From 607d7cfdb34d5ec936aa5ee1ad42ab633c42e394 Mon Sep 17 00:00:00 2001
From: Sean Parkinson <sean@wolfssl.com>
Date: Wed, 8 Jul 2026 10:42:30 +1000
Subject: [PATCH 1/2] FrodoKEM: Initial implementation

Supports Fast C code, small C code, small stack and assembly for x86_64, Aarch64, Aarch32, Thumb2.
---
 .codespellrc                                  |   12 +
 .github/workflows/pq-all.yml                  |   42 +-
 .gitignore                                    |    1 +
 .wolfssl_known_macro_extras                   |    8 +
 CMakeLists.txt                                |  146 +
 cmake/functions.cmake                         |   32 +
 configure.ac                                  |  210 +
 .../header_files/doxygen_groups.h             |   12 +
 doc/dox_comments/header_files/wc_frodokem.h   |  462 +
 src/include.am                                |   37 +
 tests/api.c                                   |    2 +
 tests/api/include.am                          |    2 +
 tests/api/test_frodokem.c                     | 1498 +++
 tests/api/test_frodokem.h                     |   54 +
 wolfcrypt/benchmark/benchmark.c               |  295 +-
 wolfcrypt/benchmark/benchmark.h               |    1 +
 wolfcrypt/src/aes_gcm_asm.asm                 |  194 +-
 wolfcrypt/src/cpuid.c                         |   70 +-
 wolfcrypt/src/port/arm/armv8-32-aes-asm.S     |    4 +-
 wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c   |    4 +-
 wolfcrypt/src/port/arm/armv8-32-chacha-asm.S  |    4 +-
 .../src/port/arm/armv8-32-chacha-asm_c.c      |    4 +-
 wolfcrypt/src/port/arm/armv8-32-curve25519.S  |    4 +-
 .../src/port/arm/armv8-32-curve25519_c.c      |    4 +-
 .../src/port/arm/armv8-32-frodokem-asm.S      |  690 ++
 .../src/port/arm/armv8-32-frodokem-asm_c.c    |  877 ++
 wolfcrypt/src/port/arm/armv8-32-mlkem-asm.S   |    4 +-
 wolfcrypt/src/port/arm/armv8-32-mlkem-asm_c.c |    4 +-
 .../src/port/arm/armv8-32-poly1305-asm.S      |    4 +-
 .../src/port/arm/armv8-32-poly1305-asm_c.c    |    4 +-
 wolfcrypt/src/port/arm/armv8-32-sha256-asm.S  |    4 +-
 .../src/port/arm/armv8-32-sha256-asm_c.c      |    4 +-
 wolfcrypt/src/port/arm/armv8-32-sha3-asm.S    |    4 +-
 wolfcrypt/src/port/arm/armv8-32-sha3-asm_c.c  |    4 +-
 wolfcrypt/src/port/arm/armv8-32-sha512-asm.S  |    4 +-
 .../src/port/arm/armv8-32-sha512-asm_c.c      |    4 +-
 wolfcrypt/src/port/arm/armv8-aes-asm.asm      | 8229 ++++++++++-----
 wolfcrypt/src/port/arm/armv8-frodokem-asm.S   | 2347 +++++
 wolfcrypt/src/port/arm/armv8-frodokem-asm.asm | 1665 ++++
 wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c | 1315 +++
 wolfcrypt/src/port/arm/thumb2-aes-asm.S       |    4 +-
 wolfcrypt/src/port/arm/thumb2-aes-asm_c.c     |  108 +-
 wolfcrypt/src/port/arm/thumb2-chacha-asm.S    |    4 +-
 wolfcrypt/src/port/arm/thumb2-chacha-asm_c.c  |    4 +-
 wolfcrypt/src/port/arm/thumb2-curve25519.S    |    4 +-
 wolfcrypt/src/port/arm/thumb2-curve25519_c.c  |    4 +-
 wolfcrypt/src/port/arm/thumb2-frodokem-asm.S  |  264 +
 .../src/port/arm/thumb2-frodokem-asm_c.c      |  461 +
 wolfcrypt/src/port/arm/thumb2-mlkem-asm.S     |    4 +-
 wolfcrypt/src/port/arm/thumb2-mlkem-asm_c.c   |    6 +-
 wolfcrypt/src/port/arm/thumb2-poly1305-asm.S  |    4 +-
 .../src/port/arm/thumb2-poly1305-asm_c.c      |    4 +-
 wolfcrypt/src/port/arm/thumb2-sha256-asm.S    |    4 +-
 wolfcrypt/src/port/arm/thumb2-sha256-asm_c.c  |    4 +-
 wolfcrypt/src/port/arm/thumb2-sha3-asm.S      |    4 +-
 wolfcrypt/src/port/arm/thumb2-sha3-asm_c.c    |    4 +-
 wolfcrypt/src/port/arm/thumb2-sha512-asm.S    |    4 +-
 wolfcrypt/src/port/arm/thumb2-sha512-asm_c.c  |    4 +-
 wolfcrypt/src/sha3_asm.S                      | 8807 +++++++++++++++-
 wolfcrypt/src/sha3_asm.asm                    | 8819 ++++++++++++++++-
 wolfcrypt/src/sp_x86_64_asm.asm               |   44 +-
 wolfcrypt/src/wc_frodokem.c                   | 1439 +++
 wolfcrypt/src/wc_frodokem_asm.S               | 1590 +++
 wolfcrypt/src/wc_frodokem_asm.asm             | 1613 +++
 wolfcrypt/src/wc_frodokem_mat.c               | 3037 ++++++
 wolfcrypt/test/test.c                         |  163 +
 wolfssl-VS2022.vcxproj                        |   16 +-
 wolfssl.vcxproj                               |   16 +-
 wolfssl/wolfcrypt/cpuid.h                     |    4 +
 wolfssl/wolfcrypt/include.am                  |    2 +
 wolfssl/wolfcrypt/sha3.h                      |    4 +
 wolfssl/wolfcrypt/wc_frodokem.h               |  328 +
 wolfssl/wolfcrypt/wc_frodokem_mat.h           |  466 +
 73 files changed, 42274 insertions(+), 3234 deletions(-)
 create mode 100644 .codespellrc
 create mode 100644 doc/dox_comments/header_files/wc_frodokem.h
 create mode 100644 tests/api/test_frodokem.c
 create mode 100644 tests/api/test_frodokem.h
 create mode 100644 wolfcrypt/src/port/arm/armv8-32-frodokem-asm.S
 create mode 100644 wolfcrypt/src/port/arm/armv8-32-frodokem-asm_c.c
 create mode 100644 wolfcrypt/src/port/arm/armv8-frodokem-asm.S
 create mode 100644 wolfcrypt/src/port/arm/armv8-frodokem-asm.asm
 create mode 100644 wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
 create mode 100644 wolfcrypt/src/port/arm/thumb2-frodokem-asm.S
 create mode 100644 wolfcrypt/src/port/arm/thumb2-frodokem-asm_c.c
 create mode 100644 wolfcrypt/src/wc_frodokem.c
 create mode 100644 wolfcrypt/src/wc_frodokem_asm.S
 create mode 100644 wolfcrypt/src/wc_frodokem_asm.asm
 create mode 100644 wolfcrypt/src/wc_frodokem_mat.c
 create mode 100644 wolfssl/wolfcrypt/wc_frodokem.h
 create mode 100644 wolfssl/wolfcrypt/wc_frodokem_mat.h

diff --git a/.codespellrc b/.codespellrc
new file mode 100644
index 00000000000..068c4feba6b
--- /dev/null
+++ b/.codespellrc
@@ -0,0 +1,12 @@
+# codespell configuration (read automatically from the repository root).
+#
+# "SME" is the Arm Scalable Matrix Extension, referenced throughout the
+# FrodoKEM Aarch64 code (comments, CPUID_..._SME macros, frodokem_..._sme
+# identifiers, "sve2+sme" build strings). codespell's dictionary treats it as
+# a misspelling of some/same/sms. The ignore-regex below drops the standalone
+# SME token (any case, including "_sme" / "+sme") before spell-checking, while
+# still flagging "sme" embedded in a larger alphabetic word - so genuine typos
+# are unaffected. Kept out of ignore-words-list so "sme" is not globally
+# whitelisted for every file.
+[codespell]
+ignore-regex = (?i)(?<![a-z])sme(?![a-z])
diff --git a/.github/workflows/pq-all.yml b/.github/workflows/pq-all.yml
index 7805f91d876..0017a95e668 100644
--- a/.github/workflows/pq-all.yml
+++ b/.github/workflows/pq-all.yml
@@ -43,7 +43,7 @@ jobs:
       - name: Install dependencies
         uses: ./.github/actions/install-apt-deps
         with:
-          packages: autoconf automake libtool build-essential bubblewrap
+          packages: autoconf automake libtool build-essential bubblewrap crossbuild-essential-arm64 crossbuild-essential-armhf
           ghcr-debs-tag: ubuntu-24.04-minimal
 
       # ccache via the cross-platform composite; the script passes the
@@ -154,6 +154,46 @@ jobs:
             "--enable-dilithium=yes,no-ctx", "--enable-dual-alg-certs",
             "--disable-qt",
             "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
+          {"name": "all-frodokem", "minutes": 3.5,
+           "configure": ["--enable-intelasm", "--enable-sp-asm",
+            "--enable-all", "--enable-testcert", "--enable-experimental",
+            "--enable-mlkem=yes,kyber,ml-kem",
+            "--enable-frodokem=aes,ephemeral", "--disable-qt",
+            "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DWOLFCRYPT_TEST_LINT -DNO_WOLFSSL_CIPHER_SUITE_TEST -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"]},
+          {"name": "frodokem-small-smallstack-noasm", "minutes": 2.5,
+           "configure": ["--disable-intelasm", "--enable-smallstack",
+            "--enable-smallstackcache", "--enable-experimental",
+            "--enable-frodokem=aes,ephemeral,small",
+            "CPPFLAGS=-Wdeclaration-after-statement"]},
+          {"name": "frodokem-976-only-noasm", "minutes": 1.5,
+           "comment": "976-only builds D=16 (q=2^16) alone; no-asm the C path",
+           "configure": ["--disable-intelasm", "--enable-experimental",
+            "--enable-frodokem=aes,ephemeral,no-640,no-1344",
+            "CPPFLAGS=-Wdeclaration-after-statement"]},
+          {"name": "frodokem-640-shake-only", "minutes": 1.5,
+           "comment": "640-only builds D=15 (q=2^15); shake-only, with asm",
+           "configure": ["--enable-intelasm", "--enable-sp-asm",
+            "--enable-experimental",
+            "--enable-frodokem=no-976,no-1344,no-aes",
+            "CPPFLAGS=-Wdeclaration-after-statement"]},
+          {"name": "frodokem-aarch64-armasm", "minutes": 4, "check": false,
+           "cc": "ccache aarch64-linux-gnu-gcc",
+           "comment": "Cross-build only (no ARM runner): catches ARM asm link/compile breaks. sve+sme+aes A-gen all live in the .S.",
+           "configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly",
+            "--enable-armasm", "--enable-experimental",
+            "--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]},
+          {"name": "frodokem-aarch64-armasm-inline", "minutes": 4,
+           "check": false, "cc": "ccache aarch64-linux-gnu-gcc",
+           "comment": "Inline armasm: sve/sme/aes are .S-only, so they must fall back to NEON/C; guards the inline-asm link break.",
+           "configure": ["--host=aarch64-linux-gnu", "--enable-cryptonly",
+            "--enable-armasm=inline", "--enable-experimental",
+            "--enable-frodokem=aes,ephemeral,sve,sme", "--disable-examples"]},
+          {"name": "frodokem-arm32-armasm", "minutes": 4, "check": false,
+           "cc": "ccache arm-linux-gnueabihf-gcc",
+           "comment": "Cross-build only: AArch32 NEON matrix ops + AES-crypto A-gen.",
+           "configure": ["--host=arm-linux-gnueabihf", "--enable-cryptonly",
+            "--enable-armasm", "--enable-experimental",
+            "--enable-frodokem=aes,ephemeral", "--disable-examples"]},
           {"name": "ubsan-mldsa-mlkem", "minutes": 2.5,
            "configure": ["--disable-shared", "--enable-dilithium",
             "--enable-mlkem",
diff --git a/.gitignore b/.gitignore
index ecc8bb7feaf..d6a54acb811 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@ ctaocrypt/src/src/
 *.d
 *.libs
 *.cache
+*.su
 .dirstamp
 *.user
 !*-VS2022.vcxproj.user
diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index 707c68cb51d..f682cdfcd17 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -335,6 +335,8 @@ HSM_OP_KEY_GENERATION_FLAGS_CREATE
 HSM_OP_KEY_GENERATION_FLAGS_UPDATE
 HSM_SVC_KEY_STORE_FLAGS_UPDATE
 HWCAP_ASIMDRDM
+HWCAP2_SME
+HWCAP_SVE
 IDIRECT_DEV_RANDOM
 IDIRECT_DEV_TIME
 ID_TRNG
@@ -1111,7 +1113,13 @@ __ARCH_STRNCPY_NO_REDIRECT
 __ARCH_STRSTR_NO_REDIRECT
 __ARM_ARCH_7M__
 __ARM_FEATURE_CRYPTO
+__ARM_FEATURE_DSP
+__ARM_FEATURE_SIMD32
+__ARM_FEATURE_SME
+__ARM_FEATURE_SVE
 __ARM_FEATURE_UNALIGNED
+__ARM_NEON
+__ARM_NEON__
 __ASSEMBLER__
 __ATOMIC_CONSUME
 __ATOMIC_RELAXED
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 7345e9afb1d..89e908b297b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1037,6 +1037,56 @@ add_option(WOLFSSL_EXTRA_PQC_HYBRIDS
     "Enable extra PQ/T hybrid combinations (default: disabled)"
     "no" "yes;no")
 
+# FrodoKEM reference implementation (experimental)
+add_option(WOLFSSL_FRODOKEM
+    "Enable the wolfSSL FrodoKEM reference implementation (requires WOLFSSL_EXPERIMENTAL) (default: disabled)"
+    "no" "yes;no")
+# FrodoKEM matrix A generation with SHAKE-128 (default: enabled when FrodoKEM on)
+add_option(WOLFSSL_FRODOKEM_SHAKE
+    "Enable FrodoKEM SHAKE-128 matrix A generation (default: enabled)"
+    "yes" "yes;no")
+# FrodoKEM matrix A generation with AES-128 (default: disabled)
+add_option(WOLFSSL_FRODOKEM_AES
+    "Enable FrodoKEM AES-128 matrix A generation (default: disabled)"
+    "no" "yes;no")
+# eFrodoKEM (ephemeral, salt-less) variants (default: disabled)
+add_option(WOLFSSL_FRODOKEM_EPHEMERAL
+    "Enable eFrodoKEM (ephemeral) variants (default: disabled)"
+    "no" "yes;no")
+# FrodoKEM parameter sets (each default: enabled)
+add_option(WOLFSSL_FRODOKEM_640
+    "Enable the FrodoKEM-640 parameter set (default: enabled)"
+    "yes" "yes;no")
+add_option(WOLFSSL_FRODOKEM_976
+    "Enable the FrodoKEM-976 parameter set (default: enabled)"
+    "yes" "yes;no")
+add_option(WOLFSSL_FRODOKEM_1344
+    "Enable the FrodoKEM-1344 parameter set (default: enabled)"
+    "yes" "yes;no")
+# FrodoKEM operations (each default: enabled)
+add_option(WOLFSSL_FRODOKEM_MAKE_KEY
+    "Enable FrodoKEM key generation (default: enabled)"
+    "yes" "yes;no")
+add_option(WOLFSSL_FRODOKEM_ENCAPSULATE
+    "Enable FrodoKEM encapsulation (default: enabled)"
+    "yes" "yes;no")
+add_option(WOLFSSL_FRODOKEM_DECAPSULATE
+    "Enable FrodoKEM decapsulation (default: enabled)"
+    "yes" "yes;no")
+# Small-footprint FrodoKEM: looped (not unrolled) matrix arithmetic
+# (default: disabled)
+add_option(WOLFSSL_FRODOKEM_SMALL
+    "Enable small-footprint FrodoKEM (default: disabled)"
+    "no" "yes;no")
+
+# FrodoKEM AArch64 SVE / SME acceleration (default: disabled; AArch64 asm only)
+add_option(WOLFSSL_FRODOKEM_SVE
+    "Enable FrodoKEM AArch64 SVE acceleration (default: disabled)"
+    "no" "yes;no")
+add_option(WOLFSSL_FRODOKEM_SME
+    "Enable FrodoKEM AArch64 SME acceleration (default: disabled)"
+    "no" "yes;no")
+
 message(STATUS "Looking for WOLFSSL_EXPERIMENTAL")
 if (WOLFSSL_EXPERIMENTAL)
     message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - found")
@@ -1092,6 +1142,98 @@ if (WOLFSSL_EXPERIMENTAL)
         message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - not found")
     endif()
 
+    # Checking for experimental feature: FrodoKEM
+    message(STATUS "Looking for WOLFSSL_FRODOKEM")
+    if (WOLFSSL_FRODOKEM)
+        set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
+        message(STATUS "Looking for WOLFSSL_FRODOKEM - found")
+
+        # At least one matrix A generation method must be enabled.
+        if (NOT WOLFSSL_FRODOKEM_SHAKE AND NOT WOLFSSL_FRODOKEM_AES)
+            message(FATAL_ERROR
+                "WOLFSSL_FRODOKEM requires WOLFSSL_FRODOKEM_SHAKE and/or WOLFSSL_FRODOKEM_AES.")
+        endif()
+        # At least one parameter set must be enabled.
+        if (NOT WOLFSSL_FRODOKEM_640 AND NOT WOLFSSL_FRODOKEM_976 AND
+            NOT WOLFSSL_FRODOKEM_1344)
+            message(FATAL_ERROR
+                "WOLFSSL_FRODOKEM requires at least one of WOLFSSL_FRODOKEM_640, WOLFSSL_FRODOKEM_976 or WOLFSSL_FRODOKEM_1344.")
+        endif()
+        # At least one operation must be enabled.
+        if (NOT WOLFSSL_FRODOKEM_MAKE_KEY AND NOT WOLFSSL_FRODOKEM_ENCAPSULATE
+            AND NOT WOLFSSL_FRODOKEM_DECAPSULATE)
+            message(FATAL_ERROR
+                "WOLFSSL_FRODOKEM requires at least one of WOLFSSL_FRODOKEM_MAKE_KEY, WOLFSSL_FRODOKEM_ENCAPSULATE or WOLFSSL_FRODOKEM_DECAPSULATE.")
+        endif()
+
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_FRODOKEM")
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
+        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
+
+        set_wolfssl_definitions("WOLFSSL_HAVE_FRODOKEM" RESULT)
+        set_wolfssl_definitions("WOLFSSL_SHA3"          RESULT)
+        set_wolfssl_definitions("WOLFSSL_SHAKE128"      RESULT)
+        set_wolfssl_definitions("WOLFSSL_SHAKE256"      RESULT)
+
+        if (WOLFSSL_FRODOKEM_SHAKE)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_SHAKE")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_SHAKE" RESULT)
+        endif()
+        if (WOLFSSL_FRODOKEM_AES)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_AES")
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_AES_DIRECT")
+            list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_AES_ECB")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_AES" RESULT)
+            set_wolfssl_definitions("WOLFSSL_AES_DIRECT"   RESULT)
+            set_wolfssl_definitions("HAVE_AES_ECB"         RESULT)
+        endif()
+        if (WOLFSSL_FRODOKEM_EPHEMERAL)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_EPHEMERAL")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_EPHEMERAL" RESULT)
+        endif()
+        if (WOLFSSL_FRODOKEM_SMALL)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_SMALL")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_SMALL" RESULT)
+        endif()
+        if (WOLFSSL_FRODOKEM_SVE)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_SVE")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_SVE" RESULT)
+        endif()
+        if (WOLFSSL_FRODOKEM_SME)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_SME")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_SME" RESULT)
+        endif()
+        # Excluded parameter sets.
+        if (NOT WOLFSSL_FRODOKEM_640)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_FRODOKEM_640")
+            set_wolfssl_definitions("WOLFSSL_NO_FRODOKEM_640" RESULT)
+        endif()
+        if (NOT WOLFSSL_FRODOKEM_976)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_FRODOKEM_976")
+            set_wolfssl_definitions("WOLFSSL_NO_FRODOKEM_976" RESULT)
+        endif()
+        if (NOT WOLFSSL_FRODOKEM_1344)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_FRODOKEM_1344")
+            set_wolfssl_definitions("WOLFSSL_NO_FRODOKEM_1344" RESULT)
+        endif()
+        # Excluded operations.
+        if (NOT WOLFSSL_FRODOKEM_MAKE_KEY)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_NO_MAKE_KEY")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_NO_MAKE_KEY" RESULT)
+        endif()
+        if (NOT WOLFSSL_FRODOKEM_ENCAPSULATE)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_NO_ENCAPSULATE")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_NO_ENCAPSULATE" RESULT)
+        endif()
+        if (NOT WOLFSSL_FRODOKEM_DECAPSULATE)
+            list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_FRODOKEM_NO_DECAPSULATE")
+            set_wolfssl_definitions("WOLFSSL_FRODOKEM_NO_DECAPSULATE" RESULT)
+        endif()
+    else()
+        message(STATUS "Looking for WOLFSSL_FRODOKEM - not found")
+    endif()
+
     # Other experimental feature detection can be added here...
 
     # Were any experimental features found? Display a message.
@@ -1110,6 +1252,9 @@ else()
     if (WOLFSSL_FALCON)
         message(FATAL_ERROR "Error: WOLFSSL_FALCON requires WOLFSSL_EXPERIMENTAL at this time.")
     endif()
+    if (WOLFSSL_FRODOKEM)
+        message(FATAL_ERROR "Error: WOLFSSL_FRODOKEM requires WOLFSSL_EXPERIMENTAL at this time.")
+    endif()
 endif()
 
 # LMS
@@ -4184,6 +4329,7 @@ if(WOLFSSL_EXAMPLES)
         tests/api/test_ed25519.c
         tests/api/test_curve448.c
         tests/api/test_ed448.c
+        tests/api/test_frodokem.c
         tests/api/test_mlkem.c
         tests/api/test_mldsa.c
         tests/api/test_mldsa_legacy.c
diff --git a/cmake/functions.cmake b/cmake/functions.cmake
index e53d44054ce..a3d37f3de9c 100644
--- a/cmake/functions.cmake
+++ b/cmake/functions.cmake
@@ -253,6 +253,9 @@ function(generate_build_flags)
     if(WOLFSSL_MLKEM OR WOLFSSL_USER_SETTINGS)
         set(BUILD_WC_MLKEM "yes" PARENT_SCOPE)
     endif()
+    if(WOLFSSL_FRODOKEM OR WOLFSSL_USER_SETTINGS)
+        set(BUILD_WC_FRODOKEM "yes" PARENT_SCOPE)
+    endif()
     if(WOLFSSL_MLDSA OR WOLFSSL_DILITHIUM OR WOLFSSL_USER_SETTINGS)
         set(BUILD_MLDSA "yes" PARENT_SCOPE)
     endif()
@@ -1175,6 +1178,35 @@ function(generate_lib_src_list LIB_SOURCES)
             endif()
         endif()
 
+        if(BUILD_WC_FRODOKEM)
+            list(APPEND LIB_SOURCES wolfcrypt/src/wc_frodokem.c)
+            list(APPEND LIB_SOURCES wolfcrypt/src/wc_frodokem_mat.c)
+
+            if(BUILD_ARMASM)
+                if(BUILD_ARMASM_INLINE)
+                    list(APPEND LIB_SOURCES
+                        wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
+                        wolfcrypt/src/port/arm/armv8-32-frodokem-asm_c.c)
+                else()
+                    list(APPEND LIB_SOURCES
+                        wolfcrypt/src/port/arm/armv8-frodokem-asm.S
+                        wolfcrypt/src/port/arm/armv8-32-frodokem-asm.S)
+                endif()
+
+                if(BUILD_ARMASM_INLINE AND BUILD_ARM_THUMB)
+                    list(APPEND LIB_SOURCES
+                        wolfcrypt/src/port/arm/thumb2-frodokem-asm_c.c)
+                elseif(BUILD_ARM_THUMB)
+                    list(APPEND LIB_SOURCES
+                        wolfcrypt/src/port/arm/thumb2-frodokem-asm.S)
+                endif()
+            endif()
+
+            if(BUILD_INTELASM)
+                list(APPEND LIB_SOURCES wolfcrypt/src/wc_frodokem_asm.S)
+            endif()
+        endif()
+
         if(BUILD_WC_LMS)
             list(APPEND LIB_SOURCES wolfcrypt/src/wc_lms.c)
             list(APPEND LIB_SOURCES wolfcrypt/src/wc_lms_impl.c)
diff --git a/configure.ac b/configure.ac
index 537a51ff99c..564289a938e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1904,6 +1904,166 @@ AC_ARG_ENABLE([extra-pqc-hybrids],
     )
 
 
+# FrodoKEM (experimental reference implementation)
+AC_ARG_ENABLE([frodokem],
+    [AS_HELP_STRING([--enable-frodokem],[Enable FrodoKEM reference implementation, optionally with a comma-separated list of sub-options e.g. aes,ephemeral,small,no-640 (requires --enable-experimental) (default: disabled)])],
+    [ ENABLED_FRODOKEM=$enableval ],
+    [ ENABLED_FRODOKEM=no ]
+    )
+
+AS_IF([ test "$ENABLED_FRODOKEM" != "no" && test "$ENABLED_EXPERIMENTAL" != "yes" ],[ AC_MSG_ERROR([frodokem requires --enable-experimental.]) ])
+
+# FrodoKEM matrix A generation with SHAKE-128 (default: enabled with frodokem).
+AC_ARG_ENABLE([frodokem-shake],
+    [AS_HELP_STRING([--enable-frodokem-shake],[Enable FrodoKEM SHAKE-128 matrix A generation (default: enabled)])],
+    [ ENABLED_FRODOKEM_SHAKE=$enableval ],
+    [ ENABLED_FRODOKEM_SHAKE=default ]
+    )
+# FrodoKEM matrix A generation with AES-128 (default: disabled).
+AC_ARG_ENABLE([frodokem-aes],
+    [AS_HELP_STRING([--enable-frodokem-aes],[Enable FrodoKEM AES-128 matrix A generation (default: disabled)])],
+    [ ENABLED_FRODOKEM_AES=$enableval ],
+    [ ENABLED_FRODOKEM_AES=no ]
+    )
+# AArch64 SVE S*A accumulate, selected at run time by HWCAP (default: disabled).
+AC_ARG_ENABLE([frodokem-sve],
+    [AS_HELP_STRING([--enable-frodokem-sve],[Enable FrodoKEM AArch64 SVE matrix acceleration (default: disabled)])],
+    [ ENABLED_FRODOKEM_SVE=$enableval ],
+    [ ENABLED_FRODOKEM_SVE=no ]
+    )
+# AArch64 SME B*S via the ZA-tile UMOPA, selected at run time (default: disabled).
+AC_ARG_ENABLE([frodokem-sme],
+    [AS_HELP_STRING([--enable-frodokem-sme],[Enable FrodoKEM AArch64 SME matrix acceleration (default: disabled)])],
+    [ ENABLED_FRODOKEM_SME=$enableval ],
+    [ ENABLED_FRODOKEM_SME=no ]
+    )
+# eFrodoKEM (ephemeral, salt-less) variants (default: disabled).
+AC_ARG_ENABLE([frodokem-ephemeral],
+    [AS_HELP_STRING([--enable-frodokem-ephemeral],[Enable eFrodoKEM (ephemeral) variants (default: disabled)])],
+    [ ENABLED_FRODOKEM_EPHEMERAL=$enableval ],
+    [ ENABLED_FRODOKEM_EPHEMERAL=no ]
+    )
+# FrodoKEM parameter sets (each default: enabled with frodokem).
+AC_ARG_ENABLE([frodokem-640],
+    [AS_HELP_STRING([--enable-frodokem-640],[Enable the FrodoKEM-640 parameter set (default: enabled)])],
+    [ ENABLED_FRODOKEM_640=$enableval ],
+    [ ENABLED_FRODOKEM_640=yes ]
+    )
+AC_ARG_ENABLE([frodokem-976],
+    [AS_HELP_STRING([--enable-frodokem-976],[Enable the FrodoKEM-976 parameter set (default: enabled)])],
+    [ ENABLED_FRODOKEM_976=$enableval ],
+    [ ENABLED_FRODOKEM_976=yes ]
+    )
+AC_ARG_ENABLE([frodokem-1344],
+    [AS_HELP_STRING([--enable-frodokem-1344],[Enable the FrodoKEM-1344 parameter set (default: enabled)])],
+    [ ENABLED_FRODOKEM_1344=$enableval ],
+    [ ENABLED_FRODOKEM_1344=yes ]
+    )
+# FrodoKEM operations (each default: enabled with frodokem).
+AC_ARG_ENABLE([frodokem-make-key],
+    [AS_HELP_STRING([--enable-frodokem-make-key],[Enable FrodoKEM key generation (default: enabled)])],
+    [ ENABLED_FRODOKEM_MAKE_KEY=$enableval ],
+    [ ENABLED_FRODOKEM_MAKE_KEY=yes ]
+    )
+AC_ARG_ENABLE([frodokem-encapsulate],
+    [AS_HELP_STRING([--enable-frodokem-encapsulate],[Enable FrodoKEM encapsulation (default: enabled)])],
+    [ ENABLED_FRODOKEM_ENCAPSULATE=$enableval ],
+    [ ENABLED_FRODOKEM_ENCAPSULATE=yes ]
+    )
+AC_ARG_ENABLE([frodokem-decapsulate],
+    [AS_HELP_STRING([--enable-frodokem-decapsulate],[Enable FrodoKEM decapsulation (default: enabled)])],
+    [ ENABLED_FRODOKEM_DECAPSULATE=$enableval ],
+    [ ENABLED_FRODOKEM_DECAPSULATE=yes ]
+    )
+# Small-footprint FrodoKEM: use the looped (not fully unrolled) matrix
+# arithmetic (default: disabled).
+AC_ARG_ENABLE([frodokem-small],
+    [AS_HELP_STRING([--enable-frodokem-small],[Enable small-footprint FrodoKEM (default: disabled)])],
+    [ ENABLED_FRODOKEM_SMALL=$enableval ],
+    [ ENABLED_FRODOKEM_SMALL=no ]
+    )
+
+# The FrodoKEM sub-options may also be given as a comma-separated list to
+# --enable-frodokem, e.g. --enable-frodokem=aes,ephemeral,small,no-640. Each
+# token sets the matching --enable-frodokem-<option> value ("no-<option>"
+# disables). This is equivalent to passing the individual --enable-frodokem-*
+# options.
+case "$ENABLED_FRODOKEM" in
+no | yes | '')
+    ;;
+*)
+    frodokem_opts="$ENABLED_FRODOKEM"
+    ENABLED_FRODOKEM=yes
+    for frodokem_opt in $(echo "$frodokem_opts" | tr ',' ' ')
+    do
+        case "$frodokem_opt" in
+        yes)            ;;
+        small)          ENABLED_FRODOKEM_SMALL=yes ;;
+        no-small)       ENABLED_FRODOKEM_SMALL=no ;;
+        shake)          ENABLED_FRODOKEM_SHAKE=yes ;;
+        no-shake)       ENABLED_FRODOKEM_SHAKE=no ;;
+        aes)            ENABLED_FRODOKEM_AES=yes ;;
+        no-aes)         ENABLED_FRODOKEM_AES=no ;;
+        sve)            ENABLED_FRODOKEM_SVE=yes ;;
+        no-sve)         ENABLED_FRODOKEM_SVE=no ;;
+        sme)            ENABLED_FRODOKEM_SME=yes ;;
+        no-sme)         ENABLED_FRODOKEM_SME=no ;;
+        ephemeral)      ENABLED_FRODOKEM_EPHEMERAL=yes ;;
+        no-ephemeral)   ENABLED_FRODOKEM_EPHEMERAL=no ;;
+        640)            ENABLED_FRODOKEM_640=yes ;;
+        no-640)         ENABLED_FRODOKEM_640=no ;;
+        976)            ENABLED_FRODOKEM_976=yes ;;
+        no-976)         ENABLED_FRODOKEM_976=no ;;
+        1344)           ENABLED_FRODOKEM_1344=yes ;;
+        no-1344)        ENABLED_FRODOKEM_1344=no ;;
+        make-key)       ENABLED_FRODOKEM_MAKE_KEY=yes ;;
+        no-make-key)    ENABLED_FRODOKEM_MAKE_KEY=no ;;
+        encapsulate)    ENABLED_FRODOKEM_ENCAPSULATE=yes ;;
+        no-encapsulate) ENABLED_FRODOKEM_ENCAPSULATE=no ;;
+        decapsulate)    ENABLED_FRODOKEM_DECAPSULATE=yes ;;
+        no-decapsulate) ENABLED_FRODOKEM_DECAPSULATE=no ;;
+        *) AC_MSG_ERROR([Unknown --enable-frodokem option: $frodokem_opt]) ;;
+        esac
+    done
+    ;;
+esac
+
+AS_IF([ test "$ENABLED_FRODOKEM" = "no" &&
+        ( test "$ENABLED_FRODOKEM_AES" != "no" ||
+          test "$ENABLED_FRODOKEM_EPHEMERAL" != "no" ) ],
+      [ AC_MSG_ERROR([frodokem-aes and frodokem-ephemeral require --enable-frodokem.]) ])
+
+if test "$ENABLED_FRODOKEM" != "no"
+then
+    # SHAKE-128 matrix A generation is on by default unless explicitly disabled.
+    if test "$ENABLED_FRODOKEM_SHAKE" = "default"; then
+        ENABLED_FRODOKEM_SHAKE=yes
+    fi
+    # At least one matrix A generation method must be enabled.
+    if test "$ENABLED_FRODOKEM_SHAKE" = "no" && test "$ENABLED_FRODOKEM_AES" = "no"
+    then
+        AC_MSG_ERROR([frodokem requires at least one of --enable-frodokem-shake or --enable-frodokem-aes.])
+    fi
+    # At least one parameter set must be enabled.
+    if test "$ENABLED_FRODOKEM_640" = "no" && \
+       test "$ENABLED_FRODOKEM_976" = "no" && \
+       test "$ENABLED_FRODOKEM_1344" = "no"
+    then
+        AC_MSG_ERROR([frodokem requires at least one of --enable-frodokem-640, --enable-frodokem-976 or --enable-frodokem-1344.])
+    fi
+    # At least one operation must be enabled.
+    if test "$ENABLED_FRODOKEM_MAKE_KEY" = "no" && \
+       test "$ENABLED_FRODOKEM_ENCAPSULATE" = "no" && \
+       test "$ENABLED_FRODOKEM_DECAPSULATE" = "no"
+    then
+        AC_MSG_ERROR([frodokem requires at least one of --enable-frodokem-make-key, --enable-frodokem-encapsulate or --enable-frodokem-decapsulate.])
+    fi
+else
+    if test "$ENABLED_FRODOKEM_SHAKE" = "default"; then
+        ENABLED_FRODOKEM_SHAKE=no
+    fi
+fi
+
 # Dilithium
 #  - SHA3, Shake128 and Shake256
 AC_ARG_ENABLE([mldsa],
@@ -7639,6 +7799,12 @@ then
     ENABLED_SHAKE128=yes
     ENABLED_SHAKE256=yes
 fi
+if test "$ENABLED_FRODOKEM" != "no"
+then
+    ENABLED_SHA3=yes
+    ENABLED_SHAKE128=yes
+    ENABLED_SHAKE256=yes
+fi
 
 # Set SHA-3 flags
 if test "$ENABLED_SHA3" != "no"
@@ -11916,6 +12082,39 @@ AS_IF([test "x$ENABLED_SYS_CA_CERTS" = "xyes"],
 AS_IF([test "x$ENABLED_DUAL_ALG_CERTS" = "xyes"],
       [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DUAL_ALG_CERTS"])
 
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_HAVE_FRODOKEM"
+       AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_HAVE_FRODOKEM"])
+AS_IF([test "x$ENABLED_FRODOKEM_SHAKE" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_SHAKE"])
+AS_IF([test "x$ENABLED_FRODOKEM_AES" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_AES -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB"])
+AS_IF([test "x$ENABLED_FRODOKEM_SVE" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_SVE"])
+AS_IF([test "x$ENABLED_FRODOKEM_SME" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_SME"])
+AS_IF([test "x$ENABLED_FRODOKEM_EPHEMERAL" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_EPHEMERAL"])
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes" && \
+       test "x$ENABLED_FRODOKEM_SMALL" = "xyes"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_SMALL"])
+# Parameter sets and operations excluded from the build.
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes" && test "x$ENABLED_FRODOKEM_640" = "xno"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_FRODOKEM_640"])
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes" && test "x$ENABLED_FRODOKEM_976" = "xno"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_FRODOKEM_976"])
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes" && test "x$ENABLED_FRODOKEM_1344" = "xno"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_FRODOKEM_1344"])
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes" && \
+       test "x$ENABLED_FRODOKEM_MAKE_KEY" = "xno"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_NO_MAKE_KEY"])
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes" && \
+       test "x$ENABLED_FRODOKEM_ENCAPSULATE" = "xno"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_NO_ENCAPSULATE"])
+AS_IF([test "x$ENABLED_FRODOKEM" = "xyes" && \
+       test "x$ENABLED_FRODOKEM_DECAPSULATE" = "xno"],
+      [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_FRODOKEM_NO_DECAPSULATE"])
+
 AS_IF([test "x$ENABLED_RPK" = "xyes"],
       [AM_CFLAGS="$AM_CFLAGS -DHAVE_RPK"])
 
@@ -12578,6 +12777,7 @@ AM_CONDITIONAL([BUILD_WC_LMS],[test "x$ENABLED_LMS" != "xno" || test "x$ENABLED_
 AM_CONDITIONAL([BUILD_WC_XMSS],[test "x$ENABLED_XMSS" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_WC_SLHDSA],[test "x$ENABLED_SLHDSA" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_WC_MLKEM],[test "x$ENABLED_MLKEM" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
+AM_CONDITIONAL([BUILD_WC_FRODOKEM],[test "x$ENABLED_FRODOKEM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_MLDSA],[test "x$ENABLED_MLDSA" != "xno" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_ECCSI],[test "x$ENABLED_ECCSI" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_SAKKE],[test "x$ENABLED_SAKKE" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
@@ -13300,6 +13500,16 @@ echo "   * Maxim Integrated MAXQ10XX:  $ENABLED_MAXQ10XX"
 echo "   * PSA:                        $ENABLED_PSA"
 echo "   * System CA certs:            $ENABLED_SYS_CA_CERTS"
 echo "   * Dual alg cert support:      $ENABLED_DUAL_ALG_CERTS"
+echo "   * FrodoKEM (experimental):    $ENABLED_FRODOKEM"
+echo "   * FrodoKEM SHAKE-128 matrix A: $ENABLED_FRODOKEM_SHAKE"
+echo "   * FrodoKEM AES-128 matrix A:   $ENABLED_FRODOKEM_AES"
+echo "   * eFrodoKEM (ephemeral):      $ENABLED_FRODOKEM_EPHEMERAL"
+echo "   * FrodoKEM-640:               $ENABLED_FRODOKEM_640"
+echo "   * FrodoKEM-976:               $ENABLED_FRODOKEM_976"
+echo "   * FrodoKEM-1344:              $ENABLED_FRODOKEM_1344"
+echo "   * FrodoKEM make key:          $ENABLED_FRODOKEM_MAKE_KEY"
+echo "   * FrodoKEM encapsulate:       $ENABLED_FRODOKEM_ENCAPSULATE"
+echo "   * FrodoKEM decapsulate:       $ENABLED_FRODOKEM_DECAPSULATE"
 echo "   * ERR Queues per Thread:      $ENABLED_ERRORQUEUEPERTHREAD"
 echo "   * rwlock:                     $ENABLED_RWLOCK"
 echo "   * keylog export:              $ENABLED_KEYLOG_EXPORT"
diff --git a/doc/dox_comments/header_files/doxygen_groups.h b/doc/dox_comments/header_files/doxygen_groups.h
index 3bb8ac043f3..f092dd3d31f 100644
--- a/doc/dox_comments/header_files/doxygen_groups.h
+++ b/doc/dox_comments/header_files/doxygen_groups.h
@@ -39,6 +39,18 @@
     selected when the key is initialized via wc_MlKemKey_Init() or
     wc_MlKemKey_New().
 
+    \defgroup FRODO_KEM Algorithms - FrodoKEM
+    FrodoKEM is a conservative, unstructured-lattice (plain LWE) key
+    encapsulation mechanism. This is an experimental reference
+    implementation following the ISO/CFRG (salted) FrodoKEM and the
+    ephemeral eFrodoKEM (salt-less) variants. Three parameter sets are
+    provided - FrodoKEM-640 (NIST level 1), FrodoKEM-976 (level 3) and
+    FrodoKEM-1344 (level 5) - each with either SHAKE-128 or AES-128
+    generation of the public matrix A. The variant is selected by the
+    key type (a base parameter set optionally OR'd with FRODOKEM_AES
+    and/or FRODOKEM_EPHEMERAL) when the key is initialized via
+    wc_FrodoKemKey_Init() or wc_FrodoKemKey_New().
+
     \defgroup SLH_DSA Algorithms - SLH-DSA (FIPS 205)
     SLH-DSA (Stateless Hash-based Digital Signature Algorithm) is a
     quantum-resistant signature scheme standardized by NIST as
diff --git a/doc/dox_comments/header_files/wc_frodokem.h b/doc/dox_comments/header_files/wc_frodokem.h
new file mode 100644
index 00000000000..6fa6a9c980e
--- /dev/null
+++ b/doc/dox_comments/header_files/wc_frodokem.h
@@ -0,0 +1,462 @@
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Allocates and initializes a new FrodoKemKey on the heap. The
+    returned pointer must be released with wc_FrodoKemKey_Delete().
+
+    FrodoKEM is a conservative, unstructured-lattice key encapsulation
+    mechanism. The type parameter is a base parameter set -
+    WC_FRODOKEM_640_SHAKE (NIST level 1), WC_FRODOKEM_976_SHAKE
+    (level 3) or WC_FRODOKEM_1344_SHAKE (level 5) - optionally OR'd with
+    FRODOKEM_AES (generate matrix A with AES-128 instead of SHAKE-128)
+    and/or FRODOKEM_EPHEMERAL (eFrodoKEM: ephemeral, no salt). Named
+    combinations such as WC_FRODOKEM_640_AES and WC_EFRODOKEM_1344_SHAKE
+    are provided.
+
+    \return Pointer to a freshly allocated FrodoKemKey on success.
+    \return NULL on allocation failure or if type is invalid.
+
+    \param [in] type FrodoKEM key type: a base parameter set optionally
+    OR'd with FRODOKEM_AES and/or FRODOKEM_EPHEMERAL.
+    \param [in] heap Heap hint for dynamic memory allocation. May be
+    NULL.
+    \param [in] devId Device identifier for hardware crypto callbacks.
+    Use INVALID_DEVID for software-only.
+
+    _Example_
+    \code
+    FrodoKemKey* key = wc_FrodoKemKey_New(WC_FRODOKEM_640_SHAKE, NULL,
+        INVALID_DEVID);
+    if (key == NULL) {
+        // allocation failed
+    }
+    // ... use key ...
+    wc_FrodoKemKey_Delete(key, &key);
+    \endcode
+
+    \sa wc_FrodoKemKey_Delete
+    \sa wc_FrodoKemKey_Init
+*/
+FrodoKemKey* wc_FrodoKemKey_New(int type, void* heap, int devId);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Frees and zeros a heap-allocated FrodoKemKey previously
+    returned by wc_FrodoKemKey_New(). On success the caller's pointer
+    variable is set to NULL via key_p when key_p is not NULL.
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key is NULL.
+
+    \param [in,out] key The FrodoKemKey to free.
+    \param [in,out] key_p Optional address of the caller's pointer
+    variable; when not NULL, it is set to NULL on success.
+
+    \sa wc_FrodoKemKey_New
+*/
+int wc_FrodoKemKey_Delete(FrodoKemKey* key, FrodoKemKey** key_p);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Initializes a FrodoKemKey object in place. The type parameter
+    selects the FrodoKEM variant: a base parameter set
+    (WC_FRODOKEM_640_SHAKE, WC_FRODOKEM_976_SHAKE or
+    WC_FRODOKEM_1344_SHAKE) optionally OR'd with FRODOKEM_AES and/or
+    FRODOKEM_EPHEMERAL.
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key is NULL or type has bits set outside a
+    base parameter set, FRODOKEM_AES and FRODOKEM_EPHEMERAL.
+    \return NOT_COMPILED_IN if type names a valid variant whose
+    parameter set or matrix-A generation method was disabled at build
+    time.
+
+    \param [in,out] key Pointer to the FrodoKemKey to initialize.
+    \param [in] type FrodoKEM key type: a base parameter set optionally
+    OR'd with FRODOKEM_AES and/or FRODOKEM_EPHEMERAL.
+    \param [in] heap Heap hint for dynamic memory allocation. May be
+    NULL.
+    \param [in] devId Device identifier for hardware crypto callbacks.
+
+    _Example_
+    \code
+    FrodoKemKey key;
+    int ret;
+
+    ret = wc_FrodoKemKey_Init(&key, WC_FRODOKEM_640_SHAKE, NULL,
+        INVALID_DEVID);
+    if (ret != 0) {
+        // error initializing key
+    }
+    // ... use key ...
+    wc_FrodoKemKey_Free(&key);
+    \endcode
+
+    \sa wc_FrodoKemKey_Free
+    \sa wc_FrodoKemKey_MakeKey
+*/
+int wc_FrodoKemKey_Init(FrodoKemKey* key, int type, void* heap,
+    int devId);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Releases the resources held by a FrodoKemKey initialized with
+    wc_FrodoKemKey_Init() and zeroizes its secret material. The key
+    object itself is not freed (it was not allocated by Init).
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key is NULL.
+
+    \param [in,out] key The FrodoKemKey to free.
+
+    \sa wc_FrodoKemKey_Init
+*/
+int wc_FrodoKemKey_Free(FrodoKemKey* key);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Generates a FrodoKEM key pair into an initialized key using
+    the provided random number generator. On success the key holds both
+    the public and private keys, which can be serialized with
+    wc_FrodoKemKey_EncodePublicKey() and wc_FrodoKemKey_EncodePrivateKey().
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or rng is NULL.
+    \return MEMORY_E on allocation failure.
+    \return A negative error code from the RNG or hashing on failure.
+
+    \param [in,out] key An initialized FrodoKemKey to hold the generated
+    key pair.
+    \param [in] rng An initialized random number generator.
+
+    _Example_
+    \code
+    FrodoKemKey key;
+    WC_RNG rng;
+    int ret;
+
+    wc_InitRng(&rng);
+    wc_FrodoKemKey_Init(&key, WC_FRODOKEM_640_SHAKE, NULL, INVALID_DEVID);
+
+    ret = wc_FrodoKemKey_MakeKey(&key, &rng);
+    if (ret != 0) {
+        // error generating key pair
+    }
+
+    wc_FrodoKemKey_Free(&key);
+    wc_FreeRng(&rng);
+    \endcode
+
+    \sa wc_FrodoKemKey_MakeKeyWithRandom
+    \sa wc_FrodoKemKey_Encapsulate
+    \sa wc_FrodoKemKey_EncodePublicKey
+*/
+int wc_FrodoKemKey_MakeKey(FrodoKemKey* key, WC_RNG* rng);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Generates a FrodoKEM key pair from caller-supplied random
+    bytes rather than an RNG. This is primarily for testing and known
+    answer tests; production code should use wc_FrodoKemKey_MakeKey().
+    The required length depends on the parameter set (for example
+    WC_FRODOKEM_640_MAKEKEY_RAND_SZ for FrodoKEM-640).
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or rand is NULL, or len is not the
+    length required for the key's parameter set.
+
+    \param [in,out] key An initialized FrodoKemKey to hold the generated
+    key pair.
+    \param [in] rand Buffer of random bytes.
+    \param [in] len Length of rand in bytes; must equal the parameter
+    set's WC_FRODOKEM_<set>_MAKEKEY_RAND_SZ.
+
+    \sa wc_FrodoKemKey_MakeKey
+*/
+int wc_FrodoKemKey_MakeKeyWithRandom(FrodoKemKey* key,
+    const unsigned char* rand, int len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Returns, through len, the size in bytes of a ciphertext
+    (encapsulation) for the key's parameter set. Use this to size the
+    ct buffer passed to wc_FrodoKemKey_Encapsulate().
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or len is NULL.
+
+    \param [in] key An initialized FrodoKemKey.
+    \param [out] len Set to the ciphertext size in bytes.
+
+    \sa wc_FrodoKemKey_Encapsulate
+    \sa wc_FrodoKemKey_SharedSecretSize
+*/
+int wc_FrodoKemKey_CipherTextSize(FrodoKemKey* key, word32* len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Returns, through len, the size in bytes of a shared secret
+    for the key's parameter set. Use this to size the ss buffer passed
+    to wc_FrodoKemKey_Encapsulate() and wc_FrodoKemKey_Decapsulate().
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or len is NULL.
+
+    \param [in] key An initialized FrodoKemKey.
+    \param [out] len Set to the shared secret size in bytes.
+
+    \sa wc_FrodoKemKey_CipherTextSize
+    \sa wc_FrodoKemKey_Encapsulate
+*/
+int wc_FrodoKemKey_SharedSecretSize(FrodoKemKey* key, word32* len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Encapsulates to a public key: generates a random shared
+    secret and the ciphertext that encapsulates it under key's public
+    key. The key must hold a public key (from wc_FrodoKemKey_MakeKey()
+    or wc_FrodoKemKey_DecodePublicKey()). Size the ct and ss buffers with
+    wc_FrodoKemKey_CipherTextSize() and wc_FrodoKemKey_SharedSecretSize().
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key, ct, ss or rng is NULL.
+    \return BAD_STATE_E if key does not hold a public key.
+    \return MEMORY_E on allocation failure.
+
+    \param [in] key A FrodoKemKey holding a public key.
+    \param [out] ct Buffer to receive the ciphertext.
+    \param [out] ss Buffer to receive the shared secret.
+    \param [in] rng An initialized random number generator.
+
+    _Example_
+    \code
+    FrodoKemKey key;
+    WC_RNG rng;
+    word32 ctSz, ssSz;
+    byte ct[WC_FRODOKEM_640_CIPHER_TEXT_SIZE];
+    byte ss[WC_FRODOKEM_640_SS_SIZE];
+    int ret;
+
+    // key holds a decoded/generated public key
+    wc_FrodoKemKey_CipherTextSize(&key, &ctSz);
+    wc_FrodoKemKey_SharedSecretSize(&key, &ssSz);
+
+    ret = wc_FrodoKemKey_Encapsulate(&key, ct, ss, &rng);
+    if (ret != 0) {
+        // error encapsulating
+    }
+    \endcode
+
+    \sa wc_FrodoKemKey_Decapsulate
+    \sa wc_FrodoKemKey_EncapsulateWithRandom
+    \sa wc_FrodoKemKey_CipherTextSize
+*/
+int wc_FrodoKemKey_Encapsulate(FrodoKemKey* key, unsigned char* ct,
+    unsigned char* ss, WC_RNG* rng);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Encapsulates using caller-supplied random bytes rather than
+    an RNG. This is primarily for testing and known answer tests;
+    production code should use wc_FrodoKemKey_Encapsulate(). The required
+    length depends on the parameter set (for example
+    WC_FRODOKEM_640_ENC_RAND_SZ for FrodoKEM-640).
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key, ct, ss or rand is NULL, or len is not
+    the length required for the key's parameter set.
+    \return BAD_STATE_E if key does not hold a public key.
+
+    \param [in] key A FrodoKemKey holding a public key.
+    \param [out] ct Buffer to receive the ciphertext.
+    \param [out] ss Buffer to receive the shared secret.
+    \param [in] rand Buffer of random bytes.
+    \param [in] len Length of rand in bytes; must equal the parameter
+    set's WC_FRODOKEM_<set>_ENC_RAND_SZ.
+
+    \sa wc_FrodoKemKey_Encapsulate
+*/
+int wc_FrodoKemKey_EncapsulateWithRandom(FrodoKemKey* key,
+    unsigned char* ct, unsigned char* ss, const unsigned char* rand,
+    int len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Decapsulates a ciphertext to recover the shared secret using
+    the key's private key. FrodoKEM is IND-CCA2 secure: a ciphertext
+    that does not decrypt consistently yields a pseudo-random shared
+    secret (implicit rejection) rather than an error, so decapsulation
+    of a valid ciphertext reproduces the shared secret from
+    encapsulation. Size the ss buffer with
+    wc_FrodoKemKey_SharedSecretSize().
+
+    \return 0 on success (a shared secret is always produced for a
+    correctly sized ciphertext).
+    \return BAD_FUNC_ARG if key, ss or ct is NULL, or len is not the
+    ciphertext size for the key's parameter set.
+    \return BAD_STATE_E if key does not hold a private key.
+    \return MEMORY_E on allocation failure.
+
+    \param [in] key A FrodoKemKey holding a private key.
+    \param [out] ss Buffer to receive the shared secret.
+    \param [in] ct The ciphertext to decapsulate.
+    \param [in] len Length of ct in bytes; must equal the ciphertext
+    size for the key's parameter set.
+
+    _Example_
+    \code
+    FrodoKemKey key;
+    word32 ssSz;
+    byte ss[WC_FRODOKEM_640_SS_SIZE];
+    int ret;
+
+    // key holds a decoded/generated private key
+    wc_FrodoKemKey_SharedSecretSize(&key, &ssSz);
+
+    ret = wc_FrodoKemKey_Decapsulate(&key, ss, ct, ctSz);
+    if (ret != 0) {
+        // error decapsulating
+    }
+    \endcode
+
+    \sa wc_FrodoKemKey_Encapsulate
+    \sa wc_FrodoKemKey_SharedSecretSize
+*/
+int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
+    const unsigned char* ct, word32 len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Decodes (imports) a FrodoKEM private key from its serialized
+    form into an initialized key. The expected length matches
+    wc_FrodoKemKey_PrivateKeySize() for the key's parameter set.
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or in is NULL, or len is not the private
+    key size for the key's parameter set.
+
+    \param [in,out] key An initialized FrodoKemKey to hold the private
+    key.
+    \param [in] in The serialized private key.
+    \param [in] len Length of in in bytes.
+
+    \sa wc_FrodoKemKey_EncodePrivateKey
+    \sa wc_FrodoKemKey_PrivateKeySize
+    \sa wc_FrodoKemKey_Decapsulate
+*/
+int wc_FrodoKemKey_DecodePrivateKey(FrodoKemKey* key,
+    const unsigned char* in, word32 len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Decodes (imports) a FrodoKEM public key from its serialized
+    form into an initialized key. The expected length matches
+    wc_FrodoKemKey_PublicKeySize() for the key's parameter set.
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or in is NULL, or len is not the public
+    key size for the key's parameter set.
+
+    \param [in,out] key An initialized FrodoKemKey to hold the public
+    key.
+    \param [in] in The serialized public key.
+    \param [in] len Length of in in bytes.
+
+    \sa wc_FrodoKemKey_EncodePublicKey
+    \sa wc_FrodoKemKey_PublicKeySize
+    \sa wc_FrodoKemKey_Encapsulate
+*/
+int wc_FrodoKemKey_DecodePublicKey(FrodoKemKey* key,
+    const unsigned char* in, word32 len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Returns, through len, the size in bytes of a serialized
+    private key for the key's parameter set. Use this to size the buffer
+    passed to wc_FrodoKemKey_EncodePrivateKey().
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or len is NULL.
+
+    \param [in] key An initialized FrodoKemKey.
+    \param [out] len Set to the private key size in bytes.
+
+    \sa wc_FrodoKemKey_EncodePrivateKey
+    \sa wc_FrodoKemKey_DecodePrivateKey
+*/
+int wc_FrodoKemKey_PrivateKeySize(FrodoKemKey* key, word32* len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Returns, through len, the size in bytes of a serialized
+    public key for the key's parameter set. Use this to size the buffer
+    passed to wc_FrodoKemKey_EncodePublicKey().
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or len is NULL.
+
+    \param [in] key An initialized FrodoKemKey.
+    \param [out] len Set to the public key size in bytes.
+
+    \sa wc_FrodoKemKey_EncodePublicKey
+    \sa wc_FrodoKemKey_DecodePublicKey
+*/
+int wc_FrodoKemKey_PublicKeySize(FrodoKemKey* key, word32* len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Encodes (exports) the private key held by key into its
+    serialized form. The out buffer must be at least
+    wc_FrodoKemKey_PrivateKeySize() bytes.
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or out is NULL, or len is smaller than
+    the private key size for the key's parameter set.
+    \return BAD_STATE_E if key does not hold a private key.
+
+    \param [in] key A FrodoKemKey holding a private key.
+    \param [out] out Buffer to receive the serialized private key.
+    \param [in] len Length of the out buffer in bytes.
+
+    \sa wc_FrodoKemKey_DecodePrivateKey
+    \sa wc_FrodoKemKey_PrivateKeySize
+*/
+int wc_FrodoKemKey_EncodePrivateKey(FrodoKemKey* key,
+    unsigned char* out, word32 len);
+
+/*!
+    \ingroup FRODO_KEM
+
+    \brief Encodes (exports) the public key held by key into its
+    serialized form. The out buffer must be at least
+    wc_FrodoKemKey_PublicKeySize() bytes.
+
+    \return 0 on success.
+    \return BAD_FUNC_ARG if key or out is NULL, or len is smaller than
+    the public key size for the key's parameter set.
+    \return BAD_STATE_E if key does not hold a public key.
+
+    \param [in] key A FrodoKemKey holding a public key.
+    \param [out] out Buffer to receive the serialized public key.
+    \param [in] len Length of the out buffer in bytes.
+
+    \sa wc_FrodoKemKey_DecodePublicKey
+    \sa wc_FrodoKemKey_PublicKeySize
+*/
+int wc_FrodoKemKey_EncodePublicKey(FrodoKemKey* key,
+    unsigned char* out, word32 len);
diff --git a/src/include.am b/src/include.am
index bbee8f9394d..d22737d7dbf 100644
--- a/src/include.am
+++ b/src/include.am
@@ -1849,6 +1849,43 @@ src_libwolfssl@LIBSUFFIX@_la_SOURCES += \
                wolfcrypt/src/logging.c \
                wolfcrypt/src/wc_port.c
 
