s1 : bits (8) = (s0) ^ (s1) ^ (s2) ^ (s3); let b2 : bits (8) = x[15.. 8]; let s2 : bits (8) = gfmul(s0, 0xE) ^ gfmul(s1, 0xE) ^ gfmul(s3, 0x9); let b1 : bits (8) = x[23..16]; let