8c7976282dee8199ULL,0x5d1737a5dd1f7abdULL,0x4f53433c09a9fa80ULL,
+	0xfa8b0c53df7ca1d9ULL,0x3fd9dcbc886ccb77ULL,0xc040917ca91b4720ULL,0x7dd00142f9d1dcdfULL,
+	0x8476fc1d4f387b58ULL,0x23f8e7c5f3316503ULL,0x032a2244e7e37339ULL,0x5c87a5d750f5a74bULL,
+	0x082b4cc43698992eULL,0xdf917becb858f63cULL,0x3270b8fc5bf86ddaULL,0x10ae72bb29b5dd76ULL,
+	0x576ac94e7700362bULL,0x1ad112dac61efb8fULL,0x691bc30ec5faa427ULL,0xff246311cc327143ULL,
+	0x3142368e30e53206ULL,0x71380e31e02ca396ULL,0x958d5c960aad76f1ULL,0xf8d6f430c16da536ULL,
+	0xc8ffd13f1be7e1d2ULL,0x7578ae66004ddbe1ULL,0x05833f01067be646ULL,0xbb34b5ad3bfe586dULL,
+	0x095f34c9a12b97f0ULL,0x247ab64525d60ca8ULL,0xdcdbc6f3017477d1ULL,0x4a2e14d4decad24dULL,
+	0xbdb5e6d9be0a1eebULL,0x2a7e70f7794301abULL,0xdef42d8a270540fdULL,0x01078ec0a34c22c1ULL,
+	0xe5de511af4c16387ULL,0x7ebb3a52bd9a330aULL,0x77697857aa7d6435ULL,0x004e831603ae4c32ULL,
+	0xe7a21020ad78e312ULL,0x9d41a70c6ab420f2ULL,0x28e06c18ea1141e6ULL,0xd2b28cbd984f6b28ULL,
+	0x26b75f6c446e9d83ULL,0xba47568c4d418d7fULL,0xd80badbfe6183d8eULL,0x0e206d7f5f166044ULL,
+	0xe258a43911cbca3eULL,0x723a1746b21dc0bcULL,0xc7caa854f5d7cdd3ULL,0x7cac32883d261d9cULL,
+	0x7690c26423ba942cULL,0x17e55524478042b8ULL,0xe0be477656a2389fULL,0x4d289b5e67ab2da0ULL,
+	0x44862b9c8fbbfd31ULL,0xb47cc8049d141365ULL,0x822c1b362b91c793ULL,0x4eb14655fb13dfd8ULL,
+	0x1ecbba0714e2a97bULL,0x6143459d5cde5f14ULL,0x53a8fbf1d5f0ac89ULL,0x97ea04d81c5e5b00ULL,
+	0x622181a8d4fdb3f3ULL,0xe9bcd341572a1208ULL,0x1411258643cce58aULL,0x9144c5fea4c6e0a4ULL,
+	0x0d33d06565cf620fULL,0x54a48d489f219ca1ULL,0xc43e5eac6d63c821ULL,0xa9728b3a72770dafULL,
+	0xd7934e7b20df87efULL,0xe35503b61a3e86e5ULL,0xcae321fbc819d504ULL,0x129a50b3ac60bfa6ULL,
+	0xcd5e68ea7e9fb6c3ULL,0xb01c90199483b1c7ULL,0x3de93cd5c295376cULL,0xaed52edf2ab9ad13ULL,
+	0x2e60f512c0a07884ULL,0xbc3d86a3e36210c9ULL,0x35269d9b163951ceULL,0x0c7d6e2ad0cdb5faULL,
+	0x59e86297d87f5733ULL,0x298ef221898db0e7ULL,0x55000029d1a5aa7eULL,0x8bc08ae1b5061b45ULL,
+	0xc2c31c2b6c92703aULL,0x94cc596baf25ef42ULL,0x0a1d73db22540456ULL,0x04b6a0f9d9c4179aULL,
+	0xeffdafa2ae3d3c60ULL,0xf7c8075bb49496c4ULL,0x9cc5c7141d1cd4e3ULL,0x78bd1638218e5534ULL,
+	0xb2f11568f850246aULL,0xedfabcfa9502bc29ULL,0x796ce5f2da23051bULL,0xaae128b0dc93537cULL,
+	0x3a493da0ee4b29aeULL,0xb5df6b2c416895d7ULL,0xfcabbd25122d7f37ULL,0x70810b58105dc4b1ULL,
+	0xe10fdd37f7882a90ULL,0x524dcab5518a3f5cULL,0x3c9e85878451255bULL,0x4029828119bd34e2ULL,
+	0x74a05b6f5d3ceccbULL,0xb610021542e13ecaULL,0x0ff979d12f59e2acULL,0x6037da27e4f9cc50ULL,
+	0x5e92975a0df1847dULL,0xd66de190d3e623feULL,0x5032d6b87b568048ULL,0x9a36b7ce8235216eULL,
+	0x80272a7a24f64b4aULL,0x93efed8b8c6916f7ULL,0x37ddbff44cce1555ULL,0x4b95db5d4b99bd25ULL,
+	0x92d3fda169812fc0ULL,0xfb1a4a9a90660bb6ULL,0x730c196946a4b9b2ULL,0x81e289aa7f49da68ULL,
+	0x64669a0f83b1a05fULL,0x27b3ff7d9644f48bULL,0xcc6b615c8db675b3ULL,0x674f20b9bcebbe95ULL,
+	0x6f31238275655982ULL,0x5ae488713e45cf05ULL,0xbf619f9954c21157ULL,0xeabac46040a8eae9ULL,
+	0x454c6fe9f2c0c1cdULL,0x419cf6496412691cULL,0xd3dc3bef265b0f70ULL,0x6d0e60f5c3578a9eULL,
+};
+
+static const uint64_t t4[256]=
+{
+	0x5b0e608526323c55ULL,0x1a46c1a9fa1b59f5ULL, 0xa9e245a17c4c8ffaULL,0x65ca5159db2955d7ULL,
+	0x05db0a76ce35afc2ULL,0x81eac77ea9113d45ULL, 0x528ef88ab6ac0a0dULL,0xa09ea253597be3ffULL,
+	0x430ddfb3ac48cd56ULL,0xc4b3a67af45ce46fULL, 0x4ececfd8fbe2d05eULL,0x3ef56f10b39935f0ULL,
+	0x0b22d6829cd619c6ULL,0x17fd460a74df2069ULL, 0x6cf8cc8e8510ed40ULL,0xd6c824bf3a6ecaa7ULL,
+	0x61243d581a817049ULL,0x048bacb6bbc163a2ULL, 0xd9a38ac27d44cc32ULL,0x7fddff5baaf410abULL,
+	0xad6d495aa804824bULL,0xe1a6a74f2d8c9f94ULL, 0xd4f7851235dee8e3ULL,0xfd4b7f886540d893ULL,
+	0x247c20042aa4bfdaULL,0x096ea1c517d1327cULL, 0xd56966b4361a6685ULL,0x277da5c31221057dULL,
+	0x94d59893a43acff7ULL,0x64f0c51ccdc02281ULL, 0x3d33bcc4ff6189dbULL,0xe005cb184ce66af1ULL,
+	0xff5ccd1d1db99beaULL,0xb0b854a7fe42980fULL, 0x7bd46a6a718d4b9fULL,0xd10fa8cc22a5fd8cULL,
+	0xd31484952be4bd31ULL,0xc7fa975fcb243847ULL, 0x4886ed1e5846c407ULL,0x28cddb791eb70b04ULL,
+	0xc2b00be2f573417fULL,0x5c9590452180f877ULL, 0x7a6bddfff370eb00ULL,0xce509e38d6d9d6a4ULL,
+	0xebeb0f00647fa702ULL,0x1dcc06cf76606f06ULL, 0xe4d9f28ba286ff0aULL,0xd85a305dc918c262ULL,
+	0x475b1d8732225f54ULL,0x2d4fb51668ccb5feULL, 0xa679b9d9d72bba20ULL,0x53841c0d912d43a5ULL,
+	0x3b7eaa48bf12a4e8ULL,0x781e0e47f22f1ddfULL, 0xeff20ce60ab50973ULL,0x20d261d19dffb742ULL,
+	0x16a12b03062a2e39ULL,0x1960eb2239650495ULL, 0x251c16fed50eb8b8ULL,0x9ac0c330f826016eULL,
+	0xed152665953e7671ULL,0x02d63194a6369570ULL, 0x5074f08394b1c987ULL,0x70ba598c90b25ce1ULL,
+	0x794a15810b9742f6ULL,0x0d5925e9fcaf8c6cULL, 0x3067716cd868744eULL,0x910ab077e8d7731bULL,
+	0x6a61bbdb5ac42f61ULL,0x93513efbf0851567ULL, 0xf494724b9e83e9d5ULL,0xe887e1985c09648dULL,
+	0x34b1d3c675370cfdULL,0xdc35e433bc0d255dULL, 0xd0aab84234131be0ULL,0x08042a50b48b7eafULL,
+	0x9997c4ee44a3ab35ULL,0x829a7b49201799d0ULL, 0x263b8307b7c54441ULL,0x752f95f4fd6a6ca6ULL,
+	0x927217402c08c6e5ULL,0x2a8ab754a795d9eeULL, 0xa442f7552f72943dULL,0x2c31334e19781208ULL,
+	0x4fa98d7ceaee6291ULL,0x55c3862f665db309ULL, 0xbd0610175d53b1f3ULL,0x46fe6cb840413f27ULL,
+	0x3fe03792df0cfa59ULL,0xcfe700372eb85e8fULL, 0xa7be29e7adbce118ULL,0xe544ee5cde8431ddULL,
+	0x8a781b1b41f1873eULL,0xa5c94c78a0d2f0e7ULL, 0x39412e2877b60728ULL,0xa1265ef3afc9a62cULL,
+	0xbcc2770c6a2506c5ULL,0x3ab66dd5dce1ce12ULL, 0xe65499d04a675b37ULL,0x7d8f523481bfd216ULL,
+	0x0f6f64fcec15f389ULL,0x74efbe618b5b13c8ULL, 0xacdc82b714273e1dULL,0xdd40bfe003199d17ULL,
+	0x37e99257e7e061f8ULL,0xfa52626904775aaaULL, 0x8bbbf63a463d56f9ULL,0xf0013f1543a26e64ULL,
+	0xa8307e9f879ec898ULL,0xcc4c27a4150177ccULL, 0x1b432f2cca1d3348ULL,0xde1d1f8f9f6fa013ULL,
+	0x606602a047a7ddd6ULL,0xd237ab64cc1cb2c7ULL, 0x9b938e7225fcd1d3ULL,0xec4e03708e0ff476ULL,
+	0xfeb2fbda3d03c12dULL,0xae0bced2ee43889aULL, 0x22cb8923ebfb4f43ULL,0x69360d013cf7396dULL,
+	0x855e3602d2d4e022ULL,0x073805bad01f784cULL, 0x33e17a133852f546ULL,0xdf4874058ac7b638ULL,
+	0xba92b29c678aa14aULL,0x0ce89fc76cfaadcdULL, 0x5f9d4e0908339e34ULL,0xf1afe9291f5923b9ULL,
+	0x6e3480f60f4a265fULL,0xeebf3a2ab29b841cULL, 0xe21938a88f91b4adULL,0x57dfeff845c6d3c3ULL,
+	0x2f006b0bf62caaf2ULL,0x62f479ef6f75ee78ULL, 0x11a55ad41c8916a9ULL,0xf229d29084fed453ULL,
+	0x42f1c27b16b000e6ULL,0x2b1f76749823c074ULL, 0x4b76eca3c2745360ULL,0x8c98f463b91691bdULL,
+	0x14bcc93cf1ade66aULL,0x8885213e6d458397ULL, 0x8e177df0274d4711ULL,0xb49b73b5503f2951ULL,
+	0x10168168c3f96b6bULL,0x0e3d963b63cab0aeULL, 0x8dfc4b5655a1db14ULL,0xf789f1356e14de5cULL,
+	0x683e68af4e51dac1ULL,0xc9a84f9d8d4b0fd9ULL, 0x3691e03f52a0f9d1ULL,0x5ed86e46e1878e80ULL,
+	0x3c711a0e99d07150ULL,0x5a0865b20c4e9310ULL, 0x56fbfc1fe4f0682eULL,0xea8d5de3105edf9bULL,
+	0x71abfdb12379187aULL,0x2eb99de1bee77b9cULL, 0x21ecc0ea33cf4523ULL,0x59a4d7521805c7a1ULL,
+	0x3896f5eb56ae7c72ULL,0xaa638f3db18f75dcULL, 0x9f39358dabe9808eULL,0xb7defa91c00b72acULL,
+	0x6b5541fd62492d92ULL,0x6dc6dee8f92e4d5bULL, 0x353f57abc4beea7eULL,0x735769d6da5690ceULL,
+	0x0a234aa642391484ULL,0xf6f9508028f80d9dULL, 0xb8e319a27ab3f215ULL,0x31ad9c1151341a4dULL,
+	0x773c22a57bef5805ULL,0x45c7561a07968633ULL, 0xf913da9e249dbe36ULL,0xda652d9b78a64c68ULL,
+	0x4c27a97f3bc334efULL,0x76621220e66b17f4ULL, 0x967743899acd7d0bULL,0xf3ee5bcae0ed6782ULL,
+	0x409f753600c879fcULL,0x06d09a39b5926db6ULL, 0x6f83aeb0317ac588ULL,0x01e6ca4a86381f21ULL,
+	0x66ff3462d19f3025ULL,0x72207c24ddfd3bfbULL, 0x4af6b6d3e2ece2ebULL,0x9c994dbec7ea08deULL,
+	0x49ace597b09a8bc4ULL,0xb38c4766cf0797baULL, 0x131b9373c57c2a75ULL,0xb1822cce61931e58ULL,
+	0x9d7555b909ba1c0cULL,0x127fafdd937d11d2ULL, 0x29da3badc66d92e4ULL,0xa2c1d57154c2ecbcULL,
+	0x58c5134d82f6fe24ULL,0x1c3ae3515b62274fULL, 0xe907c82e01cb8126ULL,0xf8ed091913e37fcbULL,
+	0x3249d8f9c80046c9ULL,0x80cf9bede388fb63ULL, 0x1881539a116cf19eULL,0x5103f3f76bd52457ULL,
+	0x15b7e6f5ae47f7a8ULL,0xdbd7c6ded47e9ccfULL, 0x44e55c410228bb1aULL,0xb647d4255edb4e99ULL,
+	0x5d11882bb8aafc30ULL,0xf5098bbb29d3212aULL, 0x8fb5ea14e90296b3ULL,0x677b942157dd025aULL,
+	0xfb58e7c0a390acb5ULL,0x89d3674c83bd4a01ULL, 0x9e2da4df4bf3b93bULL,0xfcc41e328cab4829ULL,
+	0x03f38c96ba582c52ULL,0xcad1bdbd7fd85db2ULL, 0xbbb442c16082ae83ULL,0xb95fe86ba5da9ab0ULL,
+	0xb22e04673771a93fULL,0x845358c9493152d8ULL, 0xbe2a488697b4541eULL,0x95a2dc2dd38e6966ULL,
+	0xc02c11ac923c852bULL,0x2388b1990df2a87bULL, 0x7c8008fa1b4f37beULL,0x1f70d0c84d54e503ULL,
+	0x5490adec7ece57d4ULL,0x002b3c27d9063a3aULL, 0x7eaea3848030a2bfULL,0xc602326ded2003c0ULL,
+	0x83a7287d69a94086ULL,0xc57a5fcb30f57a8aULL, 0xb56844e479ebe779ULL,0xa373b40f05dcbce9ULL,
+	0xd71a786e88570ee2ULL,0x879cbacdbde8f6a0ULL, 0x976ad1bcc164a32fULL,0xab21e25e9666d78bULL,
+	0x901063aae5e5c33cULL,0x9818b34448698d90ULL, 0xe36487ae3e1e8abbULL,0xafbdf931893bdcb4ULL,
+	0x6345a0dc5fbbd519ULL,0x8628fe269b9465caULL, 0x1e5d01603f9c51ecULL,0x4de44006a15049b7ULL,
+	0xbf6c70e5f776cbb1ULL,0x411218f2ef552bedULL, 0xcb0c0708705a36a3ULL,0xe74d14754f986044ULL,
+	0xcd56d9430ea8280eULL,0xc12591d7535f5065ULL, 0xc83223f1720aef96ULL,0xc3a0396f7363a51fULL,
+}; 
+
+void crypton_tiger_init(struct tiger_ctx *ctx)
+{
+	memset(ctx, 0, sizeof(*ctx));
+
+	ctx->h[0] = 0x0123456789abcdefULL;
+	ctx->h[1] = 0xfedcba9876543210ULL;
+	ctx->h[2] = 0xf096a5b4c3b2e187ULL;
+}
+
+static inline void tiger_do_chunk(struct tiger_ctx *ctx, uint64_t *buf)
+{
+	uint64_t x0, x1, x2, x3, x4, x5, x6, x7;
+	uint64_t a,b,c;
+	a = ctx->h[0];
+	b = ctx->h[1];
+	c = ctx->h[2];
+
+	x0 = cpu_to_le64(buf[0]); x1 = cpu_to_le64(buf[1]); x2 = cpu_to_le64(buf[2]); x3 = cpu_to_le64(buf[3]);
+	x4 = cpu_to_le64(buf[4]); x5 = cpu_to_le64(buf[5]); x6 = cpu_to_le64(buf[6]); x7 = cpu_to_le64(buf[7]);
+
+#define BYTEOF(c, n) ((uint8_t) (c >> ((n * 8))))
+
+#define ROUND(a,b,c,x,mul)                                                          \
+	c ^= x;                                                                     \
+	a -= t1[BYTEOF(c,0)] ^ t2[BYTEOF(c,2)] ^ t3[BYTEOF(c,4)] ^ t4[BYTEOF(c,6)]; \
+	b += t4[BYTEOF(c,1)] ^ t3[BYTEOF(c,3)] ^ t2[BYTEOF(c,5)] ^ t1[BYTEOF(c,7)]; \
+	b *= mul;
+
+#define PASS(a,b,c,mul)	     \
+	ROUND(a,b,c,x0,mul); \
+	ROUND(b,c,a,x1,mul); \
+	ROUND(c,a,b,x2,mul); \
+	ROUND(a,b,c,x3,mul); \
+	ROUND(b,c,a,x4,mul); \
+	ROUND(c,a,b,x5,mul); \
+	ROUND(a,b,c,x6,mul); \
+	ROUND(b,c,a,x7,mul)
+
+#define SCHEDULE()                        \
+	x0 -= x7 ^ 0xa5a5a5a5a5a5a5a5ULL; \
+	x1 ^= x0;                         \
+	x2 += x1;                         \
+	x3 -= x2 ^ ((~x1)<<19);           \
+	x4 ^= x3;                         \
+	x5 += x4;                         \
+	x6 -= x5 ^ ((~x4)>>23);           \
+	x7 ^= x6;                         \
+	x0 += x7;                         \
+	x1 -= x0 ^ ((~x7)<<19);           \
+	x2 ^= x1;                         \
+	x3 += x2;                         \
+	x4 -= x3 ^ ((~x2)>>23);           \
+	x5 ^= x4;                         \
+	x6 += x5;                         \
+	x7 -= x6 ^ 0x0123456789abcdefULL
+
+	PASS(a,b,c,5);
+	SCHEDULE();
+	PASS(c,a,b,7);
+	SCHEDULE();
+	PASS(b,c,a,9);
+
+	ctx->h[0] ^= a;
+	ctx->h[1] = b - ctx->h[1];
+	ctx->h[2] += c;
+}
+
+void crypton_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len)
+{
+	uint32_t index, to_fill;
+
+	index = (uint32_t) (ctx->sz & 0x3f);
+	to_fill = 64 - index;
+
+	ctx->sz += len;
+
+	/* process partial buffer if there's enough data to make a block */
+	if (index && len >= to_fill) {
+		memcpy(ctx->buf + index, data, to_fill);
+		tiger_do_chunk(ctx, (uint64_t *) ctx->buf);
+		len -= to_fill;
+		data += to_fill;
+		index = 0;
+	}
+
+	if (need_alignment(data, 8)) {
+		uint64_t tramp[8];
+		ASSERT_ALIGNMENT(tramp, 8);
+		for (; len >= 64; len -= 64, data += 64) {
+			memcpy(tramp, data, 64);
+			tiger_do_chunk(ctx, tramp);
+		}
+	} else {
+		/* process as much 64-block as possible */
+		for (; len >= 64; len -= 64, data += 64)
+			tiger_do_chunk(ctx, (uint64_t *) data);
+	}
+
+	/* append data into buf */
+	if (len)
+		memcpy(ctx->buf + index, data, len);
+}
+
+void crypton_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out)
+{
+	static uint8_t padding[64] = { 0x01, };
+	uint64_t bits;
+	uint32_t index, padlen;
+
+	/* add padding and update data with it */
+	bits = cpu_to_le64(ctx->sz << 3);
+
+	/* pad out to 56 */
+	index = (uint32_t) (ctx->sz & 0x3f);
+	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
+	crypton_tiger_update(ctx, padding, padlen);
+
+	/* append length */
+	crypton_tiger_update(ctx, (uint8_t *) &bits, sizeof(bits));
+
+	/* output hash */
+	store_le64(out   , ctx->h[0]);
+	store_le64(out+ 8, ctx->h[1]);
+	store_le64(out+16, ctx->h[2]);
+}
diff --git a/cbits/crypton_tiger.h b/cbits/crypton_tiger.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_tiger.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef CRYPTOHASH_TIGER_H
+#define CRYPTOHASH_TIGER_H
+
+#include <stdint.h>
+
+struct tiger_ctx
+{
+	uint64_t sz;
+	uint8_t  buf[64];
+	uint64_t h[3];
+};
+
+#define TIGER_DIGEST_SIZE	24
+#define TIGER_CTX_SIZE 		(sizeof(struct tiger_ctx))
+
+void crypton_tiger_init(struct tiger_ctx *ctx);
+void crypton_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len);
+void crypton_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out);
+
+#endif
diff --git a/cbits/crypton_whirlpool.c b/cbits/crypton_whirlpool.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_whirlpool.c
@@ -0,0 +1,1026 @@
+/**
+ * The Whirlpool hashing function.
+ *
+ * <P>
+ * <b>References</b>
+ *
+ * <P>
+ * The Whirlpool algorithm was developed by
+ * <a href="mailto:pbarreto@scopus.com.br">Paulo S. L. M. Barreto</a> and
+ * <a href="mailto:vincent.rijmen@cryptomathic.com">Vincent Rijmen</a>.
+ *
+ * See
+ *      P.S.L.M. Barreto, V. Rijmen,
+ *      ``The Whirlpool hashing function,''
+ *      NESSIE submission, 2000 (tweaked version, 2001),
+ *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>
+ * 
+ * @author  Paulo S.L.M. Barreto
+ * @author  Vincent Rijmen.
+ *
+ * @version 3.0 (2003.03.12)
+ *
+ * =============================================================================
+ *
+ * Differences from version 2.1:
+ *
+ * - Suboptimal diffusion matrix replaced by cir(1, 1, 4, 1, 8, 5, 2, 9).
+ *
+ * =============================================================================
+ *
+ * Differences from version 2.0:
+ *
+ * - Generation of ISO/IEC 10118-3 test vectors.
+ * - Bug fix: nonzero carry was ignored when tallying the data length
+ *      (this bug apparently only manifested itself when feeding data
+ *      in pieces rather than in a single chunk at once).
+ * - Support for MS Visual C++ 64-bit integer arithmetic.
+ *
+ * Differences from version 1.0:
+ *
+ * - Original S-box replaced by the tweaked, hardware-efficient version.
+ *
+ * =============================================================================
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+ * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+ * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+/* Modified by Stijn van Drongelen for use in the cryptohash library.
+*/
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "crypton_bitfn.h"
+#include "crypton_whirlpool.h"
+
+/* #define TRACE_INTERMEDIATE_VALUES */
+
+/*
+ * The number of rounds of the internal dedicated block cipher.
+ */
+#define R 10
+
+/*
+ * Though Whirlpool is endianness-neutral, the encryption tables are listed
+ * in BIG-ENDIAN format, which is adopted throughout this implementation
+ * (but little-endian notation would be equally suitable if consistently
+ * employed).
+ */
+
+static const uint64_t C0[256] = {
+	0x18186018c07830d8ULL, 0x23238c2305af4626ULL, 0xc6c63fc67ef991b8ULL, 0xe8e887e8136fcdfbULL,
+	0x878726874ca113cbULL, 0xb8b8dab8a9626d11ULL, 0x0101040108050209ULL, 0x4f4f214f426e9e0dULL,
+	0x3636d836adee6c9bULL, 0xa6a6a2a6590451ffULL, 0xd2d26fd2debdb90cULL, 0xf5f5f3f5fb06f70eULL,
+	0x7979f979ef80f296ULL, 0x6f6fa16f5fcede30ULL, 0x91917e91fcef3f6dULL, 0x52525552aa07a4f8ULL,
+	0x60609d6027fdc047ULL, 0xbcbccabc89766535ULL, 0x9b9b569baccd2b37ULL, 0x8e8e028e048c018aULL,
+	0xa3a3b6a371155bd2ULL, 0x0c0c300c603c186cULL, 0x7b7bf17bff8af684ULL, 0x3535d435b5e16a80ULL,
+	0x1d1d741de8693af5ULL, 0xe0e0a7e05347ddb3ULL, 0xd7d77bd7f6acb321ULL, 0xc2c22fc25eed999cULL,
+	0x2e2eb82e6d965c43ULL, 0x4b4b314b627a9629ULL, 0xfefedffea321e15dULL, 0x575741578216aed5ULL,
+	0x15155415a8412abdULL, 0x7777c1779fb6eee8ULL, 0x3737dc37a5eb6e92ULL, 0xe5e5b3e57b56d79eULL,
+	0x9f9f469f8cd92313ULL, 0xf0f0e7f0d317fd23ULL, 0x4a4a354a6a7f9420ULL, 0xdada4fda9e95a944ULL,
+	0x58587d58fa25b0a2ULL, 0xc9c903c906ca8fcfULL, 0x2929a429558d527cULL, 0x0a0a280a5022145aULL,
+	0xb1b1feb1e14f7f50ULL, 0xa0a0baa0691a5dc9ULL, 0x6b6bb16b7fdad614ULL, 0x85852e855cab17d9ULL,
+	0xbdbdcebd8173673cULL, 0x5d5d695dd234ba8fULL, 0x1010401080502090ULL, 0xf4f4f7f4f303f507ULL,
+	0xcbcb0bcb16c08bddULL, 0x3e3ef83eedc67cd3ULL, 0x0505140528110a2dULL, 0x676781671fe6ce78ULL,
+	0xe4e4b7e47353d597ULL, 0x27279c2725bb4e02ULL, 0x4141194132588273ULL, 0x8b8b168b2c9d0ba7ULL,
+	0xa7a7a6a7510153f6ULL, 0x7d7de97dcf94fab2ULL, 0x95956e95dcfb3749ULL, 0xd8d847d88e9fad56ULL,
+	0xfbfbcbfb8b30eb70ULL, 0xeeee9fee2371c1cdULL, 0x7c7ced7cc791f8bbULL, 0x6666856617e3cc71ULL,
+	0xdddd53dda68ea77bULL, 0x17175c17b84b2eafULL, 0x4747014702468e45ULL, 0x9e9e429e84dc211aULL,
+	0xcaca0fca1ec589d4ULL, 0x2d2db42d75995a58ULL, 0xbfbfc6bf9179632eULL, 0x07071c07381b0e3fULL,
+	0xadad8ead012347acULL, 0x5a5a755aea2fb4b0ULL, 0x838336836cb51befULL, 0x3333cc3385ff66b6ULL,
+	0x636391633ff2c65cULL, 0x02020802100a0412ULL, 0xaaaa92aa39384993ULL, 0x7171d971afa8e2deULL,
+	0xc8c807c80ecf8dc6ULL, 0x19196419c87d32d1ULL, 0x494939497270923bULL, 0xd9d943d9869aaf5fULL,
+	0xf2f2eff2c31df931ULL, 0xe3e3abe34b48dba8ULL, 0x5b5b715be22ab6b9ULL, 0x88881a8834920dbcULL,
+	0x9a9a529aa4c8293eULL, 0x262698262dbe4c0bULL, 0x3232c8328dfa64bfULL, 0xb0b0fab0e94a7d59ULL,
+	0xe9e983e91b6acff2ULL, 0x0f0f3c0f78331e77ULL, 0xd5d573d5e6a6b733ULL, 0x80803a8074ba1df4ULL,
+	0xbebec2be997c6127ULL, 0xcdcd13cd26de87ebULL, 0x3434d034bde46889ULL, 0x48483d487a759032ULL,
+	0xffffdbffab24e354ULL, 0x7a7af57af78ff48dULL, 0x90907a90f4ea3d64ULL, 0x5f5f615fc23ebe9dULL,
+	0x202080201da0403dULL, 0x6868bd6867d5d00fULL, 0x1a1a681ad07234caULL, 0xaeae82ae192c41b7ULL,
+	0xb4b4eab4c95e757dULL, 0x54544d549a19a8ceULL, 0x93937693ece53b7fULL, 0x222288220daa442fULL,
+	0x64648d6407e9c863ULL, 0xf1f1e3f1db12ff2aULL, 0x7373d173bfa2e6ccULL, 0x12124812905a2482ULL,
+	0x40401d403a5d807aULL, 0x0808200840281048ULL, 0xc3c32bc356e89b95ULL, 0xecec97ec337bc5dfULL,
+	0xdbdb4bdb9690ab4dULL, 0xa1a1bea1611f5fc0ULL, 0x8d8d0e8d1c830791ULL, 0x3d3df43df5c97ac8ULL,
+	0x97976697ccf1335bULL, 0x0000000000000000ULL, 0xcfcf1bcf36d483f9ULL, 0x2b2bac2b4587566eULL,
+	0x7676c57697b3ece1ULL, 0x8282328264b019e6ULL, 0xd6d67fd6fea9b128ULL, 0x1b1b6c1bd87736c3ULL,
+	0xb5b5eeb5c15b7774ULL, 0xafaf86af112943beULL, 0x6a6ab56a77dfd41dULL, 0x50505d50ba0da0eaULL,
+	0x45450945124c8a57ULL, 0xf3f3ebf3cb18fb38ULL, 0x3030c0309df060adULL, 0xefef9bef2b74c3c4ULL,
+	0x3f3ffc3fe5c37edaULL, 0x55554955921caac7ULL, 0xa2a2b2a2791059dbULL, 0xeaea8fea0365c9e9ULL,
+	0x656589650fecca6aULL, 0xbabad2bab9686903ULL, 0x2f2fbc2f65935e4aULL, 0xc0c027c04ee79d8eULL,
+	0xdede5fdebe81a160ULL, 0x1c1c701ce06c38fcULL, 0xfdfdd3fdbb2ee746ULL, 0x4d4d294d52649a1fULL,
+	0x92927292e4e03976ULL, 0x7575c9758fbceafaULL, 0x06061806301e0c36ULL, 0x8a8a128a249809aeULL,
+	0xb2b2f2b2f940794bULL, 0xe6e6bfe66359d185ULL, 0x0e0e380e70361c7eULL, 0x1f1f7c1ff8633ee7ULL,
+	0x6262956237f7c455ULL, 0xd4d477d4eea3b53aULL, 0xa8a89aa829324d81ULL, 0x96966296c4f43152ULL,
+	0xf9f9c3f99b3aef62ULL, 0xc5c533c566f697a3ULL, 0x2525942535b14a10ULL, 0x59597959f220b2abULL,
+	0x84842a8454ae15d0ULL, 0x7272d572b7a7e4c5ULL, 0x3939e439d5dd72ecULL, 0x4c4c2d4c5a619816ULL,
+	0x5e5e655eca3bbc94ULL, 0x7878fd78e785f09fULL, 0x3838e038ddd870e5ULL, 0x8c8c0a8c14860598ULL,
+	0xd1d163d1c6b2bf17ULL, 0xa5a5aea5410b57e4ULL, 0xe2e2afe2434dd9a1ULL, 0x616199612ff8c24eULL,
+	0xb3b3f6b3f1457b42ULL, 0x2121842115a54234ULL, 0x9c9c4a9c94d62508ULL, 0x1e1e781ef0663ceeULL,
+	0x4343114322528661ULL, 0xc7c73bc776fc93b1ULL, 0xfcfcd7fcb32be54fULL, 0x0404100420140824ULL,
+	0x51515951b208a2e3ULL, 0x99995e99bcc72f25ULL, 0x6d6da96d4fc4da22ULL, 0x0d0d340d68391a65ULL,
+	0xfafacffa8335e979ULL, 0xdfdf5bdfb684a369ULL, 0x7e7ee57ed79bfca9ULL, 0x242490243db44819ULL,
+	0x3b3bec3bc5d776feULL, 0xabab96ab313d4b9aULL, 0xcece1fce3ed181f0ULL, 0x1111441188552299ULL,
+	0x8f8f068f0c890383ULL, 0x4e4e254e4a6b9c04ULL, 0xb7b7e6b7d1517366ULL, 0xebeb8beb0b60cbe0ULL,
+	0x3c3cf03cfdcc78c1ULL, 0x81813e817cbf1ffdULL, 0x94946a94d4fe3540ULL, 0xf7f7fbf7eb0cf31cULL,
+	0xb9b9deb9a1676f18ULL, 0x13134c13985f268bULL, 0x2c2cb02c7d9c5851ULL, 0xd3d36bd3d6b8bb05ULL,
+	0xe7e7bbe76b5cd38cULL, 0x6e6ea56e57cbdc39ULL, 0xc4c437c46ef395aaULL, 0x03030c03180f061bULL,
+	0x565645568a13acdcULL, 0x44440d441a49885eULL, 0x7f7fe17fdf9efea0ULL, 0xa9a99ea921374f88ULL,
+	0x2a2aa82a4d825467ULL, 0xbbbbd6bbb16d6b0aULL, 0xc1c123c146e29f87ULL, 0x53535153a202a6f1ULL,
+	0xdcdc57dcae8ba572ULL, 0x0b0b2c0b58271653ULL, 0x9d9d4e9d9cd32701ULL, 0x6c6cad6c47c1d82bULL,
+	0x3131c43195f562a4ULL, 0x7474cd7487b9e8f3ULL, 0xf6f6fff6e309f115ULL, 0x464605460a438c4cULL,
+	0xacac8aac092645a5ULL, 0x89891e893c970fb5ULL, 0x14145014a04428b4ULL, 0xe1e1a3e15b42dfbaULL,
+	0x16165816b04e2ca6ULL, 0x3a3ae83acdd274f7ULL, 0x6969b9696fd0d206ULL, 0x09092409482d1241ULL,
+	0x7070dd70a7ade0d7ULL, 0xb6b6e2b6d954716fULL, 0xd0d067d0ceb7bd1eULL, 0xeded93ed3b7ec7d6ULL,
+	0xcccc17cc2edb85e2ULL, 0x424215422a578468ULL, 0x98985a98b4c22d2cULL, 0xa4a4aaa4490e55edULL,
+	0x2828a0285d885075ULL, 0x5c5c6d5cda31b886ULL, 0xf8f8c7f8933fed6bULL, 0x8686228644a411c2ULL,
+};
+
+static const uint64_t C1[256] = {
+	0xd818186018c07830ULL, 0x2623238c2305af46ULL, 0xb8c6c63fc67ef991ULL, 0xfbe8e887e8136fcdULL,
+	0xcb878726874ca113ULL, 0x11b8b8dab8a9626dULL, 0x0901010401080502ULL, 0x0d4f4f214f426e9eULL,
+	0x9b3636d836adee6cULL, 0xffa6a6a2a6590451ULL, 0x0cd2d26fd2debdb9ULL, 0x0ef5f5f3f5fb06f7ULL,
+	0x967979f979ef80f2ULL, 0x306f6fa16f5fcedeULL, 0x6d91917e91fcef3fULL, 0xf852525552aa07a4ULL,
+	0x4760609d6027fdc0ULL, 0x35bcbccabc897665ULL, 0x379b9b569baccd2bULL, 0x8a8e8e028e048c01ULL,
+	0xd2a3a3b6a371155bULL, 0x6c0c0c300c603c18ULL, 0x847b7bf17bff8af6ULL, 0x803535d435b5e16aULL,
+	0xf51d1d741de8693aULL, 0xb3e0e0a7e05347ddULL, 0x21d7d77bd7f6acb3ULL, 0x9cc2c22fc25eed99ULL,
+	0x432e2eb82e6d965cULL, 0x294b4b314b627a96ULL, 0x5dfefedffea321e1ULL, 0xd5575741578216aeULL,
+	0xbd15155415a8412aULL, 0xe87777c1779fb6eeULL, 0x923737dc37a5eb6eULL, 0x9ee5e5b3e57b56d7ULL,
+	0x139f9f469f8cd923ULL, 0x23f0f0e7f0d317fdULL, 0x204a4a354a6a7f94ULL, 0x44dada4fda9e95a9ULL,
+	0xa258587d58fa25b0ULL, 0xcfc9c903c906ca8fULL, 0x7c2929a429558d52ULL, 0x5a0a0a280a502214ULL,
+	0x50b1b1feb1e14f7fULL, 0xc9a0a0baa0691a5dULL, 0x146b6bb16b7fdad6ULL, 0xd985852e855cab17ULL,
+	0x3cbdbdcebd817367ULL, 0x8f5d5d695dd234baULL, 0x9010104010805020ULL, 0x07f4f4f7f4f303f5ULL,
+	0xddcbcb0bcb16c08bULL, 0xd33e3ef83eedc67cULL, 0x2d0505140528110aULL, 0x78676781671fe6ceULL,
+	0x97e4e4b7e47353d5ULL, 0x0227279c2725bb4eULL, 0x7341411941325882ULL, 0xa78b8b168b2c9d0bULL,
+	0xf6a7a7a6a7510153ULL, 0xb27d7de97dcf94faULL, 0x4995956e95dcfb37ULL, 0x56d8d847d88e9fadULL,
+	0x70fbfbcbfb8b30ebULL, 0xcdeeee9fee2371c1ULL, 0xbb7c7ced7cc791f8ULL, 0x716666856617e3ccULL,
+	0x7bdddd53dda68ea7ULL, 0xaf17175c17b84b2eULL, 0x454747014702468eULL, 0x1a9e9e429e84dc21ULL,
+	0xd4caca0fca1ec589ULL, 0x582d2db42d75995aULL, 0x2ebfbfc6bf917963ULL, 0x3f07071c07381b0eULL,
+	0xacadad8ead012347ULL, 0xb05a5a755aea2fb4ULL, 0xef838336836cb51bULL, 0xb63333cc3385ff66ULL,
+	0x5c636391633ff2c6ULL, 0x1202020802100a04ULL, 0x93aaaa92aa393849ULL, 0xde7171d971afa8e2ULL,
+	0xc6c8c807c80ecf8dULL, 0xd119196419c87d32ULL, 0x3b49493949727092ULL, 0x5fd9d943d9869aafULL,
+	0x31f2f2eff2c31df9ULL, 0xa8e3e3abe34b48dbULL, 0xb95b5b715be22ab6ULL, 0xbc88881a8834920dULL,
+	0x3e9a9a529aa4c829ULL, 0x0b262698262dbe4cULL, 0xbf3232c8328dfa64ULL, 0x59b0b0fab0e94a7dULL,
+	0xf2e9e983e91b6acfULL, 0x770f0f3c0f78331eULL, 0x33d5d573d5e6a6b7ULL, 0xf480803a8074ba1dULL,
+	0x27bebec2be997c61ULL, 0xebcdcd13cd26de87ULL, 0x893434d034bde468ULL, 0x3248483d487a7590ULL,
+	0x54ffffdbffab24e3ULL, 0x8d7a7af57af78ff4ULL, 0x6490907a90f4ea3dULL, 0x9d5f5f615fc23ebeULL,
+	0x3d202080201da040ULL, 0x0f6868bd6867d5d0ULL, 0xca1a1a681ad07234ULL, 0xb7aeae82ae192c41ULL,
+	0x7db4b4eab4c95e75ULL, 0xce54544d549a19a8ULL, 0x7f93937693ece53bULL, 0x2f222288220daa44ULL,
+	0x6364648d6407e9c8ULL, 0x2af1f1e3f1db12ffULL, 0xcc7373d173bfa2e6ULL, 0x8212124812905a24ULL,
+	0x7a40401d403a5d80ULL, 0x4808082008402810ULL, 0x95c3c32bc356e89bULL, 0xdfecec97ec337bc5ULL,
+	0x4ddbdb4bdb9690abULL, 0xc0a1a1bea1611f5fULL, 0x918d8d0e8d1c8307ULL, 0xc83d3df43df5c97aULL,
+	0x5b97976697ccf133ULL, 0x0000000000000000ULL, 0xf9cfcf1bcf36d483ULL, 0x6e2b2bac2b458756ULL,
+	0xe17676c57697b3ecULL, 0xe68282328264b019ULL, 0x28d6d67fd6fea9b1ULL, 0xc31b1b6c1bd87736ULL,
+	0x74b5b5eeb5c15b77ULL, 0xbeafaf86af112943ULL, 0x1d6a6ab56a77dfd4ULL, 0xea50505d50ba0da0ULL,
+	0x5745450945124c8aULL, 0x38f3f3ebf3cb18fbULL, 0xad3030c0309df060ULL, 0xc4efef9bef2b74c3ULL,
+	0xda3f3ffc3fe5c37eULL, 0xc755554955921caaULL, 0xdba2a2b2a2791059ULL, 0xe9eaea8fea0365c9ULL,
+	0x6a656589650feccaULL, 0x03babad2bab96869ULL, 0x4a2f2fbc2f65935eULL, 0x8ec0c027c04ee79dULL,
+	0x60dede5fdebe81a1ULL, 0xfc1c1c701ce06c38ULL, 0x46fdfdd3fdbb2ee7ULL, 0x1f4d4d294d52649aULL,
+	0x7692927292e4e039ULL, 0xfa7575c9758fbceaULL, 0x3606061806301e0cULL, 0xae8a8a128a249809ULL,
+	0x4bb2b2f2b2f94079ULL, 0x85e6e6bfe66359d1ULL, 0x7e0e0e380e70361cULL, 0xe71f1f7c1ff8633eULL,
+	0x556262956237f7c4ULL, 0x3ad4d477d4eea3b5ULL, 0x81a8a89aa829324dULL, 0x5296966296c4f431ULL,
+	0x62f9f9c3f99b3aefULL, 0xa3c5c533c566f697ULL, 0x102525942535b14aULL, 0xab59597959f220b2ULL,
+	0xd084842a8454ae15ULL, 0xc57272d572b7a7e4ULL, 0xec3939e439d5dd72ULL, 0x164c4c2d4c5a6198ULL,
+	0x945e5e655eca3bbcULL, 0x9f7878fd78e785f0ULL, 0xe53838e038ddd870ULL, 0x988c8c0a8c148605ULL,
+	0x17d1d163d1c6b2bfULL, 0xe4a5a5aea5410b57ULL, 0xa1e2e2afe2434dd9ULL, 0x4e616199612ff8c2ULL,
+	0x42b3b3f6b3f1457bULL, 0x342121842115a542ULL, 0x089c9c4a9c94d625ULL, 0xee1e1e781ef0663cULL,
+	0x6143431143225286ULL, 0xb1c7c73bc776fc93ULL, 0x4ffcfcd7fcb32be5ULL, 0x2404041004201408ULL,
+	0xe351515951b208a2ULL, 0x2599995e99bcc72fULL, 0x226d6da96d4fc4daULL, 0x650d0d340d68391aULL,
+	0x79fafacffa8335e9ULL, 0x69dfdf5bdfb684a3ULL, 0xa97e7ee57ed79bfcULL, 0x19242490243db448ULL,
+	0xfe3b3bec3bc5d776ULL, 0x9aabab96ab313d4bULL, 0xf0cece1fce3ed181ULL, 0x9911114411885522ULL,
+	0x838f8f068f0c8903ULL, 0x044e4e254e4a6b9cULL, 0x66b7b7e6b7d15173ULL, 0xe0ebeb8beb0b60cbULL,
+	0xc13c3cf03cfdcc78ULL, 0xfd81813e817cbf1fULL, 0x4094946a94d4fe35ULL, 0x1cf7f7fbf7eb0cf3ULL,
+	0x18b9b9deb9a1676fULL, 0x8b13134c13985f26ULL, 0x512c2cb02c7d9c58ULL, 0x05d3d36bd3d6b8bbULL,
+	0x8ce7e7bbe76b5cd3ULL, 0x396e6ea56e57cbdcULL, 0xaac4c437c46ef395ULL, 0x1b03030c03180f06ULL,
+	0xdc565645568a13acULL, 0x5e44440d441a4988ULL, 0xa07f7fe17fdf9efeULL, 0x88a9a99ea921374fULL,
+	0x672a2aa82a4d8254ULL, 0x0abbbbd6bbb16d6bULL, 0x87c1c123c146e29fULL, 0xf153535153a202a6ULL,
+	0x72dcdc57dcae8ba5ULL, 0x530b0b2c0b582716ULL, 0x019d9d4e9d9cd327ULL, 0x2b6c6cad6c47c1d8ULL,
+	0xa43131c43195f562ULL, 0xf37474cd7487b9e8ULL, 0x15f6f6fff6e309f1ULL, 0x4c464605460a438cULL,
+	0xa5acac8aac092645ULL, 0xb589891e893c970fULL, 0xb414145014a04428ULL, 0xbae1e1a3e15b42dfULL,
+	0xa616165816b04e2cULL, 0xf73a3ae83acdd274ULL, 0x066969b9696fd0d2ULL, 0x4109092409482d12ULL,
+	0xd77070dd70a7ade0ULL, 0x6fb6b6e2b6d95471ULL, 0x1ed0d067d0ceb7bdULL, 0xd6eded93ed3b7ec7ULL,
+	0xe2cccc17cc2edb85ULL, 0x68424215422a5784ULL, 0x2c98985a98b4c22dULL, 0xeda4a4aaa4490e55ULL,
+	0x752828a0285d8850ULL, 0x865c5c6d5cda31b8ULL, 0x6bf8f8c7f8933fedULL, 0xc28686228644a411ULL,
+};
+
+static const uint64_t C2[256] = {
+	0x30d818186018c078ULL, 0x462623238c2305afULL, 0x91b8c6c63fc67ef9ULL, 0xcdfbe8e887e8136fULL,
+	0x13cb878726874ca1ULL, 0x6d11b8b8dab8a962ULL, 0x0209010104010805ULL, 0x9e0d4f4f214f426eULL,
+	0x6c9b3636d836adeeULL, 0x51ffa6a6a2a65904ULL, 0xb90cd2d26fd2debdULL, 0xf70ef5f5f3f5fb06ULL,
+	0xf2967979f979ef80ULL, 0xde306f6fa16f5fceULL, 0x3f6d91917e91fcefULL, 0xa4f852525552aa07ULL,
+	0xc04760609d6027fdULL, 0x6535bcbccabc8976ULL, 0x2b379b9b569baccdULL, 0x018a8e8e028e048cULL,
+	0x5bd2a3a3b6a37115ULL, 0x186c0c0c300c603cULL, 0xf6847b7bf17bff8aULL, 0x6a803535d435b5e1ULL,
+	0x3af51d1d741de869ULL, 0xddb3e0e0a7e05347ULL, 0xb321d7d77bd7f6acULL, 0x999cc2c22fc25eedULL,
+	0x5c432e2eb82e6d96ULL, 0x96294b4b314b627aULL, 0xe15dfefedffea321ULL, 0xaed5575741578216ULL,
+	0x2abd15155415a841ULL, 0xeee87777c1779fb6ULL, 0x6e923737dc37a5ebULL, 0xd79ee5e5b3e57b56ULL,
+	0x23139f9f469f8cd9ULL, 0xfd23f0f0e7f0d317ULL, 0x94204a4a354a6a7fULL, 0xa944dada4fda9e95ULL,
+	0xb0a258587d58fa25ULL, 0x8fcfc9c903c906caULL, 0x527c2929a429558dULL, 0x145a0a0a280a5022ULL,
+	0x7f50b1b1feb1e14fULL, 0x5dc9a0a0baa0691aULL, 0xd6146b6bb16b7fdaULL, 0x17d985852e855cabULL,
+	0x673cbdbdcebd8173ULL, 0xba8f5d5d695dd234ULL, 0x2090101040108050ULL, 0xf507f4f4f7f4f303ULL,
+	0x8bddcbcb0bcb16c0ULL, 0x7cd33e3ef83eedc6ULL, 0x0a2d050514052811ULL, 0xce78676781671fe6ULL,
+	0xd597e4e4b7e47353ULL, 0x4e0227279c2725bbULL, 0x8273414119413258ULL, 0x0ba78b8b168b2c9dULL,
+	0x53f6a7a7a6a75101ULL, 0xfab27d7de97dcf94ULL, 0x374995956e95dcfbULL, 0xad56d8d847d88e9fULL,
+	0xeb70fbfbcbfb8b30ULL, 0xc1cdeeee9fee2371ULL, 0xf8bb7c7ced7cc791ULL, 0xcc716666856617e3ULL,
+	0xa77bdddd53dda68eULL, 0x2eaf17175c17b84bULL, 0x8e45474701470246ULL, 0x211a9e9e429e84dcULL,
+	0x89d4caca0fca1ec5ULL, 0x5a582d2db42d7599ULL, 0x632ebfbfc6bf9179ULL, 0x0e3f07071c07381bULL,
+	0x47acadad8ead0123ULL, 0xb4b05a5a755aea2fULL, 0x1bef838336836cb5ULL, 0x66b63333cc3385ffULL,
+	0xc65c636391633ff2ULL, 0x041202020802100aULL, 0x4993aaaa92aa3938ULL, 0xe2de7171d971afa8ULL,
+	0x8dc6c8c807c80ecfULL, 0x32d119196419c87dULL, 0x923b494939497270ULL, 0xaf5fd9d943d9869aULL,
+	0xf931f2f2eff2c31dULL, 0xdba8e3e3abe34b48ULL, 0xb6b95b5b715be22aULL, 0x0dbc88881a883492ULL,
+	0x293e9a9a529aa4c8ULL, 0x4c0b262698262dbeULL, 0x64bf3232c8328dfaULL, 0x7d59b0b0fab0e94aULL,
+	0xcff2e9e983e91b6aULL, 0x1e770f0f3c0f7833ULL, 0xb733d5d573d5e6a6ULL, 0x1df480803a8074baULL,
+	0x6127bebec2be997cULL, 0x87ebcdcd13cd26deULL, 0x68893434d034bde4ULL, 0x903248483d487a75ULL,
+	0xe354ffffdbffab24ULL, 0xf48d7a7af57af78fULL, 0x3d6490907a90f4eaULL, 0xbe9d5f5f615fc23eULL,
+	0x403d202080201da0ULL, 0xd00f6868bd6867d5ULL, 0x34ca1a1a681ad072ULL, 0x41b7aeae82ae192cULL,
+	0x757db4b4eab4c95eULL, 0xa8ce54544d549a19ULL, 0x3b7f93937693ece5ULL, 0x442f222288220daaULL,
+	0xc86364648d6407e9ULL, 0xff2af1f1e3f1db12ULL, 0xe6cc7373d173bfa2ULL, 0x248212124812905aULL,
+	0x807a40401d403a5dULL, 0x1048080820084028ULL, 0x9b95c3c32bc356e8ULL, 0xc5dfecec97ec337bULL,
+	0xab4ddbdb4bdb9690ULL, 0x5fc0a1a1bea1611fULL, 0x07918d8d0e8d1c83ULL, 0x7ac83d3df43df5c9ULL,
+	0x335b97976697ccf1ULL, 0x0000000000000000ULL, 0x83f9cfcf1bcf36d4ULL, 0x566e2b2bac2b4587ULL,
+	0xece17676c57697b3ULL, 0x19e68282328264b0ULL, 0xb128d6d67fd6fea9ULL, 0x36c31b1b6c1bd877ULL,
+	0x7774b5b5eeb5c15bULL, 0x43beafaf86af1129ULL, 0xd41d6a6ab56a77dfULL, 0xa0ea50505d50ba0dULL,
+	0x8a5745450945124cULL, 0xfb38f3f3ebf3cb18ULL, 0x60ad3030c0309df0ULL, 0xc3c4efef9bef2b74ULL,
+	0x7eda3f3ffc3fe5c3ULL, 0xaac755554955921cULL, 0x59dba2a2b2a27910ULL, 0xc9e9eaea8fea0365ULL,
+	0xca6a656589650fecULL, 0x6903babad2bab968ULL, 0x5e4a2f2fbc2f6593ULL, 0x9d8ec0c027c04ee7ULL,
+	0xa160dede5fdebe81ULL, 0x38fc1c1c701ce06cULL, 0xe746fdfdd3fdbb2eULL, 0x9a1f4d4d294d5264ULL,
+	0x397692927292e4e0ULL, 0xeafa7575c9758fbcULL, 0x0c3606061806301eULL, 0x09ae8a8a128a2498ULL,
+	0x794bb2b2f2b2f940ULL, 0xd185e6e6bfe66359ULL, 0x1c7e0e0e380e7036ULL, 0x3ee71f1f7c1ff863ULL,
+	0xc4556262956237f7ULL, 0xb53ad4d477d4eea3ULL, 0x4d81a8a89aa82932ULL, 0x315296966296c4f4ULL,
+	0xef62f9f9c3f99b3aULL, 0x97a3c5c533c566f6ULL, 0x4a102525942535b1ULL, 0xb2ab59597959f220ULL,
+	0x15d084842a8454aeULL, 0xe4c57272d572b7a7ULL, 0x72ec3939e439d5ddULL, 0x98164c4c2d4c5a61ULL,
+	0xbc945e5e655eca3bULL, 0xf09f7878fd78e785ULL, 0x70e53838e038ddd8ULL, 0x05988c8c0a8c1486ULL,
+	0xbf17d1d163d1c6b2ULL, 0x57e4a5a5aea5410bULL, 0xd9a1e2e2afe2434dULL, 0xc24e616199612ff8ULL,
+	0x7b42b3b3f6b3f145ULL, 0x42342121842115a5ULL, 0x25089c9c4a9c94d6ULL, 0x3cee1e1e781ef066ULL,
+	0x8661434311432252ULL, 0x93b1c7c73bc776fcULL, 0xe54ffcfcd7fcb32bULL, 0x0824040410042014ULL,
+	0xa2e351515951b208ULL, 0x2f2599995e99bcc7ULL, 0xda226d6da96d4fc4ULL, 0x1a650d0d340d6839ULL,
+	0xe979fafacffa8335ULL, 0xa369dfdf5bdfb684ULL, 0xfca97e7ee57ed79bULL, 0x4819242490243db4ULL,
+	0x76fe3b3bec3bc5d7ULL, 0x4b9aabab96ab313dULL, 0x81f0cece1fce3ed1ULL, 0x2299111144118855ULL,
+	0x03838f8f068f0c89ULL, 0x9c044e4e254e4a6bULL, 0x7366b7b7e6b7d151ULL, 0xcbe0ebeb8beb0b60ULL,
+	0x78c13c3cf03cfdccULL, 0x1ffd81813e817cbfULL, 0x354094946a94d4feULL, 0xf31cf7f7fbf7eb0cULL,
+	0x6f18b9b9deb9a167ULL, 0x268b13134c13985fULL, 0x58512c2cb02c7d9cULL, 0xbb05d3d36bd3d6b8ULL,
+	0xd38ce7e7bbe76b5cULL, 0xdc396e6ea56e57cbULL, 0x95aac4c437c46ef3ULL, 0x061b03030c03180fULL,
+	0xacdc565645568a13ULL, 0x885e44440d441a49ULL, 0xfea07f7fe17fdf9eULL, 0x4f88a9a99ea92137ULL,
+	0x54672a2aa82a4d82ULL, 0x6b0abbbbd6bbb16dULL, 0x9f87c1c123c146e2ULL, 0xa6f153535153a202ULL,
+	0xa572dcdc57dcae8bULL, 0x16530b0b2c0b5827ULL, 0x27019d9d4e9d9cd3ULL, 0xd82b6c6cad6c47c1ULL,
+	0x62a43131c43195f5ULL, 0xe8f37474cd7487b9ULL, 0xf115f6f6fff6e309ULL, 0x8c4c464605460a43ULL,
+	0x45a5acac8aac0926ULL, 0x0fb589891e893c97ULL, 0x28b414145014a044ULL, 0xdfbae1e1a3e15b42ULL,
+	0x2ca616165816b04eULL, 0x74f73a3ae83acdd2ULL, 0xd2066969b9696fd0ULL, 0x124109092409482dULL,
+	0xe0d77070dd70a7adULL, 0x716fb6b6e2b6d954ULL, 0xbd1ed0d067d0ceb7ULL, 0xc7d6eded93ed3b7eULL,
+	0x85e2cccc17cc2edbULL, 0x8468424215422a57ULL, 0x2d2c98985a98b4c2ULL, 0x55eda4a4aaa4490eULL,
+	0x50752828a0285d88ULL, 0xb8865c5c6d5cda31ULL, 0xed6bf8f8c7f8933fULL, 0x11c28686228644a4ULL,
+};
+
+static const uint64_t C3[256] = {
+	0x7830d818186018c0ULL, 0xaf462623238c2305ULL, 0xf991b8c6c63fc67eULL, 0x6fcdfbe8e887e813ULL,
+	0xa113cb878726874cULL, 0x626d11b8b8dab8a9ULL, 0x0502090101040108ULL, 0x6e9e0d4f4f214f42ULL,
+	0xee6c9b3636d836adULL, 0x0451ffa6a6a2a659ULL, 0xbdb90cd2d26fd2deULL, 0x06f70ef5f5f3f5fbULL,
+	0x80f2967979f979efULL, 0xcede306f6fa16f5fULL, 0xef3f6d91917e91fcULL, 0x07a4f852525552aaULL,
+	0xfdc04760609d6027ULL, 0x766535bcbccabc89ULL, 0xcd2b379b9b569bacULL, 0x8c018a8e8e028e04ULL,
+	0x155bd2a3a3b6a371ULL, 0x3c186c0c0c300c60ULL, 0x8af6847b7bf17bffULL, 0xe16a803535d435b5ULL,
+	0x693af51d1d741de8ULL, 0x47ddb3e0e0a7e053ULL, 0xacb321d7d77bd7f6ULL, 0xed999cc2c22fc25eULL,
+	0x965c432e2eb82e6dULL, 0x7a96294b4b314b62ULL, 0x21e15dfefedffea3ULL, 0x16aed55757415782ULL,
+	0x412abd15155415a8ULL, 0xb6eee87777c1779fULL, 0xeb6e923737dc37a5ULL, 0x56d79ee5e5b3e57bULL,
+	0xd923139f9f469f8cULL, 0x17fd23f0f0e7f0d3ULL, 0x7f94204a4a354a6aULL, 0x95a944dada4fda9eULL,
+	0x25b0a258587d58faULL, 0xca8fcfc9c903c906ULL, 0x8d527c2929a42955ULL, 0x22145a0a0a280a50ULL,
+	0x4f7f50b1b1feb1e1ULL, 0x1a5dc9a0a0baa069ULL, 0xdad6146b6bb16b7fULL, 0xab17d985852e855cULL,
+	0x73673cbdbdcebd81ULL, 0x34ba8f5d5d695dd2ULL, 0x5020901010401080ULL, 0x03f507f4f4f7f4f3ULL,
+	0xc08bddcbcb0bcb16ULL, 0xc67cd33e3ef83eedULL, 0x110a2d0505140528ULL, 0xe6ce78676781671fULL,
+	0x53d597e4e4b7e473ULL, 0xbb4e0227279c2725ULL, 0x5882734141194132ULL, 0x9d0ba78b8b168b2cULL,
+	0x0153f6a7a7a6a751ULL, 0x94fab27d7de97dcfULL, 0xfb374995956e95dcULL, 0x9fad56d8d847d88eULL,
+	0x30eb70fbfbcbfb8bULL, 0x71c1cdeeee9fee23ULL, 0x91f8bb7c7ced7cc7ULL, 0xe3cc716666856617ULL,
+	0x8ea77bdddd53dda6ULL, 0x4b2eaf17175c17b8ULL, 0x468e454747014702ULL, 0xdc211a9e9e429e84ULL,
+	0xc589d4caca0fca1eULL, 0x995a582d2db42d75ULL, 0x79632ebfbfc6bf91ULL, 0x1b0e3f07071c0738ULL,
+	0x2347acadad8ead01ULL, 0x2fb4b05a5a755aeaULL, 0xb51bef838336836cULL, 0xff66b63333cc3385ULL,
+	0xf2c65c636391633fULL, 0x0a04120202080210ULL, 0x384993aaaa92aa39ULL, 0xa8e2de7171d971afULL,
+	0xcf8dc6c8c807c80eULL, 0x7d32d119196419c8ULL, 0x70923b4949394972ULL, 0x9aaf5fd9d943d986ULL,
+	0x1df931f2f2eff2c3ULL, 0x48dba8e3e3abe34bULL, 0x2ab6b95b5b715be2ULL, 0x920dbc88881a8834ULL,
+	0xc8293e9a9a529aa4ULL, 0xbe4c0b262698262dULL, 0xfa64bf3232c8328dULL, 0x4a7d59b0b0fab0e9ULL,
+	0x6acff2e9e983e91bULL, 0x331e770f0f3c0f78ULL, 0xa6b733d5d573d5e6ULL, 0xba1df480803a8074ULL,
+	0x7c6127bebec2be99ULL, 0xde87ebcdcd13cd26ULL, 0xe468893434d034bdULL, 0x75903248483d487aULL,
+	0x24e354ffffdbffabULL, 0x8ff48d7a7af57af7ULL, 0xea3d6490907a90f4ULL, 0x3ebe9d5f5f615fc2ULL,
+	0xa0403d202080201dULL, 0xd5d00f6868bd6867ULL, 0x7234ca1a1a681ad0ULL, 0x2c41b7aeae82ae19ULL,
+	0x5e757db4b4eab4c9ULL, 0x19a8ce54544d549aULL, 0xe53b7f93937693ecULL, 0xaa442f222288220dULL,
+	0xe9c86364648d6407ULL, 0x12ff2af1f1e3f1dbULL, 0xa2e6cc7373d173bfULL, 0x5a24821212481290ULL,
+	0x5d807a40401d403aULL, 0x2810480808200840ULL, 0xe89b95c3c32bc356ULL, 0x7bc5dfecec97ec33ULL,
+	0x90ab4ddbdb4bdb96ULL, 0x1f5fc0a1a1bea161ULL, 0x8307918d8d0e8d1cULL, 0xc97ac83d3df43df5ULL,
+	0xf1335b97976697ccULL, 0x0000000000000000ULL, 0xd483f9cfcf1bcf36ULL, 0x87566e2b2bac2b45ULL,
+	0xb3ece17676c57697ULL, 0xb019e68282328264ULL, 0xa9b128d6d67fd6feULL, 0x7736c31b1b6c1bd8ULL,
+	0x5b7774b5b5eeb5c1ULL, 0x2943beafaf86af11ULL, 0xdfd41d6a6ab56a77ULL, 0x0da0ea50505d50baULL,
+	0x4c8a574545094512ULL, 0x18fb38f3f3ebf3cbULL, 0xf060ad3030c0309dULL, 0x74c3c4efef9bef2bULL,
+	0xc37eda3f3ffc3fe5ULL, 0x1caac75555495592ULL, 0x1059dba2a2b2a279ULL, 0x65c9e9eaea8fea03ULL,
+	0xecca6a656589650fULL, 0x686903babad2bab9ULL, 0x935e4a2f2fbc2f65ULL, 0xe79d8ec0c027c04eULL,
+	0x81a160dede5fdebeULL, 0x6c38fc1c1c701ce0ULL, 0x2ee746fdfdd3fdbbULL, 0x649a1f4d4d294d52ULL,
+	0xe0397692927292e4ULL, 0xbceafa7575c9758fULL, 0x1e0c360606180630ULL, 0x9809ae8a8a128a24ULL,
+	0x40794bb2b2f2b2f9ULL, 0x59d185e6e6bfe663ULL, 0x361c7e0e0e380e70ULL, 0x633ee71f1f7c1ff8ULL,
+	0xf7c4556262956237ULL, 0xa3b53ad4d477d4eeULL, 0x324d81a8a89aa829ULL, 0xf4315296966296c4ULL,
+	0x3aef62f9f9c3f99bULL, 0xf697a3c5c533c566ULL, 0xb14a102525942535ULL, 0x20b2ab59597959f2ULL,
+	0xae15d084842a8454ULL, 0xa7e4c57272d572b7ULL, 0xdd72ec3939e439d5ULL, 0x6198164c4c2d4c5aULL,
+	0x3bbc945e5e655ecaULL, 0x85f09f7878fd78e7ULL, 0xd870e53838e038ddULL, 0x8605988c8c0a8c14ULL,
+	0xb2bf17d1d163d1c6ULL, 0x0b57e4a5a5aea541ULL, 0x4dd9a1e2e2afe243ULL, 0xf8c24e616199612fULL,
+	0x457b42b3b3f6b3f1ULL, 0xa542342121842115ULL, 0xd625089c9c4a9c94ULL, 0x663cee1e1e781ef0ULL,
+	0x5286614343114322ULL, 0xfc93b1c7c73bc776ULL, 0x2be54ffcfcd7fcb3ULL, 0x1408240404100420ULL,
+	0x08a2e351515951b2ULL, 0xc72f2599995e99bcULL, 0xc4da226d6da96d4fULL, 0x391a650d0d340d68ULL,
+	0x35e979fafacffa83ULL, 0x84a369dfdf5bdfb6ULL, 0x9bfca97e7ee57ed7ULL, 0xb44819242490243dULL,
+	0xd776fe3b3bec3bc5ULL, 0x3d4b9aabab96ab31ULL, 0xd181f0cece1fce3eULL, 0x5522991111441188ULL,
+	0x8903838f8f068f0cULL, 0x6b9c044e4e254e4aULL, 0x517366b7b7e6b7d1ULL, 0x60cbe0ebeb8beb0bULL,
+	0xcc78c13c3cf03cfdULL, 0xbf1ffd81813e817cULL, 0xfe354094946a94d4ULL, 0x0cf31cf7f7fbf7ebULL,
+	0x676f18b9b9deb9a1ULL, 0x5f268b13134c1398ULL, 0x9c58512c2cb02c7dULL, 0xb8bb05d3d36bd3d6ULL,
+	0x5cd38ce7e7bbe76bULL, 0xcbdc396e6ea56e57ULL, 0xf395aac4c437c46eULL, 0x0f061b03030c0318ULL,
+	0x13acdc565645568aULL, 0x49885e44440d441aULL, 0x9efea07f7fe17fdfULL, 0x374f88a9a99ea921ULL,
+	0x8254672a2aa82a4dULL, 0x6d6b0abbbbd6bbb1ULL, 0xe29f87c1c123c146ULL, 0x02a6f153535153a2ULL,
+	0x8ba572dcdc57dcaeULL, 0x2716530b0b2c0b58ULL, 0xd327019d9d4e9d9cULL, 0xc1d82b6c6cad6c47ULL,
+	0xf562a43131c43195ULL, 0xb9e8f37474cd7487ULL, 0x09f115f6f6fff6e3ULL, 0x438c4c464605460aULL,
+	0x2645a5acac8aac09ULL, 0x970fb589891e893cULL, 0x4428b414145014a0ULL, 0x42dfbae1e1a3e15bULL,
+	0x4e2ca616165816b0ULL, 0xd274f73a3ae83acdULL, 0xd0d2066969b9696fULL, 0x2d12410909240948ULL,
+	0xade0d77070dd70a7ULL, 0x54716fb6b6e2b6d9ULL, 0xb7bd1ed0d067d0ceULL, 0x7ec7d6eded93ed3bULL,
+	0xdb85e2cccc17cc2eULL, 0x578468424215422aULL, 0xc22d2c98985a98b4ULL, 0x0e55eda4a4aaa449ULL,
+	0x8850752828a0285dULL, 0x31b8865c5c6d5cdaULL, 0x3fed6bf8f8c7f893ULL, 0xa411c28686228644ULL,
+};
+
+static const uint64_t C4[256] = {
+	0xc07830d818186018ULL, 0x05af462623238c23ULL, 0x7ef991b8c6c63fc6ULL, 0x136fcdfbe8e887e8ULL,
+	0x4ca113cb87872687ULL, 0xa9626d11b8b8dab8ULL, 0x0805020901010401ULL, 0x426e9e0d4f4f214fULL,
+	0xadee6c9b3636d836ULL, 0x590451ffa6a6a2a6ULL, 0xdebdb90cd2d26fd2ULL, 0xfb06f70ef5f5f3f5ULL,
+	0xef80f2967979f979ULL, 0x5fcede306f6fa16fULL, 0xfcef3f6d91917e91ULL, 0xaa07a4f852525552ULL,
+	0x27fdc04760609d60ULL, 0x89766535bcbccabcULL, 0xaccd2b379b9b569bULL, 0x048c018a8e8e028eULL,
+	0x71155bd2a3a3b6a3ULL, 0x603c186c0c0c300cULL, 0xff8af6847b7bf17bULL, 0xb5e16a803535d435ULL,
+	0xe8693af51d1d741dULL, 0x5347ddb3e0e0a7e0ULL, 0xf6acb321d7d77bd7ULL, 0x5eed999cc2c22fc2ULL,
+	0x6d965c432e2eb82eULL, 0x627a96294b4b314bULL, 0xa321e15dfefedffeULL, 0x8216aed557574157ULL,
+	0xa8412abd15155415ULL, 0x9fb6eee87777c177ULL, 0xa5eb6e923737dc37ULL, 0x7b56d79ee5e5b3e5ULL,
+	0x8cd923139f9f469fULL, 0xd317fd23f0f0e7f0ULL, 0x6a7f94204a4a354aULL, 0x9e95a944dada4fdaULL,
+	0xfa25b0a258587d58ULL, 0x06ca8fcfc9c903c9ULL, 0x558d527c2929a429ULL, 0x5022145a0a0a280aULL,
+	0xe14f7f50b1b1feb1ULL, 0x691a5dc9a0a0baa0ULL, 0x7fdad6146b6bb16bULL, 0x5cab17d985852e85ULL,
+	0x8173673cbdbdcebdULL, 0xd234ba8f5d5d695dULL, 0x8050209010104010ULL, 0xf303f507f4f4f7f4ULL,
+	0x16c08bddcbcb0bcbULL, 0xedc67cd33e3ef83eULL, 0x28110a2d05051405ULL, 0x1fe6ce7867678167ULL,
+	0x7353d597e4e4b7e4ULL, 0x25bb4e0227279c27ULL, 0x3258827341411941ULL, 0x2c9d0ba78b8b168bULL,
+	0x510153f6a7a7a6a7ULL, 0xcf94fab27d7de97dULL, 0xdcfb374995956e95ULL, 0x8e9fad56d8d847d8ULL,
+	0x8b30eb70fbfbcbfbULL, 0x2371c1cdeeee9feeULL, 0xc791f8bb7c7ced7cULL, 0x17e3cc7166668566ULL,
+	0xa68ea77bdddd53ddULL, 0xb84b2eaf17175c17ULL, 0x02468e4547470147ULL, 0x84dc211a9e9e429eULL,
+	0x1ec589d4caca0fcaULL, 0x75995a582d2db42dULL, 0x9179632ebfbfc6bfULL, 0x381b0e3f07071c07ULL,
+	0x012347acadad8eadULL, 0xea2fb4b05a5a755aULL, 0x6cb51bef83833683ULL, 0x85ff66b63333cc33ULL,
+	0x3ff2c65c63639163ULL, 0x100a041202020802ULL, 0x39384993aaaa92aaULL, 0xafa8e2de7171d971ULL,
+	0x0ecf8dc6c8c807c8ULL, 0xc87d32d119196419ULL, 0x7270923b49493949ULL, 0x869aaf5fd9d943d9ULL,
+	0xc31df931f2f2eff2ULL, 0x4b48dba8e3e3abe3ULL, 0xe22ab6b95b5b715bULL, 0x34920dbc88881a88ULL,
+	0xa4c8293e9a9a529aULL, 0x2dbe4c0b26269826ULL, 0x8dfa64bf3232c832ULL, 0xe94a7d59b0b0fab0ULL,
+	0x1b6acff2e9e983e9ULL, 0x78331e770f0f3c0fULL, 0xe6a6b733d5d573d5ULL, 0x74ba1df480803a80ULL,
+	0x997c6127bebec2beULL, 0x26de87ebcdcd13cdULL, 0xbde468893434d034ULL, 0x7a75903248483d48ULL,
+	0xab24e354ffffdbffULL, 0xf78ff48d7a7af57aULL, 0xf4ea3d6490907a90ULL, 0xc23ebe9d5f5f615fULL,
+	0x1da0403d20208020ULL, 0x67d5d00f6868bd68ULL, 0xd07234ca1a1a681aULL, 0x192c41b7aeae82aeULL,
+	0xc95e757db4b4eab4ULL, 0x9a19a8ce54544d54ULL, 0xece53b7f93937693ULL, 0x0daa442f22228822ULL,
+	0x07e9c86364648d64ULL, 0xdb12ff2af1f1e3f1ULL, 0xbfa2e6cc7373d173ULL, 0x905a248212124812ULL,
+	0x3a5d807a40401d40ULL, 0x4028104808082008ULL, 0x56e89b95c3c32bc3ULL, 0x337bc5dfecec97ecULL,
+	0x9690ab4ddbdb4bdbULL, 0x611f5fc0a1a1bea1ULL, 0x1c8307918d8d0e8dULL, 0xf5c97ac83d3df43dULL,
+	0xccf1335b97976697ULL, 0x0000000000000000ULL, 0x36d483f9cfcf1bcfULL, 0x4587566e2b2bac2bULL,
+	0x97b3ece17676c576ULL, 0x64b019e682823282ULL, 0xfea9b128d6d67fd6ULL, 0xd87736c31b1b6c1bULL,
+	0xc15b7774b5b5eeb5ULL, 0x112943beafaf86afULL, 0x77dfd41d6a6ab56aULL, 0xba0da0ea50505d50ULL,
+	0x124c8a5745450945ULL, 0xcb18fb38f3f3ebf3ULL, 0x9df060ad3030c030ULL, 0x2b74c3c4efef9befULL,
+	0xe5c37eda3f3ffc3fULL, 0x921caac755554955ULL, 0x791059dba2a2b2a2ULL, 0x0365c9e9eaea8feaULL,
+	0x0fecca6a65658965ULL, 0xb9686903babad2baULL, 0x65935e4a2f2fbc2fULL, 0x4ee79d8ec0c027c0ULL,
+	0xbe81a160dede5fdeULL, 0xe06c38fc1c1c701cULL, 0xbb2ee746fdfdd3fdULL, 0x52649a1f4d4d294dULL,
+	0xe4e0397692927292ULL, 0x8fbceafa7575c975ULL, 0x301e0c3606061806ULL, 0x249809ae8a8a128aULL,
+	0xf940794bb2b2f2b2ULL, 0x6359d185e6e6bfe6ULL, 0x70361c7e0e0e380eULL, 0xf8633ee71f1f7c1fULL,
+	0x37f7c45562629562ULL, 0xeea3b53ad4d477d4ULL, 0x29324d81a8a89aa8ULL, 0xc4f4315296966296ULL,
+	0x9b3aef62f9f9c3f9ULL, 0x66f697a3c5c533c5ULL, 0x35b14a1025259425ULL, 0xf220b2ab59597959ULL,
+	0x54ae15d084842a84ULL, 0xb7a7e4c57272d572ULL, 0xd5dd72ec3939e439ULL, 0x5a6198164c4c2d4cULL,
+	0xca3bbc945e5e655eULL, 0xe785f09f7878fd78ULL, 0xddd870e53838e038ULL, 0x148605988c8c0a8cULL,
+	0xc6b2bf17d1d163d1ULL, 0x410b57e4a5a5aea5ULL, 0x434dd9a1e2e2afe2ULL, 0x2ff8c24e61619961ULL,
+	0xf1457b42b3b3f6b3ULL, 0x15a5423421218421ULL, 0x94d625089c9c4a9cULL, 0xf0663cee1e1e781eULL,
+	0x2252866143431143ULL, 0x76fc93b1c7c73bc7ULL, 0xb32be54ffcfcd7fcULL, 0x2014082404041004ULL,
+	0xb208a2e351515951ULL, 0xbcc72f2599995e99ULL, 0x4fc4da226d6da96dULL, 0x68391a650d0d340dULL,
+	0x8335e979fafacffaULL, 0xb684a369dfdf5bdfULL, 0xd79bfca97e7ee57eULL, 0x3db4481924249024ULL,
+	0xc5d776fe3b3bec3bULL, 0x313d4b9aabab96abULL, 0x3ed181f0cece1fceULL, 0x8855229911114411ULL,
+	0x0c8903838f8f068fULL, 0x4a6b9c044e4e254eULL, 0xd1517366b7b7e6b7ULL, 0x0b60cbe0ebeb8bebULL,
+	0xfdcc78c13c3cf03cULL, 0x7cbf1ffd81813e81ULL, 0xd4fe354094946a94ULL, 0xeb0cf31cf7f7fbf7ULL,
+	0xa1676f18b9b9deb9ULL, 0x985f268b13134c13ULL, 0x7d9c58512c2cb02cULL, 0xd6b8bb05d3d36bd3ULL,
+	0x6b5cd38ce7e7bbe7ULL, 0x57cbdc396e6ea56eULL, 0x6ef395aac4c437c4ULL, 0x180f061b03030c03ULL,
+	0x8a13acdc56564556ULL, 0x1a49885e44440d44ULL, 0xdf9efea07f7fe17fULL, 0x21374f88a9a99ea9ULL,
+	0x4d8254672a2aa82aULL, 0xb16d6b0abbbbd6bbULL, 0x46e29f87c1c123c1ULL, 0xa202a6f153535153ULL,
+	0xae8ba572dcdc57dcULL, 0x582716530b0b2c0bULL, 0x9cd327019d9d4e9dULL, 0x47c1d82b6c6cad6cULL,
+	0x95f562a43131c431ULL, 0x87b9e8f37474cd74ULL, 0xe309f115f6f6fff6ULL, 0x0a438c4c46460546ULL,
+	0x092645a5acac8aacULL, 0x3c970fb589891e89ULL, 0xa04428b414145014ULL, 0x5b42dfbae1e1a3e1ULL,
+	0xb04e2ca616165816ULL, 0xcdd274f73a3ae83aULL, 0x6fd0d2066969b969ULL, 0x482d124109092409ULL,
+	0xa7ade0d77070dd70ULL, 0xd954716fb6b6e2b6ULL, 0xceb7bd1ed0d067d0ULL, 0x3b7ec7d6eded93edULL,
+	0x2edb85e2cccc17ccULL, 0x2a57846842421542ULL, 0xb4c22d2c98985a98ULL, 0x490e55eda4a4aaa4ULL,
+	0x5d8850752828a028ULL, 0xda31b8865c5c6d5cULL, 0x933fed6bf8f8c7f8ULL, 0x44a411c286862286ULL,
+};
+
+static const uint64_t C5[256] = {
+	0x18c07830d8181860ULL, 0x2305af462623238cULL, 0xc67ef991b8c6c63fULL, 0xe8136fcdfbe8e887ULL,
+	0x874ca113cb878726ULL, 0xb8a9626d11b8b8daULL, 0x0108050209010104ULL, 0x4f426e9e0d4f4f21ULL,
+	0x36adee6c9b3636d8ULL, 0xa6590451ffa6a6a2ULL, 0xd2debdb90cd2d26fULL, 0xf5fb06f70ef5f5f3ULL,
+	0x79ef80f2967979f9ULL, 0x6f5fcede306f6fa1ULL, 0x91fcef3f6d91917eULL, 0x52aa07a4f8525255ULL,
+	0x6027fdc04760609dULL, 0xbc89766535bcbccaULL, 0x9baccd2b379b9b56ULL, 0x8e048c018a8e8e02ULL,
+	0xa371155bd2a3a3b6ULL, 0x0c603c186c0c0c30ULL, 0x7bff8af6847b7bf1ULL, 0x35b5e16a803535d4ULL,
+	0x1de8693af51d1d74ULL, 0xe05347ddb3e0e0a7ULL, 0xd7f6acb321d7d77bULL, 0xc25eed999cc2c22fULL,
+	0x2e6d965c432e2eb8ULL, 0x4b627a96294b4b31ULL, 0xfea321e15dfefedfULL, 0x578216aed5575741ULL,
+	0x15a8412abd151554ULL, 0x779fb6eee87777c1ULL, 0x37a5eb6e923737dcULL, 0xe57b56d79ee5e5b3ULL,
+	0x9f8cd923139f9f46ULL, 0xf0d317fd23f0f0e7ULL, 0x4a6a7f94204a4a35ULL, 0xda9e95a944dada4fULL,
+	0x58fa25b0a258587dULL, 0xc906ca8fcfc9c903ULL, 0x29558d527c2929a4ULL, 0x0a5022145a0a0a28ULL,
+	0xb1e14f7f50b1b1feULL, 0xa0691a5dc9a0a0baULL, 0x6b7fdad6146b6bb1ULL, 0x855cab17d985852eULL,
+	0xbd8173673cbdbdceULL, 0x5dd234ba8f5d5d69ULL, 0x1080502090101040ULL, 0xf4f303f507f4f4f7ULL,
+	0xcb16c08bddcbcb0bULL, 0x3eedc67cd33e3ef8ULL, 0x0528110a2d050514ULL, 0x671fe6ce78676781ULL,
+	0xe47353d597e4e4b7ULL, 0x2725bb4e0227279cULL, 0x4132588273414119ULL, 0x8b2c9d0ba78b8b16ULL,
+	0xa7510153f6a7a7a6ULL, 0x7dcf94fab27d7de9ULL, 0x95dcfb374995956eULL, 0xd88e9fad56d8d847ULL,
+	0xfb8b30eb70fbfbcbULL, 0xee2371c1cdeeee9fULL, 0x7cc791f8bb7c7cedULL, 0x6617e3cc71666685ULL,
+	0xdda68ea77bdddd53ULL, 0x17b84b2eaf17175cULL, 0x4702468e45474701ULL, 0x9e84dc211a9e9e42ULL,
+	0xca1ec589d4caca0fULL, 0x2d75995a582d2db4ULL, 0xbf9179632ebfbfc6ULL, 0x07381b0e3f07071cULL,
+	0xad012347acadad8eULL, 0x5aea2fb4b05a5a75ULL, 0x836cb51bef838336ULL, 0x3385ff66b63333ccULL,
+	0x633ff2c65c636391ULL, 0x02100a0412020208ULL, 0xaa39384993aaaa92ULL, 0x71afa8e2de7171d9ULL,
+	0xc80ecf8dc6c8c807ULL, 0x19c87d32d1191964ULL, 0x497270923b494939ULL, 0xd9869aaf5fd9d943ULL,
+	0xf2c31df931f2f2efULL, 0xe34b48dba8e3e3abULL, 0x5be22ab6b95b5b71ULL, 0x8834920dbc88881aULL,
+	0x9aa4c8293e9a9a52ULL, 0x262dbe4c0b262698ULL, 0x328dfa64bf3232c8ULL, 0xb0e94a7d59b0b0faULL,
+	0xe91b6acff2e9e983ULL, 0x0f78331e770f0f3cULL, 0xd5e6a6b733d5d573ULL, 0x8074ba1df480803aULL,
+	0xbe997c6127bebec2ULL, 0xcd26de87ebcdcd13ULL, 0x34bde468893434d0ULL, 0x487a75903248483dULL,
+	0xffab24e354ffffdbULL, 0x7af78ff48d7a7af5ULL, 0x90f4ea3d6490907aULL, 0x5fc23ebe9d5f5f61ULL,
+	0x201da0403d202080ULL, 0x6867d5d00f6868bdULL, 0x1ad07234ca1a1a68ULL, 0xae192c41b7aeae82ULL,
+	0xb4c95e757db4b4eaULL, 0x549a19a8ce54544dULL, 0x93ece53b7f939376ULL, 0x220daa442f222288ULL,
+	0x6407e9c86364648dULL, 0xf1db12ff2af1f1e3ULL, 0x73bfa2e6cc7373d1ULL, 0x12905a2482121248ULL,
+	0x403a5d807a40401dULL, 0x0840281048080820ULL, 0xc356e89b95c3c32bULL, 0xec337bc5dfecec97ULL,
+	0xdb9690ab4ddbdb4bULL, 0xa1611f5fc0a1a1beULL, 0x8d1c8307918d8d0eULL, 0x3df5c97ac83d3df4ULL,
+	0x97ccf1335b979766ULL, 0x0000000000000000ULL, 0xcf36d483f9cfcf1bULL, 0x2b4587566e2b2bacULL,
+	0x7697b3ece17676c5ULL, 0x8264b019e6828232ULL, 0xd6fea9b128d6d67fULL, 0x1bd87736c31b1b6cULL,
+	0xb5c15b7774b5b5eeULL, 0xaf112943beafaf86ULL, 0x6a77dfd41d6a6ab5ULL, 0x50ba0da0ea50505dULL,
+	0x45124c8a57454509ULL, 0xf3cb18fb38f3f3ebULL, 0x309df060ad3030c0ULL, 0xef2b74c3c4efef9bULL,
+	0x3fe5c37eda3f3ffcULL, 0x55921caac7555549ULL, 0xa2791059dba2a2b2ULL, 0xea0365c9e9eaea8fULL,
+	0x650fecca6a656589ULL, 0xbab9686903babad2ULL, 0x2f65935e4a2f2fbcULL, 0xc04ee79d8ec0c027ULL,
+	0xdebe81a160dede5fULL, 0x1ce06c38fc1c1c70ULL, 0xfdbb2ee746fdfdd3ULL, 0x4d52649a1f4d4d29ULL,
+	0x92e4e03976929272ULL, 0x758fbceafa7575c9ULL, 0x06301e0c36060618ULL, 0x8a249809ae8a8a12ULL,
+	0xb2f940794bb2b2f2ULL, 0xe66359d185e6e6bfULL, 0x0e70361c7e0e0e38ULL, 0x1ff8633ee71f1f7cULL,
+	0x6237f7c455626295ULL, 0xd4eea3b53ad4d477ULL, 0xa829324d81a8a89aULL, 0x96c4f43152969662ULL,
+	0xf99b3aef62f9f9c3ULL, 0xc566f697a3c5c533ULL, 0x2535b14a10252594ULL, 0x59f220b2ab595979ULL,
+	0x8454ae15d084842aULL, 0x72b7a7e4c57272d5ULL, 0x39d5dd72ec3939e4ULL, 0x4c5a6198164c4c2dULL,
+	0x5eca3bbc945e5e65ULL, 0x78e785f09f7878fdULL, 0x38ddd870e53838e0ULL, 0x8c148605988c8c0aULL,
+	0xd1c6b2bf17d1d163ULL, 0xa5410b57e4a5a5aeULL, 0xe2434dd9a1e2e2afULL, 0x612ff8c24e616199ULL,
+	0xb3f1457b42b3b3f6ULL, 0x2115a54234212184ULL, 0x9c94d625089c9c4aULL, 0x1ef0663cee1e1e78ULL,
+	0x4322528661434311ULL, 0xc776fc93b1c7c73bULL, 0xfcb32be54ffcfcd7ULL, 0x0420140824040410ULL,
+	0x51b208a2e3515159ULL, 0x99bcc72f2599995eULL, 0x6d4fc4da226d6da9ULL, 0x0d68391a650d0d34ULL,
+	0xfa8335e979fafacfULL, 0xdfb684a369dfdf5bULL, 0x7ed79bfca97e7ee5ULL, 0x243db44819242490ULL,
+	0x3bc5d776fe3b3becULL, 0xab313d4b9aabab96ULL, 0xce3ed181f0cece1fULL, 0x1188552299111144ULL,
+	0x8f0c8903838f8f06ULL, 0x4e4a6b9c044e4e25ULL, 0xb7d1517366b7b7e6ULL, 0xeb0b60cbe0ebeb8bULL,
+	0x3cfdcc78c13c3cf0ULL, 0x817cbf1ffd81813eULL, 0x94d4fe354094946aULL, 0xf7eb0cf31cf7f7fbULL,
+	0xb9a1676f18b9b9deULL, 0x13985f268b13134cULL, 0x2c7d9c58512c2cb0ULL, 0xd3d6b8bb05d3d36bULL,
+	0xe76b5cd38ce7e7bbULL, 0x6e57cbdc396e6ea5ULL, 0xc46ef395aac4c437ULL, 0x03180f061b03030cULL,
+	0x568a13acdc565645ULL, 0x441a49885e44440dULL, 0x7fdf9efea07f7fe1ULL, 0xa921374f88a9a99eULL,
+	0x2a4d8254672a2aa8ULL, 0xbbb16d6b0abbbbd6ULL, 0xc146e29f87c1c123ULL, 0x53a202a6f1535351ULL,
+	0xdcae8ba572dcdc57ULL, 0x0b582716530b0b2cULL, 0x9d9cd327019d9d4eULL, 0x6c47c1d82b6c6cadULL,
+	0x3195f562a43131c4ULL, 0x7487b9e8f37474cdULL, 0xf6e309f115f6f6ffULL, 0x460a438c4c464605ULL,
+	0xac092645a5acac8aULL, 0x893c970fb589891eULL, 0x14a04428b4141450ULL, 0xe15b42dfbae1e1a3ULL,
+	0x16b04e2ca6161658ULL, 0x3acdd274f73a3ae8ULL, 0x696fd0d2066969b9ULL, 0x09482d1241090924ULL,
+	0x70a7ade0d77070ddULL, 0xb6d954716fb6b6e2ULL, 0xd0ceb7bd1ed0d067ULL, 0xed3b7ec7d6eded93ULL,
+	0xcc2edb85e2cccc17ULL, 0x422a578468424215ULL, 0x98b4c22d2c98985aULL, 0xa4490e55eda4a4aaULL,
+	0x285d8850752828a0ULL, 0x5cda31b8865c5c6dULL, 0xf8933fed6bf8f8c7ULL, 0x8644a411c2868622ULL,
+};
+
+static const uint64_t C6[256] = {
+	0x6018c07830d81818ULL, 0x8c2305af46262323ULL, 0x3fc67ef991b8c6c6ULL, 0x87e8136fcdfbe8e8ULL,
+	0x26874ca113cb8787ULL, 0xdab8a9626d11b8b8ULL, 0x0401080502090101ULL, 0x214f426e9e0d4f4fULL,
+	0xd836adee6c9b3636ULL, 0xa2a6590451ffa6a6ULL, 0x6fd2debdb90cd2d2ULL, 0xf3f5fb06f70ef5f5ULL,
+	0xf979ef80f2967979ULL, 0xa16f5fcede306f6fULL, 0x7e91fcef3f6d9191ULL, 0x5552aa07a4f85252ULL,
+	0x9d6027fdc0476060ULL, 0xcabc89766535bcbcULL, 0x569baccd2b379b9bULL, 0x028e048c018a8e8eULL,
+	0xb6a371155bd2a3a3ULL, 0x300c603c186c0c0cULL, 0xf17bff8af6847b7bULL, 0xd435b5e16a803535ULL,
+	0x741de8693af51d1dULL, 0xa7e05347ddb3e0e0ULL, 0x7bd7f6acb321d7d7ULL, 0x2fc25eed999cc2c2ULL,
+	0xb82e6d965c432e2eULL, 0x314b627a96294b4bULL, 0xdffea321e15dfefeULL, 0x41578216aed55757ULL,
+	0x5415a8412abd1515ULL, 0xc1779fb6eee87777ULL, 0xdc37a5eb6e923737ULL, 0xb3e57b56d79ee5e5ULL,
+	0x469f8cd923139f9fULL, 0xe7f0d317fd23f0f0ULL, 0x354a6a7f94204a4aULL, 0x4fda9e95a944dadaULL,
+	0x7d58fa25b0a25858ULL, 0x03c906ca8fcfc9c9ULL, 0xa429558d527c2929ULL, 0x280a5022145a0a0aULL,
+	0xfeb1e14f7f50b1b1ULL, 0xbaa0691a5dc9a0a0ULL, 0xb16b7fdad6146b6bULL, 0x2e855cab17d98585ULL,
+	0xcebd8173673cbdbdULL, 0x695dd234ba8f5d5dULL, 0x4010805020901010ULL, 0xf7f4f303f507f4f4ULL,
+	0x0bcb16c08bddcbcbULL, 0xf83eedc67cd33e3eULL, 0x140528110a2d0505ULL, 0x81671fe6ce786767ULL,
+	0xb7e47353d597e4e4ULL, 0x9c2725bb4e022727ULL, 0x1941325882734141ULL, 0x168b2c9d0ba78b8bULL,
+	0xa6a7510153f6a7a7ULL, 0xe97dcf94fab27d7dULL, 0x6e95dcfb37499595ULL, 0x47d88e9fad56d8d8ULL,
+	0xcbfb8b30eb70fbfbULL, 0x9fee2371c1cdeeeeULL, 0xed7cc791f8bb7c7cULL, 0x856617e3cc716666ULL,
+	0x53dda68ea77bddddULL, 0x5c17b84b2eaf1717ULL, 0x014702468e454747ULL, 0x429e84dc211a9e9eULL,
+	0x0fca1ec589d4cacaULL, 0xb42d75995a582d2dULL, 0xc6bf9179632ebfbfULL, 0x1c07381b0e3f0707ULL,
+	0x8ead012347acadadULL, 0x755aea2fb4b05a5aULL, 0x36836cb51bef8383ULL, 0xcc3385ff66b63333ULL,
+	0x91633ff2c65c6363ULL, 0x0802100a04120202ULL, 0x92aa39384993aaaaULL, 0xd971afa8e2de7171ULL,
+	0x07c80ecf8dc6c8c8ULL, 0x6419c87d32d11919ULL, 0x39497270923b4949ULL, 0x43d9869aaf5fd9d9ULL,
+	0xeff2c31df931f2f2ULL, 0xabe34b48dba8e3e3ULL, 0x715be22ab6b95b5bULL, 0x1a8834920dbc8888ULL,
+	0x529aa4c8293e9a9aULL, 0x98262dbe4c0b2626ULL, 0xc8328dfa64bf3232ULL, 0xfab0e94a7d59b0b0ULL,
+	0x83e91b6acff2e9e9ULL, 0x3c0f78331e770f0fULL, 0x73d5e6a6b733d5d5ULL, 0x3a8074ba1df48080ULL,
+	0xc2be997c6127bebeULL, 0x13cd26de87ebcdcdULL, 0xd034bde468893434ULL, 0x3d487a7590324848ULL,
+	0xdbffab24e354ffffULL, 0xf57af78ff48d7a7aULL, 0x7a90f4ea3d649090ULL, 0x615fc23ebe9d5f5fULL,
+	0x80201da0403d2020ULL, 0xbd6867d5d00f6868ULL, 0x681ad07234ca1a1aULL, 0x82ae192c41b7aeaeULL,
+	0xeab4c95e757db4b4ULL, 0x4d549a19a8ce5454ULL, 0x7693ece53b7f9393ULL, 0x88220daa442f2222ULL,
+	0x8d6407e9c8636464ULL, 0xe3f1db12ff2af1f1ULL, 0xd173bfa2e6cc7373ULL, 0x4812905a24821212ULL,
+	0x1d403a5d807a4040ULL, 0x2008402810480808ULL, 0x2bc356e89b95c3c3ULL, 0x97ec337bc5dfececULL,
+	0x4bdb9690ab4ddbdbULL, 0xbea1611f5fc0a1a1ULL, 0x0e8d1c8307918d8dULL, 0xf43df5c97ac83d3dULL,
+	0x6697ccf1335b9797ULL, 0x0000000000000000ULL, 0x1bcf36d483f9cfcfULL, 0xac2b4587566e2b2bULL,
+	0xc57697b3ece17676ULL, 0x328264b019e68282ULL, 0x7fd6fea9b128d6d6ULL, 0x6c1bd87736c31b1bULL,
+	0xeeb5c15b7774b5b5ULL, 0x86af112943beafafULL, 0xb56a77dfd41d6a6aULL, 0x5d50ba0da0ea5050ULL,
+	0x0945124c8a574545ULL, 0xebf3cb18fb38f3f3ULL, 0xc0309df060ad3030ULL, 0x9bef2b74c3c4efefULL,
+	0xfc3fe5c37eda3f3fULL, 0x4955921caac75555ULL, 0xb2a2791059dba2a2ULL, 0x8fea0365c9e9eaeaULL,
+	0x89650fecca6a6565ULL, 0xd2bab9686903babaULL, 0xbc2f65935e4a2f2fULL, 0x27c04ee79d8ec0c0ULL,
+	0x5fdebe81a160dedeULL, 0x701ce06c38fc1c1cULL, 0xd3fdbb2ee746fdfdULL, 0x294d52649a1f4d4dULL,
+	0x7292e4e039769292ULL, 0xc9758fbceafa7575ULL, 0x1806301e0c360606ULL, 0x128a249809ae8a8aULL,
+	0xf2b2f940794bb2b2ULL, 0xbfe66359d185e6e6ULL, 0x380e70361c7e0e0eULL, 0x7c1ff8633ee71f1fULL,
+	0x956237f7c4556262ULL, 0x77d4eea3b53ad4d4ULL, 0x9aa829324d81a8a8ULL, 0x6296c4f431529696ULL,
+	0xc3f99b3aef62f9f9ULL, 0x33c566f697a3c5c5ULL, 0x942535b14a102525ULL, 0x7959f220b2ab5959ULL,
+	0x2a8454ae15d08484ULL, 0xd572b7a7e4c57272ULL, 0xe439d5dd72ec3939ULL, 0x2d4c5a6198164c4cULL,
+	0x655eca3bbc945e5eULL, 0xfd78e785f09f7878ULL, 0xe038ddd870e53838ULL, 0x0a8c148605988c8cULL,
+	0x63d1c6b2bf17d1d1ULL, 0xaea5410b57e4a5a5ULL, 0xafe2434dd9a1e2e2ULL, 0x99612ff8c24e6161ULL,
+	0xf6b3f1457b42b3b3ULL, 0x842115a542342121ULL, 0x4a9c94d625089c9cULL, 0x781ef0663cee1e1eULL,
+	0x1143225286614343ULL, 0x3bc776fc93b1c7c7ULL, 0xd7fcb32be54ffcfcULL, 0x1004201408240404ULL,
+	0x5951b208a2e35151ULL, 0x5e99bcc72f259999ULL, 0xa96d4fc4da226d6dULL, 0x340d68391a650d0dULL,
+	0xcffa8335e979fafaULL, 0x5bdfb684a369dfdfULL, 0xe57ed79bfca97e7eULL, 0x90243db448192424ULL,
+	0xec3bc5d776fe3b3bULL, 0x96ab313d4b9aababULL, 0x1fce3ed181f0ceceULL, 0x4411885522991111ULL,
+	0x068f0c8903838f8fULL, 0x254e4a6b9c044e4eULL, 0xe6b7d1517366b7b7ULL, 0x8beb0b60cbe0ebebULL,
+	0xf03cfdcc78c13c3cULL, 0x3e817cbf1ffd8181ULL, 0x6a94d4fe35409494ULL, 0xfbf7eb0cf31cf7f7ULL,
+	0xdeb9a1676f18b9b9ULL, 0x4c13985f268b1313ULL, 0xb02c7d9c58512c2cULL, 0x6bd3d6b8bb05d3d3ULL,
+	0xbbe76b5cd38ce7e7ULL, 0xa56e57cbdc396e6eULL, 0x37c46ef395aac4c4ULL, 0x0c03180f061b0303ULL,
+	0x45568a13acdc5656ULL, 0x0d441a49885e4444ULL, 0xe17fdf9efea07f7fULL, 0x9ea921374f88a9a9ULL,
+	0xa82a4d8254672a2aULL, 0xd6bbb16d6b0abbbbULL, 0x23c146e29f87c1c1ULL, 0x5153a202a6f15353ULL,
+	0x57dcae8ba572dcdcULL, 0x2c0b582716530b0bULL, 0x4e9d9cd327019d9dULL, 0xad6c47c1d82b6c6cULL,
+	0xc43195f562a43131ULL, 0xcd7487b9e8f37474ULL, 0xfff6e309f115f6f6ULL, 0x05460a438c4c4646ULL,
+	0x8aac092645a5acacULL, 0x1e893c970fb58989ULL, 0x5014a04428b41414ULL, 0xa3e15b42dfbae1e1ULL,
+	0x5816b04e2ca61616ULL, 0xe83acdd274f73a3aULL, 0xb9696fd0d2066969ULL, 0x2409482d12410909ULL,
+	0xdd70a7ade0d77070ULL, 0xe2b6d954716fb6b6ULL, 0x67d0ceb7bd1ed0d0ULL, 0x93ed3b7ec7d6ededULL,
+	0x17cc2edb85e2ccccULL, 0x15422a5784684242ULL, 0x5a98b4c22d2c9898ULL, 0xaaa4490e55eda4a4ULL,
+	0xa0285d8850752828ULL, 0x6d5cda31b8865c5cULL, 0xc7f8933fed6bf8f8ULL, 0x228644a411c28686ULL,
+};
+
+static const uint64_t C7[256] = {
+	0x186018c07830d818ULL, 0x238c2305af462623ULL, 0xc63fc67ef991b8c6ULL, 0xe887e8136fcdfbe8ULL,
+	0x8726874ca113cb87ULL, 0xb8dab8a9626d11b8ULL, 0x0104010805020901ULL, 0x4f214f426e9e0d4fULL,
+	0x36d836adee6c9b36ULL, 0xa6a2a6590451ffa6ULL, 0xd26fd2debdb90cd2ULL, 0xf5f3f5fb06f70ef5ULL,
+	0x79f979ef80f29679ULL, 0x6fa16f5fcede306fULL, 0x917e91fcef3f6d91ULL, 0x525552aa07a4f852ULL,
+	0x609d6027fdc04760ULL, 0xbccabc89766535bcULL, 0x9b569baccd2b379bULL, 0x8e028e048c018a8eULL,
+	0xa3b6a371155bd2a3ULL, 0x0c300c603c186c0cULL, 0x7bf17bff8af6847bULL, 0x35d435b5e16a8035ULL,
+	0x1d741de8693af51dULL, 0xe0a7e05347ddb3e0ULL, 0xd77bd7f6acb321d7ULL, 0xc22fc25eed999cc2ULL,
+	0x2eb82e6d965c432eULL, 0x4b314b627a96294bULL, 0xfedffea321e15dfeULL, 0x5741578216aed557ULL,
+	0x155415a8412abd15ULL, 0x77c1779fb6eee877ULL, 0x37dc37a5eb6e9237ULL, 0xe5b3e57b56d79ee5ULL,
+	0x9f469f8cd923139fULL, 0xf0e7f0d317fd23f0ULL, 0x4a354a6a7f94204aULL, 0xda4fda9e95a944daULL,
+	0x587d58fa25b0a258ULL, 0xc903c906ca8fcfc9ULL, 0x29a429558d527c29ULL, 0x0a280a5022145a0aULL,
+	0xb1feb1e14f7f50b1ULL, 0xa0baa0691a5dc9a0ULL, 0x6bb16b7fdad6146bULL, 0x852e855cab17d985ULL,
+	0xbdcebd8173673cbdULL, 0x5d695dd234ba8f5dULL, 0x1040108050209010ULL, 0xf4f7f4f303f507f4ULL,
+	0xcb0bcb16c08bddcbULL, 0x3ef83eedc67cd33eULL, 0x05140528110a2d05ULL, 0x6781671fe6ce7867ULL,
+	0xe4b7e47353d597e4ULL, 0x279c2725bb4e0227ULL, 0x4119413258827341ULL, 0x8b168b2c9d0ba78bULL,
+	0xa7a6a7510153f6a7ULL, 0x7de97dcf94fab27dULL, 0x956e95dcfb374995ULL, 0xd847d88e9fad56d8ULL,
+	0xfbcbfb8b30eb70fbULL, 0xee9fee2371c1cdeeULL, 0x7ced7cc791f8bb7cULL, 0x66856617e3cc7166ULL,
+	0xdd53dda68ea77bddULL, 0x175c17b84b2eaf17ULL, 0x47014702468e4547ULL, 0x9e429e84dc211a9eULL,
+	0xca0fca1ec589d4caULL, 0x2db42d75995a582dULL, 0xbfc6bf9179632ebfULL, 0x071c07381b0e3f07ULL,
+	0xad8ead012347acadULL, 0x5a755aea2fb4b05aULL, 0x8336836cb51bef83ULL, 0x33cc3385ff66b633ULL,
+	0x6391633ff2c65c63ULL, 0x020802100a041202ULL, 0xaa92aa39384993aaULL, 0x71d971afa8e2de71ULL,
+	0xc807c80ecf8dc6c8ULL, 0x196419c87d32d119ULL, 0x4939497270923b49ULL, 0xd943d9869aaf5fd9ULL,
+	0xf2eff2c31df931f2ULL, 0xe3abe34b48dba8e3ULL, 0x5b715be22ab6b95bULL, 0x881a8834920dbc88ULL,
+	0x9a529aa4c8293e9aULL, 0x2698262dbe4c0b26ULL, 0x32c8328dfa64bf32ULL, 0xb0fab0e94a7d59b0ULL,
+	0xe983e91b6acff2e9ULL, 0x0f3c0f78331e770fULL, 0xd573d5e6a6b733d5ULL, 0x803a8074ba1df480ULL,
+	0xbec2be997c6127beULL, 0xcd13cd26de87ebcdULL, 0x34d034bde4688934ULL, 0x483d487a75903248ULL,
+	0xffdbffab24e354ffULL, 0x7af57af78ff48d7aULL, 0x907a90f4ea3d6490ULL, 0x5f615fc23ebe9d5fULL,
+	0x2080201da0403d20ULL, 0x68bd6867d5d00f68ULL, 0x1a681ad07234ca1aULL, 0xae82ae192c41b7aeULL,
+	0xb4eab4c95e757db4ULL, 0x544d549a19a8ce54ULL, 0x937693ece53b7f93ULL, 0x2288220daa442f22ULL,
+	0x648d6407e9c86364ULL, 0xf1e3f1db12ff2af1ULL, 0x73d173bfa2e6cc73ULL, 0x124812905a248212ULL,
+	0x401d403a5d807a40ULL, 0x0820084028104808ULL, 0xc32bc356e89b95c3ULL, 0xec97ec337bc5dfecULL,
+	0xdb4bdb9690ab4ddbULL, 0xa1bea1611f5fc0a1ULL, 0x8d0e8d1c8307918dULL, 0x3df43df5c97ac83dULL,
+	0x976697ccf1335b97ULL, 0x0000000000000000ULL, 0xcf1bcf36d483f9cfULL, 0x2bac2b4587566e2bULL,
+	0x76c57697b3ece176ULL, 0x82328264b019e682ULL, 0xd67fd6fea9b128d6ULL, 0x1b6c1bd87736c31bULL,
+	0xb5eeb5c15b7774b5ULL, 0xaf86af112943beafULL, 0x6ab56a77dfd41d6aULL, 0x505d50ba0da0ea50ULL,
+	0x450945124c8a5745ULL, 0xf3ebf3cb18fb38f3ULL, 0x30c0309df060ad30ULL, 0xef9bef2b74c3c4efULL,
+	0x3ffc3fe5c37eda3fULL, 0x554955921caac755ULL, 0xa2b2a2791059dba2ULL, 0xea8fea0365c9e9eaULL,
+	0x6589650fecca6a65ULL, 0xbad2bab9686903baULL, 0x2fbc2f65935e4a2fULL, 0xc027c04ee79d8ec0ULL,
+	0xde5fdebe81a160deULL, 0x1c701ce06c38fc1cULL, 0xfdd3fdbb2ee746fdULL, 0x4d294d52649a1f4dULL,
+	0x927292e4e0397692ULL, 0x75c9758fbceafa75ULL, 0x061806301e0c3606ULL, 0x8a128a249809ae8aULL,
+	0xb2f2b2f940794bb2ULL, 0xe6bfe66359d185e6ULL, 0x0e380e70361c7e0eULL, 0x1f7c1ff8633ee71fULL,
+	0x62956237f7c45562ULL, 0xd477d4eea3b53ad4ULL, 0xa89aa829324d81a8ULL, 0x966296c4f4315296ULL,
+	0xf9c3f99b3aef62f9ULL, 0xc533c566f697a3c5ULL, 0x25942535b14a1025ULL, 0x597959f220b2ab59ULL,
+	0x842a8454ae15d084ULL, 0x72d572b7a7e4c572ULL, 0x39e439d5dd72ec39ULL, 0x4c2d4c5a6198164cULL,
+	0x5e655eca3bbc945eULL, 0x78fd78e785f09f78ULL, 0x38e038ddd870e538ULL, 0x8c0a8c148605988cULL,
+	0xd163d1c6b2bf17d1ULL, 0xa5aea5410b57e4a5ULL, 0xe2afe2434dd9a1e2ULL, 0x6199612ff8c24e61ULL,
+	0xb3f6b3f1457b42b3ULL, 0x21842115a5423421ULL, 0x9c4a9c94d625089cULL, 0x1e781ef0663cee1eULL,
+	0x4311432252866143ULL, 0xc73bc776fc93b1c7ULL, 0xfcd7fcb32be54ffcULL, 0x0410042014082404ULL,
+	0x515951b208a2e351ULL, 0x995e99bcc72f2599ULL, 0x6da96d4fc4da226dULL, 0x0d340d68391a650dULL,
+	0xfacffa8335e979faULL, 0xdf5bdfb684a369dfULL, 0x7ee57ed79bfca97eULL, 0x2490243db4481924ULL,
+	0x3bec3bc5d776fe3bULL, 0xab96ab313d4b9aabULL, 0xce1fce3ed181f0ceULL, 0x1144118855229911ULL,
+	0x8f068f0c8903838fULL, 0x4e254e4a6b9c044eULL, 0xb7e6b7d1517366b7ULL, 0xeb8beb0b60cbe0ebULL,
+	0x3cf03cfdcc78c13cULL, 0x813e817cbf1ffd81ULL, 0x946a94d4fe354094ULL, 0xf7fbf7eb0cf31cf7ULL,
+	0xb9deb9a1676f18b9ULL, 0x134c13985f268b13ULL, 0x2cb02c7d9c58512cULL, 0xd36bd3d6b8bb05d3ULL,
+	0xe7bbe76b5cd38ce7ULL, 0x6ea56e57cbdc396eULL, 0xc437c46ef395aac4ULL, 0x030c03180f061b03ULL,
+	0x5645568a13acdc56ULL, 0x440d441a49885e44ULL, 0x7fe17fdf9efea07fULL, 0xa99ea921374f88a9ULL,
+	0x2aa82a4d8254672aULL, 0xbbd6bbb16d6b0abbULL, 0xc123c146e29f87c1ULL, 0x535153a202a6f153ULL,
+	0xdc57dcae8ba572dcULL, 0x0b2c0b582716530bULL, 0x9d4e9d9cd327019dULL, 0x6cad6c47c1d82b6cULL,
+	0x31c43195f562a431ULL, 0x74cd7487b9e8f374ULL, 0xf6fff6e309f115f6ULL, 0x4605460a438c4c46ULL,
+	0xac8aac092645a5acULL, 0x891e893c970fb589ULL, 0x145014a04428b414ULL, 0xe1a3e15b42dfbae1ULL,
+	0x165816b04e2ca616ULL, 0x3ae83acdd274f73aULL, 0x69b9696fd0d20669ULL, 0x092409482d124109ULL,
+	0x70dd70a7ade0d770ULL, 0xb6e2b6d954716fb6ULL, 0xd067d0ceb7bd1ed0ULL, 0xed93ed3b7ec7d6edULL,
+	0xcc17cc2edb85e2ccULL, 0x4215422a57846842ULL, 0x985a98b4c22d2c98ULL, 0xa4aaa4490e55eda4ULL,
+	0x28a0285d88507528ULL, 0x5c6d5cda31b8865cULL, 0xf8c7f8933fed6bf8ULL, 0x86228644a411c286ULL,
+};
+
+static const uint64_t rc[R + 1] = {
+	0x0000000000000000ULL,
+	0x1823c6e887b8014fULL,
+	0x36a6d2f5796f9152ULL,
+	0x60bc9b8ea30c7b35ULL,
+	0x1de0d7c22e4bfe57ULL,
+	0x157737e59ff04adaULL,
+	0x58c9290ab1a06b85ULL,
+	0xbd5d10f4cb3e0567ULL,
+	0xe427418ba77d95d8ULL,
+	0xfbee7c66dd17479eULL,
+	0xca2dbf07ad5a8333ULL,
+};
+
+/* This might not be true for all platforms and compilers. */
+#define SANE_ARRAY_PACKING 1
+
+#if defined(SANE_ARRAY_PACKING) && (defined(ARCH_IS_LITTLE_ENDIAN) || defined(ARCH_IS_BIG_ENDIAN))
+
+#if defined(ARCH_IS_LITTLE_ENDIAN)
+#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 7]] \
+	^ C1[mu[((n+7)%8) * 8 + 6]] \
+	^ C2[mu[((n+6)%8) * 8 + 5]] \
+	^ C3[mu[((n+5)%8) * 8 + 4]] \
+	^ C4[mu[((n+4)%8) * 8 + 3]] \
+	^ C5[mu[((n+3)%8) * 8 + 2]] \
+	^ C6[mu[((n+2)%8) * 8 + 1]] \
+	^ C7[mu[((n+1)%8) * 8 + 0]] \
+	; } while (0)
+#else
+#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 0]] \
+	^ C1[mu[((n+7)%8) * 8 + 1]] \
+	^ C2[mu[((n+6)%8) * 8 + 2]] \
+	^ C3[mu[((n+5)%8) * 8 + 3]] \
+	^ C4[mu[((n+4)%8) * 8 + 4]] \
+	^ C5[mu[((n+3)%8) * 8 + 5]] \
+	^ C6[mu[((n+2)%8) * 8 + 6]] \
+	^ C7[mu[((n+1)%8) * 8 + 7]] \
+	; } while (0)
+#endif
+
+static void transformMatrix(uint64_t m[8])
+{
+	uint64_t L[8];
+	uint8_t *mu = (uint8_t*)m;
+
+	LB(0);
+	LB(1);
+	LB(2);
+	LB(3);
+	LB(4);
+	LB(5);
+	LB(6);
+	LB(7);
+
+	array_copy64(m, L, 8);
+}
+
+#else
+
+static void transformMatrix(uint64_t m[8])
+{
+	uint64_t L[8];
+
+	L[0] =
+		C0[(int)(m[0] >> 56)       ] ^
+		C1[(int)(m[7] >> 48) & 0xff] ^
+		C2[(int)(m[6] >> 40) & 0xff] ^
+		C3[(int)(m[5] >> 32) & 0xff] ^
+		C4[(int)(m[4] >> 24) & 0xff] ^
+		C5[(int)(m[3] >> 16) & 0xff] ^
+		C6[(int)(m[2] >>  8) & 0xff] ^
+		C7[(int)(m[1]      ) & 0xff];
+	L[1] =
+		C0[(int)(m[1] >> 56)       ] ^
+		C1[(int)(m[0] >> 48) & 0xff] ^
+		C2[(int)(m[7] >> 40) & 0xff] ^
+		C3[(int)(m[6] >> 32) & 0xff] ^
+		C4[(int)(m[5] >> 24) & 0xff] ^
+		C5[(int)(m[4] >> 16) & 0xff] ^
+		C6[(int)(m[3] >>  8) & 0xff] ^
+		C7[(int)(m[2]      ) & 0xff];
+	L[2] =
+		C0[(int)(m[2] >> 56)       ] ^
+		C1[(int)(m[1] >> 48) & 0xff] ^
+		C2[(int)(m[0] >> 40) & 0xff] ^
+		C3[(int)(m[7] >> 32) & 0xff] ^
+		C4[(int)(m[6] >> 24) & 0xff] ^
+		C5[(int)(m[5] >> 16) & 0xff] ^
+		C6[(int)(m[4] >>  8) & 0xff] ^
+		C7[(int)(m[3]      ) & 0xff];
+	L[3] =
+		C0[(int)(m[3] >> 56)       ] ^
+		C1[(int)(m[2] >> 48) & 0xff] ^
+		C2[(int)(m[1] >> 40) & 0xff] ^
+		C3[(int)(m[0] >> 32) & 0xff] ^
+		C4[(int)(m[7] >> 24) & 0xff] ^
+		C5[(int)(m[6] >> 16) & 0xff] ^
+		C6[(int)(m[5] >>  8) & 0xff] ^
+		C7[(int)(m[4]      ) & 0xff];
+	L[4] =
+		C0[(int)(m[4] >> 56)       ] ^
+		C1[(int)(m[3] >> 48) & 0xff] ^
+		C2[(int)(m[2] >> 40) & 0xff] ^
+		C3[(int)(m[1] >> 32) & 0xff] ^
+		C4[(int)(m[0] >> 24) & 0xff] ^
+		C5[(int)(m[7] >> 16) & 0xff] ^
+		C6[(int)(m[6] >>  8) & 0xff] ^
+		C7[(int)(m[5]      ) & 0xff];
+	L[5] =
+		C0[(int)(m[5] >> 56)       ] ^
+		C1[(int)(m[4] >> 48) & 0xff] ^
+		C2[(int)(m[3] >> 40) & 0xff] ^
+		C3[(int)(m[2] >> 32) & 0xff] ^
+		C4[(int)(m[1] >> 24) & 0xff] ^
+		C5[(int)(m[0] >> 16) & 0xff] ^
+		C6[(int)(m[7] >>  8) & 0xff] ^
+		C7[(int)(m[6]      ) & 0xff];
+	L[6] =
+		C0[(int)(m[6] >> 56)       ] ^
+		C1[(int)(m[5] >> 48) & 0xff] ^
+		C2[(int)(m[4] >> 40) & 0xff] ^
+		C3[(int)(m[3] >> 32) & 0xff] ^
+		C4[(int)(m[2] >> 24) & 0xff] ^
+		C5[(int)(m[1] >> 16) & 0xff] ^
+		C6[(int)(m[0] >>  8) & 0xff] ^
+		C7[(int)(m[7]      ) & 0xff];
+	L[7] =
+		C0[(int)(m[7] >> 56)       ] ^
+		C1[(int)(m[6] >> 48) & 0xff] ^
+		C2[(int)(m[5] >> 40) & 0xff] ^
+		C3[(int)(m[4] >> 32) & 0xff] ^
+		C4[(int)(m[3] >> 24) & 0xff] ^
+		C5[(int)(m[2] >> 16) & 0xff] ^
+		C6[(int)(m[1] >>  8) & 0xff] ^
+		C7[(int)(m[0]      ) & 0xff];
+
+	array_copy64(m, L, 8);
+}
+
+#endif
+
+static void inplaceXor(uint64_t dst[8], uint64_t src[8])
+{
+	dst[0] ^= src[0];
+	dst[1] ^= src[1];
+	dst[2] ^= src[2];
+	dst[3] ^= src[3];
+	dst[4] ^= src[4];
+	dst[5] ^= src[5];
+	dst[6] ^= src[6];
+	dst[7] ^= src[7];
+}
+
+/**
+ * The core Whirlpool transform.
+ */
+static void processBuffer(whirlpool_ctx * const ctx)
+{
+	int i, r;
+	uint64_t K[8];        /* the round key */
+	uint64_t block[8];    /* mu(buffer) */
+	uint64_t state[8];    /* the cipher state */
+	uint8_t *buffer = ctx->buffer;
+
+	/*
+	 * map the buffer to a block:
+	 */
+	for (i = 0; i < 8; i++, buffer += 8) {
+		block[i] =
+			(((uint64_t)buffer[0]        ) << 56) ^
+			(((uint64_t)buffer[1] & 0xffL) << 48) ^
+			(((uint64_t)buffer[2] & 0xffL) << 40) ^
+			(((uint64_t)buffer[3] & 0xffL) << 32) ^
+			(((uint64_t)buffer[4] & 0xffL) << 24) ^
+			(((uint64_t)buffer[5] & 0xffL) << 16) ^
+			(((uint64_t)buffer[6] & 0xffL) <<  8) ^
+			(((uint64_t)buffer[7] & 0xffL)      );
+	}
+
+	/*
+	 * compute and apply K^0 to the cipher state:
+	 */
+	array_copy64(K, ctx->hash, 8);
+	array_copy64(state, block, 8);
+	inplaceXor(state, K);
+
+	/*
+	 * iterate over all rounds:
+	 */
+	for (r = 1; r <= R; r++) {
+		/*
+		 * compute K^r from K^{r-1}:
+		 */
+		transformMatrix(K);
+		K[0] ^= rc[r];
+
+		/*
+		 * apply the r-th round transformation:
+		 */
+		transformMatrix(state);
+		inplaceXor(state, K);
+	}
+	/*
+	 * apply the Miyaguchi-Preneel compression function:
+	 */
+	inplaceXor(ctx->hash, state);
+	inplaceXor(ctx->hash, block);
+}
+
+/**
+ * Initialize the hashing state.
+ */
+void crypton_whirlpool_init(struct whirlpool_ctx * const ctx)
+{
+	int i;
+
+	memset(ctx->bitLength, 0, 32);
+	ctx->bufferBits = ctx->bufferPos = 0;
+	ctx->buffer[0] = 0; /* it's only necessary to cleanup buffer[bufferPos] */
+	for (i = 0; i < 8; i++) {
+		ctx->hash[i] = 0L; /* initial value */
+	}
+}
+
+/**
+ * Delivers input data to the hashing algorithm.
+ *
+ * @param    source        plaintext data to hash.
+ * @param    sourceBits    how many bits of plaintext to process.
+ *
+ * This method maintains the invariant: bufferBits < DIGESTBITS
+ */
+void crypton_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t sourceBytes)
+{
+	/*
+	   sourcePos
+	   |
+	   +-------+-------+-------
+	   ||||||||||||||||||||| source
+	   +-------+-------+-------
+	   +-------+-------+-------+-------+-------+-------
+	   ||||||||||||||||||||||                           buffer
+	   +-------+-------+-------+-------+-------+-------
+	   |
+	   bufferPos
+	   */
+	int sourceBits   = sourceBytes * 8;
+	int sourcePos    = 0; /* index of leftmost source uint8_t containing data (1 to 8 bits). */
+	int sourceGap    = (8 - ((int)sourceBits & 7)) & 7; /* space on source[sourcePos]. */
+	int bufferRem    = ctx->bufferBits & 7; /* occupied bits on buffer[bufferPos]. */
+	int i;
+	uint32_t b, carry;
+	uint8_t *buffer       = ctx->buffer;
+	uint8_t *bitLength    = ctx->bitLength;
+	int bufferBits   = ctx->bufferBits;
+	int bufferPos    = ctx->bufferPos;
+
+	/*
+	 * tally the length of the added data:
+	 */
+	uint64_t value = sourceBits;
+	for (i = 31, carry = 0; i >= 0 && (carry != 0 || value != 0ULL); i--) {
+		carry += bitLength[i] + ((uint32_t)value & 0xff);
+		bitLength[i] = (uint8_t)carry;
+		carry >>= 8;
+		value >>= 8;
+	}
+	/*
+	 * process data in chunks of 8 bits (a more efficient approach would be to take whole-word chunks):