+# FrodoKEM (experimental reference implementation)
+if BUILD_WC_FRODOKEM
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_frodokem.c
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_frodokem_mat.c
+if BUILD_INTELASM
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/wc_frodokem_asm.S
+endif BUILD_INTELASM
+# AArch64: NEON, plus the opt-in SVE and SME ops (guarded by WOLFSSL_FRODOKEM_SVE
+# / WOLFSSL_FRODOKEM_SME), all in the one armv8-frodokem-asm file.
+if BUILD_ARMASM_NEON
+if BUILD_ARMASM_INLINE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
+else
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/arm/armv8-frodokem-asm.S
+endif !BUILD_ARMASM_INLINE
+endif BUILD_ARMASM_NEON
+# AArch32: NEON and the 32-bit-SIMD (SMLAD/SADD16/...) NEON-absent fallback share
+# the one armv8-32-frodokem-asm file, built for ARM (non-Thumb) with or without
+# NEON. Thumb2 has its own file.
+if BUILD_ARMASM
+if BUILD_ARM_NONTHUMB
+if BUILD_ARMASM_INLINE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/arm/armv8-32-frodokem-asm_c.c
+else
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/arm/armv8-32-frodokem-asm.S
+endif !BUILD_ARMASM_INLINE
+endif BUILD_ARM_NONTHUMB
+if BUILD_ARM_THUMB
+if BUILD_ARMASM_INLINE
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/arm/thumb2-frodokem-asm_c.c
+else
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/port/arm/thumb2-frodokem-asm.S
+endif !BUILD_ARMASM_INLINE
+endif BUILD_ARM_THUMB
+endif BUILD_ARMASM
+endif
+
 if BUILD_ERROR_STRINGS
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/error.c
 endif
diff --git a/tests/api.c b/tests/api.c
index 238ea673976..d9ac5b2bf26 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -235,6 +235,7 @@
 #include <tests/api/test_curve448.h>
 #include <tests/api/test_ed448.h>
 #include <tests/api/test_mlkem.h>
+#include <tests/api/test_frodokem.h>
 #include <tests/api/test_mldsa.h>
 #include <tests/api/test_slhdsa.h>
 #include <tests/api/test_signature.h>
@@ -36979,6 +36980,7 @@ TEST_CASE testCases[] = {
     TEST_ED448_DECLS,
     /* Kyber */
     TEST_MLKEM_DECLS,
+    TEST_FRODOKEM_DECLS,
     /* Dilithium */
     TEST_MLDSA_DECLS,
     /* SLH-DSA */
diff --git a/tests/api/include.am b/tests/api/include.am
index fcb9720114c..b3f46178e18 100644
--- a/tests/api/include.am
+++ b/tests/api/include.am
@@ -47,6 +47,7 @@ tests_unit_test_SOURCES += tests/api/test_ed25519.c
 tests_unit_test_SOURCES += tests/api/test_curve448.c
 tests_unit_test_SOURCES += tests/api/test_ed448.c
 tests_unit_test_SOURCES += tests/api/test_mlkem.c
+tests_unit_test_SOURCES += tests/api/test_frodokem.c
 tests_unit_test_SOURCES += tests/api/test_mldsa.c
 tests_unit_test_SOURCES += tests/api/test_mldsa_legacy.c
 tests_unit_test_SOURCES += tests/api/test_slhdsa.c
@@ -163,6 +164,7 @@ EXTRA_DIST += tests/api/test_ed25519.h
 EXTRA_DIST += tests/api/test_curve448.h
 EXTRA_DIST += tests/api/test_ed448.h
 EXTRA_DIST += tests/api/test_mlkem.h
+EXTRA_DIST += tests/api/test_frodokem.h
 EXTRA_DIST += tests/api/test_mldsa.h
 EXTRA_DIST += tests/api/test_slhdsa.h
 EXTRA_DIST += tests/api/test_signature.h
diff --git a/tests/api/test_frodokem.c b/tests/api/test_frodokem.c
new file mode 100644
index 00000000000..75df0058db7
--- /dev/null
+++ b/tests/api/test_frodokem.c
@@ -0,0 +1,1498 @@
+/* test_frodokem.c
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#include <tests/unit.h>
+
+#ifdef NO_INLINE
+    #include <wolfssl/wolfcrypt/misc.h>
+#else
+    #define WOLFSSL_MISC_INCLUDED
+    #include <wolfcrypt/src/misc.c>
+#endif
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    #include <wolfssl/wolfcrypt/wc_frodokem.h>
+    #include <wolfssl/wolfcrypt/hash.h>
+    #include <wolfssl/wolfcrypt/sha256.h>
+#endif
+#include <wolfssl/wolfcrypt/types.h>
+#include <tests/api/api.h>
+#include <tests/api/test_frodokem.h>
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+
+/* The set of compiled-in key types, used to drive the functional tests. */
+static const int frodokem_types[] = {
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+#ifdef WOLFSSL_WC_FRODOKEM_640
+    WC_FRODOKEM_640_SHAKE,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_976
+    WC_FRODOKEM_976_SHAKE,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+    WC_FRODOKEM_1344_SHAKE,
+#endif
+#endif /* WOLFSSL_FRODOKEM_SHAKE */
+#ifdef WOLFSSL_FRODOKEM_AES
+#ifdef WOLFSSL_WC_FRODOKEM_640
+    WC_FRODOKEM_640_AES,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_976
+    WC_FRODOKEM_976_AES,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+    WC_FRODOKEM_1344_AES,
+#endif
+#endif /* WOLFSSL_FRODOKEM_AES */
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+#ifdef WOLFSSL_WC_FRODOKEM_640
+    WC_EFRODOKEM_640_SHAKE,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_976
+    WC_EFRODOKEM_976_SHAKE,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+    WC_EFRODOKEM_1344_SHAKE,
+#endif
+#endif /* WOLFSSL_FRODOKEM_SHAKE */
+#ifdef WOLFSSL_FRODOKEM_AES
+#ifdef WOLFSSL_WC_FRODOKEM_640
+    WC_EFRODOKEM_640_AES,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_976
+    WC_EFRODOKEM_976_AES,
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+    WC_EFRODOKEM_1344_AES,
+#endif
+#endif /* WOLFSSL_FRODOKEM_AES */
+#endif /* WOLFSSL_FRODOKEM_EPHEMERAL */
+    0 /* sentinel so the array is never empty */
+};
+
+#define FRODOKEM_TYPE_CNT \
+    ((int)(sizeof(frodokem_types) / sizeof(frodokem_types[0])) - 1)
+
+/* The KAT data is only used by the make-key/encapsulate/decapsulate KAT tests,
+ * all of which need key generation to reconstruct the key. */
+#if !defined(NO_SHA256) && !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
+
+/* Known-answer test data derived from the official FrodoKEM and eFrodoKEM
+ * KAT vectors (PQCkemKAT_*.rsp, count 0), for both the SHAKE and AES matrix A
+ * generation variants. To keep the data compact the public key, secret key and
+ * ciphertext are stored as SHA-256 digests; the shared secret is stored in
+ * full. The seed randomness (kr = s || seedSE || z for key generation, er =
+ * u || salt for encapsulation) is what the NIST AES-CTR DRBG produces for KAT
+ * count 0. */
+
+#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_SHAKE)
+static const byte frodokem_kr_640_SHAKE[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,
+};
+static const byte frodokem_er_640_SHAKE[] = {
+    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
+    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
+    0x19,0x42,0xec,0xa8,0xf6,0xc0,0x01,0xba,0x26,0x20,0x2b,0xee,
+    0x59,0xac,0x27,0x54,0x84,0xea,0x76,0x7d,0x41,0xd8,0xd3,0x57,
+};
+static const byte frodokem_hpk_640_SHAKE[] = {
+    0x10,0xe6,0x3e,0xfe,0x34,0x0a,0x73,0xd4,0x6d,0x78,0xf7,0x68,
+    0xcf,0xea,0x23,0x5d,0x0d,0x7d,0xa1,0xe9,0xc6,0x36,0xd6,0xed,
+    0xc3,0x2d,0x2a,0x4e,0xd4,0xb1,0x3c,0xdc,
+};
+static const byte frodokem_hsk_640_SHAKE[] = {
+    0x23,0x3a,0x52,0xe7,0x3b,0xf5,0xf1,0x6d,0xaa,0xd0,0x03,0xdd,
+    0x15,0xce,0xa2,0x8e,0x30,0xdb,0xe6,0x42,0x61,0x58,0xbe,0x48,
+    0x67,0x95,0x6a,0xff,0x03,0xd1,0x26,0x91,
+};
+static const byte frodokem_hct_640_SHAKE[] = {
+    0x27,0x11,0xc7,0xe8,0x63,0xc9,0xd8,0x1c,0x08,0x18,0x2b,0x3e,
+    0xe1,0xe1,0xc9,0x53,0xcb,0xff,0xb1,0x5d,0xd5,0x0b,0xff,0x88,
+    0x25,0xc6,0xc2,0xa7,0x1a,0x4f,0xd0,0x1d,
+};
+static const byte frodokem_ss_640_SHAKE[] = {
+    0x2e,0xd4,0x2c,0xe7,0xd5,0xdb,0xfb,0x11,0x5f,0x2e,0x2b,0xdc,
+    0xb6,0x50,0xb3,0xfa,
+};
+#define FKAT_640_SHAKE \
+    { WC_FRODOKEM_640_SHAKE, \
+      frodokem_kr_640_SHAKE, \
+      (word32)sizeof(frodokem_kr_640_SHAKE), \
+      frodokem_er_640_SHAKE, \
+      (word32)sizeof(frodokem_er_640_SHAKE), \
+      frodokem_hpk_640_SHAKE, \
+      frodokem_hsk_640_SHAKE, \
+      frodokem_hct_640_SHAKE, \
+      frodokem_ss_640_SHAKE, \
+      (word32)sizeof(frodokem_ss_640_SHAKE) },
+#else
+#define FKAT_640_SHAKE
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_SHAKE)
+static const byte frodokem_kr_976_SHAKE[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
+    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
+    0x17,0x50,0x84,0xaa,
+};
+static const byte frodokem_er_976_SHAKE[] = {
+    0xee,0x71,0x67,0x62,0xc1,0x5e,0x3b,0x72,0xaa,0x76,0x50,0xa6,
+    0x3b,0x9a,0x51,0x00,0x40,0xb0,0x3c,0x0f,0xe7,0x04,0x75,0xc0,
+    0x46,0x3b,0xbc,0x45,0xa0,0xba,0x5b,0x79,0x80,0xdd,0x46,0xee,
+    0xf8,0x2f,0xb0,0x62,0x03,0x50,0x77,0xd0,0x42,0xf3,0x06,0xbb,
+    0x63,0x91,0x04,0x0e,0x0d,0xd9,0x65,0xf1,0xfd,0xa9,0xd1,0x83,
+    0xca,0x9f,0xcc,0xb4,0x8f,0xc0,0x10,0xb1,0x84,0xab,0x00,0x33,
+};
+static const byte frodokem_hpk_976_SHAKE[] = {
+    0x75,0xed,0x58,0xdd,0x9c,0xb2,0x50,0x1a,0xf1,0x3e,0x56,0xbb,
+    0xd8,0x57,0x9b,0x73,0x17,0x99,0x8d,0x82,0x8c,0xa2,0x93,0xe3,
+    0x98,0x09,0xf4,0x00,0x44,0x04,0xe7,0x89,
+};
+static const byte frodokem_hsk_976_SHAKE[] = {
+    0x2e,0x79,0x47,0x64,0xc6,0xa3,0xe7,0xc1,0xa1,0x6f,0x00,0xa3,
+    0xc3,0x45,0x59,0x1f,0xea,0x97,0x7c,0x21,0x3c,0x87,0x32,0xad,
+    0x37,0x1a,0xb9,0x60,0x3e,0x5d,0x63,0xa9,
+};
+static const byte frodokem_hct_976_SHAKE[] = {
+    0x6e,0x35,0x8f,0x98,0xcf,0x02,0xec,0xbf,0x38,0xb8,0xdf,0x50,
+    0x61,0x49,0x1d,0xec,0x1e,0xae,0x05,0x2e,0xa6,0x80,0x65,0x61,
+    0xc3,0xa4,0xaa,0x5e,0xd2,0x15,0xf7,0xa3,
+};
+static const byte frodokem_ss_976_SHAKE[] = {
+    0x5b,0x6e,0x5a,0x69,0xa3,0xd5,0xf8,0xe7,0x5e,0xea,0x3a,0x6e,
+    0x95,0x59,0x5e,0xd0,0x27,0x8d,0xa5,0x5b,0x8b,0x37,0x31,0x42,
+};
+#define FKAT_976_SHAKE \
+    { WC_FRODOKEM_976_SHAKE, \
+      frodokem_kr_976_SHAKE, \
+      (word32)sizeof(frodokem_kr_976_SHAKE), \
+      frodokem_er_976_SHAKE, \
+      (word32)sizeof(frodokem_er_976_SHAKE), \
+      frodokem_hpk_976_SHAKE, \
+      frodokem_hsk_976_SHAKE, \
+      frodokem_hct_976_SHAKE, \
+      frodokem_ss_976_SHAKE, \
+      (word32)sizeof(frodokem_ss_976_SHAKE) },
+#else
+#define FKAT_976_SHAKE
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_SHAKE)
+static const byte frodokem_kr_1344_SHAKE[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
+    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
+    0x17,0x50,0x84,0xaa,0x48,0x8b,0x3b,0x74,0x34,0x06,0x78,0xaa,
+    0x38,0xe2,0x2e,0x96,0x28,0xb0,0xa1,0x61,0xfd,0xeb,0x0b,0xd2,
+    0x52,0x17,0x3b,0x9c,
+};
+static const byte frodokem_er_1344_SHAKE[] = {
+    0x9f,0x08,0x58,0x76,0x87,0xff,0x66,0x76,0x5c,0x67,0x1d,0xe7,
+    0x3e,0x91,0x8d,0x28,0x23,0xca,0x57,0x3f,0xf4,0xe7,0xa3,0x1a,
+    0x91,0x60,0x32,0x40,0x26,0xe5,0x40,0xea,0xcb,0x3a,0x04,0xe0,
+    0xd5,0x4c,0x75,0xde,0xb9,0x70,0x5b,0xfd,0xfb,0xdf,0x93,0x5a,
+    0x75,0x28,0x80,0x2e,0xe6,0xe5,0xb0,0xc6,0xa7,0x3b,0x2b,0x76,
+    0x1d,0x9b,0xd0,0x84,0x8a,0x6e,0x4c,0xf3,0xfc,0x4c,0xa8,0x4f,
+    0x14,0xe0,0x33,0x1a,0xf3,0x5b,0xfe,0xf4,0x1e,0x42,0xb1,0x3a,
+    0x6d,0xae,0x6d,0xf9,0x37,0xf7,0x38,0xc1,0x85,0x7b,0xa1,0xca,
+};
+static const byte frodokem_hpk_1344_SHAKE[] = {
+    0x97,0x4d,0x55,0x14,0xfb,0x13,0x11,0x4b,0xb6,0x67,0x52,0x7e,
+    0x84,0x09,0x0b,0x6d,0xe0,0xdf,0xee,0xa0,0x14,0x35,0xc6,0x0a,
+    0x3e,0xdc,0x57,0x0d,0x33,0x1a,0x5b,0xd6,
+};
+static const byte frodokem_hsk_1344_SHAKE[] = {
+    0x02,0xd4,0xf7,0x10,0x96,0xb3,0x6f,0x46,0xa9,0x03,0xf7,0x7f,
+    0xcc,0x9b,0x77,0x64,0x36,0x6d,0x9a,0x8f,0x84,0xf0,0x6c,0x9f,
+    0x86,0xc4,0x64,0xcf,0x69,0x52,0x6d,0x8f,
+};
+static const byte frodokem_hct_1344_SHAKE[] = {
+    0xaa,0x07,0x79,0x97,0x59,0xe8,0x7a,0xd1,0xd0,0x80,0xb2,0xd1,
+    0xeb,0x31,0xd1,0x1e,0x3e,0xf9,0x3e,0x66,0x5d,0xf9,0xa8,0xba,
+    0xe5,0x02,0x7f,0x4e,0x40,0xfc,0x7a,0x46,
+};
+static const byte frodokem_ss_1344_SHAKE[] = {
+    0x8d,0x20,0xf9,0x71,0x46,0x4d,0xf1,0x9e,0x05,0x61,0xbd,0xd3,
+    0x85,0xaf,0xd0,0xe2,0xef,0x0c,0xe2,0x12,0xef,0xd4,0x5a,0x63,
+    0x2f,0x5d,0x2c,0x64,0xf3,0xd6,0x6a,0xac,
+};
+#define FKAT_1344_SHAKE \
+    { WC_FRODOKEM_1344_SHAKE, \
+      frodokem_kr_1344_SHAKE, \
+      (word32)sizeof(frodokem_kr_1344_SHAKE), \
+      frodokem_er_1344_SHAKE, \
+      (word32)sizeof(frodokem_er_1344_SHAKE), \
+      frodokem_hpk_1344_SHAKE, \
+      frodokem_hsk_1344_SHAKE, \
+      frodokem_hct_1344_SHAKE, \
+      frodokem_ss_1344_SHAKE, \
+      (word32)sizeof(frodokem_ss_1344_SHAKE) },
+#else
+#define FKAT_1344_SHAKE
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_AES)
+static const byte frodokem_kr_640_AES[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,
+};
+static const byte frodokem_er_640_AES[] = {
+    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
+    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
+    0x19,0x42,0xec,0xa8,0xf6,0xc0,0x01,0xba,0x26,0x20,0x2b,0xee,
+    0x59,0xac,0x27,0x54,0x84,0xea,0x76,0x7d,0x41,0xd8,0xd3,0x57,
+};
+static const byte frodokem_hpk_640_AES[] = {
+    0x44,0x19,0xf4,0xf1,0x4c,0x33,0x63,0x55,0x11,0x86,0xb9,0x93,
+    0x82,0xbf,0x3e,0x62,0xac,0x23,0x82,0xb7,0xb5,0xd4,0xca,0x70,
+    0x39,0x2d,0xda,0x58,0x69,0xc8,0xbd,0xa1,
+};
+static const byte frodokem_hsk_640_AES[] = {
+    0x1e,0xfb,0x89,0xe5,0xfc,0x52,0xd2,0xbb,0xab,0x4a,0xdb,0xbb,
+    0x65,0xda,0xfb,0x49,0x73,0xd8,0xbf,0x09,0x7f,0x86,0x7e,0xf8,
+    0x6d,0xbe,0xa2,0xfd,0x51,0xe5,0xe3,0xea,
+};
+static const byte frodokem_hct_640_AES[] = {
+    0x56,0xd2,0xbd,0xd0,0xc6,0xe9,0x2b,0xc3,0x65,0xf2,0x86,0xbe,
+    0x75,0x7e,0x46,0xa0,0xe0,0x40,0xc8,0x75,0xef,0x50,0x20,0xbb,
+    0xbf,0xab,0xee,0x00,0x28,0x52,0xe7,0xe4,
+};
+static const byte frodokem_ss_640_AES[] = {
+    0xee,0x5b,0xa8,0xce,0xbb,0x0b,0x41,0xe9,0x03,0x0c,0xa1,0xfb,
+    0xc3,0xbe,0xad,0xb9,
+};
+#define FKAT_640_AES \
+    { WC_FRODOKEM_640_AES, \
+      frodokem_kr_640_AES, \
+      (word32)sizeof(frodokem_kr_640_AES), \
+      frodokem_er_640_AES, \
+      (word32)sizeof(frodokem_er_640_AES), \
+      frodokem_hpk_640_AES, \
+      frodokem_hsk_640_AES, \
+      frodokem_hct_640_AES, \
+      frodokem_ss_640_AES, \
+      (word32)sizeof(frodokem_ss_640_AES) },
+#else
+#define FKAT_640_AES
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_AES)
+static const byte frodokem_kr_976_AES[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
+    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
+    0x17,0x50,0x84,0xaa,
+};
+static const byte frodokem_er_976_AES[] = {
+    0xee,0x71,0x67,0x62,0xc1,0x5e,0x3b,0x72,0xaa,0x76,0x50,0xa6,
+    0x3b,0x9a,0x51,0x00,0x40,0xb0,0x3c,0x0f,0xe7,0x04,0x75,0xc0,
+    0x46,0x3b,0xbc,0x45,0xa0,0xba,0x5b,0x79,0x80,0xdd,0x46,0xee,
+    0xf8,0x2f,0xb0,0x62,0x03,0x50,0x77,0xd0,0x42,0xf3,0x06,0xbb,
+    0x63,0x91,0x04,0x0e,0x0d,0xd9,0x65,0xf1,0xfd,0xa9,0xd1,0x83,
+    0xca,0x9f,0xcc,0xb4,0x8f,0xc0,0x10,0xb1,0x84,0xab,0x00,0x33,
+};
+static const byte frodokem_hpk_976_AES[] = {
+    0x47,0x7d,0x38,0x49,0x0e,0x9c,0xf9,0x67,0xdd,0x03,0x8a,0xf6,
+    0xb9,0x34,0xd0,0x75,0x12,0x7c,0x0d,0x05,0x15,0x9d,0xe0,0x4f,
+    0xc9,0x37,0xb6,0x16,0x5b,0x3d,0xf2,0x1d,
+};
+static const byte frodokem_hsk_976_AES[] = {
+    0x01,0x6e,0xbc,0x6e,0x61,0xcd,0xcf,0x75,0xac,0xf2,0x17,0xe3,
+    0x7b,0xc9,0x2c,0xb5,0x57,0x7f,0x61,0xd1,0x4f,0x2c,0x83,0x8b,
+    0xd1,0xa2,0x67,0x5a,0x4d,0x34,0x26,0xe8,
+};
+static const byte frodokem_hct_976_AES[] = {
+    0x64,0x1f,0xa3,0x00,0x89,0xd3,0x97,0x82,0x8c,0xa9,0xd1,0xc0,
+    0xf2,0x80,0x7b,0xeb,0xe8,0x70,0xa3,0xbd,0xc7,0xdc,0x5b,0xa8,
+    0x86,0x6c,0x54,0x3e,0xbf,0x47,0xbc,0x98,
+};
+static const byte frodokem_ss_976_AES[] = {
+    0xd9,0x38,0x8d,0x1b,0x0f,0x97,0xc5,0xdb,0x5f,0x9b,0x4a,0x7e,
+    0x99,0x42,0x7c,0xfe,0x90,0xe3,0xe1,0x0c,0x5c,0x56,0x9d,0x02,
+};
+#define FKAT_976_AES \
+    { WC_FRODOKEM_976_AES, \
+      frodokem_kr_976_AES, \
+      (word32)sizeof(frodokem_kr_976_AES), \
+      frodokem_er_976_AES, \
+      (word32)sizeof(frodokem_er_976_AES), \
+      frodokem_hpk_976_AES, \
+      frodokem_hsk_976_AES, \
+      frodokem_hct_976_AES, \
+      frodokem_ss_976_AES, \
+      (word32)sizeof(frodokem_ss_976_AES) },
+#else
+#define FKAT_976_AES
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_AES)
+static const byte frodokem_kr_1344_AES[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
+    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,0x2e,0x0f,0x44,0x79,
+    0x17,0x50,0x84,0xaa,0x48,0x8b,0x3b,0x74,0x34,0x06,0x78,0xaa,
+    0x38,0xe2,0x2e,0x96,0x28,0xb0,0xa1,0x61,0xfd,0xeb,0x0b,0xd2,
+    0x52,0x17,0x3b,0x9c,
+};
+static const byte frodokem_er_1344_AES[] = {
+    0x9f,0x08,0x58,0x76,0x87,0xff,0x66,0x76,0x5c,0x67,0x1d,0xe7,
+    0x3e,0x91,0x8d,0x28,0x23,0xca,0x57,0x3f,0xf4,0xe7,0xa3,0x1a,
+    0x91,0x60,0x32,0x40,0x26,0xe5,0x40,0xea,0xcb,0x3a,0x04,0xe0,
+    0xd5,0x4c,0x75,0xde,0xb9,0x70,0x5b,0xfd,0xfb,0xdf,0x93,0x5a,
+    0x75,0x28,0x80,0x2e,0xe6,0xe5,0xb0,0xc6,0xa7,0x3b,0x2b,0x76,
+    0x1d,0x9b,0xd0,0x84,0x8a,0x6e,0x4c,0xf3,0xfc,0x4c,0xa8,0x4f,
+    0x14,0xe0,0x33,0x1a,0xf3,0x5b,0xfe,0xf4,0x1e,0x42,0xb1,0x3a,
+    0x6d,0xae,0x6d,0xf9,0x37,0xf7,0x38,0xc1,0x85,0x7b,0xa1,0xca,
+};
+static const byte frodokem_hpk_1344_AES[] = {
+    0xe2,0x83,0xbf,0xd5,0x9b,0xcc,0xa4,0xda,0x53,0x80,0xbc,0xa9,
+    0xe4,0x3c,0x0d,0xfc,0xc3,0xb3,0xb2,0xb4,0xd3,0xf3,0xa0,0x2c,
+    0x64,0x2e,0x0d,0x43,0x92,0x03,0xee,0x81,
+};
+static const byte frodokem_hsk_1344_AES[] = {
+    0xee,0x4a,0x33,0x60,0x94,0x5b,0x71,0x8f,0xb1,0x04,0x74,0xe9,
+    0xc6,0x64,0xe2,0xc3,0x9b,0xd7,0x7d,0xfd,0x6b,0xfe,0xba,0x73,
+    0x3c,0x10,0xd2,0x69,0x50,0xf4,0x62,0xce,
+};
+static const byte frodokem_hct_1344_AES[] = {
+    0x4a,0x37,0x7d,0xba,0x12,0xe3,0x78,0xeb,0x9a,0x82,0x32,0x02,
+    0x81,0xc9,0xe8,0x61,0x08,0xd8,0x31,0xb2,0xde,0xba,0xe1,0xe1,
+    0x9c,0xc5,0x19,0x5f,0xe8,0x6d,0x73,0x20,
+};
+static const byte frodokem_ss_1344_AES[] = {
+    0x37,0x69,0x55,0x16,0x12,0x73,0xfc,0x66,0x7f,0x3f,0xea,0xe5,
+    0xec,0x98,0x68,0x18,0x20,0xdb,0xd7,0x59,0x97,0x1b,0xb0,0xa2,
+    0xd2,0xbe,0xc4,0x51,0x0f,0x55,0x7e,0x83,
+};
+#define FKAT_1344_AES \
+    { WC_FRODOKEM_1344_AES, \
+      frodokem_kr_1344_AES, \
+      (word32)sizeof(frodokem_kr_1344_AES), \
+      frodokem_er_1344_AES, \
+      (word32)sizeof(frodokem_er_1344_AES), \
+      frodokem_hpk_1344_AES, \
+      frodokem_hsk_1344_AES, \
+      frodokem_hct_1344_AES, \
+      frodokem_ss_1344_AES, \
+      (word32)sizeof(frodokem_ss_1344_AES) },
+#else
+#define FKAT_1344_AES
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
+    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
+static const byte frodokem_kr_E640_SHAKE[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+};
+static const byte frodokem_er_E640_SHAKE[] = {
+    0x33,0xb3,0xc0,0x75,0x07,0xe4,0x20,0x17,0x48,0x49,0x4d,0x83,
+    0x2b,0x6e,0xe2,0xa6,
+};
+static const byte frodokem_hpk_E640_SHAKE[] = {
+    0x49,0xa3,0x03,0x46,0x0f,0x09,0x77,0x33,0x9c,0xbd,0x2c,0x1b,
+    0x5a,0xa0,0xe7,0xaf,0x44,0xc5,0x02,0x49,0x17,0xf5,0xf7,0xac,
+    0xed,0x47,0x25,0xe9,0xd4,0xa2,0xc6,0x14,
+};
+static const byte frodokem_hsk_E640_SHAKE[] = {
+    0x85,0xd0,0xe3,0x16,0x3f,0x8c,0xae,0xbe,0xe1,0xb5,0x48,0x37,
+    0xa4,0x70,0xe6,0xb0,0x49,0x83,0x78,0x4e,0x3c,0x3d,0x2b,0x2f,
+    0x03,0x6b,0x7f,0x95,0x87,0x55,0x08,0xaa,
+};
+static const byte frodokem_hct_E640_SHAKE[] = {
+    0x88,0xba,0x53,0x7b,0x53,0x6d,0x89,0xfd,0x0b,0x84,0xf8,0x60,
+    0x4a,0x60,0x40,0xa9,0xdd,0x96,0x11,0x4e,0xe6,0xad,0x43,0x23,
+    0x5c,0x95,0x1e,0xdf,0x42,0x6c,0x68,0x0d,
+};
+static const byte frodokem_ss_E640_SHAKE[] = {
+    0x72,0x97,0x80,0xfc,0x51,0x65,0x7e,0x21,0x35,0x7f,0x03,0xa3,
+    0x38,0x11,0x65,0x69,
+};
+#define FKAT_E640_SHAKE \
+    { WC_EFRODOKEM_640_SHAKE, \
+      frodokem_kr_E640_SHAKE, \
+      (word32)sizeof(frodokem_kr_E640_SHAKE), \
+      frodokem_er_E640_SHAKE, \
+      (word32)sizeof(frodokem_er_E640_SHAKE), \
+      frodokem_hpk_E640_SHAKE, \
+      frodokem_hsk_E640_SHAKE, \
+      frodokem_hct_E640_SHAKE, \
+      frodokem_ss_E640_SHAKE, \
+      (word32)sizeof(frodokem_ss_E640_SHAKE) },
+#else
+#define FKAT_E640_SHAKE
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
+    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
+static const byte frodokem_kr_E976_SHAKE[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,
+};
+static const byte frodokem_er_E976_SHAKE[] = {
+    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
+    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
+};
+static const byte frodokem_hpk_E976_SHAKE[] = {
+    0x94,0x9c,0xe7,0x6a,0xae,0x38,0xde,0xcd,0x41,0xe2,0x32,0x06,
+    0x23,0x62,0xad,0xb8,0x92,0x46,0xba,0xce,0xfe,0x22,0x1f,0x80,
+    0x32,0x5d,0x45,0x49,0x02,0x63,0x1c,0xe4,
+};
+static const byte frodokem_hsk_E976_SHAKE[] = {
+    0x3d,0x5a,0x3a,0x15,0x0f,0xee,0xd6,0x4a,0x86,0x1f,0x7e,0x87,
+    0xd4,0xee,0x83,0xb1,0x35,0xc8,0xb1,0xbe,0x43,0x9e,0x14,0x21,
+    0xc4,0x19,0xbf,0x86,0xac,0x15,0xdc,0x50,
+};
+static const byte frodokem_hct_E976_SHAKE[] = {
+    0xdf,0x84,0x22,0xbf,0xda,0xe4,0xe3,0x13,0x55,0x22,0x54,0xd4,
+    0xc2,0x91,0xeb,0x17,0xf0,0xc6,0x0d,0x5c,0x46,0x01,0x3a,0x26,
+    0x79,0x21,0x45,0xa4,0xc4,0x6f,0x4b,0x0e,
+};
+static const byte frodokem_ss_E976_SHAKE[] = {
+    0xa9,0x81,0x65,0x53,0x9a,0x4a,0xad,0x97,0x90,0x23,0xd6,0x7b,
+    0x43,0x5d,0x31,0x6f,0x00,0x7c,0x86,0xee,0xaf,0xdb,0x63,0xc7,
+};
+#define FKAT_E976_SHAKE \
+    { WC_EFRODOKEM_976_SHAKE, \
+      frodokem_kr_E976_SHAKE, \
+      (word32)sizeof(frodokem_kr_E976_SHAKE), \
+      frodokem_er_E976_SHAKE, \
+      (word32)sizeof(frodokem_er_E976_SHAKE), \
+      frodokem_hpk_E976_SHAKE, \
+      frodokem_hsk_E976_SHAKE, \
+      frodokem_hct_E976_SHAKE, \
+      frodokem_ss_E976_SHAKE, \
+      (word32)sizeof(frodokem_ss_E976_SHAKE) },
+#else
+#define FKAT_E976_SHAKE
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
+    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
+static const byte frodokem_kr_E1344_SHAKE[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
+    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,
+};
+static const byte frodokem_er_E1344_SHAKE[] = {
+    0x8b,0xf0,0xf4,0x59,0xf0,0xfb,0x3e,0xa8,0xd3,0x27,0x64,0xc2,
+    0x59,0xae,0x63,0x11,0x78,0x97,0x6b,0xaf,0x36,0x83,0xd3,0x33,
+    0x83,0x18,0x8a,0x65,0xa4,0xc2,0x44,0x9b,
+};
+static const byte frodokem_hpk_E1344_SHAKE[] = {
+    0x45,0x4d,0x55,0x2f,0x3c,0x25,0xaa,0xf0,0xe5,0xac,0xc1,0xa4,
+    0xfc,0x43,0x10,0x98,0xb9,0x0c,0xe3,0x99,0x3e,0x86,0x42,0x68,
+    0xa2,0x79,0x5a,0xe7,0xff,0x3c,0xe5,0xca,
+};
+static const byte frodokem_hsk_E1344_SHAKE[] = {
+    0xbe,0x73,0xb2,0x19,0x69,0x05,0x4a,0x4f,0xd4,0x45,0x25,0x08,
+    0x23,0xbe,0xd8,0xec,0x91,0xe6,0xa2,0x52,0x1b,0xce,0x0a,0xd0,
+    0x97,0x49,0xdd,0x1e,0x6c,0xb8,0xd6,0x6f,
+};
+static const byte frodokem_hct_E1344_SHAKE[] = {
+    0x2c,0x76,0xc5,0x40,0xee,0xba,0x95,0x1c,0x7e,0x16,0x68,0x99,
+    0x3d,0x13,0xa3,0xe3,0xcc,0xfd,0xc8,0xbc,0xba,0x29,0x44,0x68,
+    0x54,0x80,0xc2,0xb8,0x82,0x50,0xcc,0xf9,
+};
+static const byte frodokem_ss_E1344_SHAKE[] = {
+    0x6d,0x69,0xdf,0x1a,0x90,0x96,0x8e,0xab,0xad,0xa6,0x9c,0xd3,
+    0x0e,0xc6,0x81,0x3a,0x44,0x06,0x30,0x9d,0xac,0x17,0x44,0x29,
+    0xa0,0x12,0x08,0x52,0xbf,0x82,0x64,0x60,
+};
+#define FKAT_E1344_SHAKE \
+    { WC_EFRODOKEM_1344_SHAKE, \
+      frodokem_kr_E1344_SHAKE, \
+      (word32)sizeof(frodokem_kr_E1344_SHAKE), \
+      frodokem_er_E1344_SHAKE, \
+      (word32)sizeof(frodokem_er_E1344_SHAKE), \
+      frodokem_hpk_E1344_SHAKE, \
+      frodokem_hsk_E1344_SHAKE, \
+      frodokem_hct_E1344_SHAKE, \
+      frodokem_ss_E1344_SHAKE, \
+      (word32)sizeof(frodokem_ss_E1344_SHAKE) },
+#else
+#define FKAT_E1344_SHAKE
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_640) && defined(WOLFSSL_FRODOKEM_AES) && \
+    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
+static const byte frodokem_kr_E640_AES[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+};
+static const byte frodokem_er_E640_AES[] = {
+    0x33,0xb3,0xc0,0x75,0x07,0xe4,0x20,0x17,0x48,0x49,0x4d,0x83,
+    0x2b,0x6e,0xe2,0xa6,
+};
+static const byte frodokem_hpk_E640_AES[] = {
+    0x3d,0x9e,0xc6,0x83,0x5b,0x6e,0x15,0xd8,0x15,0xc2,0xf8,0x45,
+    0x48,0x42,0x79,0xa7,0xcc,0x4b,0xf3,0xcc,0xc7,0x7d,0x00,0x29,
+    0xd3,0xb6,0x95,0x47,0x34,0x19,0xf3,0x29,
+};
+static const byte frodokem_hsk_E640_AES[] = {
+    0x80,0x96,0xbd,0x18,0x6c,0xf9,0x9d,0xfa,0x98,0x9a,0x78,0xe2,
+    0x95,0xe9,0x58,0xcc,0x83,0x39,0xaf,0x24,0x5d,0x7b,0xe3,0x8d,
+    0x88,0x70,0x4f,0x32,0x9a,0x00,0xba,0x66,
+};
+static const byte frodokem_hct_E640_AES[] = {
+    0xa2,0xdb,0xb4,0xa4,0xbc,0x4b,0x72,0x92,0xf3,0x68,0xe7,0x1a,
+    0x34,0x51,0xad,0x8d,0xcd,0x10,0x12,0x32,0x68,0x0c,0x24,0xa6,
+    0x92,0xcc,0xe8,0xca,0xd4,0x03,0x48,0xea,
+};
+static const byte frodokem_ss_E640_AES[] = {
+    0x9f,0x54,0x37,0x7d,0x45,0x20,0x90,0xf3,0x63,0x1e,0x45,0xb9,
+    0x39,0x9a,0x28,0x92,
+};
+#define FKAT_E640_AES \
+    { WC_EFRODOKEM_640_AES, \
+      frodokem_kr_E640_AES, \
+      (word32)sizeof(frodokem_kr_E640_AES), \
+      frodokem_er_E640_AES, \
+      (word32)sizeof(frodokem_er_E640_AES), \
+      frodokem_hpk_E640_AES, \
+      frodokem_hsk_E640_AES, \
+      frodokem_hct_E640_AES, \
+      frodokem_ss_E640_AES, \
+      (word32)sizeof(frodokem_ss_E640_AES) },
+#else
+#define FKAT_E640_AES
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_AES) && \
+    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
+static const byte frodokem_kr_E976_AES[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,
+};
+static const byte frodokem_er_E976_AES[] = {
+    0xeb,0x4a,0x7c,0x66,0xef,0x4e,0xba,0x2d,0xdb,0x38,0xc8,0x8d,
+    0x8b,0xc7,0x06,0xb1,0xd6,0x39,0x00,0x21,0x98,0x17,0x2a,0x7b,
+};
+static const byte frodokem_hpk_E976_AES[] = {
+    0xc6,0xc9,0x25,0x07,0xc1,0xf4,0x8c,0x20,0x89,0x76,0x8d,0xe0,
+    0x14,0x22,0xa5,0x9c,0x2b,0xb8,0x5c,0xe5,0x6e,0x09,0x56,0x5c,
+    0x5f,0x07,0xa9,0x0f,0x84,0x9c,0x45,0xc0,
+};
+static const byte frodokem_hsk_E976_AES[] = {
+    0x07,0x74,0x6e,0x26,0x0b,0x4c,0x11,0x01,0x15,0x58,0xa9,0xb5,
+    0x5e,0x1c,0x27,0xa3,0x76,0x0a,0x3b,0x98,0x0e,0x76,0xab,0x22,
+    0x19,0xaf,0x01,0x85,0x41,0xff,0x00,0x45,
+};
+static const byte frodokem_hct_E976_AES[] = {
+    0x16,0x05,0x08,0xa0,0xd9,0x3e,0x28,0xcd,0xd7,0xd7,0xf3,0xac,
+    0x31,0x66,0x79,0x20,0x4e,0x24,0xf7,0x7d,0x57,0x1d,0x6d,0x31,
+    0x8f,0x41,0x41,0xf2,0x51,0x87,0xfd,0xc2,
+};
+static const byte frodokem_ss_E976_AES[] = {
+    0x59,0x4d,0xe8,0x44,0x73,0xb3,0x40,0x8e,0x35,0xf6,0xc4,0xd1,
+    0xf2,0xf2,0xec,0x3b,0x56,0xd2,0xdd,0xa9,0x6f,0xa2,0x34,0x96,
+};
+#define FKAT_E976_AES \
+    { WC_EFRODOKEM_976_AES, \
+      frodokem_kr_E976_AES, \
+      (word32)sizeof(frodokem_kr_E976_AES), \
+      frodokem_er_E976_AES, \
+      (word32)sizeof(frodokem_er_E976_AES), \
+      frodokem_hpk_E976_AES, \
+      frodokem_hsk_E976_AES, \
+      frodokem_hct_E976_AES, \
+      frodokem_ss_E976_AES, \
+      (word32)sizeof(frodokem_ss_E976_AES) },
+#else
+#define FKAT_E976_AES
+#endif
+
+#if defined(WOLFSSL_WC_FRODOKEM_1344) && defined(WOLFSSL_FRODOKEM_AES) && \
+    defined(WOLFSSL_FRODOKEM_EPHEMERAL)
+static const byte frodokem_kr_E1344_AES[] = {
+    0x7c,0x99,0x35,0xa0,0xb0,0x76,0x94,0xaa,0x0c,0x6d,0x10,0xe4,
+    0xdb,0x6b,0x1a,0xdd,0x2f,0xd8,0x1a,0x25,0xcc,0xb1,0x48,0x03,
+    0x2d,0xcd,0x73,0x99,0x36,0x73,0x7f,0x2d,0xb5,0x05,0xd7,0xcf,
+    0xad,0x1b,0x49,0x74,0x99,0x32,0x3c,0x86,0x86,0x32,0x5e,0x47,
+    0x92,0xf2,0x67,0xaa,0xfa,0x3f,0x87,0xca,0x60,0xd0,0x1c,0xb5,
+    0x4f,0x29,0x20,0x2a,0x3e,0x78,0x4c,0xcb,0x7e,0xbc,0xdc,0xfd,
+    0x45,0x54,0x2b,0x7f,0x6a,0xf7,0x78,0x74,
+};
+static const byte frodokem_er_E1344_AES[] = {
+    0x8b,0xf0,0xf4,0x59,0xf0,0xfb,0x3e,0xa8,0xd3,0x27,0x64,0xc2,
+    0x59,0xae,0x63,0x11,0x78,0x97,0x6b,0xaf,0x36,0x83,0xd3,0x33,
+    0x83,0x18,0x8a,0x65,0xa4,0xc2,0x44,0x9b,
+};
+static const byte frodokem_hpk_E1344_AES[] = {
+    0xf4,0xc8,0x3f,0xd6,0xbd,0xbd,0xd1,0x49,0x30,0x7f,0x72,0xd6,
+    0x7b,0xdd,0x83,0xaa,0x49,0xcd,0xa6,0xde,0xa6,0x9b,0xf3,0x64,
+    0xe7,0xef,0x27,0x76,0xc3,0xb7,0x21,0xff,
+};
+static const byte frodokem_hsk_E1344_AES[] = {
+    0xe4,0x99,0x44,0x64,0x5a,0xa1,0x19,0xb7,0x53,0xe1,0xdd,0x48,
+    0x68,0xb4,0x19,0xc4,0x21,0xe9,0x04,0x61,0xde,0x23,0xbb,0xdc,
+    0xd5,0x5e,0xa2,0x8c,0xa8,0xd1,0x59,0xf9,
+};
+static const byte frodokem_hct_E1344_AES[] = {
+    0x25,0x27,0xe2,0xb6,0x22,0xec,0xa7,0x6d,0xc8,0xea,0x48,0x9d,
+    0x51,0x6c,0x68,0x5c,0x4c,0x67,0x75,0x11,0x27,0xfd,0x3f,0x49,
+    0x25,0xc6,0x91,0x55,0x60,0xe9,0xe8,0x43,
+};
+static const byte frodokem_ss_E1344_AES[] = {
+    0xb2,0x43,0xfe,0x6d,0x7c,0x9b,0x38,0x29,0x25,0x2d,0x5a,0xec,
+    0x09,0x0a,0x47,0x09,0xf5,0xe3,0x96,0xfd,0xef,0xe4,0xef,0x1a,
+    0xa4,0xae,0x6c,0x94,0x98,0xcb,0xce,0x15,
+};
+#define FKAT_E1344_AES \
+    { WC_EFRODOKEM_1344_AES, \
+      frodokem_kr_E1344_AES, \
+      (word32)sizeof(frodokem_kr_E1344_AES), \
+      frodokem_er_E1344_AES, \
+      (word32)sizeof(frodokem_er_E1344_AES), \
+      frodokem_hpk_E1344_AES, \
+      frodokem_hsk_E1344_AES, \
+      frodokem_hct_E1344_AES, \
+      frodokem_ss_E1344_AES, \
+      (word32)sizeof(frodokem_ss_E1344_AES) },
+#else
+#define FKAT_E1344_AES
+#endif
+
+
+/* One known-answer entry per compiled parameter set / variant. */
+typedef struct FrodoKemKat {
+    int type;
+    const byte* kr;
+    word32 krLen;
+    const byte* er;
+    word32 erLen;
+    const byte* hpk;
+    const byte* hsk;
+    const byte* hct;
+    const byte* ss;
+    word32 ssLen;
+} FrodoKemKat;
+
+static const FrodoKemKat frodokem_kats[] = {
+    FKAT_640_SHAKE FKAT_976_SHAKE FKAT_1344_SHAKE
+    FKAT_640_AES FKAT_976_AES FKAT_1344_AES
+    FKAT_E640_SHAKE FKAT_E976_SHAKE FKAT_E1344_SHAKE
+    FKAT_E640_AES FKAT_E976_AES FKAT_E1344_AES
+};
+
+#define FRODOKEM_KAT_CNT \
+    ((int)(sizeof(frodokem_kats) / sizeof(frodokem_kats[0])))
+
+#endif /* !NO_SHA256 && !WOLFSSL_FRODOKEM_NO_MAKE_KEY */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+/* KAT: key generation. Regenerate each key from fixed randomness and check the
+ * encoded public and private keys against the expected SHA-256 digests. */
+int test_wc_frodokem_make_key_kats(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(NO_SHA256) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
+    int i;
+    FrodoKemKey* key = NULL;
+    byte* buf = NULL;
+    byte hash[WC_SHA256_DIGEST_SIZE];
+    word32 pkLen = 0;
+    word32 skLen = 0;
+
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    buf = (byte*)XMALLOC(FRODOKEM_MAX_PRIVATE_KEY_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(buf);
+
+    for (i = 0; (i < FRODOKEM_KAT_CNT) && EXPECT_SUCCESS(); i++) {
+        const FrodoKemKat* k = &frodokem_kats[i];
+
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, k->type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, k->kr,
+            (int)k->krLen), 0);
+
+        ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, buf, pkLen), 0);
+        ExpectIntEQ(wc_Sha256Hash(buf, pkLen, hash), 0);
+        ExpectIntEQ(XMEMCMP(hash, k->hpk, WC_SHA256_DIGEST_SIZE), 0);
+
+        ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, buf, skLen), 0);
+        ExpectIntEQ(wc_Sha256Hash(buf, skLen, hash), 0);
+        ExpectIntEQ(XMEMCMP(hash, k->hsk, WC_SHA256_DIGEST_SIZE), 0);
+
+        wc_FrodoKemKey_Free(key);
+    }
+
+    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* KAT: encapsulation. Recreate the key, encapsulate with fixed randomness and
+ * check the ciphertext digest and shared secret against expected values. */
+int test_wc_frodokem_encapsulate_kats(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(NO_SHA256) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE)
+    int i;
+    FrodoKemKey* key = NULL;
+    byte* ct = NULL;
+    byte hash[WC_SHA256_DIGEST_SIZE];
+    byte ss[FRODOKEM_MAX_LENSEC];
+    word32 ctLen = 0;
+    word32 ssLen = 0;
+
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+
+    for (i = 0; (i < FRODOKEM_KAT_CNT) && EXPECT_SUCCESS(); i++) {
+        const FrodoKemKat* k = &frodokem_kats[i];
+
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, k->type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, k->kr,
+            (int)k->krLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
+
+        ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, k->er,
+            (int)k->erLen), 0);
+        ExpectIntEQ(wc_Sha256Hash(ct, ctLen, hash), 0);
+        ExpectIntEQ(XMEMCMP(hash, k->hct, WC_SHA256_DIGEST_SIZE), 0);
+        ExpectIntEQ(XMEMCMP(ss, k->ss, ssLen), 0);
+
+        wc_FrodoKemKey_Free(key);
+    }
+
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* KAT: decapsulation. Recreate the key and ciphertext, decapsulate and check
+ * the recovered shared secret against the expected value. */
+int test_wc_frodokem_decapsulate_kats(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(NO_SHA256) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    int i;
+    FrodoKemKey* key = NULL;
+    byte* ct = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte ssDec[FRODOKEM_MAX_LENSEC];
+    word32 ctLen = 0;
+    word32 ssLen = 0;
+
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+
+    for (i = 0; (i < FRODOKEM_KAT_CNT) && EXPECT_SUCCESS(); i++) {
+        const FrodoKemKat* k = &frodokem_kats[i];
+
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, k->type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, k->kr,
+            (int)k->krLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, k->er,
+            (int)k->erLen), 0);
+
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
+        ExpectIntEQ(XMEMCMP(ssDec, k->ss, ssLen), 0);
+
+        wc_FrodoKemKey_Free(key);
+    }
+
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Full RNG-based round trip for every compiled variant: the decapsulated
+ * shared secret must equal the encapsulated one. */
+int test_wc_frodokem_roundtrip(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    int i;
+    FrodoKemKey* key = NULL;
+    WC_RNG rng;
+    byte* ct = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte ssDec[FRODOKEM_MAX_LENSEC];
+    word32 ctLen = 0;
+    word32 ssLen = 0;
+    int rngInit = 0;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
+            INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
+        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);
+        wc_FrodoKemKey_Free(key);
+    }
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Encode then decode the public and private keys and confirm the decoded key
+ * pair still produces matching shared secrets. */
+int test_wc_frodokem_encode_decode(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    int i;
+    FrodoKemKey* key = NULL;
+    FrodoKemKey* pubKey = NULL;
+    FrodoKemKey* privKey = NULL;
+    WC_RNG rng;
+    byte* pkBuf = NULL;
+    byte* skBuf = NULL;
+    byte* ct = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte ssDec[FRODOKEM_MAX_LENSEC];
+    word32 pkLen = 0;
+    word32 skLen = 0;
+    word32 ctLen = 0;
+    word32 ssLen = 0;
+    int rngInit = 0;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    pubKey = (FrodoKemKey*)XMALLOC(sizeof(*pubKey), NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(pubKey);
+    privKey = (FrodoKemKey*)XMALLOC(sizeof(*privKey), NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(privKey);
+    pkBuf = (byte*)XMALLOC(FRODOKEM_MAX_PUBLIC_KEY_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(pkBuf);
+    skBuf = (byte*)XMALLOC(FRODOKEM_MAX_PRIVATE_KEY_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(skBuf);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        int type = frodokem_types[i];
+
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Init(pubKey, type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Init(privKey, type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
+
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, pkBuf, pkLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, skBuf, skLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(pubKey, pkBuf, pkLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(privKey, skBuf, skLen), 0);
+
+        /* Encapsulate to the decoded public key, decapsulate with the decoded
+         * private key. */
+        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(pubKey, ct, ss, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(privKey, ssDec, ct, ctLen), 0);
+        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);
+
+        wc_FrodoKemKey_Free(privKey);
+        wc_FrodoKemKey_Free(pubKey);
+        wc_FrodoKemKey_Free(key);
+    }
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(skBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(pkBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* A modified ciphertext must decapsulate (implicit rejection) to a shared
+ * secret different from the one produced for the valid ciphertext. */
+int test_wc_frodokem_decap_implicit_reject(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    int i;
+    FrodoKemKey* key = NULL;
+    WC_RNG rng;
+    byte* ct = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte ssDec[FRODOKEM_MAX_LENSEC];
+    byte ssDec2[FRODOKEM_MAX_LENSEC];
+    byte exp[FRODOKEM_MAX_LENSEC];
+    wc_Shake sh;
+    word32 ctLen = 0;
+    word32 ssLen = 0;
+    int rngInit = 0;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    XMEMSET(&sh, 0, sizeof(sh));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    /* Every compiled variant: a modified ciphertext must decapsulate to an
+     * implicit-rejection secret, deterministically. */
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
+            INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
+        /* Flip a bit in the ciphertext. */
+        if (EXPECT_SUCCESS()) {
+            ct[0] ^= 0xff;
+        }
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
+        ExpectIntNE(XMEMCMP(ss, ssDec, ssLen), 0);
+        /* Implicit rejection is deterministic: decapsulating the same modified
+         * ciphertext again yields the same shared secret (the SHAKE(c' || s)
+         * value), not uninitialized/garbage data. */
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec2, ct, ctLen), 0);
+        ExpectIntEQ(XMEMCMP(ssDec, ssDec2, ssLen), 0);
+        /* Isolate the implicit-rejection property: the rejected secret must be
+         * SHAKE(c1 || c2 || salt || s) over the STORED rejection secret s (not
+         * k'). Recompute it (640 hashes with SHAKE128, 976/1344 with SHAKE256)
+         * and confirm it matches - a select that used k' would not. */
+        if ((frodokem_types[i] & FRODOKEM_BASE_MASK) == WC_FRODOKEM_640) {
+            ExpectIntEQ(wc_InitShake128(&sh, NULL, INVALID_DEVID), 0);
+            ExpectIntEQ(wc_Shake128_Update(&sh, ct, ctLen), 0);
+            ExpectIntEQ(wc_Shake128_Update(&sh, key->s, ssLen), 0);
+            ExpectIntEQ(wc_Shake128_Final(&sh, exp, ssLen), 0);
+            wc_Shake128_Free(&sh);
+        }
+        else {
+            ExpectIntEQ(wc_InitShake256(&sh, NULL, INVALID_DEVID), 0);
+            ExpectIntEQ(wc_Shake256_Update(&sh, ct, ctLen), 0);
+            ExpectIntEQ(wc_Shake256_Update(&sh, key->s, ssLen), 0);
+            ExpectIntEQ(wc_Shake256_Final(&sh, exp, ssLen), 0);
+            wc_Shake256_Free(&sh);
+        }
+        ExpectIntEQ(XMEMCMP(ssDec, exp, ssLen), 0);
+        wc_FrodoKemKey_Free(key);
+    }
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Decapsulating with a public-key-only object must fail. */
+int test_wc_frodokem_decapsulate_pubonly_fails(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    int i;
+    FrodoKemKey* key = NULL;
+    FrodoKemKey* pubKey = NULL;
+    WC_RNG rng;
+    byte* pkBuf = NULL;
+    byte* ct = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte ssDec[FRODOKEM_MAX_LENSEC];
+    word32 pkLen = 0;
+    word32 ctLen = 0;
+    int rngInit = 0;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    pubKey = (FrodoKemKey*)XMALLOC(sizeof(*pubKey), NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(pubKey);
+    pkBuf = (byte*)XMALLOC(FRODOKEM_MAX_PUBLIC_KEY_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(pkBuf);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    /* Every compiled variant: a public-key-only object cannot decapsulate. */
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
+            INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Init(pubKey, frodokem_types[i], NULL,
+            INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, pkBuf, pkLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(pubKey, pkBuf, pkLen), 0);
+        /* Public-key-only object cannot decapsulate. */
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(pubKey, ssDec, ct, ctLen),
+            WC_NO_ERR_TRACE(BAD_STATE_E));
+        wc_FrodoKemKey_Free(pubKey);
+        wc_FrodoKemKey_Free(key);
+    }
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(pkBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* A private key whose embedded public-key hash does not match the public key
+ * must be rejected by decode. */
+int test_wc_frodokem_decode_privkey_bad_pkh(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
+    int i;
+    FrodoKemKey* key = NULL;
+    WC_RNG rng;
+    byte* sk = NULL;
+    word32 skLen = 0;
+    int rngInit = 0;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    sk = (byte*)XMALLOC(FRODOKEM_MAX_PRIVATE_KEY_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(sk);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    /* Every compiled variant: a corrupted embedded pkh is rejected. */
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
+            INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, sk, skLen), 0);
+
+        /* A correctly encoded private key decodes. */
+        ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, sk, skLen), 0);
+
+        /* Corrupt the stored public-key hash (the final lenSec bytes). */
+        if (EXPECT_SUCCESS()) {
+            sk[skLen - 1] ^= 0xff;
+        }
+        ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, sk, skLen),
+            WC_NO_ERR_TRACE(WC_KEY_MISMATCH_E));
+        wc_FrodoKemKey_Free(key);
+    }
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(sk, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Bad-argument and bad-length handling. */
+int test_wc_frodokem_bad_args(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM)
+    FrodoKemKey* key = NULL;
+    word32 len = 0;
+    word32 pkLen = 0;
+    word32 skLen = 0;
+    int type = frodokem_types[0];
+    byte small[8];
+
+    XMEMSET(small, 0, sizeof(small));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+
+    /* Constructor / destructor NULL handling. */
+#ifndef WC_NO_CONSTRUCTORS
+    ExpectIntEQ(wc_FrodoKemKey_Delete(NULL, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+    ExpectIntEQ(wc_FrodoKemKey_Free(NULL), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    /* Init argument checks: NULL key, unknown type bits. */
+    ExpectIntEQ(wc_FrodoKemKey_Init(NULL, type, NULL, INVALID_DEVID),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_Init(key, -1, NULL, INVALID_DEVID),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    /* Size queries reject NULL key and NULL output. */
+    ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
+    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(NULL, &len),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(NULL, &len),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(NULL, &len),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(NULL, &len),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
+    ExpectIntEQ(wc_FrodoKemKey_PrivateKeySize(key, &skLen), 0);
+
+    /* Make key argument and length checks. */
+#ifndef WOLFSSL_FRODOKEM_NO_MAKE_KEY
+    ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(NULL, small, 0),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, NULL, 0),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_MakeKeyWithRandom(key, small, 1),
+        WC_NO_ERR_TRACE(BUFFER_E));
+#ifndef WC_NO_RNG
+    ExpectIntEQ(wc_FrodoKemKey_MakeKey(NULL, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+#endif /* !WOLFSSL_FRODOKEM_NO_MAKE_KEY */
+
+    /* Encapsulate argument checks. */
+#ifndef WOLFSSL_FRODOKEM_NO_ENCAPSULATE
+#ifndef WC_NO_RNG
+    ExpectIntEQ(wc_FrodoKemKey_Encapsulate(NULL, small, small, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(NULL, small, small,
+        small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    /* NULL ct / ss are rejected independently of key state. */
+    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, NULL, small,
+        small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, small, NULL,
+        small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#ifndef WC_NO_RNG
+    /* Encapsulate rejects a NULL rng in isolation (ct and ss valid). */
+    ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, small, small, NULL),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+    /* Encapsulate on a key with no public key set reports bad state. */
+    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, small, small,
+        small, 0), WC_NO_ERR_TRACE(BAD_STATE_E));
+#endif /* !WOLFSSL_FRODOKEM_NO_ENCAPSULATE */
+
+    /* Decapsulate argument checks. */
+#ifndef WOLFSSL_FRODOKEM_NO_DECAPSULATE
+    ExpectIntEQ(wc_FrodoKemKey_Decapsulate(NULL, small, small, 0),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    /* NULL ss / ct are rejected independently of key state and length. */
+    ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, NULL, small, 0),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, small, NULL, 0),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+#endif
+
+    /* Encode / decode NULL handling. */
+    ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(NULL, small, pkLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, NULL, pkLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(NULL, small, skLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, NULL, skLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(NULL, small, pkLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(key, NULL, pkLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(NULL, small, skLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, NULL, skLen),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    /* Encoding before any key material is set must report bad state. */
+    ExpectIntEQ(wc_FrodoKemKey_EncodePublicKey(key, small, pkLen),
+        WC_NO_ERR_TRACE(BAD_STATE_E));
+    ExpectIntEQ(wc_FrodoKemKey_EncodePrivateKey(key, small, skLen),
+        WC_NO_ERR_TRACE(BAD_STATE_E));
+
+    /* Wrong encoded lengths on decode must report a buffer error. */
+    ExpectIntEQ(wc_FrodoKemKey_DecodePublicKey(key, small, pkLen - 1),
+        WC_NO_ERR_TRACE(BUFFER_E));
+    ExpectIntEQ(wc_FrodoKemKey_DecodePrivateKey(key, small, skLen - 1),
+        WC_NO_ERR_TRACE(BUFFER_E));
+
+    wc_FrodoKemKey_Free(key);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Encapsulate and decapsulate length checks on a fully made key. */
+int test_wc_frodokem_op_len_checks(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    FrodoKemKey* key = NULL;
+    WC_RNG rng;
+    byte* ct = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte rnd[8];
+    word32 ctLen = 0;
+    int rngInit = 0;
+    int i = 0;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    XMEMSET(rnd, 0, sizeof(rnd));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    /* Repeat for every compiled variant: the bad-length thresholds differ
+     * across the parameter sets and the standard/ephemeral split (encapsulate
+     * checks lenSec + lenSalt, decapsulate checks ctSize), so a single variant
+     * would not exercise them all. */
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, frodokem_types[i], NULL,
+            INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+
+        /* Encapsulate with the wrong random length reports a buffer error (the
+         * public key is set, so this reaches the length check, not bad
+         * state). */
+        ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, rnd, 1),
+            WC_NO_ERR_TRACE(BUFFER_E));
+        /* Decapsulate with the wrong ciphertext length reports a buffer
+         * error. */
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ss, ct, ctLen - 1),
+            WC_NO_ERR_TRACE(BUFFER_E));
+
+        wc_FrodoKemKey_Free(key);
+    }
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Constructor and destructor happy path. */
+int test_wc_frodokem_new_delete(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WC_NO_CONSTRUCTORS)
+    FrodoKemKey* key = NULL;
+    word32 pkLen = 0;
+
+    /* New allocates and initializes the object. */
+    key = wc_FrodoKemKey_New(frodokem_types[0], NULL, INVALID_DEVID);
+    ExpectNotNull(key);
+    /* Initialized: a size query on it succeeds and returns a non-zero size. */
+    ExpectIntEQ(wc_FrodoKemKey_PublicKeySize(key, &pkLen), 0);
+    ExpectIntGT(pkLen, 0);
+    /* Delete frees the object and clears the caller's pointer. */
+    ExpectIntEQ(wc_FrodoKemKey_Delete(key, &key), 0);
+    ExpectNull(key);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* A validly-formed type whose parameter set or A-generation method is not
+ * compiled in must report NOT_COMPILED_IN (an ill-formed type is
+ * BAD_FUNC_ARG). The compiled-variant list is the source of truth, so this
+ * exercises the not-compiled path in single-variant / method-restricted builds
+ * and is a self-consistent no-op when every variant is enabled. */
+int test_wc_frodokem_not_compiled_in(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM)
+    /* All twelve validly-formed variant types. These are bit combinations,
+     * always defined regardless of what is compiled in. */
+    static const int allTypes[] = {
+        WC_FRODOKEM_640_SHAKE, WC_FRODOKEM_976_SHAKE, WC_FRODOKEM_1344_SHAKE,
+        WC_FRODOKEM_640_AES, WC_FRODOKEM_976_AES, WC_FRODOKEM_1344_AES,
+        WC_EFRODOKEM_640_SHAKE, WC_EFRODOKEM_976_SHAKE, WC_EFRODOKEM_1344_SHAKE,
+        WC_EFRODOKEM_640_AES, WC_EFRODOKEM_976_AES, WC_EFRODOKEM_1344_AES
+    };
+    FrodoKemKey* key = NULL;
+    int i, j, compiled;
+
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+
+    for (i = 0; (i < (int)(sizeof(allTypes) / sizeof(allTypes[0]))) &&
+            EXPECT_SUCCESS(); i++) {
+        /* Is this type one of the compiled-in variants? */
+        compiled = 0;
+        for (j = 0; j < FRODOKEM_TYPE_CNT; j++) {
+            if (frodokem_types[j] == allTypes[i]) {
+                compiled = 1;
+                break;
+            }
+        }
+        if (compiled) {
+            /* A compiled variant initializes. */
+            ExpectIntEQ(wc_FrodoKemKey_Init(key, allTypes[i], NULL,
+                INVALID_DEVID), 0);
+            wc_FrodoKemKey_Free(key);
+        }
+        else {
+            /* A valid but not-compiled variant reports NOT_COMPILED_IN. */
+            ExpectIntEQ(wc_FrodoKemKey_Init(key, allTypes[i], NULL,
+                INVALID_DEVID), WC_NO_ERR_TRACE(NOT_COMPILED_IN));
+        }
+    }
+
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
diff --git a/tests/api/test_frodokem.h b/tests/api/test_frodokem.h
new file mode 100644
index 00000000000..ffbdb66ccc3
--- /dev/null
+++ b/tests/api/test_frodokem.h
@@ -0,0 +1,54 @@
+/* test_frodokem.h
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#ifndef WOLFCRYPT_TEST_FRODOKEM_H
+#define WOLFCRYPT_TEST_FRODOKEM_H
+
+#include <tests/api/api_decl.h>
+
+int test_wc_frodokem_make_key_kats(void);
+int test_wc_frodokem_encapsulate_kats(void);
+int test_wc_frodokem_decapsulate_kats(void);
+int test_wc_frodokem_roundtrip(void);
+int test_wc_frodokem_encode_decode(void);
+int test_wc_frodokem_decap_implicit_reject(void);
+int test_wc_frodokem_decapsulate_pubonly_fails(void);
+int test_wc_frodokem_decode_privkey_bad_pkh(void);
+int test_wc_frodokem_bad_args(void);
+int test_wc_frodokem_op_len_checks(void);
+int test_wc_frodokem_new_delete(void);
+int test_wc_frodokem_not_compiled_in(void);
+
+#define TEST_FRODOKEM_DECLS                                                 \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_make_key_kats),            \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_encapsulate_kats),         \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_decapsulate_kats),         \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_roundtrip),                \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_encode_decode),            \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_decap_implicit_reject),    \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_decapsulate_pubonly_fails),\
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_decode_privkey_bad_pkh),   \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_bad_args),                 \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_op_len_checks),            \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_new_delete),               \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_not_compiled_in)
+
+#endif /* WOLFCRYPT_TEST_FRODOKEM_H */
diff --git a/wolfcrypt/benchmark/benchmark.c b/wolfcrypt/benchmark/benchmark.c
index 7f7379b3002..b0f7e79078b 100644
--- a/wolfcrypt/benchmark/benchmark.c
+++ b/wolfcrypt/benchmark/benchmark.c
@@ -171,6 +171,9 @@
 #ifdef WOLFSSL_HAVE_MLKEM
     #include <wolfssl/wolfcrypt/wc_mlkem.h>
 #endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    #include <wolfssl/wolfcrypt/wc_frodokem.h>
+#endif
 #if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
     #include <wolfssl/wolfcrypt/wc_lms.h>
 #endif
@@ -914,6 +917,12 @@ static WC_INLINE void bench_append_memory_info(char* buffer, size_t size,
 #define BENCH_ML_KEM_1024               0x00000080
 #define BENCH_ML_KEM                    (BENCH_ML_KEM_512 | BENCH_ML_KEM_768 | \
                                          BENCH_ML_KEM_1024)
+#define BENCH_FRODOKEM_640              0x00000100
+#define BENCH_FRODOKEM_976              0x00000200
+#define BENCH_FRODOKEM_1344             0x00000400
+#define BENCH_FRODOKEM                  (BENCH_FRODOKEM_640 | \
+                                         BENCH_FRODOKEM_976 | \
+                                         BENCH_FRODOKEM_1344)
 #define BENCH_FALCON_LEVEL1_SIGN        0x00000001
 #define BENCH_FALCON_LEVEL5_SIGN        0x00000002
 #define BENCH_ML_DSA_44_SIGN            0x04000000
@@ -1359,8 +1368,8 @@ static const bench_pq_hash_sig_alg bench_pq_hash_sig_opt[] = {
 #endif /* !WOLFSSL_BENCHMARK_ALL && !NO_MAIN_DRIVER */
 
 #if !defined(WOLFSSL_BENCHMARK_ALL) && !defined(MAIN_NO_ARGS)
-#if defined(WOLFSSL_HAVE_MLKEM) || defined(HAVE_FALCON) || \
-    defined(WOLFSSL_HAVE_MLDSA)
+#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM) || \
+    defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA)
 /* The post-quantum-specific mapping of command line option to bit values and
  * OQS name. */
 typedef struct bench_pq_alg {
@@ -1384,6 +1393,12 @@ static const bench_pq_alg bench_pq_asym_opt[] = {
     { "-ml-kem-768",        BENCH_ML_KEM_768        },
     { "-ml-kem-1024",       BENCH_ML_KEM_1024       },
 #endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    { "-frodokem",          BENCH_FRODOKEM          },
+    { "-frodokem-640",      BENCH_FRODOKEM_640      },
+    { "-frodokem-976",      BENCH_FRODOKEM_976      },
+    { "-frodokem-1344",     BENCH_FRODOKEM_1344     },
+#endif
 #if defined(HAVE_FALCON)
     { "-falcon_level1",     BENCH_FALCON_LEVEL1_SIGN },
     { "-falcon_level5",     BENCH_FALCON_LEVEL5_SIGN },
@@ -4458,6 +4473,26 @@ static void* benchmarks_do(void* args)
     }
 #endif
 
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    if (bench_all || (bench_pq_asym_algs & BENCH_FRODOKEM)) {
+    #ifdef WOLFSSL_WC_FRODOKEM_640
+        if (bench_all || (bench_pq_asym_algs & BENCH_FRODOKEM_640)) {
+            bench_frodokem(WC_FRODOKEM_640);
+        }
+    #endif
+    #ifdef WOLFSSL_WC_FRODOKEM_976
+        if (bench_all || (bench_pq_asym_algs & BENCH_FRODOKEM_976)) {
+            bench_frodokem(WC_FRODOKEM_976);
+        }
+    #endif
+    #ifdef WOLFSSL_WC_FRODOKEM_1344
+        if (bench_all || (bench_pq_asym_algs & BENCH_FRODOKEM_1344)) {
+            bench_frodokem(WC_FRODOKEM_1344);
+        }
+    #endif
+    }
+#endif
+
 #if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
     if (bench_all || (bench_pq_hash_sig_algs & BENCH_LMS_HSS)) {
         bench_lms();
@@ -11439,6 +11474,262 @@ void bench_mlkem(int type)
 }
 #endif
 
+#ifdef WOLFSSL_HAVE_FRODOKEM
+static void bench_frodokem_keygen(int type, const char* name, int keySize,
+    FrodoKemKey* key)
+{
+#ifndef WOLFSSL_FRODOKEM_NO_MAKE_KEY
+    int ret = 0, times, count, pending = 0;
+    double start;
+    const char**desc = bench_desc_words[lng_index];
+    DECLARE_MULTI_VALUE_STATS_VARS()
+
+    bench_stats_prepare();
+
+    /* FrodoKEM Make Key */
+    bench_stats_start(&count, &start);
+    do {
+        /* while free pending slots in queue, submit ops */
+        for (times = 0; times < agreeTimes || pending > 0; times++) {
+            wc_FrodoKemKey_Free(key);
+            ret = wc_FrodoKemKey_Init(key, type, HEAP_HINT, INVALID_DEVID);
+            if (ret != 0)
+                goto exit;
+
+            ret = wc_FrodoKemKey_MakeKey(key, &gRng);
+            if (ret != 0)
+                goto exit;
+            RECORD_MULTI_VALUE_STATS();
+        } /* for times */
+        count += times;
+    } while (bench_stats_check(start)
+#ifdef MULTI_VALUE_STATISTICS
+       || runs < minimum_runs
+#endif
+       );
+
+exit:
+    bench_stats_asym_finish(name, keySize, desc[2], 0, count, start, ret);
+#ifdef MULTI_VALUE_STATISTICS
+    bench_multi_value_stats(max, min, sum, squareSum, runs);
+#endif
+#else
+   (void)type;
+   (void)name;
+   (void)keySize;
+   (void)key;
+#endif /* !WOLFSSL_FRODOKEM_NO_MAKE_KEY */
+}
+
+#if !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) || \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+static void bench_frodokem_encap(int type, const char* name, int keySize,
+    FrodoKemKey* key1, FrodoKemKey* key2)
+{
+    int ret = 0, times, count, pending = 0;
+    double start;
+    const char**desc = bench_desc_words[lng_index];
+    WC_DECLARE_VAR(ct, byte, FRODOKEM_MAX_CIPHER_TEXT_SIZE, HEAP_HINT);
+    WC_DECLARE_VAR(ss, byte, FRODOKEM_MAX_LENSEC, HEAP_HINT);
+    WC_DECLARE_VAR(pub, byte, FRODOKEM_MAX_PUBLIC_KEY_SIZE, HEAP_HINT);
+    word32 pubLen;
+    word32 ctSz;
+    DECLARE_MULTI_VALUE_STATS_VARS()
+
+    bench_stats_prepare();
+
+    WC_ALLOC_VAR(ct, byte, FRODOKEM_MAX_CIPHER_TEXT_SIZE, HEAP_HINT);
+    WC_ALLOC_VAR(ss, byte, FRODOKEM_MAX_LENSEC, HEAP_HINT);
+    WC_ALLOC_VAR(pub, byte, FRODOKEM_MAX_PUBLIC_KEY_SIZE, HEAP_HINT);
+
+    ret = wc_FrodoKemKey_PublicKeySize(key1, &pubLen);
+    if (ret != 0) {
+        goto exit;
+    }
+    ret = wc_FrodoKemKey_EncodePublicKey(key1, pub, pubLen);
+    if (ret != 0) {
+        goto exit;
+    }
+    ret = wc_FrodoKemKey_Init(key2, type, HEAP_HINT, INVALID_DEVID);
+    if (ret != 0) {
+        goto exit;
+    }
+    ret = wc_FrodoKemKey_DecodePublicKey(key2, pub, pubLen);
+    if (ret != 0) {
+        goto exit;
+    }
+
+    ret = wc_FrodoKemKey_CipherTextSize(key2, &ctSz);
+    if (ret != 0) {
+        goto exit;
+    }
+
+#ifndef WOLFSSL_FRODOKEM_NO_ENCAPSULATE
+    /* FrodoKEM Encapsulate */
+    bench_stats_start(&count, &start);
+    do {
+        /* while free pending slots in queue, submit ops */
+        for (times = 0; times < agreeTimes || pending > 0; times++) {
+            ret = wc_FrodoKemKey_Encapsulate(key2, ct, ss, &gRng);
+            if (ret != 0)
+                goto exit_encap;
+            RECORD_MULTI_VALUE_STATS();
+        } /* for times */
+        count += times;
+    } while (bench_stats_check(start)
+#ifdef MULTI_VALUE_STATISTICS
+       || runs < minimum_runs
+#endif
+       );
+
+exit_encap:
+    bench_stats_asym_finish(name, keySize, desc[9], 0, count, start, ret);
+#ifdef MULTI_VALUE_STATISTICS
+    bench_multi_value_stats(max, min, sum, squareSum, runs);
+#endif
+#endif
+
+#ifndef WOLFSSL_FRODOKEM_NO_DECAPSULATE
+    RESET_MULTI_VALUE_STATS_VARS();
+
+    /* FrodoKEM Decapsulate */
+    PRIVATE_KEY_UNLOCK();
+    bench_stats_start(&count, &start);
+    do {
+        /* while free pending slots in queue, submit ops */
+        for (times = 0; times < agreeTimes || pending > 0; times++) {
+            ret = wc_FrodoKemKey_Decapsulate(key1, ss, ct, ctSz);
+            if (ret != 0)
+                goto exit_decap;
+            RECORD_MULTI_VALUE_STATS();
+        } /* for times */
+        count += times;
+    } while (bench_stats_check(start)
+#ifdef MULTI_VALUE_STATISTICS
+       || runs < minimum_runs
+#endif
+       );
+
+exit_decap:
+    PRIVATE_KEY_LOCK();
+    bench_stats_asym_finish(name, keySize, desc[13], 0, count, start, ret);
+#ifdef MULTI_VALUE_STATISTICS
+    bench_multi_value_stats(max, min, sum, squareSum, runs);
+#endif
+
+#endif
+
+exit:
+
+    WC_FREE_VAR(ct, HEAP_HINT);
+    WC_FREE_VAR(ss, HEAP_HINT);
+    WC_FREE_VAR(pub, HEAP_HINT);
+
+    if (ret != 0)
+        printf("error: bench_frodokem_encap() failed with code %d.\n", ret);
+
+    return;
+}
+#endif
+
+void bench_frodokem(int type)
+{
+#ifdef WOLFSSL_SMALL_STACK
+    FrodoKemKey *key1 = NULL;
+    FrodoKemKey *key2 = NULL;
+#else
+    FrodoKemKey key1[1];
+    FrodoKemKey key2[1];
+#endif
+    /* Matrix-A method and eFrodoKEM modifiers to layer onto the base parameter
+     * set. Only combinations that are compiled in are listed, so every built
+     * variant of the requested parameter set is benchmarked. */
+    static const int mods[] = {
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+        0,
+    #ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+        FRODOKEM_EPHEMERAL,
+    #endif
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+        FRODOKEM_AES,
+    #ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+        FRODOKEM_AES | FRODOKEM_EPHEMERAL,
+    #endif
+#endif
+    };
+    int base = type & ~(FRODOKEM_AES | FRODOKEM_EPHEMERAL);
+    const char* baseName = NULL;
+    int keySize = 0;
+    size_t v;
+
+    switch (base) {
+#ifdef WOLFSSL_WC_FRODOKEM_640
+    case WC_FRODOKEM_640:
+        baseName = "640 ";
+        keySize = 128;
+        break;
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_976
+    case WC_FRODOKEM_976:
+        baseName = "976 ";
+        keySize = 192;
+        break;
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+    case WC_FRODOKEM_1344:
+        baseName = "1344";
+        keySize = 256;
+        break;
+#endif
+    default:
+        return;
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    key1 = (FrodoKemKey *)XMALLOC(sizeof(*key1), HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    if (key1 == NULL)
+        return;
+    key2 = (FrodoKemKey *)XMALLOC(sizeof(*key2), HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    if (key2 == NULL) {
+        XFREE(key1, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+        return;
+    }
+#endif
+
+    /* Zero the key objects so the wc_FrodoKemKey_Free calls below are safe even
+     * if a benchmark helper returns before initializing its key. */
+    XMEMSET(key1, 0, sizeof(*key1));
+    XMEMSET(key2, 0, sizeof(*key2));
+
+    for (v = 0; v < sizeof(mods) / sizeof(mods[0]); v++) {
+        int mod = mods[v];
+        int fullType = base | mod;
+        /* e.g. "FRODOKEM 640  SHAKE" or "EFRODOKEM 1344 AES". */
+        char name[24];
+
+        (void)XSNPRINTF(name, sizeof(name), "%sFRODOKEM %s %s",
+            (mod & FRODOKEM_EPHEMERAL) ? "E" : "",
+            baseName,
+            (mod & FRODOKEM_AES) ? "AES" : "SHAKE");
+
+        bench_frodokem_keygen(fullType, name, keySize, key1);
+#if !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) || \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+        bench_frodokem_encap(fullType, name, keySize, key1, key2);
+#endif
+    }
+
+    wc_FrodoKemKey_Free(key2);
+    wc_FrodoKemKey_Free(key1);
+
+    WC_FREE_VAR_EX(key1, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    WC_FREE_VAR_EX(key2, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+}
+#endif
+
 #if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
 #ifndef WOLFSSL_WC_LMS_SERIALIZE_STATE
 #ifndef WOLFSSL_NO_LMS_SHA256_256
diff --git a/wolfcrypt/benchmark/benchmark.h b/wolfcrypt/benchmark/benchmark.h
index 272e6578438..3c97e0b300e 100644
--- a/wolfcrypt/benchmark/benchmark.h
+++ b/wolfcrypt/benchmark/benchmark.h
@@ -104,6 +104,7 @@ void bench_rsa(int useDeviceID);
 void bench_rsa_key(int useDeviceID, word32 keySz);
 void bench_dh(int useDeviceID);
 void bench_mlkem(int type);
+void bench_frodokem(int type);
 void bench_lms(void);
 void bench_xmss(int hash);
 void bench_slhdsa(int param);
diff --git a/wolfcrypt/src/aes_gcm_asm.asm b/wolfcrypt/src/aes_gcm_asm.asm
index 54bcfc033ec..c0de3a6f5d8 100644
--- a/wolfcrypt/src/aes_gcm_asm.asm
+++ b/wolfcrypt/src/aes_gcm_asm.asm
@@ -6459,8 +6459,7 @@ _TEXT ENDS
 IFDEF WOLFSSL_AESGCM_SIV
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcm_siv_bswap_mask QWORD \
-     08090a0b0c0d0e0fh,  0001020304050607h
+L_aes_gcm_siv_bswap_mask QWORD 08090a0b0c0d0e0fh, 0001020304050607h
 ptr_L_aes_gcm_siv_bswap_mask QWORD L_aes_gcm_siv_bswap_mask
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -6825,8 +6824,7 @@ AES_GCMSIV_polyval_aesni ENDP
 _TEXT ENDS
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcmsiv_ctr_aesni_one QWORD \
-     0000000000000001h,  0000000000000000h
+L_aes_gcmsiv_ctr_aesni_one QWORD 0000000000000001h, 0000000000000000h
 ptr_L_aes_gcmsiv_ctr_aesni_one QWORD L_aes_gcmsiv_ctr_aesni_one
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -12471,8 +12469,7 @@ _TEXT ENDS
 IFDEF WOLFSSL_AESGCM_SIV
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcm_siv_bswap_mask_avx1 QWORD \
-     08090a0b0c0d0e0fh,  0001020304050607h
+L_aes_gcm_siv_bswap_mask_avx1 QWORD 08090a0b0c0d0e0fh, 0001020304050607h
 ptr_L_aes_gcm_siv_bswap_mask_avx1 QWORD L_aes_gcm_siv_bswap_mask_avx1
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -12738,8 +12735,7 @@ AES_GCMSIV_polyval_avx1 ENDP
 _TEXT ENDS
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcmsiv_ctr_avx1_one QWORD \
-     0000000000000001h,  0000000000000000h
+L_aes_gcmsiv_ctr_avx1_one QWORD 0000000000000001h, 0000000000000000h
 ptr_L_aes_gcmsiv_ctr_avx1_one QWORD L_aes_gcmsiv_ctr_avx1_one
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -25206,8 +25202,7 @@ _TEXT ENDS
 IFDEF WOLFSSL_AESGCM_SIV
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcm_siv_bswap_mask_vaes QWORD \
-     08090a0b0c0d0e0fh,  0001020304050607h
+L_aes_gcm_siv_bswap_mask_vaes QWORD 08090a0b0c0d0e0fh, 0001020304050607h
 ptr_L_aes_gcm_siv_bswap_mask_vaes QWORD L_aes_gcm_siv_bswap_mask_vaes
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -25743,24 +25738,23 @@ AES_GCMSIV_polyval_vaes ENDP
 _TEXT ENDS
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcmsiv_ctr_inc_vaes QWORD \
-     0000000000000000h,  0000000000000000h,
-     0000000000000001h,  0000000000000000h,
-     0000000000000002h,  0000000000000000h,
-     0000000000000003h,  0000000000000000h,
-     0000000000000004h,  0000000000000000h,
-     0000000000000005h,  0000000000000000h,
-     0000000000000006h,  0000000000000000h,
-     0000000000000007h,  0000000000000000h,
-     0000000000000008h,  0000000000000000h,
-     0000000000000009h,  0000000000000000h,
-     000000000000000ah,  0000000000000000h,
-     000000000000000bh,  0000000000000000h,
-     000000000000000ch,  0000000000000000h,
-     000000000000000dh,  0000000000000000h,
-     000000000000000eh,  0000000000000000h,
-     000000000000000fh,  0000000000000000h,
-     0000000000000010h,  0000000000000000h
+L_aes_gcmsiv_ctr_inc_vaes QWORD 0000000000000000h, 0000000000000000h
+        QWORD 0000000000000001h, 0000000000000000h
+        QWORD 0000000000000002h, 0000000000000000h
+        QWORD 0000000000000003h, 0000000000000000h
+        QWORD 0000000000000004h, 0000000000000000h
+        QWORD 0000000000000005h, 0000000000000000h
+        QWORD 0000000000000006h, 0000000000000000h
+        QWORD 0000000000000007h, 0000000000000000h
+        QWORD 0000000000000008h, 0000000000000000h
+        QWORD 0000000000000009h, 0000000000000000h
+        QWORD 000000000000000ah, 0000000000000000h
+        QWORD 000000000000000bh, 0000000000000000h
+        QWORD 000000000000000ch, 0000000000000000h
+        QWORD 000000000000000dh, 0000000000000000h
+        QWORD 000000000000000eh, 0000000000000000h
+        QWORD 000000000000000fh, 0000000000000000h
+        QWORD 0000000000000010h, 0000000000000000h
 ptr_L_aes_gcmsiv_ctr_inc_vaes QWORD L_aes_gcmsiv_ctr_inc_vaes
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -25777,10 +25771,10 @@ AES_GCMSIV_ctr_vaes PROC
         vmovdqu	OWORD PTR [rsp+48], xmm9
         vmovdqu	OWORD PTR [rsp+64], xmm10
         vmovdqu	OWORD PTR [rsp+80], xmm11
-        vbroadcasti128	ymm7, [r10]
-        vbroadcasti128	ymm8, [ptr_L_aes_gcmsiv_ctr_inc_vaes+128]
-        vbroadcasti128	ymm9, [ptr_L_aes_gcmsiv_ctr_inc_vaes+32]
-        vbroadcasti128	ymm10, [ptr_L_aes_gcmsiv_ctr_inc_vaes+16]
+        vbroadcasti128	ymm7, OWORD PTR [r10]
+        vbroadcasti128	ymm8, OWORD PTR [ptr_L_aes_gcmsiv_ctr_inc_vaes+128]
+        vbroadcasti128	ymm9, OWORD PTR [ptr_L_aes_gcmsiv_ctr_inc_vaes+32]
+        vbroadcasti128	ymm10, OWORD PTR [ptr_L_aes_gcmsiv_ctr_inc_vaes+16]
         xor	r11d, r11d
         cmp	r8d, 128
         mov	r12d, r8d
@@ -25803,81 +25797,81 @@ L_AES_GCMSIV_ctr_vaes_enc_128:
         vpaddd	ymm6, ymm6, ymm8
         vpaddd	ymm7, ymm7, ymm8
         ; aes_enc_block
-        vbroadcasti128	ymm11, [r9]
+        vbroadcasti128	ymm11, OWORD PTR [r9]
         vpxor	ymm0, ymm0, ymm11
         vpxor	ymm1, ymm1, ymm11
         vpxor	ymm2, ymm2, ymm11
         vpxor	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+16]
+        vbroadcasti128	ymm11, OWORD PTR [r9+16]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+32]
+        vbroadcasti128	ymm11, OWORD PTR [r9+32]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+48]
+        vbroadcasti128	ymm11, OWORD PTR [r9+48]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+64]
+        vbroadcasti128	ymm11, OWORD PTR [r9+64]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+80]
+        vbroadcasti128	ymm11, OWORD PTR [r9+80]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+96]
+        vbroadcasti128	ymm11, OWORD PTR [r9+96]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+112]
+        vbroadcasti128	ymm11, OWORD PTR [r9+112]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+128]
+        vbroadcasti128	ymm11, OWORD PTR [r9+128]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+144]
+        vbroadcasti128	ymm11, OWORD PTR [r9+144]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
         cmp	eax, 11
-        vbroadcasti128	ymm11, [r9+160]
+        vbroadcasti128	ymm11, OWORD PTR [r9+160]
         jl	L_AES_GCMSIV_ctr_vaes_128_aes_enc_block_last
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+176]
+        vbroadcasti128	ymm11, OWORD PTR [r9+176]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
         cmp	eax, 13
-        vbroadcasti128	ymm11, [r9+192]
+        vbroadcasti128	ymm11, OWORD PTR [r9+192]
         jl	L_AES_GCMSIV_ctr_vaes_128_aes_enc_block_last
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+208]
+        vbroadcasti128	ymm11, OWORD PTR [r9+208]
         vaesenc	ymm0, ymm0, ymm11
         vaesenc	ymm1, ymm1, ymm11
         vaesenc	ymm2, ymm2, ymm11
         vaesenc	ymm3, ymm3, ymm11
-        vbroadcasti128	ymm11, [r9+224]
+        vbroadcasti128	ymm11, OWORD PTR [r9+224]
 L_AES_GCMSIV_ctr_vaes_128_aes_enc_block_last:
         vaesenclast	ymm0, ymm0, ymm11
         vaesenclast	ymm1, ymm1, ymm11
@@ -25908,39 +25902,39 @@ L_AES_GCMSIV_ctr_vaes_enc_32:
         vpaddd	ymm0, ymm7, [ptr_L_aes_gcmsiv_ctr_inc_vaes]
         vpaddd	ymm7, ymm7, ymm9
         ; aes_enc_block
-        vbroadcasti128	ymm11, [r9]
+        vbroadcasti128	ymm11, OWORD PTR [r9]
         vpxor	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+16]
+        vbroadcasti128	ymm11, OWORD PTR [r9+16]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+32]
+        vbroadcasti128	ymm11, OWORD PTR [r9+32]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+48]
+        vbroadcasti128	ymm11, OWORD PTR [r9+48]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+64]
+        vbroadcasti128	ymm11, OWORD PTR [r9+64]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+80]
+        vbroadcasti128	ymm11, OWORD PTR [r9+80]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+96]
+        vbroadcasti128	ymm11, OWORD PTR [r9+96]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+112]
+        vbroadcasti128	ymm11, OWORD PTR [r9+112]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+128]
+        vbroadcasti128	ymm11, OWORD PTR [r9+128]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+144]
+        vbroadcasti128	ymm11, OWORD PTR [r9+144]
         vaesenc	ymm0, ymm0, ymm11
         cmp	eax, 11
-        vbroadcasti128	ymm11, [r9+160]
+        vbroadcasti128	ymm11, OWORD PTR [r9+160]
         jl	L_AES_GCMSIV_ctr_vaes_32_aes_enc_block_last
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+176]
+        vbroadcasti128	ymm11, OWORD PTR [r9+176]
         vaesenc	ymm0, ymm0, ymm11
         cmp	eax, 13
-        vbroadcasti128	ymm11, [r9+192]
+        vbroadcasti128	ymm11, OWORD PTR [r9+192]
         jl	L_AES_GCMSIV_ctr_vaes_32_aes_enc_block_last
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+208]
+        vbroadcasti128	ymm11, OWORD PTR [r9+208]
         vaesenc	ymm0, ymm0, ymm11
-        vbroadcasti128	ymm11, [r9+224]
+        vbroadcasti128	ymm11, OWORD PTR [r9+224]
 L_AES_GCMSIV_ctr_vaes_32_aes_enc_block_last:
         vaesenclast	ymm0, ymm0, ymm11
         vpxor	ymm0, ymm0, [r13]
@@ -35966,8 +35960,7 @@ _TEXT ENDS
 IFDEF WOLFSSL_AESGCM_SIV
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcm_siv_bswap_mask_avx512 QWORD \
-     08090a0b0c0d0e0fh,  0001020304050607h
+L_aes_gcm_siv_bswap_mask_avx512 QWORD 08090a0b0c0d0e0fh, 0001020304050607h
 ptr_L_aes_gcm_siv_bswap_mask_avx512 QWORD L_aes_gcm_siv_bswap_mask_avx512
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -36702,24 +36695,23 @@ AES_GCMSIV_polyval_avx512 ENDP
 _TEXT ENDS
 _DATA SEGMENT
 ALIGN 16
-L_aes_gcmsiv_ctr_inc_avx512 QWORD \
-     0000000000000000h,  0000000000000000h,
-     0000000000000001h,  0000000000000000h,
-     0000000000000002h,  0000000000000000h,
-     0000000000000003h,  0000000000000000h,
-     0000000000000004h,  0000000000000000h,
-     0000000000000005h,  0000000000000000h,
-     0000000000000006h,  0000000000000000h,
-     0000000000000007h,  0000000000000000h,
-     0000000000000008h,  0000000000000000h,
-     0000000000000009h,  0000000000000000h,
-     000000000000000ah,  0000000000000000h,
-     000000000000000bh,  0000000000000000h,
-     000000000000000ch,  0000000000000000h,
-     000000000000000dh,  0000000000000000h,
-     000000000000000eh,  0000000000000000h,
-     000000000000000fh,  0000000000000000h,
-     0000000000000010h,  0000000000000000h
+L_aes_gcmsiv_ctr_inc_avx512 QWORD 0000000000000000h, 0000000000000000h
+        QWORD 0000000000000001h, 0000000000000000h
+        QWORD 0000000000000002h, 0000000000000000h
+        QWORD 0000000000000003h, 0000000000000000h
+        QWORD 0000000000000004h, 0000000000000000h
+        QWORD 0000000000000005h, 0000000000000000h
+        QWORD 0000000000000006h, 0000000000000000h
+        QWORD 0000000000000007h, 0000000000000000h
+        QWORD 0000000000000008h, 0000000000000000h
+        QWORD 0000000000000009h, 0000000000000000h
+        QWORD 000000000000000ah, 0000000000000000h
+        QWORD 000000000000000bh, 0000000000000000h
+        QWORD 000000000000000ch, 0000000000000000h
+        QWORD 000000000000000dh, 0000000000000000h
+        QWORD 000000000000000eh, 0000000000000000h
+        QWORD 000000000000000fh, 0000000000000000h
+        QWORD 0000000000000010h, 0000000000000000h
 ptr_L_aes_gcmsiv_ctr_inc_avx512 QWORD L_aes_gcmsiv_ctr_inc_avx512
 _DATA ENDS
 _TEXT SEGMENT READONLY PARA
@@ -36740,32 +36732,32 @@ AES_GCMSIV_ctr_avx512 PROC
         vmovdqu	OWORD PTR [rsp+112], xmm13
         vmovdqu	OWORD PTR [rsp+128], xmm14
         vmovdqu	OWORD PTR [rsp+144], xmm15
-        vbroadcasti32x4	zmm7, [r10]
-        vbroadcasti32x4	zmm8, [ptr_L_aes_gcmsiv_ctr_inc_avx512+256]
-        vbroadcasti32x4	zmm9, [ptr_L_aes_gcmsiv_ctr_inc_avx512+64]
-        vbroadcasti32x4	zmm10, [ptr_L_aes_gcmsiv_ctr_inc_avx512+16]
+        vbroadcasti32x4	zmm7, OWORD PTR [r10]
+        vbroadcasti32x4	zmm8, OWORD PTR [ptr_L_aes_gcmsiv_ctr_inc_avx512+256]
+        vbroadcasti32x4	zmm9, OWORD PTR [ptr_L_aes_gcmsiv_ctr_inc_avx512+64]
+        vbroadcasti32x4	zmm10, OWORD PTR [ptr_L_aes_gcmsiv_ctr_inc_avx512+16]
         xor	r11d, r11d
         cmp	r8d, 64
         jl	L_AES_GCMSIV_ctr_avx512_done_64
-        vbroadcasti32x4	zmm12, [r9]
-        vbroadcasti32x4	zmm13, [r9+16]
-        vbroadcasti32x4	zmm14, [r9+32]
-        vbroadcasti32x4	zmm15, [r9+48]
-        vbroadcasti32x4	zmm16, [r9+64]
-        vbroadcasti32x4	zmm17, [r9+80]
-        vbroadcasti32x4	zmm18, [r9+96]
-        vbroadcasti32x4	zmm19, [r9+112]
-        vbroadcasti32x4	zmm20, [r9+128]
-        vbroadcasti32x4	zmm21, [r9+144]
-        vbroadcasti32x4	zmm22, [r9+160]
+        vbroadcasti32x4	zmm12, OWORD PTR [r9]
+        vbroadcasti32x4	zmm13, OWORD PTR [r9+16]
+        vbroadcasti32x4	zmm14, OWORD PTR [r9+32]
+        vbroadcasti32x4	zmm15, OWORD PTR [r9+48]
+        vbroadcasti32x4	zmm16, OWORD PTR [r9+64]
+        vbroadcasti32x4	zmm17, OWORD PTR [r9+80]
+        vbroadcasti32x4	zmm18, OWORD PTR [r9+96]
+        vbroadcasti32x4	zmm19, OWORD PTR [r9+112]
+        vbroadcasti32x4	zmm20, OWORD PTR [r9+128]
+        vbroadcasti32x4	zmm21, OWORD PTR [r9+144]
+        vbroadcasti32x4	zmm22, OWORD PTR [r9+160]
         cmp	eax, 11
         jl	L_AES_GCMSIV_ctr_avx512_key_cached
-        vbroadcasti32x4	zmm23, [r9+176]
-        vbroadcasti32x4	zmm24, [r9+192]
+        vbroadcasti32x4	zmm23, OWORD PTR [r9+176]
+        vbroadcasti32x4	zmm24, OWORD PTR [r9+192]
         cmp	eax, 13
         jl	L_AES_GCMSIV_ctr_avx512_key_cached
-        vbroadcasti32x4	zmm25, [r9+208]
-        vbroadcasti32x4	zmm26, [r9+224]
+        vbroadcasti32x4	zmm25, OWORD PTR [r9+208]
+        vbroadcasti32x4	zmm26, OWORD PTR [r9+224]
 L_AES_GCMSIV_ctr_avx512_key_cached:
         cmp	r8d, 256
         mov	r12d, r8d
diff --git a/wolfcrypt/src/cpuid.c b/wolfcrypt/src/cpuid.c
index 545e6e927d9..a39780c77b7 100644
--- a/wolfcrypt/src/cpuid.c
+++ b/wolfcrypt/src/cpuid.c
@@ -154,7 +154,27 @@
 #define CPUID_AARCH64_FEAT_SHA3        ((word64)1 << 32)
 #define CPUID_AARCH64_FEAT_SM3         ((word64)1 << 36)
 #define CPUID_AARCH64_FEAT_SM4         ((word64)1 << 40)
+/* ID_AA64PFR0_EL1.AdvSIMD field [23:20]: 0xf means NEON is NOT implemented. */
 #define CPUID_AARCH64_FEAT_ASIMD       ((word64)0xf << 20)
+/* ID_AA64PFR0_EL1.SVE field [35:32]: non-zero means SVE is implemented. */
+#define CPUID_AARCH64_FEAT_SVE         ((word64)0xf << 32)
+/* ID_AA64PFR1_EL1.SME field [27:24]: non-zero means SME is implemented. */
+#define CPUID_AARCH64_FEAT_SME         ((word64)0xf << 24)
+
+/* SVE and/or SME are guaranteed present when the architecture the code is
+ * compiled for includes them (the ACLE __ARM_FEATURE_* macros). In that case
+ * the flag is set unconditionally: the runtime detection below can be
+ * unavailable or incomplete on some platforms, but the feature is known usable.
+ */
+#if defined(__ARM_FEATURE_SVE) && defined(__ARM_FEATURE_SME)
+    #define CPUID_AARCH64_COMPILED     (CPUID_SVE | CPUID_SME)
+#elif defined(__ARM_FEATURE_SVE)
+    #define CPUID_AARCH64_COMPILED     CPUID_SVE
+#elif defined(__ARM_FEATURE_SME)
+    #define CPUID_AARCH64_COMPILED     CPUID_SME
+#else
+    #define CPUID_AARCH64_COMPILED     0
+#endif
 
 #ifdef WOLFSSL_AARCH64_PRIVILEGE_MODE
     /* https://developer.arm.com/documentation/ddi0601/2024-09/AArch64-Registers
@@ -163,30 +183,39 @@
     static WC_INLINE void cpuid_set_flags(void)
     {
         if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
-            cpuid_flags_t new_cpuid_flags = 0,
+            cpuid_flags_t new_cpuid_flags = CPUID_AARCH64_COMPILED,
                 old_cpuid_flags = WC_CPUID_INITIALIZER;
             word64 features;
+            word64 pfr0;
+            word64 pfr1;
 
-        #ifndef WOLFSSL_ARMASM_NO_NEON
             __asm__ __volatile (
-                "mrs    %[feat], ID_AA64PFR0_EL1\n"
+                "mrs    %[feat], ID_AA64ISAR0_EL1\n"
                 : [feat] "=r" (features)
                 :
                 :
             );
-
-            if ((features & CPUID_AARCH64_FEAT_ASIMD) !=
-                    CPUID_AARCH64_FEAT_ASIMD)
-                new_cpuid_flags |= CPUID_ASIMD;
-        #endif
-
             __asm__ __volatile (
-                "mrs    %[feat], ID_AA64ISAR0_EL1\n"
-                : [feat] "=r" (features)
+                "mrs    %[feat], ID_AA64PFR0_EL1\n"
+                : [feat] "=r" (pfr0)
+                :
+                :
+            );
+            __asm__ __volatile (
+                "mrs    %[feat], ID_AA64PFR1_EL1\n"
+                : [feat] "=r" (pfr1)
                 :
                 :
             );
 
+        #ifndef WOLFSSL_ARMASM_NO_NEON
+            if ((pfr0 & CPUID_AARCH64_FEAT_ASIMD) != CPUID_AARCH64_FEAT_ASIMD)
+                new_cpuid_flags |= CPUID_ASIMD;
+        #endif
+            if (pfr0 & CPUID_AARCH64_FEAT_SVE)
+                new_cpuid_flags |= CPUID_SVE;
+            if (pfr1 & CPUID_AARCH64_FEAT_SME)
+                new_cpuid_flags |= CPUID_SME;
         #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
             if (features & CPUID_AARCH64_FEAT_AES)
                 new_cpuid_flags |= CPUID_AES;
@@ -232,7 +261,7 @@
     static WC_INLINE void cpuid_set_flags(void)
     {
         if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
-            cpuid_flags_t new_cpuid_flags = 0,
+            cpuid_flags_t new_cpuid_flags = CPUID_AARCH64_COMPILED,
                 old_cpuid_flags = WC_CPUID_INITIALIZER;
             word64 hwcaps = getauxval(AT_HWCAP);
 
@@ -269,6 +298,15 @@
             if (hwcaps & HWCAP_SM4)
                 new_cpuid_flags |= CPUID_SM4;
         #endif
+        #ifdef HWCAP_SVE
+            if (hwcaps & HWCAP_SVE)
+                new_cpuid_flags |= CPUID_SVE;
+        #endif
+        #ifdef HWCAP2_SME
+            /* SME is reported in the second HWCAP word. */
+            if (getauxval(AT_HWCAP2) & HWCAP2_SME)
+                new_cpuid_flags |= CPUID_SME;
+        #endif
 
             (void)hwcaps;
             (void)wolfSSL_Atomic_Uint_CompareExchange
@@ -284,7 +322,7 @@
     static WC_INLINE void cpuid_set_flags(void)
     {
         if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
-            cpuid_flags_t new_cpuid_flags = 0,
+            cpuid_flags_t new_cpuid_flags = CPUID_AARCH64_COMPILED,
                 old_cpuid_flags = WC_CPUID_INITIALIZER;
             word64 features = android_getCpuFeatures();
 
@@ -324,7 +362,7 @@
     static WC_INLINE void cpuid_set_flags(void)
     {
         if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
-            cpuid_flags_t new_cpuid_flags = 0,
+            cpuid_flags_t new_cpuid_flags = CPUID_AARCH64_COMPILED,
                 old_cpuid_flags = WC_CPUID_INITIALIZER;
 
         #ifndef WOLFSSL_ARMASM_NO_NEON
@@ -370,7 +408,7 @@
     static WC_INLINE void cpuid_set_flags(void)
     {
         if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
-            cpuid_flags_t new_cpuid_flags = 0,
+            cpuid_flags_t new_cpuid_flags = CPUID_AARCH64_COMPILED,
                 old_cpuid_flags = WC_CPUID_INITIALIZER;
             word64 features = 0;
 
@@ -486,7 +524,7 @@
     static WC_INLINE void cpuid_set_flags(void)
     {
         if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
-            cpuid_flags_t new_cpuid_flags = 0,
+            cpuid_flags_t new_cpuid_flags = CPUID_AARCH64_COMPILED,
                 old_cpuid_flags = WC_CPUID_INITIALIZER;
         #ifndef WOLFSSL_ARMASM_NO_NEON
             new_cpuid_flags |= CPUID_ASIMD;
diff --git a/wolfcrypt/src/port/arm/armv8-32-aes-asm.S b/wolfcrypt/src/port/arm/armv8-32-aes-asm.S
index 42518d80541..447b8923fc4 100644
--- a/wolfcrypt/src/port/arm/armv8-32-aes-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-32-aes-asm.S
@@ -29542,10 +29542,10 @@ L_AES_GCMSIV_ctr_base_end:
 #endif /* WOLFSSL_AESGCM_SIV */
 #endif /* !WOLFSSL_ARMASM_NO_HW_CRYPTO */
 #endif /* !NO_AES */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c
index 34b81792f19..a046e48562d 100644
--- a/wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-aes-asm_c.c
@@ -30555,7 +30555,7 @@ WC_OMIT_FRAME_POINTER void AES_GCMSIV_ctr_base(const unsigned char* in,
 #endif /* WOLFSSL_AESGCM_SIV */
 #endif /* !WOLFSSL_ARMASM_NO_HW_CRYPTO */
 #endif /* !NO_AES */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-chacha-asm.S b/wolfcrypt/src/port/arm/armv8-32-chacha-asm.S
index 1b47cb6333e..1283d5769b5 100644
--- a/wolfcrypt/src/port/arm/armv8-32-chacha-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-32-chacha-asm.S
@@ -1246,10 +1246,10 @@ L_chacha_use_over_arm32_done:
 	.size	wc_chacha_use_over,.-wc_chacha_use_over
 #endif /* !WOLFSSL_ARMASM_NO_NEON */
 #endif /* HAVE_CHACHA */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-chacha-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-chacha-asm_c.c
index cc3bdecd5c3..9d91c854144 100644
--- a/wolfcrypt/src/port/arm/armv8-32-chacha-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-chacha-asm_c.c
@@ -1435,7 +1435,7 @@ WC_OMIT_FRAME_POINTER void wc_chacha_use_over(byte* over, byte* output,
 
 #endif /* !WOLFSSL_ARMASM_NO_NEON */
 #endif /* HAVE_CHACHA */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-curve25519.S b/wolfcrypt/src/port/arm/armv8-32-curve25519.S
index f03c1920cf4..c368dcb6f37 100644
--- a/wolfcrypt/src/port/arm/armv8-32-curve25519.S
+++ b/wolfcrypt/src/port/arm/armv8-32-curve25519.S
@@ -9678,10 +9678,10 @@ sc_muladd:
 
 #endif /* !CURVE25519_SMALL || !ED25519_SMALL */
 #endif /* HAVE_CURVE25519 || HAVE_ED25519 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-curve25519_c.c b/wolfcrypt/src/port/arm/armv8-32-curve25519_c.c
index bd3b528c465..7cb48eacd3a 100644
--- a/wolfcrypt/src/port/arm/armv8-32-curve25519_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-curve25519_c.c
@@ -10446,7 +10446,7 @@ WC_OMIT_FRAME_POINTER void sc_muladd(byte* s, const byte* a, const byte* b,
 
