Notation and Conventions

x ← y, also in listings (x ← y in inline code): assignment of y to x.

x = y, x ≠ y (x != y in listings), <, ≤, >, ≥: equality, inequality and the usual integer comparisons.

+, -, ×: integer addition, subtraction and multiplication; a / b: exact division, used only where b divides a, or inside ceil or floor as the real quotient; a mod b, for b > 0: the remainder of a divided by b, from 0 to b-1.

[k]P: the elliptic-curve point P added to itself k times by the group law of its curve.

V xor W, V and W, V or W: bitwise operations on values of equal length.

V << k, V >> k: logical shifts of V by k bits within its declared width, shifting in zeros; a left shift moves data toward the later bytes of the string.

A @ B, for values A of p bits and B of q bits: their concatenation, the (p+q)-bit value C with C[q-1:0] = B and C[p+q-1:q] = A; the left operand of @ occupies the more significant bits.

X ‖ Y, for byte strings or arrays of blocks: X followed by Y, X at the lower offsets or indices. This specification uses ‖ only in this little-endian sense, into which it transcribes a standard’s formula (Transcribing a Formula from a Standard); a standard’s own ‖ appears only in those examples and in Conventions of the Referenced Standards.

foreach(i from a to b) do: executes the indented body that follows for each integer i from a to b, both included, in increasing order, and not at all if a > b; foreach(i from a to b by s) steps i by s > 0.

if (c) then: performs the indented lines that follow only if c holds, and a following else: its own lines otherwise; while (c) do: performs its indented lines while c holds, testing c before each pass.

xk (x**k in listing blocks): x to the power k; in a field, x may be the polynomial variable and · the field product, with x-128 the inverse of x128. As an operand of @ or ‖, 0k and 1k are instead zeros(k) and ones(k), empty for k = 0.

local x : T, local a, b : T: pseudocode variables, outside any architectural state; a variable first assigned in a listing without local is also local to its function.

function f(a : T, …) → T' = { … }, struct { … }, array [i..j] of T, return: function definition, record, array type, and result. struct { f = v, … } builds a record and r.f selects its field f; A[] is a whole array of unspecified bounds and A[i] its element i, which may be sliced (A[i][j:k]) and assigned to as a slice.

x ∈ {a, b}: set membership.

Where a bit string is expected, binary digits, with or without the prefix 0b, are a bit string, the most significant first, as in the RISC-V ISA manual: 10 is the 2-bit V with V[1] = 1 and V[0] = 0, and a bare 0 or 1 is one bit. Where an n-bit value is expected, a hexadecimal numeral 0x… of value v stands for bin(v, n). Every other numeral is an integer.

(a, b) after return, and x, y ← f(…): a result with several components and its component-wise assignment, in declaration order; a result type written {x : T, …} is such a tuple.

bool, true, false: the Boolean type and its values; int: the integer type; bits(n): the type of an n-bit value.

X[r]: GPR number r, as in the RISC-V ISA manual (X[rs1] is the GPR that field rs1 names); X[s+1] @ X[s] is the GPR pair that holds a 64-bit value on RV32.

sext(x): x sign-extended to XLEN bits.

bin(n,m): the m least significant bits of the unsigned integer n, zero-extended if needed, bit i being the coefficient of 2ⁱ: bin(int(V), m) = V for an m-bit V, and int(bin(n, m)) = n mod 2^m.

bswap(m): the byte string m in reverse byte order; for an 8n-bit value V, byte i of the result is byte n-1-i of V. bswap(m, n) = bswap(m[8n-1:0]).

brev8(V): for an 8n-bit value V, the value with the bits of each byte reversed, brev8(V)[8i+j] = V[8i+7-j] for 0 ≤ i < n and 0 ≤ j < 8, as the Zbkb instruction brev8 computes.

ceil(x), also ⌈x⌉: the smallest integer at least x; floor(x), also ⌊x⌋: the largest integer at most x.

double(S): doubling in GF(2^b), as CMAC Functions defines it; OCB Mode uses it with b = 128.

Galoismul(a, b): multiplication in the GHASH field (GCM Mode).

int(V): V read as a little-endian unsigned binary number, bit V[i] being the coefficient of 2ⁱ.

lcm(a, b): the least common multiple of the positive integers a and b.

len_in_bits(M): the length of the value or string M in bits; len_in_bytes(M) = len_in_bits(M) / 8, defined only when len_in_bits(M) is a multiple of 8.

log2(x): the base-2 logarithm of the real number x > 0.

lsb(x), msb(x): the least, resp. most, significant bit of x; lsbc(x), msbc(x): its c least, resp. most, significant bits.

m[i .. j]: bytes i to j of the byte array m, both inclusive; bits are indexed as in Values, Bits, and Byte Strings.

min(x, y, …), max(x, y, …): the smallest, resp. largest, argument.

Montmul(a, b): the POLYVAL field operation (POLYVAL Hashing Function).

ones(i), zeros(i): i ones, resp. zeros.

update_mask(M): the XEX/XTS mask update (XEX/XTS Modes); a Machine that uses it names the one it means.

cite:[RFC8452] §4 builds each key-derivation input as the four-byte little-endian counter followed by the twelve-byte nonce, LE32(i) ‖ N: step 1 gives N @ LE32(i), and step 2 N @ bin(i,32).

cite:[nist-SP-800-38D] §7.1 builds, for a 96-bit IV, J0 = IV ‖ 031 ‖ 1, whose last four bytes encode the integer 1 big-endian: step 1 gives (031 ‖ 1) @ IV, the 32-bit counter counting as one field, and step 2 J0 ← bswap(bin(1,32)) @ IV. The left-to-right transcription IV @ zeros(31) @ 1 would put the IV in J0[127:32] and the counter in J0[31:0], the reverse of what cite:[nist-SP-800-38D] requires.