+	 */
+	while (sourceBits > 8) {
+		/* N.B. at least source[sourcePos] and source[sourcePos+1] contain data. */
+		/*
+		 * take a byte from the source:
+		 */
+		b = ((source[sourcePos] << sourceGap) & 0xff) |
+			((source[sourcePos + 1] & 0xff) >> (8 - sourceGap));
+		/*
+		 * process this byte:
+		 */
+		buffer[bufferPos++] |= (uint8_t)(b >> bufferRem);
+		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */
+		if (bufferBits == DIGESTBITS) {
+			/*
+			 * process data block:
+			 */
+			processBuffer(ctx);
+			/*
+			 * reset buffer:
+			 */
+			bufferBits = bufferPos = 0;
+		}
+		buffer[bufferPos] = b << (8 - bufferRem);
+		bufferBits += bufferRem;
+		/*
+		 * proceed to remaining data:
+		 */
+		sourceBits -= 8;
+		sourcePos++;
+	}
+	/* now 0 <= sourceBits <= 8;
+	 * furthermore, all data (if any is left) is in source[sourcePos].
+	 */
+	if (sourceBits > 0) {
+		b = (source[sourcePos] << sourceGap) & 0xff; /* bits are left-justified on b. */
+		/*
+		 * process the remaining bits:
+		 */
+		buffer[bufferPos] |= b >> bufferRem;
+	} else {
+		b = 0;
+	}
+	if (bufferRem + sourceBits < 8) {
+		/*
+		 * all remaining data fits on buffer[bufferPos],
+		 * and there still remains some space.
+		 */
+		bufferBits += sourceBits;
+	} else {
+		/*
+		 * buffer[bufferPos] is full:
+		 */
+		bufferPos++;
+		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */
+		sourceBits -= 8 - bufferRem;
+		/* now 0 <= sourceBits < 8;
+		 * furthermore, all data (if any is left) is in source[sourcePos].
+		 */
+		if (bufferBits == DIGESTBITS) {
+			/*
+			 * process data block:
+			 */
+			processBuffer(ctx);
+			/*
+			 * reset buffer:
+			 */
+			bufferBits = bufferPos = 0;
+		}
+		buffer[bufferPos] = b << (8 - bufferRem);
+		bufferBits += (int)sourceBits;
+	}
+	ctx->bufferBits   = bufferBits;
+	ctx->bufferPos    = bufferPos;
+}
+
+/**
+ * Get the hash value from the hashing state.
+ * 
+ * This method uses the invariant: bufferBits < DIGESTBITS
+ */
+void crypton_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result)
+{
+	int i;
+	uint8_t *buffer    = ctx->buffer;
+	uint8_t *bitLength = ctx->bitLength;
+	int bufferBits     = ctx->bufferBits;
+	int bufferPos      = ctx->bufferPos;
+	uint8_t *digest    = result;
+
+	/*
+	 * append a '1'-bit:
+	 */
+	buffer[bufferPos] |= 0x80U >> (bufferBits & 7);
+	bufferPos++; /* all remaining bits on the current uint8_t are set to zero. */
+	/*
+	 * pad with zero bits to complete (N*WBLOCKBITS - LENGTHBITS) bits:
+	 */
+	if (bufferPos > WBLOCKBYTES - LENGTHBYTES) {
+		if (bufferPos < WBLOCKBYTES) {
+			memset(&buffer[bufferPos], 0, WBLOCKBYTES - bufferPos);
+		}
+		/*
+		 * process data block:
+		 */
+		processBuffer(ctx);
+		/*
+		 * reset buffer:
+		 */
+		bufferPos = 0;
+	}
+	if (bufferPos < WBLOCKBYTES - LENGTHBYTES) {
+		memset(&buffer[bufferPos], 0, (WBLOCKBYTES - LENGTHBYTES) - bufferPos);
+	}
+	bufferPos = WBLOCKBYTES - LENGTHBYTES;
+	/*
+	 * append bit length of hashed data:
+	 */
+	memcpy(&buffer[WBLOCKBYTES - LENGTHBYTES], bitLength, LENGTHBYTES);
+	/*
+	 * process data block:
+	 */
+	processBuffer(ctx);
+	/*
+	 * return the completed message digest:
+	 */
+	for (i = 0; i < DIGESTBYTES/8; i++) {
+		digest[0] = (uint8_t)(ctx->hash[i] >> 56);
+		digest[1] = (uint8_t)(ctx->hash[i] >> 48);
+		digest[2] = (uint8_t)(ctx->hash[i] >> 40);
+		digest[3] = (uint8_t)(ctx->hash[i] >> 32);
+		digest[4] = (uint8_t)(ctx->hash[i] >> 24);
+		digest[5] = (uint8_t)(ctx->hash[i] >> 16);
+		digest[6] = (uint8_t)(ctx->hash[i] >>  8);
+		digest[7] = (uint8_t)(ctx->hash[i]      );
+		digest += 8;
+	}
+	ctx->bufferBits   = bufferBits;
+	ctx->bufferPos    = bufferPos;
+}
diff --git a/cbits/crypton_whirlpool.h b/cbits/crypton_whirlpool.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_whirlpool.h
@@ -0,0 +1,31 @@
+#ifndef CRYPTOHASH_WHIRLPOOL_H
+#define CRYPTOHASH_WHIRLPOOL_H
+
+#include <stdint.h>
+
+/*
+ * Whirlpool-specific definitions.
+ */
+
+#define DIGESTBYTES 64
+#define DIGESTBITS  (8*DIGESTBYTES) /* 512 */
+
+#define WBLOCKBYTES 64
+#define WBLOCKBITS  (8*WBLOCKBYTES) /* 512 */
+
+#define LENGTHBYTES 32
+#define LENGTHBITS  (8*LENGTHBYTES) /* 256 */
+
+typedef struct whirlpool_ctx {
+	uint8_t  bitLength[LENGTHBYTES]; /* global number of hashed bits (256-bit counter) */
+	uint8_t  buffer[WBLOCKBYTES];    /* buffer of data to hash */
+	uint32_t bufferBits;             /* current number of bits on the buffer */
+	uint32_t bufferPos;              /* current (possibly incomplete) byte slot on the buffer */
+	uint64_t hash[DIGESTBYTES/8];    /* the hashing state */
+} whirlpool_ctx;
+
+void crypton_whirlpool_init(struct whirlpool_ctx * const ctx);
+void crypton_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t len);
+void crypton_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result);
+
+#endif
diff --git a/cbits/crypton_xsalsa.c b/cbits/crypton_xsalsa.c
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_xsalsa.c
@@ -0,0 +1,90 @@
+/*
+ * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>
+ * 
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <stdint.h>
+#include <string.h>
+#include "crypton_xsalsa.h"
+#include "crypton_align.h"
+#include "crypton_bitfn.h"
+
+/* XSalsa20 algorithm as described in https://cr.yp.to/snuffle/xsalsa-20081128.pdf */
+void crypton_xsalsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds,
+                            uint32_t keylen, const uint8_t *key,
+                            uint32_t ivlen, const uint8_t *iv)
+{
+  memset(ctx, 0, sizeof(*ctx));
+  ctx->nb_rounds = nb_rounds;
+
+  /* Create initial 512-bit input block:
+       (x0, x5, x10, x15) is the Salsa20 constant
+       (x1, x2, x3, x4, x11, x12, x13, x14) is a 256-bit key
+       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce
+  */
+  crypton_salsa_init_core(&ctx->st, keylen, key, 8, iv);
+
+  /* Continue initialization in a separate function that may also
+     be called independently */
+  crypton_xsalsa_derive(ctx, ivlen - 8, iv + 8);
+}
+
+void crypton_xsalsa_derive(crypton_salsa_context *ctx,
+                              uint32_t ivlen, const uint8_t *iv)
+{
+  /* Finish creating initial 512-bit input block:
+       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce
+
+     Except iv has been shifted by 64 bits so there are now only 128 bits ahead.
+  */
+  ctx->st.d[ 8] += load_le32(iv + 0);
+  ctx->st.d[ 9] += load_le32(iv + 4);
+
+  /* Compute (z0, z1, . . . , z15) = doubleround ^(r/2) (x0, x1, . . . , x15) */
+  block hSalsa;
+  memset(&hSalsa, 0, sizeof(block));
+  crypton_salsa_core_xor(ctx->nb_rounds, &hSalsa, &ctx->st);
+ 
+  /* Build a new 512-bit input block (x′0, x′1, . . . , x′15):
+       (x′0, x′5, x′10, x′15) is the Salsa20 constant
+       (x′1,x′2,x′3,x′4,x′11,x′12,x′13,x′14) = (z0,z5,z10,z15,z6,z7,z8,z9)
+       (x′6,x′7) is the last 64 bits of the 192-bit nonce
+       (x′8, x′9) is a 64-bit block counter.
+  */
+  ctx->st.d[ 1] = hSalsa.d[ 0] - ctx->st.d[ 0];
+  ctx->st.d[ 2] = hSalsa.d[ 5] - ctx->st.d[ 5];
+  ctx->st.d[ 3] = hSalsa.d[10] - ctx->st.d[10];
+  ctx->st.d[ 4] = hSalsa.d[15] - ctx->st.d[15];
+  ctx->st.d[11] = hSalsa.d[ 6] - ctx->st.d[ 6];
+  ctx->st.d[12] = hSalsa.d[ 7] - ctx->st.d[ 7];
+  ctx->st.d[13] = hSalsa.d[ 8] - ctx->st.d[ 8];
+  ctx->st.d[14] = hSalsa.d[ 9] - ctx->st.d[ 9];
+  ctx->st.d[ 6] = load_le32(iv + 8);
+  ctx->st.d[ 7] = load_le32(iv + 12);
+  ctx->st.d[ 8] = 0;
+  ctx->st.d[ 9] = 0;
+}
diff --git a/cbits/crypton_xsalsa.h b/cbits/crypton_xsalsa.h
new file mode 100644
--- /dev/null
+++ b/cbits/crypton_xsalsa.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the author nor the names of his contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#ifndef CRYPTON_XSALSA
+#define CRYPTON_XSALSA
+
+#include "crypton_salsa.h"
+
+void crypton_xsalsa_init(crypton_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
+void crypton_xsalsa_derive(crypton_salsa_context *ctx, uint32_t ivlen, const uint8_t *iv);
+
+#endif
diff --git a/cbits/cryptonite_aes.c b/cbits/cryptonite_aes.c
deleted file mode 100644
--- a/cbits/cryptonite_aes.c
+++ /dev/null
@@ -1,1109 +0,0 @@
-/*
- * Copyright (c) 2012 Vincent Hanquez <vincent@snarc.org>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <string.h>
-#include <stdio.h>
-
-#include <cryptonite_cpu.h>
-#include <cryptonite_aes.h>
-#include <cryptonite_bitfn.h>
-
-#include <aes/generic.h>
-#include <aes/gf.h>
-#include <aes/x86ni.h>
-
-void cryptonite_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);
-void cryptonite_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);
-void cryptonite_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
-
-enum {
-	/* init */
-	INIT_128, INIT_192, INIT_256,
-	/* single block */
-	ENCRYPT_BLOCK_128, ENCRYPT_BLOCK_192, ENCRYPT_BLOCK_256,
-	DECRYPT_BLOCK_128, DECRYPT_BLOCK_192, DECRYPT_BLOCK_256,
-	/* ecb */
-	ENCRYPT_ECB_128, ENCRYPT_ECB_192, ENCRYPT_ECB_256,
-	DECRYPT_ECB_128, DECRYPT_ECB_192, DECRYPT_ECB_256,
-	/* cbc */
-	ENCRYPT_CBC_128, ENCRYPT_CBC_192, ENCRYPT_CBC_256,
-	DECRYPT_CBC_128, DECRYPT_CBC_192, DECRYPT_CBC_256,
-	/* ctr */
-	ENCRYPT_CTR_128, ENCRYPT_CTR_192, ENCRYPT_CTR_256,
-	/* ctr with 32-bit wrapping */
-	ENCRYPT_C32_128, ENCRYPT_C32_192, ENCRYPT_C32_256,
-	/* xts */
-	ENCRYPT_XTS_128, ENCRYPT_XTS_192, ENCRYPT_XTS_256,
-	DECRYPT_XTS_128, DECRYPT_XTS_192, DECRYPT_XTS_256,
-	/* gcm */
-	ENCRYPT_GCM_128, ENCRYPT_GCM_192, ENCRYPT_GCM_256,
-	DECRYPT_GCM_128, DECRYPT_GCM_192, DECRYPT_GCM_256,
-	/* ocb */
-	ENCRYPT_OCB_128, ENCRYPT_OCB_192, ENCRYPT_OCB_256,
-	DECRYPT_OCB_128, DECRYPT_OCB_192, DECRYPT_OCB_256,
-	/* ccm */
-	ENCRYPT_CCM_128, ENCRYPT_CCM_192, ENCRYPT_CCM_256,
-	DECRYPT_CCM_128, DECRYPT_CCM_192, DECRYPT_CCM_256,
-	/* ghash */
-	GHASH_HINIT, GHASH_GF_MUL,
-};
-
-void *cryptonite_aes_branch_table[] = {
-	/* INIT */
-	[INIT_128]          = cryptonite_aes_generic_init,
-	[INIT_192]          = cryptonite_aes_generic_init,
-	[INIT_256]          = cryptonite_aes_generic_init,
-	/* BLOCK */
-	[ENCRYPT_BLOCK_128] = cryptonite_aes_generic_encrypt_block,
-	[ENCRYPT_BLOCK_192] = cryptonite_aes_generic_encrypt_block,
-	[ENCRYPT_BLOCK_256] = cryptonite_aes_generic_encrypt_block,
-	[DECRYPT_BLOCK_128] = cryptonite_aes_generic_decrypt_block,
-	[DECRYPT_BLOCK_192] = cryptonite_aes_generic_decrypt_block,
-	[DECRYPT_BLOCK_256] = cryptonite_aes_generic_decrypt_block,
-	/* ECB */
-	[ENCRYPT_ECB_128]   = cryptonite_aes_generic_encrypt_ecb,
-	[ENCRYPT_ECB_192]   = cryptonite_aes_generic_encrypt_ecb,
-	[ENCRYPT_ECB_256]   = cryptonite_aes_generic_encrypt_ecb,
-	[DECRYPT_ECB_128]   = cryptonite_aes_generic_decrypt_ecb,
-	[DECRYPT_ECB_192]   = cryptonite_aes_generic_decrypt_ecb,
-	[DECRYPT_ECB_256]   = cryptonite_aes_generic_decrypt_ecb,
-	/* CBC */
-	[ENCRYPT_CBC_128]   = cryptonite_aes_generic_encrypt_cbc,
-	[ENCRYPT_CBC_192]   = cryptonite_aes_generic_encrypt_cbc,
-	[ENCRYPT_CBC_256]   = cryptonite_aes_generic_encrypt_cbc,
-	[DECRYPT_CBC_128]   = cryptonite_aes_generic_decrypt_cbc,
-	[DECRYPT_CBC_192]   = cryptonite_aes_generic_decrypt_cbc,
-	[DECRYPT_CBC_256]   = cryptonite_aes_generic_decrypt_cbc,
-	/* CTR */
-	[ENCRYPT_CTR_128]   = cryptonite_aes_generic_encrypt_ctr,
-	[ENCRYPT_CTR_192]   = cryptonite_aes_generic_encrypt_ctr,
-	[ENCRYPT_CTR_256]   = cryptonite_aes_generic_encrypt_ctr,
-	/* CTR with 32-bit wrapping */
-	[ENCRYPT_C32_128]   = cryptonite_aes_generic_encrypt_c32,
-	[ENCRYPT_C32_192]   = cryptonite_aes_generic_encrypt_c32,
-	[ENCRYPT_C32_256]   = cryptonite_aes_generic_encrypt_c32,
-	/* XTS */
-	[ENCRYPT_XTS_128]   = cryptonite_aes_generic_encrypt_xts,
-	[ENCRYPT_XTS_192]   = cryptonite_aes_generic_encrypt_xts,
-	[ENCRYPT_XTS_256]   = cryptonite_aes_generic_encrypt_xts,
-	[DECRYPT_XTS_128]   = cryptonite_aes_generic_decrypt_xts,
-	[DECRYPT_XTS_192]   = cryptonite_aes_generic_decrypt_xts,
-	[DECRYPT_XTS_256]   = cryptonite_aes_generic_decrypt_xts,
-	/* GCM */
-	[ENCRYPT_GCM_128]   = cryptonite_aes_generic_gcm_encrypt,
-	[ENCRYPT_GCM_192]   = cryptonite_aes_generic_gcm_encrypt,
-	[ENCRYPT_GCM_256]   = cryptonite_aes_generic_gcm_encrypt,
-	[DECRYPT_GCM_128]   = cryptonite_aes_generic_gcm_decrypt,
-	[DECRYPT_GCM_192]   = cryptonite_aes_generic_gcm_decrypt,
-	[DECRYPT_GCM_256]   = cryptonite_aes_generic_gcm_decrypt,
-	/* OCB */
-	[ENCRYPT_OCB_128]   = cryptonite_aes_generic_ocb_encrypt,
-	[ENCRYPT_OCB_192]   = cryptonite_aes_generic_ocb_encrypt,
-	[ENCRYPT_OCB_256]   = cryptonite_aes_generic_ocb_encrypt,
-	[DECRYPT_OCB_128]   = cryptonite_aes_generic_ocb_decrypt,
-	[DECRYPT_OCB_192]   = cryptonite_aes_generic_ocb_decrypt,
-	[DECRYPT_OCB_256]   = cryptonite_aes_generic_ocb_decrypt,
-	/* CCM */
-	[ENCRYPT_CCM_128]   = cryptonite_aes_generic_ccm_encrypt,
-	[ENCRYPT_CCM_192]   = cryptonite_aes_generic_ccm_encrypt,
-	[ENCRYPT_CCM_256]   = cryptonite_aes_generic_ccm_encrypt,
-	[DECRYPT_CCM_128]   = cryptonite_aes_generic_ccm_decrypt,
-	[DECRYPT_CCM_192]   = cryptonite_aes_generic_ccm_decrypt,
-	[DECRYPT_CCM_256]   = cryptonite_aes_generic_ccm_decrypt,
-	/* GHASH */
-	[GHASH_HINIT]       = cryptonite_aes_generic_hinit,
-	[GHASH_GF_MUL]      = cryptonite_aes_generic_gf_mul,
-};
-
-typedef void (*init_f)(aes_key *, uint8_t *, uint8_t);
-typedef void (*ecb_f)(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
-typedef void (*cbc_f)(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
-typedef void (*ctr_f)(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t length);
-typedef void (*xts_f)(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit, uint32_t spoint, aes_block *input, uint32_t nb_blocks);
-typedef void (*gcm_crypt_f)(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
-typedef void (*ocb_crypt_f)(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
-typedef void (*ccm_crypt_f)(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
-typedef void (*block_f)(aes_block *output, aes_key *key, aes_block *input);
-typedef void (*hinit_f)(table_4bit htable, const block128 *h);
-typedef void (*gf_mul_f)(block128 *a, const table_4bit htable);
-
-#ifdef WITH_AESNI
-#define GET_INIT(strength) \
-	((init_f) (cryptonite_aes_branch_table[INIT_128 + strength]))
-#define GET_ECB_ENCRYPT(strength) \
-	((ecb_f) (cryptonite_aes_branch_table[ENCRYPT_ECB_128 + strength]))
-#define GET_ECB_DECRYPT(strength) \
-	((ecb_f) (cryptonite_aes_branch_table[DECRYPT_ECB_128 + strength]))
-#define GET_CBC_ENCRYPT(strength) \
-	((cbc_f) (cryptonite_aes_branch_table[ENCRYPT_CBC_128 + strength]))
-#define GET_CBC_DECRYPT(strength) \
-	((cbc_f) (cryptonite_aes_branch_table[DECRYPT_CBC_128 + strength]))
-#define GET_CTR_ENCRYPT(strength) \
-	((ctr_f) (cryptonite_aes_branch_table[ENCRYPT_CTR_128 + strength]))
-#define GET_C32_ENCRYPT(strength) \
-	((ctr_f) (cryptonite_aes_branch_table[ENCRYPT_C32_128 + strength]))
-#define GET_XTS_ENCRYPT(strength) \
-	((xts_f) (cryptonite_aes_branch_table[ENCRYPT_XTS_128 + strength]))
-#define GET_XTS_DECRYPT(strength) \
-	((xts_f) (cryptonite_aes_branch_table[DECRYPT_XTS_128 + strength]))
-#define GET_GCM_ENCRYPT(strength) \
-	((gcm_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_GCM_128 + strength]))
-#define GET_GCM_DECRYPT(strength) \
-	((gcm_crypt_f) (cryptonite_aes_branch_table[DECRYPT_GCM_128 + strength]))
-#define GET_OCB_ENCRYPT(strength) \
-	((ocb_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_OCB_128 + strength]))
-#define GET_OCB_DECRYPT(strength) \
-	((ocb_crypt_f) (cryptonite_aes_branch_table[DECRYPT_OCB_128 + strength]))
-#define GET_CCM_ENCRYPT(strength) \
-	((ccm_crypt_f) (cryptonite_aes_branch_table[ENCRYPT_CCM_128 + strength]))
-#define GET_CCM_DECRYPT(strength) \
-	((ccm_crypt_f) (cryptonite_aes_branch_table[DECRYPT_CCM_128 + strength]))
-#define cryptonite_aes_encrypt_block(o,k,i) \
-	(((block_f) (cryptonite_aes_branch_table[ENCRYPT_BLOCK_128 + k->strength]))(o,k,i))
-#define cryptonite_aes_decrypt_block(o,k,i) \
-	(((block_f) (cryptonite_aes_branch_table[DECRYPT_BLOCK_128 + k->strength]))(o,k,i))
-#define cryptonite_hinit(t,h) \
-	(((hinit_f) (cryptonite_aes_branch_table[GHASH_HINIT]))(t,h))
-#define cryptonite_gf_mul(a,t) \
-	(((gf_mul_f) (cryptonite_aes_branch_table[GHASH_GF_MUL]))(a,t))
-#else
-#define GET_INIT(strenght) cryptonite_aes_generic_init
-#define GET_ECB_ENCRYPT(strength) cryptonite_aes_generic_encrypt_ecb
-#define GET_ECB_DECRYPT(strength) cryptonite_aes_generic_decrypt_ecb
-#define GET_CBC_ENCRYPT(strength) cryptonite_aes_generic_encrypt_cbc
-#define GET_CBC_DECRYPT(strength) cryptonite_aes_generic_decrypt_cbc
-#define GET_CTR_ENCRYPT(strength) cryptonite_aes_generic_encrypt_ctr
-#define GET_C32_ENCRYPT(strength) cryptonite_aes_generic_encrypt_c32
-#define GET_XTS_ENCRYPT(strength) cryptonite_aes_generic_encrypt_xts
-#define GET_XTS_DECRYPT(strength) cryptonite_aes_generic_decrypt_xts
-#define GET_GCM_ENCRYPT(strength) cryptonite_aes_generic_gcm_encrypt
-#define GET_GCM_DECRYPT(strength) cryptonite_aes_generic_gcm_decrypt
-#define GET_OCB_ENCRYPT(strength) cryptonite_aes_generic_ocb_encrypt
-#define GET_OCB_DECRYPT(strength) cryptonite_aes_generic_ocb_decrypt
-#define GET_CCM_ENCRYPT(strength) cryptonite_aes_generic_ccm_encrypt
-#define GET_CCM_DECRYPT(strength) cryptonite_aes_generic_ccm_decrypt
-#define cryptonite_aes_encrypt_block(o,k,i) cryptonite_aes_generic_encrypt_block(o,k,i)
-#define cryptonite_aes_decrypt_block(o,k,i) cryptonite_aes_generic_decrypt_block(o,k,i)
-#define cryptonite_hinit(t,h) cryptonite_aes_generic_hinit(t,h)
-#define cryptonite_gf_mul(a,t) cryptonite_aes_generic_gf_mul(a,t)
-#endif
-
-#define CPU_AESNI        0
-#define CPU_PCLMUL       1
-#define CPU_OPTION_COUNT 2
-
-static uint8_t cryptonite_aes_cpu_options[CPU_OPTION_COUNT] = {};
-
-#if defined(ARCH_X86) && defined(WITH_AESNI)
-static void initialize_table_ni(int aesni, int pclmul)
-{
-	if (!aesni)
-		return;
-	cryptonite_aes_cpu_options[CPU_AESNI] = 1;
-
-	cryptonite_aes_branch_table[INIT_128] = cryptonite_aesni_init;
-	cryptonite_aes_branch_table[INIT_256] = cryptonite_aesni_init;
-
-	cryptonite_aes_branch_table[ENCRYPT_BLOCK_128] = cryptonite_aesni_encrypt_block128;
-	cryptonite_aes_branch_table[DECRYPT_BLOCK_128] = cryptonite_aesni_decrypt_block128;
-	cryptonite_aes_branch_table[ENCRYPT_BLOCK_256] = cryptonite_aesni_encrypt_block256;
-	cryptonite_aes_branch_table[DECRYPT_BLOCK_256] = cryptonite_aesni_decrypt_block256;
-	/* ECB */
-	cryptonite_aes_branch_table[ENCRYPT_ECB_128] = cryptonite_aesni_encrypt_ecb128;
-	cryptonite_aes_branch_table[DECRYPT_ECB_128] = cryptonite_aesni_decrypt_ecb128;
-	cryptonite_aes_branch_table[ENCRYPT_ECB_256] = cryptonite_aesni_encrypt_ecb256;
-	cryptonite_aes_branch_table[DECRYPT_ECB_256] = cryptonite_aesni_decrypt_ecb256;
-	/* CBC */
-	cryptonite_aes_branch_table[ENCRYPT_CBC_128] = cryptonite_aesni_encrypt_cbc128;
-	cryptonite_aes_branch_table[DECRYPT_CBC_128] = cryptonite_aesni_decrypt_cbc128;
-	cryptonite_aes_branch_table[ENCRYPT_CBC_256] = cryptonite_aesni_encrypt_cbc256;
-	cryptonite_aes_branch_table[DECRYPT_CBC_256] = cryptonite_aesni_decrypt_cbc256;
-	/* CTR */
-	cryptonite_aes_branch_table[ENCRYPT_CTR_128] = cryptonite_aesni_encrypt_ctr128;
-	cryptonite_aes_branch_table[ENCRYPT_CTR_256] = cryptonite_aesni_encrypt_ctr256;
-	/* CTR with 32-bit wrapping */
-	cryptonite_aes_branch_table[ENCRYPT_C32_128] = cryptonite_aesni_encrypt_c32_128;
-	cryptonite_aes_branch_table[ENCRYPT_C32_256] = cryptonite_aesni_encrypt_c32_256;
-	/* XTS */
-	cryptonite_aes_branch_table[ENCRYPT_XTS_128] = cryptonite_aesni_encrypt_xts128;
-	cryptonite_aes_branch_table[ENCRYPT_XTS_256] = cryptonite_aesni_encrypt_xts256;
-	/* GCM */
-	cryptonite_aes_branch_table[ENCRYPT_GCM_128] = cryptonite_aesni_gcm_encrypt128;
-	cryptonite_aes_branch_table[ENCRYPT_GCM_256] = cryptonite_aesni_gcm_encrypt256;
-	/* OCB */
-	/*
-	cryptonite_aes_branch_table[ENCRYPT_OCB_128] = cryptonite_aesni_ocb_encrypt128;
-	cryptonite_aes_branch_table[ENCRYPT_OCB_256] = cryptonite_aesni_ocb_encrypt256;
-	*/
-#ifdef WITH_PCLMUL
-	if (!pclmul)
-		return;
-	cryptonite_aes_cpu_options[CPU_PCLMUL] = 1;
-
-	/* GHASH */
-	cryptonite_aes_branch_table[GHASH_HINIT]     = cryptonite_aesni_hinit_pclmul,
-	cryptonite_aes_branch_table[GHASH_GF_MUL]    = cryptonite_aesni_gf_mul_pclmul,
-	cryptonite_aesni_init_pclmul();
-#endif
-}
-#endif
-
-uint8_t *cryptonite_aes_cpu_init(void)
-{
-#if defined(ARCH_X86) && defined(WITH_AESNI)
-	cryptonite_aesni_initialize_hw(initialize_table_ni);
-#endif
-	return cryptonite_aes_cpu_options;
-}
-
-void cryptonite_aes_initkey(aes_key *key, uint8_t *origkey, uint8_t size)
-{
-	switch (size) {
-	case 16: key->nbr = 10; key->strength = 0; break;
-	case 24: key->nbr = 12; key->strength = 1; break;
-	case 32: key->nbr = 14; key->strength = 2; break;
-	}
-	cryptonite_aes_cpu_init();
-	init_f _init = GET_INIT(key->strength);
-	_init(key, origkey, size);
-}
-
-void cryptonite_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
-{
-	ecb_f e = GET_ECB_ENCRYPT(key->strength);
-	e(output, key, input, nb_blocks);
-}
-
-void cryptonite_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
-{
-	ecb_f d = GET_ECB_DECRYPT(key->strength);
-	d(output, key, input, nb_blocks);
-}
-
-void cryptonite_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)
-{
-	cbc_f e = GET_CBC_ENCRYPT(key->strength);
-	e(output, key, iv, input, nb_blocks);
-}
-
-void cryptonite_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)
-{
-	cbc_f d = GET_CBC_DECRYPT(key->strength);
-	d(output, key, iv, input, nb_blocks);
-}
-
-void cryptonite_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks)
-{
-	aes_block block;
-
-	/* preload IV in block */
-	block128_copy(&block, iv);
-
-	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {
-		cryptonite_aes_encrypt_block(output, key, &block);
-	}
-}
-
-void cryptonite_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks)
-{
-	aes_block block;
-
-	/* preload IV in block */
-	block128_copy(&block, iv);
-
-	for ( ; nb_blocks-- > 0; output++, block128_inc_be(&block)) {
-		cryptonite_aes_encrypt_block(output, key, &block);
-	}
-
-	/* copy back the IV */
-	block128_copy(iv, &block);
-}
-
-void cryptonite_aes_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
-{
-	ctr_f e = GET_CTR_ENCRYPT(key->strength);
-	e(output, key, iv, input, len);
-}
-
-void cryptonite_aes_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
-{
-	ctr_f e = GET_C32_ENCRYPT(key->strength);
-	e(output, key, iv, input, len);
-}
-
-void cryptonite_aes_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)
-{
-	xts_f e = GET_XTS_ENCRYPT(k1->strength);
-	e(output, k1, k2, dataunit, spoint, input, nb_blocks);
-}
-
-void cryptonite_aes_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks)
-{
-	cryptonite_aes_generic_decrypt_xts(output, k1, k2, dataunit, spoint, input, nb_blocks);
-}
-
-void cryptonite_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	gcm_crypt_f e = GET_GCM_ENCRYPT(key->strength);
-	e(output, gcm, key, input, length);
-}
-
-void cryptonite_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	gcm_crypt_f d = GET_GCM_DECRYPT(key->strength);
-	d(output, gcm, key, input, length);
-}
-
-void cryptonite_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	ccm_crypt_f e = GET_CCM_ENCRYPT(key->strength);
-	e(output, ccm, key, input, length);
-}
-
-void cryptonite_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	ccm_crypt_f d = GET_CCM_DECRYPT(key->strength);
-	d(output, ccm, key, input, length);
-}
-
-void cryptonite_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
-{
-	ocb_crypt_f e = GET_OCB_ENCRYPT(key->strength);
-	e(output, ocb, key, input, length);
-}
-
-void cryptonite_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
-{
-	ocb_crypt_f d = GET_OCB_DECRYPT(key->strength);
-	d(output, ocb, key, input, length);
-}
-
-static void gcm_ghash_add(aes_gcm *gcm, block128 *b)
-{
-	block128_xor(&gcm->tag, b);
-	cryptonite_gf_mul(&gcm->tag, gcm->htable);
-}
-
-void cryptonite_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len)
-{
-	block128 h;
-	gcm->length_aad = 0;
-	gcm->length_input = 0;
-
-	block128_zero(&h);
-	block128_zero(&gcm->tag);
-	block128_zero(&gcm->iv);
-
-	/* prepare H : encrypt_K(0^128) */
-	cryptonite_aes_encrypt_block(&h, key, &h);
-	cryptonite_hinit(gcm->htable, &h);
-
-	if (len == 12) {
-		block128_copy_bytes(&gcm->iv, iv, 12);
-		gcm->iv.b[15] = 0x01;
-	} else {
-		uint32_t origlen = len << 3;
-		int i;
-		for (; len >= 16; len -= 16, iv += 16) {
-			block128_xor(&gcm->iv, (block128 *) iv);
-			cryptonite_gf_mul(&gcm->iv, gcm->htable);
-		}
-		if (len > 0) {
-			block128_xor_bytes(&gcm->iv, iv, len);
-			cryptonite_gf_mul(&gcm->iv, gcm->htable);
-		}
-		for (i = 15; origlen; --i, origlen >>= 8)
-			gcm->iv.b[i] ^= (uint8_t) origlen;
-		cryptonite_gf_mul(&gcm->iv, gcm->htable);
-	}
-
-	block128_copy_aligned(&gcm->civ, &gcm->iv);
-}
-
-void cryptonite_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length)
-{
-	gcm->length_aad += length;
-	for (; length >= 16; input += 16, length -= 16) {
-		gcm_ghash_add(gcm, (block128 *) input);
-	}
-	if (length > 0) {
-		aes_block tmp;
-		block128_zero(&tmp);
-		block128_copy_bytes(&tmp, input, length);
-		gcm_ghash_add(gcm, &tmp);
-	}
-
-}
-
-void cryptonite_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key)
-{
-	aes_block lblock;
-	int i;
-
-	/* tag = (tag-1 xor (lenbits(a) | lenbits(c)) ) . H */
-	lblock.q[0] = cpu_to_be64(gcm->length_aad << 3);
-	lblock.q[1] = cpu_to_be64(gcm->length_input << 3);
-	gcm_ghash_add(gcm, &lblock);
-
-	cryptonite_aes_encrypt_block(&lblock, key, &gcm->iv);
-	block128_xor_aligned(&gcm->tag, &lblock);
-
-	for (i = 0; i < 16; i++) {
-		tag[i] = gcm->tag.b[i];
-	}
-}
-
-static inline uint8_t ccm_b0_flags(uint32_t has_adata, uint32_t m, uint32_t l)
-{
-	return 8*m + l + (has_adata? 64: 0);
-}
-
-/* depends on input size */
-static void ccm_encode_b0(block128* output, aes_ccm* ccm, uint32_t has_adata)
-{
-	int last = 15;
-	uint32_t m = ccm->length_M;
-	uint32_t l = ccm->length_L;
-	uint32_t msg_len = ccm->length_input;
-
-	block128_zero(output);
-	block128_copy_aligned(output, &ccm->nonce);
-	output->b[0] = ccm_b0_flags(has_adata, (m-2)/2, l-1);
-	while (msg_len > 0) {
-		output->b[last--] = msg_len & 0xff;
-		msg_len >>= 8;
-	}
-}
-
-/* encode adata length */
-static int ccm_encode_la(block128* output, uint32_t la)
-{
-	if (la < ( (1 << 16) - (1 << 8)) ) {
-		output->b[0] = (la >> 8) & 0xff;
-		output->b[1] = la        & 0xff;
-		return 2;
-	} else {
-		output->b[0] = 0xff;
-		output->b[1] = 0xfe;
-		output->b[2] = (la >> 24) & 0xff;
-		output->b[3] = (la >> 16) & 0xff;
-		output->b[4] = (la >>  8) & 0xff;
-		output->b[5] = la         & 0xff;
-		return 6;
-	}
-}
-
-static void ccm_encode_ctr(block128* out, aes_ccm* ccm, unsigned int cnt)
-{
-	int last = 15;
-	block128_copy_aligned(out, &ccm->nonce);
-	out->b[0] = ccm->length_L - 1;
-
-	while (cnt > 0) {
-		out->b[last--] = cnt & 0xff;
-		cnt >>= 8;
-	}
-}
-
-static void ccm_cbcmac_add(aes_ccm* ccm, aes_key* key, block128* bi)
-{
-	block128_xor_aligned(&ccm->xi, bi);
-	cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->xi);
-}
-
-/* even though it is possible to support message size as large as 2^64, we support up to 2^32 only */
-void cryptonite_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t nonce_len, uint32_t input_size, int m, int l)
-{
-	memset(ccm, 0, sizeof(aes_ccm));
-
-	if (l < 2 || l > 4) return;
-	if (m != 4 && m != 6 && m != 8 && m != 10
-		   && m != 12 && m != 14 && m != 16) return;
-
-	if (nonce_len > 15 - l) {
-		nonce_len = 15 - l;
-	}
-
-	if (l <= 4) {
-		if (input_size >= (1ull << (8*l))) return;
-	}
-
-	ccm->length_L = l;
-	ccm->length_M = m;
-	ccm->length_input = input_size;
-
-	memcpy(&ccm->nonce.b[1], nonce, nonce_len);
-
-	ccm_encode_b0(&ccm->b0, ccm, 1); /* assume aad is present */
-	cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->b0);
-}
-
-/* even though l(a) can be as large as 2^64, we only handle aad up to 2 ^ 32 for practical reasons.
-  Also we don't support incremental aad add, because the 1st encoded adata has length information
- */
-void cryptonite_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	block128 tmp;
-
-	if (ccm->length_aad != 0) return;
-
-	ccm->length_aad = length;
-	int len_len;
-
-	block128_zero(&tmp);
-	len_len = ccm_encode_la(&tmp, length);
-
-	if (length < 16 - len_len) {
-		memcpy(&tmp.b[len_len], input, length);
-		length = 0;
-	} else {
-		memcpy(&tmp.b[len_len], input, 16 - len_len);
-		input += 16 - len_len;
-		length -= 16 - len_len;
-	}
-
-	ccm_cbcmac_add(ccm, key, &tmp);
-
-	for (; length >= 16; input += 16, length -= 16) {
-		block128_copy(&tmp, (block128*)input);
-		ccm_cbcmac_add(ccm, key, &tmp);
-
-	}
-	if (length > 0) {
-		block128_zero(&tmp);
-		block128_copy_bytes(&tmp, input, length);
-		ccm_cbcmac_add(ccm, key, &tmp);
-	}
-	block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);
-}
-
-void cryptonite_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key)
-{
-	block128 iv, s0;
-
-	block128_zero(&iv);
-	ccm_encode_ctr(&iv, ccm, 0);
-	cryptonite_aes_encrypt_block(&s0, key, &iv);
-	block128_vxor((block128*)tag, &ccm->xi, &s0);
-}
-
-static inline void ocb_block_double(block128 *d, block128 *s)
-{
-	unsigned int i;
-	uint8_t tmp = s->b[0];
-
-	for (i=0; i<15; i++)
-		d->b[i] = (s->b[i] << 1) | (s->b[i+1] >> 7);
-	d->b[15] = (s->b[15] << 1) ^ ((tmp >> 7) * 0x87);
-}
-
-static void ocb_get_L_i(block128 *l, block128 *lis, unsigned int i)
-{
-#define L_CACHED 4
-	i = bitfn_ntz(i);
-	if (i < L_CACHED) {
-		block128_copy(l, &lis[i]);
-	} else {
-		i -= (L_CACHED - 1);
-		block128_copy(l, &lis[L_CACHED - 1]);
-		while (i--) {
-			ocb_block_double(l, l);
-		}
-	}
-#undef L_CACHED
-}
-
-void cryptonite_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len)
-{
-	block128 tmp, nonce, ktop;
-	unsigned char stretch[24];
-	unsigned bottom, byteshift, bitshift, i;
-
-	/* we don't accept more than 15 bytes, any bytes higher will be ignored. */
-	if (len > 15) {
-		len = 15;
-	}
-
-	/* create L*, and L$,L0,L1,L2,L3 */
-	block128_zero(&tmp);
-	cryptonite_aes_encrypt_block(&ocb->lstar, key, &tmp);
-
-	ocb_block_double(&ocb->ldollar, &ocb->lstar);
-	ocb_block_double(&ocb->li[0], &ocb->ldollar);
-	ocb_block_double(&ocb->li[1], &ocb->li[0]);
-	ocb_block_double(&ocb->li[2], &ocb->li[1]);
-	ocb_block_double(&ocb->li[3], &ocb->li[2]);
-
-	/* create strech from the nonce */
-	block128_zero(&nonce);
-	memcpy(nonce.b + 4, iv, 12);
-	nonce.b[0] = (unsigned char)(((16 * 8) % 128) << 1);
-	nonce.b[16-12-1] |= 0x01;
-	bottom = nonce.b[15] & 0x3F;
-	nonce.b[15] &= 0xC0;
-	cryptonite_aes_encrypt_block(&ktop, key, &nonce);
-	memcpy(stretch, ktop.b, 16);
-
-	memcpy(tmp.b, ktop.b + 1, 8);
-	block128_xor_aligned(&tmp, &ktop);
-	memcpy(stretch + 16, tmp.b, 8);
-
-	/* initialize the encryption offset from stretch */
-	byteshift = bottom / 8;
-	bitshift = bottom % 8;
-	if (bitshift != 0)
-		for (i = 0; i < 16; i++)
-			ocb->offset_enc.b[i] = (stretch[i+byteshift] << bitshift)
-			                     | (stretch[i+byteshift+1] >> (8-bitshift));
-	else
-		for (i = 0; i < 16; i++)
-			ocb->offset_enc.b[i] = stretch[i+byteshift];
-	/* initialize checksum for aad and encryption, and the aad offset */
-	block128_zero(&ocb->sum_aad);
-	block128_zero(&ocb->sum_enc);
-	block128_zero(&ocb->offset_aad);
-}
-
-void cryptonite_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
-{
-	block128 tmp;
-	unsigned int i;
-
-	for (i=1; i<= length/16; i++, input=input+16) {
-		ocb_get_L_i(&tmp, ocb->li, i);
-		block128_xor_aligned(&ocb->offset_aad, &tmp);
-
-		block128_vxor(&tmp, &ocb->offset_aad, (block128 *) input);
-		cryptonite_aes_encrypt_block(&tmp, key, &tmp);
-		block128_xor_aligned(&ocb->sum_aad, &tmp);
-	}
-
-	length = length % 16; /* Bytes in final block */
-	if (length > 0) {
-		block128_xor_aligned(&ocb->offset_aad, &ocb->lstar);
-		block128_zero(&tmp);
-		block128_copy_bytes(&tmp, input, length);
-		tmp.b[length] = 0x80;
-		block128_xor_aligned(&tmp, &ocb->offset_aad);
-		cryptonite_aes_encrypt_block(&tmp, key, &tmp);
-		block128_xor_aligned(&ocb->sum_aad, &tmp);
-	}
-}
-
-void cryptonite_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key)
-{
-	block128 tmp;
-
-	block128_vxor_aligned(&tmp, &ocb->sum_enc, &ocb->offset_enc);
-	block128_xor_aligned(&tmp, &ocb->ldollar);
-	cryptonite_aes_encrypt_block((block128 *) tag, key, &tmp);
-	block128_xor((block128 *) tag, &ocb->sum_aad);
-}
-
-void cryptonite_aes_generic_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
-{
-	for ( ; nb_blocks-- > 0; input++, output++) {
-		cryptonite_aes_generic_encrypt_block(output, key, input);
-	}
-}
-
-void cryptonite_aes_generic_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks)
-{
-	for ( ; nb_blocks-- > 0; input++, output++) {
-		cryptonite_aes_generic_decrypt_block(output, key, input);
-	}
-}
-
-void cryptonite_aes_generic_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks)
-{
-	aes_block block;
-
-	/* preload IV in block */
-	block128_copy(&block, iv);
-	for ( ; nb_blocks-- > 0; input++, output++) {
-		block128_xor(&block, (block128 *) input);
-		cryptonite_aes_generic_encrypt_block(&block, key, &block);
-		block128_copy((block128 *) output, &block);
-	}
-}
-
-void cryptonite_aes_generic_decrypt_cbc(aes_block *output, aes_key *key, aes_block *ivini, aes_block *input, uint32_t nb_blocks)
-{
-	aes_block block, blocko;
-	aes_block iv;
-
-	/* preload IV in block */
-	block128_copy(&iv, ivini);
-	for ( ; nb_blocks-- > 0; input++, output++) {
-		block128_copy(&block, (block128 *) input);
-		cryptonite_aes_generic_decrypt_block(&blocko, key, &block);
-		block128_vxor((block128 *) output, &blocko, &iv);
-		block128_copy(&iv, &block);
-	}
-}
-
-void cryptonite_aes_generic_encrypt_ctr(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
-{
-	aes_block block, o;
-	uint32_t nb_blocks = len / 16;
-	int i;
-
-	/* preload IV in block */
-	block128_copy(&block, iv);
-
-	for ( ; nb_blocks-- > 0; block128_inc_be(&block), output += 16, input += 16) {
-		cryptonite_aes_encrypt_block(&o, key, &block);
-		block128_vxor((block128 *) output, &o, (block128 *) input);
-	}
-
-	if ((len % 16) != 0) {
-		cryptonite_aes_encrypt_block(&o, key, &block);
-		for (i = 0; i < (len % 16); i++) {
-			*output = ((uint8_t *) &o)[i] ^ *input;
-			output++;
-			input++;
-		}
-	}
-}
-
-void cryptonite_aes_generic_encrypt_c32(uint8_t *output, aes_key *key, aes_block *iv, uint8_t *input, uint32_t len)
-{
-	aes_block block, o;
-	uint32_t nb_blocks = len / 16;
-	int i;
-
-	/* preload IV in block */
-	block128_copy(&block, iv);
-
-	for ( ; nb_blocks-- > 0; block128_inc32_le(&block), output += 16, input += 16) {
-		cryptonite_aes_encrypt_block(&o, key, &block);
-		block128_vxor((block128 *) output, &o, (block128 *) input);
-	}
-
-	if ((len % 16) != 0) {
-		cryptonite_aes_encrypt_block(&o, key, &block);
-		for (i = 0; i < (len % 16); i++) {
-			*output = ((uint8_t *) &o)[i] ^ *input;
-			output++;
-			input++;
-		}
-	}
-}
-
-void cryptonite_aes_generic_encrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)
-{
-	aes_block block, tweak;
-
-	/* load IV and encrypt it using k2 as the tweak */
-	block128_copy(&tweak, dataunit);
-	cryptonite_aes_encrypt_block(&tweak, k2, &tweak);
-
-	/* TO OPTIMISE: this is really inefficient way to do that */
-	while (spoint-- > 0)
-		cryptonite_aes_generic_gf_mulx(&tweak);
-
-	for ( ; nb_blocks-- > 0; input++, output++, cryptonite_aes_generic_gf_mulx(&tweak)) {
-		block128_vxor(&block, input, &tweak);
-		cryptonite_aes_encrypt_block(&block, k1, &block);
-		block128_vxor(output, &block, &tweak);
-	}
-}
-
-void cryptonite_aes_generic_decrypt_xts(aes_block *output, aes_key *k1, aes_key *k2, aes_block *dataunit,
-                             uint32_t spoint, aes_block *input, uint32_t nb_blocks)
-{
-	aes_block block, tweak;
-
-	/* load IV and encrypt it using k2 as the tweak */
-	block128_copy(&tweak, dataunit);
-	cryptonite_aes_encrypt_block(&tweak, k2, &tweak);
-
-	/* TO OPTIMISE: this is really inefficient way to do that */
-	while (spoint-- > 0)
-		cryptonite_aes_generic_gf_mulx(&tweak);
-
-	for ( ; nb_blocks-- > 0; input++, output++, cryptonite_aes_generic_gf_mulx(&tweak)) {
-		block128_vxor(&block, input, &tweak);
-		cryptonite_aes_decrypt_block(&block, k1, &block);
-		block128_vxor(output, &block, &tweak);
-	}
-}
-
-void cryptonite_aes_generic_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	aes_block out;
-
-	gcm->length_input += length;
-	for (; length >= 16; input += 16, output += 16, length -= 16) {
-		block128_inc32_be(&gcm->civ);
-
-		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);
-		block128_xor(&out, (block128 *) input);
-		gcm_ghash_add(gcm, &out);
-		block128_copy((block128 *) output, &out);
-	}
-	if (length > 0) {
-		aes_block tmp;
-		int i;
-
-		block128_inc32_be(&gcm->civ);
-		/* create e(civ) in out */
-		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);
-		/* initialize a tmp as input and xor it to e(civ) */
-		block128_zero(&tmp);
-		block128_copy_bytes(&tmp, input, length);
-		block128_xor_bytes(&tmp, out.b, length);
-
-		gcm_ghash_add(gcm, &tmp);
-
-		for (i = 0; i < length; i++) {
-			output[i] = tmp.b[i];
-		}
-	}
-}
-
-void cryptonite_aes_generic_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	aes_block out;
-
-	gcm->length_input += length;
-	for (; length >= 16; input += 16, output += 16, length -= 16) {
-		block128_inc32_be(&gcm->civ);
-
-		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);
-		gcm_ghash_add(gcm, (block128 *) input);
-		block128_xor(&out, (block128 *) input);
-		block128_copy((block128 *) output, &out);
-	}
-	if (length > 0) {
-		aes_block tmp;
-		int i;
-
-		block128_inc32_be(&gcm->civ);
-
-		block128_zero(&tmp);
-		block128_copy_bytes(&tmp, input, length);
-		gcm_ghash_add(gcm, &tmp);
-
-		cryptonite_aes_encrypt_block(&out, key, &gcm->civ);
-		block128_xor_bytes(&tmp, out.b, length);
-
-		for (i = 0; i < length; i++) {
-			output[i] = tmp.b[i];
-		}
-	}
-}
-
-static void ocb_generic_crypt(uint8_t *output, aes_ocb *ocb, aes_key *key,
-                              uint8_t *input, uint32_t length, int encrypt)
-{
-	block128 tmp, pad;
-	unsigned int i;
-
-	for (i = 1; i <= length/16; i++, input += 16, output += 16) {
-		/* Offset_i = Offset_{i-1} xor L_{ntz(i)} */
-		ocb_get_L_i(&tmp, ocb->li, i);
-		block128_xor_aligned(&ocb->offset_enc, &tmp);
-
-		block128_vxor(&tmp, &ocb->offset_enc, (block128 *) input);
-		if (encrypt) {
-			cryptonite_aes_encrypt_block(&tmp, key, &tmp);
-			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);
-			block128_xor(&ocb->sum_enc, (block128 *) input);
-		} else {
-			cryptonite_aes_decrypt_block(&tmp, key, &tmp);
-			block128_vxor((block128 *) output, &ocb->offset_enc, &tmp);
-			block128_xor(&ocb->sum_enc, (block128 *) output);
-		}
-	}
-
-	/* process the last partial block if any */
-	length = length % 16;
-	if (length > 0) {
-		block128_xor_aligned(&ocb->offset_enc, &ocb->lstar);
-		cryptonite_aes_encrypt_block(&pad, key, &ocb->offset_enc);
-
-		if (encrypt) {
-			block128_zero(&tmp);
-			block128_copy_bytes(&tmp, input, length);
-			tmp.b[length] = 0x80;
-			block128_xor_aligned(&ocb->sum_enc, &tmp);
-			block128_xor_aligned(&pad, &tmp);
-			memcpy(output, pad.b, length);
-			output += length;
-		} else {
-			block128_copy_aligned(&tmp, &pad);
-			block128_copy_bytes(&tmp, input, length);
-			block128_xor_aligned(&tmp, &pad);
-			tmp.b[length] = 0x80;
-			memcpy(output, tmp.b, length);
-			block128_xor_aligned(&ocb->sum_enc, &tmp);
-			input += length;
-		}
-	}
-}
-
-void cryptonite_aes_generic_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	block128 tmp, ctr;
-
-	/* when aad is absent, reset b0 block */
-	if (ccm->length_aad == 0) {
-		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */
-		cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->b0);
-		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);
-	}
-
-	if (length != ccm->length_input) {
-		return;
-	}
-
-	ccm_encode_ctr(&ctr, ccm, 1);
-	cryptonite_aes_encrypt_ctr(output, key, &ctr, input, length);
-
-	for (;length >= 16; input += 16, length -= 16) {
-		block128_copy(&tmp, (block128*)input);
-		ccm_cbcmac_add(ccm, key, &tmp);
-	}
-	if (length > 0) {
-		block128_zero(&tmp);
-		block128_copy_bytes(&tmp, input, length);
-		ccm_cbcmac_add(ccm, key, &tmp);
-	}
-}
-
-void cryptonite_aes_generic_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length)
-{
-	block128 tmp, ctr;
-
-	if (length != ccm->length_input) {
-		return;
-	}
-
-	/* when aad is absent, reset b0 block */
-	if (ccm->length_aad == 0) {
-		ccm_encode_b0(&ccm->b0, ccm, 0); /* assume aad is present */
-		cryptonite_aes_encrypt_block(&ccm->xi, key, &ccm->b0);
-		block128_copy_aligned(&ccm->header_cbcmac, &ccm->xi);
-	}
-
-	ccm_encode_ctr(&ctr, ccm, 1);
-	cryptonite_aes_encrypt_ctr(output, key, &ctr, input, length);
-	block128_copy_aligned(&ccm->xi, &ccm->header_cbcmac);
-	input = output;
-
-	for (;length >= 16; input += 16, length -= 16) {
-		block128_copy(&tmp, (block128*)input);
-		ccm_cbcmac_add(ccm, key, &tmp);
-	}
-	if (length > 0) {
-		block128_zero(&tmp);
-		block128_copy_bytes(&tmp, input, length);
-		ccm_cbcmac_add(ccm, key, &tmp);
-	}
-}
-
-void cryptonite_aes_generic_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
-{
-	ocb_generic_crypt(output, ocb, key, input, length, 1);
-}
-
-void cryptonite_aes_generic_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length)
-{
-	ocb_generic_crypt(output, ocb, key, input, length, 0);
-}
-
-static inline void gf_mulx_rev(block128 *a, const block128 *h)
-{
-	uint64_t v1 = cpu_to_le64(h->q[0]);
-	uint64_t v0 = cpu_to_le64(h->q[1]);
-	a->q[1] = cpu_to_be64(v1 >> 1 | v0 << 63);
-	a->q[0] = cpu_to_be64(v0 >> 1 ^ ((0-(v1 & 1)) & 0xe100000000000000ULL));
-}
-
-void cryptonite_aes_polyval_init(aes_polyval *ctx, const aes_block *h)
-{
-	aes_block r;
-
-	/* ByteReverse(S_0) = 0 */
-	block128_zero(&ctx->s);
-
-	/* ByteReverse(H) * x */
-	gf_mulx_rev(&r, h);
-	cryptonite_hinit(ctx->htable, &r);
-}
-
-void cryptonite_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length)
-{
-	aes_block r;
-	const uint8_t *p;
-	uint32_t sz;
-
-	/* This automatically pads with zeros if input is not a multiple of the
-	   block size. */
-	for (p = input; length > 0; p += 16, length -= sz)
-	{
-		sz = length < 16 ? length : 16;
-
-		/* ByteReverse(X_j) */
-		block128_zero(&r);
-		memcpy(&r, p, sz);
-		block128_byte_reverse(&r);
-
-		/* ByteReverse(S_{j-1}) + ByteReverse(X_j) */
-		block128_xor_aligned(&ctx->s, &r);
-
-		/* ByteReverse(S_j) */
-		cryptonite_gf_mul(&ctx->s, ctx->htable);
-	}
-}
-
-void cryptonite_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst)
-{
-	/* S_s */
-	block128_copy_aligned(dst, &ctx->s);
-	block128_byte_reverse(dst);
-}
diff --git a/cbits/cryptonite_aes.h b/cbits/cryptonite_aes.h
deleted file mode 100644
--- a/cbits/cryptonite_aes.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- *	Copyright (C) 2008 Vincent Hanquez <tab@snarc.org>
- *
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * AES implementation
- */
-#ifndef CRYPTONITE_AES_H
-#define CRYPTONITE_AES_H
-
-#include <stdint.h>
-#include "aes/block128.h"
-
-typedef block128 aes_block;
-
-/* size = 456 */
-typedef struct {
-	uint8_t nbr; /* number of rounds: 10 (128), 12 (192), 14 (256) */
-	uint8_t strength; /* 128 = 0, 192 = 1, 256 = 2 */
-	uint8_t _padding[6];
-	uint8_t data[16*14*2];
-} aes_key;
-
-/* size = 19*16+2*8= 320 */
-typedef struct {
-	aes_block tag;
-	aes_block htable[16];
-	aes_block iv;
-	aes_block civ;
-	uint64_t length_aad;
-	uint64_t length_input;
-} aes_gcm;
-
-/* size = 4*16+4*4= 80 */
-typedef struct {
-	aes_block xi;
-	aes_block header_cbcmac;
-	aes_block b0;
-	aes_block nonce;
-	uint32_t length_aad;
-	uint32_t length_input;
-	uint32_t length_M;
-	uint32_t length_L;
-} aes_ccm;
-
-typedef struct {
-	block128 offset_aad;
-	block128 offset_enc;
-	block128 sum_aad;
-	block128 sum_enc;
-	block128 lstar;
-	block128 ldollar;
-	block128 li[4];
-} aes_ocb;
-
-/* size = 17*16= 272 */
-typedef struct {
-	aes_block htable[16];
-	aes_block s;
-} aes_polyval;
-
-/* in bytes: either 16,24,32 */
-void cryptonite_aes_initkey(aes_key *ctx, uint8_t *key, uint8_t size);
-
-void cryptonite_aes_encrypt(aes_block *output, aes_key *key, aes_block *input);
-void cryptonite_aes_decrypt(aes_block *output, aes_key *key, aes_block *input);
-
-void cryptonite_aes_encrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_decrypt_ecb(aes_block *output, aes_key *key, aes_block *input, uint32_t nb_blocks);
-
-void cryptonite_aes_encrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_decrypt_cbc(aes_block *output, aes_key *key, aes_block *iv, aes_block *input, uint32_t nb_blocks);
-
-void cryptonite_aes_gen_ctr(aes_block *output, aes_key *key, const aes_block *iv, uint32_t nb_blocks);
-void cryptonite_aes_gen_ctr_cont(aes_block *output, aes_key *key, aes_block *iv, uint32_t nb_blocks);
-
-void cryptonite_aes_encrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,
-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);
-void cryptonite_aes_decrypt_xts(aes_block *output, aes_key *key, aes_key *key2, aes_block *sector,
-                     uint32_t spoint, aes_block *input, uint32_t nb_blocks);
-
-void cryptonite_aes_gcm_init(aes_gcm *gcm, aes_key *key, uint8_t *iv, uint32_t len);
-void cryptonite_aes_gcm_aad(aes_gcm *gcm, uint8_t *input, uint32_t length);
-void cryptonite_aes_gcm_encrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_gcm_decrypt(uint8_t *output, aes_gcm *gcm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_gcm_finish(uint8_t *tag, aes_gcm *gcm, aes_key *key);
-
-void cryptonite_aes_ocb_init(aes_ocb *ocb, aes_key *key, uint8_t *iv, uint32_t len);
-void cryptonite_aes_ocb_aad(aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_ocb_encrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_ocb_decrypt(uint8_t *output, aes_ocb *ocb, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_ocb_finish(uint8_t *tag, aes_ocb *ocb, aes_key *key);
-
-void cryptonite_aes_ccm_init(aes_ccm *ccm, aes_key *key, uint8_t *nonce, uint32_t len, uint32_t msg_size, int m, int l);
-void cryptonite_aes_ccm_aad(aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_ccm_encrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_ccm_decrypt(uint8_t *output, aes_ccm *ccm, aes_key *key, uint8_t *input, uint32_t length);
-void cryptonite_aes_ccm_finish(uint8_t *tag, aes_ccm *ccm, aes_key *key);
-
-uint8_t *cryptonite_aes_cpu_init(void);
-
-void cryptonite_aes_polyval_init(aes_polyval *ctx, const aes_block *h);
-void cryptonite_aes_polyval_update(aes_polyval *ctx, const uint8_t *input, uint32_t length);
-void cryptonite_aes_polyval_finalize(aes_polyval *ctx, aes_block *dst);
-
-#endif
diff --git a/cbits/cryptonite_align.h b/cbits/cryptonite_align.h
deleted file mode 100644
--- a/cbits/cryptonite_align.h
+++ /dev/null
@@ -1,140 +0,0 @@
-#ifndef CRYPTONITE_ALIGN_H
-#define CRYPTONITE_ALIGN_H
-
-#include "cryptonite_bitfn.h"
-
-#if (defined(__i386__))
-# define UNALIGNED_ACCESS_OK
-#elif defined(__x86_64__)
-# define UNALIGNED_ACCESS_OK
-#else
-# define UNALIGNED_ACCESS_FAULT
-#endif
-
-/* n need to be power of 2.
- * IS_ALIGNED(p,8) */
-#define IS_ALIGNED(p,alignment) (((uintptr_t) (p)) & ((alignment)-1))
-
-#ifdef WITH_ASSERT_ALIGNMENT
-#include <stdio.h>
-#include <stdlib.h>
-#include <inttypes.h>
-# define ASSERT_ALIGNMENT(up, alignment) \
-	do { if (IS_ALIGNED(up, alignment)) \
-	{ printf("ALIGNMENT-ASSERT-FAILURE: %s:%d: ptr=%p alignment=%d\n", __FILE__, __LINE__, (void *) up, (alignment)); \
-	  exit(99); \
-	}; } while (0)
-#else
-# define ASSERT_ALIGNMENT(p, n) do {} while (0)
-#endif
-
-#ifdef UNALIGNED_ACCESS_OK
-#define need_alignment(p,n) (0)
-#else
-#define need_alignment(p,n) IS_ALIGNED(p,n)
-#endif
-
-static inline uint32_t load_le32_aligned(const uint8_t *p)
-{
-	return le32_to_cpu(*((uint32_t *) p));		
-}
-
-static inline void store_le32_aligned(uint8_t *dst, const uint32_t v)
-{
-	*((uint32_t *) dst) = cpu_to_le32(v);
-}
-
-static inline void xor_le32_aligned(uint8_t *dst, const uint32_t v)
-{
-	*((uint32_t *) dst) ^= cpu_to_le32(v);
-}
-
-static inline void store_be32_aligned(uint8_t *dst, const uint32_t v)
-{
-	*((uint32_t *) dst) = cpu_to_be32(v);
-}
-
-static inline void xor_be32_aligned(uint8_t *dst, const uint32_t v)
-{
-	*((uint32_t *) dst) ^= cpu_to_be32(v);
-}
-
-static inline void store_le64_aligned(uint8_t *dst, const uint64_t v)
-{
-	*((uint64_t *) dst) = cpu_to_le64(v);
-}
-
-static inline void store_be64_aligned(uint8_t *dst, const uint64_t v)
-{
-	*((uint64_t *) dst) = cpu_to_be64(v);
-}
-
-static inline void xor_be64_aligned(uint8_t *dst, const uint64_t v)
-{
-	*((uint64_t *) dst) ^= cpu_to_be64(v);
-}
-
-#ifdef UNALIGNED_ACCESS_OK
-#define load_le32(a) load_le32_aligned(a)
-#else
-static inline uint32_t load_le32(const uint8_t *p)
-{
-	return ((uint32_t)p[0]) | ((uint32_t)p[1] <<  8) | ((uint32_t)p[2] << 16) | ((uint32_t)p[3] << 24);
-}
-#endif
-
-#ifdef UNALIGNED_ACCESS_OK
-#define store_le32(a, b) store_le32_aligned(a, b)
-#define xor_le32(a, b) xor_le32_aligned(a, b)
-#else
-static inline void store_le32(uint8_t *dst, const uint32_t v)
-{
-	dst[0] = v; dst[1] = v >> 8; dst[2] = v >> 16; dst[3] = v >> 24;
-}
-static inline void xor_le32(uint8_t *dst, const uint32_t v)
-{
-	dst[0] ^= v; dst[1] ^= v >> 8; dst[2] ^= v >> 16; dst[3] ^= v >> 24;
-}
-#endif
-
-#ifdef UNALIGNED_ACCESS_OK
-#define store_be32(a, b) store_be32_aligned(a, b)
-#define xor_be32(a, b) xor_be32_aligned(a, b)
-#else
-static inline void store_be32(uint8_t *dst, const uint32_t v)
-{
-	dst[3] = v; dst[2] = v >> 8; dst[1] = v >> 16; dst[0] = v >> 24;
-}
-static inline void xor_be32(uint8_t *dst, const uint32_t v)
-{
-	dst[3] ^= v; dst[2] ^= v >> 8; dst[1] ^= v >> 16; dst[0] ^= v >> 24;
-}
-#endif
-
-#ifdef UNALIGNED_ACCESS_OK
-#define store_le64(a, b) store_le64_aligned(a, b)
-#else
-static inline void store_le64(uint8_t *dst, const uint64_t v)
-{
-	dst[0] = v      ; dst[1] = v >> 8 ; dst[2] = v >> 16; dst[3] = v >> 24;
-	dst[4] = v >> 32; dst[5] = v >> 40; dst[6] = v >> 48; dst[7] = v >> 56;
-}
-#endif
-
-#ifdef UNALIGNED_ACCESS_OK
-#define store_be64(a, b) store_be64_aligned(a, b)
-#define xor_be64(a, b) xor_be64_aligned(a, b)
-#else
-static inline void store_be64(uint8_t *dst, const uint64_t v)
-{
-	dst[7] = v      ; dst[6] = v >> 8 ; dst[5] = v >> 16; dst[4] = v >> 24;
-	dst[3] = v >> 32; dst[2] = v >> 40; dst[1] = v >> 48; dst[0] = v >> 56;
-}
-static inline void xor_be64(uint8_t *dst, const uint64_t v)
-{
-	dst[7] ^= v      ; dst[6] ^= v >> 8 ; dst[5] ^= v >> 16; dst[4] ^= v >> 24;
-	dst[3] ^= v >> 32; dst[2] ^= v >> 40; dst[1] ^= v >> 48; dst[0] ^= v >> 56;
-}
-#endif
-
-#endif
diff --git a/cbits/cryptonite_bitfn.h b/cbits/cryptonite_bitfn.h
deleted file mode 100644
--- a/cbits/cryptonite_bitfn.h
+++ /dev/null
@@ -1,253 +0,0 @@
-/*
- * Copyright (C) 2006-2014 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef BITFN_H
-#define BITFN_H
-#include <stdint.h>
-
-#ifndef NO_INLINE_ASM
-/**********************************************************/
-# if (defined(__i386__))
-#  define ARCH_HAS_SWAP32
-static inline uint32_t bitfn_swap32(uint32_t a)
-{
-	asm ("bswap %0" : "=r" (a) : "0" (a));
-	return a;
-}
-/**********************************************************/
-# elif (defined(__arm__))
-#  define ARCH_HAS_SWAP32
-static inline uint32_t bitfn_swap32(uint32_t a)
-{
-	uint32_t tmp = a;
-	asm volatile ("eor %1, %0, %0, ror #16\n"
-	              "bic %1, %1, #0xff0000\n"
-	              "mov %0, %0, ror #8\n"
-	              "eor %0, %0, %1, lsr #8\n"
-	             : "=r" (a), "=r" (tmp) : "0" (a), "1" (tmp));
-	return a;
-}
-/**********************************************************/
-# elif defined(__x86_64__)
-#  define ARCH_HAS_SWAP32
-#  define ARCH_HAS_SWAP64
-static inline uint32_t bitfn_swap32(uint32_t a)
-{
-	asm ("bswap %0" : "=r" (a) : "0" (a));
-	return a;
-}
-
-static inline uint64_t bitfn_swap64(uint64_t a)
-{
-	asm ("bswap %0" : "=r" (a) : "0" (a));
-	return a;
-}
-
-# endif
-#endif /* NO_INLINE_ASM */
-/**********************************************************/
-
-#ifndef ARCH_HAS_ROL32
-static inline uint32_t rol32(uint32_t word, uint32_t shift)
-{
-	return (word << shift) | (word >> (32 - shift));
-}
-#endif
-
-#ifndef ARCH_HAS_ROR32
-static inline uint32_t ror32(uint32_t word, uint32_t shift)
-{
-	return (word >> shift) | (word << (32 - shift));
-}
-#endif
-
-#ifndef ARCH_HAS_ROL64
-static inline uint64_t rol64(uint64_t word, uint32_t shift)
-{
-	return (word << shift) | (word >> (64 - shift));
-}
-#endif
-
-#ifndef ARCH_HAS_ROR64
-static inline uint64_t ror64(uint64_t word, uint32_t shift)
-{
-	return (word >> shift) | (word << (64 - shift));
-}
-#endif
-
-#ifndef ARCH_HAS_SWAP32
-static inline uint32_t bitfn_swap32(uint32_t a)
-{
-	return (a << 24) | ((a & 0xff00) << 8) | ((a >> 8) & 0xff00) | (a >> 24);
-}
-#endif
-
-#ifndef ARCH_HAS_ARRAY_SWAP32
-static inline void array_swap32(uint32_t *d, uint32_t *s, uint32_t nb)
-{
-	while (nb--)
-		*d++ = bitfn_swap32(*s++);
-}
-#endif
-
-#ifndef ARCH_HAS_SWAP64
-static inline uint64_t bitfn_swap64(uint64_t a)
-{
-	return ((uint64_t) bitfn_swap32((uint32_t) (a >> 32))) |
-	       (((uint64_t) bitfn_swap32((uint32_t) a)) << 32);
-}
-#endif
-
-#ifndef ARCH_HAS_ARRAY_SWAP64
-static inline void array_swap64(uint64_t *d, uint64_t *s, uint32_t nb)
-{
-	while (nb--)
-		*d++ = bitfn_swap64(*s++);
-}
-#endif
-
-#ifndef ARCH_HAS_MEMORY_ZERO
-static inline void memory_zero(void *ptr, uint32_t len)
-{
-	uint32_t *ptr32 = ptr;
-	uint8_t *ptr8;
-	int i;
-
-	for (i = 0; i < len / 4; i++)
-		*ptr32++ = 0;
-	if (len % 4) {
-		ptr8 = (uint8_t *) ptr32;
-		for (i = len % 4; i >= 0; i--)
-			ptr8[i] = 0;
-	}
-}
-#endif
-
-#ifndef ARCH_HAS_ARRAY_COPY32
-static inline void array_copy32(uint32_t *d, uint32_t *s, uint32_t nb)
-{
-	while (nb--) *d++ = *s++;
-}
-#endif
-
-#ifndef ARCH_HAS_ARRAY_XOR32
-static inline void array_xor32(uint32_t *d, uint32_t *s, uint32_t nb)
-{
-	while (nb--) *d++ ^= *s++;
-}
-#endif
-
-#ifndef ARCH_HAS_ARRAY_COPY64
-static inline void array_copy64(uint64_t *d, uint64_t *s, uint32_t nb)
-{
-	while (nb--) *d++ = *s++;
-}
-#endif
-
-#ifdef __GNUC__
-#define bitfn_ntz(n) __builtin_ctz(n)
-#else
-#error "define ntz for your platform"
-#endif
-
-#ifdef __MINGW32__
-  # define LITTLE_ENDIAN 1234
-  # define BYTE_ORDER    LITTLE_ENDIAN
-#elif defined(__FreeBSD__) || defined(__DragonFly__) || defined(__NetBSD__)
-  # include <sys/endian.h>
-#elif defined(__OpenBSD__) || defined(__SVR4)
-  # include <sys/types.h>
-#elif defined(__APPLE__)
-  # include <machine/endian.h>
-#elif defined( BSD ) && ( BSD >= 199103 )
-  # include <machine/endian.h>
-#elif defined( __QNXNTO__ ) && defined( __LITTLEENDIAN__ )
-  # define LITTLE_ENDIAN 1234
-  # define BYTE_ORDER    LITTLE_ENDIAN
-#elif defined( __QNXNTO__ ) && defined( __BIGENDIAN__ )
-  # define BIG_ENDIAN 1234
-  # define BYTE_ORDER    BIG_ENDIAN
-#elif defined( _AIX )
-  # include <sys/machine.h>
-#else
-  # include <endian.h>
-#endif
-/* big endian to cpu */
-#if LITTLE_ENDIAN == BYTE_ORDER
-
-# define be32_to_cpu(a) bitfn_swap32(a)
-# define cpu_to_be32(a) bitfn_swap32(a)
-# define le32_to_cpu(a) (a)
-# define cpu_to_le32(a) (a)
-# define be64_to_cpu(a) bitfn_swap64(a)
-# define cpu_to_be64(a) bitfn_swap64(a)
-# define le64_to_cpu(a) (a)
-# define cpu_to_le64(a) (a)
-
-# define cpu_to_le32_array(d, s, l) array_copy32(d, s, l)
-# define le32_to_cpu_array(d, s, l) array_copy32(d, s, l)
-# define cpu_to_be32_array(d, s, l) array_swap32(d, s, l)
-# define be32_to_cpu_array(d, s, l) array_swap32(d, s, l)
-
-# define cpu_to_le64_array(d, s, l) array_copy64(d, s, l)
-# define le64_to_cpu_array(d, s, l) array_copy64(d, s, l)
-# define cpu_to_be64_array(d, s, l) array_swap64(d, s, l)
-# define be64_to_cpu_array(d, s, l) array_swap64(d, s, l)
-
-# define ror32_be(a, s) rol32(a, s)
-# define rol32_be(a, s) ror32(a, s)
-
-# define ARCH_IS_LITTLE_ENDIAN
-
-#elif BIG_ENDIAN == BYTE_ORDER
-
-# define be32_to_cpu(a) (a)
-# define cpu_to_be32(a) (a)
-# define be64_to_cpu(a) (a)
-# define cpu_to_be64(a) (a)
-# define le64_to_cpu(a) bitfn_swap64(a)
-# define cpu_to_le64(a) bitfn_swap64(a)
-# define le32_to_cpu(a) bitfn_swap32(a)
-# define cpu_to_le32(a) bitfn_swap32(a)
-
-# define cpu_to_le32_array(d, s, l) array_swap32(d, s, l)
-# define le32_to_cpu_array(d, s, l) array_swap32(d, s, l)
-# define cpu_to_be32_array(d, s, l) array_copy32(d, s, l)
-# define be32_to_cpu_array(d, s, l) array_copy32(d, s, l)
-
-# define cpu_to_le64_array(d, s, l) array_swap64(d, s, l)
-# define le64_to_cpu_array(d, s, l) array_swap64(d, s, l)
-# define cpu_to_be64_array(d, s, l) array_copy64(d, s, l)
-# define be64_to_cpu_array(d, s, l) array_copy64(d, s, l)
-
-# define ror32_be(a, s) ror32(a, s)
-# define rol32_be(a, s) rol32(a, s)
-
-# define ARCH_IS_BIG_ENDIAN
-
-#else
-# error "endian not supported"
-#endif
-
-#endif /* !BITFN_H */
diff --git a/cbits/cryptonite_blake2b.c b/cbits/cryptonite_blake2b.c
deleted file mode 100644
--- a/cbits/cryptonite_blake2b.c
+++ /dev/null
@@ -1,16 +0,0 @@
-#include "cryptonite_blake2b.h"
-
-void cryptonite_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen)
-{
-	_cryptonite_blake2b_init(ctx, hashlen / 8);
-}
-
-void cryptonite_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	_cryptonite_blake2b_update(ctx, data, len);
-}
-
-void cryptonite_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	_cryptonite_blake2b_final(ctx, out, hashlen / 8);
-}
diff --git a/cbits/cryptonite_blake2b.h b/cbits/cryptonite_blake2b.h
deleted file mode 100644
--- a/cbits/cryptonite_blake2b.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef CRYPTOHASH_BLAKE2B_H
-#define CRYPTOHASH_BLAKE2B_H
-
-#include "blake2.h"
-
-typedef blake2b_state blake2b_ctx;
-
-void cryptonite_blake2b_init(blake2b_ctx *ctx, uint32_t hashlen);
-void cryptonite_blake2b_update(blake2b_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_blake2b_finalize(blake2b_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_blake2bp.c b/cbits/cryptonite_blake2bp.c
deleted file mode 100644
--- a/cbits/cryptonite_blake2bp.c
+++ /dev/null
@@ -1,16 +0,0 @@
-#include "cryptonite_blake2bp.h"
-
-void cryptonite_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen)
-{
-	_cryptonite_blake2bp_init(ctx, hashlen / 8);
-}
-
-void cryptonite_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	_cryptonite_blake2bp_update(ctx, data, len);
-}
-
-void cryptonite_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	_cryptonite_blake2bp_final(ctx, out, hashlen / 8);
-}
diff --git a/cbits/cryptonite_blake2bp.h b/cbits/cryptonite_blake2bp.h
deleted file mode 100644
--- a/cbits/cryptonite_blake2bp.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef CRYPTOHASH_BLAKE2BP_H
-#define CRYPTOHASH_BLAKE2BP_H
-
-#include "blake2.h"
-
-typedef blake2bp_state blake2bp_ctx;
-
-void cryptonite_blake2bp_init(blake2bp_ctx *ctx, uint32_t hashlen);
-void cryptonite_blake2bp_update(blake2bp_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_blake2bp_finalize(blake2bp_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_blake2s.c b/cbits/cryptonite_blake2s.c
deleted file mode 100644
--- a/cbits/cryptonite_blake2s.c
+++ /dev/null
@@ -1,16 +0,0 @@
-#include "cryptonite_blake2s.h"
-
-void cryptonite_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen)
-{
-	_cryptonite_blake2s_init(ctx, hashlen / 8);
-}
-
-void cryptonite_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	_cryptonite_blake2s_update(ctx, data, len);
-}
-
-void cryptonite_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	_cryptonite_blake2s_final(ctx, out, hashlen / 8);
-}
diff --git a/cbits/cryptonite_blake2s.h b/cbits/cryptonite_blake2s.h
deleted file mode 100644
--- a/cbits/cryptonite_blake2s.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef CRYPTOHASH_BLAKE2S_H
-#define CRYPTOHASH_BLAKE2S_H
-
-#include "blake2.h"
-
-typedef blake2s_state blake2s_ctx;
-
-void cryptonite_blake2s_init(blake2s_ctx *ctx, uint32_t hashlen);
-void cryptonite_blake2s_update(blake2s_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_blake2s_finalize(blake2s_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_blake2sp.c b/cbits/cryptonite_blake2sp.c
deleted file mode 100644
--- a/cbits/cryptonite_blake2sp.c
+++ /dev/null
@@ -1,16 +0,0 @@
-#include "cryptonite_blake2sp.h"
-
-void cryptonite_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen)
-{
-	_cryptonite_blake2sp_init(ctx, hashlen / 8);
-}
-
-void cryptonite_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	_cryptonite_blake2sp_update(ctx, data, len);
-}
-
-void cryptonite_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	_cryptonite_blake2sp_final(ctx, out, hashlen / 8);
-}
diff --git a/cbits/cryptonite_blake2sp.h b/cbits/cryptonite_blake2sp.h
deleted file mode 100644
--- a/cbits/cryptonite_blake2sp.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef CRYPTOHASH_BLAKE2SP_H
-#define CRYPTOHASH_BLAKE2SP_H
-
-#include "blake2.h"
-
-typedef blake2sp_state blake2sp_ctx;
-
-void cryptonite_blake2sp_init(blake2sp_ctx *ctx, uint32_t hashlen);
-void cryptonite_blake2sp_update(blake2sp_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_blake2sp_finalize(blake2sp_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_chacha.c b/cbits/cryptonite_chacha.c
deleted file mode 100644
--- a/cbits/cryptonite_chacha.c
+++ /dev/null
@@ -1,288 +0,0 @@
-/*
- * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <stdint.h>
-#include <string.h>
-#include "cryptonite_chacha.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include <stdio.h>
-
-#define QR(a,b,c,d) \
-	a += b; d = rol32(d ^ a,16); \
-	c += d; b = rol32(b ^ c,12); \
-	a += b; d = rol32(d ^ a, 8); \
-	c += d; b = rol32(b ^ c, 7);
-
-#define ALIGNED64(PTR) \
-	(((uintptr_t)(const void *)(PTR)) % 8 == 0)
-
-static const uint8_t sigma[16] = "expand 32-byte k";
-static const uint8_t tau[16] = "expand 16-byte k";
-
-static void chacha_core(int rounds, block *out, const cryptonite_chacha_state *in)
-{
-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
-	int i;
-
-	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];
-	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];
-	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];
-	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];
-
-	for (i = rounds; i > 0; i -= 2) {
-		QR(x0, x4, x8, x12);
-		QR(x1, x5, x9, x13);
-		QR(x2, x6, x10, x14);
-		QR(x3, x7, x11, x15);
-
-		QR(x0, x5, x10, x15);
-		QR(x1, x6, x11, x12);
-		QR(x2, x7, x8, x13);
-		QR(x3, x4, x9, x14);
-	}
-
-	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];
-	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];
-	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];
-	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];
-
-	out->d[0] = cpu_to_le32(x0);
-	out->d[1] = cpu_to_le32(x1);
-	out->d[2] = cpu_to_le32(x2);
-	out->d[3] = cpu_to_le32(x3);
-	out->d[4] = cpu_to_le32(x4);
-	out->d[5] = cpu_to_le32(x5);
-	out->d[6] = cpu_to_le32(x6);
-	out->d[7] = cpu_to_le32(x7);
-	out->d[8] = cpu_to_le32(x8);
-	out->d[9] = cpu_to_le32(x9);
-	out->d[10] = cpu_to_le32(x10);
-	out->d[11] = cpu_to_le32(x11);
-	out->d[12] = cpu_to_le32(x12);
-	out->d[13] = cpu_to_le32(x13);
-	out->d[14] = cpu_to_le32(x14);
-	out->d[15] = cpu_to_le32(x15);
-}
-
-/* only 2 valids values are 256 (32) and 128 (16) */
-void cryptonite_chacha_init_core(cryptonite_chacha_state *st,
-                                 uint32_t keylen, const uint8_t *key,
-                                 uint32_t ivlen, const uint8_t *iv)
-{
-	const uint8_t *constants = (keylen == 32) ? sigma : tau;
-
-	ASSERT_ALIGNMENT(constants, 4);
-
-	st->d[0] = load_le32_aligned(constants + 0);
-	st->d[1] = load_le32_aligned(constants + 4);
-	st->d[2] = load_le32_aligned(constants + 8);
-	st->d[3] = load_le32_aligned(constants + 12);
-
-	st->d[4] = load_le32(key + 0);
-	st->d[5] = load_le32(key + 4);
-	st->d[6] = load_le32(key + 8);
-	st->d[7] = load_le32(key + 12);
-	/* we repeat the key on 128 bits */
-	if (keylen == 32)
-		key += 16;
-	st->d[8] = load_le32(key + 0);
-	st->d[9] = load_le32(key + 4);
-	st->d[10] = load_le32(key + 8);
-	st->d[11] = load_le32(key + 12);
-	st->d[12] = 0;
-	switch (ivlen) {
-	case 8:
-		st->d[13] = 0;
-		st->d[14] = load_le32(iv + 0);
-		st->d[15] = load_le32(iv + 4);
-		break;
-	case 12:
-		st->d[13] = load_le32(iv + 0);
-		st->d[14] = load_le32(iv + 4);
-		st->d[15] = load_le32(iv + 8);
-	default:
-		return;
-	}
-}
-
-void cryptonite_chacha_init(cryptonite_chacha_context *ctx, uint8_t nb_rounds,
-                            uint32_t keylen, const uint8_t *key,
-                            uint32_t ivlen, const uint8_t *iv)
-{
-	memset(ctx, 0, sizeof(*ctx));
-	ctx->nb_rounds = nb_rounds;
-	cryptonite_chacha_init_core(&ctx->st, keylen, key, ivlen, iv);
-}
-
-void cryptonite_chacha_combine(uint8_t *dst, cryptonite_chacha_context *ctx, const uint8_t *src, uint32_t bytes)
-{
-	block out;
-	cryptonite_chacha_state *st;
-	int i;
-
-	if (!bytes)
-		return;
-
-	/* xor the previous buffer first (if any) */
-	if (ctx->prev_len > 0) {
-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
-		for (i = 0; i < to_copy; i++)
-			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];
-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
-		ctx->prev_len -= to_copy;
-		ctx->prev_ofs += to_copy;
-		src += to_copy;
-		dst += to_copy;
-		bytes -= to_copy;
-	}
-
-	if (bytes == 0)
-		return;
-
-	st = &ctx->st;
-
-	/* xor new 64-bytes chunks and store the left over if any */
-	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {
-		/* generate new chunk and update state */
-		chacha_core(ctx->nb_rounds, &out, st);
-		st->d[12] += 1;
-		if (st->d[12] == 0)
-			st->d[13] += 1;
-
-		for (i = 0; i < 64; ++i)
-			dst[i] = src[i] ^ out.b[i];
-	}
-
-	if (bytes > 0) {
-		/* generate new chunk and update state */
-		chacha_core(ctx->nb_rounds, &out, st);
-		st->d[12] += 1;
-		if (st->d[12] == 0)
-			st->d[13] += 1;
-
-		/* xor as much as needed */
-		for (i = 0; i < bytes; i++)
-			dst[i] = src[i] ^ out.b[i];
-		
-		/* copy the left over in the buffer */
-		ctx->prev_len = 64 - bytes;
-		ctx->prev_ofs = i;
-		for (; i < 64; i++) {
-			ctx->prev[i] = out.b[i];
-		}
-	}
-}
-
-void cryptonite_chacha_generate(uint8_t *dst, cryptonite_chacha_context *ctx, uint32_t bytes)
-{
-	cryptonite_chacha_state *st;
-	block out;
-	int i;
-
-	if (!bytes)
-		return;
-
-	/* xor the previous buffer first (if any) */
-	if (ctx->prev_len > 0) {
-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
-		for (i = 0; i < to_copy; i++)
-			dst[i] = ctx->prev[ctx->prev_ofs+i];
-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
-		ctx->prev_len -= to_copy;
-		ctx->prev_ofs += to_copy;
-		dst += to_copy;
-		bytes -= to_copy;
-	}
-
-	if (bytes == 0)
-		return;
-
-	st = &ctx->st;
-
-	if (ALIGNED64(dst)) {
-		/* xor new 64-bytes chunks and store the left over if any */
-		for (; bytes >= 64; bytes -= 64, dst += 64) {
-			/* generate new chunk and update state */
-			chacha_core(ctx->nb_rounds, (block *) dst, st);
-			st->d[12] += 1;
-			if (st->d[12] == 0)
-				st->d[13] += 1;
-		}
-	} else {
-		/* xor new 64-bytes chunks and store the left over if any */
-		for (; bytes >= 64; bytes -= 64, dst += 64) {
-			/* generate new chunk and update state */
-			chacha_core(ctx->nb_rounds, &out, st);
-			st->d[12] += 1;
-			if (st->d[12] == 0)
-				st->d[13] += 1;
-
-			for (i = 0; i < 64; ++i)
-				dst[i] = out.b[i];
-		}
-	}
-
-	if (bytes > 0) {
-		/* generate new chunk and update state */
-		chacha_core(ctx->nb_rounds, &out, st);
-		st->d[12] += 1;
-		if (st->d[12] == 0)
-			st->d[13] += 1;
-
-		/* xor as much as needed */
-		for (i = 0; i < bytes; i++)
-			dst[i] = out.b[i];
-		
-		/* copy the left over in the buffer */
-		ctx->prev_len = 64 - bytes;
-		ctx->prev_ofs = i;
-		for (; i < 64; i++)
-			ctx->prev[i] = out.b[i];
-	}
-}
-
-void cryptonite_chacha_random(uint32_t rounds, uint8_t *dst, cryptonite_chacha_state *st, uint32_t bytes)
-{
-	block out;
-
-	if (!bytes)
-		return;
-	for (; bytes >= 16; bytes -= 16, dst += 16) {
-		chacha_core(rounds, &out, st);
-		memcpy(dst, out.b + 40, 16);
-		cryptonite_chacha_init_core(st, 32, out.b, 8, out.b + 32);
-	}
-	if (bytes) {
-		chacha_core(rounds, &out, st);
-		memcpy(dst, out.b + 40, bytes);
-		cryptonite_chacha_init_core(st, 32, out.b, 8, out.b + 32);
-	}
-}
diff --git a/cbits/cryptonite_chacha.h b/cbits/cryptonite_chacha.h
deleted file mode 100644
--- a/cbits/cryptonite_chacha.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#ifndef CRYPTONITE_CHACHA
-#define CRYPTONITE_CHACHA
-
-typedef union {
-	uint64_t q[8];
-	uint32_t d[16];
-	uint8_t  b[64];
-} block;
-
-typedef block cryptonite_chacha_state;
-
-typedef struct {
-	cryptonite_chacha_state st;
-	uint8_t prev[64];
-	uint8_t prev_ofs;
-	uint8_t prev_len;
-	uint8_t nb_rounds;
-} cryptonite_chacha_context;
-
-void cryptonite_chacha_init_core(cryptonite_chacha_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
-void cryptonite_chacha_init(cryptonite_chacha_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
-void cryptonite_chacha_combine(uint8_t *dst, cryptonite_chacha_context *st, const uint8_t *src, uint32_t bytes);
-void cryptonite_chacha_generate(uint8_t *dst, cryptonite_chacha_context *st, uint32_t bytes);
-
-#endif
diff --git a/cbits/cryptonite_cpu.c b/cbits/cryptonite_cpu.c
deleted file mode 100644
--- a/cbits/cryptonite_cpu.c
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>
- *
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-#include "cryptonite_cpu.h"
-#include <stdint.h>
-
-#ifdef ARCH_X86
-static void cpuid(uint32_t info, uint32_t *eax, uint32_t *ebx, uint32_t *ecx, uint32_t *edx)
-{
-	*eax = info;
-	asm volatile
-		(
-#ifdef __x86_64__
-		 "mov %%rbx, %%rdi;"
-#else
-		 "mov %%ebx, %%edi;"
-#endif
-		 "cpuid;"
-		 "mov %%ebx, %%esi;"
-#ifdef __x86_64__
-		 "mov %%rdi, %%rbx;"
-#else
-		 "mov %%edi, %%ebx;"
-#endif
-		 :"+a" (*eax), "=S" (*ebx), "=c" (*ecx), "=d" (*edx)
-		 : :"edi");
-}
-
-#ifdef USE_AESNI
-void cryptonite_aesni_initialize_hw(void (*init_table)(int, int))
-{
-	static int inited = 0;
-	if (inited == 0) {
-		uint32_t eax, ebx, ecx, edx;
-		int aesni, pclmul;
-
-		inited = 1;
-		cpuid(1, &eax, &ebx, &ecx, &edx);
-		aesni = (ecx & 0x02000000);
-		pclmul = (ecx & 0x00000001);
-		init_table(aesni, pclmul);
-	}
-}
-#else
-#define cryptonite_aesni_initialize_hw(init_table) 	(0)
-#endif
-
-#endif
diff --git a/cbits/cryptonite_cpu.h b/cbits/cryptonite_cpu.h
deleted file mode 100644
--- a/cbits/cryptonite_cpu.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- *	Copyright (C) 2012 Vincent Hanquez <tab@snarc.org>
- *
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-#ifndef CPU_H
-#define CPU_H
-
-#if defined(__i386__) || defined(__x86_64__)
-#define ARCH_X86
-#define USE_AESNI
-#endif
-
-#ifdef USE_AESNI
-void cryptonite_aesni_initialize_hw(void (*init_table)(int, int));
-#else
-#define cryptonite_aesni_initialize_hw(init_table) 	(0)
-#endif
-
-#endif