 #endif /* !CURVE25519_SMALL || !ED25519_SMALL */
 #endif /* HAVE_CURVE25519 || HAVE_ED25519 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-frodokem-asm.S b/wolfcrypt/src/port/arm/armv8-32-frodokem-asm.S
new file mode 100644
index 00000000000..fc3bc43199d
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-32-frodokem-asm.S
@@ -0,0 +1,690 @@
+/* armv8-32-frodokem-asm
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Generated using (from wolfssl):
+ *   cd ../scripts
+ *   ruby ./frodokem/frodokem.rb arm32 \
+ *       ../wolfssl/wolfcrypt/src/port/arm/armv8-32-frodokem-asm.S
+ */
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources_asm.h>
+
+#ifdef WOLFSSL_ARMASM
+#if !defined(__aarch64__) && !defined(WOLFSSL_ARMASM_THUMB2)
+#ifndef WOLFSSL_ARMASM_INLINE
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifndef WOLFSSL_ARMASM_NO_NEON
+	.text
+	.align	4
+	.fpu	neon
+	.globl	frodokem_add_neon
+	.type	frodokem_add_neon, %function
+frodokem_add_neon:
+	vdup.16	q2, r2
+	mov	r3, #8
+L_frodokem_add_neon_blk:
+	vld1.16	{d0-d1}, [r0]
+	vld1.16	{d2-d3}, [r1]!
+	vadd.i16	q0, q0, q1
+	vand	q0, q0, q2
+	vst1.16	{d0-d1}, [r0]!
+	subs	r3, r3, #1
+	bne	L_frodokem_add_neon_blk
+	bx	lr
+	.size	frodokem_add_neon,.-frodokem_add_neon
+	.text
+	.align	4
+	.fpu	neon
+	.globl	frodokem_sample_neon
+	.type	frodokem_sample_neon, %function
+frodokem_sample_neon:
+	push	{r4, lr}
+	vpush	{d8-d11}
+L_frodokem_sample_neon_blk:
+	vld1.16	{d0-d1}, [r0]
+	vshr.u16	q1, q0, #1
+	vmov.i16	q2, #1
+	vand	q2, q2, q0
+	vmov.i16	q3, #0
+	mov	r12, r2
+	mov	lr, r3
+L_frodokem_sample_neon_cdf:
+	ldrh	r4, [r12]
+	add	r12, r12, #2
+	vdup.16	q4, r4
+	vsub.i16	q4, q4, q1
+	vshr.u16	q4, q4, #15
+	vadd.i16	q3, q3, q4
+	subs	lr, lr, #1
+	bne	L_frodokem_sample_neon_cdf
+	vneg.s16	q5, q2
+	veor	q3, q3, q5
+	vadd.i16	q3, q3, q2
+	vst1.16	{d6-d7}, [r0]!
+	subs	r1, r1, #8
+	bne	L_frodokem_sample_neon_blk
+	vpop	{d8-d11}
+	pop	{r4, pc}
+	.size	frodokem_sample_neon,.-frodokem_sample_neon
+	.text
+	.align	4
+	.fpu	neon
+	.globl	frodokem_sa_accum_neon
+	.type	frodokem_sa_accum_neon, %function
+frodokem_sa_accum_neon:
+	push	{r4, r5, r6, r7, r8, lr}
+	ldr	r12, [sp, #24]
+	lsl	lr, r12, #1
+	add	r4, r1, r3, lsl #1
+	mov	r7, #8
+L_frodokem_sa_accum_neon_i:
+	ldrh	r8, [r4]
+	vdup.16	q0, r8
+	add	r4, r4, lr
+	mov	r5, r2
+	lsr	r6, lr, #4
+L_frodokem_sa_accum_neon_k:
+	vld1.16	{d2-d3}, [r0]
+	vld1.16	{d4-d5}, [r5]!
+	vmla.i16	q1, q2, q0
+	vst1.16	{d2-d3}, [r0]!
+	subs	r6, r6, #1
+	bne	L_frodokem_sa_accum_neon_k
+	subs	r7, r7, #1
+	bne	L_frodokem_sa_accum_neon_i
+	pop	{r4, r5, r6, r7, r8, pc}
+	.size	frodokem_sa_accum_neon,.-frodokem_sa_accum_neon
+	.text
+	.align	4
+	.fpu	neon
+	.globl	frodokem_as_accum_neon
+	.type	frodokem_as_accum_neon, %function
+frodokem_as_accum_neon:
+	push	{r4, r5, r6, r7, r8, r9, lr}
+	vpush	{d8-d15}
+	ldr	r12, [sp, #92]
+	lsl	lr, r12, #1
+	add	r7, r0, r3, lsl #4
+	mov	r6, r2
+	mov	r4, r1
+	veor	q0, q0, q0
+	veor	q1, q1, q1
+	veor	q2, q2, q2
+	veor	q3, q3, q3
+	veor	q4, q4, q4
+	veor	q5, q5, q5
+	veor	q6, q6, q6
+	veor	q7, q7, q7
+	lsr	r8, lr, #4
+L_frodokem_as_accum_neon_k:
+	vld1.16	{d16-d17}, [r6]!
+	mov	r5, r4
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q0, q8, q9
+	add	r5, r5, lr
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q1, q8, q9
+	add	r5, r5, lr
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q2, q8, q9
+	add	r5, r5, lr
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q3, q8, q9
+	add	r5, r5, lr
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q4, q8, q9
+	add	r5, r5, lr
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q5, q8, q9
+	add	r5, r5, lr
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q6, q8, q9
+	add	r5, r5, lr
+	vld1.16	{d18-d19}, [r5]
+	vmla.i16	q7, q8, q9
+	add	r5, r5, lr
+	add	r4, r4, #16
+	subs	r8, r8, #1
+	bne	L_frodokem_as_accum_neon_k
+	vadd.i16	d18, d0, d1
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d20[0], r9
+	vadd.i16	d18, d2, d3
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d20[1], r9
+	vadd.i16	d18, d4, d5
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d20[2], r9
+	vadd.i16	d18, d6, d7
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d20[3], r9
+	vadd.i16	d18, d8, d9
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d21[0], r9
+	vadd.i16	d18, d10, d11
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d21[1], r9
+	vadd.i16	d18, d12, d13
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d21[2], r9
+	vadd.i16	d18, d14, d15
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r9, d18[0]
+	vmov.16	d21[3], r9
+	vld1.16	{d22-d23}, [r7]
+	vadd.i16	q10, q10, q11
+	vst1.16	{d20-d21}, [r7]
+	vpop	{d8-d15}
+	pop	{r4, r5, r6, r7, r8, r9, pc}
+	.size	frodokem_as_accum_neon,.-frodokem_as_accum_neon
+	.text
+	.align	4
+	.fpu	neon
+	.globl	frodokem_mul_bs_neon
+	.type	frodokem_mul_bs_neon, %function
+frodokem_mul_bs_neon:
+	push	{r4, r5, r6, r7, r8, r9, r10, lr}
+	vpush	{d8-d15}
+	ldr	lr, [sp, #96]
+	lsl	r12, r3, #1
+	vdup.16	q11, lr
+	mov	r7, r0
+	mov	r4, r1
+	mov	r9, #8
+L_frodokem_mul_bs_neon_r:
+	mov	r5, r2
+	veor	q0, q0, q0
+	veor	q1, q1, q1
+	veor	q2, q2, q2
+	veor	q3, q3, q3
+	veor	q4, q4, q4
+	veor	q5, q5, q5
+	veor	q6, q6, q6
+	veor	q7, q7, q7
+	lsr	r8, r12, #4
+L_frodokem_mul_bs_neon_k:
+	vld1.16	{d16-d17}, [r4]!
+	mov	r6, r5
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q0, q8, q9
+	add	r6, r6, r12
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q1, q8, q9
+	add	r6, r6, r12
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q2, q8, q9
+	add	r6, r6, r12
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q3, q8, q9
+	add	r6, r6, r12
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q4, q8, q9
+	add	r6, r6, r12
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q5, q8, q9
+	add	r6, r6, r12
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q6, q8, q9
+	add	r6, r6, r12
+	vld1.16	{d18-d19}, [r6]
+	vmla.i16	q7, q8, q9
+	add	r6, r6, r12
+	add	r5, r5, #16
+	subs	r8, r8, #1
+	bne	L_frodokem_mul_bs_neon_k
+	vadd.i16	d18, d0, d1
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d20[0], r10
+	vadd.i16	d18, d2, d3
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d20[1], r10
+	vadd.i16	d18, d4, d5
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d20[2], r10
+	vadd.i16	d18, d6, d7
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d20[3], r10
+	vadd.i16	d18, d8, d9
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d21[0], r10
+	vadd.i16	d18, d10, d11
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d21[1], r10
+	vadd.i16	d18, d12, d13
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d21[2], r10
+	vadd.i16	d18, d14, d15
+	vpadd.i16	d18, d18, d18
+	vpadd.i16	d18, d18, d18
+	vmov.u16	r10, d18[0]
+	vmov.16	d21[3], r10
+	vand	q10, q10, q11
+	vst1.16	{d20-d21}, [r7]!
+	subs	r9, r9, #1
+	bne	L_frodokem_mul_bs_neon_r
+	vpop	{d8-d15}
+	pop	{r4, r5, r6, r7, r8, r9, r10, pc}
+	.size	frodokem_mul_bs_neon,.-frodokem_mul_bs_neon
+	.text
+	.align	4
+	.fpu	neon
+	.globl	frodokem_mul_add_sb_plus_e_neon
+	.type	frodokem_mul_add_sb_plus_e_neon, %function
+frodokem_mul_add_sb_plus_e_neon:
+	push	{r4, r5, r6, r7, r8, r9, lr}
+	vpush	{d8-d15}
+	ldr	lr, [sp, #92]
+	lsl	r12, r3, #1
+	vdup.16	q10, lr
+	mov	r4, r1
+	mov	r5, r2
+	mov	r7, r0
+	vld1.16	{d0-d1}, [r7]!
+	vld1.16	{d2-d3}, [r7]!
+	vld1.16	{d4-d5}, [r7]!
+	vld1.16	{d6-d7}, [r7]!
+	vld1.16	{d8-d9}, [r7]!
+	vld1.16	{d10-d11}, [r7]!
+	vld1.16	{d12-d13}, [r7]!
+	vld1.16	{d14-d15}, [r7]!
+	mov	r8, r3
+L_frodokem_mul_add_sb_plus_e_neon_j:
+	vld1.16	{d16-d17}, [r4]!
+	mov	r6, r5
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q0, q8, q9
+	add	r6, r6, r12
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q1, q8, q9
+	add	r6, r6, r12
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q2, q8, q9
+	add	r6, r6, r12
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q3, q8, q9
+	add	r6, r6, r12
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q4, q8, q9
+	add	r6, r6, r12
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q5, q8, q9
+	add	r6, r6, r12
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q6, q8, q9
+	add	r6, r6, r12
+	ldrh	r9, [r6]
+	vdup.16	q9, r9
+	vmla.i16	q7, q8, q9
+	add	r6, r6, r12
+	add	r5, r5, #2
+	subs	r8, r8, #1
+	bne	L_frodokem_mul_add_sb_plus_e_neon_j
+	mov	r7, r0
+	vand	q0, q0, q10
+	vst1.16	{d0-d1}, [r7]!
+	vand	q1, q1, q10
+	vst1.16	{d2-d3}, [r7]!
+	vand	q2, q2, q10
+	vst1.16	{d4-d5}, [r7]!
+	vand	q3, q3, q10
+	vst1.16	{d6-d7}, [r7]!
+	vand	q4, q4, q10
+	vst1.16	{d8-d9}, [r7]!
+	vand	q5, q5, q10
+	vst1.16	{d10-d11}, [r7]!
+	vand	q6, q6, q10
+	vst1.16	{d12-d13}, [r7]!
+	vand	q7, q7, q10
+	vst1.16	{d14-d15}, [r7]!
+	vpop	{d8-d15}
+	pop	{r4, r5, r6, r7, r8, r9, pc}
+	.size	frodokem_mul_add_sb_plus_e_neon,.-frodokem_mul_add_sb_plus_e_neon
+#endif /* WOLFSSL_ARMASM_NO_NEON */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifndef WOLFSSL_ARMASM_NO_NEON
+	.fpu	crypto-neon-fp-armv8
+	.text
+	.align	4
+	.globl	frodokem_gen_a_rows_aes_arm32
+	.type	frodokem_gen_a_rows_aes_arm32, %function
+frodokem_gen_a_rows_aes_arm32:
+	push	{r4, r5, r6, r7, r8, r9, lr}
+	vpush	{d8-d15}
+	ldr	lr, [sp, #96]
+	lsl	lr, lr, #1
+	ldr	r4, [sp, #92]
+	mul	r4, r4, lr
+	ldr	r12, [sp, #100]
+	vld1.8	{d0-d1}, [r2]!
+	vld1.8	{d2-d3}, [r2]!
+	vld1.8	{d4-d5}, [r2]!
+	vld1.8	{d6-d7}, [r2]!
+	vld1.8	{d8-d9}, [r2]!
+	vld1.8	{d10-d11}, [r2]!
+	vld1.8	{d12-d13}, [r2]!
+	vld1.8	{d14-d15}, [r2]!
+	vld1.8	{d16-d17}, [r2]!
+	vld1.8	{d18-d19}, [r2]!
+	vld1.8	{d20-d21}, [r2]!
+	vdup.16	q13, r12
+	movw	r8, #0
+#if defined(WOLFSSL_ARM_ARCH) && (WOLFSSL_ARM_ARCH < 7)
+	orr	r8, r8, #0x80000
+#else
+	movt	r8, #0x8
+#endif
+	mov	r9, #0
+	mov	r5, r0
+L_frodokem_gen_a_rows_aes_arm32_row:
+	mov	r7, r3
+	add	r6, r5, lr
+L_frodokem_gen_a_rows_aes_arm32_blk:
+	str	r7, [r5], #4
+	str	r9, [r5], #4
+	str	r9, [r5], #4
+	str	r9, [r5], #4
+	add	r7, r7, r8
+	cmp	r5, r6
+	blt	L_frodokem_gen_a_rows_aes_arm32_blk
+	add	r3, r3, #1
+	add	r6, r0, r4
+	cmp	r5, r6
+	blt	L_frodokem_gen_a_rows_aes_arm32_row
+L_frodokem_gen_a_rows_aes_arm32_aes:
+	vld1.8	{d22-d23}, [r0]!
+	vld1.8	{d24-d25}, [r0]!
+	aese.8	q11, q0
+	aese.8	q12, q0
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q1
+	aese.8	q12, q1
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q2
+	aese.8	q12, q2
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q3
+	aese.8	q12, q3
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q4
+	aese.8	q12, q4
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q5
+	aese.8	q12, q5
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q6
+	aese.8	q12, q6
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q7
+	aese.8	q12, q7
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q8
+	aese.8	q12, q8
+	aesmc.8	q11, q11
+	aesmc.8	q12, q12
+	aese.8	q11, q9
+	aese.8	q12, q9
+	veor	q11, q11, q10
+	veor	q12, q12, q10
+	vand	q11, q11, q13
+	vand	q12, q12, q13
+	vst1.8	{d22-d23}, [r1]!
+	vst1.8	{d24-d25}, [r1]!
+	subs	r4, r4, #32
+	bne	L_frodokem_gen_a_rows_aes_arm32_aes
+	vpop	{d8-d15}
+	pop	{r4, r5, r6, r7, r8, r9, pc}
+	.size	frodokem_gen_a_rows_aes_arm32,.-frodokem_gen_a_rows_aes_arm32
+#endif /* WOLFSSL_ARMASM_NO_NEON */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifdef __ARM_FEATURE_SIMD32
+#if (!defined(__ARM_NEON) && !defined(__ARM_NEON__)) || defined(WOLFSSL_ARMASM_NO_NEON)
+	.text
+	.align	4
+	.globl	frodokem_add_simd32
+	.type	frodokem_add_simd32, %function
+frodokem_add_simd32:
+	push	{lr}
+	orr	r2, r2, r2, lsl #16
+	mov	r3, #32
+L_frodokem_add_simd32_blk:
+	ldr	r12, [r0]
+	ldr	lr, [r1], #4
+	sadd16	r12, r12, lr
+	and	r12, r12, r2
+	str	r12, [r0], #4
+	subs	r3, r3, #1
+	bne	L_frodokem_add_simd32_blk
+	pop	{pc}
+	.size	frodokem_add_simd32,.-frodokem_add_simd32
+	.text
+	.align	4
+	.globl	frodokem_sa_accum_simd32
+	.type	frodokem_sa_accum_simd32, %function
+frodokem_sa_accum_simd32:
+	push	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	ldr	r12, [sp, #36]
+	lsl	r12, r12, #1
+	add	lr, r1, r3, lsl #1
+	mov	r6, #8
+L_frodokem_sa_accum_simd32_i:
+	ldrh	r7, [lr]
+	add	lr, lr, r12
+	mov	r4, r2
+	lsr	r5, r12, #2
+L_frodokem_sa_accum_simd32_k:
+	ldr	r9, [r0]
+	ldr	r8, [r4], #4
+	smulbb	r10, r7, r8
+	smulbt	r11, r7, r8
+	pkhbt	r10, r10, r11, LSL #16
+	sadd16	r9, r9, r10
+	str	r9, [r0], #4
+	subs	r5, r5, #1
+	bne	L_frodokem_sa_accum_simd32_k
+	subs	r6, r6, #1
+	bne	L_frodokem_sa_accum_simd32_i
+	pop	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	.size	frodokem_sa_accum_simd32,.-frodokem_sa_accum_simd32
+	.text
+	.align	4
+	.globl	frodokem_as_accum_simd32
+	.type	frodokem_as_accum_simd32, %function
+frodokem_as_accum_simd32:
+	push	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	ldr	r12, [sp, #36]
+	lsl	r12, r12, #1
+	add	lr, r0, r3, lsl #4
+	mov	r4, r1
+	mov	r7, #8
+L_frodokem_as_accum_simd32_c:
+	mov	r9, #0
+	mov	r5, r2
+	mov	r6, r4
+	lsr	r8, r12, #2
+L_frodokem_as_accum_simd32_j:
+	ldr	r10, [r5], #4
+	ldr	r11, [r6], #4
+	smlad	r9, r10, r11, r9
+	subs	r8, r8, #1
+	bne	L_frodokem_as_accum_simd32_j
+	ldrh	r10, [lr]
+	add	r10, r10, r9
+	strh	r10, [lr]
+	add	lr, lr, #2
+	add	r4, r4, r12
+	subs	r7, r7, #1
+	bne	L_frodokem_as_accum_simd32_c
+	pop	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	.size	frodokem_as_accum_simd32,.-frodokem_as_accum_simd32
+	.text
+	.align	4
+	.globl	frodokem_mul_bs_simd32
+	.type	frodokem_mul_bs_simd32, %function
+frodokem_mul_bs_simd32:
+	push	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	mov	r12, r1
+	mov	r6, #8
+L_frodokem_mul_bs_simd32_i:
+	mov	lr, r2
+	mov	r7, #8
+L_frodokem_mul_bs_simd32_c:
+	mov	r9, #0
+	mov	r4, r12
+	mov	r5, lr
+	lsr	r8, r3, #1
+L_frodokem_mul_bs_simd32_j:
+	ldr	r10, [r4], #4
+	ldr	r11, [r5], #4
+	smlad	r9, r10, r11, r9
+	subs	r8, r8, #1
+	bne	L_frodokem_mul_bs_simd32_j
+	ldr	r10, [sp, #36]
+	orr	r10, r10, r10, lsl #16
+	and	r9, r9, r10
+	strh	r9, [r0]
+	add	r0, r0, #2
+	add	lr, lr, r3, lsl #1
+	subs	r7, r7, #1
+	bne	L_frodokem_mul_bs_simd32_c
+	add	r12, r12, r3, lsl #1
+	subs	r6, r6, #1
+	bne	L_frodokem_mul_bs_simd32_i
+	pop	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	.size	frodokem_mul_bs_simd32,.-frodokem_mul_bs_simd32
+	.text
+	.align	4
+	.globl	frodokem_mul_add_sb_plus_e_simd32
+	.type	frodokem_mul_add_sb_plus_e_simd32, %function
+frodokem_mul_add_sb_plus_e_simd32:
+	push	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	sub	sp, sp, #8
+	lsl	r9, r3, #1
+	str	r9, [sp, #4]
+	str	r1, [sp]
+	mov	r12, #8
+L_frodokem_mul_add_sb_plus_e_simd32_i:
+	ldr	r9, [sp, #4]
+	add	r3, r2, r9
+	ldr	r1, [sp]
+	mov	lr, r2
+	ldr	r4, [r0]
+	ldr	r5, [r0, #4]
+	ldr	r6, [r0, #8]
+	ldr	r7, [r0, #12]
+L_frodokem_mul_add_sb_plus_e_simd32_j:
+	ldrh	r8, [lr]
+	add	lr, lr, #2
+	ldr	r9, [r1]
+	smulbb	r10, r8, r9
+	smulbt	r11, r8, r9
+	pkhbt	r10, r10, r11, LSL #16
+	sadd16	r4, r4, r10
+	ldr	r9, [r1, #4]
+	smulbb	r10, r8, r9
+	smulbt	r11, r8, r9
+	pkhbt	r10, r10, r11, LSL #16
+	sadd16	r5, r5, r10
+	ldr	r9, [r1, #8]
+	smulbb	r10, r8, r9
+	smulbt	r11, r8, r9
+	pkhbt	r10, r10, r11, LSL #16
+	sadd16	r6, r6, r10
+	ldr	r9, [r1, #12]
+	smulbb	r10, r8, r9
+	smulbt	r11, r8, r9
+	pkhbt	r10, r10, r11, LSL #16
+	sadd16	r7, r7, r10
+	add	r1, r1, #16
+	cmp	lr, r3
+	bne	L_frodokem_mul_add_sb_plus_e_simd32_j
+	ldr	r9, [sp, #44]
+	orr	r9, r9, r9, lsl #16
+	and	r4, r4, r9
+	and	r5, r5, r9
+	and	r6, r6, r9
+	and	r7, r7, r9
+	str	r4, [r0]
+	str	r5, [r0, #4]
+	str	r6, [r0, #8]
+	str	r7, [r0, #12]
+	add	r0, r0, #16
+	mov	r2, r3
+	subs	r12, r12, #1
+	bne	L_frodokem_mul_add_sb_plus_e_simd32_i
+	add	sp, sp, #8
+	pop	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	.size	frodokem_mul_add_sb_plus_e_simd32,.-frodokem_mul_add_sb_plus_e_simd32
+#endif /* (!defined(__ARM_NEON) && !defined(__ARM_NEON__)) || defined(WOLFSSL_ARMASM_NO_NEON) */
+#endif /* __ARM_FEATURE_SIMD32 */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+#if defined(__linux__) && defined(__ELF__)
+.section	.note.GNU-stack,"",%progbits
+#endif
+#endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-frodokem-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-frodokem-asm_c.c
new file mode 100644
index 00000000000..5470caba33a
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-32-frodokem-asm_c.c
@@ -0,0 +1,877 @@
+/* armv8-32-frodokem-asm
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Generated using (from wolfssl):
+ *   cd ../scripts
+ *   ruby ./frodokem/frodokem.rb arm32 \
+ *       ../wolfssl/wolfcrypt/src/port/arm/armv8-32-frodokem-asm.c
+ */
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources_asm.h>
+#include <wolfssl/wolfcrypt/error-crypt.h>
+
+#ifdef WOLFSSL_ARMASM
+#if !defined(__aarch64__) && !defined(WOLFSSL_ARMASM_THUMB2)
+#ifdef WOLFSSL_ARMASM_INLINE
+
+#ifdef __IAR_SYSTEMS_ICC__
+#define __asm__        asm
+#define __volatile__   volatile
+#define WOLFSSL_NO_VAR_ASSIGN_REG
+#endif /* __IAR_SYSTEMS_ICC__ */
+#ifdef __KEIL__
+#define __asm__        __asm
+#define __volatile__   volatile
+#endif /* __KEIL__ */
+#ifdef __ghs__
+#define __asm__        __asm
+#define __volatile__
+#define WOLFSSL_NO_VAR_ASSIGN_REG
+#endif /* __ghs__ */
+
+#include <wolfssl/wolfcrypt/wc_frodokem_mat.h>
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifndef WOLFSSL_ARMASM_NO_NEON
+void frodokem_add_neon(word16* a_p, const word16* b_p, int qmask_p);
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_add_neon(word16* a_p, const word16* b_p,
+    int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_add_neon(word16* a, const word16* b,
+    int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* a __asm__ ("r0") = (word16*)a_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register int qmask __asm__ ("r2") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "vdup.16	q2, %[qmask]\n\t"
+        "mov	r3, #8\n\t"
+        "\n"
+    "L_frodokem_add_neon_blk_%=:\n\t"
+        "vld1.16	{d0-d1}, [%[a]]\n\t"
+        "vld1.16	{d2-d3}, [%[b]]!\n\t"
+        "vadd.i16	q0, q0, q1\n\t"
+        "vand	q0, q0, q2\n\t"
+        "vst1.16	{d0-d1}, [%[a]]!\n\t"
+        "subs	r3, r3, #1\n\t"
+        "bne	L_frodokem_add_neon_blk_%=\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [a] "+r" (a), [b] "+r" (b), [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [a] "r" (a), [b] "r" (b), [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r3", "q0", "q1", "q2"
+    );
+}
+
+void frodokem_sample_neon(word16* mat_p, int cnt_p, const word16* cdf_p,
+    int cdflen_p);
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_sample_neon(word16* mat_p, int cnt_p,
+    const word16* cdf_p, int cdflen_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_sample_neon(word16* mat, int cnt,
+    const word16* cdf, int cdflen)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* mat __asm__ ("r0") = (word16*)mat_p;
+    register int cnt __asm__ ("r1") = (int)cnt_p;
+    register const word16* cdf __asm__ ("r2") = (const word16*)cdf_p;
+    register int cdflen __asm__ ("r3") = (int)cdflen_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "\n"
+    "L_frodokem_sample_neon_blk_%=:\n\t"
+        "vld1.16	{d0-d1}, [%[mat]]\n\t"
+        "vshr.u16	q1, q0, #1\n\t"
+        "vmov.i16	q2, #1\n\t"
+        "vand	q2, q2, q0\n\t"
+        "vmov.i16	q3, #0\n\t"
+        "mov	r12, %[cdf]\n\t"
+        "mov	lr, %[cdflen]\n\t"
+        "\n"
+    "L_frodokem_sample_neon_cdf_%=:\n\t"
+        "ldrh	r4, [r12]\n\t"
+        "add	r12, r12, #2\n\t"
+        "vdup.16	q4, r4\n\t"
+        "vsub.i16	q4, q4, q1\n\t"
+        "vshr.u16	q4, q4, #15\n\t"
+        "vadd.i16	q3, q3, q4\n\t"
+        "subs	lr, lr, #1\n\t"
+        "bne	L_frodokem_sample_neon_cdf_%=\n\t"
+        "vneg.s16	q5, q2\n\t"
+        "veor	q3, q3, q5\n\t"
+        "vadd.i16	q3, q3, q2\n\t"
+        "vst1.16	{d6-d7}, [%[mat]]!\n\t"
+        "subs	%[cnt], %[cnt], #8\n\t"
+        "bne	L_frodokem_sample_neon_blk_%=\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [mat] "+r" (mat), [cnt] "+r" (cnt), [cdf] "+r" (cdf),
+          [cdflen] "+r" (cdflen)
+        :
+#else
+        :
+        : [mat] "r" (mat), [cnt] "r" (cnt), [cdf] "r" (cdf),
+          [cdflen] "r" (cdflen)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r12", "lr", "r4", "q0", "q1", "q2", "q3", "q4", "q5"
+    );
+}
+
+void frodokem_sa_accum_neon(word16* out_p, const word16* s_p,
+    const word16* row_p, int j_p, int n_p);
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_sa_accum_neon(word16* out_p,
+    const word16* s_p, const word16* row_p, int j_p, int n_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_sa_accum_neon(word16* out, const word16* s,
+    const word16* row, int j, int n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* s __asm__ ("r1") = (const word16*)s_p;
+    register const word16* row __asm__ ("r2") = (const word16*)row_p;
+    register int j __asm__ ("r3") = (int)j_p;
+    register int n __asm__ ("r12") = (int)n_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[n]}\n\t"
+        "ldr	r12, [sp]\n\t"
+        "lsl	lr, r12, #1\n\t"
+        "add	r4, %[s], %[j], lsl #1\n\t"
+        "mov	r7, #8\n\t"
+        "\n"
+    "L_frodokem_sa_accum_neon_i_%=:\n\t"
+        "ldrh	r8, [r4]\n\t"
+        "vdup.16	q0, r8\n\t"
+        "add	r4, r4, lr\n\t"
+        "mov	r5, %[row]\n\t"
+        "lsr	r6, lr, #4\n\t"
+        "\n"
+    "L_frodokem_sa_accum_neon_k_%=:\n\t"
+        "vld1.16	{d2-d3}, [%[out]]\n\t"
+        "vld1.16	{d4-d5}, [r5]!\n\t"
+        "vmla.i16	q1, q2, q0\n\t"
+        "vst1.16	{d2-d3}, [%[out]]!\n\t"
+        "subs	r6, r6, #1\n\t"
+        "bne	L_frodokem_sa_accum_neon_k_%=\n\t"
+        "subs	r7, r7, #1\n\t"
+        "bne	L_frodokem_sa_accum_neon_i_%=\n\t"
+        "pop	{%[n]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [s] "+r" (s), [row] "+r" (row), [j] "+r" (j),
+          [n] "+r" (n)
+        :
+#else
+        :
+        : [out] "r" (out), [s] "r" (s), [row] "r" (row), [j] "r" (j),
+          [n] "r" (n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "q0", "q1", "q2"
+    );
+}
+
+void frodokem_as_accum_neon(word16* out_p, const word16* s_p,
+    const word16* row_p, int i_p, int n_p);
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_as_accum_neon(word16* out_p,
+    const word16* s_p, const word16* row_p, int i_p, int n_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_as_accum_neon(word16* out, const word16* s,
+    const word16* row, int i, int n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* s __asm__ ("r1") = (const word16*)s_p;
+    register const word16* row __asm__ ("r2") = (const word16*)row_p;
+    register int i __asm__ ("r3") = (int)i_p;
+    register int n __asm__ ("r12") = (int)n_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[n]}\n\t"
+        "ldr	r12, [sp]\n\t"
+        "lsl	lr, r12, #1\n\t"
+        "add	r7, %[out], %[i], lsl #4\n\t"
+        "mov	r6, %[row]\n\t"
+        "mov	r4, %[s]\n\t"
+        "veor	q0, q0, q0\n\t"
+        "veor	q1, q1, q1\n\t"
+        "veor	q2, q2, q2\n\t"
+        "veor	q3, q3, q3\n\t"
+        "veor	q4, q4, q4\n\t"
+        "veor	q5, q5, q5\n\t"
+        "veor	q6, q6, q6\n\t"
+        "veor	q7, q7, q7\n\t"
+        "lsr	r8, lr, #4\n\t"
+        "\n"
+    "L_frodokem_as_accum_neon_k_%=:\n\t"
+        "vld1.16	{d16-d17}, [r6]!\n\t"
+        "mov	r5, r4\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q0, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q1, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q2, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q3, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q4, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q5, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q6, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "vld1.16	{d18-d19}, [r5]\n\t"
+        "vmla.i16	q7, q8, q9\n\t"
+        "add	r5, r5, lr\n\t"
+        "add	r4, r4, #16\n\t"
+        "subs	r8, r8, #1\n\t"
+        "bne	L_frodokem_as_accum_neon_k_%=\n\t"
+        "vadd.i16	d18, d0, d1\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d20[0], r9\n\t"
+        "vadd.i16	d18, d2, d3\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d20[1], r9\n\t"
+        "vadd.i16	d18, d4, d5\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d20[2], r9\n\t"
+        "vadd.i16	d18, d6, d7\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d20[3], r9\n\t"
+        "vadd.i16	d18, d8, d9\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d21[0], r9\n\t"
+        "vadd.i16	d18, d10, d11\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d21[1], r9\n\t"
+        "vadd.i16	d18, d12, d13\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d21[2], r9\n\t"
+        "vadd.i16	d18, d14, d15\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r9, d18[0]\n\t"
+        "vmov.16	d21[3], r9\n\t"
+        "vld1.16	{d22-d23}, [r7]\n\t"
+        "vadd.i16	q10, q10, q11\n\t"
+        "vst1.16	{d20-d21}, [r7]\n\t"
+        "pop	{%[n]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [s] "+r" (s), [row] "+r" (row), [i] "+r" (i),
+          [n] "+r" (n)
+        :
+#else
+        :
+        : [out] "r" (out), [s] "r" (s), [row] "r" (row), [i] "r" (i),
+          [n] "r" (n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "r9", "q0", "q1",
+            "q2", "q3", "q4", "q5", "q6", "q7", "q8", "q9", "q10", "q11"
+    );
+}
+
+void frodokem_mul_bs_neon(word16* out_p, const word16* b_p, const word16* s_p,
+    int n_p, int qmask_p);
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_mul_bs_neon(word16* out_p,
+    const word16* b_p, const word16* s_p, int n_p, int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_mul_bs_neon(word16* out, const word16* b,
+    const word16* s, int n, int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register const word16* s __asm__ ("r2") = (const word16*)s_p;
+    register int n __asm__ ("r3") = (int)n_p;
+    register int qmask __asm__ ("r12") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[qmask]}\n\t"
+        "ldr	lr, [sp]\n\t"
+        "lsl	r12, %[n], #1\n\t"
+        "vdup.16	q11, lr\n\t"
+        "mov	r7, %[out]\n\t"
+        "mov	r4, %[b]\n\t"
+        "mov	r9, #8\n\t"
+        "\n"
+    "L_frodokem_mul_bs_neon_r_%=:\n\t"
+        "mov	r5, %[s]\n\t"
+        "veor	q0, q0, q0\n\t"
+        "veor	q1, q1, q1\n\t"
+        "veor	q2, q2, q2\n\t"
+        "veor	q3, q3, q3\n\t"
+        "veor	q4, q4, q4\n\t"
+        "veor	q5, q5, q5\n\t"
+        "veor	q6, q6, q6\n\t"
+        "veor	q7, q7, q7\n\t"
+        "lsr	r8, r12, #4\n\t"
+        "\n"
+    "L_frodokem_mul_bs_neon_k_%=:\n\t"
+        "vld1.16	{d16-d17}, [r4]!\n\t"
+        "mov	r6, r5\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q0, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q1, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q2, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q3, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q4, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q5, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q6, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "vld1.16	{d18-d19}, [r6]\n\t"
+        "vmla.i16	q7, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "add	r5, r5, #16\n\t"
+        "subs	r8, r8, #1\n\t"
+        "bne	L_frodokem_mul_bs_neon_k_%=\n\t"
+        "vadd.i16	d18, d0, d1\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d20[0], r10\n\t"
+        "vadd.i16	d18, d2, d3\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d20[1], r10\n\t"
+        "vadd.i16	d18, d4, d5\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d20[2], r10\n\t"
+        "vadd.i16	d18, d6, d7\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d20[3], r10\n\t"
+        "vadd.i16	d18, d8, d9\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d21[0], r10\n\t"
+        "vadd.i16	d18, d10, d11\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d21[1], r10\n\t"
+        "vadd.i16	d18, d12, d13\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d21[2], r10\n\t"
+        "vadd.i16	d18, d14, d15\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vpadd.i16	d18, d18, d18\n\t"
+        "vmov.u16	r10, d18[0]\n\t"
+        "vmov.16	d21[3], r10\n\t"
+        "vand	q10, q10, q11\n\t"
+        "vst1.16	{d20-d21}, [r7]!\n\t"
+        "subs	r9, r9, #1\n\t"
+        "bne	L_frodokem_mul_bs_neon_r_%=\n\t"
+        "pop	{%[qmask]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [b] "+r" (b), [s] "+r" (s), [n] "+r" (n),
+          [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [out] "r" (out), [b] "r" (b), [s] "r" (s), [n] "r" (n),
+          [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "q0",
+            "q1", "q2", "q3", "q4", "q5", "q6", "q7", "q8", "q9", "q10", "q11"
+    );
+}
+
+void frodokem_mul_add_sb_plus_e_neon(word16* out_p, const word16* b_p,
+    const word16* s_p, int n_p, int qmask_p);
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_mul_add_sb_plus_e_neon(word16* out_p,
+    const word16* b_p, const word16* s_p, int n_p, int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_mul_add_sb_plus_e_neon(word16* out,
+    const word16* b, const word16* s, int n, int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register const word16* s __asm__ ("r2") = (const word16*)s_p;
+    register int n __asm__ ("r3") = (int)n_p;
+    register int qmask __asm__ ("r12") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[qmask]}\n\t"
+        "ldr	lr, [sp]\n\t"
+        "lsl	r12, %[n], #1\n\t"
+        "vdup.16	q10, lr\n\t"
+        "mov	r4, %[b]\n\t"
+        "mov	r5, %[s]\n\t"
+        "mov	r7, %[out]\n\t"
+        "vld1.16	{d0-d1}, [r7]!\n\t"
+        "vld1.16	{d2-d3}, [r7]!\n\t"
+        "vld1.16	{d4-d5}, [r7]!\n\t"
+        "vld1.16	{d6-d7}, [r7]!\n\t"
+        "vld1.16	{d8-d9}, [r7]!\n\t"
+        "vld1.16	{d10-d11}, [r7]!\n\t"
+        "vld1.16	{d12-d13}, [r7]!\n\t"
+        "vld1.16	{d14-d15}, [r7]!\n\t"
+        "mov	r8, %[n]\n\t"
+        "\n"
+    "L_frodokem_mul_add_sb_plus_e_neon_j_%=:\n\t"
+        "vld1.16	{d16-d17}, [r4]!\n\t"
+        "mov	r6, r5\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q0, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q1, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q2, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q3, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q4, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q5, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q6, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "ldrh	r9, [r6]\n\t"
+        "vdup.16	q9, r9\n\t"
+        "vmla.i16	q7, q8, q9\n\t"
+        "add	r6, r6, r12\n\t"
+        "add	r5, r5, #2\n\t"
+        "subs	r8, r8, #1\n\t"
+        "bne	L_frodokem_mul_add_sb_plus_e_neon_j_%=\n\t"
+        "mov	r7, %[out]\n\t"
+        "vand	q0, q0, q10\n\t"
+        "vst1.16	{d0-d1}, [r7]!\n\t"
+        "vand	q1, q1, q10\n\t"
+        "vst1.16	{d2-d3}, [r7]!\n\t"
+        "vand	q2, q2, q10\n\t"
+        "vst1.16	{d4-d5}, [r7]!\n\t"
+        "vand	q3, q3, q10\n\t"
+        "vst1.16	{d6-d7}, [r7]!\n\t"
+        "vand	q4, q4, q10\n\t"
+        "vst1.16	{d8-d9}, [r7]!\n\t"
+        "vand	q5, q5, q10\n\t"
+        "vst1.16	{d10-d11}, [r7]!\n\t"
+        "vand	q6, q6, q10\n\t"
+        "vst1.16	{d12-d13}, [r7]!\n\t"
+        "vand	q7, q7, q10\n\t"
+        "vst1.16	{d14-d15}, [r7]!\n\t"
+        "pop	{%[qmask]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [b] "+r" (b), [s] "+r" (s), [n] "+r" (n),
+          [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [out] "r" (out), [b] "r" (b), [s] "r" (s), [n] "r" (n),
+          [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "r9", "q0", "q1",
+            "q2", "q3", "q4", "q5", "q6", "q7", "q8", "q9", "q10"
+    );
+}
+
+#endif /* WOLFSSL_ARMASM_NO_NEON */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifdef __ARM_FEATURE_SIMD32
+#if (!defined(__ARM_NEON) && !defined(__ARM_NEON__)) || \
+        defined(WOLFSSL_ARMASM_NO_NEON)
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_add_simd32(word16* a_p, const word16* b_p,
+    int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_add_simd32(word16* a, const word16* b,
+    int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* a __asm__ ("r0") = (word16*)a_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register int qmask __asm__ ("r2") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "orr	%[qmask], %[qmask], %[qmask], lsl #16\n\t"
+        "mov	r3, #32\n\t"
+        "\n"
+    "L_frodokem_add_simd32_blk_%=:\n\t"
+        "ldr	r12, [%[a]]\n\t"
+        "ldr	lr, [%[b]], #4\n\t"
+        "sadd16	r12, r12, lr\n\t"
+        "and	r12, r12, %[qmask]\n\t"
+        "str	r12, [%[a]], #4\n\t"
+        "subs	r3, r3, #1\n\t"
+        "bne	L_frodokem_add_simd32_blk_%=\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [a] "+r" (a), [b] "+r" (b), [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [a] "r" (a), [b] "r" (b), [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r3", "r12", "lr"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_sa_accum_simd32(word16* out_p,
+    const word16* s_p, const word16* row_p, int j_p, int n_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_sa_accum_simd32(word16* out,
+    const word16* s, const word16* row, int j, int n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* s __asm__ ("r1") = (const word16*)s_p;
+    register const word16* row __asm__ ("r2") = (const word16*)row_p;
+    register int j __asm__ ("r3") = (int)j_p;
+    register int n __asm__ ("r12") = (int)n_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[n]}\n\t"
+        "ldr	r12, [sp]\n\t"
+        "lsl	r12, r12, #1\n\t"
+        "add	lr, %[s], %[j], lsl #1\n\t"
+        "mov	r6, #8\n\t"
+        "\n"
+    "L_frodokem_sa_accum_simd32_i_%=:\n\t"
+        "ldrh	r7, [lr]\n\t"
+        "add	lr, lr, r12\n\t"
+        "mov	r4, %[row]\n\t"
+        "lsr	r5, r12, #2\n\t"
+        "\n"
+    "L_frodokem_sa_accum_simd32_k_%=:\n\t"
+        "ldr	r9, [%[out]]\n\t"
+        "ldr	r8, [r4], #4\n\t"
+        "smulbb	r10, r7, r8\n\t"
+        "smulbt	r11, r7, r8\n\t"
+        "pkhbt	r10, r10, r11, LSL #16\n\t"
+        "sadd16	r9, r9, r10\n\t"
+        "str	r9, [%[out]], #4\n\t"
+        "subs	r5, r5, #1\n\t"
+        "bne	L_frodokem_sa_accum_simd32_k_%=\n\t"
+        "subs	r6, r6, #1\n\t"
+        "bne	L_frodokem_sa_accum_simd32_i_%=\n\t"
+        "pop	{%[n]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [s] "+r" (s), [row] "+r" (row), [j] "+r" (j),
+          [n] "+r" (n)
+        :
+#else
+        :
+        : [out] "r" (out), [s] "r" (s), [row] "r" (row), [j] "r" (j),
+          [n] "r" (n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
+            "r11"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_as_accum_simd32(word16* out_p,
+    const word16* s_p, const word16* row_p, int i_p, int n_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_as_accum_simd32(word16* out,
+    const word16* s, const word16* row, int i, int n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* s __asm__ ("r1") = (const word16*)s_p;
+    register const word16* row __asm__ ("r2") = (const word16*)row_p;
+    register int i __asm__ ("r3") = (int)i_p;
+    register int n __asm__ ("r12") = (int)n_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[n]}\n\t"
+        "ldr	r12, [sp]\n\t"
+        "lsl	r12, r12, #1\n\t"
+        "add	lr, %[out], %[i], lsl #4\n\t"
+        "mov	r4, %[s]\n\t"
+        "mov	r7, #8\n\t"
+        "\n"
+    "L_frodokem_as_accum_simd32_c_%=:\n\t"
+        "mov	r9, #0\n\t"
+        "mov	r5, %[row]\n\t"
+        "mov	r6, r4\n\t"
+        "lsr	r8, r12, #2\n\t"
+        "\n"
+    "L_frodokem_as_accum_simd32_j_%=:\n\t"
+        "ldr	r10, [r5], #4\n\t"
+        "ldr	r11, [r6], #4\n\t"
+        "smlad	r9, r10, r11, r9\n\t"
+        "subs	r8, r8, #1\n\t"
+        "bne	L_frodokem_as_accum_simd32_j_%=\n\t"
+        "ldrh	r10, [lr]\n\t"
+        "add	r10, r10, r9\n\t"
+        "strh	r10, [lr]\n\t"
+        "add	lr, lr, #2\n\t"
+        "add	r4, r4, r12\n\t"
+        "subs	r7, r7, #1\n\t"
+        "bne	L_frodokem_as_accum_simd32_c_%=\n\t"
+        "pop	{%[n]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [s] "+r" (s), [row] "+r" (row), [i] "+r" (i),
+          [n] "+r" (n)
+        :
+#else
+        :
+        : [out] "r" (out), [s] "r" (s), [row] "r" (row), [i] "r" (i),
+          [n] "r" (n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
+            "r11"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_mul_bs_simd32(word16* out_p,
+    const word16* b_p, const word16* s_p, int n_p, int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_mul_bs_simd32(word16* out, const word16* b,
+    const word16* s, int n, int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register const word16* s __asm__ ("r2") = (const word16*)s_p;
+    register int n __asm__ ("r3") = (int)n_p;
+    register int qmask __asm__ ("r12") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[qmask]}\n\t"
+        "mov	r12, %[b]\n\t"
+        "mov	r6, #8\n\t"
+        "\n"
+    "L_frodokem_mul_bs_simd32_i_%=:\n\t"
+        "mov	lr, %[s]\n\t"
+        "mov	r7, #8\n\t"
+        "\n"
+    "L_frodokem_mul_bs_simd32_c_%=:\n\t"
+        "mov	r9, #0\n\t"
+        "mov	r4, r12\n\t"
+        "mov	r5, lr\n\t"
+        "lsr	r8, %[n], #1\n\t"
+        "\n"
+    "L_frodokem_mul_bs_simd32_j_%=:\n\t"
+        "ldr	r10, [r4], #4\n\t"
+        "ldr	r11, [r5], #4\n\t"
+        "smlad	r9, r10, r11, r9\n\t"
+        "subs	r8, r8, #1\n\t"
+        "bne	L_frodokem_mul_bs_simd32_j_%=\n\t"
+        "ldr	r10, [sp]\n\t"
+        "orr	r10, r10, r10, lsl #16\n\t"
+        "and	r9, r9, r10\n\t"
+        "strh	r9, [%[out]]\n\t"
+        "add	%[out], %[out], #2\n\t"
+        "add	lr, lr, %[n], lsl #1\n\t"
+        "subs	r7, r7, #1\n\t"
+        "bne	L_frodokem_mul_bs_simd32_c_%=\n\t"
+        "add	r12, r12, %[n], lsl #1\n\t"
+        "subs	r6, r6, #1\n\t"
+        "bne	L_frodokem_mul_bs_simd32_i_%=\n\t"
+        "pop	{%[qmask]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [b] "+r" (b), [s] "+r" (s), [n] "+r" (n),
+          [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [out] "r" (out), [b] "r" (b), [s] "r" (s), [n] "r" (n),
+          [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
+            "r11"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_mul_add_sb_plus_e_simd32(word16* out_p,
+    const word16* b_p, const word16* s_p, int n_p, int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_mul_add_sb_plus_e_simd32(word16* out,
+    const word16* b, const word16* s, int n, int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register const word16* s __asm__ ("r2") = (const word16*)s_p;
+    register int n __asm__ ("r3") = (int)n_p;
+    register int qmask __asm__ ("r12") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "push	{%[qmask]}\n\t"
+        "sub	sp, sp, #8\n\t"
+        "lsl	r9, %[n], #1\n\t"
+        "str	r9, [sp, #4]\n\t"
+        "str	%[b], [sp]\n\t"
+        "mov	r12, #8\n\t"
+        "\n"
+    "L_frodokem_mul_add_sb_plus_e_simd32_i_%=:\n\t"
+        "ldr	r9, [sp, #4]\n\t"
+        "add	%[n], %[s], r9\n\t"
+        "ldr	%[b], [sp]\n\t"
+        "mov	lr, %[s]\n\t"
+        "ldr	r4, [%[out]]\n\t"
+        "ldr	r5, [%[out], #4]\n\t"
+        "ldr	r6, [%[out], #8]\n\t"
+        "ldr	r7, [%[out], #12]\n\t"
+        "\n"
+    "L_frodokem_mul_add_sb_plus_e_simd32_j_%=:\n\t"
+        "ldrh	r8, [lr]\n\t"
+        "add	lr, lr, #2\n\t"
+        "ldr	r9, [%[b]]\n\t"
+        "smulbb	r10, r8, r9\n\t"
+        "smulbt	r11, r8, r9\n\t"
+        "pkhbt	r10, r10, r11, LSL #16\n\t"
+        "sadd16	r4, r4, r10\n\t"
+        "ldr	r9, [%[b], #4]\n\t"
+        "smulbb	r10, r8, r9\n\t"
+        "smulbt	r11, r8, r9\n\t"
+        "pkhbt	r10, r10, r11, LSL #16\n\t"
+        "sadd16	r5, r5, r10\n\t"
+        "ldr	r9, [%[b], #8]\n\t"
+        "smulbb	r10, r8, r9\n\t"
+        "smulbt	r11, r8, r9\n\t"
+        "pkhbt	r10, r10, r11, LSL #16\n\t"
+        "sadd16	r6, r6, r10\n\t"
+        "ldr	r9, [%[b], #12]\n\t"
+        "smulbb	r10, r8, r9\n\t"
+        "smulbt	r11, r8, r9\n\t"
+        "pkhbt	r10, r10, r11, LSL #16\n\t"
+        "sadd16	r7, r7, r10\n\t"
+        "add	%[b], %[b], #16\n\t"
+        "cmp	lr, %[n]\n\t"
+        "bne	L_frodokem_mul_add_sb_plus_e_simd32_j_%=\n\t"
+        "ldr	r9, [sp, #8]\n\t"
+        "orr	r9, r9, r9, lsl #16\n\t"
+        "and	r4, r4, r9\n\t"
+        "and	r5, r5, r9\n\t"
+        "and	r6, r6, r9\n\t"
+        "and	r7, r7, r9\n\t"
+        "str	r4, [%[out]]\n\t"
+        "str	r5, [%[out], #4]\n\t"
+        "str	r6, [%[out], #8]\n\t"
+        "str	r7, [%[out], #12]\n\t"
+        "add	%[out], %[out], #16\n\t"
+        "mov	%[s], %[n]\n\t"
+        "subs	r12, r12, #1\n\t"
+        "bne	L_frodokem_mul_add_sb_plus_e_simd32_i_%=\n\t"
+        "add	sp, sp, #8\n\t"
+        "pop	{%[qmask]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [b] "+r" (b), [s] "+r" (s), [n] "+r" (n),
+          [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [out] "r" (out), [b] "r" (b), [s] "r" (s), [n] "r" (n),
+          [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "lr", "r4", "r5", "r6", "r7", "r8", "r9", "r10",
+            "r11"
+    );
+}
+
+#endif /* (!defined(__ARM_NEON) && !defined(__ARM_NEON__)) ||
+        * defined(WOLFSSL_ARMASM_NO_NEON) */
+#endif /* __ARM_FEATURE_SIMD32 */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+#endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-mlkem-asm.S b/wolfcrypt/src/port/arm/armv8-32-mlkem-asm.S
index 2089663a2f1..25ec479b25d 100644
--- a/wolfcrypt/src/port/arm/armv8-32-mlkem-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-32-mlkem-asm.S
@@ -8508,10 +8508,10 @@ L_mlkem_arm32_rej_uniform_done:
 	pop	{r4, r5, r6, r7, r8, pc}
 	.size	mlkem_arm32_rej_uniform,.-mlkem_arm32_rej_uniform
 #endif /* WOLFSSL_HAVE_MLKEM */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-mlkem-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-mlkem-asm_c.c
index 7e6ee3eaf1b..5587777b0e4 100644
--- a/wolfcrypt/src/port/arm/armv8-32-mlkem-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-mlkem-asm_c.c
@@ -8664,7 +8664,7 @@ WC_OMIT_FRAME_POINTER unsigned int mlkem_arm32_rej_uniform(sword16* p,
 }
 
 #endif /* WOLFSSL_HAVE_MLKEM */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-poly1305-asm.S b/wolfcrypt/src/port/arm/armv8-32-poly1305-asm.S
index f67031475bd..e61ae335554 100644
--- a/wolfcrypt/src/port/arm/armv8-32-poly1305-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-32-poly1305-asm.S
@@ -1296,10 +1296,10 @@ poly1305_final:
 	.size	poly1305_final,.-poly1305_final
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* HAVE_POLY1305 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-poly1305-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-poly1305-asm_c.c
index af09921e03e..0e686f6ad74 100644
--- a/wolfcrypt/src/port/arm/armv8-32-poly1305-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-poly1305-asm_c.c
@@ -1446,7 +1446,7 @@ WC_OMIT_FRAME_POINTER void poly1305_final(Poly1305* ctx, byte* mac)
 
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* HAVE_POLY1305 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S b/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S
index e0883cc7deb..6515bd8484c 100644
--- a/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-32-sha256-asm.S
@@ -3772,10 +3772,10 @@ L_sha256_len_crypto_begin:
 #endif /* WOLFSSL_ARMASM_NO_HW_CRYPTO */
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* !NO_SHA256 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.c
index e329de7d7ec..18c3b5c4b3d 100644
--- a/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-sha256-asm_c.c
@@ -3861,7 +3861,7 @@ WC_OMIT_FRAME_POINTER void Transform_Sha256_Len_crypto(wc_Sha256* sha256,
 #endif /* WOLFSSL_ARMASM_NO_HW_CRYPTO */
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* !NO_SHA256 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S b/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S
index 6d2f0172994..8d58f1bedfc 100644
--- a/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-32-sha3-asm.S
@@ -2325,10 +2325,10 @@ L_sha3_arm32_begin:
 	.size	BlockSha3,.-BlockSha3
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* WOLFSSL_SHA3 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-sha3-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-sha3-asm_c.c
index 6477cf50246..92a95c8c078 100644
--- a/wolfcrypt/src/port/arm/armv8-32-sha3-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-sha3-asm_c.c
@@ -2367,7 +2367,7 @@ WC_OMIT_FRAME_POINTER void BlockSha3(word64* state)
 
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* WOLFSSL_SHA3 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S b/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S
index 60a7d731362..b8e41fc24f1 100644
--- a/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-32-sha512-asm.S
@@ -9060,10 +9060,10 @@ L_SHA512_transform_neon_len_start:
 	.size	Transform_Sha512_Len_neon,.-Transform_Sha512_Len_neon
 #endif /* !WOLFSSL_ARMASM_NO_NEON */
 #endif /* WOLFSSL_SHA512 || WOLFSSL_SHA384 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-32-sha512-asm_c.c b/wolfcrypt/src/port/arm/armv8-32-sha512-asm_c.c
index 1010c7df535..3d458a8e338 100644
--- a/wolfcrypt/src/port/arm/armv8-32-sha512-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-32-sha512-asm_c.c
@@ -9118,7 +9118,7 @@ WC_OMIT_FRAME_POINTER void Transform_Sha512_Len_neon(wc_Sha512* sha512,
 