diff --git a/cbits/cryptonite_curve25519.h b/cbits/cryptonite_curve25519.h
deleted file mode 100644
--- a/cbits/cryptonite_curve25519.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef CRYPTONITE_CURVE25519_H
-#define CRYPTONITE_CURVE25519_H
-
-int cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint);
-
-#endif
diff --git a/cbits/cryptonite_hash_prefix.c b/cbits/cryptonite_hash_prefix.c
deleted file mode 100644
--- a/cbits/cryptonite_hash_prefix.c
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <cryptonite_hash_prefix.h>
-
-void CRYPTONITE_HASHED(finalize_prefix)(struct HASHED_LOWER(ctx) *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)
-{
-	uint64_t bits[HASHED(BITS_ELEMS)];
-	uint8_t *p = (uint8_t *) &bits;
-	uint32_t index, padidx, padlen, pos, out_mask;
-	static const uint32_t cut_off = HASHED(BLOCK_SIZE) - sizeof(bits);
-
-	/* Make sure n <= len */
-	n += (len - n) & constant_time_lt(len, n);
-
-	/* Initial index, based on current context state */
-	index = CRYPTONITE_HASHED(get_index)(ctx);
-
-	/* Final size after n bytes */
-	CRYPTONITE_HASHED(incr_sz)(ctx, bits, n);
-
-	/* Padding index and length */
-	padidx = CRYPTONITE_HASHED(get_index)(ctx);
-	padlen = HASHED(BLOCK_SIZE) + cut_off - padidx;
-	padlen -= HASHED(BLOCK_SIZE) & constant_time_lt(padidx, cut_off);
-
-	/* Initialize buffers because we will XOR into them */
-	memset(ctx->buf + index, 0, HASHED(BLOCK_SIZE) - index);
-	memset(out, 0, HASHED(DIGEST_SIZE));
-	pos = 0;
-
-	/* Iterate based on the full buffer length, regardless of n, and include
-	 * the maximum overhead with padding and size bytes
-	 */
-	while (pos < len + HASHED(BLOCK_SIZE) + sizeof(bits)) {
-		uint8_t b;
-
-		/* Take as many bytes from the input buffer as possible */
-		if (pos < len)
-			b = *(data++) & (uint8_t) constant_time_lt(pos, n);
-		else
-			b = 0;
-
-		/* First padding byte */
-		b |= 0x80 & (uint8_t) constant_time_eq(pos, n);
-
-		/* Size bytes are always at the end of a block */
-		if (index >= cut_off)
-			b |= p[index - cut_off] & (uint8_t) constant_time_ge(pos, n + padlen);
-
-		/* Store this byte into the buffer */
-		ctx->buf[index++] ^= b;
-		pos++;
-
-		/* Process a full block, at a boundary which is independent from n */
-		if (index >= HASHED(BLOCK_SIZE)) {
-			index = 0;
-			HASHED_LOWER(do_chunk)(ctx, (void *) ctx->buf);
-			memset(ctx->buf, 0, HASHED(BLOCK_SIZE));
-
-			/* Try to store the result: this is a no-op except when we reach the
-			 * actual size based on n, more iterations may continue after that
-			 * when len is really larger
-			 */
-			out_mask = constant_time_eq(pos, n + padlen + sizeof(bits));
-			CRYPTONITE_HASHED(select_digest)(ctx, out, out_mask);
-		}
-	}
-}
diff --git a/cbits/cryptonite_hash_prefix.h b/cbits/cryptonite_hash_prefix.h
deleted file mode 100644
--- a/cbits/cryptonite_hash_prefix.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Copyright (C) 2020 Olivier Chéron <olivier.cheron@gmail.com>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *	notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *	notice, this list of conditions and the following disclaimer in the
- *	documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CRYPTONITE_HASH_PREFIX_H
-#define CRYPTONITE_HASH_PREFIX_H
-
-#include <stdint.h>
-
-static inline uint32_t constant_time_msb(uint32_t a)
-{
-	return 0 - (a >> 31);
-}
-
-static inline uint32_t constant_time_lt(uint32_t a, uint32_t b)
-{
-	return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
-}
-
-static inline uint32_t constant_time_ge(uint32_t a, uint32_t b)
-{
-	return ~constant_time_lt(a, b);
-}
-
-static inline uint32_t constant_time_is_zero(uint32_t a)
-{
-	return constant_time_msb(~a & (a - 1));
-}
-
-static inline uint32_t constant_time_eq(uint32_t a, uint32_t b)
-{
-	return constant_time_is_zero(a ^ b);
-}
-
-static inline uint64_t constant_time_msb_64(uint64_t a)
-{
-	return 0 - (a >> 63);
-}
-
-static inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b)
-{
-	return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b)));
-}
-
-#endif
diff --git a/cbits/cryptonite_md2.c b/cbits/cryptonite_md2.c
deleted file mode 100644
--- a/cbits/cryptonite_md2.c
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include <stdio.h>
-#include "cryptonite_bitfn.h"
-#include "cryptonite_md2.h"
-
-void cryptonite_md2_init(struct md2_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-	ctx->sz = 0ULL;
-}
-
-static uint8_t S_table[]  = {
-	0x29, 0x2E, 0x43, 0xC9, 0xA2, 0xD8, 0x7C, 0x01, 0x3D, 0x36, 0x54, 0xA1, 0xEC, 0xF0, 0x06, 0x13, 
-	0x62, 0xA7, 0x05, 0xF3, 0xC0, 0xC7, 0x73, 0x8C, 0x98, 0x93, 0x2B, 0xD9, 0xBC, 0x4C, 0x82, 0xCA, 
-	0x1E, 0x9B, 0x57, 0x3C, 0xFD, 0xD4, 0xE0, 0x16, 0x67, 0x42, 0x6F, 0x18, 0x8A, 0x17, 0xE5, 0x12, 
-	0xBE, 0x4E, 0xC4, 0xD6, 0xDA, 0x9E, 0xDE, 0x49, 0xA0, 0xFB, 0xF5, 0x8E, 0xBB, 0x2F, 0xEE, 0x7A, 
-	0xA9, 0x68, 0x79, 0x91, 0x15, 0xB2, 0x07, 0x3F, 0x94, 0xC2, 0x10, 0x89, 0x0B, 0x22, 0x5F, 0x21,
-	0x80, 0x7F, 0x5D, 0x9A, 0x5A, 0x90, 0x32, 0x27, 0x35, 0x3E, 0xCC, 0xE7, 0xBF, 0xF7, 0x97, 0x03, 
-	0xFF, 0x19, 0x30, 0xB3, 0x48, 0xA5, 0xB5, 0xD1, 0xD7, 0x5E, 0x92, 0x2A, 0xAC, 0x56, 0xAA, 0xC6, 
-	0x4F, 0xB8, 0x38, 0xD2, 0x96, 0xA4, 0x7D, 0xB6, 0x76, 0xFC, 0x6B, 0xE2, 0x9C, 0x74, 0x04, 0xF1, 
-	0x45, 0x9D, 0x70, 0x59, 0x64, 0x71, 0x87, 0x20, 0x86, 0x5B, 0xCF, 0x65, 0xE6, 0x2D, 0xA8, 0x02, 
-	0x1B, 0x60, 0x25, 0xAD, 0xAE, 0xB0, 0xB9, 0xF6, 0x1C, 0x46, 0x61, 0x69, 0x34, 0x40, 0x7E, 0x0F, 
-	0x55, 0x47, 0xA3, 0x23, 0xDD, 0x51, 0xAF, 0x3A, 0xC3, 0x5C, 0xF9, 0xCE, 0xBA, 0xC5, 0xEA, 0x26, 
-	0x2C, 0x53, 0x0D, 0x6E, 0x85, 0x28, 0x84, 0x09, 0xD3, 0xDF, 0xCD, 0xF4, 0x41, 0x81, 0x4D, 0x52, 
-	0x6A, 0xDC, 0x37, 0xC8, 0x6C, 0xC1, 0xAB, 0xFA, 0x24, 0xE1, 0x7B, 0x08, 0x0C, 0xBD, 0xB1, 0x4A, 
-	0x78, 0x88, 0x95, 0x8B, 0xE3, 0x63, 0xE8, 0x6D, 0xE9, 0xCB, 0xD5, 0xFE, 0x3B, 0x00, 0x1D, 0x39, 
-	0xF2, 0xEF, 0xB7, 0x0E, 0x66, 0x58, 0xD0, 0xE4, 0xA6, 0x77, 0x72, 0xF8, 0xEB, 0x75, 0x4B, 0x0A, 
-	0x31, 0x44, 0x50, 0xB4, 0x8F, 0xED, 0x1F, 0x1A, 0xDB, 0x99, 0x8D, 0x33, 0x9F, 0x11, 0x83, 0x14
-};
-
-#define UBYTES(s) ((uint8_t *) s)
-static uint8_t *padding_table[] = {
-	UBYTES(""),
-	UBYTES("\x1"),
-	UBYTES("\x2\x2"),
-	UBYTES("\x3\x3\x3"),
-	UBYTES("\x4\x4\x4\x4"),
-	UBYTES("\x5\x5\x5\x5\x5"),
-	UBYTES("\x6\x6\x6\x6\x6\x6"),
-	UBYTES("\x7\x7\x7\x7\x7\x7\x7"),
-	UBYTES("\x8\x8\x8\x8\x8\x8\x8\x8"),
-	UBYTES("\x9\x9\x9\x9\x9\x9\x9\x9\x9"),
-	UBYTES("\xa\xa\xa\xa\xa\xa\xa\xa\xa\xa"),
-	UBYTES("\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb\xb"),
-	UBYTES("\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc\xc"),
-	UBYTES("\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd\xd"),
-	UBYTES("\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe\xe"),
-	UBYTES("\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf\xf"),
-	UBYTES("\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10\x10")
-};
-
-static void md2_do_chunk(struct md2_ctx *ctx, const uint8_t *buf)
-{
-	uint8_t i, j, t;
-	uint8_t x[48];
-
-	memcpy(x, ctx->h, 16);
-	memcpy(x+16, buf, 16);
-
-	for (i = 0; i < 16; i++)
-		x[i+32] = ctx->h[i] ^ buf[i];
-
-	for (t = i = 0; i < 18; i++) {
-		for (j = 0; j < 48; j++)
-			t = x[j] ^= S_table[t];
-		t = (t + i) & 0xff;
-	}
-
-	memcpy(ctx->h, x, 16);
-
-	t = ctx->cksum[15];
-	for (i = 0; i < 16; i++)
-		t = ctx->cksum[i] ^= S_table[buf[i] ^ t];
-}
-
-void cryptonite_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t index, to_fill;
-
-	index = (uint32_t) (ctx->sz & 0xf);
-	to_fill = 16 - index;
-
-	ctx->sz += len;
-
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		md2_do_chunk(ctx, ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	/* process as much 16-block as possible */
-	for (; len >= 16; len -= 16, data += 16)
-		md2_do_chunk(ctx, data);
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_md2_finalize(struct md2_ctx *ctx, uint8_t *out)
-{
-	uint32_t index, padlen;
-
-	index = ctx->sz & 0xf;
-	padlen = 16 - index;
-
-	cryptonite_md2_update(ctx, padding_table[padlen], padlen);
-	cryptonite_md2_update(ctx, ctx->cksum, 16);
-	memcpy(out, ctx->h, 16);
-}
diff --git a/cbits/cryptonite_md2.h b/cbits/cryptonite_md2.h
deleted file mode 100644
--- a/cbits/cryptonite_md2.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_MD2_H
-#define CRYPTOHASH_MD2_H
-
-#include <stdint.h>
-
-struct md2_ctx
-{
-	uint64_t sz;
-	uint8_t  buf[16];
-	uint8_t  h[16];
-	uint8_t  cksum[16];
-};
-
-#define MD2_DIGEST_SIZE		16
-#define MD2_CTX_SIZE		sizeof(struct md2_ctx)
-
-void cryptonite_md2_init(struct md2_ctx *ctx);
-void cryptonite_md2_update(struct md2_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_md2_finalize(struct md2_ctx *ctx, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_md4.c b/cbits/cryptonite_md4.c
deleted file mode 100644
--- a/cbits/cryptonite_md4.c
+++ /dev/null
@@ -1,174 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include <stdio.h>
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include "cryptonite_md4.h"
-
-void cryptonite_md4_init(struct md4_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->sz = 0ULL;
-	ctx->h[0] = 0x67452301;
-	ctx->h[1] = 0xefcdab89;
-	ctx->h[2] = 0x98badcfe;
-	ctx->h[3] = 0x10325476;
-}
-
-#define f1(x, y, z)	((x & y) | ((~x) & z))
-#define f2(x, y, z)	((x & y) | (x & z) | (y & z))
-#define f3(x, y, z)	(x ^ y ^ z)
-
-#define K1 	0x00000000
-#define K2 	0x5A827999
-#define K3 	0x6ED9EBA1
-#define R(a,b,c,d,f,k,s,i) (a = rol32(a + f(b,c,d) + w[i] + k, s))
-
-static void md4_do_chunk(struct md4_ctx *ctx, uint32_t *buf)
-{
-	uint32_t a, b, c, d;
-#ifdef ARCH_IS_BIG_ENDIAN
-	uint32_t w[16];
-	cpu_to_le32_array(w, (uint32_t *) buf, 16);
-#else
-	uint32_t *w = buf;
-#endif
-
-	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
-
-	R(a, b, c, d, f1, K1, 3, 0);
-	R(d, a, b, c, f1, K1, 7, 1);
-	R(c, d, a, b, f1, K1, 11, 2);
-	R(b, c, d, a, f1, K1, 19, 3);
-	R(a, b, c, d, f1, K1, 3, 4);
-	R(d, a, b, c, f1, K1, 7, 5);
-	R(c, d, a, b, f1, K1, 11, 6);
-	R(b, c, d, a, f1, K1, 19, 7);
-	R(a, b, c, d, f1, K1, 3, 8);
-	R(d, a, b, c, f1, K1, 7, 9);
-	R(c, d, a, b, f1, K1, 11, 10);
-	R(b, c, d, a, f1, K1, 19, 11);
-	R(a, b, c, d, f1, K1, 3, 12);
-	R(d, a, b, c, f1, K1, 7, 13);
-	R(c, d, a, b, f1, K1, 11, 14);
-	R(b, c, d, a, f1, K1, 19, 15);
-
-	R(a, b, c, d, f2, K2, 3, 0);
-	R(d, a, b, c, f2, K2, 5, 4);
-	R(c, d, a, b, f2, K2, 9, 8);
-	R(b, c, d, a, f2, K2, 13, 12);
-	R(a, b, c, d, f2, K2, 3, 1);
-	R(d, a, b, c, f2, K2, 5, 5);
-	R(c, d, a, b, f2, K2, 9, 9);
-	R(b, c, d, a, f2, K2, 13, 13);
-	R(a, b, c, d, f2, K2, 3, 2);
-	R(d, a, b, c, f2, K2, 5, 6);
-	R(c, d, a, b, f2, K2, 9, 10);
-	R(b, c, d, a, f2, K2, 13, 14);
-	R(a, b, c, d, f2, K2, 3, 3);
-	R(d, a, b, c, f2, K2, 5, 7);
-	R(c, d, a, b, f2, K2, 9, 11);
-	R(b, c, d, a, f2, K2, 13, 15);
-
-	R(a, b, c, d, f3, K3, 3, 0);
-	R(d, a, b, c, f3, K3, 9, 8);
-	R(c, d, a, b, f3, K3, 11, 4);
-	R(b, c, d, a, f3, K3, 15, 12);
-	R(a, b, c, d, f3, K3, 3, 2);
-	R(d, a, b, c, f3, K3, 9, 10);
-	R(c, d, a, b, f3, K3, 11, 6);
-	R(b, c, d, a, f3, K3, 15, 14);
-	R(a, b, c, d, f3, K3, 3, 1);
-	R(d, a, b, c, f3, K3, 9, 9);
-	R(c, d, a, b, f3, K3, 11, 5);
-	R(b, c, d, a, f3, K3, 15, 13);
-	R(a, b, c, d, f3, K3, 3, 3);
-	R(d, a, b, c, f3, K3, 9, 11);
-	R(c, d, a, b, f3, K3, 11, 7);
-	R(b, c, d, a, f3, K3, 15, 15);
-
-	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
-}
-
-void cryptonite_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t index, to_fill;
-
-	index = (uint32_t) (ctx->sz & 0x3f);
-	to_fill = 64 - index;
-
-	ctx->sz += len;
-
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		md4_do_chunk(ctx, (uint32_t *) ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	if (need_alignment(data, 4)) {
-		uint32_t tramp[16];
-		ASSERT_ALIGNMENT(tramp, 4);
-		for (; len >= 64; len -= 64, data += 64) {
-			memcpy(tramp, data, 64);
-			md4_do_chunk(ctx, tramp);
-		}
-	} else {
-		/* process as much 64-block as possible */
-		for (; len >= 64; len -= 64, data += 64)
-			md4_do_chunk(ctx, (uint32_t *) data);
-	}
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_md4_finalize(struct md4_ctx *ctx, uint8_t *out)
-{
-	static uint8_t padding[64] = { 0x80, };
-	uint64_t bits;
-	uint32_t index, padlen;
-
-	/* add padding and update data with it */
-	bits = cpu_to_le64(ctx->sz << 3);
-
-	/* pad out to 56 */
-	index = (uint32_t) (ctx->sz & 0x3f);
-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
-	cryptonite_md4_update(ctx, padding, padlen);
-
-	/* append length */
-	cryptonite_md4_update(ctx, (uint8_t *) &bits, sizeof(bits));
-
-	/* output hash */
-	store_le32(out   , ctx->h[0]);
-	store_le32(out+ 4, ctx->h[1]);
-	store_le32(out+ 8, ctx->h[2]);
-	store_le32(out+12, ctx->h[3]);
-}
diff --git a/cbits/cryptonite_md4.h b/cbits/cryptonite_md4.h
deleted file mode 100644
--- a/cbits/cryptonite_md4.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_MD4_H
-#define CRYPTOHASH_MD4_H
-
-#include <stdint.h>
-
-struct md4_ctx
-{
-	uint64_t sz;
-	uint8_t  buf[64];
-	uint32_t h[4];
-};
-
-#define MD4_DIGEST_SIZE		16
-#define MD4_CTX_SIZE		sizeof(struct md4_ctx)
-
-void cryptonite_md4_init(struct md4_ctx *ctx);
-void cryptonite_md4_update(struct md4_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_md4_finalize(struct md4_ctx *ctx, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_md5.c b/cbits/cryptonite_md5.c
deleted file mode 100644
--- a/cbits/cryptonite_md5.c
+++ /dev/null
@@ -1,214 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include <stdio.h>
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include "cryptonite_md5.h"
-
-void cryptonite_md5_init(struct md5_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->sz = 0ULL;
-	ctx->h[0] = 0x67452301;
-	ctx->h[1] = 0xefcdab89;
-	ctx->h[2] = 0x98badcfe;
-	ctx->h[3] = 0x10325476;
-}
-
-#define f1(x, y, z)	(z ^ (x & (y ^ z)))
-#define f2(x, y, z)	f1(z, x, y)
-#define f3(x, y, z)	(x ^ y ^ z)
-#define f4(x, y, z)	(y ^ (x | ~z))
-#define R(f, a, b, c, d, i, k, s) a += f(b, c, d) + w[i] + k; a = rol32(a, s); a += b
-
-static void md5_do_chunk(struct md5_ctx *ctx, uint32_t *buf)
-{
-	uint32_t a, b, c, d;
-#ifdef ARCH_IS_BIG_ENDIAN
-	uint32_t w[16];
-	cpu_to_le32_array(w, buf, 16);
-#else
-	uint32_t *w = buf;
-#endif
-	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
-
-	R(f1, a, b, c, d, 0, 0xd76aa478, 7);
-	R(f1, d, a, b, c, 1, 0xe8c7b756, 12);
-	R(f1, c, d, a, b, 2, 0x242070db, 17);
-	R(f1, b, c, d, a, 3, 0xc1bdceee, 22);
-	R(f1, a, b, c, d, 4, 0xf57c0faf, 7);
-	R(f1, d, a, b, c, 5, 0x4787c62a, 12);
-	R(f1, c, d, a, b, 6, 0xa8304613, 17);
-	R(f1, b, c, d, a, 7, 0xfd469501, 22);
-	R(f1, a, b, c, d, 8, 0x698098d8, 7);
-	R(f1, d, a, b, c, 9, 0x8b44f7af, 12);
-	R(f1, c, d, a, b, 10, 0xffff5bb1, 17);
-	R(f1, b, c, d, a, 11, 0x895cd7be, 22);
-	R(f1, a, b, c, d, 12, 0x6b901122, 7);
-	R(f1, d, a, b, c, 13, 0xfd987193, 12);
-	R(f1, c, d, a, b, 14, 0xa679438e, 17);
-	R(f1, b, c, d, a, 15, 0x49b40821, 22);
-
-	R(f2, a, b, c, d, 1, 0xf61e2562, 5);
-	R(f2, d, a, b, c, 6, 0xc040b340, 9);
-	R(f2, c, d, a, b, 11, 0x265e5a51, 14);
-	R(f2, b, c, d, a, 0, 0xe9b6c7aa, 20);
-	R(f2, a, b, c, d, 5, 0xd62f105d, 5);
-	R(f2, d, a, b, c, 10, 0x02441453, 9);
-	R(f2, c, d, a, b, 15, 0xd8a1e681, 14);
-	R(f2, b, c, d, a, 4, 0xe7d3fbc8, 20);
-	R(f2, a, b, c, d, 9, 0x21e1cde6, 5);
-	R(f2, d, a, b, c, 14, 0xc33707d6, 9);
-	R(f2, c, d, a, b, 3, 0xf4d50d87, 14);
-	R(f2, b, c, d, a, 8, 0x455a14ed, 20);
-	R(f2, a, b, c, d, 13, 0xa9e3e905, 5);
-	R(f2, d, a, b, c, 2, 0xfcefa3f8, 9);
-	R(f2, c, d, a, b, 7, 0x676f02d9, 14);
-	R(f2, b, c, d, a, 12, 0x8d2a4c8a, 20);
-
-	R(f3, a, b, c, d, 5, 0xfffa3942, 4);
-	R(f3, d, a, b, c, 8, 0x8771f681, 11);
-	R(f3, c, d, a, b, 11, 0x6d9d6122, 16);
-	R(f3, b, c, d, a, 14, 0xfde5380c, 23);
-	R(f3, a, b, c, d, 1, 0xa4beea44, 4);
-	R(f3, d, a, b, c, 4, 0x4bdecfa9, 11);
-	R(f3, c, d, a, b, 7, 0xf6bb4b60, 16);
-	R(f3, b, c, d, a, 10, 0xbebfbc70, 23);
-	R(f3, a, b, c, d, 13, 0x289b7ec6, 4);
-	R(f3, d, a, b, c, 0, 0xeaa127fa, 11);
-	R(f3, c, d, a, b, 3, 0xd4ef3085, 16);
-	R(f3, b, c, d, a, 6, 0x04881d05, 23);
-	R(f3, a, b, c, d, 9, 0xd9d4d039, 4);
-	R(f3, d, a, b, c, 12, 0xe6db99e5, 11);
-	R(f3, c, d, a, b, 15, 0x1fa27cf8, 16);
-	R(f3, b, c, d, a, 2, 0xc4ac5665, 23);
-
-	R(f4, a, b, c, d, 0, 0xf4292244, 6);
-	R(f4, d, a, b, c, 7, 0x432aff97, 10);
-	R(f4, c, d, a, b, 14, 0xab9423a7, 15);
-	R(f4, b, c, d, a, 5, 0xfc93a039, 21);
-	R(f4, a, b, c, d, 12, 0x655b59c3, 6);
-	R(f4, d, a, b, c, 3, 0x8f0ccc92, 10);
-	R(f4, c, d, a, b, 10, 0xffeff47d, 15);
-	R(f4, b, c, d, a, 1, 0x85845dd1, 21);
-	R(f4, a, b, c, d, 8, 0x6fa87e4f, 6);
-	R(f4, d, a, b, c, 15, 0xfe2ce6e0, 10);
-	R(f4, c, d, a, b, 6, 0xa3014314, 15);
-	R(f4, b, c, d, a, 13, 0x4e0811a1, 21);
-	R(f4, a, b, c, d, 4, 0xf7537e82, 6);
-	R(f4, d, a, b, c, 11, 0xbd3af235, 10);
-	R(f4, c, d, a, b, 2, 0x2ad7d2bb, 15);
-	R(f4, b, c, d, a, 9, 0xeb86d391, 21);
-
-	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
-}
-
-void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t index, to_fill;
-
-	index = (uint32_t) (ctx->sz & 0x3f);
-	to_fill = 64 - index;
-
-	ctx->sz += len;
-
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		md5_do_chunk(ctx, (uint32_t *) ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	if (need_alignment(data, 4)) {
-		uint32_t tramp[16];
-		ASSERT_ALIGNMENT(tramp, 4);
-		for (; len >= 64; len -= 64, data += 64) {
-			memcpy(tramp, data, 64);
-			md5_do_chunk(ctx, tramp);
-		}
-	} else {
-		/* process as much 64-block as possible */
-		for (; len >= 64; len -= 64, data += 64)
-			md5_do_chunk(ctx, (uint32_t *) data);
-	}
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out)
-{
-	static uint8_t padding[64] = { 0x80, };
-	uint64_t bits;
-	uint32_t index, padlen;
-
-	/* add padding and update data with it */
-	bits = cpu_to_le64(ctx->sz << 3);
-
-	/* pad out to 56 */
-	index = (uint32_t) (ctx->sz & 0x3f);
-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
-	cryptonite_md5_update(ctx, padding, padlen);
-
-	/* append length */
-	cryptonite_md5_update(ctx, (uint8_t *) &bits, sizeof(bits));
-
-	/* output hash */
-	store_le32(out   , ctx->h[0]);
-	store_le32(out+ 4, ctx->h[1]);
-	store_le32(out+ 8, ctx->h[2]);
-	store_le32(out+12, ctx->h[3]);
-}
-
-#define HASHED(m) MD5_##m
-#define HASHED_LOWER(m) md5_##m
-#define CRYPTONITE_HASHED(m) cryptonite_md5_##m
-#define MD5_BLOCK_SIZE 64
-#define MD5_BITS_ELEMS 1
-
-static inline uint32_t cryptonite_md5_get_index(const struct md5_ctx *ctx)
-{
-	return (uint32_t) (ctx->sz & 0x3f);
-}
-
-static inline void cryptonite_md5_incr_sz(struct md5_ctx *ctx, uint64_t *bits, uint32_t n)
-{
-	ctx->sz += n;
-	*bits = cpu_to_le64(ctx->sz << 3);
-}
-
-static inline void cryptonite_md5_select_digest(const struct md5_ctx *ctx, uint8_t *out, uint32_t out_mask)
-{
-	xor_le32(out   , ctx->h[0] & out_mask);
-	xor_le32(out+ 4, ctx->h[1] & out_mask);
-	xor_le32(out+ 8, ctx->h[2] & out_mask);
-	xor_le32(out+12, ctx->h[3] & out_mask);
-}
-
-#include <cryptonite_hash_prefix.c>
diff --git a/cbits/cryptonite_md5.h b/cbits/cryptonite_md5.h
deleted file mode 100644
--- a/cbits/cryptonite_md5.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_MD5_H
-#define CRYPTOHASH_MD5_H
-
-#include <stdint.h>
-
-struct md5_ctx
-{
-	uint64_t sz;
-	uint8_t  buf[64];
-	uint32_t h[4];
-};
-
-#define MD5_DIGEST_SIZE		16
-#define MD5_CTX_SIZE		sizeof(struct md5_ctx)
-
-void cryptonite_md5_init(struct md5_ctx *ctx);
-void cryptonite_md5_update(struct md5_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_md5_finalize(struct md5_ctx *ctx, uint8_t *out);
-void cryptonite_md5_finalize_prefix(struct md5_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_pbkdf2.c b/cbits/cryptonite_pbkdf2.c
deleted file mode 100644
--- a/cbits/cryptonite_pbkdf2.c
+++ /dev/null
@@ -1,390 +0,0 @@
-/*
- * fast-pbkdf2 - Optimal PBKDF2-HMAC calculation
- * Written in 2015 by Joseph Birr-Pixton <jpixton@gmail.com>
- * Ported to cryptonite in 2017 by Nicolas Di Prima <nicolas@primetype.co.uk>
- *
- * To the extent possible under law, the author(s) have dedicated all
- * copyright and related and neighboring rights to this software to the
- * public domain worldwide. This software is distributed without any
- * warranty.
- *
- * You should have received a copy of the CC0 Public Domain Dedication
- * along with this software. If not, see
- * <http://creativecommons.org/publicdomain/zero/1.0/>.
- */
-
-#include <assert.h>
-#include <string.h>
-
-#include "cryptonite_pbkdf2.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include "cryptonite_sha1.h"
-#include "cryptonite_sha256.h"
-#include "cryptonite_sha512.h"
-
-/* --- MSVC doesn't support C99 --- */
-#ifdef _MSC_VER
-#define restrict
-#define _Pragma __pragma
-#endif
-
-/* --- Common useful things --- */
-#define MIN(a, b) ((a) > (b)) ? (b) : (a)
-
-/* Prepare block (of blocksz bytes) to contain md padding denoting a msg-size
- * message (in bytes).  block has a prefix of used bytes.
- *
- * Message length is expressed in 32 bits (so suitable for sha1, sha256, sha512). */
-static inline void md_pad(uint8_t *block, size_t blocksz, size_t used, size_t msg)
-{
-  memset(block + used, 0, blocksz - used - 4);
-  block[used] = 0x80;
-  block += blocksz - 4;
-  store_be32(block, (uint32_t) (msg * 8));
-}
-
-/* Internal function/type names for hash-specific things. */
-#define HMAC_CTX(_name) HMAC_ ## _name ## _ctx
-#define HMAC_INIT(_name) HMAC_ ## _name ## _init
-#define HMAC_UPDATE(_name) HMAC_ ## _name ## _update
-#define HMAC_FINAL(_name) HMAC_ ## _name ## _final
-
-#define PBKDF2_F(_name) pbkdf2_f_ ## _name
-#define PBKDF2(_name) pbkdf2_ ## _name
-
-/* This macro expands to decls for the whole implementation for a given
- * hash function.  Arguments are:
- *
- * _name like 'sha1', added to symbol names
- * _blocksz block size, in bytes
- * _hashsz digest output, in bytes
- * _ctx hash context type
- * _init hash context initialisation function
- *    args: (_ctx *c)
- * _update hash context update function
- *    args: (_ctx *c, const void *data, size_t ndata)
- * _final hash context finish function
- *    args: (void *out, _ctx *c)
- * _xform hash context raw block update function
- *    args: (_ctx *c, const void *data)
- * _xcpy hash context raw copy function (only need copy hash state)
- *    args: (_ctx * restrict out, const _ctx *restrict in)
- * _xtract hash context state extraction
- *    args: args (_ctx *restrict c, uint8_t *restrict out)
- * _xxor hash context xor function (only need xor hash state)
- *    args: (_ctx *restrict out, const _ctx *restrict in)
- *
- * The resulting function is named PBKDF2(_name).
- */
-#define DECL_PBKDF2(_name, _blocksz, _hashsz, _ctx,                           \
-                    _init, _update, _xform, _final, _xcpy, _xtract, _xxor)    \
-  typedef struct {                                                            \
-    _ctx inner;                                                               \
-    _ctx outer;                                                               \
-  } HMAC_CTX(_name);                                                          \
-                                                                              \
-  static inline void HMAC_INIT(_name)(HMAC_CTX(_name) *ctx,                   \
-                                      const uint8_t *key, size_t nkey)        \
-  {                                                                           \
-    /* Prepare key: */                                                        \
-    uint8_t k[_blocksz];                                                      \
-                                                                              \
-    /* Shorten long keys. */                                                  \
-    if (nkey > _blocksz)                                                      \
-    {                                                                         \
-      _init(&ctx->inner);                                                     \
-      _update(&ctx->inner, key, nkey);                                        \
-      _final(&ctx->inner, k);                                                 \
-                                                                              \
-      key = k;                                                                \
-      nkey = _hashsz;                                                         \
-    }                                                                         \
-                                                                              \
-    /* Standard doesn't cover case where blocksz < hashsz. */                 \
-    assert(nkey <= _blocksz);                                                 \
-                                                                              \
-    /* Right zero-pad short keys. */                                          \
-    if (k != key)                                                             \
-      memcpy(k, key, nkey);                                                   \
-    if (_blocksz > nkey)                                                      \
-      memset(k + nkey, 0, _blocksz - nkey);                                   \
-                                                                              \
-    /* Start inner hash computation */                                        \
-    uint8_t blk_inner[_blocksz];                                              \
-    uint8_t blk_outer[_blocksz];                                              \
-                                                                              \
-    for (size_t i = 0; i < _blocksz; i++)                                     \
-    {                                                                         \
-      blk_inner[i] = 0x36 ^ k[i];                                             \
-      blk_outer[i] = 0x5c ^ k[i];                                             \
-    }                                                                         \
-                                                                              \
-    _init(&ctx->inner);                                                       \
-    _update(&ctx->inner, blk_inner, sizeof blk_inner);                        \
-                                                                              \
-    /* And outer. */                                                          \
-    _init(&ctx->outer);                                                       \
-    _update(&ctx->outer, blk_outer, sizeof blk_outer);                        \
-  }                                                                           \
-                                                                              \
-  static inline void HMAC_UPDATE(_name)(HMAC_CTX(_name) *ctx,                 \
-                                        const void *data, size_t ndata)       \
-  {                                                                           \
-    _update(&ctx->inner, data, ndata);                                        \
-  }                                                                           \
-                                                                              \
-  static inline void HMAC_FINAL(_name)(HMAC_CTX(_name) *ctx,                  \
-                                       uint8_t out[_hashsz])                  \
-  {                                                                           \
-    _final(&ctx->inner, out);                                                 \
-    _update(&ctx->outer, out, _hashsz);                                       \
-    _final(&ctx->outer, out);                                                 \
-  }                                                                           \
-                                                                              \
-                                                                              \
-  /* --- PBKDF2 --- */                                                        \
-  static inline void PBKDF2_F(_name)(const HMAC_CTX(_name) *startctx,         \
-                                     uint32_t counter,                        \
-                                     const uint8_t *salt, size_t nsalt,       \
-                                     uint32_t iterations,                     \
-                                     uint8_t *out)                            \
-  {                                                                           \
-    uint8_t countbuf[4];                                                      \
-    store_be32(countbuf, counter);                                            \
-                                                                              \
-    /* Prepare loop-invariant padding block. */                               \
-    uint8_t Ublock[_blocksz];                                                 \
-    md_pad(Ublock, _blocksz, _hashsz, _blocksz + _hashsz);                    \
-                                                                              \
-    /* First iteration:                                                       \
-     *   U_1 = PRF(P, S || INT_32_BE(i))                                      \
-     */                                                                       \
-    HMAC_CTX(_name) ctx = *startctx;                                          \
-    HMAC_UPDATE(_name)(&ctx, salt, nsalt);                                    \
-    HMAC_UPDATE(_name)(&ctx, countbuf, sizeof countbuf);                      \
-    HMAC_FINAL(_name)(&ctx, Ublock);                                          \
-    _ctx result = ctx.outer;                                                  \
-                                                                              \
-    /* Subsequent iterations:                                                 \
-     *   U_c = PRF(P, U_{c-1})                                                \
-     */                                                                       \
-    for (uint32_t i = 1; i < iterations; i++)                                 \
-    {                                                                         \
-      /* Complete inner hash with previous U */                               \
-      _xcpy(&ctx.inner, &startctx->inner);                                    \
-      _xform(&ctx.inner, Ublock);                                             \
-      _xtract(&ctx.inner, Ublock);                                            \
-      /* Complete outer hash with inner output */                             \
-      _xcpy(&ctx.outer, &startctx->outer);                                    \
-      _xform(&ctx.outer, Ublock);                                             \
-      _xtract(&ctx.outer, Ublock);                                            \
-      _xxor(&result, &ctx.outer);                                             \
-    }                                                                         \
-                                                                              \
-    /* Reform result into output buffer. */                                   \
-    _xtract(&result, out);                                                    \
-  }                                                                           \
-                                                                              \
-  static inline void PBKDF2(_name)(const uint8_t *pw, size_t npw,             \
-                     const uint8_t *salt, size_t nsalt,                       \
-                     uint32_t iterations,                                     \
-                     uint8_t *out, size_t nout)                               \
-  {                                                                           \
-    assert(iterations);                                                       \
-    assert(out && nout);                                                      \
-                                                                              \
-    /* Starting point for inner loop. */                                      \
-    HMAC_CTX(_name) ctx;                                                      \
-    HMAC_INIT(_name)(&ctx, pw, npw);                                          \
-                                                                              \
-    /* How many blocks do we need? */                                         \
-    uint32_t blocks_needed = (uint32_t)(nout + _hashsz - 1) / _hashsz;        \
-                                                                              \
-    for (uint32_t counter = 1; counter <= blocks_needed; counter++)           \
-    {                                                                         \
-      uint8_t block[_hashsz];                                                 \
-      PBKDF2_F(_name)(&ctx, counter, salt, nsalt, iterations, block);         \
-                                                                              \
-      size_t offset = (counter - 1) * _hashsz;                                \
-      size_t taken = MIN(nout - offset, _hashsz);                             \
-      memcpy(out + offset, block, taken);                                     \
-    }                                                                         \
-  }
-
-static inline void sha1_extract(struct sha1_ctx *restrict ctx, uint8_t *restrict out)
-{
-	store_be32(out   , ctx->h[0]);
-	store_be32(out+4 , ctx->h[1]);
-	store_be32(out+8 , ctx->h[2]);
-	store_be32(out+12, ctx->h[3]);
-	store_be32(out+16, ctx->h[4]);
-}
-
-static inline void sha1_cpy(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)
-{
-  out->h[0] = in->h[0];
-  out->h[1] = in->h[1];
-  out->h[2] = in->h[2];
-  out->h[3] = in->h[3];
-  out->h[4] = in->h[4];
-}
-
-static inline void sha1_xor(struct sha1_ctx *restrict out, const struct sha1_ctx *restrict in)
-{
-  out->h[0] ^= in->h[0];
-  out->h[1] ^= in->h[1];
-  out->h[2] ^= in->h[2];
-  out->h[3] ^= in->h[3];
-  out->h[4] ^= in->h[4];
-}
-
-void cryptonite_sha1_transform(struct sha1_ctx* ctx, uint8_t block[SHA1_BLOCK_SIZE])
-{
-  cryptonite_sha1_update(ctx, block, SHA1_BLOCK_SIZE);
-}
-
-DECL_PBKDF2(sha1,
-            SHA1_BLOCK_SIZE,
-            SHA1_DIGEST_SIZE,
-            struct sha1_ctx,
-            cryptonite_sha1_init,
-            cryptonite_sha1_update,
-            cryptonite_sha1_transform,
-            cryptonite_sha1_finalize,
-            sha1_cpy,
-            sha1_extract,
-            sha1_xor);
-
-static inline void sha256_extract(struct sha256_ctx *restrict ctx, uint8_t *restrict out)
-{
-	store_be32(out   , ctx->h[0]);
-	store_be32(out+4 , ctx->h[1]);
-	store_be32(out+8 , ctx->h[2]);
-	store_be32(out+12, ctx->h[3]);
-	store_be32(out+16, ctx->h[4]);
-	store_be32(out+20, ctx->h[5]);
-	store_be32(out+24, ctx->h[6]);
-	store_be32(out+28, ctx->h[7]);
-}
-
-static inline void sha256_cpy(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)
-{
-	out->h[0] = in->h[0];
-	out->h[1] = in->h[1];
-	out->h[2] = in->h[2];
-	out->h[3] = in->h[3];
-	out->h[4] = in->h[4];
-	out->h[5] = in->h[5];
-	out->h[6] = in->h[6];
-	out->h[7] = in->h[7];
-}
-
-static inline void sha256_xor(struct sha256_ctx *restrict out, const struct sha256_ctx *restrict in)
-{
-	out->h[0] ^= in->h[0];
-	out->h[1] ^= in->h[1];
-	out->h[2] ^= in->h[2];
-	out->h[3] ^= in->h[3];
-	out->h[4] ^= in->h[4];
-	out->h[5] ^= in->h[5];
-	out->h[6] ^= in->h[6];
-	out->h[7] ^= in->h[7];
-}
-
-void cryptonite_sha256_transform(struct sha256_ctx* ctx, uint8_t block[SHA256_BLOCK_SIZE])
-{
-  cryptonite_sha256_update(ctx, block, SHA256_BLOCK_SIZE);
-}
-
-DECL_PBKDF2(sha256,
-            SHA256_BLOCK_SIZE,
-            SHA256_DIGEST_SIZE,
-            struct sha256_ctx,
-            cryptonite_sha256_init,
-            cryptonite_sha256_update,
-            cryptonite_sha256_transform,
-            cryptonite_sha256_finalize,
-            sha256_cpy,
-            sha256_extract,
-            sha256_xor);
-
-static inline void sha512_extract(struct sha512_ctx *restrict ctx, uint8_t *restrict out)
-{
-	store_be64(out   , ctx->h[0]);
-	store_be64(out+8 , ctx->h[1]);
-	store_be64(out+16, ctx->h[2]);
-	store_be64(out+24, ctx->h[3]);
-	store_be64(out+32, ctx->h[4]);
-	store_be64(out+40, ctx->h[5]);
-	store_be64(out+48, ctx->h[6]);
-	store_be64(out+56, ctx->h[7]);
-}
-
-static inline void sha512_cpy(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)
-{
-	out->h[0] = in->h[0];
-	out->h[1] = in->h[1];
-	out->h[2] = in->h[2];
-	out->h[3] = in->h[3];
-	out->h[4] = in->h[4];
-	out->h[5] = in->h[5];
-	out->h[6] = in->h[6];
-	out->h[7] = in->h[7];
-}
-
-static inline void sha512_xor(struct sha512_ctx *restrict out, const struct sha512_ctx *restrict in)
-{
-	out->h[0] ^= in->h[0];
-	out->h[1] ^= in->h[1];
-	out->h[2] ^= in->h[2];
-	out->h[3] ^= in->h[3];
-	out->h[4] ^= in->h[4];
-	out->h[5] ^= in->h[5];
-	out->h[6] ^= in->h[6];
-	out->h[7] ^= in->h[7];
-}
-
-void cryptonite_sha512_transform(struct sha512_ctx* ctx, uint8_t block[SHA512_BLOCK_SIZE])
-{
-	cryptonite_sha512_update(ctx, block, SHA512_BLOCK_SIZE);
-}
-
-DECL_PBKDF2(sha512,
-            SHA512_BLOCK_SIZE,
-            SHA512_DIGEST_SIZE,
-            struct sha512_ctx,
-            cryptonite_sha512_init,
-            cryptonite_sha512_update,
-            cryptonite_sha512_transform,
-            cryptonite_sha512_finalize,
-            sha512_cpy,
-            sha512_extract,
-            sha512_xor);
-
-void cryptonite_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw
-                                    , const uint8_t *salt, size_t nsalt
-                                    , uint32_t iterations
-                                    , uint8_t *out, size_t nout
-                                    )
-{
-  PBKDF2(sha1)(pw, npw, salt, nsalt, iterations, out, nout);
-}
-
-void cryptonite_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw
-                                      , const uint8_t *salt, size_t nsalt
-                                      , uint32_t iterations
-                                      , uint8_t *out, size_t nout
-                                      )
-{
-  PBKDF2(sha256)(pw, npw, salt, nsalt, iterations, out, nout);
-}
-
-void cryptonite_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw
-                                      , const uint8_t *salt, size_t nsalt
-                                      , uint32_t iterations
-                                      , uint8_t *out, size_t nout
-                                      )
-{
-  PBKDF2(sha512)(pw, npw, salt, nsalt, iterations, out, nout);
-}
diff --git a/cbits/cryptonite_pbkdf2.h b/cbits/cryptonite_pbkdf2.h
deleted file mode 100644
--- a/cbits/cryptonite_pbkdf2.h
+++ /dev/null
@@ -1,31 +0,0 @@
-#ifndef CRYPTONITE_PBKDF2_H_
-#define CRYPTONITE_PBKDF2_H_
-
-#include <stdlib.h>
-#include <stdint.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-void cryptonite_fastpbkdf2_hmac_sha1( const uint8_t *pw, size_t npw
-                                    , const uint8_t *salt, size_t nsalt
-                                    , uint32_t iterations
-                                    , uint8_t *out, size_t nout
-                                    );
-void cryptonite_fastpbkdf2_hmac_sha256( const uint8_t *pw, size_t npw
-                                      , const uint8_t *salt, size_t nsalt
-                                      , uint32_t iterations
-                                      , uint8_t *out, size_t nout
-                                      );
-void cryptonite_fastpbkdf2_hmac_sha512( const uint8_t *pw, size_t npw
-                                      , const uint8_t *salt, size_t nsalt
-                                      , uint32_t iterations
-                                      , uint8_t *out, size_t nout
-                                      );
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/cbits/cryptonite_poly1305.c b/cbits/cryptonite_poly1305.c
deleted file mode 100644
--- a/cbits/cryptonite_poly1305.c
+++ /dev/null
@@ -1,203 +0,0 @@
-/*
- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The following code contains some code copied from and inspired by poly1305-donna
- * in poly1305_do_chunk and poly1305_finalize which is licensed under MIT or PUBLIC DOMAIN.
- * see [poly1305-donna](https://github.com/floodyberry/poly1305-donna)
- *
- */
-
-#include <stdint.h>
-#include <string.h>
-#include "cryptonite_poly1305.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-
-static void poly1305_do_chunk(poly1305_ctx *ctx, uint8_t *data, int blocks, int final)
-{
-	/* following is a cleanup copy of code available poly1305-donna */
-	const uint32_t hibit = (final) ? 0 : (1 << 24); /* 1 << 128 */
-	uint32_t r0,r1,r2,r3,r4;
-	uint32_t s1,s2,s3,s4;
-	uint32_t h0,h1,h2,h3,h4;
-	uint64_t d0,d1,d2,d3,d4;
-	uint32_t c;
-
-	/* load r[i], h[i] */
-	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];
-	r0 = ctx->r[0]; r1 = ctx->r[1]; r2 = ctx->r[2]; r3 = ctx->r[3]; r4 = ctx->r[4];
-
-	/* s[i] = r[i] * 5 */
-	s1 = r1 * 5; s2 = r2 * 5; s3 = r3 * 5; s4 = r4 * 5;
-
-	while (blocks--) {
-		h0 += (load_le32(data+ 0)     ) & 0x3ffffff;
-		h1 += (load_le32(data+ 3) >> 2) & 0x3ffffff;
-		h2 += (load_le32(data+ 6) >> 4) & 0x3ffffff;
-		h3 += (load_le32(data+ 9) >> 6) & 0x3ffffff;
-		h4 += (load_le32(data+12) >> 8) | hibit;
-
-		d0 = ((uint64_t)h0 * r0) + ((uint64_t)h1 * s4) + ((uint64_t)h2 * s3) + ((uint64_t)h3 * s2) + ((uint64_t)h4 * s1);
-		d1 = ((uint64_t)h0 * r1) + ((uint64_t)h1 * r0) + ((uint64_t)h2 * s4) + ((uint64_t)h3 * s3) + ((uint64_t)h4 * s2);
-		d2 = ((uint64_t)h0 * r2) + ((uint64_t)h1 * r1) + ((uint64_t)h2 * r0) + ((uint64_t)h3 * s4) + ((uint64_t)h4 * s3);
-		d3 = ((uint64_t)h0 * r3) + ((uint64_t)h1 * r2) + ((uint64_t)h2 * r1) + ((uint64_t)h3 * r0) + ((uint64_t)h4 * s4);
-		d4 = ((uint64_t)h0 * r4) + ((uint64_t)h1 * r3) + ((uint64_t)h2 * r2) + ((uint64_t)h3 * r1) + ((uint64_t)h4 * r0);
-
-		c = (uint32_t)(d0 >> 26); h0 = (uint32_t)d0 & 0x3ffffff;
-		d1 += c;      c = (uint32_t)(d1 >> 26); h1 = (uint32_t)d1 & 0x3ffffff;
-		d2 += c;      c = (uint32_t)(d2 >> 26); h2 = (uint32_t)d2 & 0x3ffffff;
-		d3 += c;      c = (uint32_t)(d3 >> 26); h3 = (uint32_t)d3 & 0x3ffffff;
-		d4 += c;      c = (uint32_t)(d4 >> 26); h4 = (uint32_t)d4 & 0x3ffffff;
-		h0 += c * 5;  c =           (h0 >> 26); h0 = h0 & 0x3ffffff;
-		h1 += c;
-
-		data += 16;
-	}
-
-	/* store h[i] */
-	ctx->h[0] = h0; ctx->h[1] = h1; ctx->h[2] = h2; ctx->h[3] = h3; ctx->h[4] = h4;
-}
-
-void cryptonite_poly1305_init(poly1305_ctx *ctx, poly1305_key *key)
-{
-	uint8_t *k = (uint8_t *) key;
-
-	memset(ctx, 0, sizeof(poly1305_ctx));
-
-	ctx->r[0] = (load_le32(&k[ 0])     ) & 0x3ffffff;
-	ctx->r[1] = (load_le32(&k[ 3]) >> 2) & 0x3ffff03;
-	ctx->r[2] = (load_le32(&k[ 6]) >> 4) & 0x3ffc0ff;
-	ctx->r[3] = (load_le32(&k[ 9]) >> 6) & 0x3f03fff;
-	ctx->r[4] = (load_le32(&k[12]) >> 8) & 0x00fffff;
-
-	ctx->pad[0] = load_le32(&k[16]);
-	ctx->pad[1] = load_le32(&k[20]);
-	ctx->pad[2] = load_le32(&k[24]);
-	ctx->pad[3] = load_le32(&k[28]);
-
-	ctx->index = 0;
-}
-
-void cryptonite_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length)
-{
-	uint32_t to_fill, nb_blocks_bytes;
-
-	to_fill = 16 - ctx->index;
-
-	/* process partial buffer if there's enough data to make a block */
-	if (ctx->index && length >= to_fill) {
-		memcpy(ctx->buf + ctx->index, data, to_fill);
-		poly1305_do_chunk(ctx, ctx->buf, 1, 0);
-		ctx->index = 0;
-		length -= to_fill;
-		data += to_fill;
-	}
-
-	/* process as much 16-block as possible */
-	nb_blocks_bytes = length & ~(16 - 1);
-	poly1305_do_chunk(ctx, data, nb_blocks_bytes >> 4, 0);
-	data += nb_blocks_bytes;
-	length &= 0xf;
-
-	/* fill the remaining bytes in the partial buffer */
-	if (length) {
-		memcpy(ctx->buf + ctx->index, data, length);
-		ctx->index += length;
-	}
-}
-
-void cryptonite_poly1305_finalize(poly1305_mac mac8, poly1305_ctx *ctx)
-{
-	uint32_t h0,h1,h2,h3,h4,c;
-	uint32_t g0,g1,g2,g3,g4;
-	uint64_t f;
-	uint32_t mask;
-	uint32_t *mac = (uint32_t *) mac8;
-	int i;
-
-	if (ctx->index) {
-		/* append partial final buffer with 10* then process */
-		ctx->buf[ctx->index] = 0x1;
-		for (i = ctx->index + 1; i < 16; i++)
-			ctx->buf[i] = 0x0;
-		poly1305_do_chunk(ctx, ctx->buf, 1, 1);
-	}
-
-	/* following is a cleanup copy of code available poly1305-donna */
-
-	/* fully carry h */
-	h0 = ctx->h[0]; h1 = ctx->h[1]; h2 = ctx->h[2]; h3 = ctx->h[3]; h4 = ctx->h[4];
-
-	             c = h1 >> 26; h1 = h1 & 0x3ffffff;
-	h2 +=     c; c = h2 >> 26; h2 = h2 & 0x3ffffff;
-	h3 +=     c; c = h3 >> 26; h3 = h3 & 0x3ffffff;
-	h4 +=     c; c = h4 >> 26; h4 = h4 & 0x3ffffff;
-	h0 += c * 5; c = h0 >> 26; h0 = h0 & 0x3ffffff;
-	h1 +=     c;
-
-	/* compute h + -p */
-	g0 = h0 + 5; c = g0 >> 26; g0 &= 0x3ffffff;
-	g1 = h1 + c; c = g1 >> 26; g1 &= 0x3ffffff;
-	g2 = h2 + c; c = g2 >> 26; g2 &= 0x3ffffff;
-	g3 = h3 + c; c = g3 >> 26; g3 &= 0x3ffffff;
-	g4 = h4 + c - (1 << 26);
-
-	/* select h if h < p, or h + -p if h >= p */
-	mask = (g4 >> ((sizeof(uint32_t) * 8) - 1)) - 1;
-	g0 &= mask;
-	g1 &= mask;
-	g2 &= mask;
-	g3 &= mask;
-	g4 &= mask;
-	mask = ~mask;
-	h0 = (h0 & mask) | g0;
-	h1 = (h1 & mask) | g1;
-	h2 = (h2 & mask) | g2;
-	h3 = (h3 & mask) | g3;
-	h4 = (h4 & mask) | g4;
-
-	/* h = h % (2^128) */
-	h0 = ((h0      ) | (h1 << 26)) & 0xffffffff;
-	h1 = ((h1 >>  6) | (h2 << 20)) & 0xffffffff;
-	h2 = ((h2 >> 12) | (h3 << 14)) & 0xffffffff;
-	h3 = ((h3 >> 18) | (h4 <<  8)) & 0xffffffff;
-
-	/* mac = (h + pad) % (2^128) */
-	f = (uint64_t)h0 + ctx->pad[0];
-	mac[0] = cpu_to_le32((uint32_t) f);
-
-	f = (uint64_t)h1 + ctx->pad[1] + (f >> 32);
-	mac[1] = cpu_to_le32((uint32_t) f);
-
-	f = (uint64_t)h2 + ctx->pad[2] + (f >> 32);
-	mac[2] = cpu_to_le32((uint32_t) f);
-
-	f = (uint64_t)h3 + ctx->pad[3] + (f >> 32);
-	mac[3] = cpu_to_le32((uint32_t) f);
-}
diff --git a/cbits/cryptonite_poly1305.h b/cbits/cryptonite_poly1305.h
deleted file mode 100644
--- a/cbits/cryptonite_poly1305.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#ifndef CRYPTONITE_POLY1305_H
-# define CRYPTONITE_POLY1305_H
-
-/* 8*8+1*16+1*4 = 84 */
-typedef struct
-{
-	uint32_t r[5];
-	uint32_t h[5];
-	uint32_t pad[4];
-	uint32_t index;
-	uint8_t buf[16]; /* previous partial block */
-} poly1305_ctx;
-
-typedef uint8_t poly1305_mac[16];
-typedef uint8_t poly1305_key[32];
-
-void cryptonite_poly1305_init(poly1305_ctx *ctx, poly1305_key *key);
-void cryptonite_poly1305_update(poly1305_ctx *ctx, uint8_t *data, uint32_t length);
-void cryptonite_poly1305_finalize(poly1305_mac mac, poly1305_ctx *ctx);
-
-#endif
diff --git a/cbits/cryptonite_rc4.c b/cbits/cryptonite_rc4.c
deleted file mode 100644
--- a/cbits/cryptonite_rc4.c
+++ /dev/null
@@ -1,63 +0,0 @@
-/* initial implementation by
- *   Peter White <peter@janrain.com>
- */
-
-/* C Standard includes */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdint.h>
-
-/* Local include */
-#include "cryptonite_rc4.h"
-
-/* Swap array elements i=State[i] and b=State[j]. */
-static void swap(uint8_t *i, uint8_t *j)
-{
-	uint8_t temp;
-
-	temp = *i;
-	*i = *j;
-	*j = temp;
-}
-
-/* Key scheduling algorithm. Swap array elements based on the key. */
-void cryptonite_rc4_init(uint8_t *key, uint32_t keylen, struct rc4_ctx *ctx)
-{
-	uint32_t i, j;
-	memset(ctx, 0, sizeof(struct rc4_ctx));
-
-	/* initialize context */
-	for (i = 0; i < 256; i++)
-		ctx->state[i] = i;
-	for (i = j = 0; i < 256; i++) {
-		j = (j + ctx->state[i] + key[i % keylen]) % 256;
-		swap(&ctx->state[i], &ctx->state[j]);
-	}
-}
-
-/* Combine the stream generated by the rc4 with some input */
-void cryptonite_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output)
-{
-	uint32_t i = ctx->i;
-	uint32_t j = ctx->j;
-	uint32_t m;
-	uint8_t si, sj;
-
-	/* The RC4 algorithm */
-	for (m = 0; m < len; m++) {
-		i = (i + 1) & 0xff;
-		si = ctx->state[i];
-		j = (j + si) & 0xff;
-		sj = ctx->state[j];
-		/* swap(&state[i], &state[j]); */
-		ctx->state[i] = sj;
-		ctx->state[j] = si;
-		/* Xor the key stream value into the input */
-		*output++ = *input++ ^ (ctx->state[(si + sj) & 0xff]);
-	}
-
-	/* Output new S-box indices */
-	ctx->i = i;
-	ctx->j = j;
-}
diff --git a/cbits/cryptonite_rc4.h b/cbits/cryptonite_rc4.h
deleted file mode 100644
--- a/cbits/cryptonite_rc4.h
+++ /dev/null
@@ -1,14 +0,0 @@
-#ifndef CRYPTONITE_RC4_H
-# define CRYPTONITE_RC4_H
-
-struct rc4_ctx
-{
-	uint8_t state[256];
-	uint32_t i;
-	uint32_t j;
-};
-
-void cryptonite_rc4_init(uint8_t * key, uint32_t keylen, struct rc4_ctx *ctx);
-void cryptonite_rc4_combine(struct rc4_ctx *ctx, uint8_t *input, uint32_t len, uint8_t *output);
-
-#endif
diff --git a/cbits/cryptonite_rdrand.c b/cbits/cryptonite_rdrand.c
deleted file mode 100644
--- a/cbits/cryptonite_rdrand.c
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Copyright (C) Thomas DuBuisson
- * Copyright (C) 2013 Vincent Hanquez <tab@snarc.org>
- *
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <stdint.h>
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-
-int cryptonite_cpu_has_rdrand()
-{
-	uint32_t ax,bx,cx,dx,func=1;
-#if defined(__PIC__) && defined(__i386__)
-	__asm__ volatile ("mov %%ebx, %%edi;" "cpuid;" "xchgl %%ebx, %%edi;"
-		: "=a" (ax), "=D" (bx), "=c" (cx), "=d" (dx) : "a" (func));
-#else
-	__asm__ volatile ("cpuid": "=a" (ax), "=b" (bx), "=c" (cx), "=d" (dx) : "a" (func));
-#endif
-	return (cx & 0x40000000);
-}
-
-/* inline encoding of 'rdrand %rax' to cover old binutils
- * - no inputs
- * - 'cc' to the clobber list as we modify condition code.
- * - output of rdrand in rax and have a 8 bit error condition
- */
-#define inline_rdrand_rax(val, err) \
-	asm(".byte 0x48,0x0f,0xc7,0xf0; setc %1" \
-	   : "=a" (val), "=q" (err) \
-	   : \
-	   : "cc")
-
-/* inline encoding of 'rdrand %eax' to cover old binutils
- * - no inputs
- * - 'cc' to the clobber list as we modify condition code.
- * - output of rdrand in eax and have a 8 bit error condition
- */
-#define inline_rdrand_eax(val, err) \
-	asm(".byte 0x0f,0xc7,0xf0; setc %1" \
-	   : "=a" (val), "=q" (err) \
-	   : \
-	   : "cc")
-
-#ifdef __x86_64__
-# define RDRAND_SZ 8
-# define RDRAND_T  uint64_t
-#define inline_rdrand(val, err) err = cryptonite_rdrand_step(&val)
-#else
-# define RDRAND_SZ 4
-# define RDRAND_T  uint32_t
-#define inline_rdrand(val, err) err = cryptonite_rdrand_step(&val)
-#endif
-
-/* sadly many people are still using an old binutils,
- * leading to report that instruction is not recognized.
- */
-#if 1
-/* Returns 1 on success */
-static inline int cryptonite_rdrand_step(RDRAND_T *buffer)
-{
-	unsigned char err;
-	asm volatile ("rdrand %0; setc %1" : "=r" (*buffer), "=qm" (err));
-	return (int) err;
-}
-#endif
-
-/* Returns the number of bytes successfully generated */
-int cryptonite_get_rand_bytes(uint8_t *buffer, size_t len)
-{
-	RDRAND_T tmp;
-	int aligned = (intptr_t) buffer % RDRAND_SZ;
-	int orig_len = len;
-	int to_alignment = RDRAND_SZ - aligned;
-	uint8_t ok;
-
-	if (aligned != 0) {
-		inline_rdrand(tmp, ok);
-		if (!ok)
-			return 0;
-		memcpy(buffer, (uint8_t *) &tmp, to_alignment);
-		buffer += to_alignment;
-		len -= to_alignment;
-	}
-
-	for (; len >= RDRAND_SZ; buffer += RDRAND_SZ, len -= RDRAND_SZ) {
-		inline_rdrand(tmp, ok);
-		if (!ok)
-			return (orig_len - len);
-		*((RDRAND_T *) buffer) = tmp;
-	}
-
-	if (len > 0) {
-		inline_rdrand(tmp, ok);
-		if (!ok)
-			return (orig_len - len);
-		memcpy(buffer, (uint8_t *) &tmp, len);
-	}
-	return orig_len;
-}
diff --git a/cbits/cryptonite_ripemd.c b/cbits/cryptonite_ripemd.c
deleted file mode 100644
--- a/cbits/cryptonite_ripemd.c
+++ /dev/null
@@ -1,310 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "cryptonite_ripemd.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include <string.h>
-
-void cryptonite_ripemd160_init(struct ripemd160_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->h[0] = 0x67452301;
-	ctx->h[1] = 0xefcdab89;
-	ctx->h[2] = 0x98badcfe;
-	ctx->h[3] = 0x10325476;
-	ctx->h[4] = 0xc3d2e1f0;
-}
-
-#define K1  0x00000000
-#define K2  0x5a827999
-#define K3  0x6ed9eba1
-#define K4  0x8f1bbcdc
-#define K5  0xa953fd4e
-#define K6  0x50a28be6
-#define K7  0x5c4dd124
-#define K8  0x6d703ef3
-#define K9  0x7a6d76e9
-
-#define f1(x, y, z) (x ^ y ^ z)
-#define f2(x, y, z) (z ^ (x & (y ^ z)))
-#define f3(x, y, z) ((x | ~y) ^ z)
-#define f4(x, y, z) (y ^ (z & (x ^ y)))
-#define f5(x, y, z) (x ^ (y | ~z))
-
-#define R(a, b, c, d, e, f, k, i, s)	\
-	a += f(b, c, d) + w[i] + k; a = rol32(a, s) + e; c = rol32(c, 10)
-
-static void ripemd160_do_chunk(struct ripemd160_ctx *ctx, uint32_t *buf)
-{
-	uint32_t a1, b1, c1, d1, e1, a2, b2, c2, d2, e2;
-#ifdef ARCH_IS_BIG_ENDIAN
-	uint32_t w[16];
-	cpu_to_le32_array(w, buf, 16);
-#else
-	uint32_t *w = buf;
-#endif
-
-	a1 = ctx->h[0]; b1 = ctx->h[1]; c1 = ctx->h[2]; d1 = ctx->h[3]; e1 = ctx->h[4];
-	a2 = ctx->h[0]; b2 = ctx->h[1]; c2 = ctx->h[2]; d2 = ctx->h[3]; e2 = ctx->h[4];
-
-	/* 5 passes on first state copy */
-	R(a1, b1, c1, d1, e1, f1, K1, 0, 11);
-	R(e1, a1, b1, c1, d1, f1, K1, 1, 14);
-	R(d1, e1, a1, b1, c1, f1, K1, 2, 15);
-	R(c1, d1, e1, a1, b1, f1, K1, 3, 12);
-	R(b1, c1, d1, e1, a1, f1, K1, 4, 5);
-	R(a1, b1, c1, d1, e1, f1, K1, 5, 8);
-	R(e1, a1, b1, c1, d1, f1, K1, 6, 7);
-	R(d1, e1, a1, b1, c1, f1, K1, 7, 9);
-	R(c1, d1, e1, a1, b1, f1, K1, 8, 11);
-	R(b1, c1, d1, e1, a1, f1, K1, 9, 13);
-	R(a1, b1, c1, d1, e1, f1, K1, 10, 14);
-	R(e1, a1, b1, c1, d1, f1, K1, 11, 15);
-	R(d1, e1, a1, b1, c1, f1, K1, 12, 6);
-	R(c1, d1, e1, a1, b1, f1, K1, 13, 7);
-	R(b1, c1, d1, e1, a1, f1, K1, 14, 9);
-	R(a1, b1, c1, d1, e1, f1, K1, 15, 8);
-	
-	R(e1, a1, b1, c1, d1, f2, K2, 7, 7);
-	R(d1, e1, a1, b1, c1, f2, K2, 4, 6);
-	R(c1, d1, e1, a1, b1, f2, K2, 13, 8);
-	R(b1, c1, d1, e1, a1, f2, K2, 1, 13);
-	R(a1, b1, c1, d1, e1, f2, K2, 10, 11);
-	R(e1, a1, b1, c1, d1, f2, K2, 6, 9);
-	R(d1, e1, a1, b1, c1, f2, K2, 15, 7);
-	R(c1, d1, e1, a1, b1, f2, K2, 3, 15);
-	R(b1, c1, d1, e1, a1, f2, K2, 12, 7);
-	R(a1, b1, c1, d1, e1, f2, K2, 0, 12);
-	R(e1, a1, b1, c1, d1, f2, K2, 9, 15);
-	R(d1, e1, a1, b1, c1, f2, K2, 5, 9);
-	R(c1, d1, e1, a1, b1, f2, K2, 2, 11);
-	R(b1, c1, d1, e1, a1, f2, K2, 14, 7);
-	R(a1, b1, c1, d1, e1, f2, K2, 11, 13);
-	R(e1, a1, b1, c1, d1, f2, K2, 8, 12);
-
-	R(d1, e1, a1, b1, c1, f3, K3, 3, 11);
-	R(c1, d1, e1, a1, b1, f3, K3, 10, 13);
-	R(b1, c1, d1, e1, a1, f3, K3, 14, 6);
-	R(a1, b1, c1, d1, e1, f3, K3, 4, 7);
-	R(e1, a1, b1, c1, d1, f3, K3, 9, 14);
-	R(d1, e1, a1, b1, c1, f3, K3, 15, 9);
-	R(c1, d1, e1, a1, b1, f3, K3, 8, 13);
-	R(b1, c1, d1, e1, a1, f3, K3, 1, 15);
-	R(a1, b1, c1, d1, e1, f3, K3, 2, 14);
-	R(e1, a1, b1, c1, d1, f3, K3, 7, 8);
-	R(d1, e1, a1, b1, c1, f3, K3, 0, 13);
-	R(c1, d1, e1, a1, b1, f3, K3, 6, 6);
-	R(b1, c1, d1, e1, a1, f3, K3, 13, 5);
-	R(a1, b1, c1, d1, e1, f3, K3, 11, 12);
-	R(e1, a1, b1, c1, d1, f3, K3, 5, 7);
-	R(d1, e1, a1, b1, c1, f3, K3, 12, 5);
-
-	R(c1, d1, e1, a1, b1, f4, K4, 1, 11);
-	R(b1, c1, d1, e1, a1, f4, K4, 9, 12);
-	R(a1, b1, c1, d1, e1, f4, K4, 11, 14);
-	R(e1, a1, b1, c1, d1, f4, K4, 10, 15);
-	R(d1, e1, a1, b1, c1, f4, K4, 0, 14);
-	R(c1, d1, e1, a1, b1, f4, K4, 8, 15);
-	R(b1, c1, d1, e1, a1, f4, K4, 12, 9);
-	R(a1, b1, c1, d1, e1, f4, K4, 4, 8);
-	R(e1, a1, b1, c1, d1, f4, K4, 13, 9);
-	R(d1, e1, a1, b1, c1, f4, K4, 3, 14);
-	R(c1, d1, e1, a1, b1, f4, K4, 7, 5);
-	R(b1, c1, d1, e1, a1, f4, K4, 15, 6);
-	R(a1, b1, c1, d1, e1, f4, K4, 14, 8);
-	R(e1, a1, b1, c1, d1, f4, K4, 5, 6);
-	R(d1, e1, a1, b1, c1, f4, K4, 6, 5);
-	R(c1, d1, e1, a1, b1, f4, K4, 2, 12);
-
-	R(b1, c1, d1, e1, a1, f5, K5, 4, 9);
-	R(a1, b1, c1, d1, e1, f5, K5, 0, 15);
-	R(e1, a1, b1, c1, d1, f5, K5, 5, 5);
-	R(d1, e1, a1, b1, c1, f5, K5, 9, 11);
-	R(c1, d1, e1, a1, b1, f5, K5, 7, 6);
-	R(b1, c1, d1, e1, a1, f5, K5, 12, 8);
-	R(a1, b1, c1, d1, e1, f5, K5, 2, 13);
-	R(e1, a1, b1, c1, d1, f5, K5, 10, 12);
-	R(d1, e1, a1, b1, c1, f5, K5, 14, 5);
-	R(c1, d1, e1, a1, b1, f5, K5, 1, 12);
-	R(b1, c1, d1, e1, a1, f5, K5, 3, 13);
-	R(a1, b1, c1, d1, e1, f5, K5, 8, 14);
-	R(e1, a1, b1, c1, d1, f5, K5, 11, 11);
-	R(d1, e1, a1, b1, c1, f5, K5, 6, 8);
-	R(c1, d1, e1, a1, b1, f5, K5, 15, 5);
-	R(b1, c1, d1, e1, a1, f5, K5, 13, 6);
-
-	/* 5 passes on second state copy */
-	R(a2, b2, c2, d2, e2, f5, K6, 5, 8);
-	R(e2, a2, b2, c2, d2, f5, K6, 14, 9);
-	R(d2, e2, a2, b2, c2, f5, K6, 7, 9);
-	R(c2, d2, e2, a2, b2, f5, K6, 0, 11);
-	R(b2, c2, d2, e2, a2, f5, K6, 9, 13);
-	R(a2, b2, c2, d2, e2, f5, K6, 2, 15);
-	R(e2, a2, b2, c2, d2, f5, K6, 11, 15);
-	R(d2, e2, a2, b2, c2, f5, K6, 4, 5);
-	R(c2, d2, e2, a2, b2, f5, K6, 13, 7);
-	R(b2, c2, d2, e2, a2, f5, K6, 6, 7);
-	R(a2, b2, c2, d2, e2, f5, K6, 15, 8);
-	R(e2, a2, b2, c2, d2, f5, K6, 8, 11);
-	R(d2, e2, a2, b2, c2, f5, K6, 1, 14);
-	R(c2, d2, e2, a2, b2, f5, K6, 10, 14);
-	R(b2, c2, d2, e2, a2, f5, K6, 3, 12);
-	R(a2, b2, c2, d2, e2, f5, K6, 12, 6);
-
-	R(e2, a2, b2, c2, d2, f4, K7, 6, 9);
-	R(d2, e2, a2, b2, c2, f4, K7, 11, 13);
-	R(c2, d2, e2, a2, b2, f4, K7, 3, 15);
-	R(b2, c2, d2, e2, a2, f4, K7, 7, 7);
-	R(a2, b2, c2, d2, e2, f4, K7, 0, 12);
-	R(e2, a2, b2, c2, d2, f4, K7, 13, 8);
-	R(d2, e2, a2, b2, c2, f4, K7, 5, 9);
-	R(c2, d2, e2, a2, b2, f4, K7, 10, 11);
-	R(b2, c2, d2, e2, a2, f4, K7, 14, 7);
-	R(a2, b2, c2, d2, e2, f4, K7, 15, 7);
-	R(e2, a2, b2, c2, d2, f4, K7, 8, 12);
-	R(d2, e2, a2, b2, c2, f4, K7, 12, 7);
-	R(c2, d2, e2, a2, b2, f4, K7, 4, 6);
-	R(b2, c2, d2, e2, a2, f4, K7, 9, 15);
-	R(a2, b2, c2, d2, e2, f4, K7, 1, 13);
-	R(e2, a2, b2, c2, d2, f4, K7, 2, 11);
-
-	R(d2, e2, a2, b2, c2, f3, K8, 15, 9);
-	R(c2, d2, e2, a2, b2, f3, K8, 5, 7);
-	R(b2, c2, d2, e2, a2, f3, K8, 1, 15);
-	R(a2, b2, c2, d2, e2, f3, K8, 3, 11);
-	R(e2, a2, b2, c2, d2, f3, K8, 7, 8);
-	R(d2, e2, a2, b2, c2, f3, K8, 14, 6);
-	R(c2, d2, e2, a2, b2, f3, K8, 6, 6);
-	R(b2, c2, d2, e2, a2, f3, K8, 9, 14);
-	R(a2, b2, c2, d2, e2, f3, K8, 11, 12);
-	R(e2, a2, b2, c2, d2, f3, K8, 8, 13);
-	R(d2, e2, a2, b2, c2, f3, K8, 12, 5);
-	R(c2, d2, e2, a2, b2, f3, K8, 2, 14);
-	R(b2, c2, d2, e2, a2, f3, K8, 10, 13);
-	R(a2, b2, c2, d2, e2, f3, K8, 0, 13);
-	R(e2, a2, b2, c2, d2, f3, K8, 4, 7);
-	R(d2, e2, a2, b2, c2, f3, K8, 13, 5);
-
-	R(c2, d2, e2, a2, b2, f2, K9, 8, 15);
-	R(b2, c2, d2, e2, a2, f2, K9, 6, 5);
-	R(a2, b2, c2, d2, e2, f2, K9, 4, 8);
-	R(e2, a2, b2, c2, d2, f2, K9, 1, 11);
-	R(d2, e2, a2, b2, c2, f2, K9, 3, 14);
-	R(c2, d2, e2, a2, b2, f2, K9, 11, 14);
-	R(b2, c2, d2, e2, a2, f2, K9, 15, 6);
-	R(a2, b2, c2, d2, e2, f2, K9, 0, 14);
-	R(e2, a2, b2, c2, d2, f2, K9, 5, 6);
-	R(d2, e2, a2, b2, c2, f2, K9, 12, 9);
-	R(c2, d2, e2, a2, b2, f2, K9, 2, 12);
-	R(b2, c2, d2, e2, a2, f2, K9, 13, 9);
-	R(a2, b2, c2, d2, e2, f2, K9, 9, 12);
-	R(e2, a2, b2, c2, d2, f2, K9, 7, 5);
-	R(d2, e2, a2, b2, c2, f2, K9, 10, 15);
-	R(c2, d2, e2, a2, b2, f2, K9, 14, 8);
-
-	R(b2, c2, d2, e2, a2, f1, K1, 12, 8);
-	R(a2, b2, c2, d2, e2, f1, K1, 15, 5);
-	R(e2, a2, b2, c2, d2, f1, K1, 10, 12);
-	R(d2, e2, a2, b2, c2, f1, K1, 4, 9);
-	R(c2, d2, e2, a2, b2, f1, K1, 1, 12);
-	R(b2, c2, d2, e2, a2, f1, K1, 5, 5);
-	R(a2, b2, c2, d2, e2, f1, K1, 8, 14);
-	R(e2, a2, b2, c2, d2, f1, K1, 7, 6);
-	R(d2, e2, a2, b2, c2, f1, K1, 6, 8);
-	R(c2, d2, e2, a2, b2, f1, K1, 2, 13);
-	R(b2, c2, d2, e2, a2, f1, K1, 13, 6);
-	R(a2, b2, c2, d2, e2, f1, K1, 14, 5);
-	R(e2, a2, b2, c2, d2, f1, K1, 0, 15);
-	R(d2, e2, a2, b2, c2, f1, K1, 3, 13);
-	R(c2, d2, e2, a2, b2, f1, K1, 9, 11);
-	R(b2, c2, d2, e2, a2, f1, K1, 11, 11);
-
-	d2 += c1 + ctx->h[1];
-	ctx->h[1] = ctx->h[2] + d1 + e2;
-	ctx->h[2] = ctx->h[3] + e1 + a2;
-	ctx->h[3] = ctx->h[4] + a1 + b2;
-	ctx->h[4] = ctx->h[0] + b1 + c2;
-	ctx->h[0] = d2;
-}
-
-void cryptonite_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t index, to_fill;
-
-	index = (uint32_t) (ctx->sz & 0x3f);
-	to_fill = 64 - index;
-
-	ctx->sz += len;
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		ripemd160_do_chunk(ctx, (uint32_t *) ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	if (need_alignment(data, 4)) {
-		uint32_t tramp[16];
-		ASSERT_ALIGNMENT(tramp, 4);
-		for (; len >= 64; len -= 64, data += 64) {
-			memcpy(tramp, data, 64);
-			ripemd160_do_chunk(ctx, tramp);
-		}
-	} else {
-		/* process as much 64-block as possible */
-		for (; len >= 64; len -= 64, data += 64)
-			ripemd160_do_chunk(ctx, (uint32_t *) data);
-	}
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out)
-{
-	static uint8_t padding[64] = { 0x80, };
-	uint64_t bits;
-	uint32_t index, padlen;
-
-	/* add padding and update data with it */
-	bits = cpu_to_le64(ctx->sz << 3);
-
-	/* pad out to 56 */
-	index = (uint32_t) (ctx->sz & 0x3f);
-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
-	cryptonite_ripemd160_update(ctx, padding, padlen);
-
-	/* append length */
-	cryptonite_ripemd160_update(ctx, (uint8_t *) &bits, sizeof(bits));
-
-	/* output digest */
-	store_le32(out   , ctx->h[0]);
-	store_le32(out+ 4, ctx->h[1]);
-	store_le32(out+ 8, ctx->h[2]);
-	store_le32(out+12, ctx->h[3]);
-	store_le32(out+16, ctx->h[4]);
-}
diff --git a/cbits/cryptonite_ripemd.h b/cbits/cryptonite_ripemd.h
deleted file mode 100644
--- a/cbits/cryptonite_ripemd.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_RIPEMD_H
-#define CRYPTOHASH_RIPEMD_H
-
-#include <stdint.h>
-
-struct ripemd160_ctx
-{
-	uint64_t sz;
-	uint8_t  buf[64];
-	uint32_t h[5];
-};
-
-#define RIPEMD160_DIGEST_SIZE	20
-#define RIPEMD160_CTX_SIZE	sizeof(struct ripemd160_ctx)
-
-void cryptonite_ripemd160_init(struct ripemd160_ctx *ctx);
-void cryptonite_ripemd160_update(struct ripemd160_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_ripemd160_finalize(struct ripemd160_ctx *ctx, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_salsa.c b/cbits/cryptonite_salsa.c
deleted file mode 100644
--- a/cbits/cryptonite_salsa.c
+++ /dev/null
@@ -1,292 +0,0 @@
-/*
- * Copyright (c) 2014-2015 Vincent Hanquez <vincent@snarc.org>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <stdint.h>
-#include <string.h>
-#include <stdio.h>
-#include "cryptonite_salsa.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-
-static const uint8_t sigma[16] = "expand 32-byte k";
-static const uint8_t tau[16] = "expand 16-byte k";
-
-#define QR(a,b,c,d) \
-	b ^= rol32(a+d, 7); \
-	c ^= rol32(b+a, 9); \
-	d ^= rol32(c+b, 13); \
-	a ^= rol32(d+c, 18);
-
-#define ALIGNED64(PTR) \
-	(((uintptr_t)(const void *)(PTR)) % 8 == 0)
-
-#define SALSA_CORE_LOOP \
-	for (i = rounds; i > 0; i -= 2) { \
-		QR (x0,x4,x8,x12); \
-		QR (x5,x9,x13,x1); \
-		QR (x10,x14,x2,x6); \
-		QR (x15,x3,x7,x11); \
-		QR (x0,x1,x2,x3); \
-		QR (x5,x6,x7,x4); \
-		QR (x10,x11,x8,x9); \
-		QR (x15,x12,x13,x14); \
-	}
-
-static void salsa_core(int rounds, block *out, const cryptonite_salsa_state *in)
-{
-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
-	int i;
-
-	x0 = in->d[0]; x1 = in->d[1]; x2 = in->d[2]; x3 = in->d[3];
-	x4 = in->d[4]; x5 = in->d[5]; x6 = in->d[6]; x7 = in->d[7];
-	x8 = in->d[8]; x9 = in->d[9]; x10 = in->d[10]; x11 = in->d[11];
-	x12 = in->d[12]; x13 = in->d[13]; x14 = in->d[14]; x15 = in->d[15];
-
-	SALSA_CORE_LOOP;
-
-	x0 += in->d[0]; x1 += in->d[1]; x2 += in->d[2]; x3 += in->d[3];
-	x4 += in->d[4]; x5 += in->d[5]; x6 += in->d[6]; x7 += in->d[7];
-	x8 += in->d[8]; x9 += in->d[9]; x10 += in->d[10]; x11 += in->d[11];
-	x12 += in->d[12]; x13 += in->d[13]; x14 += in->d[14]; x15 += in->d[15];
-
-	out->d[0] = cpu_to_le32(x0);
-	out->d[1] = cpu_to_le32(x1);
-	out->d[2] = cpu_to_le32(x2);
-	out->d[3] = cpu_to_le32(x3);
-	out->d[4] = cpu_to_le32(x4);
-	out->d[5] = cpu_to_le32(x5);
-	out->d[6] = cpu_to_le32(x6);
-	out->d[7] = cpu_to_le32(x7);
-	out->d[8] = cpu_to_le32(x8);
-	out->d[9] = cpu_to_le32(x9);
-	out->d[10] = cpu_to_le32(x10);
-	out->d[11] = cpu_to_le32(x11);
-	out->d[12] = cpu_to_le32(x12);
-	out->d[13] = cpu_to_le32(x13);
-	out->d[14] = cpu_to_le32(x14);
-	out->d[15] = cpu_to_le32(x15);
-}
-
-void cryptonite_salsa_core_xor(int rounds, block *out, block *in)
-{
-	uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
-	int i;
-
-#define LOAD(i) (out->d[i] ^= in->d[i])
-	x0 = LOAD(0); x1 = LOAD(1); x2 = LOAD(2); x3 = LOAD(3);
-	x4 = LOAD(4); x5 = LOAD(5); x6 = LOAD(6); x7 = LOAD(7);
-	x8 = LOAD(8); x9 = LOAD(9); x10 = LOAD(10); x11 = LOAD(11);
-	x12 = LOAD(12); x13 = LOAD(13); x14 = LOAD(14); x15 = LOAD(15);
-#undef LOAD
-
-	SALSA_CORE_LOOP;
-
-	out->d[0] += x0; out->d[1] += x1; out->d[2] += x2; out->d[3] += x3;
-	out->d[4] += x4; out->d[5] += x5; out->d[6] += x6; out->d[7] += x7;
-	out->d[8] += x8; out->d[9] += x9; out->d[10] += x10; out->d[11] += x11;
-	out->d[12] += x12; out->d[13] += x13; out->d[14] += x14; out->d[15] += x15;
-}
-
-/* only 2 valid values for keylen are 256 (32) and 128 (16) */
-void cryptonite_salsa_init_core(cryptonite_salsa_state *st,
-                                uint32_t keylen, const uint8_t *key,
-                                uint32_t ivlen, const uint8_t *iv)
-{
-	const uint8_t *constants = (keylen == 32) ? sigma : tau;
-
-	st->d[0] = load_le32_aligned(constants + 0);
-	st->d[5] = load_le32_aligned(constants + 4);
-	st->d[10] = load_le32_aligned(constants + 8);
-	st->d[15] = load_le32_aligned(constants + 12);
-
-	st->d[1] = load_le32(key + 0);
-	st->d[2] = load_le32(key + 4);
-	st->d[3] = load_le32(key + 8);
-	st->d[4] = load_le32(key + 12);
-	/* we repeat the key on 128 bits */
-	if (keylen == 32)
-		key += 16;
-	st->d[11] = load_le32(key + 0);
-	st->d[12] = load_le32(key + 4);
-	st->d[13] = load_le32(key + 8);
-	st->d[14] = load_le32(key + 12);
-
-	st->d[9] = 0;
-	switch (ivlen) {
-	case 8:
-		st->d[6] = load_le32(iv + 0);
-		st->d[7] = load_le32(iv + 4);
-		st->d[8] = 0;
-		break;
-	case 12:
-		st->d[6] = load_le32(iv + 0);
-		st->d[7] = load_le32(iv + 4);
-		st->d[8] = load_le32(iv + 8);
-	default:
-		return;
-	}
-}
-
-void cryptonite_salsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds,
-                           uint32_t keylen, const uint8_t *key,
-                           uint32_t ivlen, const uint8_t *iv)
-{
-	memset(ctx, 0, sizeof(*ctx));
-	ctx->nb_rounds = nb_rounds;
-	cryptonite_salsa_init_core(&ctx->st, keylen, key, ivlen, iv);
-}
-
-void cryptonite_salsa_combine(uint8_t *dst, cryptonite_salsa_context *ctx, const uint8_t *src, uint32_t bytes)
-{
-	block out;
-	cryptonite_salsa_state *st;
-	int i;
-
-	if (!bytes)
-		return;
-
-	/* xor the previous buffer first (if any) */
-	if (ctx->prev_len > 0) {
-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
-		for (i = 0; i < to_copy; i++)
-			dst[i] = src[i] ^ ctx->prev[ctx->prev_ofs+i];
-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
-		ctx->prev_len -= to_copy;
-		ctx->prev_ofs += to_copy;
-		src += to_copy;
-		dst += to_copy;
-		bytes -= to_copy;
-	}
-
-	if (bytes == 0)
-		return;
-
-	st = &ctx->st;
-
-	/* xor new 64-bytes chunks and store the left over if any */
-	for (; bytes >= 64; bytes -= 64, src += 64, dst += 64) {
-		/* generate new chunk and update state */
-		salsa_core(ctx->nb_rounds, &out, st);
-		st->d[8] += 1;
-		if (st->d[8] == 0)
-			st->d[9] += 1;
-
-		for (i = 0; i < 64; ++i)
-			dst[i] = src[i] ^ out.b[i];
-	}
-
-	if (bytes > 0) {
-		/* generate new chunk and update state */
-		salsa_core(ctx->nb_rounds, &out, st);
-		st->d[8] += 1;
-		if (st->d[8] == 0)
-			st->d[9] += 1;
-
-		/* xor as much as needed */
-		for (i = 0; i < bytes; i++)
-			dst[i] = src[i] ^ out.b[i];
-		
-		/* copy the left over in the buffer */
-		ctx->prev_len = 64 - bytes;
-		ctx->prev_ofs = i;
-		for (; i < 64; i++) {
-			ctx->prev[i] = out.b[i];
-		}
-	}
-}
-
-void cryptonite_salsa_generate(uint8_t *dst, cryptonite_salsa_context *ctx, uint32_t bytes)
-{
-	cryptonite_salsa_state *st;
-	block out;
-	int i;
-
-	if (!bytes)
-		return;
-
-	/* xor the previous buffer first (if any) */
-	if (ctx->prev_len > 0) {
-		int to_copy = (ctx->prev_len < bytes) ? ctx->prev_len : bytes;
-		for (i = 0; i < to_copy; i++)
-			dst[i] = ctx->prev[ctx->prev_ofs+i];
-		memset(ctx->prev + ctx->prev_ofs, 0, to_copy);
-		ctx->prev_len -= to_copy;
-		ctx->prev_ofs += to_copy;
-		dst += to_copy;
-		bytes -= to_copy;
-	}
-
-	if (bytes == 0)
-		return;
-
-	st = &ctx->st;
-
-	if (ALIGNED64(dst)) {
-		/* xor new 64-bytes chunks and store the left over if any */
-		for (; bytes >= 64; bytes -= 64, dst += 64) {
-			/* generate new chunk and update state */
-			salsa_core(ctx->nb_rounds, (block *) dst, st);
-			st->d[8] += 1;
-			if (st->d[8] == 0)
-				st->d[9] += 1;
-		}
-	} else {
-		/* xor new 64-bytes chunks and store the left over if any */
-		for (; bytes >= 64; bytes -= 64, dst += 64) {
-			/* generate new chunk and update state */
-			salsa_core(ctx->nb_rounds, &out, st);
-			st->d[8] += 1;
-			if (st->d[8] == 0)
-				st->d[9] += 1;
-
-			for (i = 0; i < 64; ++i)
-				dst[i] = out.b[i];
-		}
-	}
-
-	if (bytes > 0) {
-		/* generate new chunk and update state */
-		salsa_core(ctx->nb_rounds, &out, st);
-		st->d[8] += 1;
-		if (st->d[8] == 0)
-			st->d[9] += 1;
-
-		/* xor as much as needed */
-		for (i = 0; i < bytes; i++)
-			dst[i] = out.b[i];
-		
-		/* copy the left over in the buffer */
-		ctx->prev_len = 64 - bytes;
-		ctx->prev_ofs = i;
-		for (; i < 64; i++)
-			ctx->prev[i] = out.b[i];
-	}
-}
-
diff --git a/cbits/cryptonite_salsa.h b/cbits/cryptonite_salsa.h
deleted file mode 100644
--- a/cbits/cryptonite_salsa.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (c) 2014 Vincent Hanquez <vincent@snarc.org>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#ifndef CRYPTONITE_SALSA
-#define CRYPTONITE_SALSA
-
-typedef union {
-	uint64_t q[8];
-	uint32_t d[16];
-	uint8_t  b[64];
-} block;
-
-typedef block cryptonite_salsa_state;
-
-typedef struct {
-	cryptonite_salsa_state st;
-	uint8_t prev[64];
-	uint8_t prev_ofs;
-	uint8_t prev_len;
-	uint8_t nb_rounds;
-} cryptonite_salsa_context;
-
-/* for scrypt */
-void cryptonite_salsa_core_xor(int rounds, block *out, block *in);
-
-void cryptonite_salsa_init_core(cryptonite_salsa_state *st, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
-void cryptonite_salsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
-void cryptonite_salsa_combine(uint8_t *dst, cryptonite_salsa_context *st, const uint8_t *src, uint32_t bytes);
-void cryptonite_salsa_generate(uint8_t *dst, cryptonite_salsa_context *st, uint32_t bytes);
-
-#endif
diff --git a/cbits/cryptonite_scrypt.c b/cbits/cryptonite_scrypt.c
deleted file mode 100644
--- a/cbits/cryptonite_scrypt.c
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Copyright (C) 2014 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * Based on scrypt from Colin Percival's paper
- */
-
-#include <stdint.h>
-#include <string.h>
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include "cryptonite_salsa.h"
-
-static void blockmix_salsa8(uint32_t *in, uint32_t *out, uint32_t *X, const uint32_t r)
-{
-	int i;
-
-	array_copy32(X, &in[(2 * r - 1) * 16], 16);
-
-	for (i = 0; i < 2 * r; i += 2) {
-		cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16]);
-		array_copy32(&out[i * 8], X, 16);
-
-		cryptonite_salsa_core_xor(8, (block *) X, (block *) &in[i*16+16]);
-		array_copy32(&out[i * 8 + r * 16], X, 16);
-	}
-}
-
-static inline uint64_t integerify(uint32_t *B, const uint32_t r)
-{
-	return B[(2*r-1) * 16] | (uint64_t)B[(2*r-1) * 16 + 1] << 32;
-}
-
-void cryptonite_scrypt_smix(uint8_t *B, const uint32_t r, const uint64_t N, uint32_t *V, uint32_t *XY)
-{
-	uint32_t *X = XY;
-	uint32_t *Y = &XY[32 * r];
-	uint32_t *Z = &XY[64 * r];
-	uint64_t i, j;
-	int k;
-	const int r32 = 32*r;
-
-	for (k = 0; k < r32; k++)
-		X[k] = load_le32_aligned(&B[4 * k]);
-	for (i = 0; i < N; i += 2) {
-		array_copy32(&V[i * r32], X, r32);
-		blockmix_salsa8(X, Y, Z, r);
-		array_copy32(&V[(i + 1) * r32], Y, r32);
-		blockmix_salsa8(Y, X, Z, r);
-	}
-	for (i = 0; i < N; i += 2) {
-		j = integerify(X, r) & (N - 1);
-		array_xor32(X, &V[j * r32], r32);
-		blockmix_salsa8(X, Y, Z, r);
-
-		j = integerify(Y, r) & (N - 1);
-		array_xor32(Y, &V[j * r32], r32);
-		blockmix_salsa8(Y, X, Z, r);
-	}
-	for (k = 0; k < r32; k++)
-		store_le32_aligned(&B[4*k], X[k]);
-}
diff --git a/cbits/cryptonite_sha1.c b/cbits/cryptonite_sha1.c
deleted file mode 100644
--- a/cbits/cryptonite_sha1.c
+++ /dev/null
@@ -1,246 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include "cryptonite_sha1.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-
-void cryptonite_sha1_init(struct sha1_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->h[0] = 0x67452301;
-	ctx->h[1] = 0xefcdab89;
-	ctx->h[2] = 0x98badcfe;
-	ctx->h[3] = 0x10325476;
-	ctx->h[4] = 0xc3d2e1f0;
-}
-
-#define f1(x, y, z)   (z ^ (x & (y ^ z)))
-#define f2(x, y, z)   (x ^ y ^ z)
-#define f3(x, y, z)   ((x & y) + (z & (x ^ y)))
-#define f4(x, y, z)   f2(x, y, z)
-
-#define K1  0x5a827999
-#define K2  0x6ed9eba1
-#define K3  0x8f1bbcdc
-#define K4  0xca62c1d6
-
-#define R(a, b, c, d, e, f, k, w)  \
-	e += rol32(a, 5) + f(b, c, d) + k + w; b = rol32(b, 30)
-
-#define M(i)  (w[i & 0x0f] = rol32(w[i & 0x0f] ^ w[(i - 14) & 0x0f] \
-              ^ w[(i - 8) & 0x0f] ^ w[(i - 3) & 0x0f], 1))
-
-static inline void sha1_do_chunk(struct sha1_ctx *ctx, uint32_t *buf)
-{
-	uint32_t a, b, c, d, e;
-	uint32_t w[16];
-#define CPY(i)	w[i] = be32_to_cpu(buf[i])
-	CPY(0); CPY(1); CPY(2); CPY(3); CPY(4); CPY(5); CPY(6); CPY(7);
-	CPY(8); CPY(9); CPY(10); CPY(11); CPY(12); CPY(13); CPY(14); CPY(15);
-#undef CPY
-
-	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3]; e = ctx->h[4];
-
-	R(a, b, c, d, e, f1, K1, w[0]);
-	R(e, a, b, c, d, f1, K1, w[1]);
-	R(d, e, a, b, c, f1, K1, w[2]);
-	R(c, d, e, a, b, f1, K1, w[3]);
-	R(b, c, d, e, a, f1, K1, w[4]);
-	R(a, b, c, d, e, f1, K1, w[5]);
-	R(e, a, b, c, d, f1, K1, w[6]);
-	R(d, e, a, b, c, f1, K1, w[7]);
-	R(c, d, e, a, b, f1, K1, w[8]);
-	R(b, c, d, e, a, f1, K1, w[9]);
-	R(a, b, c, d, e, f1, K1, w[10]);
-	R(e, a, b, c, d, f1, K1, w[11]);
-	R(d, e, a, b, c, f1, K1, w[12]);
-	R(c, d, e, a, b, f1, K1, w[13]);
-	R(b, c, d, e, a, f1, K1, w[14]);
-	R(a, b, c, d, e, f1, K1, w[15]);
-	R(e, a, b, c, d, f1, K1, M(16));
-	R(d, e, a, b, c, f1, K1, M(17));
-	R(c, d, e, a, b, f1, K1, M(18));
-	R(b, c, d, e, a, f1, K1, M(19));
-
-	R(a, b, c, d, e, f2, K2, M(20));
-	R(e, a, b, c, d, f2, K2, M(21));
-	R(d, e, a, b, c, f2, K2, M(22));
-	R(c, d, e, a, b, f2, K2, M(23));
-	R(b, c, d, e, a, f2, K2, M(24));
-	R(a, b, c, d, e, f2, K2, M(25));
-	R(e, a, b, c, d, f2, K2, M(26));
-	R(d, e, a, b, c, f2, K2, M(27));
-	R(c, d, e, a, b, f2, K2, M(28));
-	R(b, c, d, e, a, f2, K2, M(29));
-	R(a, b, c, d, e, f2, K2, M(30));
-	R(e, a, b, c, d, f2, K2, M(31));
-	R(d, e, a, b, c, f2, K2, M(32));
-	R(c, d, e, a, b, f2, K2, M(33));
-	R(b, c, d, e, a, f2, K2, M(34));
-	R(a, b, c, d, e, f2, K2, M(35));
-	R(e, a, b, c, d, f2, K2, M(36));
-	R(d, e, a, b, c, f2, K2, M(37));
-	R(c, d, e, a, b, f2, K2, M(38));
-	R(b, c, d, e, a, f2, K2, M(39));
-
-	R(a, b, c, d, e, f3, K3, M(40));
-	R(e, a, b, c, d, f3, K3, M(41));
-	R(d, e, a, b, c, f3, K3, M(42));
-	R(c, d, e, a, b, f3, K3, M(43));
-	R(b, c, d, e, a, f3, K3, M(44));
-	R(a, b, c, d, e, f3, K3, M(45));
-	R(e, a, b, c, d, f3, K3, M(46));
-	R(d, e, a, b, c, f3, K3, M(47));
-	R(c, d, e, a, b, f3, K3, M(48));
-	R(b, c, d, e, a, f3, K3, M(49));
-	R(a, b, c, d, e, f3, K3, M(50));
-	R(e, a, b, c, d, f3, K3, M(51));
-	R(d, e, a, b, c, f3, K3, M(52));
-	R(c, d, e, a, b, f3, K3, M(53));
-	R(b, c, d, e, a, f3, K3, M(54));
-	R(a, b, c, d, e, f3, K3, M(55));
-	R(e, a, b, c, d, f3, K3, M(56));
-	R(d, e, a, b, c, f3, K3, M(57));
-	R(c, d, e, a, b, f3, K3, M(58));
-	R(b, c, d, e, a, f3, K3, M(59));
-
-	R(a, b, c, d, e, f4, K4, M(60));
-	R(e, a, b, c, d, f4, K4, M(61));
-	R(d, e, a, b, c, f4, K4, M(62));
-	R(c, d, e, a, b, f4, K4, M(63));
-	R(b, c, d, e, a, f4, K4, M(64));
-	R(a, b, c, d, e, f4, K4, M(65));
-	R(e, a, b, c, d, f4, K4, M(66));
-	R(d, e, a, b, c, f4, K4, M(67));
-	R(c, d, e, a, b, f4, K4, M(68));
-	R(b, c, d, e, a, f4, K4, M(69));
-	R(a, b, c, d, e, f4, K4, M(70));
-	R(e, a, b, c, d, f4, K4, M(71));
-	R(d, e, a, b, c, f4, K4, M(72));
-	R(c, d, e, a, b, f4, K4, M(73));
-	R(b, c, d, e, a, f4, K4, M(74));
-	R(a, b, c, d, e, f4, K4, M(75));
-	R(e, a, b, c, d, f4, K4, M(76));
-	R(d, e, a, b, c, f4, K4, M(77));
-	R(c, d, e, a, b, f4, K4, M(78));
-	R(b, c, d, e, a, f4, K4, M(79));
-
-	ctx->h[0] += a;
-	ctx->h[1] += b;
-	ctx->h[2] += c;
-	ctx->h[3] += d;
-	ctx->h[4] += e;
-}
-
-void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t index, to_fill;
-
-	index = (uint32_t) (ctx->sz & 0x3f);
-	to_fill = 64 - index;
-
-	ctx->sz += len;
-
-	/* process partial buffer if there's enough data to make a block */
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		sha1_do_chunk(ctx, (uint32_t *) ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	if (need_alignment(data, 4)) {
-		uint32_t tramp[16];
-		ASSERT_ALIGNMENT(tramp, 4);
-		for (; len >= 64; len -= 64, data += 64) {
-			memcpy(tramp, data, 64);
-			sha1_do_chunk(ctx, tramp);
-		}
-	} else {
-		/* process as much 64-block as possible */
-		for (; len >= 64; len -= 64, data += 64)
-			sha1_do_chunk(ctx, (uint32_t *) data);
-	}
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out)
-{
-	static uint8_t padding[64] = { 0x80, };
-	uint64_t bits;
-	uint32_t index, padlen;
-
-	/* add padding and update data with it */
-	bits = cpu_to_be64(ctx->sz << 3);
-
-	/* pad out to 56 */
-	index = (uint32_t) (ctx->sz & 0x3f);
-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
-	cryptonite_sha1_update(ctx, padding, padlen);
-
-	/* append length */
-	cryptonite_sha1_update(ctx, (uint8_t *) &bits, sizeof(bits));
-
-	/* output hash */
-	store_be32(out   , ctx->h[0]);
-	store_be32(out+ 4, ctx->h[1]);
-	store_be32(out+ 8, ctx->h[2]);
-	store_be32(out+12, ctx->h[3]);
-	store_be32(out+16, ctx->h[4]);
-}
-
-#define HASHED(m) SHA1_##m
-#define HASHED_LOWER(m) sha1_##m
-#define CRYPTONITE_HASHED(m) cryptonite_sha1_##m
-#define SHA1_BLOCK_SIZE 64
-#define SHA1_BITS_ELEMS 1
-
-static inline uint32_t cryptonite_sha1_get_index(const struct sha1_ctx *ctx)
-{
-	return (uint32_t) (ctx->sz & 0x3f);
-}
-
-static inline void cryptonite_sha1_incr_sz(struct sha1_ctx *ctx, uint64_t *bits, uint32_t n)
-{
-	ctx->sz += n;
-	*bits = cpu_to_be64(ctx->sz << 3);
-}
-
-static inline void cryptonite_sha1_select_digest(const struct sha1_ctx *ctx, uint8_t *out, uint32_t out_mask)
-{
-	xor_be32(out   , ctx->h[0] & out_mask);
-	xor_be32(out+ 4, ctx->h[1] & out_mask);
-	xor_be32(out+ 8, ctx->h[2] & out_mask);
-	xor_be32(out+12, ctx->h[3] & out_mask);
-	xor_be32(out+16, ctx->h[4] & out_mask);
-}
-
-#include <cryptonite_hash_prefix.c>
diff --git a/cbits/cryptonite_sha1.h b/cbits/cryptonite_sha1.h
deleted file mode 100644
--- a/cbits/cryptonite_sha1.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_SHA1_H
-#define CRYPTOHASH_SHA1_H
-
-#include <stdint.h>
-
-# define SHA1_BLOCK_SIZE 64
-
-struct sha1_ctx
-{
-	uint64_t sz;
-	uint8_t  buf[SHA1_BLOCK_SIZE];
-	uint32_t h[5];
-};
-
-#define SHA1_DIGEST_SIZE	20
-#define SHA1_CTX_SIZE 		(sizeof(struct sha1_ctx))
-
-void cryptonite_sha1_init(struct sha1_ctx *ctx);
-void cryptonite_sha1_update(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_sha1_finalize(struct sha1_ctx *ctx, uint8_t *out);
-void cryptonite_sha1_finalize_prefix(struct sha1_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_sha256.c b/cbits/cryptonite_sha256.c
deleted file mode 100644
--- a/cbits/cryptonite_sha256.c
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include "cryptonite_sha256.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-
-void cryptonite_sha224_init(struct sha224_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->h[0] = 0xc1059ed8;
-	ctx->h[1] = 0x367cd507;
-	ctx->h[2] = 0x3070dd17;
-	ctx->h[3] = 0xf70e5939;
-	ctx->h[4] = 0xffc00b31;
-	ctx->h[5] = 0x68581511;
-	ctx->h[6] = 0x64f98fa7;
-	ctx->h[7] = 0xbefa4fa4;
-}
-
-void cryptonite_sha256_init(struct sha256_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->h[0] = 0x6a09e667;
-	ctx->h[1] = 0xbb67ae85;
-	ctx->h[2] = 0x3c6ef372;
-	ctx->h[3] = 0xa54ff53a;
-	ctx->h[4] = 0x510e527f;
-	ctx->h[5] = 0x9b05688c;
-	ctx->h[6] = 0x1f83d9ab;
-	ctx->h[7] = 0x5be0cd19;
-}
-
-/* 232 times the cube root of the first 64 primes 2..311 */
-static const uint32_t k[] = {
-	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
-	0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
-	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
-	0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
-	0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
-	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
-	0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
-	0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
-	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-};
-
-#define e0(x)       (ror32(x, 2) ^ ror32(x,13) ^ ror32(x,22))
-#define e1(x)       (ror32(x, 6) ^ ror32(x,11) ^ ror32(x,25))
-#define s0(x)       (ror32(x, 7) ^ ror32(x,18) ^ (x >> 3))
-#define s1(x)       (ror32(x,17) ^ ror32(x,19) ^ (x >> 10))
-
-static void sha256_do_chunk(struct sha256_ctx *ctx, uint32_t buf[])
-{
-	uint32_t a, b, c, d, e, f, g, h, t1, t2;
-	int i;
-	uint32_t w[64];
-
-	cpu_to_be32_array(w, buf, 16);
-	for (i = 16; i < 64; i++)
-		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];
-
-	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
-	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];
-
-#define R(a, b, c, d, e, f, g, h, k, w)			\
-	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w; 	\
-	t2 = e0(a) + ((a & b) | (c & (a | b)));		\
-	d += t1;					\
-	h = t1 + t2;
-
-	for (i = 0; i < 64; i += 8) {
-		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);
-		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);
-		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);
-		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);
-		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);
-		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);
-		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);
-		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);
-	}
-
-#undef R
-
-	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
-	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
-}
-
-void cryptonite_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	return cryptonite_sha256_update(ctx, data, len);
-}
-
-void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t index, to_fill;
-
-	/* check for partial buffer */
-	index = (uint32_t) (ctx->sz & 0x3f);
-	to_fill = 64 - index;
-
-	ctx->sz += len;
-
-	/* process partial buffer if there's enough data to make a block */
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		sha256_do_chunk(ctx, (uint32_t *) ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	if (need_alignment(data, 4)) {
-		uint32_t tramp[16];
-		ASSERT_ALIGNMENT(tramp, 4);
-		for (; len >= 64; len -= 64, data += 64) {
-			memcpy(tramp, data, 64);
-			sha256_do_chunk(ctx, tramp);
-		}
-	} else {
-		/* process as much 64-block as possible */
-		for (; len >= 64; len -= 64, data += 64)
-			sha256_do_chunk(ctx, (uint32_t *) data);
-	}
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out)
-{
-	uint8_t intermediate[SHA256_DIGEST_SIZE];
-
-	cryptonite_sha256_finalize(ctx, intermediate);
-	memcpy(out, intermediate, SHA224_DIGEST_SIZE);
-}
-
-void cryptonite_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)
-{
-	uint8_t intermediate[SHA256_DIGEST_SIZE];
-
-	cryptonite_sha256_finalize_prefix(ctx, data, len, n, intermediate);
-	memcpy(out, intermediate, SHA224_DIGEST_SIZE);
-}
-
-void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out)
-{
-	static uint8_t padding[64] = { 0x80, };
-	uint64_t bits;
-	uint32_t i, index, padlen;
-
-	/* cpu -> big endian */
-	bits = cpu_to_be64(ctx->sz << 3);
-
-	/* pad out to 56 */
-	index = (uint32_t) (ctx->sz & 0x3f);
-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
-	cryptonite_sha256_update(ctx, padding, padlen);
-
-	/* append length */
-	cryptonite_sha256_update(ctx, (uint8_t *) &bits, sizeof(bits));
-
-	/* store to digest */
-	for (i = 0; i < 8; i++)
-		store_be32(out+4*i, ctx->h[i]);
-}
-
-#define HASHED(m) SHA256_##m
-#define HASHED_LOWER(m) sha256_##m
-#define CRYPTONITE_HASHED(m) cryptonite_sha256_##m
-#define SHA256_BLOCK_SIZE 64
-#define SHA256_BITS_ELEMS 1
-
-static inline uint32_t cryptonite_sha256_get_index(const struct sha256_ctx *ctx)
-{
-	return (uint32_t) (ctx->sz & 0x3f);
-}
-
-static inline void cryptonite_sha256_incr_sz(struct sha256_ctx *ctx, uint64_t *bits, uint32_t n)
-{
-	ctx->sz += n;
-	*bits = cpu_to_be64(ctx->sz << 3);
-}
-
-static inline void cryptonite_sha256_select_digest(const struct sha256_ctx *ctx, uint8_t *out, uint32_t out_mask)
-{
-	uint32_t i;
-	for (i = 0; i < 8; i++)
-		xor_be32(out+4*i, ctx->h[i] & out_mask);
-}
-
-#include <cryptonite_hash_prefix.c>
diff --git a/cbits/cryptonite_sha256.h b/cbits/cryptonite_sha256.h
deleted file mode 100644
--- a/cbits/cryptonite_sha256.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CRYPTOHASH_SHA256_H
-#define CRYPTOHASH_SHA256_H
-
-#include <stdint.h>
-
-#define SHA256_BLOCK_SIZE 64
-
-struct sha256_ctx
-{
-	uint64_t sz;
-	uint8_t  buf[128];
-	uint32_t h[8];
-};
-
-#define sha224_ctx 		sha256_ctx
-
-#define SHA224_DIGEST_SIZE	28
-#define SHA224_CTX_SIZE		sizeof(struct sha224_ctx)
-
-#define SHA256_DIGEST_SIZE	32
-#define SHA256_CTX_SIZE		sizeof(struct sha256_ctx)
-
-void cryptonite_sha224_init(struct sha224_ctx *ctx);
-void cryptonite_sha224_update(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_sha224_finalize(struct sha224_ctx *ctx, uint8_t *out);
-void cryptonite_sha224_finalize_prefix(struct sha224_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
-
-void cryptonite_sha256_init(struct sha256_ctx *ctx);
-void cryptonite_sha256_update(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_sha256_finalize(struct sha256_ctx *ctx, uint8_t *out);
-void cryptonite_sha256_finalize_prefix(struct sha256_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_sha3.c b/cbits/cryptonite_sha3.c
deleted file mode 100644
--- a/cbits/cryptonite_sha3.c
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <stdint.h>
-#include <string.h>
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include "cryptonite_sha3.h"
-
-#define KECCAK_NB_ROUNDS 24
-
-/* rounds constants */
-static const uint64_t keccak_rndc[24] =
-{
-	0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,
-	0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,
-	0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,
-	0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
-	0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,
-	0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,
-	0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,
-	0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL,
-};
-
-/* triangular numbers constants */
-static const int keccak_rotc[24] =
-	{ 1,3,6,10,15,21,28,36,45,55,2,14,27,41,56,8,25,43,62,18,39,61,20,44 };
-
-static const int keccak_piln[24] =
-	{ 10,7,11,17,18,3,5,16,8,21,24,4,15,23,19,13,12,2,20,14,22,9,6,1 };
-
-static inline void sha3_do_chunk(uint64_t state[25], uint64_t buf[], int bufsz)
-{
-	int i, j, r;
-	uint64_t tmp, bc[5];
-
-	/* merge buf with state */
-	for (i = 0; i < bufsz; i++)
-		state[i] ^= le64_to_cpu(buf[i]);
-
-	/* run keccak rounds */
-	for (r = 0; r < KECCAK_NB_ROUNDS; r++) {
-		/* compute the parity of each columns */
-		for (i = 0; i < 5; i++)
-			bc[i] = state[i] ^ state[i+5] ^ state[i+10] ^ state[i+15] ^ state[i+20];
-
-		for (i = 0; i < 5; i++) {
-			tmp = bc[(i + 4) % 5] ^ rol64(bc[(i + 1) % 5], 1);
-			for (j = 0; j < 25; j += 5)
-				state[j + i] ^= tmp;
-		}
-
-		/* rho pi */
-		tmp = state[1];
-		for (i = 0; i < 24; i++) {
-			j = keccak_piln[i];
-			bc[0] = state[j];
-			state[j] = rol64(tmp, keccak_rotc[i]);
-			tmp = bc[0];
-		}
-
-		/* bitwise combine along rows using a = a xor (not b and c) */
-		for (j = 0; j < 25; j += 5) {
-			for (i = 0; i < 5; i++)
-				bc[i] = state[j + i];
-			#define andn(b,c) (~(b) & (c))
-			state[j + 0] ^= andn(bc[1], bc[2]);
-			state[j + 1] ^= andn(bc[2], bc[3]);
-			state[j + 2] ^= andn(bc[3], bc[4]);
-			state[j + 3] ^= andn(bc[4], bc[0]);
-			state[j + 4] ^= andn(bc[0], bc[1]);
-			#undef andn
-		}
-
-		/* xor the round constant */
-		state[0] ^= keccak_rndc[r];
-	}
-}
-
-/*
- * Initialize a SHA-3 / SHAKE / cSHAKE context: hashlen is the security level
- * (and half the capacity) in bits.
- *
- * In case of cSHAKE, the message prefix with encoded N and S must be added with
- * cryptonite_sha3_update.
- */
-void cryptonite_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen)
-{
-	/* assert(hashlen >= SHA3_BITSIZE_MIN && hashlen <= SHA3_BITSIZE_MAX) */
-	int bufsz = SHA3_BUF_SIZE(hashlen);
-	memset(ctx, 0, sizeof(*ctx) + bufsz);
-	ctx->bufsz = bufsz;
-}
-
-/* Update a SHA-3 / SHAKE / cSHAKE context */
-void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t to_fill;
-
-	to_fill = ctx->bufsz - ctx->bufindex;
-
-	if (ctx->bufindex == ctx->bufsz) {
-		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
-		ctx->bufindex = 0;
-	}
-
-	/* process partial buffer if there's enough data to make a block */
-	if (ctx->bufindex && len >= to_fill) {
-		memcpy(ctx->buf + ctx->bufindex, data, to_fill);
-		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
-		len -= to_fill;
-		data += to_fill;
-		ctx->bufindex = 0;
-	}
-
-	if (need_alignment(data, 8)) {
-		uint64_t tramp[SHA3_BUF_SIZE_MAX/8];
-		ASSERT_ALIGNMENT(tramp, 8);
-		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz) {
-			memcpy(tramp, data, ctx->bufsz);
-			sha3_do_chunk(ctx->state, tramp, ctx->bufsz / 8);
-		}
-	} else {
-		/* process as much ctx->bufsz-block */
-		for (; len >= ctx->bufsz; len -= ctx->bufsz, data += ctx->bufsz)
-			sha3_do_chunk(ctx->state, (uint64_t *) data, ctx->bufsz / 8);
-	}
-
-
-	/* append data into buf */
-	if (len) {
-		memcpy(ctx->buf + ctx->bufindex, data, len);
-		ctx->bufindex += len;
-	}
-}
-
-void cryptonite_sha3_finalize_with_pad_byte(struct sha3_ctx *ctx, uint8_t pad_byte)
-{
-	/* process full buffer if needed */
-	if (ctx->bufindex == ctx->bufsz) {
-		sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
-		ctx->bufindex = 0;
-	}
-
-	/* add the 10*1 padding */
-	ctx->buf[ctx->bufindex++] = pad_byte;
-	memset(ctx->buf + ctx->bufindex, 0, ctx->bufsz - ctx->bufindex);
-	ctx->buf[ctx->bufsz - 1] |= 0x80;
-
-	/* process */
-	sha3_do_chunk(ctx->state, (uint64_t *) ctx->buf, ctx->bufsz / 8);
-	ctx->bufindex = 0;
-}
-
-/*
- * Extract some bytes from a finalized SHA-3 / SHAKE / cSHAKE context.
- * May be called multiple times.
- */
-void cryptonite_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len)
-{
-	uint64_t w[25];
-	uint8_t *wptr = (uint8_t *) w;
-	uint32_t still_avail;
-
-	still_avail = ctx->bufsz - ctx->bufindex;
-
-	if (ctx->bufindex == ctx->bufsz) {
-		/* squeeze the sponge again, without any input */
-		sha3_do_chunk(ctx->state, NULL, 0);
-		ctx->bufindex = 0;
-	}
-
-	/* use bytes already available if this block is fully consumed */
-	if (ctx->bufindex && len >= still_avail) {
-		cpu_to_le64_array(w, ctx->state, 25);
-		memcpy(out, wptr + ctx->bufindex, still_avail);
-		sha3_do_chunk(ctx->state, NULL, 0);
-		len -= still_avail;
-		out += still_avail;
-		ctx->bufindex = 0;
-	}
-
-	/* output as much ctx->bufsz-block */
-	for (; len > ctx->bufsz; len -= ctx->bufsz, out += ctx->bufsz) {
-		cpu_to_le64_array(w, ctx->state, 25);
-		memcpy(out, w, ctx->bufsz);
-		sha3_do_chunk(ctx->state, NULL, 0);
-	}
-
-	/* output from partial buffer */
-	if (len) {
-		cpu_to_le64_array(w, ctx->state, 25);
-		memcpy(out, wptr + ctx->bufindex, len);
-		ctx->bufindex += len;
-	}
-}
-
-/* Finalize a SHA-3 context and return the digest value */
-void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	cryptonite_sha3_finalize_with_pad_byte(ctx, 0x06);
-	cryptonite_sha3_output(ctx, out, hashlen / 8);
-}
-
-/* Finalize a SHAKE context. Output is read using cryptonite_sha3_output. */
-void cryptonite_sha3_finalize_shake(struct sha3_ctx *ctx)
-{
-	cryptonite_sha3_finalize_with_pad_byte(ctx, 0x1F);
-}
-
-/* Finalize a cSHAKE context. Output is read using cryptonite_sha3_output. */
-void cryptonite_sha3_finalize_cshake(struct sha3_ctx *ctx)
-{
-	cryptonite_sha3_finalize_with_pad_byte(ctx, 0x04);
-}
-
-void cryptonite_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen)
-{
-	cryptonite_sha3_init(ctx, hashlen);
-}
-
-void cryptonite_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len)
-{
-	cryptonite_sha3_update(ctx, data, len);
-}
-
-void cryptonite_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	cryptonite_sha3_finalize_with_pad_byte(ctx, 1);
-	cryptonite_sha3_output(ctx, out, hashlen / 8);
-}
diff --git a/cbits/cryptonite_sha3.h b/cbits/cryptonite_sha3.h
deleted file mode 100644
--- a/cbits/cryptonite_sha3.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2012 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_SHA3_H
-#define CRYPTOHASH_SHA3_H
-
-#include <stdint.h>
-
-struct sha3_ctx
-{
-	uint32_t bufindex;
-	uint32_t bufsz;
-	uint64_t state[25];
-	uint8_t  buf[0]; /* maximum SHAKE128 is 168 bytes, otherwise buffer can be decreased */
-};
-
-#define SHA3_CTX_SIZE		sizeof(struct sha3_ctx)
-#define SHA3_CTX_BUF_MAX_SIZE   (SHA3_CTX_SIZE + SHA3_BUF_SIZE_MAX)
-#define SHA3_BITSIZE_MIN   	128
-#define SHA3_BITSIZE_MAX    	512
-
-#define SHA3_BUF_SIZE(bitsize)  (200 - 2 * ((bitsize) / 8))
-
-#define SHA3_BUF_SIZE_MIN       SHA3_BUF_SIZE(SHA3_BITSIZE_MAX)
-#define SHA3_BUF_SIZE_MAX       SHA3_BUF_SIZE(SHA3_BITSIZE_MIN)
-
-/*
- * buffer size:
- *
- * 128 bits (shake 128 bits) => 200 - 2 * (128 / 8) = 200 - 2*16 = 200 - 32  = 168 bytes
- * 224 bits (SHA3 224 bits)  => 200 - 2 * (224 / 8) = 200 - 2*28 = 200 - 56  = 144 bytes
- * 512 bits (SHA3 512 bits)  => 200 - 2 * (512 / 8) = 200 - 2*64 = 200 - 128 = 72 bytes
- */
-
-void cryptonite_sha3_init(struct sha3_ctx *ctx, uint32_t hashlen);
-void cryptonite_sha3_update(struct sha3_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_sha3_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-void cryptonite_sha3_finalize_shake(struct sha3_ctx *ctx);
-void cryptonite_sha3_finalize_cshake(struct sha3_ctx *ctx);
-void cryptonite_sha3_output(struct sha3_ctx *ctx, uint8_t *out, uint32_t len);
-
-void cryptonite_keccak_init(struct sha3_ctx *ctx, uint32_t hashlen);
-void cryptonite_keccak_update(struct sha3_ctx *ctx, uint8_t *data, uint32_t len);
-void cryptonite_keccak_finalize(struct sha3_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_sha512.c b/cbits/cryptonite_sha512.c
deleted file mode 100644
--- a/cbits/cryptonite_sha512.c
+++ /dev/null
@@ -1,307 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-#include "cryptonite_sha512.h"
-
-void cryptonite_sha384_init(struct sha512_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->h[0] = 0xcbbb9d5dc1059ed8ULL;
-	ctx->h[1] = 0x629a292a367cd507ULL;
-	ctx->h[2] = 0x9159015a3070dd17ULL;
-	ctx->h[3] = 0x152fecd8f70e5939ULL;
-	ctx->h[4] = 0x67332667ffc00b31ULL;
-	ctx->h[5] = 0x8eb44a8768581511ULL;
-	ctx->h[6] = 0xdb0c2e0d64f98fa7ULL;
-	ctx->h[7] = 0x47b5481dbefa4fa4ULL;
-}
-
-void cryptonite_sha512_init(struct sha512_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->h[0] = 0x6a09e667f3bcc908ULL;
-	ctx->h[1] = 0xbb67ae8584caa73bULL;
-	ctx->h[2] = 0x3c6ef372fe94f82bULL;
-	ctx->h[3] = 0xa54ff53a5f1d36f1ULL;
-	ctx->h[4] = 0x510e527fade682d1ULL;
-	ctx->h[5] = 0x9b05688c2b3e6c1fULL;
-	ctx->h[6] = 0x1f83d9abfb41bd6bULL;
-	ctx->h[7] = 0x5be0cd19137e2179ULL;
-}
-
-/* 232 times the cube root of the first 64 primes 2..311 */
-static const uint64_t k[] = {
-	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL, 0xb5c0fbcfec4d3b2fULL,
-	0xe9b5dba58189dbbcULL, 0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
-	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL, 0xd807aa98a3030242ULL,
-	0x12835b0145706fbeULL, 0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
-	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL, 0x9bdc06a725c71235ULL,
-	0xc19bf174cf692694ULL, 0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
-	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL, 0x2de92c6f592b0275ULL,
-	0x4a7484aa6ea6e483ULL, 0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
-	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL, 0xb00327c898fb213fULL,
-	0xbf597fc7beef0ee4ULL, 0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
-	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL, 0x27b70a8546d22ffcULL,
-	0x2e1b21385c26c926ULL, 0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
-	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL, 0x81c2c92e47edaee6ULL,
-	0x92722c851482353bULL, 0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
-	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL, 0xd192e819d6ef5218ULL,
-	0xd69906245565a910ULL, 0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
-	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL, 0x2748774cdf8eeb99ULL,
-	0x34b0bcb5e19b48a8ULL, 0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
-	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL, 0x748f82ee5defb2fcULL,
-	0x78a5636f43172f60ULL, 0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
-	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL, 0xbef9a3f7b2c67915ULL,
-	0xc67178f2e372532bULL, 0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
-	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL, 0x06f067aa72176fbaULL,
-	0x0a637dc5a2c898a6ULL, 0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
-	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL, 0x3c9ebe0a15c9bebcULL,
-	0x431d67c49c100d4cULL, 0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
-	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL,
-};
-
-#define e0(x)       (ror64(x, 28) ^ ror64(x, 34) ^ ror64(x, 39))
-#define e1(x)       (ror64(x, 14) ^ ror64(x, 18) ^ ror64(x, 41))
-#define s0(x)       (ror64(x, 1) ^ ror64(x, 8) ^ (x >> 7))
-#define s1(x)       (ror64(x, 19) ^ ror64(x, 61) ^ (x >> 6))
-
-static void sha512_do_chunk(struct sha512_ctx *ctx, uint64_t *buf)
-{
-	uint64_t a, b, c, d, e, f, g, h, t1, t2;
-	int i;
-	uint64_t w[80];
-
-	cpu_to_be64_array(w, buf, 16);
-
-	for (i = 16; i < 80; i++)
-		w[i] = s1(w[i - 2]) + w[i - 7] + s0(w[i - 15]) + w[i - 16];
-
-	a = ctx->h[0]; b = ctx->h[1]; c = ctx->h[2]; d = ctx->h[3];
-	e = ctx->h[4]; f = ctx->h[5]; g = ctx->h[6]; h = ctx->h[7];
-
-#define R(a, b, c, d, e, f, g, h, k, w)			\
-	t1 = h + e1(e) + (g ^ (e & (f ^ g))) + k + w;	\
-	t2 = e0(a) + ((a & b) | (c & (a | b)));		\
-	d += t1;					\
-	h = t1 + t2
-
-	for (i = 0; i < 80; i += 8) {
-		R(a, b, c, d, e, f, g, h, k[i + 0], w[i + 0]);
-		R(h, a, b, c, d, e, f, g, k[i + 1], w[i + 1]);
-		R(g, h, a, b, c, d, e, f, k[i + 2], w[i + 2]);
-		R(f, g, h, a, b, c, d, e, k[i + 3], w[i + 3]);
-		R(e, f, g, h, a, b, c, d, k[i + 4], w[i + 4]);
-		R(d, e, f, g, h, a, b, c, k[i + 5], w[i + 5]);
-		R(c, d, e, f, g, h, a, b, k[i + 6], w[i + 6]);
-		R(b, c, d, e, f, g, h, a, k[i + 7], w[i + 7]);
-	}
-
-#undef R
-
-	ctx->h[0] += a; ctx->h[1] += b; ctx->h[2] += c; ctx->h[3] += d;
-	ctx->h[4] += e; ctx->h[5] += f; ctx->h[6] += g; ctx->h[7] += h;
-}
-
-void cryptonite_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	return cryptonite_sha512_update(ctx, data, len);
-}
-
-void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	unsigned int index, to_fill;
-
-	/* check for partial buffer */
-	index = (unsigned int) (ctx->sz[0] & 0x7f);
-	to_fill = 128 - index;
-
-	ctx->sz[0] += len;
-	if (ctx->sz[0] < len)
-		ctx->sz[1]++;
-
-	/* process partial buffer if there's enough data to make a block */
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		sha512_do_chunk(ctx, (uint64_t *) ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	if (need_alignment(data, 8)) {
-		uint64_t tramp[16];
-		ASSERT_ALIGNMENT(tramp, 8);
-		for (; len >= 128; len -= 128, data += 128) {
-			memcpy(tramp, data, 128);
-			sha512_do_chunk(ctx, tramp);
-		}
-	} else {
-		/* process as much 128-block as possible */
-		for (; len >= 128; len -= 128, data += 128)
-			sha512_do_chunk(ctx, (uint64_t *) data);
-	}
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out)
-{
-	uint8_t intermediate[SHA512_DIGEST_SIZE];
-
-	cryptonite_sha512_finalize(ctx, intermediate);
-	memcpy(out, intermediate, SHA384_DIGEST_SIZE);
-}
-
-void cryptonite_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out)
-{
-	uint8_t intermediate[SHA512_DIGEST_SIZE];
-
-	cryptonite_sha512_finalize_prefix(ctx, data, len, n, intermediate);
-	memcpy(out, intermediate, SHA384_DIGEST_SIZE);
-}
-
-void cryptonite_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out)
-{
-	static uint8_t padding[128] = { 0x80, };
-	uint32_t i, index, padlen;
-	uint64_t bits[2];
-
-	/* cpu -> big endian */
-	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));
-	bits[1] = cpu_to_be64((ctx->sz[0] << 3));
-
-	/* pad out to 56 */
-	index = (unsigned int) (ctx->sz[0] & 0x7f);
-	padlen = (index < 112) ? (112 - index) : ((128 + 112) - index);
-	cryptonite_sha512_update(ctx, padding, padlen);
-
-	/* append length */
-	cryptonite_sha512_update(ctx, (uint8_t *) bits, sizeof(bits));
-
-	/* store to digest */
-	for (i = 0; i < 8; i++)
-		store_be64(out+8*i, ctx->h[i]);
-}
-
-#define HASHED(m) SHA512_##m
-#define HASHED_LOWER(m) sha512_##m
-#define CRYPTONITE_HASHED(m) cryptonite_sha512_##m
-#define SHA512_BLOCK_SIZE 128
-#define SHA512_BITS_ELEMS 2
-
-#include <cryptonite_hash_prefix.h>
-
-static inline uint32_t cryptonite_sha512_get_index(const struct sha512_ctx *ctx)
-{
-	return (uint32_t) (ctx->sz[0] & 0x7f);
-}
-
-static inline void cryptonite_sha512_incr_sz(struct sha512_ctx *ctx, uint64_t *bits, uint32_t n)
-{
-	ctx->sz[0] += n;
-	ctx->sz[1] += 1 & constant_time_lt_64(ctx->sz[0], n);
-	bits[0] = cpu_to_be64((ctx->sz[1] << 3 | ctx->sz[0] >> 61));
-	bits[1] = cpu_to_be64((ctx->sz[0] << 3));
-}
-
-static inline void cryptonite_sha512_select_digest(const struct sha512_ctx *ctx, uint8_t *out, uint32_t out_mask)
-{
-	uint32_t i;
-	uint64_t out_mask_64 = out_mask;
-	out_mask_64 |= out_mask_64 << 32;
-	for (i = 0; i < 8; i++)
-		xor_be64(out+8*i, ctx->h[i] & out_mask_64);
-}
-
-#include <cryptonite_hash_prefix.c>
-
-#include <stdio.h>
-
-void cryptonite_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen)
-{
-	memset(ctx, 0, sizeof(*ctx));
-	if (hashlen >= 512)
-		return;
-	switch (hashlen) {
-	case 224:
-		ctx->h[0] = 0x8c3d37c819544da2ULL;
-		ctx->h[1] = 0x73e1996689dcd4d6ULL;
-		ctx->h[2] = 0x1dfab7ae32ff9c82ULL;
-		ctx->h[3] = 0x679dd514582f9fcfULL;
-		ctx->h[4] = 0x0f6d2b697bd44da8ULL;
-		ctx->h[5] = 0x77e36f7304c48942ULL;
-		ctx->h[6] = 0x3f9d85a86a1d36c8ULL;
-		ctx->h[7] = 0x1112e6ad91d692a1ULL;
-		break;
-	case 256:
-		ctx->h[0] = 0x22312194fc2bf72cULL;
-		ctx->h[1] = 0x9f555fa3c84c64c2ULL;
-		ctx->h[2] = 0x2393b86b6f53b151ULL;
-		ctx->h[3] = 0x963877195940eabdULL;
-		ctx->h[4] = 0x96283ee2a88effe3ULL;
-		ctx->h[5] = 0xbe5e1e2553863992ULL;
-		ctx->h[6] = 0x2b0199fc2c85b8aaULL;
-		ctx->h[7] = 0x0eb72ddc81c52ca2ULL;
-		break;
-	default: {
-		char buf[8+4];
-		uint8_t out[64];
-		int i;
-
-		cryptonite_sha512_init(ctx);
-		for (i = 0; i < 8; i++)
-			ctx->h[i] ^= 0xa5a5a5a5a5a5a5a5ULL;
-
-		i = sprintf(buf, "SHA-512/%d", hashlen);
-		cryptonite_sha512_update(ctx, (uint8_t *) buf, i);
-		cryptonite_sha512_finalize(ctx, out);
-
-		/* re-init the context, otherwise len is changed */
-		memset(ctx, 0, sizeof(*ctx));
-		for (i = 0; i < 8; i++)
-			ctx->h[i] = cpu_to_be64(((uint64_t *) out)[i]);
-		}
-	}
-}
-
-void cryptonite_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	return cryptonite_sha512_update(ctx, data, len);
-}
-
-void cryptonite_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	uint8_t intermediate[SHA512_DIGEST_SIZE];
-
-	cryptonite_sha512_finalize(ctx, intermediate);
-	memcpy(out, intermediate, hashlen / 8);
-}
-
diff --git a/cbits/cryptonite_sha512.h b/cbits/cryptonite_sha512.h
deleted file mode 100644
--- a/cbits/cryptonite_sha512.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_SHA512_H
-#define CRYPTOHASH_SHA512_H
-
-#include <stdint.h>
-
-# define SHA512_BLOCK_SIZE 128
-
-struct sha512_ctx
-{
-	uint64_t sz[2];
-	uint8_t  buf[SHA512_BLOCK_SIZE];
-	uint64_t h[8];
-};
-
-#define sha384_ctx sha512_ctx
-
-#define SHA384_DIGEST_SIZE	48
-#define SHA384_CTX_SIZE		sizeof(struct sha384_ctx)
-
-#define SHA512_DIGEST_SIZE	64
-#define SHA512_CTX_SIZE		sizeof(struct sha512_ctx)
-
-void cryptonite_sha384_init(struct sha384_ctx *ctx);
-void cryptonite_sha384_update(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_sha384_finalize(struct sha384_ctx *ctx, uint8_t *out);
-void cryptonite_sha384_finalize_prefix(struct sha384_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
-
-void cryptonite_sha512_init(struct sha512_ctx *ctx);
-void cryptonite_sha512_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_sha512_finalize(struct sha512_ctx *ctx, uint8_t *out);
-void cryptonite_sha512_finalize_prefix(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len, uint32_t n, uint8_t *out);
-
-/* only multiples of 8 are supported as valid t values */
-void cryptonite_sha512t_init(struct sha512_ctx *ctx, uint32_t hashlen);
-void cryptonite_sha512t_update(struct sha512_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_sha512t_finalize(struct sha512_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_skein.h b/cbits/cryptonite_skein.h
deleted file mode 100644
--- a/cbits/cryptonite_skein.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_SKEIN_H
-#define CRYPTOHASH_SKEIN_H
-
-#define SKEIN_VERSION 1ULL
-#define SKEIN_IDSTRING 0x33414853ULL
-
-/*
-t0 0-63 || t1 64-127
-0-95      96-111      112-118    119     120-125  126    127
-Position  reserved    TreeLevel  BitPad  Type     First  Final
-*/
-#define FLAG_FIRST   (1ULL << 62)
-#define FLAG_FINAL   (1ULL << 63)
-#define FLAG_TYPE(x) (((uint64_t) ((x) & 0x3f)) << 56)
-
-#define TYPE_KEY     0x00
-#define TYPE_CFG     0x04
-#define TYPE_MSG     0x30
-#define TYPE_OUT     0x3f
-
-#define SET_TYPE(ctx, ty) ctx->t0 = 0; ctx->t1 = (ty)
-
-#endif
diff --git a/cbits/cryptonite_skein256.c b/cbits/cryptonite_skein256.c
deleted file mode 100644
--- a/cbits/cryptonite_skein256.c
+++ /dev/null
@@ -1,204 +0,0 @@
-/*
- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include "cryptonite_skein.h"
-#include "cryptonite_skein256.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-
-static const uint8_t K256_0[2] = { 14, 16, };
-static const uint8_t K256_1[2] = { 52, 57, };
-static const uint8_t K256_2[2] = { 23, 40, };
-static const uint8_t K256_3[2] = {  5, 37, };
-static const uint8_t K256_4[2] = { 25, 33, };
-static const uint8_t K256_5[2] = { 46, 12, };
-static const uint8_t K256_6[2] = { 58, 22, };
-static const uint8_t K256_7[2] = { 32, 32, };
-
-static inline void skein256_do_chunk(struct skein256_ctx *ctx, uint64_t *buf, uint32_t len)
-{
-	uint64_t x[4];
-	uint64_t ts[3];
-	uint64_t ks[4+1];
-
-	ks[4] = 0x1bd11bdaa9fc1a22ULL;
-	ks[0] = ctx->h[0]; ks[4] ^= ctx->h[0];
-	ks[1] = ctx->h[1]; ks[4] ^= ctx->h[1];
-	ks[2] = ctx->h[2]; ks[4] ^= ctx->h[2];
-	ks[3] = ctx->h[3]; ks[4] ^= ctx->h[3];
-
-	ts[0] = ctx->t0;
-	ts[1] = ctx->t1;
-
-	ts[0] += len;
-
-	ts[2] = ts[0] ^ ts[1];
-
-#define INJECTKEY(r) \
-	x[0] += ks[((r)+0) % (4+1)];                   \
-	x[1] += ks[((r)+1) % (4+1)] + ts[((r)+0) % 3]; \
-	x[2] += ks[((r)+2) % (4+1)] + ts[((r)+1) % 3]; \
-	x[3] += ks[((r)+3) % (4+1)] + (r)
-
-#define ROUND(a,b,c,d,k) \
-	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \
-	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c];
-
-#define PASS(i) \
-	ROUND(0,1,2,3,K256_0); \
-	ROUND(0,3,2,1,K256_1); \
-	ROUND(0,1,2,3,K256_2); \
-	ROUND(0,3,2,1,K256_3); \
-	INJECTKEY((i*2) + 1);          \
-	ROUND(0,1,2,3,K256_4); \
-	ROUND(0,3,2,1,K256_5); \
-	ROUND(0,1,2,3,K256_6); \
-	ROUND(0,3,2,1,K256_7); \
-	INJECTKEY((i*2) + 2)
-
-	x[0] = le64_to_cpu(buf[0]) + ks[0];
-	x[1] = le64_to_cpu(buf[1]) + ks[1] + ts[0];
-	x[2] = le64_to_cpu(buf[2]) + ks[2] + ts[1];
-	x[3] = le64_to_cpu(buf[3]) + ks[3];
-
-	/* 9 pass of 8 rounds = 72 rounds */
-	PASS(0);
-	PASS(1);
-	PASS(2);
-	PASS(3);
-	PASS(4);
-	PASS(5);
-	PASS(6);
-	PASS(7);
-	PASS(8);
-
-	ts[1] &= ~FLAG_FIRST;
-	ctx->t0 = ts[0];
-	ctx->t1 = ts[1];
-
-	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);
-        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);
-        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);
-        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);
-}
-
-void cryptonite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen)
-{
-	uint64_t buf[4];
-	memset(ctx, 0, sizeof(*ctx));
-
-	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));
-	
-	memset(buf, '\0', sizeof(buf));
-	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);
-	buf[1] = cpu_to_le64(hashlen);
-	buf[2] = 0; /* tree info, not implemented */
-	skein256_do_chunk(ctx, buf, 4*8);
-
-	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));
-}
-
-void cryptonite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t to_fill;
-
-	if (!len)
-		return;
-
-	to_fill = 32 - ctx->bufindex;
-
-	if (ctx->bufindex == 32) {
-		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);
-		ctx->bufindex = 0;
-	}
-
-	/* process partial buffer if there's enough data to make a block
-	 * and there's without doubt further blocks */
-	if (ctx->bufindex && len > to_fill) {
-		memcpy(ctx->buf + ctx->bufindex, data, to_fill);
-		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, 32);
-		len -= to_fill;
-		data += to_fill;
-		ctx->bufindex = 0;
-	}
-
-	if (need_alignment(data, 8)) {
-		uint64_t tramp[4];
-		ASSERT_ALIGNMENT(tramp, 8);
-		for (; len > 32; len -= 32, data += 32) {
-			memcpy(tramp, data, 32);
-			skein256_do_chunk(ctx, tramp, 32);
-		}
-	} else {
-		/* process as much 32-block as possible except the last one in case we finalize */
-		for (; len > 32; len -= 32, data += 32)
-			skein256_do_chunk(ctx, (uint64_t *) data, 32);
-	}
-
-	/* append data into buf */
-	if (len) {
-		memcpy(ctx->buf + ctx->bufindex, data, len);
-		ctx->bufindex += len;
-	}
-}
-
-void cryptonite_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	uint32_t outsize;
-	uint64_t x[4];
-	int i, j, n;
-
-	ctx->t1 |= FLAG_FINAL;
-	/* if buf is not complete pad with 0 bytes */
-	if (ctx->bufindex < 32)
-		memset(ctx->buf + ctx->bufindex, '\0', 32 - ctx->bufindex);
-	skein256_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);
-
-	memset(ctx->buf, '\0', 32);
-
-	/* make sure we have a 8 bit up rounded value */
-	outsize = (hashlen + 7) >> 3;
-
-	/* backup h[0--4] */
-	for (j = 0; j < 4; j++)
-		x[j] = ctx->h[j];
-	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */
-	for (i = 0; i*32 < outsize; i++) {
-		uint64_t w[4];
-		*((uint64_t *) ctx->buf) = cpu_to_le64(i);
-		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));
-		skein256_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));
-
-		n = outsize - i * 32;
-		if (n >= 32) n = 32;
-
-		cpu_to_le64_array(w, ctx->h, 4);
-		memcpy(out + i*32, w, n);
-
-		/* restore h[0--4] */
-		for (j = 0; j < 4; j++)
-			ctx->h[j] = x[j];
-	}
-}
diff --git a/cbits/cryptonite_skein256.h b/cbits/cryptonite_skein256.h
deleted file mode 100644
--- a/cbits/cryptonite_skein256.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_SKEIN256_H
-#define CRYPTOHASH_SKEIN256_H
-
-#include <stdint.h>
-
-struct skein256_ctx
-{
-	uint8_t  buf[32];
-	uint64_t h[4];
-	uint64_t t0;
-	uint64_t t1;
-	uint32_t bufindex;
-};
-
-#define SKEIN256_CTX_SIZE		sizeof(struct skein256_ctx)
-
-void cryponite_skein256_init(struct skein256_ctx *ctx, uint32_t hashlen);
-void cryponite_skein256_update(struct skein256_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryponite_skein256_finalize(struct skein256_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_skein512.c b/cbits/cryptonite_skein512.c
deleted file mode 100644
--- a/cbits/cryptonite_skein512.c
+++ /dev/null
@@ -1,222 +0,0 @@
-/*
- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include "cryptonite_skein.h"
-#include "cryptonite_skein512.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-
-static const uint8_t K512_0[4] = { 46, 36, 19, 37, };
-static const uint8_t K512_1[4] = { 33, 27, 14, 42, };
-static const uint8_t K512_2[4] = { 17, 49, 36, 39, };
-static const uint8_t K512_3[4] = { 44,  9, 54, 56, };
-static const uint8_t K512_4[4] = { 39, 30, 34, 24, };
-static const uint8_t K512_5[4] = { 13, 50, 10, 17, };
-static const uint8_t K512_6[4] = { 25, 29, 39, 43, };
-static const uint8_t K512_7[4] = {  8, 35, 56, 22, };
-
-static inline void skein512_do_chunk(struct skein512_ctx *ctx, uint64_t *buf, uint32_t len)
-{
-	uint64_t x[8];
-	uint64_t ts[3];
-	uint64_t ks[8+1];
-
-	ks[8] = 0x1bd11bdaa9fc1a22ULL;
-	ks[0] = ctx->h[0]; ks[8] ^= ctx->h[0];
-	ks[1] = ctx->h[1]; ks[8] ^= ctx->h[1];
-	ks[2] = ctx->h[2]; ks[8] ^= ctx->h[2];
-	ks[3] = ctx->h[3]; ks[8] ^= ctx->h[3];
-	ks[4] = ctx->h[4]; ks[8] ^= ctx->h[4];
-	ks[5] = ctx->h[5]; ks[8] ^= ctx->h[5];
-	ks[6] = ctx->h[6]; ks[8] ^= ctx->h[6];
-	ks[7] = ctx->h[7]; ks[8] ^= ctx->h[7];
-
-	ts[0] = ctx->t0;
-	ts[1] = ctx->t1;
-
-	ts[0] += len;
-
-	ts[2] = ts[0] ^ ts[1];
-
-#define INJECTKEY(r) \
-	x[0] += ks[((r)+0) % (8+1)];                   \
-	x[1] += ks[((r)+1) % (8+1)];                   \
-	x[2] += ks[((r)+2) % (8+1)];                   \
-	x[3] += ks[((r)+3) % (8+1)];                   \
-	x[4] += ks[((r)+4) % (8+1)];                   \
-	x[5] += ks[((r)+5) % (8+1)] + ts[((r)+0) % 3]; \
-	x[6] += ks[((r)+6) % (8+1)] + ts[((r)+1) % 3]; \
-	x[7] += ks[((r)+7) % (8+1)] + (r)
-
-#define ROUND(a,b,c,d,e,f,g,h,k) \
-	x[a] += x[b]; x[b] = rol64(x[b],k[0]); x[b] ^= x[a]; \
-	x[c] += x[d]; x[d] = rol64(x[d],k[1]); x[d] ^= x[c]; \
-	x[e] += x[f]; x[f] = rol64(x[f],k[2]); x[f] ^= x[e]; \
-	x[g] += x[h]; x[h] = rol64(x[h],k[3]); x[h] ^= x[g];
-
-#define PASS(i) \
-	ROUND(0,1,2,3,4,5,6,7,K512_0); \
-	ROUND(2,1,4,7,6,5,0,3,K512_1); \
-	ROUND(4,1,6,3,0,5,2,7,K512_2); \
-	ROUND(6,1,0,7,2,5,4,3,K512_3); \
-	INJECTKEY((i*2) + 1);          \
-	ROUND(0,1,2,3,4,5,6,7,K512_4); \
-	ROUND(2,1,4,7,6,5,0,3,K512_5); \
-	ROUND(4,1,6,3,0,5,2,7,K512_6); \
-	ROUND(6,1,0,7,2,5,4,3,K512_7); \
-	INJECTKEY((i*2) + 2)
-
-	x[0] = le64_to_cpu(buf[0]) + ks[0];
-	x[1] = le64_to_cpu(buf[1]) + ks[1];
-	x[2] = le64_to_cpu(buf[2]) + ks[2];
-	x[3] = le64_to_cpu(buf[3]) + ks[3];
-	x[4] = le64_to_cpu(buf[4]) + ks[4];
-	x[5] = le64_to_cpu(buf[5]) + ks[5] + ts[0];
-	x[6] = le64_to_cpu(buf[6]) + ks[6] + ts[1];
-	x[7] = le64_to_cpu(buf[7]) + ks[7];
-
-	/* 9 pass of 8 rounds = 72 rounds */
-	PASS(0);
-	PASS(1);
-	PASS(2);
-	PASS(3);
-	PASS(4);
-	PASS(5);
-	PASS(6);
-	PASS(7);
-	PASS(8);
-
-	ts[1] &= ~FLAG_FIRST;
-	ctx->t0 = ts[0];
-	ctx->t1 = ts[1];
-
-	ctx->h[0] = x[0] ^ cpu_to_le64(buf[0]);
-        ctx->h[1] = x[1] ^ cpu_to_le64(buf[1]);
-        ctx->h[2] = x[2] ^ cpu_to_le64(buf[2]);
-        ctx->h[3] = x[3] ^ cpu_to_le64(buf[3]);
-        ctx->h[4] = x[4] ^ cpu_to_le64(buf[4]);
-        ctx->h[5] = x[5] ^ cpu_to_le64(buf[5]);
-        ctx->h[6] = x[6] ^ cpu_to_le64(buf[6]);
-        ctx->h[7] = x[7] ^ cpu_to_le64(buf[7]);
-}
-
-void cryptonite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen)
-{
-	uint64_t buf[8];
-	memset(ctx, 0, sizeof(*ctx));
-
-	SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_CFG));
-	
-	memset(buf, '\0', sizeof(buf));
-	buf[0] = cpu_to_le64((SKEIN_VERSION << 32) | SKEIN_IDSTRING);
-	buf[1] = cpu_to_le64(hashlen);
-	buf[2] = 0; /* tree info, not implemented */
-	skein512_do_chunk(ctx, buf, 4*8);
-
-	SET_TYPE(ctx, FLAG_FIRST | FLAG_TYPE(TYPE_MSG));
-}
-
-void cryptonite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t to_fill;
-
-	if (!len)
-		return;
-
-	to_fill = 64 - ctx->bufindex;
-
-	if (ctx->bufindex == 64) {
-		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);
-		ctx->bufindex = 0;
-	}
-
-	/* process partial buffer if there's enough data to make a block
-	 * and there's without doubt further blocks */
-	if (ctx->bufindex && len > to_fill) {
-		memcpy(ctx->buf + ctx->bufindex, data, to_fill);
-		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, 64);
-		len -= to_fill;
-		data += to_fill;
-		ctx->bufindex = 0;
-	}
-
-	if (need_alignment(data, 8)) {
-		uint64_t tramp[8];
-		ASSERT_ALIGNMENT(tramp, 8);
-		for (; len > 64; len -= 64, data += 64) {
-			memcpy(tramp, data, 64);
-			skein512_do_chunk(ctx, tramp, 64);
-		}
-	} else {
-		/* process as much 64-block as possible except the last one in case we finalize */
-		for (; len > 64; len -= 64, data += 64)
-			skein512_do_chunk(ctx, (uint64_t *) data, 64);
-	}
-
-	/* append data into buf */
-	if (len) {
-		memcpy(ctx->buf + ctx->bufindex, data, len);
-		ctx->bufindex += len;
-	}
-}
-
-void cryptonite_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out)
-{
-	uint32_t outsize;
-	uint64_t x[8];
-	int i, j, n;
-
-	ctx->t1 |= FLAG_FINAL;
-	/* if buf is not complete pad with 0 bytes */
-	if (ctx->bufindex < 64)
-		memset(ctx->buf + ctx->bufindex, '\0', 64 - ctx->bufindex);
-	skein512_do_chunk(ctx, (uint64_t *) ctx->buf, ctx->bufindex);
-
-	memset(ctx->buf, '\0', 64);
-
-	/* make sure we have a 8 bit rounded value */
-	outsize = (hashlen + 7) >> 3;
-
-	/* backup h[0--7] */
-	for (j = 0; j < 8; j++)
-		x[j] = ctx->h[j];
-	/* threefish in counter mode, 0 for 1st 64 bytes, 1 for 2nd 64 bytes, .. */
-	for (i = 0; i*64 < outsize; i++) {
-		uint64_t w[8];
-		*((uint64_t *) ctx->buf) = cpu_to_le64(i);
-		SET_TYPE(ctx, FLAG_FIRST | FLAG_FINAL | FLAG_TYPE(TYPE_OUT));
-		skein512_do_chunk(ctx, (uint64_t *) ctx->buf, sizeof(uint64_t));
-
-		n = outsize - i * 64;
-		if (n >= 64) n = 64;
-
-		cpu_to_le64_array(w, ctx->h, 8);
-		memcpy(out + i*64, w, n);
-
-		/* restore h[0--7] */
-		for (j = 0; j < 8; j++)
-			ctx->h[j] = x[j];
-	}
-}
diff --git a/cbits/cryptonite_skein512.h b/cbits/cryptonite_skein512.h
deleted file mode 100644
--- a/cbits/cryptonite_skein512.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 2006-2010 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_SKEIN512_H
-#define CRYPTOHASH_SKEIN512_H
-
-#include <stdint.h>
-
-struct skein512_ctx
-{
-	uint8_t  buf[64];
-	uint64_t h[8];
-	uint64_t t0;
-	uint64_t t1;
-	uint32_t bufindex;
-};
-
-#define SKEIN512_CTX_SIZE		sizeof(struct skein512_ctx)
-
-void cryponite_skein512_init(struct skein512_ctx *ctx, uint32_t hashlen);
-void cryponite_skein512_update(struct skein512_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryponite_skein512_finalize(struct skein512_ctx *ctx, uint32_t hashlen, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_tiger.c b/cbits/cryptonite_tiger.c
deleted file mode 100644
--- a/cbits/cryptonite_tiger.c
+++ /dev/null
@@ -1,424 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <string.h>
-#include "cryptonite_tiger.h"
-#include "cryptonite_bitfn.h"
-#include "cryptonite_align.h"
-
-static const uint64_t t1[256] = {
-	0x02aab17cf7e90c5eULL,0xac424b03e243a8ecULL,0x72cd5be30dd5fcd3ULL,0x6d019b93f6f97f3aULL,
-	0xcd9978ffd21f9193ULL,0x7573a1c9708029e2ULL,0xb164326b922a83c3ULL,0x46883eee04915870ULL,
-	0xeaace3057103ece6ULL,0xc54169b808a3535cULL,0x4ce754918ddec47cULL,0x0aa2f4dfdc0df40cULL,
-	0x10b76f18a74dbefaULL,0xc6ccb6235ad1ab6aULL,0x13726121572fe2ffULL,0x1a488c6f199d921eULL,
-	0x4bc9f9f4da0007caULL,0x26f5e6f6e85241c7ULL,0x859079dbea5947b6ULL,0x4f1885c5c99e8c92ULL,
-	0xd78e761ea96f864bULL,0x8e36428c52b5c17dULL,0x69cf6827373063c1ULL,0xb607c93d9bb4c56eULL,
-	0x7d820e760e76b5eaULL,0x645c9cc6f07fdc42ULL,0xbf38a078243342e0ULL,0x5f6b343c9d2e7d04ULL,
-	0xf2c28aeb600b0ec6ULL,0x6c0ed85f7254bcacULL,0x71592281a4db4fe5ULL,0x1967fa69ce0fed9fULL,
-	0xfd5293f8b96545dbULL,0xc879e9d7f2a7600bULL,0x860248920193194eULL,0xa4f9533b2d9cc0b3ULL,
-	0x9053836c15957613ULL,0xdb6dcf8afc357bf1ULL,0x18beea7a7a370f57ULL,0x037117ca50b99066ULL,
-	0x6ab30a9774424a35ULL,0xf4e92f02e325249bULL,0x7739db07061ccae1ULL,0xd8f3b49ceca42a05ULL,
-	0xbd56be3f51382f73ULL,0x45faed5843b0bb28ULL,0x1c813d5c11bf1f83ULL,0x8af0e4b6d75fa169ULL,
-	0x33ee18a487ad9999ULL,0x3c26e8eab1c94410ULL,0xb510102bc0a822f9ULL,0x141eef310ce6123bULL,
-	0xfc65b90059ddb154ULL,0xe0158640c5e0e607ULL,0x884e079826c3a3cfULL,0x930d0d9523c535fdULL,
-	0x35638d754e9a2b00ULL,0x4085fccf40469dd5ULL,0xc4b17ad28be23a4cULL,0xcab2f0fc6a3e6a2eULL,
-	0x2860971a6b943fcdULL,0x3dde6ee212e30446ULL,0x6222f32ae01765aeULL,0x5d550bb5478308feULL,
-	0xa9efa98da0eda22aULL,0xc351a71686c40da7ULL,0x1105586d9c867c84ULL,0xdcffee85fda22853ULL,
-	0xccfbd0262c5eef76ULL,0xbaf294cb8990d201ULL,0xe69464f52afad975ULL,0x94b013afdf133e14ULL,
-	0x06a7d1a32823c958ULL,0x6f95fe5130f61119ULL,0xd92ab34e462c06c0ULL,0xed7bde33887c71d2ULL,
-	0x79746d6e6518393eULL,0x5ba419385d713329ULL,0x7c1ba6b948a97564ULL,0x31987c197bfdac67ULL,
-	0xde6c23c44b053d02ULL,0x581c49fed002d64dULL,0xdd474d6338261571ULL,0xaa4546c3e473d062ULL,
-	0x928fce349455f860ULL,0x48161bbacaab94d9ULL,0x63912430770e6f68ULL,0x6ec8a5e602c6641cULL,
-	0x87282515337ddd2bULL,0x2cda6b42034b701bULL,0xb03d37c181cb096dULL,0xe108438266c71c6fULL,
-	0x2b3180c7eb51b255ULL,0xdf92b82f96c08bbcULL,0x5c68c8c0a632f3baULL,0x5504cc861c3d0556ULL,
-	0xabbfa4e55fb26b8fULL,0x41848b0ab3baceb4ULL,0xb334a273aa445d32ULL,0xbca696f0a85ad881ULL,
-	0x24f6ec65b528d56cULL,0x0ce1512e90f4524aULL,0x4e9dd79d5506d35aULL,0x258905fac6ce9779ULL,
-	0x2019295b3e109b33ULL,0xf8a9478b73a054ccULL,0x2924f2f934417eb0ULL,0x3993357d536d1bc4ULL,
-	0x38a81ac21db6ff8bULL,0x47c4fbf17d6016bfULL,0x1e0faadd7667e3f5ULL,0x7abcff62938beb96ULL,
-	0xa78dad948fc179c9ULL,0x8f1f98b72911e50dULL,0x61e48eae27121a91ULL,0x4d62f7ad31859808ULL,
-	0xeceba345ef5ceaebULL,0xf5ceb25ebc9684ceULL,0xf633e20cb7f76221ULL,0xa32cdf06ab8293e4ULL,
-	0x985a202ca5ee2ca4ULL,0xcf0b8447cc8a8fb1ULL,0x9f765244979859a3ULL,0xa8d516b1a1240017ULL,
-	0x0bd7ba3ebb5dc726ULL,0xe54bca55b86adb39ULL,0x1d7a3afd6c478063ULL,0x519ec608e7669eddULL,
-	0x0e5715a2d149aa23ULL,0x177d4571848ff194ULL,0xeeb55f3241014c22ULL,0x0f5e5ca13a6e2ec2ULL,
-	0x8029927b75f5c361ULL,0xad139fabc3d6e436ULL,0x0d5df1a94ccf402fULL,0x3e8bd948bea5dfc8ULL,
-	0xa5a0d357bd3ff77eULL,0xa2d12e251f74f645ULL,0x66fd9e525e81a082ULL,0x2e0c90ce7f687a49ULL,
-	0xc2e8bcbeba973bc5ULL,0x000001bce509745fULL,0x423777bbe6dab3d6ULL,0xd1661c7eaef06eb5ULL,
-	0xa1781f354daacfd8ULL,0x2d11284a2b16affcULL,0xf1fc4f67fa891d1fULL,0x73ecc25dcb920adaULL,
-	0xae610c22c2a12651ULL,0x96e0a810d356b78aULL,0x5a9a381f2fe7870fULL,0xd5ad62ede94e5530ULL,
-	0xd225e5e8368d1427ULL,0x65977b70c7af4631ULL,0x99f889b2de39d74fULL,0x233f30bf54e1d143ULL,
-	0x9a9675d3d9a63c97ULL,0x5470554ff334f9a8ULL,0x166acb744a4f5688ULL,0x70c74caab2e4aeadULL,
-	0xf0d091646f294d12ULL,0x57b82a89684031d1ULL,0xefd95a5a61be0b6bULL,0x2fbd12e969f2f29aULL,
-	0x9bd37013feff9fe8ULL,0x3f9b0404d6085a06ULL,0x4940c1f3166cfe15ULL,0x09542c4dcdf3defbULL,
-	0xb4c5218385cd5ce3ULL,0xc935b7dc4462a641ULL,0x3417f8a68ed3b63fULL,0xb80959295b215b40ULL,
-	0xf99cdaef3b8c8572ULL,0x018c0614f8fcb95dULL,0x1b14accd1a3acdf3ULL,0x84d471f200bb732dULL,
-	0xc1a3110e95e8da16ULL,0x430a7220bf1a82b8ULL,0xb77e090d39df210eULL,0x5ef4bd9f3cd05e9dULL,
-	0x9d4ff6da7e57a444ULL,0xda1d60e183d4a5f8ULL,0xb287c38417998e47ULL,0xfe3edc121bb31886ULL,
-	0xc7fe3ccc980ccbefULL,0xe46fb590189bfd03ULL,0x3732fd469a4c57dcULL,0x7ef700a07cf1ad65ULL,
-	0x59c64468a31d8859ULL,0x762fb0b4d45b61f6ULL,0x155baed099047718ULL,0x68755e4c3d50baa6ULL,
-	0xe9214e7f22d8b4dfULL,0x2addbf532eac95f4ULL,0x32ae3909b4bd0109ULL,0x834df537b08e3450ULL,
-	0xfa209da84220728dULL,0x9e691d9b9efe23f7ULL,0x0446d288c4ae8d7fULL,0x7b4cc524e169785bULL,
-	0x21d87f0135ca1385ULL,0xcebb400f137b8aa5ULL,0x272e2b66580796beULL,0x3612264125c2b0deULL,
-	0x057702bdad1efbb2ULL,0xd4babb8eacf84be9ULL,0x91583139641bc67bULL,0x8bdc2de08036e024ULL,
-	0x603c8156f49f68edULL,0xf7d236f7dbef5111ULL,0x9727c4598ad21e80ULL,0xa08a0896670a5fd7ULL,
-	0xcb4a8f4309eba9cbULL,0x81af564b0f7036a1ULL,0xc0b99aa778199abdULL,0x959f1ec83fc8e952ULL,
-	0x8c505077794a81b9ULL,0x3acaaf8f056338f0ULL,0x07b43f50627a6778ULL,0x4a44ab49f5eccc77ULL,
-	0x3bc3d6e4b679ee98ULL,0x9cc0d4d1cf14108cULL,0x4406c00b206bc8a0ULL,0x82a18854c8d72d89ULL,
-	0x67e366b35c3c432cULL,0xb923dd61102b37f2ULL,0x56ab2779d884271dULL,0xbe83e1b0ff1525afULL,
-	0xfb7c65d4217e49a9ULL,0x6bdbe0e76d48e7d4ULL,0x08df828745d9179eULL,0x22ea6a9add53bd34ULL,
-	0xe36e141c5622200aULL,0x7f805d1b8cb750eeULL,0xafe5c7a59f58e837ULL,0xe27f996a4fb1c23cULL,
-	0xd3867dfb0775f0d0ULL,0xd0e673de6e88891aULL,0x123aeb9eafb86c25ULL,0x30f1d5d5c145b895ULL,
-	0xbb434a2dee7269e7ULL,0x78cb67ecf931fa38ULL,0xf33b0372323bbf9cULL,0x52d66336fb279c74ULL,
-	0x505f33ac0afb4eaaULL,0xe8a5cd99a2cce187ULL,0x534974801e2d30bbULL,0x8d2d5711d5876d90ULL,
-	0x1f1a412891bc038eULL,0xd6e2e71d82e56648ULL,0x74036c3a497732b7ULL,0x89b67ed96361f5abULL,
-	0xffed95d8f1ea02a2ULL,0xe72b3bd61464d43dULL,0xa6300f170bdc4820ULL,0xebc18760ed78a77aULL,
-};
-
-static const uint64_t t2[256] =
-{
-	0xe6a6be5a05a12138ULL,0xb5a122a5b4f87c98ULL,0x563c6089140b6990ULL,0x4c46cb2e391f5dd5ULL,
-	0xd932addbc9b79434ULL,0x08ea70e42015aff5ULL,0xd765a6673e478cf1ULL,0xc4fb757eab278d99ULL,
-	0xdf11c6862d6e0692ULL,0xddeb84f10d7f3b16ULL,0x6f2ef604a665ea04ULL,0x4a8e0f0ff0e0dfb3ULL,
-	0xa5edeef83dbcba51ULL,0xfc4f0a2a0ea4371eULL,0xe83e1da85cb38429ULL,0xdc8ff882ba1b1ce2ULL,
-	0xcd45505e8353e80dULL,0x18d19a00d4db0717ULL,0x34a0cfeda5f38101ULL,0x0be77e518887caf2ULL,
-	0x1e341438b3c45136ULL,0xe05797f49089ccf9ULL,0xffd23f9df2591d14ULL,0x543dda228595c5cdULL,
-	0x661f81fd99052a33ULL,0x8736e641db0f7b76ULL,0x15227725418e5307ULL,0xe25f7f46162eb2faULL,
-	0x48a8b2126c13d9feULL,0xafdc541792e76eeaULL,0x03d912bfc6d1898fULL,0x31b1aafa1b83f51bULL,
-	0xf1ac2796e42ab7d9ULL,0x40a3a7d7fcd2ebacULL,0x1056136d0afbbcc5ULL,0x7889e1dd9a6d0c85ULL,
-	0xd33525782a7974aaULL,0xa7e25d09078ac09bULL,0xbd4138b3eac6edd0ULL,0x920abfbe71eb9e70ULL,
-	0xa2a5d0f54fc2625cULL,0xc054e36b0b1290a3ULL,0xf6dd59ff62fe932bULL,0x3537354511a8ac7dULL,
-	0xca845e9172fadcd4ULL,0x84f82b60329d20dcULL,0x79c62ce1cd672f18ULL,0x8b09a2add124642cULL,
-	0xd0c1e96a19d9e726ULL,0x5a786a9b4ba9500cULL,0x0e020336634c43f3ULL,0xc17b474aeb66d822ULL,
-	0x6a731ae3ec9baac2ULL,0x8226667ae0840258ULL,0x67d4567691caeca5ULL,0x1d94155c4875adb5ULL,
-	0x6d00fd985b813fdfULL,0x51286efcb774cd06ULL,0x5e8834471fa744afULL,0xf72ca0aee761ae2eULL,
-	0xbe40e4cdaee8e09aULL,0xe9970bbb5118f665ULL,0x726e4beb33df1964ULL,0x703b000729199762ULL,
-	0x4631d816f5ef30a7ULL,0xb880b5b51504a6beULL,0x641793c37ed84b6cULL,0x7b21ed77f6e97d96ULL,
-	0x776306312ef96b73ULL,0xae528948e86ff3f4ULL,0x53dbd7f286a3f8f8ULL,0x16cadce74cfc1063ULL,
-	0x005c19bdfa52c6ddULL,0x68868f5d64d46ad3ULL,0x3a9d512ccf1e186aULL,0x367e62c2385660aeULL,
-	0xe359e7ea77dcb1d7ULL,0x526c0773749abe6eULL,0x735ae5f9d09f734bULL,0x493fc7cc8a558ba8ULL,
-	0xb0b9c1533041ab45ULL,0x321958ba470a59bdULL,0x852db00b5f46c393ULL,0x91209b2bd336b0e5ULL,
-	0x6e604f7d659ef19fULL,0xb99a8ae2782ccb24ULL,0xccf52ab6c814c4c7ULL,0x4727d9afbe11727bULL,
-	0x7e950d0c0121b34dULL,0x756f435670ad471fULL,0xf5add442615a6849ULL,0x4e87e09980b9957aULL,
-	0x2acfa1df50aee355ULL,0xd898263afd2fd556ULL,0xc8f4924dd80c8fd6ULL,0xcf99ca3d754a173aULL,
-	0xfe477bacaf91bf3cULL,0xed5371f6d690c12dULL,0x831a5c285e687094ULL,0xc5d3c90a3708a0a4ULL,
-	0x0f7f903717d06580ULL,0x19f9bb13b8fdf27fULL,0xb1bd6f1b4d502843ULL,0x1c761ba38fff4012ULL,
-	0x0d1530c4e2e21f3bULL,0x8943ce69a7372c8aULL,0xe5184e11feb5ce66ULL,0x618bdb80bd736621ULL,
-	0x7d29bad68b574d0bULL,0x81bb613e25e6fe5bULL,0x071c9c10bc07913fULL,0xc7beeb7909ac2d97ULL,
-	0xc3e58d353bc5d757ULL,0xeb017892f38f61e8ULL,0xd4effb9c9b1cc21aULL,0x99727d26f494f7abULL,
-	0xa3e063a2956b3e03ULL,0x9d4a8b9a4aa09c30ULL,0x3f6ab7d500090fb4ULL,0x9cc0f2a057268ac0ULL,
-	0x3dee9d2dedbf42d1ULL,0x330f49c87960a972ULL,0xc6b2720287421b41ULL,0x0ac59ec07c00369cULL,
-	0xef4eac49cb353425ULL,0xf450244eef0129d8ULL,0x8acc46e5caf4deb6ULL,0x2ffeab63989263f7ULL,
-	0x8f7cb9fe5d7a4578ULL,0x5bd8f7644e634635ULL,0x427a7315bf2dc900ULL,0x17d0c4aa2125261cULL,
-	0x3992486c93518e50ULL,0xb4cbfee0a2d7d4c3ULL,0x7c75d6202c5ddd8dULL,0xdbc295d8e35b6c61ULL,
-	0x60b369d302032b19ULL,0xce42685fdce44132ULL,0x06f3ddb9ddf65610ULL,0x8ea4d21db5e148f0ULL,
-	0x20b0fce62fcd496fULL,0x2c1b912358b0ee31ULL,0xb28317b818f5a308ULL,0xa89c1e189ca6d2cfULL,
-	0x0c6b18576aaadbc8ULL,0xb65deaa91299fae3ULL,0xfb2b794b7f1027e7ULL,0x04e4317f443b5bebULL,
-	0x4b852d325939d0a6ULL,0xd5ae6beefb207ffcULL,0x309682b281c7d374ULL,0xbae309a194c3b475ULL,
-	0x8cc3f97b13b49f05ULL,0x98a9422ff8293967ULL,0x244b16b01076ff7cULL,0xf8bf571c663d67eeULL,
-	0x1f0d6758eee30da1ULL,0xc9b611d97adeb9b7ULL,0xb7afd5887b6c57a2ULL,0x6290ae846b984fe1ULL,
-	0x94df4cdeacc1a5fdULL,0x058a5bd1c5483affULL,0x63166cc142ba3c37ULL,0x8db8526eb2f76f40ULL,
-	0xe10880036f0d6d4eULL,0x9e0523c9971d311dULL,0x45ec2824cc7cd691ULL,0x575b8359e62382c9ULL,
-	0xfa9e400dc4889995ULL,0xd1823ecb45721568ULL,0xdafd983b8206082fULL,0xaa7d29082386a8cbULL,
-	0x269fcd4403b87588ULL,0x1b91f5f728bdd1e0ULL,0xe4669f39040201f6ULL,0x7a1d7c218cf04adeULL,
-	0x65623c29d79ce5ceULL,0x2368449096c00bb1ULL,0xab9bf1879da503baULL,0xbc23ecb1a458058eULL,
-	0x9a58df01bb401eccULL,0xa070e868a85f143dULL,0x4ff188307df2239eULL,0x14d565b41a641183ULL,
-	0xee13337452701602ULL,0x950e3dcf3f285e09ULL,0x59930254b9c80953ULL,0x3bf299408930da6dULL,
-	0xa955943f53691387ULL,0xa15edecaa9cb8784ULL,0x29142127352be9a0ULL,0x76f0371fff4e7afbULL,
-	0x0239f450274f2228ULL,0xbb073af01d5e868bULL,0xbfc80571c10e96c1ULL,0xd267088568222e23ULL,
-	0x9671a3d48e80b5b0ULL,0x55b5d38ae193bb81ULL,0x693ae2d0a18b04b8ULL,0x5c48b4ecadd5335fULL,
-	0xfd743b194916a1caULL,0x2577018134be98c4ULL,0xe77987e83c54a4adULL,0x28e11014da33e1b9ULL,
-	0x270cc59e226aa213ULL,0x71495f756d1a5f60ULL,0x9be853fb60afef77ULL,0xadc786a7f7443dbfULL,
-	0x0904456173b29a82ULL,0x58bc7a66c232bd5eULL,0xf306558c673ac8b2ULL,0x41f639c6b6c9772aULL,
-	0x216defe99fda35daULL,0x11640cc71c7be615ULL,0x93c43694565c5527ULL,0xea038e6246777839ULL,
-	0xf9abf3ce5a3e2469ULL,0x741e768d0fd312d2ULL,0x0144b883ced652c6ULL,0xc20b5a5ba33f8552ULL,
-	0x1ae69633c3435a9dULL,0x97a28ca4088cfdecULL,0x8824a43c1e96f420ULL,0x37612fa66eeea746ULL,
-	0x6b4cb165f9cf0e5aULL,0x43aa1c06a0abfb4aULL,0x7f4dc26ff162796bULL,0x6cbacc8e54ed9b0fULL,
-	0xa6b7ffefd2bb253eULL,0x2e25bc95b0a29d4fULL,0x86d6a58bdef1388cULL,0xded74ac576b6f054ULL,
-	0x8030bdbc2b45805dULL,0x3c81af70e94d9289ULL,0x3eff6dda9e3100dbULL,0xb38dc39fdfcc8847ULL,
-	0x123885528d17b87eULL,0xf2da0ed240b1b642ULL,0x44cefadcd54bf9a9ULL,0x1312200e433c7ee6ULL,
-	0x9ffcc84f3a78c748ULL,0xf0cd1f72248576bbULL,0xec6974053638cfe4ULL,0x2ba7b67c0cec4e4cULL,
-	0xac2f4df3e5ce32edULL,0xcb33d14326ea4c11ULL,0xa4e9044cc77e58bcULL,0x5f513293d934fcefULL,
-	0x5dc9645506e55444ULL,0x50de418f317de40aULL,0x388cb31a69dde259ULL,0x2db4a83455820a86ULL,
-	0x9010a91e84711ae9ULL,0x4df7f0b7b1498371ULL,0xd62a2eabc0977179ULL,0x22fac097aa8d5c0eULL,
-}; 
-
-static const uint64_t t3[256]= {
-	0xf49fcc2ff1daf39bULL,0x487fd5c66ff29281ULL,0xe8a30667fcdca83fULL,0x2c9b4be3d2fcce63ULL,
-	0xda3ff74b93fbbbc2ULL,0x2fa165d2fe70ba66ULL,0xa103e279970e93d4ULL,0xbecdec77b0e45e71ULL,
-	0xcfb41e723985e497ULL,0xb70aaa025ef75017ULL,0xd42309f03840b8e0ULL,0x8efc1ad035898579ULL,
-	0x96c6920be2b2abc5ULL,0x66af4163375a9172ULL,0x2174abdcca7127fbULL,0xb33ccea64a72ff41ULL,
-	0xf04a4933083066a5ULL,0x8d970acdd7289af5ULL,0x8f96e8e031c8c25eULL,0xf3fec02276875d47ULL,
-	0xec7bf310056190ddULL,0xf5adb0aebb0f1491ULL,0x9b50f8850fd58892ULL,0x4975488358b74de8ULL,
-	0xa3354ff691531c61ULL,0x0702bbe481d2c6eeULL,0x89fb24057deded98ULL,0xac3075138596e902ULL,
-	0x1d2d3580172772edULL,0xeb738fc28e6bc30dULL,0x5854ef8f63044326ULL,0x9e5c52325add3bbeULL,
-	0x90aa53cf325c4623ULL,0xc1d24d51349dd067ULL,0x2051cfeea69ea624ULL,0x13220f0a862e7e4fULL,
-	0xce39399404e04864ULL,0xd9c42ca47086fcb7ULL,0x685ad2238a03e7ccULL,0x066484b2ab2ff1dbULL,
-	0xfe9d5d70efbf79ecULL,0x5b13b9dd9c481854ULL,0x15f0d475ed1509adULL,0x0bebcd060ec79851ULL,
-	0xd58c6791183ab7f8ULL,0xd1187c5052f3eee4ULL,0xc95d1192e54e82ffULL,0x86eea14cb9ac6ca2ULL,
-	0x3485beb153677d5dULL,0xdd191d781f8c492aULL,0xf60866baa784ebf9ULL,0x518f643ba2d08c74ULL,
-	0x8852e956e1087c22ULL,0xa768cb8dc410ae8dULL,0x38047726bfec8e1aULL,0xa67738b4cd3b45aaULL,
-	0xad16691cec0dde19ULL,0xc6d4319380462e07ULL,0xc5a5876d0ba61938ULL,0x16b9fa1fa58fd840ULL,
-	0x188ab1173ca74f18ULL,0xabda2f98c99c021fULL,0x3e0580ab134ae816ULL,0x5f3b05b773645abbULL,
-	0x2501a2be5575f2f6ULL,0x1b2f74004e7e8ba9ULL,0x1cd7580371e8d953ULL,0x7f6ed89562764e30ULL,
-	0xb15926ff596f003dULL,0x9f65293da8c5d6b9ULL,0x6ecef04dd690f84cULL,0x4782275fff33af88ULL,
-	0xe41433083f820801ULL,0xfd0dfe409a1af9b5ULL,0x4325a3342cdb396bULL,0x8ae77e62b301b252ULL,
-	0xc36f9e9f6655615aULL,0x85455a2d92d32c09ULL,0xf2c7dea949477485ULL,0x63cfb4c133a39ebaULL,
-	0x83b040cc6ebc5462ULL,0x3b9454c8fdb326b0ULL,0x56f56a9e87ffd78cULL,0x2dc2940d99f42bc6ULL,
-	0x98f7df096b096e2dULL,0x19a6e01e3ad852bfULL,0x42a99ccbdbd4b40bULL,0xa59998af45e9c559ULL,
-	0x366295e807d93186ULL,0x6b48181bfaa1f773ULL,0x1fec57e2157a0a1dULL,0x4667446af6201ad5ULL,
-	0xe615ebcacfb0f075ULL,0xb8f31f4f68290778ULL,0x22713ed6ce22d11eULL,0x3057c1a72ec3c93bULL,
-	0xcb46acc37c3f1f2fULL,0xdbb893fd02aaf50eULL,0x331fd92e600b9fcfULL,0xa498f96148ea3ad6ULL,
-	0xa8d8426e8b6a83eaULL,0xa089b274b7735cdcULL,0x87f6b3731e524a11ULL,0x118808e5cbc96749ULL,
-	0x9906e4c7b19bd394ULL,0xafed7f7e9b24a20cULL,0x6509eadeeb3644a7ULL,0x6c1ef1d3e8ef0edeULL,
-	0xb9c97d43e9798fb4ULL,0xa2f2d784740c28a3ULL,0x7b8496476197566fULL,0x7a5be3e6b65f069dULL,
-	0xf96330ed78be6f10ULL,0xeee60de77a076a15ULL,0x2b4bee4aa08b9bd0ULL,0x6a56a63ec7b8894eULL,
-	0x02121359ba34fef4ULL,0x4cbf99f8283703fcULL,0x398071350caf30c8ULL,0xd0a77a89f017687aULL,
-	0xf1c1a9eb9e423569ULL,0x8c7976282dee8199ULL,0x5d1737a5dd1f7abdULL,0x4f53433c09a9fa80ULL,
-	0xfa8b0c53df7ca1d9ULL,0x3fd9dcbc886ccb77ULL,0xc040917ca91b4720ULL,0x7dd00142f9d1dcdfULL,
-	0x8476fc1d4f387b58ULL,0x23f8e7c5f3316503ULL,0x032a2244e7e37339ULL,0x5c87a5d750f5a74bULL,
-	0x082b4cc43698992eULL,0xdf917becb858f63cULL,0x3270b8fc5bf86ddaULL,0x10ae72bb29b5dd76ULL,
-	0x576ac94e7700362bULL,0x1ad112dac61efb8fULL,0x691bc30ec5faa427ULL,0xff246311cc327143ULL,
-	0x3142368e30e53206ULL,0x71380e31e02ca396ULL,0x958d5c960aad76f1ULL,0xf8d6f430c16da536ULL,
-	0xc8ffd13f1be7e1d2ULL,0x7578ae66004ddbe1ULL,0x05833f01067be646ULL,0xbb34b5ad3bfe586dULL,
-	0x095f34c9a12b97f0ULL,0x247ab64525d60ca8ULL,0xdcdbc6f3017477d1ULL,0x4a2e14d4decad24dULL,
-	0xbdb5e6d9be0a1eebULL,0x2a7e70f7794301abULL,0xdef42d8a270540fdULL,0x01078ec0a34c22c1ULL,
-	0xe5de511af4c16387ULL,0x7ebb3a52bd9a330aULL,0x77697857aa7d6435ULL,0x004e831603ae4c32ULL,
-	0xe7a21020ad78e312ULL,0x9d41a70c6ab420f2ULL,0x28e06c18ea1141e6ULL,0xd2b28cbd984f6b28ULL,
-	0x26b75f6c446e9d83ULL,0xba47568c4d418d7fULL,0xd80badbfe6183d8eULL,0x0e206d7f5f166044ULL,
-	0xe258a43911cbca3eULL,0x723a1746b21dc0bcULL,0xc7caa854f5d7cdd3ULL,0x7cac32883d261d9cULL,
-	0x7690c26423ba942cULL,0x17e55524478042b8ULL,0xe0be477656a2389fULL,0x4d289b5e67ab2da0ULL,
-	0x44862b9c8fbbfd31ULL,0xb47cc8049d141365ULL,0x822c1b362b91c793ULL,0x4eb14655fb13dfd8ULL,
-	0x1ecbba0714e2a97bULL,0x6143459d5cde5f14ULL,0x53a8fbf1d5f0ac89ULL,0x97ea04d81c5e5b00ULL,
-	0x622181a8d4fdb3f3ULL,0xe9bcd341572a1208ULL,0x1411258643cce58aULL,0x9144c5fea4c6e0a4ULL,
-	0x0d33d06565cf620fULL,0x54a48d489f219ca1ULL,0xc43e5eac6d63c821ULL,0xa9728b3a72770dafULL,
-	0xd7934e7b20df87efULL,0xe35503b61a3e86e5ULL,0xcae321fbc819d504ULL,0x129a50b3ac60bfa6ULL,
-	0xcd5e68ea7e9fb6c3ULL,0xb01c90199483b1c7ULL,0x3de93cd5c295376cULL,0xaed52edf2ab9ad13ULL,
-	0x2e60f512c0a07884ULL,0xbc3d86a3e36210c9ULL,0x35269d9b163951ceULL,0x0c7d6e2ad0cdb5faULL,
-	0x59e86297d87f5733ULL,0x298ef221898db0e7ULL,0x55000029d1a5aa7eULL,0x8bc08ae1b5061b45ULL,
-	0xc2c31c2b6c92703aULL,0x94cc596baf25ef42ULL,0x0a1d73db22540456ULL,0x04b6a0f9d9c4179aULL,
-	0xeffdafa2ae3d3c60ULL,0xf7c8075bb49496c4ULL,0x9cc5c7141d1cd4e3ULL,0x78bd1638218e5534ULL,
-	0xb2f11568f850246aULL,0xedfabcfa9502bc29ULL,0x796ce5f2da23051bULL,0xaae128b0dc93537cULL,
-	0x3a493da0ee4b29aeULL,0xb5df6b2c416895d7ULL,0xfcabbd25122d7f37ULL,0x70810b58105dc4b1ULL,
-	0xe10fdd37f7882a90ULL,0x524dcab5518a3f5cULL,0x3c9e85878451255bULL,0x4029828119bd34e2ULL,
-	0x74a05b6f5d3ceccbULL,0xb610021542e13ecaULL,0x0ff979d12f59e2acULL,0x6037da27e4f9cc50ULL,
-	0x5e92975a0df1847dULL,0xd66de190d3e623feULL,0x5032d6b87b568048ULL,0x9a36b7ce8235216eULL,
-	0x80272a7a24f64b4aULL,0x93efed8b8c6916f7ULL,0x37ddbff44cce1555ULL,0x4b95db5d4b99bd25ULL,
-	0x92d3fda169812fc0ULL,0xfb1a4a9a90660bb6ULL,0x730c196946a4b9b2ULL,0x81e289aa7f49da68ULL,
-	0x64669a0f83b1a05fULL,0x27b3ff7d9644f48bULL,0xcc6b615c8db675b3ULL,0x674f20b9bcebbe95ULL,
-	0x6f31238275655982ULL,0x5ae488713e45cf05ULL,0xbf619f9954c21157ULL,0xeabac46040a8eae9ULL,
-	0x454c6fe9f2c0c1cdULL,0x419cf6496412691cULL,0xd3dc3bef265b0f70ULL,0x6d0e60f5c3578a9eULL,
-};
-
-static const uint64_t t4[256]=
-{
-	0x5b0e608526323c55ULL,0x1a46c1a9fa1b59f5ULL, 0xa9e245a17c4c8ffaULL,0x65ca5159db2955d7ULL,
-	0x05db0a76ce35afc2ULL,0x81eac77ea9113d45ULL, 0x528ef88ab6ac0a0dULL,0xa09ea253597be3ffULL,
-	0x430ddfb3ac48cd56ULL,0xc4b3a67af45ce46fULL, 0x4ececfd8fbe2d05eULL,0x3ef56f10b39935f0ULL,
-	0x0b22d6829cd619c6ULL,0x17fd460a74df2069ULL, 0x6cf8cc8e8510ed40ULL,0xd6c824bf3a6ecaa7ULL,
-	0x61243d581a817049ULL,0x048bacb6bbc163a2ULL, 0xd9a38ac27d44cc32ULL,0x7fddff5baaf410abULL,
-	0xad6d495aa804824bULL,0xe1a6a74f2d8c9f94ULL, 0xd4f7851235dee8e3ULL,0xfd4b7f886540d893ULL,
-	0x247c20042aa4bfdaULL,0x096ea1c517d1327cULL, 0xd56966b4361a6685ULL,0x277da5c31221057dULL,
-	0x94d59893a43acff7ULL,0x64f0c51ccdc02281ULL, 0x3d33bcc4ff6189dbULL,0xe005cb184ce66af1ULL,
-	0xff5ccd1d1db99beaULL,0xb0b854a7fe42980fULL, 0x7bd46a6a718d4b9fULL,0xd10fa8cc22a5fd8cULL,
-	0xd31484952be4bd31ULL,0xc7fa975fcb243847ULL, 0x4886ed1e5846c407ULL,0x28cddb791eb70b04ULL,
-	0xc2b00be2f573417fULL,0x5c9590452180f877ULL, 0x7a6bddfff370eb00ULL,0xce509e38d6d9d6a4ULL,
-	0xebeb0f00647fa702ULL,0x1dcc06cf76606f06ULL, 0xe4d9f28ba286ff0aULL,0xd85a305dc918c262ULL,
-	0x475b1d8732225f54ULL,0x2d4fb51668ccb5feULL, 0xa679b9d9d72bba20ULL,0x53841c0d912d43a5ULL,
-	0x3b7eaa48bf12a4e8ULL,0x781e0e47f22f1ddfULL, 0xeff20ce60ab50973ULL,0x20d261d19dffb742ULL,
-	0x16a12b03062a2e39ULL,0x1960eb2239650495ULL, 0x251c16fed50eb8b8ULL,0x9ac0c330f826016eULL,
-	0xed152665953e7671ULL,0x02d63194a6369570ULL, 0x5074f08394b1c987ULL,0x70ba598c90b25ce1ULL,
-	0x794a15810b9742f6ULL,0x0d5925e9fcaf8c6cULL, 0x3067716cd868744eULL,0x910ab077e8d7731bULL,
-	0x6a61bbdb5ac42f61ULL,0x93513efbf0851567ULL, 0xf494724b9e83e9d5ULL,0xe887e1985c09648dULL,
-	0x34b1d3c675370cfdULL,0xdc35e433bc0d255dULL, 0xd0aab84234131be0ULL,0x08042a50b48b7eafULL,
-	0x9997c4ee44a3ab35ULL,0x829a7b49201799d0ULL, 0x263b8307b7c54441ULL,0x752f95f4fd6a6ca6ULL,
-	0x927217402c08c6e5ULL,0x2a8ab754a795d9eeULL, 0xa442f7552f72943dULL,0x2c31334e19781208ULL,
-	0x4fa98d7ceaee6291ULL,0x55c3862f665db309ULL, 0xbd0610175d53b1f3ULL,0x46fe6cb840413f27ULL,
-	0x3fe03792df0cfa59ULL,0xcfe700372eb85e8fULL, 0xa7be29e7adbce118ULL,0xe544ee5cde8431ddULL,
-	0x8a781b1b41f1873eULL,0xa5c94c78a0d2f0e7ULL, 0x39412e2877b60728ULL,0xa1265ef3afc9a62cULL,
-	0xbcc2770c6a2506c5ULL,0x3ab66dd5dce1ce12ULL, 0xe65499d04a675b37ULL,0x7d8f523481bfd216ULL,
-	0x0f6f64fcec15f389ULL,0x74efbe618b5b13c8ULL, 0xacdc82b714273e1dULL,0xdd40bfe003199d17ULL,
-	0x37e99257e7e061f8ULL,0xfa52626904775aaaULL, 0x8bbbf63a463d56f9ULL,0xf0013f1543a26e64ULL,
-	0xa8307e9f879ec898ULL,0xcc4c27a4150177ccULL, 0x1b432f2cca1d3348ULL,0xde1d1f8f9f6fa013ULL,
-	0x606602a047a7ddd6ULL,0xd237ab64cc1cb2c7ULL, 0x9b938e7225fcd1d3ULL,0xec4e03708e0ff476ULL,
-	0xfeb2fbda3d03c12dULL,0xae0bced2ee43889aULL, 0x22cb8923ebfb4f43ULL,0x69360d013cf7396dULL,
-	0x855e3602d2d4e022ULL,0x073805bad01f784cULL, 0x33e17a133852f546ULL,0xdf4874058ac7b638ULL,
-	0xba92b29c678aa14aULL,0x0ce89fc76cfaadcdULL, 0x5f9d4e0908339e34ULL,0xf1afe9291f5923b9ULL,
-	0x6e3480f60f4a265fULL,0xeebf3a2ab29b841cULL, 0xe21938a88f91b4adULL,0x57dfeff845c6d3c3ULL,
-	0x2f006b0bf62caaf2ULL,0x62f479ef6f75ee78ULL, 0x11a55ad41c8916a9ULL,0xf229d29084fed453ULL,
-	0x42f1c27b16b000e6ULL,0x2b1f76749823c074ULL, 0x4b76eca3c2745360ULL,0x8c98f463b91691bdULL,
-	0x14bcc93cf1ade66aULL,0x8885213e6d458397ULL, 0x8e177df0274d4711ULL,0xb49b73b5503f2951ULL,
-	0x10168168c3f96b6bULL,0x0e3d963b63cab0aeULL, 0x8dfc4b5655a1db14ULL,0xf789f1356e14de5cULL,
-	0x683e68af4e51dac1ULL,0xc9a84f9d8d4b0fd9ULL, 0x3691e03f52a0f9d1ULL,0x5ed86e46e1878e80ULL,
-	0x3c711a0e99d07150ULL,0x5a0865b20c4e9310ULL, 0x56fbfc1fe4f0682eULL,0xea8d5de3105edf9bULL,
-	0x71abfdb12379187aULL,0x2eb99de1bee77b9cULL, 0x21ecc0ea33cf4523ULL,0x59a4d7521805c7a1ULL,
-	0x3896f5eb56ae7c72ULL,0xaa638f3db18f75dcULL, 0x9f39358dabe9808eULL,0xb7defa91c00b72acULL,
-	0x6b5541fd62492d92ULL,0x6dc6dee8f92e4d5bULL, 0x353f57abc4beea7eULL,0x735769d6da5690ceULL,
-	0x0a234aa642391484ULL,0xf6f9508028f80d9dULL, 0xb8e319a27ab3f215ULL,0x31ad9c1151341a4dULL,
-	0x773c22a57bef5805ULL,0x45c7561a07968633ULL, 0xf913da9e249dbe36ULL,0xda652d9b78a64c68ULL,
-	0x4c27a97f3bc334efULL,0x76621220e66b17f4ULL, 0x967743899acd7d0bULL,0xf3ee5bcae0ed6782ULL,
-	0x409f753600c879fcULL,0x06d09a39b5926db6ULL, 0x6f83aeb0317ac588ULL,0x01e6ca4a86381f21ULL,
-	0x66ff3462d19f3025ULL,0x72207c24ddfd3bfbULL, 0x4af6b6d3e2ece2ebULL,0x9c994dbec7ea08deULL,
-	0x49ace597b09a8bc4ULL,0xb38c4766cf0797baULL, 0x131b9373c57c2a75ULL,0xb1822cce61931e58ULL,
-	0x9d7555b909ba1c0cULL,0x127fafdd937d11d2ULL, 0x29da3badc66d92e4ULL,0xa2c1d57154c2ecbcULL,
-	0x58c5134d82f6fe24ULL,0x1c3ae3515b62274fULL, 0xe907c82e01cb8126ULL,0xf8ed091913e37fcbULL,
-	0x3249d8f9c80046c9ULL,0x80cf9bede388fb63ULL, 0x1881539a116cf19eULL,0x5103f3f76bd52457ULL,
-	0x15b7e6f5ae47f7a8ULL,0xdbd7c6ded47e9ccfULL, 0x44e55c410228bb1aULL,0xb647d4255edb4e99ULL,
-	0x5d11882bb8aafc30ULL,0xf5098bbb29d3212aULL, 0x8fb5ea14e90296b3ULL,0x677b942157dd025aULL,
-	0xfb58e7c0a390acb5ULL,0x89d3674c83bd4a01ULL, 0x9e2da4df4bf3b93bULL,0xfcc41e328cab4829ULL,
-	0x03f38c96ba582c52ULL,0xcad1bdbd7fd85db2ULL, 0xbbb442c16082ae83ULL,0xb95fe86ba5da9ab0ULL,
-	0xb22e04673771a93fULL,0x845358c9493152d8ULL, 0xbe2a488697b4541eULL,0x95a2dc2dd38e6966ULL,
-	0xc02c11ac923c852bULL,0x2388b1990df2a87bULL, 0x7c8008fa1b4f37beULL,0x1f70d0c84d54e503ULL,
-	0x5490adec7ece57d4ULL,0x002b3c27d9063a3aULL, 0x7eaea3848030a2bfULL,0xc602326ded2003c0ULL,
-	0x83a7287d69a94086ULL,0xc57a5fcb30f57a8aULL, 0xb56844e479ebe779ULL,0xa373b40f05dcbce9ULL,
-	0xd71a786e88570ee2ULL,0x879cbacdbde8f6a0ULL, 0x976ad1bcc164a32fULL,0xab21e25e9666d78bULL,
-	0x901063aae5e5c33cULL,0x9818b34448698d90ULL, 0xe36487ae3e1e8abbULL,0xafbdf931893bdcb4ULL,
-	0x6345a0dc5fbbd519ULL,0x8628fe269b9465caULL, 0x1e5d01603f9c51ecULL,0x4de44006a15049b7ULL,