 #endif /* !WOLFSSL_ARMASM_NO_NEON */
 #endif /* WOLFSSL_SHA512 || WOLFSSL_SHA384 */
-#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* !__aarch64__ && !WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/armv8-aes-asm.asm b/wolfcrypt/src/port/arm/armv8-aes-asm.asm
index b6155ace79e..1416b02bf50 100644
--- a/wolfcrypt/src/port/arm/armv8-aes-asm.asm
+++ b/wolfcrypt/src/port/arm/armv8-aes-asm.asm
@@ -42809,259 +42809,1306 @@ L_aes_xts_decrypt_arm64_crypto_done
 	ENDP
 	ENDIF
 	ENDIF
-	ENDIF
-	IF :LNOT::DEF:WOLFSSL_ARMASM_NO_NEON
-	IF :DEF:HAVE_AES_DECRYPT :LOR: :DEF:HAVE_AES_CBC :LOR: :DEF:HAVE_AESCCM :LOR: :DEF:HAVE_AESGCM :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER
-	AREA	|.rodata|, DATA, READONLY, ALIGN=4
-	ALIGN	8
-L_AES_ARM64_NEON_te
-	DCB	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
-	DCB	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76
-	DCB	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0
-	DCB	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0
-	DCB	0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc
-	DCB	0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15
-	DCB	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a
-	DCB	0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75
-	DCB	0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0
-	DCB	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84
-	DCB	0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b
-	DCB	0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf
-	DCB	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85
-	DCB	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8
-	DCB	0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5
-	DCB	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2
-	DCB	0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17
-	DCB	0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73
-	DCB	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88
-	DCB	0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb
-	DCB	0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c
-	DCB	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79
-	DCB	0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9
-	DCB	0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08
-	DCB	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6
-	DCB	0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a
-	DCB	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e
-	DCB	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e
-	DCB	0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94
-	DCB	0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf
-	DCB	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68
-	DCB	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
-	AREA	|.rodata|, DATA, READONLY, ALIGN=4
-	ALIGN	8
-L_AES_ARM64_NEON_shift_rows_shuffle
-	DCB	0x0c, 0x09, 0x06, 0x03, 0x00, 0x0d, 0x0a, 0x07
-	DCB	0x04, 0x01, 0x0e, 0x0b, 0x08, 0x05, 0x02, 0x0f
-	ENDIF
-	IF :DEF:HAVE_AES_DECRYPT
+	IF :DEF:WOLFSSL_AESGCM_SIV
 	AREA	|.text|, CODE, READONLY
 	ALIGN	4
-	EXPORT	AES_invert_key_NEON
-AES_invert_key_NEON PROC
-	add	x3, x0, x1, lsl 4
-	mov	x2, x0
-	mov	w4, w1
-L_AES_invert_key_NEON_loop
-	ld1	{V0.2D}, [x2]
-	ld1	{V1.2D}, [x3]
-	st1	{V0.2D}, [x3]
-	st1	{V1.2D}, [x2], #16
-	subs	w4, w4, #2
-	sub	x3, x3, #16
-	bne	L_AES_invert_key_NEON_loop
-	movi	V2.16B, #27
-	add	x2, x0, #16
-	sub	w4, w1, #1
-L_AES_invert_key_NEON_mix_loop
-	ld1	{V0.2D}, [x2]
-	sshr	V5.16B, V0.16B, #7
-	ushr	V6.16B, V0.16B, #6
-	ushr	V3.16B, V0.16B, #5
-	and	V5.16B, V5.16B, V2.16B
-	pmul	V6.16B, V6.16B, V2.16B
-	pmul	V3.16B, V3.16B, V2.16B
-	shl	V4.16B, V0.16B, #1
-	eor	V5.16B, V5.16B, V4.16B
-	shl	V4.16B, V0.16B, #3
-	eor	V3.16B, V3.16B, V4.16B
-	shl	V4.16B, V0.16B, #2
-	eor	V6.16B, V6.16B, V4.16B
-	eor	V4.16B, V5.16B, V3.16B
-	eor	V3.16B, V3.16B, V0.16B
-	eor	V5.16B, V6.16B, V3.16B
-	eor	V6.16B, V6.16B, V4.16B
-	eor	V4.16B, V4.16B, V0.16B
-	shl	V0.4S, V4.4S, #8
-	rev32	V5.8H, V5.8H
-	sri	V0.4S, V4.4S, #24
-	eor	V0.16B, V0.16B, V6.16B
-	shl	V4.4S, V3.4S, #24
-	eor	V0.16B, V0.16B, V5.16B
-	sri	V4.4S, V3.4S, #8
-	eor	V0.16B, V0.16B, V4.16B
-	st1	{V0.2D}, [x2], #16
-	subs	w4, w4, #1
-	bne	L_AES_invert_key_NEON_mix_loop
+	EXPORT	AES_GCMSIV_polyval_pmull
+AES_GCMSIV_polyval_pmull PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	movi	V2.16B, #0
+	ld1	{V1.16B}, [x1]
+	ld1	{V0.16B}, [x0]
+	rev64	V0.16B, V0.16B
+	ext8	V0.16B, V0.16B, V0.16B, #8
+	pmull	V18.1Q, V1.1D, V1.1D
+	pmull2	V19.1Q, V1.2D, V1.2D
+	ext8	V22.16B, V1.16B, V1.16B, #8
+	pmull	V23.1Q, V22.1D, V1.1D
+	pmull2	V22.1Q, V22.2D, V1.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V3.16B, V19.16B, V18.16B
+	pmull	V18.1Q, V3.1D, V1.1D
+	pmull2	V19.1Q, V3.2D, V1.2D
+	ext8	V22.16B, V3.16B, V3.16B, #8
+	pmull	V23.1Q, V22.1D, V1.1D
+	pmull2	V22.1Q, V22.2D, V1.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V4.16B, V19.16B, V18.16B
+	pmull	V18.1Q, V3.1D, V3.1D
+	pmull2	V19.1Q, V3.2D, V3.2D
+	ext8	V22.16B, V3.16B, V3.16B, #8
+	pmull	V23.1Q, V22.1D, V3.1D
+	pmull2	V22.1Q, V22.2D, V3.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V5.16B, V19.16B, V18.16B
+	pmull	V18.1Q, V5.1D, V1.1D
+	pmull2	V19.1Q, V5.2D, V1.2D
+	ext8	V22.16B, V5.16B, V5.16B, #8
+	pmull	V23.1Q, V22.1D, V1.1D
+	pmull2	V22.1Q, V22.2D, V1.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V6.16B, V19.16B, V18.16B
+	pmull	V18.1Q, V5.1D, V3.1D
+	pmull2	V19.1Q, V5.2D, V3.2D
+	ext8	V22.16B, V5.16B, V5.16B, #8
+	pmull	V23.1Q, V22.1D, V3.1D
+	pmull2	V22.1Q, V22.2D, V3.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V7.16B, V19.16B, V18.16B
+	pmull	V18.1Q, V5.1D, V4.1D
+	pmull2	V19.1Q, V5.2D, V4.2D
+	ext8	V22.16B, V5.16B, V5.16B, #8
+	pmull	V23.1Q, V22.1D, V4.1D
+	pmull2	V22.1Q, V22.2D, V4.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V8.16B, V19.16B, V18.16B
+	pmull	V18.1Q, V5.1D, V5.1D
+	pmull2	V19.1Q, V5.2D, V5.2D
+	ext8	V22.16B, V5.16B, V5.16B, #8
+	pmull	V23.1Q, V22.1D, V5.1D
+	pmull2	V22.1Q, V22.2D, V5.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V9.16B, V19.16B, V18.16B
+L_AES_GCMSIV_polyval_pmull_loop8
+	cmp	w3, #8
+	blt	L_AES_GCMSIV_polyval_pmull_done8
+	ld1	{V10.16B, V11.16B, V12.16B, V13.16B}, [x2], #0x40
+	ld1	{V14.16B, V15.16B, V16.16B, V17.16B}, [x2], #0x40
+	eor	V10.16B, V10.16B, V0.16B
+	pmull	V18.1Q, V10.1D, V9.1D
+	pmull2	V19.1Q, V10.2D, V9.2D
+	ext8	V22.16B, V10.16B, V10.16B, #8
+	pmull	V23.1Q, V22.1D, V9.1D
+	pmull2	V22.1Q, V22.2D, V9.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	pmull	V20.1Q, V11.1D, V8.1D
+	pmull2	V21.1Q, V11.2D, V8.2D
+	ext8	V22.16B, V11.16B, V11.16B, #8
+	pmull	V23.1Q, V22.1D, V8.1D
+	pmull2	V22.1Q, V22.2D, V8.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V12.1D, V7.1D
+	pmull2	V21.1Q, V12.2D, V7.2D
+	ext8	V22.16B, V12.16B, V12.16B, #8
+	pmull	V23.1Q, V22.1D, V7.1D
+	pmull2	V22.1Q, V22.2D, V7.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V13.1D, V6.1D
+	pmull2	V21.1Q, V13.2D, V6.2D
+	ext8	V22.16B, V13.16B, V13.16B, #8
+	pmull	V23.1Q, V22.1D, V6.1D
+	pmull2	V22.1Q, V22.2D, V6.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V14.1D, V5.1D
+	pmull2	V21.1Q, V14.2D, V5.2D
+	ext8	V22.16B, V14.16B, V14.16B, #8
+	pmull	V23.1Q, V22.1D, V5.1D
+	pmull2	V22.1Q, V22.2D, V5.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V15.1D, V4.1D
+	pmull2	V21.1Q, V15.2D, V4.2D
+	ext8	V22.16B, V15.16B, V15.16B, #8
+	pmull	V23.1Q, V22.1D, V4.1D
+	pmull2	V22.1Q, V22.2D, V4.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V16.1D, V3.1D
+	pmull2	V21.1Q, V16.2D, V3.2D
+	ext8	V22.16B, V16.16B, V16.16B, #8
+	pmull	V23.1Q, V22.1D, V3.1D
+	pmull2	V22.1Q, V22.2D, V3.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V17.1D, V1.1D
+	pmull2	V21.1Q, V17.2D, V1.2D
+	ext8	V22.16B, V17.16B, V17.16B, #8
+	pmull	V23.1Q, V22.1D, V1.1D
+	pmull2	V22.1Q, V22.2D, V1.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V0.16B, V19.16B, V18.16B
+	sub	w3, w3, #8
+	b	L_AES_GCMSIV_polyval_pmull_loop8
+L_AES_GCMSIV_polyval_pmull_done8
+L_AES_GCMSIV_polyval_pmull_loop4
+	cmp	w3, #4
+	blt	L_AES_GCMSIV_polyval_pmull_done4
+	ld1	{V10.16B, V11.16B, V12.16B, V13.16B}, [x2], #0x40
+	eor	V10.16B, V10.16B, V0.16B
+	pmull	V18.1Q, V10.1D, V5.1D
+	pmull2	V19.1Q, V10.2D, V5.2D
+	ext8	V22.16B, V10.16B, V10.16B, #8
+	pmull	V23.1Q, V22.1D, V5.1D
+	pmull2	V22.1Q, V22.2D, V5.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	pmull	V20.1Q, V11.1D, V4.1D
+	pmull2	V21.1Q, V11.2D, V4.2D
+	ext8	V22.16B, V11.16B, V11.16B, #8
+	pmull	V23.1Q, V22.1D, V4.1D
+	pmull2	V22.1Q, V22.2D, V4.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V12.1D, V3.1D
+	pmull2	V21.1Q, V12.2D, V3.2D
+	ext8	V22.16B, V12.16B, V12.16B, #8
+	pmull	V23.1Q, V22.1D, V3.1D
+	pmull2	V22.1Q, V22.2D, V3.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	pmull	V20.1Q, V13.1D, V1.1D
+	pmull2	V21.1Q, V13.2D, V1.2D
+	ext8	V22.16B, V13.16B, V13.16B, #8
+	pmull	V23.1Q, V22.1D, V1.1D
+	pmull2	V22.1Q, V22.2D, V1.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V20.16B, V20.16B, V23.16B
+	eor	V21.16B, V21.16B, V22.16B
+	eor	V18.16B, V18.16B, V20.16B
+	eor	V19.16B, V19.16B, V21.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V0.16B, V19.16B, V18.16B
+	sub	w3, w3, #4
+	b	L_AES_GCMSIV_polyval_pmull_loop4
+L_AES_GCMSIV_polyval_pmull_done4
+L_AES_GCMSIV_polyval_pmull_rem
+	cbz	w3, L_AES_GCMSIV_polyval_pmull_done
+	ld1	{V10.16B}, [x2], #16
+	eor	V0.16B, V0.16B, V10.16B
+	pmull	V18.1Q, V0.1D, V1.1D
+	pmull2	V19.1Q, V0.2D, V1.2D
+	ext8	V22.16B, V0.16B, V0.16B, #8
+	pmull	V23.1Q, V22.1D, V1.1D
+	pmull2	V22.1Q, V22.2D, V1.2D
+	eor	V22.16B, V22.16B, V23.16B
+	ext8	V23.16B, V2.16B, V22.16B, #8
+	ext8	V22.16B, V22.16B, V2.16B, #8
+	eor	V18.16B, V18.16B, V23.16B
+	eor	V19.16B, V19.16B, V22.16B
+	ushr	V24.4S, V18.4S, #31
+	ushr	V25.4S, V19.4S, #31
+	shl	V18.4S, V18.4S, #1
+	shl	V19.4S, V19.4S, #1
+	ext8	V26.16B, V24.16B, V2.16B, #12
+	ext8	V25.16B, V2.16B, V25.16B, #12
+	ext8	V24.16B, V2.16B, V24.16B, #12
+	orr	V18.16B, V18.16B, V24.16B
+	orr	V19.16B, V19.16B, V25.16B
+	orr	V19.16B, V19.16B, V26.16B
+	shl	V24.4S, V18.4S, #31
+	shl	V25.4S, V18.4S, #30
+	shl	V26.4S, V18.4S, #25
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V24.16B, V24.16B, V26.16B
+	ext8	V25.16B, V24.16B, V2.16B, #4
+	ext8	V24.16B, V2.16B, V24.16B, #4
+	eor	V18.16B, V18.16B, V24.16B
+	ushr	V24.4S, V18.4S, #1
+	ushr	V26.4S, V18.4S, #2
+	ushr	V27.4S, V18.4S, #7
+	eor	V24.16B, V24.16B, V26.16B
+	eor	V24.16B, V24.16B, V27.16B
+	eor	V24.16B, V24.16B, V25.16B
+	eor	V18.16B, V18.16B, V24.16B
+	eor	V0.16B, V19.16B, V18.16B
+	subs	w3, w3, #1
+	bne	L_AES_GCMSIV_polyval_pmull_rem
+L_AES_GCMSIV_polyval_pmull_done
+	rev64	V0.16B, V0.16B
+	ext8	V0.16B, V0.16B, V0.16B, #8
+	st1	{V0.16B}, [x0]
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
 	ret
 	ENDP
-	ENDIF
-	AREA	|.rodata|, DATA, READONLY, ALIGN=4
-	ALIGN	8
-L_AES_ARM64_NEON_rcon
-	DCD	0x01000000, 0x02000000, 0x04000000, 0x08000000
-	DCD	0x10000000, 0x20000000, 0x40000000, 0x80000000
-	DCD	0x1b000000, 0x36000000
 	AREA	|.text|, CODE, READONLY
 	ALIGN	4
-	EXPORT	AES_set_encrypt_key_NEON
-AES_set_encrypt_key_NEON PROC
+	EXPORT	AES_GCMSIV_ctr_aarch64
+AES_GCMSIV_ctr_aarch64 PROC
 	stp	x29, x30, [sp, #-80]!
 	add	x29, sp, #0
 	stp	D8, D9, [x29, #16]
 	stp	D10, D11, [x29, #32]
 	stp	D12, D13, [x29, #48]
 	stp	D14, D15, [x29, #64]
-	adrp	x4, L_AES_ARM64_NEON_rcon
-	add	x4, x4, L_AES_ARM64_NEON_rcon
-	adrp	x5, L_AES_ARM64_NEON_te
-	add	x5, x5, L_AES_ARM64_NEON_te
-	ld1	{V6.16B, V7.16B, V8.16B, V9.16B}, [x5], #0x40
-	ld1	{V10.16B, V11.16B, V12.16B, V13.16B}, [x5], #0x40
-	ld1	{V14.16B, V15.16B, V16.16B, V17.16B}, [x5], #0x40
-	ld1	{V18.16B, V19.16B, V20.16B, V21.16B}, [x5]
-	movi	V2.16B, #0x40
-	movi	V3.16B, #0x80
-	movi	V4.16B, #0xc0
-	movi	V5.16B, #27
-	eor	V26.16B, V26.16B, V26.16B
-	cmp	x1, #0x80
-	beq	L_AES_set_encrypt_key_NEON_start_128
-	cmp	x1, #0xc0
-	beq	L_AES_set_encrypt_key_NEON_start_192
-	ld1	{V0.16B}, [x0], #16
-	ld1	{V1.16B}, [x0]
-	rev32	V0.16B, V0.16B
-	rev32	V1.16B, V1.16B
-	st1	{V0.2D}, [x2], #16
-	st1	{V1.2D}, [x2], #16
-	mov	x3, #6
-L_AES_set_encrypt_key_NEON_loop_256
-	eor	V22.16B, V1.16B, V2.16B
-	eor	V23.16B, V1.16B, V3.16B
-	eor	V24.16B, V1.16B, V4.16B
-	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V1.16B
-	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
-	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
-	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
-	orr	V25.16B, V25.16B, V22.16B
-	orr	V23.16B, V23.16B, V24.16B
-	orr	V25.16B, V25.16B, V23.16B
-	ext8	V25.16B, V25.16B, V26.16B, #12
-	shl	V22.4S, V25.4S, #8
-	sri	V22.4S, V25.4S, #24
-	eor	V0.16B, V0.16B, V22.16B
-	ld1r	{V25.4S}, [x4], #4
-	dup	V22.4S, V0.S[0]
-	dup	V23.2S, V0.S[1]
-	dup	V24.2S, V0.S[2]
-	ext8	V22.16B, V26.16B, V22.16B, #12
-	ext8	V23.16B, V26.16B, V23.16B, #8
-	eor	V0.16B, V0.16B, V22.16B
-	ext8	V24.16B, V26.16B, V24.16B, #4
-	eor	V0.16B, V0.16B, V23.16B
-	eor	V0.16B, V0.16B, V24.16B
-	eor	V0.16B, V0.16B, V25.16B
-	st1	{V0.2D}, [x2], #16
-	eor	V22.16B, V0.16B, V2.16B
-	eor	V23.16B, V0.16B, V3.16B
-	eor	V24.16B, V0.16B, V4.16B
-	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V0.16B
-	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
-	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
-	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
-	orr	V25.16B, V25.16B, V22.16B
-	orr	V23.16B, V23.16B, V24.16B
-	orr	V25.16B, V25.16B, V23.16B
-	ext8	V25.16B, V25.16B, V26.16B, #12
-	eor	V1.16B, V1.16B, V25.16B
-	dup	V22.4S, V1.S[0]
-	dup	V23.2S, V1.S[1]
-	dup	V24.2S, V1.S[2]
-	ext8	V22.16B, V26.16B, V22.16B, #12
-	ext8	V23.16B, V26.16B, V23.16B, #8
-	eor	V1.16B, V1.16B, V22.16B
-	ext8	V24.16B, V26.16B, V24.16B, #4
-	eor	V1.16B, V1.16B, V23.16B
-	eor	V1.16B, V1.16B, V24.16B
-	st1	{V1.2D}, [x2], #16
-	subs	x3, x3, #1
-	bne	L_AES_set_encrypt_key_NEON_loop_256
-	eor	V22.16B, V1.16B, V2.16B
-	eor	V23.16B, V1.16B, V3.16B
-	eor	V24.16B, V1.16B, V4.16B
-	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V1.16B
-	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
-	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
-	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
-	orr	V25.16B, V25.16B, V22.16B
-	orr	V23.16B, V23.16B, V24.16B
-	orr	V25.16B, V25.16B, V23.16B
-	ext8	V25.16B, V25.16B, V26.16B, #12
-	shl	V22.4S, V25.4S, #8
-	sri	V22.4S, V25.4S, #24
-	eor	V0.16B, V0.16B, V22.16B
-	ld1r	{V25.4S}, [x4], #4
-	dup	V22.4S, V0.S[0]
-	dup	V23.2S, V0.S[1]
-	dup	V24.2S, V0.S[2]
-	ext8	V22.16B, V26.16B, V22.16B, #12
-	ext8	V23.16B, V26.16B, V23.16B, #8
-	eor	V0.16B, V0.16B, V22.16B
-	ext8	V24.16B, V26.16B, V24.16B, #4
-	eor	V0.16B, V0.16B, V23.16B
-	eor	V0.16B, V0.16B, V24.16B
-	eor	V0.16B, V0.16B, V25.16B
-	st1	{V0.2D}, [x2], #16
-	b	L_AES_set_encrypt_key_NEON_end
-L_AES_set_encrypt_key_NEON_start_192
-	ld1	{V0.16B}, [x0], #16
-	ld1	{V1.8B}, [x0]
-	rev32	V0.16B, V0.16B
-	rev32	V1.8B, V1.8B
-	st1	{V0.16B}, [x2], #16
-	st1	{V1.8B}, [x2], #8
-	ext8	V1.16B, V1.16B, V1.16B, #8
-	mov	x3, #7
-L_AES_set_encrypt_key_NEON_loop_192
-	eor	V22.16B, V1.16B, V2.16B
-	eor	V23.16B, V1.16B, V3.16B
-	eor	V24.16B, V1.16B, V4.16B
-	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V1.16B
-	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
-	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
-	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
-	orr	V25.16B, V25.16B, V22.16B
-	orr	V23.16B, V23.16B, V24.16B
-	orr	V25.16B, V25.16B, V23.16B
-	ext8	V25.16B, V25.16B, V26.16B, #12
-	shl	V22.4S, V25.4S, #8
-	sri	V22.4S, V25.4S, #24
-	eor	V0.16B, V0.16B, V22.16B
-	ld1r	{V25.4S}, [x4], #4
-	dup	V22.4S, V0.S[0]
-	dup	V23.2S, V0.S[1]
-	dup	V24.2S, V0.S[2]
-	ext8	V22.16B, V26.16B, V22.16B, #12
-	ext8	V23.16B, V26.16B, V23.16B, #8
-	eor	V0.16B, V0.16B, V22.16B
-	ext8	V24.16B, V26.16B, V24.16B, #4
-	eor	V0.16B, V0.16B, V23.16B
-	eor	V0.16B, V0.16B, V24.16B
-	eor	V0.16B, V0.16B, V25.16B
-	st1	{V0.2D}, [x2], #16
-	mov	V23.16B, V26.16B
-	mov	V23.S[2], V0.S[3]
-	eor	V1.16B, V1.16B, V23.16B
+	ld1	{V15.2D}, [x5]
+	mov	w7, V15.S[0]
+	lsr	x6, x2, #4
+	ld1	{V0.2D, V1.2D, V2.2D, V3.2D}, [x3], #0x40
+	ld1	{V4.2D, V5.2D, V6.2D, V7.2D}, [x3], #0x40
+	cmp	w4, #12
+	blt	L_AES_GCMSIV_ctr_aarch64_start_128
+	bgt	L_AES_GCMSIV_ctr_aarch64_start_256
+	; AES_GCMSIV_CTR_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{V8.2D, V9.2D, V10.2D, V11.2D}, [x3], #0x40
+	ld1	{V12.2D}, [x3]
+L_AES_GCMSIV_ctr_aarch64_192_loop4
+	cmp	x6, #4
+	blt	L_AES_GCMSIV_ctr_aarch64_192_done4
+	mov	V16.16B, V15.16B
+	mov	V16.S[0], w7
+	mov	V17.16B, V15.16B
+	add	w8, w7, #1
+	mov	V17.S[0], w8
+	mov	V18.16B, V15.16B
+	add	w8, w7, #2
+	mov	V18.S[0], w8
+	mov	V19.16B, V15.16B
+	add	w8, w7, #3
+	mov	V19.S[0], w8
+	add	w7, w7, #4
+	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x0], #0x40
+	aese	V16.16B, V0.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V0.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V0.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V0.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V1.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V1.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V1.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V1.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V2.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V2.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V2.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V2.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V3.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V3.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V3.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V3.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V4.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V4.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V4.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V4.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V5.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V5.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V5.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V5.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V6.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V6.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V6.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V6.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V7.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V7.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V7.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V7.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V8.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V8.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V8.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V8.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V9.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V9.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V9.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V9.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V10.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V10.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V10.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V10.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V11.16B
+	eor	V16.16B, V16.16B, V12.16B
+	aese	V17.16B, V11.16B
+	eor	V17.16B, V17.16B, V12.16B
+	aese	V18.16B, V11.16B
+	eor	V18.16B, V18.16B, V12.16B
+	aese	V19.16B, V11.16B
+	eor	V19.16B, V19.16B, V12.16B
+	eor	V20.16B, V20.16B, V16.16B
+	eor	V21.16B, V21.16B, V17.16B
+	eor	V22.16B, V22.16B, V18.16B
+	eor	V23.16B, V23.16B, V19.16B
+	st1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x1], #0x40
+	sub	x6, x6, #4
+	cmp	x6, #4
+	bge	L_AES_GCMSIV_ctr_aarch64_192_loop4
+L_AES_GCMSIV_ctr_aarch64_192_done4
+L_AES_GCMSIV_ctr_aarch64_192_loop1
+	cbz	x6, L_AES_GCMSIV_ctr_aarch64_192_done1
+	mov	V16.16B, V15.16B
+	mov	V16.S[0], w7
+	add	w7, w7, #1
+	ld1	{V20.16B}, [x0], #16
+	aese	V16.16B, V0.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V1.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V2.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V3.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V4.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V5.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V6.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V7.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V8.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V9.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V10.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V11.16B
+	eor	V16.16B, V16.16B, V12.16B
+	eor	V20.16B, V20.16B, V16.16B
+	st1	{V20.16B}, [x1], #16
+	sub	x6, x6, #1
+	b	L_AES_GCMSIV_ctr_aarch64_192_loop1
+L_AES_GCMSIV_ctr_aarch64_192_done1
+	ENDIF
+	b	L_AES_GCMSIV_ctr_aarch64_done
+	; AES_GCMSIV_CTR_256
+L_AES_GCMSIV_ctr_aarch64_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{V8.2D, V9.2D, V10.2D, V11.2D}, [x3], #0x40
+	ld1	{V12.2D, V13.2D}, [x3], #32
+	ld1	{V14.2D}, [x3]
+L_AES_GCMSIV_ctr_aarch64_256_loop4
+	cmp	x6, #4
+	blt	L_AES_GCMSIV_ctr_aarch64_256_done4
+	mov	V16.16B, V15.16B
+	mov	V16.S[0], w7
+	mov	V17.16B, V15.16B
+	add	w8, w7, #1
+	mov	V17.S[0], w8
+	mov	V18.16B, V15.16B
+	add	w8, w7, #2
+	mov	V18.S[0], w8
+	mov	V19.16B, V15.16B
+	add	w8, w7, #3
+	mov	V19.S[0], w8
+	add	w7, w7, #4
+	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x0], #0x40
+	aese	V16.16B, V0.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V0.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V0.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V0.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V1.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V1.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V1.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V1.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V2.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V2.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V2.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V2.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V3.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V3.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V3.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V3.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V4.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V4.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V4.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V4.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V5.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V5.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V5.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V5.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V6.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V6.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V6.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V6.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V7.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V7.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V7.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V7.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V8.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V8.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V8.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V8.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V9.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V9.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V9.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V9.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V10.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V10.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V10.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V10.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V11.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V11.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V11.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V11.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V12.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V12.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V12.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V12.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V13.16B
+	eor	V16.16B, V16.16B, V14.16B
+	aese	V17.16B, V13.16B
+	eor	V17.16B, V17.16B, V14.16B
+	aese	V18.16B, V13.16B
+	eor	V18.16B, V18.16B, V14.16B
+	aese	V19.16B, V13.16B
+	eor	V19.16B, V19.16B, V14.16B
+	eor	V20.16B, V20.16B, V16.16B
+	eor	V21.16B, V21.16B, V17.16B
+	eor	V22.16B, V22.16B, V18.16B
+	eor	V23.16B, V23.16B, V19.16B
+	st1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x1], #0x40
+	sub	x6, x6, #4
+	cmp	x6, #4
+	bge	L_AES_GCMSIV_ctr_aarch64_256_loop4
+L_AES_GCMSIV_ctr_aarch64_256_done4
+L_AES_GCMSIV_ctr_aarch64_256_loop1
+	cbz	x6, L_AES_GCMSIV_ctr_aarch64_256_done1
+	mov	V16.16B, V15.16B
+	mov	V16.S[0], w7
+	add	w7, w7, #1
+	ld1	{V20.16B}, [x0], #16
+	aese	V16.16B, V0.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V1.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V2.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V3.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V4.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V5.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V6.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V7.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V8.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V9.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V10.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V11.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V12.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V13.16B
+	eor	V16.16B, V16.16B, V14.16B
+	eor	V20.16B, V20.16B, V16.16B
+	st1	{V20.16B}, [x1], #16
+	sub	x6, x6, #1
+	b	L_AES_GCMSIV_ctr_aarch64_256_loop1
+L_AES_GCMSIV_ctr_aarch64_256_done1
+	ENDIF
+	b	L_AES_GCMSIV_ctr_aarch64_done
+	; AES_GCMSIV_CTR_128
+L_AES_GCMSIV_ctr_aarch64_start_128
+	IF :LNOT::DEF:NO_AES_128
+	ld1	{V8.2D, V9.2D}, [x3], #32
+	ld1	{V10.2D}, [x3]
+L_AES_GCMSIV_ctr_aarch64_128_loop4
+	cmp	x6, #4
+	blt	L_AES_GCMSIV_ctr_aarch64_128_done4
+	mov	V16.16B, V15.16B
+	mov	V16.S[0], w7
+	mov	V17.16B, V15.16B
+	add	w8, w7, #1
+	mov	V17.S[0], w8
+	mov	V18.16B, V15.16B
+	add	w8, w7, #2
+	mov	V18.S[0], w8
+	mov	V19.16B, V15.16B
+	add	w8, w7, #3
+	mov	V19.S[0], w8
+	add	w7, w7, #4
+	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x0], #0x40
+	aese	V16.16B, V0.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V0.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V0.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V0.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V1.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V1.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V1.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V1.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V2.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V2.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V2.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V2.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V3.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V3.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V3.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V3.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V4.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V4.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V4.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V4.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V5.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V5.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V5.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V5.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V6.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V6.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V6.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V6.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V7.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V7.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V7.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V7.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V8.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V8.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V8.16B
+	aesmc	V18.16B, V18.16B
+	aese	V19.16B, V8.16B
+	aesmc	V19.16B, V19.16B
+	aese	V16.16B, V9.16B
+	eor	V16.16B, V16.16B, V10.16B
+	aese	V17.16B, V9.16B
+	eor	V17.16B, V17.16B, V10.16B
+	aese	V18.16B, V9.16B
+	eor	V18.16B, V18.16B, V10.16B
+	aese	V19.16B, V9.16B
+	eor	V19.16B, V19.16B, V10.16B
+	eor	V20.16B, V20.16B, V16.16B
+	eor	V21.16B, V21.16B, V17.16B
+	eor	V22.16B, V22.16B, V18.16B
+	eor	V23.16B, V23.16B, V19.16B
+	st1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x1], #0x40
+	sub	x6, x6, #4
+	cmp	x6, #4
+	bge	L_AES_GCMSIV_ctr_aarch64_128_loop4
+L_AES_GCMSIV_ctr_aarch64_128_done4
+L_AES_GCMSIV_ctr_aarch64_128_loop1
+	cbz	x6, L_AES_GCMSIV_ctr_aarch64_128_done1
+	mov	V16.16B, V15.16B
+	mov	V16.S[0], w7
+	add	w7, w7, #1
+	ld1	{V20.16B}, [x0], #16
+	aese	V16.16B, V0.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V1.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V2.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V3.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V4.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V5.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V6.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V7.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V8.16B
+	aesmc	V16.16B, V16.16B
+	aese	V16.16B, V9.16B
+	eor	V16.16B, V16.16B, V10.16B
+	eor	V20.16B, V20.16B, V16.16B
+	st1	{V20.16B}, [x1], #16
+	sub	x6, x6, #1
+	b	L_AES_GCMSIV_ctr_aarch64_128_loop1
+L_AES_GCMSIV_ctr_aarch64_128_done1
+	ENDIF
+L_AES_GCMSIV_ctr_aarch64_done
+	mov	V15.S[0], w7
+	st1	{V15.2D}, [x5]
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	IF :LNOT::DEF:WOLFSSL_ARMASM_NO_NEON
+	IF :DEF:HAVE_AES_DECRYPT :LOR: :DEF:HAVE_AES_CBC :LOR: :DEF:HAVE_AESCCM :LOR: :DEF:HAVE_AESGCM :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	8
+L_AES_ARM64_NEON_te
+	DCB	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
+	DCB	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76
+	DCB	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0
+	DCB	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0
+	DCB	0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc
+	DCB	0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15
+	DCB	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a
+	DCB	0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75
+	DCB	0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0
+	DCB	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84
+	DCB	0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b
+	DCB	0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf
+	DCB	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85
+	DCB	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8
+	DCB	0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5
+	DCB	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2
+	DCB	0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17
+	DCB	0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73
+	DCB	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88
+	DCB	0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb
+	DCB	0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c
+	DCB	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79
+	DCB	0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9
+	DCB	0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08
+	DCB	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6
+	DCB	0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a
+	DCB	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e
+	DCB	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e
+	DCB	0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94
+	DCB	0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf
+	DCB	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68
+	DCB	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	8
+L_AES_ARM64_NEON_shift_rows_shuffle
+	DCB	0x0c, 0x09, 0x06, 0x03, 0x00, 0x0d, 0x0a, 0x07
+	DCB	0x04, 0x01, 0x0e, 0x0b, 0x08, 0x05, 0x02, 0x0f
+	ENDIF
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_invert_key_NEON
+AES_invert_key_NEON PROC
+	add	x3, x0, x1, lsl 4
+	mov	x2, x0
+	mov	w4, w1
+L_AES_invert_key_NEON_loop
+	ld1	{V0.2D}, [x2]
+	ld1	{V1.2D}, [x3]
+	st1	{V0.2D}, [x3]
+	st1	{V1.2D}, [x2], #16
+	subs	w4, w4, #2
+	sub	x3, x3, #16
+	bne	L_AES_invert_key_NEON_loop
+	movi	V2.16B, #27
+	add	x2, x0, #16
+	sub	w4, w1, #1
+L_AES_invert_key_NEON_mix_loop
+	ld1	{V0.2D}, [x2]
+	sshr	V5.16B, V0.16B, #7
+	ushr	V6.16B, V0.16B, #6
+	ushr	V3.16B, V0.16B, #5
+	and	V5.16B, V5.16B, V2.16B
+	pmul	V6.16B, V6.16B, V2.16B
+	pmul	V3.16B, V3.16B, V2.16B
+	shl	V4.16B, V0.16B, #1
+	eor	V5.16B, V5.16B, V4.16B
+	shl	V4.16B, V0.16B, #3
+	eor	V3.16B, V3.16B, V4.16B
+	shl	V4.16B, V0.16B, #2
+	eor	V6.16B, V6.16B, V4.16B
+	eor	V4.16B, V5.16B, V3.16B
+	eor	V3.16B, V3.16B, V0.16B
+	eor	V5.16B, V6.16B, V3.16B
+	eor	V6.16B, V6.16B, V4.16B
+	eor	V4.16B, V4.16B, V0.16B
+	shl	V0.4S, V4.4S, #8
+	rev32	V5.8H, V5.8H
+	sri	V0.4S, V4.4S, #24
+	eor	V0.16B, V0.16B, V6.16B
+	shl	V4.4S, V3.4S, #24
+	eor	V0.16B, V0.16B, V5.16B
+	sri	V4.4S, V3.4S, #8
+	eor	V0.16B, V0.16B, V4.16B
+	st1	{V0.2D}, [x2], #16
+	subs	w4, w4, #1
+	bne	L_AES_invert_key_NEON_mix_loop
+	ret
+	ENDP
+	ENDIF
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	8
+L_AES_ARM64_NEON_rcon
+	DCD	0x01000000, 0x02000000, 0x04000000, 0x08000000
+	DCD	0x10000000, 0x20000000, 0x40000000, 0x80000000
+	DCD	0x1b000000, 0x36000000
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_set_encrypt_key_NEON
+AES_set_encrypt_key_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	adrp	x4, L_AES_ARM64_NEON_rcon
+	add	x4, x4, L_AES_ARM64_NEON_rcon
+	adrp	x5, L_AES_ARM64_NEON_te
+	add	x5, x5, L_AES_ARM64_NEON_te
+	ld1	{V6.16B, V7.16B, V8.16B, V9.16B}, [x5], #0x40
+	ld1	{V10.16B, V11.16B, V12.16B, V13.16B}, [x5], #0x40
+	ld1	{V14.16B, V15.16B, V16.16B, V17.16B}, [x5], #0x40
+	ld1	{V18.16B, V19.16B, V20.16B, V21.16B}, [x5]
+	movi	V2.16B, #0x40
+	movi	V3.16B, #0x80
+	movi	V4.16B, #0xc0
+	movi	V5.16B, #27
+	eor	V26.16B, V26.16B, V26.16B
+	cmp	x1, #0x80
+	beq	L_AES_set_encrypt_key_NEON_start_128
+	cmp	x1, #0xc0
+	beq	L_AES_set_encrypt_key_NEON_start_192
+	ld1	{V0.16B}, [x0], #16
+	ld1	{V1.16B}, [x0]
+	rev32	V0.16B, V0.16B
+	rev32	V1.16B, V1.16B
+	st1	{V0.2D}, [x2], #16
+	st1	{V1.2D}, [x2], #16
+	mov	x3, #6
+L_AES_set_encrypt_key_NEON_loop_256
+	eor	V22.16B, V1.16B, V2.16B
+	eor	V23.16B, V1.16B, V3.16B
+	eor	V24.16B, V1.16B, V4.16B
+	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V1.16B
+	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
+	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
+	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
+	orr	V25.16B, V25.16B, V22.16B
+	orr	V23.16B, V23.16B, V24.16B
+	orr	V25.16B, V25.16B, V23.16B
+	ext8	V25.16B, V25.16B, V26.16B, #12
+	shl	V22.4S, V25.4S, #8
+	sri	V22.4S, V25.4S, #24
+	eor	V0.16B, V0.16B, V22.16B
+	ld1r	{V25.4S}, [x4], #4
+	dup	V22.4S, V0.S[0]
+	dup	V23.2S, V0.S[1]
+	dup	V24.2S, V0.S[2]
+	ext8	V22.16B, V26.16B, V22.16B, #12
+	ext8	V23.16B, V26.16B, V23.16B, #8
+	eor	V0.16B, V0.16B, V22.16B
+	ext8	V24.16B, V26.16B, V24.16B, #4
+	eor	V0.16B, V0.16B, V23.16B
+	eor	V0.16B, V0.16B, V24.16B
+	eor	V0.16B, V0.16B, V25.16B
+	st1	{V0.2D}, [x2], #16
+	eor	V22.16B, V0.16B, V2.16B
+	eor	V23.16B, V0.16B, V3.16B
+	eor	V24.16B, V0.16B, V4.16B
+	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V0.16B
+	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
+	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
+	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
+	orr	V25.16B, V25.16B, V22.16B
+	orr	V23.16B, V23.16B, V24.16B
+	orr	V25.16B, V25.16B, V23.16B
+	ext8	V25.16B, V25.16B, V26.16B, #12
+	eor	V1.16B, V1.16B, V25.16B
+	dup	V22.4S, V1.S[0]
+	dup	V23.2S, V1.S[1]
+	dup	V24.2S, V1.S[2]
+	ext8	V22.16B, V26.16B, V22.16B, #12
+	ext8	V23.16B, V26.16B, V23.16B, #8
+	eor	V1.16B, V1.16B, V22.16B
+	ext8	V24.16B, V26.16B, V24.16B, #4
+	eor	V1.16B, V1.16B, V23.16B
+	eor	V1.16B, V1.16B, V24.16B
+	st1	{V1.2D}, [x2], #16
+	subs	x3, x3, #1
+	bne	L_AES_set_encrypt_key_NEON_loop_256
+	eor	V22.16B, V1.16B, V2.16B
+	eor	V23.16B, V1.16B, V3.16B
+	eor	V24.16B, V1.16B, V4.16B
+	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V1.16B
+	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
+	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
+	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
+	orr	V25.16B, V25.16B, V22.16B
+	orr	V23.16B, V23.16B, V24.16B
+	orr	V25.16B, V25.16B, V23.16B
+	ext8	V25.16B, V25.16B, V26.16B, #12
+	shl	V22.4S, V25.4S, #8
+	sri	V22.4S, V25.4S, #24
+	eor	V0.16B, V0.16B, V22.16B
+	ld1r	{V25.4S}, [x4], #4
+	dup	V22.4S, V0.S[0]
+	dup	V23.2S, V0.S[1]
+	dup	V24.2S, V0.S[2]
+	ext8	V22.16B, V26.16B, V22.16B, #12
+	ext8	V23.16B, V26.16B, V23.16B, #8
+	eor	V0.16B, V0.16B, V22.16B
+	ext8	V24.16B, V26.16B, V24.16B, #4
+	eor	V0.16B, V0.16B, V23.16B
+	eor	V0.16B, V0.16B, V24.16B
+	eor	V0.16B, V0.16B, V25.16B
+	st1	{V0.2D}, [x2], #16
+	b	L_AES_set_encrypt_key_NEON_end
+L_AES_set_encrypt_key_NEON_start_192
+	ld1	{V0.16B}, [x0], #16
+	ld1	{V1.8B}, [x0]
+	rev32	V0.16B, V0.16B
+	rev32	V1.8B, V1.8B
+	st1	{V0.16B}, [x2], #16
+	st1	{V1.8B}, [x2], #8
+	ext8	V1.16B, V1.16B, V1.16B, #8
+	mov	x3, #7
+L_AES_set_encrypt_key_NEON_loop_192
+	eor	V22.16B, V1.16B, V2.16B
+	eor	V23.16B, V1.16B, V3.16B
+	eor	V24.16B, V1.16B, V4.16B
+	tbl	V25.16B, {V6.16B, V7.16B, V8.16B, V9.16B}, V1.16B
+	tbl	V22.16B, {V10.16B, V11.16B, V12.16B, V13.16B}, V22.16B
+	tbl	V23.16B, {V14.16B, V15.16B, V16.16B, V17.16B}, V23.16B
+	tbl	V24.16B, {V18.16B, V19.16B, V20.16B, V21.16B}, V24.16B
+	orr	V25.16B, V25.16B, V22.16B
+	orr	V23.16B, V23.16B, V24.16B
+	orr	V25.16B, V25.16B, V23.16B
+	ext8	V25.16B, V25.16B, V26.16B, #12
+	shl	V22.4S, V25.4S, #8
+	sri	V22.4S, V25.4S, #24
+	eor	V0.16B, V0.16B, V22.16B
+	ld1r	{V25.4S}, [x4], #4
+	dup	V22.4S, V0.S[0]
+	dup	V23.2S, V0.S[1]
+	dup	V24.2S, V0.S[2]
+	ext8	V22.16B, V26.16B, V22.16B, #12
+	ext8	V23.16B, V26.16B, V23.16B, #8
+	eor	V0.16B, V0.16B, V22.16B
+	ext8	V24.16B, V26.16B, V24.16B, #4
+	eor	V0.16B, V0.16B, V23.16B
+	eor	V0.16B, V0.16B, V24.16B
+	eor	V0.16B, V0.16B, V25.16B
+	st1	{V0.2D}, [x2], #16
+	mov	V23.16B, V26.16B
+	mov	V23.S[2], V0.S[3]
+	eor	V1.16B, V1.16B, V23.16B
 	mov	V23.16B, V26.16B
 	mov	V23.S[3], V1.S[2]
 	eor	V1.16B, V1.16B, V23.16B
@@ -49055,7 +50102,162 @@ L_AES_XTS_encrypt_NEON_loop_nr_partial
 	orr	V9.16B, V9.16B, V10.16B
 	orr	V4.16B, V4.16B, V9.16B
 	tbl	V4.16B, {V4.16B}, V3.16B
-	ld1	{V0.2D}, [x22], #16
+	ld1	{V0.2D}, [x22], #16
+	sshr	V10.16B, V4.16B, #7
+	shl	V9.16B, V4.16B, #1
+	and	V10.16B, V10.16B, V15.16B
+	eor	V10.16B, V10.16B, V9.16B
+	rev32	V8.8H, V4.8H
+	eor	V11.16B, V10.16B, V4.16B
+	eor	V10.16B, V10.16B, V8.16B
+	shl	V9.4S, V4.4S, #24
+	shl	V8.4S, V11.4S, #8
+	;   XOR in Key Schedule
+	eor	V10.16B, V10.16B, V0.16B
+	sri	V9.4S, V4.4S, #8
+	sri	V8.4S, V11.4S, #24
+	eor	V4.16B, V10.16B, V9.16B
+	eor	V4.16B, V4.16B, V8.16B
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
+	ld1	{V4.2D}, [x22], #16
+	sshr	V10.16B, V0.16B, #7
+	shl	V9.16B, V0.16B, #1
+	and	V10.16B, V10.16B, V15.16B
+	eor	V10.16B, V10.16B, V9.16B
+	rev32	V8.8H, V0.8H
+	eor	V11.16B, V10.16B, V0.16B
+	eor	V10.16B, V10.16B, V8.16B
+	shl	V9.4S, V0.4S, #24
+	shl	V8.4S, V11.4S, #8
+	;   XOR in Key Schedule
+	eor	V10.16B, V10.16B, V4.16B
+	sri	V9.4S, V0.4S, #8
+	sri	V8.4S, V11.4S, #24
+	eor	V0.16B, V10.16B, V9.16B
+	eor	V0.16B, V0.16B, V8.16B
+	subs	w21, w21, #2
+	bne	L_AES_XTS_encrypt_NEON_loop_nr_partial
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V0.16B, V13.16B
+	eor	V10.16B, V0.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	ld1	{V0.2D}, [x22], #16
+	sshr	V10.16B, V4.16B, #7
+	shl	V9.16B, V4.16B, #1
+	and	V10.16B, V10.16B, V15.16B
+	eor	V10.16B, V10.16B, V9.16B
+	rev32	V8.8H, V4.8H
+	eor	V11.16B, V10.16B, V4.16B
+	eor	V10.16B, V10.16B, V8.16B
+	shl	V9.4S, V4.4S, #24
+	shl	V8.4S, V11.4S, #8
+	;   XOR in Key Schedule
+	eor	V10.16B, V10.16B, V0.16B
+	sri	V9.4S, V4.4S, #8
+	sri	V8.4S, V11.4S, #24
+	eor	V4.16B, V10.16B, V9.16B
+	eor	V4.16B, V4.16B, V8.16B
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
+	ld1	{V4.2D}, [x22], #16
+	;   XOR in Key Schedule
+	eor	V0.16B, V0.16B, V4.16B
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V2.16B
+	st1	{V0.16B}, [x1]
+L_AES_XTS_encrypt_NEON_data_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldr	x22, [x29, #56]
+	ldp	D8, D9, [x29, #64]
+	ldp	D10, D11, [x29, #80]
+	ldp	D12, D13, [x29, #96]
+	ldp	D14, D15, [x29, #112]
+	ldp	x29, x30, [sp], #0x80
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_decrypt_NEON
+AES_XTS_decrypt_NEON PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	stp	x22, x23, [x29, #48]
+	stp	x24, x25, [x29, #64]
+	stp	D8, D9, [x29, #80]
+	stp	D10, D11, [x29, #96]
+	stp	D12, D13, [x29, #112]
+	stp	D14, D15, [x29, #128]
+	adrp	x20, L_AES_ARM64_NEON_te
+	add	x20, x20, L_AES_ARM64_NEON_te
+	adrp	x21, L_AES_ARM64_NEON_td
+	add	x21, x21, L_AES_ARM64_NEON_td
+	adrp	x22, L_AES_ARM64_NEON_shift_rows_shuffle
+	add	x22, x22, L_AES_ARM64_NEON_shift_rows_shuffle
+	adrp	x23, L_AES_ARM64_NEON_shift_rows_invshuffle
+	add	x23, x23, L_AES_ARM64_NEON_shift_rows_invshuffle
+	ld1	{V16.16B, V17.16B, V18.16B, V19.16B}, [x20], #0x40
+	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x20], #0x40
+	ld1	{V24.16B, V25.16B, V26.16B, V27.16B}, [x20], #0x40
+	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x20]
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	movi	V15.16B, #27
+	ld1	{V3.2D}, [x22]
+	mov	x17, #0x87
+	ands	w19, w2, #15
+	cset	w16, ne
+	sub	w2, w2, w16, lsl 4
+	ld1	{V2.2D}, [x3]
+	ld1	{V4.2D}, [x5]
+	rev32	V2.16B, V2.16B
+	add	x25, x5, #16
+	; Round: 0 - XOR in key schedule
+	eor	V2.16B, V2.16B, V4.16B
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_tweak
+	eor	V8.16B, V2.16B, V12.16B
+	eor	V9.16B, V2.16B, V13.16B
+	eor	V10.16B, V2.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	ld1	{V2.2D}, [x25], #16
 	sshr	V10.16B, V4.16B, #7
 	shl	V9.16B, V4.16B, #1
 	and	V10.16B, V10.16B, V15.16B
@@ -49066,7 +50268,7 @@ L_AES_XTS_encrypt_NEON_loop_nr_partial
 	shl	V9.4S, V4.4S, #24
 	shl	V8.4S, V11.4S, #8
 	;   XOR in Key Schedule
-	eor	V10.16B, V10.16B, V0.16B
+	eor	V10.16B, V10.16B, V2.16B
 	sri	V9.4S, V4.4S, #8
 	sri	V8.4S, V11.4S, #24
 	eor	V4.16B, V10.16B, V9.16B
@@ -49074,36 +50276,36 @@ L_AES_XTS_encrypt_NEON_loop_nr_partial
 	eor	V8.16B, V4.16B, V12.16B
 	eor	V9.16B, V4.16B, V13.16B
 	eor	V10.16B, V4.16B, V14.16B
-	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V0.16B, V0.16B, V8.16B
+	orr	V2.16B, V2.16B, V8.16B
 	orr	V9.16B, V9.16B, V10.16B
-	orr	V0.16B, V0.16B, V9.16B
-	tbl	V0.16B, {V0.16B}, V3.16B
-	ld1	{V4.2D}, [x22], #16
-	sshr	V10.16B, V0.16B, #7
-	shl	V9.16B, V0.16B, #1
+	orr	V2.16B, V2.16B, V9.16B
+	tbl	V2.16B, {V2.16B}, V3.16B
+	ld1	{V4.2D}, [x25], #16
+	sshr	V10.16B, V2.16B, #7
+	shl	V9.16B, V2.16B, #1
 	and	V10.16B, V10.16B, V15.16B
 	eor	V10.16B, V10.16B, V9.16B
-	rev32	V8.8H, V0.8H
-	eor	V11.16B, V10.16B, V0.16B
+	rev32	V8.8H, V2.8H
+	eor	V11.16B, V10.16B, V2.16B
 	eor	V10.16B, V10.16B, V8.16B
-	shl	V9.4S, V0.4S, #24
+	shl	V9.4S, V2.4S, #24
 	shl	V8.4S, V11.4S, #8
 	;   XOR in Key Schedule
 	eor	V10.16B, V10.16B, V4.16B
-	sri	V9.4S, V0.4S, #8
+	sri	V9.4S, V2.4S, #8
 	sri	V8.4S, V11.4S, #24
-	eor	V0.16B, V10.16B, V9.16B
-	eor	V0.16B, V0.16B, V8.16B
-	subs	w21, w21, #2
-	bne	L_AES_XTS_encrypt_NEON_loop_nr_partial
-	eor	V8.16B, V0.16B, V12.16B
-	eor	V9.16B, V0.16B, V13.16B
-	eor	V10.16B, V0.16B, V14.16B
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	eor	V2.16B, V10.16B, V9.16B
+	eor	V2.16B, V2.16B, V8.16B
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_tweak
+	eor	V8.16B, V2.16B, V12.16B
+	eor	V9.16B, V2.16B, V13.16B
+	eor	V10.16B, V2.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
@@ -49111,7 +50313,7 @@ L_AES_XTS_encrypt_NEON_loop_nr_partial
 	orr	V9.16B, V9.16B, V10.16B
 	orr	V4.16B, V4.16B, V9.16B
 	tbl	V4.16B, {V4.16B}, V3.16B
-	ld1	{V0.2D}, [x22], #16
+	ld1	{V2.2D}, [x25], #16
 	sshr	V10.16B, V4.16B, #7
 	shl	V9.16B, V4.16B, #1
 	and	V10.16B, V10.16B, V15.16B
@@ -49122,203 +50324,602 @@ L_AES_XTS_encrypt_NEON_loop_nr_partial
 	shl	V9.4S, V4.4S, #24
 	shl	V8.4S, V11.4S, #8
 	;   XOR in Key Schedule
-	eor	V10.16B, V10.16B, V0.16B
-	sri	V9.4S, V4.4S, #8
-	sri	V8.4S, V11.4S, #24
-	eor	V4.16B, V10.16B, V9.16B
-	eor	V4.16B, V4.16B, V8.16B
-	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V4.16B, V13.16B
-	eor	V10.16B, V4.16B, V14.16B
+	eor	V10.16B, V10.16B, V2.16B
+	sri	V9.4S, V4.4S, #8
+	sri	V8.4S, V11.4S, #24
+	eor	V4.16B, V10.16B, V9.16B
+	eor	V4.16B, V4.16B, V8.16B
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V2.16B, V2.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V2.16B, V2.16B, V9.16B
+	tbl	V2.16B, {V2.16B}, V3.16B
+	ld1	{V4.2D}, [x25], #16
+	;   XOR in Key Schedule
+	eor	V2.16B, V2.16B, V4.16B
+	rev32	V2.16B, V2.16B
+	mov	x8, V2.D[0]
+	mov	x9, V2.D[1]
+	ld1	{V16.16B, V17.16B, V18.16B, V19.16B}, [x21], #0x40
+	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x21], #0x40
+	ld1	{V24.16B, V25.16B, V26.16B, V27.16B}, [x21], #0x40
+	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
+	ld1	{V3.2D}, [x23]
+	cmp	w2, #0x40
+	blt	L_AES_XTS_decrypt_NEON_start_2
+L_AES_XTS_decrypt_NEON_loop_4
+	mov	x25, x4
+	ld1	{V0.16B, V1.16B, V2.16B, V3.16B}, [x0], #0x40
+	ld1	{V4.16B}, [x25], #16
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	and	x16, x17, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x16, x10, lsl 1
+	and	x16, x17, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x16, x12, lsl 1
+	mov	V8.D[0], x8
+	mov	V8.D[1], x9
+	mov	V9.D[0], x10
+	mov	V9.D[1], x11
+	mov	V10.D[0], x12
+	mov	V10.D[1], x13
+	mov	V11.D[0], x14
+	mov	V11.D[1], x15
+	eor	V0.16B, V0.16B, V8.16B
+	eor	V1.16B, V1.16B, V9.16B
+	eor	V2.16B, V2.16B, V10.16B
+	eor	V3.16B, V3.16B, V11.16B
+	rev32	V0.16B, V0.16B
+	rev32	V1.16B, V1.16B
+	rev32	V2.16B, V2.16B
+	rev32	V3.16B, V3.16B
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V4.16B
+	eor	V2.16B, V2.16B, V4.16B
+	eor	V3.16B, V3.16B, V4.16B
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_4
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	tbl	V6.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
+	tbl	V7.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V3.16B
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V1.16B, V12.16B
+	eor	V10.16B, V2.16B, V12.16B
+	eor	V11.16B, V3.16B, V12.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	eor	V8.16B, V0.16B, V13.16B
+	eor	V9.16B, V1.16B, V13.16B
+	eor	V10.16B, V2.16B, V13.16B
+	eor	V11.16B, V3.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	eor	V8.16B, V0.16B, V14.16B
+	eor	V9.16B, V1.16B, V14.16B
+	eor	V10.16B, V2.16B, V14.16B
+	eor	V11.16B, V3.16B, V14.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	ld1	{V0.16B}, [x23]
+	tbl	V4.16B, {V4.16B}, V0.16B
+	tbl	V5.16B, {V5.16B}, V0.16B
+	tbl	V6.16B, {V6.16B}, V0.16B
+	tbl	V7.16B, {V7.16B}, V0.16B
+	movi	V28.16B, #27
+	sshr	V8.16B, V4.16B, #7
+	sshr	V9.16B, V5.16B, #7
+	sshr	V10.16B, V6.16B, #7
+	sshr	V11.16B, V7.16B, #7
+	shl	V12.16B, V4.16B, #1
+	shl	V13.16B, V5.16B, #1
+	shl	V14.16B, V6.16B, #1
+	shl	V15.16B, V7.16B, #1
+	and	V8.16B, V8.16B, V28.16B
+	and	V9.16B, V9.16B, V28.16B
+	and	V10.16B, V10.16B, V28.16B
+	and	V11.16B, V11.16B, V28.16B
+	eor	V8.16B, V8.16B, V12.16B
+	eor	V9.16B, V9.16B, V13.16B
+	eor	V10.16B, V10.16B, V14.16B
+	eor	V11.16B, V11.16B, V15.16B
+	ushr	V12.16B, V4.16B, #6
+	ushr	V13.16B, V5.16B, #6
+	ushr	V14.16B, V6.16B, #6
+	ushr	V15.16B, V7.16B, #6
+	shl	V0.16B, V4.16B, #2
+	shl	V1.16B, V5.16B, #2
+	shl	V2.16B, V6.16B, #2
+	shl	V3.16B, V7.16B, #2
+	pmul	V12.16B, V12.16B, V28.16B
+	pmul	V13.16B, V13.16B, V28.16B
+	pmul	V14.16B, V14.16B, V28.16B
+	pmul	V15.16B, V15.16B, V28.16B
+	eor	V12.16B, V12.16B, V0.16B
+	eor	V13.16B, V13.16B, V1.16B
+	eor	V14.16B, V14.16B, V2.16B
+	eor	V15.16B, V15.16B, V3.16B
+	ushr	V0.16B, V4.16B, #5
+	ushr	V1.16B, V5.16B, #5
+	ushr	V2.16B, V6.16B, #5
+	ushr	V3.16B, V7.16B, #5
+	pmul	V0.16B, V0.16B, V28.16B
+	pmul	V1.16B, V1.16B, V28.16B
+	pmul	V2.16B, V2.16B, V28.16B
+	pmul	V3.16B, V3.16B, V28.16B
+	shl	V28.16B, V4.16B, #3
+	shl	V29.16B, V5.16B, #3
+	shl	V30.16B, V6.16B, #3
+	shl	V31.16B, V7.16B, #3
+	eor	V0.16B, V0.16B, V28.16B
+	eor	V1.16B, V1.16B, V29.16B
+	eor	V2.16B, V2.16B, V30.16B
+	eor	V3.16B, V3.16B, V31.16B
+	eor	V28.16B, V8.16B, V0.16B
+	eor	V29.16B, V9.16B, V1.16B
+	eor	V30.16B, V10.16B, V2.16B
+	eor	V31.16B, V11.16B, V3.16B
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V5.16B
+	eor	V2.16B, V2.16B, V6.16B
+	eor	V3.16B, V3.16B, V7.16B
+	eor	V8.16B, V12.16B, V0.16B
+	eor	V9.16B, V13.16B, V1.16B
+	eor	V10.16B, V14.16B, V2.16B
+	eor	V11.16B, V15.16B, V3.16B
+	eor	V12.16B, V12.16B, V28.16B
+	eor	V13.16B, V13.16B, V29.16B
+	eor	V14.16B, V14.16B, V30.16B
+	eor	V15.16B, V15.16B, V31.16B
+	eor	V28.16B, V28.16B, V4.16B
+	eor	V29.16B, V29.16B, V5.16B
+	eor	V30.16B, V30.16B, V6.16B
+	eor	V31.16B, V31.16B, V7.16B
+	shl	V4.4S, V28.4S, #8
+	shl	V5.4S, V29.4S, #8
+	shl	V6.4S, V30.4S, #8
+	shl	V7.4S, V31.4S, #8
+	rev32	V8.8H, V8.8H
+	rev32	V9.8H, V9.8H
+	rev32	V10.8H, V10.8H
+	rev32	V11.8H, V11.8H
+	sri	V4.4S, V28.4S, #24
+	sri	V5.4S, V29.4S, #24
+	sri	V6.4S, V30.4S, #24
+	sri	V7.4S, V31.4S, #24
+	eor	V4.16B, V4.16B, V12.16B
+	eor	V5.16B, V5.16B, V13.16B
+	eor	V6.16B, V6.16B, V14.16B
+	eor	V7.16B, V7.16B, V15.16B
+	shl	V28.4S, V0.4S, #24
+	shl	V29.4S, V1.4S, #24
+	shl	V30.4S, V2.4S, #24
+	shl	V31.4S, V3.4S, #24
+	eor	V4.16B, V4.16B, V8.16B
+	eor	V5.16B, V5.16B, V9.16B
+	eor	V6.16B, V6.16B, V10.16B
+	eor	V7.16B, V7.16B, V11.16B
+	sri	V28.4S, V0.4S, #8
+	sri	V29.4S, V1.4S, #8
+	sri	V30.4S, V2.4S, #8
+	sri	V31.4S, V3.4S, #8
+	eor	V4.16B, V4.16B, V28.16B
+	eor	V5.16B, V5.16B, V29.16B
+	eor	V6.16B, V6.16B, V30.16B
+	eor	V7.16B, V7.16B, V31.16B
+	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
+	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x25], #16
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V0.16B
+	eor	V6.16B, V6.16B, V0.16B
+	eor	V7.16B, V7.16B, V0.16B
+	; Round Done
 	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
-	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V0.16B, V0.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V0.16B, V0.16B, V9.16B
-	tbl	V0.16B, {V0.16B}, V3.16B
-	ld1	{V4.2D}, [x22], #16
-	;   XOR in Key Schedule
-	eor	V0.16B, V0.16B, V4.16B
-	rev32	V0.16B, V0.16B
-	eor	V0.16B, V0.16B, V2.16B
-	st1	{V0.16B}, [x1]
-L_AES_XTS_encrypt_NEON_data_done
-	ldp	x17, x19, [x29, #24]
-	ldp	x20, x21, [x29, #40]
-	ldr	x22, [x29, #56]
-	ldp	D8, D9, [x29, #64]
-	ldp	D10, D11, [x29, #80]
-	ldp	D12, D13, [x29, #96]
-	ldp	D14, D15, [x29, #112]
-	ldp	x29, x30, [sp], #0x80
-	ret
-	ENDP
-	IF :DEF:HAVE_AES_DECRYPT
-	AREA	|.text|, CODE, READONLY
-	ALIGN	4
-	EXPORT	AES_XTS_decrypt_NEON
-AES_XTS_decrypt_NEON PROC
-	stp	x29, x30, [sp, #-144]!
-	add	x29, sp, #0
-	stp	x17, x19, [x29, #16]
-	stp	x20, x21, [x29, #32]
-	stp	x22, x23, [x29, #48]
-	stp	x24, x25, [x29, #64]
-	stp	D8, D9, [x29, #80]
-	stp	D10, D11, [x29, #96]
-	stp	D12, D13, [x29, #112]
-	stp	D14, D15, [x29, #128]
-	adrp	x20, L_AES_ARM64_NEON_te
-	add	x20, x20, L_AES_ARM64_NEON_te
-	adrp	x21, L_AES_ARM64_NEON_td
-	add	x21, x21, L_AES_ARM64_NEON_td
-	adrp	x22, L_AES_ARM64_NEON_shift_rows_shuffle
-	add	x22, x22, L_AES_ARM64_NEON_shift_rows_shuffle
-	adrp	x23, L_AES_ARM64_NEON_shift_rows_invshuffle
-	add	x23, x23, L_AES_ARM64_NEON_shift_rows_invshuffle
-	ld1	{V16.16B, V17.16B, V18.16B, V19.16B}, [x20], #0x40
-	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x20], #0x40
-	ld1	{V24.16B, V25.16B, V26.16B, V27.16B}, [x20], #0x40
-	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x20]
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V6.16B
+	tbl	V3.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V7.16B
 	movi	V12.16B, #0x40
 	movi	V13.16B, #0x80
 	movi	V14.16B, #0xc0
-	movi	V15.16B, #27
-	ld1	{V3.2D}, [x22]
-	mov	x17, #0x87
-	ands	w19, w2, #15
-	cset	w16, ne
-	sub	w2, w2, w16, lsl 4
-	ld1	{V2.2D}, [x3]
-	ld1	{V4.2D}, [x5]
-	rev32	V2.16B, V2.16B
-	add	x25, x5, #16
-	; Round: 0 - XOR in key schedule
-	eor	V2.16B, V2.16B, V4.16B
-	sub	w24, w7, #2
-L_AES_XTS_decrypt_NEON_loop_nr_tweak
-	eor	V8.16B, V2.16B, V12.16B
-	eor	V9.16B, V2.16B, V13.16B
-	eor	V10.16B, V2.16B, V14.16B
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
-	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V4.16B, V4.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V4.16B, V4.16B, V9.16B
-	tbl	V4.16B, {V4.16B}, V3.16B
-	ld1	{V2.2D}, [x25], #16
-	sshr	V10.16B, V4.16B, #7
-	shl	V9.16B, V4.16B, #1
-	and	V10.16B, V10.16B, V15.16B
-	eor	V10.16B, V10.16B, V9.16B
-	rev32	V8.8H, V4.8H
-	eor	V11.16B, V10.16B, V4.16B
-	eor	V10.16B, V10.16B, V8.16B
-	shl	V9.4S, V4.4S, #24
-	shl	V8.4S, V11.4S, #8
-	;   XOR in Key Schedule
-	eor	V10.16B, V10.16B, V2.16B
-	sri	V9.4S, V4.4S, #8
-	sri	V8.4S, V11.4S, #24
-	eor	V4.16B, V10.16B, V9.16B
-	eor	V4.16B, V4.16B, V8.16B
 	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V4.16B, V13.16B
-	eor	V10.16B, V4.16B, V14.16B
-	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	eor	V9.16B, V5.16B, V12.16B
+	eor	V10.16B, V6.16B, V12.16B
+	eor	V11.16B, V7.16B, V12.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	eor	V8.16B, V4.16B, V13.16B
+	eor	V9.16B, V5.16B, V13.16B
+	eor	V10.16B, V6.16B, V13.16B
+	eor	V11.16B, V7.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	eor	V8.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V14.16B
+	eor	V10.16B, V6.16B, V14.16B
+	eor	V11.16B, V7.16B, V14.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V2.16B, V2.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V2.16B, V2.16B, V9.16B
-	tbl	V2.16B, {V2.16B}, V3.16B
-	ld1	{V4.2D}, [x25], #16
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	ld1	{V4.16B}, [x23]
+	tbl	V0.16B, {V0.16B}, V4.16B
+	tbl	V1.16B, {V1.16B}, V4.16B
+	tbl	V2.16B, {V2.16B}, V4.16B
+	tbl	V3.16B, {V3.16B}, V4.16B
+	movi	V28.16B, #27
+	sshr	V8.16B, V0.16B, #7
+	sshr	V9.16B, V1.16B, #7
 	sshr	V10.16B, V2.16B, #7
-	shl	V9.16B, V2.16B, #1
-	and	V10.16B, V10.16B, V15.16B
-	eor	V10.16B, V10.16B, V9.16B
-	rev32	V8.8H, V2.8H
-	eor	V11.16B, V10.16B, V2.16B
-	eor	V10.16B, V10.16B, V8.16B
-	shl	V9.4S, V2.4S, #24
-	shl	V8.4S, V11.4S, #8
+	sshr	V11.16B, V3.16B, #7
+	shl	V12.16B, V0.16B, #1
+	shl	V13.16B, V1.16B, #1
+	shl	V14.16B, V2.16B, #1
+	shl	V15.16B, V3.16B, #1
+	and	V8.16B, V8.16B, V28.16B
+	and	V9.16B, V9.16B, V28.16B
+	and	V10.16B, V10.16B, V28.16B
+	and	V11.16B, V11.16B, V28.16B
+	eor	V8.16B, V8.16B, V12.16B
+	eor	V9.16B, V9.16B, V13.16B
+	eor	V10.16B, V10.16B, V14.16B
+	eor	V11.16B, V11.16B, V15.16B
+	ushr	V12.16B, V0.16B, #6
+	ushr	V13.16B, V1.16B, #6
+	ushr	V14.16B, V2.16B, #6
+	ushr	V15.16B, V3.16B, #6
+	shl	V4.16B, V0.16B, #2
+	shl	V5.16B, V1.16B, #2
+	shl	V6.16B, V2.16B, #2
+	shl	V7.16B, V3.16B, #2
+	pmul	V12.16B, V12.16B, V28.16B
+	pmul	V13.16B, V13.16B, V28.16B
+	pmul	V14.16B, V14.16B, V28.16B
+	pmul	V15.16B, V15.16B, V28.16B
+	eor	V12.16B, V12.16B, V4.16B
+	eor	V13.16B, V13.16B, V5.16B
+	eor	V14.16B, V14.16B, V6.16B
+	eor	V15.16B, V15.16B, V7.16B
+	ushr	V4.16B, V0.16B, #5
+	ushr	V5.16B, V1.16B, #5
+	ushr	V6.16B, V2.16B, #5
+	ushr	V7.16B, V3.16B, #5
+	pmul	V4.16B, V4.16B, V28.16B
+	pmul	V5.16B, V5.16B, V28.16B
+	pmul	V6.16B, V6.16B, V28.16B
+	pmul	V7.16B, V7.16B, V28.16B
+	shl	V28.16B, V0.16B, #3
+	shl	V29.16B, V1.16B, #3
+	shl	V30.16B, V2.16B, #3
+	shl	V31.16B, V3.16B, #3
+	eor	V4.16B, V4.16B, V28.16B
+	eor	V5.16B, V5.16B, V29.16B
+	eor	V6.16B, V6.16B, V30.16B
+	eor	V7.16B, V7.16B, V31.16B
+	eor	V28.16B, V8.16B, V4.16B
+	eor	V29.16B, V9.16B, V5.16B
+	eor	V30.16B, V10.16B, V6.16B
+	eor	V31.16B, V11.16B, V7.16B
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V1.16B
+	eor	V6.16B, V6.16B, V2.16B
+	eor	V7.16B, V7.16B, V3.16B
+	eor	V8.16B, V12.16B, V4.16B
+	eor	V9.16B, V13.16B, V5.16B
+	eor	V10.16B, V14.16B, V6.16B
+	eor	V11.16B, V15.16B, V7.16B
+	eor	V12.16B, V12.16B, V28.16B
+	eor	V13.16B, V13.16B, V29.16B
+	eor	V14.16B, V14.16B, V30.16B
+	eor	V15.16B, V15.16B, V31.16B
+	eor	V28.16B, V28.16B, V0.16B
+	eor	V29.16B, V29.16B, V1.16B
+	eor	V30.16B, V30.16B, V2.16B
+	eor	V31.16B, V31.16B, V3.16B
+	shl	V0.4S, V28.4S, #8
+	shl	V1.4S, V29.4S, #8
+	shl	V2.4S, V30.4S, #8
+	shl	V3.4S, V31.4S, #8
+	rev32	V8.8H, V8.8H
+	rev32	V9.8H, V9.8H
+	rev32	V10.8H, V10.8H
+	rev32	V11.8H, V11.8H
+	sri	V0.4S, V28.4S, #24
+	sri	V1.4S, V29.4S, #24
+	sri	V2.4S, V30.4S, #24
+	sri	V3.4S, V31.4S, #24
+	eor	V0.16B, V0.16B, V12.16B
+	eor	V1.16B, V1.16B, V13.16B
+	eor	V2.16B, V2.16B, V14.16B
+	eor	V3.16B, V3.16B, V15.16B
+	shl	V28.4S, V4.4S, #24
+	shl	V29.4S, V5.4S, #24
+	shl	V30.4S, V6.4S, #24
+	shl	V31.4S, V7.4S, #24
+	eor	V0.16B, V0.16B, V8.16B
+	eor	V1.16B, V1.16B, V9.16B
+	eor	V2.16B, V2.16B, V10.16B
+	eor	V3.16B, V3.16B, V11.16B
+	sri	V28.4S, V4.4S, #8
+	sri	V29.4S, V5.4S, #8
+	sri	V30.4S, V6.4S, #8
+	sri	V31.4S, V7.4S, #8
+	eor	V0.16B, V0.16B, V28.16B
+	eor	V1.16B, V1.16B, V29.16B
+	eor	V2.16B, V2.16B, V30.16B
+	eor	V3.16B, V3.16B, V31.16B
+	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
 	;   XOR in Key Schedule
-	eor	V10.16B, V10.16B, V4.16B
-	sri	V9.4S, V2.4S, #8
-	sri	V8.4S, V11.4S, #24
-	eor	V2.16B, V10.16B, V9.16B
-	eor	V2.16B, V2.16B, V8.16B
+	ld1	{V4.2D}, [x25], #16
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V4.16B
+	eor	V2.16B, V2.16B, V4.16B
+	eor	V3.16B, V3.16B, V4.16B
+	; Round Done
 	subs	w24, w24, #2
-	bne	L_AES_XTS_decrypt_NEON_loop_nr_tweak
-	eor	V8.16B, V2.16B, V12.16B
-	eor	V9.16B, V2.16B, V13.16B
-	eor	V10.16B, V2.16B, V14.16B
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_4
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	tbl	V6.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
+	tbl	V7.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V3.16B
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V1.16B, V12.16B
+	eor	V10.16B, V2.16B, V12.16B
+	eor	V11.16B, V3.16B, V12.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	eor	V8.16B, V0.16B, V13.16B
+	eor	V9.16B, V1.16B, V13.16B
+	eor	V10.16B, V2.16B, V13.16B
+	eor	V11.16B, V3.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	eor	V8.16B, V0.16B, V14.16B
+	eor	V9.16B, V1.16B, V14.16B
+	eor	V10.16B, V2.16B, V14.16B
+	eor	V11.16B, V3.16B, V14.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V4.16B, V4.16B, V9.16B
-	tbl	V4.16B, {V4.16B}, V3.16B
-	ld1	{V2.2D}, [x25], #16
-	sshr	V10.16B, V4.16B, #7
-	shl	V9.16B, V4.16B, #1
-	and	V10.16B, V10.16B, V15.16B
-	eor	V10.16B, V10.16B, V9.16B
-	rev32	V8.8H, V4.8H
-	eor	V11.16B, V10.16B, V4.16B
-	eor	V10.16B, V10.16B, V8.16B
-	shl	V9.4S, V4.4S, #24
-	shl	V8.4S, V11.4S, #8
-	;   XOR in Key Schedule
-	eor	V10.16B, V10.16B, V2.16B
-	sri	V9.4S, V4.4S, #8
-	sri	V8.4S, V11.4S, #24
-	eor	V4.16B, V10.16B, V9.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	ld1	{V0.16B}, [x23]
+	tbl	V4.16B, {V4.16B}, V0.16B
+	tbl	V5.16B, {V5.16B}, V0.16B
+	tbl	V6.16B, {V6.16B}, V0.16B
+	tbl	V7.16B, {V7.16B}, V0.16B
+	movi	V28.16B, #27
+	sshr	V8.16B, V4.16B, #7
+	sshr	V9.16B, V5.16B, #7
+	sshr	V10.16B, V6.16B, #7
+	sshr	V11.16B, V7.16B, #7
+	shl	V12.16B, V4.16B, #1
+	shl	V13.16B, V5.16B, #1
+	shl	V14.16B, V6.16B, #1
+	shl	V15.16B, V7.16B, #1
+	and	V8.16B, V8.16B, V28.16B
+	and	V9.16B, V9.16B, V28.16B
+	and	V10.16B, V10.16B, V28.16B
+	and	V11.16B, V11.16B, V28.16B
+	eor	V8.16B, V8.16B, V12.16B
+	eor	V9.16B, V9.16B, V13.16B
+	eor	V10.16B, V10.16B, V14.16B
+	eor	V11.16B, V11.16B, V15.16B
+	ushr	V12.16B, V4.16B, #6
+	ushr	V13.16B, V5.16B, #6
+	ushr	V14.16B, V6.16B, #6
+	ushr	V15.16B, V7.16B, #6
+	shl	V0.16B, V4.16B, #2
+	shl	V1.16B, V5.16B, #2
+	shl	V2.16B, V6.16B, #2
+	shl	V3.16B, V7.16B, #2
+	pmul	V12.16B, V12.16B, V28.16B
+	pmul	V13.16B, V13.16B, V28.16B
+	pmul	V14.16B, V14.16B, V28.16B
+	pmul	V15.16B, V15.16B, V28.16B
+	eor	V12.16B, V12.16B, V0.16B
+	eor	V13.16B, V13.16B, V1.16B
+	eor	V14.16B, V14.16B, V2.16B
+	eor	V15.16B, V15.16B, V3.16B
+	ushr	V0.16B, V4.16B, #5
+	ushr	V1.16B, V5.16B, #5
+	ushr	V2.16B, V6.16B, #5
+	ushr	V3.16B, V7.16B, #5
+	pmul	V0.16B, V0.16B, V28.16B
+	pmul	V1.16B, V1.16B, V28.16B
+	pmul	V2.16B, V2.16B, V28.16B
+	pmul	V3.16B, V3.16B, V28.16B
+	shl	V28.16B, V4.16B, #3
+	shl	V29.16B, V5.16B, #3
+	shl	V30.16B, V6.16B, #3
+	shl	V31.16B, V7.16B, #3
+	eor	V0.16B, V0.16B, V28.16B
+	eor	V1.16B, V1.16B, V29.16B
+	eor	V2.16B, V2.16B, V30.16B
+	eor	V3.16B, V3.16B, V31.16B
+	eor	V28.16B, V8.16B, V0.16B
+	eor	V29.16B, V9.16B, V1.16B
+	eor	V30.16B, V10.16B, V2.16B
+	eor	V31.16B, V11.16B, V3.16B
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V5.16B
+	eor	V2.16B, V2.16B, V6.16B
+	eor	V3.16B, V3.16B, V7.16B
+	eor	V8.16B, V12.16B, V0.16B
+	eor	V9.16B, V13.16B, V1.16B
+	eor	V10.16B, V14.16B, V2.16B
+	eor	V11.16B, V15.16B, V3.16B
+	eor	V12.16B, V12.16B, V28.16B
+	eor	V13.16B, V13.16B, V29.16B
+	eor	V14.16B, V14.16B, V30.16B
+	eor	V15.16B, V15.16B, V31.16B
+	eor	V28.16B, V28.16B, V4.16B
+	eor	V29.16B, V29.16B, V5.16B
+	eor	V30.16B, V30.16B, V6.16B
+	eor	V31.16B, V31.16B, V7.16B
+	shl	V4.4S, V28.4S, #8
+	shl	V5.4S, V29.4S, #8
+	shl	V6.4S, V30.4S, #8
+	shl	V7.4S, V31.4S, #8
+	rev32	V8.8H, V8.8H
+	rev32	V9.8H, V9.8H
+	rev32	V10.8H, V10.8H
+	rev32	V11.8H, V11.8H
+	sri	V4.4S, V28.4S, #24
+	sri	V5.4S, V29.4S, #24
+	sri	V6.4S, V30.4S, #24
+	sri	V7.4S, V31.4S, #24
+	eor	V4.16B, V4.16B, V12.16B
+	eor	V5.16B, V5.16B, V13.16B
+	eor	V6.16B, V6.16B, V14.16B
+	eor	V7.16B, V7.16B, V15.16B
+	shl	V28.4S, V0.4S, #24
+	shl	V29.4S, V1.4S, #24
+	shl	V30.4S, V2.4S, #24
+	shl	V31.4S, V3.4S, #24
 	eor	V4.16B, V4.16B, V8.16B
+	eor	V5.16B, V5.16B, V9.16B
+	eor	V6.16B, V6.16B, V10.16B
+	eor	V7.16B, V7.16B, V11.16B
+	sri	V28.4S, V0.4S, #8
+	sri	V29.4S, V1.4S, #8
+	sri	V30.4S, V2.4S, #8
+	sri	V31.4S, V3.4S, #8
+	eor	V4.16B, V4.16B, V28.16B
+	eor	V5.16B, V5.16B, V29.16B
+	eor	V6.16B, V6.16B, V30.16B
+	eor	V7.16B, V7.16B, V31.16B
+	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
+	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x25], #16
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V0.16B
+	eor	V6.16B, V6.16B, V0.16B
+	eor	V7.16B, V7.16B, V0.16B
+	; Round Done
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V6.16B
+	tbl	V3.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V7.16B
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
 	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V4.16B, V13.16B
-	eor	V10.16B, V4.16B, V14.16B
-	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	eor	V9.16B, V5.16B, V12.16B
+	eor	V10.16B, V6.16B, V12.16B
+	eor	V11.16B, V7.16B, V12.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	eor	V8.16B, V4.16B, V13.16B
+	eor	V9.16B, V5.16B, V13.16B
+	eor	V10.16B, V6.16B, V13.16B
+	eor	V11.16B, V7.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	eor	V8.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V14.16B
+	eor	V10.16B, V6.16B, V14.16B
+	eor	V11.16B, V7.16B, V14.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V2.16B, V2.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V2.16B, V2.16B, V9.16B
-	tbl	V2.16B, {V2.16B}, V3.16B
-	ld1	{V4.2D}, [x25], #16
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	ld1	{V4.16B}, [x23]
+	tbl	V0.16B, {V0.16B}, V4.16B
+	tbl	V1.16B, {V1.16B}, V4.16B
+	tbl	V2.16B, {V2.16B}, V4.16B
+	tbl	V3.16B, {V3.16B}, V4.16B
 	;   XOR in Key Schedule
+	ld1	{V4.2D}, [x25], #16
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V4.16B
 	eor	V2.16B, V2.16B, V4.16B
+	eor	V3.16B, V3.16B, V4.16B
+	; Round Done
+	rev32	V0.16B, V0.16B
+	rev32	V1.16B, V1.16B
 	rev32	V2.16B, V2.16B
-	mov	x8, V2.D[0]
-	mov	x9, V2.D[1]
-	ld1	{V16.16B, V17.16B, V18.16B, V19.16B}, [x21], #0x40
-	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x21], #0x40
-	ld1	{V24.16B, V25.16B, V26.16B, V27.16B}, [x21], #0x40
-	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
-	ld1	{V3.2D}, [x23]
-	cmp	w2, #0x40
-	blt	L_AES_XTS_decrypt_NEON_start_2
-L_AES_XTS_decrypt_NEON_loop_4
-	mov	x25, x4
-	ld1	{V0.16B, V1.16B, V2.16B, V3.16B}, [x0], #0x40
-	ld1	{V4.16B}, [x25], #16
-	and	x16, x17, x9, asr 63
-	extr	x11, x9, x8, #63
-	eor	x10, x16, x8, lsl 1
-	and	x16, x17, x11, asr 63
-	extr	x13, x11, x10, #63
-	eor	x12, x16, x10, lsl 1
-	and	x16, x17, x13, asr 63
-	extr	x15, x13, x12, #63
-	eor	x14, x16, x12, lsl 1
+	rev32	V3.16B, V3.16B
 	mov	V8.D[0], x8
 	mov	V8.D[1], x9
 	mov	V9.D[0], x10
@@ -49331,1212 +50932,1863 @@ L_AES_XTS_decrypt_NEON_loop_4
 	eor	V1.16B, V1.16B, V9.16B
 	eor	V2.16B, V2.16B, V10.16B
 	eor	V3.16B, V3.16B, V11.16B
+	st1	{V0.16B, V1.16B, V2.16B, V3.16B}, [x1], #0x40
+	and	x16, x17, x15, asr 63
+	extr	x9, x15, x14, #63
+	eor	x8, x16, x14, lsl 1
+	sub	w2, w2, #0x40
+	cmp	w2, #0x40
+	bge	L_AES_XTS_decrypt_NEON_loop_4
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	movi	V15.16B, #27
+L_AES_XTS_decrypt_NEON_start_2
+	cmp	w2, #32
+	blt	L_AES_XTS_decrypt_NEON_start_1
+	mov	x25, x4
+	ld1	{V0.16B, V1.16B}, [x0], #32
+	ld1	{V4.16B}, [x25], #16
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	and	x16, x17, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x16, x10, lsl 1
+	mov	V2.D[0], x8
+	mov	V2.D[1], x9
+	mov	V3.D[0], x10
+	mov	V3.D[1], x11
+	eor	V0.16B, V0.16B, V2.16B
+	eor	V1.16B, V1.16B, V3.16B
 	rev32	V0.16B, V0.16B
 	rev32	V1.16B, V1.16B
-	rev32	V2.16B, V2.16B
-	rev32	V3.16B, V3.16B
 	eor	V0.16B, V0.16B, V4.16B
 	eor	V1.16B, V1.16B, V4.16B
-	eor	V2.16B, V2.16B, V4.16B
-	eor	V3.16B, V3.16B, V4.16B
 	sub	w24, w7, #2
-L_AES_XTS_decrypt_NEON_loop_nr_4
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
-	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
-	tbl	V6.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
-	tbl	V7.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V3.16B
+L_AES_XTS_decrypt_NEON_loop_nr_2
 	movi	V12.16B, #0x40
 	movi	V13.16B, #0x80
 	movi	V14.16B, #0xc0
 	eor	V8.16B, V0.16B, V12.16B
 	eor	V9.16B, V1.16B, V12.16B
-	eor	V10.16B, V2.16B, V12.16B
-	eor	V11.16B, V3.16B, V12.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
 	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
-	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	eor	V10.16B, V0.16B, V13.16B
+	eor	V11.16B, V1.16B, V13.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
 	orr	V5.16B, V5.16B, V9.16B
-	orr	V6.16B, V6.16B, V10.16B
-	orr	V7.16B, V7.16B, V11.16B
-	eor	V8.16B, V0.16B, V13.16B
-	eor	V9.16B, V1.16B, V13.16B
-	eor	V10.16B, V2.16B, V13.16B
-	eor	V11.16B, V3.16B, V13.16B
-	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	eor	V8.16B, V0.16B, V14.16B
+	eor	V9.16B, V1.16B, V14.16B
+	orr	V4.16B, V4.16B, V10.16B
+	orr	V5.16B, V5.16B, V11.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	ld1	{V0.16B}, [x23]
+	tbl	V4.16B, {V4.16B}, V0.16B
+	tbl	V5.16B, {V5.16B}, V0.16B
+	movi	V10.16B, #27
+	sshr	V8.16B, V4.16B, #7
+	sshr	V9.16B, V5.16B, #7
+	shl	V12.16B, V4.16B, #1
+	shl	V13.16B, V5.16B, #1
+	and	V8.16B, V8.16B, V10.16B
+	and	V9.16B, V9.16B, V10.16B
+	eor	V8.16B, V8.16B, V12.16B
+	eor	V9.16B, V9.16B, V13.16B
+	ushr	V12.16B, V4.16B, #6
+	ushr	V13.16B, V5.16B, #6
+	shl	V0.16B, V4.16B, #2
+	shl	V1.16B, V5.16B, #2
+	pmul	V12.16B, V12.16B, V10.16B
+	pmul	V13.16B, V13.16B, V10.16B
+	eor	V12.16B, V12.16B, V0.16B
+	eor	V13.16B, V13.16B, V1.16B
+	ushr	V0.16B, V4.16B, #5
+	ushr	V1.16B, V5.16B, #5
+	pmul	V0.16B, V0.16B, V10.16B
+	pmul	V1.16B, V1.16B, V10.16B
+	shl	V10.16B, V4.16B, #3
+	shl	V11.16B, V5.16B, #3
+	eor	V0.16B, V0.16B, V10.16B
+	eor	V1.16B, V1.16B, V11.16B
+	eor	V10.16B, V8.16B, V0.16B
+	eor	V11.16B, V9.16B, V1.16B
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V5.16B
+	eor	V8.16B, V12.16B, V0.16B
+	eor	V9.16B, V13.16B, V1.16B
+	eor	V12.16B, V12.16B, V10.16B
+	eor	V13.16B, V13.16B, V11.16B
+	eor	V10.16B, V10.16B, V4.16B
+	eor	V11.16B, V11.16B, V5.16B
+	shl	V4.4S, V10.4S, #8
+	shl	V5.4S, V11.4S, #8
+	rev32	V8.8H, V8.8H
+	rev32	V9.8H, V9.8H
+	sri	V4.4S, V10.4S, #24
+	sri	V5.4S, V11.4S, #24
+	eor	V4.16B, V4.16B, V12.16B
+	eor	V5.16B, V5.16B, V13.16B
+	shl	V10.4S, V0.4S, #24
+	shl	V11.4S, V1.4S, #24
+	eor	V4.16B, V4.16B, V8.16B
+	eor	V5.16B, V5.16B, V9.16B
+	sri	V10.4S, V0.4S, #8
+	sri	V11.4S, V1.4S, #8
+	eor	V4.16B, V4.16B, V10.16B
+	eor	V5.16B, V5.16B, V11.16B
+	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x25], #16
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V0.16B
+	; Round Done
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V5.16B, V12.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	eor	V10.16B, V4.16B, V13.16B
+	eor	V11.16B, V5.16B, V13.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	eor	V8.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V14.16B
+	orr	V0.16B, V0.16B, V10.16B
+	orr	V1.16B, V1.16B, V11.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	ld1	{V4.16B}, [x23]
+	tbl	V0.16B, {V0.16B}, V4.16B
+	tbl	V1.16B, {V1.16B}, V4.16B
+	movi	V10.16B, #27
+	sshr	V8.16B, V0.16B, #7
+	sshr	V9.16B, V1.16B, #7
+	shl	V12.16B, V0.16B, #1
+	shl	V13.16B, V1.16B, #1
+	and	V8.16B, V8.16B, V10.16B
+	and	V9.16B, V9.16B, V10.16B
+	eor	V8.16B, V8.16B, V12.16B
+	eor	V9.16B, V9.16B, V13.16B
+	ushr	V12.16B, V0.16B, #6
+	ushr	V13.16B, V1.16B, #6
+	shl	V4.16B, V0.16B, #2
+	shl	V5.16B, V1.16B, #2
+	pmul	V12.16B, V12.16B, V10.16B
+	pmul	V13.16B, V13.16B, V10.16B
+	eor	V12.16B, V12.16B, V4.16B
+	eor	V13.16B, V13.16B, V5.16B
+	ushr	V4.16B, V0.16B, #5
+	ushr	V5.16B, V1.16B, #5
+	pmul	V4.16B, V4.16B, V10.16B
+	pmul	V5.16B, V5.16B, V10.16B
+	shl	V10.16B, V0.16B, #3
+	shl	V11.16B, V1.16B, #3
+	eor	V4.16B, V4.16B, V10.16B
+	eor	V5.16B, V5.16B, V11.16B
+	eor	V10.16B, V8.16B, V4.16B
+	eor	V11.16B, V9.16B, V5.16B
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V1.16B
+	eor	V8.16B, V12.16B, V4.16B
+	eor	V9.16B, V13.16B, V5.16B
+	eor	V12.16B, V12.16B, V10.16B
+	eor	V13.16B, V13.16B, V11.16B
+	eor	V10.16B, V10.16B, V0.16B
+	eor	V11.16B, V11.16B, V1.16B
+	shl	V0.4S, V10.4S, #8
+	shl	V1.4S, V11.4S, #8
+	rev32	V8.8H, V8.8H
+	rev32	V9.8H, V9.8H
+	sri	V0.4S, V10.4S, #24
+	sri	V1.4S, V11.4S, #24
+	eor	V0.16B, V0.16B, V12.16B
+	eor	V1.16B, V1.16B, V13.16B
+	shl	V10.4S, V4.4S, #24
+	shl	V11.4S, V5.4S, #24
+	eor	V0.16B, V0.16B, V8.16B
+	eor	V1.16B, V1.16B, V9.16B
+	sri	V10.4S, V4.4S, #8
+	sri	V11.4S, V5.4S, #8
+	eor	V0.16B, V0.16B, V10.16B
+	eor	V1.16B, V1.16B, V11.16B
+	;   XOR in Key Schedule
+	ld1	{V4.2D}, [x25], #16
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V4.16B
+	; Round Done
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_2
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V1.16B, V12.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	eor	V10.16B, V0.16B, V13.16B
+	eor	V11.16B, V1.16B, V13.16B
 	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
 	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
 	orr	V5.16B, V5.16B, V9.16B
-	orr	V6.16B, V6.16B, V10.16B
-	orr	V7.16B, V7.16B, V11.16B
 	eor	V8.16B, V0.16B, V14.16B
 	eor	V9.16B, V1.16B, V14.16B
-	eor	V10.16B, V2.16B, V14.16B
-	eor	V11.16B, V3.16B, V14.16B
+	orr	V4.16B, V4.16B, V10.16B
+	orr	V5.16B, V5.16B, V11.16B
 	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
 	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
 	orr	V5.16B, V5.16B, V9.16B
-	orr	V6.16B, V6.16B, V10.16B
-	orr	V7.16B, V7.16B, V11.16B
 	ld1	{V0.16B}, [x23]
 	tbl	V4.16B, {V4.16B}, V0.16B
 	tbl	V5.16B, {V5.16B}, V0.16B
-	tbl	V6.16B, {V6.16B}, V0.16B
-	tbl	V7.16B, {V7.16B}, V0.16B
-	movi	V28.16B, #27
+	movi	V10.16B, #27
 	sshr	V8.16B, V4.16B, #7
 	sshr	V9.16B, V5.16B, #7
-	sshr	V10.16B, V6.16B, #7
-	sshr	V11.16B, V7.16B, #7
 	shl	V12.16B, V4.16B, #1
 	shl	V13.16B, V5.16B, #1
-	shl	V14.16B, V6.16B, #1
-	shl	V15.16B, V7.16B, #1
-	and	V8.16B, V8.16B, V28.16B
-	and	V9.16B, V9.16B, V28.16B
-	and	V10.16B, V10.16B, V28.16B
-	and	V11.16B, V11.16B, V28.16B
+	and	V8.16B, V8.16B, V10.16B
+	and	V9.16B, V9.16B, V10.16B
 	eor	V8.16B, V8.16B, V12.16B
 	eor	V9.16B, V9.16B, V13.16B
-	eor	V10.16B, V10.16B, V14.16B
-	eor	V11.16B, V11.16B, V15.16B
 	ushr	V12.16B, V4.16B, #6
 	ushr	V13.16B, V5.16B, #6
-	ushr	V14.16B, V6.16B, #6
-	ushr	V15.16B, V7.16B, #6
 	shl	V0.16B, V4.16B, #2
 	shl	V1.16B, V5.16B, #2
-	shl	V2.16B, V6.16B, #2
-	shl	V3.16B, V7.16B, #2
-	pmul	V12.16B, V12.16B, V28.16B
-	pmul	V13.16B, V13.16B, V28.16B
-	pmul	V14.16B, V14.16B, V28.16B
-	pmul	V15.16B, V15.16B, V28.16B
+	pmul	V12.16B, V12.16B, V10.16B
+	pmul	V13.16B, V13.16B, V10.16B
 	eor	V12.16B, V12.16B, V0.16B
 	eor	V13.16B, V13.16B, V1.16B
-	eor	V14.16B, V14.16B, V2.16B
-	eor	V15.16B, V15.16B, V3.16B
 	ushr	V0.16B, V4.16B, #5
 	ushr	V1.16B, V5.16B, #5
-	ushr	V2.16B, V6.16B, #5
-	ushr	V3.16B, V7.16B, #5
-	pmul	V0.16B, V0.16B, V28.16B
-	pmul	V1.16B, V1.16B, V28.16B
-	pmul	V2.16B, V2.16B, V28.16B
-	pmul	V3.16B, V3.16B, V28.16B
-	shl	V28.16B, V4.16B, #3
-	shl	V29.16B, V5.16B, #3
-	shl	V30.16B, V6.16B, #3
-	shl	V31.16B, V7.16B, #3
-	eor	V0.16B, V0.16B, V28.16B
-	eor	V1.16B, V1.16B, V29.16B
-	eor	V2.16B, V2.16B, V30.16B
-	eor	V3.16B, V3.16B, V31.16B
-	eor	V28.16B, V8.16B, V0.16B
-	eor	V29.16B, V9.16B, V1.16B
-	eor	V30.16B, V10.16B, V2.16B
-	eor	V31.16B, V11.16B, V3.16B
+	pmul	V0.16B, V0.16B, V10.16B
+	pmul	V1.16B, V1.16B, V10.16B
+	shl	V10.16B, V4.16B, #3
+	shl	V11.16B, V5.16B, #3
+	eor	V0.16B, V0.16B, V10.16B
+	eor	V1.16B, V1.16B, V11.16B
+	eor	V10.16B, V8.16B, V0.16B
+	eor	V11.16B, V9.16B, V1.16B
 	eor	V0.16B, V0.16B, V4.16B
 	eor	V1.16B, V1.16B, V5.16B
-	eor	V2.16B, V2.16B, V6.16B
-	eor	V3.16B, V3.16B, V7.16B
 	eor	V8.16B, V12.16B, V0.16B
 	eor	V9.16B, V13.16B, V1.16B
-	eor	V10.16B, V14.16B, V2.16B
-	eor	V11.16B, V15.16B, V3.16B
-	eor	V12.16B, V12.16B, V28.16B
-	eor	V13.16B, V13.16B, V29.16B
-	eor	V14.16B, V14.16B, V30.16B
-	eor	V15.16B, V15.16B, V31.16B
-	eor	V28.16B, V28.16B, V4.16B
-	eor	V29.16B, V29.16B, V5.16B
-	eor	V30.16B, V30.16B, V6.16B
-	eor	V31.16B, V31.16B, V7.16B
-	shl	V4.4S, V28.4S, #8
-	shl	V5.4S, V29.4S, #8
-	shl	V6.4S, V30.4S, #8
-	shl	V7.4S, V31.4S, #8
+	eor	V12.16B, V12.16B, V10.16B
+	eor	V13.16B, V13.16B, V11.16B
+	eor	V10.16B, V10.16B, V4.16B
+	eor	V11.16B, V11.16B, V5.16B
+	shl	V4.4S, V10.4S, #8
+	shl	V5.4S, V11.4S, #8
 	rev32	V8.8H, V8.8H
 	rev32	V9.8H, V9.8H
-	rev32	V10.8H, V10.8H
-	rev32	V11.8H, V11.8H
-	sri	V4.4S, V28.4S, #24
-	sri	V5.4S, V29.4S, #24
-	sri	V6.4S, V30.4S, #24
-	sri	V7.4S, V31.4S, #24
+	sri	V4.4S, V10.4S, #24
+	sri	V5.4S, V11.4S, #24
 	eor	V4.16B, V4.16B, V12.16B
 	eor	V5.16B, V5.16B, V13.16B
-	eor	V6.16B, V6.16B, V14.16B
-	eor	V7.16B, V7.16B, V15.16B
-	shl	V28.4S, V0.4S, #24
-	shl	V29.4S, V1.4S, #24
-	shl	V30.4S, V2.4S, #24
-	shl	V31.4S, V3.4S, #24
+	shl	V10.4S, V0.4S, #24
+	shl	V11.4S, V1.4S, #24
 	eor	V4.16B, V4.16B, V8.16B
 	eor	V5.16B, V5.16B, V9.16B
-	eor	V6.16B, V6.16B, V10.16B
-	eor	V7.16B, V7.16B, V11.16B
-	sri	V28.4S, V0.4S, #8
-	sri	V29.4S, V1.4S, #8
-	sri	V30.4S, V2.4S, #8
-	sri	V31.4S, V3.4S, #8
-	eor	V4.16B, V4.16B, V28.16B
-	eor	V5.16B, V5.16B, V29.16B
-	eor	V6.16B, V6.16B, V30.16B
-	eor	V7.16B, V7.16B, V31.16B
-	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
+	sri	V10.4S, V0.4S, #8
+	sri	V11.4S, V1.4S, #8
+	eor	V4.16B, V4.16B, V10.16B
+	eor	V5.16B, V5.16B, V11.16B
+	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x25], #16
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V0.16B
+	; Round Done
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V5.16B, V12.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	eor	V10.16B, V4.16B, V13.16B
+	eor	V11.16B, V5.16B, V13.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	eor	V8.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V14.16B
+	orr	V0.16B, V0.16B, V10.16B
+	orr	V1.16B, V1.16B, V11.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	ld1	{V4.16B}, [x23]
+	tbl	V0.16B, {V0.16B}, V4.16B
+	tbl	V1.16B, {V1.16B}, V4.16B
+	;   XOR in Key Schedule
+	ld1	{V4.2D}, [x25], #16
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V4.16B
+	; Round Done
+	rev32	V0.16B, V0.16B
+	rev32	V1.16B, V1.16B
+	eor	V0.16B, V0.16B, V2.16B
+	eor	V1.16B, V1.16B, V3.16B
+	st1	{V0.16B, V1.16B}, [x1], #32
+	and	x16, x17, x11, asr 63
+	extr	x9, x11, x10, #63
+	eor	x8, x16, x10, lsl 1
+	sub	w2, w2, #32
+L_AES_XTS_decrypt_NEON_start_1
+	ld1	{V3.2D}, [x23]
+	mov	V2.D[0], x8
+	mov	V2.D[1], x9
+	cmp	w2, #16
+	blt	L_AES_XTS_decrypt_NEON_start_partial
+	mov	x25, x4
+	ld1	{V0.16B}, [x0], #16
+	ld1	{V4.2D}, [x25], #16
+	eor	V0.16B, V0.16B, V2.16B
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V4.16B
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_1
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V0.16B, V13.16B
+	eor	V10.16B, V0.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	sshr	V10.16B, V4.16B, #7
+	ushr	V11.16B, V4.16B, #6
+	ushr	V8.16B, V4.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V4.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V4.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V4.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V4.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V4.16B
+	shl	V4.4S, V9.4S, #8
+	rev32	V10.8H, V10.8H
+	sri	V4.4S, V9.4S, #24
+	eor	V4.16B, V4.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V4.16B, V4.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V4.16B, V4.16B, V9.16B
+	ld1	{V0.2D}, [x25], #16
+	;   XOR in Key Schedule
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
+	sshr	V10.16B, V0.16B, #7
+	ushr	V11.16B, V0.16B, #6
+	ushr	V8.16B, V0.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V0.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V0.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V0.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V0.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V0.16B
+	shl	V0.4S, V9.4S, #8
+	rev32	V10.8H, V10.8H
+	sri	V0.4S, V9.4S, #24
+	eor	V0.16B, V0.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V0.16B, V0.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V0.16B, V0.16B, V9.16B
+	ld1	{V4.2D}, [x25], #16
 	;   XOR in Key Schedule
+	eor	V0.16B, V0.16B, V4.16B
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_1
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V0.16B, V13.16B
+	eor	V10.16B, V0.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	sshr	V10.16B, V4.16B, #7
+	ushr	V11.16B, V4.16B, #6
+	ushr	V8.16B, V4.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V4.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V4.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V4.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V4.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V4.16B
+	shl	V4.4S, V9.4S, #8
+	rev32	V10.8H, V10.8H
+	sri	V4.4S, V9.4S, #24
+	eor	V4.16B, V4.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V4.16B, V4.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V4.16B, V4.16B, V9.16B
 	ld1	{V0.2D}, [x25], #16
+	;   XOR in Key Schedule
 	eor	V4.16B, V4.16B, V0.16B
-	eor	V5.16B, V5.16B, V0.16B
-	eor	V6.16B, V6.16B, V0.16B
-	eor	V7.16B, V7.16B, V0.16B
-	; Round Done
-	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
-	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
-	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V6.16B
-	tbl	V3.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V7.16B
-	movi	V12.16B, #0x40
-	movi	V13.16B, #0x80
-	movi	V14.16B, #0xc0
 	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V5.16B, V12.16B
-	eor	V10.16B, V6.16B, V12.16B
-	eor	V11.16B, V7.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
-	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
-	orr	V0.16B, V0.16B, V8.16B
-	orr	V1.16B, V1.16B, V9.16B
-	orr	V2.16B, V2.16B, V10.16B
-	orr	V3.16B, V3.16B, V11.16B
-	eor	V8.16B, V4.16B, V13.16B
-	eor	V9.16B, V5.16B, V13.16B
-	eor	V10.16B, V6.16B, V13.16B
-	eor	V11.16B, V7.16B, V13.16B
-	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
-	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
-	orr	V0.16B, V0.16B, V8.16B
-	orr	V1.16B, V1.16B, V9.16B
-	orr	V2.16B, V2.16B, V10.16B
-	orr	V3.16B, V3.16B, V11.16B
-	eor	V8.16B, V4.16B, V14.16B
-	eor	V9.16B, V5.16B, V14.16B
-	eor	V10.16B, V6.16B, V14.16B
-	eor	V11.16B, V7.16B, V14.16B
-	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
-	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
-	orr	V1.16B, V1.16B, V9.16B
-	orr	V2.16B, V2.16B, V10.16B
-	orr	V3.16B, V3.16B, V11.16B
-	ld1	{V4.16B}, [x23]
-	tbl	V0.16B, {V0.16B}, V4.16B
-	tbl	V1.16B, {V1.16B}, V4.16B
-	tbl	V2.16B, {V2.16B}, V4.16B
-	tbl	V3.16B, {V3.16B}, V4.16B
-	movi	V28.16B, #27
-	sshr	V8.16B, V0.16B, #7
-	sshr	V9.16B, V1.16B, #7
-	sshr	V10.16B, V2.16B, #7
-	sshr	V11.16B, V3.16B, #7
-	shl	V12.16B, V0.16B, #1
-	shl	V13.16B, V1.16B, #1
-	shl	V14.16B, V2.16B, #1
-	shl	V15.16B, V3.16B, #1
-	and	V8.16B, V8.16B, V28.16B
-	and	V9.16B, V9.16B, V28.16B
-	and	V10.16B, V10.16B, V28.16B
-	and	V11.16B, V11.16B, V28.16B
-	eor	V8.16B, V8.16B, V12.16B
-	eor	V9.16B, V9.16B, V13.16B
-	eor	V10.16B, V10.16B, V14.16B
-	eor	V11.16B, V11.16B, V15.16B
-	ushr	V12.16B, V0.16B, #6
-	ushr	V13.16B, V1.16B, #6
-	ushr	V14.16B, V2.16B, #6
-	ushr	V15.16B, V3.16B, #6
-	shl	V4.16B, V0.16B, #2
-	shl	V5.16B, V1.16B, #2
-	shl	V6.16B, V2.16B, #2
-	shl	V7.16B, V3.16B, #2
-	pmul	V12.16B, V12.16B, V28.16B
-	pmul	V13.16B, V13.16B, V28.16B
-	pmul	V14.16B, V14.16B, V28.16B
-	pmul	V15.16B, V15.16B, V28.16B
-	eor	V12.16B, V12.16B, V4.16B
-	eor	V13.16B, V13.16B, V5.16B
-	eor	V14.16B, V14.16B, V6.16B
-	eor	V15.16B, V15.16B, V7.16B
-	ushr	V4.16B, V0.16B, #5
-	ushr	V5.16B, V1.16B, #5
-	ushr	V6.16B, V2.16B, #5
-	ushr	V7.16B, V3.16B, #5
-	pmul	V4.16B, V4.16B, V28.16B
-	pmul	V5.16B, V5.16B, V28.16B
-	pmul	V6.16B, V6.16B, V28.16B
-	pmul	V7.16B, V7.16B, V28.16B
-	shl	V28.16B, V0.16B, #3
-	shl	V29.16B, V1.16B, #3
-	shl	V30.16B, V2.16B, #3
-	shl	V31.16B, V3.16B, #3
-	eor	V4.16B, V4.16B, V28.16B
-	eor	V5.16B, V5.16B, V29.16B
-	eor	V6.16B, V6.16B, V30.16B
-	eor	V7.16B, V7.16B, V31.16B
-	eor	V28.16B, V8.16B, V4.16B
-	eor	V29.16B, V9.16B, V5.16B
-	eor	V30.16B, V10.16B, V6.16B
-	eor	V31.16B, V11.16B, V7.16B
-	eor	V4.16B, V4.16B, V0.16B
-	eor	V5.16B, V5.16B, V1.16B
-	eor	V6.16B, V6.16B, V2.16B
-	eor	V7.16B, V7.16B, V3.16B
-	eor	V8.16B, V12.16B, V4.16B
-	eor	V9.16B, V13.16B, V5.16B
-	eor	V10.16B, V14.16B, V6.16B
-	eor	V11.16B, V15.16B, V7.16B
-	eor	V12.16B, V12.16B, V28.16B
-	eor	V13.16B, V13.16B, V29.16B
-	eor	V14.16B, V14.16B, V30.16B
-	eor	V15.16B, V15.16B, V31.16B
-	eor	V28.16B, V28.16B, V0.16B
-	eor	V29.16B, V29.16B, V1.16B
-	eor	V30.16B, V30.16B, V2.16B
-	eor	V31.16B, V31.16B, V3.16B
-	shl	V0.4S, V28.4S, #8
-	shl	V1.4S, V29.4S, #8
-	shl	V2.4S, V30.4S, #8
-	shl	V3.4S, V31.4S, #8
-	rev32	V8.8H, V8.8H
-	rev32	V9.8H, V9.8H
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
+	ld1	{V4.2D}, [x25], #16
+	;   XOR in Key Schedule
+	eor	V0.16B, V0.16B, V4.16B
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V2.16B
+	st1	{V0.16B}, [x1], #16
+	sub	w2, w2, #16
+	cbz	w19, L_AES_XTS_decrypt_NEON_data_done
+	and	x16, x17, x9, asr 63
+	extr	x9, x9, x8, #63
+	eor	x8, x16, x8, lsl 1
+L_AES_XTS_decrypt_NEON_start_partial
+	mov	w2, w19
+	cbz	w2, L_AES_XTS_decrypt_NEON_data_done
+	mov	V2.D[0], x8
+	mov	V2.D[1], x9
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	mov	V1.D[0], x10
+	mov	V1.D[1], x11
+	mov	x25, x4
+	ld1	{V0.16B}, [x0], #16
+	ld1	{V4.2D}, [x25], #16
+	eor	V0.16B, V0.16B, V1.16B
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V4.16B
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_partial_1
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V0.16B, V13.16B
+	eor	V10.16B, V0.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	sshr	V10.16B, V4.16B, #7
+	ushr	V11.16B, V4.16B, #6
+	ushr	V8.16B, V4.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V4.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V4.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V4.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V4.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V4.16B
+	shl	V4.4S, V9.4S, #8
 	rev32	V10.8H, V10.8H
-	rev32	V11.8H, V11.8H
-	sri	V0.4S, V28.4S, #24
-	sri	V1.4S, V29.4S, #24
-	sri	V2.4S, V30.4S, #24
-	sri	V3.4S, V31.4S, #24
-	eor	V0.16B, V0.16B, V12.16B
-	eor	V1.16B, V1.16B, V13.16B
-	eor	V2.16B, V2.16B, V14.16B
-	eor	V3.16B, V3.16B, V15.16B
-	shl	V28.4S, V4.4S, #24
-	shl	V29.4S, V5.4S, #24
-	shl	V30.4S, V6.4S, #24
-	shl	V31.4S, V7.4S, #24
-	eor	V0.16B, V0.16B, V8.16B
-	eor	V1.16B, V1.16B, V9.16B
-	eor	V2.16B, V2.16B, V10.16B
-	eor	V3.16B, V3.16B, V11.16B
-	sri	V28.4S, V4.4S, #8
-	sri	V29.4S, V5.4S, #8
-	sri	V30.4S, V6.4S, #8
-	sri	V31.4S, V7.4S, #8
-	eor	V0.16B, V0.16B, V28.16B
-	eor	V1.16B, V1.16B, V29.16B
-	eor	V2.16B, V2.16B, V30.16B
-	eor	V3.16B, V3.16B, V31.16B
-	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
+	sri	V4.4S, V9.4S, #24
+	eor	V4.16B, V4.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V4.16B, V4.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V4.16B, V4.16B, V9.16B
+	ld1	{V0.2D}, [x25], #16
 	;   XOR in Key Schedule
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
+	sshr	V10.16B, V0.16B, #7
+	ushr	V11.16B, V0.16B, #6
+	ushr	V8.16B, V0.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V0.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V0.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V0.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V0.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V0.16B
+	shl	V0.4S, V9.4S, #8
+	rev32	V10.8H, V10.8H
+	sri	V0.4S, V9.4S, #24
+	eor	V0.16B, V0.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V0.16B, V0.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V0.16B, V0.16B, V9.16B
 	ld1	{V4.2D}, [x25], #16
+	;   XOR in Key Schedule
 	eor	V0.16B, V0.16B, V4.16B
-	eor	V1.16B, V1.16B, V4.16B
-	eor	V2.16B, V2.16B, V4.16B
-	eor	V3.16B, V3.16B, V4.16B
-	; Round Done
 	subs	w24, w24, #2
-	bne	L_AES_XTS_decrypt_NEON_loop_nr_4
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
-	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
-	tbl	V6.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
-	tbl	V7.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V3.16B
-	movi	V12.16B, #0x40
-	movi	V13.16B, #0x80
-	movi	V14.16B, #0xc0
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_partial_1
 	eor	V8.16B, V0.16B, V12.16B
-	eor	V9.16B, V1.16B, V12.16B
-	eor	V10.16B, V2.16B, V12.16B
-	eor	V11.16B, V3.16B, V12.16B
+	eor	V9.16B, V0.16B, V13.16B
+	eor	V10.16B, V0.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
-	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
-	orr	V4.16B, V4.16B, V8.16B
-	orr	V5.16B, V5.16B, V9.16B
-	orr	V6.16B, V6.16B, V10.16B
-	orr	V7.16B, V7.16B, V11.16B
-	eor	V8.16B, V0.16B, V13.16B
-	eor	V9.16B, V1.16B, V13.16B
-	eor	V10.16B, V2.16B, V13.16B
-	eor	V11.16B, V3.16B, V13.16B
-	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
-	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
-	orr	V4.16B, V4.16B, V8.16B
-	orr	V5.16B, V5.16B, V9.16B
-	orr	V6.16B, V6.16B, V10.16B
-	orr	V7.16B, V7.16B, V11.16B
-	eor	V8.16B, V0.16B, V14.16B
-	eor	V9.16B, V1.16B, V14.16B
-	eor	V10.16B, V2.16B, V14.16B
-	eor	V11.16B, V3.16B, V14.16B
-	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
-	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
-	orr	V5.16B, V5.16B, V9.16B
-	orr	V6.16B, V6.16B, V10.16B
-	orr	V7.16B, V7.16B, V11.16B
-	ld1	{V0.16B}, [x23]
-	tbl	V4.16B, {V4.16B}, V0.16B
-	tbl	V5.16B, {V5.16B}, V0.16B
-	tbl	V6.16B, {V6.16B}, V0.16B
-	tbl	V7.16B, {V7.16B}, V0.16B
-	movi	V28.16B, #27
-	sshr	V8.16B, V4.16B, #7
-	sshr	V9.16B, V5.16B, #7
-	sshr	V10.16B, V6.16B, #7
-	sshr	V11.16B, V7.16B, #7
-	shl	V12.16B, V4.16B, #1
-	shl	V13.16B, V5.16B, #1
-	shl	V14.16B, V6.16B, #1
-	shl	V15.16B, V7.16B, #1
-	and	V8.16B, V8.16B, V28.16B
-	and	V9.16B, V9.16B, V28.16B
-	and	V10.16B, V10.16B, V28.16B
-	and	V11.16B, V11.16B, V28.16B
-	eor	V8.16B, V8.16B, V12.16B
-	eor	V9.16B, V9.16B, V13.16B
-	eor	V10.16B, V10.16B, V14.16B
-	eor	V11.16B, V11.16B, V15.16B
-	ushr	V12.16B, V4.16B, #6
-	ushr	V13.16B, V5.16B, #6
-	ushr	V14.16B, V6.16B, #6
-	ushr	V15.16B, V7.16B, #6
-	shl	V0.16B, V4.16B, #2
-	shl	V1.16B, V5.16B, #2
-	shl	V2.16B, V6.16B, #2
-	shl	V3.16B, V7.16B, #2
-	pmul	V12.16B, V12.16B, V28.16B
-	pmul	V13.16B, V13.16B, V28.16B
-	pmul	V14.16B, V14.16B, V28.16B
-	pmul	V15.16B, V15.16B, V28.16B
-	eor	V12.16B, V12.16B, V0.16B
-	eor	V13.16B, V13.16B, V1.16B
-	eor	V14.16B, V14.16B, V2.16B
-	eor	V15.16B, V15.16B, V3.16B
-	ushr	V0.16B, V4.16B, #5
-	ushr	V1.16B, V5.16B, #5
-	ushr	V2.16B, V6.16B, #5
-	ushr	V3.16B, V7.16B, #5
-	pmul	V0.16B, V0.16B, V28.16B
-	pmul	V1.16B, V1.16B, V28.16B
-	pmul	V2.16B, V2.16B, V28.16B
-	pmul	V3.16B, V3.16B, V28.16B
-	shl	V28.16B, V4.16B, #3
-	shl	V29.16B, V5.16B, #3
-	shl	V30.16B, V6.16B, #3
-	shl	V31.16B, V7.16B, #3
-	eor	V0.16B, V0.16B, V28.16B
-	eor	V1.16B, V1.16B, V29.16B
-	eor	V2.16B, V2.16B, V30.16B
-	eor	V3.16B, V3.16B, V31.16B
-	eor	V28.16B, V8.16B, V0.16B
-	eor	V29.16B, V9.16B, V1.16B
-	eor	V30.16B, V10.16B, V2.16B
-	eor	V31.16B, V11.16B, V3.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	sshr	V10.16B, V4.16B, #7
+	ushr	V11.16B, V4.16B, #6
+	ushr	V8.16B, V4.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V4.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V4.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V4.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V4.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V4.16B
+	shl	V4.4S, V9.4S, #8
+	rev32	V10.8H, V10.8H
+	sri	V4.4S, V9.4S, #24
+	eor	V4.16B, V4.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V4.16B, V4.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V4.16B, V4.16B, V9.16B
+	ld1	{V0.2D}, [x25], #16
+	;   XOR in Key Schedule
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
+	ld1	{V4.2D}, [x25], #16
+	;   XOR in Key Schedule
 	eor	V0.16B, V0.16B, V4.16B
-	eor	V1.16B, V1.16B, V5.16B
-	eor	V2.16B, V2.16B, V6.16B
-	eor	V3.16B, V3.16B, V7.16B
-	eor	V8.16B, V12.16B, V0.16B
-	eor	V9.16B, V13.16B, V1.16B
-	eor	V10.16B, V14.16B, V2.16B
-	eor	V11.16B, V15.16B, V3.16B
-	eor	V12.16B, V12.16B, V28.16B
-	eor	V13.16B, V13.16B, V29.16B
-	eor	V14.16B, V14.16B, V30.16B
-	eor	V15.16B, V15.16B, V31.16B
-	eor	V28.16B, V28.16B, V4.16B
-	eor	V29.16B, V29.16B, V5.16B
-	eor	V30.16B, V30.16B, V6.16B
-	eor	V31.16B, V31.16B, V7.16B
-	shl	V4.4S, V28.4S, #8
-	shl	V5.4S, V29.4S, #8
-	shl	V6.4S, V30.4S, #8
-	shl	V7.4S, V31.4S, #8
-	rev32	V8.8H, V8.8H
-	rev32	V9.8H, V9.8H
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V1.16B
+	st1	{V0.2D}, [x6]
+	add	x1, x1, #16
+	mov	w16, w2
+L_AES_XTS_decrypt_NEON_start_byte
+	ldrb	w10, [x6]
+	ldrb	w11, [x0], #1
+	strb	w10, [x1], #1
+	strb	w11, [x6], #1
+	subs	w16, w16, #1
+	bgt	L_AES_XTS_decrypt_NEON_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	mov	x25, x4
+	ld1	{V0.2D}, [x6]
+	ld1	{V4.2D}, [x25], #16
+	eor	V0.16B, V0.16B, V2.16B
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V4.16B
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_partial_2
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V0.16B, V13.16B
+	eor	V10.16B, V0.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	sshr	V10.16B, V4.16B, #7
+	ushr	V11.16B, V4.16B, #6
+	ushr	V8.16B, V4.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V4.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V4.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V4.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V4.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V4.16B
+	shl	V4.4S, V9.4S, #8
+	rev32	V10.8H, V10.8H
+	sri	V4.4S, V9.4S, #24
+	eor	V4.16B, V4.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V4.16B, V4.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V4.16B, V4.16B, V9.16B
+	ld1	{V0.2D}, [x25], #16
+	;   XOR in Key Schedule
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V8.16B, V4.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
+	sshr	V10.16B, V0.16B, #7
+	ushr	V11.16B, V0.16B, #6
+	ushr	V8.16B, V0.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V0.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V0.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V0.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V0.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V0.16B
+	shl	V0.4S, V9.4S, #8
 	rev32	V10.8H, V10.8H
-	rev32	V11.8H, V11.8H
-	sri	V4.4S, V28.4S, #24
-	sri	V5.4S, V29.4S, #24
-	sri	V6.4S, V30.4S, #24
-	sri	V7.4S, V31.4S, #24
-	eor	V4.16B, V4.16B, V12.16B
-	eor	V5.16B, V5.16B, V13.16B
-	eor	V6.16B, V6.16B, V14.16B
-	eor	V7.16B, V7.16B, V15.16B
-	shl	V28.4S, V0.4S, #24
-	shl	V29.4S, V1.4S, #24
-	shl	V30.4S, V2.4S, #24
-	shl	V31.4S, V3.4S, #24
-	eor	V4.16B, V4.16B, V8.16B
-	eor	V5.16B, V5.16B, V9.16B
-	eor	V6.16B, V6.16B, V10.16B
-	eor	V7.16B, V7.16B, V11.16B
-	sri	V28.4S, V0.4S, #8
-	sri	V29.4S, V1.4S, #8
-	sri	V30.4S, V2.4S, #8
-	sri	V31.4S, V3.4S, #8
-	eor	V4.16B, V4.16B, V28.16B
-	eor	V5.16B, V5.16B, V29.16B
-	eor	V6.16B, V6.16B, V30.16B
-	eor	V7.16B, V7.16B, V31.16B
-	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x21]
+	sri	V0.4S, V9.4S, #24
+	eor	V0.16B, V0.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V0.16B, V0.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V0.16B, V0.16B, V9.16B
+	ld1	{V4.2D}, [x25], #16
 	;   XOR in Key Schedule
+	eor	V0.16B, V0.16B, V4.16B
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_partial_2
+	eor	V8.16B, V0.16B, V12.16B
+	eor	V9.16B, V0.16B, V13.16B
+	eor	V10.16B, V0.16B, V14.16B
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V4.16B, V4.16B, V9.16B
+	tbl	V4.16B, {V4.16B}, V3.16B
+	sshr	V10.16B, V4.16B, #7
+	ushr	V11.16B, V4.16B, #6
+	ushr	V8.16B, V4.16B, #5
+	and	V10.16B, V10.16B, V15.16B
+	pmul	V11.16B, V11.16B, V15.16B
+	pmul	V8.16B, V8.16B, V15.16B
+	shl	V9.16B, V4.16B, #1
+	eor	V10.16B, V10.16B, V9.16B
+	shl	V9.16B, V4.16B, #3
+	eor	V8.16B, V8.16B, V9.16B
+	shl	V9.16B, V4.16B, #2
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V10.16B, V8.16B
+	eor	V8.16B, V8.16B, V4.16B
+	eor	V10.16B, V11.16B, V8.16B
+	eor	V11.16B, V11.16B, V9.16B
+	eor	V9.16B, V9.16B, V4.16B
+	shl	V4.4S, V9.4S, #8
+	rev32	V10.8H, V10.8H
+	sri	V4.4S, V9.4S, #24
+	eor	V4.16B, V4.16B, V11.16B
+	shl	V9.4S, V8.4S, #24
+	eor	V4.16B, V4.16B, V10.16B
+	sri	V9.4S, V8.4S, #8
+	eor	V4.16B, V4.16B, V9.16B
 	ld1	{V0.2D}, [x25], #16
+	;   XOR in Key Schedule
 	eor	V4.16B, V4.16B, V0.16B
-	eor	V5.16B, V5.16B, V0.16B
-	eor	V6.16B, V6.16B, V0.16B
-	eor	V7.16B, V7.16B, V0.16B
-	; Round Done
-	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
-	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
-	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V6.16B
-	tbl	V3.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V7.16B
-	movi	V12.16B, #0x40
-	movi	V13.16B, #0x80
-	movi	V14.16B, #0xc0
 	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V5.16B, V12.16B
-	eor	V10.16B, V6.16B, V12.16B
-	eor	V11.16B, V7.16B, V12.16B
+	eor	V9.16B, V4.16B, V13.16B
+	eor	V10.16B, V4.16B, V14.16B
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
-	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
-	orr	V0.16B, V0.16B, V8.16B
-	orr	V1.16B, V1.16B, V9.16B
-	orr	V2.16B, V2.16B, V10.16B
-	orr	V3.16B, V3.16B, V11.16B
-	eor	V8.16B, V4.16B, V13.16B
-	eor	V9.16B, V5.16B, V13.16B
-	eor	V10.16B, V6.16B, V13.16B
-	eor	V11.16B, V7.16B, V13.16B
-	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
 	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
-	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
-	orr	V0.16B, V0.16B, V8.16B
-	orr	V1.16B, V1.16B, V9.16B
-	orr	V2.16B, V2.16B, V10.16B
-	orr	V3.16B, V3.16B, V11.16B
-	eor	V8.16B, V4.16B, V14.16B
-	eor	V9.16B, V5.16B, V14.16B
-	eor	V10.16B, V6.16B, V14.16B
-	eor	V11.16B, V7.16B, V14.16B
-	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
-	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
 	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
-	orr	V1.16B, V1.16B, V9.16B
-	orr	V2.16B, V2.16B, V10.16B
-	orr	V3.16B, V3.16B, V11.16B
-	ld1	{V4.16B}, [x23]
-	tbl	V0.16B, {V0.16B}, V4.16B
-	tbl	V1.16B, {V1.16B}, V4.16B
-	tbl	V2.16B, {V2.16B}, V4.16B
-	tbl	V3.16B, {V3.16B}, V4.16B
-	;   XOR in Key Schedule
+	orr	V9.16B, V9.16B, V10.16B
+	orr	V0.16B, V0.16B, V9.16B
+	tbl	V0.16B, {V0.16B}, V3.16B
 	ld1	{V4.2D}, [x25], #16
+	;   XOR in Key Schedule
 	eor	V0.16B, V0.16B, V4.16B
-	eor	V1.16B, V1.16B, V4.16B
-	eor	V2.16B, V2.16B, V4.16B
-	eor	V3.16B, V3.16B, V4.16B
-	; Round Done
 	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V2.16B
+	st1	{V0.16B}, [x1]
+L_AES_XTS_decrypt_NEON_data_done
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x22, x23, [x29, #48]
+	ldp	x24, x25, [x29, #64]
+	ldp	D8, D9, [x29, #80]
+	ldp	D10, D11, [x29, #96]
+	ldp	D12, D13, [x29, #112]
+	ldp	D14, D15, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	IF :DEF:WOLFSSL_AESGCM_SIV
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCMSIV_polyval_neon
+AES_GCMSIV_polyval_neon PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	ld1	{V18.2D}, [x0]
+	ld1	{V10.2D}, [x1]
+	movi	V19.16B, #15
+	eor	V20.16B, V20.16B, V20.16B
+	rev64	V10.16B, V10.16B
+	ext8	V10.16B, V10.16B, V10.16B, #8
+	rbit	V10.16B, V10.16B
+	rbit	V18.16B, V18.16B
+	and	V12.16B, V10.16B, V19.16B
+	ushr	V13.16B, V10.16B, #4
+	eor	V14.16B, V12.16B, V13.16B
+	cbz	w3, L_AES_GCMSIV_polyval_neon_done
+L_AES_GCMSIV_polyval_neon_loop
+	ld1	{V0.16B}, [x2], #16
+	rev64	V0.16B, V0.16B
+	ext8	V0.16B, V0.16B, V0.16B, #8
+	rbit	V0.16B, V0.16B
+	eor	V18.16B, V18.16B, V0.16B
+	and	V15.16B, V18.16B, V19.16B
+	ushr	V16.16B, V18.16B, #4
+	eor	V17.16B, V15.16B, V16.16B
+	dup	V0.16B, V12.B[0]
+	dup	V2.16B, V14.B[0]
+	dup	V1.16B, V13.B[0]
+	pmul	V8.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V8.16B
+	eor	V5.16B, V5.16B, V4.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V8.16B, V8.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	dup	V0.16B, V12.B[1]
+	dup	V2.16B, V14.B[1]
+	dup	V1.16B, V13.B[1]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V6.16B, V20.16B, V3.16B, #15
+	ext8	V9.16B, V3.16B, V20.16B, #15
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[2]
+	dup	V2.16B, V14.B[2]
+	dup	V1.16B, V13.B[2]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #14
+	ext8	V6.16B, V20.16B, V3.16B, #14
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[3]
+	dup	V2.16B, V14.B[3]
+	dup	V1.16B, V13.B[3]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #13
+	ext8	V6.16B, V20.16B, V3.16B, #13
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[4]
+	dup	V2.16B, V14.B[4]
+	dup	V1.16B, V13.B[4]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #12
+	ext8	V6.16B, V20.16B, V3.16B, #12
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[5]
+	dup	V2.16B, V14.B[5]
+	dup	V1.16B, V13.B[5]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #11
+	ext8	V6.16B, V20.16B, V3.16B, #11
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[6]
+	dup	V2.16B, V14.B[6]
+	dup	V1.16B, V13.B[6]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #10
+	ext8	V6.16B, V20.16B, V3.16B, #10
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[7]
+	dup	V2.16B, V14.B[7]
+	dup	V1.16B, V13.B[7]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #9
+	ext8	V6.16B, V20.16B, V3.16B, #9
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[8]
+	dup	V2.16B, V14.B[8]
+	dup	V1.16B, V13.B[8]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #8
+	ext8	V6.16B, V20.16B, V3.16B, #8
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[9]
+	dup	V2.16B, V14.B[9]
+	dup	V1.16B, V13.B[9]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #7
+	ext8	V6.16B, V20.16B, V3.16B, #7
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[10]
+	dup	V2.16B, V14.B[10]
+	dup	V1.16B, V13.B[10]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #6
+	ext8	V6.16B, V20.16B, V3.16B, #6
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[11]
+	dup	V2.16B, V14.B[11]
+	dup	V1.16B, V13.B[11]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #5
+	ext8	V6.16B, V20.16B, V3.16B, #5
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[12]
+	dup	V2.16B, V14.B[12]
+	dup	V1.16B, V13.B[12]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #4
+	ext8	V6.16B, V20.16B, V3.16B, #4
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[13]
+	dup	V2.16B, V14.B[13]
+	dup	V1.16B, V13.B[13]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #3
+	ext8	V6.16B, V20.16B, V3.16B, #3
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[14]
+	dup	V2.16B, V14.B[14]
+	dup	V1.16B, V13.B[14]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #2
+	ext8	V6.16B, V20.16B, V3.16B, #2
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	dup	V0.16B, V12.B[15]
+	dup	V2.16B, V14.B[15]
+	dup	V1.16B, V13.B[15]
+	pmul	V3.16B, V15.16B, V0.16B
+	pmul	V5.16B, V17.16B, V2.16B
+	pmul	V4.16B, V16.16B, V1.16B
+	eor	V5.16B, V5.16B, V3.16B
+	eor	V5.16B, V5.16B, V4.16B
+	eor	V3.16B, V3.16B, V11.16B
+	shl	V6.16B, V5.16B, #4
+	ushr	V7.16B, V5.16B, #4
+	eor	V3.16B, V3.16B, V6.16B
+	eor	V11.16B, V4.16B, V7.16B
+	ext8	V7.16B, V3.16B, V20.16B, #1
+	ext8	V6.16B, V20.16B, V3.16B, #1
+	eor	V9.16B, V9.16B, V7.16B
+	eor	V8.16B, V8.16B, V6.16B
+	eor	V9.16B, V9.16B, V11.16B
+	shl	V0.16B, V9.16B, #1
+	shl	V1.16B, V9.16B, #2
+	shl	V2.16B, V9.16B, #7
+	ushr	V3.16B, V9.16B, #7
+	ushr	V4.16B, V9.16B, #6
+	ushr	V5.16B, V9.16B, #1
+	eor	V0.16B, V0.16B, V9.16B
+	eor	V1.16B, V1.16B, V2.16B
+	eor	V0.16B, V0.16B, V1.16B
+	eor	V8.16B, V8.16B, V0.16B
+	ext8	V0.16B, V20.16B, V3.16B, #15
+	ext8	V1.16B, V20.16B, V4.16B, #15
+	ext8	V2.16B, V20.16B, V5.16B, #15
+	ext8	V4.16B, V4.16B, V20.16B, #15
+	ext8	V5.16B, V5.16B, V20.16B, #15
+	eor	V0.16B, V0.16B, V1.16B
+	eor	V8.16B, V8.16B, V2.16B
+	eor	V8.16B, V8.16B, V0.16B
+	eor	V3.16B, V4.16B, V5.16B
+	shl	V0.2D, V3.2D, #1
+	shl	V1.2D, V3.2D, #2
+	shl	V2.2D, V3.2D, #7
+	eor	V3.16B, V3.16B, V0.16B
+	eor	V1.16B, V1.16B, V2.16B
+	eor	V8.16B, V8.16B, V3.16B
+	eor	V18.16B, V8.16B, V1.16B
+	subs	w3, w3, #1
+	bne	L_AES_GCMSIV_polyval_neon_loop
+L_AES_GCMSIV_polyval_neon_done
+	rbit	V18.16B, V18.16B
+	st1	{V18.2D}, [x0]
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	8
+L_AES_GCMSIV_ctr_neon_te
+	DCB	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
+	DCB	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76
+	DCB	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0
+	DCB	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0
+	DCB	0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc
+	DCB	0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15
+	DCB	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a
+	DCB	0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75
+	DCB	0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0
+	DCB	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84
+	DCB	0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b
+	DCB	0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf
+	DCB	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85
+	DCB	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8
+	DCB	0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5
+	DCB	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2
+	DCB	0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17
+	DCB	0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73
+	DCB	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88
+	DCB	0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb
+	DCB	0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c
+	DCB	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79
+	DCB	0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9
+	DCB	0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08
+	DCB	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6
+	DCB	0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a
+	DCB	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e
+	DCB	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e
+	DCB	0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94
+	DCB	0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf
+	DCB	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68
+	DCB	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	8
+L_AES_GCMSIV_ctr_neon_shuffle
+	DCB	0x0c, 0x09, 0x06, 0x03, 0x00, 0x0d, 0x0a, 0x07
+	DCB	0x04, 0x01, 0x0e, 0x0b, 0x08, 0x05, 0x02, 0x0f
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCMSIV_ctr_neon
+AES_GCMSIV_ctr_neon PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	adrp	x6, L_AES_GCMSIV_ctr_neon_te
+	add	x6, x6, L_AES_GCMSIV_ctr_neon_te
+	adrp	x7, L_AES_GCMSIV_ctr_neon_shuffle
+	add	x7, x7, L_AES_GCMSIV_ctr_neon_shuffle
+	ld1	{V16.16B, V17.16B, V18.16B, V19.16B}, [x6], #0x40
+	ld1	{V20.16B, V21.16B, V22.16B, V23.16B}, [x6], #0x40
+	ld1	{V24.16B, V25.16B, V26.16B, V27.16B}, [x6], #0x40
+	ld1	{V28.16B, V29.16B, V30.16B, V31.16B}, [x6]
+	ldr	w10, [x5]
+	cmp	x2, #0x40
+	blt	L_AES_GCMSIV_ctr_neon_start_2
+L_AES_GCMSIV_ctr_neon_loop_4
+	mov	x9, x3
+	ld1	{V4.2D}, [x9], #16
+	; Round: 0 - build counters and XOR in key schedule
+	ld1	{V0.2D}, [x5]
+	mov	V0.S[0], w10
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V4.16B
+	ld1	{V1.2D}, [x5]
+	add	w8, w10, #1
+	mov	V1.S[0], w8
 	rev32	V1.16B, V1.16B
+	eor	V1.16B, V1.16B, V4.16B
+	ld1	{V2.2D}, [x5]
+	add	w8, w10, #2
+	mov	V2.S[0], w8
 	rev32	V2.16B, V2.16B
+	eor	V2.16B, V2.16B, V4.16B
+	ld1	{V3.2D}, [x5]
+	add	w8, w10, #3
+	mov	V3.S[0], w8
 	rev32	V3.16B, V3.16B
-	mov	V8.D[0], x8
-	mov	V8.D[1], x9
-	mov	V9.D[0], x10
-	mov	V9.D[1], x11
-	mov	V10.D[0], x12
-	mov	V10.D[1], x13
-	mov	V11.D[0], x14
-	mov	V11.D[1], x15
-	eor	V0.16B, V0.16B, V8.16B
-	eor	V1.16B, V1.16B, V9.16B
-	eor	V2.16B, V2.16B, V10.16B
-	eor	V3.16B, V3.16B, V11.16B
-	st1	{V0.16B, V1.16B, V2.16B, V3.16B}, [x1], #0x40
-	and	x16, x17, x15, asr 63
-	extr	x9, x15, x14, #63
-	eor	x8, x16, x14, lsl 1
-	sub	w2, w2, #0x40
-	cmp	w2, #0x40
-	bge	L_AES_XTS_decrypt_NEON_loop_4
-	movi	V12.16B, #0x40
-	movi	V13.16B, #0x80
-	movi	V14.16B, #0xc0
-	movi	V15.16B, #27
-L_AES_XTS_decrypt_NEON_start_2
-	cmp	w2, #32
-	blt	L_AES_XTS_decrypt_NEON_start_1
-	mov	x25, x4
-	ld1	{V0.16B, V1.16B}, [x0], #32
-	ld1	{V4.16B}, [x25], #16
-	and	x16, x17, x9, asr 63
-	extr	x11, x9, x8, #63
-	eor	x10, x16, x8, lsl 1
-	and	x16, x17, x11, asr 63
-	extr	x13, x11, x10, #63
-	eor	x12, x16, x10, lsl 1
-	mov	V2.D[0], x8
-	mov	V2.D[1], x9
-	mov	V3.D[0], x10
-	mov	V3.D[1], x11
-	eor	V0.16B, V0.16B, V2.16B
-	eor	V1.16B, V1.16B, V3.16B
-	rev32	V0.16B, V0.16B
-	rev32	V1.16B, V1.16B
-	eor	V0.16B, V0.16B, V4.16B
-	eor	V1.16B, V1.16B, V4.16B
-	sub	w24, w7, #2
-L_AES_XTS_decrypt_NEON_loop_nr_2
+	eor	V3.16B, V3.16B, V4.16B
+	add	w10, w10, #4
+	sub	w8, w4, #2
+L_AES_GCMSIV_ctr_neon_loop_nr_4
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	tbl	V6.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
+	tbl	V7.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V3.16B
 	movi	V12.16B, #0x40
 	movi	V13.16B, #0x80
 	movi	V14.16B, #0xc0
 	eor	V8.16B, V0.16B, V12.16B
 	eor	V9.16B, V1.16B, V12.16B
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
-	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	eor	V10.16B, V2.16B, V12.16B
+	eor	V11.16B, V3.16B, V12.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
 	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	eor	V10.16B, V0.16B, V13.16B
-	eor	V11.16B, V1.16B, V13.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	eor	V8.16B, V0.16B, V13.16B
+	eor	V9.16B, V1.16B, V13.16B
+	eor	V10.16B, V2.16B, V13.16B
+	eor	V11.16B, V3.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
 	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
 	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
 	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
 	eor	V8.16B, V0.16B, V14.16B
 	eor	V9.16B, V1.16B, V14.16B
-	orr	V4.16B, V4.16B, V10.16B
-	orr	V5.16B, V5.16B, V11.16B
+	eor	V10.16B, V2.16B, V14.16B
+	eor	V11.16B, V3.16B, V14.16B
 	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
 	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
 	orr	V5.16B, V5.16B, V9.16B
-	ld1	{V0.16B}, [x23]
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	ld1	{V0.16B}, [x7]
 	tbl	V4.16B, {V4.16B}, V0.16B
 	tbl	V5.16B, {V5.16B}, V0.16B
-	movi	V10.16B, #27
+	tbl	V6.16B, {V6.16B}, V0.16B
+	tbl	V7.16B, {V7.16B}, V0.16B
 	sshr	V8.16B, V4.16B, #7
 	sshr	V9.16B, V5.16B, #7
+	sshr	V10.16B, V6.16B, #7
+	sshr	V11.16B, V7.16B, #7
 	shl	V12.16B, V4.16B, #1
 	shl	V13.16B, V5.16B, #1
-	and	V8.16B, V8.16B, V10.16B
-	and	V9.16B, V9.16B, V10.16B
+	shl	V14.16B, V6.16B, #1
+	shl	V15.16B, V7.16B, #1
+	movi	V0.16B, #27
+	and	V8.16B, V8.16B, V0.16B
+	and	V9.16B, V9.16B, V0.16B
+	and	V10.16B, V10.16B, V0.16B
+	and	V11.16B, V11.16B, V0.16B
 	eor	V8.16B, V8.16B, V12.16B
 	eor	V9.16B, V9.16B, V13.16B
-	ushr	V12.16B, V4.16B, #6
-	ushr	V13.16B, V5.16B, #6
-	shl	V0.16B, V4.16B, #2
-	shl	V1.16B, V5.16B, #2
-	pmul	V12.16B, V12.16B, V10.16B
-	pmul	V13.16B, V13.16B, V10.16B
-	eor	V12.16B, V12.16B, V0.16B
-	eor	V13.16B, V13.16B, V1.16B
-	ushr	V0.16B, V4.16B, #5
-	ushr	V1.16B, V5.16B, #5
-	pmul	V0.16B, V0.16B, V10.16B
-	pmul	V1.16B, V1.16B, V10.16B
-	shl	V10.16B, V4.16B, #3
-	shl	V11.16B, V5.16B, #3
-	eor	V0.16B, V0.16B, V10.16B
-	eor	V1.16B, V1.16B, V11.16B
-	eor	V10.16B, V8.16B, V0.16B
-	eor	V11.16B, V9.16B, V1.16B
-	eor	V0.16B, V0.16B, V4.16B
-	eor	V1.16B, V1.16B, V5.16B
-	eor	V8.16B, V12.16B, V0.16B
-	eor	V9.16B, V13.16B, V1.16B
-	eor	V12.16B, V12.16B, V10.16B
-	eor	V13.16B, V13.16B, V11.16B
-	eor	V10.16B, V10.16B, V4.16B
-	eor	V11.16B, V11.16B, V5.16B
-	shl	V4.4S, V10.4S, #8
-	shl	V5.4S, V11.4S, #8
-	rev32	V8.8H, V8.8H
-	rev32	V9.8H, V9.8H
-	sri	V4.4S, V10.4S, #24
-	sri	V5.4S, V11.4S, #24
-	eor	V4.16B, V4.16B, V12.16B
-	eor	V5.16B, V5.16B, V13.16B
-	shl	V10.4S, V0.4S, #24
-	shl	V11.4S, V1.4S, #24
+	eor	V10.16B, V10.16B, V14.16B
+	eor	V11.16B, V11.16B, V15.16B
+	eor	V0.16B, V8.16B, V4.16B
+	eor	V1.16B, V9.16B, V5.16B
+	eor	V2.16B, V10.16B, V6.16B
+	eor	V3.16B, V11.16B, V7.16B
+	shl	V12.4S, V0.4S, #8
+	shl	V13.4S, V1.4S, #8
+	shl	V14.4S, V2.4S, #8
+	shl	V15.4S, V3.4S, #8
+	sri	V12.4S, V0.4S, #24
+	sri	V13.4S, V1.4S, #24
+	sri	V14.4S, V2.4S, #24
+	sri	V15.4S, V3.4S, #24
+	shl	V0.4S, V4.4S, #24
+	shl	V1.4S, V5.4S, #24
+	shl	V2.4S, V6.4S, #24
+	shl	V3.4S, V7.4S, #24
+	sri	V0.4S, V4.4S, #8
+	sri	V1.4S, V5.4S, #8
+	sri	V2.4S, V6.4S, #8
+	sri	V3.4S, V7.4S, #8
+	rev32	V4.8H, V4.8H
+	rev32	V5.8H, V5.8H
+	rev32	V6.8H, V6.8H
+	rev32	V7.8H, V7.8H
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V1.16B
+	eor	V6.16B, V6.16B, V2.16B
+	eor	V7.16B, V7.16B, V3.16B
+	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x9], #16
 	eor	V4.16B, V4.16B, V8.16B
 	eor	V5.16B, V5.16B, V9.16B
-	sri	V10.4S, V0.4S, #8
-	sri	V11.4S, V1.4S, #8
-	eor	V4.16B, V4.16B, V10.16B
-	eor	V5.16B, V5.16B, V11.16B
-	;   XOR in Key Schedule
-	ld1	{V0.2D}, [x25], #16
+	eor	V6.16B, V6.16B, V10.16B
+	eor	V7.16B, V7.16B, V11.16B
 	eor	V4.16B, V4.16B, V0.16B
 	eor	V5.16B, V5.16B, V0.16B
+	eor	V6.16B, V6.16B, V0.16B
+	eor	V7.16B, V7.16B, V0.16B
+	eor	V4.16B, V4.16B, V12.16B
+	eor	V5.16B, V5.16B, V13.16B
+	eor	V6.16B, V6.16B, V14.16B
+	eor	V7.16B, V7.16B, V15.16B
 	; Round Done
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V6.16B
+	tbl	V3.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V7.16B
 	movi	V12.16B, #0x40
 	movi	V13.16B, #0x80
 	movi	V14.16B, #0xc0
 	eor	V8.16B, V4.16B, V12.16B
 	eor	V9.16B, V5.16B, V12.16B
-	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
-	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	eor	V10.16B, V6.16B, V12.16B
+	eor	V11.16B, V7.16B, V12.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
 	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	eor	V10.16B, V4.16B, V13.16B
-	eor	V11.16B, V5.16B, V13.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	eor	V8.16B, V4.16B, V13.16B
+	eor	V9.16B, V5.16B, V13.16B
+	eor	V10.16B, V6.16B, V13.16B
+	eor	V11.16B, V7.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
 	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
 	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
 	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
 	eor	V8.16B, V4.16B, V14.16B
 	eor	V9.16B, V5.16B, V14.16B
-	orr	V0.16B, V0.16B, V10.16B
-	orr	V1.16B, V1.16B, V11.16B
+	eor	V10.16B, V6.16B, V14.16B
+	eor	V11.16B, V7.16B, V14.16B
 	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
 	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
 	orr	V1.16B, V1.16B, V9.16B
-	ld1	{V4.16B}, [x23]
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	ld1	{V4.16B}, [x7]
 	tbl	V0.16B, {V0.16B}, V4.16B
 	tbl	V1.16B, {V1.16B}, V4.16B
-	movi	V10.16B, #27
+	tbl	V2.16B, {V2.16B}, V4.16B
+	tbl	V3.16B, {V3.16B}, V4.16B
 	sshr	V8.16B, V0.16B, #7
 	sshr	V9.16B, V1.16B, #7
+	sshr	V10.16B, V2.16B, #7
+	sshr	V11.16B, V3.16B, #7
 	shl	V12.16B, V0.16B, #1
 	shl	V13.16B, V1.16B, #1
-	and	V8.16B, V8.16B, V10.16B
-	and	V9.16B, V9.16B, V10.16B
+	shl	V14.16B, V2.16B, #1
+	shl	V15.16B, V3.16B, #1
+	movi	V4.16B, #27
+	and	V8.16B, V8.16B, V4.16B
+	and	V9.16B, V9.16B, V4.16B
+	and	V10.16B, V10.16B, V4.16B
+	and	V11.16B, V11.16B, V4.16B
 	eor	V8.16B, V8.16B, V12.16B
 	eor	V9.16B, V9.16B, V13.16B
-	ushr	V12.16B, V0.16B, #6
-	ushr	V13.16B, V1.16B, #6
-	shl	V4.16B, V0.16B, #2
-	shl	V5.16B, V1.16B, #2
-	pmul	V12.16B, V12.16B, V10.16B
-	pmul	V13.16B, V13.16B, V10.16B
-	eor	V12.16B, V12.16B, V4.16B
-	eor	V13.16B, V13.16B, V5.16B
-	ushr	V4.16B, V0.16B, #5
-	ushr	V5.16B, V1.16B, #5
-	pmul	V4.16B, V4.16B, V10.16B
-	pmul	V5.16B, V5.16B, V10.16B
-	shl	V10.16B, V0.16B, #3
-	shl	V11.16B, V1.16B, #3
-	eor	V4.16B, V4.16B, V10.16B
-	eor	V5.16B, V5.16B, V11.16B
-	eor	V10.16B, V8.16B, V4.16B
-	eor	V11.16B, V9.16B, V5.16B
-	eor	V4.16B, V4.16B, V0.16B
-	eor	V5.16B, V5.16B, V1.16B
-	eor	V8.16B, V12.16B, V4.16B
-	eor	V9.16B, V13.16B, V5.16B
-	eor	V12.16B, V12.16B, V10.16B
-	eor	V13.16B, V13.16B, V11.16B
-	eor	V10.16B, V10.16B, V0.16B
-	eor	V11.16B, V11.16B, V1.16B
-	shl	V0.4S, V10.4S, #8
-	shl	V1.4S, V11.4S, #8
-	rev32	V8.8H, V8.8H
-	rev32	V9.8H, V9.8H
-	sri	V0.4S, V10.4S, #24
-	sri	V1.4S, V11.4S, #24
-	eor	V0.16B, V0.16B, V12.16B
-	eor	V1.16B, V1.16B, V13.16B
-	shl	V10.4S, V4.4S, #24
-	shl	V11.4S, V5.4S, #24
+	eor	V10.16B, V10.16B, V14.16B
+	eor	V11.16B, V11.16B, V15.16B
+	eor	V4.16B, V8.16B, V0.16B
+	eor	V5.16B, V9.16B, V1.16B
+	eor	V6.16B, V10.16B, V2.16B
+	eor	V7.16B, V11.16B, V3.16B
+	shl	V12.4S, V4.4S, #8
+	shl	V13.4S, V5.4S, #8
+	shl	V14.4S, V6.4S, #8
+	shl	V15.4S, V7.4S, #8
+	sri	V12.4S, V4.4S, #24
+	sri	V13.4S, V5.4S, #24
+	sri	V14.4S, V6.4S, #24
+	sri	V15.4S, V7.4S, #24
+	shl	V4.4S, V0.4S, #24
+	shl	V5.4S, V1.4S, #24
+	shl	V6.4S, V2.4S, #24
+	shl	V7.4S, V3.4S, #24
+	sri	V4.4S, V0.4S, #8
+	sri	V5.4S, V1.4S, #8
+	sri	V6.4S, V2.4S, #8
+	sri	V7.4S, V3.4S, #8
+	rev32	V0.8H, V0.8H
+	rev32	V1.8H, V1.8H
+	rev32	V2.8H, V2.8H
+	rev32	V3.8H, V3.8H
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V5.16B
+	eor	V2.16B, V2.16B, V6.16B
+	eor	V3.16B, V3.16B, V7.16B
+	;   XOR in Key Schedule
+	ld1	{V4.2D}, [x9], #16
 	eor	V0.16B, V0.16B, V8.16B
 	eor	V1.16B, V1.16B, V9.16B
-	sri	V10.4S, V4.4S, #8
-	sri	V11.4S, V5.4S, #8
-	eor	V0.16B, V0.16B, V10.16B
-	eor	V1.16B, V1.16B, V11.16B
-	;   XOR in Key Schedule
-	ld1	{V4.2D}, [x25], #16
+	eor	V2.16B, V2.16B, V10.16B
+	eor	V3.16B, V3.16B, V11.16B
 	eor	V0.16B, V0.16B, V4.16B
 	eor	V1.16B, V1.16B, V4.16B
+	eor	V2.16B, V2.16B, V4.16B
+	eor	V3.16B, V3.16B, V4.16B
+	eor	V0.16B, V0.16B, V12.16B
+	eor	V1.16B, V1.16B, V13.16B
+	eor	V2.16B, V2.16B, V14.16B
+	eor	V3.16B, V3.16B, V15.16B
 	; Round Done
-	subs	w24, w24, #2
-	bne	L_AES_XTS_decrypt_NEON_loop_nr_2
+	subs	w8, w8, #2
+	bne	L_AES_GCMSIV_ctr_neon_loop_nr_4
+	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	tbl	V6.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V2.16B
+	tbl	V7.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V3.16B
 	movi	V12.16B, #0x40
 	movi	V13.16B, #0x80
 	movi	V14.16B, #0xc0
 	eor	V8.16B, V0.16B, V12.16B
 	eor	V9.16B, V1.16B, V12.16B
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
-	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	eor	V10.16B, V2.16B, V12.16B
+	eor	V11.16B, V3.16B, V12.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
 	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	eor	V10.16B, V0.16B, V13.16B
-	eor	V11.16B, V1.16B, V13.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	eor	V8.16B, V0.16B, V13.16B
+	eor	V9.16B, V1.16B, V13.16B
+	eor	V10.16B, V2.16B, V13.16B
+	eor	V11.16B, V3.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
 	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
 	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
 	orr	V5.16B, V5.16B, V9.16B
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
 	eor	V8.16B, V0.16B, V14.16B
 	eor	V9.16B, V1.16B, V14.16B
-	orr	V4.16B, V4.16B, V10.16B
-	orr	V5.16B, V5.16B, V11.16B
+	eor	V10.16B, V2.16B, V14.16B
+	eor	V11.16B, V3.16B, V14.16B
 	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
 	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
 	orr	V5.16B, V5.16B, V9.16B
-	ld1	{V0.16B}, [x23]
+	orr	V6.16B, V6.16B, V10.16B
+	orr	V7.16B, V7.16B, V11.16B
+	ld1	{V0.16B}, [x7]
 	tbl	V4.16B, {V4.16B}, V0.16B
 	tbl	V5.16B, {V5.16B}, V0.16B
-	movi	V10.16B, #27
+	tbl	V6.16B, {V6.16B}, V0.16B
+	tbl	V7.16B, {V7.16B}, V0.16B
 	sshr	V8.16B, V4.16B, #7
 	sshr	V9.16B, V5.16B, #7
+	sshr	V10.16B, V6.16B, #7
+	sshr	V11.16B, V7.16B, #7
 	shl	V12.16B, V4.16B, #1
 	shl	V13.16B, V5.16B, #1
-	and	V8.16B, V8.16B, V10.16B
-	and	V9.16B, V9.16B, V10.16B
+	shl	V14.16B, V6.16B, #1
+	shl	V15.16B, V7.16B, #1
+	movi	V0.16B, #27
+	and	V8.16B, V8.16B, V0.16B
+	and	V9.16B, V9.16B, V0.16B
+	and	V10.16B, V10.16B, V0.16B
+	and	V11.16B, V11.16B, V0.16B
 	eor	V8.16B, V8.16B, V12.16B
 	eor	V9.16B, V9.16B, V13.16B
-	ushr	V12.16B, V4.16B, #6
-	ushr	V13.16B, V5.16B, #6
-	shl	V0.16B, V4.16B, #2
-	shl	V1.16B, V5.16B, #2
-	pmul	V12.16B, V12.16B, V10.16B
-	pmul	V13.16B, V13.16B, V10.16B
-	eor	V12.16B, V12.16B, V0.16B
-	eor	V13.16B, V13.16B, V1.16B
-	ushr	V0.16B, V4.16B, #5
-	ushr	V1.16B, V5.16B, #5
-	pmul	V0.16B, V0.16B, V10.16B
-	pmul	V1.16B, V1.16B, V10.16B
-	shl	V10.16B, V4.16B, #3
-	shl	V11.16B, V5.16B, #3
-	eor	V0.16B, V0.16B, V10.16B
-	eor	V1.16B, V1.16B, V11.16B
-	eor	V10.16B, V8.16B, V0.16B
-	eor	V11.16B, V9.16B, V1.16B
-	eor	V0.16B, V0.16B, V4.16B
-	eor	V1.16B, V1.16B, V5.16B
-	eor	V8.16B, V12.16B, V0.16B
-	eor	V9.16B, V13.16B, V1.16B
-	eor	V12.16B, V12.16B, V10.16B
-	eor	V13.16B, V13.16B, V11.16B
-	eor	V10.16B, V10.16B, V4.16B
-	eor	V11.16B, V11.16B, V5.16B
-	shl	V4.4S, V10.4S, #8
-	shl	V5.4S, V11.4S, #8
-	rev32	V8.8H, V8.8H
-	rev32	V9.8H, V9.8H
-	sri	V4.4S, V10.4S, #24
-	sri	V5.4S, V11.4S, #24
-	eor	V4.16B, V4.16B, V12.16B
-	eor	V5.16B, V5.16B, V13.16B
-	shl	V10.4S, V0.4S, #24
-	shl	V11.4S, V1.4S, #24
+	eor	V10.16B, V10.16B, V14.16B
+	eor	V11.16B, V11.16B, V15.16B
+	eor	V0.16B, V8.16B, V4.16B
+	eor	V1.16B, V9.16B, V5.16B
+	eor	V2.16B, V10.16B, V6.16B
+	eor	V3.16B, V11.16B, V7.16B
+	shl	V12.4S, V0.4S, #8
+	shl	V13.4S, V1.4S, #8
+	shl	V14.4S, V2.4S, #8
+	shl	V15.4S, V3.4S, #8
+	sri	V12.4S, V0.4S, #24
+	sri	V13.4S, V1.4S, #24
+	sri	V14.4S, V2.4S, #24
+	sri	V15.4S, V3.4S, #24
+	shl	V0.4S, V4.4S, #24
+	shl	V1.4S, V5.4S, #24
+	shl	V2.4S, V6.4S, #24
+	shl	V3.4S, V7.4S, #24
+	sri	V0.4S, V4.4S, #8
+	sri	V1.4S, V5.4S, #8
+	sri	V2.4S, V6.4S, #8
+	sri	V3.4S, V7.4S, #8
+	rev32	V4.8H, V4.8H
+	rev32	V5.8H, V5.8H
+	rev32	V6.8H, V6.8H
+	rev32	V7.8H, V7.8H
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V1.16B
+	eor	V6.16B, V6.16B, V2.16B
+	eor	V7.16B, V7.16B, V3.16B
+	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x9], #16
 	eor	V4.16B, V4.16B, V8.16B
 	eor	V5.16B, V5.16B, V9.16B
-	sri	V10.4S, V0.4S, #8
-	sri	V11.4S, V1.4S, #8
-	eor	V4.16B, V4.16B, V10.16B
-	eor	V5.16B, V5.16B, V11.16B
-	;   XOR in Key Schedule
-	ld1	{V0.2D}, [x25], #16
+	eor	V6.16B, V6.16B, V10.16B
+	eor	V7.16B, V7.16B, V11.16B
 	eor	V4.16B, V4.16B, V0.16B
 	eor	V5.16B, V5.16B, V0.16B
+	eor	V6.16B, V6.16B, V0.16B
+	eor	V7.16B, V7.16B, V0.16B
+	eor	V4.16B, V4.16B, V12.16B
+	eor	V5.16B, V5.16B, V13.16B
+	eor	V6.16B, V6.16B, V14.16B
+	eor	V7.16B, V7.16B, V15.16B
 	; Round Done
+	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	tbl	V2.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V6.16B
+	tbl	V3.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V7.16B
 	movi	V12.16B, #0x40
 	movi	V13.16B, #0x80
 	movi	V14.16B, #0xc0
 	eor	V8.16B, V4.16B, V12.16B
 	eor	V9.16B, V5.16B, V12.16B
-	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
-	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
+	eor	V10.16B, V6.16B, V12.16B
+	eor	V11.16B, V7.16B, V12.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
 	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
-	eor	V10.16B, V4.16B, V13.16B
-	eor	V11.16B, V5.16B, V13.16B
+	tbl	V10.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V10.16B
+	tbl	V11.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V11.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	eor	V8.16B, V4.16B, V13.16B
+	eor	V9.16B, V5.16B, V13.16B
+	eor	V10.16B, V6.16B, V13.16B
+	eor	V11.16B, V7.16B, V13.16B
+	tbl	V8.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V8.16B
+	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
 	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
 	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
 	orr	V1.16B, V1.16B, V9.16B
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
 	eor	V8.16B, V4.16B, V14.16B
 	eor	V9.16B, V5.16B, V14.16B
-	orr	V0.16B, V0.16B, V10.16B
-	orr	V1.16B, V1.16B, V11.16B
+	eor	V10.16B, V6.16B, V14.16B
+	eor	V11.16B, V7.16B, V14.16B
 	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
 	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V11.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
 	orr	V1.16B, V1.16B, V9.16B
-	ld1	{V4.16B}, [x23]
+	orr	V2.16B, V2.16B, V10.16B
+	orr	V3.16B, V3.16B, V11.16B
+	ld1	{V4.16B}, [x7]
 	tbl	V0.16B, {V0.16B}, V4.16B
 	tbl	V1.16B, {V1.16B}, V4.16B
+	tbl	V2.16B, {V2.16B}, V4.16B
+	tbl	V3.16B, {V3.16B}, V4.16B
 	;   XOR in Key Schedule
-	ld1	{V4.2D}, [x25], #16
+	ld1	{V4.2D}, [x9], #16
 	eor	V0.16B, V0.16B, V4.16B
 	eor	V1.16B, V1.16B, V4.16B
+	eor	V2.16B, V2.16B, V4.16B
+	eor	V3.16B, V3.16B, V4.16B
 	; Round Done
 	rev32	V0.16B, V0.16B
 	rev32	V1.16B, V1.16B
-	eor	V0.16B, V0.16B, V2.16B
-	eor	V1.16B, V1.16B, V3.16B
-	st1	{V0.16B, V1.16B}, [x1], #32
-	and	x16, x17, x11, asr 63
-	extr	x9, x11, x10, #63
-	eor	x8, x16, x10, lsl 1
-	sub	w2, w2, #32
-L_AES_XTS_decrypt_NEON_start_1
-	ld1	{V3.2D}, [x23]
-	mov	V2.D[0], x8
-	mov	V2.D[1], x9
-	cmp	w2, #16
-	blt	L_AES_XTS_decrypt_NEON_start_partial
-	mov	x25, x4
-	ld1	{V0.16B}, [x0], #16
-	ld1	{V4.2D}, [x25], #16
-	eor	V0.16B, V0.16B, V2.16B
-	rev32	V0.16B, V0.16B
-	eor	V0.16B, V0.16B, V4.16B
-	sub	w24, w7, #2
-L_AES_XTS_decrypt_NEON_loop_nr_1
-	eor	V8.16B, V0.16B, V12.16B
-	eor	V9.16B, V0.16B, V13.16B
-	eor	V10.16B, V0.16B, V14.16B
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
-	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V4.16B, V4.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V4.16B, V4.16B, V9.16B
-	tbl	V4.16B, {V4.16B}, V3.16B
-	sshr	V10.16B, V4.16B, #7
-	ushr	V11.16B, V4.16B, #6
-	ushr	V8.16B, V4.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
-	shl	V9.16B, V4.16B, #1
-	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V4.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V4.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V4.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V4.16B
-	shl	V4.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V4.4S, V9.4S, #24
-	eor	V4.16B, V4.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V4.16B, V4.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V4.16B, V4.16B, V9.16B
-	ld1	{V0.2D}, [x25], #16
-	;   XOR in Key Schedule
-	eor	V4.16B, V4.16B, V0.16B
-	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V4.16B, V13.16B
-	eor	V10.16B, V4.16B, V14.16B
-	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
-	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V0.16B, V0.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V0.16B, V0.16B, V9.16B
-	tbl	V0.16B, {V0.16B}, V3.16B
-	sshr	V10.16B, V0.16B, #7
-	ushr	V11.16B, V0.16B, #6
-	ushr	V8.16B, V0.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
-	shl	V9.16B, V0.16B, #1
-	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V0.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V0.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V0.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V0.16B
-	shl	V0.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V0.4S, V9.4S, #24
-	eor	V0.16B, V0.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V0.16B, V0.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V0.16B, V0.16B, V9.16B
-	ld1	{V4.2D}, [x25], #16
-	;   XOR in Key Schedule
-	eor	V0.16B, V0.16B, V4.16B
-	subs	w24, w24, #2
-	bne	L_AES_XTS_decrypt_NEON_loop_nr_1
-	eor	V8.16B, V0.16B, V12.16B
-	eor	V9.16B, V0.16B, V13.16B
-	eor	V10.16B, V0.16B, V14.16B
-	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
-	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V4.16B, V4.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V4.16B, V4.16B, V9.16B
-	tbl	V4.16B, {V4.16B}, V3.16B
-	sshr	V10.16B, V4.16B, #7
-	ushr	V11.16B, V4.16B, #6
-	ushr	V8.16B, V4.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
-	shl	V9.16B, V4.16B, #1
-	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V4.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V4.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V4.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V4.16B
-	shl	V4.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V4.4S, V9.4S, #24
-	eor	V4.16B, V4.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V4.16B, V4.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V4.16B, V4.16B, V9.16B
-	ld1	{V0.2D}, [x25], #16
-	;   XOR in Key Schedule
-	eor	V4.16B, V4.16B, V0.16B
-	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V4.16B, V13.16B
-	eor	V10.16B, V4.16B, V14.16B
-	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
-	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V0.16B, V0.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V0.16B, V0.16B, V9.16B
-	tbl	V0.16B, {V0.16B}, V3.16B
-	ld1	{V4.2D}, [x25], #16
-	;   XOR in Key Schedule
+	rev32	V2.16B, V2.16B
+	rev32	V3.16B, V3.16B
+	ld1	{V4.16B, V5.16B, V6.16B, V7.16B}, [x0], #0x40
 	eor	V0.16B, V0.16B, V4.16B
-	rev32	V0.16B, V0.16B
-	eor	V0.16B, V0.16B, V2.16B
-	st1	{V0.16B}, [x1], #16
-	sub	w2, w2, #16
-	cbz	w19, L_AES_XTS_decrypt_NEON_data_done
-	and	x16, x17, x9, asr 63
-	extr	x9, x9, x8, #63
-	eor	x8, x16, x8, lsl 1
-L_AES_XTS_decrypt_NEON_start_partial
-	mov	w2, w19
-	cbz	w2, L_AES_XTS_decrypt_NEON_data_done
-	mov	V2.D[0], x8
-	mov	V2.D[1], x9
-	and	x16, x17, x9, asr 63
-	extr	x11, x9, x8, #63
-	eor	x10, x16, x8, lsl 1
-	mov	V1.D[0], x10
-	mov	V1.D[1], x11
-	mov	x25, x4
-	ld1	{V0.16B}, [x0], #16
-	ld1	{V4.2D}, [x25], #16
-	eor	V0.16B, V0.16B, V1.16B
+	eor	V1.16B, V1.16B, V5.16B
+	eor	V2.16B, V2.16B, V6.16B
+	eor	V3.16B, V3.16B, V7.16B
+	st1	{V0.16B, V1.16B, V2.16B, V3.16B}, [x1], #0x40
+	sub	x2, x2, #0x40
+	cmp	x2, #0x40
+	bge	L_AES_GCMSIV_ctr_neon_loop_4
+L_AES_GCMSIV_ctr_neon_start_2
+	movi	V12.16B, #0x40
+	movi	V13.16B, #0x80
+	movi	V14.16B, #0xc0
+	movi	V15.16B, #27
+	cmp	x2, #16
+	beq	L_AES_GCMSIV_ctr_neon_start_1
+	blt	L_AES_GCMSIV_ctr_neon_data_done
+L_AES_GCMSIV_ctr_neon_loop_2
+	mov	x9, x3
+	ld1	{V4.2D}, [x9], #16
+	; Round: 0 - build counters and XOR in key schedule
+	ld1	{V0.2D}, [x5]
+	mov	V0.S[0], w10
 	rev32	V0.16B, V0.16B
 	eor	V0.16B, V0.16B, V4.16B
-	sub	w24, w7, #2
-L_AES_XTS_decrypt_NEON_loop_nr_partial_1
+	ld1	{V1.2D}, [x5]
+	add	w8, w10, #1
+	mov	V1.S[0], w8
+	rev32	V1.16B, V1.16B
+	eor	V1.16B, V1.16B, V4.16B
+	add	w10, w10, #2
+	sub	w8, w4, #2
+L_AES_GCMSIV_ctr_neon_loop_nr_2
 	eor	V8.16B, V0.16B, V12.16B
-	eor	V9.16B, V0.16B, V13.16B
-	eor	V10.16B, V0.16B, V14.16B
+	eor	V9.16B, V1.16B, V12.16B
 	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
-	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
-	orr	V4.16B, V4.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V4.16B, V4.16B, V9.16B
-	tbl	V4.16B, {V4.16B}, V3.16B
-	sshr	V10.16B, V4.16B, #7
-	ushr	V11.16B, V4.16B, #6
-	ushr	V8.16B, V4.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
-	shl	V9.16B, V4.16B, #1
-	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V4.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V4.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V4.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V4.16B
-	shl	V4.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V4.4S, V9.4S, #24
-	eor	V4.16B, V4.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V4.16B, V4.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V4.16B, V4.16B, V9.16B
-	ld1	{V0.2D}, [x25], #16
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
+	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	eor	V10.16B, V0.16B, V13.16B
+	eor	V11.16B, V1.16B, V13.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	eor	V8.16B, V0.16B, V14.16B
+	eor	V9.16B, V1.16B, V14.16B
+	orr	V4.16B, V4.16B, V10.16B
+	orr	V5.16B, V5.16B, V11.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	ld1	{V0.16B}, [x7]
+	tbl	V4.16B, {V4.16B}, V0.16B
+	tbl	V5.16B, {V5.16B}, V0.16B
+	sshr	V8.16B, V4.16B, #7
+	sshr	V9.16B, V5.16B, #7
+	shl	V10.16B, V4.16B, #1
+	shl	V11.16B, V5.16B, #1
+	and	V8.16B, V8.16B, V15.16B
+	and	V9.16B, V9.16B, V15.16B