-	0xbf6c70e5f776cbb1ULL,0x411218f2ef552bedULL, 0xcb0c0708705a36a3ULL,0xe74d14754f986044ULL,
-	0xcd56d9430ea8280eULL,0xc12591d7535f5065ULL, 0xc83223f1720aef96ULL,0xc3a0396f7363a51fULL,
-}; 
-
-void cryptonite_tiger_init(struct tiger_ctx *ctx)
-{
-	memset(ctx, 0, sizeof(*ctx));
-
-	ctx->h[0] = 0x0123456789abcdefULL;
-	ctx->h[1] = 0xfedcba9876543210ULL;
-	ctx->h[2] = 0xf096a5b4c3b2e187ULL;
-}
-
-static inline void tiger_do_chunk(struct tiger_ctx *ctx, uint64_t *buf)
-{
-	uint64_t x0, x1, x2, x3, x4, x5, x6, x7;
-	uint64_t a,b,c;
-	a = ctx->h[0];
-	b = ctx->h[1];
-	c = ctx->h[2];
-
-	x0 = cpu_to_le64(buf[0]); x1 = cpu_to_le64(buf[1]); x2 = cpu_to_le64(buf[2]); x3 = cpu_to_le64(buf[3]);
-	x4 = cpu_to_le64(buf[4]); x5 = cpu_to_le64(buf[5]); x6 = cpu_to_le64(buf[6]); x7 = cpu_to_le64(buf[7]);
-
-#define BYTEOF(c, n) ((uint8_t) (c >> ((n * 8))))
-
-#define ROUND(a,b,c,x,mul)                                                          \
-	c ^= x;                                                                     \
-	a -= t1[BYTEOF(c,0)] ^ t2[BYTEOF(c,2)] ^ t3[BYTEOF(c,4)] ^ t4[BYTEOF(c,6)]; \
-	b += t4[BYTEOF(c,1)] ^ t3[BYTEOF(c,3)] ^ t2[BYTEOF(c,5)] ^ t1[BYTEOF(c,7)]; \
-	b *= mul;
-
-#define PASS(a,b,c,mul)	     \
-	ROUND(a,b,c,x0,mul); \
-	ROUND(b,c,a,x1,mul); \
-	ROUND(c,a,b,x2,mul); \
-	ROUND(a,b,c,x3,mul); \
-	ROUND(b,c,a,x4,mul); \
-	ROUND(c,a,b,x5,mul); \
-	ROUND(a,b,c,x6,mul); \
-	ROUND(b,c,a,x7,mul)
-
-#define SCHEDULE()                        \
-	x0 -= x7 ^ 0xa5a5a5a5a5a5a5a5ULL; \
-	x1 ^= x0;                         \
-	x2 += x1;                         \
-	x3 -= x2 ^ ((~x1)<<19);           \
-	x4 ^= x3;                         \
-	x5 += x4;                         \
-	x6 -= x5 ^ ((~x4)>>23);           \
-	x7 ^= x6;                         \
-	x0 += x7;                         \
-	x1 -= x0 ^ ((~x7)<<19);           \
-	x2 ^= x1;                         \
-	x3 += x2;                         \
-	x4 -= x3 ^ ((~x2)>>23);           \
-	x5 ^= x4;                         \
-	x6 += x5;                         \
-	x7 -= x6 ^ 0x0123456789abcdefULL
-
-	PASS(a,b,c,5);
-	SCHEDULE();
-	PASS(c,a,b,7);
-	SCHEDULE();
-	PASS(b,c,a,9);
-
-	ctx->h[0] ^= a;
-	ctx->h[1] = b - ctx->h[1];
-	ctx->h[2] += c;
-}
-
-void cryptonite_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len)
-{
-	uint32_t index, to_fill;
-
-	index = (uint32_t) (ctx->sz & 0x3f);
-	to_fill = 64 - index;
-
-	ctx->sz += len;
-
-	/* process partial buffer if there's enough data to make a block */
-	if (index && len >= to_fill) {
-		memcpy(ctx->buf + index, data, to_fill);
-		tiger_do_chunk(ctx, (uint64_t *) ctx->buf);
-		len -= to_fill;
-		data += to_fill;
-		index = 0;
-	}
-
-	if (need_alignment(data, 8)) {
-		uint64_t tramp[8];
-		ASSERT_ALIGNMENT(tramp, 8);
-		for (; len >= 64; len -= 64, data += 64) {
-			memcpy(tramp, data, 64);
-			tiger_do_chunk(ctx, tramp);
-		}
-	} else {
-		/* process as much 64-block as possible */
-		for (; len >= 64; len -= 64, data += 64)
-			tiger_do_chunk(ctx, (uint64_t *) data);
-	}
-
-	/* append data into buf */
-	if (len)
-		memcpy(ctx->buf + index, data, len);
-}
-
-void cryptonite_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out)
-{
-	static uint8_t padding[64] = { 0x01, };
-	uint64_t bits;
-	uint32_t index, padlen;
-
-	/* add padding and update data with it */
-	bits = cpu_to_le64(ctx->sz << 3);
-
-	/* pad out to 56 */
-	index = (uint32_t) (ctx->sz & 0x3f);
-	padlen = (index < 56) ? (56 - index) : ((64 + 56) - index);
-	cryptonite_tiger_update(ctx, padding, padlen);
-
-	/* append length */
-	cryptonite_tiger_update(ctx, (uint8_t *) &bits, sizeof(bits));
-
-	/* output hash */
-	store_le64(out   , ctx->h[0]);
-	store_le64(out+ 8, ctx->h[1]);
-	store_le64(out+16, ctx->h[2]);
-}
diff --git a/cbits/cryptonite_tiger.h b/cbits/cryptonite_tiger.h
deleted file mode 100644
--- a/cbits/cryptonite_tiger.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) 2006-2009 Vincent Hanquez <vincent@snarc.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-#ifndef CRYPTOHASH_TIGER_H
-#define CRYPTOHASH_TIGER_H
-
-#include <stdint.h>
-
-struct tiger_ctx
-{
-	uint64_t sz;
-	uint8_t  buf[64];
-	uint64_t h[3];
-};
-
-#define TIGER_DIGEST_SIZE	24
-#define TIGER_CTX_SIZE 		(sizeof(struct tiger_ctx))
-
-void cryptonite_tiger_init(struct tiger_ctx *ctx);
-void cryptonite_tiger_update(struct tiger_ctx *ctx, const uint8_t *data, uint32_t len);
-void cryptonite_tiger_finalize(struct tiger_ctx *ctx, uint8_t *out);
-
-#endif
diff --git a/cbits/cryptonite_whirlpool.c b/cbits/cryptonite_whirlpool.c
deleted file mode 100644
--- a/cbits/cryptonite_whirlpool.c
+++ /dev/null
@@ -1,1026 +0,0 @@
-/**
- * The Whirlpool hashing function.
- *
- * <P>
- * <b>References</b>
- *
- * <P>
- * The Whirlpool algorithm was developed by
- * <a href="mailto:pbarreto@scopus.com.br">Paulo S. L. M. Barreto</a> and
- * <a href="mailto:vincent.rijmen@cryptomathic.com">Vincent Rijmen</a>.
- *
- * See
- *      P.S.L.M. Barreto, V. Rijmen,
- *      ``The Whirlpool hashing function,''
- *      NESSIE submission, 2000 (tweaked version, 2001),
- *      <https://www.cosic.esat.kuleuven.ac.be/nessie/workshop/submissions/whirlpool.zip>
- * 
- * @author  Paulo S.L.M. Barreto
- * @author  Vincent Rijmen.
- *
- * @version 3.0 (2003.03.12)
- *
- * =============================================================================
- *
- * Differences from version 2.1:
- *
- * - Suboptimal diffusion matrix replaced by cir(1, 1, 4, 1, 8, 5, 2, 9).
- *
- * =============================================================================
- *
- * Differences from version 2.0:
- *
- * - Generation of ISO/IEC 10118-3 test vectors.
- * - Bug fix: nonzero carry was ignored when tallying the data length
- *      (this bug apparently only manifested itself when feeding data
- *      in pieces rather than in a single chunk at once).
- * - Support for MS Visual C++ 64-bit integer arithmetic.
- *
- * Differences from version 1.0:
- *
- * - Original S-box replaced by the tweaked, hardware-efficient version.
- *
- * =============================================================================
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
- * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
- * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
- * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
- * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-/* Modified by Stijn van Drongelen for use in the cryptohash library.
-*/
-
-#include <stdlib.h>
-#include <string.h>
-
-#include "cryptonite_bitfn.h"
-#include "cryptonite_whirlpool.h"
-
-/* #define TRACE_INTERMEDIATE_VALUES */
-
-/*
- * The number of rounds of the internal dedicated block cipher.
- */
-#define R 10
-
-/*
- * Though Whirlpool is endianness-neutral, the encryption tables are listed
- * in BIG-ENDIAN format, which is adopted throughout this implementation
- * (but little-endian notation would be equally suitable if consistently
- * employed).
- */
-
-static const uint64_t C0[256] = {
-	0x18186018c07830d8ULL, 0x23238c2305af4626ULL, 0xc6c63fc67ef991b8ULL, 0xe8e887e8136fcdfbULL,
-	0x878726874ca113cbULL, 0xb8b8dab8a9626d11ULL, 0x0101040108050209ULL, 0x4f4f214f426e9e0dULL,
-	0x3636d836adee6c9bULL, 0xa6a6a2a6590451ffULL, 0xd2d26fd2debdb90cULL, 0xf5f5f3f5fb06f70eULL,
-	0x7979f979ef80f296ULL, 0x6f6fa16f5fcede30ULL, 0x91917e91fcef3f6dULL, 0x52525552aa07a4f8ULL,
-	0x60609d6027fdc047ULL, 0xbcbccabc89766535ULL, 0x9b9b569baccd2b37ULL, 0x8e8e028e048c018aULL,
-	0xa3a3b6a371155bd2ULL, 0x0c0c300c603c186cULL, 0x7b7bf17bff8af684ULL, 0x3535d435b5e16a80ULL,
-	0x1d1d741de8693af5ULL, 0xe0e0a7e05347ddb3ULL, 0xd7d77bd7f6acb321ULL, 0xc2c22fc25eed999cULL,
-	0x2e2eb82e6d965c43ULL, 0x4b4b314b627a9629ULL, 0xfefedffea321e15dULL, 0x575741578216aed5ULL,
-	0x15155415a8412abdULL, 0x7777c1779fb6eee8ULL, 0x3737dc37a5eb6e92ULL, 0xe5e5b3e57b56d79eULL,
-	0x9f9f469f8cd92313ULL, 0xf0f0e7f0d317fd23ULL, 0x4a4a354a6a7f9420ULL, 0xdada4fda9e95a944ULL,
-	0x58587d58fa25b0a2ULL, 0xc9c903c906ca8fcfULL, 0x2929a429558d527cULL, 0x0a0a280a5022145aULL,
-	0xb1b1feb1e14f7f50ULL, 0xa0a0baa0691a5dc9ULL, 0x6b6bb16b7fdad614ULL, 0x85852e855cab17d9ULL,
-	0xbdbdcebd8173673cULL, 0x5d5d695dd234ba8fULL, 0x1010401080502090ULL, 0xf4f4f7f4f303f507ULL,
-	0xcbcb0bcb16c08bddULL, 0x3e3ef83eedc67cd3ULL, 0x0505140528110a2dULL, 0x676781671fe6ce78ULL,
-	0xe4e4b7e47353d597ULL, 0x27279c2725bb4e02ULL, 0x4141194132588273ULL, 0x8b8b168b2c9d0ba7ULL,
-	0xa7a7a6a7510153f6ULL, 0x7d7de97dcf94fab2ULL, 0x95956e95dcfb3749ULL, 0xd8d847d88e9fad56ULL,
-	0xfbfbcbfb8b30eb70ULL, 0xeeee9fee2371c1cdULL, 0x7c7ced7cc791f8bbULL, 0x6666856617e3cc71ULL,
-	0xdddd53dda68ea77bULL, 0x17175c17b84b2eafULL, 0x4747014702468e45ULL, 0x9e9e429e84dc211aULL,
-	0xcaca0fca1ec589d4ULL, 0x2d2db42d75995a58ULL, 0xbfbfc6bf9179632eULL, 0x07071c07381b0e3fULL,
-	0xadad8ead012347acULL, 0x5a5a755aea2fb4b0ULL, 0x838336836cb51befULL, 0x3333cc3385ff66b6ULL,
-	0x636391633ff2c65cULL, 0x02020802100a0412ULL, 0xaaaa92aa39384993ULL, 0x7171d971afa8e2deULL,
-	0xc8c807c80ecf8dc6ULL, 0x19196419c87d32d1ULL, 0x494939497270923bULL, 0xd9d943d9869aaf5fULL,
-	0xf2f2eff2c31df931ULL, 0xe3e3abe34b48dba8ULL, 0x5b5b715be22ab6b9ULL, 0x88881a8834920dbcULL,
-	0x9a9a529aa4c8293eULL, 0x262698262dbe4c0bULL, 0x3232c8328dfa64bfULL, 0xb0b0fab0e94a7d59ULL,
-	0xe9e983e91b6acff2ULL, 0x0f0f3c0f78331e77ULL, 0xd5d573d5e6a6b733ULL, 0x80803a8074ba1df4ULL,
-	0xbebec2be997c6127ULL, 0xcdcd13cd26de87ebULL, 0x3434d034bde46889ULL, 0x48483d487a759032ULL,
-	0xffffdbffab24e354ULL, 0x7a7af57af78ff48dULL, 0x90907a90f4ea3d64ULL, 0x5f5f615fc23ebe9dULL,
-	0x202080201da0403dULL, 0x6868bd6867d5d00fULL, 0x1a1a681ad07234caULL, 0xaeae82ae192c41b7ULL,
-	0xb4b4eab4c95e757dULL, 0x54544d549a19a8ceULL, 0x93937693ece53b7fULL, 0x222288220daa442fULL,
-	0x64648d6407e9c863ULL, 0xf1f1e3f1db12ff2aULL, 0x7373d173bfa2e6ccULL, 0x12124812905a2482ULL,
-	0x40401d403a5d807aULL, 0x0808200840281048ULL, 0xc3c32bc356e89b95ULL, 0xecec97ec337bc5dfULL,
-	0xdbdb4bdb9690ab4dULL, 0xa1a1bea1611f5fc0ULL, 0x8d8d0e8d1c830791ULL, 0x3d3df43df5c97ac8ULL,
-	0x97976697ccf1335bULL, 0x0000000000000000ULL, 0xcfcf1bcf36d483f9ULL, 0x2b2bac2b4587566eULL,
-	0x7676c57697b3ece1ULL, 0x8282328264b019e6ULL, 0xd6d67fd6fea9b128ULL, 0x1b1b6c1bd87736c3ULL,
-	0xb5b5eeb5c15b7774ULL, 0xafaf86af112943beULL, 0x6a6ab56a77dfd41dULL, 0x50505d50ba0da0eaULL,
-	0x45450945124c8a57ULL, 0xf3f3ebf3cb18fb38ULL, 0x3030c0309df060adULL, 0xefef9bef2b74c3c4ULL,
-	0x3f3ffc3fe5c37edaULL, 0x55554955921caac7ULL, 0xa2a2b2a2791059dbULL, 0xeaea8fea0365c9e9ULL,
-	0x656589650fecca6aULL, 0xbabad2bab9686903ULL, 0x2f2fbc2f65935e4aULL, 0xc0c027c04ee79d8eULL,
-	0xdede5fdebe81a160ULL, 0x1c1c701ce06c38fcULL, 0xfdfdd3fdbb2ee746ULL, 0x4d4d294d52649a1fULL,
-	0x92927292e4e03976ULL, 0x7575c9758fbceafaULL, 0x06061806301e0c36ULL, 0x8a8a128a249809aeULL,
-	0xb2b2f2b2f940794bULL, 0xe6e6bfe66359d185ULL, 0x0e0e380e70361c7eULL, 0x1f1f7c1ff8633ee7ULL,
-	0x6262956237f7c455ULL, 0xd4d477d4eea3b53aULL, 0xa8a89aa829324d81ULL, 0x96966296c4f43152ULL,
-	0xf9f9c3f99b3aef62ULL, 0xc5c533c566f697a3ULL, 0x2525942535b14a10ULL, 0x59597959f220b2abULL,
-	0x84842a8454ae15d0ULL, 0x7272d572b7a7e4c5ULL, 0x3939e439d5dd72ecULL, 0x4c4c2d4c5a619816ULL,
-	0x5e5e655eca3bbc94ULL, 0x7878fd78e785f09fULL, 0x3838e038ddd870e5ULL, 0x8c8c0a8c14860598ULL,
-	0xd1d163d1c6b2bf17ULL, 0xa5a5aea5410b57e4ULL, 0xe2e2afe2434dd9a1ULL, 0x616199612ff8c24eULL,
-	0xb3b3f6b3f1457b42ULL, 0x2121842115a54234ULL, 0x9c9c4a9c94d62508ULL, 0x1e1e781ef0663ceeULL,
-	0x4343114322528661ULL, 0xc7c73bc776fc93b1ULL, 0xfcfcd7fcb32be54fULL, 0x0404100420140824ULL,
-	0x51515951b208a2e3ULL, 0x99995e99bcc72f25ULL, 0x6d6da96d4fc4da22ULL, 0x0d0d340d68391a65ULL,
-	0xfafacffa8335e979ULL, 0xdfdf5bdfb684a369ULL, 0x7e7ee57ed79bfca9ULL, 0x242490243db44819ULL,
-	0x3b3bec3bc5d776feULL, 0xabab96ab313d4b9aULL, 0xcece1fce3ed181f0ULL, 0x1111441188552299ULL,
-	0x8f8f068f0c890383ULL, 0x4e4e254e4a6b9c04ULL, 0xb7b7e6b7d1517366ULL, 0xebeb8beb0b60cbe0ULL,
-	0x3c3cf03cfdcc78c1ULL, 0x81813e817cbf1ffdULL, 0x94946a94d4fe3540ULL, 0xf7f7fbf7eb0cf31cULL,
-	0xb9b9deb9a1676f18ULL, 0x13134c13985f268bULL, 0x2c2cb02c7d9c5851ULL, 0xd3d36bd3d6b8bb05ULL,
-	0xe7e7bbe76b5cd38cULL, 0x6e6ea56e57cbdc39ULL, 0xc4c437c46ef395aaULL, 0x03030c03180f061bULL,
-	0x565645568a13acdcULL, 0x44440d441a49885eULL, 0x7f7fe17fdf9efea0ULL, 0xa9a99ea921374f88ULL,
-	0x2a2aa82a4d825467ULL, 0xbbbbd6bbb16d6b0aULL, 0xc1c123c146e29f87ULL, 0x53535153a202a6f1ULL,
-	0xdcdc57dcae8ba572ULL, 0x0b0b2c0b58271653ULL, 0x9d9d4e9d9cd32701ULL, 0x6c6cad6c47c1d82bULL,
-	0x3131c43195f562a4ULL, 0x7474cd7487b9e8f3ULL, 0xf6f6fff6e309f115ULL, 0x464605460a438c4cULL,
-	0xacac8aac092645a5ULL, 0x89891e893c970fb5ULL, 0x14145014a04428b4ULL, 0xe1e1a3e15b42dfbaULL,
-	0x16165816b04e2ca6ULL, 0x3a3ae83acdd274f7ULL, 0x6969b9696fd0d206ULL, 0x09092409482d1241ULL,
-	0x7070dd70a7ade0d7ULL, 0xb6b6e2b6d954716fULL, 0xd0d067d0ceb7bd1eULL, 0xeded93ed3b7ec7d6ULL,
-	0xcccc17cc2edb85e2ULL, 0x424215422a578468ULL, 0x98985a98b4c22d2cULL, 0xa4a4aaa4490e55edULL,
-	0x2828a0285d885075ULL, 0x5c5c6d5cda31b886ULL, 0xf8f8c7f8933fed6bULL, 0x8686228644a411c2ULL,
-};
-
-static const uint64_t C1[256] = {
-	0xd818186018c07830ULL, 0x2623238c2305af46ULL, 0xb8c6c63fc67ef991ULL, 0xfbe8e887e8136fcdULL,
-	0xcb878726874ca113ULL, 0x11b8b8dab8a9626dULL, 0x0901010401080502ULL, 0x0d4f4f214f426e9eULL,
-	0x9b3636d836adee6cULL, 0xffa6a6a2a6590451ULL, 0x0cd2d26fd2debdb9ULL, 0x0ef5f5f3f5fb06f7ULL,
-	0x967979f979ef80f2ULL, 0x306f6fa16f5fcedeULL, 0x6d91917e91fcef3fULL, 0xf852525552aa07a4ULL,
-	0x4760609d6027fdc0ULL, 0x35bcbccabc897665ULL, 0x379b9b569baccd2bULL, 0x8a8e8e028e048c01ULL,
-	0xd2a3a3b6a371155bULL, 0x6c0c0c300c603c18ULL, 0x847b7bf17bff8af6ULL, 0x803535d435b5e16aULL,
-	0xf51d1d741de8693aULL, 0xb3e0e0a7e05347ddULL, 0x21d7d77bd7f6acb3ULL, 0x9cc2c22fc25eed99ULL,
-	0x432e2eb82e6d965cULL, 0x294b4b314b627a96ULL, 0x5dfefedffea321e1ULL, 0xd5575741578216aeULL,
-	0xbd15155415a8412aULL, 0xe87777c1779fb6eeULL, 0x923737dc37a5eb6eULL, 0x9ee5e5b3e57b56d7ULL,
-	0x139f9f469f8cd923ULL, 0x23f0f0e7f0d317fdULL, 0x204a4a354a6a7f94ULL, 0x44dada4fda9e95a9ULL,
-	0xa258587d58fa25b0ULL, 0xcfc9c903c906ca8fULL, 0x7c2929a429558d52ULL, 0x5a0a0a280a502214ULL,
-	0x50b1b1feb1e14f7fULL, 0xc9a0a0baa0691a5dULL, 0x146b6bb16b7fdad6ULL, 0xd985852e855cab17ULL,
-	0x3cbdbdcebd817367ULL, 0x8f5d5d695dd234baULL, 0x9010104010805020ULL, 0x07f4f4f7f4f303f5ULL,
-	0xddcbcb0bcb16c08bULL, 0xd33e3ef83eedc67cULL, 0x2d0505140528110aULL, 0x78676781671fe6ceULL,
-	0x97e4e4b7e47353d5ULL, 0x0227279c2725bb4eULL, 0x7341411941325882ULL, 0xa78b8b168b2c9d0bULL,
-	0xf6a7a7a6a7510153ULL, 0xb27d7de97dcf94faULL, 0x4995956e95dcfb37ULL, 0x56d8d847d88e9fadULL,
-	0x70fbfbcbfb8b30ebULL, 0xcdeeee9fee2371c1ULL, 0xbb7c7ced7cc791f8ULL, 0x716666856617e3ccULL,
-	0x7bdddd53dda68ea7ULL, 0xaf17175c17b84b2eULL, 0x454747014702468eULL, 0x1a9e9e429e84dc21ULL,
-	0xd4caca0fca1ec589ULL, 0x582d2db42d75995aULL, 0x2ebfbfc6bf917963ULL, 0x3f07071c07381b0eULL,
-	0xacadad8ead012347ULL, 0xb05a5a755aea2fb4ULL, 0xef838336836cb51bULL, 0xb63333cc3385ff66ULL,
-	0x5c636391633ff2c6ULL, 0x1202020802100a04ULL, 0x93aaaa92aa393849ULL, 0xde7171d971afa8e2ULL,
-	0xc6c8c807c80ecf8dULL, 0xd119196419c87d32ULL, 0x3b49493949727092ULL, 0x5fd9d943d9869aafULL,
-	0x31f2f2eff2c31df9ULL, 0xa8e3e3abe34b48dbULL, 0xb95b5b715be22ab6ULL, 0xbc88881a8834920dULL,
-	0x3e9a9a529aa4c829ULL, 0x0b262698262dbe4cULL, 0xbf3232c8328dfa64ULL, 0x59b0b0fab0e94a7dULL,
-	0xf2e9e983e91b6acfULL, 0x770f0f3c0f78331eULL, 0x33d5d573d5e6a6b7ULL, 0xf480803a8074ba1dULL,
-	0x27bebec2be997c61ULL, 0xebcdcd13cd26de87ULL, 0x893434d034bde468ULL, 0x3248483d487a7590ULL,
-	0x54ffffdbffab24e3ULL, 0x8d7a7af57af78ff4ULL, 0x6490907a90f4ea3dULL, 0x9d5f5f615fc23ebeULL,
-	0x3d202080201da040ULL, 0x0f6868bd6867d5d0ULL, 0xca1a1a681ad07234ULL, 0xb7aeae82ae192c41ULL,
-	0x7db4b4eab4c95e75ULL, 0xce54544d549a19a8ULL, 0x7f93937693ece53bULL, 0x2f222288220daa44ULL,
-	0x6364648d6407e9c8ULL, 0x2af1f1e3f1db12ffULL, 0xcc7373d173bfa2e6ULL, 0x8212124812905a24ULL,
-	0x7a40401d403a5d80ULL, 0x4808082008402810ULL, 0x95c3c32bc356e89bULL, 0xdfecec97ec337bc5ULL,
-	0x4ddbdb4bdb9690abULL, 0xc0a1a1bea1611f5fULL, 0x918d8d0e8d1c8307ULL, 0xc83d3df43df5c97aULL,
-	0x5b97976697ccf133ULL, 0x0000000000000000ULL, 0xf9cfcf1bcf36d483ULL, 0x6e2b2bac2b458756ULL,
-	0xe17676c57697b3ecULL, 0xe68282328264b019ULL, 0x28d6d67fd6fea9b1ULL, 0xc31b1b6c1bd87736ULL,
-	0x74b5b5eeb5c15b77ULL, 0xbeafaf86af112943ULL, 0x1d6a6ab56a77dfd4ULL, 0xea50505d50ba0da0ULL,
-	0x5745450945124c8aULL, 0x38f3f3ebf3cb18fbULL, 0xad3030c0309df060ULL, 0xc4efef9bef2b74c3ULL,
-	0xda3f3ffc3fe5c37eULL, 0xc755554955921caaULL, 0xdba2a2b2a2791059ULL, 0xe9eaea8fea0365c9ULL,
-	0x6a656589650feccaULL, 0x03babad2bab96869ULL, 0x4a2f2fbc2f65935eULL, 0x8ec0c027c04ee79dULL,
-	0x60dede5fdebe81a1ULL, 0xfc1c1c701ce06c38ULL, 0x46fdfdd3fdbb2ee7ULL, 0x1f4d4d294d52649aULL,
-	0x7692927292e4e039ULL, 0xfa7575c9758fbceaULL, 0x3606061806301e0cULL, 0xae8a8a128a249809ULL,
-	0x4bb2b2f2b2f94079ULL, 0x85e6e6bfe66359d1ULL, 0x7e0e0e380e70361cULL, 0xe71f1f7c1ff8633eULL,
-	0x556262956237f7c4ULL, 0x3ad4d477d4eea3b5ULL, 0x81a8a89aa829324dULL, 0x5296966296c4f431ULL,
-	0x62f9f9c3f99b3aefULL, 0xa3c5c533c566f697ULL, 0x102525942535b14aULL, 0xab59597959f220b2ULL,
-	0xd084842a8454ae15ULL, 0xc57272d572b7a7e4ULL, 0xec3939e439d5dd72ULL, 0x164c4c2d4c5a6198ULL,
-	0x945e5e655eca3bbcULL, 0x9f7878fd78e785f0ULL, 0xe53838e038ddd870ULL, 0x988c8c0a8c148605ULL,
-	0x17d1d163d1c6b2bfULL, 0xe4a5a5aea5410b57ULL, 0xa1e2e2afe2434dd9ULL, 0x4e616199612ff8c2ULL,
-	0x42b3b3f6b3f1457bULL, 0x342121842115a542ULL, 0x089c9c4a9c94d625ULL, 0xee1e1e781ef0663cULL,
-	0x6143431143225286ULL, 0xb1c7c73bc776fc93ULL, 0x4ffcfcd7fcb32be5ULL, 0x2404041004201408ULL,
-	0xe351515951b208a2ULL, 0x2599995e99bcc72fULL, 0x226d6da96d4fc4daULL, 0x650d0d340d68391aULL,
-	0x79fafacffa8335e9ULL, 0x69dfdf5bdfb684a3ULL, 0xa97e7ee57ed79bfcULL, 0x19242490243db448ULL,
-	0xfe3b3bec3bc5d776ULL, 0x9aabab96ab313d4bULL, 0xf0cece1fce3ed181ULL, 0x9911114411885522ULL,
-	0x838f8f068f0c8903ULL, 0x044e4e254e4a6b9cULL, 0x66b7b7e6b7d15173ULL, 0xe0ebeb8beb0b60cbULL,
-	0xc13c3cf03cfdcc78ULL, 0xfd81813e817cbf1fULL, 0x4094946a94d4fe35ULL, 0x1cf7f7fbf7eb0cf3ULL,
-	0x18b9b9deb9a1676fULL, 0x8b13134c13985f26ULL, 0x512c2cb02c7d9c58ULL, 0x05d3d36bd3d6b8bbULL,
-	0x8ce7e7bbe76b5cd3ULL, 0x396e6ea56e57cbdcULL, 0xaac4c437c46ef395ULL, 0x1b03030c03180f06ULL,
-	0xdc565645568a13acULL, 0x5e44440d441a4988ULL, 0xa07f7fe17fdf9efeULL, 0x88a9a99ea921374fULL,
-	0x672a2aa82a4d8254ULL, 0x0abbbbd6bbb16d6bULL, 0x87c1c123c146e29fULL, 0xf153535153a202a6ULL,
-	0x72dcdc57dcae8ba5ULL, 0x530b0b2c0b582716ULL, 0x019d9d4e9d9cd327ULL, 0x2b6c6cad6c47c1d8ULL,
-	0xa43131c43195f562ULL, 0xf37474cd7487b9e8ULL, 0x15f6f6fff6e309f1ULL, 0x4c464605460a438cULL,
-	0xa5acac8aac092645ULL, 0xb589891e893c970fULL, 0xb414145014a04428ULL, 0xbae1e1a3e15b42dfULL,
-	0xa616165816b04e2cULL, 0xf73a3ae83acdd274ULL, 0x066969b9696fd0d2ULL, 0x4109092409482d12ULL,
-	0xd77070dd70a7ade0ULL, 0x6fb6b6e2b6d95471ULL, 0x1ed0d067d0ceb7bdULL, 0xd6eded93ed3b7ec7ULL,
-	0xe2cccc17cc2edb85ULL, 0x68424215422a5784ULL, 0x2c98985a98b4c22dULL, 0xeda4a4aaa4490e55ULL,
-	0x752828a0285d8850ULL, 0x865c5c6d5cda31b8ULL, 0x6bf8f8c7f8933fedULL, 0xc28686228644a411ULL,
-};
-
-static const uint64_t C2[256] = {
-	0x30d818186018c078ULL, 0x462623238c2305afULL, 0x91b8c6c63fc67ef9ULL, 0xcdfbe8e887e8136fULL,
-	0x13cb878726874ca1ULL, 0x6d11b8b8dab8a962ULL, 0x0209010104010805ULL, 0x9e0d4f4f214f426eULL,
-	0x6c9b3636d836adeeULL, 0x51ffa6a6a2a65904ULL, 0xb90cd2d26fd2debdULL, 0xf70ef5f5f3f5fb06ULL,
-	0xf2967979f979ef80ULL, 0xde306f6fa16f5fceULL, 0x3f6d91917e91fcefULL, 0xa4f852525552aa07ULL,
-	0xc04760609d6027fdULL, 0x6535bcbccabc8976ULL, 0x2b379b9b569baccdULL, 0x018a8e8e028e048cULL,
-	0x5bd2a3a3b6a37115ULL, 0x186c0c0c300c603cULL, 0xf6847b7bf17bff8aULL, 0x6a803535d435b5e1ULL,
-	0x3af51d1d741de869ULL, 0xddb3e0e0a7e05347ULL, 0xb321d7d77bd7f6acULL, 0x999cc2c22fc25eedULL,
-	0x5c432e2eb82e6d96ULL, 0x96294b4b314b627aULL, 0xe15dfefedffea321ULL, 0xaed5575741578216ULL,
-	0x2abd15155415a841ULL, 0xeee87777c1779fb6ULL, 0x6e923737dc37a5ebULL, 0xd79ee5e5b3e57b56ULL,
-	0x23139f9f469f8cd9ULL, 0xfd23f0f0e7f0d317ULL, 0x94204a4a354a6a7fULL, 0xa944dada4fda9e95ULL,
-	0xb0a258587d58fa25ULL, 0x8fcfc9c903c906caULL, 0x527c2929a429558dULL, 0x145a0a0a280a5022ULL,
-	0x7f50b1b1feb1e14fULL, 0x5dc9a0a0baa0691aULL, 0xd6146b6bb16b7fdaULL, 0x17d985852e855cabULL,
-	0x673cbdbdcebd8173ULL, 0xba8f5d5d695dd234ULL, 0x2090101040108050ULL, 0xf507f4f4f7f4f303ULL,
-	0x8bddcbcb0bcb16c0ULL, 0x7cd33e3ef83eedc6ULL, 0x0a2d050514052811ULL, 0xce78676781671fe6ULL,
-	0xd597e4e4b7e47353ULL, 0x4e0227279c2725bbULL, 0x8273414119413258ULL, 0x0ba78b8b168b2c9dULL,
-	0x53f6a7a7a6a75101ULL, 0xfab27d7de97dcf94ULL, 0x374995956e95dcfbULL, 0xad56d8d847d88e9fULL,
-	0xeb70fbfbcbfb8b30ULL, 0xc1cdeeee9fee2371ULL, 0xf8bb7c7ced7cc791ULL, 0xcc716666856617e3ULL,
-	0xa77bdddd53dda68eULL, 0x2eaf17175c17b84bULL, 0x8e45474701470246ULL, 0x211a9e9e429e84dcULL,
-	0x89d4caca0fca1ec5ULL, 0x5a582d2db42d7599ULL, 0x632ebfbfc6bf9179ULL, 0x0e3f07071c07381bULL,
-	0x47acadad8ead0123ULL, 0xb4b05a5a755aea2fULL, 0x1bef838336836cb5ULL, 0x66b63333cc3385ffULL,
-	0xc65c636391633ff2ULL, 0x041202020802100aULL, 0x4993aaaa92aa3938ULL, 0xe2de7171d971afa8ULL,
-	0x8dc6c8c807c80ecfULL, 0x32d119196419c87dULL, 0x923b494939497270ULL, 0xaf5fd9d943d9869aULL,
-	0xf931f2f2eff2c31dULL, 0xdba8e3e3abe34b48ULL, 0xb6b95b5b715be22aULL, 0x0dbc88881a883492ULL,
-	0x293e9a9a529aa4c8ULL, 0x4c0b262698262dbeULL, 0x64bf3232c8328dfaULL, 0x7d59b0b0fab0e94aULL,
-	0xcff2e9e983e91b6aULL, 0x1e770f0f3c0f7833ULL, 0xb733d5d573d5e6a6ULL, 0x1df480803a8074baULL,
-	0x6127bebec2be997cULL, 0x87ebcdcd13cd26deULL, 0x68893434d034bde4ULL, 0x903248483d487a75ULL,
-	0xe354ffffdbffab24ULL, 0xf48d7a7af57af78fULL, 0x3d6490907a90f4eaULL, 0xbe9d5f5f615fc23eULL,
-	0x403d202080201da0ULL, 0xd00f6868bd6867d5ULL, 0x34ca1a1a681ad072ULL, 0x41b7aeae82ae192cULL,
-	0x757db4b4eab4c95eULL, 0xa8ce54544d549a19ULL, 0x3b7f93937693ece5ULL, 0x442f222288220daaULL,
-	0xc86364648d6407e9ULL, 0xff2af1f1e3f1db12ULL, 0xe6cc7373d173bfa2ULL, 0x248212124812905aULL,
-	0x807a40401d403a5dULL, 0x1048080820084028ULL, 0x9b95c3c32bc356e8ULL, 0xc5dfecec97ec337bULL,
-	0xab4ddbdb4bdb9690ULL, 0x5fc0a1a1bea1611fULL, 0x07918d8d0e8d1c83ULL, 0x7ac83d3df43df5c9ULL,
-	0x335b97976697ccf1ULL, 0x0000000000000000ULL, 0x83f9cfcf1bcf36d4ULL, 0x566e2b2bac2b4587ULL,
-	0xece17676c57697b3ULL, 0x19e68282328264b0ULL, 0xb128d6d67fd6fea9ULL, 0x36c31b1b6c1bd877ULL,
-	0x7774b5b5eeb5c15bULL, 0x43beafaf86af1129ULL, 0xd41d6a6ab56a77dfULL, 0xa0ea50505d50ba0dULL,
-	0x8a5745450945124cULL, 0xfb38f3f3ebf3cb18ULL, 0x60ad3030c0309df0ULL, 0xc3c4efef9bef2b74ULL,
-	0x7eda3f3ffc3fe5c3ULL, 0xaac755554955921cULL, 0x59dba2a2b2a27910ULL, 0xc9e9eaea8fea0365ULL,
-	0xca6a656589650fecULL, 0x6903babad2bab968ULL, 0x5e4a2f2fbc2f6593ULL, 0x9d8ec0c027c04ee7ULL,
-	0xa160dede5fdebe81ULL, 0x38fc1c1c701ce06cULL, 0xe746fdfdd3fdbb2eULL, 0x9a1f4d4d294d5264ULL,
-	0x397692927292e4e0ULL, 0xeafa7575c9758fbcULL, 0x0c3606061806301eULL, 0x09ae8a8a128a2498ULL,
-	0x794bb2b2f2b2f940ULL, 0xd185e6e6bfe66359ULL, 0x1c7e0e0e380e7036ULL, 0x3ee71f1f7c1ff863ULL,
-	0xc4556262956237f7ULL, 0xb53ad4d477d4eea3ULL, 0x4d81a8a89aa82932ULL, 0x315296966296c4f4ULL,
-	0xef62f9f9c3f99b3aULL, 0x97a3c5c533c566f6ULL, 0x4a102525942535b1ULL, 0xb2ab59597959f220ULL,
-	0x15d084842a8454aeULL, 0xe4c57272d572b7a7ULL, 0x72ec3939e439d5ddULL, 0x98164c4c2d4c5a61ULL,
-	0xbc945e5e655eca3bULL, 0xf09f7878fd78e785ULL, 0x70e53838e038ddd8ULL, 0x05988c8c0a8c1486ULL,
-	0xbf17d1d163d1c6b2ULL, 0x57e4a5a5aea5410bULL, 0xd9a1e2e2afe2434dULL, 0xc24e616199612ff8ULL,
-	0x7b42b3b3f6b3f145ULL, 0x42342121842115a5ULL, 0x25089c9c4a9c94d6ULL, 0x3cee1e1e781ef066ULL,
-	0x8661434311432252ULL, 0x93b1c7c73bc776fcULL, 0xe54ffcfcd7fcb32bULL, 0x0824040410042014ULL,
-	0xa2e351515951b208ULL, 0x2f2599995e99bcc7ULL, 0xda226d6da96d4fc4ULL, 0x1a650d0d340d6839ULL,
-	0xe979fafacffa8335ULL, 0xa369dfdf5bdfb684ULL, 0xfca97e7ee57ed79bULL, 0x4819242490243db4ULL,
-	0x76fe3b3bec3bc5d7ULL, 0x4b9aabab96ab313dULL, 0x81f0cece1fce3ed1ULL, 0x2299111144118855ULL,
-	0x03838f8f068f0c89ULL, 0x9c044e4e254e4a6bULL, 0x7366b7b7e6b7d151ULL, 0xcbe0ebeb8beb0b60ULL,
-	0x78c13c3cf03cfdccULL, 0x1ffd81813e817cbfULL, 0x354094946a94d4feULL, 0xf31cf7f7fbf7eb0cULL,
-	0x6f18b9b9deb9a167ULL, 0x268b13134c13985fULL, 0x58512c2cb02c7d9cULL, 0xbb05d3d36bd3d6b8ULL,
-	0xd38ce7e7bbe76b5cULL, 0xdc396e6ea56e57cbULL, 0x95aac4c437c46ef3ULL, 0x061b03030c03180fULL,
-	0xacdc565645568a13ULL, 0x885e44440d441a49ULL, 0xfea07f7fe17fdf9eULL, 0x4f88a9a99ea92137ULL,
-	0x54672a2aa82a4d82ULL, 0x6b0abbbbd6bbb16dULL, 0x9f87c1c123c146e2ULL, 0xa6f153535153a202ULL,
-	0xa572dcdc57dcae8bULL, 0x16530b0b2c0b5827ULL, 0x27019d9d4e9d9cd3ULL, 0xd82b6c6cad6c47c1ULL,
-	0x62a43131c43195f5ULL, 0xe8f37474cd7487b9ULL, 0xf115f6f6fff6e309ULL, 0x8c4c464605460a43ULL,
-	0x45a5acac8aac0926ULL, 0x0fb589891e893c97ULL, 0x28b414145014a044ULL, 0xdfbae1e1a3e15b42ULL,
-	0x2ca616165816b04eULL, 0x74f73a3ae83acdd2ULL, 0xd2066969b9696fd0ULL, 0x124109092409482dULL,
-	0xe0d77070dd70a7adULL, 0x716fb6b6e2b6d954ULL, 0xbd1ed0d067d0ceb7ULL, 0xc7d6eded93ed3b7eULL,
-	0x85e2cccc17cc2edbULL, 0x8468424215422a57ULL, 0x2d2c98985a98b4c2ULL, 0x55eda4a4aaa4490eULL,
-	0x50752828a0285d88ULL, 0xb8865c5c6d5cda31ULL, 0xed6bf8f8c7f8933fULL, 0x11c28686228644a4ULL,
-};
-
-static const uint64_t C3[256] = {
-	0x7830d818186018c0ULL, 0xaf462623238c2305ULL, 0xf991b8c6c63fc67eULL, 0x6fcdfbe8e887e813ULL,
-	0xa113cb878726874cULL, 0x626d11b8b8dab8a9ULL, 0x0502090101040108ULL, 0x6e9e0d4f4f214f42ULL,
-	0xee6c9b3636d836adULL, 0x0451ffa6a6a2a659ULL, 0xbdb90cd2d26fd2deULL, 0x06f70ef5f5f3f5fbULL,
-	0x80f2967979f979efULL, 0xcede306f6fa16f5fULL, 0xef3f6d91917e91fcULL, 0x07a4f852525552aaULL,
-	0xfdc04760609d6027ULL, 0x766535bcbccabc89ULL, 0xcd2b379b9b569bacULL, 0x8c018a8e8e028e04ULL,
-	0x155bd2a3a3b6a371ULL, 0x3c186c0c0c300c60ULL, 0x8af6847b7bf17bffULL, 0xe16a803535d435b5ULL,
-	0x693af51d1d741de8ULL, 0x47ddb3e0e0a7e053ULL, 0xacb321d7d77bd7f6ULL, 0xed999cc2c22fc25eULL,
-	0x965c432e2eb82e6dULL, 0x7a96294b4b314b62ULL, 0x21e15dfefedffea3ULL, 0x16aed55757415782ULL,
-	0x412abd15155415a8ULL, 0xb6eee87777c1779fULL, 0xeb6e923737dc37a5ULL, 0x56d79ee5e5b3e57bULL,
-	0xd923139f9f469f8cULL, 0x17fd23f0f0e7f0d3ULL, 0x7f94204a4a354a6aULL, 0x95a944dada4fda9eULL,
-	0x25b0a258587d58faULL, 0xca8fcfc9c903c906ULL, 0x8d527c2929a42955ULL, 0x22145a0a0a280a50ULL,
-	0x4f7f50b1b1feb1e1ULL, 0x1a5dc9a0a0baa069ULL, 0xdad6146b6bb16b7fULL, 0xab17d985852e855cULL,
-	0x73673cbdbdcebd81ULL, 0x34ba8f5d5d695dd2ULL, 0x5020901010401080ULL, 0x03f507f4f4f7f4f3ULL,
-	0xc08bddcbcb0bcb16ULL, 0xc67cd33e3ef83eedULL, 0x110a2d0505140528ULL, 0xe6ce78676781671fULL,
-	0x53d597e4e4b7e473ULL, 0xbb4e0227279c2725ULL, 0x5882734141194132ULL, 0x9d0ba78b8b168b2cULL,
-	0x0153f6a7a7a6a751ULL, 0x94fab27d7de97dcfULL, 0xfb374995956e95dcULL, 0x9fad56d8d847d88eULL,
-	0x30eb70fbfbcbfb8bULL, 0x71c1cdeeee9fee23ULL, 0x91f8bb7c7ced7cc7ULL, 0xe3cc716666856617ULL,
-	0x8ea77bdddd53dda6ULL, 0x4b2eaf17175c17b8ULL, 0x468e454747014702ULL, 0xdc211a9e9e429e84ULL,
-	0xc589d4caca0fca1eULL, 0x995a582d2db42d75ULL, 0x79632ebfbfc6bf91ULL, 0x1b0e3f07071c0738ULL,
-	0x2347acadad8ead01ULL, 0x2fb4b05a5a755aeaULL, 0xb51bef838336836cULL, 0xff66b63333cc3385ULL,
-	0xf2c65c636391633fULL, 0x0a04120202080210ULL, 0x384993aaaa92aa39ULL, 0xa8e2de7171d971afULL,
-	0xcf8dc6c8c807c80eULL, 0x7d32d119196419c8ULL, 0x70923b4949394972ULL, 0x9aaf5fd9d943d986ULL,
-	0x1df931f2f2eff2c3ULL, 0x48dba8e3e3abe34bULL, 0x2ab6b95b5b715be2ULL, 0x920dbc88881a8834ULL,
-	0xc8293e9a9a529aa4ULL, 0xbe4c0b262698262dULL, 0xfa64bf3232c8328dULL, 0x4a7d59b0b0fab0e9ULL,
-	0x6acff2e9e983e91bULL, 0x331e770f0f3c0f78ULL, 0xa6b733d5d573d5e6ULL, 0xba1df480803a8074ULL,
-	0x7c6127bebec2be99ULL, 0xde87ebcdcd13cd26ULL, 0xe468893434d034bdULL, 0x75903248483d487aULL,
-	0x24e354ffffdbffabULL, 0x8ff48d7a7af57af7ULL, 0xea3d6490907a90f4ULL, 0x3ebe9d5f5f615fc2ULL,
-	0xa0403d202080201dULL, 0xd5d00f6868bd6867ULL, 0x7234ca1a1a681ad0ULL, 0x2c41b7aeae82ae19ULL,
-	0x5e757db4b4eab4c9ULL, 0x19a8ce54544d549aULL, 0xe53b7f93937693ecULL, 0xaa442f222288220dULL,
-	0xe9c86364648d6407ULL, 0x12ff2af1f1e3f1dbULL, 0xa2e6cc7373d173bfULL, 0x5a24821212481290ULL,
-	0x5d807a40401d403aULL, 0x2810480808200840ULL, 0xe89b95c3c32bc356ULL, 0x7bc5dfecec97ec33ULL,
-	0x90ab4ddbdb4bdb96ULL, 0x1f5fc0a1a1bea161ULL, 0x8307918d8d0e8d1cULL, 0xc97ac83d3df43df5ULL,
-	0xf1335b97976697ccULL, 0x0000000000000000ULL, 0xd483f9cfcf1bcf36ULL, 0x87566e2b2bac2b45ULL,
-	0xb3ece17676c57697ULL, 0xb019e68282328264ULL, 0xa9b128d6d67fd6feULL, 0x7736c31b1b6c1bd8ULL,
-	0x5b7774b5b5eeb5c1ULL, 0x2943beafaf86af11ULL, 0xdfd41d6a6ab56a77ULL, 0x0da0ea50505d50baULL,
-	0x4c8a574545094512ULL, 0x18fb38f3f3ebf3cbULL, 0xf060ad3030c0309dULL, 0x74c3c4efef9bef2bULL,
-	0xc37eda3f3ffc3fe5ULL, 0x1caac75555495592ULL, 0x1059dba2a2b2a279ULL, 0x65c9e9eaea8fea03ULL,
-	0xecca6a656589650fULL, 0x686903babad2bab9ULL, 0x935e4a2f2fbc2f65ULL, 0xe79d8ec0c027c04eULL,
-	0x81a160dede5fdebeULL, 0x6c38fc1c1c701ce0ULL, 0x2ee746fdfdd3fdbbULL, 0x649a1f4d4d294d52ULL,
-	0xe0397692927292e4ULL, 0xbceafa7575c9758fULL, 0x1e0c360606180630ULL, 0x9809ae8a8a128a24ULL,
-	0x40794bb2b2f2b2f9ULL, 0x59d185e6e6bfe663ULL, 0x361c7e0e0e380e70ULL, 0x633ee71f1f7c1ff8ULL,
-	0xf7c4556262956237ULL, 0xa3b53ad4d477d4eeULL, 0x324d81a8a89aa829ULL, 0xf4315296966296c4ULL,
-	0x3aef62f9f9c3f99bULL, 0xf697a3c5c533c566ULL, 0xb14a102525942535ULL, 0x20b2ab59597959f2ULL,
-	0xae15d084842a8454ULL, 0xa7e4c57272d572b7ULL, 0xdd72ec3939e439d5ULL, 0x6198164c4c2d4c5aULL,
-	0x3bbc945e5e655ecaULL, 0x85f09f7878fd78e7ULL, 0xd870e53838e038ddULL, 0x8605988c8c0a8c14ULL,
-	0xb2bf17d1d163d1c6ULL, 0x0b57e4a5a5aea541ULL, 0x4dd9a1e2e2afe243ULL, 0xf8c24e616199612fULL,
-	0x457b42b3b3f6b3f1ULL, 0xa542342121842115ULL, 0xd625089c9c4a9c94ULL, 0x663cee1e1e781ef0ULL,
-	0x5286614343114322ULL, 0xfc93b1c7c73bc776ULL, 0x2be54ffcfcd7fcb3ULL, 0x1408240404100420ULL,
-	0x08a2e351515951b2ULL, 0xc72f2599995e99bcULL, 0xc4da226d6da96d4fULL, 0x391a650d0d340d68ULL,
-	0x35e979fafacffa83ULL, 0x84a369dfdf5bdfb6ULL, 0x9bfca97e7ee57ed7ULL, 0xb44819242490243dULL,
-	0xd776fe3b3bec3bc5ULL, 0x3d4b9aabab96ab31ULL, 0xd181f0cece1fce3eULL, 0x5522991111441188ULL,
-	0x8903838f8f068f0cULL, 0x6b9c044e4e254e4aULL, 0x517366b7b7e6b7d1ULL, 0x60cbe0ebeb8beb0bULL,
-	0xcc78c13c3cf03cfdULL, 0xbf1ffd81813e817cULL, 0xfe354094946a94d4ULL, 0x0cf31cf7f7fbf7ebULL,
-	0x676f18b9b9deb9a1ULL, 0x5f268b13134c1398ULL, 0x9c58512c2cb02c7dULL, 0xb8bb05d3d36bd3d6ULL,
-	0x5cd38ce7e7bbe76bULL, 0xcbdc396e6ea56e57ULL, 0xf395aac4c437c46eULL, 0x0f061b03030c0318ULL,
-	0x13acdc565645568aULL, 0x49885e44440d441aULL, 0x9efea07f7fe17fdfULL, 0x374f88a9a99ea921ULL,
-	0x8254672a2aa82a4dULL, 0x6d6b0abbbbd6bbb1ULL, 0xe29f87c1c123c146ULL, 0x02a6f153535153a2ULL,
-	0x8ba572dcdc57dcaeULL, 0x2716530b0b2c0b58ULL, 0xd327019d9d4e9d9cULL, 0xc1d82b6c6cad6c47ULL,
-	0xf562a43131c43195ULL, 0xb9e8f37474cd7487ULL, 0x09f115f6f6fff6e3ULL, 0x438c4c464605460aULL,
-	0x2645a5acac8aac09ULL, 0x970fb589891e893cULL, 0x4428b414145014a0ULL, 0x42dfbae1e1a3e15bULL,
-	0x4e2ca616165816b0ULL, 0xd274f73a3ae83acdULL, 0xd0d2066969b9696fULL, 0x2d12410909240948ULL,
-	0xade0d77070dd70a7ULL, 0x54716fb6b6e2b6d9ULL, 0xb7bd1ed0d067d0ceULL, 0x7ec7d6eded93ed3bULL,
-	0xdb85e2cccc17cc2eULL, 0x578468424215422aULL, 0xc22d2c98985a98b4ULL, 0x0e55eda4a4aaa449ULL,
-	0x8850752828a0285dULL, 0x31b8865c5c6d5cdaULL, 0x3fed6bf8f8c7f893ULL, 0xa411c28686228644ULL,
-};
-
-static const uint64_t C4[256] = {
-	0xc07830d818186018ULL, 0x05af462623238c23ULL, 0x7ef991b8c6c63fc6ULL, 0x136fcdfbe8e887e8ULL,
-	0x4ca113cb87872687ULL, 0xa9626d11b8b8dab8ULL, 0x0805020901010401ULL, 0x426e9e0d4f4f214fULL,
-	0xadee6c9b3636d836ULL, 0x590451ffa6a6a2a6ULL, 0xdebdb90cd2d26fd2ULL, 0xfb06f70ef5f5f3f5ULL,
-	0xef80f2967979f979ULL, 0x5fcede306f6fa16fULL, 0xfcef3f6d91917e91ULL, 0xaa07a4f852525552ULL,
-	0x27fdc04760609d60ULL, 0x89766535bcbccabcULL, 0xaccd2b379b9b569bULL, 0x048c018a8e8e028eULL,
-	0x71155bd2a3a3b6a3ULL, 0x603c186c0c0c300cULL, 0xff8af6847b7bf17bULL, 0xb5e16a803535d435ULL,
-	0xe8693af51d1d741dULL, 0x5347ddb3e0e0a7e0ULL, 0xf6acb321d7d77bd7ULL, 0x5eed999cc2c22fc2ULL,
-	0x6d965c432e2eb82eULL, 0x627a96294b4b314bULL, 0xa321e15dfefedffeULL, 0x8216aed557574157ULL,
-	0xa8412abd15155415ULL, 0x9fb6eee87777c177ULL, 0xa5eb6e923737dc37ULL, 0x7b56d79ee5e5b3e5ULL,
-	0x8cd923139f9f469fULL, 0xd317fd23f0f0e7f0ULL, 0x6a7f94204a4a354aULL, 0x9e95a944dada4fdaULL,
-	0xfa25b0a258587d58ULL, 0x06ca8fcfc9c903c9ULL, 0x558d527c2929a429ULL, 0x5022145a0a0a280aULL,
-	0xe14f7f50b1b1feb1ULL, 0x691a5dc9a0a0baa0ULL, 0x7fdad6146b6bb16bULL, 0x5cab17d985852e85ULL,
-	0x8173673cbdbdcebdULL, 0xd234ba8f5d5d695dULL, 0x8050209010104010ULL, 0xf303f507f4f4f7f4ULL,
-	0x16c08bddcbcb0bcbULL, 0xedc67cd33e3ef83eULL, 0x28110a2d05051405ULL, 0x1fe6ce7867678167ULL,
-	0x7353d597e4e4b7e4ULL, 0x25bb4e0227279c27ULL, 0x3258827341411941ULL, 0x2c9d0ba78b8b168bULL,
-	0x510153f6a7a7a6a7ULL, 0xcf94fab27d7de97dULL, 0xdcfb374995956e95ULL, 0x8e9fad56d8d847d8ULL,
-	0x8b30eb70fbfbcbfbULL, 0x2371c1cdeeee9feeULL, 0xc791f8bb7c7ced7cULL, 0x17e3cc7166668566ULL,
-	0xa68ea77bdddd53ddULL, 0xb84b2eaf17175c17ULL, 0x02468e4547470147ULL, 0x84dc211a9e9e429eULL,
-	0x1ec589d4caca0fcaULL, 0x75995a582d2db42dULL, 0x9179632ebfbfc6bfULL, 0x381b0e3f07071c07ULL,
-	0x012347acadad8eadULL, 0xea2fb4b05a5a755aULL, 0x6cb51bef83833683ULL, 0x85ff66b63333cc33ULL,
-	0x3ff2c65c63639163ULL, 0x100a041202020802ULL, 0x39384993aaaa92aaULL, 0xafa8e2de7171d971ULL,
-	0x0ecf8dc6c8c807c8ULL, 0xc87d32d119196419ULL, 0x7270923b49493949ULL, 0x869aaf5fd9d943d9ULL,
-	0xc31df931f2f2eff2ULL, 0x4b48dba8e3e3abe3ULL, 0xe22ab6b95b5b715bULL, 0x34920dbc88881a88ULL,
-	0xa4c8293e9a9a529aULL, 0x2dbe4c0b26269826ULL, 0x8dfa64bf3232c832ULL, 0xe94a7d59b0b0fab0ULL,
-	0x1b6acff2e9e983e9ULL, 0x78331e770f0f3c0fULL, 0xe6a6b733d5d573d5ULL, 0x74ba1df480803a80ULL,
-	0x997c6127bebec2beULL, 0x26de87ebcdcd13cdULL, 0xbde468893434d034ULL, 0x7a75903248483d48ULL,
-	0xab24e354ffffdbffULL, 0xf78ff48d7a7af57aULL, 0xf4ea3d6490907a90ULL, 0xc23ebe9d5f5f615fULL,
-	0x1da0403d20208020ULL, 0x67d5d00f6868bd68ULL, 0xd07234ca1a1a681aULL, 0x192c41b7aeae82aeULL,
-	0xc95e757db4b4eab4ULL, 0x9a19a8ce54544d54ULL, 0xece53b7f93937693ULL, 0x0daa442f22228822ULL,
-	0x07e9c86364648d64ULL, 0xdb12ff2af1f1e3f1ULL, 0xbfa2e6cc7373d173ULL, 0x905a248212124812ULL,
-	0x3a5d807a40401d40ULL, 0x4028104808082008ULL, 0x56e89b95c3c32bc3ULL, 0x337bc5dfecec97ecULL,
-	0x9690ab4ddbdb4bdbULL, 0x611f5fc0a1a1bea1ULL, 0x1c8307918d8d0e8dULL, 0xf5c97ac83d3df43dULL,
-	0xccf1335b97976697ULL, 0x0000000000000000ULL, 0x36d483f9cfcf1bcfULL, 0x4587566e2b2bac2bULL,
-	0x97b3ece17676c576ULL, 0x64b019e682823282ULL, 0xfea9b128d6d67fd6ULL, 0xd87736c31b1b6c1bULL,
-	0xc15b7774b5b5eeb5ULL, 0x112943beafaf86afULL, 0x77dfd41d6a6ab56aULL, 0xba0da0ea50505d50ULL,
-	0x124c8a5745450945ULL, 0xcb18fb38f3f3ebf3ULL, 0x9df060ad3030c030ULL, 0x2b74c3c4efef9befULL,
-	0xe5c37eda3f3ffc3fULL, 0x921caac755554955ULL, 0x791059dba2a2b2a2ULL, 0x0365c9e9eaea8feaULL,
-	0x0fecca6a65658965ULL, 0xb9686903babad2baULL, 0x65935e4a2f2fbc2fULL, 0x4ee79d8ec0c027c0ULL,
-	0xbe81a160dede5fdeULL, 0xe06c38fc1c1c701cULL, 0xbb2ee746fdfdd3fdULL, 0x52649a1f4d4d294dULL,
-	0xe4e0397692927292ULL, 0x8fbceafa7575c975ULL, 0x301e0c3606061806ULL, 0x249809ae8a8a128aULL,
-	0xf940794bb2b2f2b2ULL, 0x6359d185e6e6bfe6ULL, 0x70361c7e0e0e380eULL, 0xf8633ee71f1f7c1fULL,
-	0x37f7c45562629562ULL, 0xeea3b53ad4d477d4ULL, 0x29324d81a8a89aa8ULL, 0xc4f4315296966296ULL,
-	0x9b3aef62f9f9c3f9ULL, 0x66f697a3c5c533c5ULL, 0x35b14a1025259425ULL, 0xf220b2ab59597959ULL,
-	0x54ae15d084842a84ULL, 0xb7a7e4c57272d572ULL, 0xd5dd72ec3939e439ULL, 0x5a6198164c4c2d4cULL,
-	0xca3bbc945e5e655eULL, 0xe785f09f7878fd78ULL, 0xddd870e53838e038ULL, 0x148605988c8c0a8cULL,
-	0xc6b2bf17d1d163d1ULL, 0x410b57e4a5a5aea5ULL, 0x434dd9a1e2e2afe2ULL, 0x2ff8c24e61619961ULL,
-	0xf1457b42b3b3f6b3ULL, 0x15a5423421218421ULL, 0x94d625089c9c4a9cULL, 0xf0663cee1e1e781eULL,
-	0x2252866143431143ULL, 0x76fc93b1c7c73bc7ULL, 0xb32be54ffcfcd7fcULL, 0x2014082404041004ULL,
-	0xb208a2e351515951ULL, 0xbcc72f2599995e99ULL, 0x4fc4da226d6da96dULL, 0x68391a650d0d340dULL,
-	0x8335e979fafacffaULL, 0xb684a369dfdf5bdfULL, 0xd79bfca97e7ee57eULL, 0x3db4481924249024ULL,
-	0xc5d776fe3b3bec3bULL, 0x313d4b9aabab96abULL, 0x3ed181f0cece1fceULL, 0x8855229911114411ULL,
-	0x0c8903838f8f068fULL, 0x4a6b9c044e4e254eULL, 0xd1517366b7b7e6b7ULL, 0x0b60cbe0ebeb8bebULL,
-	0xfdcc78c13c3cf03cULL, 0x7cbf1ffd81813e81ULL, 0xd4fe354094946a94ULL, 0xeb0cf31cf7f7fbf7ULL,
-	0xa1676f18b9b9deb9ULL, 0x985f268b13134c13ULL, 0x7d9c58512c2cb02cULL, 0xd6b8bb05d3d36bd3ULL,
-	0x6b5cd38ce7e7bbe7ULL, 0x57cbdc396e6ea56eULL, 0x6ef395aac4c437c4ULL, 0x180f061b03030c03ULL,
-	0x8a13acdc56564556ULL, 0x1a49885e44440d44ULL, 0xdf9efea07f7fe17fULL, 0x21374f88a9a99ea9ULL,
-	0x4d8254672a2aa82aULL, 0xb16d6b0abbbbd6bbULL, 0x46e29f87c1c123c1ULL, 0xa202a6f153535153ULL,
-	0xae8ba572dcdc57dcULL, 0x582716530b0b2c0bULL, 0x9cd327019d9d4e9dULL, 0x47c1d82b6c6cad6cULL,
-	0x95f562a43131c431ULL, 0x87b9e8f37474cd74ULL, 0xe309f115f6f6fff6ULL, 0x0a438c4c46460546ULL,
-	0x092645a5acac8aacULL, 0x3c970fb589891e89ULL, 0xa04428b414145014ULL, 0x5b42dfbae1e1a3e1ULL,
-	0xb04e2ca616165816ULL, 0xcdd274f73a3ae83aULL, 0x6fd0d2066969b969ULL, 0x482d124109092409ULL,
-	0xa7ade0d77070dd70ULL, 0xd954716fb6b6e2b6ULL, 0xceb7bd1ed0d067d0ULL, 0x3b7ec7d6eded93edULL,
-	0x2edb85e2cccc17ccULL, 0x2a57846842421542ULL, 0xb4c22d2c98985a98ULL, 0x490e55eda4a4aaa4ULL,
-	0x5d8850752828a028ULL, 0xda31b8865c5c6d5cULL, 0x933fed6bf8f8c7f8ULL, 0x44a411c286862286ULL,
-};
-
-static const uint64_t C5[256] = {
-	0x18c07830d8181860ULL, 0x2305af462623238cULL, 0xc67ef991b8c6c63fULL, 0xe8136fcdfbe8e887ULL,
-	0x874ca113cb878726ULL, 0xb8a9626d11b8b8daULL, 0x0108050209010104ULL, 0x4f426e9e0d4f4f21ULL,
-	0x36adee6c9b3636d8ULL, 0xa6590451ffa6a6a2ULL, 0xd2debdb90cd2d26fULL, 0xf5fb06f70ef5f5f3ULL,
-	0x79ef80f2967979f9ULL, 0x6f5fcede306f6fa1ULL, 0x91fcef3f6d91917eULL, 0x52aa07a4f8525255ULL,
-	0x6027fdc04760609dULL, 0xbc89766535bcbccaULL, 0x9baccd2b379b9b56ULL, 0x8e048c018a8e8e02ULL,
-	0xa371155bd2a3a3b6ULL, 0x0c603c186c0c0c30ULL, 0x7bff8af6847b7bf1ULL, 0x35b5e16a803535d4ULL,
-	0x1de8693af51d1d74ULL, 0xe05347ddb3e0e0a7ULL, 0xd7f6acb321d7d77bULL, 0xc25eed999cc2c22fULL,
-	0x2e6d965c432e2eb8ULL, 0x4b627a96294b4b31ULL, 0xfea321e15dfefedfULL, 0x578216aed5575741ULL,
-	0x15a8412abd151554ULL, 0x779fb6eee87777c1ULL, 0x37a5eb6e923737dcULL, 0xe57b56d79ee5e5b3ULL,
-	0x9f8cd923139f9f46ULL, 0xf0d317fd23f0f0e7ULL, 0x4a6a7f94204a4a35ULL, 0xda9e95a944dada4fULL,
-	0x58fa25b0a258587dULL, 0xc906ca8fcfc9c903ULL, 0x29558d527c2929a4ULL, 0x0a5022145a0a0a28ULL,
-	0xb1e14f7f50b1b1feULL, 0xa0691a5dc9a0a0baULL, 0x6b7fdad6146b6bb1ULL, 0x855cab17d985852eULL,
-	0xbd8173673cbdbdceULL, 0x5dd234ba8f5d5d69ULL, 0x1080502090101040ULL, 0xf4f303f507f4f4f7ULL,
-	0xcb16c08bddcbcb0bULL, 0x3eedc67cd33e3ef8ULL, 0x0528110a2d050514ULL, 0x671fe6ce78676781ULL,
-	0xe47353d597e4e4b7ULL, 0x2725bb4e0227279cULL, 0x4132588273414119ULL, 0x8b2c9d0ba78b8b16ULL,
-	0xa7510153f6a7a7a6ULL, 0x7dcf94fab27d7de9ULL, 0x95dcfb374995956eULL, 0xd88e9fad56d8d847ULL,
-	0xfb8b30eb70fbfbcbULL, 0xee2371c1cdeeee9fULL, 0x7cc791f8bb7c7cedULL, 0x6617e3cc71666685ULL,
-	0xdda68ea77bdddd53ULL, 0x17b84b2eaf17175cULL, 0x4702468e45474701ULL, 0x9e84dc211a9e9e42ULL,
-	0xca1ec589d4caca0fULL, 0x2d75995a582d2db4ULL, 0xbf9179632ebfbfc6ULL, 0x07381b0e3f07071cULL,
-	0xad012347acadad8eULL, 0x5aea2fb4b05a5a75ULL, 0x836cb51bef838336ULL, 0x3385ff66b63333ccULL,
-	0x633ff2c65c636391ULL, 0x02100a0412020208ULL, 0xaa39384993aaaa92ULL, 0x71afa8e2de7171d9ULL,
-	0xc80ecf8dc6c8c807ULL, 0x19c87d32d1191964ULL, 0x497270923b494939ULL, 0xd9869aaf5fd9d943ULL,
-	0xf2c31df931f2f2efULL, 0xe34b48dba8e3e3abULL, 0x5be22ab6b95b5b71ULL, 0x8834920dbc88881aULL,
-	0x9aa4c8293e9a9a52ULL, 0x262dbe4c0b262698ULL, 0x328dfa64bf3232c8ULL, 0xb0e94a7d59b0b0faULL,
-	0xe91b6acff2e9e983ULL, 0x0f78331e770f0f3cULL, 0xd5e6a6b733d5d573ULL, 0x8074ba1df480803aULL,
-	0xbe997c6127bebec2ULL, 0xcd26de87ebcdcd13ULL, 0x34bde468893434d0ULL, 0x487a75903248483dULL,
-	0xffab24e354ffffdbULL, 0x7af78ff48d7a7af5ULL, 0x90f4ea3d6490907aULL, 0x5fc23ebe9d5f5f61ULL,
-	0x201da0403d202080ULL, 0x6867d5d00f6868bdULL, 0x1ad07234ca1a1a68ULL, 0xae192c41b7aeae82ULL,
-	0xb4c95e757db4b4eaULL, 0x549a19a8ce54544dULL, 0x93ece53b7f939376ULL, 0x220daa442f222288ULL,
-	0x6407e9c86364648dULL, 0xf1db12ff2af1f1e3ULL, 0x73bfa2e6cc7373d1ULL, 0x12905a2482121248ULL,
-	0x403a5d807a40401dULL, 0x0840281048080820ULL, 0xc356e89b95c3c32bULL, 0xec337bc5dfecec97ULL,
-	0xdb9690ab4ddbdb4bULL, 0xa1611f5fc0a1a1beULL, 0x8d1c8307918d8d0eULL, 0x3df5c97ac83d3df4ULL,
-	0x97ccf1335b979766ULL, 0x0000000000000000ULL, 0xcf36d483f9cfcf1bULL, 0x2b4587566e2b2bacULL,
-	0x7697b3ece17676c5ULL, 0x8264b019e6828232ULL, 0xd6fea9b128d6d67fULL, 0x1bd87736c31b1b6cULL,
-	0xb5c15b7774b5b5eeULL, 0xaf112943beafaf86ULL, 0x6a77dfd41d6a6ab5ULL, 0x50ba0da0ea50505dULL,
-	0x45124c8a57454509ULL, 0xf3cb18fb38f3f3ebULL, 0x309df060ad3030c0ULL, 0xef2b74c3c4efef9bULL,
-	0x3fe5c37eda3f3ffcULL, 0x55921caac7555549ULL, 0xa2791059dba2a2b2ULL, 0xea0365c9e9eaea8fULL,
-	0x650fecca6a656589ULL, 0xbab9686903babad2ULL, 0x2f65935e4a2f2fbcULL, 0xc04ee79d8ec0c027ULL,
-	0xdebe81a160dede5fULL, 0x1ce06c38fc1c1c70ULL, 0xfdbb2ee746fdfdd3ULL, 0x4d52649a1f4d4d29ULL,
-	0x92e4e03976929272ULL, 0x758fbceafa7575c9ULL, 0x06301e0c36060618ULL, 0x8a249809ae8a8a12ULL,
-	0xb2f940794bb2b2f2ULL, 0xe66359d185e6e6bfULL, 0x0e70361c7e0e0e38ULL, 0x1ff8633ee71f1f7cULL,
-	0x6237f7c455626295ULL, 0xd4eea3b53ad4d477ULL, 0xa829324d81a8a89aULL, 0x96c4f43152969662ULL,
-	0xf99b3aef62f9f9c3ULL, 0xc566f697a3c5c533ULL, 0x2535b14a10252594ULL, 0x59f220b2ab595979ULL,
-	0x8454ae15d084842aULL, 0x72b7a7e4c57272d5ULL, 0x39d5dd72ec3939e4ULL, 0x4c5a6198164c4c2dULL,
-	0x5eca3bbc945e5e65ULL, 0x78e785f09f7878fdULL, 0x38ddd870e53838e0ULL, 0x8c148605988c8c0aULL,
-	0xd1c6b2bf17d1d163ULL, 0xa5410b57e4a5a5aeULL, 0xe2434dd9a1e2e2afULL, 0x612ff8c24e616199ULL,
-	0xb3f1457b42b3b3f6ULL, 0x2115a54234212184ULL, 0x9c94d625089c9c4aULL, 0x1ef0663cee1e1e78ULL,
-	0x4322528661434311ULL, 0xc776fc93b1c7c73bULL, 0xfcb32be54ffcfcd7ULL, 0x0420140824040410ULL,
-	0x51b208a2e3515159ULL, 0x99bcc72f2599995eULL, 0x6d4fc4da226d6da9ULL, 0x0d68391a650d0d34ULL,
-	0xfa8335e979fafacfULL, 0xdfb684a369dfdf5bULL, 0x7ed79bfca97e7ee5ULL, 0x243db44819242490ULL,
-	0x3bc5d776fe3b3becULL, 0xab313d4b9aabab96ULL, 0xce3ed181f0cece1fULL, 0x1188552299111144ULL,
-	0x8f0c8903838f8f06ULL, 0x4e4a6b9c044e4e25ULL, 0xb7d1517366b7b7e6ULL, 0xeb0b60cbe0ebeb8bULL,
-	0x3cfdcc78c13c3cf0ULL, 0x817cbf1ffd81813eULL, 0x94d4fe354094946aULL, 0xf7eb0cf31cf7f7fbULL,
-	0xb9a1676f18b9b9deULL, 0x13985f268b13134cULL, 0x2c7d9c58512c2cb0ULL, 0xd3d6b8bb05d3d36bULL,
-	0xe76b5cd38ce7e7bbULL, 0x6e57cbdc396e6ea5ULL, 0xc46ef395aac4c437ULL, 0x03180f061b03030cULL,
-	0x568a13acdc565645ULL, 0x441a49885e44440dULL, 0x7fdf9efea07f7fe1ULL, 0xa921374f88a9a99eULL,
-	0x2a4d8254672a2aa8ULL, 0xbbb16d6b0abbbbd6ULL, 0xc146e29f87c1c123ULL, 0x53a202a6f1535351ULL,
-	0xdcae8ba572dcdc57ULL, 0x0b582716530b0b2cULL, 0x9d9cd327019d9d4eULL, 0x6c47c1d82b6c6cadULL,
-	0x3195f562a43131c4ULL, 0x7487b9e8f37474cdULL, 0xf6e309f115f6f6ffULL, 0x460a438c4c464605ULL,
-	0xac092645a5acac8aULL, 0x893c970fb589891eULL, 0x14a04428b4141450ULL, 0xe15b42dfbae1e1a3ULL,
-	0x16b04e2ca6161658ULL, 0x3acdd274f73a3ae8ULL, 0x696fd0d2066969b9ULL, 0x09482d1241090924ULL,
-	0x70a7ade0d77070ddULL, 0xb6d954716fb6b6e2ULL, 0xd0ceb7bd1ed0d067ULL, 0xed3b7ec7d6eded93ULL,
-	0xcc2edb85e2cccc17ULL, 0x422a578468424215ULL, 0x98b4c22d2c98985aULL, 0xa4490e55eda4a4aaULL,
-	0x285d8850752828a0ULL, 0x5cda31b8865c5c6dULL, 0xf8933fed6bf8f8c7ULL, 0x8644a411c2868622ULL,
-};
-
-static const uint64_t C6[256] = {
-	0x6018c07830d81818ULL, 0x8c2305af46262323ULL, 0x3fc67ef991b8c6c6ULL, 0x87e8136fcdfbe8e8ULL,
-	0x26874ca113cb8787ULL, 0xdab8a9626d11b8b8ULL, 0x0401080502090101ULL, 0x214f426e9e0d4f4fULL,
-	0xd836adee6c9b3636ULL, 0xa2a6590451ffa6a6ULL, 0x6fd2debdb90cd2d2ULL, 0xf3f5fb06f70ef5f5ULL,
-	0xf979ef80f2967979ULL, 0xa16f5fcede306f6fULL, 0x7e91fcef3f6d9191ULL, 0x5552aa07a4f85252ULL,
-	0x9d6027fdc0476060ULL, 0xcabc89766535bcbcULL, 0x569baccd2b379b9bULL, 0x028e048c018a8e8eULL,
-	0xb6a371155bd2a3a3ULL, 0x300c603c186c0c0cULL, 0xf17bff8af6847b7bULL, 0xd435b5e16a803535ULL,
-	0x741de8693af51d1dULL, 0xa7e05347ddb3e0e0ULL, 0x7bd7f6acb321d7d7ULL, 0x2fc25eed999cc2c2ULL,
-	0xb82e6d965c432e2eULL, 0x314b627a96294b4bULL, 0xdffea321e15dfefeULL, 0x41578216aed55757ULL,
-	0x5415a8412abd1515ULL, 0xc1779fb6eee87777ULL, 0xdc37a5eb6e923737ULL, 0xb3e57b56d79ee5e5ULL,
-	0x469f8cd923139f9fULL, 0xe7f0d317fd23f0f0ULL, 0x354a6a7f94204a4aULL, 0x4fda9e95a944dadaULL,
-	0x7d58fa25b0a25858ULL, 0x03c906ca8fcfc9c9ULL, 0xa429558d527c2929ULL, 0x280a5022145a0a0aULL,
-	0xfeb1e14f7f50b1b1ULL, 0xbaa0691a5dc9a0a0ULL, 0xb16b7fdad6146b6bULL, 0x2e855cab17d98585ULL,
-	0xcebd8173673cbdbdULL, 0x695dd234ba8f5d5dULL, 0x4010805020901010ULL, 0xf7f4f303f507f4f4ULL,
-	0x0bcb16c08bddcbcbULL, 0xf83eedc67cd33e3eULL, 0x140528110a2d0505ULL, 0x81671fe6ce786767ULL,
-	0xb7e47353d597e4e4ULL, 0x9c2725bb4e022727ULL, 0x1941325882734141ULL, 0x168b2c9d0ba78b8bULL,
-	0xa6a7510153f6a7a7ULL, 0xe97dcf94fab27d7dULL, 0x6e95dcfb37499595ULL, 0x47d88e9fad56d8d8ULL,
-	0xcbfb8b30eb70fbfbULL, 0x9fee2371c1cdeeeeULL, 0xed7cc791f8bb7c7cULL, 0x856617e3cc716666ULL,
-	0x53dda68ea77bddddULL, 0x5c17b84b2eaf1717ULL, 0x014702468e454747ULL, 0x429e84dc211a9e9eULL,
-	0x0fca1ec589d4cacaULL, 0xb42d75995a582d2dULL, 0xc6bf9179632ebfbfULL, 0x1c07381b0e3f0707ULL,
-	0x8ead012347acadadULL, 0x755aea2fb4b05a5aULL, 0x36836cb51bef8383ULL, 0xcc3385ff66b63333ULL,
-	0x91633ff2c65c6363ULL, 0x0802100a04120202ULL, 0x92aa39384993aaaaULL, 0xd971afa8e2de7171ULL,
-	0x07c80ecf8dc6c8c8ULL, 0x6419c87d32d11919ULL, 0x39497270923b4949ULL, 0x43d9869aaf5fd9d9ULL,
-	0xeff2c31df931f2f2ULL, 0xabe34b48dba8e3e3ULL, 0x715be22ab6b95b5bULL, 0x1a8834920dbc8888ULL,
-	0x529aa4c8293e9a9aULL, 0x98262dbe4c0b2626ULL, 0xc8328dfa64bf3232ULL, 0xfab0e94a7d59b0b0ULL,
-	0x83e91b6acff2e9e9ULL, 0x3c0f78331e770f0fULL, 0x73d5e6a6b733d5d5ULL, 0x3a8074ba1df48080ULL,
-	0xc2be997c6127bebeULL, 0x13cd26de87ebcdcdULL, 0xd034bde468893434ULL, 0x3d487a7590324848ULL,
-	0xdbffab24e354ffffULL, 0xf57af78ff48d7a7aULL, 0x7a90f4ea3d649090ULL, 0x615fc23ebe9d5f5fULL,
-	0x80201da0403d2020ULL, 0xbd6867d5d00f6868ULL, 0x681ad07234ca1a1aULL, 0x82ae192c41b7aeaeULL,
-	0xeab4c95e757db4b4ULL, 0x4d549a19a8ce5454ULL, 0x7693ece53b7f9393ULL, 0x88220daa442f2222ULL,
-	0x8d6407e9c8636464ULL, 0xe3f1db12ff2af1f1ULL, 0xd173bfa2e6cc7373ULL, 0x4812905a24821212ULL,
-	0x1d403a5d807a4040ULL, 0x2008402810480808ULL, 0x2bc356e89b95c3c3ULL, 0x97ec337bc5dfececULL,
-	0x4bdb9690ab4ddbdbULL, 0xbea1611f5fc0a1a1ULL, 0x0e8d1c8307918d8dULL, 0xf43df5c97ac83d3dULL,
-	0x6697ccf1335b9797ULL, 0x0000000000000000ULL, 0x1bcf36d483f9cfcfULL, 0xac2b4587566e2b2bULL,
-	0xc57697b3ece17676ULL, 0x328264b019e68282ULL, 0x7fd6fea9b128d6d6ULL, 0x6c1bd87736c31b1bULL,
-	0xeeb5c15b7774b5b5ULL, 0x86af112943beafafULL, 0xb56a77dfd41d6a6aULL, 0x5d50ba0da0ea5050ULL,
-	0x0945124c8a574545ULL, 0xebf3cb18fb38f3f3ULL, 0xc0309df060ad3030ULL, 0x9bef2b74c3c4efefULL,
-	0xfc3fe5c37eda3f3fULL, 0x4955921caac75555ULL, 0xb2a2791059dba2a2ULL, 0x8fea0365c9e9eaeaULL,
-	0x89650fecca6a6565ULL, 0xd2bab9686903babaULL, 0xbc2f65935e4a2f2fULL, 0x27c04ee79d8ec0c0ULL,
-	0x5fdebe81a160dedeULL, 0x701ce06c38fc1c1cULL, 0xd3fdbb2ee746fdfdULL, 0x294d52649a1f4d4dULL,
-	0x7292e4e039769292ULL, 0xc9758fbceafa7575ULL, 0x1806301e0c360606ULL, 0x128a249809ae8a8aULL,
-	0xf2b2f940794bb2b2ULL, 0xbfe66359d185e6e6ULL, 0x380e70361c7e0e0eULL, 0x7c1ff8633ee71f1fULL,
-	0x956237f7c4556262ULL, 0x77d4eea3b53ad4d4ULL, 0x9aa829324d81a8a8ULL, 0x6296c4f431529696ULL,
-	0xc3f99b3aef62f9f9ULL, 0x33c566f697a3c5c5ULL, 0x942535b14a102525ULL, 0x7959f220b2ab5959ULL,
-	0x2a8454ae15d08484ULL, 0xd572b7a7e4c57272ULL, 0xe439d5dd72ec3939ULL, 0x2d4c5a6198164c4cULL,
-	0x655eca3bbc945e5eULL, 0xfd78e785f09f7878ULL, 0xe038ddd870e53838ULL, 0x0a8c148605988c8cULL,
-	0x63d1c6b2bf17d1d1ULL, 0xaea5410b57e4a5a5ULL, 0xafe2434dd9a1e2e2ULL, 0x99612ff8c24e6161ULL,
-	0xf6b3f1457b42b3b3ULL, 0x842115a542342121ULL, 0x4a9c94d625089c9cULL, 0x781ef0663cee1e1eULL,
-	0x1143225286614343ULL, 0x3bc776fc93b1c7c7ULL, 0xd7fcb32be54ffcfcULL, 0x1004201408240404ULL,
-	0x5951b208a2e35151ULL, 0x5e99bcc72f259999ULL, 0xa96d4fc4da226d6dULL, 0x340d68391a650d0dULL,
-	0xcffa8335e979fafaULL, 0x5bdfb684a369dfdfULL, 0xe57ed79bfca97e7eULL, 0x90243db448192424ULL,
-	0xec3bc5d776fe3b3bULL, 0x96ab313d4b9aababULL, 0x1fce3ed181f0ceceULL, 0x4411885522991111ULL,
-	0x068f0c8903838f8fULL, 0x254e4a6b9c044e4eULL, 0xe6b7d1517366b7b7ULL, 0x8beb0b60cbe0ebebULL,
-	0xf03cfdcc78c13c3cULL, 0x3e817cbf1ffd8181ULL, 0x6a94d4fe35409494ULL, 0xfbf7eb0cf31cf7f7ULL,
-	0xdeb9a1676f18b9b9ULL, 0x4c13985f268b1313ULL, 0xb02c7d9c58512c2cULL, 0x6bd3d6b8bb05d3d3ULL,
-	0xbbe76b5cd38ce7e7ULL, 0xa56e57cbdc396e6eULL, 0x37c46ef395aac4c4ULL, 0x0c03180f061b0303ULL,
-	0x45568a13acdc5656ULL, 0x0d441a49885e4444ULL, 0xe17fdf9efea07f7fULL, 0x9ea921374f88a9a9ULL,
-	0xa82a4d8254672a2aULL, 0xd6bbb16d6b0abbbbULL, 0x23c146e29f87c1c1ULL, 0x5153a202a6f15353ULL,
-	0x57dcae8ba572dcdcULL, 0x2c0b582716530b0bULL, 0x4e9d9cd327019d9dULL, 0xad6c47c1d82b6c6cULL,
-	0xc43195f562a43131ULL, 0xcd7487b9e8f37474ULL, 0xfff6e309f115f6f6ULL, 0x05460a438c4c4646ULL,
-	0x8aac092645a5acacULL, 0x1e893c970fb58989ULL, 0x5014a04428b41414ULL, 0xa3e15b42dfbae1e1ULL,
-	0x5816b04e2ca61616ULL, 0xe83acdd274f73a3aULL, 0xb9696fd0d2066969ULL, 0x2409482d12410909ULL,
-	0xdd70a7ade0d77070ULL, 0xe2b6d954716fb6b6ULL, 0x67d0ceb7bd1ed0d0ULL, 0x93ed3b7ec7d6ededULL,
-	0x17cc2edb85e2ccccULL, 0x15422a5784684242ULL, 0x5a98b4c22d2c9898ULL, 0xaaa4490e55eda4a4ULL,
-	0xa0285d8850752828ULL, 0x6d5cda31b8865c5cULL, 0xc7f8933fed6bf8f8ULL, 0x228644a411c28686ULL,
-};
-
-static const uint64_t C7[256] = {
-	0x186018c07830d818ULL, 0x238c2305af462623ULL, 0xc63fc67ef991b8c6ULL, 0xe887e8136fcdfbe8ULL,
-	0x8726874ca113cb87ULL, 0xb8dab8a9626d11b8ULL, 0x0104010805020901ULL, 0x4f214f426e9e0d4fULL,
-	0x36d836adee6c9b36ULL, 0xa6a2a6590451ffa6ULL, 0xd26fd2debdb90cd2ULL, 0xf5f3f5fb06f70ef5ULL,
-	0x79f979ef80f29679ULL, 0x6fa16f5fcede306fULL, 0x917e91fcef3f6d91ULL, 0x525552aa07a4f852ULL,
-	0x609d6027fdc04760ULL, 0xbccabc89766535bcULL, 0x9b569baccd2b379bULL, 0x8e028e048c018a8eULL,
-	0xa3b6a371155bd2a3ULL, 0x0c300c603c186c0cULL, 0x7bf17bff8af6847bULL, 0x35d435b5e16a8035ULL,
-	0x1d741de8693af51dULL, 0xe0a7e05347ddb3e0ULL, 0xd77bd7f6acb321d7ULL, 0xc22fc25eed999cc2ULL,
-	0x2eb82e6d965c432eULL, 0x4b314b627a96294bULL, 0xfedffea321e15dfeULL, 0x5741578216aed557ULL,
-	0x155415a8412abd15ULL, 0x77c1779fb6eee877ULL, 0x37dc37a5eb6e9237ULL, 0xe5b3e57b56d79ee5ULL,
-	0x9f469f8cd923139fULL, 0xf0e7f0d317fd23f0ULL, 0x4a354a6a7f94204aULL, 0xda4fda9e95a944daULL,
-	0x587d58fa25b0a258ULL, 0xc903c906ca8fcfc9ULL, 0x29a429558d527c29ULL, 0x0a280a5022145a0aULL,
-	0xb1feb1e14f7f50b1ULL, 0xa0baa0691a5dc9a0ULL, 0x6bb16b7fdad6146bULL, 0x852e855cab17d985ULL,
-	0xbdcebd8173673cbdULL, 0x5d695dd234ba8f5dULL, 0x1040108050209010ULL, 0xf4f7f4f303f507f4ULL,
-	0xcb0bcb16c08bddcbULL, 0x3ef83eedc67cd33eULL, 0x05140528110a2d05ULL, 0x6781671fe6ce7867ULL,
-	0xe4b7e47353d597e4ULL, 0x279c2725bb4e0227ULL, 0x4119413258827341ULL, 0x8b168b2c9d0ba78bULL,
-	0xa7a6a7510153f6a7ULL, 0x7de97dcf94fab27dULL, 0x956e95dcfb374995ULL, 0xd847d88e9fad56d8ULL,
-	0xfbcbfb8b30eb70fbULL, 0xee9fee2371c1cdeeULL, 0x7ced7cc791f8bb7cULL, 0x66856617e3cc7166ULL,
-	0xdd53dda68ea77bddULL, 0x175c17b84b2eaf17ULL, 0x47014702468e4547ULL, 0x9e429e84dc211a9eULL,
-	0xca0fca1ec589d4caULL, 0x2db42d75995a582dULL, 0xbfc6bf9179632ebfULL, 0x071c07381b0e3f07ULL,
-	0xad8ead012347acadULL, 0x5a755aea2fb4b05aULL, 0x8336836cb51bef83ULL, 0x33cc3385ff66b633ULL,
-	0x6391633ff2c65c63ULL, 0x020802100a041202ULL, 0xaa92aa39384993aaULL, 0x71d971afa8e2de71ULL,
-	0xc807c80ecf8dc6c8ULL, 0x196419c87d32d119ULL, 0x4939497270923b49ULL, 0xd943d9869aaf5fd9ULL,
-	0xf2eff2c31df931f2ULL, 0xe3abe34b48dba8e3ULL, 0x5b715be22ab6b95bULL, 0x881a8834920dbc88ULL,
-	0x9a529aa4c8293e9aULL, 0x2698262dbe4c0b26ULL, 0x32c8328dfa64bf32ULL, 0xb0fab0e94a7d59b0ULL,
-	0xe983e91b6acff2e9ULL, 0x0f3c0f78331e770fULL, 0xd573d5e6a6b733d5ULL, 0x803a8074ba1df480ULL,
-	0xbec2be997c6127beULL, 0xcd13cd26de87ebcdULL, 0x34d034bde4688934ULL, 0x483d487a75903248ULL,
-	0xffdbffab24e354ffULL, 0x7af57af78ff48d7aULL, 0x907a90f4ea3d6490ULL, 0x5f615fc23ebe9d5fULL,
-	0x2080201da0403d20ULL, 0x68bd6867d5d00f68ULL, 0x1a681ad07234ca1aULL, 0xae82ae192c41b7aeULL,
-	0xb4eab4c95e757db4ULL, 0x544d549a19a8ce54ULL, 0x937693ece53b7f93ULL, 0x2288220daa442f22ULL,
-	0x648d6407e9c86364ULL, 0xf1e3f1db12ff2af1ULL, 0x73d173bfa2e6cc73ULL, 0x124812905a248212ULL,
-	0x401d403a5d807a40ULL, 0x0820084028104808ULL, 0xc32bc356e89b95c3ULL, 0xec97ec337bc5dfecULL,
-	0xdb4bdb9690ab4ddbULL, 0xa1bea1611f5fc0a1ULL, 0x8d0e8d1c8307918dULL, 0x3df43df5c97ac83dULL,
-	0x976697ccf1335b97ULL, 0x0000000000000000ULL, 0xcf1bcf36d483f9cfULL, 0x2bac2b4587566e2bULL,
-	0x76c57697b3ece176ULL, 0x82328264b019e682ULL, 0xd67fd6fea9b128d6ULL, 0x1b6c1bd87736c31bULL,
-	0xb5eeb5c15b7774b5ULL, 0xaf86af112943beafULL, 0x6ab56a77dfd41d6aULL, 0x505d50ba0da0ea50ULL,
-	0x450945124c8a5745ULL, 0xf3ebf3cb18fb38f3ULL, 0x30c0309df060ad30ULL, 0xef9bef2b74c3c4efULL,
-	0x3ffc3fe5c37eda3fULL, 0x554955921caac755ULL, 0xa2b2a2791059dba2ULL, 0xea8fea0365c9e9eaULL,
-	0x6589650fecca6a65ULL, 0xbad2bab9686903baULL, 0x2fbc2f65935e4a2fULL, 0xc027c04ee79d8ec0ULL,
-	0xde5fdebe81a160deULL, 0x1c701ce06c38fc1cULL, 0xfdd3fdbb2ee746fdULL, 0x4d294d52649a1f4dULL,
-	0x927292e4e0397692ULL, 0x75c9758fbceafa75ULL, 0x061806301e0c3606ULL, 0x8a128a249809ae8aULL,
-	0xb2f2b2f940794bb2ULL, 0xe6bfe66359d185e6ULL, 0x0e380e70361c7e0eULL, 0x1f7c1ff8633ee71fULL,
-	0x62956237f7c45562ULL, 0xd477d4eea3b53ad4ULL, 0xa89aa829324d81a8ULL, 0x966296c4f4315296ULL,
-	0xf9c3f99b3aef62f9ULL, 0xc533c566f697a3c5ULL, 0x25942535b14a1025ULL, 0x597959f220b2ab59ULL,
-	0x842a8454ae15d084ULL, 0x72d572b7a7e4c572ULL, 0x39e439d5dd72ec39ULL, 0x4c2d4c5a6198164cULL,
-	0x5e655eca3bbc945eULL, 0x78fd78e785f09f78ULL, 0x38e038ddd870e538ULL, 0x8c0a8c148605988cULL,
-	0xd163d1c6b2bf17d1ULL, 0xa5aea5410b57e4a5ULL, 0xe2afe2434dd9a1e2ULL, 0x6199612ff8c24e61ULL,
-	0xb3f6b3f1457b42b3ULL, 0x21842115a5423421ULL, 0x9c4a9c94d625089cULL, 0x1e781ef0663cee1eULL,
-	0x4311432252866143ULL, 0xc73bc776fc93b1c7ULL, 0xfcd7fcb32be54ffcULL, 0x0410042014082404ULL,
-	0x515951b208a2e351ULL, 0x995e99bcc72f2599ULL, 0x6da96d4fc4da226dULL, 0x0d340d68391a650dULL,
-	0xfacffa8335e979faULL, 0xdf5bdfb684a369dfULL, 0x7ee57ed79bfca97eULL, 0x2490243db4481924ULL,
-	0x3bec3bc5d776fe3bULL, 0xab96ab313d4b9aabULL, 0xce1fce3ed181f0ceULL, 0x1144118855229911ULL,
-	0x8f068f0c8903838fULL, 0x4e254e4a6b9c044eULL, 0xb7e6b7d1517366b7ULL, 0xeb8beb0b60cbe0ebULL,
-	0x3cf03cfdcc78c13cULL, 0x813e817cbf1ffd81ULL, 0x946a94d4fe354094ULL, 0xf7fbf7eb0cf31cf7ULL,
-	0xb9deb9a1676f18b9ULL, 0x134c13985f268b13ULL, 0x2cb02c7d9c58512cULL, 0xd36bd3d6b8bb05d3ULL,
-	0xe7bbe76b5cd38ce7ULL, 0x6ea56e57cbdc396eULL, 0xc437c46ef395aac4ULL, 0x030c03180f061b03ULL,
-	0x5645568a13acdc56ULL, 0x440d441a49885e44ULL, 0x7fe17fdf9efea07fULL, 0xa99ea921374f88a9ULL,
-	0x2aa82a4d8254672aULL, 0xbbd6bbb16d6b0abbULL, 0xc123c146e29f87c1ULL, 0x535153a202a6f153ULL,
-	0xdc57dcae8ba572dcULL, 0x0b2c0b582716530bULL, 0x9d4e9d9cd327019dULL, 0x6cad6c47c1d82b6cULL,
-	0x31c43195f562a431ULL, 0x74cd7487b9e8f374ULL, 0xf6fff6e309f115f6ULL, 0x4605460a438c4c46ULL,
-	0xac8aac092645a5acULL, 0x891e893c970fb589ULL, 0x145014a04428b414ULL, 0xe1a3e15b42dfbae1ULL,
-	0x165816b04e2ca616ULL, 0x3ae83acdd274f73aULL, 0x69b9696fd0d20669ULL, 0x092409482d124109ULL,
-	0x70dd70a7ade0d770ULL, 0xb6e2b6d954716fb6ULL, 0xd067d0ceb7bd1ed0ULL, 0xed93ed3b7ec7d6edULL,
-	0xcc17cc2edb85e2ccULL, 0x4215422a57846842ULL, 0x985a98b4c22d2c98ULL, 0xa4aaa4490e55eda4ULL,
-	0x28a0285d88507528ULL, 0x5c6d5cda31b8865cULL, 0xf8c7f8933fed6bf8ULL, 0x86228644a411c286ULL,
-};
-
-static const uint64_t rc[R + 1] = {
-	0x0000000000000000ULL,
-	0x1823c6e887b8014fULL,
-	0x36a6d2f5796f9152ULL,
-	0x60bc9b8ea30c7b35ULL,
-	0x1de0d7c22e4bfe57ULL,
-	0x157737e59ff04adaULL,
-	0x58c9290ab1a06b85ULL,
-	0xbd5d10f4cb3e0567ULL,
-	0xe427418ba77d95d8ULL,
-	0xfbee7c66dd17479eULL,
-	0xca2dbf07ad5a8333ULL,
-};
-
-/* This might not be true for all platforms and compilers. */
-#define SANE_ARRAY_PACKING 1
-
-#if defined(SANE_ARRAY_PACKING) && (defined(ARCH_IS_LITTLE_ENDIAN) || defined(ARCH_IS_BIG_ENDIAN))
-
-#if defined(ARCH_IS_LITTLE_ENDIAN)
-#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 7]] \
-	^ C1[mu[((n+7)%8) * 8 + 6]] \
-	^ C2[mu[((n+6)%8) * 8 + 5]] \
-	^ C3[mu[((n+5)%8) * 8 + 4]] \
-	^ C4[mu[((n+4)%8) * 8 + 3]] \
-	^ C5[mu[((n+3)%8) * 8 + 2]] \
-	^ C6[mu[((n+2)%8) * 8 + 1]] \
-	^ C7[mu[((n+1)%8) * 8 + 0]] \
-	; } while (0)
-#else
-#define LB(n)  do { L[n] = C0[mu[((n+0)%8) * 8 + 0]] \
-	^ C1[mu[((n+7)%8) * 8 + 1]] \
-	^ C2[mu[((n+6)%8) * 8 + 2]] \
-	^ C3[mu[((n+5)%8) * 8 + 3]] \
-	^ C4[mu[((n+4)%8) * 8 + 4]] \
-	^ C5[mu[((n+3)%8) * 8 + 5]] \
-	^ C6[mu[((n+2)%8) * 8 + 6]] \
-	^ C7[mu[((n+1)%8) * 8 + 7]] \
-	; } while (0)
-#endif
-
-static void transformMatrix(uint64_t m[8])
-{
-	uint64_t L[8];
-	uint8_t *mu = (uint8_t*)m;
-
-	LB(0);
-	LB(1);
-	LB(2);
-	LB(3);
-	LB(4);
-	LB(5);
-	LB(6);
-	LB(7);
-
-	array_copy64(m, L, 8);
-}
-
-#else
-
-static void transformMatrix(uint64_t m[8])
-{
-	uint64_t L[8];
-
-	L[0] =
-		C0[(int)(m[0] >> 56)       ] ^
-		C1[(int)(m[7] >> 48) & 0xff] ^
-		C2[(int)(m[6] >> 40) & 0xff] ^
-		C3[(int)(m[5] >> 32) & 0xff] ^
-		C4[(int)(m[4] >> 24) & 0xff] ^
-		C5[(int)(m[3] >> 16) & 0xff] ^
-		C6[(int)(m[2] >>  8) & 0xff] ^
-		C7[(int)(m[1]      ) & 0xff];
-	L[1] =
-		C0[(int)(m[1] >> 56)       ] ^
-		C1[(int)(m[0] >> 48) & 0xff] ^
-		C2[(int)(m[7] >> 40) & 0xff] ^
-		C3[(int)(m[6] >> 32) & 0xff] ^
-		C4[(int)(m[5] >> 24) & 0xff] ^
-		C5[(int)(m[4] >> 16) & 0xff] ^
-		C6[(int)(m[3] >>  8) & 0xff] ^
-		C7[(int)(m[2]      ) & 0xff];
-	L[2] =
-		C0[(int)(m[2] >> 56)       ] ^
-		C1[(int)(m[1] >> 48) & 0xff] ^
-		C2[(int)(m[0] >> 40) & 0xff] ^
-		C3[(int)(m[7] >> 32) & 0xff] ^
-		C4[(int)(m[6] >> 24) & 0xff] ^
-		C5[(int)(m[5] >> 16) & 0xff] ^
-		C6[(int)(m[4] >>  8) & 0xff] ^
-		C7[(int)(m[3]      ) & 0xff];
-	L[3] =
-		C0[(int)(m[3] >> 56)       ] ^
-		C1[(int)(m[2] >> 48) & 0xff] ^
-		C2[(int)(m[1] >> 40) & 0xff] ^
-		C3[(int)(m[0] >> 32) & 0xff] ^
-		C4[(int)(m[7] >> 24) & 0xff] ^
-		C5[(int)(m[6] >> 16) & 0xff] ^
-		C6[(int)(m[5] >>  8) & 0xff] ^
-		C7[(int)(m[4]      ) & 0xff];
-	L[4] =
-		C0[(int)(m[4] >> 56)       ] ^
-		C1[(int)(m[3] >> 48) & 0xff] ^
-		C2[(int)(m[2] >> 40) & 0xff] ^
-		C3[(int)(m[1] >> 32) & 0xff] ^
-		C4[(int)(m[0] >> 24) & 0xff] ^
-		C5[(int)(m[7] >> 16) & 0xff] ^
-		C6[(int)(m[6] >>  8) & 0xff] ^
-		C7[(int)(m[5]      ) & 0xff];
-	L[5] =
-		C0[(int)(m[5] >> 56)       ] ^
-		C1[(int)(m[4] >> 48) & 0xff] ^
-		C2[(int)(m[3] >> 40) & 0xff] ^
-		C3[(int)(m[2] >> 32) & 0xff] ^
-		C4[(int)(m[1] >> 24) & 0xff] ^
-		C5[(int)(m[0] >> 16) & 0xff] ^
-		C6[(int)(m[7] >>  8) & 0xff] ^
-		C7[(int)(m[6]      ) & 0xff];
-	L[6] =
-		C0[(int)(m[6] >> 56)       ] ^
-		C1[(int)(m[5] >> 48) & 0xff] ^
-		C2[(int)(m[4] >> 40) & 0xff] ^
-		C3[(int)(m[3] >> 32) & 0xff] ^
-		C4[(int)(m[2] >> 24) & 0xff] ^
-		C5[(int)(m[1] >> 16) & 0xff] ^
-		C6[(int)(m[0] >>  8) & 0xff] ^
-		C7[(int)(m[7]      ) & 0xff];
-	L[7] =
-		C0[(int)(m[7] >> 56)       ] ^
-		C1[(int)(m[6] >> 48) & 0xff] ^
-		C2[(int)(m[5] >> 40) & 0xff] ^
-		C3[(int)(m[4] >> 32) & 0xff] ^
-		C4[(int)(m[3] >> 24) & 0xff] ^
-		C5[(int)(m[2] >> 16) & 0xff] ^
-		C6[(int)(m[1] >>  8) & 0xff] ^
-		C7[(int)(m[0]      ) & 0xff];
-
-	array_copy64(m, L, 8);
-}
-
-#endif
-
-static void inplaceXor(uint64_t dst[8], uint64_t src[8])
-{
-	dst[0] ^= src[0];
-	dst[1] ^= src[1];
-	dst[2] ^= src[2];
-	dst[3] ^= src[3];
-	dst[4] ^= src[4];
-	dst[5] ^= src[5];
-	dst[6] ^= src[6];
-	dst[7] ^= src[7];
-}
-
-/**
- * The core Whirlpool transform.
- */
-static void processBuffer(whirlpool_ctx * const ctx)
-{
-	int i, r;
-	uint64_t K[8];        /* the round key */
-	uint64_t block[8];    /* mu(buffer) */
-	uint64_t state[8];    /* the cipher state */
-	uint8_t *buffer = ctx->buffer;
-
-	/*
-	 * map the buffer to a block:
-	 */
-	for (i = 0; i < 8; i++, buffer += 8) {
-		block[i] =
-			(((uint64_t)buffer[0]        ) << 56) ^
-			(((uint64_t)buffer[1] & 0xffL) << 48) ^
-			(((uint64_t)buffer[2] & 0xffL) << 40) ^
-			(((uint64_t)buffer[3] & 0xffL) << 32) ^
-			(((uint64_t)buffer[4] & 0xffL) << 24) ^
-			(((uint64_t)buffer[5] & 0xffL) << 16) ^
-			(((uint64_t)buffer[6] & 0xffL) <<  8) ^
-			(((uint64_t)buffer[7] & 0xffL)      );
-	}
-
-	/*
-	 * compute and apply K^0 to the cipher state:
-	 */
-	array_copy64(K, ctx->hash, 8);
-	array_copy64(state, block, 8);
-	inplaceXor(state, K);
-
-	/*
-	 * iterate over all rounds:
-	 */
-	for (r = 1; r <= R; r++) {
-		/*
-		 * compute K^r from K^{r-1}:
-		 */
-		transformMatrix(K);
-		K[0] ^= rc[r];
-
-		/*
-		 * apply the r-th round transformation:
-		 */
-		transformMatrix(state);
-		inplaceXor(state, K);
-	}
-	/*
-	 * apply the Miyaguchi-Preneel compression function:
-	 */
-	inplaceXor(ctx->hash, state);
-	inplaceXor(ctx->hash, block);
-}
-
-/**
- * Initialize the hashing state.
- */
-void cryptonite_whirlpool_init(struct whirlpool_ctx * const ctx)
-{
-	int i;
-
-	memset(ctx->bitLength, 0, 32);
-	ctx->bufferBits = ctx->bufferPos = 0;
-	ctx->buffer[0] = 0; /* it's only necessary to cleanup buffer[bufferPos] */
-	for (i = 0; i < 8; i++) {
-		ctx->hash[i] = 0L; /* initial value */
-	}
-}
-
-/**
- * Delivers input data to the hashing algorithm.
- *
- * @param    source        plaintext data to hash.
- * @param    sourceBits    how many bits of plaintext to process.
- *
- * This method maintains the invariant: bufferBits < DIGESTBITS
- */
-void cryptonite_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t sourceBytes)
-{
-	/*
-	   sourcePos
-	   |
-	   +-------+-------+-------
-	   ||||||||||||||||||||| source
-	   +-------+-------+-------
-	   +-------+-------+-------+-------+-------+-------
-	   ||||||||||||||||||||||                           buffer
-	   +-------+-------+-------+-------+-------+-------
-	   |
-	   bufferPos
-	   */
-	int sourceBits   = sourceBytes * 8;
-	int sourcePos    = 0; /* index of leftmost source uint8_t containing data (1 to 8 bits). */
-	int sourceGap    = (8 - ((int)sourceBits & 7)) & 7; /* space on source[sourcePos]. */
-	int bufferRem    = ctx->bufferBits & 7; /* occupied bits on buffer[bufferPos]. */
-	int i;
-	uint32_t b, carry;
-	uint8_t *buffer       = ctx->buffer;
-	uint8_t *bitLength    = ctx->bitLength;
-	int bufferBits   = ctx->bufferBits;
-	int bufferPos    = ctx->bufferPos;
-
-	/*
-	 * tally the length of the added data:
-	 */
-	uint64_t value = sourceBits;
-	for (i = 31, carry = 0; i >= 0 && (carry != 0 || value != 0ULL); i--) {
-		carry += bitLength[i] + ((uint32_t)value & 0xff);
-		bitLength[i] = (uint8_t)carry;
-		carry >>= 8;
-		value >>= 8;
-	}
-	/*
-	 * process data in chunks of 8 bits (a more efficient approach would be to take whole-word chunks):
-	 */
-	while (sourceBits > 8) {
-		/* N.B. at least source[sourcePos] and source[sourcePos+1] contain data. */
-		/*
-		 * take a byte from the source:
-		 */
-		b = ((source[sourcePos] << sourceGap) & 0xff) |
-			((source[sourcePos + 1] & 0xff) >> (8 - sourceGap));
-		/*
-		 * process this byte:
-		 */
-		buffer[bufferPos++] |= (uint8_t)(b >> bufferRem);
-		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */
-		if (bufferBits == DIGESTBITS) {
-			/*
-			 * process data block:
-			 */
-			processBuffer(ctx);
-			/*
-			 * reset buffer:
-			 */
-			bufferBits = bufferPos = 0;
-		}
-		buffer[bufferPos] = b << (8 - bufferRem);
-		bufferBits += bufferRem;
-		/*
-		 * proceed to remaining data:
-		 */
-		sourceBits -= 8;
-		sourcePos++;
-	}
-	/* now 0 <= sourceBits <= 8;
-	 * furthermore, all data (if any is left) is in source[sourcePos].
-	 */
-	if (sourceBits > 0) {
-		b = (source[sourcePos] << sourceGap) & 0xff; /* bits are left-justified on b. */
-		/*
-		 * process the remaining bits:
-		 */
-		buffer[bufferPos] |= b >> bufferRem;
-	} else {
-		b = 0;
-	}
-	if (bufferRem + sourceBits < 8) {
-		/*
-		 * all remaining data fits on buffer[bufferPos],
-		 * and there still remains some space.
-		 */
-		bufferBits += sourceBits;
-	} else {
-		/*
-		 * buffer[bufferPos] is full:
-		 */
-		bufferPos++;
-		bufferBits += 8 - bufferRem; /* bufferBits = 8*bufferPos; */
-		sourceBits -= 8 - bufferRem;
-		/* now 0 <= sourceBits < 8;
-		 * furthermore, all data (if any is left) is in source[sourcePos].
-		 */
-		if (bufferBits == DIGESTBITS) {
-			/*
-			 * process data block:
-			 */
-			processBuffer(ctx);
-			/*
-			 * reset buffer:
-			 */
-			bufferBits = bufferPos = 0;
-		}
-		buffer[bufferPos] = b << (8 - bufferRem);
-		bufferBits += (int)sourceBits;
-	}
-	ctx->bufferBits   = bufferBits;
-	ctx->bufferPos    = bufferPos;
-}
-
-/**
- * Get the hash value from the hashing state.
- * 
- * This method uses the invariant: bufferBits < DIGESTBITS
- */
-void cryptonite_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result)
-{
-	int i;
-	uint8_t *buffer    = ctx->buffer;
-	uint8_t *bitLength = ctx->bitLength;
-	int bufferBits     = ctx->bufferBits;
-	int bufferPos      = ctx->bufferPos;
-	uint8_t *digest    = result;
-
-	/*
-	 * append a '1'-bit:
-	 */
-	buffer[bufferPos] |= 0x80U >> (bufferBits & 7);
-	bufferPos++; /* all remaining bits on the current uint8_t are set to zero. */
-	/*
-	 * pad with zero bits to complete (N*WBLOCKBITS - LENGTHBITS) bits:
-	 */
-	if (bufferPos > WBLOCKBYTES - LENGTHBYTES) {
-		if (bufferPos < WBLOCKBYTES) {
-			memset(&buffer[bufferPos], 0, WBLOCKBYTES - bufferPos);
-		}
-		/*
-		 * process data block:
-		 */
-		processBuffer(ctx);
-		/*
-		 * reset buffer:
-		 */
-		bufferPos = 0;
-	}
-	if (bufferPos < WBLOCKBYTES - LENGTHBYTES) {
-		memset(&buffer[bufferPos], 0, (WBLOCKBYTES - LENGTHBYTES) - bufferPos);
-	}
-	bufferPos = WBLOCKBYTES - LENGTHBYTES;
-	/*
-	 * append bit length of hashed data:
-	 */
-	memcpy(&buffer[WBLOCKBYTES - LENGTHBYTES], bitLength, LENGTHBYTES);
-	/*
-	 * process data block:
-	 */
-	processBuffer(ctx);
-	/*
-	 * return the completed message digest:
-	 */
-	for (i = 0; i < DIGESTBYTES/8; i++) {
-		digest[0] = (uint8_t)(ctx->hash[i] >> 56);
-		digest[1] = (uint8_t)(ctx->hash[i] >> 48);
-		digest[2] = (uint8_t)(ctx->hash[i] >> 40);
-		digest[3] = (uint8_t)(ctx->hash[i] >> 32);
-		digest[4] = (uint8_t)(ctx->hash[i] >> 24);
-		digest[5] = (uint8_t)(ctx->hash[i] >> 16);
-		digest[6] = (uint8_t)(ctx->hash[i] >>  8);
-		digest[7] = (uint8_t)(ctx->hash[i]      );
-		digest += 8;
-	}
-	ctx->bufferBits   = bufferBits;
-	ctx->bufferPos    = bufferPos;
-}
diff --git a/cbits/cryptonite_whirlpool.h b/cbits/cryptonite_whirlpool.h
deleted file mode 100644
--- a/cbits/cryptonite_whirlpool.h
+++ /dev/null
@@ -1,31 +0,0 @@
-#ifndef CRYPTOHASH_WHIRLPOOL_H
-#define CRYPTOHASH_WHIRLPOOL_H
-
-#include <stdint.h>
-
-/*
- * Whirlpool-specific definitions.
- */
-
-#define DIGESTBYTES 64
-#define DIGESTBITS  (8*DIGESTBYTES) /* 512 */
-
-#define WBLOCKBYTES 64
-#define WBLOCKBITS  (8*WBLOCKBYTES) /* 512 */
-
-#define LENGTHBYTES 32
-#define LENGTHBITS  (8*LENGTHBYTES) /* 256 */
-
-typedef struct whirlpool_ctx {
-	uint8_t  bitLength[LENGTHBYTES]; /* global number of hashed bits (256-bit counter) */
-	uint8_t  buffer[WBLOCKBYTES];    /* buffer of data to hash */
-	uint32_t bufferBits;             /* current number of bits on the buffer */
-	uint32_t bufferPos;              /* current (possibly incomplete) byte slot on the buffer */
-	uint64_t hash[DIGESTBYTES/8];    /* the hashing state */
-} whirlpool_ctx;
-
-void cryptonite_whirlpool_init(struct whirlpool_ctx * const ctx);
-void cryptonite_whirlpool_update(struct whirlpool_ctx * const ctx, const uint8_t * const source, uint32_t len);
-void cryptonite_whirlpool_finalize(struct whirlpool_ctx * const ctx, uint8_t * const result);
-
-#endif
diff --git a/cbits/cryptonite_xsalsa.c b/cbits/cryptonite_xsalsa.c
deleted file mode 100644
--- a/cbits/cryptonite_xsalsa.c
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>
- * 
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#include <stdint.h>
-#include <string.h>
-#include "cryptonite_xsalsa.h"
-#include "cryptonite_align.h"
-#include "cryptonite_bitfn.h"
-
-/* XSalsa20 algorithm as described in https://cr.yp.to/snuffle/xsalsa-20081128.pdf */
-void cryptonite_xsalsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds,
-                            uint32_t keylen, const uint8_t *key,
-                            uint32_t ivlen, const uint8_t *iv)
-{
-  memset(ctx, 0, sizeof(*ctx));
-  ctx->nb_rounds = nb_rounds;
-
-  /* Create initial 512-bit input block:
-       (x0, x5, x10, x15) is the Salsa20 constant
-       (x1, x2, x3, x4, x11, x12, x13, x14) is a 256-bit key
-       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce
-  */
-  cryptonite_salsa_init_core(&ctx->st, keylen, key, 8, iv);
-
-  /* Continue initialization in a separate function that may also
-     be called independently */
-  cryptonite_xsalsa_derive(ctx, ivlen - 8, iv + 8);
-}
-
-void cryptonite_xsalsa_derive(cryptonite_salsa_context *ctx,
-                              uint32_t ivlen, const uint8_t *iv)
-{
-  /* Finish creating initial 512-bit input block:
-       (x6, x7, x8, x9) is the first 128 bits of a 192-bit nonce
-
-     Except iv has been shifted by 64 bits so there are now only 128 bits ahead.
-  */
-  ctx->st.d[ 8] += load_le32(iv + 0);
-  ctx->st.d[ 9] += load_le32(iv + 4);
-
-  /* Compute (z0, z1, . . . , z15) = doubleround ^(r/2) (x0, x1, . . . , x15) */
-  block hSalsa;
-  memset(&hSalsa, 0, sizeof(block));
-  cryptonite_salsa_core_xor(ctx->nb_rounds, &hSalsa, &ctx->st);
- 
-  /* Build a new 512-bit input block (x′0, x′1, . . . , x′15):
-       (x′0, x′5, x′10, x′15) is the Salsa20 constant
-       (x′1,x′2,x′3,x′4,x′11,x′12,x′13,x′14) = (z0,z5,z10,z15,z6,z7,z8,z9)
-       (x′6,x′7) is the last 64 bits of the 192-bit nonce
-       (x′8, x′9) is a 64-bit block counter.
-  */
-  ctx->st.d[ 1] = hSalsa.d[ 0] - ctx->st.d[ 0];
-  ctx->st.d[ 2] = hSalsa.d[ 5] - ctx->st.d[ 5];
-  ctx->st.d[ 3] = hSalsa.d[10] - ctx->st.d[10];
-  ctx->st.d[ 4] = hSalsa.d[15] - ctx->st.d[15];
-  ctx->st.d[11] = hSalsa.d[ 6] - ctx->st.d[ 6];
-  ctx->st.d[12] = hSalsa.d[ 7] - ctx->st.d[ 7];
-  ctx->st.d[13] = hSalsa.d[ 8] - ctx->st.d[ 8];
-  ctx->st.d[14] = hSalsa.d[ 9] - ctx->st.d[ 9];
-  ctx->st.d[ 6] = load_le32(iv + 8);
-  ctx->st.d[ 7] = load_le32(iv + 12);
-  ctx->st.d[ 8] = 0;
-  ctx->st.d[ 9] = 0;
-}
diff --git a/cbits/cryptonite_xsalsa.h b/cbits/cryptonite_xsalsa.h
deleted file mode 100644
--- a/cbits/cryptonite_xsalsa.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright (c) 2016 Brandon Hamilton <brandon.hamilton@gmail.com>
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the author nor the names of his contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-#ifndef CRYPTONITE_XSALSA
-#define CRYPTONITE_XSALSA
-
-#include "cryptonite_salsa.h"
-
-void cryptonite_xsalsa_init(cryptonite_salsa_context *ctx, uint8_t nb_rounds, uint32_t keylen, const uint8_t *key, uint32_t ivlen, const uint8_t *iv);
-void cryptonite_xsalsa_derive(cryptonite_salsa_context *ctx, uint32_t ivlen, const uint8_t *iv);
-
-#endif
diff --git a/cbits/curve25519/curve25519-donna-c64.c b/cbits/curve25519/curve25519-donna-c64.c
--- a/cbits/curve25519/curve25519-donna-c64.c
+++ b/cbits/curve25519/curve25519-donna-c64.c
@@ -428,7 +428,7 @@
 }
 
 int
-cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
+crypton_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
   limb bp[5], x[5], z[5], zmone[5];
   uint8_t e[32];
   int i;
diff --git a/cbits/curve25519/curve25519-donna.c b/cbits/curve25519/curve25519-donna.c
--- a/cbits/curve25519/curve25519-donna.c
+++ b/cbits/curve25519/curve25519-donna.c
@@ -841,7 +841,7 @@
 }
 
 int
-cryptonite_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
+crypton_curve25519_donna(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
   limb bp[10], x[10], z[11], zmone[10];
   uint8_t e[32];
   int i;
diff --git a/cbits/decaf/ed448goldilocks/decaf.c b/cbits/decaf/ed448goldilocks/decaf.c
--- a/cbits/decaf/ed448goldilocks/decaf.c
+++ b/cbits/decaf/ed448goldilocks/decaf.c
@@ -19,1624 +19,1624 @@
 #include <decaf/ed448.h>
 
 /* Template stuff */
-#define API_NS(_id) cryptonite_decaf_448_##_id
-#define SCALAR_BITS CRYPTONITE_DECAF_448_SCALAR_BITS
-#define SCALAR_SER_BYTES CRYPTONITE_DECAF_448_SCALAR_BYTES
-#define SCALAR_LIMBS CRYPTONITE_DECAF_448_SCALAR_LIMBS
-#define scalar_t API_NS(scalar_t)
-#define point_t API_NS(point_t)
-#define precomputed_s API_NS(precomputed_s)
-#define IMAGINE_TWIST 0
-#define COFACTOR 4
-
-/* Comb config: number of combs, n, t, s. */
-#define COMBS_N 5
-#define COMBS_T 5
-#define COMBS_S 18
-#define CRYPTONITE_DECAF_WINDOW_BITS 5
-#define CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS 5
-#define CRYPTONITE_DECAF_WNAF_VAR_TABLE_BITS 3
-
-#define EDDSA_USE_SIGMA_ISOGENY 0
-
-static const int EDWARDS_D = -39081;
-static const scalar_t point_scalarmul_adjustment = {{{
-    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)
-}}}, precomputed_scalarmul_adjustment = {{{
-    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)
-}}};
-
-const uint8_t cryptonite_decaf_x448_base_point[CRYPTONITE_DECAF_X448_PUBLIC_BYTES] = { 0x05 };
-
-#if COFACTOR==8 || EDDSA_USE_SIGMA_ISOGENY
-    static const gf SQRT_ONE_MINUS_D = {FIELD_LITERAL(
-        /* NONE */
-    )};
-#endif
-
-/* End of template stuff */
-
-/* Sanity */
-#if (COFACTOR == 8) && !IMAGINE_TWIST && !UNSAFE_CURVE_HAS_POINTS_AT_INFINITY
-/* FUTURE MAGIC: Curve41417 doesn't have these properties. */
-#error "Currently require IMAGINE_TWIST (and thus p=5 mod 8) for cofactor 8"
-        /* OK, but why?
-         * Two reasons: #1: There are bugs when COFACTOR == && IMAGINE_TWIST
-         # #2: 
-         */
-#endif
-
-#if IMAGINE_TWIST && (P_MOD_8 != 5)
-    #error "Cannot use IMAGINE_TWIST except for p == 5 mod 8"
-#endif
-
-#if (COFACTOR != 8) && (COFACTOR != 4)
-    #error "COFACTOR must be 4 or 8"
-#endif
- 
-#if IMAGINE_TWIST
-    extern const gf SQRT_MINUS_ONE;
-#endif
-
-#define WBITS CRYPTONITE_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */
-
-extern const point_t API_NS(point_base);
-
-/* Projective Niels coordinates */
-typedef struct { gf a, b, c; } niels_s, niels_t[1];
-typedef struct { niels_t n; gf z; } VECTOR_ALIGNED pniels_s, pniels_t[1];
-
-/* Precomputed base */
-struct precomputed_s { niels_t table [COMBS_N<<(COMBS_T-1)]; };
-
-extern const gf API_NS(precomputed_base_as_fe)[];
-const precomputed_s *API_NS(precomputed_base) =
-    (const precomputed_s *) &API_NS(precomputed_base_as_fe);
-
-const size_t API_NS(sizeof_precomputed_s) = sizeof(precomputed_s);
-const size_t API_NS(alignof_precomputed_s) = sizeof(big_register_t);
-
-/** Inverse. */
-static void
-cryptonite_gf_invert(gf y, const gf x, int assert_nonzero) {
-    gf t1, t2;
-    cryptonite_gf_sqr(t1, x); // o^2
-    mask_t ret = cryptonite_gf_isr(t2, t1); // +-1/sqrt(o^2) = +-1/o
-    (void)ret;
-    if (assert_nonzero) assert(ret);
-    cryptonite_gf_sqr(t1, t2);
-    cryptonite_gf_mul(t2, t1, x); // not direct to y in case of alias.
-    cryptonite_gf_copy(y, t2);
-}
-
-/** Return high bit of x = low bit of 2x mod p */
-static mask_t cryptonite_gf_lobit(const gf x) {
-    gf y;
-    cryptonite_gf_copy(y,x);
-    cryptonite_gf_strong_reduce(y);
-    return -(y->limb[0]&1);
-}
-
-/** identity = (0,1) */
-const point_t API_NS(point_identity) = {{{{{0}}},{{{1}}},{{{1}}},{{{0}}}}};
-
-void API_NS(deisogenize) (
-    cryptonite_gf_s *__restrict__ s,
-    cryptonite_gf_s *__restrict__ minus_t_over_s,
-    const point_t p,
-    mask_t toggle_hibit_s,
-    mask_t toggle_hibit_t_over_s,
-    mask_t toggle_rotation
-);
-
-void API_NS(deisogenize) (
-    cryptonite_gf_s *__restrict__ s,
-    cryptonite_gf_s *__restrict__ minus_t_over_s,
-    const point_t p,
-    mask_t toggle_hibit_s,
-    mask_t toggle_hibit_t_over_s,
-    mask_t toggle_rotation
-) {
-#if COFACTOR == 4 && !IMAGINE_TWIST
-    (void) toggle_rotation;
-    
-    gf b, d;
-    cryptonite_gf_s *c = s, *a = minus_t_over_s;
-    cryptonite_gf_mulw(a, p->y, 1-EDWARDS_D);
-    cryptonite_gf_mul(c, a, p->t);     /* -dYT, with EDWARDS_D = d-1 */
-    cryptonite_gf_mul(a, p->x, p->z); 
-    cryptonite_gf_sub(d, c, a);  /* aXZ-dYT with a=-1 */
-    cryptonite_gf_add(a, p->z, p->y); 
-    cryptonite_gf_sub(b, p->z, p->y); 
-    cryptonite_gf_mul(c, b, a);
-    cryptonite_gf_mulw(b, c, -EDWARDS_D); /* (a-d)(Z+Y)(Z-Y) */
-    mask_t ok = cryptonite_gf_isr (a,b); /* r in the paper */
-    (void)ok; assert(ok | cryptonite_gf_eq(b,ZERO));
-    cryptonite_gf_mulw (b, a, -EDWARDS_D); /* u in the paper */
-
-    cryptonite_gf_mul(c,a,d); /* r(aZX-dYT) */
-    cryptonite_gf_mul(a,b,p->z); /* uZ */
-    cryptonite_gf_add(a,a,a); /* 2uZ */
-    
-    mask_t tg = toggle_hibit_t_over_s ^ ~cryptonite_gf_hibit(minus_t_over_s);
-    cryptonite_gf_cond_neg(minus_t_over_s, tg); /* t/s <-? -t/s */
-    cryptonite_gf_cond_neg(c, tg); /* u <- -u if negative. */
-    
-    cryptonite_gf_add(d,c,p->y);
-    cryptonite_gf_mul(s,b,d);
-    cryptonite_gf_cond_neg(s, toggle_hibit_s ^ cryptonite_gf_hibit(s));
-#else
-    /* More complicated because of rotation */
-    /* MAGIC This code is wrong for certain non-Curve25519 curves;
-     * check if it's because of Cofactor==8 or IMAGINE_TWIST */
-    
-    gf c, d;
-    cryptonite_gf_s *b = s, *a = minus_t_over_s;
-
-    #if IMAGINE_TWIST
-        gf x, t;
-        cryptonite_gf_div_qnr(x,p->x);
-        cryptonite_gf_div_qnr(t,p->t);
-        cryptonite_gf_add ( a, p->z, x );
-        cryptonite_gf_sub ( b, p->z, x );
-        cryptonite_gf_mul ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 - X^2 */
-    #else
-        const cryptonite_gf_s *x = p->x, *t = p->t;
-        cryptonite_gf_sqr ( a, p->z );
-        cryptonite_gf_sqr ( b, p->x );
-        cryptonite_gf_add ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 + X^2 */
-    #endif
-    /* Here: c = "zx" in the SAGE code = Z^2 - aX^2 */
-    
-    cryptonite_gf_mul ( a, p->z, t ); /* "tz" = T*Z */
-    cryptonite_gf_sqr ( b, a );
-    cryptonite_gf_mul ( d, b, c ); /* (TZ)^2 * (Z^2-aX^2) */
-    mask_t ok = cryptonite_gf_isr(b, d);
-    (void)ok; assert(ok | cryptonite_gf_eq(d,ZERO));
-    cryptonite_gf_mul ( d, b, a ); /* "osx" = 1 / sqrt(z^2-ax^2) */
-    cryptonite_gf_mul ( a, b, c ); 
-    cryptonite_gf_mul ( b, a, d ); /* 1/tz */
-
-    mask_t rotate;
-    #if (COFACTOR == 8)
-        gf e;
-        cryptonite_gf_sqr(e, p->z);
-        cryptonite_gf_mul(a, e, b); /* z^2 / tz = z/t = 1/xy */
-        rotate = cryptonite_gf_hibit(a) ^ toggle_rotation;
-        /* Curve25519: cond select between zx * 1/tz or sqrt(1-d); y=-x */
-        cryptonite_gf_mul ( a, b, c ); 
-        cryptonite_gf_cond_sel ( a, a, SQRT_ONE_MINUS_D, rotate );
-        cryptonite_gf_cond_sel ( e, p->y, x, rotate );
-    #else
-        const cryptonite_gf_s *e = x;
-        (void)toggle_rotation;
-        rotate = 0;
-    #endif
-    
-    cryptonite_gf_mul ( c, a, d ); // new "osx"
-    cryptonite_gf_mul ( a, c, p->z );
-    cryptonite_gf_add ( minus_t_over_s, a, a ); // 2 * "osx" * Z
-    cryptonite_gf_mul ( d, b, p->z );
-    
-    mask_t tg = toggle_hibit_t_over_s ^~ cryptonite_gf_hibit(minus_t_over_s);
-    cryptonite_gf_cond_neg ( minus_t_over_s, tg );
-    cryptonite_gf_cond_neg ( c, rotate ^ tg );
-    cryptonite_gf_add ( d, d, c );
-    cryptonite_gf_mul ( s, d, e ); /* here "x" = y unless rotate */
-    cryptonite_gf_cond_neg ( s, toggle_hibit_s ^ cryptonite_gf_hibit(s) );
-#endif
-}
-
-void API_NS(point_encode)( unsigned char ser[SER_BYTES], const point_t p ) {
-    gf s, mtos;
-    API_NS(deisogenize)(s,mtos,p,0,0,0);
-    cryptonite_gf_serialize(ser,s,0);
-}
-
-cryptonite_decaf_error_t API_NS(point_decode) (
-    point_t p,
-    const unsigned char ser[SER_BYTES],
-    cryptonite_decaf_bool_t allow_identity
-) {
-    gf s, a, b, c, d, e, f;
-    mask_t succ = cryptonite_gf_deserialize(s, ser, 0);
-    mask_t zero = cryptonite_gf_eq(s, ZERO);
-    succ &= bool_to_mask(allow_identity) | ~zero;
-    cryptonite_gf_sqr ( a, s ); /* s^2 */
-#if IMAGINE_TWIST
-    cryptonite_gf_sub ( f, ONE, a ); /* f = 1-as^2 = 1-s^2*/
-#else
-    cryptonite_gf_add ( f, ONE, a ); /* f = 1-as^2 = 1+s^2 */
-#endif
-    succ &= ~ cryptonite_gf_eq( f, ZERO );
-    cryptonite_gf_sqr ( b, f );  /* (1-as^2)^2 = 1 - 2as^2 + a^2 s^4 */
-    cryptonite_gf_mulw ( c, a, 4*IMAGINE_TWIST-4*EDWARDS_D ); 
-    cryptonite_gf_add ( c, c, b ); /* t^2 = 1 + (2a-4d) s^2 + s^4 */
-    cryptonite_gf_mul ( d, f, s ); /* s * (1-as^2) for denoms */
-    cryptonite_gf_sqr ( e, d );    /* s^2 * (1-as^2)^2 */
-    cryptonite_gf_mul ( b, c, e ); /* t^2 * s^2 * (1-as^2)^2 */
-    
-    succ &= cryptonite_gf_isr(e,b) | cryptonite_gf_eq(b,ZERO); /* e = 1/(t s (1-as^2)) */
-    cryptonite_gf_mul ( b, e, d ); /* 1 / t */
-    cryptonite_gf_mul ( d, e, c ); /* t / (s(1-as^2)) */
-    cryptonite_gf_mul ( e, d, f ); /* t / s */
-    mask_t negtos = cryptonite_gf_hibit(e);
-    cryptonite_gf_cond_neg(b, negtos);
-    cryptonite_gf_cond_neg(d, negtos);
-
-#if IMAGINE_TWIST
-    cryptonite_gf_add ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */
-#else
-    cryptonite_gf_sub ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */
-#endif
-
-#if COFACTOR == 8
-    cryptonite_gf_mul ( a, p->z, d); /* t(1+s^2) / s(1-s^2) = 2/xy */
-    succ &= ~cryptonite_gf_lobit(a); /* = ~cryptonite_gf_hibit(a/2), since cryptonite_gf_hibit(x) = cryptonite_gf_lobit(2x) */
-#endif
-    
-    cryptonite_gf_mul ( a, f, b ); /* y = (1-s^2) / t */
-    cryptonite_gf_mul ( p->y, p->z, a ); /* Y = yZ */
-#if IMAGINE_TWIST
-    cryptonite_gf_add ( b, s, s );
-    cryptonite_gf_mul(p->x, b, SQRT_MINUS_ONE); /* Curve25519 */
-#else
-    cryptonite_gf_add ( p->x, s, s );
-#endif
-    cryptonite_gf_mul ( p->t, p->x, a ); /* T = 2s (1-as^2)/t */
-    
-#if UNSAFE_CURVE_HAS_POINTS_AT_INFINITY
-    /* This can't happen for any of the supported configurations.
-     *
-     * If it can happen (because s=1), it's because the curve has points
-     * at infinity, which means that there may be critical security bugs
-     * elsewhere in the library.  In that case, it's better that you hit
-     * the assertion in point_valid, which will happen in the test suite
-     * since it tests s=1.
-     *
-     * This debugging option is to allow testing of IMAGINE_TWIST = 0 on
-     * Ed25519, without hitting that assertion.  Don't use it in
-     * production.
-     */
-    succ &= ~cryptonite_gf_eq(p->z,ZERO);
-#endif
-    
-    p->y->limb[0] -= zero;
-    assert(API_NS(point_valid)(p) | ~succ);
-    
-    return cryptonite_decaf_succeed_if(mask_to_bool(succ));
-}
-
-#if IMAGINE_TWIST
-#define TWISTED_D (-(EDWARDS_D))
-#else
-#define TWISTED_D ((EDWARDS_D)-1)
-#endif
-
-#if TWISTED_D < 0
-#define EFF_D (-(TWISTED_D))
-#define NEG_D 1
-#else
-#define EFF_D TWISTED_D
-#define NEG_D 0
-#endif
-
-void API_NS(point_sub) (
-    point_t p,
-    const point_t q,
-    const point_t r
-) {
-    gf a, b, c, d;
-    cryptonite_gf_sub_nr ( b, q->y, q->x ); /* 3+e */
-    cryptonite_gf_sub_nr ( d, r->y, r->x ); /* 3+e */
-    cryptonite_gf_add_nr ( c, r->y, r->x ); /* 2+e */
-    cryptonite_gf_mul ( a, c, b );
-    cryptonite_gf_add_nr ( b, q->y, q->x ); /* 2+e */
-    cryptonite_gf_mul ( p->y, d, b );
-    cryptonite_gf_mul ( b, r->t, q->t );
-    cryptonite_gf_mulw ( p->x, b, 2*EFF_D );
-    cryptonite_gf_add_nr ( b, a, p->y );    /* 2+e */
-    cryptonite_gf_sub_nr ( c, p->y, a );    /* 3+e */
-    cryptonite_gf_mul ( a, q->z, r->z );
-    cryptonite_gf_add_nr ( a, a, a );       /* 2+e */
-    if (GF_HEADROOM <= 3) cryptonite_gf_weak_reduce(a); /* or 1+e */
-#if NEG_D
-    cryptonite_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */
-    cryptonite_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */
-#else
-    cryptonite_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */
-    cryptonite_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */
-#endif
-    cryptonite_gf_mul ( p->z, a, p->y );
-    cryptonite_gf_mul ( p->x, p->y, c );
-    cryptonite_gf_mul ( p->y, a, b );
-    cryptonite_gf_mul ( p->t, b, c );
-}
-    
-void API_NS(point_add) (
-    point_t p,
-    const point_t q,
-    const point_t r
-) {
-    gf a, b, c, d;
-    cryptonite_gf_sub_nr ( b, q->y, q->x ); /* 3+e */
-    cryptonite_gf_sub_nr ( c, r->y, r->x ); /* 3+e */
-    cryptonite_gf_add_nr ( d, r->y, r->x ); /* 2+e */
-    cryptonite_gf_mul ( a, c, b );
-    cryptonite_gf_add_nr ( b, q->y, q->x ); /* 2+e */
-    cryptonite_gf_mul ( p->y, d, b );
-    cryptonite_gf_mul ( b, r->t, q->t );
-    cryptonite_gf_mulw ( p->x, b, 2*EFF_D );
-    cryptonite_gf_add_nr ( b, a, p->y );    /* 2+e */
-    cryptonite_gf_sub_nr ( c, p->y, a );    /* 3+e */
-    cryptonite_gf_mul ( a, q->z, r->z );
-    cryptonite_gf_add_nr ( a, a, a );       /* 2+e */
-    if (GF_HEADROOM <= 3) cryptonite_gf_weak_reduce(a); /* or 1+e */
-#if NEG_D
-    cryptonite_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */
-    cryptonite_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */
-#else
-    cryptonite_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */
-    cryptonite_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */
-#endif
-    cryptonite_gf_mul ( p->z, a, p->y );
-    cryptonite_gf_mul ( p->x, p->y, c );
-    cryptonite_gf_mul ( p->y, a, b );
-    cryptonite_gf_mul ( p->t, b, c );
-}
-
-static CRYPTONITE_DECAF_NOINLINE void
-point_double_internal (
-    point_t p,
-    const point_t q,
-    int before_double
-) {
-    gf a, b, c, d;
-    cryptonite_gf_sqr ( c, q->x );
-    cryptonite_gf_sqr ( a, q->y );
-    cryptonite_gf_add_nr ( d, c, a );             /* 2+e */
-    cryptonite_gf_add_nr ( p->t, q->y, q->x );    /* 2+e */
-    cryptonite_gf_sqr ( b, p->t );
-    cryptonite_gf_subx_nr ( b, b, d, 3 );         /* 4+e */
-    cryptonite_gf_sub_nr ( p->t, a, c );          /* 3+e */
-    cryptonite_gf_sqr ( p->x, q->z );
-    cryptonite_gf_add_nr ( p->z, p->x, p->x );    /* 2+e */
-    cryptonite_gf_subx_nr ( a, p->z, p->t, 4 );   /* 6+e */
-    if (GF_HEADROOM == 5) cryptonite_gf_weak_reduce(a); /* or 1+e */
-    cryptonite_gf_mul ( p->x, a, b );
-    cryptonite_gf_mul ( p->z, p->t, a );
-    cryptonite_gf_mul ( p->y, p->t, d );
-    if (!before_double) cryptonite_gf_mul ( p->t, b, d );
-}
-
-void API_NS(point_double)(point_t p, const point_t q) {
-    point_double_internal(p,q,0);
-}
-
-void API_NS(point_negate) (
-   point_t nega,
-   const point_t a
-) {
-    cryptonite_gf_sub(nega->x, ZERO, a->x);
-    cryptonite_gf_copy(nega->y, a->y);
-    cryptonite_gf_copy(nega->z, a->z);
-    cryptonite_gf_sub(nega->t, ZERO, a->t);
-}
-
-/* Operations on [p]niels */
-static CRYPTONITE_DECAF_INLINE void
-cond_neg_niels (
-    niels_t n,
-    mask_t neg
-) {
-    cryptonite_gf_cond_swap(n->a, n->b, neg);
-    cryptonite_gf_cond_neg(n->c, neg);
-}
-
-static CRYPTONITE_DECAF_NOINLINE void pt_to_pniels (
-    pniels_t b,
-    const point_t a
-) {
-    cryptonite_gf_sub ( b->n->a, a->y, a->x );
-    cryptonite_gf_add ( b->n->b, a->x, a->y );
-    cryptonite_gf_mulw ( b->n->c, a->t, 2*TWISTED_D );
-    cryptonite_gf_add ( b->z, a->z, a->z );
-}
-
-static CRYPTONITE_DECAF_NOINLINE void pniels_to_pt (
-    point_t e,
-    const pniels_t d
-) {
-    gf eu;
-    cryptonite_gf_add ( eu, d->n->b, d->n->a );
-    cryptonite_gf_sub ( e->y, d->n->b, d->n->a );
-    cryptonite_gf_mul ( e->t, e->y, eu);
-    cryptonite_gf_mul ( e->x, d->z, e->y );
-    cryptonite_gf_mul ( e->y, d->z, eu );
-    cryptonite_gf_sqr ( e->z, d->z );
-}
-
-static CRYPTONITE_DECAF_NOINLINE void
-niels_to_pt (
-    point_t e,
-    const niels_t n
-) {
-    cryptonite_gf_add ( e->y, n->b, n->a );
-    cryptonite_gf_sub ( e->x, n->b, n->a );
-    cryptonite_gf_mul ( e->t, e->y, e->x );
-    cryptonite_gf_copy ( e->z, ONE );
-}
-
-static CRYPTONITE_DECAF_NOINLINE void
-add_niels_to_pt (
-    point_t d,
-    const niels_t e,
-    int before_double
-) {
-    gf a, b, c;
-    cryptonite_gf_sub_nr ( b, d->y, d->x ); /* 3+e */
-    cryptonite_gf_mul ( a, e->a, b );
-    cryptonite_gf_add_nr ( b, d->x, d->y ); /* 2+e */
-    cryptonite_gf_mul ( d->y, e->b, b );
-    cryptonite_gf_mul ( d->x, e->c, d->t );
-    cryptonite_gf_add_nr ( c, a, d->y );    /* 2+e */
-    cryptonite_gf_sub_nr ( b, d->y, a );    /* 3+e */
-    cryptonite_gf_sub_nr ( d->y, d->z, d->x ); /* 3+e */
-    cryptonite_gf_add_nr ( a, d->x, d->z ); /* 2+e */
-    cryptonite_gf_mul ( d->z, a, d->y );
-    cryptonite_gf_mul ( d->x, d->y, b );
-    cryptonite_gf_mul ( d->y, a, c );
-    if (!before_double) cryptonite_gf_mul ( d->t, b, c );
-}
-
-static CRYPTONITE_DECAF_NOINLINE void
-sub_niels_from_pt (
-    point_t d,
-    const niels_t e,
-    int before_double
-) {
-    gf a, b, c;
-    cryptonite_gf_sub_nr ( b, d->y, d->x ); /* 3+e */
-    cryptonite_gf_mul ( a, e->b, b );
-    cryptonite_gf_add_nr ( b, d->x, d->y ); /* 2+e */
-    cryptonite_gf_mul ( d->y, e->a, b );
-    cryptonite_gf_mul ( d->x, e->c, d->t );
-    cryptonite_gf_add_nr ( c, a, d->y );    /* 2+e */
-    cryptonite_gf_sub_nr ( b, d->y, a );    /* 3+e */
-    cryptonite_gf_add_nr ( d->y, d->z, d->x ); /* 2+e */
-    cryptonite_gf_sub_nr ( a, d->z, d->x ); /* 3+e */
-    cryptonite_gf_mul ( d->z, a, d->y );
-    cryptonite_gf_mul ( d->x, d->y, b );
-    cryptonite_gf_mul ( d->y, a, c );
-    if (!before_double) cryptonite_gf_mul ( d->t, b, c );
-}
-
-static void
-add_pniels_to_pt (
-    point_t p,
-    const pniels_t pn,
-    int before_double
-) {
-    gf L0;
-    cryptonite_gf_mul ( L0, p->z, pn->z );
-    cryptonite_gf_copy ( p->z, L0 );
-    add_niels_to_pt( p, pn->n, before_double );
-}
-
-static void
-sub_pniels_from_pt (
-    point_t p,
-    const pniels_t pn,
-    int before_double
-) {
-    gf L0;
-    cryptonite_gf_mul ( L0, p->z, pn->z );
-    cryptonite_gf_copy ( p->z, L0 );
-    sub_niels_from_pt( p, pn->n, before_double );
-}
-
-static CRYPTONITE_DECAF_NOINLINE void
-prepare_fixed_window(
-    pniels_t *multiples,
-    const point_t b,
-    int ntable
-) {
-    point_t tmp;
-    pniels_t pn;
-    int i;
-    
-    point_double_internal(tmp, b, 0);
-    pt_to_pniels(pn, tmp);
-    pt_to_pniels(multiples[0], b);
-    API_NS(point_copy)(tmp, b);
-    for (i=1; i<ntable; i++) {
-        add_pniels_to_pt(tmp, pn, 0);
-        pt_to_pniels(multiples[i], tmp);
-    }
-    
-    cryptonite_decaf_bzero(pn,sizeof(pn));
-    cryptonite_decaf_bzero(tmp,sizeof(tmp));
-}
-
-void API_NS(point_scalarmul) (
-    point_t a,
-    const point_t b,
-    const scalar_t scalar
-) {
-    const int WINDOW = CRYPTONITE_DECAF_WINDOW_BITS,
-        WINDOW_MASK = (1<<WINDOW)-1,
-        WINDOW_T_MASK = WINDOW_MASK >> 1,
-        NTABLE = 1<<(WINDOW-1);
-        
-    scalar_t scalar1x;
-    API_NS(scalar_add)(scalar1x, scalar, point_scalarmul_adjustment);
-    API_NS(scalar_halve)(scalar1x,scalar1x);
-    
-    /* Set up a precomputed table with odd multiples of b. */
-    pniels_t pn, multiples[NTABLE];
-    point_t tmp;
-    prepare_fixed_window(multiples, b, NTABLE);
-
-    /* Initialize. */
-    int i,j,first=1;
-    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;
-
-    for (; i>=0; i-=WINDOW) {
-        /* Fetch another block of bits */
-        word_t bits = scalar1x->limb[i/WBITS] >> (i%WBITS);
-        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {
-            bits ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
-        }
-        bits &= WINDOW_MASK;
-        mask_t inv = (bits>>(WINDOW-1))-1;
-        bits ^= inv;
-    
-        /* Add in from table.  Compute t only on last iteration. */
-        constant_time_lookup(pn, multiples, sizeof(pn), NTABLE, bits & WINDOW_T_MASK);
-        cond_neg_niels(pn->n, inv);
-        if (first) {
-            pniels_to_pt(tmp, pn);
-            first = 0;
-        } else {
-           /* Using Hisil et al's lookahead method instead of extensible here
-            * for no particular reason.  Double WINDOW times, but only compute t on
-            * the last one.
-            */
-            for (j=0; j<WINDOW-1; j++)
-                point_double_internal(tmp, tmp, -1);
-            point_double_internal(tmp, tmp, 0);
-            add_pniels_to_pt(tmp, pn, i ? -1 : 0);
-        }
-    }
-    
-    /* Write out the answer */
-    API_NS(point_copy)(a,tmp);
-    
-    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));
-    cryptonite_decaf_bzero(pn,sizeof(pn));
-    cryptonite_decaf_bzero(multiples,sizeof(multiples));
-    cryptonite_decaf_bzero(tmp,sizeof(tmp));
-}
-
-void API_NS(point_double_scalarmul) (
-    point_t a,
-    const point_t b,
-    const scalar_t scalarb,
-    const point_t c,
-    const scalar_t scalarc
-) {
-    const int WINDOW = CRYPTONITE_DECAF_WINDOW_BITS,
-        WINDOW_MASK = (1<<WINDOW)-1,
-        WINDOW_T_MASK = WINDOW_MASK >> 1,
-        NTABLE = 1<<(WINDOW-1);
-        
-    scalar_t scalar1x, scalar2x;
-    API_NS(scalar_add)(scalar1x, scalarb, point_scalarmul_adjustment);
-    API_NS(scalar_halve)(scalar1x,scalar1x);
-    API_NS(scalar_add)(scalar2x, scalarc, point_scalarmul_adjustment);
-    API_NS(scalar_halve)(scalar2x,scalar2x);
-    
-    /* Set up a precomputed table with odd multiples of b. */
-    pniels_t pn, multiples1[NTABLE], multiples2[NTABLE];
-    point_t tmp;
-    prepare_fixed_window(multiples1, b, NTABLE);
-    prepare_fixed_window(multiples2, c, NTABLE);
-
-    /* Initialize. */
-    int i,j,first=1;
-    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;
-
-    for (; i>=0; i-=WINDOW) {
-        /* Fetch another block of bits */
-        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),
-                     bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);
-        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {
-            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
-            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
-        }
-        bits1 &= WINDOW_MASK;
-        bits2 &= WINDOW_MASK;
-        mask_t inv1 = (bits1>>(WINDOW-1))-1;
-        mask_t inv2 = (bits2>>(WINDOW-1))-1;
-        bits1 ^= inv1;
-        bits2 ^= inv2;
-    
-        /* Add in from table.  Compute t only on last iteration. */
-        constant_time_lookup(pn, multiples1, sizeof(pn), NTABLE, bits1 & WINDOW_T_MASK);
-        cond_neg_niels(pn->n, inv1);
-        if (first) {
-            pniels_to_pt(tmp, pn);
-            first = 0;
-        } else {
-           /* Using Hisil et al's lookahead method instead of extensible here
-            * for no particular reason.  Double WINDOW times, but only compute t on
-            * the last one.
-            */
-            for (j=0; j<WINDOW-1; j++)
-                point_double_internal(tmp, tmp, -1);
-            point_double_internal(tmp, tmp, 0);
-            add_pniels_to_pt(tmp, pn, 0);
-        }
-        constant_time_lookup(pn, multiples2, sizeof(pn), NTABLE, bits2 & WINDOW_T_MASK);
-        cond_neg_niels(pn->n, inv2);
-        add_pniels_to_pt(tmp, pn, i?-1:0);
-    }
-    
-    /* Write out the answer */
-    API_NS(point_copy)(a,tmp);
-    
-
-    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));
-    cryptonite_decaf_bzero(scalar2x,sizeof(scalar2x));
-    cryptonite_decaf_bzero(pn,sizeof(pn));
-    cryptonite_decaf_bzero(multiples1,sizeof(multiples1));
-    cryptonite_decaf_bzero(multiples2,sizeof(multiples2));
-    cryptonite_decaf_bzero(tmp,sizeof(tmp));
-}
-
-void API_NS(point_dual_scalarmul) (
-    point_t a1,
-    point_t a2,
-    const point_t b,
-    const scalar_t scalar1,
-    const scalar_t scalar2
-) {
-    const int WINDOW = CRYPTONITE_DECAF_WINDOW_BITS,
-        WINDOW_MASK = (1<<WINDOW)-1,
-        WINDOW_T_MASK = WINDOW_MASK >> 1,
-        NTABLE = 1<<(WINDOW-1);
-        
-    scalar_t scalar1x, scalar2x;
-    API_NS(scalar_add)(scalar1x, scalar1, point_scalarmul_adjustment);
-    API_NS(scalar_halve)(scalar1x,scalar1x);
-    API_NS(scalar_add)(scalar2x, scalar2, point_scalarmul_adjustment);
-    API_NS(scalar_halve)(scalar2x,scalar2x);
-    
-    /* Set up a precomputed table with odd multiples of b. */
-    point_t multiples1[NTABLE], multiples2[NTABLE], working, tmp;
-    pniels_t pn;
-    
-    API_NS(point_copy)(working, b);
-
-    /* Initialize. */
-    int i,j;
-    
-    for (i=0; i<NTABLE; i++) {
-        API_NS(point_copy)(multiples1[i], API_NS(point_identity));
-        API_NS(point_copy)(multiples2[i], API_NS(point_identity));
-    }
-
-    for (i=0; i<SCALAR_BITS; i+=WINDOW) {   
-        if (i) {
-            for (j=0; j<WINDOW-1; j++)
-                point_double_internal(working, working, -1);
-            point_double_internal(working, working, 0);
-        }
-        
-        /* Fetch another block of bits */
-        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),
-               bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);
-        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {
-            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
-            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
-        }
-        bits1 &= WINDOW_MASK;
-        bits2 &= WINDOW_MASK;
-        mask_t inv1 = (bits1>>(WINDOW-1))-1;
-        mask_t inv2 = (bits2>>(WINDOW-1))-1;
-        bits1 ^= inv1;
-        bits2 ^= inv2;
-        
-        pt_to_pniels(pn, working);
-
-        constant_time_lookup(tmp, multiples1, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);
-        cond_neg_niels(pn->n, inv1);
-        /* add_pniels_to_pt(multiples1[bits1 & WINDOW_T_MASK], pn, 0); */
-        add_pniels_to_pt(tmp, pn, 0);
-        constant_time_insert(multiples1, tmp, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);
-        
-        
-        constant_time_lookup(tmp, multiples2, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);
-        cond_neg_niels(pn->n, inv1^inv2);
-        /* add_pniels_to_pt(multiples2[bits2 & WINDOW_T_MASK], pn, 0); */
-        add_pniels_to_pt(tmp, pn, 0);
-        constant_time_insert(multiples2, tmp, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);
-    }
-    
-    if (NTABLE > 1) {
-        API_NS(point_copy)(working, multiples1[NTABLE-1]);
-        API_NS(point_copy)(tmp    , multiples2[NTABLE-1]);
-    
-        for (i=NTABLE-1; i>1; i--) {
-            API_NS(point_add)(multiples1[i-1], multiples1[i-1], multiples1[i]);
-            API_NS(point_add)(multiples2[i-1], multiples2[i-1], multiples2[i]);
-            API_NS(point_add)(working, working, multiples1[i-1]);
-            API_NS(point_add)(tmp,     tmp,     multiples2[i-1]);
-        }
-    
-        API_NS(point_add)(multiples1[0], multiples1[0], multiples1[1]);
-        API_NS(point_add)(multiples2[0], multiples2[0], multiples2[1]);
-        point_double_internal(working, working, 0);
-        point_double_internal(tmp,         tmp, 0);
-        API_NS(point_add)(a1, working, multiples1[0]);
-        API_NS(point_add)(a2, tmp,     multiples2[0]);
-    } else {
-        API_NS(point_copy)(a1, multiples1[0]);
-        API_NS(point_copy)(a2, multiples2[0]);
-    }
-
-    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));
-    cryptonite_decaf_bzero(scalar2x,sizeof(scalar2x));
-    cryptonite_decaf_bzero(pn,sizeof(pn));
-    cryptonite_decaf_bzero(multiples1,sizeof(multiples1));
-    cryptonite_decaf_bzero(multiples2,sizeof(multiples2));
-    cryptonite_decaf_bzero(tmp,sizeof(tmp));
-    cryptonite_decaf_bzero(working,sizeof(working));
-}
-
-cryptonite_decaf_bool_t API_NS(point_eq) ( const point_t p, const point_t q ) {
-    /* equality mod 2-torsion compares x/y */
-    gf a, b;
-    cryptonite_gf_mul ( a, p->y, q->x );
-    cryptonite_gf_mul ( b, q->y, p->x );
-    mask_t succ = cryptonite_gf_eq(a,b);
-    
-    #if (COFACTOR == 8) && IMAGINE_TWIST
-        cryptonite_gf_mul ( a, p->y, q->y );
-        cryptonite_gf_mul ( b, q->x, p->x );
-        #if !(IMAGINE_TWIST)
-            cryptonite_gf_sub ( a, ZERO, a );
-        #else
-           /* Interesting note: the 4tor would normally be rotation.
-            * But because of the *i twist, it's actually
-            * (x,y) <-> (iy,ix)
-            */
-    
-           /* No code, just a comment. */
-        #endif
-        succ |= cryptonite_gf_eq(a,b);
-    #endif
-    
-    return mask_to_bool(succ);
-}
-
-cryptonite_decaf_bool_t API_NS(point_valid) (
-    const point_t p
-) {
-    gf a,b,c;
-    cryptonite_gf_mul(a,p->x,p->y);
-    cryptonite_gf_mul(b,p->z,p->t);
-    mask_t out = cryptonite_gf_eq(a,b);
-    cryptonite_gf_sqr(a,p->x);
-    cryptonite_gf_sqr(b,p->y);
-    cryptonite_gf_sub(a,b,a);
-    cryptonite_gf_sqr(b,p->t);
-    cryptonite_gf_mulw(c,b,TWISTED_D);
-    cryptonite_gf_sqr(b,p->z);
-    cryptonite_gf_add(b,b,c);
-    out &= cryptonite_gf_eq(a,b);
-    out &= ~cryptonite_gf_eq(p->z,ZERO);
-    return mask_to_bool(out);
-}
-
-void API_NS(point_debugging_torque) (
-    point_t q,
-    const point_t p
-) {
-#if COFACTOR == 8 && IMAGINE_TWIST
-    gf tmp;
-    cryptonite_gf_mul(tmp,p->x,SQRT_MINUS_ONE);
-    cryptonite_gf_mul(q->x,p->y,SQRT_MINUS_ONE);
-    cryptonite_gf_copy(q->y,tmp);
-    cryptonite_gf_copy(q->z,p->z);
-    cryptonite_gf_sub(q->t,ZERO,p->t);
-#else
-    cryptonite_gf_sub(q->x,ZERO,p->x);
-    cryptonite_gf_sub(q->y,ZERO,p->y);
-    cryptonite_gf_copy(q->z,p->z);
-    cryptonite_gf_copy(q->t,p->t);
-#endif
-}
-
-void API_NS(point_debugging_pscale) (
-    point_t q,
-    const point_t p,
-    const uint8_t factor[SER_BYTES]
-) {
-    gf gfac,tmp;
-    /* NB this means you'll never pscale by negative numbers for p521 */
-    ignore_result(cryptonite_gf_deserialize(gfac,factor,0));
-    cryptonite_gf_cond_sel(gfac,gfac,ONE,cryptonite_gf_eq(gfac,ZERO));
-    cryptonite_gf_mul(tmp,p->x,gfac);
-    cryptonite_gf_copy(q->x,tmp);
-    cryptonite_gf_mul(tmp,p->y,gfac);
-    cryptonite_gf_copy(q->y,tmp);
-    cryptonite_gf_mul(tmp,p->z,gfac);
-    cryptonite_gf_copy(q->z,tmp);
-    cryptonite_gf_mul(tmp,p->t,gfac);
-    cryptonite_gf_copy(q->t,tmp);
-}
-
-static void cryptonite_gf_batch_invert (
-    gf *__restrict__ out,
-    const gf *in,
-    unsigned int n
-) {
-    gf t1;
-    assert(n>1);
-  
-    cryptonite_gf_copy(out[1], in[0]);
-    int i;
-    for (i=1; i<(int) (n-1); i++) {
-        cryptonite_gf_mul(out[i+1], out[i], in[i]);
-    }
-    cryptonite_gf_mul(out[0], out[n-1], in[n-1]);
-
-    cryptonite_gf_invert(out[0], out[0], 1);
-
-    for (i=n-1; i>0; i--) {
-        cryptonite_gf_mul(t1, out[i], out[0]);
-        cryptonite_gf_copy(out[i], t1);
-        cryptonite_gf_mul(t1, out[0], in[i]);
-        cryptonite_gf_copy(out[0], t1);
-    }
-}
-
-static void batch_normalize_niels (
-    niels_t *table,
-    const gf *zs,
-    gf *__restrict__ zis,
-    int n
-) {
-    int i;
-    gf product;
-    cryptonite_gf_batch_invert(zis, zs, n);
-
-    for (i=0; i<n; i++) {
-        cryptonite_gf_mul(product, table[i]->a, zis[i]);
-        cryptonite_gf_strong_reduce(product);
-        cryptonite_gf_copy(table[i]->a, product);
-        
-        cryptonite_gf_mul(product, table[i]->b, zis[i]);
-        cryptonite_gf_strong_reduce(product);
-        cryptonite_gf_copy(table[i]->b, product);
-        
-        cryptonite_gf_mul(product, table[i]->c, zis[i]);
-        cryptonite_gf_strong_reduce(product);
-        cryptonite_gf_copy(table[i]->c, product);
-    }
-    
-    cryptonite_decaf_bzero(product,sizeof(product));
-}
-
-void API_NS(precompute) (
-    precomputed_s *table,
-    const point_t base
-) { 
-    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;
-    assert(n*t*s >= SCALAR_BITS);
-  
-    point_t working, start, doubles[t-1];
-    API_NS(point_copy)(working, base);
-    pniels_t pn_tmp;
-  
-    gf zs[n<<(t-1)], zis[n<<(t-1)];
-  
-    unsigned int i,j,k;
-    
-    /* Compute n tables */
-    for (i=0; i<n; i++) {
-
-        /* Doubling phase */
-        for (j=0; j<t; j++) {
-            if (j) API_NS(point_add)(start, start, working);
-            else API_NS(point_copy)(start, working);
-
-            if (j==t-1 && i==n-1) break;
-
-            point_double_internal(working, working,0);
-            if (j<t-1) API_NS(point_copy)(doubles[j], working);
-
-            for (k=0; k<s-1; k++)
-                point_double_internal(working, working, k<s-2);
-        }
-
-        /* Gray-code phase */
-        for (j=0;; j++) {
-            int gray = j ^ (j>>1);
-            int idx = (((i+1)<<(t-1))-1) ^ gray;
-
-            pt_to_pniels(pn_tmp, start);
-            memcpy(table->table[idx], pn_tmp->n, sizeof(pn_tmp->n));
-            cryptonite_gf_copy(zs[idx], pn_tmp->z);
-			
-            if (j >= (1u<<(t-1)) - 1) break;
-            int delta = (j+1) ^ ((j+1)>>1) ^ gray;
-
-            for (k=0; delta>1; k++)
-                delta >>=1;
-            
-            if (gray & (1<<k)) {
-                API_NS(point_add)(start, start, doubles[k]);
-            } else {
-                API_NS(point_sub)(start, start, doubles[k]);
-            }
-        }
-    }
-    
-    batch_normalize_niels(table->table,(const gf *)zs,zis,n<<(t-1));
-    
-    cryptonite_decaf_bzero(zs,sizeof(zs));
-    cryptonite_decaf_bzero(zis,sizeof(zis));
-    cryptonite_decaf_bzero(pn_tmp,sizeof(pn_tmp));
-    cryptonite_decaf_bzero(working,sizeof(working));
-    cryptonite_decaf_bzero(start,sizeof(start));
-    cryptonite_decaf_bzero(doubles,sizeof(doubles));
-}
-
-static CRYPTONITE_DECAF_INLINE void
-constant_time_lookup_niels (
-    niels_s *__restrict__ ni,
-    const niels_t *table,
-    int nelts,
-    int idx
-) {
-    constant_time_lookup(ni, table, sizeof(niels_s), nelts, idx);
-}
-
-void API_NS(precomputed_scalarmul) (
-    point_t out,
-    const precomputed_s *table,
-    const scalar_t scalar
-) {
-    int i;
-    unsigned j,k;
-    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;
-    
-    scalar_t scalar1x;
-    API_NS(scalar_add)(scalar1x, scalar, precomputed_scalarmul_adjustment);
-    API_NS(scalar_halve)(scalar1x,scalar1x);
-    
-    niels_t ni;
-    
-    for (i=s-1; i>=0; i--) {
-        if (i != (int)s-1) point_double_internal(out,out,0);
-        
-        for (j=0; j<n; j++) {
-            int tab = 0;
-         
-            for (k=0; k<t; k++) {
-                unsigned int bit = i + s*(k + j*t);
-                if (bit < SCALAR_BITS) {
-                    tab |= (scalar1x->limb[bit/WBITS] >> (bit%WBITS) & 1) << k;
-                }
-            }
-            
-            mask_t invert = (tab>>(t-1))-1;
-            tab ^= invert;
-            tab &= (1<<(t-1)) - 1;
-
-            constant_time_lookup_niels(ni, &table->table[j<<(t-1)], 1<<(t-1), tab);
-
-            cond_neg_niels(ni, invert);
-            if ((i!=(int)s-1)||j) {
-                add_niels_to_pt(out, ni, j==n-1 && i);
-            } else {
-                niels_to_pt(out, ni);
-            }
-        }
-    }
-    
-    cryptonite_decaf_bzero(ni,sizeof(ni));
-    cryptonite_decaf_bzero(scalar1x,sizeof(scalar1x));
-}
-
-void API_NS(point_cond_sel) (
-    point_t out,
-    const point_t a,
-    const point_t b,
-    cryptonite_decaf_bool_t pick_b
-) {
-    constant_time_select(out,a,b,sizeof(point_t),bool_to_mask(pick_b),0);
-}
-
-/* FUTURE: restore Curve25519 Montgomery ladder? */
-cryptonite_decaf_error_t API_NS(direct_scalarmul) (
-    uint8_t scaled[SER_BYTES],
-    const uint8_t base[SER_BYTES],
-    const scalar_t scalar,
-    cryptonite_decaf_bool_t allow_identity,
-    cryptonite_decaf_bool_t short_circuit
-) {
-    point_t basep;
-    cryptonite_decaf_error_t succ = API_NS(point_decode)(basep, base, allow_identity);
-    if (short_circuit && succ != CRYPTONITE_DECAF_SUCCESS) return succ;
-    API_NS(point_cond_sel)(basep, API_NS(point_base), basep, succ);
-    API_NS(point_scalarmul)(basep, basep, scalar);
-    API_NS(point_encode)(scaled, basep);
-    API_NS(point_destroy)(basep);
-    return succ;
-}
-
-void API_NS(point_mul_by_cofactor_and_encode_like_eddsa) (
-    uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const point_t p
-) {
-    
-    /* The point is now on the twisted curve.  Move it to untwisted. */
-    gf x, y, z, t;
-    point_t q;
-#if COFACTOR == 8
-    API_NS(point_double)(q,p);
-#else
-    API_NS(point_copy)(q,p);
-#endif
-    
-#if EDDSA_USE_SIGMA_ISOGENY
-    {
-        /* Use 4-isogeny like ed25519:
-         *   2*x*y*sqrt(d/a-1)/(ax^2 + y^2 - 2)
-         *   (y^2 - ax^2)/(y^2 + ax^2)
-         * with a = -1, d = -EDWARDS_D:
-         *   -2xysqrt(EDWARDS_D-1)/(2z^2-y^2+x^2)
-         *   (y^2+x^2)/(y^2-x^2)
-         */
-        gf u;
-        cryptonite_gf_sqr ( x, q->x ); // x^2
-        cryptonite_gf_sqr ( t, q->y ); // y^2
-        cryptonite_gf_add( u, x, t ); // x^2 + y^2
-        cryptonite_gf_add( z, q->y, q->x );
-        cryptonite_gf_sqr ( y, z);
-        cryptonite_gf_sub ( y, u, y ); // -2xy
-        cryptonite_gf_sub ( z, t, x ); // y^2 - x^2
-        cryptonite_gf_sqr ( x, q->z );
-        cryptonite_gf_add ( t, x, x);
-        cryptonite_gf_sub ( t, t, z);  // 2z^2 - y^2 + x^2
-        cryptonite_gf_mul ( x, y, z ); // 2xy(y^2-x^2)
-        cryptonite_gf_mul ( y, u, t ); // (x^2+y^2)(2z^2-y^2+x^2)
-        cryptonite_gf_mul ( u, z, t );
-        cryptonite_gf_copy( z, u );
-        cryptonite_gf_mul ( u, x, SQRT_ONE_MINUS_D );
-        cryptonite_gf_copy( x, u );
-        cryptonite_decaf_bzero(u,sizeof(u));
-    }
-#elif IMAGINE_TWIST
-    {
-        API_NS(point_double)(q,q);
-        API_NS(point_double)(q,q);
-        cryptonite_gf_mul_qnr(x, q->x);
-        cryptonite_gf_copy(y, q->y);
-        cryptonite_gf_copy(z, q->z);
-    }
-#else
-    {
-        /* 4-isogeny: 2xy/(y^+x^2), (y^2-x^2)/(2z^2-y^2+x^2) */
-        gf u;
-        cryptonite_gf_sqr ( x, q->x );
-        cryptonite_gf_sqr ( t, q->y );
-        cryptonite_gf_add( u, x, t );
-        cryptonite_gf_add( z, q->y, q->x );
-        cryptonite_gf_sqr ( y, z);
-        cryptonite_gf_sub ( y, u, y );
-        cryptonite_gf_sub ( z, t, x );
-        cryptonite_gf_sqr ( x, q->z );
-        cryptonite_gf_add ( t, x, x); 
-        cryptonite_gf_sub ( t, t, z);
-        cryptonite_gf_mul ( x, t, y );
-        cryptonite_gf_mul ( y, z, u );
-        cryptonite_gf_mul ( z, u, t );
-        cryptonite_decaf_bzero(u,sizeof(u));
-    }
-#endif
-    /* Affinize */
-    cryptonite_gf_invert(z,z,1);
-    cryptonite_gf_mul(t,x,z);
-    cryptonite_gf_mul(x,y,z);
-    
-    /* Encode */
-    enc[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] = 0;
-    cryptonite_gf_serialize(enc, x, 1);
-    enc[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] |= 0x80 & cryptonite_gf_lobit(t);
-
-    cryptonite_decaf_bzero(x,sizeof(x));
-    cryptonite_decaf_bzero(y,sizeof(y));
-    cryptonite_decaf_bzero(z,sizeof(z));
-    cryptonite_decaf_bzero(t,sizeof(t));
-    API_NS(point_destroy)(q);
-}
-
-
-cryptonite_decaf_error_t API_NS(point_decode_like_eddsa_and_ignore_cofactor) (
-    point_t p,
-    const uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]
-) {
-    uint8_t enc2[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES];
-    memcpy(enc2,enc,sizeof(enc2));
-
-    mask_t low = ~word_is_zero(enc2[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] & 0x80);
-    enc2[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1] &= ~0x80;
-    
-    mask_t succ = cryptonite_gf_deserialize(p->y, enc2, 1);
-#if 0 == 0
-    succ &= word_is_zero(enc2[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES-1]);
-#endif
-
-    cryptonite_gf_sqr(p->x,p->y);
-    cryptonite_gf_sub(p->z,ONE,p->x); /* num = 1-y^2 */
-    #if EDDSA_USE_SIGMA_ISOGENY
-        cryptonite_gf_mulw(p->t,p->z,EDWARDS_D); /* d-dy^2 */
-        cryptonite_gf_mulw(p->x,p->z,EDWARDS_D-1); /* num = (1-y^2)(d-1) */
-        cryptonite_gf_copy(p->z,p->x);
-    #else
-        cryptonite_gf_mulw(p->t,p->x,EDWARDS_D); /* dy^2 */
-    #endif
-    cryptonite_gf_sub(p->t,ONE,p->t); /* denom = 1-dy^2 or 1-d + dy^2 */
-    
-    cryptonite_gf_mul(p->x,p->z,p->t);
-    succ &= cryptonite_gf_isr(p->t,p->x); /* 1/sqrt(num * denom) */
-    
-    cryptonite_gf_mul(p->x,p->t,p->z); /* sqrt(num / denom) */
-    cryptonite_gf_cond_neg(p->x,~cryptonite_gf_lobit(p->x)^low);
-    cryptonite_gf_copy(p->z,ONE);
-  
-    #if EDDSA_USE_SIGMA_ISOGENY
-    {
-       /* Use 4-isogeny like ed25519:
-        *   2*x*y/sqrt(1-d/a)/(ax^2 + y^2 - 2)
-        *   (y^2 - ax^2)/(y^2 + ax^2)
-        * (MAGIC: above formula may be off by a factor of -a
-        * or something somewhere; check it for other a)
-        *
-        * with a = -1, d = -EDWARDS_D:
-        *   -2xy/sqrt(1-EDWARDS_D)/(2z^2-y^2+x^2)
-        *   (y^2+x^2)/(y^2-x^2)
-        */
-        gf a, b, c, d;
-        cryptonite_gf_sqr ( c, p->x );
-        cryptonite_gf_sqr ( a, p->y );
-        cryptonite_gf_add ( d, c, a ); // x^2 + y^2
-        cryptonite_gf_add ( p->t, p->y, p->x );
-        cryptonite_gf_sqr ( b, p->t );
-        cryptonite_gf_sub ( b, b, d ); // 2xy
-        cryptonite_gf_sub ( p->t, a, c ); // y^2 - x^2
-        cryptonite_gf_sqr ( p->x, p->z );
-        cryptonite_gf_add ( p->z, p->x, p->x );
-        cryptonite_gf_sub ( a, p->z, p->t ); // 2z^2 - y^2 + x^2
-        cryptonite_gf_mul ( c, a, SQRT_ONE_MINUS_D );
-        cryptonite_gf_mul ( p->x, b, p->t); // (2xy)(y^2-x^2)
-        cryptonite_gf_mul ( p->z, p->t, c ); // (y^2-x^2)sd(2z^2 - y^2 + x^2)
-        cryptonite_gf_mul ( p->y, d, c ); // (y^2+x^2)sd(2z^2 - y^2 + x^2)
-        cryptonite_gf_mul ( p->t, d, b );
-        cryptonite_decaf_bzero(a,sizeof(a));
-        cryptonite_decaf_bzero(b,sizeof(b));
-        cryptonite_decaf_bzero(c,sizeof(c));
-        cryptonite_decaf_bzero(d,sizeof(d));
-    } 
-    #elif IMAGINE_TWIST
-    {
-        cryptonite_gf_mul(p->t,p->x,SQRT_MINUS_ONE);
-        cryptonite_gf_copy(p->x,p->t);
-        cryptonite_gf_mul(p->t,p->x,p->y);
-    }
-    #else
-    {
-        /* 4-isogeny 2xy/(y^2-ax^2), (y^2+ax^2)/(2-y^2-ax^2) */
-        gf a, b, c, d;
-        cryptonite_gf_sqr ( c, p->x );
-        cryptonite_gf_sqr ( a, p->y );
-        cryptonite_gf_add ( d, c, a );
-        cryptonite_gf_add ( p->t, p->y, p->x );
-        cryptonite_gf_sqr ( b, p->t );
-        cryptonite_gf_sub ( b, b, d );
-        cryptonite_gf_sub ( p->t, a, c );
-        cryptonite_gf_sqr ( p->x, p->z );
-        cryptonite_gf_add ( p->z, p->x, p->x );
-        cryptonite_gf_sub ( a, p->z, d );
-        cryptonite_gf_mul ( p->x, a, b );
-        cryptonite_gf_mul ( p->z, p->t, a );
-        cryptonite_gf_mul ( p->y, p->t, d );
-        cryptonite_gf_mul ( p->t, b, d );
-        cryptonite_decaf_bzero(a,sizeof(a));
-        cryptonite_decaf_bzero(b,sizeof(b));
-        cryptonite_decaf_bzero(c,sizeof(c));
-        cryptonite_decaf_bzero(d,sizeof(d));
-    }
-    #endif
-    
-    cryptonite_decaf_bzero(enc2,sizeof(enc2));
-    assert(API_NS(point_valid)(p) || ~succ);
-    return cryptonite_decaf_succeed_if(mask_to_bool(succ));
-}
-
-cryptonite_decaf_error_t cryptonite_decaf_x448 (
-    uint8_t out[X_PUBLIC_BYTES],
-    const uint8_t base[X_PUBLIC_BYTES],
-    const uint8_t scalar[X_PRIVATE_BYTES]
-) {
-    gf x1, x2, z2, x3, z3, t1, t2;
-    ignore_result(cryptonite_gf_deserialize(x1,base,1));
-    cryptonite_gf_copy(x2,ONE);
-    cryptonite_gf_copy(z2,ZERO);
-    cryptonite_gf_copy(x3,x1);
-    cryptonite_gf_copy(z3,ONE);
-    
-    int t;
-    mask_t swap = 0;
-    
-    for (t = X_PRIVATE_BITS-1; t>=0; t--) {
-        uint8_t sb = scalar[t/8];
-        
-        /* Scalar conditioning */
-        if (t/8==0) sb &= -(uint8_t)COFACTOR;
-        else if (t == X_PRIVATE_BITS-1) sb = -1;
-        
-        mask_t k_t = (sb>>(t%8)) & 1;
-        k_t = -k_t; /* set to all 0s or all 1s */
-        
-        swap ^= k_t;
-        cryptonite_gf_cond_swap(x2,x3,swap);
-        cryptonite_gf_cond_swap(z2,z3,swap);
-        swap = k_t;
-        
-        cryptonite_gf_add_nr(t1,x2,z2); /* A = x2 + z2 */        /* 2+e */
-        cryptonite_gf_sub_nr(t2,x2,z2); /* B = x2 - z2 */        /* 3+e */
-        cryptonite_gf_sub_nr(z2,x3,z3); /* D = x3 - z3 */        /* 3+e */
-        cryptonite_gf_mul(x2,t1,z2);    /* DA */
-        cryptonite_gf_add_nr(z2,z3,x3); /* C = x3 + z3 */        /* 2+e */
-        cryptonite_gf_mul(x3,t2,z2);    /* CB */
-        cryptonite_gf_sub_nr(z3,x2,x3); /* DA-CB */              /* 3+e */
-        cryptonite_gf_sqr(z2,z3);       /* (DA-CB)^2 */
-        cryptonite_gf_mul(z3,x1,z2);    /* z3 = x1(DA-CB)^2 */
-        cryptonite_gf_add_nr(z2,x2,x3); /* (DA+CB) */            /* 2+e */
-        cryptonite_gf_sqr(x3,z2);       /* x3 = (DA+CB)^2 */
-        
-        cryptonite_gf_sqr(z2,t1);       /* AA = A^2 */
-        cryptonite_gf_sqr(t1,t2);       /* BB = B^2 */
-        cryptonite_gf_mul(x2,z2,t1);    /* x2 = AA*BB */
-        cryptonite_gf_sub_nr(t2,z2,t1); /* E = AA-BB */          /* 3+e */
-        
-        cryptonite_gf_mulw(t1,t2,-EDWARDS_D); /* E*-d = a24*E */
-        cryptonite_gf_add_nr(t1,t1,z2); /* AA + a24*E */         /* 2+e */
-        cryptonite_gf_mul(z2,t2,t1); /* z2 = E(AA+a24*E) */
-    }
-    
-    /* Finish */
-    cryptonite_gf_cond_swap(x2,x3,swap);
-    cryptonite_gf_cond_swap(z2,z3,swap);
-    cryptonite_gf_invert(z2,z2,0);
-    cryptonite_gf_mul(x1,x2,z2);
-    cryptonite_gf_serialize(out,x1,1);
-    mask_t nz = ~cryptonite_gf_eq(x1,ZERO);
-    
-    cryptonite_decaf_bzero(x1,sizeof(x1));
-    cryptonite_decaf_bzero(x2,sizeof(x2));
-    cryptonite_decaf_bzero(z2,sizeof(z2));
-    cryptonite_decaf_bzero(x3,sizeof(x3));
-    cryptonite_decaf_bzero(z3,sizeof(z3));
-    cryptonite_decaf_bzero(t1,sizeof(t1));
-    cryptonite_decaf_bzero(t2,sizeof(t2));
-    
-    return cryptonite_decaf_succeed_if(mask_to_bool(nz));
-}
-
-/* Thanks Johan Pascal */
-void cryptonite_decaf_ed448_convert_public_key_to_x448 (
-    uint8_t x[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],
-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]
-) {
-    gf y;
-    {
-        uint8_t enc2[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES];
-        memcpy(enc2,ed,sizeof(enc2));
-
-        /* retrieve y from the ed compressed point */
-        enc2[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES-1] &= ~0x80;
-        ignore_result(cryptonite_gf_deserialize(y, enc2, 0));
-        cryptonite_decaf_bzero(enc2,sizeof(enc2));
-    }
-    
-    {
-        gf n,d;
-        
-#if EDDSA_USE_SIGMA_ISOGENY
-        /* u = (1+y)/(1-y)*/
-        cryptonite_gf_add(n, y, ONE); /* n = y+1 */
-        cryptonite_gf_sub(d, ONE, y); /* d = 1-y */
-        cryptonite_gf_invert(d, d, 0); /* d = 1/(1-y) */
-        cryptonite_gf_mul(y, n, d); /* u = (y+1)/(1-y) */
-        cryptonite_gf_serialize(x,y,1);
-#else /* EDDSA_USE_SIGMA_ISOGENY */
-        /* u = y^2 * (1-dy^2) / (1-y^2) */
-        cryptonite_gf_sqr(n,y); /* y^2*/
-        cryptonite_gf_sub(d,ONE,n); /* 1-y^2*/
-        cryptonite_gf_invert(d,d,0); /* 1/(1-y^2)*/
-        cryptonite_gf_mul(y,n,d); /* y^2 / (1-y^2) */
-        cryptonite_gf_mulw(d,n,EDWARDS_D); /* dy^2*/
-        cryptonite_gf_sub(d, ONE, d); /* 1-dy^2*/
-        cryptonite_gf_mul(n, y, d); /* y^2 * (1-dy^2) / (1-y^2) */
-        cryptonite_gf_serialize(x,n,1);
-#endif /* EDDSA_USE_SIGMA_ISOGENY */
-        
-        cryptonite_decaf_bzero(y,sizeof(y));
-        cryptonite_decaf_bzero(n,sizeof(n));
-        cryptonite_decaf_bzero(d,sizeof(d));
-    }
-}
-
-void cryptonite_decaf_x448_generate_key (
-    uint8_t out[X_PUBLIC_BYTES],
-    const uint8_t scalar[X_PRIVATE_BYTES]
-) {
-    cryptonite_decaf_x448_derive_public_key(out,scalar);
-}
-
-void cryptonite_decaf_x448_derive_public_key (
-    uint8_t out[X_PUBLIC_BYTES],
-    const uint8_t scalar[X_PRIVATE_BYTES]
-) {
-    /* Scalar conditioning */
-    uint8_t scalar2[X_PRIVATE_BYTES];
-    memcpy(scalar2,scalar,sizeof(scalar2));
-    scalar2[0] &= -(uint8_t)COFACTOR;
-    
-    scalar2[X_PRIVATE_BYTES-1] &= ~(-1u<<((X_PRIVATE_BITS+7)%8));
-    scalar2[X_PRIVATE_BYTES-1] |= 1<<((X_PRIVATE_BITS+7)%8);
-    
-    scalar_t the_scalar;
-    API_NS(scalar_decode_long)(the_scalar,scalar2,sizeof(scalar2));
-    
-    /* We're gonna isogenize by 2, so divide by 2.
-     *
-     * Why by 2, even though it's a 4-isogeny?
-     *
-     * The isogeny map looks like
-     * Montgomery <-2-> Jacobi <-2-> Edwards
-     *
-     * Since the Jacobi base point is the PREimage of the iso to
-     * the Montgomery curve, and we're going
-     * Jacobi -> Edwards -> Jacobi -> Montgomery,
-     * we pick up only a factor of 2 over Jacobi -> Montgomery. 
-     */
-    API_NS(scalar_halve)(the_scalar,the_scalar);
-    point_t p;
-    API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),the_scalar);
-    
-    /* Isogenize to Montgomery curve.
-     *
-     * Why isn't this just a separate function, eg cryptonite_decaf_encode_like_x448?
-     * Basically because in general it does the wrong thing if there is a cofactor
-     * component in the input.  In this function though, there isn't a cofactor
-     * component in the input.
-     */
-    cryptonite_gf_invert(p->t,p->x,0); /* 1/x */
-    cryptonite_gf_mul(p->z,p->t,p->y); /* y/x */
-    cryptonite_gf_sqr(p->y,p->z); /* (y/x)^2 */
-#if IMAGINE_TWIST
-    cryptonite_gf_sub(p->y,ZERO,p->y);
-#endif
-    cryptonite_gf_serialize(out,p->y,1);
-        
-    cryptonite_decaf_bzero(scalar2,sizeof(scalar2));
-    API_NS(scalar_destroy)(the_scalar);
-    API_NS(point_destroy)(p);
-}
-
-/**
- * @cond internal
- * Control for variable-time scalar multiply algorithms.
- */
-struct smvt_control {
-  int power, addend;
-};
-
-static int recode_wnaf (
-    struct smvt_control *control, /* [nbits/(table_bits+1) + 3] */
-    const scalar_t scalar,
-    unsigned int table_bits
-) {
-    unsigned int table_size = SCALAR_BITS/(table_bits+1) + 3;
-    int position = table_size - 1; /* at the end */
-    
-    /* place the end marker */
-    control[position].power = -1;
-    control[position].addend = 0;
-    position--;
-
-    /* PERF: Could negate scalar if it's large.  But then would need more cases
-     * in the actual code that uses it, all for an expected reduction of like 1/5 op.
-     * Probably not worth it.
-     */
-    
-    uint64_t current = scalar->limb[0] & 0xFFFF;
-    uint32_t mask = (1<<(table_bits+1))-1;
-
-    unsigned int w;
-    const unsigned int B_OVER_16 = sizeof(scalar->limb[0]) / 2;
-    for (w = 1; w<(SCALAR_BITS-1)/16+3; w++) {
-        if (w < (SCALAR_BITS-1)/16+1) {
-            /* Refill the 16 high bits of current */
-            current += (uint32_t)((scalar->limb[w/B_OVER_16]>>(16*(w%B_OVER_16)))<<16);
-        }
-        
-        while (current & 0xFFFF) {
-            assert(position >= 0);
-            uint32_t pos = __builtin_ctz((uint32_t)current), odd = (uint32_t)current >> pos;
-            int32_t delta = odd & mask;
-            if (odd & 1<<(table_bits+1)) delta -= (1<<(table_bits+1));
-            current -= delta << pos;
-            control[position].power = pos + 16*(w-1);
-            control[position].addend = delta;
-            position--;
-        }
-        current >>= 16;
-    }
-    assert(current==0);
-    
-    position++;
-    unsigned int n = table_size - position;
-    unsigned int i;
-    for (i=0; i<n; i++) {
-        control[i] = control[i+position];
-    }
-    return n-1;
-}
-
-static void
-prepare_wnaf_table(
-    pniels_t *output,
-    const point_t working,
-    unsigned int tbits
-) {
-    point_t tmp;
-    int i;
-    pt_to_pniels(output[0], working);
-
-    if (tbits == 0) return;
-
-    API_NS(point_double)(tmp,working);
-    pniels_t twop;
-    pt_to_pniels(twop, tmp);
-
-    add_pniels_to_pt(tmp, output[0],0);
-    pt_to_pniels(output[1], tmp);
-
-    for (i=2; i < 1<<tbits; i++) {
-        add_pniels_to_pt(tmp, twop,0);
-        pt_to_pniels(output[i], tmp);
-    }
-    
-    API_NS(point_destroy)(tmp);
-    cryptonite_decaf_bzero(twop,sizeof(twop));
-}
-
-extern const gf API_NS(precomputed_wnaf_as_fe)[];
-static const niels_t *API_NS(wnaf_base) = (const niels_t *)API_NS(precomputed_wnaf_as_fe);
-const size_t API_NS(sizeof_precomputed_wnafs)
-    = sizeof(niels_t)<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS;
-
-void API_NS(precompute_wnafs) (
-    niels_t out[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS],
-    const point_t base
-);
-
-void API_NS(precompute_wnafs) (
-    niels_t out[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS],
-    const point_t base
-) {
-    pniels_t tmp[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS];
-    gf zs[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS], zis[1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS];
-    int i;
-    prepare_wnaf_table(tmp,base,CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS);
-    for (i=0; i<1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS; i++) {
-        memcpy(out[i], tmp[i]->n, sizeof(niels_t));
-        cryptonite_gf_copy(zs[i], tmp[i]->z);
-    }
-    batch_normalize_niels(out, (const gf *)zs, zis, 1<<CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS);
-    
-    cryptonite_decaf_bzero(tmp,sizeof(tmp));
-    cryptonite_decaf_bzero(zs,sizeof(zs));
-    cryptonite_decaf_bzero(zis,sizeof(zis));
-}
-
-void API_NS(base_double_scalarmul_non_secret) (
-    point_t combo,
-    const scalar_t scalar1,
-    const point_t base2,
-    const scalar_t scalar2
-) {
-    const int table_bits_var = CRYPTONITE_DECAF_WNAF_VAR_TABLE_BITS,
-        table_bits_pre = CRYPTONITE_DECAF_WNAF_FIXED_TABLE_BITS;
-    struct smvt_control control_var[SCALAR_BITS/(table_bits_var+1)+3];
-    struct smvt_control control_pre[SCALAR_BITS/(table_bits_pre+1)+3];
-    
-    int ncb_pre = recode_wnaf(control_pre, scalar1, table_bits_pre);
-    int ncb_var = recode_wnaf(control_var, scalar2, table_bits_var);
-  
-    pniels_t precmp_var[1<<table_bits_var];
-    prepare_wnaf_table(precmp_var, base2, table_bits_var);
-  
-    int contp=0, contv=0, i = control_var[0].power;
-
-    if (i < 0) {
-        API_NS(point_copy)(combo, API_NS(point_identity));
-        return;
-    } else if (i > control_pre[0].power) {
-        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);
-        contv++;
-    } else if (i == control_pre[0].power && i >=0 ) {
-        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);
-        add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1], i);
-        contv++; contp++;
-    } else {
-        i = control_pre[0].power;
-        niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1]);
-        contp++;
-    }
-    
-    for (i--; i >= 0; i--) {
-        int cv = (i==control_var[contv].power), cp = (i==control_pre[contp].power);
-        point_double_internal(combo,combo,i && !(cv||cp));
-
-        if (cv) {
-            assert(control_var[contv].addend);
-
-            if (control_var[contv].addend > 0) {
-                add_pniels_to_pt(combo, precmp_var[control_var[contv].addend >> 1], i&&!cp);
-            } else {
-                sub_pniels_from_pt(combo, precmp_var[(-control_var[contv].addend) >> 1], i&&!cp);
-            }
-            contv++;
-        }
-
-        if (cp) {
-            assert(control_pre[contp].addend);
-
-            if (control_pre[contp].addend > 0) {
-                add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[contp].addend >> 1], i);
-            } else {
-                sub_niels_from_pt(combo, API_NS(wnaf_base)[(-control_pre[contp].addend) >> 1], i);
-            }
-            contp++;
-        }
-    }
-    
-    /* This function is non-secret, but whatever this is cheap. */
-    cryptonite_decaf_bzero(control_var,sizeof(control_var));
-    cryptonite_decaf_bzero(control_pre,sizeof(control_pre));
-    cryptonite_decaf_bzero(precmp_var,sizeof(precmp_var));
-
-    assert(contv == ncb_var); (void)ncb_var;
-    assert(contp == ncb_pre); (void)ncb_pre;
-}
-
-void API_NS(point_destroy) (
-    point_t point
-) {
-    cryptonite_decaf_bzero(point, sizeof(point_t));
-}
-
-void API_NS(precomputed_destroy) (
-    precomputed_s *pre
-) {
-    cryptonite_decaf_bzero(pre, API_NS(sizeof_precomputed_s));
+#define API_NS(_id) crypton_decaf_448_##_id
+#define SCALAR_BITS CRYPTON_DECAF_448_SCALAR_BITS
+#define SCALAR_SER_BYTES CRYPTON_DECAF_448_SCALAR_BYTES
+#define SCALAR_LIMBS CRYPTON_DECAF_448_SCALAR_LIMBS
+#define scalar_t API_NS(scalar_t)
+#define point_t API_NS(point_t)
+#define precomputed_s API_NS(precomputed_s)
+#define IMAGINE_TWIST 0
+#define COFACTOR 4
+
+/* Comb config: number of combs, n, t, s. */
+#define COMBS_N 5
+#define COMBS_T 5
+#define COMBS_S 18
+#define CRYPTON_DECAF_WINDOW_BITS 5
+#define CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS 5
+#define CRYPTON_DECAF_WNAF_VAR_TABLE_BITS 3
+
+#define EDDSA_USE_SIGMA_ISOGENY 0
+
+static const int EDWARDS_D = -39081;
+static const scalar_t point_scalarmul_adjustment = {{{
+    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)
+}}}, precomputed_scalarmul_adjustment = {{{
+    SC_LIMB(0xc873d6d54a7bb0cf), SC_LIMB(0xe933d8d723a70aad), SC_LIMB(0xbb124b65129c96fd), SC_LIMB(0x00000008335dc163)
+}}};
+
+const uint8_t crypton_decaf_x448_base_point[CRYPTON_DECAF_X448_PUBLIC_BYTES] = { 0x05 };
+
+#if COFACTOR==8 || EDDSA_USE_SIGMA_ISOGENY
+    static const gf SQRT_ONE_MINUS_D = {FIELD_LITERAL(
+        /* NONE */
+    )};
+#endif
+
+/* End of template stuff */
+
+/* Sanity */
+#if (COFACTOR == 8) && !IMAGINE_TWIST && !UNSAFE_CURVE_HAS_POINTS_AT_INFINITY
+/* FUTURE MAGIC: Curve41417 doesn't have these properties. */
+#error "Currently require IMAGINE_TWIST (and thus p=5 mod 8) for cofactor 8"
+        /* OK, but why?
+         * Two reasons: #1: There are bugs when COFACTOR == && IMAGINE_TWIST
+         # #2: 
+         */
+#endif
+
+#if IMAGINE_TWIST && (P_MOD_8 != 5)
+    #error "Cannot use IMAGINE_TWIST except for p == 5 mod 8"
+#endif
+
+#if (COFACTOR != 8) && (COFACTOR != 4)
+    #error "COFACTOR must be 4 or 8"
+#endif
+ 
+#if IMAGINE_TWIST
+    extern const gf SQRT_MINUS_ONE;
+#endif
+
+#define WBITS CRYPTON_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */
+
+extern const point_t API_NS(point_base);
+
+/* Projective Niels coordinates */
+typedef struct { gf a, b, c; } niels_s, niels_t[1];
+typedef struct { niels_t n; gf z; } VECTOR_ALIGNED pniels_s, pniels_t[1];
+
+/* Precomputed base */
+struct precomputed_s { niels_t table [COMBS_N<<(COMBS_T-1)]; };
+
+extern const gf API_NS(precomputed_base_as_fe)[];
+const precomputed_s *API_NS(precomputed_base) =
+    (const precomputed_s *) &API_NS(precomputed_base_as_fe);
+
+const size_t API_NS(sizeof_precomputed_s) = sizeof(precomputed_s);
+const size_t API_NS(alignof_precomputed_s) = sizeof(big_register_t);
+
+/** Inverse. */
+static void
+crypton_gf_invert(gf y, const gf x, int assert_nonzero) {
+    gf t1, t2;
+    crypton_gf_sqr(t1, x); // o^2
+    mask_t ret = crypton_gf_isr(t2, t1); // +-1/sqrt(o^2) = +-1/o
+    (void)ret;
+    if (assert_nonzero) assert(ret);
+    crypton_gf_sqr(t1, t2);
+    crypton_gf_mul(t2, t1, x); // not direct to y in case of alias.
+    crypton_gf_copy(y, t2);
+}
+
+/** Return high bit of x = low bit of 2x mod p */
+static mask_t crypton_gf_lobit(const gf x) {
+    gf y;
+    crypton_gf_copy(y,x);
+    crypton_gf_strong_reduce(y);
+    return -(y->limb[0]&1);
+}
+
+/** identity = (0,1) */
+const point_t API_NS(point_identity) = {{{{{0}}},{{{1}}},{{{1}}},{{{0}}}}};
+
+void API_NS(deisogenize) (
+    crypton_gf_s *__restrict__ s,
+    crypton_gf_s *__restrict__ minus_t_over_s,
+    const point_t p,
+    mask_t toggle_hibit_s,
+    mask_t toggle_hibit_t_over_s,
+    mask_t toggle_rotation
+);
+
+void API_NS(deisogenize) (
+    crypton_gf_s *__restrict__ s,
+    crypton_gf_s *__restrict__ minus_t_over_s,
+    const point_t p,
+    mask_t toggle_hibit_s,
+    mask_t toggle_hibit_t_over_s,
+    mask_t toggle_rotation
+) {
+#if COFACTOR == 4 && !IMAGINE_TWIST
+    (void) toggle_rotation;
+    
+    gf b, d;
+    crypton_gf_s *c = s, *a = minus_t_over_s;
+    crypton_gf_mulw(a, p->y, 1-EDWARDS_D);
+    crypton_gf_mul(c, a, p->t);     /* -dYT, with EDWARDS_D = d-1 */
+    crypton_gf_mul(a, p->x, p->z); 
+    crypton_gf_sub(d, c, a);  /* aXZ-dYT with a=-1 */
+    crypton_gf_add(a, p->z, p->y); 
+    crypton_gf_sub(b, p->z, p->y); 
+    crypton_gf_mul(c, b, a);
+    crypton_gf_mulw(b, c, -EDWARDS_D); /* (a-d)(Z+Y)(Z-Y) */
+    mask_t ok = crypton_gf_isr (a,b); /* r in the paper */
+    (void)ok; assert(ok | crypton_gf_eq(b,ZERO));
+    crypton_gf_mulw (b, a, -EDWARDS_D); /* u in the paper */
+
+    crypton_gf_mul(c,a,d); /* r(aZX-dYT) */
+    crypton_gf_mul(a,b,p->z); /* uZ */
+    crypton_gf_add(a,a,a); /* 2uZ */
+    
+    mask_t tg = toggle_hibit_t_over_s ^ ~crypton_gf_hibit(minus_t_over_s);
+    crypton_gf_cond_neg(minus_t_over_s, tg); /* t/s <-? -t/s */
+    crypton_gf_cond_neg(c, tg); /* u <- -u if negative. */
+    
+    crypton_gf_add(d,c,p->y);
+    crypton_gf_mul(s,b,d);
+    crypton_gf_cond_neg(s, toggle_hibit_s ^ crypton_gf_hibit(s));
+#else
+    /* More complicated because of rotation */
+    /* MAGIC This code is wrong for certain non-Curve25519 curves;
+     * check if it's because of Cofactor==8 or IMAGINE_TWIST */
+    
+    gf c, d;
+    crypton_gf_s *b = s, *a = minus_t_over_s;
+
+    #if IMAGINE_TWIST
+        gf x, t;
+        crypton_gf_div_qnr(x,p->x);
+        crypton_gf_div_qnr(t,p->t);
+        crypton_gf_add ( a, p->z, x );
+        crypton_gf_sub ( b, p->z, x );
+        crypton_gf_mul ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 - X^2 */
+    #else
+        const crypton_gf_s *x = p->x, *t = p->t;
+        crypton_gf_sqr ( a, p->z );
+        crypton_gf_sqr ( b, p->x );
+        crypton_gf_add ( c, a, b ); /* "zx" = Z^2 - aX^2 = Z^2 + X^2 */
+    #endif
+    /* Here: c = "zx" in the SAGE code = Z^2 - aX^2 */
+    
+    crypton_gf_mul ( a, p->z, t ); /* "tz" = T*Z */
+    crypton_gf_sqr ( b, a );
+    crypton_gf_mul ( d, b, c ); /* (TZ)^2 * (Z^2-aX^2) */
+    mask_t ok = crypton_gf_isr(b, d);
+    (void)ok; assert(ok | crypton_gf_eq(d,ZERO));
+    crypton_gf_mul ( d, b, a ); /* "osx" = 1 / sqrt(z^2-ax^2) */
+    crypton_gf_mul ( a, b, c ); 
+    crypton_gf_mul ( b, a, d ); /* 1/tz */
+
+    mask_t rotate;
+    #if (COFACTOR == 8)
+        gf e;
+        crypton_gf_sqr(e, p->z);
+        crypton_gf_mul(a, e, b); /* z^2 / tz = z/t = 1/xy */
+        rotate = crypton_gf_hibit(a) ^ toggle_rotation;
+        /* Curve25519: cond select between zx * 1/tz or sqrt(1-d); y=-x */
+        crypton_gf_mul ( a, b, c ); 
+        crypton_gf_cond_sel ( a, a, SQRT_ONE_MINUS_D, rotate );
+        crypton_gf_cond_sel ( e, p->y, x, rotate );
+    #else
+        const crypton_gf_s *e = x;
+        (void)toggle_rotation;
+        rotate = 0;
+    #endif
+    
+    crypton_gf_mul ( c, a, d ); // new "osx"
+    crypton_gf_mul ( a, c, p->z );
+    crypton_gf_add ( minus_t_over_s, a, a ); // 2 * "osx" * Z
+    crypton_gf_mul ( d, b, p->z );
+    
+    mask_t tg = toggle_hibit_t_over_s ^~ crypton_gf_hibit(minus_t_over_s);
+    crypton_gf_cond_neg ( minus_t_over_s, tg );
+    crypton_gf_cond_neg ( c, rotate ^ tg );
+    crypton_gf_add ( d, d, c );
+    crypton_gf_mul ( s, d, e ); /* here "x" = y unless rotate */
+    crypton_gf_cond_neg ( s, toggle_hibit_s ^ crypton_gf_hibit(s) );
+#endif
+}
+
+void API_NS(point_encode)( unsigned char ser[SER_BYTES], const point_t p ) {
+    gf s, mtos;
+    API_NS(deisogenize)(s,mtos,p,0,0,0);
+    crypton_gf_serialize(ser,s,0);
+}
+
+crypton_decaf_error_t API_NS(point_decode) (
+    point_t p,
+    const unsigned char ser[SER_BYTES],
+    crypton_decaf_bool_t allow_identity
+) {
+    gf s, a, b, c, d, e, f;
+    mask_t succ = crypton_gf_deserialize(s, ser, 0);
+    mask_t zero = crypton_gf_eq(s, ZERO);
+    succ &= bool_to_mask(allow_identity) | ~zero;
+    crypton_gf_sqr ( a, s ); /* s^2 */
+#if IMAGINE_TWIST
+    crypton_gf_sub ( f, ONE, a ); /* f = 1-as^2 = 1-s^2*/
+#else
+    crypton_gf_add ( f, ONE, a ); /* f = 1-as^2 = 1+s^2 */
+#endif
+    succ &= ~ crypton_gf_eq( f, ZERO );
+    crypton_gf_sqr ( b, f );  /* (1-as^2)^2 = 1 - 2as^2 + a^2 s^4 */
+    crypton_gf_mulw ( c, a, 4*IMAGINE_TWIST-4*EDWARDS_D ); 
+    crypton_gf_add ( c, c, b ); /* t^2 = 1 + (2a-4d) s^2 + s^4 */
+    crypton_gf_mul ( d, f, s ); /* s * (1-as^2) for denoms */
+    crypton_gf_sqr ( e, d );    /* s^2 * (1-as^2)^2 */
+    crypton_gf_mul ( b, c, e ); /* t^2 * s^2 * (1-as^2)^2 */
+    
+    succ &= crypton_gf_isr(e,b) | crypton_gf_eq(b,ZERO); /* e = 1/(t s (1-as^2)) */
+    crypton_gf_mul ( b, e, d ); /* 1 / t */
+    crypton_gf_mul ( d, e, c ); /* t / (s(1-as^2)) */
+    crypton_gf_mul ( e, d, f ); /* t / s */
+    mask_t negtos = crypton_gf_hibit(e);
+    crypton_gf_cond_neg(b, negtos);
+    crypton_gf_cond_neg(d, negtos);
+
+#if IMAGINE_TWIST
+    crypton_gf_add ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */
+#else
+    crypton_gf_sub ( p->z, ONE, a); /* Z = 1+as^2 = 1-s^2 */
+#endif
+
+#if COFACTOR == 8
+    crypton_gf_mul ( a, p->z, d); /* t(1+s^2) / s(1-s^2) = 2/xy */
+    succ &= ~crypton_gf_lobit(a); /* = ~crypton_gf_hibit(a/2), since crypton_gf_hibit(x) = crypton_gf_lobit(2x) */
+#endif
+    
+    crypton_gf_mul ( a, f, b ); /* y = (1-s^2) / t */
+    crypton_gf_mul ( p->y, p->z, a ); /* Y = yZ */
+#if IMAGINE_TWIST
+    crypton_gf_add ( b, s, s );
+    crypton_gf_mul(p->x, b, SQRT_MINUS_ONE); /* Curve25519 */
+#else
+    crypton_gf_add ( p->x, s, s );
+#endif
+    crypton_gf_mul ( p->t, p->x, a ); /* T = 2s (1-as^2)/t */
+    
+#if UNSAFE_CURVE_HAS_POINTS_AT_INFINITY
+    /* This can't happen for any of the supported configurations.
+     *
+     * If it can happen (because s=1), it's because the curve has points
+     * at infinity, which means that there may be critical security bugs
+     * elsewhere in the library.  In that case, it's better that you hit
+     * the assertion in point_valid, which will happen in the test suite
+     * since it tests s=1.
+     *
+     * This debugging option is to allow testing of IMAGINE_TWIST = 0 on
+     * Ed25519, without hitting that assertion.  Don't use it in
+     * production.
+     */
+    succ &= ~crypton_gf_eq(p->z,ZERO);
+#endif
+    
+    p->y->limb[0] -= zero;
+    assert(API_NS(point_valid)(p) | ~succ);
+    
+    return crypton_decaf_succeed_if(mask_to_bool(succ));
+}
+
+#if IMAGINE_TWIST
+#define TWISTED_D (-(EDWARDS_D))
+#else
+#define TWISTED_D ((EDWARDS_D)-1)
+#endif
+
+#if TWISTED_D < 0
+#define EFF_D (-(TWISTED_D))
+#define NEG_D 1
+#else
+#define EFF_D TWISTED_D
+#define NEG_D 0
+#endif
+
+void API_NS(point_sub) (
+    point_t p,
+    const point_t q,
+    const point_t r
+) {
+    gf a, b, c, d;
+    crypton_gf_sub_nr ( b, q->y, q->x ); /* 3+e */
+    crypton_gf_sub_nr ( d, r->y, r->x ); /* 3+e */
+    crypton_gf_add_nr ( c, r->y, r->x ); /* 2+e */
+    crypton_gf_mul ( a, c, b );
+    crypton_gf_add_nr ( b, q->y, q->x ); /* 2+e */
+    crypton_gf_mul ( p->y, d, b );
+    crypton_gf_mul ( b, r->t, q->t );
+    crypton_gf_mulw ( p->x, b, 2*EFF_D );
+    crypton_gf_add_nr ( b, a, p->y );    /* 2+e */
+    crypton_gf_sub_nr ( c, p->y, a );    /* 3+e */
+    crypton_gf_mul ( a, q->z, r->z );
+    crypton_gf_add_nr ( a, a, a );       /* 2+e */
+    if (GF_HEADROOM <= 3) crypton_gf_weak_reduce(a); /* or 1+e */
+#if NEG_D
+    crypton_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */
+    crypton_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */
+#else
+    crypton_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */
+    crypton_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */
+#endif
+    crypton_gf_mul ( p->z, a, p->y );
+    crypton_gf_mul ( p->x, p->y, c );
+    crypton_gf_mul ( p->y, a, b );
+    crypton_gf_mul ( p->t, b, c );
+}
+    
+void API_NS(point_add) (
+    point_t p,
+    const point_t q,
+    const point_t r
+) {
+    gf a, b, c, d;
+    crypton_gf_sub_nr ( b, q->y, q->x ); /* 3+e */
+    crypton_gf_sub_nr ( c, r->y, r->x ); /* 3+e */
+    crypton_gf_add_nr ( d, r->y, r->x ); /* 2+e */
+    crypton_gf_mul ( a, c, b );
+    crypton_gf_add_nr ( b, q->y, q->x ); /* 2+e */
+    crypton_gf_mul ( p->y, d, b );
+    crypton_gf_mul ( b, r->t, q->t );
+    crypton_gf_mulw ( p->x, b, 2*EFF_D );
+    crypton_gf_add_nr ( b, a, p->y );    /* 2+e */
+    crypton_gf_sub_nr ( c, p->y, a );    /* 3+e */
+    crypton_gf_mul ( a, q->z, r->z );
+    crypton_gf_add_nr ( a, a, a );       /* 2+e */
+    if (GF_HEADROOM <= 3) crypton_gf_weak_reduce(a); /* or 1+e */
+#if NEG_D
+    crypton_gf_add_nr ( p->y, a, p->x ); /* 3+e or 2+e */
+    crypton_gf_sub_nr ( a, a, p->x );    /* 4+e or 3+e */
+#else
+    crypton_gf_sub_nr ( p->y, a, p->x ); /* 4+e or 3+e */
+    crypton_gf_add_nr ( a, a, p->x );    /* 3+e or 2+e */
+#endif
+    crypton_gf_mul ( p->z, a, p->y );
+    crypton_gf_mul ( p->x, p->y, c );
+    crypton_gf_mul ( p->y, a, b );
+    crypton_gf_mul ( p->t, b, c );
+}
+
+static CRYPTON_DECAF_NOINLINE void
+point_double_internal (
+    point_t p,
+    const point_t q,
+    int before_double
+) {
+    gf a, b, c, d;
+    crypton_gf_sqr ( c, q->x );
+    crypton_gf_sqr ( a, q->y );
+    crypton_gf_add_nr ( d, c, a );             /* 2+e */
+    crypton_gf_add_nr ( p->t, q->y, q->x );    /* 2+e */
+    crypton_gf_sqr ( b, p->t );
+    crypton_gf_subx_nr ( b, b, d, 3 );         /* 4+e */
+    crypton_gf_sub_nr ( p->t, a, c );          /* 3+e */
+    crypton_gf_sqr ( p->x, q->z );
+    crypton_gf_add_nr ( p->z, p->x, p->x );    /* 2+e */
+    crypton_gf_subx_nr ( a, p->z, p->t, 4 );   /* 6+e */
+    if (GF_HEADROOM == 5) crypton_gf_weak_reduce(a); /* or 1+e */
+    crypton_gf_mul ( p->x, a, b );
+    crypton_gf_mul ( p->z, p->t, a );
+    crypton_gf_mul ( p->y, p->t, d );
+    if (!before_double) crypton_gf_mul ( p->t, b, d );
+}
+
+void API_NS(point_double)(point_t p, const point_t q) {
+    point_double_internal(p,q,0);
+}
+
+void API_NS(point_negate) (
+   point_t nega,
+   const point_t a
+) {
+    crypton_gf_sub(nega->x, ZERO, a->x);
+    crypton_gf_copy(nega->y, a->y);
+    crypton_gf_copy(nega->z, a->z);
+    crypton_gf_sub(nega->t, ZERO, a->t);
+}
+
+/* Operations on [p]niels */
+static CRYPTON_DECAF_INLINE void
+cond_neg_niels (
+    niels_t n,
+    mask_t neg
+) {
+    crypton_gf_cond_swap(n->a, n->b, neg);
+    crypton_gf_cond_neg(n->c, neg);
+}
+
+static CRYPTON_DECAF_NOINLINE void pt_to_pniels (
+    pniels_t b,
+    const point_t a
+) {
+    crypton_gf_sub ( b->n->a, a->y, a->x );
+    crypton_gf_add ( b->n->b, a->x, a->y );
+    crypton_gf_mulw ( b->n->c, a->t, 2*TWISTED_D );
+    crypton_gf_add ( b->z, a->z, a->z );
+}
+
+static CRYPTON_DECAF_NOINLINE void pniels_to_pt (
+    point_t e,
+    const pniels_t d
+) {
+    gf eu;
+    crypton_gf_add ( eu, d->n->b, d->n->a );
+    crypton_gf_sub ( e->y, d->n->b, d->n->a );
+    crypton_gf_mul ( e->t, e->y, eu);
+    crypton_gf_mul ( e->x, d->z, e->y );
+    crypton_gf_mul ( e->y, d->z, eu );
+    crypton_gf_sqr ( e->z, d->z );
+}
+
+static CRYPTON_DECAF_NOINLINE void
+niels_to_pt (
+    point_t e,
+    const niels_t n
+) {
+    crypton_gf_add ( e->y, n->b, n->a );
+    crypton_gf_sub ( e->x, n->b, n->a );
+    crypton_gf_mul ( e->t, e->y, e->x );
+    crypton_gf_copy ( e->z, ONE );
+}
+
+static CRYPTON_DECAF_NOINLINE void
+add_niels_to_pt (
+    point_t d,
+    const niels_t e,
+    int before_double
+) {
+    gf a, b, c;
+    crypton_gf_sub_nr ( b, d->y, d->x ); /* 3+e */
+    crypton_gf_mul ( a, e->a, b );
+    crypton_gf_add_nr ( b, d->x, d->y ); /* 2+e */
+    crypton_gf_mul ( d->y, e->b, b );
+    crypton_gf_mul ( d->x, e->c, d->t );
+    crypton_gf_add_nr ( c, a, d->y );    /* 2+e */
+    crypton_gf_sub_nr ( b, d->y, a );    /* 3+e */
+    crypton_gf_sub_nr ( d->y, d->z, d->x ); /* 3+e */
+    crypton_gf_add_nr ( a, d->x, d->z ); /* 2+e */
+    crypton_gf_mul ( d->z, a, d->y );
+    crypton_gf_mul ( d->x, d->y, b );
+    crypton_gf_mul ( d->y, a, c );
+    if (!before_double) crypton_gf_mul ( d->t, b, c );
+}
+
+static CRYPTON_DECAF_NOINLINE void
+sub_niels_from_pt (
+    point_t d,
+    const niels_t e,
+    int before_double
+) {
+    gf a, b, c;
+    crypton_gf_sub_nr ( b, d->y, d->x ); /* 3+e */
+    crypton_gf_mul ( a, e->b, b );
+    crypton_gf_add_nr ( b, d->x, d->y ); /* 2+e */
+    crypton_gf_mul ( d->y, e->a, b );
+    crypton_gf_mul ( d->x, e->c, d->t );
+    crypton_gf_add_nr ( c, a, d->y );    /* 2+e */
+    crypton_gf_sub_nr ( b, d->y, a );    /* 3+e */
+    crypton_gf_add_nr ( d->y, d->z, d->x ); /* 2+e */
+    crypton_gf_sub_nr ( a, d->z, d->x ); /* 3+e */
+    crypton_gf_mul ( d->z, a, d->y );
+    crypton_gf_mul ( d->x, d->y, b );
+    crypton_gf_mul ( d->y, a, c );
+    if (!before_double) crypton_gf_mul ( d->t, b, c );
+}
+
+static void
+add_pniels_to_pt (
+    point_t p,
+    const pniels_t pn,
+    int before_double
+) {
+    gf L0;
+    crypton_gf_mul ( L0, p->z, pn->z );
+    crypton_gf_copy ( p->z, L0 );
+    add_niels_to_pt( p, pn->n, before_double );
+}
+
+static void
+sub_pniels_from_pt (
+    point_t p,
+    const pniels_t pn,
+    int before_double
+) {
+    gf L0;
+    crypton_gf_mul ( L0, p->z, pn->z );
+    crypton_gf_copy ( p->z, L0 );
+    sub_niels_from_pt( p, pn->n, before_double );
+}
+
+static CRYPTON_DECAF_NOINLINE void
+prepare_fixed_window(
+    pniels_t *multiples,
+    const point_t b,
+    int ntable
+) {
+    point_t tmp;
+    pniels_t pn;
+    int i;
+    
+    point_double_internal(tmp, b, 0);
+    pt_to_pniels(pn, tmp);
+    pt_to_pniels(multiples[0], b);
+    API_NS(point_copy)(tmp, b);
+    for (i=1; i<ntable; i++) {
+        add_pniels_to_pt(tmp, pn, 0);
+        pt_to_pniels(multiples[i], tmp);
+    }
+    
+    crypton_decaf_bzero(pn,sizeof(pn));
+    crypton_decaf_bzero(tmp,sizeof(tmp));
+}
+
+void API_NS(point_scalarmul) (
+    point_t a,
+    const point_t b,
+    const scalar_t scalar
+) {
+    const int WINDOW = CRYPTON_DECAF_WINDOW_BITS,
+        WINDOW_MASK = (1<<WINDOW)-1,
+        WINDOW_T_MASK = WINDOW_MASK >> 1,
+        NTABLE = 1<<(WINDOW-1);
+        
+    scalar_t scalar1x;
+    API_NS(scalar_add)(scalar1x, scalar, point_scalarmul_adjustment);
+    API_NS(scalar_halve)(scalar1x,scalar1x);
+    
+    /* Set up a precomputed table with odd multiples of b. */
+    pniels_t pn, multiples[NTABLE];
+    point_t tmp;
+    prepare_fixed_window(multiples, b, NTABLE);
+
+    /* Initialize. */
+    int i,j,first=1;
+    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;
+
+    for (; i>=0; i-=WINDOW) {
+        /* Fetch another block of bits */
+        word_t bits = scalar1x->limb[i/WBITS] >> (i%WBITS);
+        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {
+            bits ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
+        }
+        bits &= WINDOW_MASK;
+        mask_t inv = (bits>>(WINDOW-1))-1;
+        bits ^= inv;
+    
+        /* Add in from table.  Compute t only on last iteration. */
+        constant_time_lookup(pn, multiples, sizeof(pn), NTABLE, bits & WINDOW_T_MASK);
+        cond_neg_niels(pn->n, inv);
+        if (first) {
+            pniels_to_pt(tmp, pn);
+            first = 0;
+        } else {
+           /* Using Hisil et al's lookahead method instead of extensible here
+            * for no particular reason.  Double WINDOW times, but only compute t on
+            * the last one.
+            */
+            for (j=0; j<WINDOW-1; j++)
+                point_double_internal(tmp, tmp, -1);
+            point_double_internal(tmp, tmp, 0);
+            add_pniels_to_pt(tmp, pn, i ? -1 : 0);
+        }
+    }
+    
+    /* Write out the answer */
+    API_NS(point_copy)(a,tmp);
+    
+    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));
+    crypton_decaf_bzero(pn,sizeof(pn));
+    crypton_decaf_bzero(multiples,sizeof(multiples));
+    crypton_decaf_bzero(tmp,sizeof(tmp));
+}
+
+void API_NS(point_double_scalarmul) (
+    point_t a,
+    const point_t b,
+    const scalar_t scalarb,
+    const point_t c,
+    const scalar_t scalarc
+) {
+    const int WINDOW = CRYPTON_DECAF_WINDOW_BITS,
+        WINDOW_MASK = (1<<WINDOW)-1,
+        WINDOW_T_MASK = WINDOW_MASK >> 1,
+        NTABLE = 1<<(WINDOW-1);
+        
+    scalar_t scalar1x, scalar2x;
+    API_NS(scalar_add)(scalar1x, scalarb, point_scalarmul_adjustment);
+    API_NS(scalar_halve)(scalar1x,scalar1x);
+    API_NS(scalar_add)(scalar2x, scalarc, point_scalarmul_adjustment);
+    API_NS(scalar_halve)(scalar2x,scalar2x);
+    
+    /* Set up a precomputed table with odd multiples of b. */
+    pniels_t pn, multiples1[NTABLE], multiples2[NTABLE];
+    point_t tmp;
+    prepare_fixed_window(multiples1, b, NTABLE);
+    prepare_fixed_window(multiples2, c, NTABLE);
+
+    /* Initialize. */
+    int i,j,first=1;
+    i = SCALAR_BITS - ((SCALAR_BITS-1) % WINDOW) - 1;
+
+    for (; i>=0; i-=WINDOW) {
+        /* Fetch another block of bits */
+        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),
+                     bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);
+        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {
+            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
+            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
+        }
+        bits1 &= WINDOW_MASK;
+        bits2 &= WINDOW_MASK;
+        mask_t inv1 = (bits1>>(WINDOW-1))-1;
+        mask_t inv2 = (bits2>>(WINDOW-1))-1;
+        bits1 ^= inv1;
+        bits2 ^= inv2;
+    
+        /* Add in from table.  Compute t only on last iteration. */
+        constant_time_lookup(pn, multiples1, sizeof(pn), NTABLE, bits1 & WINDOW_T_MASK);
+        cond_neg_niels(pn->n, inv1);
+        if (first) {
+            pniels_to_pt(tmp, pn);
+            first = 0;
+        } else {
+           /* Using Hisil et al's lookahead method instead of extensible here
+            * for no particular reason.  Double WINDOW times, but only compute t on
+            * the last one.
+            */
+            for (j=0; j<WINDOW-1; j++)
+                point_double_internal(tmp, tmp, -1);
+            point_double_internal(tmp, tmp, 0);
+            add_pniels_to_pt(tmp, pn, 0);
+        }
+        constant_time_lookup(pn, multiples2, sizeof(pn), NTABLE, bits2 & WINDOW_T_MASK);
+        cond_neg_niels(pn->n, inv2);
+        add_pniels_to_pt(tmp, pn, i?-1:0);
+    }
+    
+    /* Write out the answer */
+    API_NS(point_copy)(a,tmp);
+    
+
+    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));
+    crypton_decaf_bzero(scalar2x,sizeof(scalar2x));
+    crypton_decaf_bzero(pn,sizeof(pn));
+    crypton_decaf_bzero(multiples1,sizeof(multiples1));
+    crypton_decaf_bzero(multiples2,sizeof(multiples2));
+    crypton_decaf_bzero(tmp,sizeof(tmp));
+}
+
+void API_NS(point_dual_scalarmul) (
+    point_t a1,
+    point_t a2,
+    const point_t b,
+    const scalar_t scalar1,
+    const scalar_t scalar2
+) {
+    const int WINDOW = CRYPTON_DECAF_WINDOW_BITS,
+        WINDOW_MASK = (1<<WINDOW)-1,
+        WINDOW_T_MASK = WINDOW_MASK >> 1,
+        NTABLE = 1<<(WINDOW-1);
+        
+    scalar_t scalar1x, scalar2x;
+    API_NS(scalar_add)(scalar1x, scalar1, point_scalarmul_adjustment);
+    API_NS(scalar_halve)(scalar1x,scalar1x);
+    API_NS(scalar_add)(scalar2x, scalar2, point_scalarmul_adjustment);
+    API_NS(scalar_halve)(scalar2x,scalar2x);
+    
+    /* Set up a precomputed table with odd multiples of b. */
+    point_t multiples1[NTABLE], multiples2[NTABLE], working, tmp;
+    pniels_t pn;
+    
+    API_NS(point_copy)(working, b);
+
+    /* Initialize. */
+    int i,j;
+    
+    for (i=0; i<NTABLE; i++) {
+        API_NS(point_copy)(multiples1[i], API_NS(point_identity));
+        API_NS(point_copy)(multiples2[i], API_NS(point_identity));
+    }
+
+    for (i=0; i<SCALAR_BITS; i+=WINDOW) {   
+        if (i) {
+            for (j=0; j<WINDOW-1; j++)
+                point_double_internal(working, working, -1);
+            point_double_internal(working, working, 0);
+        }
+        
+        /* Fetch another block of bits */
+        word_t bits1 = scalar1x->limb[i/WBITS] >> (i%WBITS),
+               bits2 = scalar2x->limb[i/WBITS] >> (i%WBITS);
+        if (i%WBITS >= WBITS-WINDOW && i/WBITS<SCALAR_LIMBS-1) {
+            bits1 ^= scalar1x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
+            bits2 ^= scalar2x->limb[i/WBITS+1] << (WBITS - (i%WBITS));
+        }
+        bits1 &= WINDOW_MASK;
+        bits2 &= WINDOW_MASK;
+        mask_t inv1 = (bits1>>(WINDOW-1))-1;
+        mask_t inv2 = (bits2>>(WINDOW-1))-1;
+        bits1 ^= inv1;
+        bits2 ^= inv2;
+        
+        pt_to_pniels(pn, working);
+
+        constant_time_lookup(tmp, multiples1, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);
+        cond_neg_niels(pn->n, inv1);
+        /* add_pniels_to_pt(multiples1[bits1 & WINDOW_T_MASK], pn, 0); */
+        add_pniels_to_pt(tmp, pn, 0);
+        constant_time_insert(multiples1, tmp, sizeof(tmp), NTABLE, bits1 & WINDOW_T_MASK);
+        
+        
+        constant_time_lookup(tmp, multiples2, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);
+        cond_neg_niels(pn->n, inv1^inv2);
+        /* add_pniels_to_pt(multiples2[bits2 & WINDOW_T_MASK], pn, 0); */
+        add_pniels_to_pt(tmp, pn, 0);
+        constant_time_insert(multiples2, tmp, sizeof(tmp), NTABLE, bits2 & WINDOW_T_MASK);
+    }
+    
+    if (NTABLE > 1) {
+        API_NS(point_copy)(working, multiples1[NTABLE-1]);
+        API_NS(point_copy)(tmp    , multiples2[NTABLE-1]);
+    
+        for (i=NTABLE-1; i>1; i--) {
+            API_NS(point_add)(multiples1[i-1], multiples1[i-1], multiples1[i]);
+            API_NS(point_add)(multiples2[i-1], multiples2[i-1], multiples2[i]);
+            API_NS(point_add)(working, working, multiples1[i-1]);
+            API_NS(point_add)(tmp,     tmp,     multiples2[i-1]);
+        }
+    
+        API_NS(point_add)(multiples1[0], multiples1[0], multiples1[1]);
+        API_NS(point_add)(multiples2[0], multiples2[0], multiples2[1]);
+        point_double_internal(working, working, 0);
+        point_double_internal(tmp,         tmp, 0);
+        API_NS(point_add)(a1, working, multiples1[0]);
+        API_NS(point_add)(a2, tmp,     multiples2[0]);
+    } else {
+        API_NS(point_copy)(a1, multiples1[0]);
+        API_NS(point_copy)(a2, multiples2[0]);
+    }
+
+    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));
+    crypton_decaf_bzero(scalar2x,sizeof(scalar2x));
+    crypton_decaf_bzero(pn,sizeof(pn));
+    crypton_decaf_bzero(multiples1,sizeof(multiples1));
+    crypton_decaf_bzero(multiples2,sizeof(multiples2));
+    crypton_decaf_bzero(tmp,sizeof(tmp));
+    crypton_decaf_bzero(working,sizeof(working));
+}
+
+crypton_decaf_bool_t API_NS(point_eq) ( const point_t p, const point_t q ) {
+    /* equality mod 2-torsion compares x/y */
+    gf a, b;
+    crypton_gf_mul ( a, p->y, q->x );
+    crypton_gf_mul ( b, q->y, p->x );
+    mask_t succ = crypton_gf_eq(a,b);
+    
+    #if (COFACTOR == 8) && IMAGINE_TWIST
+        crypton_gf_mul ( a, p->y, q->y );
+        crypton_gf_mul ( b, q->x, p->x );
+        #if !(IMAGINE_TWIST)
+            crypton_gf_sub ( a, ZERO, a );
+        #else
+           /* Interesting note: the 4tor would normally be rotation.
+            * But because of the *i twist, it's actually
+            * (x,y) <-> (iy,ix)
+            */
+    
+           /* No code, just a comment. */
+        #endif
+        succ |= crypton_gf_eq(a,b);
+    #endif
+    
+    return mask_to_bool(succ);
+}
+
+crypton_decaf_bool_t API_NS(point_valid) (
+    const point_t p
+) {
+    gf a,b,c;
+    crypton_gf_mul(a,p->x,p->y);
+    crypton_gf_mul(b,p->z,p->t);
+    mask_t out = crypton_gf_eq(a,b);
+    crypton_gf_sqr(a,p->x);
+    crypton_gf_sqr(b,p->y);
+    crypton_gf_sub(a,b,a);
+    crypton_gf_sqr(b,p->t);
+    crypton_gf_mulw(c,b,TWISTED_D);
+    crypton_gf_sqr(b,p->z);
+    crypton_gf_add(b,b,c);
+    out &= crypton_gf_eq(a,b);
+    out &= ~crypton_gf_eq(p->z,ZERO);
+    return mask_to_bool(out);
+}
+
+void API_NS(point_debugging_torque) (
+    point_t q,
+    const point_t p
+) {
+#if COFACTOR == 8 && IMAGINE_TWIST
+    gf tmp;
+    crypton_gf_mul(tmp,p->x,SQRT_MINUS_ONE);
+    crypton_gf_mul(q->x,p->y,SQRT_MINUS_ONE);
+    crypton_gf_copy(q->y,tmp);
+    crypton_gf_copy(q->z,p->z);
+    crypton_gf_sub(q->t,ZERO,p->t);
+#else
+    crypton_gf_sub(q->x,ZERO,p->x);
+    crypton_gf_sub(q->y,ZERO,p->y);
+    crypton_gf_copy(q->z,p->z);
+    crypton_gf_copy(q->t,p->t);
+#endif
+}
+
+void API_NS(point_debugging_pscale) (
+    point_t q,
+    const point_t p,
+    const uint8_t factor[SER_BYTES]
+) {
+    gf gfac,tmp;
+    /* NB this means you'll never pscale by negative numbers for p521 */
+    ignore_result(crypton_gf_deserialize(gfac,factor,0));
+    crypton_gf_cond_sel(gfac,gfac,ONE,crypton_gf_eq(gfac,ZERO));
+    crypton_gf_mul(tmp,p->x,gfac);
+    crypton_gf_copy(q->x,tmp);
+    crypton_gf_mul(tmp,p->y,gfac);
+    crypton_gf_copy(q->y,tmp);
+    crypton_gf_mul(tmp,p->z,gfac);
+    crypton_gf_copy(q->z,tmp);
+    crypton_gf_mul(tmp,p->t,gfac);
+    crypton_gf_copy(q->t,tmp);
+}
+
+static void crypton_gf_batch_invert (
+    gf *__restrict__ out,
+    const gf *in,
+    unsigned int n
+) {
+    gf t1;
+    assert(n>1);
+  
+    crypton_gf_copy(out[1], in[0]);
+    int i;
+    for (i=1; i<(int) (n-1); i++) {
+        crypton_gf_mul(out[i+1], out[i], in[i]);
+    }
+    crypton_gf_mul(out[0], out[n-1], in[n-1]);
+
+    crypton_gf_invert(out[0], out[0], 1);
+
+    for (i=n-1; i>0; i--) {
+        crypton_gf_mul(t1, out[i], out[0]);
+        crypton_gf_copy(out[i], t1);
+        crypton_gf_mul(t1, out[0], in[i]);
+        crypton_gf_copy(out[0], t1);
+    }
+}
+
+static void batch_normalize_niels (
+    niels_t *table,
+    const gf *zs,
+    gf *__restrict__ zis,
+    int n
+) {
+    int i;
+    gf product;
+    crypton_gf_batch_invert(zis, zs, n);
+
+    for (i=0; i<n; i++) {
+        crypton_gf_mul(product, table[i]->a, zis[i]);
+        crypton_gf_strong_reduce(product);
+        crypton_gf_copy(table[i]->a, product);
+        
+        crypton_gf_mul(product, table[i]->b, zis[i]);
+        crypton_gf_strong_reduce(product);
+        crypton_gf_copy(table[i]->b, product);
+        
+        crypton_gf_mul(product, table[i]->c, zis[i]);
+        crypton_gf_strong_reduce(product);
+        crypton_gf_copy(table[i]->c, product);
+    }
+    
+    crypton_decaf_bzero(product,sizeof(product));
+}
+
+void API_NS(precompute) (
+    precomputed_s *table,
+    const point_t base
+) { 
+    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;
+    assert(n*t*s >= SCALAR_BITS);
+  
+    point_t working, start, doubles[t-1];
+    API_NS(point_copy)(working, base);
+    pniels_t pn_tmp;
+  
+    gf zs[n<<(t-1)], zis[n<<(t-1)];
+  
+    unsigned int i,j,k;
+    
+    /* Compute n tables */
+    for (i=0; i<n; i++) {
+
+        /* Doubling phase */
+        for (j=0; j<t; j++) {
+            if (j) API_NS(point_add)(start, start, working);
+            else API_NS(point_copy)(start, working);
+
+            if (j==t-1 && i==n-1) break;
+
+            point_double_internal(working, working,0);
+            if (j<t-1) API_NS(point_copy)(doubles[j], working);
+
+            for (k=0; k<s-1; k++)
+                point_double_internal(working, working, k<s-2);
+        }
+
+        /* Gray-code phase */
+        for (j=0;; j++) {
+            int gray = j ^ (j>>1);
+            int idx = (((i+1)<<(t-1))-1) ^ gray;
+
+            pt_to_pniels(pn_tmp, start);
+            memcpy(table->table[idx], pn_tmp->n, sizeof(pn_tmp->n));
+            crypton_gf_copy(zs[idx], pn_tmp->z);
+			
+            if (j >= (1u<<(t-1)) - 1) break;
+            int delta = (j+1) ^ ((j+1)>>1) ^ gray;
+
+            for (k=0; delta>1; k++)
+                delta >>=1;
+            
+            if (gray & (1<<k)) {
+                API_NS(point_add)(start, start, doubles[k]);
+            } else {
+                API_NS(point_sub)(start, start, doubles[k]);
+            }
+        }
+    }
+    
+    batch_normalize_niels(table->table,(const gf *)zs,zis,n<<(t-1));
+    
+    crypton_decaf_bzero(zs,sizeof(zs));
+    crypton_decaf_bzero(zis,sizeof(zis));
+    crypton_decaf_bzero(pn_tmp,sizeof(pn_tmp));
+    crypton_decaf_bzero(working,sizeof(working));
+    crypton_decaf_bzero(start,sizeof(start));
+    crypton_decaf_bzero(doubles,sizeof(doubles));
+}
+
+static CRYPTON_DECAF_INLINE void
+constant_time_lookup_niels (
+    niels_s *__restrict__ ni,
+    const niels_t *table,
+    int nelts,
+    int idx
+) {
+    constant_time_lookup(ni, table, sizeof(niels_s), nelts, idx);
+}
+
+void API_NS(precomputed_scalarmul) (
+    point_t out,
+    const precomputed_s *table,
+    const scalar_t scalar
+) {
+    int i;
+    unsigned j,k;
+    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;
+    
+    scalar_t scalar1x;
+    API_NS(scalar_add)(scalar1x, scalar, precomputed_scalarmul_adjustment);
+    API_NS(scalar_halve)(scalar1x,scalar1x);
+    
+    niels_t ni;
+    
+    for (i=s-1; i>=0; i--) {
+        if (i != (int)s-1) point_double_internal(out,out,0);
+        
+        for (j=0; j<n; j++) {
+            int tab = 0;
+         
+            for (k=0; k<t; k++) {
+                unsigned int bit = i + s*(k + j*t);
+                if (bit < SCALAR_BITS) {
+                    tab |= (scalar1x->limb[bit/WBITS] >> (bit%WBITS) & 1) << k;
+                }
+            }
+            
+            mask_t invert = (tab>>(t-1))-1;
+            tab ^= invert;
+            tab &= (1<<(t-1)) - 1;
+
+            constant_time_lookup_niels(ni, &table->table[j<<(t-1)], 1<<(t-1), tab);
+
+            cond_neg_niels(ni, invert);
+            if ((i!=(int)s-1)||j) {
+                add_niels_to_pt(out, ni, j==n-1 && i);
+            } else {
+                niels_to_pt(out, ni);
+            }
+        }
+    }
+    
+    crypton_decaf_bzero(ni,sizeof(ni));
+    crypton_decaf_bzero(scalar1x,sizeof(scalar1x));
+}
+
+void API_NS(point_cond_sel) (
+    point_t out,
+    const point_t a,
+    const point_t b,
+    crypton_decaf_bool_t pick_b
+) {
+    constant_time_select(out,a,b,sizeof(point_t),bool_to_mask(pick_b),0);
+}
+
+/* FUTURE: restore Curve25519 Montgomery ladder? */
+crypton_decaf_error_t API_NS(direct_scalarmul) (
+    uint8_t scaled[SER_BYTES],
+    const uint8_t base[SER_BYTES],
+    const scalar_t scalar,
+    crypton_decaf_bool_t allow_identity,
+    crypton_decaf_bool_t short_circuit
+) {
+    point_t basep;
+    crypton_decaf_error_t succ = API_NS(point_decode)(basep, base, allow_identity);
+    if (short_circuit && succ != CRYPTON_DECAF_SUCCESS) return succ;
+    API_NS(point_cond_sel)(basep, API_NS(point_base), basep, succ);
+    API_NS(point_scalarmul)(basep, basep, scalar);
+    API_NS(point_encode)(scaled, basep);
+    API_NS(point_destroy)(basep);
+    return succ;
+}
+
+void API_NS(point_mul_by_cofactor_and_encode_like_eddsa) (
+    uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const point_t p
+) {
+    
+    /* The point is now on the twisted curve.  Move it to untwisted. */
+    gf x, y, z, t;
+    point_t q;
+#if COFACTOR == 8
+    API_NS(point_double)(q,p);
+#else
+    API_NS(point_copy)(q,p);
+#endif
+    
+#if EDDSA_USE_SIGMA_ISOGENY
+    {
+        /* Use 4-isogeny like ed25519:
+         *   2*x*y*sqrt(d/a-1)/(ax^2 + y^2 - 2)
+         *   (y^2 - ax^2)/(y^2 + ax^2)
+         * with a = -1, d = -EDWARDS_D:
+         *   -2xysqrt(EDWARDS_D-1)/(2z^2-y^2+x^2)
+         *   (y^2+x^2)/(y^2-x^2)
+         */
+        gf u;
+        crypton_gf_sqr ( x, q->x ); // x^2
+        crypton_gf_sqr ( t, q->y ); // y^2
+        crypton_gf_add( u, x, t ); // x^2 + y^2
+        crypton_gf_add( z, q->y, q->x );
+        crypton_gf_sqr ( y, z);
+        crypton_gf_sub ( y, u, y ); // -2xy
+        crypton_gf_sub ( z, t, x ); // y^2 - x^2
+        crypton_gf_sqr ( x, q->z );
+        crypton_gf_add ( t, x, x);
+        crypton_gf_sub ( t, t, z);  // 2z^2 - y^2 + x^2
+        crypton_gf_mul ( x, y, z ); // 2xy(y^2-x^2)
+        crypton_gf_mul ( y, u, t ); // (x^2+y^2)(2z^2-y^2+x^2)
+        crypton_gf_mul ( u, z, t );
+        crypton_gf_copy( z, u );
+        crypton_gf_mul ( u, x, SQRT_ONE_MINUS_D );
+        crypton_gf_copy( x, u );
+        crypton_decaf_bzero(u,sizeof(u));
+    }
+#elif IMAGINE_TWIST
+    {
+        API_NS(point_double)(q,q);
+        API_NS(point_double)(q,q);
+        crypton_gf_mul_qnr(x, q->x);
+        crypton_gf_copy(y, q->y);
+        crypton_gf_copy(z, q->z);
+    }
+#else
+    {
+        /* 4-isogeny: 2xy/(y^+x^2), (y^2-x^2)/(2z^2-y^2+x^2) */
+        gf u;
+        crypton_gf_sqr ( x, q->x );
+        crypton_gf_sqr ( t, q->y );
+        crypton_gf_add( u, x, t );
+        crypton_gf_add( z, q->y, q->x );
+        crypton_gf_sqr ( y, z);
+        crypton_gf_sub ( y, u, y );
+        crypton_gf_sub ( z, t, x );
+        crypton_gf_sqr ( x, q->z );
+        crypton_gf_add ( t, x, x); 
+        crypton_gf_sub ( t, t, z);
+        crypton_gf_mul ( x, t, y );
+        crypton_gf_mul ( y, z, u );
+        crypton_gf_mul ( z, u, t );
+        crypton_decaf_bzero(u,sizeof(u));
+    }
+#endif
+    /* Affinize */
+    crypton_gf_invert(z,z,1);
+    crypton_gf_mul(t,x,z);
+    crypton_gf_mul(x,y,z);
+    
+    /* Encode */
+    enc[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] = 0;
+    crypton_gf_serialize(enc, x, 1);
+    enc[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] |= 0x80 & crypton_gf_lobit(t);
+
+    crypton_decaf_bzero(x,sizeof(x));
+    crypton_decaf_bzero(y,sizeof(y));
+    crypton_decaf_bzero(z,sizeof(z));
+    crypton_decaf_bzero(t,sizeof(t));
+    API_NS(point_destroy)(q);
+}
+
+
+crypton_decaf_error_t API_NS(point_decode_like_eddsa_and_ignore_cofactor) (
+    point_t p,
+    const uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]
+) {
+    uint8_t enc2[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES];
+    memcpy(enc2,enc,sizeof(enc2));
+
+    mask_t low = ~word_is_zero(enc2[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] & 0x80);
+    enc2[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1] &= ~0x80;
+    
+    mask_t succ = crypton_gf_deserialize(p->y, enc2, 1);
+#if 0 == 0
+    succ &= word_is_zero(enc2[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES-1]);
+#endif
+
+    crypton_gf_sqr(p->x,p->y);
+    crypton_gf_sub(p->z,ONE,p->x); /* num = 1-y^2 */
+    #if EDDSA_USE_SIGMA_ISOGENY
+        crypton_gf_mulw(p->t,p->z,EDWARDS_D); /* d-dy^2 */
+        crypton_gf_mulw(p->x,p->z,EDWARDS_D-1); /* num = (1-y^2)(d-1) */
+        crypton_gf_copy(p->z,p->x);
+    #else
+        crypton_gf_mulw(p->t,p->x,EDWARDS_D); /* dy^2 */
+    #endif
+    crypton_gf_sub(p->t,ONE,p->t); /* denom = 1-dy^2 or 1-d + dy^2 */
+    
+    crypton_gf_mul(p->x,p->z,p->t);
+    succ &= crypton_gf_isr(p->t,p->x); /* 1/sqrt(num * denom) */
+    
+    crypton_gf_mul(p->x,p->t,p->z); /* sqrt(num / denom) */
+    crypton_gf_cond_neg(p->x,~crypton_gf_lobit(p->x)^low);
+    crypton_gf_copy(p->z,ONE);
+  
+    #if EDDSA_USE_SIGMA_ISOGENY
+    {
+       /* Use 4-isogeny like ed25519:
+        *   2*x*y/sqrt(1-d/a)/(ax^2 + y^2 - 2)
+        *   (y^2 - ax^2)/(y^2 + ax^2)
+        * (MAGIC: above formula may be off by a factor of -a
+        * or something somewhere; check it for other a)
+        *
+        * with a = -1, d = -EDWARDS_D:
+        *   -2xy/sqrt(1-EDWARDS_D)/(2z^2-y^2+x^2)
+        *   (y^2+x^2)/(y^2-x^2)
+        */
+        gf a, b, c, d;
+        crypton_gf_sqr ( c, p->x );
+        crypton_gf_sqr ( a, p->y );
+        crypton_gf_add ( d, c, a ); // x^2 + y^2
+        crypton_gf_add ( p->t, p->y, p->x );
+        crypton_gf_sqr ( b, p->t );
+        crypton_gf_sub ( b, b, d ); // 2xy
+        crypton_gf_sub ( p->t, a, c ); // y^2 - x^2
+        crypton_gf_sqr ( p->x, p->z );
+        crypton_gf_add ( p->z, p->x, p->x );
+        crypton_gf_sub ( a, p->z, p->t ); // 2z^2 - y^2 + x^2
+        crypton_gf_mul ( c, a, SQRT_ONE_MINUS_D );
+        crypton_gf_mul ( p->x, b, p->t); // (2xy)(y^2-x^2)
+        crypton_gf_mul ( p->z, p->t, c ); // (y^2-x^2)sd(2z^2 - y^2 + x^2)
+        crypton_gf_mul ( p->y, d, c ); // (y^2+x^2)sd(2z^2 - y^2 + x^2)
+        crypton_gf_mul ( p->t, d, b );
+        crypton_decaf_bzero(a,sizeof(a));
+        crypton_decaf_bzero(b,sizeof(b));
+        crypton_decaf_bzero(c,sizeof(c));
+        crypton_decaf_bzero(d,sizeof(d));
+    } 
+    #elif IMAGINE_TWIST
+    {
+        crypton_gf_mul(p->t,p->x,SQRT_MINUS_ONE);
+        crypton_gf_copy(p->x,p->t);
+        crypton_gf_mul(p->t,p->x,p->y);
+    }
+    #else
+    {
+        /* 4-isogeny 2xy/(y^2-ax^2), (y^2+ax^2)/(2-y^2-ax^2) */
+        gf a, b, c, d;
+        crypton_gf_sqr ( c, p->x );
+        crypton_gf_sqr ( a, p->y );
+        crypton_gf_add ( d, c, a );
+        crypton_gf_add ( p->t, p->y, p->x );
+        crypton_gf_sqr ( b, p->t );
+        crypton_gf_sub ( b, b, d );
+        crypton_gf_sub ( p->t, a, c );
+        crypton_gf_sqr ( p->x, p->z );
+        crypton_gf_add ( p->z, p->x, p->x );
+        crypton_gf_sub ( a, p->z, d );
+        crypton_gf_mul ( p->x, a, b );
+        crypton_gf_mul ( p->z, p->t, a );
+        crypton_gf_mul ( p->y, p->t, d );
+        crypton_gf_mul ( p->t, b, d );
+        crypton_decaf_bzero(a,sizeof(a));
+        crypton_decaf_bzero(b,sizeof(b));
+        crypton_decaf_bzero(c,sizeof(c));
+        crypton_decaf_bzero(d,sizeof(d));
+    }
+    #endif
+    
+    crypton_decaf_bzero(enc2,sizeof(enc2));
+    assert(API_NS(point_valid)(p) || ~succ);
+    return crypton_decaf_succeed_if(mask_to_bool(succ));
+}
+
+crypton_decaf_error_t crypton_decaf_x448 (
+    uint8_t out[X_PUBLIC_BYTES],
+    const uint8_t base[X_PUBLIC_BYTES],
+    const uint8_t scalar[X_PRIVATE_BYTES]
+) {
+    gf x1, x2, z2, x3, z3, t1, t2;
+    ignore_result(crypton_gf_deserialize(x1,base,1));
+    crypton_gf_copy(x2,ONE);
+    crypton_gf_copy(z2,ZERO);
+    crypton_gf_copy(x3,x1);
+    crypton_gf_copy(z3,ONE);
+    
+    int t;
+    mask_t swap = 0;
+    
+    for (t = X_PRIVATE_BITS-1; t>=0; t--) {
+        uint8_t sb = scalar[t/8];
+        
+        /* Scalar conditioning */
+        if (t/8==0) sb &= -(uint8_t)COFACTOR;
+        else if (t == X_PRIVATE_BITS-1) sb = -1;
+        
+        mask_t k_t = (sb>>(t%8)) & 1;
+        k_t = -k_t; /* set to all 0s or all 1s */
+        
+        swap ^= k_t;
+        crypton_gf_cond_swap(x2,x3,swap);
+        crypton_gf_cond_swap(z2,z3,swap);
+        swap = k_t;
+        
+        crypton_gf_add_nr(t1,x2,z2); /* A = x2 + z2 */        /* 2+e */
+        crypton_gf_sub_nr(t2,x2,z2); /* B = x2 - z2 */        /* 3+e */
+        crypton_gf_sub_nr(z2,x3,z3); /* D = x3 - z3 */        /* 3+e */
+        crypton_gf_mul(x2,t1,z2);    /* DA */
+        crypton_gf_add_nr(z2,z3,x3); /* C = x3 + z3 */        /* 2+e */
+        crypton_gf_mul(x3,t2,z2);    /* CB */
+        crypton_gf_sub_nr(z3,x2,x3); /* DA-CB */              /* 3+e */
+        crypton_gf_sqr(z2,z3);       /* (DA-CB)^2 */
+        crypton_gf_mul(z3,x1,z2);    /* z3 = x1(DA-CB)^2 */
+        crypton_gf_add_nr(z2,x2,x3); /* (DA+CB) */            /* 2+e */
+        crypton_gf_sqr(x3,z2);       /* x3 = (DA+CB)^2 */
+        
+        crypton_gf_sqr(z2,t1);       /* AA = A^2 */
+        crypton_gf_sqr(t1,t2);       /* BB = B^2 */
+        crypton_gf_mul(x2,z2,t1);    /* x2 = AA*BB */
+        crypton_gf_sub_nr(t2,z2,t1); /* E = AA-BB */          /* 3+e */
+        
+        crypton_gf_mulw(t1,t2,-EDWARDS_D); /* E*-d = a24*E */
+        crypton_gf_add_nr(t1,t1,z2); /* AA + a24*E */         /* 2+e */
+        crypton_gf_mul(z2,t2,t1); /* z2 = E(AA+a24*E) */
+    }
+    
+    /* Finish */
+    crypton_gf_cond_swap(x2,x3,swap);
+    crypton_gf_cond_swap(z2,z3,swap);
+    crypton_gf_invert(z2,z2,0);
+    crypton_gf_mul(x1,x2,z2);
+    crypton_gf_serialize(out,x1,1);
+    mask_t nz = ~crypton_gf_eq(x1,ZERO);
+    
+    crypton_decaf_bzero(x1,sizeof(x1));
+    crypton_decaf_bzero(x2,sizeof(x2));
+    crypton_decaf_bzero(z2,sizeof(z2));
+    crypton_decaf_bzero(x3,sizeof(x3));
+    crypton_decaf_bzero(z3,sizeof(z3));
+    crypton_decaf_bzero(t1,sizeof(t1));
+    crypton_decaf_bzero(t2,sizeof(t2));
+    
+    return crypton_decaf_succeed_if(mask_to_bool(nz));
+}
+
+/* Thanks Johan Pascal */
+void crypton_decaf_ed448_convert_public_key_to_x448 (
+    uint8_t x[CRYPTON_DECAF_X448_PUBLIC_BYTES],
+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]
+) {
+    gf y;
+    {
+        uint8_t enc2[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES];
+        memcpy(enc2,ed,sizeof(enc2));
+
+        /* retrieve y from the ed compressed point */
+        enc2[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES-1] &= ~0x80;
+        ignore_result(crypton_gf_deserialize(y, enc2, 0));
+        crypton_decaf_bzero(enc2,sizeof(enc2));
+    }
+    
+    {
+        gf n,d;
+        
+#if EDDSA_USE_SIGMA_ISOGENY
+        /* u = (1+y)/(1-y)*/
+        crypton_gf_add(n, y, ONE); /* n = y+1 */
+        crypton_gf_sub(d, ONE, y); /* d = 1-y */
+        crypton_gf_invert(d, d, 0); /* d = 1/(1-y) */
+        crypton_gf_mul(y, n, d); /* u = (y+1)/(1-y) */
+        crypton_gf_serialize(x,y,1);
+#else /* EDDSA_USE_SIGMA_ISOGENY */
+        /* u = y^2 * (1-dy^2) / (1-y^2) */
+        crypton_gf_sqr(n,y); /* y^2*/
+        crypton_gf_sub(d,ONE,n); /* 1-y^2*/
+        crypton_gf_invert(d,d,0); /* 1/(1-y^2)*/
+        crypton_gf_mul(y,n,d); /* y^2 / (1-y^2) */
+        crypton_gf_mulw(d,n,EDWARDS_D); /* dy^2*/
+        crypton_gf_sub(d, ONE, d); /* 1-dy^2*/
+        crypton_gf_mul(n, y, d); /* y^2 * (1-dy^2) / (1-y^2) */
+        crypton_gf_serialize(x,n,1);
+#endif /* EDDSA_USE_SIGMA_ISOGENY */
+        
+        crypton_decaf_bzero(y,sizeof(y));
+        crypton_decaf_bzero(n,sizeof(n));
+        crypton_decaf_bzero(d,sizeof(d));
+    }
+}
+
+void crypton_decaf_x448_generate_key (
+    uint8_t out[X_PUBLIC_BYTES],
+    const uint8_t scalar[X_PRIVATE_BYTES]
+) {
+    crypton_decaf_x448_derive_public_key(out,scalar);
+}
+
+void crypton_decaf_x448_derive_public_key (
+    uint8_t out[X_PUBLIC_BYTES],
+    const uint8_t scalar[X_PRIVATE_BYTES]
+) {
+    /* Scalar conditioning */
+    uint8_t scalar2[X_PRIVATE_BYTES];
+    memcpy(scalar2,scalar,sizeof(scalar2));
+    scalar2[0] &= -(uint8_t)COFACTOR;
+    
+    scalar2[X_PRIVATE_BYTES-1] &= ~(-1u<<((X_PRIVATE_BITS+7)%8));
+    scalar2[X_PRIVATE_BYTES-1] |= 1<<((X_PRIVATE_BITS+7)%8);
+    
+    scalar_t the_scalar;
+    API_NS(scalar_decode_long)(the_scalar,scalar2,sizeof(scalar2));
+    
+    /* We're gonna isogenize by 2, so divide by 2.
+     *
+     * Why by 2, even though it's a 4-isogeny?
+     *
+     * The isogeny map looks like
+     * Montgomery <-2-> Jacobi <-2-> Edwards
+     *
+     * Since the Jacobi base point is the PREimage of the iso to
+     * the Montgomery curve, and we're going
+     * Jacobi -> Edwards -> Jacobi -> Montgomery,
+     * we pick up only a factor of 2 over Jacobi -> Montgomery. 
+     */
+    API_NS(scalar_halve)(the_scalar,the_scalar);
+    point_t p;
+    API_NS(precomputed_scalarmul)(p,API_NS(precomputed_base),the_scalar);
+    
+    /* Isogenize to Montgomery curve.
+     *
+     * Why isn't this just a separate function, eg crypton_decaf_encode_like_x448?
+     * Basically because in general it does the wrong thing if there is a cofactor
+     * component in the input.  In this function though, there isn't a cofactor
+     * component in the input.
+     */
+    crypton_gf_invert(p->t,p->x,0); /* 1/x */
+    crypton_gf_mul(p->z,p->t,p->y); /* y/x */
+    crypton_gf_sqr(p->y,p->z); /* (y/x)^2 */
+#if IMAGINE_TWIST
+    crypton_gf_sub(p->y,ZERO,p->y);
+#endif
+    crypton_gf_serialize(out,p->y,1);
+        
+    crypton_decaf_bzero(scalar2,sizeof(scalar2));
+    API_NS(scalar_destroy)(the_scalar);
+    API_NS(point_destroy)(p);
+}
+
+/**
+ * @cond internal
+ * Control for variable-time scalar multiply algorithms.
+ */
+struct smvt_control {
+  int power, addend;
+};
+
+static int recode_wnaf (
+    struct smvt_control *control, /* [nbits/(table_bits+1) + 3] */
+    const scalar_t scalar,
+    unsigned int table_bits
+) {
+    unsigned int table_size = SCALAR_BITS/(table_bits+1) + 3;
+    int position = table_size - 1; /* at the end */
+    
+    /* place the end marker */
+    control[position].power = -1;
+    control[position].addend = 0;
+    position--;
+
+    /* PERF: Could negate scalar if it's large.  But then would need more cases
+     * in the actual code that uses it, all for an expected reduction of like 1/5 op.
+     * Probably not worth it.
+     */
+    
+    uint64_t current = scalar->limb[0] & 0xFFFF;
+    uint32_t mask = (1<<(table_bits+1))-1;
+
+    unsigned int w;
+    const unsigned int B_OVER_16 = sizeof(scalar->limb[0]) / 2;
+    for (w = 1; w<(SCALAR_BITS-1)/16+3; w++) {
+        if (w < (SCALAR_BITS-1)/16+1) {
+            /* Refill the 16 high bits of current */
+            current += (uint32_t)((scalar->limb[w/B_OVER_16]>>(16*(w%B_OVER_16)))<<16);
+        }
+        
+        while (current & 0xFFFF) {
+            assert(position >= 0);
+            uint32_t pos = __builtin_ctz((uint32_t)current), odd = (uint32_t)current >> pos;
+            int32_t delta = odd & mask;
+            if (odd & 1<<(table_bits+1)) delta -= (1<<(table_bits+1));
+            current -= delta << pos;
+            control[position].power = pos + 16*(w-1);
+            control[position].addend = delta;
+            position--;
+        }
+        current >>= 16;
+    }
+    assert(current==0);
+    
+    position++;
+    unsigned int n = table_size - position;
+    unsigned int i;
+    for (i=0; i<n; i++) {
+        control[i] = control[i+position];
+    }
+    return n-1;
+}
+
+static void
+prepare_wnaf_table(
+    pniels_t *output,
+    const point_t working,
+    unsigned int tbits
+) {
+    point_t tmp;
+    int i;
+    pt_to_pniels(output[0], working);
+
+    if (tbits == 0) return;
+
+    API_NS(point_double)(tmp,working);
+    pniels_t twop;
+    pt_to_pniels(twop, tmp);
+
+    add_pniels_to_pt(tmp, output[0],0);
+    pt_to_pniels(output[1], tmp);
+
+    for (i=2; i < 1<<tbits; i++) {
+        add_pniels_to_pt(tmp, twop,0);
+        pt_to_pniels(output[i], tmp);
+    }
+    
+    API_NS(point_destroy)(tmp);
+    crypton_decaf_bzero(twop,sizeof(twop));
+}
+
+extern const gf API_NS(precomputed_wnaf_as_fe)[];
+static const niels_t *API_NS(wnaf_base) = (const niels_t *)API_NS(precomputed_wnaf_as_fe);
+const size_t API_NS(sizeof_precomputed_wnafs)
+    = sizeof(niels_t)<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS;
+
+void API_NS(precompute_wnafs) (
+    niels_t out[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS],
+    const point_t base
+);
+
+void API_NS(precompute_wnafs) (
+    niels_t out[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS],
+    const point_t base
+) {
+    pniels_t tmp[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS];
+    gf zs[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS], zis[1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS];
+    int i;
+    prepare_wnaf_table(tmp,base,CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS);
+    for (i=0; i<1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS; i++) {
+        memcpy(out[i], tmp[i]->n, sizeof(niels_t));
+        crypton_gf_copy(zs[i], tmp[i]->z);
+    }
+    batch_normalize_niels(out, (const gf *)zs, zis, 1<<CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS);
+    
+    crypton_decaf_bzero(tmp,sizeof(tmp));
+    crypton_decaf_bzero(zs,sizeof(zs));
+    crypton_decaf_bzero(zis,sizeof(zis));
+}
+
+void API_NS(base_double_scalarmul_non_secret) (
+    point_t combo,
+    const scalar_t scalar1,
+    const point_t base2,
+    const scalar_t scalar2
+) {
+    const int table_bits_var = CRYPTON_DECAF_WNAF_VAR_TABLE_BITS,
+        table_bits_pre = CRYPTON_DECAF_WNAF_FIXED_TABLE_BITS;
+    struct smvt_control control_var[SCALAR_BITS/(table_bits_var+1)+3];
+    struct smvt_control control_pre[SCALAR_BITS/(table_bits_pre+1)+3];
+    
+    int ncb_pre = recode_wnaf(control_pre, scalar1, table_bits_pre);
+    int ncb_var = recode_wnaf(control_var, scalar2, table_bits_var);
+  
+    pniels_t precmp_var[1<<table_bits_var];
+    prepare_wnaf_table(precmp_var, base2, table_bits_var);
+  
+    int contp=0, contv=0, i = control_var[0].power;
+
+    if (i < 0) {
+        API_NS(point_copy)(combo, API_NS(point_identity));
+        return;
+    } else if (i > control_pre[0].power) {
+        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);
+        contv++;
+    } else if (i == control_pre[0].power && i >=0 ) {
+        pniels_to_pt(combo, precmp_var[control_var[0].addend >> 1]);
+        add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1], i);
+        contv++; contp++;
+    } else {
+        i = control_pre[0].power;
+        niels_to_pt(combo, API_NS(wnaf_base)[control_pre[0].addend >> 1]);
+        contp++;
+    }
+    
+    for (i--; i >= 0; i--) {
+        int cv = (i==control_var[contv].power), cp = (i==control_pre[contp].power);
+        point_double_internal(combo,combo,i && !(cv||cp));
+
+        if (cv) {
+            assert(control_var[contv].addend);
+
+            if (control_var[contv].addend > 0) {
+                add_pniels_to_pt(combo, precmp_var[control_var[contv].addend >> 1], i&&!cp);
+            } else {
+                sub_pniels_from_pt(combo, precmp_var[(-control_var[contv].addend) >> 1], i&&!cp);
+            }
+            contv++;
+        }
+
+        if (cp) {
+            assert(control_pre[contp].addend);
+
+            if (control_pre[contp].addend > 0) {
+                add_niels_to_pt(combo, API_NS(wnaf_base)[control_pre[contp].addend >> 1], i);
+            } else {
+                sub_niels_from_pt(combo, API_NS(wnaf_base)[(-control_pre[contp].addend) >> 1], i);
+            }
+            contp++;
+        }
+    }
+    
+    /* This function is non-secret, but whatever this is cheap. */
+    crypton_decaf_bzero(control_var,sizeof(control_var));
+    crypton_decaf_bzero(control_pre,sizeof(control_pre));
+    crypton_decaf_bzero(precmp_var,sizeof(precmp_var));
+
+    assert(contv == ncb_var); (void)ncb_var;
+    assert(contp == ncb_pre); (void)ncb_pre;
+}
+
+void API_NS(point_destroy) (
+    point_t point
+) {
+    crypton_decaf_bzero(point, sizeof(point_t));
+}
+
+void API_NS(precomputed_destroy) (
+    precomputed_s *pre
+) {
+    crypton_decaf_bzero(pre, API_NS(sizeof_precomputed_s));
 }
diff --git a/cbits/decaf/ed448goldilocks/decaf_tables.c b/cbits/decaf/ed448goldilocks/decaf_tables.c
--- a/cbits/decaf/ed448goldilocks/decaf_tables.c
+++ b/cbits/decaf/ed448goldilocks/decaf_tables.c
@@ -3,7 +3,7 @@
 