+	eor	V8.16B, V8.16B, V10.16B
+	eor	V9.16B, V9.16B, V11.16B
+	eor	V0.16B, V8.16B, V4.16B
+	eor	V1.16B, V9.16B, V5.16B
+	shl	V10.4S, V0.4S, #8
+	shl	V11.4S, V1.4S, #8
+	sri	V10.4S, V0.4S, #24
+	sri	V11.4S, V1.4S, #24
+	shl	V0.4S, V4.4S, #24
+	shl	V1.4S, V5.4S, #24
+	sri	V0.4S, V4.4S, #8
+	sri	V1.4S, V5.4S, #8
+	rev32	V4.8H, V4.8H
+	rev32	V5.8H, V5.8H
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V1.16B
 	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x9], #16
+	eor	V4.16B, V4.16B, V8.16B
+	eor	V5.16B, V5.16B, V9.16B
 	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V0.16B
+	eor	V4.16B, V4.16B, V10.16B
+	eor	V5.16B, V5.16B, V11.16B
+	; Round Done
 	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V4.16B, V13.16B
-	eor	V10.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V12.16B
 	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	eor	V10.16B, V4.16B, V13.16B
+	eor	V11.16B, V5.16B, V13.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V0.16B, V0.16B, V9.16B
-	tbl	V0.16B, {V0.16B}, V3.16B
-	sshr	V10.16B, V0.16B, #7
-	ushr	V11.16B, V0.16B, #6
-	ushr	V8.16B, V0.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
-	shl	V9.16B, V0.16B, #1
-	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V0.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V0.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V0.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V0.16B
-	shl	V0.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V0.4S, V9.4S, #24
-	eor	V0.16B, V0.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V0.16B, V0.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V0.16B, V0.16B, V9.16B
-	ld1	{V4.2D}, [x25], #16
+	orr	V1.16B, V1.16B, V9.16B
+	eor	V8.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V14.16B
+	orr	V0.16B, V0.16B, V10.16B
+	orr	V1.16B, V1.16B, V11.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	ld1	{V4.16B}, [x7]
+	tbl	V0.16B, {V0.16B}, V4.16B
+	tbl	V1.16B, {V1.16B}, V4.16B
+	sshr	V8.16B, V0.16B, #7
+	sshr	V9.16B, V1.16B, #7
+	shl	V10.16B, V0.16B, #1
+	shl	V11.16B, V1.16B, #1
+	and	V8.16B, V8.16B, V15.16B
+	and	V9.16B, V9.16B, V15.16B
+	eor	V8.16B, V8.16B, V10.16B
+	eor	V9.16B, V9.16B, V11.16B
+	eor	V4.16B, V8.16B, V0.16B
+	eor	V5.16B, V9.16B, V1.16B
+	shl	V10.4S, V4.4S, #8
+	shl	V11.4S, V5.4S, #8
+	sri	V10.4S, V4.4S, #24
+	sri	V11.4S, V5.4S, #24
+	shl	V4.4S, V0.4S, #24
+	shl	V5.4S, V1.4S, #24
+	sri	V4.4S, V0.4S, #8
+	sri	V5.4S, V1.4S, #8
+	rev32	V0.8H, V0.8H
+	rev32	V1.8H, V1.8H
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V5.16B
 	;   XOR in Key Schedule
+	ld1	{V4.2D}, [x9], #16
+	eor	V0.16B, V0.16B, V8.16B
+	eor	V1.16B, V1.16B, V9.16B
 	eor	V0.16B, V0.16B, V4.16B
-	subs	w24, w24, #2
-	bne	L_AES_XTS_decrypt_NEON_loop_nr_partial_1
+	eor	V1.16B, V1.16B, V4.16B
+	eor	V0.16B, V0.16B, V10.16B
+	eor	V1.16B, V1.16B, V11.16B
+	; Round Done
+	subs	w8, w8, #2
+	bne	L_AES_GCMSIV_ctr_neon_loop_nr_2
 	eor	V8.16B, V0.16B, V12.16B
-	eor	V9.16B, V0.16B, V13.16B
-	eor	V10.16B, V0.16B, V14.16B
+	eor	V9.16B, V1.16B, V12.16B
 	tbl	V4.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V0.16B
+	tbl	V5.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V1.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	eor	V10.16B, V0.16B, V13.16B
+	eor	V11.16B, V1.16B, V13.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V4.16B, V4.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V4.16B, V4.16B, V9.16B
-	tbl	V4.16B, {V4.16B}, V3.16B
-	sshr	V10.16B, V4.16B, #7
-	ushr	V11.16B, V4.16B, #6
-	ushr	V8.16B, V4.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
-	shl	V9.16B, V4.16B, #1
-	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V4.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V4.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V4.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V4.16B
-	shl	V4.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V4.4S, V9.4S, #24
-	eor	V4.16B, V4.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V4.16B, V4.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V4.16B, V4.16B, V9.16B
-	ld1	{V0.2D}, [x25], #16
+	orr	V5.16B, V5.16B, V9.16B
+	eor	V8.16B, V0.16B, V14.16B
+	eor	V9.16B, V1.16B, V14.16B
+	orr	V4.16B, V4.16B, V10.16B
+	orr	V5.16B, V5.16B, V11.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	orr	V4.16B, V4.16B, V8.16B
+	orr	V5.16B, V5.16B, V9.16B
+	ld1	{V0.16B}, [x7]
+	tbl	V4.16B, {V4.16B}, V0.16B
+	tbl	V5.16B, {V5.16B}, V0.16B
+	sshr	V8.16B, V4.16B, #7
+	sshr	V9.16B, V5.16B, #7
+	shl	V10.16B, V4.16B, #1
+	shl	V11.16B, V5.16B, #1
+	and	V8.16B, V8.16B, V15.16B
+	and	V9.16B, V9.16B, V15.16B
+	eor	V8.16B, V8.16B, V10.16B
+	eor	V9.16B, V9.16B, V11.16B
+	eor	V0.16B, V8.16B, V4.16B
+	eor	V1.16B, V9.16B, V5.16B
+	shl	V10.4S, V0.4S, #8
+	shl	V11.4S, V1.4S, #8
+	sri	V10.4S, V0.4S, #24
+	sri	V11.4S, V1.4S, #24
+	shl	V0.4S, V4.4S, #24
+	shl	V1.4S, V5.4S, #24
+	sri	V0.4S, V4.4S, #8
+	sri	V1.4S, V5.4S, #8
+	rev32	V4.8H, V4.8H
+	rev32	V5.8H, V5.8H
+	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V1.16B
 	;   XOR in Key Schedule
+	ld1	{V0.2D}, [x9], #16
+	eor	V4.16B, V4.16B, V8.16B
+	eor	V5.16B, V5.16B, V9.16B
 	eor	V4.16B, V4.16B, V0.16B
+	eor	V5.16B, V5.16B, V0.16B
+	eor	V4.16B, V4.16B, V10.16B
+	eor	V5.16B, V5.16B, V11.16B
+	; Round Done
 	eor	V8.16B, V4.16B, V12.16B
-	eor	V9.16B, V4.16B, V13.16B
-	eor	V10.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V12.16B
 	tbl	V0.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V4.16B
+	tbl	V1.16B, {V16.16B, V17.16B, V18.16B, V19.16B}, V5.16B
 	tbl	V8.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V8.16B
-	tbl	V9.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V9.16B
-	tbl	V10.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V10.16B
+	tbl	V9.16B, {V20.16B, V21.16B, V22.16B, V23.16B}, V9.16B
+	eor	V10.16B, V4.16B, V13.16B
+	eor	V11.16B, V5.16B, V13.16B
+	tbl	V10.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V10.16B
+	tbl	V11.16B, {V24.16B, V25.16B, V26.16B, V27.16B}, V11.16B
 	orr	V0.16B, V0.16B, V8.16B
-	orr	V9.16B, V9.16B, V10.16B
-	orr	V0.16B, V0.16B, V9.16B
-	tbl	V0.16B, {V0.16B}, V3.16B
-	ld1	{V4.2D}, [x25], #16
-	;   XOR in Key Schedule
-	eor	V0.16B, V0.16B, V4.16B
-	rev32	V0.16B, V0.16B
-	eor	V0.16B, V0.16B, V1.16B
-	st1	{V0.2D}, [x6]
-	add	x1, x1, #16
-	mov	w16, w2
-L_AES_XTS_decrypt_NEON_start_byte
-	ldrb	w10, [x6]
-	ldrb	w11, [x0], #1
-	strb	w10, [x1], #1
-	strb	w11, [x6], #1
-	subs	w16, w16, #1
-	bgt	L_AES_XTS_decrypt_NEON_start_byte
-	sub	x1, x1, x2
-	sub	x6, x6, x2
-	sub	x1, x1, #16
-	mov	x25, x4
-	ld1	{V0.2D}, [x6]
-	ld1	{V4.2D}, [x25], #16
-	eor	V0.16B, V0.16B, V2.16B
+	orr	V1.16B, V1.16B, V9.16B
+	eor	V8.16B, V4.16B, V14.16B
+	eor	V9.16B, V5.16B, V14.16B
+	orr	V0.16B, V0.16B, V10.16B
+	orr	V1.16B, V1.16B, V11.16B
+	tbl	V8.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V8.16B
+	tbl	V9.16B, {V28.16B, V29.16B, V30.16B, V31.16B}, V9.16B
+	orr	V0.16B, V0.16B, V8.16B
+	orr	V1.16B, V1.16B, V9.16B
+	ld1	{V4.16B}, [x7]
+	tbl	V0.16B, {V0.16B}, V4.16B
+	tbl	V1.16B, {V1.16B}, V4.16B
+	;   XOR in Key Schedule
+	ld1	{V4.2D}, [x9], #16
+	eor	V0.16B, V0.16B, V4.16B
+	eor	V1.16B, V1.16B, V4.16B
+	; Round Done
 	rev32	V0.16B, V0.16B
+	rev32	V1.16B, V1.16B
+	ld1	{V4.16B, V5.16B}, [x0], #32
 	eor	V0.16B, V0.16B, V4.16B
-	sub	w24, w7, #2
-L_AES_XTS_decrypt_NEON_loop_nr_partial_2
+	eor	V1.16B, V1.16B, V5.16B
+	st1	{V0.16B, V1.16B}, [x1], #32
+	sub	x2, x2, #32
+	cmp	x2, #0
+	beq	L_AES_GCMSIV_ctr_neon_data_done
+L_AES_GCMSIV_ctr_neon_start_1
+	ld1	{V3.2D}, [x7]
+	mov	x9, x3
+	ld1	{V4.2D}, [x9], #16
+	; Round: 0 - build counter and XOR in key schedule
+	ld1	{V0.2D}, [x5]
+	mov	V0.S[0], w10
+	rev32	V0.16B, V0.16B
+	eor	V0.16B, V0.16B, V4.16B
+	add	w10, w10, #1
+	sub	w8, w4, #2
+L_AES_GCMSIV_ctr_neon_loop_nr_1
 	eor	V8.16B, V0.16B, V12.16B
 	eor	V9.16B, V0.16B, V13.16B
 	eor	V10.16B, V0.16B, V14.16B
@@ -50548,34 +52800,22 @@ L_AES_XTS_decrypt_NEON_loop_nr_partial_2
 	orr	V9.16B, V9.16B, V10.16B
 	orr	V4.16B, V4.16B, V9.16B
 	tbl	V4.16B, {V4.16B}, V3.16B
+	ld1	{V0.2D}, [x9], #16
 	sshr	V10.16B, V4.16B, #7
-	ushr	V11.16B, V4.16B, #6
-	ushr	V8.16B, V4.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
 	shl	V9.16B, V4.16B, #1
+	and	V10.16B, V10.16B, V15.16B
 	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V4.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V4.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V4.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V4.16B
-	shl	V4.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V4.4S, V9.4S, #24
-	eor	V4.16B, V4.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V4.16B, V4.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V4.16B, V4.16B, V9.16B
-	ld1	{V0.2D}, [x25], #16
+	rev32	V8.8H, V4.8H
+	eor	V11.16B, V10.16B, V4.16B
+	eor	V10.16B, V10.16B, V8.16B
+	shl	V9.4S, V4.4S, #24
+	shl	V8.4S, V11.4S, #8
 	;   XOR in Key Schedule
-	eor	V4.16B, V4.16B, V0.16B
+	eor	V10.16B, V10.16B, V0.16B
+	sri	V9.4S, V4.4S, #8
+	sri	V8.4S, V11.4S, #24
+	eor	V4.16B, V10.16B, V9.16B
+	eor	V4.16B, V4.16B, V8.16B
 	eor	V8.16B, V4.16B, V12.16B
 	eor	V9.16B, V4.16B, V13.16B
 	eor	V10.16B, V4.16B, V14.16B
@@ -50587,36 +52827,24 @@ L_AES_XTS_decrypt_NEON_loop_nr_partial_2
 	orr	V9.16B, V9.16B, V10.16B
 	orr	V0.16B, V0.16B, V9.16B
 	tbl	V0.16B, {V0.16B}, V3.16B
+	ld1	{V4.2D}, [x9], #16
 	sshr	V10.16B, V0.16B, #7
-	ushr	V11.16B, V0.16B, #6
-	ushr	V8.16B, V0.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
 	shl	V9.16B, V0.16B, #1
+	and	V10.16B, V10.16B, V15.16B
 	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V0.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V0.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V0.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V0.16B
-	shl	V0.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V0.4S, V9.4S, #24
-	eor	V0.16B, V0.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V0.16B, V0.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V0.16B, V0.16B, V9.16B
-	ld1	{V4.2D}, [x25], #16
+	rev32	V8.8H, V0.8H
+	eor	V11.16B, V10.16B, V0.16B
+	eor	V10.16B, V10.16B, V8.16B
+	shl	V9.4S, V0.4S, #24
+	shl	V8.4S, V11.4S, #8
 	;   XOR in Key Schedule
-	eor	V0.16B, V0.16B, V4.16B
-	subs	w24, w24, #2
-	bne	L_AES_XTS_decrypt_NEON_loop_nr_partial_2
+	eor	V10.16B, V10.16B, V4.16B
+	sri	V9.4S, V0.4S, #8
+	sri	V8.4S, V11.4S, #24
+	eor	V0.16B, V10.16B, V9.16B
+	eor	V0.16B, V0.16B, V8.16B
+	subs	w8, w8, #2
+	bne	L_AES_GCMSIV_ctr_neon_loop_nr_1
 	eor	V8.16B, V0.16B, V12.16B
 	eor	V9.16B, V0.16B, V13.16B
 	eor	V10.16B, V0.16B, V14.16B
@@ -50628,34 +52856,22 @@ L_AES_XTS_decrypt_NEON_loop_nr_partial_2
 	orr	V9.16B, V9.16B, V10.16B
 	orr	V4.16B, V4.16B, V9.16B
 	tbl	V4.16B, {V4.16B}, V3.16B
+	ld1	{V0.2D}, [x9], #16
 	sshr	V10.16B, V4.16B, #7
-	ushr	V11.16B, V4.16B, #6
-	ushr	V8.16B, V4.16B, #5
-	and	V10.16B, V10.16B, V15.16B
-	pmul	V11.16B, V11.16B, V15.16B
-	pmul	V8.16B, V8.16B, V15.16B
 	shl	V9.16B, V4.16B, #1
+	and	V10.16B, V10.16B, V15.16B
 	eor	V10.16B, V10.16B, V9.16B
-	shl	V9.16B, V4.16B, #3
-	eor	V8.16B, V8.16B, V9.16B
-	shl	V9.16B, V4.16B, #2
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V10.16B, V8.16B
-	eor	V8.16B, V8.16B, V4.16B
-	eor	V10.16B, V11.16B, V8.16B
-	eor	V11.16B, V11.16B, V9.16B
-	eor	V9.16B, V9.16B, V4.16B
-	shl	V4.4S, V9.4S, #8
-	rev32	V10.8H, V10.8H
-	sri	V4.4S, V9.4S, #24
-	eor	V4.16B, V4.16B, V11.16B
-	shl	V9.4S, V8.4S, #24
-	eor	V4.16B, V4.16B, V10.16B
-	sri	V9.4S, V8.4S, #8
-	eor	V4.16B, V4.16B, V9.16B
-	ld1	{V0.2D}, [x25], #16
+	rev32	V8.8H, V4.8H
+	eor	V11.16B, V10.16B, V4.16B
+	eor	V10.16B, V10.16B, V8.16B
+	shl	V9.4S, V4.4S, #24
+	shl	V8.4S, V11.4S, #8
 	;   XOR in Key Schedule
-	eor	V4.16B, V4.16B, V0.16B
+	eor	V10.16B, V10.16B, V0.16B
+	sri	V9.4S, V4.4S, #8
+	sri	V8.4S, V11.4S, #24
+	eor	V4.16B, V10.16B, V9.16B
+	eor	V4.16B, V4.16B, V8.16B
 	eor	V8.16B, V4.16B, V12.16B
 	eor	V9.16B, V4.16B, V13.16B
 	eor	V10.16B, V4.16B, V14.16B
@@ -50667,27 +52883,24 @@ L_AES_XTS_decrypt_NEON_loop_nr_partial_2
 	orr	V9.16B, V9.16B, V10.16B
 	orr	V0.16B, V0.16B, V9.16B
 	tbl	V0.16B, {V0.16B}, V3.16B
-	ld1	{V4.2D}, [x25], #16
+	ld1	{V4.2D}, [x9], #16
 	;   XOR in Key Schedule
 	eor	V0.16B, V0.16B, V4.16B
 	rev32	V0.16B, V0.16B
-	eor	V0.16B, V0.16B, V2.16B
-	st1	{V0.16B}, [x1]
-L_AES_XTS_decrypt_NEON_data_done
-	ldp	x17, x19, [x29, #16]
-	ldp	x20, x21, [x29, #32]
-	ldp	x22, x23, [x29, #48]
-	ldp	x24, x25, [x29, #64]
-	ldp	D8, D9, [x29, #80]
-	ldp	D10, D11, [x29, #96]
-	ldp	D12, D13, [x29, #112]
-	ldp	D14, D15, [x29, #128]
-	ldp	x29, x30, [sp], #0x90
+	ld1	{V4.16B}, [x0], #16
+	eor	V0.16B, V0.16B, V4.16B
+	st1	{V0.16B}, [x1], #16
+L_AES_GCMSIV_ctr_neon_data_done
+	str	w10, [x5]
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
 	ret
 	ENDP
 	ENDIF
 	ENDIF
-	ENDIF
 	IF :LNOT::DEF:WOLFSSL_ARMASM_NEON_NO_TABLE_LOOKUP
 	IF :DEF:HAVE_AES_DECRYPT
 	AREA	|.rodata|, DATA, READONLY, ALIGN=4
@@ -53785,122 +55998,419 @@ L_AES_GCM_encrypt_loop_nr
 	eor	w9, w9, w15, lsl 16
 	bfi	x7, x9, #32, #32
 	;   XOR in Key Schedule
-	eor	x6, x6, x10
-	eor	x7, x7, x11
-	rev32	x6, x6
-	rev32	x7, x7
-	ldr	x10, [x0]
-	ldr	x11, [x0, #8]
-	eor	x6, x6, x10
-	eor	x7, x7, x11
-	str	x6, [x1]
-	str	x7, [x1, #8]
-	subs	x2, x2, #16
-	add	x0, x0, #16
-	add	x1, x1, #16
-	bne	L_AES_GCM_encrypt_loop_block
-	rev32	x16, x16
-	rev32	x17, x17
-	stp	x16, x17, [x5]
-	ldp	x17, x19, [x29, #16]
-	ldp	x20, x21, [x29, #32]
-	ldp	x29, x30, [sp], #48
-	ret
-	ENDP
-	ENDIF
-	IF :DEF:WOLFSSL_AES_XTS
-	AREA	|.text|, CODE, READONLY
-	ALIGN	4
-	EXPORT	AES_XTS_encrypt
-AES_XTS_encrypt PROC
-	stp	x29, x30, [sp, #-96]!
-	add	x29, sp, #0
-	stp	x17, x19, [x29, #24]
-	stp	x20, x21, [x29, #40]
-	stp	x22, x23, [x29, #56]
-	stp	x24, x25, [x29, #72]
-	str	x26, [x29, #88]
-	adrp	x8, L_AES_ARM64_te
-	add	x8, x8, L_AES_ARM64_te
-	mov	x9, #0x87
-	mov	x26, x5
-	ldp	x21, x22, [x3]
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	rev32	x6, x6
+	rev32	x7, x7
+	ldr	x10, [x0]
+	ldr	x11, [x0, #8]
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	str	x6, [x1]
+	str	x7, [x1, #8]
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_GCM_encrypt_loop_block
+	rev32	x16, x16
+	rev32	x17, x17
+	stp	x16, x17, [x5]
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:WOLFSSL_AES_XTS
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_encrypt
+AES_XTS_encrypt PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	str	x26, [x29, #88]
+	adrp	x8, L_AES_ARM64_te
+	add	x8, x8, L_AES_ARM64_te
+	mov	x9, #0x87
+	mov	x26, x5
+	ldp	x21, x22, [x3]
+	ldp	x14, x15, [x26], #16
+	rev32	x21, x21
+	rev32	x22, x22
+	; Round: 0 - XOR in key schedule
+	eor	x21, x21, x14
+	eor	x22, x22, x15
+	sub	w25, w7, #2
+L_AES_XTS_encrypt_loop_nr_tweak
+	ubfx	x14, x21, #48, #8
+	ubfx	x17, x21, #24, #8
+	ubfx	x19, x22, #8, #8
+	ubfx	x20, x22, #32, #8
+	ldr	x23, [x8]
+	ldr	x23, [x8, #64]
+	ldr	x23, [x8, #128]
+	ldr	x23, [x8, #192]
+	ldr	x23, [x8, #256]
+	ldr	x23, [x8, #320]
+	ldr	x23, [x8, #384]
+	ldr	x23, [x8, #448]
+	ldr	x23, [x8, #512]
+	ldr	x23, [x8, #576]
+	ldr	x23, [x8, #640]
+	ldr	x23, [x8, #704]
+	ldr	x23, [x8, #768]
+	ldr	x23, [x8, #832]
+	ldr	x23, [x8, #896]
+	ldr	x23, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x22, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x21, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x22, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x21, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x22, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x22, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x21, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x21, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x23, x22, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x21, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x22, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x21, #40, #8
+	ldr	w23, [x8, x23, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w23, ror 24
+	ldp	x21, x22, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x21
+	eor	x15, x15, x22
+	ubfx	x21, x14, #48, #8
+	ubfx	x24, x14, #24, #8
+	ubfx	x19, x15, #8, #8
+	ubfx	x20, x15, #32, #8
+	ldr	x16, [x8]
+	ldr	x16, [x8, #64]
+	ldr	x16, [x8, #128]
+	ldr	x16, [x8, #192]
+	ldr	x16, [x8, #256]
+	ldr	x16, [x8, #320]
+	ldr	x16, [x8, #384]
+	ldr	x16, [x8, #448]
+	ldr	x16, [x8, #512]
+	ldr	x16, [x8, #576]
+	ldr	x16, [x8, #640]
+	ldr	x16, [x8, #704]
+	ldr	x16, [x8, #768]
+	ldr	x16, [x8, #832]
+	ldr	x16, [x8, #896]
+	ldr	x16, [x8, #960]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x22, x15, #16, #8
+	eor	w21, w21, w24, ror 24
+	ubfx	x24, x14, #56, #8
+	eor	w21, w21, w19, ror 8
+	ubfx	x19, x15, #40, #8
+	eor	w21, w21, w20, ror 16
+	ubfx	x20, x14, #0, #8
+	ldr	w22, [x8, x22, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x23, x15, #48, #8
+	eor	w22, w22, w24, ror 24
+	ubfx	x24, x15, #24, #8
+	eor	w22, w22, w19, ror 8
+	ubfx	x19, x14, #8, #8
+	eor	w22, w22, w20, ror 16
+	ubfx	x20, x14, #32, #8
+	bfi	x21, x22, #32, #32
+	ldr	w23, [x8, x23, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x15, #0, #8
+	eor	w23, w23, w24, ror 24
+	ubfx	x24, x14, #16, #8
+	eor	w23, w23, w19, ror 8
+	ubfx	x19, x15, #56, #8
+	eor	w22, w23, w20, ror 16
+	ubfx	x20, x14, #40, #8
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w16, ror 24
 	ldp	x14, x15, [x26], #16
+	eor	w24, w24, w19, ror 24
+	eor	w24, w24, w20, ror 8
+	bfi	x22, x24, #32, #32
+	;   XOR in Key Schedule
+	eor	x21, x21, x14
+	eor	x22, x22, x15
+	subs	w25, w25, #2
+	bne	L_AES_XTS_encrypt_loop_nr_tweak
+	ubfx	x14, x21, #48, #8
+	ubfx	x17, x21, #24, #8
+	ubfx	x19, x22, #8, #8
+	ubfx	x20, x22, #32, #8
+	ldr	x23, [x8]
+	ldr	x23, [x8, #64]
+	ldr	x23, [x8, #128]
+	ldr	x23, [x8, #192]
+	ldr	x23, [x8, #256]
+	ldr	x23, [x8, #320]
+	ldr	x23, [x8, #384]
+	ldr	x23, [x8, #448]
+	ldr	x23, [x8, #512]
+	ldr	x23, [x8, #576]
+	ldr	x23, [x8, #640]
+	ldr	x23, [x8, #704]
+	ldr	x23, [x8, #768]
+	ldr	x23, [x8, #832]
+	ldr	x23, [x8, #896]
+	ldr	x23, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x22, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x21, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x22, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x21, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x22, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x22, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x21, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x21, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x23, x22, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x21, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x22, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x21, #40, #8
+	ldr	w23, [x8, x23, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w23, ror 24
+	ldp	x21, x22, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x21
+	eor	x15, x15, x22
+	ubfx	x21, x15, #32, #8
+	ubfx	x24, x15, #8, #8
+	ubfx	x19, x14, #48, #8
+	ubfx	x20, x14, #24, #8
+	lsl	w21, w21, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldr	x17, [x8]
+	ldr	x17, [x8, #64]
+	ldr	x17, [x8, #128]
+	ldr	x17, [x8, #192]
+	ldr	x17, [x8, #256]
+	ldr	x17, [x8, #320]
+	ldr	x17, [x8, #384]
+	ldr	x17, [x8, #448]
+	ldr	x17, [x8, #512]
+	ldr	x17, [x8, #576]
+	ldr	x17, [x8, #640]
+	ldr	x17, [x8, #704]
+	ldr	x17, [x8, #768]
+	ldr	x17, [x8, #832]
+	ldr	x17, [x8, #896]
+	ldr	x17, [x8, #960]
+	ldrb	w21, [x8, x21, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x22, x14, #0, #8
+	eor	w21, w21, w24, lsl 8
+	ubfx	x24, x15, #40, #8
+	eor	w21, w21, w19, lsl 16
+	ubfx	x19, x15, #16, #8
+	eor	w21, w21, w20, lsl 24
+	ubfx	x20, x14, #56, #8
+	lsl	w22, w22, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w22, [x8, x22, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x23, x14, #32, #8
+	eor	w22, w22, w24, lsl 8
+	ubfx	x24, x14, #8, #8
+	eor	w22, w22, w19, lsl 16
+	ubfx	x19, x15, #48, #8
+	eor	w22, w22, w20, lsl 24
+	ubfx	x20, x15, #24, #8
+	bfi	x21, x22, #32, #32
+	lsl	w23, w23, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w23, [x8, x23, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x17, x15, #56, #8
+	eor	w23, w23, w24, lsl 8
+	ubfx	x24, x15, #0, #8
+	eor	w23, w23, w19, lsl 16
+	ubfx	x19, x14, #40, #8
+	eor	w22, w23, w20, lsl 24
+	ubfx	x20, x14, #16, #8
+	lsl	w17, w17, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w17, [x8, x17, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	eor	w19, w19, w17, lsl 16
+	ldp	x14, x15, [x26]
+	eor	w24, w24, w19, lsl 8
+	eor	w24, w24, w20, lsl 16
+	bfi	x22, x24, #32, #32
+	;   XOR in Key Schedule
+	eor	x21, x21, x14
+	eor	x22, x22, x15
 	rev32	x21, x21
 	rev32	x22, x22
+L_AES_XTS_encrypt_loop_block
+	mov	x26, x4
+	ldp	x10, x11, [x0]
+	ldp	x14, x15, [x26], #16
+	eor	x10, x10, x21
+	eor	x11, x11, x22
+	rev32	x10, x10
+	rev32	x11, x11
 	; Round: 0 - XOR in key schedule
-	eor	x21, x21, x14
-	eor	x22, x22, x15
+	eor	x10, x10, x14
+	eor	x11, x11, x15
 	sub	w25, w7, #2
-L_AES_XTS_encrypt_loop_nr_tweak
-	ubfx	x14, x21, #48, #8
-	ubfx	x17, x21, #24, #8
-	ubfx	x19, x22, #8, #8
-	ubfx	x20, x22, #32, #8
-	ldr	x23, [x8]
-	ldr	x23, [x8, #64]
-	ldr	x23, [x8, #128]
-	ldr	x23, [x8, #192]
-	ldr	x23, [x8, #256]
-	ldr	x23, [x8, #320]
-	ldr	x23, [x8, #384]
-	ldr	x23, [x8, #448]
-	ldr	x23, [x8, #512]
-	ldr	x23, [x8, #576]
-	ldr	x23, [x8, #640]
-	ldr	x23, [x8, #704]
-	ldr	x23, [x8, #768]
-	ldr	x23, [x8, #832]
-	ldr	x23, [x8, #896]
-	ldr	x23, [x8, #960]
+L_AES_XTS_encrypt_loop_nr
+	ubfx	x14, x10, #48, #8
+	ubfx	x17, x10, #24, #8
+	ubfx	x19, x11, #8, #8
+	ubfx	x20, x11, #32, #8
+	ldr	x12, [x8]
+	ldr	x12, [x8, #64]
+	ldr	x12, [x8, #128]
+	ldr	x12, [x8, #192]
+	ldr	x12, [x8, #256]
+	ldr	x12, [x8, #320]
+	ldr	x12, [x8, #384]
+	ldr	x12, [x8, #448]
+	ldr	x12, [x8, #512]
+	ldr	x12, [x8, #576]
+	ldr	x12, [x8, #640]
+	ldr	x12, [x8, #704]
+	ldr	x12, [x8, #768]
+	ldr	x12, [x8, #832]
+	ldr	x12, [x8, #896]
+	ldr	x12, [x8, #960]
 	ldr	w14, [x8, x14, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x15, x22, #16, #8
+	ubfx	x15, x11, #16, #8
 	eor	w14, w14, w17, ror 24
-	ubfx	x17, x21, #56, #8
+	ubfx	x17, x10, #56, #8
 	eor	w14, w14, w19, ror 8
-	ubfx	x19, x22, #40, #8
+	ubfx	x19, x11, #40, #8
 	eor	w14, w14, w20, ror 16
-	ubfx	x20, x21, #0, #8
+	ubfx	x20, x10, #0, #8
 	ldr	w15, [x8, x15, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x16, x22, #48, #8
+	ubfx	x16, x11, #48, #8
 	eor	w15, w15, w17, ror 24
-	ubfx	x17, x22, #24, #8
+	ubfx	x17, x11, #24, #8
 	eor	w15, w15, w19, ror 8
-	ubfx	x19, x21, #8, #8
+	ubfx	x19, x10, #8, #8
 	eor	w15, w15, w20, ror 16
-	ubfx	x20, x21, #32, #8
+	ubfx	x20, x10, #32, #8
 	bfi	x14, x15, #32, #32
 	ldr	w16, [x8, x16, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x23, x22, #0, #8
+	ubfx	x12, x11, #0, #8
 	eor	w16, w16, w17, ror 24
-	ubfx	x17, x21, #16, #8
+	ubfx	x17, x10, #16, #8
 	eor	w16, w16, w19, ror 8
-	ubfx	x19, x22, #56, #8
+	ubfx	x19, x11, #56, #8
 	eor	w15, w16, w20, ror 16
-	ubfx	x20, x21, #40, #8
-	ldr	w23, [x8, x23, LSL 2]
+	ubfx	x20, x10, #40, #8
+	ldr	w12, [x8, x12, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	eor	w19, w19, w23, ror 24
-	ldp	x21, x22, [x26], #16
+	eor	w19, w19, w12, ror 24
+	ldp	x10, x11, [x26], #16
 	eor	w17, w17, w19, ror 24
 	eor	w17, w17, w20, ror 8
 	bfi	x15, x17, #32, #32
 	;   XOR in Key Schedule
-	eor	x14, x14, x21
-	eor	x15, x15, x22
-	ubfx	x21, x14, #48, #8
-	ubfx	x24, x14, #24, #8
+	eor	x14, x14, x10
+	eor	x15, x15, x11
+	ubfx	x10, x14, #48, #8
+	ubfx	x13, x14, #24, #8
 	ubfx	x19, x15, #8, #8
 	ubfx	x20, x15, #32, #8
 	ldr	x16, [x8]
@@ -53919,126 +56429,126 @@ L_AES_XTS_encrypt_loop_nr_tweak
 	ldr	x16, [x8, #832]
 	ldr	x16, [x8, #896]
 	ldr	x16, [x8, #960]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w24, [x8, x24, LSL 2]
+	ldr	w10, [x8, x10, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x22, x15, #16, #8
-	eor	w21, w21, w24, ror 24
-	ubfx	x24, x14, #56, #8
-	eor	w21, w21, w19, ror 8
+	ubfx	x11, x15, #16, #8
+	eor	w10, w10, w13, ror 24
+	ubfx	x13, x14, #56, #8
+	eor	w10, w10, w19, ror 8
 	ubfx	x19, x15, #40, #8
-	eor	w21, w21, w20, ror 16
+	eor	w10, w10, w20, ror 16
 	ubfx	x20, x14, #0, #8
-	ldr	w22, [x8, x22, LSL 2]
-	ldr	w24, [x8, x24, LSL 2]
+	ldr	w11, [x8, x11, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x23, x15, #48, #8
-	eor	w22, w22, w24, ror 24
-	ubfx	x24, x15, #24, #8
-	eor	w22, w22, w19, ror 8
+	ubfx	x12, x15, #48, #8
+	eor	w11, w11, w13, ror 24
+	ubfx	x13, x15, #24, #8
+	eor	w11, w11, w19, ror 8
 	ubfx	x19, x14, #8, #8
-	eor	w22, w22, w20, ror 16
+	eor	w11, w11, w20, ror 16
 	ubfx	x20, x14, #32, #8
-	bfi	x21, x22, #32, #32
-	ldr	w23, [x8, x23, LSL 2]
-	ldr	w24, [x8, x24, LSL 2]
+	bfi	x10, x11, #32, #32
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
 	ubfx	x16, x15, #0, #8
-	eor	w23, w23, w24, ror 24
-	ubfx	x24, x14, #16, #8
-	eor	w23, w23, w19, ror 8
+	eor	w12, w12, w13, ror 24
+	ubfx	x13, x14, #16, #8
+	eor	w12, w12, w19, ror 8
 	ubfx	x19, x15, #56, #8
-	eor	w22, w23, w20, ror 16
+	eor	w11, w12, w20, ror 16
 	ubfx	x20, x14, #40, #8
 	ldr	w16, [x8, x16, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
-	ldr	w24, [x8, x24, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
 	eor	w19, w19, w16, ror 24
 	ldp	x14, x15, [x26], #16
-	eor	w24, w24, w19, ror 24
-	eor	w24, w24, w20, ror 8
-	bfi	x22, x24, #32, #32
+	eor	w13, w13, w19, ror 24
+	eor	w13, w13, w20, ror 8
+	bfi	x11, x13, #32, #32
 	;   XOR in Key Schedule
-	eor	x21, x21, x14
-	eor	x22, x22, x15
+	eor	x10, x10, x14
+	eor	x11, x11, x15
 	subs	w25, w25, #2
-	bne	L_AES_XTS_encrypt_loop_nr_tweak
-	ubfx	x14, x21, #48, #8
-	ubfx	x17, x21, #24, #8
-	ubfx	x19, x22, #8, #8
-	ubfx	x20, x22, #32, #8
-	ldr	x23, [x8]
-	ldr	x23, [x8, #64]
-	ldr	x23, [x8, #128]
-	ldr	x23, [x8, #192]
-	ldr	x23, [x8, #256]
-	ldr	x23, [x8, #320]
-	ldr	x23, [x8, #384]
-	ldr	x23, [x8, #448]
-	ldr	x23, [x8, #512]
-	ldr	x23, [x8, #576]
-	ldr	x23, [x8, #640]
-	ldr	x23, [x8, #704]
-	ldr	x23, [x8, #768]
-	ldr	x23, [x8, #832]
-	ldr	x23, [x8, #896]
-	ldr	x23, [x8, #960]
+	bne	L_AES_XTS_encrypt_loop_nr
+	ubfx	x14, x10, #48, #8
+	ubfx	x17, x10, #24, #8
+	ubfx	x19, x11, #8, #8
+	ubfx	x20, x11, #32, #8
+	ldr	x12, [x8]
+	ldr	x12, [x8, #64]
+	ldr	x12, [x8, #128]
+	ldr	x12, [x8, #192]
+	ldr	x12, [x8, #256]
+	ldr	x12, [x8, #320]
+	ldr	x12, [x8, #384]
+	ldr	x12, [x8, #448]
+	ldr	x12, [x8, #512]
+	ldr	x12, [x8, #576]
+	ldr	x12, [x8, #640]
+	ldr	x12, [x8, #704]
+	ldr	x12, [x8, #768]
+	ldr	x12, [x8, #832]
+	ldr	x12, [x8, #896]
+	ldr	x12, [x8, #960]
 	ldr	w14, [x8, x14, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x15, x22, #16, #8
+	ubfx	x15, x11, #16, #8
 	eor	w14, w14, w17, ror 24
-	ubfx	x17, x21, #56, #8
+	ubfx	x17, x10, #56, #8
 	eor	w14, w14, w19, ror 8
-	ubfx	x19, x22, #40, #8
+	ubfx	x19, x11, #40, #8
 	eor	w14, w14, w20, ror 16
-	ubfx	x20, x21, #0, #8
+	ubfx	x20, x10, #0, #8
 	ldr	w15, [x8, x15, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x16, x22, #48, #8
+	ubfx	x16, x11, #48, #8
 	eor	w15, w15, w17, ror 24
-	ubfx	x17, x22, #24, #8
+	ubfx	x17, x11, #24, #8
 	eor	w15, w15, w19, ror 8
-	ubfx	x19, x21, #8, #8
+	ubfx	x19, x10, #8, #8
 	eor	w15, w15, w20, ror 16
-	ubfx	x20, x21, #32, #8
+	ubfx	x20, x10, #32, #8
 	bfi	x14, x15, #32, #32
 	ldr	w16, [x8, x16, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x23, x22, #0, #8
+	ubfx	x12, x11, #0, #8
 	eor	w16, w16, w17, ror 24
-	ubfx	x17, x21, #16, #8
+	ubfx	x17, x10, #16, #8
 	eor	w16, w16, w19, ror 8
-	ubfx	x19, x22, #56, #8
+	ubfx	x19, x11, #56, #8
 	eor	w15, w16, w20, ror 16
-	ubfx	x20, x21, #40, #8
-	ldr	w23, [x8, x23, LSL 2]
+	ubfx	x20, x10, #40, #8
+	ldr	w12, [x8, x12, LSL 2]
 	ldr	w19, [x8, x19, LSL 2]
 	ldr	w17, [x8, x17, LSL 2]
 	ldr	w20, [x8, x20, LSL 2]
-	eor	w19, w19, w23, ror 24
-	ldp	x21, x22, [x26], #16
+	eor	w19, w19, w12, ror 24
+	ldp	x10, x11, [x26], #16
 	eor	w17, w17, w19, ror 24
 	eor	w17, w17, w20, ror 8
 	bfi	x15, x17, #32, #32
 	;   XOR in Key Schedule
-	eor	x14, x14, x21
-	eor	x15, x15, x22
-	ubfx	x21, x15, #32, #8
-	ubfx	x24, x15, #8, #8
+	eor	x14, x14, x10
+	eor	x15, x15, x11
+	ubfx	x10, x15, #32, #8
+	ubfx	x13, x15, #8, #8
 	ubfx	x19, x14, #48, #8
 	ubfx	x20, x14, #24, #8
-	lsl	w21, w21, #2
-	lsl	w24, w24, #2
+	lsl	w10, w10, #2
+	lsl	w13, w13, #2
 	lsl	w19, w19, #2
 	lsl	w20, w20, #2
 	ldr	x17, [x8]
@@ -54057,69 +56567,94 @@ L_AES_XTS_encrypt_loop_nr_tweak
 	ldr	x17, [x8, #832]
 	ldr	x17, [x8, #896]
 	ldr	x17, [x8, #960]
-	ldrb	w21, [x8, x21, LSL 0]
-	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w10, [x8, x10, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
 	ldrb	w19, [x8, x19, LSL 0]
-	ldrb	w20, [x8, x20, LSL 0]
-	ubfx	x22, x14, #0, #8
-	eor	w21, w21, w24, lsl 8
-	ubfx	x24, x15, #40, #8
-	eor	w21, w21, w19, lsl 16
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x11, x14, #0, #8
+	eor	w10, w10, w13, lsl 8
+	ubfx	x13, x15, #40, #8
+	eor	w10, w10, w19, lsl 16
 	ubfx	x19, x15, #16, #8
-	eor	w21, w21, w20, lsl 24
+	eor	w10, w10, w20, lsl 24
 	ubfx	x20, x14, #56, #8
-	lsl	w22, w22, #2
-	lsl	w24, w24, #2
+	lsl	w11, w11, #2
+	lsl	w13, w13, #2
 	lsl	w19, w19, #2
 	lsl	w20, w20, #2
-	ldrb	w22, [x8, x22, LSL 0]
-	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w11, [x8, x11, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
 	ldrb	w19, [x8, x19, LSL 0]
 	ldrb	w20, [x8, x20, LSL 0]
-	ubfx	x23, x14, #32, #8
-	eor	w22, w22, w24, lsl 8
-	ubfx	x24, x14, #8, #8
-	eor	w22, w22, w19, lsl 16
+	ubfx	x12, x14, #32, #8
+	eor	w11, w11, w13, lsl 8
+	ubfx	x13, x14, #8, #8
+	eor	w11, w11, w19, lsl 16
 	ubfx	x19, x15, #48, #8
-	eor	w22, w22, w20, lsl 24
+	eor	w11, w11, w20, lsl 24
 	ubfx	x20, x15, #24, #8
-	bfi	x21, x22, #32, #32
-	lsl	w23, w23, #2
-	lsl	w24, w24, #2
+	bfi	x10, x11, #32, #32
+	lsl	w12, w12, #2
+	lsl	w13, w13, #2
 	lsl	w19, w19, #2
 	lsl	w20, w20, #2
-	ldrb	w23, [x8, x23, LSL 0]
-	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w12, [x8, x12, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
 	ldrb	w19, [x8, x19, LSL 0]
 	ldrb	w20, [x8, x20, LSL 0]
 	ubfx	x17, x15, #56, #8
-	eor	w23, w23, w24, lsl 8
-	ubfx	x24, x15, #0, #8
-	eor	w23, w23, w19, lsl 16
+	eor	w12, w12, w13, lsl 8
+	ubfx	x13, x15, #0, #8
+	eor	w12, w12, w19, lsl 16
 	ubfx	x19, x14, #40, #8
-	eor	w22, w23, w20, lsl 24
+	eor	w11, w12, w20, lsl 24
 	ubfx	x20, x14, #16, #8
 	lsl	w17, w17, #2
-	lsl	w24, w24, #2
+	lsl	w13, w13, #2
 	lsl	w19, w19, #2
 	lsl	w20, w20, #2
 	ldrb	w17, [x8, x17, LSL 0]
-	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
 	ldrb	w19, [x8, x19, LSL 0]
 	ldrb	w20, [x8, x20, LSL 0]
 	eor	w19, w19, w17, lsl 16
 	ldp	x14, x15, [x26]
-	eor	w24, w24, w19, lsl 8
-	eor	w24, w24, w20, lsl 16
-	bfi	x22, x24, #32, #32
+	eor	w13, w13, w19, lsl 8
+	eor	w13, w13, w20, lsl 16
+	bfi	x11, x13, #32, #32
 	;   XOR in Key Schedule
-	eor	x21, x21, x14
-	eor	x22, x22, x15
-	rev32	x21, x21
-	rev32	x22, x22
-L_AES_XTS_encrypt_loop_block
+	eor	x10, x10, x14
+	eor	x11, x11, x15
+	rev32	x10, x10
+	rev32	x11, x11
+	eor	x10, x10, x21
+	eor	x11, x11, x22
+	stp	x10, x11, [x1]
+	and	x19, x9, x22, asr 63
+	extr	x22, x22, x21, #63
+	eor	x21, x19, x21, lsl 1
+	sub	w2, w2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	cmp	w2, #16
+	bge	L_AES_XTS_encrypt_loop_block
+	cbz	w2, L_AES_XTS_encrypt_done_data
 	mov	x26, x4
-	ldp	x10, x11, [x0]
+	sub	x1, x1, #16
+	ldp	x10, x11, [x1], #16
+	stp	x10, x11, [x6]
+	mov	w14, w2
+L_AES_XTS_encrypt_start_byte
+	ldrb	w19, [x6]
+	ldrb	w20, [x0], #1
+	strb	w19, [x1], #1
+	strb	w20, [x6], #1
+	subs	w14, w14, #1
+	bgt	L_AES_XTS_encrypt_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ldp	x10, x11, [x6]
 	ldp	x14, x15, [x26], #16
 	eor	x10, x10, x21
 	eor	x11, x11, x22
@@ -54129,7 +56664,7 @@ L_AES_XTS_encrypt_loop_block
 	eor	x10, x10, x14
 	eor	x11, x11, x15
 	sub	w25, w7, #2
-L_AES_XTS_encrypt_loop_nr
+L_AES_XTS_encrypt_loop_nr_partial
 	ubfx	x14, x10, #48, #8
 	ubfx	x17, x10, #24, #8
 	ubfx	x19, x11, #8, #8
@@ -54263,7 +56798,7 @@ L_AES_XTS_encrypt_loop_nr
 	eor	x10, x10, x14
 	eor	x11, x11, x15
 	subs	w25, w25, #2
-	bne	L_AES_XTS_encrypt_loop_nr
+	bne	L_AES_XTS_encrypt_loop_nr_partial
 	ubfx	x14, x10, #48, #8
 	ubfx	x17, x10, #24, #8
 	ubfx	x19, x11, #8, #8
@@ -54417,669 +56952,631 @@ L_AES_XTS_encrypt_loop_nr
 	eor	x10, x10, x21
 	eor	x11, x11, x22
 	stp	x10, x11, [x1]
-	and	x19, x9, x22, asr 63
-	extr	x22, x22, x21, #63
-	eor	x21, x19, x21, lsl 1
-	sub	w2, w2, #16
-	add	x0, x0, #16
-	add	x1, x1, #16
-	cmp	w2, #16
-	bge	L_AES_XTS_encrypt_loop_block
-	cbz	w2, L_AES_XTS_encrypt_done_data
-	mov	x26, x4
-	sub	x1, x1, #16
-	ldp	x10, x11, [x1], #16
-	stp	x10, x11, [x6]
-	mov	w14, w2
-L_AES_XTS_encrypt_start_byte
-	ldrb	w19, [x6]
-	ldrb	w20, [x0], #1
-	strb	w19, [x1], #1
-	strb	w20, [x6], #1
-	subs	w14, w14, #1
-	bgt	L_AES_XTS_encrypt_start_byte
-	sub	x1, x1, x2
-	sub	x6, x6, x2
-	sub	x1, x1, #16
-	ldp	x10, x11, [x6]
-	ldp	x14, x15, [x26], #16
-	eor	x10, x10, x21
-	eor	x11, x11, x22
-	rev32	x10, x10
-	rev32	x11, x11
+L_AES_XTS_encrypt_done_data
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldr	x26, [x29, #88]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_decrypt
+AES_XTS_decrypt PROC
+	stp	x29, x30, [sp, #-112]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	stp	x26, x27, [x29, #88]
+	str	x28, [x29, #104]
+	adrp	x8, L_AES_ARM64_td
+	add	x8, x8, L_AES_ARM64_td
+	adrp	x9, L_AES_ARM64_td4
+	add	x9, x9, L_AES_ARM64_td4
+	adrp	x10, L_AES_ARM64_te
+	add	x10, x10, L_AES_ARM64_te
+	ands	w11, w2, #15
+	cset	w11, ne
+	sub	w2, w2, w11, lsl 4
+	mov	x11, #0x87
+	mov	x28, x5
+	ldp	x23, x24, [x3]
+	ldp	x16, x17, [x28], #16
+	rev32	x23, x23
+	rev32	x24, x24
 	; Round: 0 - XOR in key schedule
-	eor	x10, x10, x14
-	eor	x11, x11, x15
-	sub	w25, w7, #2
-L_AES_XTS_encrypt_loop_nr_partial
-	ubfx	x14, x10, #48, #8
-	ubfx	x17, x10, #24, #8
-	ubfx	x19, x11, #8, #8
-	ubfx	x20, x11, #32, #8
-	ldr	x12, [x8]
-	ldr	x12, [x8, #64]
-	ldr	x12, [x8, #128]
-	ldr	x12, [x8, #192]
-	ldr	x12, [x8, #256]
-	ldr	x12, [x8, #320]
-	ldr	x12, [x8, #384]
-	ldr	x12, [x8, #448]
-	ldr	x12, [x8, #512]
-	ldr	x12, [x8, #576]
-	ldr	x12, [x8, #640]
-	ldr	x12, [x8, #704]
-	ldr	x12, [x8, #768]
-	ldr	x12, [x8, #832]
-	ldr	x12, [x8, #896]
-	ldr	x12, [x8, #960]
-	ldr	w14, [x8, x14, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x15, x11, #16, #8
-	eor	w14, w14, w17, ror 24
-	ubfx	x17, x10, #56, #8
-	eor	w14, w14, w19, ror 8
-	ubfx	x19, x11, #40, #8
-	eor	w14, w14, w20, ror 16
-	ubfx	x20, x10, #0, #8
-	ldr	w15, [x8, x15, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x16, x11, #48, #8
-	eor	w15, w15, w17, ror 24
-	ubfx	x17, x11, #24, #8
-	eor	w15, w15, w19, ror 8
-	ubfx	x19, x10, #8, #8
-	eor	w15, w15, w20, ror 16
-	ubfx	x20, x10, #32, #8
-	bfi	x14, x15, #32, #32
-	ldr	w16, [x8, x16, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x12, x11, #0, #8
-	eor	w16, w16, w17, ror 24
-	ubfx	x17, x10, #16, #8
-	eor	w16, w16, w19, ror 8
-	ubfx	x19, x11, #56, #8
-	eor	w15, w16, w20, ror 16
-	ubfx	x20, x10, #40, #8
-	ldr	w12, [x8, x12, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	eor	w19, w19, w12, ror 24
-	ldp	x10, x11, [x26], #16
-	eor	w17, w17, w19, ror 24
-	eor	w17, w17, w20, ror 8
-	bfi	x15, x17, #32, #32
+	eor	x23, x23, x16
+	eor	x24, x24, x17
+	sub	w27, w7, #2
+L_AES_XTS_decrypt_loop_nr_tweak
+	ubfx	x16, x23, #48, #8
+	ubfx	x20, x23, #24, #8
+	ubfx	x21, x24, #8, #8
+	ubfx	x22, x24, #32, #8
+	ldr	x25, [x10]
+	ldr	x25, [x10, #64]
+	ldr	x25, [x10, #128]
+	ldr	x25, [x10, #192]
+	ldr	x25, [x10, #256]
+	ldr	x25, [x10, #320]
+	ldr	x25, [x10, #384]
+	ldr	x25, [x10, #448]
+	ldr	x25, [x10, #512]
+	ldr	x25, [x10, #576]
+	ldr	x25, [x10, #640]
+	ldr	x25, [x10, #704]
+	ldr	x25, [x10, #768]
+	ldr	x25, [x10, #832]
+	ldr	x25, [x10, #896]
+	ldr	x25, [x10, #960]
+	ldr	w16, [x10, x16, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x17, x24, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x23, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x24, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x23, #0, #8
+	ldr	w17, [x10, x17, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x19, x24, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x24, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x23, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x23, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x10, x19, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x25, x24, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x23, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x24, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x23, #40, #8
+	ldr	w25, [x10, x25, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	eor	w21, w21, w25, ror 24
+	ldp	x23, x24, [x28], #16
+	eor	w20, w20, w21, ror 24
+	eor	w20, w20, w22, ror 8
+	bfi	x17, x20, #32, #32
 	;   XOR in Key Schedule
-	eor	x14, x14, x10
-	eor	x15, x15, x11
-	ubfx	x10, x14, #48, #8
-	ubfx	x13, x14, #24, #8
-	ubfx	x19, x15, #8, #8
-	ubfx	x20, x15, #32, #8
-	ldr	x16, [x8]
-	ldr	x16, [x8, #64]
-	ldr	x16, [x8, #128]
-	ldr	x16, [x8, #192]
-	ldr	x16, [x8, #256]
-	ldr	x16, [x8, #320]
-	ldr	x16, [x8, #384]
-	ldr	x16, [x8, #448]
-	ldr	x16, [x8, #512]
-	ldr	x16, [x8, #576]
-	ldr	x16, [x8, #640]
-	ldr	x16, [x8, #704]
-	ldr	x16, [x8, #768]
-	ldr	x16, [x8, #832]
-	ldr	x16, [x8, #896]
-	ldr	x16, [x8, #960]
-	ldr	w10, [x8, x10, LSL 2]
-	ldr	w13, [x8, x13, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x11, x15, #16, #8
-	eor	w10, w10, w13, ror 24
-	ubfx	x13, x14, #56, #8
-	eor	w10, w10, w19, ror 8
-	ubfx	x19, x15, #40, #8
-	eor	w10, w10, w20, ror 16
-	ubfx	x20, x14, #0, #8
-	ldr	w11, [x8, x11, LSL 2]
-	ldr	w13, [x8, x13, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x12, x15, #48, #8
-	eor	w11, w11, w13, ror 24
-	ubfx	x13, x15, #24, #8
-	eor	w11, w11, w19, ror 8
-	ubfx	x19, x14, #8, #8
-	eor	w11, w11, w20, ror 16
-	ubfx	x20, x14, #32, #8
-	bfi	x10, x11, #32, #32
-	ldr	w12, [x8, x12, LSL 2]
-	ldr	w13, [x8, x13, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x16, x15, #0, #8
-	eor	w12, w12, w13, ror 24
-	ubfx	x13, x14, #16, #8
-	eor	w12, w12, w19, ror 8
-	ubfx	x19, x15, #56, #8
-	eor	w11, w12, w20, ror 16
-	ubfx	x20, x14, #40, #8
-	ldr	w16, [x8, x16, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w13, [x8, x13, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	eor	w19, w19, w16, ror 24
-	ldp	x14, x15, [x26], #16
-	eor	w13, w13, w19, ror 24
-	eor	w13, w13, w20, ror 8
-	bfi	x11, x13, #32, #32
+	eor	x16, x16, x23
+	eor	x17, x17, x24
+	ubfx	x23, x16, #48, #8
+	ubfx	x26, x16, #24, #8
+	ubfx	x21, x17, #8, #8
+	ubfx	x22, x17, #32, #8
+	ldr	x19, [x10]
+	ldr	x19, [x10, #64]
+	ldr	x19, [x10, #128]
+	ldr	x19, [x10, #192]
+	ldr	x19, [x10, #256]
+	ldr	x19, [x10, #320]
+	ldr	x19, [x10, #384]
+	ldr	x19, [x10, #448]
+	ldr	x19, [x10, #512]
+	ldr	x19, [x10, #576]
+	ldr	x19, [x10, #640]
+	ldr	x19, [x10, #704]
+	ldr	x19, [x10, #768]
+	ldr	x19, [x10, #832]
+	ldr	x19, [x10, #896]
+	ldr	x19, [x10, #960]
+	ldr	w23, [x10, x23, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x24, x17, #16, #8
+	eor	w23, w23, w26, ror 24
+	ubfx	x26, x16, #56, #8
+	eor	w23, w23, w21, ror 8
+	ubfx	x21, x17, #40, #8
+	eor	w23, w23, w22, ror 16
+	ubfx	x22, x16, #0, #8
+	ldr	w24, [x10, x24, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x25, x17, #48, #8
+	eor	w24, w24, w26, ror 24
+	ubfx	x26, x17, #24, #8
+	eor	w24, w24, w21, ror 8
+	ubfx	x21, x16, #8, #8
+	eor	w24, w24, w22, ror 16
+	ubfx	x22, x16, #32, #8
+	bfi	x23, x24, #32, #32
+	ldr	w25, [x10, x25, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x19, x17, #0, #8
+	eor	w25, w25, w26, ror 24
+	ubfx	x26, x16, #16, #8
+	eor	w25, w25, w21, ror 8
+	ubfx	x21, x17, #56, #8
+	eor	w24, w25, w22, ror 16
+	ubfx	x22, x16, #40, #8
+	ldr	w19, [x10, x19, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	eor	w21, w21, w19, ror 24
+	ldp	x16, x17, [x28], #16
+	eor	w26, w26, w21, ror 24
+	eor	w26, w26, w22, ror 8
+	bfi	x24, x26, #32, #32
 	;   XOR in Key Schedule
-	eor	x10, x10, x14
-	eor	x11, x11, x15
-	subs	w25, w25, #2
-	bne	L_AES_XTS_encrypt_loop_nr_partial
-	ubfx	x14, x10, #48, #8
-	ubfx	x17, x10, #24, #8
-	ubfx	x19, x11, #8, #8
-	ubfx	x20, x11, #32, #8
-	ldr	x12, [x8]
-	ldr	x12, [x8, #64]
-	ldr	x12, [x8, #128]
-	ldr	x12, [x8, #192]
-	ldr	x12, [x8, #256]
-	ldr	x12, [x8, #320]
-	ldr	x12, [x8, #384]
-	ldr	x12, [x8, #448]
-	ldr	x12, [x8, #512]
-	ldr	x12, [x8, #576]
-	ldr	x12, [x8, #640]
-	ldr	x12, [x8, #704]
-	ldr	x12, [x8, #768]
-	ldr	x12, [x8, #832]
-	ldr	x12, [x8, #896]
-	ldr	x12, [x8, #960]
-	ldr	w14, [x8, x14, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x15, x11, #16, #8
-	eor	w14, w14, w17, ror 24
-	ubfx	x17, x10, #56, #8
-	eor	w14, w14, w19, ror 8
-	ubfx	x19, x11, #40, #8
-	eor	w14, w14, w20, ror 16
-	ubfx	x20, x10, #0, #8
-	ldr	w15, [x8, x15, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x16, x11, #48, #8
-	eor	w15, w15, w17, ror 24
-	ubfx	x17, x11, #24, #8
-	eor	w15, w15, w19, ror 8
-	ubfx	x19, x10, #8, #8
-	eor	w15, w15, w20, ror 16
-	ubfx	x20, x10, #32, #8
-	bfi	x14, x15, #32, #32
-	ldr	w16, [x8, x16, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ubfx	x12, x11, #0, #8
-	eor	w16, w16, w17, ror 24
-	ubfx	x17, x10, #16, #8
-	eor	w16, w16, w19, ror 8
-	ubfx	x19, x11, #56, #8
-	eor	w15, w16, w20, ror 16
-	ubfx	x20, x10, #40, #8
-	ldr	w12, [x8, x12, LSL 2]
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	eor	w19, w19, w12, ror 24
-	ldp	x10, x11, [x26], #16
-	eor	w17, w17, w19, ror 24
-	eor	w17, w17, w20, ror 8
-	bfi	x15, x17, #32, #32
+	eor	x23, x23, x16
+	eor	x24, x24, x17
+	subs	w27, w27, #2
+	bne	L_AES_XTS_decrypt_loop_nr_tweak
+	ubfx	x16, x23, #48, #8
+	ubfx	x20, x23, #24, #8
+	ubfx	x21, x24, #8, #8
+	ubfx	x22, x24, #32, #8
+	ldr	x25, [x10]
+	ldr	x25, [x10, #64]
+	ldr	x25, [x10, #128]
+	ldr	x25, [x10, #192]
+	ldr	x25, [x10, #256]
+	ldr	x25, [x10, #320]
+	ldr	x25, [x10, #384]
+	ldr	x25, [x10, #448]
+	ldr	x25, [x10, #512]
+	ldr	x25, [x10, #576]
+	ldr	x25, [x10, #640]
+	ldr	x25, [x10, #704]
+	ldr	x25, [x10, #768]
+	ldr	x25, [x10, #832]
+	ldr	x25, [x10, #896]
+	ldr	x25, [x10, #960]
+	ldr	w16, [x10, x16, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x17, x24, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x23, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x24, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x23, #0, #8
+	ldr	w17, [x10, x17, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x19, x24, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x24, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x23, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x23, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x10, x19, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x25, x24, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x23, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x24, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x23, #40, #8
+	ldr	w25, [x10, x25, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	eor	w21, w21, w25, ror 24
+	ldp	x23, x24, [x28], #16
+	eor	w20, w20, w21, ror 24
+	eor	w20, w20, w22, ror 8
+	bfi	x17, x20, #32, #32
 	;   XOR in Key Schedule
-	eor	x14, x14, x10
-	eor	x15, x15, x11
-	ubfx	x10, x15, #32, #8
-	ubfx	x13, x15, #8, #8
-	ubfx	x19, x14, #48, #8
-	ubfx	x20, x14, #24, #8
-	lsl	w10, w10, #2
-	lsl	w13, w13, #2
-	lsl	w19, w19, #2
-	lsl	w20, w20, #2
-	ldr	x17, [x8]
-	ldr	x17, [x8, #64]
-	ldr	x17, [x8, #128]
-	ldr	x17, [x8, #192]
-	ldr	x17, [x8, #256]
-	ldr	x17, [x8, #320]
-	ldr	x17, [x8, #384]
-	ldr	x17, [x8, #448]
-	ldr	x17, [x8, #512]
-	ldr	x17, [x8, #576]
-	ldr	x17, [x8, #640]
-	ldr	x17, [x8, #704]
-	ldr	x17, [x8, #768]
-	ldr	x17, [x8, #832]
-	ldr	x17, [x8, #896]
-	ldr	x17, [x8, #960]
-	ldrb	w10, [x8, x10, LSL 0]
-	ldrb	w13, [x8, x13, LSL 0]
-	ldrb	w19, [x8, x19, LSL 0]
-	ldrb	w20, [x8, x20, LSL 0]
-	ubfx	x11, x14, #0, #8
-	eor	w10, w10, w13, lsl 8
-	ubfx	x13, x15, #40, #8
-	eor	w10, w10, w19, lsl 16
-	ubfx	x19, x15, #16, #8
-	eor	w10, w10, w20, lsl 24
-	ubfx	x20, x14, #56, #8
-	lsl	w11, w11, #2
-	lsl	w13, w13, #2
-	lsl	w19, w19, #2
-	lsl	w20, w20, #2
-	ldrb	w11, [x8, x11, LSL 0]
-	ldrb	w13, [x8, x13, LSL 0]
-	ldrb	w19, [x8, x19, LSL 0]
-	ldrb	w20, [x8, x20, LSL 0]
-	ubfx	x12, x14, #32, #8
-	eor	w11, w11, w13, lsl 8
-	ubfx	x13, x14, #8, #8
-	eor	w11, w11, w19, lsl 16
-	ubfx	x19, x15, #48, #8
-	eor	w11, w11, w20, lsl 24
-	ubfx	x20, x15, #24, #8
-	bfi	x10, x11, #32, #32
-	lsl	w12, w12, #2
-	lsl	w13, w13, #2
-	lsl	w19, w19, #2
-	lsl	w20, w20, #2
-	ldrb	w12, [x8, x12, LSL 0]
-	ldrb	w13, [x8, x13, LSL 0]
-	ldrb	w19, [x8, x19, LSL 0]
-	ldrb	w20, [x8, x20, LSL 0]
-	ubfx	x17, x15, #56, #8
-	eor	w12, w12, w13, lsl 8
-	ubfx	x13, x15, #0, #8
-	eor	w12, w12, w19, lsl 16
-	ubfx	x19, x14, #40, #8
-	eor	w11, w12, w20, lsl 24
-	ubfx	x20, x14, #16, #8
-	lsl	w17, w17, #2
-	lsl	w13, w13, #2
-	lsl	w19, w19, #2
+	eor	x16, x16, x23
+	eor	x17, x17, x24
+	ubfx	x23, x17, #32, #8
+	ubfx	x26, x17, #8, #8
+	ubfx	x21, x16, #48, #8
+	ubfx	x22, x16, #24, #8
+	lsl	w23, w23, #2
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldr	x20, [x10]
+	ldr	x20, [x10, #64]
+	ldr	x20, [x10, #128]
+	ldr	x20, [x10, #192]
+	ldr	x20, [x10, #256]
+	ldr	x20, [x10, #320]
+	ldr	x20, [x10, #384]
+	ldr	x20, [x10, #448]
+	ldr	x20, [x10, #512]
+	ldr	x20, [x10, #576]
+	ldr	x20, [x10, #640]
+	ldr	x20, [x10, #704]
+	ldr	x20, [x10, #768]
+	ldr	x20, [x10, #832]
+	ldr	x20, [x10, #896]
+	ldr	x20, [x10, #960]
+	ldrb	w23, [x10, x23, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	ubfx	x24, x16, #0, #8
+	eor	w23, w23, w26, lsl 8
+	ubfx	x26, x17, #40, #8
+	eor	w23, w23, w21, lsl 16
+	ubfx	x21, x17, #16, #8
+	eor	w23, w23, w22, lsl 24
+	ubfx	x22, x16, #56, #8
+	lsl	w24, w24, #2
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldrb	w24, [x10, x24, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	ubfx	x25, x16, #32, #8
+	eor	w24, w24, w26, lsl 8
+	ubfx	x26, x16, #8, #8
+	eor	w24, w24, w21, lsl 16
+	ubfx	x21, x17, #48, #8
+	eor	w24, w24, w22, lsl 24
+	ubfx	x22, x17, #24, #8
+	bfi	x23, x24, #32, #32
+	lsl	w25, w25, #2
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldrb	w25, [x10, x25, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	ubfx	x20, x17, #56, #8
+	eor	w25, w25, w26, lsl 8
+	ubfx	x26, x17, #0, #8
+	eor	w25, w25, w21, lsl 16
+	ubfx	x21, x16, #40, #8
+	eor	w24, w25, w22, lsl 24
+	ubfx	x22, x16, #16, #8
 	lsl	w20, w20, #2
-	ldrb	w17, [x8, x17, LSL 0]
-	ldrb	w13, [x8, x13, LSL 0]
-	ldrb	w19, [x8, x19, LSL 0]
-	ldrb	w20, [x8, x20, LSL 0]
-	eor	w19, w19, w17, lsl 16
-	ldp	x14, x15, [x26]
-	eor	w13, w13, w19, lsl 8
-	eor	w13, w13, w20, lsl 16
-	bfi	x11, x13, #32, #32
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldrb	w20, [x10, x20, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	eor	w21, w21, w20, lsl 16
+	ldp	x16, x17, [x28]
+	eor	w26, w26, w21, lsl 8
+	eor	w26, w26, w22, lsl 16
+	bfi	x24, x26, #32, #32
 	;   XOR in Key Schedule
-	eor	x10, x10, x14
-	eor	x11, x11, x15
-	rev32	x10, x10
-	rev32	x11, x11
-	eor	x10, x10, x21
-	eor	x11, x11, x22
-	stp	x10, x11, [x1]
-L_AES_XTS_encrypt_done_data
-	ldp	x17, x19, [x29, #24]
-	ldp	x20, x21, [x29, #40]
-	ldp	x22, x23, [x29, #56]
-	ldp	x24, x25, [x29, #72]
-	ldr	x26, [x29, #88]
-	ldp	x29, x30, [sp], #0x60
-	ret
-	ENDP
-	IF :DEF:HAVE_AES_DECRYPT
-	AREA	|.text|, CODE, READONLY
-	ALIGN	4
-	EXPORT	AES_XTS_decrypt
-AES_XTS_decrypt PROC
-	stp	x29, x30, [sp, #-112]!
-	add	x29, sp, #0
-	stp	x17, x19, [x29, #24]
-	stp	x20, x21, [x29, #40]
-	stp	x22, x23, [x29, #56]
-	stp	x24, x25, [x29, #72]
-	stp	x26, x27, [x29, #88]
-	str	x28, [x29, #104]
-	adrp	x8, L_AES_ARM64_td
-	add	x8, x8, L_AES_ARM64_td
-	adrp	x9, L_AES_ARM64_td4
-	add	x9, x9, L_AES_ARM64_td4
-	adrp	x10, L_AES_ARM64_te
-	add	x10, x10, L_AES_ARM64_te
-	ands	w11, w2, #15
-	cset	w11, ne
-	sub	w2, w2, w11, lsl 4
-	mov	x11, #0x87
-	mov	x28, x5
-	ldp	x23, x24, [x3]
+	eor	x23, x23, x16
+	eor	x24, x24, x17
+	rev32	x23, x23
+	rev32	x24, x24
+	cmp	w2, #16
+	blt	L_AES_XTS_decrypt_start_partail
+L_AES_XTS_decrypt_loop_block
+	mov	x28, x4
+	ldp	x12, x13, [x0]
 	ldp	x16, x17, [x28], #16
-	rev32	x23, x23
-	rev32	x24, x24
+	eor	x12, x12, x23
+	eor	x13, x13, x24
+	rev32	x12, x12
+	rev32	x13, x13
 	; Round: 0 - XOR in key schedule
-	eor	x23, x23, x16
-	eor	x24, x24, x17
+	eor	x12, x12, x16
+	eor	x13, x13, x17
 	sub	w27, w7, #2
-L_AES_XTS_decrypt_loop_nr_tweak
-	ubfx	x16, x23, #48, #8
-	ubfx	x20, x23, #24, #8
-	ubfx	x21, x24, #8, #8
-	ubfx	x22, x24, #32, #8
-	ldr	x25, [x10]
-	ldr	x25, [x10, #64]
-	ldr	x25, [x10, #128]
-	ldr	x25, [x10, #192]
-	ldr	x25, [x10, #256]
-	ldr	x25, [x10, #320]
-	ldr	x25, [x10, #384]
-	ldr	x25, [x10, #448]
-	ldr	x25, [x10, #512]
-	ldr	x25, [x10, #576]
-	ldr	x25, [x10, #640]
-	ldr	x25, [x10, #704]
-	ldr	x25, [x10, #768]
-	ldr	x25, [x10, #832]
-	ldr	x25, [x10, #896]
-	ldr	x25, [x10, #960]
-	ldr	w16, [x10, x16, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x17, x24, #16, #8
+L_AES_XTS_decrypt_loop_nr
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
 	eor	w16, w16, w20, ror 24
-	ubfx	x20, x23, #56, #8
+	ubfx	x20, x12, #56, #8
 	eor	w16, w16, w21, ror 8
-	ubfx	x21, x24, #40, #8
+	ubfx	x21, x13, #40, #8
 	eor	w16, w16, w22, ror 16
-	ubfx	x22, x23, #0, #8
-	ldr	w17, [x10, x17, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x19, x24, #48, #8
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
 	eor	w17, w17, w20, ror 24
-	ubfx	x20, x24, #24, #8
+	ubfx	x20, x13, #24, #8
 	eor	w17, w17, w21, ror 8
-	ubfx	x21, x23, #8, #8
+	ubfx	x21, x12, #8, #8
 	eor	w17, w17, w22, ror 16
-	ubfx	x22, x23, #32, #8
+	ubfx	x22, x13, #32, #8
 	bfi	x16, x17, #32, #32
-	ldr	w19, [x10, x19, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x25, x24, #0, #8
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
 	eor	w19, w19, w20, ror 24
-	ubfx	x20, x23, #16, #8
+	ubfx	x20, x13, #16, #8
 	eor	w19, w19, w21, ror 8
-	ubfx	x21, x24, #56, #8
+	ubfx	x21, x13, #56, #8
 	eor	w17, w19, w22, ror 16
-	ubfx	x22, x23, #40, #8
-	ldr	w25, [x10, x25, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	eor	w21, w21, w25, ror 24
-	ldp	x23, x24, [x28], #16
-	eor	w20, w20, w21, ror 24
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
 	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
 	bfi	x17, x20, #32, #32
 	;   XOR in Key Schedule
-	eor	x16, x16, x23
-	eor	x17, x17, x24
-	ubfx	x23, x16, #48, #8
-	ubfx	x26, x16, #24, #8
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x17, #48, #8
+	ubfx	x15, x16, #24, #8
 	ubfx	x21, x17, #8, #8
-	ubfx	x22, x17, #32, #8
-	ldr	x19, [x10]
-	ldr	x19, [x10, #64]
-	ldr	x19, [x10, #128]
-	ldr	x19, [x10, #192]
-	ldr	x19, [x10, #256]
-	ldr	x19, [x10, #320]
-	ldr	x19, [x10, #384]
-	ldr	x19, [x10, #448]
-	ldr	x19, [x10, #512]
-	ldr	x19, [x10, #576]
-	ldr	x19, [x10, #640]
-	ldr	x19, [x10, #704]
-	ldr	x19, [x10, #768]
-	ldr	x19, [x10, #832]
-	ldr	x19, [x10, #896]
-	ldr	x19, [x10, #960]
-	ldr	w23, [x10, x23, LSL 2]
-	ldr	w26, [x10, x26, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x24, x17, #16, #8
-	eor	w23, w23, w26, ror 24
-	ubfx	x26, x16, #56, #8
-	eor	w23, w23, w21, ror 8
+	ubfx	x22, x16, #32, #8
+	ldr	x19, [x8]
+	ldr	x19, [x8, #64]
+	ldr	x19, [x8, #128]
+	ldr	x19, [x8, #192]
+	ldr	x19, [x8, #256]
+	ldr	x19, [x8, #320]
+	ldr	x19, [x8, #384]
+	ldr	x19, [x8, #448]
+	ldr	x19, [x8, #512]
+	ldr	x19, [x8, #576]
+	ldr	x19, [x8, #640]
+	ldr	x19, [x8, #704]
+	ldr	x19, [x8, #768]
+	ldr	x19, [x8, #832]
+	ldr	x19, [x8, #896]
+	ldr	x19, [x8, #960]
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x13, x16, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x16, #56, #8
+	eor	w12, w12, w21, ror 8
 	ubfx	x21, x17, #40, #8
-	eor	w23, w23, w22, ror 16
-	ubfx	x22, x16, #0, #8
-	ldr	w24, [x10, x24, LSL 2]
-	ldr	w26, [x10, x26, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x25, x17, #48, #8
-	eor	w24, w24, w26, ror 24
-	ubfx	x26, x17, #24, #8
-	eor	w24, w24, w21, ror 8
+	eor	w12, w12, w22, ror 16
+	ubfx	x22, x17, #0, #8
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x16, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x17, #24, #8
+	eor	w13, w13, w21, ror 8
 	ubfx	x21, x16, #8, #8
-	eor	w24, w24, w22, ror 16
-	ubfx	x22, x16, #32, #8
-	bfi	x23, x24, #32, #32
-	ldr	w25, [x10, x25, LSL 2]
-	ldr	w26, [x10, x26, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x19, x17, #0, #8
-	eor	w25, w25, w26, ror 24
-	ubfx	x26, x16, #16, #8
-	eor	w25, w25, w21, ror 8
+	eor	w13, w13, w22, ror 16
+	ubfx	x22, x17, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x16, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x17, #16, #8
+	eor	w14, w14, w21, ror 8
 	ubfx	x21, x17, #56, #8
-	eor	w24, w25, w22, ror 16
+	eor	w13, w14, w22, ror 16
 	ubfx	x22, x16, #40, #8
-	ldr	w19, [x10, x19, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w26, [x10, x26, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	eor	w21, w21, w19, ror 24
-	ldp	x16, x17, [x28], #16
-	eor	w26, w26, w21, ror 24
-	eor	w26, w26, w22, ror 8
-	bfi	x24, x26, #32, #32
-	;   XOR in Key Schedule
-	eor	x23, x23, x16
-	eor	x24, x24, x17
-	subs	w27, w27, #2
-	bne	L_AES_XTS_decrypt_loop_nr_tweak
-	ubfx	x16, x23, #48, #8
-	ubfx	x20, x23, #24, #8
-	ubfx	x21, x24, #8, #8
-	ubfx	x22, x24, #32, #8
-	ldr	x25, [x10]
-	ldr	x25, [x10, #64]
-	ldr	x25, [x10, #128]
-	ldr	x25, [x10, #192]
-	ldr	x25, [x10, #256]
-	ldr	x25, [x10, #320]
-	ldr	x25, [x10, #384]
-	ldr	x25, [x10, #448]
-	ldr	x25, [x10, #512]
-	ldr	x25, [x10, #576]
-	ldr	x25, [x10, #640]
-	ldr	x25, [x10, #704]
-	ldr	x25, [x10, #768]
-	ldr	x25, [x10, #832]
-	ldr	x25, [x10, #896]
-	ldr	x25, [x10, #960]
-	ldr	w16, [x10, x16, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x17, x24, #16, #8
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w19, ror 24
+	ldp	x16, x17, [x28], #16
+	eor	w15, w15, w22, ror 8
+	eor	w15, w15, w21, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	subs	w27, w27, #2
+	bne	L_AES_XTS_decrypt_loop_nr
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
 	eor	w16, w16, w20, ror 24
-	ubfx	x20, x23, #56, #8
+	ubfx	x20, x12, #56, #8
 	eor	w16, w16, w21, ror 8
-	ubfx	x21, x24, #40, #8
+	ubfx	x21, x13, #40, #8
 	eor	w16, w16, w22, ror 16
-	ubfx	x22, x23, #0, #8
-	ldr	w17, [x10, x17, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x19, x24, #48, #8
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
 	eor	w17, w17, w20, ror 24
-	ubfx	x20, x24, #24, #8
+	ubfx	x20, x13, #24, #8
 	eor	w17, w17, w21, ror 8
-	ubfx	x21, x23, #8, #8
+	ubfx	x21, x12, #8, #8
 	eor	w17, w17, w22, ror 16
-	ubfx	x22, x23, #32, #8
+	ubfx	x22, x13, #32, #8
 	bfi	x16, x17, #32, #32
-	ldr	w19, [x10, x19, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	ubfx	x25, x24, #0, #8
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
 	eor	w19, w19, w20, ror 24
-	ubfx	x20, x23, #16, #8
+	ubfx	x20, x13, #16, #8
 	eor	w19, w19, w21, ror 8
-	ubfx	x21, x24, #56, #8
+	ubfx	x21, x13, #56, #8
 	eor	w17, w19, w22, ror 16
-	ubfx	x22, x23, #40, #8
-	ldr	w25, [x10, x25, LSL 2]
-	ldr	w21, [x10, x21, LSL 2]
-	ldr	w20, [x10, x20, LSL 2]
-	ldr	w22, [x10, x22, LSL 2]
-	eor	w21, w21, w25, ror 24
-	ldp	x23, x24, [x28], #16
-	eor	w20, w20, w21, ror 24
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
 	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
 	bfi	x17, x20, #32, #32
 	;   XOR in Key Schedule
-	eor	x16, x16, x23
-	eor	x17, x17, x24
-	ubfx	x23, x17, #32, #8
-	ubfx	x26, x17, #8, #8
-	ubfx	x21, x16, #48, #8
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x16, #32, #8
+	ubfx	x15, x17, #8, #8
+	ubfx	x21, x17, #48, #8
 	ubfx	x22, x16, #24, #8
-	lsl	w23, w23, #2
-	lsl	w26, w26, #2
-	lsl	w21, w21, #2
-	lsl	w22, w22, #2
-	ldr	x20, [x10]
-	ldr	x20, [x10, #64]
-	ldr	x20, [x10, #128]
-	ldr	x20, [x10, #192]
-	ldr	x20, [x10, #256]
-	ldr	x20, [x10, #320]
-	ldr	x20, [x10, #384]
-	ldr	x20, [x10, #448]
-	ldr	x20, [x10, #512]
-	ldr	x20, [x10, #576]
-	ldr	x20, [x10, #640]
-	ldr	x20, [x10, #704]
-	ldr	x20, [x10, #768]
-	ldr	x20, [x10, #832]
-	ldr	x20, [x10, #896]
-	ldr	x20, [x10, #960]
-	ldrb	w23, [x10, x23, LSL 0]
-	ldrb	w26, [x10, x26, LSL 0]
-	ldrb	w21, [x10, x21, LSL 0]
-	ldrb	w22, [x10, x22, LSL 0]
-	ubfx	x24, x16, #0, #8
-	eor	w23, w23, w26, lsl 8
-	ubfx	x26, x17, #40, #8
-	eor	w23, w23, w21, lsl 16
-	ubfx	x21, x17, #16, #8
-	eor	w23, w23, w22, lsl 24
+	ldr	x20, [x9]
+	ldr	x20, [x9, #64]
+	ldr	x20, [x9, #128]
+	ldr	x20, [x9, #192]
+	ldrb	w12, [x9, x12, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ubfx	x13, x17, #0, #8
+	eor	w12, w12, w15, lsl 8
+	ubfx	x15, x17, #40, #8
+	eor	w12, w12, w21, lsl 16
+	ubfx	x21, x16, #16, #8
+	eor	w12, w12, w22, lsl 24
 	ubfx	x22, x16, #56, #8
-	lsl	w24, w24, #2
-	lsl	w26, w26, #2
-	lsl	w21, w21, #2
-	lsl	w22, w22, #2
-	ldrb	w24, [x10, x24, LSL 0]
-	ldrb	w26, [x10, x26, LSL 0]
-	ldrb	w21, [x10, x21, LSL 0]
-	ldrb	w22, [x10, x22, LSL 0]
-	ubfx	x25, x16, #32, #8
-	eor	w24, w24, w26, lsl 8
-	ubfx	x26, x16, #8, #8
-	eor	w24, w24, w21, lsl 16
-	ubfx	x21, x17, #48, #8
-	eor	w24, w24, w22, lsl 24
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w13, [x9, x13, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ubfx	x14, x17, #32, #8
+	eor	w13, w13, w15, lsl 8
+	ubfx	x15, x16, #8, #8
+	eor	w13, w13, w21, lsl 16
+	ubfx	x21, x16, #48, #8
+	eor	w13, w13, w22, lsl 24
 	ubfx	x22, x17, #24, #8
-	bfi	x23, x24, #32, #32
-	lsl	w25, w25, #2
-	lsl	w26, w26, #2
-	lsl	w21, w21, #2
-	lsl	w22, w22, #2
-	ldrb	w25, [x10, x25, LSL 0]
-	ldrb	w26, [x10, x26, LSL 0]
-	ldrb	w21, [x10, x21, LSL 0]
-	ldrb	w22, [x10, x22, LSL 0]
+	bfi	x12, x13, #32, #32
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w14, [x9, x14, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
 	ubfx	x20, x17, #56, #8
-	eor	w25, w25, w26, lsl 8
-	ubfx	x26, x17, #0, #8
-	eor	w25, w25, w21, lsl 16
+	eor	w14, w14, w15, lsl 8
+	ubfx	x15, x16, #0, #8
+	eor	w14, w14, w21, lsl 16
 	ubfx	x21, x16, #40, #8
-	eor	w24, w25, w22, lsl 24
-	ubfx	x22, x16, #16, #8
-	lsl	w20, w20, #2
-	lsl	w26, w26, #2
-	lsl	w21, w21, #2
-	lsl	w22, w22, #2
-	ldrb	w20, [x10, x20, LSL 0]
-	ldrb	w26, [x10, x26, LSL 0]
-	ldrb	w21, [x10, x21, LSL 0]
-	ldrb	w22, [x10, x22, LSL 0]
+	eor	w13, w14, w22, lsl 24
+	ubfx	x22, x17, #16, #8
+	ldrb	w20, [x9, x20, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
 	eor	w21, w21, w20, lsl 16
 	ldp	x16, x17, [x28]
-	eor	w26, w26, w21, lsl 8
-	eor	w26, w26, w22, lsl 16
-	bfi	x24, x26, #32, #32
+	eor	w15, w15, w21, lsl 8
+	eor	w15, w15, w22, lsl 16
+	bfi	x13, x15, #32, #32
 	;   XOR in Key Schedule
-	eor	x23, x23, x16
-	eor	x24, x24, x17
-	rev32	x23, x23
-	rev32	x24, x24
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	rev32	x12, x12
+	rev32	x13, x13
+	eor	x12, x12, x23
+	eor	x13, x13, x24
+	stp	x12, x13, [x1]
+	and	x21, x11, x24, asr 63
+	extr	x24, x24, x23, #63
+	eor	x23, x21, x23, lsl 1
+	sub	w2, w2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
 	cmp	w2, #16
-	blt	L_AES_XTS_decrypt_start_partail
-L_AES_XTS_decrypt_loop_block
+	bge	L_AES_XTS_decrypt_loop_block
+	cbz	w2, L_AES_XTS_decrypt_done_data
+L_AES_XTS_decrypt_start_partail
+	and	x21, x11, x24, asr 63
+	extr	x26, x24, x23, #63
+	eor	x25, x21, x23, lsl 1
 	mov	x28, x4
-	ldp	x12, x13, [x0]
+	ldp	x12, x13, [x0], #16
 	ldp	x16, x17, [x28], #16
-	eor	x12, x12, x23
-	eor	x13, x13, x24
+	eor	x12, x12, x25
+	eor	x13, x13, x26
 	rev32	x12, x12
 	rev32	x13, x13
 	; Round: 0 - XOR in key schedule
 	eor	x12, x12, x16
 	eor	x13, x13, x17
 	sub	w27, w7, #2
-L_AES_XTS_decrypt_loop_nr
+L_AES_XTS_decrypt_loop_nr_partial_1
 	ubfx	x16, x13, #48, #8
 	ubfx	x20, x12, #24, #8
 	ubfx	x21, x13, #8, #8
@@ -55213,7 +57710,7 @@ L_AES_XTS_decrypt_loop_nr
 	eor	x12, x12, x16
 	eor	x13, x13, x17
 	subs	w27, w27, #2
-	bne	L_AES_XTS_decrypt_loop_nr
+	bne	L_AES_XTS_decrypt_loop_nr_partial_1
 	ubfx	x16, x13, #48, #8
 	ubfx	x20, x12, #24, #8
 	ubfx	x21, x13, #8, #8
@@ -55334,36 +57831,35 @@ L_AES_XTS_decrypt_loop_nr
 	;   XOR in Key Schedule
 	eor	x12, x12, x16
 	eor	x13, x13, x17
-	rev32	x12, x12
-	rev32	x13, x13
-	eor	x12, x12, x23
-	eor	x13, x13, x24
-	stp	x12, x13, [x1]
-	and	x21, x11, x24, asr 63
-	extr	x24, x24, x23, #63
-	eor	x23, x21, x23, lsl 1
-	sub	w2, w2, #16
-	add	x0, x0, #16
+	rev32	x12, x12
+	rev32	x13, x13
+	eor	x12, x12, x25
+	eor	x13, x13, x26
+	stp	x12, x13, [x6]
 	add	x1, x1, #16
-	cmp	w2, #16
-	bge	L_AES_XTS_decrypt_loop_block
-	cbz	w2, L_AES_XTS_decrypt_done_data
-L_AES_XTS_decrypt_start_partail
-	and	x21, x11, x24, asr 63
-	extr	x26, x24, x23, #63
-	eor	x25, x21, x23, lsl 1
+	mov	w16, w2
+L_AES_XTS_decrypt_start_byte
+	ldrb	w21, [x6]
+	ldrb	w22, [x0], #1
+	strb	w21, [x1], #1
+	strb	w22, [x6], #1
+	subs	w16, w16, #1
+	bgt	L_AES_XTS_decrypt_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
 	mov	x28, x4
-	ldp	x12, x13, [x0], #16
+	ldp	x12, x13, [x6]
 	ldp	x16, x17, [x28], #16
-	eor	x12, x12, x25
-	eor	x13, x13, x26
+	eor	x12, x12, x23
+	eor	x13, x13, x24
 	rev32	x12, x12
 	rev32	x13, x13
 	; Round: 0 - XOR in key schedule
 	eor	x12, x12, x16
 	eor	x13, x13, x17
 	sub	w27, w7, #2
-L_AES_XTS_decrypt_loop_nr_partial_1
+L_AES_XTS_decrypt_loop_nr_partial_2
 	ubfx	x16, x13, #48, #8
 	ubfx	x20, x12, #24, #8
 	ubfx	x21, x13, #8, #8
@@ -55497,7 +57993,7 @@ L_AES_XTS_decrypt_loop_nr_partial_1
 	eor	x12, x12, x16
 	eor	x13, x13, x17
 	subs	w27, w27, #2
-	bne	L_AES_XTS_decrypt_loop_nr_partial_1
+	bne	L_AES_XTS_decrypt_loop_nr_partial_2
 	ubfx	x16, x13, #48, #8
 	ubfx	x20, x12, #24, #8
 	ubfx	x21, x13, #8, #8
@@ -55616,308 +58112,805 @@ L_AES_XTS_decrypt_loop_nr_partial_1
 	eor	w15, w15, w22, lsl 16
 	bfi	x13, x15, #32, #32
 	;   XOR in Key Schedule
-	eor	x12, x12, x16
-	eor	x13, x13, x17
-	rev32	x12, x12
-	rev32	x13, x13
-	eor	x12, x12, x25
-	eor	x13, x13, x26
-	stp	x12, x13, [x6]
-	add	x1, x1, #16
-	mov	w16, w2
-L_AES_XTS_decrypt_start_byte
-	ldrb	w21, [x6]
-	ldrb	w22, [x0], #1
-	strb	w21, [x1], #1
-	strb	w22, [x6], #1
-	subs	w16, w16, #1
-	bgt	L_AES_XTS_decrypt_start_byte
-	sub	x1, x1, x2
-	sub	x6, x6, x2
-	sub	x1, x1, #16
-	mov	x28, x4
-	ldp	x12, x13, [x6]
-	ldp	x16, x17, [x28], #16
-	eor	x12, x12, x23
-	eor	x13, x13, x24
-	rev32	x12, x12
-	rev32	x13, x13
-	; Round: 0 - XOR in key schedule
-	eor	x12, x12, x16
-	eor	x13, x13, x17
-	sub	w27, w7, #2
-L_AES_XTS_decrypt_loop_nr_partial_2
-	ubfx	x16, x13, #48, #8
-	ubfx	x20, x12, #24, #8
-	ubfx	x21, x13, #8, #8
-	ubfx	x22, x12, #32, #8
-	ldr	x14, [x8]
-	ldr	x14, [x8, #64]
-	ldr	x14, [x8, #128]
-	ldr	x14, [x8, #192]
-	ldr	x14, [x8, #256]
-	ldr	x14, [x8, #320]
-	ldr	x14, [x8, #384]
-	ldr	x14, [x8, #448]
-	ldr	x14, [x8, #512]
-	ldr	x14, [x8, #576]
-	ldr	x14, [x8, #640]
-	ldr	x14, [x8, #704]
-	ldr	x14, [x8, #768]
-	ldr	x14, [x8, #832]
-	ldr	x14, [x8, #896]
-	ldr	x14, [x8, #960]
-	ldr	w16, [x8, x16, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x17, x12, #16, #8
-	eor	w16, w16, w20, ror 24
-	ubfx	x20, x12, #56, #8
-	eor	w16, w16, w21, ror 8
-	ubfx	x21, x13, #40, #8
-	eor	w16, w16, w22, ror 16
-	ubfx	x22, x13, #0, #8
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x19, x12, #48, #8
-	eor	w17, w17, w20, ror 24
-	ubfx	x20, x13, #24, #8
-	eor	w17, w17, w21, ror 8
-	ubfx	x21, x12, #8, #8
-	eor	w17, w17, w22, ror 16
-	ubfx	x22, x13, #32, #8
-	bfi	x16, x17, #32, #32
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x14, x12, #0, #8
-	eor	w19, w19, w20, ror 24
-	ubfx	x20, x13, #16, #8
-	eor	w19, w19, w21, ror 8
-	ubfx	x21, x13, #56, #8
-	eor	w17, w19, w22, ror 16
-	ubfx	x22, x12, #40, #8
-	ldr	w14, [x8, x14, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	eor	w21, w21, w14, ror 24
-	ldp	x12, x13, [x28], #16
-	eor	w20, w20, w22, ror 8
-	eor	w20, w20, w21, ror 24
-	bfi	x17, x20, #32, #32
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	rev32	x12, x12
+	rev32	x13, x13
+	eor	x12, x12, x23
+	eor	x13, x13, x24
+	stp	x12, x13, [x1]
+L_AES_XTS_decrypt_done_data
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldp	x26, x27, [x29, #88]
+	ldr	x28, [x29, #104]
+	ldp	x29, x30, [sp], #0x70
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	IF :DEF:WOLFSSL_AESGCM_SIV
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	16
+L_AES_GCMSIV_polyval_base_r
+	DCQ	0x0000000000000000, 0x1c20000000000000
+	DCQ	0x3840000000000000, 0x2460000000000000
+	DCQ	0x7080000000000000, 0x6ca0000000000000
+	DCQ	0x48c0000000000000, 0x54e0000000000000
+	DCQ	0xe100000000000000, 0xfd20000000000000
+	DCQ	0xd940000000000000, 0xc560000000000000
+	DCQ	0x9180000000000000, 0x8da0000000000000
+	DCQ	0xa9c0000000000000, 0xb5e0000000000000
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCMSIV_polyval_base
+AES_GCMSIV_polyval_base PROC
+	adrp	x15, L_AES_GCMSIV_polyval_base_r
+	add	x15, x15, L_AES_GCMSIV_polyval_base_r
+	cbz	w3, L_AES_GCMSIV_polyval_base_done
+L_AES_GCMSIV_polyval_base_loop
+	ldp	x6, x7, [x2]
+	ldp	x4, x5, [x0]
+	rev	x6, x6
+	rev	x7, x7
+	eor	x4, x4, x7
+	eor	x5, x5, x6
+	eor	x8, x8, x8
+	eor	x9, x9, x9