 #include <decaf.h>
 
-#define API_NS(_id) cryptonite_decaf_448_##_id
+#define API_NS(_id) crypton_decaf_448_##_id
 const API_NS(point_t) API_NS(point_base) = {{
 {FIELD_LITERAL(0x00fffffffffffffe,0x00ffffffffffffff,0x00ffffffffffffff,0x00ffffffffffffff,0x0000000000000003,0x0000000000000000,0x0000000000000000,0x0000000000000000)},
   {FIELD_LITERAL(0x0081e6d37f752992,0x003078ead1c28721,0x00135cfd2394666c,0x0041149c50506061,0x0031d30e4f5490b3,0x00902014990dc141,0x0052341b04c1e328,0x0014237853c10a1b)},
diff --git a/cbits/decaf/ed448goldilocks/eddsa.c b/cbits/decaf/ed448goldilocks/eddsa.c
--- a/cbits/decaf/ed448goldilocks/eddsa.c
+++ b/cbits/decaf/ed448goldilocks/eddsa.c
@@ -18,23 +18,23 @@
 #include <decaf/sha512.h>
 #include <string.h>
 
-#define API_NAME "cryptonite_decaf_448"
-#define API_NS(_id) cryptonite_decaf_448_##_id
+#define API_NAME "crypton_decaf_448"
+#define API_NS(_id) crypton_decaf_448_##_id
 
-#define hash_ctx_t   cryptonite_decaf_shake256_ctx_t
-#define hash_init    cryptonite_decaf_shake256_init
-#define hash_update  cryptonite_decaf_shake256_update
-#define hash_final   cryptonite_decaf_shake256_final
-#define hash_destroy cryptonite_decaf_shake256_destroy
-#define hash_hash    cryptonite_decaf_shake256_hash
+#define hash_ctx_t   crypton_decaf_shake256_ctx_t
+#define hash_init    crypton_decaf_shake256_init
+#define hash_update  crypton_decaf_shake256_update
+#define hash_final   crypton_decaf_shake256_final
+#define hash_destroy crypton_decaf_shake256_destroy
+#define hash_hash    crypton_decaf_shake256_hash
 
-#define NO_CONTEXT CRYPTONITE_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS
+#define NO_CONTEXT CRYPTON_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS
 #define EDDSA_USE_SIGMA_ISOGENY 0
 #define COFACTOR 4
 
 #if NO_CONTEXT
-const uint8_t CRYPTONITE_NO_CONTEXT_POINTS_HERE = 0;
-const uint8_t * const CRYPTONITE_DECAF_ED448_NO_CONTEXT = &CRYPTONITE_NO_CONTEXT_POINTS_HERE;
+const uint8_t CRYPTON_NO_CONTEXT_POINTS_HERE = 0;
+const uint8_t * const CRYPTON_DECAF_ED448_NO_CONTEXT = &CRYPTON_NO_CONTEXT_POINTS_HERE;
 #endif
 
 /* EDDSA_BASE_POINT_RATIO = 1 or 2
@@ -44,17 +44,17 @@
 #define EDDSA_BASE_POINT_RATIO (1+EDDSA_USE_SIGMA_ISOGENY)
 
 static void clamp (
-    uint8_t secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]
+    uint8_t secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES]
 ) {
     /* Blarg */
     secret_scalar_ser[0] &= -COFACTOR;
     uint8_t hibit = (1<<0)>>1;
     if (hibit == 0) {
-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 1] = 0;
-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;
+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 1] = 0;
+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 2] |= 0x80;
     } else {
-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 1] &= hibit-1;
-        secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES - 1] |= hibit;
+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 1] &= hibit-1;
+        secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES - 1] |= hibit;
     }
 }
 
@@ -68,7 +68,7 @@
     hash_init(hash);
 
 #if NO_CONTEXT
-    if (context_len == 0 && context == CRYPTONITE_DECAF_ED448_NO_CONTEXT) {
+    if (context_len == 0 && context == CRYPTON_DECAF_ED448_NO_CONTEXT) {
         (void)prehashed;
         (void)for_prehash;
         (void)context;
@@ -83,39 +83,39 @@
     hash_update(hash,context,context_len);
 }
 
-void cryptonite_decaf_ed448_prehash_init (
+void crypton_decaf_ed448_prehash_init (
     hash_ctx_t hash
 ) {
     hash_init(hash);
 }
 
 /* In this file because it uses the hash */
-void cryptonite_decaf_ed448_convert_private_key_to_x448 (
-    uint8_t x[CRYPTONITE_DECAF_X448_PRIVATE_BYTES],
-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]
+void crypton_decaf_ed448_convert_private_key_to_x448 (
+    uint8_t x[CRYPTON_DECAF_X448_PRIVATE_BYTES],
+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES]
 ) {
     /* pass the private key through hash_hash function */
-    /* and keep the first CRYPTONITE_DECAF_X448_PRIVATE_BYTES bytes */
+    /* and keep the first CRYPTON_DECAF_X448_PRIVATE_BYTES bytes */
     hash_hash(
         x,
-        CRYPTONITE_DECAF_X448_PRIVATE_BYTES,
+        CRYPTON_DECAF_X448_PRIVATE_BYTES,
         ed,
-        CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES
+        CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES
     );
 }
     
-void cryptonite_decaf_ed448_derive_public_key (
-    uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]
+void crypton_decaf_ed448_derive_public_key (
+    uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES]
 ) {
     /* only this much used for keygen */
-    uint8_t secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];
+    uint8_t secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];
     
     hash_hash(
         secret_scalar_ser,
         sizeof(secret_scalar_ser),
         privkey,
-        CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES
+        CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES
     );
     clamp(secret_scalar_ser);
         
@@ -140,13 +140,13 @@
     /* Cleanup */
     API_NS(scalar_destroy)(secret_scalar);
     API_NS(point_destroy)(p);
-    cryptonite_decaf_bzero(secret_scalar_ser, sizeof(secret_scalar_ser));
+    crypton_decaf_bzero(secret_scalar_ser, sizeof(secret_scalar_ser));
 }
 
-void cryptonite_decaf_ed448_sign (
-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
+void crypton_decaf_ed448_sign (
+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
     const uint8_t *message,
     size_t message_len,
     uint8_t prehashed,
@@ -158,14 +158,14 @@
     {
         /* Schedule the secret key */
         struct {
-            uint8_t secret_scalar_ser[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];
-            uint8_t seed[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];
+            uint8_t secret_scalar_ser[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];
+            uint8_t seed[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];
         } __attribute__((packed)) expanded;
         hash_hash(
             (uint8_t *)&expanded,
             sizeof(expanded),
             privkey,
-            CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES
+            CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES
         );
         clamp(expanded.secret_scalar_ser);   
         API_NS(scalar_decode_long)(secret_scalar, expanded.secret_scalar_ser, sizeof(expanded.secret_scalar_ser));
@@ -174,19 +174,19 @@
         hash_init_with_dom(hash,prehashed,0,context,context_len);
         hash_update(hash,expanded.seed,sizeof(expanded.seed));
         hash_update(hash,message,message_len);
-        cryptonite_decaf_bzero(&expanded, sizeof(expanded));
+        crypton_decaf_bzero(&expanded, sizeof(expanded));
     }
     
     /* Decode the nonce */
     API_NS(scalar_t) nonce_scalar;
     {
-        uint8_t nonce[2*CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];
+        uint8_t nonce[2*CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];
         hash_final(hash,nonce,sizeof(nonce));
         API_NS(scalar_decode_long)(nonce_scalar, nonce, sizeof(nonce));
-        cryptonite_decaf_bzero(nonce, sizeof(nonce));
+        crypton_decaf_bzero(nonce, sizeof(nonce));
     }
     
-    uint8_t nonce_point[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES] = {0};
+    uint8_t nonce_point[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES] = {0};
     {
         /* Scalarmul to create the nonce-point */
         API_NS(scalar_t) nonce_scalar_2;
@@ -207,21 +207,21 @@
         /* Compute the challenge */
         hash_init_with_dom(hash,prehashed,0,context,context_len);
         hash_update(hash,nonce_point,sizeof(nonce_point));
-        hash_update(hash,pubkey,CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES);
+        hash_update(hash,pubkey,CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES);
         hash_update(hash,message,message_len);
-        uint8_t challenge[2*CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];
+        uint8_t challenge[2*CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];
         hash_final(hash,challenge,sizeof(challenge));
         hash_destroy(hash);
         API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));
-        cryptonite_decaf_bzero(challenge,sizeof(challenge));
+        crypton_decaf_bzero(challenge,sizeof(challenge));
     }
     
     API_NS(scalar_mul)(challenge_scalar,challenge_scalar,secret_scalar);
     API_NS(scalar_add)(challenge_scalar,challenge_scalar,nonce_scalar);
     
-    cryptonite_decaf_bzero(signature,CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES);
+    crypton_decaf_bzero(signature,CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES);
     memcpy(signature,nonce_point,sizeof(nonce_point));
-    API_NS(scalar_encode)(&signature[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],challenge_scalar);
+    API_NS(scalar_encode)(&signature[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],challenge_scalar);
     
     API_NS(scalar_destroy)(secret_scalar);
     API_NS(scalar_destroy)(nonce_scalar);
@@ -229,29 +229,29 @@
 }
 
 
-void cryptonite_decaf_ed448_sign_prehash (
-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const cryptonite_decaf_ed448_prehash_ctx_t hash,
+void crypton_decaf_ed448_sign_prehash (
+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const crypton_decaf_ed448_prehash_ctx_t hash,
     const uint8_t *context,
     uint8_t context_len
 ) {
     uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */
     {
-        cryptonite_decaf_ed448_prehash_ctx_t hash_too;
+        crypton_decaf_ed448_prehash_ctx_t hash_too;
         memcpy(hash_too,hash,sizeof(hash_too));
         hash_final(hash_too,hash_output,sizeof(hash_output));
         hash_destroy(hash_too);
     }
 
-    cryptonite_decaf_ed448_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
-    cryptonite_decaf_bzero(hash_output,sizeof(hash_output));
+    crypton_decaf_ed448_sign(signature,privkey,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
+    crypton_decaf_bzero(hash_output,sizeof(hash_output));
 }
 
-cryptonite_decaf_error_t cryptonite_decaf_ed448_verify (
-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
+crypton_decaf_error_t crypton_decaf_ed448_verify (
+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
     const uint8_t *message,
     size_t message_len,
     uint8_t prehashed,
@@ -259,33 +259,33 @@
     uint8_t context_len
 ) { 
     API_NS(point_t) pk_point, r_point;
-    cryptonite_decaf_error_t error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(pk_point,pubkey);
-    if (CRYPTONITE_DECAF_SUCCESS != error) { return error; }
+    crypton_decaf_error_t error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(pk_point,pubkey);
+    if (CRYPTON_DECAF_SUCCESS != error) { return error; }
     
     error = API_NS(point_decode_like_eddsa_and_ignore_cofactor)(r_point,signature);
-    if (CRYPTONITE_DECAF_SUCCESS != error) { return error; }
+    if (CRYPTON_DECAF_SUCCESS != error) { return error; }
     
     API_NS(scalar_t) challenge_scalar;
     {
         /* Compute the challenge */
         hash_ctx_t hash;
         hash_init_with_dom(hash,prehashed,0,context,context_len);
-        hash_update(hash,signature,CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES);
-        hash_update(hash,pubkey,CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES);
+        hash_update(hash,signature,CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES);
+        hash_update(hash,pubkey,CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES);
         hash_update(hash,message,message_len);
-        uint8_t challenge[2*CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES];
+        uint8_t challenge[2*CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES];
         hash_final(hash,challenge,sizeof(challenge));
         hash_destroy(hash);
         API_NS(scalar_decode_long)(challenge_scalar,challenge,sizeof(challenge));
-        cryptonite_decaf_bzero(challenge,sizeof(challenge));
+        crypton_decaf_bzero(challenge,sizeof(challenge));
     }
     API_NS(scalar_sub)(challenge_scalar, API_NS(scalar_zero), challenge_scalar);
     
     API_NS(scalar_t) response_scalar;
     API_NS(scalar_decode_long)(
         response_scalar,
-        &signature[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-        CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES
+        &signature[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+        CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES
     );
 #if EDDSA_BASE_POINT_RATIO == 2
     API_NS(scalar_add)(response_scalar,response_scalar,response_scalar);
@@ -299,28 +299,28 @@
         pk_point,
         challenge_scalar
     );
-    return cryptonite_decaf_succeed_if(API_NS(point_eq(pk_point,r_point)));
+    return crypton_decaf_succeed_if(API_NS(point_eq(pk_point,r_point)));
 }
 
 
-cryptonite_decaf_error_t cryptonite_decaf_ed448_verify_prehash (
-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const cryptonite_decaf_ed448_prehash_ctx_t hash,
+crypton_decaf_error_t crypton_decaf_ed448_verify_prehash (
+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const crypton_decaf_ed448_prehash_ctx_t hash,
     const uint8_t *context,
     uint8_t context_len
 ) {
-    cryptonite_decaf_error_t ret;
+    crypton_decaf_error_t ret;
     
     uint8_t hash_output[64]; /* MAGIC but true for all existing schemes */
     {
-        cryptonite_decaf_ed448_prehash_ctx_t hash_too;
+        crypton_decaf_ed448_prehash_ctx_t hash_too;
         memcpy(hash_too,hash,sizeof(hash_too));
         hash_final(hash_too,hash_output,sizeof(hash_output));
         hash_destroy(hash_too);
     }
     
-    ret = cryptonite_decaf_ed448_verify(signature,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
+    ret = crypton_decaf_ed448_verify(signature,pubkey,hash_output,sizeof(hash_output),1,context,context_len);
     
     return ret;
 }
diff --git a/cbits/decaf/ed448goldilocks/scalar.c b/cbits/decaf/ed448goldilocks/scalar.c
--- a/cbits/decaf/ed448goldilocks/scalar.c
+++ b/cbits/decaf/ed448goldilocks/scalar.c
@@ -16,13 +16,13 @@
 #include <decaf.h>
 
 /* Template stuff */
-#define API_NS(_id) cryptonite_decaf_448_##_id
-#define SCALAR_BITS CRYPTONITE_DECAF_448_SCALAR_BITS
-#define SCALAR_SER_BYTES CRYPTONITE_DECAF_448_SCALAR_BYTES
-#define SCALAR_LIMBS CRYPTONITE_DECAF_448_SCALAR_LIMBS
+#define API_NS(_id) crypton_decaf_448_##_id
+#define SCALAR_BITS CRYPTON_DECAF_448_SCALAR_BITS
+#define SCALAR_SER_BYTES CRYPTON_DECAF_448_SCALAR_BYTES
+#define SCALAR_LIMBS CRYPTON_DECAF_448_SCALAR_LIMBS
 #define scalar_t API_NS(scalar_t)
 
-static const cryptonite_decaf_word_t MONTGOMERY_FACTOR = (cryptonite_decaf_word_t)0x3bd440fae918bc5ull;
+static const crypton_decaf_word_t MONTGOMERY_FACTOR = (crypton_decaf_word_t)0x3bd440fae918bc5ull;
 static const scalar_t sc_p = {{{
     SC_LIMB(0x2378c292ab5844f3), SC_LIMB(0x216cc2728dc58f55), SC_LIMB(0xc44edb49aed63690), SC_LIMB(0xffffffff7cca23e9), SC_LIMB(0xffffffffffffffff), SC_LIMB(0xffffffffffffffff), SC_LIMB(0x3fffffffffffffff)
 }}}, sc_r2 = {{{
@@ -30,28 +30,28 @@
 }}};
 /* End of template stuff */
 
-#define WBITS CRYPTONITE_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */
+#define WBITS CRYPTON_DECAF_WORD_BITS /* NB this may be different from ARCH_WORD_BITS */
 
 const scalar_t API_NS(scalar_one) = {{{1}}}, API_NS(scalar_zero) = {{{0}}};
 
 /** {extra,accum} - sub +? p
  * Must have extra <= 1
  */
-static CRYPTONITE_DECAF_NOINLINE void sc_subx(
+static CRYPTON_DECAF_NOINLINE void sc_subx(
     scalar_t out,
-    const cryptonite_decaf_word_t accum[SCALAR_LIMBS],
+    const crypton_decaf_word_t accum[SCALAR_LIMBS],
     const scalar_t sub,
     const scalar_t p,
-    cryptonite_decaf_word_t extra
+    crypton_decaf_word_t extra
 ) {
-    cryptonite_decaf_dsword_t chain = 0;
+    crypton_decaf_dsword_t chain = 0;
     unsigned int i;
     for (i=0; i<SCALAR_LIMBS; i++) {
         chain = (chain + accum[i]) - sub->limb[i];
         out->limb[i] = chain;
         chain >>= WBITS;
     }
-    cryptonite_decaf_word_t borrow = chain+extra; /* = 0 or -1 */
+    crypton_decaf_word_t borrow = chain+extra; /* = 0 or -1 */
     
     chain = 0;
     for (i=0; i<SCALAR_LIMBS; i++) {
@@ -61,22 +61,22 @@
     }
 }
 
-static CRYPTONITE_DECAF_NOINLINE void sc_montmul (
+static CRYPTON_DECAF_NOINLINE void sc_montmul (
     scalar_t out,
     const scalar_t a,
     const scalar_t b
 ) {
     unsigned int i,j;
-    cryptonite_decaf_word_t accum[SCALAR_LIMBS+1] = {0};
-    cryptonite_decaf_word_t hi_carry = 0;
+    crypton_decaf_word_t accum[SCALAR_LIMBS+1] = {0};
+    crypton_decaf_word_t hi_carry = 0;
     
     for (i=0; i<SCALAR_LIMBS; i++) {
-        cryptonite_decaf_word_t mand = a->limb[i];
-        const cryptonite_decaf_word_t *mier = b->limb;
+        crypton_decaf_word_t mand = a->limb[i];
+        const crypton_decaf_word_t *mier = b->limb;
         
-        cryptonite_decaf_dword_t chain = 0;
+        crypton_decaf_dword_t chain = 0;
         for (j=0; j<SCALAR_LIMBS; j++) {
-            chain += ((cryptonite_decaf_dword_t)mand)*mier[j] + accum[j];
+            chain += ((crypton_decaf_dword_t)mand)*mier[j] + accum[j];
             accum[j] = chain;
             chain >>= WBITS;
         }
@@ -86,7 +86,7 @@
         chain = 0;
         mier = sc_p->limb;
         for (j=0; j<SCALAR_LIMBS; j++) {
-            chain += (cryptonite_decaf_dword_t)mand*mier[j] + accum[j];
+            chain += (crypton_decaf_dword_t)mand*mier[j] + accum[j];
             if (j) accum[j-1] = chain;
             chain >>= WBITS;
         }
@@ -109,11 +109,11 @@
 }
 
 /* PERF: could implement this */
-static CRYPTONITE_DECAF_INLINE void sc_montsqr (scalar_t out, const scalar_t a) {
+static CRYPTON_DECAF_INLINE void sc_montsqr (scalar_t out, const scalar_t a) {
     sc_montmul(out,a,a);
 }
 
-cryptonite_decaf_error_t API_NS(scalar_invert) (
+crypton_decaf_error_t API_NS(scalar_invert) (
     scalar_t out,
     const scalar_t a
 ) {
@@ -139,7 +139,7 @@
         
         if (started) sc_montsqr(out,out);
         
-        cryptonite_decaf_word_t w = (i>=0) ? sc_p->limb[i/WBITS] : 0;
+        crypton_decaf_word_t w = (i>=0) ? sc_p->limb[i/WBITS] : 0;
         if (i >= 0 && i<WBITS) {
             assert(w >= 2);
             w-=2;
@@ -169,8 +169,8 @@
     
     /* Demontgomerize */
     sc_montmul(out,out,API_NS(scalar_one));
-    cryptonite_decaf_bzero(precmp, sizeof(precmp));
-    return cryptonite_decaf_succeed_if(~API_NS(scalar_eq)(out,API_NS(scalar_zero)));
+    crypton_decaf_bzero(precmp, sizeof(precmp));
+    return crypton_decaf_succeed_if(~API_NS(scalar_eq)(out,API_NS(scalar_zero)));
 }
 
 void API_NS(scalar_sub) (
@@ -186,7 +186,7 @@
     const scalar_t a,
     const scalar_t b
 ) {
-    cryptonite_decaf_dword_t chain = 0;
+    crypton_decaf_dword_t chain = 0;
     unsigned int i;
     for (i=0; i<SCALAR_LIMBS; i++) {
         chain = (chain + a->limb[i]) + b->limb[i];
@@ -203,20 +203,20 @@
 ) {
     memset(out,0,sizeof(scalar_t));
     unsigned int i = 0;
-    for (; i<sizeof(uint64_t)/sizeof(cryptonite_decaf_word_t); i++) {
+    for (; i<sizeof(uint64_t)/sizeof(crypton_decaf_word_t); i++) {
         out->limb[i] = w;
-#if CRYPTONITE_DECAF_WORD_BITS < 64
-        w >>= 8*sizeof(cryptonite_decaf_word_t);
+#if CRYPTON_DECAF_WORD_BITS < 64
+        w >>= 8*sizeof(crypton_decaf_word_t);
 #endif
     }
 }
 
-cryptonite_decaf_bool_t
+crypton_decaf_bool_t
 API_NS(scalar_eq) (
     const scalar_t a,
     const scalar_t b
 ) {
-    cryptonite_decaf_word_t diff = 0;
+    crypton_decaf_word_t diff = 0;
     unsigned int i;
     for (i=0; i<SCALAR_LIMBS; i++) {
         diff |= a->limb[i] ^ b->limb[i];
@@ -224,28 +224,28 @@
     return mask_to_bool(word_is_zero(diff));
 }
 
-static CRYPTONITE_DECAF_INLINE void scalar_decode_short (
+static CRYPTON_DECAF_INLINE void scalar_decode_short (
     scalar_t s,
     const unsigned char *ser,
     unsigned int nbytes
 ) {
     unsigned int i,j,k=0;
     for (i=0; i<SCALAR_LIMBS; i++) {
-        cryptonite_decaf_word_t out = 0;
-        for (j=0; j<sizeof(cryptonite_decaf_word_t) && k<nbytes; j++,k++) {
-            out |= ((cryptonite_decaf_word_t)ser[k])<<(8*j);
+        crypton_decaf_word_t out = 0;
+        for (j=0; j<sizeof(crypton_decaf_word_t) && k<nbytes; j++,k++) {
+            out |= ((crypton_decaf_word_t)ser[k])<<(8*j);
         }
         s->limb[i] = out;
     }
 }
 
-cryptonite_decaf_error_t API_NS(scalar_decode)(
+crypton_decaf_error_t API_NS(scalar_decode)(
     scalar_t s,
     const unsigned char ser[SCALAR_SER_BYTES]
 ) {
     unsigned int i;
     scalar_decode_short(s, ser, SCALAR_SER_BYTES);
-    cryptonite_decaf_dsword_t accum = 0;
+    crypton_decaf_dsword_t accum = 0;
     for (i=0; i<SCALAR_LIMBS; i++) {
         accum = (accum + s->limb[i] - sc_p->limb[i]) >> WBITS;
     }
@@ -253,13 +253,13 @@
     
     API_NS(scalar_mul)(s,s,API_NS(scalar_one)); /* ham-handed reduce */
     
-    return cryptonite_decaf_succeed_if(~word_is_zero(accum));
+    return crypton_decaf_succeed_if(~word_is_zero(accum));
 }
 
 void API_NS(scalar_destroy) (
     scalar_t scalar
 ) {
-    cryptonite_decaf_bzero(scalar, sizeof(scalar_t));
+    crypton_decaf_bzero(scalar, sizeof(scalar_t));
 }
 
 void API_NS(scalar_decode_long)(
@@ -306,7 +306,7 @@
 ) {
     unsigned int i,j,k=0;
     for (i=0; i<SCALAR_LIMBS; i++) {
-        for (j=0; j<sizeof(cryptonite_decaf_word_t); j++,k++) {
+        for (j=0; j<sizeof(crypton_decaf_word_t); j++,k++) {
             ser[k] = s->limb[i] >> (8*j);
         }
     }
@@ -316,7 +316,7 @@
     scalar_t out,
     const scalar_t a,
     const scalar_t b,
-    cryptonite_decaf_bool_t pick_b
+    crypton_decaf_bool_t pick_b
 ) {
     constant_time_select(out,a,b,sizeof(scalar_t),bool_to_mask(pick_b),sizeof(out->limb[0]));
 }
@@ -325,13 +325,13 @@
     scalar_t out,
     const scalar_t a
 ) {
-    cryptonite_decaf_word_t mask = -(a->limb[0] & 1);
-    cryptonite_decaf_dword_t chain = 0;
+    crypton_decaf_word_t mask = -(a->limb[0] & 1);
+    crypton_decaf_dword_t chain = 0;
     unsigned int i;
     for (i=0; i<SCALAR_LIMBS; i++) {
         chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
         out->limb[i] = chain;
-        chain >>= CRYPTONITE_DECAF_WORD_BITS;
+        chain >>= CRYPTON_DECAF_WORD_BITS;
     }
     for (i=0; i<SCALAR_LIMBS-1; i++) {
         out->limb[i] = out->limb[i]>>1 | out->limb[i+1]<<(WBITS-1);
diff --git a/cbits/decaf/include/decaf.h b/cbits/decaf/include/decaf.h
--- a/cbits/decaf/include/decaf.h
+++ b/cbits/decaf/include/decaf.h
@@ -17,16 +17,16 @@
  * every string is the encoding of a valid group element.
  *
  * The formulas contain no data-dependent branches, timing or memory accesses,
- * except for cryptonite_decaf_XXX_base_double_scalarmul_non_secret.
+ * except for crypton_decaf_XXX_base_double_scalarmul_non_secret.
  *
  * @warning This file was automatically generated in Python.
  * Please do not edit it.
  */
 
-#ifndef __CRYPTONITE_DECAF_H__
-#define __CRYPTONITE_DECAF_H__ 1
+#ifndef __CRYPTON_DECAF_H__
+#define __CRYPTON_DECAF_H__ 1
 
 #include <decaf/point_255.h>
 #include <decaf/point_448.h>
 
-#endif /* __CRYPTONITE_DECAF_H__ */
+#endif /* __CRYPTON_DECAF_H__ */
diff --git a/cbits/decaf/include/decaf/common.h b/cbits/decaf/include/decaf/common.h
--- a/cbits/decaf/include/decaf/common.h
+++ b/cbits/decaf/include/decaf/common.h
@@ -9,8 +9,8 @@
  * @brief Common utility headers for Decaf library.
  */
 
-#ifndef __CRYPTONITE_DECAF_COMMON_H__
-#define __CRYPTONITE_DECAF_COMMON_H__ 1
+#ifndef __CRYPTON_DECAF_COMMON_H__
+#define __CRYPTON_DECAF_COMMON_H__ 1
 
 #include <stdint.h>
 #include <sys/types.h>
@@ -24,18 +24,18 @@
 #if defined(DOXYGEN) && !defined(__attribute__)
 #define __attribute__((x))
 #endif
-#define CRYPTONITE_DECAF_API_VIS __attribute__((visibility("default")))
-#define CRYPTONITE_DECAF_NOINLINE  __attribute__((noinline))
-#define CRYPTONITE_DECAF_WARN_UNUSED __attribute__((warn_unused_result))
-#define CRYPTONITE_DECAF_NONNULL __attribute__((nonnull))
-#define CRYPTONITE_DECAF_INLINE inline __attribute__((always_inline,unused))
+#define CRYPTON_DECAF_API_VIS __attribute__((visibility("default")))
+#define CRYPTON_DECAF_NOINLINE  __attribute__((noinline))
+#define CRYPTON_DECAF_WARN_UNUSED __attribute__((warn_unused_result))
+#define CRYPTON_DECAF_NONNULL __attribute__((nonnull))
+#define CRYPTON_DECAF_INLINE inline __attribute__((always_inline,unused))
 // Cribbed from libnotmuch
 #if defined (__clang_major__) && __clang_major__ >= 3 \
     || defined (__GNUC__) && __GNUC__ >= 5 \
     || defined (__GNUC__) && __GNUC__ == 4 && __GNUC_MINOR__ >= 5
-#define CRYPTONITE_DECAF_DEPRECATED(msg) __attribute__ ((deprecated(msg)))
+#define CRYPTON_DECAF_DEPRECATED(msg) __attribute__ ((deprecated(msg)))
 #else
-#define CRYPTONITE_DECAF_DEPRECATED(msg) __attribute__ ((deprecated))
+#define CRYPTON_DECAF_DEPRECATED(msg) __attribute__ ((deprecated))
 #endif
 /** @endcond */
 
@@ -46,71 +46,71 @@
  * platform to support dynamic linking, since even if you header was built
  * with eg arch_neon, you might end up linking a library built with arch_arm32.
  */
-#ifndef CRYPTONITE_DECAF_WORD_BITS
+#ifndef CRYPTON_DECAF_WORD_BITS
     #if (defined(__ILP64__) || defined(__amd64__) || defined(__x86_64__) || (((__UINT_FAST32_MAX__)>>30)>>30))
-        #define CRYPTONITE_DECAF_WORD_BITS 64 /**< The number of bits in a word */
+        #define CRYPTON_DECAF_WORD_BITS 64 /**< The number of bits in a word */
     #else
-        #define CRYPTONITE_DECAF_WORD_BITS 32 /**< The number of bits in a word */
+        #define CRYPTON_DECAF_WORD_BITS 32 /**< The number of bits in a word */
     #endif
 #endif
     
-#if CRYPTONITE_DECAF_WORD_BITS == 64
-typedef uint64_t cryptonite_decaf_word_t;      /**< Word size for internal computations */
-typedef int64_t cryptonite_decaf_sword_t;      /**< Signed word size for internal computations */
-typedef uint64_t cryptonite_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */
-typedef __uint128_t cryptonite_decaf_dword_t;  /**< Double-word size for internal computations */
-typedef __int128_t cryptonite_decaf_dsword_t;  /**< Signed double-word size for internal computations */
-#elif CRYPTONITE_DECAF_WORD_BITS == 32         /**< The number of bits in a word */
-typedef uint32_t cryptonite_decaf_word_t;      /**< Word size for internal computations */
-typedef int32_t cryptonite_decaf_sword_t;      /**< Signed word size for internal computations */
-typedef uint32_t cryptonite_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */
-typedef uint64_t cryptonite_decaf_dword_t;     /**< Double-word size for internal computations */
-typedef int64_t cryptonite_decaf_dsword_t;     /**< Signed double-word size for internal computations */
+#if CRYPTON_DECAF_WORD_BITS == 64
+typedef uint64_t crypton_decaf_word_t;      /**< Word size for internal computations */
+typedef int64_t crypton_decaf_sword_t;      /**< Signed word size for internal computations */
+typedef uint64_t crypton_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */
+typedef __uint128_t crypton_decaf_dword_t;  /**< Double-word size for internal computations */
+typedef __int128_t crypton_decaf_dsword_t;  /**< Signed double-word size for internal computations */
+#elif CRYPTON_DECAF_WORD_BITS == 32         /**< The number of bits in a word */
+typedef uint32_t crypton_decaf_word_t;      /**< Word size for internal computations */
+typedef int32_t crypton_decaf_sword_t;      /**< Signed word size for internal computations */
+typedef uint32_t crypton_decaf_bool_t;      /**< "Boolean" type, will be set to all-zero or all-one (i.e. -1u) */
+typedef uint64_t crypton_decaf_dword_t;     /**< Double-word size for internal computations */
+typedef int64_t crypton_decaf_dsword_t;     /**< Signed double-word size for internal computations */
 #else
-#error "Only supporting CRYPTONITE_DECAF_WORD_BITS = 32 or 64 for now"
+#error "Only supporting CRYPTON_DECAF_WORD_BITS = 32 or 64 for now"
 #endif
     
-/** CRYPTONITE_DECAF_TRUE = -1 so that CRYPTONITE_DECAF_TRUE & x = x */
-static const cryptonite_decaf_bool_t CRYPTONITE_DECAF_TRUE = -(cryptonite_decaf_bool_t)1;
+/** CRYPTON_DECAF_TRUE = -1 so that CRYPTON_DECAF_TRUE & x = x */
+static const crypton_decaf_bool_t CRYPTON_DECAF_TRUE = -(crypton_decaf_bool_t)1;
 
-/** CRYPTONITE_DECAF_FALSE = 0 so that CRYPTONITE_DECAF_FALSE & x = 0 */
-static const cryptonite_decaf_bool_t CRYPTONITE_DECAF_FALSE = 0;
+/** CRYPTON_DECAF_FALSE = 0 so that CRYPTON_DECAF_FALSE & x = 0 */
+static const crypton_decaf_bool_t CRYPTON_DECAF_FALSE = 0;
 
 /** Another boolean type used to indicate success or failure. */
 typedef enum {
-    CRYPTONITE_DECAF_SUCCESS = -1, /**< The operation succeeded. */
-    CRYPTONITE_DECAF_FAILURE = 0   /**< The operation failed. */
-} cryptonite_decaf_error_t;
+    CRYPTON_DECAF_SUCCESS = -1, /**< The operation succeeded. */
+    CRYPTON_DECAF_FAILURE = 0   /**< The operation failed. */
+} crypton_decaf_error_t;
 
 
 /** Return success if x is true */
-static CRYPTONITE_DECAF_INLINE cryptonite_decaf_error_t
-cryptonite_decaf_succeed_if(cryptonite_decaf_bool_t x) {
-    return (cryptonite_decaf_error_t)x;
+static CRYPTON_DECAF_INLINE crypton_decaf_error_t
+crypton_decaf_succeed_if(crypton_decaf_bool_t x) {
+    return (crypton_decaf_error_t)x;
 }
 
-/** Return CRYPTONITE_DECAF_TRUE iff x == CRYPTONITE_DECAF_SUCCESS */
-static CRYPTONITE_DECAF_INLINE cryptonite_decaf_bool_t
-cryptonite_decaf_successful(cryptonite_decaf_error_t e) {
-    cryptonite_decaf_dword_t w = ((cryptonite_decaf_word_t)e) ^  ((cryptonite_decaf_word_t)CRYPTONITE_DECAF_SUCCESS);
-    return (w-1)>>CRYPTONITE_DECAF_WORD_BITS;
+/** Return CRYPTON_DECAF_TRUE iff x == CRYPTON_DECAF_SUCCESS */
+static CRYPTON_DECAF_INLINE crypton_decaf_bool_t
+crypton_decaf_successful(crypton_decaf_error_t e) {
+    crypton_decaf_dword_t w = ((crypton_decaf_word_t)e) ^  ((crypton_decaf_word_t)CRYPTON_DECAF_SUCCESS);
+    return (w-1)>>CRYPTON_DECAF_WORD_BITS;
 }
     
 /** Overwrite data with zeros.  Uses memset_s if available. */
-void cryptonite_decaf_bzero (
+void crypton_decaf_bzero (
     void *data,
     size_t size
-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;
+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS;
 
-/** Compare two buffers, returning CRYPTONITE_DECAF_TRUE if they are equal. */
-cryptonite_decaf_bool_t cryptonite_decaf_memeq (
+/** Compare two buffers, returning CRYPTON_DECAF_TRUE if they are equal. */
+crypton_decaf_bool_t crypton_decaf_memeq (
     const void *data1,
     const void *data2,
     size_t size
-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_API_VIS;
+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_API_VIS;
     
 #ifdef __cplusplus
 } /* extern "C" */
 #endif
     
-#endif /* __CRYPTONITE_DECAF_COMMON_H__ */
+#endif /* __CRYPTON_DECAF_COMMON_H__ */
diff --git a/cbits/decaf/include/decaf/ed448.h b/cbits/decaf/include/decaf/ed448.h
--- a/cbits/decaf/include/decaf/ed448.h
+++ b/cbits/decaf/include/decaf/ed448.h
@@ -12,8 +12,8 @@
  * Please do not edit it.
  */
 
-#ifndef __CRYPTONITE_DECAF_ED448_H__
-#define __CRYPTONITE_DECAF_ED448_H__ 1
+#ifndef __CRYPTON_DECAF_ED448_H__
+#define __CRYPTON_DECAF_ED448_H__ 1
 
 #include <decaf/point_448.h>
 #include <decaf/shake.h>
@@ -24,22 +24,22 @@
 #endif
 
 /** Number of bytes in an EdDSA public key. */
-#define CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES 57
+#define CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES 57
 
 /** Number of bytes in an EdDSA private key. */
-#define CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES
+#define CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES
 
 /** Number of bytes in an EdDSA private key. */
-#define CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES (CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES + CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES)
+#define CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES (CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES + CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES)
 
 /** Does EdDSA support non-contextual signatures? */
-#define CRYPTONITE_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS 0
+#define CRYPTON_DECAF_EDDSA_448_SUPPORTS_CONTEXTLESS_SIGS 0
 
 /** Prehash context renaming macros. */
-#define cryptonite_decaf_ed448_prehash_ctx_s   cryptonite_decaf_shake256_ctx_s
-#define cryptonite_decaf_ed448_prehash_ctx_t   cryptonite_decaf_shake256_ctx_t
-#define cryptonite_decaf_ed448_prehash_update  cryptonite_decaf_shake256_update
-#define cryptonite_decaf_ed448_prehash_destroy cryptonite_decaf_shake256_destroy
+#define crypton_decaf_ed448_prehash_ctx_s   crypton_decaf_shake256_ctx_s
+#define crypton_decaf_ed448_prehash_ctx_t   crypton_decaf_shake256_ctx_t
+#define crypton_decaf_ed448_prehash_update  crypton_decaf_shake256_update
+#define crypton_decaf_ed448_prehash_destroy crypton_decaf_shake256_destroy
 
 /**
  * @brief EdDSA key generation.  This function uses a different (non-Decaf)
@@ -48,10 +48,10 @@
  * @param [out] pubkey The public key.
  * @param [in] privkey The private key.
  */    
-void cryptonite_decaf_ed448_derive_public_key (
-    uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_ed448_derive_public_key (
+    uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA signing.
@@ -70,16 +70,16 @@
  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives
  * you no seat belt.
  */  
-void cryptonite_decaf_ed448_sign (
-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
+void crypton_decaf_ed448_sign (
+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
     const uint8_t *message,
     size_t message_len,
     uint8_t prehashed,
     const uint8_t *context,
     uint8_t context_len
-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2,3))) CRYPTONITE_DECAF_NOINLINE;
+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2,3))) CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA signing with prehash.
@@ -96,23 +96,23 @@
  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives
  * you no seat belt.
  */  
-void cryptonite_decaf_ed448_sign_prehash (
-    uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t privkey[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const cryptonite_decaf_ed448_prehash_ctx_t hash,
+void crypton_decaf_ed448_sign_prehash (
+    uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t privkey[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const crypton_decaf_ed448_prehash_ctx_t hash,
     const uint8_t *context,
     uint8_t context_len
-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2,3,4))) CRYPTONITE_DECAF_NOINLINE;
+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2,3,4))) CRYPTON_DECAF_NOINLINE;
     
 /**
  * @brief Prehash initialization, with contexts if supported.
  *
  * @param [out] hash The hash object to be initialized.
  */
-void cryptonite_decaf_ed448_prehash_init (
-    cryptonite_decaf_ed448_prehash_ctx_t hash
-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1))) CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_ed448_prehash_init (
+    crypton_decaf_ed448_prehash_ctx_t hash
+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1))) CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA signature verification.
@@ -132,15 +132,15 @@
  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives
  * you no seat belt.
  */
-cryptonite_decaf_error_t cryptonite_decaf_ed448_verify (
-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
+crypton_decaf_error_t crypton_decaf_ed448_verify (
+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
     const uint8_t *message,
     size_t message_len,
     uint8_t prehashed,
     const uint8_t *context,
     uint8_t context_len
-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTONITE_DECAF_NOINLINE;
+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA signature verification.
@@ -158,13 +158,13 @@
  * safe.  The C++ wrapper is designed to make it harder to screw this up, but this C code gives
  * you no seat belt.
  */
-cryptonite_decaf_error_t cryptonite_decaf_ed448_verify_prehash (
-    const uint8_t signature[CRYPTONITE_DECAF_EDDSA_448_SIGNATURE_BYTES],
-    const uint8_t pubkey[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const cryptonite_decaf_ed448_prehash_ctx_t hash,
+crypton_decaf_error_t crypton_decaf_ed448_verify_prehash (
+    const uint8_t signature[CRYPTON_DECAF_EDDSA_448_SIGNATURE_BYTES],
+    const uint8_t pubkey[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const crypton_decaf_ed448_prehash_ctx_t hash,
     const uint8_t *context,
     uint8_t context_len
-) CRYPTONITE_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTONITE_DECAF_NOINLINE;
+) CRYPTON_DECAF_API_VIS __attribute__((nonnull(1,2))) CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA point encoding.  Used internally, exposed externally.
@@ -173,10 +173,10 @@
  * @param [out] enc The encoded point.
  * @param [in] p The point.
  */       
-void cryptonite_decaf_448_point_mul_by_cofactor_and_encode_like_eddsa (
-    uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES],
-    const cryptonite_decaf_448_point_t p
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_mul_by_cofactor_and_encode_like_eddsa (
+    uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES],
+    const crypton_decaf_448_point_t p
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA point decoding.  Remember that while points on the
@@ -186,10 +186,10 @@
  * @param [out] enc The encoded point.
  * @param [in] p The point.
  */       
-cryptonite_decaf_error_t cryptonite_decaf_448_point_decode_like_eddsa_and_ignore_cofactor (
-    cryptonite_decaf_448_point_t p,
-    const uint8_t enc[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_error_t crypton_decaf_448_point_decode_like_eddsa_and_ignore_cofactor (
+    crypton_decaf_448_point_t p,
+    const uint8_t enc[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA to ECDH public key conversion
@@ -202,10 +202,10 @@
  * @param[out] x The ECDH public key as in RFC7748(point on Montgomery curve)
  * @param[in] ed The EdDSA public key(point on Edwards curve)
  */
-void cryptonite_decaf_ed448_convert_public_key_to_x448 (
-    uint8_t x[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],
-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PUBLIC_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_ed448_convert_public_key_to_x448 (
+    uint8_t x[CRYPTON_DECAF_X448_PUBLIC_BYTES],
+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PUBLIC_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief EdDSA to ECDH private key conversion
@@ -215,13 +215,13 @@
  * @param[out] x The ECDH private key as in RFC7748
  * @param[in] ed The EdDSA private key
  */
-void cryptonite_decaf_ed448_convert_private_key_to_x448 (
-    uint8_t x[CRYPTONITE_DECAF_X448_PRIVATE_BYTES],
-    const uint8_t ed[CRYPTONITE_DECAF_EDDSA_448_PRIVATE_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_ed448_convert_private_key_to_x448 (
+    uint8_t x[CRYPTON_DECAF_X448_PRIVATE_BYTES],
+    const uint8_t ed[CRYPTON_DECAF_EDDSA_448_PRIVATE_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 #ifdef __cplusplus
 } /* extern "C" */
 #endif
 
-#endif /* __CRYPTONITE_DECAF_ED448_H__ */
+#endif /* __CRYPTON_DECAF_ED448_H__ */
diff --git a/cbits/decaf/include/decaf/point_448.h b/cbits/decaf/include/decaf/point_448.h
--- a/cbits/decaf/include/decaf/point_448.h
+++ b/cbits/decaf/include/decaf/point_448.h
@@ -12,8 +12,8 @@
  * Please do not edit it.
  */
 
-#ifndef __CRYPTONITE_DECAF_POINT_448_H__
-#define __CRYPTONITE_DECAF_POINT_448_H__ 1
+#ifndef __CRYPTON_DECAF_POINT_448_H__
+#define __CRYPTON_DECAF_POINT_448_H__ 1
 
 #include <decaf/common.h>
 
@@ -22,79 +22,79 @@
 #endif
 
 /** @cond internal */
-#define CRYPTONITE_DECAF_448_SCALAR_LIMBS ((446-1)/CRYPTONITE_DECAF_WORD_BITS+1)
+#define CRYPTON_DECAF_448_SCALAR_LIMBS ((446-1)/CRYPTON_DECAF_WORD_BITS+1)
 /** @endcond */
 
 /** The number of bits in a scalar */
-#define CRYPTONITE_DECAF_448_SCALAR_BITS 446
+#define CRYPTON_DECAF_448_SCALAR_BITS 446
 
 /** @cond internal */
-#ifndef __CRYPTONITE_DECAF_448_GF_DEFINED__
-#define __CRYPTONITE_DECAF_448_GF_DEFINED__ 1
+#ifndef __CRYPTON_DECAF_448_GF_DEFINED__
+#define __CRYPTON_DECAF_448_GF_DEFINED__ 1
 /** @brief Galois field element internal structure */
-typedef struct cryptonite_gf_448_s {
-    cryptonite_decaf_word_t limb[512/CRYPTONITE_DECAF_WORD_BITS];
-} __attribute__((aligned(16))) cryptonite_gf_448_s, cryptonite_gf_448_t[1];
-#endif /* __CRYPTONITE_DECAF_448_GF_DEFINED__ */
+typedef struct crypton_gf_448_s {
+    crypton_decaf_word_t limb[512/CRYPTON_DECAF_WORD_BITS];
+} __attribute__((aligned(16))) crypton_gf_448_s, crypton_gf_448_t[1];
+#endif /* __CRYPTON_DECAF_448_GF_DEFINED__ */
 /** @endcond */
 
 /** Number of bytes in a serialized point. */
-#define CRYPTONITE_DECAF_448_SER_BYTES 56
+#define CRYPTON_DECAF_448_SER_BYTES 56
 
 /** Number of bytes in an elligated point.  For now set the same as SER_BYTES
  * but could be different for other curves.
  */
-#define CRYPTONITE_DECAF_448_HASH_BYTES 56
+#define CRYPTON_DECAF_448_HASH_BYTES 56
 
 /** Number of bytes in a serialized scalar. */
-#define CRYPTONITE_DECAF_448_SCALAR_BYTES 56
+#define CRYPTON_DECAF_448_SCALAR_BYTES 56
 
 /** Number of bits in the "which" field of an elligator inverse */
-#define CRYPTONITE_DECAF_448_INVERT_ELLIGATOR_WHICH_BITS 3
+#define CRYPTON_DECAF_448_INVERT_ELLIGATOR_WHICH_BITS 3
 
 /** Number of bytes in an x448 public key */
-#define CRYPTONITE_DECAF_X448_PUBLIC_BYTES 56
+#define CRYPTON_DECAF_X448_PUBLIC_BYTES 56
 
 /** Number of bytes in an x448 private key */
-#define CRYPTONITE_DECAF_X448_PRIVATE_BYTES 56
+#define CRYPTON_DECAF_X448_PRIVATE_BYTES 56
 
 /** Twisted Edwards extended homogeneous coordinates */
-typedef struct cryptonite_decaf_448_point_s {
+typedef struct crypton_decaf_448_point_s {
     /** @cond internal */
-    cryptonite_gf_448_t x,y,z,t;
+    crypton_gf_448_t x,y,z,t;
     /** @endcond */
-} cryptonite_decaf_448_point_t[1];
+} crypton_decaf_448_point_t[1];
 
 /** Precomputed table based on a point.  Can be trivial implementation. */
-struct cryptonite_decaf_448_precomputed_s;
+struct crypton_decaf_448_precomputed_s;
 
 /** Precomputed table based on a point.  Can be trivial implementation. */
-typedef struct cryptonite_decaf_448_precomputed_s cryptonite_decaf_448_precomputed_s; 
+typedef struct crypton_decaf_448_precomputed_s crypton_decaf_448_precomputed_s; 
 
 /** Size and alignment of precomputed point tables. */
-extern const size_t cryptonite_decaf_448_sizeof_precomputed_s CRYPTONITE_DECAF_API_VIS, cryptonite_decaf_448_alignof_precomputed_s CRYPTONITE_DECAF_API_VIS;
+extern const size_t crypton_decaf_448_sizeof_precomputed_s CRYPTON_DECAF_API_VIS, crypton_decaf_448_alignof_precomputed_s CRYPTON_DECAF_API_VIS;
 
 /** Scalar is stored packed, because we don't need the speed. */
-typedef struct cryptonite_decaf_448_scalar_s {
+typedef struct crypton_decaf_448_scalar_s {
     /** @cond internal */
-    cryptonite_decaf_word_t limb[CRYPTONITE_DECAF_448_SCALAR_LIMBS];
+    crypton_decaf_word_t limb[CRYPTON_DECAF_448_SCALAR_LIMBS];
     /** @endcond */
-} cryptonite_decaf_448_scalar_t[1];
+} crypton_decaf_448_scalar_t[1];
 
 /** A scalar equal to 1. */
-extern const cryptonite_decaf_448_scalar_t cryptonite_decaf_448_scalar_one CRYPTONITE_DECAF_API_VIS;
+extern const crypton_decaf_448_scalar_t crypton_decaf_448_scalar_one CRYPTON_DECAF_API_VIS;
 
 /** A scalar equal to 0. */
-extern const cryptonite_decaf_448_scalar_t cryptonite_decaf_448_scalar_zero CRYPTONITE_DECAF_API_VIS;
+extern const crypton_decaf_448_scalar_t crypton_decaf_448_scalar_zero CRYPTON_DECAF_API_VIS;
 
 /** The identity point on the curve. */
-extern const cryptonite_decaf_448_point_t cryptonite_decaf_448_point_identity CRYPTONITE_DECAF_API_VIS;
+extern const crypton_decaf_448_point_t crypton_decaf_448_point_identity CRYPTON_DECAF_API_VIS;
 
 /** An arbitrarily chosen base point on the curve. */
-extern const cryptonite_decaf_448_point_t cryptonite_decaf_448_point_base CRYPTONITE_DECAF_API_VIS;
+extern const crypton_decaf_448_point_t crypton_decaf_448_point_base CRYPTON_DECAF_API_VIS;
 
 /** Precomputed table for the base point on the curve. */
-extern const struct cryptonite_decaf_448_precomputed_s *cryptonite_decaf_448_precomputed_base CRYPTONITE_DECAF_API_VIS;
+extern const struct crypton_decaf_448_precomputed_s *crypton_decaf_448_precomputed_base CRYPTON_DECAF_API_VIS;
 
 /**
  * @brief Read a scalar from wire format or from bytes.
@@ -102,14 +102,14 @@
  * @param [in] ser Serialized form of a scalar.
  * @param [out] out Deserialized form.
  *
- * @retval CRYPTONITE_DECAF_SUCCESS The scalar was correctly encoded.
- * @retval CRYPTONITE_DECAF_FAILURE The scalar was greater than the modulus,
+ * @retval CRYPTON_DECAF_SUCCESS The scalar was correctly encoded.
+ * @retval CRYPTON_DECAF_FAILURE The scalar was greater than the modulus,
  * and has been reduced modulo that modulus.
  */
-cryptonite_decaf_error_t cryptonite_decaf_448_scalar_decode (
-    cryptonite_decaf_448_scalar_t out,
-    const unsigned char ser[CRYPTONITE_DECAF_448_SCALAR_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_error_t crypton_decaf_448_scalar_decode (
+    crypton_decaf_448_scalar_t out,
+    const unsigned char ser[CRYPTON_DECAF_448_SCALAR_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Read a scalar from wire format or from bytes.  Reduces mod
@@ -119,11 +119,11 @@
  * @param [in] ser_len Length of serialized form.
  * @param [out] out Deserialized form.
  */
-void cryptonite_decaf_448_scalar_decode_long (
-    cryptonite_decaf_448_scalar_t out,
+void crypton_decaf_448_scalar_decode_long (
+    crypton_decaf_448_scalar_t out,
     const unsigned char *ser,
     size_t ser_len
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
     
 /**
  * @brief Serialize a scalar to wire format.
@@ -131,10 +131,10 @@
  * @param [out] ser Serialized form of a scalar.
  * @param [in] s Deserialized scalar.
  */
-void cryptonite_decaf_448_scalar_encode (
-    unsigned char ser[CRYPTONITE_DECAF_448_SCALAR_BYTES],
-    const cryptonite_decaf_448_scalar_t s
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_scalar_encode (
+    unsigned char ser[CRYPTON_DECAF_448_SCALAR_BYTES],
+    const crypton_decaf_448_scalar_t s
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_NOINLINE;
         
 /**
  * @brief Add two scalars.  The scalars may use the same memory.
@@ -142,23 +142,23 @@
  * @param [in] b Another scalar.
  * @param [out] out a+b.
  */
-void cryptonite_decaf_448_scalar_add (
-    cryptonite_decaf_448_scalar_t out,
-    const cryptonite_decaf_448_scalar_t a,
-    const cryptonite_decaf_448_scalar_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_scalar_add (
+    crypton_decaf_448_scalar_t out,
+    const crypton_decaf_448_scalar_t a,
+    const crypton_decaf_448_scalar_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Compare two scalars.
  * @param [in] a One scalar.
  * @param [in] b Another scalar.
- * @retval CRYPTONITE_DECAF_TRUE The scalars are equal.
- * @retval CRYPTONITE_DECAF_FALSE The scalars are not equal.
+ * @retval CRYPTON_DECAF_TRUE The scalars are equal.
+ * @retval CRYPTON_DECAF_FALSE The scalars are not equal.
  */    
-cryptonite_decaf_bool_t cryptonite_decaf_448_scalar_eq (
-    const cryptonite_decaf_448_scalar_t a,
-    const cryptonite_decaf_448_scalar_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_bool_t crypton_decaf_448_scalar_eq (
+    const crypton_decaf_448_scalar_t a,
+    const crypton_decaf_448_scalar_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Subtract two scalars.  The scalars may use the same memory.
@@ -166,11 +166,11 @@
  * @param [in] b Another scalar.
  * @param [out] out a-b.
  */  
-void cryptonite_decaf_448_scalar_sub (
-    cryptonite_decaf_448_scalar_t out,
-    const cryptonite_decaf_448_scalar_t a,
-    const cryptonite_decaf_448_scalar_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_scalar_sub (
+    crypton_decaf_448_scalar_t out,
+    const crypton_decaf_448_scalar_t a,
+    const crypton_decaf_448_scalar_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Multiply two scalars.  The scalars may use the same memory.
@@ -178,32 +178,32 @@
  * @param [in] b Another scalar.
  * @param [out] out a*b.
  */  
-void cryptonite_decaf_448_scalar_mul (
-    cryptonite_decaf_448_scalar_t out,
-    const cryptonite_decaf_448_scalar_t a,
-    const cryptonite_decaf_448_scalar_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_scalar_mul (
+    crypton_decaf_448_scalar_t out,
+    const crypton_decaf_448_scalar_t a,
+    const crypton_decaf_448_scalar_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
         
 /**
 * @brief Halve a scalar.  The scalars may use the same memory.
 * @param [in] a A scalar.
 * @param [out] out a/2.
 */
-void cryptonite_decaf_448_scalar_halve (
-   cryptonite_decaf_448_scalar_t out,
-   const cryptonite_decaf_448_scalar_t a
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_scalar_halve (
+   crypton_decaf_448_scalar_t out,
+   const crypton_decaf_448_scalar_t a
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Invert a scalar.  When passed zero, return 0.  The input and output may alias.
  * @param [in] a A scalar.
  * @param [out] out 1/a.
- * @return CRYPTONITE_DECAF_SUCCESS The input is nonzero.
+ * @return CRYPTON_DECAF_SUCCESS The input is nonzero.
  */  
-cryptonite_decaf_error_t cryptonite_decaf_448_scalar_invert (
-    cryptonite_decaf_448_scalar_t out,
-    const cryptonite_decaf_448_scalar_t a
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_error_t crypton_decaf_448_scalar_invert (
+    crypton_decaf_448_scalar_t out,
+    const crypton_decaf_448_scalar_t a
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Copy a scalar.  The scalars may use the same memory, in which
@@ -211,9 +211,9 @@
  * @param [in] a A scalar.
  * @param [out] out Will become a copy of a.
  */
-static inline void CRYPTONITE_DECAF_NONNULL cryptonite_decaf_448_scalar_copy (
-    cryptonite_decaf_448_scalar_t out,
-    const cryptonite_decaf_448_scalar_t a
+static inline void CRYPTON_DECAF_NONNULL crypton_decaf_448_scalar_copy (
+    crypton_decaf_448_scalar_t out,
+    const crypton_decaf_448_scalar_t a
 ) {
     *out = *a;
 }
@@ -223,10 +223,10 @@
  * @param [in] a An integer.
  * @param [out] out Will become equal to a.
  */  
-void cryptonite_decaf_448_scalar_set_unsigned (
-    cryptonite_decaf_448_scalar_t out,
+void crypton_decaf_448_scalar_set_unsigned (
+    crypton_decaf_448_scalar_t out,
     uint64_t a
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;
 
 /**
  * @brief Encode a point as a sequence of bytes.
@@ -234,10 +234,10 @@
  * @param [out] ser The byte representation of the point.
  * @param [in] pt The point to encode.
  */
-void cryptonite_decaf_448_point_encode (
-    uint8_t ser[CRYPTONITE_DECAF_448_SER_BYTES],
-    const cryptonite_decaf_448_point_t pt
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_encode (
+    uint8_t ser[CRYPTON_DECAF_448_SER_BYTES],
+    const crypton_decaf_448_point_t pt
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Decode a point from a sequence of bytes.
@@ -248,16 +248,16 @@
  *
  * @param [out] pt The decoded point.
  * @param [in] ser The serialized version of the point.
- * @param [in] allow_identity CRYPTONITE_DECAF_TRUE if the identity is a legal input.
- * @retval CRYPTONITE_DECAF_SUCCESS The decoding succeeded.
- * @retval CRYPTONITE_DECAF_FAILURE The decoding didn't succeed, because
+ * @param [in] allow_identity CRYPTON_DECAF_TRUE if the identity is a legal input.
+ * @retval CRYPTON_DECAF_SUCCESS The decoding succeeded.
+ * @retval CRYPTON_DECAF_FAILURE The decoding didn't succeed, because
  * ser does not represent a point.
  */
-cryptonite_decaf_error_t cryptonite_decaf_448_point_decode (
-    cryptonite_decaf_448_point_t pt,
-    const uint8_t ser[CRYPTONITE_DECAF_448_SER_BYTES],
-    cryptonite_decaf_bool_t allow_identity
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_error_t crypton_decaf_448_point_decode (
+    crypton_decaf_448_point_t pt,
+    const uint8_t ser[CRYPTON_DECAF_448_SER_BYTES],
+    crypton_decaf_bool_t allow_identity
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Copy a point.  The input and output may alias,
@@ -266,26 +266,26 @@
  * @param [out] a A copy of the point.
  * @param [in] b Any point.
  */
-static inline void CRYPTONITE_DECAF_NONNULL cryptonite_decaf_448_point_copy (
-    cryptonite_decaf_448_point_t a,
-    const cryptonite_decaf_448_point_t b
+static inline void CRYPTON_DECAF_NONNULL crypton_decaf_448_point_copy (
+    crypton_decaf_448_point_t a,
+    const crypton_decaf_448_point_t b
 ) {
     *a=*b;
 }
 
 /**
  * @brief Test whether two points are equal.  If yes, return
- * CRYPTONITE_DECAF_TRUE, else return CRYPTONITE_DECAF_FALSE.
+ * CRYPTON_DECAF_TRUE, else return CRYPTON_DECAF_FALSE.
  *
  * @param [in] a A point.
  * @param [in] b Another point.
- * @retval CRYPTONITE_DECAF_TRUE The points are equal.
- * @retval CRYPTONITE_DECAF_FALSE The points are not equal.
+ * @retval CRYPTON_DECAF_TRUE The points are equal.
+ * @retval CRYPTON_DECAF_FALSE The points are not equal.
  */
-cryptonite_decaf_bool_t cryptonite_decaf_448_point_eq (
-    const cryptonite_decaf_448_point_t a,
-    const cryptonite_decaf_448_point_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_bool_t crypton_decaf_448_point_eq (
+    const crypton_decaf_448_point_t a,
+    const crypton_decaf_448_point_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Add two points to produce a third point.  The
@@ -296,23 +296,23 @@
  * @param [in] a An addend.
  * @param [in] b An addend.
  */
-void cryptonite_decaf_448_point_add (
-    cryptonite_decaf_448_point_t sum,
-    const cryptonite_decaf_448_point_t a,
-    const cryptonite_decaf_448_point_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;
+void crypton_decaf_448_point_add (
+    crypton_decaf_448_point_t sum,
+    const crypton_decaf_448_point_t a,
+    const crypton_decaf_448_point_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;
 
 /**
  * @brief Double a point.  Equivalent to
- * cryptonite_decaf_448_point_add(two_a,a,a), but potentially faster.
+ * crypton_decaf_448_point_add(two_a,a,a), but potentially faster.
  *
  * @param [out] two_a The sum a+a.
  * @param [in] a A point.
  */
-void cryptonite_decaf_448_point_double (
-    cryptonite_decaf_448_point_t two_a,
-    const cryptonite_decaf_448_point_t a
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;
+void crypton_decaf_448_point_double (
+    crypton_decaf_448_point_t two_a,
+    const crypton_decaf_448_point_t a
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;
 
 /**
  * @brief Subtract two points to produce a third point.  The
@@ -323,11 +323,11 @@
  * @param [in] a The minuend.
  * @param [in] b The subtrahend.
  */
-void cryptonite_decaf_448_point_sub (
-    cryptonite_decaf_448_point_t diff,
-    const cryptonite_decaf_448_point_t a,
-    const cryptonite_decaf_448_point_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;
+void crypton_decaf_448_point_sub (
+    crypton_decaf_448_point_t diff,
+    const crypton_decaf_448_point_t a,
+    const crypton_decaf_448_point_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;
     
 /**
  * @brief Negate a point to produce another point.  The input
@@ -336,10 +336,10 @@
  * @param [out] nega The negated input point
  * @param [in] a The input point.
  */
-void cryptonite_decaf_448_point_negate (
-   cryptonite_decaf_448_point_t nega,
-   const cryptonite_decaf_448_point_t a
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL;
+void crypton_decaf_448_point_negate (
+   crypton_decaf_448_point_t nega,
+   const crypton_decaf_448_point_t a
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL;
 
 /**
  * @brief Multiply a base point by a scalar: scaled = scalar*base.
@@ -348,11 +348,11 @@
  * @param [in] base The point to be scaled.
  * @param [in] scalar The scalar to multiply by.
  */
-void cryptonite_decaf_448_point_scalarmul (
-    cryptonite_decaf_448_point_t scaled,
-    const cryptonite_decaf_448_point_t base,
-    const cryptonite_decaf_448_scalar_t scalar
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_scalarmul (
+    crypton_decaf_448_point_t scaled,
+    const crypton_decaf_448_point_t base,
+    const crypton_decaf_448_scalar_t scalar
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Multiply a base point by a scalar: scaled = scalar*base.
@@ -367,17 +367,17 @@
  * @param [in] allow_identity Allow the input to be the identity.
  * @param [in] short_circuit Allow a fast return if the input is illegal.
  *
- * @retval CRYPTONITE_DECAF_SUCCESS The scalarmul succeeded.
- * @retval CRYPTONITE_DECAF_FAILURE The scalarmul didn't succeed, because
+ * @retval CRYPTON_DECAF_SUCCESS The scalarmul succeeded.
+ * @retval CRYPTON_DECAF_FAILURE The scalarmul didn't succeed, because
  * base does not represent a point.
  */
-cryptonite_decaf_error_t cryptonite_decaf_448_direct_scalarmul (
-    uint8_t scaled[CRYPTONITE_DECAF_448_SER_BYTES],
-    const uint8_t base[CRYPTONITE_DECAF_448_SER_BYTES],
-    const cryptonite_decaf_448_scalar_t scalar,
-    cryptonite_decaf_bool_t allow_identity,
-    cryptonite_decaf_bool_t short_circuit
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_error_t crypton_decaf_448_direct_scalarmul (
+    uint8_t scaled[CRYPTON_DECAF_448_SER_BYTES],
+    const uint8_t base[CRYPTON_DECAF_448_SER_BYTES],
+    const crypton_decaf_448_scalar_t scalar,
+    crypton_decaf_bool_t allow_identity,
+    crypton_decaf_bool_t short_circuit
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief RFC 7748 Diffie-Hellman scalarmul.  This function uses a different
@@ -387,50 +387,50 @@
  * @param [in] base The point to be scaled.
  * @param [in] scalar The scalar to multiply by.
  *
- * @retval CRYPTONITE_DECAF_SUCCESS The scalarmul succeeded.
- * @retval CRYPTONITE_DECAF_FAILURE The scalarmul didn't succeed, because the base
+ * @retval CRYPTON_DECAF_SUCCESS The scalarmul succeeded.
+ * @retval CRYPTON_DECAF_FAILURE The scalarmul didn't succeed, because the base
  * point is in a small subgroup.
  */
-cryptonite_decaf_error_t cryptonite_decaf_x448 (
-    uint8_t out[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],
-    const uint8_t base[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],
-    const uint8_t scalar[CRYPTONITE_DECAF_X448_PRIVATE_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_error_t crypton_decaf_x448 (
+    uint8_t out[CRYPTON_DECAF_X448_PUBLIC_BYTES],
+    const uint8_t base[CRYPTON_DECAF_X448_PUBLIC_BYTES],
+    const uint8_t scalar[CRYPTON_DECAF_X448_PRIVATE_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NOINLINE;
 
 /** The base point for X448 Diffie-Hellman */
-extern const uint8_t cryptonite_decaf_x448_base_point[CRYPTONITE_DECAF_X448_PUBLIC_BYTES] CRYPTONITE_DECAF_API_VIS;
+extern const uint8_t crypton_decaf_x448_base_point[CRYPTON_DECAF_X448_PUBLIC_BYTES] CRYPTON_DECAF_API_VIS;
 
 /**
  * @brief RFC 7748 Diffie-Hellman base point scalarmul.  This function uses
  * a different (non-Decaf) encoding.
  *
- * @deprecated Renamed to cryptonite_decaf_x448_derive_public_key.
+ * @deprecated Renamed to crypton_decaf_x448_derive_public_key.
  * I have no particular timeline for removing this name.
  *
  * @param [out] scaled The scaled point base*scalar
  * @param [in] scalar The scalar to multiply by.
  */
-void cryptonite_decaf_x448_generate_key (
-    uint8_t out[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],
-    const uint8_t scalar[CRYPTONITE_DECAF_X448_PRIVATE_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_DEPRECATED("Renamed to cryptonite_decaf_x448_derive_public_key");
+void crypton_decaf_x448_generate_key (
+    uint8_t out[CRYPTON_DECAF_X448_PUBLIC_BYTES],
+    const uint8_t scalar[CRYPTON_DECAF_X448_PRIVATE_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_DEPRECATED("Renamed to crypton_decaf_x448_derive_public_key");
     
 /**
  * @brief RFC 7748 Diffie-Hellman base point scalarmul.  This function uses
  * a different (non-Decaf) encoding.
  *
- * Does exactly the same thing as cryptonite_decaf_x448_generate_key,
+ * Does exactly the same thing as crypton_decaf_x448_generate_key,
  * but has a better name.
  *
  * @param [out] scaled The scaled point base*scalar
  * @param [in] scalar The scalar to multiply by.
  */
-void cryptonite_decaf_x448_derive_public_key (
-    uint8_t out[CRYPTONITE_DECAF_X448_PUBLIC_BYTES],
-    const uint8_t scalar[CRYPTONITE_DECAF_X448_PRIVATE_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_x448_derive_public_key (
+    uint8_t out[CRYPTON_DECAF_X448_PUBLIC_BYTES],
+    const uint8_t scalar[CRYPTON_DECAF_X448_PRIVATE_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
-/* FUTURE: uint8_t cryptonite_decaf_448_encode_like_curve448) */
+/* FUTURE: uint8_t crypton_decaf_448_encode_like_curve448) */
 
 /**
  * @brief Precompute a table for fast scalar multiplication.
@@ -441,33 +441,33 @@
  * @param [out] a A precomputed table of multiples of the point.
  * @param [in] b Any point.
  */
-void cryptonite_decaf_448_precompute (
-    cryptonite_decaf_448_precomputed_s *a,
-    const cryptonite_decaf_448_point_t b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_precompute (
+    crypton_decaf_448_precomputed_s *a,
+    const crypton_decaf_448_point_t b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Multiply a precomputed base point by a scalar:
  * scaled = scalar*base.
  * Some implementations do not include precomputed points; for
  * those implementations, this function is the same as
- * cryptonite_decaf_448_point_scalarmul
+ * crypton_decaf_448_point_scalarmul
  *
  * @param [out] scaled The scaled point base*scalar
  * @param [in] base The point to be scaled.
  * @param [in] scalar The scalar to multiply by.
  */
-void cryptonite_decaf_448_precomputed_scalarmul (
-    cryptonite_decaf_448_point_t scaled,
-    const cryptonite_decaf_448_precomputed_s *base,
-    const cryptonite_decaf_448_scalar_t scalar
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_precomputed_scalarmul (
+    crypton_decaf_448_point_t scaled,
+    const crypton_decaf_448_precomputed_s *base,
+    const crypton_decaf_448_scalar_t scalar
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Multiply two base points by two scalars:
  * scaled = scalar1*base1 + scalar2*base2.
  *
- * Equivalent to two calls to cryptonite_decaf_448_point_scalarmul, but may be
+ * Equivalent to two calls to crypton_decaf_448_point_scalarmul, but may be
  * faster.
  *
  * @param [out] combo The linear combination scalar1*base1 + scalar2*base2.
@@ -476,13 +476,13 @@
  * @param [in] base2 A second point to be scaled.
  * @param [in] scalar2 A second scalar to multiply by.
  */
-void cryptonite_decaf_448_point_double_scalarmul (
-    cryptonite_decaf_448_point_t combo,
-    const cryptonite_decaf_448_point_t base1,
-    const cryptonite_decaf_448_scalar_t scalar1,
-    const cryptonite_decaf_448_point_t base2,
-    const cryptonite_decaf_448_scalar_t scalar2
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_double_scalarmul (
+    crypton_decaf_448_point_t combo,
+    const crypton_decaf_448_point_t base1,
+    const crypton_decaf_448_scalar_t scalar1,
+    const crypton_decaf_448_point_t base2,
+    const crypton_decaf_448_scalar_t scalar2
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
     
 /**
  * Multiply one base point by two scalars:
@@ -490,7 +490,7 @@
  * a1 = scalar1 * base
  * a2 = scalar2 * base
  *
- * Equivalent to two calls to cryptonite_decaf_448_point_scalarmul, but may be
+ * Equivalent to two calls to crypton_decaf_448_point_scalarmul, but may be
  * faster.
  *
  * @param [out] a1 The first multiple.  It may be the same as the input point.
@@ -499,19 +499,19 @@
  * @param [in] scalar1 A first scalar to multiply by.
  * @param [in] scalar2 A second scalar to multiply by.
  */
-void cryptonite_decaf_448_point_dual_scalarmul (
-    cryptonite_decaf_448_point_t a1,
-    cryptonite_decaf_448_point_t a2,
-    const cryptonite_decaf_448_point_t base1,
-    const cryptonite_decaf_448_scalar_t scalar1,
-    const cryptonite_decaf_448_scalar_t scalar2
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_dual_scalarmul (
+    crypton_decaf_448_point_t a1,
+    crypton_decaf_448_point_t a2,
+    const crypton_decaf_448_point_t base1,
+    const crypton_decaf_448_scalar_t scalar1,
+    const crypton_decaf_448_scalar_t scalar2
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Multiply two base points by two scalars:
- * scaled = scalar1*cryptonite_decaf_448_point_base + scalar2*base2.
+ * scaled = scalar1*crypton_decaf_448_point_base + scalar2*base2.
  *
- * Otherwise equivalent to cryptonite_decaf_448_point_double_scalarmul, but may be
+ * Otherwise equivalent to crypton_decaf_448_point_double_scalarmul, but may be
  * faster at the expense of being variable time.
  *
  * @param [out] combo The linear combination scalar1*base + scalar2*base2.
@@ -522,12 +522,12 @@
  * @warning: This function takes variable time, and may leak the scalars
  * used.  It is designed for signature verification.
  */
-void cryptonite_decaf_448_base_double_scalarmul_non_secret (
-    cryptonite_decaf_448_point_t combo,
-    const cryptonite_decaf_448_scalar_t scalar1,
-    const cryptonite_decaf_448_point_t base2,
-    const cryptonite_decaf_448_scalar_t scalar2
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_base_double_scalarmul_non_secret (
+    crypton_decaf_448_point_t combo,
+    const crypton_decaf_448_scalar_t scalar1,
+    const crypton_decaf_448_point_t base2,
+    const crypton_decaf_448_scalar_t scalar2
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Constant-time decision between two points.  If pick_b
@@ -538,12 +538,12 @@
  * @param [in] b Any point.
  * @param [in] pick_b If nonzero, choose point b.
  */
-void cryptonite_decaf_448_point_cond_sel (
-    cryptonite_decaf_448_point_t out,
-    const cryptonite_decaf_448_point_t a,
-    const cryptonite_decaf_448_point_t b,
-    cryptonite_decaf_word_t pick_b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_cond_sel (
+    crypton_decaf_448_point_t out,
+    const crypton_decaf_448_point_t a,
+    const crypton_decaf_448_point_t b,
+    crypton_decaf_word_t pick_b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Constant-time decision between two scalars.  If pick_b
@@ -554,23 +554,23 @@
  * @param [in] b Any scalar.
  * @param [in] pick_b If nonzero, choose scalar b.
  */
-void cryptonite_decaf_448_scalar_cond_sel (
-    cryptonite_decaf_448_scalar_t out,
-    const cryptonite_decaf_448_scalar_t a,
-    const cryptonite_decaf_448_scalar_t b,
-    cryptonite_decaf_word_t pick_b
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_scalar_cond_sel (
+    crypton_decaf_448_scalar_t out,
+    const crypton_decaf_448_scalar_t a,
+    const crypton_decaf_448_scalar_t b,
+    crypton_decaf_word_t pick_b
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Test that a point is valid, for debugging purposes.
  *
  * @param [in] to_test The point to test.
- * @retval CRYPTONITE_DECAF_TRUE The point is valid.
- * @retval CRYPTONITE_DECAF_FALSE The point is invalid.
+ * @retval CRYPTON_DECAF_TRUE The point is valid.
+ * @retval CRYPTON_DECAF_FALSE The point is invalid.
  */
-cryptonite_decaf_bool_t cryptonite_decaf_448_point_valid (
-    const cryptonite_decaf_448_point_t to_test
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_WARN_UNUSED CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_bool_t crypton_decaf_448_point_valid (
+    const crypton_decaf_448_point_t to_test
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_WARN_UNUSED CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Torque a point, for debugging purposes.  The output
@@ -579,10 +579,10 @@
  * @param [out] q The point to torque.
  * @param [in] p The point to torque.
  */
-void cryptonite_decaf_448_point_debugging_torque (
-    cryptonite_decaf_448_point_t q,
-    const cryptonite_decaf_448_point_t p
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_debugging_torque (
+    crypton_decaf_448_point_t q,
+    const crypton_decaf_448_point_t p
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Projectively scale a point, for debugging purposes.
@@ -593,18 +593,18 @@
  * @param [in] p The point to scale.
  * @param [in] factor Serialized GF factor to scale.
  */
-void cryptonite_decaf_448_point_debugging_pscale (
-    cryptonite_decaf_448_point_t q,
-    const cryptonite_decaf_448_point_t p,
-    const unsigned char factor[CRYPTONITE_DECAF_448_SER_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_debugging_pscale (
+    crypton_decaf_448_point_t q,
+    const crypton_decaf_448_point_t p,
+    const unsigned char factor[CRYPTON_DECAF_448_SER_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Almost-Elligator-like hash to curve.
  *
  * Call this function with the output of a hash to make a hash to the curve.
  *
- * This function runs Elligator2 on the cryptonite_decaf_448 Jacobi quartic model.  It then
+ * This function runs Elligator2 on the crypton_decaf_448 Jacobi quartic model.  It then
  * uses the isogeny to put the result in twisted Edwards form.  As a result,
  * it is safe (cannot produce points of order 4), and would be compatible with
  * hypothetical other implementations of Decaf using a Montgomery or untwisted
@@ -628,29 +628,29 @@
  * @param [out] pt The data hashed to the curve.
  */
 void
-cryptonite_decaf_448_point_from_hash_nonuniform (
-    cryptonite_decaf_448_point_t pt,
-    const unsigned char hashed_data[CRYPTONITE_DECAF_448_HASH_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+crypton_decaf_448_point_from_hash_nonuniform (
+    crypton_decaf_448_point_t pt,
+    const unsigned char hashed_data[CRYPTON_DECAF_448_HASH_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Indifferentiable hash function encoding to curve.
  *
- * Equivalent to calling cryptonite_decaf_448_point_from_hash_nonuniform twice and adding.
+ * Equivalent to calling crypton_decaf_448_point_from_hash_nonuniform twice and adding.
  *
  * @param [in] hashed_data Output of some hash function.
  * @param [out] pt The data hashed to the curve.
  */ 
-void cryptonite_decaf_448_point_from_hash_uniform (
-    cryptonite_decaf_448_point_t pt,
-    const unsigned char hashed_data[2*CRYPTONITE_DECAF_448_HASH_BYTES]
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE;
+void crypton_decaf_448_point_from_hash_uniform (
+    crypton_decaf_448_point_t pt,
+    const unsigned char hashed_data[2*CRYPTON_DECAF_448_HASH_BYTES]
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE;
 
 /**
  * @brief Inverse of elligator-like hash to curve.
  *
  * This function writes to the buffer, to make it so that
- * cryptonite_decaf_448_point_from_hash_nonuniform(buffer) = pt if
+ * crypton_decaf_448_point_from_hash_nonuniform(buffer) = pt if
  * possible.  Since there may be multiple preimages, the
  * "which" parameter chooses between them.  To ensure uniform
  * inverse sampling, this function succeeds or fails
@@ -661,21 +661,21 @@
  * @param [in] which A value determining which inverse point
  * to return.
  *
- * @retval CRYPTONITE_DECAF_SUCCESS The inverse succeeded.
- * @retval CRYPTONITE_DECAF_FAILURE The inverse failed.
+ * @retval CRYPTON_DECAF_SUCCESS The inverse succeeded.
+ * @retval CRYPTON_DECAF_FAILURE The inverse failed.
  */
-cryptonite_decaf_error_t
-cryptonite_decaf_448_invert_elligator_nonuniform (
-    unsigned char recovered_hash[CRYPTONITE_DECAF_448_HASH_BYTES],
-    const cryptonite_decaf_448_point_t pt,
+crypton_decaf_error_t
+crypton_decaf_448_invert_elligator_nonuniform (
+    unsigned char recovered_hash[CRYPTON_DECAF_448_HASH_BYTES],
+    const crypton_decaf_448_point_t pt,
     uint32_t which
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_WARN_UNUSED;
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_WARN_UNUSED;
 
 /**
  * @brief Inverse of elligator-like hash to curve.
  *
  * This function writes to the buffer, to make it so that
- * cryptonite_decaf_448_point_from_hash_uniform(buffer) = pt if
+ * crypton_decaf_448_point_from_hash_uniform(buffer) = pt if
  * possible.  Since there may be multiple preimages, the
  * "which" parameter chooses between them.  To ensure uniform
  * inverse sampling, this function succeeds or fails
@@ -686,39 +686,39 @@
  * @param [in] which A value determining which inverse point
  * to return.
  *
- * @retval CRYPTONITE_DECAF_SUCCESS The inverse succeeded.
- * @retval CRYPTONITE_DECAF_FAILURE The inverse failed.
+ * @retval CRYPTON_DECAF_SUCCESS The inverse succeeded.
+ * @retval CRYPTON_DECAF_FAILURE The inverse failed.
  */
-cryptonite_decaf_error_t
-cryptonite_decaf_448_invert_elligator_uniform (
-    unsigned char recovered_hash[2*CRYPTONITE_DECAF_448_HASH_BYTES],
-    const cryptonite_decaf_448_point_t pt,
+crypton_decaf_error_t
+crypton_decaf_448_invert_elligator_uniform (
+    unsigned char recovered_hash[2*CRYPTON_DECAF_448_HASH_BYTES],
+    const crypton_decaf_448_point_t pt,
     uint32_t which
-) CRYPTONITE_DECAF_API_VIS CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_NOINLINE CRYPTONITE_DECAF_WARN_UNUSED;
+) CRYPTON_DECAF_API_VIS CRYPTON_DECAF_NONNULL CRYPTON_DECAF_NOINLINE CRYPTON_DECAF_WARN_UNUSED;
 
 /**
  * @brief Overwrite scalar with zeros.
  */
-void cryptonite_decaf_448_scalar_destroy (
-    cryptonite_decaf_448_scalar_t scalar
-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;
+void crypton_decaf_448_scalar_destroy (
+    crypton_decaf_448_scalar_t scalar
+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS;
 
 /**
  * @brief Overwrite point with zeros.
  */
-void cryptonite_decaf_448_point_destroy (
-    cryptonite_decaf_448_point_t point
-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;
+void crypton_decaf_448_point_destroy (
+    crypton_decaf_448_point_t point
+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS;
 
 /**
  * @brief Overwrite precomputed table with zeros.
  */
-void cryptonite_decaf_448_precomputed_destroy (
-    cryptonite_decaf_448_precomputed_s *pre
-) CRYPTONITE_DECAF_NONNULL CRYPTONITE_DECAF_API_VIS;
+void crypton_decaf_448_precomputed_destroy (
+    crypton_decaf_448_precomputed_s *pre
+) CRYPTON_DECAF_NONNULL CRYPTON_DECAF_API_VIS;
 
 #ifdef __cplusplus
 } /* extern "C" */
 #endif
 
-#endif /* __CRYPTONITE_DECAF_POINT_448_H__ */
+#endif /* __CRYPTON_DECAF_POINT_448_H__ */
diff --git a/cbits/decaf/include/decaf/shake.h b/cbits/decaf/include/decaf/shake.h
--- a/cbits/decaf/include/decaf/shake.h
+++ b/cbits/decaf/include/decaf/shake.h
@@ -21,10 +21,10 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-#ifndef CRYPTONITE_DECAF_SHAKE_H
-#define CRYPTONITE_DECAF_SHAKE_H
+#ifndef CRYPTON_DECAF_SHAKE_H
+#define CRYPTON_DECAF_SHAKE_H
 
-#include "cryptonite_sha3.h"
+#include "crypton_sha3.h"
 
 #include <decaf/common.h>
 
@@ -35,62 +35,62 @@
         struct sha3_ctx    sc[1];
         uint8_t            filler[136];    // 200 - 2*(256/8)
 }
-cryptonite_decaf_shake256_ctx_t[1];
+crypton_decaf_shake256_ctx_t[1];
 
-static inline void cryptonite_decaf_shake256_init(cryptonite_decaf_shake256_ctx_t ctx)
+static inline void crypton_decaf_shake256_init(crypton_decaf_shake256_ctx_t ctx)
 {
-        cryptonite_sha3_init(ctx -> sc, 256);
+        crypton_sha3_init(ctx -> sc, 256);
 }
 
-static inline void cryptonite_decaf_shake256_update(cryptonite_decaf_shake256_ctx_t ctx, const uint8_t *in, size_t inlen)
+static inline void crypton_decaf_shake256_update(crypton_decaf_shake256_ctx_t ctx, const uint8_t *in, size_t inlen)
 {
 #if __SIZE_MAX__ > UINT32_MAX
         // split data over 4 GB in 2-GB chunks
         while (inlen > UINT32_MAX) {
-                cryptonite_sha3_update(ctx -> sc, in, CHUNK_SIZE_32);
+                crypton_sha3_update(ctx -> sc, in, CHUNK_SIZE_32);
                 inlen -= CHUNK_SIZE_32;
                 in += CHUNK_SIZE_32;
         }
 #endif
-        cryptonite_sha3_update(ctx -> sc, in, (uint32_t) inlen);
+        crypton_sha3_update(ctx -> sc, in, (uint32_t) inlen);
 }
 
-static inline void cryptonite_decaf_shake256_output(cryptonite_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen) {
+static inline void crypton_decaf_shake256_output(crypton_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen) {
 #if __SIZE_MAX__ > UINT32_MAX
         // split data over 4 GB in 2-GB chunks
         while (outlen > UINT32_MAX) {
-                cryptonite_sha3_output(ctx -> sc, out, CHUNK_SIZE_32);
+                crypton_sha3_output(ctx -> sc, out, CHUNK_SIZE_32);
                 outlen -= CHUNK_SIZE_32;
                 out += CHUNK_SIZE_32;
         }
 #endif
-        cryptonite_sha3_output(ctx -> sc, out, (uint32_t) outlen);
+        crypton_sha3_output(ctx -> sc, out, (uint32_t) outlen);
 }
 
-static inline void cryptonite_decaf_shake256_final(cryptonite_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen)
+static inline void crypton_decaf_shake256_final(crypton_decaf_shake256_ctx_t ctx, uint8_t *out, size_t outlen)
 {
-        cryptonite_sha3_finalize_shake(ctx -> sc);
-        cryptonite_decaf_shake256_output(ctx, out, outlen);
+        crypton_sha3_finalize_shake(ctx -> sc);
+        crypton_decaf_shake256_output(ctx, out, outlen);
 
-        cryptonite_decaf_shake256_init(ctx);
+        crypton_decaf_shake256_init(ctx);
 }
 
-static inline void cryptonite_decaf_shake256_destroy(cryptonite_decaf_shake256_ctx_t ctx)
+static inline void crypton_decaf_shake256_destroy(crypton_decaf_shake256_ctx_t ctx)
 {
-        cryptonite_decaf_bzero(ctx, sizeof(*ctx));
+        crypton_decaf_bzero(ctx, sizeof(*ctx));
 }
 
-static inline void cryptonite_decaf_shake256_hash(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen)
+static inline void crypton_decaf_shake256_hash(uint8_t *out, size_t outlen, const uint8_t *in, size_t inlen)
 {
-        cryptonite_decaf_shake256_ctx_t ctx;
+        crypton_decaf_shake256_ctx_t ctx;
 
-        cryptonite_decaf_shake256_init(ctx);
-        cryptonite_decaf_shake256_update(ctx, in, inlen);
+        crypton_decaf_shake256_init(ctx);
+        crypton_decaf_shake256_update(ctx, in, inlen);
 
-        cryptonite_sha3_finalize_shake(ctx -> sc);
-        cryptonite_decaf_shake256_output(ctx, out, outlen);
+        crypton_sha3_finalize_shake(ctx -> sc);
+        crypton_decaf_shake256_output(ctx, out, outlen);
 
-        cryptonite_decaf_shake256_destroy(ctx);
+        crypton_decaf_shake256_destroy(ctx);
 }
 
 #endif
diff --git a/cbits/decaf/include/field.h b/cbits/decaf/include/field.h
--- a/cbits/decaf/include/field.h
+++ b/cbits/decaf/include/field.h
@@ -15,89 +15,89 @@
 #include <string.h>
     
 /** Square x, n times. */
-static CRYPTONITE_DECAF_INLINE void cryptonite_gf_sqrn (
-    cryptonite_gf_s *__restrict__ y,
+static CRYPTON_DECAF_INLINE void crypton_gf_sqrn (
+    crypton_gf_s *__restrict__ y,
     const gf x,
     int n
 ) {
     gf tmp;
     assert(n>0);
     if (n&1) {
-        cryptonite_gf_sqr(y,x);
+        crypton_gf_sqr(y,x);
         n--;
     } else {
-        cryptonite_gf_sqr(tmp,x);
-        cryptonite_gf_sqr(y,tmp);
+        crypton_gf_sqr(tmp,x);
+        crypton_gf_sqr(y,tmp);
         n-=2;
     }
     for (; n; n-=2) {
-        cryptonite_gf_sqr(tmp,y);
-        cryptonite_gf_sqr(y,tmp);
+        crypton_gf_sqr(tmp,y);
+        crypton_gf_sqr(y,tmp);
     }
 }
 
-#define cryptonite_gf_add_nr cryptonite_gf_add_RAW
+#define crypton_gf_add_nr crypton_gf_add_RAW
 
 /** Subtract mod p.  Bias by 2 and don't reduce  */
-static inline void cryptonite_gf_sub_nr ( gf c, const gf a, const gf b ) {
-    cryptonite_gf_sub_RAW(c,a,b);
-    cryptonite_gf_bias(c, 2);
-    if (GF_HEADROOM < 3) cryptonite_gf_weak_reduce(c);
+static inline void crypton_gf_sub_nr ( gf c, const gf a, const gf b ) {
+    crypton_gf_sub_RAW(c,a,b);
+    crypton_gf_bias(c, 2);
+    if (GF_HEADROOM < 3) crypton_gf_weak_reduce(c);
 }
 
 /** Subtract mod p. Bias by amt but don't reduce.  */
-static inline void cryptonite_gf_subx_nr ( gf c, const gf a, const gf b, int amt ) {
-    cryptonite_gf_sub_RAW(c,a,b);
-    cryptonite_gf_bias(c, amt);
-    if (GF_HEADROOM < amt+1) cryptonite_gf_weak_reduce(c);
+static inline void crypton_gf_subx_nr ( gf c, const gf a, const gf b, int amt ) {
+    crypton_gf_sub_RAW(c,a,b);
+    crypton_gf_bias(c, amt);
+    if (GF_HEADROOM < amt+1) crypton_gf_weak_reduce(c);
 }
 
 /** Mul by signed int.  Not constant-time WRT the sign of that int. */
-static inline void cryptonite_gf_mulw(gf c, const gf a, int32_t w) {
+static inline void crypton_gf_mulw(gf c, const gf a, int32_t w) {
     if (w>0) {
-        cryptonite_gf_mulw_unsigned(c, a, w);
+        crypton_gf_mulw_unsigned(c, a, w);
     } else {
-        cryptonite_gf_mulw_unsigned(c, a, -w);
-        cryptonite_gf_sub(c,ZERO,c);
+        crypton_gf_mulw_unsigned(c, a, -w);
+        crypton_gf_sub(c,ZERO,c);
     }
 }
 
 /** Constant time, x = is_z ? z : y */
-static inline void cryptonite_gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z) {
+static inline void crypton_gf_cond_sel(gf x, const gf y, const gf z, mask_t is_z) {
     constant_time_select(x,y,z,sizeof(gf),is_z,0);
 }
 
 /** Constant time, if (neg) x=-x; */
-static inline void cryptonite_gf_cond_neg(gf x, mask_t neg) {
+static inline void crypton_gf_cond_neg(gf x, mask_t neg) {
     gf y;
-    cryptonite_gf_sub(y,ZERO,x);
-    cryptonite_gf_cond_sel(x,x,y,neg);
+    crypton_gf_sub(y,ZERO,x);
+    crypton_gf_cond_sel(x,x,y,neg);
 }
 
 /** Constant time, if (swap) (x,y) = (y,x); */
 static inline void
-cryptonite_gf_cond_swap(gf x, cryptonite_gf_s *__restrict__ y, mask_t swap) {
-    constant_time_cond_swap(x,y,sizeof(cryptonite_gf_s),swap);
+crypton_gf_cond_swap(gf x, crypton_gf_s *__restrict__ y, mask_t swap) {
+    constant_time_cond_swap(x,y,sizeof(crypton_gf_s),swap);
 }
 
-static CRYPTONITE_DECAF_INLINE void cryptonite_gf_mul_qnr(cryptonite_gf_s *__restrict__ out, const gf x) {
+static CRYPTON_DECAF_INLINE void crypton_gf_mul_qnr(crypton_gf_s *__restrict__ out, const gf x) {
 #if P_MOD_8 == 5
     /* r = QNR * r0^2 */
-    cryptonite_gf_mul(out,x,SQRT_MINUS_ONE);
+    crypton_gf_mul(out,x,SQRT_MINUS_ONE);
 #elif P_MOD_8 == 3 || P_MOD_8 == 7
-    cryptonite_gf_sub(out,ZERO,x);
+    crypton_gf_sub(out,ZERO,x);
 #else
     #error "Only supporting p=3,5,7 mod 8"
 #endif
 }
 
-static CRYPTONITE_DECAF_INLINE void cryptonite_gf_div_qnr(cryptonite_gf_s *__restrict__ out, const gf x) {
+static CRYPTON_DECAF_INLINE void crypton_gf_div_qnr(crypton_gf_s *__restrict__ out, const gf x) {
 #if P_MOD_8 == 5
     /* r = QNR * r0^2 */
-    cryptonite_gf_mul(out,x,SQRT_MINUS_ONE);
-    cryptonite_gf_sub(out,ZERO,out);
+    crypton_gf_mul(out,x,SQRT_MINUS_ONE);
+    crypton_gf_sub(out,ZERO,out);
 #elif P_MOD_8 == 3 || P_MOD_8 == 7
-    cryptonite_gf_sub(out,ZERO,x);
+    crypton_gf_sub(out,ZERO,x);
 #else
     #error "Only supporting p=3,5,7 mod 8"
 #endif
diff --git a/cbits/decaf/include/word.h b/cbits/decaf/include/word.h
--- a/cbits/decaf/include/word.h
+++ b/cbits/decaf/include/word.h
@@ -60,9 +60,9 @@
 #endif
     
 /* Scalar limbs are keyed off of the API word size instead of the arch word size. */
-#if CRYPTONITE_DECAF_WORD_BITS == 64
+#if CRYPTON_DECAF_WORD_BITS == 64
     #define SC_LIMB(x) (x##ull)
-#elif CRYPTONITE_DECAF_WORD_BITS == 32
+#elif CRYPTON_DECAF_WORD_BITS == 32
     #define SC_LIMB(x) ((uint32_t)x##ull),(x##ull>>32)
 #else
     #error "For now, libdecaf only supports 32- and 64-bit architectures."
@@ -102,7 +102,7 @@
     typedef uint64x4_t uint64xn_t;
     typedef uint32x8_t uint32xn_t;
 
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_set_to_mask(mask_t x) {
         uint32_t y = (uint32_t)x;
         big_register_t ret = {y,y,y,y,y,y,y,y};
@@ -114,7 +114,7 @@
     typedef uint64x2_t uint64xn_t;
     typedef uint32x4_t uint32xn_t;
 
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_set_to_mask(mask_t x) {
         uint32_t y = x;
         big_register_t ret = {y,y,y,y};
@@ -126,7 +126,7 @@
     typedef uint64x2_t uint64xn_t;
     typedef uint32x4_t uint32xn_t;
     
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_set_to_mask(mask_t x) {
         return vdupq_n_u32(x);
     }
@@ -135,7 +135,7 @@
     typedef uint64_t big_register_t, uint64xn_t;
 
     typedef uint32_t uint32xn_t;
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_set_to_mask(mask_t x) {
         return (big_register_t)x;
     }
@@ -145,7 +145,7 @@
     typedef uint32_t uint32xn_t;
     typedef uint32_t big_register_t;
 
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_set_to_mask(mask_t x) {
         return (big_register_t)x;
     }
@@ -160,18 +160,18 @@
 } __attribute__((packed)) unaligned_uint32xn_t;
 
 #if __AVX2__
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_is_zero(big_register_t x) {
         return (big_register_t)(x == br_set_to_mask(0));
     }
 #elif __SSE2__
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_is_zero(big_register_t x) {
         return (big_register_t)_mm_cmpeq_epi32((__m128i)x, _mm_setzero_si128());
         //return (big_register_t)(x == br_set_to_mask(0));
     }
 #elif __ARM_NEON__
-    static CRYPTONITE_DECAF_INLINE big_register_t
+    static CRYPTON_DECAF_INLINE big_register_t
     br_is_zero(big_register_t x) {
         return vceqq_u32(x,x^x);
     }
@@ -197,13 +197,13 @@
     #ifdef NEED_MEMSET_S_EXTERN
         extern int memset_s(void *, size_t, int, size_t);
     #endif
-    static CRYPTONITE_DECAF_INLINE void
+    static CRYPTON_DECAF_INLINE void
     really_memset(void *p, char c, size_t s) {
         memset_s(p, s, c, s);
     }
 #else
     /* PERF: use words? */
-    static CRYPTONITE_DECAF_INLINE void
+    static CRYPTON_DECAF_INLINE void
     really_memset(void *p, char c, size_t s) {
         volatile char *pv = (volatile char *)p;
         size_t i;
@@ -222,7 +222,7 @@
  * @return A suitable pointer, which can be free'd with free(),
  * or NULL if no memory can be allocated.
  */
-static CRYPTONITE_DECAF_INLINE void *
+static CRYPTON_DECAF_INLINE void *
 malloc_vector(size_t size) {
     void *out = NULL;
     
@@ -248,25 +248,25 @@
 
 /* The plan on booleans:
  *
- * The external interface uses cryptonite_decaf_bool_t, but this might be a different
+ * The external interface uses crypton_decaf_bool_t, but this might be a different
  * size than our particular arch's word_t (and thus mask_t).  Also, the caller
  * isn't guaranteed to pass it as nonzero.  So bool_to_mask converts word sizes
  * and checks nonzero.
  *
  * On the flip side, mask_t is always -1 or 0, but it might be a different size
- * than cryptonite_decaf_bool_t.
+ * than crypton_decaf_bool_t.
  *
  * On the third hand, we have success vs boolean types, but that's handled in
- * common.h: it converts between cryptonite_decaf_bool_t and cryptonite_decaf_error_t.
+ * common.h: it converts between crypton_decaf_bool_t and crypton_decaf_error_t.
  */
-static CRYPTONITE_DECAF_INLINE cryptonite_decaf_bool_t mask_to_bool (mask_t m) {
-    return (cryptonite_decaf_sword_t)(sword_t)m;
+static CRYPTON_DECAF_INLINE crypton_decaf_bool_t mask_to_bool (mask_t m) {
+    return (crypton_decaf_sword_t)(sword_t)m;
 }
 
-static CRYPTONITE_DECAF_INLINE mask_t bool_to_mask (cryptonite_decaf_bool_t m) {
+static CRYPTON_DECAF_INLINE mask_t bool_to_mask (crypton_decaf_bool_t m) {
     /* On most arches this will be optimized to a simple cast. */
     mask_t ret = 0;
-    unsigned int limit = sizeof(cryptonite_decaf_bool_t)/sizeof(mask_t);
+    unsigned int limit = sizeof(crypton_decaf_bool_t)/sizeof(mask_t);
     if (limit < 1) limit = 1;
     for (unsigned int i=0; i<limit; i++) {
         ret |= ~ word_is_zero(m >> (i*8*sizeof(word_t)));
@@ -274,7 +274,7 @@
     return ret;
 }
 
-static CRYPTONITE_DECAF_INLINE void ignore_result ( cryptonite_decaf_bool_t boo ) {
+static CRYPTON_DECAF_INLINE void ignore_result ( crypton_decaf_bool_t boo ) {
     (void)boo;
 }
 
diff --git a/cbits/decaf/p448/arch_32/f_impl.c b/cbits/decaf/p448/arch_32/f_impl.c
--- a/cbits/decaf/p448/arch_32/f_impl.c
+++ b/cbits/decaf/p448/arch_32/f_impl.c
@@ -5,14 +5,14 @@
 #include "f_field.h"
 
 #if (defined(__OPTIMIZE__) && !defined(__OPTIMIZE_SIZE__) && !I_HATE_UNROLLED_LOOPS) \
-     || defined(CRYPTONITE_DECAF_FORCE_UNROLL)
+     || defined(CRYPTON_DECAF_FORCE_UNROLL)
 #define REPEAT8(_x) _x _x _x _x _x _x _x _x
 #define FOR_LIMB(_i,_start,_end,_x) do { _i=_start; REPEAT8( if (_i<_end) { _x; } _i++;) } while (0)
 #else
 #define FOR_LIMB(_i,_start,_end,_x) do { for (_i=_start; _i<_end; _i++) _x; } while (0)
 #endif
 
-void cryptonite_gf_mul (cryptonite_gf_s *__restrict__ cs, const gf as, const gf bs) { 
+void crypton_gf_mul (crypton_gf_s *__restrict__ cs, const gf as, const gf bs) { 
     const uint32_t *a = as->limb, *b = bs->limb;
     uint32_t *c = cs->limb;
 
@@ -68,7 +68,7 @@
     c[1] += ((uint32_t)(accum1));
 }
 
-void cryptonite_gf_mulw_unsigned (cryptonite_gf_s *__restrict__ cs, const gf as, uint32_t b) {
+void crypton_gf_mulw_unsigned (crypton_gf_s *__restrict__ cs, const gf as, uint32_t b) {
     assert(b<1<<28);
     
     const uint32_t *a = as->limb;
@@ -95,7 +95,7 @@
     c[1] += accum8 >> 28;
 }
 
-void cryptonite_gf_sqr (cryptonite_gf_s *__restrict__ cs, const gf as) {
-    cryptonite_gf_mul(cs,as,as); /* Performs better with a dedicated square */
+void crypton_gf_sqr (crypton_gf_s *__restrict__ cs, const gf as) {
+    crypton_gf_mul(cs,as,as); /* Performs better with a dedicated square */
 }
 
diff --git a/cbits/decaf/p448/arch_32/f_impl.h b/cbits/decaf/p448/arch_32/f_impl.h
--- a/cbits/decaf/p448/arch_32/f_impl.h
+++ b/cbits/decaf/p448/arch_32/f_impl.h
@@ -9,26 +9,26 @@
     
 #define LIMB_PLACE_VALUE(i) 28
 
-void cryptonite_gf_add_RAW (gf out, const gf a, const gf b) {
+void crypton_gf_add_RAW (gf out, const gf a, const gf b) {
     for (unsigned int i=0; i<sizeof(*out)/sizeof(out->limb[0]); i++) {
         out->limb[i] = a->limb[i] + b->limb[i];
     }
 }
 
-void cryptonite_gf_sub_RAW (gf out, const gf a, const gf b) {
+void crypton_gf_sub_RAW (gf out, const gf a, const gf b) {
     for (unsigned int i=0; i<sizeof(*out)/sizeof(out->limb[0]); i++) {
         out->limb[i] = a->limb[i] - b->limb[i];
     }
 }
 
-void cryptonite_gf_bias (gf a, int amt) {    
+void crypton_gf_bias (gf a, int amt) {    
     uint32_t co1 = ((1ull<<28)-1)*amt, co2 = co1-amt;
     for (unsigned int i=0; i<sizeof(*a)/sizeof(a->limb[0]); i++) {
         a->limb[i] += (i==sizeof(*a)/sizeof(a->limb[0])/2) ? co2 : co1;
     }
 }
 
-void cryptonite_gf_weak_reduce (gf a) {
+void crypton_gf_weak_reduce (gf a) {
     uint32_t mask = (1ull<<28) - 1;
     uint32_t tmp = a->limb[15] >> 28;
     a->limb[8] += tmp;
diff --git a/cbits/decaf/p448/arch_ref64/f_impl.c b/cbits/decaf/p448/arch_ref64/f_impl.c
--- a/cbits/decaf/p448/arch_ref64/f_impl.c
+++ b/cbits/decaf/p448/arch_ref64/f_impl.c
@@ -4,7 +4,7 @@
 
 #include "f_field.h"
 
-void cryptonite_gf_mul (cryptonite_gf_s *__restrict__ cs, const gf as, const gf bs) {
+void crypton_gf_mul (crypton_gf_s *__restrict__ cs, const gf as, const gf bs) {
     const uint64_t *a = as->limb, *b = bs->limb;
     uint64_t *c = cs->limb;
 
@@ -165,7 +165,7 @@
     c[1] += ((uint64_t)(accum1));
 }
 
-void cryptonite_gf_mulw_unsigned (cryptonite_gf_s *__restrict__ cs, const gf as, uint32_t b) {
+void crypton_gf_mulw_unsigned (crypton_gf_s *__restrict__ cs, const gf as, uint32_t b) {
     const uint64_t *a = as->limb;
     uint64_t *c = cs->limb;
 
@@ -189,7 +189,7 @@
     c[1] += accum4 >> 56;
 }
 
-void cryptonite_gf_sqr (cryptonite_gf_s *__restrict__ cs, const gf as) {
+void crypton_gf_sqr (crypton_gf_s *__restrict__ cs, const gf as) {
     const uint64_t *a = as->limb;
     uint64_t *c = cs->limb;
 
diff --git a/cbits/decaf/p448/arch_ref64/f_impl.h b/cbits/decaf/p448/arch_ref64/f_impl.h
--- a/cbits/decaf/p448/arch_ref64/f_impl.h
+++ b/cbits/decaf/p448/arch_ref64/f_impl.h
@@ -7,27 +7,27 @@
     
 #define LIMB_PLACE_VALUE(i) 56
 
-void cryptonite_gf_add_RAW (gf out, const gf a, const gf b) {
+void crypton_gf_add_RAW (gf out, const gf a, const gf b) {
     for (unsigned int i=0; i<8; i++) {
         out->limb[i] = a->limb[i] + b->limb[i];
     }
-    cryptonite_gf_weak_reduce(out);
+    crypton_gf_weak_reduce(out);
 }
 
-void cryptonite_gf_sub_RAW (gf out, const gf a, const gf b) {
+void crypton_gf_sub_RAW (gf out, const gf a, const gf b) {
     uint64_t co1 = ((1ull<<56)-1)*2, co2 = co1-2;
     for (unsigned int i=0; i<8; i++) {
         out->limb[i] = a->limb[i] - b->limb[i] + ((i==4) ? co2 : co1);
     }
-    cryptonite_gf_weak_reduce(out);
+    crypton_gf_weak_reduce(out);
 }
 
-void cryptonite_gf_bias (gf a, int amt) {
+void crypton_gf_bias (gf a, int amt) {
     (void) a;
     (void) amt;
 }
 
-void cryptonite_gf_weak_reduce (gf a) {
+void crypton_gf_weak_reduce (gf a) {
     uint64_t mask = (1ull<<56) - 1;
     uint64_t tmp = a->limb[7] >> 56;
     a->limb[4] += tmp;
diff --git a/cbits/decaf/p448/f_arithmetic.c b/cbits/decaf/p448/f_arithmetic.c
--- a/cbits/decaf/p448/f_arithmetic.c
+++ b/cbits/decaf/p448/f_arithmetic.c
@@ -10,37 +10,37 @@
 
 #include "field.h"
 
-mask_t cryptonite_gf_isr (
+mask_t crypton_gf_isr (
     gf a,
     const gf x
 ) {
     gf L0, L1, L2;
-    cryptonite_gf_sqr  (L1,     x );
-    cryptonite_gf_mul  (L2,     x,   L1 );
-    cryptonite_gf_sqr  (L1,   L2 );
-    cryptonite_gf_mul  (L2,     x,   L1 );
-    cryptonite_gf_sqrn (L1,   L2,     3 );
-    cryptonite_gf_mul  (L0,   L2,   L1 );
-    cryptonite_gf_sqrn (L1,   L0,     3 );
-    cryptonite_gf_mul  (L0,   L2,   L1 );
-    cryptonite_gf_sqrn (L2,   L0,     9 );
-    cryptonite_gf_mul  (L1,   L0,   L2 );
-    cryptonite_gf_sqr  (L0,   L1 );
-    cryptonite_gf_mul  (L2,     x,   L0 );
-    cryptonite_gf_sqrn (L0,   L2,    18 );
-    cryptonite_gf_mul  (L2,   L1,   L0 );
-    cryptonite_gf_sqrn (L0,   L2,    37 );
-    cryptonite_gf_mul  (L1,   L2,   L0 );
-    cryptonite_gf_sqrn (L0,   L1,    37 );
-    cryptonite_gf_mul  (L1,   L2,   L0 );
-    cryptonite_gf_sqrn (L0,   L1,   111 );
-    cryptonite_gf_mul  (L2,   L1,   L0 );
-    cryptonite_gf_sqr  (L0,   L2 );
-    cryptonite_gf_mul  (L1,     x,   L0 );
-    cryptonite_gf_sqrn (L0,   L1,   223 );
-    cryptonite_gf_mul  (L1,   L2,   L0 );
-    cryptonite_gf_sqr  (L2, L1);
-    cryptonite_gf_mul  (L0, L2, x);
-    cryptonite_gf_copy(a,L1);
-    return cryptonite_gf_eq(L0,ONE);
+    crypton_gf_sqr  (L1,     x );
+    crypton_gf_mul  (L2,     x,   L1 );
+    crypton_gf_sqr  (L1,   L2 );
+    crypton_gf_mul  (L2,     x,   L1 );
+    crypton_gf_sqrn (L1,   L2,     3 );
+    crypton_gf_mul  (L0,   L2,   L1 );
+    crypton_gf_sqrn (L1,   L0,     3 );
+    crypton_gf_mul  (L0,   L2,   L1 );
+    crypton_gf_sqrn (L2,   L0,     9 );
+    crypton_gf_mul  (L1,   L0,   L2 );
+    crypton_gf_sqr  (L0,   L1 );
+    crypton_gf_mul  (L2,     x,   L0 );
+    crypton_gf_sqrn (L0,   L2,    18 );
+    crypton_gf_mul  (L2,   L1,   L0 );
+    crypton_gf_sqrn (L0,   L2,    37 );
+    crypton_gf_mul  (L1,   L2,   L0 );
+    crypton_gf_sqrn (L0,   L1,    37 );
+    crypton_gf_mul  (L1,   L2,   L0 );
+    crypton_gf_sqrn (L0,   L1,   111 );
+    crypton_gf_mul  (L2,   L1,   L0 );
+    crypton_gf_sqr  (L0,   L2 );
+    crypton_gf_mul  (L1,     x,   L0 );
+    crypton_gf_sqrn (L0,   L1,   223 );
+    crypton_gf_mul  (L1,   L2,   L0 );
+    crypton_gf_sqr  (L2, L1);
+    crypton_gf_mul  (L0, L2, x);
+    crypton_gf_copy(a,L1);
+    return crypton_gf_eq(L0,ONE);
 }
diff --git a/cbits/decaf/p448/f_field.h b/cbits/decaf/p448/f_field.h
--- a/cbits/decaf/p448/f_field.h
+++ b/cbits/decaf/p448/f_field.h
@@ -21,37 +21,37 @@
 
 #include "word.h"
 
-#define __CRYPTONITE_DECAF_448_GF_DEFINED__ 1
+#define __CRYPTON_DECAF_448_GF_DEFINED__ 1
 #define NLIMBS (64/sizeof(word_t))
 #define X_SER_BYTES 56
 #define SER_BYTES 56
-typedef struct cryptonite_gf_448_s {
+typedef struct crypton_gf_448_s {
     word_t limb[NLIMBS];
-} __attribute__((aligned(16))) cryptonite_gf_448_s, cryptonite_gf_448_t[1];
+} __attribute__((aligned(16))) crypton_gf_448_s, crypton_gf_448_t[1];
 
 #define GF_LIT_LIMB_BITS  56
 #define GF_BITS           448
-#define ZERO              cryptonite_gf_448_ZERO
-#define ONE               cryptonite_gf_448_ONE
-#define MODULUS           cryptonite_gf_448_MODULUS
-#define gf                cryptonite_gf_448_t
-#define cryptonite_gf_s              cryptonite_gf_448_s
-#define cryptonite_gf_eq             cryptonite_gf_448_eq
-#define cryptonite_gf_hibit          cryptonite_gf_448_hibit
-#define cryptonite_gf_copy           cryptonite_gf_448_copy
-#define cryptonite_gf_add            cryptonite_gf_448_add
-#define cryptonite_gf_sub            cryptonite_gf_448_sub
-#define cryptonite_gf_add_RAW        cryptonite_gf_448_add_RAW
-#define cryptonite_gf_sub_RAW        cryptonite_gf_448_sub_RAW
-#define cryptonite_gf_bias           cryptonite_gf_448_bias
-#define cryptonite_gf_weak_reduce    cryptonite_gf_448_weak_reduce
-#define cryptonite_gf_strong_reduce  cryptonite_gf_448_strong_reduce
-#define cryptonite_gf_mul            cryptonite_gf_448_mul
-#define cryptonite_gf_sqr            cryptonite_gf_448_sqr
-#define cryptonite_gf_mulw_unsigned  cryptonite_gf_448_mulw_unsigned
-#define cryptonite_gf_isr            cryptonite_gf_448_isr
-#define cryptonite_gf_serialize      cryptonite_gf_448_serialize
-#define cryptonite_gf_deserialize    cryptonite_gf_448_deserialize
+#define ZERO              crypton_gf_448_ZERO
+#define ONE               crypton_gf_448_ONE
+#define MODULUS           crypton_gf_448_MODULUS
+#define gf                crypton_gf_448_t
+#define crypton_gf_s              crypton_gf_448_s
+#define crypton_gf_eq             crypton_gf_448_eq
+#define crypton_gf_hibit          crypton_gf_448_hibit
+#define crypton_gf_copy           crypton_gf_448_copy
+#define crypton_gf_add            crypton_gf_448_add
+#define crypton_gf_sub            crypton_gf_448_sub
+#define crypton_gf_add_RAW        crypton_gf_448_add_RAW
+#define crypton_gf_sub_RAW        crypton_gf_448_sub_RAW
+#define crypton_gf_bias           crypton_gf_448_bias
+#define crypton_gf_weak_reduce    crypton_gf_448_weak_reduce
+#define crypton_gf_strong_reduce  crypton_gf_448_strong_reduce
+#define crypton_gf_mul            crypton_gf_448_mul
+#define crypton_gf_sqr            crypton_gf_448_sqr
+#define crypton_gf_mulw_unsigned  crypton_gf_448_mulw_unsigned
+#define crypton_gf_isr            crypton_gf_448_isr
+#define crypton_gf_serialize      crypton_gf_448_serialize
+#define crypton_gf_deserialize    crypton_gf_448_deserialize
 
 /* RFC 7748 support */
 #define X_PUBLIC_BYTES  X_SER_BYTES
@@ -67,24 +67,24 @@
 #endif
 
 /* Defined below in f_impl.h */
-static INLINE_UNUSED void cryptonite_gf_copy (gf out, const gf a) { *out = *a; }
-static INLINE_UNUSED void cryptonite_gf_add_RAW (gf out, const gf a, const gf b);
-static INLINE_UNUSED void cryptonite_gf_sub_RAW (gf out, const gf a, const gf b);
-static INLINE_UNUSED void cryptonite_gf_bias (gf inout, int amount);
-static INLINE_UNUSED void cryptonite_gf_weak_reduce (gf inout);
+static INLINE_UNUSED void crypton_gf_copy (gf out, const gf a) { *out = *a; }
+static INLINE_UNUSED void crypton_gf_add_RAW (gf out, const gf a, const gf b);
+static INLINE_UNUSED void crypton_gf_sub_RAW (gf out, const gf a, const gf b);
+static INLINE_UNUSED void crypton_gf_bias (gf inout, int amount);
+static INLINE_UNUSED void crypton_gf_weak_reduce (gf inout);
 
-void cryptonite_gf_strong_reduce (gf inout);   
-void cryptonite_gf_add (gf out, const gf a, const gf b);
-void cryptonite_gf_sub (gf out, const gf a, const gf b);
-void cryptonite_gf_mul (cryptonite_gf_s *__restrict__ out, const gf a, const gf b);
-void cryptonite_gf_mulw_unsigned (cryptonite_gf_s *__restrict__ out, const gf a, uint32_t b);
-void cryptonite_gf_sqr (cryptonite_gf_s *__restrict__ out, const gf a);
-mask_t cryptonite_gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */
-mask_t cryptonite_gf_eq (const gf x, const gf y);
-mask_t cryptonite_gf_hibit (const gf x);
+void crypton_gf_strong_reduce (gf inout);   
+void crypton_gf_add (gf out, const gf a, const gf b);
+void crypton_gf_sub (gf out, const gf a, const gf b);
+void crypton_gf_mul (crypton_gf_s *__restrict__ out, const gf a, const gf b);
+void crypton_gf_mulw_unsigned (crypton_gf_s *__restrict__ out, const gf a, uint32_t b);
+void crypton_gf_sqr (crypton_gf_s *__restrict__ out, const gf a);
+mask_t crypton_gf_isr(gf a, const gf x); /** a^2 x = 1, QNR, or 0 if x=0.  Return true if successful */
+mask_t crypton_gf_eq (const gf x, const gf y);
+mask_t crypton_gf_hibit (const gf x);
 
-void cryptonite_gf_serialize (uint8_t *serial, const gf x,int with_highbit);
-mask_t cryptonite_gf_deserialize (gf x, const uint8_t serial[SER_BYTES],int with_highbit);
+void crypton_gf_serialize (uint8_t *serial, const gf x,int with_highbit);
+mask_t crypton_gf_deserialize (gf x, const uint8_t serial[SER_BYTES],int with_highbit);
 
 
 #ifdef __cplusplus
diff --git a/cbits/decaf/p448/f_generic.c b/cbits/decaf/p448/f_generic.c
--- a/cbits/decaf/p448/f_generic.c
+++ b/cbits/decaf/p448/f_generic.c
@@ -24,11 +24,11 @@
 #endif
 
 /** Serialize to wire format. */
-void cryptonite_gf_serialize (uint8_t serial[SER_BYTES], const gf x, int with_hibit) {
+void crypton_gf_serialize (uint8_t serial[SER_BYTES], const gf x, int with_hibit) {
     gf red;
-    cryptonite_gf_copy(red, x);
-    cryptonite_gf_strong_reduce(red);
-    if (!with_hibit) { assert(cryptonite_gf_hibit(red) == 0); }
+    crypton_gf_copy(red, x);
+    crypton_gf_strong_reduce(red);
+    if (!with_hibit) { assert(crypton_gf_hibit(red) == 0); }
     
     unsigned int j=0, fill=0;
     dword_t buffer = 0;
@@ -45,15 +45,15 @@
 }
 
 /** Return high bit of x = low bit of 2x mod p */
-mask_t cryptonite_gf_hibit(const gf x) {
+mask_t crypton_gf_hibit(const gf x) {
     gf y;
-    cryptonite_gf_add(y,x,x);
-    cryptonite_gf_strong_reduce(y);
+    crypton_gf_add(y,x,x);
+    crypton_gf_strong_reduce(y);
     return -(y->limb[0]&1);
 }
 
 /** Deserialize from wire format; return -1 on success and 0 on failure. */
-mask_t cryptonite_gf_deserialize (gf x, const uint8_t serial[SER_BYTES], int with_hibit) {
+mask_t crypton_gf_deserialize (gf x, const uint8_t serial[SER_BYTES], int with_hibit) {
     unsigned int j=0, fill=0;
     dword_t buffer = 0;
     dsword_t scarry = 0;
@@ -68,14 +68,14 @@
         buffer >>= LIMB_PLACE_VALUE(LIMBPERM(i));
         scarry = (scarry + x->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)]) >> (8*sizeof(word_t));
     }
-    mask_t succ = with_hibit ? -(mask_t)1 : ~cryptonite_gf_hibit(x);
+    mask_t succ = with_hibit ? -(mask_t)1 : ~crypton_gf_hibit(x);
     return succ & word_is_zero(buffer) & ~word_is_zero(scarry);
 }
 
 /** Reduce to canonical form. */
-void cryptonite_gf_strong_reduce (gf a) {
+void crypton_gf_strong_reduce (gf a) {
     /* first, clear high */
-    cryptonite_gf_weak_reduce(a); /* Determined to have negligible perf impact. */
+    crypton_gf_weak_reduce(a); /* Determined to have negligible perf impact. */
 
     /* now the total is less than 2p */
 
@@ -107,23 +107,23 @@
 }
 
 /** Subtract two gf elements d=a-b */
-void cryptonite_gf_sub (gf d, const gf a, const gf b) {
-    cryptonite_gf_sub_RAW ( d, a, b );
-    cryptonite_gf_bias( d, 2 );
-    cryptonite_gf_weak_reduce ( d );
+void crypton_gf_sub (gf d, const gf a, const gf b) {
+    crypton_gf_sub_RAW ( d, a, b );
+    crypton_gf_bias( d, 2 );
+    crypton_gf_weak_reduce ( d );
 }
 
 /** Add two field elements d = a+b */
-void cryptonite_gf_add (gf d, const gf a, const gf b) {
-    cryptonite_gf_add_RAW ( d, a, b );
-    cryptonite_gf_weak_reduce ( d );
+void crypton_gf_add (gf d, const gf a, const gf b) {
+    crypton_gf_add_RAW ( d, a, b );
+    crypton_gf_weak_reduce ( d );
 }
 
 /** Compare a==b */
-mask_t cryptonite_gf_eq(const gf a, const gf b) {
+mask_t crypton_gf_eq(const gf a, const gf b) {
     gf c;
-    cryptonite_gf_sub(c,a,b);
-    cryptonite_gf_strong_reduce(c);
+    crypton_gf_sub(c,a,b);
+    crypton_gf_strong_reduce(c);
     mask_t ret=0;
     for (unsigned int i=0; i<NLIMBS; i++) {
         ret |= c->limb[LIMBPERM(i)];
diff --git a/cbits/decaf/utils.c b/cbits/decaf/utils.c
--- a/cbits/decaf/utils.c
+++ b/cbits/decaf/utils.c
@@ -10,25 +10,25 @@
 
 #include <decaf/common.h>
 
-void cryptonite_decaf_bzero (
+void crypton_decaf_bzero (
     void *s,
     size_t size
 ) {
 #ifdef __STDC_LIB_EXT1__
     memset_s(s, size, 0, size);
 #else
-    const size_t sw = sizeof(cryptonite_decaf_word_t);
+    const size_t sw = sizeof(crypton_decaf_word_t);
     volatile uint8_t *destroy = (volatile uint8_t *)s;
     for (; size && ((uintptr_t)destroy)%sw; size--, destroy++)
         *destroy = 0;
     for (; size >= sw; size -= sw, destroy += sw)
-        *(volatile cryptonite_decaf_word_t *)destroy = 0;
+        *(volatile crypton_decaf_word_t *)destroy = 0;
     for (; size; size--, destroy++)
         *destroy = 0;
 #endif
 }
 
-cryptonite_decaf_bool_t cryptonite_decaf_memeq (
+crypton_decaf_bool_t crypton_decaf_memeq (
    const void *data1_,
    const void *data2_,
    size_t size
@@ -39,5 +39,5 @@
     for (; size; size--, data1++, data2++) {
         ret |= *data1 ^ *data2;
     }
-    return (((cryptonite_decaf_dword_t)ret) - 1) >> 8;
+    return (((crypton_decaf_dword_t)ret) - 1) >> 8;
 }
diff --git a/cbits/ed25519/ed25519-crypton-exts.h b/cbits/ed25519/ed25519-crypton-exts.h
new file mode 100644
--- /dev/null
+++ b/cbits/ed25519/ed25519-crypton-exts.h
@@ -0,0 +1,246 @@
+/*
+    Public domain by Olivier Chéron <olivier.cheron@gmail.com>
+
+    Arithmetic extensions to Ed25519-donna
+*/
+
+
+/*
+    Scalar functions
+*/
+
+void
+ED25519_FN(ed25519_scalar_encode) (unsigned char out[32], const bignum256modm in) {
+    contract256_modm(out, in);
+}
+
+void
+ED25519_FN(ed25519_scalar_decode_long) (bignum256modm out, const unsigned char *in, size_t len) {
+    expand256_modm(out, in, len);
+}
+
+int
+ED25519_FN(ed25519_scalar_eq) (const bignum256modm a, const bignum256modm b) {
+    bignum256modm_element_t e = 0;
+
+    for (int i = 0; i < bignum256modm_limb_size; i++) {
+        e |= a[i] ^ b[i];
+    }
+
+    return (int) (1 & ((e - 1) >> bignum256modm_bits_per_limb));
+}
+
+void
+ED25519_FN(ed25519_scalar_add) (bignum256modm r, const bignum256modm x, const bignum256modm y) {
+    add256_modm(r, x, y);
+}
+
+void
+ED25519_FN(ed25519_scalar_mul) (bignum256modm r, const bignum256modm x, const bignum256modm y) {
+    mul256_modm(r, x, y);
+}
+
+
+/*
+    Point functions
+*/
+
+void
+ED25519_FN(ed25519_point_encode) (unsigned char r[32], const ge25519 *p) {
+    ge25519_pack(r, p);
+}
+
+int
+ED25519_FN(ed25519_point_decode_vartime) (ge25519 *r, const unsigned char p[32]) {
+    unsigned char p_neg[32];
+
+    // invert parity bit of X coordinate so the point is negated twice
+    // (once here, once in ge25519_unpack_negative_vartime)
+    for (int i = 0; i < 31; i++) {
+        p_neg[i] = p[i];
+    }
+    p_neg[31] = p[31] ^ 0x80;
+
+    return ge25519_unpack_negative_vartime(r, p_neg);
+}
+
+int
+ED25519_FN(ed25519_point_eq) (const ge25519 *p, const ge25519 *q) {
+    bignum25519 a, b;
+    unsigned char contract_a[32], contract_b[32];
+    int eq;
+
+    // pX * qZ = qX * pZ
+    curve25519_mul(a, p->x, q->z);
+    curve25519_contract(contract_a, a);
+    curve25519_mul(b, q->x, p->z);
+    curve25519_contract(contract_b, b);
+    eq = ed25519_verify(contract_a, contract_b, 32);
+
+    // pY * qZ = qY * pZ
+    curve25519_mul(a, p->y, q->z);
+    curve25519_contract(contract_a, a);
+    curve25519_mul(b, q->y, p->z);
+    curve25519_contract(contract_b, b);
+    eq &= ed25519_verify(contract_a, contract_b, 32);
+
+    return eq;
+}
+
+static int
+ED25519_FN(ed25519_point_is_identity) (const ge25519 *p) {
+    static const unsigned char zero[32] = {0};
+    unsigned char check[32];
+    bignum25519 d;
+    int eq;
+
+    // pX = 0
+    curve25519_contract(check, p->x);
+    eq = ed25519_verify(check, zero, 32);
+
+    // pY - pZ = 0
+    curve25519_sub_reduce(d, p->y, p->z);
+    curve25519_contract(check, d);
+    eq &= ed25519_verify(check, zero, 32);
+
+    return eq;
+}
+
+void
+ED25519_FN(ed25519_point_negate) (ge25519 *r, const ge25519 *p) {
+    curve25519_neg(r->x, p->x);
+    curve25519_copy(r->y, p->y);
+    curve25519_copy(r->z, p->z);
+    curve25519_neg(r->t, p->t);
+}
+
+void
+ED25519_FN(ed25519_point_add) (ge25519 *r, const ge25519 *p, const ge25519 *q) {
+    ge25519_add(r, p, q);
+}
+
+void
+ED25519_FN(ed25519_point_double) (ge25519 *r, const ge25519 *p) {
+    ge25519_double(r, p);
+}
+
+void
+ED25519_FN(ed25519_point_mul_by_cofactor) (ge25519 *r, const ge25519 *p) {
+    ge25519_double_partial(r, p);
+    ge25519_double_partial(r, r);
+    ge25519_double(r, r);
+}
+
+void
+ED25519_FN(ed25519_point_base_scalarmul) (ge25519 *r, const bignum256modm s) {
+    ge25519_scalarmult_base_niels(r, ge25519_niels_base_multiples, s);
+}
+
+#if defined(ED25519_64BIT)
+typedef uint64_t ed25519_move_cond_word;
+#else
+typedef uint32_t ed25519_move_cond_word;
+#endif
+
+/* out = (flag) ? in : out */
+DONNA_INLINE static void
+ed25519_move_cond_pniels(ge25519_pniels *out, const ge25519_pniels *in, uint32_t flag) {
+    const int word_count = sizeof(ge25519_pniels) / sizeof(ed25519_move_cond_word);
+    const ed25519_move_cond_word nb = (ed25519_move_cond_word) flag - 1, b = ~nb;
+
+    ed25519_move_cond_word *outw = (ed25519_move_cond_word *) out;
+    const ed25519_move_cond_word *inw  = (const ed25519_move_cond_word *) in;
+
+    // ge25519_pniels has 4 coordinates, so word_count is divisible by 4
+    for (int i = 0; i < word_count; i += 4) {
+        outw[i + 0] = (outw[i + 0] & nb) | (inw[i + 0] & b);
+        outw[i + 1] = (outw[i + 1] & nb) | (inw[i + 1] & b);
+        outw[i + 2] = (outw[i + 2] & nb) | (inw[i + 2] & b);
+        outw[i + 3] = (outw[i + 3] & nb) | (inw[i + 3] & b);
+    }
+}
+
+static void
+ed25519_point_scalarmul_w_choose_pniels(ge25519_pniels *t, const ge25519_pniels table[15], uint32_t pos) {
+    // initialize t to identity, i.e. (1, 1, 1, 0)
+    memset(t, 0, sizeof(ge25519_pniels));
+    t->ysubx[0] = 1;
+    t->xaddy[0] = 1;
+    t->z[0] = 1;
+
+    // move one entry from table matching requested position,
+    // scanning all table to avoid cache-timing attack
+    //
+    // when pos == 0, no entry matches and this returns
+    // identity as expected
+    for (uint32_t i = 1; i < 16; i++) {
+        uint32_t flag = ((i ^ pos) - 1) >> 31;
+        ed25519_move_cond_pniels(t, table + i - 1, flag);
+    }
+}
+
+void
+ED25519_FN(ed25519_point_scalarmul) (ge25519 *r, const ge25519 *p, const bignum256modm s) {
+    ge25519_pniels mult[15];
+    ge25519_pniels pn;
+    ge25519_p1p1 t;
+    unsigned char ss[32];
+
+    // transform scalar as little-endian number
+    contract256_modm(ss, s);
+
+    // initialize r to identity, i.e. ge25519 (0, 1, 1, 0)
+    memset(r, 0, sizeof(ge25519));
+    r->y[0] = 1;
+    r->z[0] = 1;
+
+    // precompute multiples of P: 1.P, 2.P, ..., 15.P
+    ge25519_full_to_pniels(&mult[0], p);
+    for (int i = 1; i < 15; i++) {
+        ge25519_pnielsadd(&mult[i], p, &mult[i-1]);
+    }
+
+    // 4-bit fixed window, still 256 doublings but 64 additions
+    for (int i = 31; i >= 0; i--) {
+        // higher bits in ss[i]
+        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] >> 4);
+        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);
+        ge25519_p1p1_to_partial(r, &t);
+
+        ge25519_double_partial(r, r);
+        ge25519_double_partial(r, r);
+        ge25519_double_partial(r, r);
+        ge25519_double(r, r);
+
+        // lower bits in ss[i]
+        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] & 0x0F);
+        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);
+        if (i > 0) {
+            ge25519_p1p1_to_partial(r, &t);
+
+            ge25519_double_partial(r, r);
+            ge25519_double_partial(r, r);
+            ge25519_double_partial(r, r);
+            ge25519_double(r, r);
+        } else {
+            ge25519_p1p1_to_full(r, &t);
+        }
+    }
+}
+
+void
+ED25519_FN(ed25519_base_double_scalarmul_vartime) (ge25519 *r, const bignum256modm s1, const ge25519 *p2, const bignum256modm s2) {
+    // computes [s1]basepoint + [s2]p2
+    ge25519_double_scalarmult_vartime(r, p2, s2, s1);
+}
+
+int
+ED25519_FN(ed25519_point_has_prime_order) (const ge25519 *p) {
+    static const bignum256modm sc_zero = {0};
+    ge25519 q;
+
+    // computes Q = m.P, vartime allowed because m is not secret
+    ED25519_FN(ed25519_base_double_scalarmul_vartime) (&q, sc_zero, p, modm_m);
+
+    return ED25519_FN(ed25519_point_is_identity) (&q);
+}
diff --git a/cbits/ed25519/ed25519-cryptonite-exts.h b/cbits/ed25519/ed25519-cryptonite-exts.h
deleted file mode 100644
--- a/cbits/ed25519/ed25519-cryptonite-exts.h
+++ /dev/null
@@ -1,246 +0,0 @@
-/*
-    Public domain by Olivier Chéron <olivier.cheron@gmail.com>
-
-    Arithmetic extensions to Ed25519-donna
-*/
-
-
-/*
-    Scalar functions
-*/
-
-void
-ED25519_FN(ed25519_scalar_encode) (unsigned char out[32], const bignum256modm in) {
-    contract256_modm(out, in);
-}
-
-void
-ED25519_FN(ed25519_scalar_decode_long) (bignum256modm out, const unsigned char *in, size_t len) {
-    expand256_modm(out, in, len);
-}
-
-int
-ED25519_FN(ed25519_scalar_eq) (const bignum256modm a, const bignum256modm b) {
-    bignum256modm_element_t e = 0;
-
-    for (int i = 0; i < bignum256modm_limb_size; i++) {
-        e |= a[i] ^ b[i];
-    }
-
-    return (int) (1 & ((e - 1) >> bignum256modm_bits_per_limb));
-}
-
-void
-ED25519_FN(ed25519_scalar_add) (bignum256modm r, const bignum256modm x, const bignum256modm y) {
-    add256_modm(r, x, y);
-}
-
-void
-ED25519_FN(ed25519_scalar_mul) (bignum256modm r, const bignum256modm x, const bignum256modm y) {
-    mul256_modm(r, x, y);
-}
-
-
-/*
-    Point functions
-*/
-
-void
-ED25519_FN(ed25519_point_encode) (unsigned char r[32], const ge25519 *p) {
-    ge25519_pack(r, p);
-}
-
-int
-ED25519_FN(ed25519_point_decode_vartime) (ge25519 *r, const unsigned char p[32]) {
-    unsigned char p_neg[32];
-
-    // invert parity bit of X coordinate so the point is negated twice
-    // (once here, once in ge25519_unpack_negative_vartime)
-    for (int i = 0; i < 31; i++) {
-        p_neg[i] = p[i];
-    }
-    p_neg[31] = p[31] ^ 0x80;
-
-    return ge25519_unpack_negative_vartime(r, p_neg);
-}
-
-int
-ED25519_FN(ed25519_point_eq) (const ge25519 *p, const ge25519 *q) {
-    bignum25519 a, b;
-    unsigned char contract_a[32], contract_b[32];
-    int eq;
-
-    // pX * qZ = qX * pZ
-    curve25519_mul(a, p->x, q->z);
-    curve25519_contract(contract_a, a);
-    curve25519_mul(b, q->x, p->z);
-    curve25519_contract(contract_b, b);
-    eq = ed25519_verify(contract_a, contract_b, 32);
-
-    // pY * qZ = qY * pZ
-    curve25519_mul(a, p->y, q->z);
-    curve25519_contract(contract_a, a);
-    curve25519_mul(b, q->y, p->z);
-    curve25519_contract(contract_b, b);
-    eq &= ed25519_verify(contract_a, contract_b, 32);
-
-    return eq;
-}
-
-static int
-ED25519_FN(ed25519_point_is_identity) (const ge25519 *p) {
-    static const unsigned char zero[32] = {0};
-    unsigned char check[32];
-    bignum25519 d;
-    int eq;
-
-    // pX = 0
-    curve25519_contract(check, p->x);
-    eq = ed25519_verify(check, zero, 32);
-
-    // pY - pZ = 0
-    curve25519_sub_reduce(d, p->y, p->z);
-    curve25519_contract(check, d);
-    eq &= ed25519_verify(check, zero, 32);
-
-    return eq;
-}
-
-void
-ED25519_FN(ed25519_point_negate) (ge25519 *r, const ge25519 *p) {
-    curve25519_neg(r->x, p->x);
-    curve25519_copy(r->y, p->y);
-    curve25519_copy(r->z, p->z);
-    curve25519_neg(r->t, p->t);
-}
-
-void
-ED25519_FN(ed25519_point_add) (ge25519 *r, const ge25519 *p, const ge25519 *q) {
-    ge25519_add(r, p, q);
-}
-
-void
-ED25519_FN(ed25519_point_double) (ge25519 *r, const ge25519 *p) {
-    ge25519_double(r, p);
-}
-
-void
-ED25519_FN(ed25519_point_mul_by_cofactor) (ge25519 *r, const ge25519 *p) {
-    ge25519_double_partial(r, p);
-    ge25519_double_partial(r, r);
-    ge25519_double(r, r);
-}
-
-void
-ED25519_FN(ed25519_point_base_scalarmul) (ge25519 *r, const bignum256modm s) {
-    ge25519_scalarmult_base_niels(r, ge25519_niels_base_multiples, s);
-}
-
-#if defined(ED25519_64BIT)
-typedef uint64_t ed25519_move_cond_word;
-#else
-typedef uint32_t ed25519_move_cond_word;
-#endif
-
-/* out = (flag) ? in : out */
-DONNA_INLINE static void
-ed25519_move_cond_pniels(ge25519_pniels *out, const ge25519_pniels *in, uint32_t flag) {
-    const int word_count = sizeof(ge25519_pniels) / sizeof(ed25519_move_cond_word);
-    const ed25519_move_cond_word nb = (ed25519_move_cond_word) flag - 1, b = ~nb;
-
-    ed25519_move_cond_word *outw = (ed25519_move_cond_word *) out;
-    const ed25519_move_cond_word *inw  = (const ed25519_move_cond_word *) in;
-
-    // ge25519_pniels has 4 coordinates, so word_count is divisible by 4
-    for (int i = 0; i < word_count; i += 4) {
-        outw[i + 0] = (outw[i + 0] & nb) | (inw[i + 0] & b);
-        outw[i + 1] = (outw[i + 1] & nb) | (inw[i + 1] & b);
-        outw[i + 2] = (outw[i + 2] & nb) | (inw[i + 2] & b);
-        outw[i + 3] = (outw[i + 3] & nb) | (inw[i + 3] & b);
-    }
-}
-
-static void
-ed25519_point_scalarmul_w_choose_pniels(ge25519_pniels *t, const ge25519_pniels table[15], uint32_t pos) {
-    // initialize t to identity, i.e. (1, 1, 1, 0)
-    memset(t, 0, sizeof(ge25519_pniels));
-    t->ysubx[0] = 1;
-    t->xaddy[0] = 1;
-    t->z[0] = 1;
-
-    // move one entry from table matching requested position,
-    // scanning all table to avoid cache-timing attack
-    //
-    // when pos == 0, no entry matches and this returns
-    // identity as expected
-    for (uint32_t i = 1; i < 16; i++) {
-        uint32_t flag = ((i ^ pos) - 1) >> 31;
-        ed25519_move_cond_pniels(t, table + i - 1, flag);
-    }
-}
-
-void
-ED25519_FN(ed25519_point_scalarmul) (ge25519 *r, const ge25519 *p, const bignum256modm s) {
-    ge25519_pniels mult[15];
-    ge25519_pniels pn;
-    ge25519_p1p1 t;
-    unsigned char ss[32];
-
-    // transform scalar as little-endian number
-    contract256_modm(ss, s);
-
-    // initialize r to identity, i.e. ge25519 (0, 1, 1, 0)
-    memset(r, 0, sizeof(ge25519));
-    r->y[0] = 1;
-    r->z[0] = 1;
-
-    // precompute multiples of P: 1.P, 2.P, ..., 15.P
-    ge25519_full_to_pniels(&mult[0], p);
-    for (int i = 1; i < 15; i++) {
-        ge25519_pnielsadd(&mult[i], p, &mult[i-1]);
-    }
-
-    // 4-bit fixed window, still 256 doublings but 64 additions
-    for (int i = 31; i >= 0; i--) {
-        // higher bits in ss[i]
-        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] >> 4);
-        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);
-        ge25519_p1p1_to_partial(r, &t);
-
-        ge25519_double_partial(r, r);
-        ge25519_double_partial(r, r);
-        ge25519_double_partial(r, r);
-        ge25519_double(r, r);
-
-        // lower bits in ss[i]
-        ed25519_point_scalarmul_w_choose_pniels(&pn, mult, ss[i] & 0x0F);
-        ge25519_pnielsadd_p1p1(&t, r, &pn, 0);
-        if (i > 0) {
-            ge25519_p1p1_to_partial(r, &t);
-
-            ge25519_double_partial(r, r);
-            ge25519_double_partial(r, r);
-            ge25519_double_partial(r, r);
-            ge25519_double(r, r);
-        } else {
-            ge25519_p1p1_to_full(r, &t);
-        }
-    }
-}
-
-void
-ED25519_FN(ed25519_base_double_scalarmul_vartime) (ge25519 *r, const bignum256modm s1, const ge25519 *p2, const bignum256modm s2) {
-    // computes [s1]basepoint + [s2]p2
-    ge25519_double_scalarmult_vartime(r, p2, s2, s1);
-}
-
-int
-ED25519_FN(ed25519_point_has_prime_order) (const ge25519 *p) {
-    static const bignum256modm sc_zero = {0};
-    ge25519 q;
-
-    // computes Q = m.P, vartime allowed because m is not secret
-    ED25519_FN(ed25519_base_double_scalarmul_vartime) (&q, sc_zero, p, modm_m);
-
-    return ED25519_FN(ed25519_point_is_identity) (&q);
-}
diff --git a/cbits/ed25519/ed25519-donna-batchverify.h b/cbits/ed25519/ed25519-donna-batchverify.h
--- a/cbits/ed25519/ed25519-donna-batchverify.h
+++ b/cbits/ed25519/ed25519-donna-batchverify.h
@@ -188,7 +188,7 @@
 }
 
 /* not actually used for anything other than testing */
-unsigned char batch_point_buffer[3][32];
+unsigned char crypton_batch_point_buffer[3][32];
 
 static int
 ge25519_is_neutral_vartime(const ge25519 *p) {
@@ -197,7 +197,7 @@
 	curve25519_contract(point_buffer[0], p->x);
 	curve25519_contract(point_buffer[1], p->y);
 	curve25519_contract(point_buffer[2], p->z);
-	memcpy(batch_point_buffer[1], point_buffer[1], 32);
+	memcpy(crypton_batch_point_buffer[1], point_buffer[1], 32);
 	return (memcmp(point_buffer[0], zero, 32) == 0) && (memcmp(point_buffer[1], point_buffer[2], 32) == 0);
 }
 
diff --git a/cbits/ed25519/ed25519-hash.h b/cbits/ed25519/ed25519-hash.h
--- a/cbits/ed25519/ed25519-hash.h
+++ b/cbits/ed25519/ed25519-hash.h
@@ -1,26 +1,26 @@
-#include <cryptonite_sha512.h>
+#include <crypton_sha512.h>
 typedef struct sha512_ctx ed25519_hash_context;
 
 static void
 ed25519_hash_init(ed25519_hash_context *ctx) {
-	cryptonite_sha512_init(ctx);
+	crypton_sha512_init(ctx);
 }
 
 static void
 ed25519_hash_update(ed25519_hash_context *ctx, const uint8_t *in, size_t inlen) {
-	cryptonite_sha512_update(ctx, in, inlen);
+	crypton_sha512_update(ctx, in, inlen);
 }
 
 static void
 ed25519_hash_final(ed25519_hash_context *ctx, uint8_t *hash) {
-	cryptonite_sha512_finalize(ctx, hash);
+	crypton_sha512_finalize(ctx, hash);
 }
 
 static void
 ed25519_hash(uint8_t *hash, const uint8_t *in, size_t inlen) {
 	ed25519_hash_context ctx;
-	cryptonite_sha512_init(&ctx);
-	cryptonite_sha512_update(&ctx, in, inlen);
-	cryptonite_sha512_finalize(&ctx, hash);
+	crypton_sha512_init(&ctx);
+	crypton_sha512_update(&ctx, in, inlen);
+	crypton_sha512_finalize(&ctx, hash);
 	memset(&ctx, 0, sizeof(ctx));
 }
diff --git a/cbits/ed25519/ed25519.c b/cbits/ed25519/ed25519.c
--- a/cbits/ed25519/ed25519.c
+++ b/cbits/ed25519/ed25519.c
@@ -5,13 +5,13 @@
 */
 
 
-#define ED25519_FN(fn)         cryptonite_##fn
+#define ED25519_FN(fn)         crypton_##fn
 
 #include "ed25519-donna.h"
 #include "ed25519.h"
 #include "ed25519-randombytes.h"
 #include "ed25519-hash.h"
-#include "ed25519-cryptonite-exts.h"
+#include "ed25519-crypton-exts.h"
 
 /*
 	Generates a (extsk[0..31]) and aExt (extsk[32..63])
diff --git a/cbits/ed25519/ed25519.h b/cbits/ed25519/ed25519.h
--- a/cbits/ed25519/ed25519.h
+++ b/cbits/ed25519/ed25519.h
@@ -13,11 +13,11 @@
 
 typedef unsigned char curved25519_key[32];
 
-void cryptonite_ed25519_publickey(const ed25519_secret_key sk, ed25519_public_key pk);
-int cryptonite_ed25519_sign_open(const unsigned char *m, size_t mlen, const ed25519_public_key pk, const ed25519_signature RS);
-void cryptonite_ed25519_sign(const unsigned char *m, size_t mlen, const ed25519_secret_key sk, const ed25519_public_key pk, ed25519_signature RS);
+void crypton_ed25519_publickey(const ed25519_secret_key sk, ed25519_public_key pk);
+int crypton_ed25519_sign_open(const unsigned char *m, size_t mlen, const ed25519_public_key pk, const ed25519_signature RS);
+void crypton_ed25519_sign(const unsigned char *m, size_t mlen, const ed25519_secret_key sk, const ed25519_public_key pk, ed25519_signature RS);
 
-//int cryptonite_ed25519_sign_open_batch(const unsigned char **m, size_t *mlen, const unsigned char **pk, const unsigned char **RS, size_t num, int *valid);
+//int crypton_ed25519_sign_open_batch(const unsigned char **m, size_t *mlen, const unsigned char **pk, const unsigned char **RS, size_t num, int *valid);
 
 //void ed25519_randombytes_unsafe(void *out, size_t count);
 
diff --git a/cbits/include32/p256/p256.h b/cbits/include32/p256/p256.h
--- a/cbits/include32/p256/p256.h
+++ b/cbits/include32/p256/p256.h
@@ -45,114 +45,114 @@
 
 #define P256_LITERAL(lo,hi) (lo), (hi)
 
-typedef int cryptonite_p256_err;
-typedef uint32_t cryptonite_p256_digit;
-typedef int32_t cryptonite_p256_sdigit;
-typedef uint64_t cryptonite_p256_ddigit;
-typedef int64_t cryptonite_p256_sddigit;
+typedef int crypton_p256_err;
+typedef uint32_t crypton_p256_digit;
+typedef int32_t crypton_p256_sdigit;
+typedef uint64_t crypton_p256_ddigit;
+typedef int64_t crypton_p256_sddigit;
 
-// Defining cryptonite_p256_int as struct to leverage struct assigment.
+// Defining crypton_p256_int as struct to leverage struct assigment.
 typedef struct {
-  cryptonite_p256_digit a[P256_NDIGITS];
-} cryptonite_p256_int;
+  crypton_p256_digit a[P256_NDIGITS];
+} crypton_p256_int;
 
-extern const cryptonite_p256_int cryptonite_SECP256r1_n;  // Curve order
-extern const cryptonite_p256_int cryptonite_SECP256r1_p;  // Curve prime
-extern const cryptonite_p256_int cryptonite_SECP256r1_b;  // Curve param
+extern const crypton_p256_int crypton_SECP256r1_n;  // Curve order
+extern const crypton_p256_int crypton_SECP256r1_p;  // Curve prime
+extern const crypton_p256_int crypton_SECP256r1_b;  // Curve param
 
-// Initialize a cryptonite_p256_int to zero.
-void cryptonite_p256_init(cryptonite_p256_int* a);
+// Initialize a crypton_p256_int to zero.
+void crypton_p256_init(crypton_p256_int* a);
 
-// Clear a cryptonite_p256_int to zero.
-void cryptonite_p256_clear(cryptonite_p256_int* a);
+// Clear a crypton_p256_int to zero.
+void crypton_p256_clear(crypton_p256_int* a);
 
 // Return bit. Index 0 is least significant.
-int cryptonite_p256_get_bit(const cryptonite_p256_int* a, int index);
+int crypton_p256_get_bit(const crypton_p256_int* a, int index);
 
 // b := a % MOD
-void cryptonite_p256_mod(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    cryptonite_p256_int* b);
+void crypton_p256_mod(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    crypton_p256_int* b);
 
 // c := a * (top_b | b) % MOD
-void cryptonite_p256_modmul(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    const cryptonite_p256_digit top_b,
-    const cryptonite_p256_int* b,
-    cryptonite_p256_int* c);
+void crypton_p256_modmul(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    const crypton_p256_digit top_b,
+    const crypton_p256_int* b,
+    crypton_p256_int* c);
 
 // b := 1 / a % MOD
 // MOD best be SECP256r1_n
-void cryptonite_p256_modinv(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    cryptonite_p256_int* b);
+void crypton_p256_modinv(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    crypton_p256_int* b);
 
 // b := 1 / a % MOD
 // MOD best be SECP256r1_n
-// Faster than cryptonite_p256_modinv()
-void cryptonite_p256_modinv_vartime(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    cryptonite_p256_int* b);
+// Faster than crypton_p256_modinv()
+void crypton_p256_modinv_vartime(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    crypton_p256_int* b);
 
 // b := a << (n % P256_BITSPERDIGIT)
 // Returns the bits shifted out of most significant digit.
-cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
+crypton_p256_digit crypton_p256_shl(const crypton_p256_int* a, int n, crypton_p256_int* b);
 
 // b := a >> (n % P256_BITSPERDIGIT)
-void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
+void crypton_p256_shr(const crypton_p256_int* a, int n, crypton_p256_int* b);
 
-int cryptonite_p256_is_zero(const cryptonite_p256_int* a);
-int cryptonite_p256_is_odd(const cryptonite_p256_int* a);
-int cryptonite_p256_is_even(const cryptonite_p256_int* a);
+int crypton_p256_is_zero(const crypton_p256_int* a);
+int crypton_p256_is_odd(const crypton_p256_int* a);
+int crypton_p256_is_even(const crypton_p256_int* a);
 
 // Returns -1, 0 or 1.
-int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int *b);
+int crypton_p256_cmp(const crypton_p256_int* a, const crypton_p256_int *b);
 
 // c: = a - b
 // Returns -1 on borrow.
-int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
+int crypton_p256_sub(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);
 
 // c := a + b
 // Returns 1 on carry.
-int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
+int crypton_p256_add(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);
 
 // c := a + (single digit)b
 // Returns carry 1 on carry.
-int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit b, cryptonite_p256_int* c);
+int crypton_p256_add_d(const crypton_p256_int* a, crypton_p256_digit b, crypton_p256_int* c);
 
 // ec routines.
 
 // {out_x,out_y} := nG
-void cryptonite_p256_base_point_mul(const cryptonite_p256_int *n,
-                         cryptonite_p256_int *out_x,
-                         cryptonite_p256_int *out_y);
+void crypton_p256_base_point_mul(const crypton_p256_int *n,
+                         crypton_p256_int *out_x,
+                         crypton_p256_int *out_y);
 
 // {out_x,out_y} := n{in_x,in_y}
-void cryptonite_p256_point_mul(const cryptonite_p256_int *n,
-                    const cryptonite_p256_int *in_x,
-                    const cryptonite_p256_int *in_y,
-                    cryptonite_p256_int *out_x,
-                    cryptonite_p256_int *out_y);
+void crypton_p256_point_mul(const crypton_p256_int *n,
+                    const crypton_p256_int *in_x,
+                    const crypton_p256_int *in_y,
+                    crypton_p256_int *out_x,
+                    crypton_p256_int *out_y);
 
 // {out_x,out_y} := n1G + n2{in_x,in_y}
-void cryptonite_p256_points_mul_vartime(
-    const cryptonite_p256_int *n1, const cryptonite_p256_int *n2,
-    const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,
-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y);
+void crypton_p256_points_mul_vartime(
+    const crypton_p256_int *n1, const crypton_p256_int *n2,
+    const crypton_p256_int *in_x, const crypton_p256_int *in_y,
+    crypton_p256_int *out_x, crypton_p256_int *out_y);
 
 // Return whether point {x,y} is on curve.
-int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y);
+int crypton_p256_is_valid_point(const crypton_p256_int* x, const crypton_p256_int* y);
 
 // Outputs big-endian binary form. No leading zero skips.
-void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES]);
+void crypton_p256_to_bin(const crypton_p256_int* src, uint8_t dst[P256_NBYTES]);
 
 // Reads from big-endian binary form,
 // thus pre-pad with leading zeros if short.
-void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst);
+void crypton_p256_from_bin(const uint8_t src[P256_NBYTES], crypton_p256_int* dst);
 
 #define P256_DIGITS(x) ((x)->a)
 #define P256_DIGIT(x,y) ((x)->a[y])
diff --git a/cbits/include32/p256/p256_gf.h b/cbits/include32/p256/p256_gf.h
--- a/cbits/include32/p256/p256_gf.h
+++ b/cbits/include32/p256/p256_gf.h
@@ -730,50 +730,50 @@
 
 #define kRInvDigits {0x80000000, 1, 0xffffffff, 0, 0x80000001, 0xfffffffe, 1, 0x7fffffff}  // 1 / 2^257 mod p256.p
 
-static const cryptonite_p256_int kR = { kRDigits };
-static const cryptonite_p256_int kRInv = { kRInvDigits };
+static const crypton_p256_int kR = { kRDigits };
+static const crypton_p256_int kRInv = { kRInvDigits };
 
 /* to_montgomery sets out = R*in. */
-static void to_montgomery(felem out, const cryptonite_p256_int* in) {
-  cryptonite_p256_int in_shifted;
+static void to_montgomery(felem out, const crypton_p256_int* in) {
+  crypton_p256_int in_shifted;
   int i;
 
-  cryptonite_p256_init(&in_shifted);
-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);
+  crypton_p256_init(&in_shifted);
+  crypton_p256_modmul(&crypton_SECP256r1_p, in, 0, &kR, &in_shifted);
 
   for (i = 0; i < NLIMBS; i++) {
     if ((i & 1) == 0) {
       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom29Bits;
-      cryptonite_p256_shr(&in_shifted, 29, &in_shifted);
+      crypton_p256_shr(&in_shifted, 29, &in_shifted);
     } else {
       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom28Bits;
-      cryptonite_p256_shr(&in_shifted, 28, &in_shifted);
+      crypton_p256_shr(&in_shifted, 28, &in_shifted);
     }
   }
 
-  cryptonite_p256_clear(&in_shifted);
+  crypton_p256_clear(&in_shifted);
 }
 
 /* from_montgomery sets out=in/R. */
-static void from_montgomery(cryptonite_p256_int* out, const felem in) {
-  cryptonite_p256_int result, tmp;
+static void from_montgomery(crypton_p256_int* out, const felem in) {
+  crypton_p256_int result, tmp;
   int i, top;
 
-  cryptonite_p256_init(&result);
-  cryptonite_p256_init(&tmp);
+  crypton_p256_init(&result);
+  crypton_p256_init(&tmp);
 
-  cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);
+  crypton_p256_add_d(&tmp, in[NLIMBS - 1], &result);
   for (i = NLIMBS - 2; i >= 0; i--) {
     if ((i & 1) == 0) {
-      top = cryptonite_p256_shl(&result, 29, &tmp);
+      top = crypton_p256_shl(&result, 29, &tmp);
     } else {
-      top = cryptonite_p256_shl(&result, 28, &tmp);
+      top = crypton_p256_shl(&result, 28, &tmp);
     }
-    top |= cryptonite_p256_add_d(&tmp, in[i], &result);
+    top |= crypton_p256_add_d(&tmp, in[i], &result);
   }
 
-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);
+  crypton_p256_modmul(&crypton_SECP256r1_p, &kRInv, top, &result, out);
 
-  cryptonite_p256_clear(&result);
-  cryptonite_p256_clear(&tmp);
+  crypton_p256_clear(&result);
+  crypton_p256_clear(&tmp);
 }
diff --git a/cbits/include64/p256/p256.h b/cbits/include64/p256/p256.h
--- a/cbits/include64/p256/p256.h
+++ b/cbits/include64/p256/p256.h
@@ -45,114 +45,114 @@
 
 #define P256_LITERAL(lo,hi) (((uint32_t) (lo)) + (((uint64_t) (hi)) << 32))
 
-typedef int cryptonite_p256_err;
-typedef uint64_t cryptonite_p256_digit;
-typedef int64_t cryptonite_p256_sdigit;
-typedef __uint128_t cryptonite_p256_ddigit;
-typedef __int128_t cryptonite_p256_sddigit;
+typedef int crypton_p256_err;
+typedef uint64_t crypton_p256_digit;
+typedef int64_t crypton_p256_sdigit;
+typedef __uint128_t crypton_p256_ddigit;
+typedef __int128_t crypton_p256_sddigit;
 
-// Defining cryptonite_p256_int as struct to leverage struct assigment.
+// Defining crypton_p256_int as struct to leverage struct assigment.
 typedef struct {
-  cryptonite_p256_digit a[P256_NDIGITS];
-} cryptonite_p256_int;
+  crypton_p256_digit a[P256_NDIGITS];
+} crypton_p256_int;
 
-extern const cryptonite_p256_int cryptonite_SECP256r1_n;  // Curve order
-extern const cryptonite_p256_int cryptonite_SECP256r1_p;  // Curve prime
-extern const cryptonite_p256_int cryptonite_SECP256r1_b;  // Curve param
+extern const crypton_p256_int crypton_SECP256r1_n;  // Curve order
+extern const crypton_p256_int crypton_SECP256r1_p;  // Curve prime
+extern const crypton_p256_int crypton_SECP256r1_b;  // Curve param
 
-// Initialize a cryptonite_p256_int to zero.
-void cryptonite_p256_init(cryptonite_p256_int* a);
+// Initialize a crypton_p256_int to zero.
+void crypton_p256_init(crypton_p256_int* a);
 
-// Clear a cryptonite_p256_int to zero.
-void cryptonite_p256_clear(cryptonite_p256_int* a);
+// Clear a crypton_p256_int to zero.
+void crypton_p256_clear(crypton_p256_int* a);
 
 // Return bit. Index 0 is least significant.
-int cryptonite_p256_get_bit(const cryptonite_p256_int* a, int index);
+int crypton_p256_get_bit(const crypton_p256_int* a, int index);
 
 // b := a % MOD
-void cryptonite_p256_mod(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    cryptonite_p256_int* b);
+void crypton_p256_mod(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    crypton_p256_int* b);
 
 // c := a * (top_b | b) % MOD
-void cryptonite_p256_modmul(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    const cryptonite_p256_digit top_b,
-    const cryptonite_p256_int* b,
-    cryptonite_p256_int* c);
+void crypton_p256_modmul(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    const crypton_p256_digit top_b,
+    const crypton_p256_int* b,
+    crypton_p256_int* c);
 
 // b := 1 / a % MOD
 // MOD best be SECP256r1_n
-void cryptonite_p256_modinv(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    cryptonite_p256_int* b);
+void crypton_p256_modinv(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    crypton_p256_int* b);
 
 // b := 1 / a % MOD
 // MOD best be SECP256r1_n
-// Faster than cryptonite_p256_modinv()
-void cryptonite_p256_modinv_vartime(
-    const cryptonite_p256_int* MOD,
-    const cryptonite_p256_int* a,
-    cryptonite_p256_int* b);
+// Faster than crypton_p256_modinv()
+void crypton_p256_modinv_vartime(
+    const crypton_p256_int* MOD,
+    const crypton_p256_int* a,
+    crypton_p256_int* b);
 
 // b := a << (n % P256_BITSPERDIGIT)
 // Returns the bits shifted out of most significant digit.
-cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
+crypton_p256_digit crypton_p256_shl(const crypton_p256_int* a, int n, crypton_p256_int* b);
 
 // b := a >> (n % P256_BITSPERDIGIT)
-void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b);
+void crypton_p256_shr(const crypton_p256_int* a, int n, crypton_p256_int* b);
 
-int cryptonite_p256_is_zero(const cryptonite_p256_int* a);
-int cryptonite_p256_is_odd(const cryptonite_p256_int* a);
-int cryptonite_p256_is_even(const cryptonite_p256_int* a);
+int crypton_p256_is_zero(const crypton_p256_int* a);
+int crypton_p256_is_odd(const crypton_p256_int* a);
+int crypton_p256_is_even(const crypton_p256_int* a);
 
 // Returns -1, 0 or 1.
-int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int *b);
+int crypton_p256_cmp(const crypton_p256_int* a, const crypton_p256_int *b);
 
 // c: = a - b
 // Returns -1 on borrow.
-int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
+int crypton_p256_sub(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);
 
 // c := a + b
 // Returns 1 on carry.
-int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c);
+int crypton_p256_add(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c);
 
 // c := a + (single digit)b
 // Returns carry 1 on carry.
-int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit b, cryptonite_p256_int* c);
+int crypton_p256_add_d(const crypton_p256_int* a, crypton_p256_digit b, crypton_p256_int* c);
 
 // ec routines.
 
 // {out_x,out_y} := nG
-void cryptonite_p256_base_point_mul(const cryptonite_p256_int *n,
-                         cryptonite_p256_int *out_x,
-                         cryptonite_p256_int *out_y);
+void crypton_p256_base_point_mul(const crypton_p256_int *n,
+                         crypton_p256_int *out_x,
+                         crypton_p256_int *out_y);
 
 // {out_x,out_y} := n{in_x,in_y}
-void cryptonite_p256_point_mul(const cryptonite_p256_int *n,
-                    const cryptonite_p256_int *in_x,
-                    const cryptonite_p256_int *in_y,
-                    cryptonite_p256_int *out_x,
-                    cryptonite_p256_int *out_y);
+void crypton_p256_point_mul(const crypton_p256_int *n,
+                    const crypton_p256_int *in_x,
+                    const crypton_p256_int *in_y,
+                    crypton_p256_int *out_x,
+                    crypton_p256_int *out_y);
 
 // {out_x,out_y} := n1G + n2{in_x,in_y}
-void cryptonite_p256_points_mul_vartime(
-    const cryptonite_p256_int *n1, const cryptonite_p256_int *n2,
-    const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,
-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y);
+void crypton_p256_points_mul_vartime(
+    const crypton_p256_int *n1, const crypton_p256_int *n2,
+    const crypton_p256_int *in_x, const crypton_p256_int *in_y,
+    crypton_p256_int *out_x, crypton_p256_int *out_y);
 
 // Return whether point {x,y} is on curve.
-int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y);
+int crypton_p256_is_valid_point(const crypton_p256_int* x, const crypton_p256_int* y);
 
 // Outputs big-endian binary form. No leading zero skips.
-void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES]);
+void crypton_p256_to_bin(const crypton_p256_int* src, uint8_t dst[P256_NBYTES]);
 
 // Reads from big-endian binary form,
 // thus pre-pad with leading zeros if short.
-void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst);
+void crypton_p256_from_bin(const uint8_t src[P256_NBYTES], crypton_p256_int* dst);
 
 #define P256_DIGITS(x) ((x)->a)
 #define P256_DIGIT(x,y) ((x)->a[y])
diff --git a/cbits/include64/p256/p256_gf.h b/cbits/include64/p256/p256_gf.h
--- a/cbits/include64/p256/p256_gf.h
+++ b/cbits/include64/p256/p256_gf.h
@@ -664,50 +664,50 @@
 
 #define kRInvDigits {0x180000000, 0xffffffff, 0xfffffffe80000001, 0x7fffffff00000001}  // 1 / 2^257 mod p256.p
 
-static const cryptonite_p256_int kR = { kRDigits };
-static const cryptonite_p256_int kRInv = { kRInvDigits };
+static const crypton_p256_int kR = { kRDigits };
+static const crypton_p256_int kRInv = { kRInvDigits };
 
 /* to_montgomery sets out = R*in. */
-static void to_montgomery(felem out, const cryptonite_p256_int* in) {
-  cryptonite_p256_int in_shifted;
+static void to_montgomery(felem out, const crypton_p256_int* in) {
+  crypton_p256_int in_shifted;
   int i;
 
-  cryptonite_p256_init(&in_shifted);
-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, in, 0, &kR, &in_shifted);
+  crypton_p256_init(&in_shifted);
+  crypton_p256_modmul(&crypton_SECP256r1_p, in, 0, &kR, &in_shifted);
 
   for (i = 0; i < NLIMBS; i++) {
     if ((i & 1) == 0) {
       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom51Bits;
-      cryptonite_p256_shr(&in_shifted, 51, &in_shifted);
+      crypton_p256_shr(&in_shifted, 51, &in_shifted);
     } else {
       out[i] = P256_DIGIT(&in_shifted, 0) & kBottom52Bits;
-      cryptonite_p256_shr(&in_shifted, 52, &in_shifted);
+      crypton_p256_shr(&in_shifted, 52, &in_shifted);
     }
   }
 
-  cryptonite_p256_clear(&in_shifted);
+  crypton_p256_clear(&in_shifted);
 }
 
 /* from_montgomery sets out=in/R. */
-static void from_montgomery(cryptonite_p256_int* out, const felem in) {
-  cryptonite_p256_int result, tmp;
+static void from_montgomery(crypton_p256_int* out, const felem in) {
+  crypton_p256_int result, tmp;
   int i, top;
 
-  cryptonite_p256_init(&result);
-  cryptonite_p256_init(&tmp);
+  crypton_p256_init(&result);
+  crypton_p256_init(&tmp);
 
-  cryptonite_p256_add_d(&tmp, in[NLIMBS - 1], &result);
+  crypton_p256_add_d(&tmp, in[NLIMBS - 1], &result);
   for (i = NLIMBS - 2; i >= 0; i--) {
     if ((i & 1) == 0) {
-      top = cryptonite_p256_shl(&result, 51, &tmp);
+      top = crypton_p256_shl(&result, 51, &tmp);
     } else {
-      top = cryptonite_p256_shl(&result, 52, &tmp);
+      top = crypton_p256_shl(&result, 52, &tmp);
     }
-    top += cryptonite_p256_add_d(&tmp, in[i], &result);
+    top += crypton_p256_add_d(&tmp, in[i], &result);
   }
 
-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, &kRInv, top, &result, out);
+  crypton_p256_modmul(&crypton_SECP256r1_p, &kRInv, top, &result, out);
 
-  cryptonite_p256_clear(&result);
-  cryptonite_p256_clear(&tmp);
+  crypton_p256_clear(&result);
+  crypton_p256_clear(&tmp);
 }
diff --git a/cbits/p256/p256.c b/cbits/p256/p256.c
--- a/cbits/p256/p256.c
+++ b/cbits/p256/p256.c
@@ -39,31 +39,31 @@
 
 #include "p256/p256.h"
 
-const cryptonite_p256_int cryptonite_SECP256r1_n =  // curve order
+const crypton_p256_int crypton_SECP256r1_n =  // curve order
   {{P256_LITERAL(0xfc632551, 0xf3b9cac2), P256_LITERAL(0xa7179e84, 0xbce6faad),
     P256_LITERAL(-1, -1), P256_LITERAL(0, -1)}};
 
-const cryptonite_p256_int cryptonite_SECP256r1_p =  // curve field size
+const crypton_p256_int crypton_SECP256r1_p =  // curve field size
   {{P256_LITERAL(-1, -1), P256_LITERAL(-1, 0),
     P256_LITERAL(0, 0), P256_LITERAL(1, -1) }};
 
-const cryptonite_p256_int cryptonite_SECP256r1_b =  // curve b
+const crypton_p256_int crypton_SECP256r1_b =  // curve b
   {{P256_LITERAL(0x27d2604b, 0x3bce3c3e), P256_LITERAL(0xcc53b0f6, 0x651d06b0),
     P256_LITERAL(0x769886bc, 0xb3ebbd55), P256_LITERAL(0xaa3a93e7, 0x5ac635d8)}};
 
-void cryptonite_p256_init(cryptonite_p256_int* a) {
+void crypton_p256_init(crypton_p256_int* a) {
   memset(a, 0, sizeof(*a));
 }
 
-void cryptonite_p256_clear(cryptonite_p256_int* a) { cryptonite_p256_init(a); }
+void crypton_p256_clear(crypton_p256_int* a) { crypton_p256_init(a); }
 
-int cryptonite_p256_get_bit(const cryptonite_p256_int* scalar, int bit) {
+int crypton_p256_get_bit(const crypton_p256_int* scalar, int bit) {
   return (P256_DIGIT(scalar, bit / P256_BITSPERDIGIT)
               >> (bit & (P256_BITSPERDIGIT - 1))) & 1;
 }
 
-int cryptonite_p256_is_zero(const cryptonite_p256_int* a) {
-  cryptonite_p256_digit result = 0;
+int crypton_p256_is_zero(const crypton_p256_int* a) {
+  crypton_p256_digit result = 0;
   int i = 0;
   for (i = 0; i < P256_NDIGITS; ++i) result |= P256_DIGIT(a, i);
   return result == 0;
@@ -71,85 +71,85 @@
 
 // top, c[] += a[] * b
 // Returns new top
-static cryptonite_p256_digit mulAdd(const cryptonite_p256_int* a,
-                         cryptonite_p256_digit b,
-                         cryptonite_p256_digit top,
-                         cryptonite_p256_digit* c) {
+static crypton_p256_digit mulAdd(const crypton_p256_int* a,
+                         crypton_p256_digit b,
+                         crypton_p256_digit top,
+                         crypton_p256_digit* c) {
   int i;
-  cryptonite_p256_ddigit carry = 0;
+  crypton_p256_ddigit carry = 0;
 
   for (i = 0; i < P256_NDIGITS; ++i) {
     carry += *c;
-    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i) * b;
-    *c++ = (cryptonite_p256_digit)carry;
+    carry += (crypton_p256_ddigit)P256_DIGIT(a, i) * b;
+    *c++ = (crypton_p256_digit)carry;
     carry >>= P256_BITSPERDIGIT;
   }
-  return top + (cryptonite_p256_digit)carry;
+  return top + (crypton_p256_digit)carry;
 }
 
 // top, c[] -= top_a, a[]
-static cryptonite_p256_digit subTop(cryptonite_p256_digit top_a,
-                         const cryptonite_p256_digit* a,
-                         cryptonite_p256_digit top_c,
-                         cryptonite_p256_digit* c) {
+static crypton_p256_digit subTop(crypton_p256_digit top_a,
+                         const crypton_p256_digit* a,
+                         crypton_p256_digit top_c,
+                         crypton_p256_digit* c) {
   int i;
-  cryptonite_p256_sddigit borrow = 0;
+  crypton_p256_sddigit borrow = 0;
 
   for (i = 0; i < P256_NDIGITS; ++i) {
     borrow += *c;
     borrow -= *a++;
-    *c++ = (cryptonite_p256_digit)borrow;
+    *c++ = (crypton_p256_digit)borrow;
     borrow >>= P256_BITSPERDIGIT;
   }
   borrow += top_c;
   borrow -= top_a;
-  top_c = (cryptonite_p256_digit)borrow;
+  top_c = (crypton_p256_digit)borrow;
   assert((borrow >> P256_BITSPERDIGIT) == 0);
   return top_c;
 }
 
 // top, c[] -= MOD[] & mask (0 or -1)
 // returns new top.
-static cryptonite_p256_digit subM(const cryptonite_p256_int* MOD,
-                       cryptonite_p256_digit top,
-                       cryptonite_p256_digit* c,
-                       cryptonite_p256_digit mask) {
+static crypton_p256_digit subM(const crypton_p256_int* MOD,
+                       crypton_p256_digit top,
+                       crypton_p256_digit* c,
+                       crypton_p256_digit mask) {
   int i;
-  cryptonite_p256_sddigit borrow = 0;
+  crypton_p256_sddigit borrow = 0;
   for (i = 0; i < P256_NDIGITS; ++i) {
     borrow += *c;
     borrow -= P256_DIGIT(MOD, i) & mask;
-    *c++ = (cryptonite_p256_digit)borrow;
+    *c++ = (crypton_p256_digit)borrow;
     borrow >>= P256_BITSPERDIGIT;
   }
-  return top + (cryptonite_p256_digit)borrow;
+  return top + (crypton_p256_digit)borrow;
 }
 
 // top, c[] += MOD[] & mask (0 or -1)
 // returns new top.
-static cryptonite_p256_digit addM(const cryptonite_p256_int* MOD,
-                       cryptonite_p256_digit top,
-                       cryptonite_p256_digit* c,
-                       cryptonite_p256_digit mask) {
+static crypton_p256_digit addM(const crypton_p256_int* MOD,
+                       crypton_p256_digit top,
+                       crypton_p256_digit* c,
+                       crypton_p256_digit mask) {
   int i;
-  cryptonite_p256_ddigit carry = 0;
+  crypton_p256_ddigit carry = 0;
   for (i = 0; i < P256_NDIGITS; ++i) {
     carry += *c;
     carry += P256_DIGIT(MOD, i) & mask;
-    *c++ = (cryptonite_p256_digit)carry;
+    *c++ = (crypton_p256_digit)carry;
     carry >>= P256_BITSPERDIGIT;
   }
-  return top + (cryptonite_p256_digit)carry;
+  return top + (crypton_p256_digit)carry;
 }
 
 // c = a * b mod MOD. c can be a and/or b.
-void cryptonite_p256_modmul(const cryptonite_p256_int* MOD,
-                 const cryptonite_p256_int* a,
-                 const cryptonite_p256_digit top_b,
-                 const cryptonite_p256_int* b,
-                 cryptonite_p256_int* c) {
-  cryptonite_p256_digit tmp[P256_NDIGITS * 2 + 1] = { 0 };
-  cryptonite_p256_digit top = 0;
+void crypton_p256_modmul(const crypton_p256_int* MOD,
+                 const crypton_p256_int* a,
+                 const crypton_p256_digit top_b,
+                 const crypton_p256_int* b,
+                 crypton_p256_int* c) {
+  crypton_p256_digit tmp[P256_NDIGITS * 2 + 1] = { 0 };
+  crypton_p256_digit top = 0;
   int i;
 
   // Multiply/add into tmp.
@@ -164,8 +164,8 @@
 
   // Reduce tmp, digit by digit.
   for (; i >= 0; --i) {
-    cryptonite_p256_digit reducer[P256_NDIGITS] = { 0 };
-    cryptonite_p256_digit top_reducer;
+    crypton_p256_digit reducer[P256_NDIGITS] = { 0 };
+    crypton_p256_digit top_reducer;
 
     // top can be any value at this point.
     // Guestimate reducer as top * MOD, since msw of MOD is -1.
@@ -195,198 +195,198 @@
 
   memcpy(c, tmp, P256_NBYTES);
 }
-int cryptonite_p256_is_odd(const cryptonite_p256_int* a) { return P256_DIGIT(a, 0) & 1; }
-int cryptonite_p256_is_even(const cryptonite_p256_int* a) { return !(P256_DIGIT(a, 0) & 1); }
+int crypton_p256_is_odd(const crypton_p256_int* a) { return P256_DIGIT(a, 0) & 1; }
+int crypton_p256_is_even(const crypton_p256_int* a) { return !(P256_DIGIT(a, 0) & 1); }
 
-cryptonite_p256_digit cryptonite_p256_shl(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b) {
+crypton_p256_digit crypton_p256_shl(const crypton_p256_int* a, int n, crypton_p256_int* b) {
   int i;
-  cryptonite_p256_digit top = P256_DIGIT(a, P256_NDIGITS - 1);
+  crypton_p256_digit top = P256_DIGIT(a, P256_NDIGITS - 1);
 
   n %= P256_BITSPERDIGIT;
   for (i = P256_NDIGITS - 1; i > 0; --i) {
-    cryptonite_p256_digit accu = (P256_DIGIT(a, i) << n);
+    crypton_p256_digit accu = (P256_DIGIT(a, i) << n);
     accu |= (P256_DIGIT(a, i - 1) >> (P256_BITSPERDIGIT - n));
     P256_DIGIT(b, i) = accu;
   }
   P256_DIGIT(b, i) = (P256_DIGIT(a, i) << n);
 
-  top = (cryptonite_p256_digit)((((cryptonite_p256_ddigit)top) << n) >> P256_BITSPERDIGIT);
+  top = (crypton_p256_digit)((((crypton_p256_ddigit)top) << n) >> P256_BITSPERDIGIT);
 
   return top;
 }
 
-void cryptonite_p256_shr(const cryptonite_p256_int* a, int n, cryptonite_p256_int* b) {
+void crypton_p256_shr(const crypton_p256_int* a, int n, crypton_p256_int* b) {
   int i;
 
   n %= P256_BITSPERDIGIT;
   for (i = 0; i < P256_NDIGITS - 1; ++i) {
-    cryptonite_p256_digit accu = (P256_DIGIT(a, i) >> n);
+    crypton_p256_digit accu = (P256_DIGIT(a, i) >> n);
     accu |= (P256_DIGIT(a, i + 1) << (P256_BITSPERDIGIT - n));
     P256_DIGIT(b, i) = accu;
   }
   P256_DIGIT(b, i) = (P256_DIGIT(a, i) >> n);
 }
 
-static void cryptonite_p256_shr1(const cryptonite_p256_int* a, int highbit, cryptonite_p256_int* b) {
+static void crypton_p256_shr1(const crypton_p256_int* a, int highbit, crypton_p256_int* b) {
   int i;
 
   for (i = 0; i < P256_NDIGITS - 1; ++i) {
-    cryptonite_p256_digit accu = (P256_DIGIT(a, i) >> 1);
+    crypton_p256_digit accu = (P256_DIGIT(a, i) >> 1);
     accu |= (P256_DIGIT(a, i + 1) << (P256_BITSPERDIGIT - 1));
     P256_DIGIT(b, i) = accu;
   }
   P256_DIGIT(b, i) = (P256_DIGIT(a, i) >> 1) |
-      (((cryptonite_p256_sdigit) highbit) << (P256_BITSPERDIGIT - 1));
+      (((crypton_p256_sdigit) highbit) << (P256_BITSPERDIGIT - 1));
 }
 
 // Return -1, 0, 1 for a < b, a == b or a > b respectively.
-int cryptonite_p256_cmp(const cryptonite_p256_int* a, const cryptonite_p256_int* b) {
+int crypton_p256_cmp(const crypton_p256_int* a, const crypton_p256_int* b) {
   int i;
-  cryptonite_p256_sddigit borrow = 0;
-  cryptonite_p256_digit notzero = 0;
+  crypton_p256_sddigit borrow = 0;
+  crypton_p256_digit notzero = 0;
 
   for (i = 0; i < P256_NDIGITS; ++i) {
-    borrow += (cryptonite_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);
+    borrow += (crypton_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);
     // Track whether any result digit is ever not zero.
     // Relies on !!(non-zero) evaluating to 1, e.g., !!(-1) evaluating to 1.
-    notzero |= !!((cryptonite_p256_digit)borrow);
+    notzero |= !!((crypton_p256_digit)borrow);
     borrow >>= P256_BITSPERDIGIT;
   }
   return (int)borrow | notzero;
 }
 
 // c = a - b. Returns borrow: 0 or -1.
-int cryptonite_p256_sub(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {
+int crypton_p256_sub(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {
   int i;
-  cryptonite_p256_sddigit borrow = 0;
+  crypton_p256_sddigit borrow = 0;
 
   for (i = 0; i < P256_NDIGITS; ++i) {
-    borrow += (cryptonite_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);
-    if (c) P256_DIGIT(c, i) = (cryptonite_p256_digit)borrow;
+    borrow += (crypton_p256_sddigit)P256_DIGIT(a, i) - P256_DIGIT(b, i);
+    if (c) P256_DIGIT(c, i) = (crypton_p256_digit)borrow;
     borrow >>= P256_BITSPERDIGIT;
   }
   return (int)borrow;
 }
 
 // c = a + b. Returns carry: 0 or 1.
-int cryptonite_p256_add(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {
+int crypton_p256_add(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {
   int i;
-  cryptonite_p256_ddigit carry = 0;
+  crypton_p256_ddigit carry = 0;
 
   for (i = 0; i < P256_NDIGITS; ++i) {
-    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i) + P256_DIGIT(b, i);
-    if (c) P256_DIGIT(c, i) = (cryptonite_p256_digit)carry;
+    carry += (crypton_p256_ddigit)P256_DIGIT(a, i) + P256_DIGIT(b, i);
+    if (c) P256_DIGIT(c, i) = (crypton_p256_digit)carry;
     carry >>= P256_BITSPERDIGIT;
   }
   return (int)carry;
 }
 
 // b = a + d. Returns carry, 0 or 1.
-int cryptonite_p256_add_d(const cryptonite_p256_int* a, cryptonite_p256_digit d, cryptonite_p256_int* b) {
+int crypton_p256_add_d(const crypton_p256_int* a, crypton_p256_digit d, crypton_p256_int* b) {
   int i;
-  cryptonite_p256_ddigit carry = d;
+  crypton_p256_ddigit carry = d;
 
   for (i = 0; i < P256_NDIGITS; ++i) {
-    carry += (cryptonite_p256_ddigit)P256_DIGIT(a, i);
-    if (b) P256_DIGIT(b, i) = (cryptonite_p256_digit)carry;
+    carry += (crypton_p256_ddigit)P256_DIGIT(a, i);
+    if (b) P256_DIGIT(b, i) = (crypton_p256_digit)carry;
     carry >>= P256_BITSPERDIGIT;
   }
   return (int)carry;
 }
 
 // b = 1/a mod MOD, binary euclid.
-void cryptonite_p256_modinv_vartime(const cryptonite_p256_int* MOD,
-                         const cryptonite_p256_int* a,
-                         cryptonite_p256_int* b) {
-  cryptonite_p256_int R = P256_ZERO;
-  cryptonite_p256_int S = P256_ONE;
-  cryptonite_p256_int U = *MOD;
-  cryptonite_p256_int V = *a;
+void crypton_p256_modinv_vartime(const crypton_p256_int* MOD,
+                         const crypton_p256_int* a,
+                         crypton_p256_int* b) {
+  crypton_p256_int R = P256_ZERO;
+  crypton_p256_int S = P256_ONE;
+  crypton_p256_int U = *MOD;
+  crypton_p256_int V = *a;
 
   for (;;) {
-    if (cryptonite_p256_is_even(&U)) {
-      cryptonite_p256_shr1(&U, 0, &U);
-      if (cryptonite_p256_is_even(&R)) {
-        cryptonite_p256_shr1(&R, 0, &R);
+    if (crypton_p256_is_even(&U)) {
+      crypton_p256_shr1(&U, 0, &U);
+      if (crypton_p256_is_even(&R)) {
+        crypton_p256_shr1(&R, 0, &R);
       } else {
         // R = (R+MOD)/2
-        cryptonite_p256_shr1(&R, cryptonite_p256_add(&R, MOD, &R), &R);
+        crypton_p256_shr1(&R, crypton_p256_add(&R, MOD, &R), &R);
       }
-    } else if (cryptonite_p256_is_even(&V)) {
-      cryptonite_p256_shr1(&V, 0, &V);
-      if (cryptonite_p256_is_even(&S)) {
-        cryptonite_p256_shr1(&S, 0, &S);
+    } else if (crypton_p256_is_even(&V)) {
+      crypton_p256_shr1(&V, 0, &V);
+      if (crypton_p256_is_even(&S)) {
+        crypton_p256_shr1(&S, 0, &S);
       } else {
         // S = (S+MOD)/2
-        cryptonite_p256_shr1(&S, cryptonite_p256_add(&S, MOD, &S) , &S);
+        crypton_p256_shr1(&S, crypton_p256_add(&S, MOD, &S) , &S);
       }
     } else {  // U,V both odd.
-      if (!cryptonite_p256_sub(&V, &U, NULL)) {
-        cryptonite_p256_sub(&V, &U, &V);
-        if (cryptonite_p256_sub(&S, &R, &S)) cryptonite_p256_add(&S, MOD, &S);
-        if (cryptonite_p256_is_zero(&V)) break;  // done.
+      if (!crypton_p256_sub(&V, &U, NULL)) {
+        crypton_p256_sub(&V, &U, &V);
+        if (crypton_p256_sub(&S, &R, &S)) crypton_p256_add(&S, MOD, &S);
+        if (crypton_p256_is_zero(&V)) break;  // done.
       } else {
-        cryptonite_p256_sub(&U, &V, &U);
-        if (cryptonite_p256_sub(&R, &S, &R)) cryptonite_p256_add(&R, MOD, &R);
+        crypton_p256_sub(&U, &V, &U);
+        if (crypton_p256_sub(&R, &S, &R)) crypton_p256_add(&R, MOD, &R);
       }
     }
   }
 
-  cryptonite_p256_mod(MOD, &R, b);
+  crypton_p256_mod(MOD, &R, b);
 }
 
-void cryptonite_p256_mod(const cryptonite_p256_int* MOD,
-              const cryptonite_p256_int* in,
-              cryptonite_p256_int* out) {
+void crypton_p256_mod(const crypton_p256_int* MOD,
+              const crypton_p256_int* in,
+              crypton_p256_int* out) {
   if (out != in) *out = *in;
   addM(MOD, 0, P256_DIGITS(out), subM(MOD, 0, P256_DIGITS(out), -1));
 }
 
 // Verify y^2 == x^3 - 3x + b mod p
 // and 0 < x < p and 0 < y < p
-int cryptonite_p256_is_valid_point(const cryptonite_p256_int* x, const cryptonite_p256_int* y) {
-  cryptonite_p256_int y2, x3;
+int crypton_p256_is_valid_point(const crypton_p256_int* x, const crypton_p256_int* y) {
+  crypton_p256_int y2, x3;
 
-  if (cryptonite_p256_cmp(&cryptonite_SECP256r1_p, x) <= 0 ||
-      cryptonite_p256_cmp(&cryptonite_SECP256r1_p, y) <= 0 ||
-      cryptonite_p256_is_zero(x) ||
-      cryptonite_p256_is_zero(y)) return 0;
+  if (crypton_p256_cmp(&crypton_SECP256r1_p, x) <= 0 ||
+      crypton_p256_cmp(&crypton_SECP256r1_p, y) <= 0 ||
+      crypton_p256_is_zero(x) ||
+      crypton_p256_is_zero(y)) return 0;
 
-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, y, 0, y, &y2);  // y^2
+  crypton_p256_modmul(&crypton_SECP256r1_p, y, 0, y, &y2);  // y^2
 
-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, x, 0, x, &x3);  // x^2
-  cryptonite_p256_modmul(&cryptonite_SECP256r1_p, x, 0, &x3, &x3);  // x^3
-  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - x
-  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - 2x
-  if (cryptonite_p256_sub(&x3, x, &x3)) cryptonite_p256_add(&x3, &cryptonite_SECP256r1_p, &x3);  // x^3 - 3x
-  if (cryptonite_p256_add(&x3, &cryptonite_SECP256r1_b, &x3))  // x^3 - 3x + b
-    cryptonite_p256_sub(&x3, &cryptonite_SECP256r1_p, &x3);
+  crypton_p256_modmul(&crypton_SECP256r1_p, x, 0, x, &x3);  // x^2
+  crypton_p256_modmul(&crypton_SECP256r1_p, x, 0, &x3, &x3);  // x^3
+  if (crypton_p256_sub(&x3, x, &x3)) crypton_p256_add(&x3, &crypton_SECP256r1_p, &x3);  // x^3 - x
+  if (crypton_p256_sub(&x3, x, &x3)) crypton_p256_add(&x3, &crypton_SECP256r1_p, &x3);  // x^3 - 2x
+  if (crypton_p256_sub(&x3, x, &x3)) crypton_p256_add(&x3, &crypton_SECP256r1_p, &x3);  // x^3 - 3x
+  if (crypton_p256_add(&x3, &crypton_SECP256r1_b, &x3))  // x^3 - 3x + b
+    crypton_p256_sub(&x3, &crypton_SECP256r1_p, &x3);
 
-  return cryptonite_p256_cmp(&y2, &x3) == 0;
+  return crypton_p256_cmp(&y2, &x3) == 0;
 }
 
-void cryptonite_p256_from_bin(const uint8_t src[P256_NBYTES], cryptonite_p256_int* dst) {
+void crypton_p256_from_bin(const uint8_t src[P256_NBYTES], crypton_p256_int* dst) {
   int i, n;
   const uint8_t* p = &src[0];
 
   for (i = P256_NDIGITS - 1; i >= 0; --i) {
-    cryptonite_p256_digit dig = 0;
+    crypton_p256_digit dig = 0;
     n = P256_BITSPERDIGIT;
     while (n > 0) {
       n -= 8;
-      dig |= ((cryptonite_p256_digit) *(p++)) << n;
+      dig |= ((crypton_p256_digit) *(p++)) << n;
     }
     P256_DIGIT(dst, i) = dig;
   }
 }
 
-void cryptonite_p256_to_bin(const cryptonite_p256_int* src, uint8_t dst[P256_NBYTES])
+void crypton_p256_to_bin(const crypton_p256_int* src, uint8_t dst[P256_NBYTES])
 {
 	int i, n;
 	uint8_t* p = &dst[0];
 
 	for (i = P256_NDIGITS -1; i >= 0; --i) {
-		const cryptonite_p256_digit dig = P256_DIGIT(src, i);
+		const crypton_p256_digit dig = P256_DIGIT(src, i);
 		n = P256_BITSPERDIGIT;
 		while (n > 0) {
 			n -= 8;
@@ -402,49 +402,49 @@
 #define MSB_COMPLEMENT(x) (((x) >> (P256_BITSPERDIGIT - 1)) - 1)
 
 // c = a + b mod MOD
-void cryptonite_p256e_modadd(const cryptonite_p256_int* MOD, const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {
-  assert(c);  /* avoid repeated checks inside inlined cryptonite_p256_add */
-  cryptonite_p256_digit top = cryptonite_p256_add(a, b, c);
+void crypton_p256e_modadd(const crypton_p256_int* MOD, const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {
+  assert(c);  /* avoid repeated checks inside inlined crypton_p256_add */
+  crypton_p256_digit top = crypton_p256_add(a, b, c);
   top = subM(MOD, top, P256_DIGITS(c), -1);
   top = subM(MOD, top, P256_DIGITS(c), MSB_COMPLEMENT(top));
   addM(MOD, 0, P256_DIGITS(c), top);
 }
 
 // c = a - b mod MOD
-void cryptonite_p256e_modsub(const cryptonite_p256_int* MOD, const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {
-  assert(c); /* avoid repeated checks inside inlined cryptonite_p256_sub */
-  cryptonite_p256_digit top = cryptonite_p256_sub(a, b, c);
+void crypton_p256e_modsub(const crypton_p256_int* MOD, const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {
+  assert(c); /* avoid repeated checks inside inlined crypton_p256_sub */
+  crypton_p256_digit top = crypton_p256_sub(a, b, c);
   top = addM(MOD, top, P256_DIGITS(c), ~MSB_COMPLEMENT(top));
   top = subM(MOD, top, P256_DIGITS(c), MSB_COMPLEMENT(top));
   addM(MOD, 0, P256_DIGITS(c), top);
 }
 
 #define NTH_DOUBLE_THEN_ADD(i, a, nth, b, out)   \
-    cryptonite_p256e_montmul(a, a, out);         \
+    crypton_p256e_montmul(a, a, out);         \
     for (i = 1; i < nth; i++)                    \
-        cryptonite_p256e_montmul(out, out, out); \
-    cryptonite_p256e_montmul(out, b, out);
+        crypton_p256e_montmul(out, out, out); \
+    crypton_p256e_montmul(out, b, out);
 
-const cryptonite_p256_int cryptonite_SECP256r1_r2 = // r^2 mod n
+const crypton_p256_int crypton_SECP256r1_r2 = // r^2 mod n
   {{P256_LITERAL(0xBE79EEA2, 0x83244C95), P256_LITERAL(0x49BD6FA6, 0x4699799C),
     P256_LITERAL(0x2B6BEC59, 0x2845B239), P256_LITERAL(0xF3D95620, 0x66E12D94)}};
 
-const cryptonite_p256_int cryptonite_SECP256r1_one = {{1}};
+const crypton_p256_int crypton_SECP256r1_one = {{1}};
 
 // Montgomery multiplication, i.e. c = ab/r mod n with r = 2^256.
 // Implementation is adapted from 'sc_montmul' in libdecaf.
-static void cryptonite_p256e_montmul(const cryptonite_p256_int* a, const cryptonite_p256_int* b, cryptonite_p256_int* c) {
+static void crypton_p256e_montmul(const crypton_p256_int* a, const crypton_p256_int* b, crypton_p256_int* c) {
   int i, j, borrow;
-  cryptonite_p256_digit accum[P256_NDIGITS+1] = {0};
-  cryptonite_p256_digit hi_carry = 0;
+  crypton_p256_digit accum[P256_NDIGITS+1] = {0};
+  crypton_p256_digit hi_carry = 0;
 
   for (i=0; i<P256_NDIGITS; i++) {
-    cryptonite_p256_digit mand = P256_DIGIT(a, i);
-    const cryptonite_p256_digit *mier = P256_DIGITS(b);
+    crypton_p256_digit mand = P256_DIGIT(a, i);
+    const crypton_p256_digit *mier = P256_DIGITS(b);
 
-    cryptonite_p256_ddigit chain = 0;
+    crypton_p256_ddigit chain = 0;
     for (j=0; j<P256_NDIGITS; j++) {
-      chain += ((cryptonite_p256_ddigit)mand)*mier[j] + accum[j];
+      chain += ((crypton_p256_ddigit)mand)*mier[j] + accum[j];
       accum[j] = chain;
       chain >>= P256_BITSPERDIGIT;
     }
@@ -452,9 +452,9 @@
 
     mand = accum[0] * P256_MONTGOMERY_FACTOR;
     chain = 0;
-    mier = P256_DIGITS(&cryptonite_SECP256r1_n);
+    mier = P256_DIGITS(&crypton_SECP256r1_n);
     for (j=0; j<P256_NDIGITS; j++) {
-      chain += (cryptonite_p256_ddigit)mand*mier[j] + accum[j];
+      chain += (crypton_p256_ddigit)mand*mier[j] + accum[j];
       if (j) accum[j-1] = chain;
       chain >>= P256_BITSPERDIGIT;
     }
@@ -465,31 +465,31 @@
   }
 
   memcpy(P256_DIGITS(c), accum, sizeof(*c));
-  borrow = cryptonite_p256_sub(c, &cryptonite_SECP256r1_n, c);
-  addM(&cryptonite_SECP256r1_n, 0, P256_DIGITS(c), borrow + hi_carry);
+  borrow = crypton_p256_sub(c, &crypton_SECP256r1_n, c);
+  addM(&crypton_SECP256r1_n, 0, P256_DIGITS(c), borrow + hi_carry);
 }
 
 // b = 1/a mod n, using Fermat's little theorem.
-void cryptonite_p256e_scalar_invert(const cryptonite_p256_int* a, cryptonite_p256_int* b) {
-  cryptonite_p256_int _1, _10, _11, _101, _111, _1010, _1111;
-  cryptonite_p256_int _10101, _101010, _101111, x6, x8, x16, x32;
+void crypton_p256e_scalar_invert(const crypton_p256_int* a, crypton_p256_int* b) {
+  crypton_p256_int _1, _10, _11, _101, _111, _1010, _1111;
+  crypton_p256_int _10101, _101010, _101111, x6, x8, x16, x32;
   int i;
 
   // Montgomerize
-  cryptonite_p256e_montmul(a, &cryptonite_SECP256r1_r2, &_1);
+  crypton_p256e_montmul(a, &crypton_SECP256r1_r2, &_1);
 
   // P-256 (secp256r1) Scalar Inversion
   // <https://briansmith.org/ecc-inversion-addition-chains-01>
-  cryptonite_p256e_montmul(&_1     , &_1     , &_10);
-  cryptonite_p256e_montmul(&_10    , &_1     , &_11);
-  cryptonite_p256e_montmul(&_10    , &_11    , &_101);
-  cryptonite_p256e_montmul(&_10    , &_101   , &_111);
-  cryptonite_p256e_montmul(&_101   , &_101   , &_1010);
-  cryptonite_p256e_montmul(&_101   , &_1010  , &_1111);
+  crypton_p256e_montmul(&_1     , &_1     , &_10);
+  crypton_p256e_montmul(&_10    , &_1     , &_11);
+  crypton_p256e_montmul(&_10    , &_11    , &_101);
+  crypton_p256e_montmul(&_10    , &_101   , &_111);
+  crypton_p256e_montmul(&_101   , &_101   , &_1010);
+  crypton_p256e_montmul(&_101   , &_1010  , &_1111);
   NTH_DOUBLE_THEN_ADD(i, &_1010,  1   , &_1     , &_10101);
-  cryptonite_p256e_montmul(&_10101 , &_10101 , &_101010);
-  cryptonite_p256e_montmul(&_101   , &_101010, &_101111);
-  cryptonite_p256e_montmul(&_10101 , &_101010, &x6);
+  crypton_p256e_montmul(&_10101 , &_10101 , &_101010);
+  crypton_p256e_montmul(&_101   , &_101010, &_101111);
+  crypton_p256e_montmul(&_10101 , &_101010, &x6);
   NTH_DOUBLE_THEN_ADD(i, &x6   ,  2   , &_11    , &x8);
   NTH_DOUBLE_THEN_ADD(i, &x8   ,  8   , &x8     , &x16);
   NTH_DOUBLE_THEN_ADD(i, &x16  , 16   , &x16    , &x32);
@@ -524,5 +524,5 @@
   NTH_DOUBLE_THEN_ADD(i, b     , 2 + 4, &_1111  , b);
 
   // Demontgomerize
-  cryptonite_p256e_montmul(b, &cryptonite_SECP256r1_one, b);
+  crypton_p256e_montmul(b, &crypton_SECP256r1_one, b);
 }
diff --git a/cbits/p256/p256_ec.c b/cbits/p256/p256_ec.c
--- a/cbits/p256/p256_ec.c
+++ b/cbits/p256/p256_ec.c
@@ -358,7 +358,7 @@
  * number. Note that the value of scalar must be less than the order of the
  * group. */
 static void scalar_base_mult(felem nx, felem ny, felem nz,
-                             const cryptonite_p256_int* scalar) {
+                             const crypton_p256_int* scalar) {
   int i, j;
   limb n_is_infinity_mask = -1, p_is_noninfinite_mask, mask;
   u32 table_offset;
@@ -378,10 +378,10 @@
     }
     table_offset = 0;
     for (j = 0; j <= 32; j += 32) {
-      char bit0 = cryptonite_p256_get_bit(scalar, 31 - i + j);
-      char bit1 = cryptonite_p256_get_bit(scalar, 95 - i + j);
-      char bit2 = cryptonite_p256_get_bit(scalar, 159 - i + j);
-      char bit3 = cryptonite_p256_get_bit(scalar, 223 - i + j);
+      char bit0 = crypton_p256_get_bit(scalar, 31 - i + j);
+      char bit1 = crypton_p256_get_bit(scalar, 95 - i + j);
+      char bit2 = crypton_p256_get_bit(scalar, 159 - i + j);
+      char bit3 = crypton_p256_get_bit(scalar, 223 - i + j);
       limb index = bit0 | (bit1 << 1) | (bit2 << 2) | (bit3 << 3);
 
       select_affine_point(px, py, kPrecomputed + table_offset, index);
@@ -426,7 +426,7 @@
 
 /* scalar_base_mult sets {nx,ny,nz} = scalar*{x,y}. */
 static void scalar_mult(felem nx, felem ny, felem nz, const felem x,
-                        const felem y, const cryptonite_p256_int* scalar) {
+                        const felem y, const crypton_p256_int* scalar) {
   int i;
   felem px, py, pz, tx, ty, tz;
   felem precomp[16][3];
@@ -460,10 +460,10 @@
       point_double(nx, ny, nz, nx, ny, nz);
     }
 
-    index = (cryptonite_p256_get_bit(scalar, 255 - i - 0) << 3) |
-            (cryptonite_p256_get_bit(scalar, 255 - i - 1) << 2) |
-            (cryptonite_p256_get_bit(scalar, 255 - i - 2) << 1) |
-            cryptonite_p256_get_bit(scalar, 255 - i - 3);
+    index = (crypton_p256_get_bit(scalar, 255 - i - 0) << 3) |
+            (crypton_p256_get_bit(scalar, 255 - i - 1) << 2) |
+            (crypton_p256_get_bit(scalar, 255 - i - 2) << 1) |
+            crypton_p256_get_bit(scalar, 255 - i - 3);
 
     /* See the comments in scalar_base_mult about handling infinities. */
     select_jacobian_point(px, py, pz, precomp[0][0], index);
@@ -482,9 +482,9 @@
   }
 }
 
-/* cryptonite_p256_base_point_mul sets {out_x,out_y} = nG, where n is < the
+/* crypton_p256_base_point_mul sets {out_x,out_y} = nG, where n is < the
  * order of the group. */
-void cryptonite_p256_base_point_mul(const cryptonite_p256_int* n, cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {
+void crypton_p256_base_point_mul(const crypton_p256_int* n, crypton_p256_int* out_x, crypton_p256_int* out_y) {
   felem x, y, z;
 
   scalar_base_mult(x, y, z, n);
@@ -498,21 +498,21 @@
   }
 }
 
-/* cryptonite_p256_points_mul_vartime sets {out_x,out_y} = n1*G + n2*{in_x,in_y}, where
+/* crypton_p256_points_mul_vartime sets {out_x,out_y} = n1*G + n2*{in_x,in_y}, where
  * n1 and n2 are < the order of the group.
  *
  * As indicated by the name, this function operates in variable time. This
  * is safe because it's used for signature validation which doesn't deal
  * with secrets. */
-void cryptonite_p256_points_mul_vartime(
-    const cryptonite_p256_int* n1, const cryptonite_p256_int* n2, const cryptonite_p256_int* in_x,
-    const cryptonite_p256_int* in_y, cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {
+void crypton_p256_points_mul_vartime(
+    const crypton_p256_int* n1, const crypton_p256_int* n2, const crypton_p256_int* in_x,
+    const crypton_p256_int* in_y, crypton_p256_int* out_x, crypton_p256_int* out_y) {
   felem x1, y1, z1, x2, y2, z2, px, py;
 
   /* If both scalars are zero, then the result is the point at infinity. */
-  if (cryptonite_p256_is_zero(n1) != 0 && cryptonite_p256_is_zero(n2) != 0) {
-    cryptonite_p256_clear(out_x);
-    cryptonite_p256_clear(out_y);
+  if (crypton_p256_is_zero(n1) != 0 && crypton_p256_is_zero(n2) != 0) {
+    crypton_p256_clear(out_x);
+    crypton_p256_clear(out_y);
     return;
   }
 
@@ -521,10 +521,10 @@
   scalar_base_mult(x1, y1, z1, n1);
   scalar_mult(x2, y2, z2, px, py, n2);
 
-  if (cryptonite_p256_is_zero(n2) != 0) {
+  if (crypton_p256_is_zero(n2) != 0) {
     /* If n2 == 0, then {x2,y2,z2} is zero and the result is just
          * {x1,y1,z1}. */
-  } else if (cryptonite_p256_is_zero(n1) != 0) {
+  } else if (crypton_p256_is_zero(n1) != 0) {
     /* If n1 == 0, then {x1,y1,z1} is zero and the result is just
          * {x2,y2,z2}. */
     memcpy(x1, x2, sizeof(x2));
@@ -544,10 +544,10 @@
    add 2 points together. so far untested.
    probably vartime, as it use point_add_or_double_vartime
  */
-void cryptonite_p256e_point_add(
-    const cryptonite_p256_int *in_x1, const cryptonite_p256_int *in_y1,
-    const cryptonite_p256_int *in_x2, const cryptonite_p256_int *in_y2,
-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y)
+void crypton_p256e_point_add(
+    const crypton_p256_int *in_x1, const crypton_p256_int *in_y1,
+    const crypton_p256_int *in_x2, const crypton_p256_int *in_y2,
+    crypton_p256_int *out_x, crypton_p256_int *out_y)
 {
     felem x, y, z, px1, py1, px2, py2;
 
@@ -566,21 +566,21 @@
 /* this function is not part of the original source
    negate a point, i.e. (out_x, out_y) = (in_x, -in_y)
  */
-void cryptonite_p256e_point_negate(
-    const cryptonite_p256_int *in_x, const cryptonite_p256_int *in_y,
-    cryptonite_p256_int *out_x, cryptonite_p256_int *out_y)
+void crypton_p256e_point_negate(
+    const crypton_p256_int *in_x, const crypton_p256_int *in_y,
+    crypton_p256_int *out_x, crypton_p256_int *out_y)
 {
     memcpy(out_x, in_x, P256_NBYTES);
-    cryptonite_p256_sub(&cryptonite_SECP256r1_p, in_y, out_y);
+    crypton_p256_sub(&crypton_SECP256r1_p, in_y, out_y);
 }
 
 /* this function is not part of the original source
-   cryptonite_p256e_point_mul sets {out_x,out_y} = n*{in_x,in_y}, where
+   crypton_p256e_point_mul sets {out_x,out_y} = n*{in_x,in_y}, where
    n is < the order of the group.
  */
-void cryptonite_p256e_point_mul(const cryptonite_p256_int* n,
-    const cryptonite_p256_int* in_x, const cryptonite_p256_int* in_y,
-    cryptonite_p256_int* out_x, cryptonite_p256_int* out_y) {
+void crypton_p256e_point_mul(const crypton_p256_int* n,
+    const crypton_p256_int* in_x, const crypton_p256_int* in_y,
+    crypton_p256_int* out_x, crypton_p256_int* out_y) {
   felem x, y, z, px, py;
 
   to_montgomery(px, in_x);
diff --git a/crypton.cabal b/crypton.cabal
--- a/crypton.cabal
+++ b/crypton.cabal
@@ -1,5 +1,5 @@
 Name:                crypton
-version:             0.31
+version:             0.32
 Synopsis:            Cryptography Primitives sink
 Description:
     A repository of cryptographic primitives.
@@ -57,7 +57,7 @@
                      cbits/argon2/*.h
                      cbits/argon2/*.c
                      cbits/aes/x86ni_impl.c
-                     cbits/cryptonite_hash_prefix.c
+                     cbits/crypton_hash_prefix.c
                      tests/*.hs
 
 source-repository head
@@ -261,32 +261,32 @@
   cc-options:        -std=gnu99
   if flag(old_toolchain_inliner)
     cc-options:      -fgnu89-inline
-  C-sources:         cbits/cryptonite_chacha.c
-                   , cbits/cryptonite_salsa.c
-                   , cbits/cryptonite_xsalsa.c
-                   , cbits/cryptonite_rc4.c
-                   , cbits/cryptonite_cpu.c
+  C-sources:         cbits/crypton_chacha.c
+                   , cbits/crypton_salsa.c
+                   , cbits/crypton_xsalsa.c
+                   , cbits/crypton_rc4.c
+                   , cbits/crypton_cpu.c
                    , cbits/p256/p256.c
                    , cbits/p256/p256_ec.c
-                   , cbits/cryptonite_blake2s.c
-                   , cbits/cryptonite_blake2sp.c
-                   , cbits/cryptonite_blake2b.c
-                   , cbits/cryptonite_blake2bp.c
-                   , cbits/cryptonite_poly1305.c
-                   , cbits/cryptonite_sha1.c
-                   , cbits/cryptonite_sha256.c
-                   , cbits/cryptonite_sha512.c
-                   , cbits/cryptonite_sha3.c
-                   , cbits/cryptonite_md2.c
-                   , cbits/cryptonite_md4.c
-                   , cbits/cryptonite_md5.c
-                   , cbits/cryptonite_ripemd.c
-                   , cbits/cryptonite_skein256.c
-                   , cbits/cryptonite_skein512.c
-                   , cbits/cryptonite_tiger.c
-                   , cbits/cryptonite_whirlpool.c
-                   , cbits/cryptonite_scrypt.c
-                   , cbits/cryptonite_pbkdf2.c
+                   , cbits/crypton_blake2s.c
+                   , cbits/crypton_blake2sp.c
+                   , cbits/crypton_blake2b.c
+                   , cbits/crypton_blake2bp.c
+                   , cbits/crypton_poly1305.c
+                   , cbits/crypton_sha1.c
+                   , cbits/crypton_sha256.c
+                   , cbits/crypton_sha512.c
+                   , cbits/crypton_sha3.c
+                   , cbits/crypton_md2.c
+                   , cbits/crypton_md4.c
+                   , cbits/crypton_md5.c
+                   , cbits/crypton_ripemd.c
+                   , cbits/crypton_skein256.c
+                   , cbits/crypton_skein512.c
+                   , cbits/crypton_tiger.c
+                   , cbits/crypton_whirlpool.c
+                   , cbits/crypton_scrypt.c
+                   , cbits/crypton_pbkdf2.c
                    , cbits/ed25519/ed25519.c
   include-dirs:      cbits
                    , cbits/ed25519
@@ -341,7 +341,7 @@
   if flag(support_rdrand) && (arch(i386) || arch(x86_64)) && !os(windows)
     CPP-options:    -DSUPPORT_RDRAND
     Other-modules:  Crypto.Random.Entropy.RDRand
-    c-sources:      cbits/cryptonite_rdrand.c
+    c-sources:      cbits/crypton_rdrand.c
 
   if flag(support_aesni) && (os(linux) || os(freebsd) || os(osx)) && (arch(i386) || arch(x86_64))
     CC-options:     -DWITH_AESNI
@@ -354,11 +354,11 @@
     C-sources:       cbits/aes/x86ni.c
                    , cbits/aes/generic.c
                    , cbits/aes/gf.c
-                   , cbits/cryptonite_aes.c
+                   , cbits/crypton_aes.c
   else
     C-sources:       cbits/aes/generic.c
                    , cbits/aes/gf.c
-                   , cbits/cryptonite_aes.c
+                   , cbits/crypton_aes.c
 
   if arch(x86_64) || flag(support_sse)
     C-sources:      cbits/blake2/sse/blake2s.c