+	ubfx	x12, x5, #56, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #60, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #48, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #52, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #40, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #44, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #32, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #36, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #24, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #28, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #16, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #20, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #8, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #12, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #0, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x5, #4, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #56, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #60, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #48, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #52, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #40, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #44, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #32, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #36, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #24, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #28, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #16, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #20, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #8, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #12, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #0, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	and	x13, x9, #15
+	lsr	x9, x9, #4
+	orr	x9, x9, x8, lsl 60
+	lsr	x8, x8, #4
+	ldr	x10, [x15, x13, LSL 3]
+	eor	x8, x8, x10
+	ubfx	x12, x4, #4, #4
+	add	x14, x1, x12, lsl 4
+	ldp	x10, x11, [x14]
+	eor	x8, x8, x10
+	eor	x9, x9, x11
+	rev	x8, x8
+	rev	x9, x9
+	stp	x8, x9, [x0]
+	subs	w3, w3, #1
+	add	x2, x2, #16
+	bne	L_AES_GCMSIV_polyval_base_loop
+L_AES_GCMSIV_polyval_base_done
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	8
+L_AES_GCMSIV_ctr_base_te
+	DCD	0xa5c66363, 0x84f87c7c, 0x99ee7777, 0x8df67b7b
+	DCD	0x0dfff2f2, 0xbdd66b6b, 0xb1de6f6f, 0x5491c5c5
+	DCD	0x50603030, 0x03020101, 0xa9ce6767, 0x7d562b2b
+	DCD	0x19e7fefe, 0x62b5d7d7, 0xe64dabab, 0x9aec7676
+	DCD	0x458fcaca, 0x9d1f8282, 0x4089c9c9, 0x87fa7d7d
+	DCD	0x15effafa, 0xebb25959, 0xc98e4747, 0x0bfbf0f0
+	DCD	0xec41adad, 0x67b3d4d4, 0xfd5fa2a2, 0xea45afaf
+	DCD	0xbf239c9c, 0xf753a4a4, 0x96e47272, 0x5b9bc0c0
+	DCD	0xc275b7b7, 0x1ce1fdfd, 0xae3d9393, 0x6a4c2626
+	DCD	0x5a6c3636, 0x417e3f3f, 0x02f5f7f7, 0x4f83cccc
+	DCD	0x5c683434, 0xf451a5a5, 0x34d1e5e5, 0x08f9f1f1
+	DCD	0x93e27171, 0x73abd8d8, 0x53623131, 0x3f2a1515
+	DCD	0x0c080404, 0x5295c7c7, 0x65462323, 0x5e9dc3c3
+	DCD	0x28301818, 0xa1379696, 0x0f0a0505, 0xb52f9a9a
+	DCD	0x090e0707, 0x36241212, 0x9b1b8080, 0x3ddfe2e2
+	DCD	0x26cdebeb, 0x694e2727, 0xcd7fb2b2, 0x9fea7575
+	DCD	0x1b120909, 0x9e1d8383, 0x74582c2c, 0x2e341a1a
+	DCD	0x2d361b1b, 0xb2dc6e6e, 0xeeb45a5a, 0xfb5ba0a0
+	DCD	0xf6a45252, 0x4d763b3b, 0x61b7d6d6, 0xce7db3b3
+	DCD	0x7b522929, 0x3edde3e3, 0x715e2f2f, 0x97138484
+	DCD	0xf5a65353, 0x68b9d1d1, 0x00000000, 0x2cc1eded
+	DCD	0x60402020, 0x1fe3fcfc, 0xc879b1b1, 0xedb65b5b
+	DCD	0xbed46a6a, 0x468dcbcb, 0xd967bebe, 0x4b723939
+	DCD	0xde944a4a, 0xd4984c4c, 0xe8b05858, 0x4a85cfcf
+	DCD	0x6bbbd0d0, 0x2ac5efef, 0xe54faaaa, 0x16edfbfb
+	DCD	0xc5864343, 0xd79a4d4d, 0x55663333, 0x94118585
+	DCD	0xcf8a4545, 0x10e9f9f9, 0x06040202, 0x81fe7f7f
+	DCD	0xf0a05050, 0x44783c3c, 0xba259f9f, 0xe34ba8a8
+	DCD	0xf3a25151, 0xfe5da3a3, 0xc0804040, 0x8a058f8f
+	DCD	0xad3f9292, 0xbc219d9d, 0x48703838, 0x04f1f5f5
+	DCD	0xdf63bcbc, 0xc177b6b6, 0x75afdada, 0x63422121
+	DCD	0x30201010, 0x1ae5ffff, 0x0efdf3f3, 0x6dbfd2d2
+	DCD	0x4c81cdcd, 0x14180c0c, 0x35261313, 0x2fc3ecec
+	DCD	0xe1be5f5f, 0xa2359797, 0xcc884444, 0x392e1717
+	DCD	0x5793c4c4, 0xf255a7a7, 0x82fc7e7e, 0x477a3d3d
+	DCD	0xacc86464, 0xe7ba5d5d, 0x2b321919, 0x95e67373
+	DCD	0xa0c06060, 0x98198181, 0xd19e4f4f, 0x7fa3dcdc
+	DCD	0x66442222, 0x7e542a2a, 0xab3b9090, 0x830b8888
+	DCD	0xca8c4646, 0x29c7eeee, 0xd36bb8b8, 0x3c281414
+	DCD	0x79a7dede, 0xe2bc5e5e, 0x1d160b0b, 0x76addbdb
+	DCD	0x3bdbe0e0, 0x56643232, 0x4e743a3a, 0x1e140a0a
+	DCD	0xdb924949, 0x0a0c0606, 0x6c482424, 0xe4b85c5c
+	DCD	0x5d9fc2c2, 0x6ebdd3d3, 0xef43acac, 0xa6c46262
+	DCD	0xa8399191, 0xa4319595, 0x37d3e4e4, 0x8bf27979
+	DCD	0x32d5e7e7, 0x438bc8c8, 0x596e3737, 0xb7da6d6d
+	DCD	0x8c018d8d, 0x64b1d5d5, 0xd29c4e4e, 0xe049a9a9
+	DCD	0xb4d86c6c, 0xfaac5656, 0x07f3f4f4, 0x25cfeaea
+	DCD	0xafca6565, 0x8ef47a7a, 0xe947aeae, 0x18100808
+	DCD	0xd56fbaba, 0x88f07878, 0x6f4a2525, 0x725c2e2e
+	DCD	0x24381c1c, 0xf157a6a6, 0xc773b4b4, 0x5197c6c6
+	DCD	0x23cbe8e8, 0x7ca1dddd, 0x9ce87474, 0x213e1f1f
+	DCD	0xdd964b4b, 0xdc61bdbd, 0x860d8b8b, 0x850f8a8a
+	DCD	0x90e07070, 0x427c3e3e, 0xc471b5b5, 0xaacc6666
+	DCD	0xd8904848, 0x05060303, 0x01f7f6f6, 0x121c0e0e
+	DCD	0xa3c26161, 0x5f6a3535, 0xf9ae5757, 0xd069b9b9
+	DCD	0x91178686, 0x5899c1c1, 0x273a1d1d, 0xb9279e9e
+	DCD	0x38d9e1e1, 0x13ebf8f8, 0xb32b9898, 0x33221111
+	DCD	0xbbd26969, 0x70a9d9d9, 0x89078e8e, 0xa7339494
+	DCD	0xb62d9b9b, 0x223c1e1e, 0x92158787, 0x20c9e9e9
+	DCD	0x4987cece, 0xffaa5555, 0x78502828, 0x7aa5dfdf
+	DCD	0x8f038c8c, 0xf859a1a1, 0x80098989, 0x171a0d0d
+	DCD	0xda65bfbf, 0x31d7e6e6, 0xc6844242, 0xb8d06868
+	DCD	0xc3824141, 0xb0299999, 0x775a2d2d, 0x111e0f0f
+	DCD	0xcb7bb0b0, 0xfca85454, 0xd66dbbbb, 0x3a2c1616
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCMSIV_ctr_base
+AES_GCMSIV_ctr_base PROC
+	stp	x29, x30, [sp, #-64]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	str	x22, [x29, #56]
+	adrp	x6, L_AES_GCMSIV_ctr_base_te
+	add	x6, x6, L_AES_GCMSIV_ctr_base_te
+	ldp	x15, x16, [x5]
+	mov	w17, w15
+	cbz	x2, L_AES_GCMSIV_ctr_base_done
+L_AES_GCMSIV_ctr_base_loop_block
+	mov	x22, x3
+	ldp	x11, x12, [x22], #16
+	; Round: 0 - set counter, XOR in key schedule
+	bfi	x15, x17, #0, #32
+	rev32	x7, x15
+	rev32	x8, x16
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	sub	w21, w4, #2
+L_AES_GCMSIV_ctr_base_loop_nr
+	ubfx	x11, x7, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x19, x8, #8, #8
+	ubfx	x20, x8, #32, #8
+	ldr	x9, [x6]
+	ldr	x9, [x6, #64]
+	ldr	x9, [x6, #128]
+	ldr	x9, [x6, #192]
+	ldr	x9, [x6, #256]
+	ldr	x9, [x6, #320]
+	ldr	x9, [x6, #384]
+	ldr	x9, [x6, #448]
+	ldr	x9, [x6, #512]
+	ldr	x9, [x6, #576]
+	ldr	x9, [x6, #640]
+	ldr	x9, [x6, #704]
+	ldr	x9, [x6, #768]
+	ldr	x9, [x6, #832]
+	ldr	x9, [x6, #896]
+	ldr	x9, [x6, #960]
+	ldr	w11, [x6, x11, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x12, x8, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w19, ror 8
+	ubfx	x19, x8, #40, #8
+	eor	w11, w11, w20, ror 16
+	ubfx	x20, x7, #0, #8
+	ldr	w12, [x6, x12, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x13, x8, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w19, ror 8
+	ubfx	x19, x7, #8, #8
+	eor	w12, w12, w20, ror 16
+	ubfx	x20, x7, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x9, x8, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x7, #16, #8
+	eor	w13, w13, w19, ror 8
+	ubfx	x19, x8, #56, #8
+	eor	w12, w13, w20, ror 16
+	ubfx	x20, x7, #40, #8
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	eor	w19, w19, w9, ror 24
+	ldp	x7, x8, [x22], #16
+	eor	w14, w14, w19, ror 24
+	eor	w14, w14, w20, ror 8
+	bfi	x12, x14, #32, #32
+	;   XOR in Key Schedule
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x11, #48, #8
+	ubfx	x10, x11, #24, #8
+	ubfx	x19, x12, #8, #8
+	ubfx	x20, x12, #32, #8
+	ldr	x13, [x6]
+	ldr	x13, [x6, #64]
+	ldr	x13, [x6, #128]
+	ldr	x13, [x6, #192]
+	ldr	x13, [x6, #256]
+	ldr	x13, [x6, #320]
+	ldr	x13, [x6, #384]
+	ldr	x13, [x6, #448]
+	ldr	x13, [x6, #512]
+	ldr	x13, [x6, #576]
+	ldr	x13, [x6, #640]
+	ldr	x13, [x6, #704]
+	ldr	x13, [x6, #768]
+	ldr	x13, [x6, #832]
+	ldr	x13, [x6, #896]
+	ldr	x13, [x6, #960]
+	ldr	w7, [x6, x7, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x8, x12, #16, #8
+	eor	w7, w7, w10, ror 24
+	ubfx	x10, x11, #56, #8
+	eor	w7, w7, w19, ror 8
+	ubfx	x19, x12, #40, #8
+	eor	w7, w7, w20, ror 16
+	ubfx	x20, x11, #0, #8
+	ldr	w8, [x6, x8, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x9, x12, #48, #8
+	eor	w8, w8, w10, ror 24
+	ubfx	x10, x12, #24, #8
+	eor	w8, w8, w19, ror 8
+	ubfx	x19, x11, #8, #8
+	eor	w8, w8, w20, ror 16
+	ubfx	x20, x11, #32, #8
+	bfi	x7, x8, #32, #32
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x13, x12, #0, #8
+	eor	w9, w9, w10, ror 24
+	ubfx	x10, x11, #16, #8
+	eor	w9, w9, w19, ror 8
+	ubfx	x19, x12, #56, #8
+	eor	w8, w9, w20, ror 16
+	ubfx	x20, x11, #40, #8
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	eor	w19, w19, w13, ror 24
+	ldp	x11, x12, [x22], #16
+	eor	w10, w10, w19, ror 24
+	eor	w10, w10, w20, ror 8
+	bfi	x8, x10, #32, #32
 	;   XOR in Key Schedule
-	eor	x16, x16, x12
-	eor	x17, x17, x13
-	ubfx	x12, x17, #48, #8
-	ubfx	x15, x16, #24, #8
-	ubfx	x21, x17, #8, #8
-	ubfx	x22, x16, #32, #8
-	ldr	x19, [x8]
-	ldr	x19, [x8, #64]
-	ldr	x19, [x8, #128]
-	ldr	x19, [x8, #192]
-	ldr	x19, [x8, #256]
-	ldr	x19, [x8, #320]
-	ldr	x19, [x8, #384]
-	ldr	x19, [x8, #448]
-	ldr	x19, [x8, #512]
-	ldr	x19, [x8, #576]
-	ldr	x19, [x8, #640]
-	ldr	x19, [x8, #704]
-	ldr	x19, [x8, #768]
-	ldr	x19, [x8, #832]
-	ldr	x19, [x8, #896]
-	ldr	x19, [x8, #960]
-	ldr	w12, [x8, x12, LSL 2]
-	ldr	w15, [x8, x15, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x13, x16, #16, #8
-	eor	w12, w12, w15, ror 24
-	ubfx	x15, x16, #56, #8
-	eor	w12, w12, w21, ror 8
-	ubfx	x21, x17, #40, #8
-	eor	w12, w12, w22, ror 16
-	ubfx	x22, x17, #0, #8
-	ldr	w13, [x8, x13, LSL 2]
-	ldr	w15, [x8, x15, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x14, x16, #48, #8
-	eor	w13, w13, w15, ror 24
-	ubfx	x15, x17, #24, #8
-	eor	w13, w13, w21, ror 8
-	ubfx	x21, x16, #8, #8
-	eor	w13, w13, w22, ror 16
-	ubfx	x22, x17, #32, #8
-	bfi	x12, x13, #32, #32
-	ldr	w14, [x8, x14, LSL 2]
-	ldr	w15, [x8, x15, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x19, x16, #0, #8
-	eor	w14, w14, w15, ror 24
-	ubfx	x15, x17, #16, #8
-	eor	w14, w14, w21, ror 8
-	ubfx	x21, x17, #56, #8
-	eor	w13, w14, w22, ror 16
-	ubfx	x22, x16, #40, #8
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w15, [x8, x15, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	eor	w21, w21, w19, ror 24
-	ldp	x16, x17, [x28], #16
-	eor	w15, w15, w22, ror 8
-	eor	w15, w15, w21, ror 24
-	bfi	x13, x15, #32, #32
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	subs	w21, w21, #2
+	bne	L_AES_GCMSIV_ctr_base_loop_nr
+	ubfx	x11, x7, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x19, x8, #8, #8
+	ubfx	x20, x8, #32, #8
+	ldr	x9, [x6]
+	ldr	x9, [x6, #64]
+	ldr	x9, [x6, #128]
+	ldr	x9, [x6, #192]
+	ldr	x9, [x6, #256]
+	ldr	x9, [x6, #320]
+	ldr	x9, [x6, #384]
+	ldr	x9, [x6, #448]
+	ldr	x9, [x6, #512]
+	ldr	x9, [x6, #576]
+	ldr	x9, [x6, #640]
+	ldr	x9, [x6, #704]
+	ldr	x9, [x6, #768]
+	ldr	x9, [x6, #832]
+	ldr	x9, [x6, #896]
+	ldr	x9, [x6, #960]
+	ldr	w11, [x6, x11, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x12, x8, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w19, ror 8
+	ubfx	x19, x8, #40, #8
+	eor	w11, w11, w20, ror 16
+	ubfx	x20, x7, #0, #8
+	ldr	w12, [x6, x12, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x13, x8, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w19, ror 8
+	ubfx	x19, x7, #8, #8
+	eor	w12, w12, w20, ror 16
+	ubfx	x20, x7, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	ubfx	x9, x8, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x7, #16, #8
+	eor	w13, w13, w19, ror 8
+	ubfx	x19, x8, #56, #8
+	eor	w12, w13, w20, ror 16
+	ubfx	x20, x7, #40, #8
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w20, [x6, x20, LSL 2]
+	eor	w19, w19, w9, ror 24
+	ldp	x7, x8, [x22], #16
+	eor	w14, w14, w19, ror 24
+	eor	w14, w14, w20, ror 8
+	bfi	x12, x14, #32, #32
 	;   XOR in Key Schedule
-	eor	x12, x12, x16
-	eor	x13, x13, x17
-	subs	w27, w27, #2
-	bne	L_AES_XTS_decrypt_loop_nr_partial_2
-	ubfx	x16, x13, #48, #8
-	ubfx	x20, x12, #24, #8
-	ubfx	x21, x13, #8, #8
-	ubfx	x22, x12, #32, #8
-	ldr	x14, [x8]
-	ldr	x14, [x8, #64]
-	ldr	x14, [x8, #128]
-	ldr	x14, [x8, #192]
-	ldr	x14, [x8, #256]
-	ldr	x14, [x8, #320]
-	ldr	x14, [x8, #384]
-	ldr	x14, [x8, #448]
-	ldr	x14, [x8, #512]
-	ldr	x14, [x8, #576]
-	ldr	x14, [x8, #640]
-	ldr	x14, [x8, #704]
-	ldr	x14, [x8, #768]
-	ldr	x14, [x8, #832]
-	ldr	x14, [x8, #896]
-	ldr	x14, [x8, #960]
-	ldr	w16, [x8, x16, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x17, x12, #16, #8
-	eor	w16, w16, w20, ror 24
-	ubfx	x20, x12, #56, #8
-	eor	w16, w16, w21, ror 8
-	ubfx	x21, x13, #40, #8
-	eor	w16, w16, w22, ror 16
-	ubfx	x22, x13, #0, #8
-	ldr	w17, [x8, x17, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x12, #32, #8
+	ubfx	x10, x12, #8, #8
+	ubfx	x19, x11, #48, #8
+	ubfx	x20, x11, #24, #8
+	lsl	w7, w7, #2
+	lsl	w10, w10, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldr	x14, [x6]
+	ldr	x14, [x6, #64]
+	ldr	x14, [x6, #128]
+	ldr	x14, [x6, #192]
+	ldr	x14, [x6, #256]
+	ldr	x14, [x6, #320]
+	ldr	x14, [x6, #384]
+	ldr	x14, [x6, #448]
+	ldr	x14, [x6, #512]
+	ldr	x14, [x6, #576]
+	ldr	x14, [x6, #640]
+	ldr	x14, [x6, #704]
+	ldr	x14, [x6, #768]
+	ldr	x14, [x6, #832]
+	ldr	x14, [x6, #896]
+	ldr	x14, [x6, #960]
+	ldrb	w7, [x6, x7, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	ldrb	w20, [x6, x20, LSL 0]
+	ubfx	x8, x11, #0, #8
+	eor	w7, w7, w10, lsl 8
+	ubfx	x10, x12, #40, #8
+	eor	w7, w7, w19, lsl 16
+	ubfx	x19, x12, #16, #8
+	eor	w7, w7, w20, lsl 24
+	ubfx	x20, x11, #56, #8
+	lsl	w8, w8, #2
+	lsl	w10, w10, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w8, [x6, x8, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	ldrb	w20, [x6, x20, LSL 0]
+	ubfx	x9, x11, #32, #8
+	eor	w8, w8, w10, lsl 8
+	ubfx	x10, x11, #8, #8
+	eor	w8, w8, w19, lsl 16
 	ubfx	x19, x12, #48, #8
-	eor	w17, w17, w20, ror 24
-	ubfx	x20, x13, #24, #8
-	eor	w17, w17, w21, ror 8
-	ubfx	x21, x12, #8, #8
-	eor	w17, w17, w22, ror 16
-	ubfx	x22, x13, #32, #8
-	bfi	x16, x17, #32, #32
-	ldr	w19, [x8, x19, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	ubfx	x14, x12, #0, #8
-	eor	w19, w19, w20, ror 24
-	ubfx	x20, x13, #16, #8
-	eor	w19, w19, w21, ror 8
-	ubfx	x21, x13, #56, #8
-	eor	w17, w19, w22, ror 16
-	ubfx	x22, x12, #40, #8
-	ldr	w14, [x8, x14, LSL 2]
-	ldr	w21, [x8, x21, LSL 2]
-	ldr	w20, [x8, x20, LSL 2]
-	ldr	w22, [x8, x22, LSL 2]
-	eor	w21, w21, w14, ror 24
-	ldp	x12, x13, [x28], #16
-	eor	w20, w20, w22, ror 8
-	eor	w20, w20, w21, ror 24
-	bfi	x17, x20, #32, #32
-	;   XOR in Key Schedule
-	eor	x16, x16, x12
-	eor	x17, x17, x13
-	ubfx	x12, x16, #32, #8
-	ubfx	x15, x17, #8, #8
-	ubfx	x21, x17, #48, #8
-	ubfx	x22, x16, #24, #8
-	ldr	x20, [x9]
-	ldr	x20, [x9, #64]
-	ldr	x20, [x9, #128]
-	ldr	x20, [x9, #192]
-	ldrb	w12, [x9, x12, LSL 0]
-	ldrb	w15, [x9, x15, LSL 0]
-	ldrb	w21, [x9, x21, LSL 0]
-	ldrb	w22, [x9, x22, LSL 0]
-	ubfx	x13, x17, #0, #8
-	eor	w12, w12, w15, lsl 8
-	ubfx	x15, x17, #40, #8
-	eor	w12, w12, w21, lsl 16
-	ubfx	x21, x16, #16, #8
-	eor	w12, w12, w22, lsl 24
-	ubfx	x22, x16, #56, #8
-	ldrb	w15, [x9, x15, LSL 0]
-	ldrb	w22, [x9, x22, LSL 0]
-	ldrb	w13, [x9, x13, LSL 0]
-	ldrb	w21, [x9, x21, LSL 0]
-	ubfx	x14, x17, #32, #8
-	eor	w13, w13, w15, lsl 8
-	ubfx	x15, x16, #8, #8
-	eor	w13, w13, w21, lsl 16
-	ubfx	x21, x16, #48, #8
-	eor	w13, w13, w22, lsl 24
-	ubfx	x22, x17, #24, #8
-	bfi	x12, x13, #32, #32
-	ldrb	w15, [x9, x15, LSL 0]
-	ldrb	w22, [x9, x22, LSL 0]
-	ldrb	w14, [x9, x14, LSL 0]
-	ldrb	w21, [x9, x21, LSL 0]
-	ubfx	x20, x17, #56, #8
-	eor	w14, w14, w15, lsl 8
-	ubfx	x15, x16, #0, #8
-	eor	w14, w14, w21, lsl 16
-	ubfx	x21, x16, #40, #8
-	eor	w13, w14, w22, lsl 24
-	ubfx	x22, x17, #16, #8
-	ldrb	w20, [x9, x20, LSL 0]
-	ldrb	w21, [x9, x21, LSL 0]
-	ldrb	w15, [x9, x15, LSL 0]
-	ldrb	w22, [x9, x22, LSL 0]
-	eor	w21, w21, w20, lsl 16
-	ldp	x16, x17, [x28]
-	eor	w15, w15, w21, lsl 8
-	eor	w15, w15, w22, lsl 16
-	bfi	x13, x15, #32, #32
+	eor	w8, w8, w20, lsl 24
+	ubfx	x20, x12, #24, #8
+	bfi	x7, x8, #32, #32
+	lsl	w9, w9, #2
+	lsl	w10, w10, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w9, [x6, x9, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	ldrb	w20, [x6, x20, LSL 0]
+	ubfx	x14, x12, #56, #8
+	eor	w9, w9, w10, lsl 8
+	ubfx	x10, x12, #0, #8
+	eor	w9, w9, w19, lsl 16
+	ubfx	x19, x11, #40, #8
+	eor	w8, w9, w20, lsl 24
+	ubfx	x20, x11, #16, #8
+	lsl	w14, w14, #2
+	lsl	w10, w10, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w14, [x6, x14, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	ldrb	w20, [x6, x20, LSL 0]
+	eor	w19, w19, w14, lsl 16
+	ldp	x11, x12, [x22]
+	eor	w10, w10, w19, lsl 8
+	eor	w10, w10, w20, lsl 16
+	bfi	x8, x10, #32, #32
 	;   XOR in Key Schedule
-	eor	x12, x12, x16
-	eor	x13, x13, x17
-	rev32	x12, x12
-	rev32	x13, x13
-	eor	x12, x12, x23
-	eor	x13, x13, x24
-	stp	x12, x13, [x1]
-L_AES_XTS_decrypt_done_data
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	rev32	x7, x7
+	rev32	x8, x8
+	ldr	x11, [x0]
+	ldr	x12, [x0, #8]
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	str	x7, [x1]
+	str	x8, [x1, #8]
+	add	w17, w17, #1
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_GCMSIV_ctr_base_loop_block
+L_AES_GCMSIV_ctr_base_done
+	bfi	x15, x17, #0, #32
+	stp	x15, x16, [x5]
 	ldp	x17, x19, [x29, #24]
 	ldp	x20, x21, [x29, #40]
-	ldp	x22, x23, [x29, #56]
-	ldp	x24, x25, [x29, #72]
-	ldp	x26, x27, [x29, #88]
-	ldr	x28, [x29, #104]
-	ldp	x29, x30, [sp], #0x70
+	ldr	x22, [x29, #56]
+	ldp	x29, x30, [sp], #0x40
 	ret
 	ENDP
 	ENDIF
 	ENDIF
 	ENDIF
-	ENDIF
 	END
diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm.S b/wolfcrypt/src/port/arm/armv8-frodokem-asm.S
new file mode 100644
index 00000000000..6f0fd9bb6ac
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm.S
@@ -0,0 +1,2347 @@
+/* armv8-frodokem-asm
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources_asm.h>
+
+/* Generated using (from wolfssl):
+ *   cd ../scripts
+ *   ruby ./frodokem/frodokem.rb arm64 \
+ *       ../wolfssl/wolfcrypt/src/port/arm/armv8-frodokem-asm.S
+ */
+#ifdef WOLFSSL_ARMASM
+#ifdef __aarch64__
+#ifndef WOLFSSL_ARMASM_INLINE
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifndef __APPLE__
+	.text
+	.section	.rodata
+	.type	L_sha3_aarch64_r, %object
+	.size	L_sha3_aarch64_r, 192
+#else
+	.section	__DATA,__data
+#endif /* __APPLE__ */
+	# 16-byte aligned, 128-bit aligned
+#ifndef __APPLE__
+	.align	4
+#else
+	.p2align	4
+#endif /* __APPLE__ */
+L_sha3_aarch64_r:
+	.quad	0x0000000000000001,0x0000000000008082
+	.quad	0x800000000000808a,0x8000000080008000
+	.quad	0x000000000000808b,0x0000000080000001
+	.quad	0x8000000080008081,0x8000000000008009
+	.quad	0x000000000000008a,0x0000000000000088
+	.quad	0x0000000080008009,0x000000008000000a
+	.quad	0x000000008000808b,0x800000000000008b
+	.quad	0x8000000000008089,0x8000000000008003
+	.quad	0x8000000000008002,0x8000000000000080
+	.quad	0x000000000000800a,0x800000008000000a
+	.quad	0x8000000080008081,0x8000000000008080
+	.quad	0x0000000080000001,0x8000000080008008
+#ifndef __APPLE__
+.text
+.globl	frodokem_sha3_x2_neon
+.type	frodokem_sha3_x2_neon,@function
+.align	2
+frodokem_sha3_x2_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sha3_x2_neon
+.p2align	2
+_frodokem_sha3_x2_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+#ifndef __APPLE__
+	adrp x1, L_sha3_aarch64_r
+	add  x1, x1, :lo12:L_sha3_aarch64_r
+#else
+	adrp x1, L_sha3_aarch64_r@PAGE
+	add  x1, x1, L_sha3_aarch64_r@PAGEOFF
+#endif /* __APPLE__ */
+	ld4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	ld1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	ld4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	ld1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	sub	x0, x0, #0x190
+	mov	x2, #24
+L_frodokem_sha3_x2_neon_begin:
+	# Col Mix NEON
+	eor	v30.16b, v4.16b, v9.16b
+	eor	v27.16b, v1.16b, v6.16b
+	eor	v30.16b, v30.16b, v14.16b
+	eor	v27.16b, v27.16b, v11.16b
+	eor	v30.16b, v30.16b, v19.16b
+	eor	v27.16b, v27.16b, v16.16b
+	eor	v30.16b, v30.16b, v24.16b
+	eor	v27.16b, v27.16b, v21.16b
+	ushr	v25.2d, v27.2d, #63
+	sli	v25.2d, v27.2d, #1
+	eor	v25.16b, v25.16b, v30.16b
+	eor	v31.16b, v0.16b, v5.16b
+	eor	v28.16b, v2.16b, v7.16b
+	eor	v31.16b, v31.16b, v10.16b
+	eor	v28.16b, v28.16b, v12.16b
+	eor	v31.16b, v31.16b, v15.16b
+	eor	v28.16b, v28.16b, v17.16b
+	eor	v31.16b, v31.16b, v20.16b
+	eor	v28.16b, v28.16b, v22.16b
+	ushr	v29.2d, v30.2d, #63
+	ushr	v26.2d, v28.2d, #63
+	sli	v29.2d, v30.2d, #1
+	sli	v26.2d, v28.2d, #1
+	eor	v28.16b, v28.16b, v29.16b
+	eor	v29.16b, v3.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v29.16b, v29.16b, v13.16b
+	eor	v29.16b, v29.16b, v18.16b
+	eor	v29.16b, v29.16b, v23.16b
+	ushr	v30.2d, v29.2d, #63
+	sli	v30.2d, v29.2d, #1
+	eor	v27.16b, v27.16b, v30.16b
+	ushr	v30.2d, v31.2d, #63
+	sli	v30.2d, v31.2d, #1
+	eor	v29.16b, v29.16b, v30.16b
+	# Swap Rotate NEON
+	eor	v0.16b, v0.16b, v25.16b
+	eor	v31.16b, v1.16b, v26.16b
+	eor	v6.16b, v6.16b, v26.16b
+	ushr	v30.2d, v31.2d, #63
+	ushr	v1.2d, v6.2d, #20
+	sli	v30.2d, v31.2d, #1
+	sli	v1.2d, v6.2d, #44
+	eor	v31.16b, v9.16b, v29.16b
+	eor	v22.16b, v22.16b, v27.16b
+	ushr	v6.2d, v31.2d, #44
+	ushr	v9.2d, v22.2d, #3
+	sli	v6.2d, v31.2d, #20
+	sli	v9.2d, v22.2d, #61
+	eor	v31.16b, v14.16b, v29.16b
+	eor	v20.16b, v20.16b, v25.16b
+	ushr	v22.2d, v31.2d, #25
+	ushr	v14.2d, v20.2d, #46
+	sli	v22.2d, v31.2d, #39
+	sli	v14.2d, v20.2d, #18
+	eor	v31.16b, v2.16b, v27.16b
+	eor	v12.16b, v12.16b, v27.16b
+	ushr	v20.2d, v31.2d, #2
+	ushr	v2.2d, v12.2d, #21
+	sli	v20.2d, v31.2d, #62
+	sli	v2.2d, v12.2d, #43
+	eor	v31.16b, v13.16b, v28.16b
+	eor	v19.16b, v19.16b, v29.16b
+	ushr	v12.2d, v31.2d, #39
+	ushr	v13.2d, v19.2d, #56
+	sli	v12.2d, v31.2d, #25
+	sli	v13.2d, v19.2d, #8
+	eor	v31.16b, v23.16b, v28.16b
+	eor	v15.16b, v15.16b, v25.16b
+	ushr	v19.2d, v31.2d, #8
+	ushr	v23.2d, v15.2d, #23
+	sli	v19.2d, v31.2d, #56
+	sli	v23.2d, v15.2d, #41
+	eor	v31.16b, v4.16b, v29.16b
+	eor	v24.16b, v24.16b, v29.16b
+	ushr	v15.2d, v31.2d, #37
+	ushr	v4.2d, v24.2d, #50
+	sli	v15.2d, v31.2d, #27
+	sli	v4.2d, v24.2d, #14
+	eor	v31.16b, v21.16b, v26.16b
+	eor	v8.16b, v8.16b, v28.16b
+	ushr	v24.2d, v31.2d, #62
+	ushr	v21.2d, v8.2d, #9
+	sli	v24.2d, v31.2d, #2
+	sli	v21.2d, v8.2d, #55
+	eor	v31.16b, v16.16b, v26.16b
+	eor	v5.16b, v5.16b, v25.16b
+	ushr	v8.2d, v31.2d, #19
+	ushr	v16.2d, v5.2d, #28
+	sli	v8.2d, v31.2d, #45
+	sli	v16.2d, v5.2d, #36
+	eor	v31.16b, v3.16b, v28.16b
+	eor	v18.16b, v18.16b, v28.16b
+	ushr	v5.2d, v31.2d, #36
+	ushr	v3.2d, v18.2d, #43
+	sli	v5.2d, v31.2d, #28
+	sli	v3.2d, v18.2d, #21
+	eor	v31.16b, v17.16b, v27.16b
+	eor	v11.16b, v11.16b, v26.16b
+	ushr	v18.2d, v31.2d, #49
+	ushr	v17.2d, v11.2d, #54
+	sli	v18.2d, v31.2d, #15
+	sli	v17.2d, v11.2d, #10
+	eor	v31.16b, v7.16b, v27.16b
+	eor	v10.16b, v10.16b, v25.16b
+	ushr	v11.2d, v31.2d, #58
+	ushr	v7.2d, v10.2d, #61
+	sli	v11.2d, v31.2d, #6
+	sli	v7.2d, v10.2d, #3
+	# Row Mix NEON
+	bic	v25.16b, v2.16b, v1.16b
+	bic	v26.16b, v3.16b, v2.16b
+	bic	v27.16b, v4.16b, v3.16b
+	bic	v28.16b, v0.16b, v4.16b
+	bic	v29.16b, v1.16b, v0.16b
+	eor	v0.16b, v0.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	eor	v2.16b, v2.16b, v27.16b
+	eor	v3.16b, v3.16b, v28.16b
+	eor	v4.16b, v4.16b, v29.16b
+	bic	v25.16b, v7.16b, v6.16b
+	bic	v26.16b, v8.16b, v7.16b
+	bic	v27.16b, v9.16b, v8.16b
+	bic	v28.16b, v5.16b, v9.16b
+	bic	v29.16b, v6.16b, v5.16b
+	eor	v5.16b, v5.16b, v25.16b
+	eor	v6.16b, v6.16b, v26.16b
+	eor	v7.16b, v7.16b, v27.16b
+	eor	v8.16b, v8.16b, v28.16b
+	eor	v9.16b, v9.16b, v29.16b
+	bic	v25.16b, v12.16b, v11.16b
+	bic	v26.16b, v13.16b, v12.16b
+	bic	v27.16b, v14.16b, v13.16b
+	bic	v28.16b, v30.16b, v14.16b
+	bic	v29.16b, v11.16b, v30.16b
+	eor	v10.16b, v30.16b, v25.16b
+	eor	v11.16b, v11.16b, v26.16b
+	eor	v12.16b, v12.16b, v27.16b
+	eor	v13.16b, v13.16b, v28.16b
+	eor	v14.16b, v14.16b, v29.16b
+	bic	v25.16b, v17.16b, v16.16b
+	bic	v26.16b, v18.16b, v17.16b
+	bic	v27.16b, v19.16b, v18.16b
+	bic	v28.16b, v15.16b, v19.16b
+	bic	v29.16b, v16.16b, v15.16b
+	eor	v15.16b, v15.16b, v25.16b
+	eor	v16.16b, v16.16b, v26.16b
+	eor	v17.16b, v17.16b, v27.16b
+	eor	v18.16b, v18.16b, v28.16b
+	eor	v19.16b, v19.16b, v29.16b
+	bic	v25.16b, v22.16b, v21.16b
+	bic	v26.16b, v23.16b, v22.16b
+	bic	v27.16b, v24.16b, v23.16b
+	bic	v28.16b, v20.16b, v24.16b
+	bic	v29.16b, v21.16b, v20.16b
+	eor	v20.16b, v20.16b, v25.16b
+	eor	v21.16b, v21.16b, v26.16b
+	eor	v22.16b, v22.16b, v27.16b
+	eor	v23.16b, v23.16b, v28.16b
+	eor	v24.16b, v24.16b, v29.16b
+	ldr	x3, [x1], #8
+	subs	x2, x2, #1
+	mov	v30.d[0], x3
+	mov	v30.d[1], x3
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_frodokem_sha3_x2_neon_begin
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+#ifndef __APPLE__
+	.size	frodokem_sha3_x2_neon,.-frodokem_sha3_x2_neon
+#endif /* __APPLE__ */
+#ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
+	.arch_extension	sha3
+#ifndef __APPLE__
+.text
+.globl	frodokem_sha3_x2_crypto
+.type	frodokem_sha3_x2_crypto,@function
+.align	2
+frodokem_sha3_x2_crypto:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sha3_x2_crypto
+.p2align	2
+_frodokem_sha3_x2_crypto:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+#ifndef __APPLE__
+	adrp x1, L_sha3_aarch64_r
+	add  x1, x1, :lo12:L_sha3_aarch64_r
+#else
+	adrp x1, L_sha3_aarch64_r@PAGE
+	add  x1, x1, L_sha3_aarch64_r@PAGEOFF
+#endif /* __APPLE__ */
+	ld4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	ld1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	ld4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	ld1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	sub	x0, x0, #0x190
+	mov	x2, #24
+L_frodokem_sha3_x2_crypto_begin:
+	# Col Mix
+	eor3	v31.16b, v0.16b, v5.16b, v10.16b
+	eor3	v27.16b, v1.16b, v6.16b, v11.16b
+	eor3	v28.16b, v2.16b, v7.16b, v12.16b
+	eor3	v29.16b, v3.16b, v8.16b, v13.16b
+	eor3	v30.16b, v4.16b, v9.16b, v14.16b
+	eor3	v31.16b, v31.16b, v15.16b, v20.16b
+	eor3	v27.16b, v27.16b, v16.16b, v21.16b
+	eor3	v28.16b, v28.16b, v17.16b, v22.16b
+	eor3	v29.16b, v29.16b, v18.16b, v23.16b
+	eor3	v30.16b, v30.16b, v19.16b, v24.16b
+	rax1	v25.2d, v30.2d, v27.2d
+	rax1	v26.2d, v31.2d, v28.2d
+	rax1	v27.2d, v27.2d, v29.2d
+	rax1	v28.2d, v28.2d, v30.2d
+	rax1	v29.2d, v29.2d, v31.2d
+	eor	v0.16b, v0.16b, v25.16b
+	xar	v30.2d, v1.2d, v26.2d, #63
+	xar	v1.2d, v6.2d, v26.2d, #20
+	xar	v6.2d, v9.2d, v29.2d, #44
+	xar	v9.2d, v22.2d, v27.2d, #3
+	xar	v22.2d, v14.2d, v29.2d, #25
+	xar	v14.2d, v20.2d, v25.2d, #46
+	xar	v20.2d, v2.2d, v27.2d, #2
+	xar	v2.2d, v12.2d, v27.2d, #21
+	xar	v12.2d, v13.2d, v28.2d, #39
+	xar	v13.2d, v19.2d, v29.2d, #56
+	xar	v19.2d, v23.2d, v28.2d, #8
+	xar	v23.2d, v15.2d, v25.2d, #23
+	xar	v15.2d, v4.2d, v29.2d, #37
+	xar	v4.2d, v24.2d, v29.2d, #50
+	xar	v24.2d, v21.2d, v26.2d, #62
+	xar	v21.2d, v8.2d, v28.2d, #9
+	xar	v8.2d, v16.2d, v26.2d, #19
+	xar	v16.2d, v5.2d, v25.2d, #28
+	xar	v5.2d, v3.2d, v28.2d, #36
+	xar	v3.2d, v18.2d, v28.2d, #43
+	xar	v18.2d, v17.2d, v27.2d, #49
+	xar	v17.2d, v11.2d, v26.2d, #54
+	xar	v11.2d, v7.2d, v27.2d, #58
+	xar	v7.2d, v10.2d, v25.2d, #61
+	# Row Mix
+	mov	v25.16b, v0.16b
+	mov	v26.16b, v1.16b
+	bcax	v0.16b, v25.16b, v2.16b, v26.16b
+	bcax	v1.16b, v26.16b, v3.16b, v2.16b
+	bcax	v2.16b, v2.16b, v4.16b, v3.16b
+	bcax	v3.16b, v3.16b, v25.16b, v4.16b
+	bcax	v4.16b, v4.16b, v26.16b, v25.16b
+	mov	v25.16b, v5.16b
+	mov	v26.16b, v6.16b
+	bcax	v5.16b, v25.16b, v7.16b, v26.16b
+	bcax	v6.16b, v26.16b, v8.16b, v7.16b
+	bcax	v7.16b, v7.16b, v9.16b, v8.16b
+	bcax	v8.16b, v8.16b, v25.16b, v9.16b
+	bcax	v9.16b, v9.16b, v26.16b, v25.16b
+	mov	v26.16b, v11.16b
+	bcax	v10.16b, v30.16b, v12.16b, v26.16b
+	bcax	v11.16b, v26.16b, v13.16b, v12.16b
+	bcax	v12.16b, v12.16b, v14.16b, v13.16b
+	bcax	v13.16b, v13.16b, v30.16b, v14.16b
+	bcax	v14.16b, v14.16b, v26.16b, v30.16b
+	mov	v25.16b, v15.16b
+	mov	v26.16b, v16.16b
+	bcax	v15.16b, v25.16b, v17.16b, v26.16b
+	bcax	v16.16b, v26.16b, v18.16b, v17.16b
+	bcax	v17.16b, v17.16b, v19.16b, v18.16b
+	bcax	v18.16b, v18.16b, v25.16b, v19.16b
+	bcax	v19.16b, v19.16b, v26.16b, v25.16b
+	mov	v25.16b, v20.16b
+	mov	v26.16b, v21.16b
+	bcax	v20.16b, v25.16b, v22.16b, v26.16b
+	bcax	v21.16b, v26.16b, v23.16b, v22.16b
+	bcax	v22.16b, v22.16b, v24.16b, v23.16b
+	bcax	v23.16b, v23.16b, v25.16b, v24.16b
+	bcax	v24.16b, v24.16b, v26.16b, v25.16b
+	ldr	x3, [x1], #8
+	subs	x2, x2, #1
+	mov	v30.d[0], x3
+	mov	v30.d[1], x3
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_frodokem_sha3_x2_crypto_begin
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+#ifndef __APPLE__
+	.size	frodokem_sha3_x2_crypto,.-frodokem_sha3_x2_crypto
+#endif /* __APPLE__ */
+#endif /* WOLFSSL_ARMASM_CRYPTO_SHA3 */
+#ifndef __APPLE__
+.text
+.globl	frodokem_add_neon
+.type	frodokem_add_neon,@function
+.align	2
+frodokem_add_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_add_neon
+.p2align	2
+_frodokem_add_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	dup	v16.8h, w2
+	ld1	{v0.8h, v1.8h, v2.8h, v3.8h}, [x0], #0x40
+	ld1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	sub	x0, x0, #0x80
+	ld1	{v8.8h, v9.8h, v10.8h, v11.8h}, [x1], #0x40
+	ld1	{v12.8h, v13.8h, v14.8h, v15.8h}, [x1], #0x40
+	add	v0.8h, v0.8h, v8.8h
+	and	v0.16b, v0.16b, v16.16b
+	add	v1.8h, v1.8h, v9.8h
+	and	v1.16b, v1.16b, v16.16b
+	add	v2.8h, v2.8h, v10.8h
+	and	v2.16b, v2.16b, v16.16b
+	add	v3.8h, v3.8h, v11.8h
+	and	v3.16b, v3.16b, v16.16b
+	add	v4.8h, v4.8h, v12.8h
+	and	v4.16b, v4.16b, v16.16b
+	add	v5.8h, v5.8h, v13.8h
+	and	v5.16b, v5.16b, v16.16b
+	add	v6.8h, v6.8h, v14.8h
+	and	v6.16b, v6.16b, v16.16b
+	add	v7.8h, v7.8h, v15.8h
+	and	v7.16b, v7.16b, v16.16b
+	st1	{v0.8h, v1.8h, v2.8h, v3.8h}, [x0], #0x40
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+#ifndef __APPLE__
+	.size	frodokem_add_neon,.-frodokem_add_neon
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_sample_neon
+.type	frodokem_sample_neon,@function
+.align	2
+frodokem_sample_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sample_neon
+.p2align	2
+_frodokem_sample_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-64]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	cmp	w1, #16
+	blt	L_frodokem_sample_neon_rem
+L_frodokem_sample_neon_blk16:
+	ld1	{v0.8h}, [x0], #16
+	ld1	{v1.8h}, [x0], #16
+	sub	x0, x0, #32
+	ushr	v2.8h, v0.8h, #1
+	movi	v4.8h, #1
+	and	v4.16b, v4.16b, v0.16b
+	movi	v6.8h, #0
+	ushr	v3.8h, v1.8h, #1
+	movi	v5.8h, #1
+	and	v5.16b, v5.16b, v1.16b
+	movi	v7.8h, #0
+	mov	x4, x2
+	mov	w5, w3
+L_frodokem_sample_neon_cdf16:
+	ld1r	{v12.8h}, [x4], #2
+	sub	v10.8h, v12.8h, v2.8h
+	ushr	v10.8h, v10.8h, #15
+	add	v6.8h, v6.8h, v10.8h
+	sub	v11.8h, v12.8h, v3.8h
+	ushr	v11.8h, v11.8h, #15
+	add	v7.8h, v7.8h, v11.8h
+	subs	w5, w5, #1
+	bne	L_frodokem_sample_neon_cdf16
+	neg	v8.8h, v4.8h
+	eor	v6.16b, v6.16b, v8.16b
+	add	v6.8h, v6.8h, v4.8h
+	st1	{v6.8h}, [x0], #16
+	neg	v9.8h, v5.8h
+	eor	v7.16b, v7.16b, v9.16b
+	add	v7.8h, v7.8h, v5.8h
+	st1	{v7.8h}, [x0], #16
+	subs	w1, w1, #16
+	cmp	w1, #16
+	bge	L_frodokem_sample_neon_blk16
+L_frodokem_sample_neon_rem:
+	cmp	w1, #0
+	beq	L_frodokem_sample_neon_done
+L_frodokem_sample_neon_blk:
+	ld1	{v0.8h}, [x0]
+	ushr	v2.8h, v0.8h, #1
+	movi	v4.8h, #1
+	and	v4.16b, v4.16b, v0.16b
+	movi	v6.8h, #0
+	mov	x4, x2
+	mov	w5, w3
+L_frodokem_sample_neon_cdf:
+	ld1r	{v12.8h}, [x4], #2
+	sub	v12.8h, v12.8h, v2.8h
+	ushr	v12.8h, v12.8h, #15
+	add	v6.8h, v6.8h, v12.8h
+	subs	w5, w5, #1
+	bne	L_frodokem_sample_neon_cdf
+	neg	v8.8h, v4.8h
+	eor	v6.16b, v6.16b, v8.16b
+	add	v6.8h, v6.8h, v4.8h
+	st1	{v6.8h}, [x0], #16
+	subs	w1, w1, #8
+	bne	L_frodokem_sample_neon_blk
+L_frodokem_sample_neon_done:
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	x29, x30, [sp], #0x40
+	ret
+#ifndef __APPLE__
+	.size	frodokem_sample_neon,.-frodokem_sample_neon
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_sa_accum_neon
+.type	frodokem_sa_accum_neon,@function
+.align	2
+frodokem_sa_accum_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sa_accum_neon
+.p2align	2
+_frodokem_sa_accum_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	stp	d8, d9, [x29, #32]
+	stp	d10, d11, [x29, #48]
+	stp	d12, d13, [x29, #64]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x7, w3
+	lsl	x7, x7, #1
+	add	x7, x1, x7
+	mov	x8, x0
+	mov	x12, #2
+L_frodokem_sa_accum_neon_t:
+	ldr	w13, [x7]
+	dup	v0.8h, w13
+	lsr	w13, w13, #16
+	dup	v4.8h, w13
+	add	x7, x7, x5
+	ldr	w13, [x7]
+	dup	v1.8h, w13
+	lsr	w13, w13, #16
+	dup	v5.8h, w13
+	add	x7, x7, x5
+	ldr	w13, [x7]
+	dup	v2.8h, w13
+	lsr	w13, w13, #16
+	dup	v6.8h, w13
+	add	x7, x7, x5
+	ldr	w13, [x7]
+	dup	v3.8h, w13
+	lsr	w13, w13, #16
+	dup	v7.8h, w13
+	add	x7, x7, x5
+	mov	x14, x8
+	add	x15, x14, x5
+	add	x16, x15, x5
+	add	x17, x16, x5
+	mov	x9, x2
+	add	x10, x2, x5
+	lsr	x11, x5, #4
+L_frodokem_sa_accum_neon_k:
+	ld1	{v8.8h}, [x9], #16
+	ld1	{v9.8h}, [x10], #16
+	ld1	{v10.8h}, [x14]
+	mla	v10.8h, v8.8h, v0.8h
+	mla	v10.8h, v9.8h, v4.8h
+	st1	{v10.8h}, [x14], #16
+	ld1	{v11.8h}, [x15]
+	mla	v11.8h, v8.8h, v1.8h
+	mla	v11.8h, v9.8h, v5.8h
+	st1	{v11.8h}, [x15], #16
+	ld1	{v12.8h}, [x16]
+	mla	v12.8h, v8.8h, v2.8h
+	mla	v12.8h, v9.8h, v6.8h
+	st1	{v12.8h}, [x16], #16
+	ld1	{v13.8h}, [x17]
+	mla	v13.8h, v8.8h, v3.8h
+	mla	v13.8h, v9.8h, v7.8h
+	st1	{v13.8h}, [x17], #16
+	subs	x11, x11, #1
+	bne	L_frodokem_sa_accum_neon_k
+	add	x8, x8, x6
+	subs	x12, x12, #1
+	bne	L_frodokem_sa_accum_neon_t
+	ldr	x17, [x29, #24]
+	ldp	d8, d9, [x29, #32]
+	ldp	d10, d11, [x29, #48]
+	ldp	d12, d13, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+#ifndef __APPLE__
+	.size	frodokem_sa_accum_neon,.-frodokem_sa_accum_neon
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_sa_accum_x4_neon
+.type	frodokem_sa_accum_x4_neon,@function
+.align	2
+frodokem_sa_accum_x4_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sa_accum_x4_neon
+.p2align	2
+_frodokem_sa_accum_x4_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-112]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	str	x20, [x29, #40]
+	stp	d8, d9, [x29, #48]
+	stp	d10, d11, [x29, #64]
+	stp	d12, d13, [x29, #80]
+	stp	d14, d15, [x29, #96]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x7, w3
+	lsl	x7, x7, #1
+	add	x7, x1, x7
+	mov	x8, x0
+	mov	x14, #2
+L_frodokem_sa_accum_x4_neon_t:
+	ldr	x15, [x7]
+	dup	v0.8h, w15
+	lsr	x15, x15, #16
+	dup	v1.8h, w15
+	lsr	x15, x15, #16
+	dup	v2.8h, w15
+	lsr	x15, x15, #16
+	dup	v3.8h, w15
+	add	x7, x7, x5
+	ldr	x15, [x7]
+	dup	v4.8h, w15
+	lsr	x15, x15, #16
+	dup	v5.8h, w15
+	lsr	x15, x15, #16
+	dup	v6.8h, w15
+	lsr	x15, x15, #16
+	dup	v7.8h, w15
+	add	x7, x7, x5
+	ldr	x15, [x7]
+	dup	v8.8h, w15
+	lsr	x15, x15, #16
+	dup	v9.8h, w15
+	lsr	x15, x15, #16
+	dup	v10.8h, w15
+	lsr	x15, x15, #16
+	dup	v11.8h, w15
+	add	x7, x7, x5
+	ldr	x15, [x7]
+	dup	v12.8h, w15
+	lsr	x15, x15, #16
+	dup	v13.8h, w15
+	lsr	x15, x15, #16
+	dup	v14.8h, w15
+	lsr	x15, x15, #16
+	dup	v15.8h, w15
+	add	x7, x7, x5
+	mov	x16, x8
+	add	x17, x16, x5
+	add	x19, x17, x5
+	add	x20, x19, x5
+	mov	x9, x2
+	add	x10, x9, x5
+	add	x11, x10, x5
+	add	x12, x11, x5
+	lsr	x13, x5, #4
+L_frodokem_sa_accum_x4_neon_k:
+	ld1	{v16.8h}, [x9], #16
+	ld1	{v17.8h}, [x10], #16
+	ld1	{v18.8h}, [x11], #16
+	ld1	{v19.8h}, [x12], #16
+	ld1	{v20.8h}, [x16]
+	mla	v20.8h, v16.8h, v0.8h
+	mla	v20.8h, v17.8h, v1.8h
+	mla	v20.8h, v18.8h, v2.8h
+	mla	v20.8h, v19.8h, v3.8h
+	st1	{v20.8h}, [x16], #16
+	ld1	{v21.8h}, [x17]
+	mla	v21.8h, v16.8h, v4.8h
+	mla	v21.8h, v17.8h, v5.8h
+	mla	v21.8h, v18.8h, v6.8h
+	mla	v21.8h, v19.8h, v7.8h
+	st1	{v21.8h}, [x17], #16
+	ld1	{v22.8h}, [x19]
+	mla	v22.8h, v16.8h, v8.8h
+	mla	v22.8h, v17.8h, v9.8h
+	mla	v22.8h, v18.8h, v10.8h
+	mla	v22.8h, v19.8h, v11.8h
+	st1	{v22.8h}, [x19], #16
+	ld1	{v23.8h}, [x20]
+	mla	v23.8h, v16.8h, v12.8h
+	mla	v23.8h, v17.8h, v13.8h
+	mla	v23.8h, v18.8h, v14.8h
+	mla	v23.8h, v19.8h, v15.8h
+	st1	{v23.8h}, [x20], #16
+	subs	x13, x13, #1
+	bne	L_frodokem_sa_accum_x4_neon_k
+	add	x8, x8, x6
+	subs	x14, x14, #1
+	bne	L_frodokem_sa_accum_x4_neon_t
+	ldp	x17, x19, [x29, #24]
+	ldr	x20, [x29, #40]
+	ldp	d8, d9, [x29, #48]
+	ldp	d10, d11, [x29, #64]
+	ldp	d12, d13, [x29, #80]
+	ldp	d14, d15, [x29, #96]
+	ldp	x29, x30, [sp], #0x70
+	ret
+#ifndef __APPLE__
+	.size	frodokem_sa_accum_x4_neon,.-frodokem_sa_accum_x4_neon
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_as_accum_neon
+.type	frodokem_as_accum_neon,@function
+.align	2
+frodokem_as_accum_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_as_accum_neon
+.p2align	2
+_frodokem_as_accum_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	str	x20, [x29, #40]
+	stp	d8, d9, [x29, #48]
+	stp	d10, d11, [x29, #64]
+	stp	d12, d13, [x29, #80]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x15, w3
+	lsl	x15, x15, #4
+	add	x7, x0, x15
+	add	x8, x7, #16
+	mov	x9, x2
+	add	x10, x2, x5
+	mov	x13, x1
+	mov	x16, x13
+	add	x17, x16, x5
+	add	x19, x17, x5
+	add	x20, x19, x5
+	mov	x11, x9
+	mov	x12, x10
+	movi	v0.8h, #0
+	movi	v1.8h, #0
+	movi	v2.8h, #0
+	movi	v3.8h, #0
+	movi	v4.8h, #0
+	movi	v5.8h, #0
+	movi	v6.8h, #0
+	movi	v7.8h, #0
+	lsr	x14, x5, #4
+L_frodokem_as_accum_neon_k0:
+	ld1	{v8.8h}, [x11], #16
+	ld1	{v9.8h}, [x12], #16
+	ld1	{v10.8h}, [x16], #16
+	mla	v0.8h, v8.8h, v10.8h
+	mla	v4.8h, v9.8h, v10.8h
+	ld1	{v10.8h}, [x17], #16
+	mla	v1.8h, v8.8h, v10.8h
+	mla	v5.8h, v9.8h, v10.8h
+	ld1	{v10.8h}, [x19], #16
+	mla	v2.8h, v8.8h, v10.8h
+	mla	v6.8h, v9.8h, v10.8h
+	ld1	{v10.8h}, [x20], #16
+	mla	v3.8h, v8.8h, v10.8h
+	mla	v7.8h, v9.8h, v10.8h
+	subs	x14, x14, #1
+	bne	L_frodokem_as_accum_neon_k0
+	addv	h13, v0.8h
+	ins	v11.h[0], v13.h[0]
+	addv	h13, v4.8h
+	ins	v12.h[0], v13.h[0]
+	addv	h13, v1.8h
+	ins	v11.h[1], v13.h[0]
+	addv	h13, v5.8h
+	ins	v12.h[1], v13.h[0]
+	addv	h13, v2.8h
+	ins	v11.h[2], v13.h[0]
+	addv	h13, v6.8h
+	ins	v12.h[2], v13.h[0]
+	addv	h13, v3.8h
+	ins	v11.h[3], v13.h[0]
+	addv	h13, v7.8h
+	ins	v12.h[3], v13.h[0]
+	add	x13, x13, x6
+	mov	x16, x13
+	add	x17, x16, x5
+	add	x19, x17, x5
+	add	x20, x19, x5
+	mov	x11, x9
+	mov	x12, x10
+	movi	v0.8h, #0
+	movi	v1.8h, #0
+	movi	v2.8h, #0
+	movi	v3.8h, #0
+	movi	v4.8h, #0
+	movi	v5.8h, #0
+	movi	v6.8h, #0
+	movi	v7.8h, #0
+	lsr	x14, x5, #4
+L_frodokem_as_accum_neon_k1:
+	ld1	{v8.8h}, [x11], #16
+	ld1	{v9.8h}, [x12], #16
+	ld1	{v10.8h}, [x16], #16
+	mla	v0.8h, v8.8h, v10.8h
+	mla	v4.8h, v9.8h, v10.8h
+	ld1	{v10.8h}, [x17], #16
+	mla	v1.8h, v8.8h, v10.8h
+	mla	v5.8h, v9.8h, v10.8h
+	ld1	{v10.8h}, [x19], #16
+	mla	v2.8h, v8.8h, v10.8h
+	mla	v6.8h, v9.8h, v10.8h
+	ld1	{v10.8h}, [x20], #16
+	mla	v3.8h, v8.8h, v10.8h
+	mla	v7.8h, v9.8h, v10.8h
+	subs	x14, x14, #1
+	bne	L_frodokem_as_accum_neon_k1
+	addv	h13, v0.8h
+	ins	v11.h[4], v13.h[0]
+	addv	h13, v4.8h
+	ins	v12.h[4], v13.h[0]
+	addv	h13, v1.8h
+	ins	v11.h[5], v13.h[0]
+	addv	h13, v5.8h
+	ins	v12.h[5], v13.h[0]
+	addv	h13, v2.8h
+	ins	v11.h[6], v13.h[0]
+	addv	h13, v6.8h
+	ins	v12.h[6], v13.h[0]
+	addv	h13, v3.8h
+	ins	v11.h[7], v13.h[0]
+	addv	h13, v7.8h
+	ins	v12.h[7], v13.h[0]
+	add	x13, x13, x6
+	ld1	{v8.8h}, [x7]
+	add	v11.8h, v11.8h, v8.8h
+	st1	{v11.8h}, [x7], #16
+	ld1	{v9.8h}, [x8]
+	add	v12.8h, v12.8h, v9.8h
+	st1	{v12.8h}, [x8], #16
+	ldp	x17, x19, [x29, #24]
+	ldr	x20, [x29, #40]
+	ldp	d8, d9, [x29, #48]
+	ldp	d10, d11, [x29, #64]
+	ldp	d12, d13, [x29, #80]
+	ldp	x29, x30, [sp], #0x60
+	ret
+#ifndef __APPLE__
+	.size	frodokem_as_accum_neon,.-frodokem_as_accum_neon
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_as_accum_x4_neon
+.type	frodokem_as_accum_x4_neon,@function
+.align	2
+frodokem_as_accum_x4_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_as_accum_x4_neon
+.p2align	2
+_frodokem_as_accum_x4_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-160]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	str	x26, [x29, #88]
+	stp	d8, d9, [x29, #96]
+	stp	d10, d11, [x29, #112]
+	stp	d12, d13, [x29, #128]
+	stp	d14, d15, [x29, #144]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x22, w3
+	lsl	x22, x22, #4
+	add	x7, x0, x22
+	add	x8, x7, #16
+	add	x9, x8, #16
+	add	x10, x9, #16
+	mov	x11, x2
+	add	x12, x11, x5
+	add	x13, x12, x5
+	add	x14, x13, x5
+	mov	x20, x1
+	mov	x23, x20
+	add	x24, x23, x5
+	add	x25, x24, x5
+	add	x26, x25, x5
+	mov	x15, x11
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	movi	v0.8h, #0
+	movi	v1.8h, #0
+	movi	v2.8h, #0
+	movi	v3.8h, #0
+	movi	v4.8h, #0
+	movi	v5.8h, #0
+	movi	v6.8h, #0
+	movi	v7.8h, #0
+	movi	v8.8h, #0
+	movi	v9.8h, #0
+	movi	v10.8h, #0
+	movi	v11.8h, #0
+	movi	v12.8h, #0
+	movi	v13.8h, #0
+	movi	v14.8h, #0
+	movi	v15.8h, #0
+	lsr	x21, x5, #4
+L_frodokem_as_accum_x4_neon_k0:
+	ld1	{v16.8h}, [x15], #16
+	ld1	{v17.8h}, [x16], #16
+	ld1	{v18.8h}, [x17], #16
+	ld1	{v19.8h}, [x19], #16
+	ld1	{v20.8h}, [x23], #16
+	mla	v0.8h, v16.8h, v20.8h
+	mla	v4.8h, v17.8h, v20.8h
+	mla	v8.8h, v18.8h, v20.8h
+	mla	v12.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x24], #16
+	mla	v1.8h, v16.8h, v20.8h
+	mla	v5.8h, v17.8h, v20.8h
+	mla	v9.8h, v18.8h, v20.8h
+	mla	v13.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x25], #16
+	mla	v2.8h, v16.8h, v20.8h
+	mla	v6.8h, v17.8h, v20.8h
+	mla	v10.8h, v18.8h, v20.8h
+	mla	v14.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x26], #16
+	mla	v3.8h, v16.8h, v20.8h
+	mla	v7.8h, v17.8h, v20.8h
+	mla	v11.8h, v18.8h, v20.8h
+	mla	v15.8h, v19.8h, v20.8h
+	subs	x21, x21, #1
+	bne	L_frodokem_as_accum_x4_neon_k0
+	addv	h25, v0.8h
+	ins	v21.h[0], v25.h[0]
+	addv	h25, v4.8h
+	ins	v22.h[0], v25.h[0]
+	addv	h25, v8.8h
+	ins	v23.h[0], v25.h[0]
+	addv	h25, v12.8h
+	ins	v24.h[0], v25.h[0]
+	addv	h25, v1.8h
+	ins	v21.h[1], v25.h[0]
+	addv	h25, v5.8h
+	ins	v22.h[1], v25.h[0]
+	addv	h25, v9.8h
+	ins	v23.h[1], v25.h[0]
+	addv	h25, v13.8h
+	ins	v24.h[1], v25.h[0]
+	addv	h25, v2.8h
+	ins	v21.h[2], v25.h[0]
+	addv	h25, v6.8h
+	ins	v22.h[2], v25.h[0]
+	addv	h25, v10.8h
+	ins	v23.h[2], v25.h[0]
+	addv	h25, v14.8h
+	ins	v24.h[2], v25.h[0]
+	addv	h25, v3.8h
+	ins	v21.h[3], v25.h[0]
+	addv	h25, v7.8h
+	ins	v22.h[3], v25.h[0]
+	addv	h25, v11.8h
+	ins	v23.h[3], v25.h[0]
+	addv	h25, v15.8h
+	ins	v24.h[3], v25.h[0]
+	add	x20, x20, x6
+	mov	x23, x20
+	add	x24, x23, x5
+	add	x25, x24, x5
+	add	x26, x25, x5
+	mov	x15, x11
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	movi	v0.8h, #0
+	movi	v1.8h, #0
+	movi	v2.8h, #0
+	movi	v3.8h, #0
+	movi	v4.8h, #0
+	movi	v5.8h, #0
+	movi	v6.8h, #0
+	movi	v7.8h, #0
+	movi	v8.8h, #0
+	movi	v9.8h, #0
+	movi	v10.8h, #0
+	movi	v11.8h, #0
+	movi	v12.8h, #0
+	movi	v13.8h, #0
+	movi	v14.8h, #0
+	movi	v15.8h, #0
+	lsr	x21, x5, #4
+L_frodokem_as_accum_x4_neon_k1:
+	ld1	{v16.8h}, [x15], #16
+	ld1	{v17.8h}, [x16], #16
+	ld1	{v18.8h}, [x17], #16
+	ld1	{v19.8h}, [x19], #16
+	ld1	{v20.8h}, [x23], #16
+	mla	v0.8h, v16.8h, v20.8h
+	mla	v4.8h, v17.8h, v20.8h
+	mla	v8.8h, v18.8h, v20.8h
+	mla	v12.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x24], #16
+	mla	v1.8h, v16.8h, v20.8h
+	mla	v5.8h, v17.8h, v20.8h
+	mla	v9.8h, v18.8h, v20.8h
+	mla	v13.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x25], #16
+	mla	v2.8h, v16.8h, v20.8h
+	mla	v6.8h, v17.8h, v20.8h
+	mla	v10.8h, v18.8h, v20.8h
+	mla	v14.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x26], #16
+	mla	v3.8h, v16.8h, v20.8h
+	mla	v7.8h, v17.8h, v20.8h
+	mla	v11.8h, v18.8h, v20.8h
+	mla	v15.8h, v19.8h, v20.8h
+	subs	x21, x21, #1
+	bne	L_frodokem_as_accum_x4_neon_k1
+	addv	h25, v0.8h
+	ins	v21.h[4], v25.h[0]
+	addv	h25, v4.8h
+	ins	v22.h[4], v25.h[0]
+	addv	h25, v8.8h
+	ins	v23.h[4], v25.h[0]
+	addv	h25, v12.8h
+	ins	v24.h[4], v25.h[0]
+	addv	h25, v1.8h
+	ins	v21.h[5], v25.h[0]
+	addv	h25, v5.8h
+	ins	v22.h[5], v25.h[0]
+	addv	h25, v9.8h
+	ins	v23.h[5], v25.h[0]
+	addv	h25, v13.8h
+	ins	v24.h[5], v25.h[0]
+	addv	h25, v2.8h
+	ins	v21.h[6], v25.h[0]
+	addv	h25, v6.8h
+	ins	v22.h[6], v25.h[0]
+	addv	h25, v10.8h
+	ins	v23.h[6], v25.h[0]
+	addv	h25, v14.8h
+	ins	v24.h[6], v25.h[0]
+	addv	h25, v3.8h
+	ins	v21.h[7], v25.h[0]
+	addv	h25, v7.8h
+	ins	v22.h[7], v25.h[0]
+	addv	h25, v11.8h
+	ins	v23.h[7], v25.h[0]
+	addv	h25, v15.8h
+	ins	v24.h[7], v25.h[0]
+	add	x20, x20, x6
+	ld1	{v16.8h}, [x7]
+	add	v21.8h, v21.8h, v16.8h
+	st1	{v21.8h}, [x7], #16
+	ld1	{v16.8h}, [x8]
+	add	v22.8h, v22.8h, v16.8h
+	st1	{v22.8h}, [x8], #16
+	ld1	{v16.8h}, [x9]
+	add	v23.8h, v23.8h, v16.8h
+	st1	{v23.8h}, [x9], #16
+	ld1	{v16.8h}, [x10]
+	add	v24.8h, v24.8h, v16.8h
+	st1	{v24.8h}, [x10], #16
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldr	x26, [x29, #88]
+	ldp	d8, d9, [x29, #96]
+	ldp	d10, d11, [x29, #112]
+	ldp	d12, d13, [x29, #128]
+	ldp	d14, d15, [x29, #144]
+	ldp	x29, x30, [sp], #0xa0
+	ret
+#ifndef __APPLE__
+	.size	frodokem_as_accum_x4_neon,.-frodokem_as_accum_x4_neon
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_bs_neon
+.type	frodokem_mul_bs_neon,@function
+.align	2
+frodokem_mul_bs_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_bs_neon
+.p2align	2
+_frodokem_mul_bs_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-160]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	stp	x22, x23, [x29, #48]
+	stp	x24, x25, [x29, #64]
+	stp	x26, x27, [x29, #80]
+	stp	d8, d9, [x29, #96]
+	stp	d10, d11, [x29, #112]
+	stp	d12, d13, [x29, #128]
+	stp	d14, d15, [x29, #144]
+	sxtw	x5, w3
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	dup	v26.8h, w4
+	mov	x7, x0
+	add	x8, x7, #16
+	add	x9, x8, #16
+	add	x10, x9, #16
+	mov	x11, x1
+	mov	x23, #2
+L_frodokem_mul_bs_neon_p:
+	mov	x12, x11
+	add	x13, x12, x5
+	add	x14, x13, x5
+	add	x15, x14, x5
+	mov	x21, x2
+	mov	x24, x21
+	add	x25, x24, x5
+	add	x26, x25, x5
+	add	x27, x26, x5
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	mov	x20, x15
+	movi	v0.8h, #0
+	movi	v1.8h, #0
+	movi	v2.8h, #0
+	movi	v3.8h, #0
+	movi	v4.8h, #0
+	movi	v5.8h, #0
+	movi	v6.8h, #0
+	movi	v7.8h, #0
+	movi	v8.8h, #0
+	movi	v9.8h, #0
+	movi	v10.8h, #0
+	movi	v11.8h, #0
+	movi	v12.8h, #0
+	movi	v13.8h, #0
+	movi	v14.8h, #0
+	movi	v15.8h, #0
+	lsr	x22, x5, #4
+L_frodokem_mul_bs_neon_k0:
+	ld1	{v16.8h}, [x16], #16
+	ld1	{v17.8h}, [x17], #16
+	ld1	{v18.8h}, [x19], #16
+	ld1	{v19.8h}, [x20], #16
+	ld1	{v20.8h}, [x24], #16
+	mla	v0.8h, v16.8h, v20.8h
+	mla	v4.8h, v17.8h, v20.8h
+	mla	v8.8h, v18.8h, v20.8h
+	mla	v12.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x25], #16
+	mla	v1.8h, v16.8h, v20.8h
+	mla	v5.8h, v17.8h, v20.8h
+	mla	v9.8h, v18.8h, v20.8h
+	mla	v13.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x26], #16
+	mla	v2.8h, v16.8h, v20.8h
+	mla	v6.8h, v17.8h, v20.8h
+	mla	v10.8h, v18.8h, v20.8h
+	mla	v14.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x27], #16
+	mla	v3.8h, v16.8h, v20.8h
+	mla	v7.8h, v17.8h, v20.8h
+	mla	v11.8h, v18.8h, v20.8h
+	mla	v15.8h, v19.8h, v20.8h
+	subs	x22, x22, #1
+	bne	L_frodokem_mul_bs_neon_k0
+	addv	h25, v0.8h
+	ins	v21.h[0], v25.h[0]
+	addv	h25, v4.8h
+	ins	v22.h[0], v25.h[0]
+	addv	h25, v8.8h
+	ins	v23.h[0], v25.h[0]
+	addv	h25, v12.8h
+	ins	v24.h[0], v25.h[0]
+	addv	h25, v1.8h
+	ins	v21.h[1], v25.h[0]
+	addv	h25, v5.8h
+	ins	v22.h[1], v25.h[0]
+	addv	h25, v9.8h
+	ins	v23.h[1], v25.h[0]
+	addv	h25, v13.8h
+	ins	v24.h[1], v25.h[0]
+	addv	h25, v2.8h
+	ins	v21.h[2], v25.h[0]
+	addv	h25, v6.8h
+	ins	v22.h[2], v25.h[0]
+	addv	h25, v10.8h
+	ins	v23.h[2], v25.h[0]
+	addv	h25, v14.8h
+	ins	v24.h[2], v25.h[0]
+	addv	h25, v3.8h
+	ins	v21.h[3], v25.h[0]
+	addv	h25, v7.8h
+	ins	v22.h[3], v25.h[0]
+	addv	h25, v11.8h
+	ins	v23.h[3], v25.h[0]
+	addv	h25, v15.8h
+	ins	v24.h[3], v25.h[0]
+	add	x21, x21, x6
+	mov	x24, x21
+	add	x25, x24, x5
+	add	x26, x25, x5
+	add	x27, x26, x5
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	mov	x20, x15
+	movi	v0.8h, #0
+	movi	v1.8h, #0
+	movi	v2.8h, #0
+	movi	v3.8h, #0
+	movi	v4.8h, #0
+	movi	v5.8h, #0
+	movi	v6.8h, #0
+	movi	v7.8h, #0
+	movi	v8.8h, #0
+	movi	v9.8h, #0
+	movi	v10.8h, #0
+	movi	v11.8h, #0
+	movi	v12.8h, #0
+	movi	v13.8h, #0
+	movi	v14.8h, #0
+	movi	v15.8h, #0
+	lsr	x22, x5, #4
+L_frodokem_mul_bs_neon_k1:
+	ld1	{v16.8h}, [x16], #16
+	ld1	{v17.8h}, [x17], #16
+	ld1	{v18.8h}, [x19], #16
+	ld1	{v19.8h}, [x20], #16
+	ld1	{v20.8h}, [x24], #16
+	mla	v0.8h, v16.8h, v20.8h
+	mla	v4.8h, v17.8h, v20.8h
+	mla	v8.8h, v18.8h, v20.8h
+	mla	v12.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x25], #16
+	mla	v1.8h, v16.8h, v20.8h
+	mla	v5.8h, v17.8h, v20.8h
+	mla	v9.8h, v18.8h, v20.8h
+	mla	v13.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x26], #16
+	mla	v2.8h, v16.8h, v20.8h
+	mla	v6.8h, v17.8h, v20.8h
+	mla	v10.8h, v18.8h, v20.8h
+	mla	v14.8h, v19.8h, v20.8h
+	ld1	{v20.8h}, [x27], #16
+	mla	v3.8h, v16.8h, v20.8h
+	mla	v7.8h, v17.8h, v20.8h
+	mla	v11.8h, v18.8h, v20.8h
+	mla	v15.8h, v19.8h, v20.8h
+	subs	x22, x22, #1
+	bne	L_frodokem_mul_bs_neon_k1
+	addv	h25, v0.8h
+	ins	v21.h[4], v25.h[0]
+	addv	h25, v4.8h
+	ins	v22.h[4], v25.h[0]
+	addv	h25, v8.8h
+	ins	v23.h[4], v25.h[0]
+	addv	h25, v12.8h
+	ins	v24.h[4], v25.h[0]
+	addv	h25, v1.8h
+	ins	v21.h[5], v25.h[0]
+	addv	h25, v5.8h
+	ins	v22.h[5], v25.h[0]
+	addv	h25, v9.8h
+	ins	v23.h[5], v25.h[0]
+	addv	h25, v13.8h
+	ins	v24.h[5], v25.h[0]
+	addv	h25, v2.8h
+	ins	v21.h[6], v25.h[0]
+	addv	h25, v6.8h
+	ins	v22.h[6], v25.h[0]
+	addv	h25, v10.8h
+	ins	v23.h[6], v25.h[0]
+	addv	h25, v14.8h
+	ins	v24.h[6], v25.h[0]
+	addv	h25, v3.8h
+	ins	v21.h[7], v25.h[0]
+	addv	h25, v7.8h
+	ins	v22.h[7], v25.h[0]
+	addv	h25, v11.8h
+	ins	v23.h[7], v25.h[0]
+	addv	h25, v15.8h
+	ins	v24.h[7], v25.h[0]
+	add	x21, x21, x6
+	and	v21.16b, v21.16b, v26.16b
+	st1	{v21.8h}, [x7]
+	and	v22.16b, v22.16b, v26.16b
+	st1	{v22.8h}, [x8]
+	and	v23.16b, v23.16b, v26.16b
+	st1	{v23.8h}, [x9]
+	and	v24.16b, v24.16b, v26.16b
+	st1	{v24.8h}, [x10]
+	add	x11, x11, x6
+	add	x7, x7, #0x40
+	add	x8, x8, #0x40
+	add	x9, x9, #0x40
+	add	x10, x10, #0x40
+	subs	x23, x23, #1
+	bne	L_frodokem_mul_bs_neon_p
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x22, x23, [x29, #48]
+	ldp	x24, x25, [x29, #64]
+	ldp	x26, x27, [x29, #80]
+	ldp	d8, d9, [x29, #96]
+	ldp	d10, d11, [x29, #112]
+	ldp	d12, d13, [x29, #128]
+	ldp	d14, d15, [x29, #144]
+	ldp	x29, x30, [sp], #0xa0
+	ret
+#ifndef __APPLE__
+	.size	frodokem_mul_bs_neon,.-frodokem_mul_bs_neon
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_add_sb_plus_e_neon
+.type	frodokem_mul_add_sb_plus_e_neon,@function
+.align	2
+frodokem_mul_add_sb_plus_e_neon:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_add_sb_plus_e_neon
+.p2align	2
+_frodokem_mul_add_sb_plus_e_neon:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	sxtw	x5, w3
+	lsl	x5, x5, #1
+	dup	v10.8h, w4
+	mov	x6, x2
+	add	x7, x6, x5
+	add	x8, x7, x5
+	add	x9, x8, x5
+	add	x10, x9, x5
+	add	x11, x10, x5
+	add	x12, x11, x5
+	add	x13, x12, x5
+	mov	x14, x1
+	mov	x16, x0
+	ld1	{v0.8h, v1.8h, v2.8h, v3.8h}, [x16], #0x40
+	ld1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x16], #0x40
+	sub	x16, x16, #0x80
+	sxtw	x15, w3
+L_frodokem_mul_add_sb_plus_e_neon_j:
+	ld1	{v8.8h}, [x14], #16
+	ld1r	{v9.8h}, [x6], #2
+	mla	v0.8h, v8.8h, v9.8h
+	ld1r	{v9.8h}, [x7], #2
+	mla	v1.8h, v8.8h, v9.8h
+	ld1r	{v9.8h}, [x8], #2
+	mla	v2.8h, v8.8h, v9.8h
+	ld1r	{v9.8h}, [x9], #2
+	mla	v3.8h, v8.8h, v9.8h
+	ld1r	{v9.8h}, [x10], #2
+	mla	v4.8h, v8.8h, v9.8h
+	ld1r	{v9.8h}, [x11], #2
+	mla	v5.8h, v8.8h, v9.8h
+	ld1r	{v9.8h}, [x12], #2
+	mla	v6.8h, v8.8h, v9.8h
+	ld1r	{v9.8h}, [x13], #2
+	mla	v7.8h, v8.8h, v9.8h
+	subs	x15, x15, #1
+	bne	L_frodokem_mul_add_sb_plus_e_neon_j
+	and	v0.16b, v0.16b, v10.16b
+	and	v1.16b, v1.16b, v10.16b
+	and	v2.16b, v2.16b, v10.16b
+	and	v3.16b, v3.16b, v10.16b
+	and	v4.16b, v4.16b, v10.16b
+	and	v5.16b, v5.16b, v10.16b
+	and	v6.16b, v6.16b, v10.16b
+	and	v7.16b, v7.16b, v10.16b
+	st1	{v0.8h, v1.8h, v2.8h, v3.8h}, [x16], #0x40
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x16], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+#ifndef __APPLE__
+	.size	frodokem_mul_add_sb_plus_e_neon,.-frodokem_mul_add_sb_plus_e_neon
+#endif /* __APPLE__ */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+	.arch	armv8-a+crypto
+#ifndef __APPLE__
+.text
+.globl	frodokem_gen_a_rows_aes_arm64
+.type	frodokem_gen_a_rows_aes_arm64,@function
+.align	2
+frodokem_gen_a_rows_aes_arm64:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_gen_a_rows_aes_arm64
+.p2align	2
+_frodokem_gen_a_rows_aes_arm64:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x2], #0x40
+	ld1	{v8.16b, v9.16b, v10.16b}, [x2], #48
+	dup	v19.8h, w6
+	sxtw	x13, w3
+	sxtw	x7, w5
+	lsl	x7, x7, #1
+	sxtw	x8, w4
+	mul	x8, x8, x7
+	movz	w14, #8, lsl 16
+	mov	x9, x0
+L_frodokem_gen_a_rows_aes_arm64_row:
+	mov	w11, w13
+	add	x10, x9, x7
+L_frodokem_gen_a_rows_aes_arm64_blk:
+	add	x12, x11, x14
+	stp	x11, xzr, [x9], #16
+	stp	x12, xzr, [x9], #16
+	add	x11, x12, x14
+	cmp	x9, x10
+	blt	L_frodokem_gen_a_rows_aes_arm64_blk
+	add	x13, x13, #1
+	add	x10, x0, x8
+	cmp	x9, x10
+	blt	L_frodokem_gen_a_rows_aes_arm64_row
+	cmp	x8, #0x80
+	blt	L_frodokem_gen_a_rows_aes_arm64_tail
+L_frodokem_gen_a_rows_aes_arm64_aes:
+	ld1	{v11.16b, v12.16b, v13.16b, v14.16b}, [x0], #0x40
+	ld1	{v15.16b, v16.16b, v17.16b, v18.16b}, [x0], #0x40
+	aese	v11.16b, v0.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v0.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v0.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v0.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v1.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v1.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v1.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v1.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v2.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v2.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v2.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v2.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v3.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v3.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v3.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v3.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v4.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v4.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v4.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v4.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v5.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v5.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v5.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v5.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v6.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v6.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v6.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v6.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v7.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v7.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v7.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v7.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v8.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v8.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v8.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v8.16b
+	aesmc	v18.16b, v18.16b
+	aese	v11.16b, v9.16b
+	aese	v12.16b, v9.16b
+	aese	v13.16b, v9.16b
+	aese	v14.16b, v9.16b
+	aese	v15.16b, v9.16b
+	aese	v16.16b, v9.16b
+	aese	v17.16b, v9.16b
+	aese	v18.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v10.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v16.16b, v16.16b, v10.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v10.16b
+	and	v11.16b, v11.16b, v19.16b
+	and	v12.16b, v12.16b, v19.16b
+	and	v13.16b, v13.16b, v19.16b
+	and	v14.16b, v14.16b, v19.16b
+	and	v15.16b, v15.16b, v19.16b
+	and	v16.16b, v16.16b, v19.16b
+	and	v17.16b, v17.16b, v19.16b
+	and	v18.16b, v18.16b, v19.16b
+	st1	{v11.16b, v12.16b, v13.16b, v14.16b}, [x1], #0x40
+	st1	{v15.16b, v16.16b, v17.16b, v18.16b}, [x1], #0x40
+	subs	x8, x8, #0x80
+	cmp	x8, #0x80
+	bge	L_frodokem_gen_a_rows_aes_arm64_aes
+L_frodokem_gen_a_rows_aes_arm64_tail:
+	cmp	x8, #0
+	beq	L_frodokem_gen_a_rows_aes_arm64_done
+	ld1	{v11.16b, v12.16b, v13.16b, v14.16b}, [x0], #0x40
+	aese	v11.16b, v0.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v0.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v0.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v1.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v1.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v1.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v2.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v2.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v2.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v3.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v3.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v3.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v4.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v4.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v4.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v5.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v5.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v5.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v6.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v6.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v6.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v7.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v7.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v7.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v8.16b
+	aesmc	v11.16b, v11.16b
+	aese	v12.16b, v8.16b
+	aesmc	v12.16b, v12.16b
+	aese	v13.16b, v8.16b
+	aesmc	v13.16b, v13.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v11.16b, v9.16b
+	aese	v12.16b, v9.16b
+	aese	v13.16b, v9.16b
+	aese	v14.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v10.16b
+	eor	v14.16b, v14.16b, v10.16b
+	and	v11.16b, v11.16b, v19.16b
+	and	v12.16b, v12.16b, v19.16b
+	and	v13.16b, v13.16b, v19.16b
+	and	v14.16b, v14.16b, v19.16b
+	st1	{v11.16b, v12.16b, v13.16b, v14.16b}, [x1], #0x40
+L_frodokem_gen_a_rows_aes_arm64_done:
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+#ifndef __APPLE__
+	.size	frodokem_gen_a_rows_aes_arm64,.-frodokem_gen_a_rows_aes_arm64
+#endif /* __APPLE__ */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifdef WOLFSSL_FRODOKEM_SVE
+	.arch	armv9-a+sve2
+#ifndef __APPLE__
+.text
+.globl	frodokem_sa_accum_sve
+.type	frodokem_sa_accum_sve,@function
+.align	2
+frodokem_sa_accum_sve:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sa_accum_sve
+.p2align	2
+_frodokem_sa_accum_sve:
+#endif /* __APPLE__ */
+	sxtw	x5, w4
+	lsl	x6, x5, #1
+	add	x7, x2, x6
+	sxtw	x8, w3
+	lsl	x8, x8, #1
+	add	x8, x1, x8
+	mov	x9, #8
+L_frodokem_sa_accum_sve_i:
+	ldr	w11, [x8]
+	mov	z0.h, w11
+	lsr	w11, w11, #16
+	mov	z1.h, w11
+	add	x8, x8, x6
+	mov	x10, #0
+L_frodokem_sa_accum_sve_k:
+	whilelt	p0.h, x10, x5
+	ld1h	{z2.h}, p0/z, [x0, x10, lsl #1]
+	ld1h	{z3.h}, p0/z, [x2, x10, lsl #1]
+	ld1h	{z4.h}, p0/z, [x7, x10, lsl #1]
+	mla	z2.h, p0/m, z3.h, z0.h
+	mla	z2.h, p0/m, z4.h, z1.h
+	st1h	{z2.h}, p0, [x0, x10, lsl #1]
+	inch	x10
+	cmp	x10, x5
+	blt	L_frodokem_sa_accum_sve_k
+	add	x0, x0, x6
+	subs	x9, x9, #1
+	bne	L_frodokem_sa_accum_sve_i
+	ret
+#ifndef __APPLE__
+	.size	frodokem_sa_accum_sve,.-frodokem_sa_accum_sve
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_as_accum_sve
+.type	frodokem_as_accum_sve,@function
+.align	2
+frodokem_as_accum_sve:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_as_accum_sve
+.p2align	2
+_frodokem_as_accum_sve:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-112]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	str	x20, [x29, #40]
+	stp	d8, d9, [x29, #48]
+	stp	d10, d11, [x29, #64]
+	stp	d12, d13, [x29, #80]
+	stp	d14, d15, [x29, #96]
+	sxtw	x5, w4
+	lsl	x6, x5, #1
+	add	x7, x2, x6
+	mov	x12, x1
+	add	x13, x12, x6
+	add	x14, x13, x6
+	add	x15, x14, x6
+	add	x16, x15, x6
+	add	x17, x16, x6
+	add	x19, x17, x6
+	add	x20, x19, x6
+	mov	z0.h, #0
+	mov	z1.h, #0
+	mov	z2.h, #0
+	mov	z3.h, #0
+	mov	z4.h, #0
+	mov	z5.h, #0
+	mov	z6.h, #0
+	mov	z7.h, #0
+	mov	z8.h, #0
+	mov	z9.h, #0
+	mov	z10.h, #0
+	mov	z11.h, #0
+	mov	z12.h, #0
+	mov	z13.h, #0
+	mov	z14.h, #0
+	mov	z15.h, #0
+	mov	x9, #0
+L_frodokem_as_accum_sve_k:
+	whilelt	p0.h, x9, x5
+	ld1h	{z16.h}, p0/z, [x2, x9, lsl #1]
+	ld1h	{z17.h}, p0/z, [x7, x9, lsl #1]
+	ld1h	{z18.h}, p0/z, [x12, x9, lsl #1]
+	mla	z0.h, p0/m, z16.h, z18.h
+	mla	z8.h, p0/m, z17.h, z18.h
+	ld1h	{z18.h}, p0/z, [x13, x9, lsl #1]
+	mla	z1.h, p0/m, z16.h, z18.h
+	mla	z9.h, p0/m, z17.h, z18.h
+	ld1h	{z18.h}, p0/z, [x14, x9, lsl #1]
+	mla	z2.h, p0/m, z16.h, z18.h
+	mla	z10.h, p0/m, z17.h, z18.h
+	ld1h	{z18.h}, p0/z, [x15, x9, lsl #1]
+	mla	z3.h, p0/m, z16.h, z18.h
+	mla	z11.h, p0/m, z17.h, z18.h
+	ld1h	{z18.h}, p0/z, [x16, x9, lsl #1]
+	mla	z4.h, p0/m, z16.h, z18.h
+	mla	z12.h, p0/m, z17.h, z18.h
+	ld1h	{z18.h}, p0/z, [x17, x9, lsl #1]
+	mla	z5.h, p0/m, z16.h, z18.h
+	mla	z13.h, p0/m, z17.h, z18.h
+	ld1h	{z18.h}, p0/z, [x19, x9, lsl #1]
+	mla	z6.h, p0/m, z16.h, z18.h
+	mla	z14.h, p0/m, z17.h, z18.h
+	ld1h	{z18.h}, p0/z, [x20, x9, lsl #1]
+	mla	z7.h, p0/m, z16.h, z18.h
+	mla	z15.h, p0/m, z17.h, z18.h
+	inch	x9
+	cmp	x9, x5
+	blt	L_frodokem_as_accum_sve_k
+	ptrue	p1.h
+	sxtw	x10, w3
+	lsl	x10, x10, #4
+	add	x8, x0, x10
+	uaddv	d19, p1, z0.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z1.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z2.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z3.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z4.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z5.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z6.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z7.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z8.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z9.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z10.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z11.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z12.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z13.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z14.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d19, p1, z15.h
+	umov	w11, v19.h[0]
+	ldrh	w10, [x8]
+	add	w11, w11, w10
+	strh	w11, [x8]
+	add	x8, x8, #2
+	ldp	x17, x19, [x29, #24]
+	ldr	x20, [x29, #40]
+	ldp	d8, d9, [x29, #48]
+	ldp	d10, d11, [x29, #64]
+	ldp	d12, d13, [x29, #80]
+	ldp	d14, d15, [x29, #96]
+	ldp	x29, x30, [sp], #0x70
+	ret
+#ifndef __APPLE__
+	.size	frodokem_as_accum_sve,.-frodokem_as_accum_sve
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_bs_sve
+.type	frodokem_mul_bs_sve,@function
+.align	2
+frodokem_mul_bs_sve:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_bs_sve
+.p2align	2
+_frodokem_mul_bs_sve:
+#endif /* __APPLE__ */
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	str	x20, [x29, #40]
+	stp	d8, d9, [x29, #48]
+	stp	d10, d11, [x29, #64]
+	sxtw	x5, w3
+	lsl	x6, x5, #1
+	mov	x12, x2
+	add	x13, x12, x6
+	add	x14, x13, x6
+	add	x15, x14, x6
+	add	x16, x15, x6
+	add	x17, x16, x6
+	add	x19, x17, x6
+	add	x20, x19, x6
+	mov	x7, x1
+	mov	x8, x0
+	ptrue	p1.h
+	mov	x9, #8
+L_frodokem_mul_bs_sve_i:
+	mov	z0.h, #0
+	mov	z1.h, #0
+	mov	z2.h, #0
+	mov	z3.h, #0
+	mov	z4.h, #0
+	mov	z5.h, #0
+	mov	z6.h, #0
+	mov	z7.h, #0
+	mov	x10, #0
+L_frodokem_mul_bs_sve_k:
+	whilelt	p0.h, x10, x5
+	ld1h	{z8.h}, p0/z, [x7, x10, lsl #1]
+	ld1h	{z9.h}, p0/z, [x12, x10, lsl #1]
+	mla	z0.h, p0/m, z8.h, z9.h
+	ld1h	{z9.h}, p0/z, [x13, x10, lsl #1]
+	mla	z1.h, p0/m, z8.h, z9.h
+	ld1h	{z9.h}, p0/z, [x14, x10, lsl #1]
+	mla	z2.h, p0/m, z8.h, z9.h
+	ld1h	{z9.h}, p0/z, [x15, x10, lsl #1]
+	mla	z3.h, p0/m, z8.h, z9.h
+	ld1h	{z9.h}, p0/z, [x16, x10, lsl #1]
+	mla	z4.h, p0/m, z8.h, z9.h
+	ld1h	{z9.h}, p0/z, [x17, x10, lsl #1]
+	mla	z5.h, p0/m, z8.h, z9.h
+	ld1h	{z9.h}, p0/z, [x19, x10, lsl #1]
+	mla	z6.h, p0/m, z8.h, z9.h
+	ld1h	{z9.h}, p0/z, [x20, x10, lsl #1]
+	mla	z7.h, p0/m, z8.h, z9.h
+	inch	x10
+	cmp	x10, x5
+	blt	L_frodokem_mul_bs_sve_k
+	uaddv	d10, p1, z0.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d10, p1, z1.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d10, p1, z2.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d10, p1, z3.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d10, p1, z4.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d10, p1, z5.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d10, p1, z6.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	uaddv	d10, p1, z7.h
+	umov	w11, v10.h[0]
+	and	w11, w11, w4
+	strh	w11, [x8]
+	add	x8, x8, #2
+	add	x7, x7, x6
+	subs	x9, x9, #1
+	bne	L_frodokem_mul_bs_sve_i
+	ldp	x17, x19, [x29, #24]
+	ldr	x20, [x29, #40]
+	ldp	d8, d9, [x29, #48]
+	ldp	d10, d11, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+#ifndef __APPLE__
+	.size	frodokem_mul_bs_sve,.-frodokem_mul_bs_sve
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_add_sve
+.type	frodokem_add_sve,@function
+.align	2
+frodokem_add_sve:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_add_sve
+.p2align	2
+_frodokem_add_sve:
+#endif /* __APPLE__ */
+	mov	z2.h, w2
+	mov	x3, #0x40
+	mov	x4, #0
+L_frodokem_add_sve_k:
+	whilelt	p0.h, x4, x3
+	ld1h	{z0.h}, p0/z, [x0, x4, lsl #1]
+	ld1h	{z1.h}, p0/z, [x1, x4, lsl #1]
+	add	z0.h, z0.h, z1.h
+	and	z0.d, z0.d, z2.d
+	st1h	{z0.h}, p0, [x0, x4, lsl #1]
+	inch	x4
+	cmp	x4, x3
+	blt	L_frodokem_add_sve_k
+	ret
+#ifndef __APPLE__
+	.size	frodokem_add_sve,.-frodokem_add_sve
+#endif /* __APPLE__ */
+#endif /* WOLFSSL_FRODOKEM_SVE */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifdef WOLFSSL_FRODOKEM_SME
+	.arch	armv9-a+sve2+sme+sme2
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_bs_sme
+.type	frodokem_mul_bs_sme,@function
+.align	2
+frodokem_mul_bs_sme:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_bs_sme
+.p2align	2
+_frodokem_mul_bs_sme:
+#endif /* __APPLE__ */
+	smstart
+	zero	{za}
+	mov	x6, #16
+	whilelt	p0.h, xzr, x6
+	sxtw	x5, w3
+	lsr	x5, x5, #1
+L_frodokem_mul_bs_sme_k:
+	ld1h	{z0.h}, p0/z, [x1]
+	ld1h	{z1.h}, p0/z, [x2]
+	umopa	za0.s, p0/m, p0/m, z0.h, z1.h
+	add	x1, x1, #32
+	add	x2, x2, #32
+	subs	x5, x5, #1
+	bne	L_frodokem_mul_bs_sme_k
+	mov	z3.h, w4
+	mov	x6, #8
+	whilelt	p1.h, xzr, x6
+	whilelt	p2.s, xzr, x6
+	mov	w12, #0
+L_frodokem_mul_bs_sme_e:
+	mova	z2.s, p2/m, za0h.s[w12, 0]
+	uzp1	z2.h, z2.h, z2.h
+	and	z2.d, z2.d, z3.d
+	st1h	{z2.h}, p1, [x0]
+	add	x0, x0, #16
+	add	w12, w12, #1
+	cmp	w12, #8
+	bne	L_frodokem_mul_bs_sme_e
+	smstop
+	ret
+#ifndef __APPLE__
+	.size	frodokem_mul_bs_sme,.-frodokem_mul_bs_sme
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_sa_accum_sme
+.type	frodokem_sa_accum_sme,@function
+.align	2
+frodokem_sa_accum_sme:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sa_accum_sme
+.p2align	2
+_frodokem_sa_accum_sme:
+#endif /* __APPLE__ */
+	smstart
+	mov	x10, #16
+	whilelt	p0.h, xzr, x10
+	mov	x10, #8
+	whilelt	p1.h, xzr, x10
+	whilelt	p2.s, xzr, x10
+	ld1h	{z0.h}, p0/z, [x1]
+	sxtw	x10, w3
+	lsr	x9, x10, #3
+	lsl	x4, x10, #1
+	mov	x5, x2
+	add	x6, x2, x4
+	mov	x7, x0
+L_frodokem_sa_accum_sme_k:
+	zero	{za}
+	ld1h	{z1.h}, p1/z, [x5]
+	ld1h	{z2.h}, p1/z, [x6]
+	zip1	z3.h, z1.h, z2.h
+	umopa	za0.s, p0/m, p0/m, z0.h, z3.h
+	add	x5, x5, #16
+	add	x6, x6, #16
+	mov	x8, x7
+	mov	w12, #0
+L_frodokem_sa_accum_sme_e:
+	mova	z4.s, p2/m, za0h.s[w12, 0]
+	uzp1	z4.h, z4.h, z4.h
+	ld1h	{z5.h}, p1/z, [x8]
+	add	z4.h, z4.h, z5.h
+	st1h	{z4.h}, p1, [x8]
+	add	x8, x8, x4
+	add	w12, w12, #1
+	cmp	w12, #8
+	blt	L_frodokem_sa_accum_sme_e
+	add	x7, x7, #16
+	subs	x9, x9, #1
+	bne	L_frodokem_sa_accum_sme_k
+	smstop
+	ret
+#ifndef __APPLE__
+	.size	frodokem_sa_accum_sme,.-frodokem_sa_accum_sme
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_as_accum_sme
+.type	frodokem_as_accum_sme,@function
+.align	2
+frodokem_as_accum_sme:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_as_accum_sme
+.p2align	2
+_frodokem_as_accum_sme:
+#endif /* __APPLE__ */
+	smstart
+	zero	{za}
+	mov	x8, #4
+	whilelt	p0.h, xzr, x8
+	mov	x8, #16
+	whilelt	p1.h, xzr, x8
+	sxtw	x7, w4
+	lsr	x7, x7, #1
+L_frodokem_as_accum_sme_k:
+	ld1h	{z0.h}, p0/z, [x1]
+	ld1h	{z1.h}, p1/z, [x2]
+	umopa	za0.s, p0/m, p1/m, z0.h, z1.h
+	add	x1, x1, #8
+	add	x2, x2, #32
+	subs	x7, x7, #1
+	bne	L_frodokem_as_accum_sme_k
+	mov	x8, #8
+	whilelt	p2.h, xzr, x8
+	whilelt	p3.s, xzr, x8
+	sxtw	x5, w3
+	lsl	x5, x5, #4
+	add	x5, x0, x5
+	add	x6, x5, #16
+	mov	w12, #0
+	mova	z2.s, p3/m, za0h.s[w12, 0]
+	uzp1	z2.h, z2.h, z2.h
+	ld1h	{z3.h}, p2/z, [x5]
+	add	z2.h, z2.h, z3.h
+	st1h	{z2.h}, p2, [x5]
+	mov	w12, #1
+	mova	z2.s, p3/m, za0h.s[w12, 0]
+	uzp1	z2.h, z2.h, z2.h
+	ld1h	{z3.h}, p2/z, [x6]
+	add	z2.h, z2.h, z3.h
+	st1h	{z2.h}, p2, [x6]
+	smstop
+	ret
+#ifndef __APPLE__
+	.size	frodokem_as_accum_sme,.-frodokem_as_accum_sme
+#endif /* __APPLE__ */
+#endif /* WOLFSSL_FRODOKEM_SME */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#endif /* __aarch64__ */
+#endif /* WOLFSSL_ARMASM */
+
+#if defined(__linux__) && defined(__ELF__)
+.section	.note.GNU-stack,"",%progbits
+#endif
+#endif /* !WOLFSSL_ARMASM_INLINE */
diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm b/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm
new file mode 100644
index 00000000000..8dbf29e94eb
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm
@@ -0,0 +1,1665 @@
+; /* armv8-frodokem-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./frodokem/frodokem.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm
+	IF :DEF:WOLFSSL_HAVE_FRODOKEM
+	AREA	|.rodata|, DATA, READONLY, ALIGN=4
+	ALIGN	16
+L_sha3_aarch64_r
+	DCQ	0x0000000000000001, 0x0000000000008082
+	DCQ	0x800000000000808a, 0x8000000080008000
+	DCQ	0x000000000000808b, 0x0000000080000001
+	DCQ	0x8000000080008081, 0x8000000000008009
+	DCQ	0x000000000000008a, 0x0000000000000088
+	DCQ	0x0000000080008009, 0x000000008000000a
+	DCQ	0x000000008000808b, 0x800000000000008b
+	DCQ	0x8000000000008089, 0x8000000000008003
+	DCQ	0x8000000000008002, 0x8000000000000080
+	DCQ	0x000000000000800a, 0x800000008000000a
+	DCQ	0x8000000080008081, 0x8000000000008080
+	DCQ	0x0000000080000001, 0x8000000080008008
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_sha3_x2_neon
+frodokem_sha3_x2_neon PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	adrp	x1, L_sha3_aarch64_r
+	add	x1, x1, L_sha3_aarch64_r
+	ld4	{V0.D, V1.D, V2.D, V3.D}[0], [x0], #32
+	ld4	{V4.D, V5.D, V6.D, V7.D}[0], [x0], #32
+	ld4	{V8.D, V9.D, V10.D, V11.D}[0], [x0], #32
+	ld4	{V12.D, V13.D, V14.D, V15.D}[0], [x0], #32
+	ld4	{V16.D, V17.D, V18.D, V19.D}[0], [x0], #32
+	ld4	{V20.D, V21.D, V22.D, V23.D}[0], [x0], #32
+	ld1	{V24.D}[0], [x0]
+	add	x0, x0, #8
+	ld4	{V0.D, V1.D, V2.D, V3.D}[1], [x0], #32
+	ld4	{V4.D, V5.D, V6.D, V7.D}[1], [x0], #32
+	ld4	{V8.D, V9.D, V10.D, V11.D}[1], [x0], #32
+	ld4	{V12.D, V13.D, V14.D, V15.D}[1], [x0], #32
+	ld4	{V16.D, V17.D, V18.D, V19.D}[1], [x0], #32
+	ld4	{V20.D, V21.D, V22.D, V23.D}[1], [x0], #32
+	ld1	{V24.D}[1], [x0]
+	add	x0, x0, #8
+	sub	x0, x0, #0x190
+	mov	x2, #24
+L_frodokem_sha3_x2_neon_begin
+	; Col Mix NEON
+	eor	V30.16B, V4.16B, V9.16B
+	eor	V27.16B, V1.16B, V6.16B
+	eor	V30.16B, V30.16B, V14.16B
+	eor	V27.16B, V27.16B, V11.16B
+	eor	V30.16B, V30.16B, V19.16B
+	eor	V27.16B, V27.16B, V16.16B
+	eor	V30.16B, V30.16B, V24.16B
+	eor	V27.16B, V27.16B, V21.16B
+	ushr	V25.2D, V27.2D, #63
+	sli	V25.2D, V27.2D, #1
+	eor	V25.16B, V25.16B, V30.16B
+	eor	V31.16B, V0.16B, V5.16B
+	eor	V28.16B, V2.16B, V7.16B
+	eor	V31.16B, V31.16B, V10.16B
+	eor	V28.16B, V28.16B, V12.16B
+	eor	V31.16B, V31.16B, V15.16B
+	eor	V28.16B, V28.16B, V17.16B
+	eor	V31.16B, V31.16B, V20.16B
+	eor	V28.16B, V28.16B, V22.16B
+	ushr	V29.2D, V30.2D, #63
+	ushr	V26.2D, V28.2D, #63
+	sli	V29.2D, V30.2D, #1
+	sli	V26.2D, V28.2D, #1
+	eor	V28.16B, V28.16B, V29.16B
+	eor	V29.16B, V3.16B, V8.16B
+	eor	V26.16B, V26.16B, V31.16B
+	eor	V29.16B, V29.16B, V13.16B
+	eor	V29.16B, V29.16B, V18.16B
+	eor	V29.16B, V29.16B, V23.16B
+	ushr	V30.2D, V29.2D, #63
+	sli	V30.2D, V29.2D, #1
+	eor	V27.16B, V27.16B, V30.16B
+	ushr	V30.2D, V31.2D, #63
+	sli	V30.2D, V31.2D, #1
+	eor	V29.16B, V29.16B, V30.16B
+	; Swap Rotate NEON
+	eor	V0.16B, V0.16B, V25.16B
+	eor	V31.16B, V1.16B, V26.16B
+	eor	V6.16B, V6.16B, V26.16B
+	ushr	V30.2D, V31.2D, #63
+	ushr	V1.2D, V6.2D, #20
+	sli	V30.2D, V31.2D, #1
+	sli	V1.2D, V6.2D, #44
+	eor	V31.16B, V9.16B, V29.16B
+	eor	V22.16B, V22.16B, V27.16B
+	ushr	V6.2D, V31.2D, #44
+	ushr	V9.2D, V22.2D, #3
+	sli	V6.2D, V31.2D, #20
+	sli	V9.2D, V22.2D, #61
+	eor	V31.16B, V14.16B, V29.16B
+	eor	V20.16B, V20.16B, V25.16B
+	ushr	V22.2D, V31.2D, #25
+	ushr	V14.2D, V20.2D, #46
+	sli	V22.2D, V31.2D, #39
+	sli	V14.2D, V20.2D, #18
+	eor	V31.16B, V2.16B, V27.16B
+	eor	V12.16B, V12.16B, V27.16B
+	ushr	V20.2D, V31.2D, #2
+	ushr	V2.2D, V12.2D, #21
+	sli	V20.2D, V31.2D, #62
+	sli	V2.2D, V12.2D, #43
+	eor	V31.16B, V13.16B, V28.16B
+	eor	V19.16B, V19.16B, V29.16B
+	ushr	V12.2D, V31.2D, #39
+	ushr	V13.2D, V19.2D, #56
+	sli	V12.2D, V31.2D, #25
+	sli	V13.2D, V19.2D, #8
+	eor	V31.16B, V23.16B, V28.16B
+	eor	V15.16B, V15.16B, V25.16B
+	ushr	V19.2D, V31.2D, #8
+	ushr	V23.2D, V15.2D, #23
+	sli	V19.2D, V31.2D, #56
+	sli	V23.2D, V15.2D, #41
+	eor	V31.16B, V4.16B, V29.16B
+	eor	V24.16B, V24.16B, V29.16B
+	ushr	V15.2D, V31.2D, #37
+	ushr	V4.2D, V24.2D, #50
+	sli	V15.2D, V31.2D, #27
+	sli	V4.2D, V24.2D, #14
+	eor	V31.16B, V21.16B, V26.16B
+	eor	V8.16B, V8.16B, V28.16B
+	ushr	V24.2D, V31.2D, #62
+	ushr	V21.2D, V8.2D, #9
+	sli	V24.2D, V31.2D, #2
+	sli	V21.2D, V8.2D, #55
+	eor	V31.16B, V16.16B, V26.16B
+	eor	V5.16B, V5.16B, V25.16B
+	ushr	V8.2D, V31.2D, #19
+	ushr	V16.2D, V5.2D, #28
+	sli	V8.2D, V31.2D, #45
+	sli	V16.2D, V5.2D, #36
+	eor	V31.16B, V3.16B, V28.16B
+	eor	V18.16B, V18.16B, V28.16B
+	ushr	V5.2D, V31.2D, #36
+	ushr	V3.2D, V18.2D, #43
+	sli	V5.2D, V31.2D, #28
+	sli	V3.2D, V18.2D, #21
+	eor	V31.16B, V17.16B, V27.16B
+	eor	V11.16B, V11.16B, V26.16B
+	ushr	V18.2D, V31.2D, #49
+	ushr	V17.2D, V11.2D, #54
+	sli	V18.2D, V31.2D, #15
+	sli	V17.2D, V11.2D, #10
+	eor	V31.16B, V7.16B, V27.16B
+	eor	V10.16B, V10.16B, V25.16B
+	ushr	V11.2D, V31.2D, #58
+	ushr	V7.2D, V10.2D, #61
+	sli	V11.2D, V31.2D, #6
+	sli	V7.2D, V10.2D, #3
+	; Row Mix NEON
+	bic	V25.16B, V2.16B, V1.16B
+	bic	V26.16B, V3.16B, V2.16B
+	bic	V27.16B, V4.16B, V3.16B
+	bic	V28.16B, V0.16B, V4.16B
+	bic	V29.16B, V1.16B, V0.16B
+	eor	V0.16B, V0.16B, V25.16B
+	eor	V1.16B, V1.16B, V26.16B
+	eor	V2.16B, V2.16B, V27.16B
+	eor	V3.16B, V3.16B, V28.16B
+	eor	V4.16B, V4.16B, V29.16B
+	bic	V25.16B, V7.16B, V6.16B
+	bic	V26.16B, V8.16B, V7.16B
+	bic	V27.16B, V9.16B, V8.16B
+	bic	V28.16B, V5.16B, V9.16B
+	bic	V29.16B, V6.16B, V5.16B
+	eor	V5.16B, V5.16B, V25.16B
+	eor	V6.16B, V6.16B, V26.16B
+	eor	V7.16B, V7.16B, V27.16B
+	eor	V8.16B, V8.16B, V28.16B
+	eor	V9.16B, V9.16B, V29.16B
+	bic	V25.16B, V12.16B, V11.16B
+	bic	V26.16B, V13.16B, V12.16B
+	bic	V27.16B, V14.16B, V13.16B
+	bic	V28.16B, V30.16B, V14.16B
+	bic	V29.16B, V11.16B, V30.16B
+	eor	V10.16B, V30.16B, V25.16B
+	eor	V11.16B, V11.16B, V26.16B
+	eor	V12.16B, V12.16B, V27.16B
+	eor	V13.16B, V13.16B, V28.16B
+	eor	V14.16B, V14.16B, V29.16B
+	bic	V25.16B, V17.16B, V16.16B
+	bic	V26.16B, V18.16B, V17.16B
+	bic	V27.16B, V19.16B, V18.16B
+	bic	V28.16B, V15.16B, V19.16B
+	bic	V29.16B, V16.16B, V15.16B
+	eor	V15.16B, V15.16B, V25.16B
+	eor	V16.16B, V16.16B, V26.16B
+	eor	V17.16B, V17.16B, V27.16B
+	eor	V18.16B, V18.16B, V28.16B
+	eor	V19.16B, V19.16B, V29.16B
+	bic	V25.16B, V22.16B, V21.16B
+	bic	V26.16B, V23.16B, V22.16B
+	bic	V27.16B, V24.16B, V23.16B
+	bic	V28.16B, V20.16B, V24.16B
+	bic	V29.16B, V21.16B, V20.16B
+	eor	V20.16B, V20.16B, V25.16B
+	eor	V21.16B, V21.16B, V26.16B
+	eor	V22.16B, V22.16B, V27.16B
+	eor	V23.16B, V23.16B, V28.16B
+	eor	V24.16B, V24.16B, V29.16B
+	ldr	x3, [x1], #8
+	subs	x2, x2, #1
+	mov	V30.D[0], x3
+	mov	V30.D[1], x3
+	eor	V0.16B, V0.16B, V30.16B
+	bne	L_frodokem_sha3_x2_neon_begin
+	st4	{V0.D, V1.D, V2.D, V3.D}[0], [x0], #32
+	st4	{V4.D, V5.D, V6.D, V7.D}[0], [x0], #32
+	st4	{V8.D, V9.D, V10.D, V11.D}[0], [x0], #32
+	st4	{V12.D, V13.D, V14.D, V15.D}[0], [x0], #32
+	st4	{V16.D, V17.D, V18.D, V19.D}[0], [x0], #32
+	st4	{V20.D, V21.D, V22.D, V23.D}[0], [x0], #32
+	st1	{V24.D}[0], [x0]
+	add	x0, x0, #8
+	st4	{V0.D, V1.D, V2.D, V3.D}[1], [x0], #32
+	st4	{V4.D, V5.D, V6.D, V7.D}[1], [x0], #32
+	st4	{V8.D, V9.D, V10.D, V11.D}[1], [x0], #32
+	st4	{V12.D, V13.D, V14.D, V15.D}[1], [x0], #32
+	st4	{V16.D, V17.D, V18.D, V19.D}[1], [x0], #32
+	st4	{V20.D, V21.D, V22.D, V23.D}[1], [x0], #32
+	st1	{V24.D}[1], [x0]
+	add	x0, x0, #8
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
+; 	.arch_extension	sha3
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_sha3_x2_crypto
+frodokem_sha3_x2_crypto PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	adrp	x1, L_sha3_aarch64_r
+	add	x1, x1, L_sha3_aarch64_r
+	ld4	{V0.D, V1.D, V2.D, V3.D}[0], [x0], #32
+	ld4	{V4.D, V5.D, V6.D, V7.D}[0], [x0], #32
+	ld4	{V8.D, V9.D, V10.D, V11.D}[0], [x0], #32
+	ld4	{V12.D, V13.D, V14.D, V15.D}[0], [x0], #32
+	ld4	{V16.D, V17.D, V18.D, V19.D}[0], [x0], #32
+	ld4	{V20.D, V21.D, V22.D, V23.D}[0], [x0], #32
+	ld1	{V24.D}[0], [x0]
+	add	x0, x0, #8
+	ld4	{V0.D, V1.D, V2.D, V3.D}[1], [x0], #32
+	ld4	{V4.D, V5.D, V6.D, V7.D}[1], [x0], #32
+	ld4	{V8.D, V9.D, V10.D, V11.D}[1], [x0], #32
+	ld4	{V12.D, V13.D, V14.D, V15.D}[1], [x0], #32
+	ld4	{V16.D, V17.D, V18.D, V19.D}[1], [x0], #32
+	ld4	{V20.D, V21.D, V22.D, V23.D}[1], [x0], #32
+	ld1	{V24.D}[1], [x0]
+	add	x0, x0, #8
+	sub	x0, x0, #0x190
+	mov	x2, #24
+L_frodokem_sha3_x2_crypto_begin
+	; Col Mix
+	eor3	V31.16B, V0.16B, V5.16B, V10.16B
+	eor3	V27.16B, V1.16B, V6.16B, V11.16B
+	eor3	V28.16B, V2.16B, V7.16B, V12.16B
+	eor3	V29.16B, V3.16B, V8.16B, V13.16B
+	eor3	V30.16B, V4.16B, V9.16B, V14.16B
+	eor3	V31.16B, V31.16B, V15.16B, V20.16B
+	eor3	V27.16B, V27.16B, V16.16B, V21.16B
+	eor3	V28.16B, V28.16B, V17.16B, V22.16B
+	eor3	V29.16B, V29.16B, V18.16B, V23.16B
+	eor3	V30.16B, V30.16B, V19.16B, V24.16B
+	rax1	V25.2D, V30.2D, V27.2D
+	rax1	V26.2D, V31.2D, V28.2D
+	rax1	V27.2D, V27.2D, V29.2D
+	rax1	V28.2D, V28.2D, V30.2D
+	rax1	V29.2D, V29.2D, V31.2D
+	eor	V0.16B, V0.16B, V25.16B
+	xar	V30.2D, V1.2D, V26.2D, #63
+	xar	V1.2D, V6.2D, V26.2D, #20
+	xar	V6.2D, V9.2D, V29.2D, #44
+	xar	V9.2D, V22.2D, V27.2D, #3
+	xar	V22.2D, V14.2D, V29.2D, #25
+	xar	V14.2D, V20.2D, V25.2D, #46
+	xar	V20.2D, V2.2D, V27.2D, #2
+	xar	V2.2D, V12.2D, V27.2D, #21
+	xar	V12.2D, V13.2D, V28.2D, #39
+	xar	V13.2D, V19.2D, V29.2D, #56
+	xar	V19.2D, V23.2D, V28.2D, #8
+	xar	V23.2D, V15.2D, V25.2D, #23
+	xar	V15.2D, V4.2D, V29.2D, #37
+	xar	V4.2D, V24.2D, V29.2D, #50
+	xar	V24.2D, V21.2D, V26.2D, #62
+	xar	V21.2D, V8.2D, V28.2D, #9
+	xar	V8.2D, V16.2D, V26.2D, #19
+	xar	V16.2D, V5.2D, V25.2D, #28
+	xar	V5.2D, V3.2D, V28.2D, #36
+	xar	V3.2D, V18.2D, V28.2D, #43
+	xar	V18.2D, V17.2D, V27.2D, #49
+	xar	V17.2D, V11.2D, V26.2D, #54
+	xar	V11.2D, V7.2D, V27.2D, #58
+	xar	V7.2D, V10.2D, V25.2D, #61
+	; Row Mix
+	mov	V25.16B, V0.16B
+	mov	V26.16B, V1.16B
+	bcax	V0.16B, V25.16B, V2.16B, V26.16B
+	bcax	V1.16B, V26.16B, V3.16B, V2.16B
+	bcax	V2.16B, V2.16B, V4.16B, V3.16B
+	bcax	V3.16B, V3.16B, V25.16B, V4.16B
+	bcax	V4.16B, V4.16B, V26.16B, V25.16B
+	mov	V25.16B, V5.16B
+	mov	V26.16B, V6.16B
+	bcax	V5.16B, V25.16B, V7.16B, V26.16B
+	bcax	V6.16B, V26.16B, V8.16B, V7.16B
+	bcax	V7.16B, V7.16B, V9.16B, V8.16B
+	bcax	V8.16B, V8.16B, V25.16B, V9.16B
+	bcax	V9.16B, V9.16B, V26.16B, V25.16B
+	mov	V26.16B, V11.16B
+	bcax	V10.16B, V30.16B, V12.16B, V26.16B
+	bcax	V11.16B, V26.16B, V13.16B, V12.16B
+	bcax	V12.16B, V12.16B, V14.16B, V13.16B
+	bcax	V13.16B, V13.16B, V30.16B, V14.16B
+	bcax	V14.16B, V14.16B, V26.16B, V30.16B
+	mov	V25.16B, V15.16B
+	mov	V26.16B, V16.16B
+	bcax	V15.16B, V25.16B, V17.16B, V26.16B
+	bcax	V16.16B, V26.16B, V18.16B, V17.16B
+	bcax	V17.16B, V17.16B, V19.16B, V18.16B
+	bcax	V18.16B, V18.16B, V25.16B, V19.16B
+	bcax	V19.16B, V19.16B, V26.16B, V25.16B
+	mov	V25.16B, V20.16B
+	mov	V26.16B, V21.16B
+	bcax	V20.16B, V25.16B, V22.16B, V26.16B
+	bcax	V21.16B, V26.16B, V23.16B, V22.16B
+	bcax	V22.16B, V22.16B, V24.16B, V23.16B
+	bcax	V23.16B, V23.16B, V25.16B, V24.16B
+	bcax	V24.16B, V24.16B, V26.16B, V25.16B
+	ldr	x3, [x1], #8
+	subs	x2, x2, #1
+	mov	V30.D[0], x3
+	mov	V30.D[1], x3
+	eor	V0.16B, V0.16B, V30.16B
+	bne	L_frodokem_sha3_x2_crypto_begin
+	st4	{V0.D, V1.D, V2.D, V3.D}[0], [x0], #32
+	st4	{V4.D, V5.D, V6.D, V7.D}[0], [x0], #32
+	st4	{V8.D, V9.D, V10.D, V11.D}[0], [x0], #32
+	st4	{V12.D, V13.D, V14.D, V15.D}[0], [x0], #32
+	st4	{V16.D, V17.D, V18.D, V19.D}[0], [x0], #32
+	st4	{V20.D, V21.D, V22.D, V23.D}[0], [x0], #32
+	st1	{V24.D}[0], [x0]
+	add	x0, x0, #8
+	st4	{V0.D, V1.D, V2.D, V3.D}[1], [x0], #32
+	st4	{V4.D, V5.D, V6.D, V7.D}[1], [x0], #32
+	st4	{V8.D, V9.D, V10.D, V11.D}[1], [x0], #32
+	st4	{V12.D, V13.D, V14.D, V15.D}[1], [x0], #32
+	st4	{V16.D, V17.D, V18.D, V19.D}[1], [x0], #32
+	st4	{V20.D, V21.D, V22.D, V23.D}[1], [x0], #32
+	st1	{V24.D}[1], [x0]
+	add	x0, x0, #8
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_add_neon
+frodokem_add_neon PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	dup	V16.8H, w2
+	ld1	{V0.8H, V1.8H, V2.8H, V3.8H}, [x0], #0x40
+	ld1	{V4.8H, V5.8H, V6.8H, V7.8H}, [x0], #0x40
+	sub	x0, x0, #0x80
+	ld1	{V8.8H, V9.8H, V10.8H, V11.8H}, [x1], #0x40
+	ld1	{V12.8H, V13.8H, V14.8H, V15.8H}, [x1], #0x40
+	add	V0.8H, V0.8H, V8.8H
+	and	V0.16B, V0.16B, V16.16B
+	add	V1.8H, V1.8H, V9.8H
+	and	V1.16B, V1.16B, V16.16B
+	add	V2.8H, V2.8H, V10.8H
+	and	V2.16B, V2.16B, V16.16B
+	add	V3.8H, V3.8H, V11.8H
+	and	V3.16B, V3.16B, V16.16B
+	add	V4.8H, V4.8H, V12.8H
+	and	V4.16B, V4.16B, V16.16B
+	add	V5.8H, V5.8H, V13.8H
+	and	V5.16B, V5.16B, V16.16B
+	add	V6.8H, V6.8H, V14.8H
+	and	V6.16B, V6.16B, V16.16B
+	add	V7.8H, V7.8H, V15.8H
+	and	V7.16B, V7.16B, V16.16B
+	st1	{V0.8H, V1.8H, V2.8H, V3.8H}, [x0], #0x40
+	st1	{V4.8H, V5.8H, V6.8H, V7.8H}, [x0], #0x40
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_sample_neon
+frodokem_sample_neon PROC
+	stp	x29, x30, [sp, #-64]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	cmp	w1, #16
+	blt	L_frodokem_sample_neon_rem
+L_frodokem_sample_neon_blk16
+	ld1	{V0.8H}, [x0], #16
+	ld1	{V1.8H}, [x0], #16
+	sub	x0, x0, #32
+	ushr	V2.8H, V0.8H, #1
+	movi	V4.8H, #1
+	and	V4.16B, V4.16B, V0.16B
+	movi	V6.8H, #0
+	ushr	V3.8H, V1.8H, #1
+	movi	V5.8H, #1
+	and	V5.16B, V5.16B, V1.16B
+	movi	V7.8H, #0
+	mov	x4, x2
+	mov	w5, w3
+L_frodokem_sample_neon_cdf16
+	ld1r	{V12.8H}, [x4], #2
+	sub	V10.8H, V12.8H, V2.8H
+	ushr	V10.8H, V10.8H, #15
+	add	V6.8H, V6.8H, V10.8H
+	sub	V11.8H, V12.8H, V3.8H
+	ushr	V11.8H, V11.8H, #15
+	add	V7.8H, V7.8H, V11.8H
+	subs	w5, w5, #1
+	bne	L_frodokem_sample_neon_cdf16
+	neg	V8.8H, V4.8H
+	eor	V6.16B, V6.16B, V8.16B
+	add	V6.8H, V6.8H, V4.8H
+	st1	{V6.8H}, [x0], #16
+	neg	V9.8H, V5.8H
+	eor	V7.16B, V7.16B, V9.16B
+	add	V7.8H, V7.8H, V5.8H
+	st1	{V7.8H}, [x0], #16
+	subs	w1, w1, #16
+	cmp	w1, #16
+	bge	L_frodokem_sample_neon_blk16
+L_frodokem_sample_neon_rem
+	cmp	w1, #0
+	beq	L_frodokem_sample_neon_done
+L_frodokem_sample_neon_blk
+	ld1	{V0.8H}, [x0]
+	ushr	V2.8H, V0.8H, #1
+	movi	V4.8H, #1
+	and	V4.16B, V4.16B, V0.16B
+	movi	V6.8H, #0
+	mov	x4, x2
+	mov	w5, w3
+L_frodokem_sample_neon_cdf
+	ld1r	{V12.8H}, [x4], #2
+	sub	V12.8H, V12.8H, V2.8H
+	ushr	V12.8H, V12.8H, #15
+	add	V6.8H, V6.8H, V12.8H
+	subs	w5, w5, #1
+	bne	L_frodokem_sample_neon_cdf
+	neg	V8.8H, V4.8H
+	eor	V6.16B, V6.16B, V8.16B
+	add	V6.8H, V6.8H, V4.8H
+	st1	{V6.8H}, [x0], #16
+	subs	w1, w1, #8
+	bne	L_frodokem_sample_neon_blk
+L_frodokem_sample_neon_done
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	x29, x30, [sp], #0x40
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_sa_accum_neon
+frodokem_sa_accum_neon PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	stp	D8, D9, [x29, #32]
+	stp	D10, D11, [x29, #48]
+	stp	D12, D13, [x29, #64]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x7, w3
+	lsl	x7, x7, #1
+	add	x7, x1, x7
+	mov	x8, x0
+	mov	x12, #2
+L_frodokem_sa_accum_neon_t
+	ldr	w13, [x7]
+	dup	V0.8H, w13
+	lsr	w13, w13, #16
+	dup	V4.8H, w13
+	add	x7, x7, x5
+	ldr	w13, [x7]
+	dup	V1.8H, w13
+	lsr	w13, w13, #16
+	dup	V5.8H, w13
+	add	x7, x7, x5
+	ldr	w13, [x7]
+	dup	V2.8H, w13
+	lsr	w13, w13, #16
+	dup	V6.8H, w13
+	add	x7, x7, x5
+	ldr	w13, [x7]
+	dup	V3.8H, w13
+	lsr	w13, w13, #16
+	dup	V7.8H, w13
+	add	x7, x7, x5
+	mov	x14, x8
+	add	x15, x14, x5
+	add	x16, x15, x5
+	add	x17, x16, x5
+	mov	x9, x2
+	add	x10, x2, x5
+	lsr	x11, x5, #4
+L_frodokem_sa_accum_neon_k
+	ld1	{V8.8H}, [x9], #16
+	ld1	{V9.8H}, [x10], #16
+	ld1	{V10.8H}, [x14]
+	mla	V10.8H, V8.8H, V0.8H
+	mla	V10.8H, V9.8H, V4.8H
+	st1	{V10.8H}, [x14], #16
+	ld1	{V11.8H}, [x15]
+	mla	V11.8H, V8.8H, V1.8H
+	mla	V11.8H, V9.8H, V5.8H
+	st1	{V11.8H}, [x15], #16
+	ld1	{V12.8H}, [x16]
+	mla	V12.8H, V8.8H, V2.8H
+	mla	V12.8H, V9.8H, V6.8H
+	st1	{V12.8H}, [x16], #16
+	ld1	{V13.8H}, [x17]
+	mla	V13.8H, V8.8H, V3.8H
+	mla	V13.8H, V9.8H, V7.8H
+	st1	{V13.8H}, [x17], #16
+	subs	x11, x11, #1
+	bne	L_frodokem_sa_accum_neon_k
+	add	x8, x8, x6
+	subs	x12, x12, #1
+	bne	L_frodokem_sa_accum_neon_t
+	ldr	x17, [x29, #24]
+	ldp	D8, D9, [x29, #32]
+	ldp	D10, D11, [x29, #48]
+	ldp	D12, D13, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_sa_accum_x4_neon
+frodokem_sa_accum_x4_neon PROC
+	stp	x29, x30, [sp, #-112]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	str	x20, [x29, #40]
+	stp	D8, D9, [x29, #48]
+	stp	D10, D11, [x29, #64]
+	stp	D12, D13, [x29, #80]
+	stp	D14, D15, [x29, #96]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x7, w3
+	lsl	x7, x7, #1
+	add	x7, x1, x7
+	mov	x8, x0
+	mov	x14, #2
+L_frodokem_sa_accum_x4_neon_t
+	ldr	x15, [x7]
+	dup	V0.8H, w15
+	lsr	x15, x15, #16
+	dup	V1.8H, w15
+	lsr	x15, x15, #16
+	dup	V2.8H, w15
+	lsr	x15, x15, #16
+	dup	V3.8H, w15
+	add	x7, x7, x5
+	ldr	x15, [x7]
+	dup	V4.8H, w15
+	lsr	x15, x15, #16
+	dup	V5.8H, w15
+	lsr	x15, x15, #16
+	dup	V6.8H, w15
+	lsr	x15, x15, #16
+	dup	V7.8H, w15
+	add	x7, x7, x5
+	ldr	x15, [x7]
+	dup	V8.8H, w15
+	lsr	x15, x15, #16
+	dup	V9.8H, w15
+	lsr	x15, x15, #16
+	dup	V10.8H, w15
+	lsr	x15, x15, #16
+	dup	V11.8H, w15
+	add	x7, x7, x5
+	ldr	x15, [x7]
+	dup	V12.8H, w15
+	lsr	x15, x15, #16
+	dup	V13.8H, w15
+	lsr	x15, x15, #16
+	dup	V14.8H, w15
+	lsr	x15, x15, #16
+	dup	V15.8H, w15
+	add	x7, x7, x5
+	mov	x16, x8
+	add	x17, x16, x5
+	add	x19, x17, x5
+	add	x20, x19, x5
+	mov	x9, x2
+	add	x10, x9, x5
+	add	x11, x10, x5
+	add	x12, x11, x5
+	lsr	x13, x5, #4
+L_frodokem_sa_accum_x4_neon_k
+	ld1	{V16.8H}, [x9], #16
+	ld1	{V17.8H}, [x10], #16
+	ld1	{V18.8H}, [x11], #16
+	ld1	{V19.8H}, [x12], #16
+	ld1	{V20.8H}, [x16]
+	mla	V20.8H, V16.8H, V0.8H
+	mla	V20.8H, V17.8H, V1.8H
+	mla	V20.8H, V18.8H, V2.8H
+	mla	V20.8H, V19.8H, V3.8H
+	st1	{V20.8H}, [x16], #16
+	ld1	{V21.8H}, [x17]
+	mla	V21.8H, V16.8H, V4.8H
+	mla	V21.8H, V17.8H, V5.8H
+	mla	V21.8H, V18.8H, V6.8H
+	mla	V21.8H, V19.8H, V7.8H
+	st1	{V21.8H}, [x17], #16
+	ld1	{V22.8H}, [x19]
+	mla	V22.8H, V16.8H, V8.8H
+	mla	V22.8H, V17.8H, V9.8H
+	mla	V22.8H, V18.8H, V10.8H
+	mla	V22.8H, V19.8H, V11.8H
+	st1	{V22.8H}, [x19], #16
+	ld1	{V23.8H}, [x20]
+	mla	V23.8H, V16.8H, V12.8H
+	mla	V23.8H, V17.8H, V13.8H
+	mla	V23.8H, V18.8H, V14.8H
+	mla	V23.8H, V19.8H, V15.8H
+	st1	{V23.8H}, [x20], #16
+	subs	x13, x13, #1
+	bne	L_frodokem_sa_accum_x4_neon_k
+	add	x8, x8, x6
+	subs	x14, x14, #1
+	bne	L_frodokem_sa_accum_x4_neon_t
+	ldp	x17, x19, [x29, #24]
+	ldr	x20, [x29, #40]
+	ldp	D8, D9, [x29, #48]
+	ldp	D10, D11, [x29, #64]
+	ldp	D12, D13, [x29, #80]
+	ldp	D14, D15, [x29, #96]
+	ldp	x29, x30, [sp], #0x70
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_as_accum_neon
+frodokem_as_accum_neon PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	str	x20, [x29, #40]
+	stp	D8, D9, [x29, #48]
+	stp	D10, D11, [x29, #64]
+	stp	D12, D13, [x29, #80]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x15, w3
+	lsl	x15, x15, #4
+	add	x7, x0, x15
+	add	x8, x7, #16
+	mov	x9, x2
+	add	x10, x2, x5
+	mov	x13, x1
+	mov	x16, x13
+	add	x17, x16, x5
+	add	x19, x17, x5
+	add	x20, x19, x5
+	mov	x11, x9
+	mov	x12, x10
+	movi	V0.8H, #0
+	movi	V1.8H, #0
+	movi	V2.8H, #0
+	movi	V3.8H, #0
+	movi	V4.8H, #0
+	movi	V5.8H, #0
+	movi	V6.8H, #0
+	movi	V7.8H, #0
+	lsr	x14, x5, #4
+L_frodokem_as_accum_neon_k0
+	ld1	{V8.8H}, [x11], #16
+	ld1	{V9.8H}, [x12], #16
+	ld1	{V10.8H}, [x16], #16
+	mla	V0.8H, V8.8H, V10.8H
+	mla	V4.8H, V9.8H, V10.8H
+	ld1	{V10.8H}, [x17], #16
+	mla	V1.8H, V8.8H, V10.8H
+	mla	V5.8H, V9.8H, V10.8H
+	ld1	{V10.8H}, [x19], #16
+	mla	V2.8H, V8.8H, V10.8H
+	mla	V6.8H, V9.8H, V10.8H
+	ld1	{V10.8H}, [x20], #16
+	mla	V3.8H, V8.8H, V10.8H
+	mla	V7.8H, V9.8H, V10.8H
+	subs	x14, x14, #1
+	bne	L_frodokem_as_accum_neon_k0
+	addv	H13, V0.8H
+	ins	V11.H[0], V13.H[0]
+	addv	H13, V4.8H
+	ins	V12.H[0], V13.H[0]
+	addv	H13, V1.8H
+	ins	V11.H[1], V13.H[0]
+	addv	H13, V5.8H
+	ins	V12.H[1], V13.H[0]
+	addv	H13, V2.8H
+	ins	V11.H[2], V13.H[0]
+	addv	H13, V6.8H
+	ins	V12.H[2], V13.H[0]
+	addv	H13, V3.8H
+	ins	V11.H[3], V13.H[0]
+	addv	H13, V7.8H
+	ins	V12.H[3], V13.H[0]
+	add	x13, x13, x6
+	mov	x16, x13
+	add	x17, x16, x5
+	add	x19, x17, x5
+	add	x20, x19, x5
+	mov	x11, x9
+	mov	x12, x10
+	movi	V0.8H, #0
+	movi	V1.8H, #0
+	movi	V2.8H, #0
+	movi	V3.8H, #0
+	movi	V4.8H, #0
+	movi	V5.8H, #0
+	movi	V6.8H, #0
+	movi	V7.8H, #0
+	lsr	x14, x5, #4
+L_frodokem_as_accum_neon_k1
+	ld1	{V8.8H}, [x11], #16
+	ld1	{V9.8H}, [x12], #16
+	ld1	{V10.8H}, [x16], #16
+	mla	V0.8H, V8.8H, V10.8H
+	mla	V4.8H, V9.8H, V10.8H
+	ld1	{V10.8H}, [x17], #16
+	mla	V1.8H, V8.8H, V10.8H
+	mla	V5.8H, V9.8H, V10.8H
+	ld1	{V10.8H}, [x19], #16
+	mla	V2.8H, V8.8H, V10.8H
+	mla	V6.8H, V9.8H, V10.8H
+	ld1	{V10.8H}, [x20], #16
+	mla	V3.8H, V8.8H, V10.8H
+	mla	V7.8H, V9.8H, V10.8H
+	subs	x14, x14, #1
+	bne	L_frodokem_as_accum_neon_k1
+	addv	H13, V0.8H
+	ins	V11.H[4], V13.H[0]
+	addv	H13, V4.8H
+	ins	V12.H[4], V13.H[0]
+	addv	H13, V1.8H
+	ins	V11.H[5], V13.H[0]
+	addv	H13, V5.8H
+	ins	V12.H[5], V13.H[0]
+	addv	H13, V2.8H
+	ins	V11.H[6], V13.H[0]
+	addv	H13, V6.8H
+	ins	V12.H[6], V13.H[0]
+	addv	H13, V3.8H
+	ins	V11.H[7], V13.H[0]
+	addv	H13, V7.8H
+	ins	V12.H[7], V13.H[0]
+	add	x13, x13, x6
+	ld1	{V8.8H}, [x7]
+	add	V11.8H, V11.8H, V8.8H
+	st1	{V11.8H}, [x7], #16
+	ld1	{V9.8H}, [x8]
+	add	V12.8H, V12.8H, V9.8H
+	st1	{V12.8H}, [x8], #16
+	ldp	x17, x19, [x29, #24]
+	ldr	x20, [x29, #40]
+	ldp	D8, D9, [x29, #48]
+	ldp	D10, D11, [x29, #64]
+	ldp	D12, D13, [x29, #80]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_as_accum_x4_neon
+frodokem_as_accum_x4_neon PROC
+	stp	x29, x30, [sp, #-160]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	str	x26, [x29, #88]
+	stp	D8, D9, [x29, #96]
+	stp	D10, D11, [x29, #112]
+	stp	D12, D13, [x29, #128]
+	stp	D14, D15, [x29, #144]
+	sxtw	x5, w4
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	sxtw	x22, w3
+	lsl	x22, x22, #4
+	add	x7, x0, x22
+	add	x8, x7, #16
+	add	x9, x8, #16
+	add	x10, x9, #16
+	mov	x11, x2
+	add	x12, x11, x5
+	add	x13, x12, x5
+	add	x14, x13, x5
+	mov	x20, x1
+	mov	x23, x20
+	add	x24, x23, x5
+	add	x25, x24, x5
+	add	x26, x25, x5
+	mov	x15, x11
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	movi	V0.8H, #0
+	movi	V1.8H, #0
+	movi	V2.8H, #0
+	movi	V3.8H, #0
+	movi	V4.8H, #0
+	movi	V5.8H, #0
+	movi	V6.8H, #0
+	movi	V7.8H, #0
+	movi	V8.8H, #0
+	movi	V9.8H, #0
+	movi	V10.8H, #0
+	movi	V11.8H, #0
+	movi	V12.8H, #0
+	movi	V13.8H, #0
+	movi	V14.8H, #0
+	movi	V15.8H, #0
+	lsr	x21, x5, #4
+L_frodokem_as_accum_x4_neon_k0
+	ld1	{V16.8H}, [x15], #16
+	ld1	{V17.8H}, [x16], #16
+	ld1	{V18.8H}, [x17], #16
+	ld1	{V19.8H}, [x19], #16
+	ld1	{V20.8H}, [x23], #16
+	mla	V0.8H, V16.8H, V20.8H
+	mla	V4.8H, V17.8H, V20.8H
+	mla	V8.8H, V18.8H, V20.8H
+	mla	V12.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x24], #16
+	mla	V1.8H, V16.8H, V20.8H
+	mla	V5.8H, V17.8H, V20.8H
+	mla	V9.8H, V18.8H, V20.8H
+	mla	V13.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x25], #16
+	mla	V2.8H, V16.8H, V20.8H
+	mla	V6.8H, V17.8H, V20.8H
+	mla	V10.8H, V18.8H, V20.8H
+	mla	V14.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x26], #16
+	mla	V3.8H, V16.8H, V20.8H
+	mla	V7.8H, V17.8H, V20.8H
+	mla	V11.8H, V18.8H, V20.8H
+	mla	V15.8H, V19.8H, V20.8H
+	subs	x21, x21, #1
+	bne	L_frodokem_as_accum_x4_neon_k0
+	addv	H25, V0.8H
+	ins	V21.H[0], V25.H[0]
+	addv	H25, V4.8H
+	ins	V22.H[0], V25.H[0]
+	addv	H25, V8.8H
+	ins	V23.H[0], V25.H[0]
+	addv	H25, V12.8H
+	ins	V24.H[0], V25.H[0]
+	addv	H25, V1.8H
+	ins	V21.H[1], V25.H[0]
+	addv	H25, V5.8H
+	ins	V22.H[1], V25.H[0]
+	addv	H25, V9.8H
+	ins	V23.H[1], V25.H[0]
+	addv	H25, V13.8H
+	ins	V24.H[1], V25.H[0]
+	addv	H25, V2.8H
+	ins	V21.H[2], V25.H[0]
+	addv	H25, V6.8H
+	ins	V22.H[2], V25.H[0]
+	addv	H25, V10.8H
+	ins	V23.H[2], V25.H[0]
+	addv	H25, V14.8H
+	ins	V24.H[2], V25.H[0]
+	addv	H25, V3.8H
+	ins	V21.H[3], V25.H[0]
+	addv	H25, V7.8H
+	ins	V22.H[3], V25.H[0]
+	addv	H25, V11.8H
+	ins	V23.H[3], V25.H[0]
+	addv	H25, V15.8H
+	ins	V24.H[3], V25.H[0]
+	add	x20, x20, x6
+	mov	x23, x20
+	add	x24, x23, x5
+	add	x25, x24, x5
+	add	x26, x25, x5
+	mov	x15, x11
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	movi	V0.8H, #0
+	movi	V1.8H, #0
+	movi	V2.8H, #0
+	movi	V3.8H, #0
+	movi	V4.8H, #0
+	movi	V5.8H, #0
+	movi	V6.8H, #0
+	movi	V7.8H, #0
+	movi	V8.8H, #0
+	movi	V9.8H, #0
+	movi	V10.8H, #0
+	movi	V11.8H, #0
+	movi	V12.8H, #0
+	movi	V13.8H, #0
+	movi	V14.8H, #0
+	movi	V15.8H, #0
+	lsr	x21, x5, #4
+L_frodokem_as_accum_x4_neon_k1
+	ld1	{V16.8H}, [x15], #16
+	ld1	{V17.8H}, [x16], #16
+	ld1	{V18.8H}, [x17], #16
+	ld1	{V19.8H}, [x19], #16
+	ld1	{V20.8H}, [x23], #16
+	mla	V0.8H, V16.8H, V20.8H
+	mla	V4.8H, V17.8H, V20.8H
+	mla	V8.8H, V18.8H, V20.8H
+	mla	V12.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x24], #16
+	mla	V1.8H, V16.8H, V20.8H
+	mla	V5.8H, V17.8H, V20.8H
+	mla	V9.8H, V18.8H, V20.8H
+	mla	V13.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x25], #16
+	mla	V2.8H, V16.8H, V20.8H
+	mla	V6.8H, V17.8H, V20.8H
+	mla	V10.8H, V18.8H, V20.8H
+	mla	V14.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x26], #16
+	mla	V3.8H, V16.8H, V20.8H
+	mla	V7.8H, V17.8H, V20.8H
+	mla	V11.8H, V18.8H, V20.8H
+	mla	V15.8H, V19.8H, V20.8H
+	subs	x21, x21, #1
+	bne	L_frodokem_as_accum_x4_neon_k1
+	addv	H25, V0.8H
+	ins	V21.H[4], V25.H[0]
+	addv	H25, V4.8H
+	ins	V22.H[4], V25.H[0]
+	addv	H25, V8.8H
+	ins	V23.H[4], V25.H[0]
+	addv	H25, V12.8H
+	ins	V24.H[4], V25.H[0]
+	addv	H25, V1.8H
+	ins	V21.H[5], V25.H[0]
+	addv	H25, V5.8H
+	ins	V22.H[5], V25.H[0]
+	addv	H25, V9.8H
+	ins	V23.H[5], V25.H[0]
+	addv	H25, V13.8H
+	ins	V24.H[5], V25.H[0]
+	addv	H25, V2.8H
+	ins	V21.H[6], V25.H[0]
+	addv	H25, V6.8H
+	ins	V22.H[6], V25.H[0]
+	addv	H25, V10.8H
+	ins	V23.H[6], V25.H[0]
+	addv	H25, V14.8H
+	ins	V24.H[6], V25.H[0]
+	addv	H25, V3.8H
+	ins	V21.H[7], V25.H[0]
+	addv	H25, V7.8H
+	ins	V22.H[7], V25.H[0]
+	addv	H25, V11.8H
+	ins	V23.H[7], V25.H[0]
+	addv	H25, V15.8H
+	ins	V24.H[7], V25.H[0]
+	add	x20, x20, x6
+	ld1	{V16.8H}, [x7]
+	add	V21.8H, V21.8H, V16.8H
+	st1	{V21.8H}, [x7], #16
+	ld1	{V16.8H}, [x8]
+	add	V22.8H, V22.8H, V16.8H
+	st1	{V22.8H}, [x8], #16
+	ld1	{V16.8H}, [x9]
+	add	V23.8H, V23.8H, V16.8H
+	st1	{V23.8H}, [x9], #16
+	ld1	{V16.8H}, [x10]
+	add	V24.8H, V24.8H, V16.8H
+	st1	{V24.8H}, [x10], #16
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldr	x26, [x29, #88]
+	ldp	D8, D9, [x29, #96]
+	ldp	D10, D11, [x29, #112]
+	ldp	D12, D13, [x29, #128]
+	ldp	D14, D15, [x29, #144]
+	ldp	x29, x30, [sp], #0xa0
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_mul_bs_neon
+frodokem_mul_bs_neon PROC
+	stp	x29, x30, [sp, #-160]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	stp	x22, x23, [x29, #48]
+	stp	x24, x25, [x29, #64]
+	stp	x26, x27, [x29, #80]
+	stp	D8, D9, [x29, #96]
+	stp	D10, D11, [x29, #112]
+	stp	D12, D13, [x29, #128]
+	stp	D14, D15, [x29, #144]
+	sxtw	x5, w3
+	lsl	x5, x5, #1
+	lsl	x6, x5, #2
+	dup	V26.8H, w4
+	mov	x7, x0
+	add	x8, x7, #16
+	add	x9, x8, #16
+	add	x10, x9, #16
+	mov	x11, x1
+	mov	x23, #2
+L_frodokem_mul_bs_neon_p
+	mov	x12, x11
+	add	x13, x12, x5
+	add	x14, x13, x5
+	add	x15, x14, x5
+	mov	x21, x2
+	mov	x24, x21
+	add	x25, x24, x5
+	add	x26, x25, x5
+	add	x27, x26, x5
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	mov	x20, x15
+	movi	V0.8H, #0
+	movi	V1.8H, #0
+	movi	V2.8H, #0
+	movi	V3.8H, #0
+	movi	V4.8H, #0
+	movi	V5.8H, #0
+	movi	V6.8H, #0
+	movi	V7.8H, #0
+	movi	V8.8H, #0
+	movi	V9.8H, #0
+	movi	V10.8H, #0
+	movi	V11.8H, #0
+	movi	V12.8H, #0
+	movi	V13.8H, #0
+	movi	V14.8H, #0
+	movi	V15.8H, #0
+	lsr	x22, x5, #4
+L_frodokem_mul_bs_neon_k0
+	ld1	{V16.8H}, [x16], #16
+	ld1	{V17.8H}, [x17], #16
+	ld1	{V18.8H}, [x19], #16
+	ld1	{V19.8H}, [x20], #16
+	ld1	{V20.8H}, [x24], #16
+	mla	V0.8H, V16.8H, V20.8H
+	mla	V4.8H, V17.8H, V20.8H
+	mla	V8.8H, V18.8H, V20.8H
+	mla	V12.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x25], #16
+	mla	V1.8H, V16.8H, V20.8H
+	mla	V5.8H, V17.8H, V20.8H
+	mla	V9.8H, V18.8H, V20.8H
+	mla	V13.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x26], #16
+	mla	V2.8H, V16.8H, V20.8H
+	mla	V6.8H, V17.8H, V20.8H
+	mla	V10.8H, V18.8H, V20.8H
+	mla	V14.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x27], #16
+	mla	V3.8H, V16.8H, V20.8H
+	mla	V7.8H, V17.8H, V20.8H
+	mla	V11.8H, V18.8H, V20.8H
+	mla	V15.8H, V19.8H, V20.8H
+	subs	x22, x22, #1
+	bne	L_frodokem_mul_bs_neon_k0
+	addv	H25, V0.8H
+	ins	V21.H[0], V25.H[0]
+	addv	H25, V4.8H
+	ins	V22.H[0], V25.H[0]
+	addv	H25, V8.8H
+	ins	V23.H[0], V25.H[0]
+	addv	H25, V12.8H
+	ins	V24.H[0], V25.H[0]
+	addv	H25, V1.8H
+	ins	V21.H[1], V25.H[0]
+	addv	H25, V5.8H
+	ins	V22.H[1], V25.H[0]
+	addv	H25, V9.8H
+	ins	V23.H[1], V25.H[0]
+	addv	H25, V13.8H
+	ins	V24.H[1], V25.H[0]
+	addv	H25, V2.8H
+	ins	V21.H[2], V25.H[0]
+	addv	H25, V6.8H
+	ins	V22.H[2], V25.H[0]
+	addv	H25, V10.8H
+	ins	V23.H[2], V25.H[0]
+	addv	H25, V14.8H
+	ins	V24.H[2], V25.H[0]
+	addv	H25, V3.8H
+	ins	V21.H[3], V25.H[0]
+	addv	H25, V7.8H
+	ins	V22.H[3], V25.H[0]
+	addv	H25, V11.8H
+	ins	V23.H[3], V25.H[0]
+	addv	H25, V15.8H
+	ins	V24.H[3], V25.H[0]
+	add	x21, x21, x6
+	mov	x24, x21
+	add	x25, x24, x5
+	add	x26, x25, x5
+	add	x27, x26, x5
+	mov	x16, x12
+	mov	x17, x13
+	mov	x19, x14
+	mov	x20, x15
+	movi	V0.8H, #0
+	movi	V1.8H, #0
+	movi	V2.8H, #0
+	movi	V3.8H, #0
+	movi	V4.8H, #0
+	movi	V5.8H, #0
+	movi	V6.8H, #0
+	movi	V7.8H, #0
+	movi	V8.8H, #0
+	movi	V9.8H, #0
+	movi	V10.8H, #0
+	movi	V11.8H, #0
+	movi	V12.8H, #0
+	movi	V13.8H, #0
+	movi	V14.8H, #0
+	movi	V15.8H, #0
+	lsr	x22, x5, #4
+L_frodokem_mul_bs_neon_k1
+	ld1	{V16.8H}, [x16], #16
+	ld1	{V17.8H}, [x17], #16
+	ld1	{V18.8H}, [x19], #16
+	ld1	{V19.8H}, [x20], #16
+	ld1	{V20.8H}, [x24], #16
+	mla	V0.8H, V16.8H, V20.8H
+	mla	V4.8H, V17.8H, V20.8H
+	mla	V8.8H, V18.8H, V20.8H
+	mla	V12.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x25], #16
+	mla	V1.8H, V16.8H, V20.8H
+	mla	V5.8H, V17.8H, V20.8H
+	mla	V9.8H, V18.8H, V20.8H
+	mla	V13.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x26], #16
+	mla	V2.8H, V16.8H, V20.8H
+	mla	V6.8H, V17.8H, V20.8H
+	mla	V10.8H, V18.8H, V20.8H
+	mla	V14.8H, V19.8H, V20.8H
+	ld1	{V20.8H}, [x27], #16
+	mla	V3.8H, V16.8H, V20.8H
+	mla	V7.8H, V17.8H, V20.8H
+	mla	V11.8H, V18.8H, V20.8H
+	mla	V15.8H, V19.8H, V20.8H
+	subs	x22, x22, #1
+	bne	L_frodokem_mul_bs_neon_k1
+	addv	H25, V0.8H
+	ins	V21.H[4], V25.H[0]
+	addv	H25, V4.8H
+	ins	V22.H[4], V25.H[0]
+	addv	H25, V8.8H
+	ins	V23.H[4], V25.H[0]
+	addv	H25, V12.8H
+	ins	V24.H[4], V25.H[0]
+	addv	H25, V1.8H
+	ins	V21.H[5], V25.H[0]
+	addv	H25, V5.8H
+	ins	V22.H[5], V25.H[0]
+	addv	H25, V9.8H
+	ins	V23.H[5], V25.H[0]
+	addv	H25, V13.8H
+	ins	V24.H[5], V25.H[0]
+	addv	H25, V2.8H
+	ins	V21.H[6], V25.H[0]
+	addv	H25, V6.8H
+	ins	V22.H[6], V25.H[0]
+	addv	H25, V10.8H
+	ins	V23.H[6], V25.H[0]
+	addv	H25, V14.8H
+	ins	V24.H[6], V25.H[0]
+	addv	H25, V3.8H
+	ins	V21.H[7], V25.H[0]
+	addv	H25, V7.8H
+	ins	V22.H[7], V25.H[0]
+	addv	H25, V11.8H
+	ins	V23.H[7], V25.H[0]
+	addv	H25, V15.8H
+	ins	V24.H[7], V25.H[0]
+	add	x21, x21, x6
+	and	V21.16B, V21.16B, V26.16B
+	st1	{V21.8H}, [x7]
+	and	V22.16B, V22.16B, V26.16B
+	st1	{V22.8H}, [x8]
+	and	V23.16B, V23.16B, V26.16B
+	st1	{V23.8H}, [x9]
+	and	V24.16B, V24.16B, V26.16B
+	st1	{V24.8H}, [x10]
+	add	x11, x11, x6
+	add	x7, x7, #0x40
+	add	x8, x8, #0x40
+	add	x9, x9, #0x40
+	add	x10, x10, #0x40
+	subs	x23, x23, #1
+	bne	L_frodokem_mul_bs_neon_p
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x22, x23, [x29, #48]
+	ldp	x24, x25, [x29, #64]
+	ldp	x26, x27, [x29, #80]
+	ldp	D8, D9, [x29, #96]
+	ldp	D10, D11, [x29, #112]
+	ldp	D12, D13, [x29, #128]
+	ldp	D14, D15, [x29, #144]
+	ldp	x29, x30, [sp], #0xa0
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_mul_add_sb_plus_e_neon
+frodokem_mul_add_sb_plus_e_neon PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	sxtw	x5, w3
+	lsl	x5, x5, #1
+	dup	V10.8H, w4
+	mov	x6, x2
+	add	x7, x6, x5
+	add	x8, x7, x5
+	add	x9, x8, x5
+	add	x10, x9, x5
+	add	x11, x10, x5
+	add	x12, x11, x5
+	add	x13, x12, x5
+	mov	x14, x1
+	mov	x16, x0
+	ld1	{V0.8H, V1.8H, V2.8H, V3.8H}, [x16], #0x40
+	ld1	{V4.8H, V5.8H, V6.8H, V7.8H}, [x16], #0x40
+	sub	x16, x16, #0x80
+	sxtw	x15, w3
+L_frodokem_mul_add_sb_plus_e_neon_j
+	ld1	{V8.8H}, [x14], #16
+	ld1r	{V9.8H}, [x6], #2
+	mla	V0.8H, V8.8H, V9.8H
+	ld1r	{V9.8H}, [x7], #2
+	mla	V1.8H, V8.8H, V9.8H
+	ld1r	{V9.8H}, [x8], #2
+	mla	V2.8H, V8.8H, V9.8H
+	ld1r	{V9.8H}, [x9], #2
+	mla	V3.8H, V8.8H, V9.8H
+	ld1r	{V9.8H}, [x10], #2
+	mla	V4.8H, V8.8H, V9.8H
+	ld1r	{V9.8H}, [x11], #2
+	mla	V5.8H, V8.8H, V9.8H
+	ld1r	{V9.8H}, [x12], #2
+	mla	V6.8H, V8.8H, V9.8H
+	ld1r	{V9.8H}, [x13], #2
+	mla	V7.8H, V8.8H, V9.8H
+	subs	x15, x15, #1
+	bne	L_frodokem_mul_add_sb_plus_e_neon_j
+	and	V0.16B, V0.16B, V10.16B
+	and	V1.16B, V1.16B, V10.16B
+	and	V2.16B, V2.16B, V10.16B
+	and	V3.16B, V3.16B, V10.16B
+	and	V4.16B, V4.16B, V10.16B
+	and	V5.16B, V5.16B, V10.16B
+	and	V6.16B, V6.16B, V10.16B
+	and	V7.16B, V7.16B, V10.16B
+	st1	{V0.8H, V1.8H, V2.8H, V3.8H}, [x16], #0x40
+	st1	{V4.8H, V5.8H, V6.8H, V7.8H}, [x16], #0x40
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:WOLFSSL_HAVE_FRODOKEM
+; 	.arch	armv8-a+crypto
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	frodokem_gen_a_rows_aes_arm64
+frodokem_gen_a_rows_aes_arm64 PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	D8, D9, [x29, #16]
+	stp	D10, D11, [x29, #32]
+	stp	D12, D13, [x29, #48]
+	stp	D14, D15, [x29, #64]
+	ld1	{V0.16B, V1.16B, V2.16B, V3.16B}, [x2], #0x40
+	ld1	{V4.16B, V5.16B, V6.16B, V7.16B}, [x2], #0x40
+	ld1	{V8.16B, V9.16B, V10.16B}, [x2], #48
+	dup	V19.8H, w6
+	sxtw	x13, w3
+	sxtw	x7, w5
+	lsl	x7, x7, #1
+	sxtw	x8, w4
+	mul	x8, x8, x7
+	movz	w14, #8, lsl 16
+	mov	x9, x0
+L_frodokem_gen_a_rows_aes_arm64_row
+	mov	w11, w13
+	add	x10, x9, x7
+L_frodokem_gen_a_rows_aes_arm64_blk
+	add	x12, x11, x14
+	stp	x11, xzr, [x9], #16
+	stp	x12, xzr, [x9], #16
+	add	x11, x12, x14
+	cmp	x9, x10
+	blt	L_frodokem_gen_a_rows_aes_arm64_blk
+	add	x13, x13, #1
+	add	x10, x0, x8
+	cmp	x9, x10
+	blt	L_frodokem_gen_a_rows_aes_arm64_row
+	cmp	x8, #0x80
+	blt	L_frodokem_gen_a_rows_aes_arm64_tail
+L_frodokem_gen_a_rows_aes_arm64_aes
+	ld1	{V11.16B, V12.16B, V13.16B, V14.16B}, [x0], #0x40
+	ld1	{V15.16B, V16.16B, V17.16B, V18.16B}, [x0], #0x40
+	aese	V11.16B, V0.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V0.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V0.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V0.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V0.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V0.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V0.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V0.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V1.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V1.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V1.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V1.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V1.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V1.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V1.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V1.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V2.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V2.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V2.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V2.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V2.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V2.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V2.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V2.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V3.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V3.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V3.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V3.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V3.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V3.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V3.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V3.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V4.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V4.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V4.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V4.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V4.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V4.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V4.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V4.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V5.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V5.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V5.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V5.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V5.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V5.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V5.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V5.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V6.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V6.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V6.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V6.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V6.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V6.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V6.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V6.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V7.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V7.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V7.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V7.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V7.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V7.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V7.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V7.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V8.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V8.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V8.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V8.16B
+	aesmc	V14.16B, V14.16B
+	aese	V15.16B, V8.16B
+	aesmc	V15.16B, V15.16B
+	aese	V16.16B, V8.16B
+	aesmc	V16.16B, V16.16B
+	aese	V17.16B, V8.16B
+	aesmc	V17.16B, V17.16B
+	aese	V18.16B, V8.16B
+	aesmc	V18.16B, V18.16B
+	aese	V11.16B, V9.16B
+	aese	V12.16B, V9.16B
+	aese	V13.16B, V9.16B
+	aese	V14.16B, V9.16B
+	aese	V15.16B, V9.16B
+	aese	V16.16B, V9.16B
+	aese	V17.16B, V9.16B
+	aese	V18.16B, V9.16B
+	eor	V11.16B, V11.16B, V10.16B
+	eor	V12.16B, V12.16B, V10.16B
+	eor	V13.16B, V13.16B, V10.16B
+	eor	V14.16B, V14.16B, V10.16B
+	eor	V15.16B, V15.16B, V10.16B
+	eor	V16.16B, V16.16B, V10.16B
+	eor	V17.16B, V17.16B, V10.16B
+	eor	V18.16B, V18.16B, V10.16B
+	and	V11.16B, V11.16B, V19.16B
+	and	V12.16B, V12.16B, V19.16B
+	and	V13.16B, V13.16B, V19.16B
+	and	V14.16B, V14.16B, V19.16B
+	and	V15.16B, V15.16B, V19.16B
+	and	V16.16B, V16.16B, V19.16B
+	and	V17.16B, V17.16B, V19.16B
+	and	V18.16B, V18.16B, V19.16B
+	st1	{V11.16B, V12.16B, V13.16B, V14.16B}, [x1], #0x40
+	st1	{V15.16B, V16.16B, V17.16B, V18.16B}, [x1], #0x40
+	subs	x8, x8, #0x80
+	cmp	x8, #0x80
+	bge	L_frodokem_gen_a_rows_aes_arm64_aes
+L_frodokem_gen_a_rows_aes_arm64_tail
+	cmp	x8, #0
+	beq	L_frodokem_gen_a_rows_aes_arm64_done
+	ld1	{V11.16B, V12.16B, V13.16B, V14.16B}, [x0], #0x40
+	aese	V11.16B, V0.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V0.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V0.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V0.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V1.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V1.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V1.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V1.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V2.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V2.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V2.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V2.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V3.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V3.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V3.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V3.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V4.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V4.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V4.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V4.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V5.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V5.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V5.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V5.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V6.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V6.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V6.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V6.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V7.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V7.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V7.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V7.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V8.16B
+	aesmc	V11.16B, V11.16B
+	aese	V12.16B, V8.16B
+	aesmc	V12.16B, V12.16B
+	aese	V13.16B, V8.16B
+	aesmc	V13.16B, V13.16B
+	aese	V14.16B, V8.16B
+	aesmc	V14.16B, V14.16B
+	aese	V11.16B, V9.16B
+	aese	V12.16B, V9.16B
+	aese	V13.16B, V9.16B
+	aese	V14.16B, V9.16B
+	eor	V11.16B, V11.16B, V10.16B
+	eor	V12.16B, V12.16B, V10.16B
+	eor	V13.16B, V13.16B, V10.16B
+	eor	V14.16B, V14.16B, V10.16B
+	and	V11.16B, V11.16B, V19.16B
+	and	V12.16B, V12.16B, V19.16B
+	and	V13.16B, V13.16B, V19.16B
+	and	V14.16B, V14.16B, V19.16B
+	st1	{V11.16B, V12.16B, V13.16B, V14.16B}, [x1], #0x40
+L_frodokem_gen_a_rows_aes_arm64_done
+	ldp	D8, D9, [x29, #16]
+	ldp	D10, D11, [x29, #32]
+	ldp	D12, D13, [x29, #48]
+	ldp	D14, D15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c b/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
new file mode 100644
index 00000000000..7074cd9f8d2
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
@@ -0,0 +1,1315 @@
+/* armv8-frodokem-asm
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources_asm.h>
+#include <wolfssl/wolfcrypt/error-crypt.h>
+
+/* Generated using (from wolfssl):
+ *   cd ../scripts
+ *   ruby ./frodokem/frodokem.rb arm64 \
+ *       ../wolfssl/wolfcrypt/src/port/arm/armv8-frodokem-asm.c
+ */
+#ifdef WOLFSSL_ARMASM
+#ifdef __aarch64__
+#ifdef WOLFSSL_ARMASM_INLINE
+#include <wolfssl/wolfcrypt/wc_frodokem_mat.h>
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+XALIGNED(16) static const word64 L_sha3_aarch64_r[] = {
+    0x0000000000000001UL, 0x0000000000008082UL,
+    0x800000000000808aUL, 0x8000000080008000UL,
+    0x000000000000808bUL, 0x0000000080000001UL,
+    0x8000000080008081UL, 0x8000000000008009UL,
+    0x000000000000008aUL, 0x0000000000000088UL,
+    0x0000000080008009UL, 0x000000008000000aUL,
+    0x000000008000808bUL, 0x800000000000008bUL,
+    0x8000000000008089UL, 0x8000000000008003UL,
+    0x8000000000008002UL, 0x8000000000000080UL,
+    0x000000000000800aUL, 0x800000008000000aUL,
+    0x8000000080008081UL, 0x8000000000008080UL,
+    0x0000000080000001UL, 0x8000000080008008UL,
+};
+
+void frodokem_sha3_x2_neon(word64* state)
+{
+    const word64* r = L_sha3_aarch64_r;
+    __asm__ __volatile__ (
+        "ld4	{v0.d, v1.d, v2.d, v3.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v4.d, v5.d, v6.d, v7.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v8.d, v9.d, v10.d, v11.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v12.d, v13.d, v14.d, v15.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v16.d, v17.d, v18.d, v19.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v20.d, v21.d, v22.d, v23.d}[0], [%x[state]], #32\n\t"
+        "ld1	{v24.d}[0], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        "ld4	{v0.d, v1.d, v2.d, v3.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v4.d, v5.d, v6.d, v7.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v8.d, v9.d, v10.d, v11.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v12.d, v13.d, v14.d, v15.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v16.d, v17.d, v18.d, v19.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v20.d, v21.d, v22.d, v23.d}[1], [%x[state]], #32\n\t"
+        "ld1	{v24.d}[1], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        "sub	%x[state], %x[state], #0x190\n\t"
+        "mov	x2, #24\n\t"
+        "\n"
+    "L_frodokem_sha3_x2_neon_begin_%=:\n\t"
+        /* Col Mix NEON */
+        "eor	v30.16b, v4.16b, v9.16b\n\t"
+        "eor	v27.16b, v1.16b, v6.16b\n\t"
+        "eor	v30.16b, v30.16b, v14.16b\n\t"
+        "eor	v27.16b, v27.16b, v11.16b\n\t"
+        "eor	v30.16b, v30.16b, v19.16b\n\t"
+        "eor	v27.16b, v27.16b, v16.16b\n\t"
+        "eor	v30.16b, v30.16b, v24.16b\n\t"
+        "eor	v27.16b, v27.16b, v21.16b\n\t"
+        "ushr	v25.2d, v27.2d, #63\n\t"
+        "sli	v25.2d, v27.2d, #1\n\t"
+        "eor	v25.16b, v25.16b, v30.16b\n\t"
+        "eor	v31.16b, v0.16b, v5.16b\n\t"
+        "eor	v28.16b, v2.16b, v7.16b\n\t"
+        "eor	v31.16b, v31.16b, v10.16b\n\t"
+        "eor	v28.16b, v28.16b, v12.16b\n\t"
+        "eor	v31.16b, v31.16b, v15.16b\n\t"
+        "eor	v28.16b, v28.16b, v17.16b\n\t"
+        "eor	v31.16b, v31.16b, v20.16b\n\t"
+        "eor	v28.16b, v28.16b, v22.16b\n\t"
+        "ushr	v29.2d, v30.2d, #63\n\t"
+        "ushr	v26.2d, v28.2d, #63\n\t"
+        "sli	v29.2d, v30.2d, #1\n\t"
+        "sli	v26.2d, v28.2d, #1\n\t"
+        "eor	v28.16b, v28.16b, v29.16b\n\t"
+        "eor	v29.16b, v3.16b, v8.16b\n\t"
+        "eor	v26.16b, v26.16b, v31.16b\n\t"
+        "eor	v29.16b, v29.16b, v13.16b\n\t"
+        "eor	v29.16b, v29.16b, v18.16b\n\t"
+        "eor	v29.16b, v29.16b, v23.16b\n\t"
+        "ushr	v30.2d, v29.2d, #63\n\t"
+        "sli	v30.2d, v29.2d, #1\n\t"
+        "eor	v27.16b, v27.16b, v30.16b\n\t"
+        "ushr	v30.2d, v31.2d, #63\n\t"
+        "sli	v30.2d, v31.2d, #1\n\t"
+        "eor	v29.16b, v29.16b, v30.16b\n\t"
+        /* Swap Rotate NEON */
+        "eor	v0.16b, v0.16b, v25.16b\n\t"
+        "eor	v31.16b, v1.16b, v26.16b\n\t"
+        "eor	v6.16b, v6.16b, v26.16b\n\t"
+        "ushr	v30.2d, v31.2d, #63\n\t"
+        "ushr	v1.2d, v6.2d, #20\n\t"
+        "sli	v30.2d, v31.2d, #1\n\t"
+        "sli	v1.2d, v6.2d, #44\n\t"
+        "eor	v31.16b, v9.16b, v29.16b\n\t"
+        "eor	v22.16b, v22.16b, v27.16b\n\t"
+        "ushr	v6.2d, v31.2d, #44\n\t"
+        "ushr	v9.2d, v22.2d, #3\n\t"
+        "sli	v6.2d, v31.2d, #20\n\t"
+        "sli	v9.2d, v22.2d, #61\n\t"
+        "eor	v31.16b, v14.16b, v29.16b\n\t"
+        "eor	v20.16b, v20.16b, v25.16b\n\t"
+        "ushr	v22.2d, v31.2d, #25\n\t"
+        "ushr	v14.2d, v20.2d, #46\n\t"
+        "sli	v22.2d, v31.2d, #39\n\t"
+        "sli	v14.2d, v20.2d, #18\n\t"
+        "eor	v31.16b, v2.16b, v27.16b\n\t"
+        "eor	v12.16b, v12.16b, v27.16b\n\t"
+        "ushr	v20.2d, v31.2d, #2\n\t"
+        "ushr	v2.2d, v12.2d, #21\n\t"
+        "sli	v20.2d, v31.2d, #62\n\t"
+        "sli	v2.2d, v12.2d, #43\n\t"
+        "eor	v31.16b, v13.16b, v28.16b\n\t"
+        "eor	v19.16b, v19.16b, v29.16b\n\t"
+        "ushr	v12.2d, v31.2d, #39\n\t"
+        "ushr	v13.2d, v19.2d, #56\n\t"
+        "sli	v12.2d, v31.2d, #25\n\t"
+        "sli	v13.2d, v19.2d, #8\n\t"
+        "eor	v31.16b, v23.16b, v28.16b\n\t"
+        "eor	v15.16b, v15.16b, v25.16b\n\t"
+        "ushr	v19.2d, v31.2d, #8\n\t"
+        "ushr	v23.2d, v15.2d, #23\n\t"
+        "sli	v19.2d, v31.2d, #56\n\t"
+        "sli	v23.2d, v15.2d, #41\n\t"
+        "eor	v31.16b, v4.16b, v29.16b\n\t"
+        "eor	v24.16b, v24.16b, v29.16b\n\t"
+        "ushr	v15.2d, v31.2d, #37\n\t"
+        "ushr	v4.2d, v24.2d, #50\n\t"
+        "sli	v15.2d, v31.2d, #27\n\t"
+        "sli	v4.2d, v24.2d, #14\n\t"
+        "eor	v31.16b, v21.16b, v26.16b\n\t"
+        "eor	v8.16b, v8.16b, v28.16b\n\t"
+        "ushr	v24.2d, v31.2d, #62\n\t"
+        "ushr	v21.2d, v8.2d, #9\n\t"
+        "sli	v24.2d, v31.2d, #2\n\t"
+        "sli	v21.2d, v8.2d, #55\n\t"
+        "eor	v31.16b, v16.16b, v26.16b\n\t"
+        "eor	v5.16b, v5.16b, v25.16b\n\t"
+        "ushr	v8.2d, v31.2d, #19\n\t"
+        "ushr	v16.2d, v5.2d, #28\n\t"
+        "sli	v8.2d, v31.2d, #45\n\t"
+        "sli	v16.2d, v5.2d, #36\n\t"
+        "eor	v31.16b, v3.16b, v28.16b\n\t"
+        "eor	v18.16b, v18.16b, v28.16b\n\t"
+        "ushr	v5.2d, v31.2d, #36\n\t"
+        "ushr	v3.2d, v18.2d, #43\n\t"
+        "sli	v5.2d, v31.2d, #28\n\t"
+        "sli	v3.2d, v18.2d, #21\n\t"
+        "eor	v31.16b, v17.16b, v27.16b\n\t"
+        "eor	v11.16b, v11.16b, v26.16b\n\t"
+        "ushr	v18.2d, v31.2d, #49\n\t"
+        "ushr	v17.2d, v11.2d, #54\n\t"
+        "sli	v18.2d, v31.2d, #15\n\t"
+        "sli	v17.2d, v11.2d, #10\n\t"
+        "eor	v31.16b, v7.16b, v27.16b\n\t"
+        "eor	v10.16b, v10.16b, v25.16b\n\t"
+        "ushr	v11.2d, v31.2d, #58\n\t"
+        "ushr	v7.2d, v10.2d, #61\n\t"
+        "sli	v11.2d, v31.2d, #6\n\t"
+        "sli	v7.2d, v10.2d, #3\n\t"
+        /* Row Mix NEON */
+        "bic	v25.16b, v2.16b, v1.16b\n\t"
+        "bic	v26.16b, v3.16b, v2.16b\n\t"
+        "bic	v27.16b, v4.16b, v3.16b\n\t"
+        "bic	v28.16b, v0.16b, v4.16b\n\t"
+        "bic	v29.16b, v1.16b, v0.16b\n\t"
+        "eor	v0.16b, v0.16b, v25.16b\n\t"
+        "eor	v1.16b, v1.16b, v26.16b\n\t"
+        "eor	v2.16b, v2.16b, v27.16b\n\t"
+        "eor	v3.16b, v3.16b, v28.16b\n\t"
+        "eor	v4.16b, v4.16b, v29.16b\n\t"
+        "bic	v25.16b, v7.16b, v6.16b\n\t"
+        "bic	v26.16b, v8.16b, v7.16b\n\t"
+        "bic	v27.16b, v9.16b, v8.16b\n\t"
+        "bic	v28.16b, v5.16b, v9.16b\n\t"
+        "bic	v29.16b, v6.16b, v5.16b\n\t"
+        "eor	v5.16b, v5.16b, v25.16b\n\t"
+        "eor	v6.16b, v6.16b, v26.16b\n\t"
+        "eor	v7.16b, v7.16b, v27.16b\n\t"
+        "eor	v8.16b, v8.16b, v28.16b\n\t"
+        "eor	v9.16b, v9.16b, v29.16b\n\t"
+        "bic	v25.16b, v12.16b, v11.16b\n\t"
+        "bic	v26.16b, v13.16b, v12.16b\n\t"
+        "bic	v27.16b, v14.16b, v13.16b\n\t"
+        "bic	v28.16b, v30.16b, v14.16b\n\t"
+        "bic	v29.16b, v11.16b, v30.16b\n\t"
+        "eor	v10.16b, v30.16b, v25.16b\n\t"
+        "eor	v11.16b, v11.16b, v26.16b\n\t"
+        "eor	v12.16b, v12.16b, v27.16b\n\t"
+        "eor	v13.16b, v13.16b, v28.16b\n\t"
+        "eor	v14.16b, v14.16b, v29.16b\n\t"
+        "bic	v25.16b, v17.16b, v16.16b\n\t"
+        "bic	v26.16b, v18.16b, v17.16b\n\t"
+        "bic	v27.16b, v19.16b, v18.16b\n\t"
+        "bic	v28.16b, v15.16b, v19.16b\n\t"
+        "bic	v29.16b, v16.16b, v15.16b\n\t"
+        "eor	v15.16b, v15.16b, v25.16b\n\t"
+        "eor	v16.16b, v16.16b, v26.16b\n\t"
+        "eor	v17.16b, v17.16b, v27.16b\n\t"
+        "eor	v18.16b, v18.16b, v28.16b\n\t"
+        "eor	v19.16b, v19.16b, v29.16b\n\t"
+        "bic	v25.16b, v22.16b, v21.16b\n\t"
+        "bic	v26.16b, v23.16b, v22.16b\n\t"
+        "bic	v27.16b, v24.16b, v23.16b\n\t"
+        "bic	v28.16b, v20.16b, v24.16b\n\t"
+        "bic	v29.16b, v21.16b, v20.16b\n\t"
+        "eor	v20.16b, v20.16b, v25.16b\n\t"
+        "eor	v21.16b, v21.16b, v26.16b\n\t"
+        "eor	v22.16b, v22.16b, v27.16b\n\t"
+        "eor	v23.16b, v23.16b, v28.16b\n\t"
+        "eor	v24.16b, v24.16b, v29.16b\n\t"
+        "ldr	x3, [%[r]], #8\n\t"
+        "subs	x2, x2, #1\n\t"
+        "mov	v30.d[0], x3\n\t"
+        "mov	v30.d[1], x3\n\t"
+        "eor	v0.16b, v0.16b, v30.16b\n\t"
+        "b.ne	L_frodokem_sha3_x2_neon_begin_%=\n\t"
+        "st4	{v0.d, v1.d, v2.d, v3.d}[0], [%x[state]], #32\n\t"
+        "st4	{v4.d, v5.d, v6.d, v7.d}[0], [%x[state]], #32\n\t"
+        "st4	{v8.d, v9.d, v10.d, v11.d}[0], [%x[state]], #32\n\t"
+        "st4	{v12.d, v13.d, v14.d, v15.d}[0], [%x[state]], #32\n\t"
+        "st4	{v16.d, v17.d, v18.d, v19.d}[0], [%x[state]], #32\n\t"
+        "st4	{v20.d, v21.d, v22.d, v23.d}[0], [%x[state]], #32\n\t"
+        "st1	{v24.d}[0], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        "st4	{v0.d, v1.d, v2.d, v3.d}[1], [%x[state]], #32\n\t"
+        "st4	{v4.d, v5.d, v6.d, v7.d}[1], [%x[state]], #32\n\t"
+        "st4	{v8.d, v9.d, v10.d, v11.d}[1], [%x[state]], #32\n\t"
+        "st4	{v12.d, v13.d, v14.d, v15.d}[1], [%x[state]], #32\n\t"
+        "st4	{v16.d, v17.d, v18.d, v19.d}[1], [%x[state]], #32\n\t"
+        "st4	{v20.d, v21.d, v22.d, v23.d}[1], [%x[state]], #32\n\t"
+        "st1	{v24.d}[1], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        : [state] "+r" (state)
+        : [r] "r" (r)
+        : "memory", "cc", "x2", "x3", "v0", "v1", "v2", "v3", "v4", "v5", "v6",
+            "v7", "v8", "v9", "v10", "v11", "v12", "v13", "v14", "v15", "v16",
+            "v17", "v18", "v19", "v20", "v21", "v22", "v23", "v24", "v25",
+            "v26", "v27", "v28", "v29", "v30", "v31"
+    );
+}
+
+#ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
+    "	.arch_extension	sha3\n\t"
+void frodokem_sha3_x2_crypto(word64* state)
+{
+    const word64* r = L_sha3_aarch64_r;
+    __asm__ __volatile__ (
+        "ld4	{v0.d, v1.d, v2.d, v3.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v4.d, v5.d, v6.d, v7.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v8.d, v9.d, v10.d, v11.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v12.d, v13.d, v14.d, v15.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v16.d, v17.d, v18.d, v19.d}[0], [%x[state]], #32\n\t"
+        "ld4	{v20.d, v21.d, v22.d, v23.d}[0], [%x[state]], #32\n\t"
+        "ld1	{v24.d}[0], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        "ld4	{v0.d, v1.d, v2.d, v3.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v4.d, v5.d, v6.d, v7.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v8.d, v9.d, v10.d, v11.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v12.d, v13.d, v14.d, v15.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v16.d, v17.d, v18.d, v19.d}[1], [%x[state]], #32\n\t"
+        "ld4	{v20.d, v21.d, v22.d, v23.d}[1], [%x[state]], #32\n\t"
+        "ld1	{v24.d}[1], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        "sub	%x[state], %x[state], #0x190\n\t"
+        "mov	x2, #24\n\t"
+        "\n"
+    "L_frodokem_sha3_x2_crypto_begin_%=:\n\t"
+        /* Col Mix */
+        "eor3	v31.16b, v0.16b, v5.16b, v10.16b\n\t"
+        "eor3	v27.16b, v1.16b, v6.16b, v11.16b\n\t"
+        "eor3	v28.16b, v2.16b, v7.16b, v12.16b\n\t"
+        "eor3	v29.16b, v3.16b, v8.16b, v13.16b\n\t"
+        "eor3	v30.16b, v4.16b, v9.16b, v14.16b\n\t"
+        "eor3	v31.16b, v31.16b, v15.16b, v20.16b\n\t"
+        "eor3	v27.16b, v27.16b, v16.16b, v21.16b\n\t"
+        "eor3	v28.16b, v28.16b, v17.16b, v22.16b\n\t"
+        "eor3	v29.16b, v29.16b, v18.16b, v23.16b\n\t"
+        "eor3	v30.16b, v30.16b, v19.16b, v24.16b\n\t"
+        "rax1	v25.2d, v30.2d, v27.2d\n\t"
+        "rax1	v26.2d, v31.2d, v28.2d\n\t"
+        "rax1	v27.2d, v27.2d, v29.2d\n\t"
+        "rax1	v28.2d, v28.2d, v30.2d\n\t"
+        "rax1	v29.2d, v29.2d, v31.2d\n\t"
+        "eor	v0.16b, v0.16b, v25.16b\n\t"
+        "xar	v30.2d, v1.2d, v26.2d, #63\n\t"
+        "xar	v1.2d, v6.2d, v26.2d, #20\n\t"
+        "xar	v6.2d, v9.2d, v29.2d, #44\n\t"
+        "xar	v9.2d, v22.2d, v27.2d, #3\n\t"
+        "xar	v22.2d, v14.2d, v29.2d, #25\n\t"
+        "xar	v14.2d, v20.2d, v25.2d, #46\n\t"
+        "xar	v20.2d, v2.2d, v27.2d, #2\n\t"
+        "xar	v2.2d, v12.2d, v27.2d, #21\n\t"
+        "xar	v12.2d, v13.2d, v28.2d, #39\n\t"
+        "xar	v13.2d, v19.2d, v29.2d, #56\n\t"
+        "xar	v19.2d, v23.2d, v28.2d, #8\n\t"
+        "xar	v23.2d, v15.2d, v25.2d, #23\n\t"
+        "xar	v15.2d, v4.2d, v29.2d, #37\n\t"
+        "xar	v4.2d, v24.2d, v29.2d, #50\n\t"
+        "xar	v24.2d, v21.2d, v26.2d, #62\n\t"
+        "xar	v21.2d, v8.2d, v28.2d, #9\n\t"
+        "xar	v8.2d, v16.2d, v26.2d, #19\n\t"
+        "xar	v16.2d, v5.2d, v25.2d, #28\n\t"
+        "xar	v5.2d, v3.2d, v28.2d, #36\n\t"
+        "xar	v3.2d, v18.2d, v28.2d, #43\n\t"
+        "xar	v18.2d, v17.2d, v27.2d, #49\n\t"
+        "xar	v17.2d, v11.2d, v26.2d, #54\n\t"
+        "xar	v11.2d, v7.2d, v27.2d, #58\n\t"
+        "xar	v7.2d, v10.2d, v25.2d, #61\n\t"
+        /* Row Mix */
+        "mov	v25.16b, v0.16b\n\t"
+        "mov	v26.16b, v1.16b\n\t"
+        "bcax	v0.16b, v25.16b, v2.16b, v26.16b\n\t"
+        "bcax	v1.16b, v26.16b, v3.16b, v2.16b\n\t"
+        "bcax	v2.16b, v2.16b, v4.16b, v3.16b\n\t"
+        "bcax	v3.16b, v3.16b, v25.16b, v4.16b\n\t"
+        "bcax	v4.16b, v4.16b, v26.16b, v25.16b\n\t"
+        "mov	v25.16b, v5.16b\n\t"
+        "mov	v26.16b, v6.16b\n\t"
+        "bcax	v5.16b, v25.16b, v7.16b, v26.16b\n\t"
+        "bcax	v6.16b, v26.16b, v8.16b, v7.16b\n\t"
+        "bcax	v7.16b, v7.16b, v9.16b, v8.16b\n\t"
+        "bcax	v8.16b, v8.16b, v25.16b, v9.16b\n\t"
+        "bcax	v9.16b, v9.16b, v26.16b, v25.16b\n\t"
+        "mov	v26.16b, v11.16b\n\t"
+        "bcax	v10.16b, v30.16b, v12.16b, v26.16b\n\t"
+        "bcax	v11.16b, v26.16b, v13.16b, v12.16b\n\t"
+        "bcax	v12.16b, v12.16b, v14.16b, v13.16b\n\t"
+        "bcax	v13.16b, v13.16b, v30.16b, v14.16b\n\t"
+        "bcax	v14.16b, v14.16b, v26.16b, v30.16b\n\t"
+        "mov	v25.16b, v15.16b\n\t"
+        "mov	v26.16b, v16.16b\n\t"
+        "bcax	v15.16b, v25.16b, v17.16b, v26.16b\n\t"
+        "bcax	v16.16b, v26.16b, v18.16b, v17.16b\n\t"
+        "bcax	v17.16b, v17.16b, v19.16b, v18.16b\n\t"
+        "bcax	v18.16b, v18.16b, v25.16b, v19.16b\n\t"
+        "bcax	v19.16b, v19.16b, v26.16b, v25.16b\n\t"
+        "mov	v25.16b, v20.16b\n\t"
+        "mov	v26.16b, v21.16b\n\t"
+        "bcax	v20.16b, v25.16b, v22.16b, v26.16b\n\t"
+        "bcax	v21.16b, v26.16b, v23.16b, v22.16b\n\t"
+        "bcax	v22.16b, v22.16b, v24.16b, v23.16b\n\t"
+        "bcax	v23.16b, v23.16b, v25.16b, v24.16b\n\t"
+        "bcax	v24.16b, v24.16b, v26.16b, v25.16b\n\t"
+        "ldr	x3, [%[r]], #8\n\t"
+        "subs	x2, x2, #1\n\t"
+        "mov	v30.d[0], x3\n\t"
+        "mov	v30.d[1], x3\n\t"
+        "eor	v0.16b, v0.16b, v30.16b\n\t"
+        "b.ne	L_frodokem_sha3_x2_crypto_begin_%=\n\t"
+        "st4	{v0.d, v1.d, v2.d, v3.d}[0], [%x[state]], #32\n\t"
+        "st4	{v4.d, v5.d, v6.d, v7.d}[0], [%x[state]], #32\n\t"
+        "st4	{v8.d, v9.d, v10.d, v11.d}[0], [%x[state]], #32\n\t"
+        "st4	{v12.d, v13.d, v14.d, v15.d}[0], [%x[state]], #32\n\t"
+        "st4	{v16.d, v17.d, v18.d, v19.d}[0], [%x[state]], #32\n\t"
+        "st4	{v20.d, v21.d, v22.d, v23.d}[0], [%x[state]], #32\n\t"
+        "st1	{v24.d}[0], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        "st4	{v0.d, v1.d, v2.d, v3.d}[1], [%x[state]], #32\n\t"
+        "st4	{v4.d, v5.d, v6.d, v7.d}[1], [%x[state]], #32\n\t"
+        "st4	{v8.d, v9.d, v10.d, v11.d}[1], [%x[state]], #32\n\t"
+        "st4	{v12.d, v13.d, v14.d, v15.d}[1], [%x[state]], #32\n\t"
+        "st4	{v16.d, v17.d, v18.d, v19.d}[1], [%x[state]], #32\n\t"
+        "st4	{v20.d, v21.d, v22.d, v23.d}[1], [%x[state]], #32\n\t"
+        "st1	{v24.d}[1], [%x[state]]\n\t"
+        "add	%x[state], %x[state], #8\n\t"
+        : [state] "+r" (state)
+        : [r] "r" (r)
+        : "memory", "cc", "x2", "x3", "v0", "v1", "v2", "v3", "v4", "v5", "v6",
+            "v7", "v8", "v9", "v10", "v11", "v12", "v13", "v14", "v15", "v16",
+            "v17", "v18", "v19", "v20", "v21", "v22", "v23", "v24", "v25",
+            "v26", "v27", "v28", "v29", "v30", "v31"
+    );
+}
+
+#endif /* WOLFSSL_ARMASM_CRYPTO_SHA3 */
+void frodokem_add_neon(word16* a, const word16* b, int qmask)
+{
+    __asm__ __volatile__ (
+        "dup	v16.8h, %w[qmask]\n\t"
+        "ld1	{v0.8h, v1.8h, v2.8h, v3.8h}, [%x[a]], #0x40\n\t"
+        "ld1	{v4.8h, v5.8h, v6.8h, v7.8h}, [%x[a]], #0x40\n\t"
+        "sub	%x[a], %x[a], #0x80\n\t"
+        "ld1	{v8.8h, v9.8h, v10.8h, v11.8h}, [%x[b]], #0x40\n\t"
+        "ld1	{v12.8h, v13.8h, v14.8h, v15.8h}, [%x[b]], #0x40\n\t"
+        "add	v0.8h, v0.8h, v8.8h\n\t"
+        "and	v0.16b, v0.16b, v16.16b\n\t"
+        "add	v1.8h, v1.8h, v9.8h\n\t"
+        "and	v1.16b, v1.16b, v16.16b\n\t"
+        "add	v2.8h, v2.8h, v10.8h\n\t"
+        "and	v2.16b, v2.16b, v16.16b\n\t"
+        "add	v3.8h, v3.8h, v11.8h\n\t"
+        "and	v3.16b, v3.16b, v16.16b\n\t"
+        "add	v4.8h, v4.8h, v12.8h\n\t"
+        "and	v4.16b, v4.16b, v16.16b\n\t"
+        "add	v5.8h, v5.8h, v13.8h\n\t"
+        "and	v5.16b, v5.16b, v16.16b\n\t"
+        "add	v6.8h, v6.8h, v14.8h\n\t"
+        "and	v6.16b, v6.16b, v16.16b\n\t"
+        "add	v7.8h, v7.8h, v15.8h\n\t"
+        "and	v7.16b, v7.16b, v16.16b\n\t"
+        "st1	{v0.8h, v1.8h, v2.8h, v3.8h}, [%x[a]], #0x40\n\t"
+        "st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [%x[a]], #0x40\n\t"
+        : [a] "+r" (a), [qmask] "+r" (qmask)
+        : [b] "r" (b)
+        : "memory", "cc", "v0", "v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8",
+            "v9", "v10", "v11", "v12", "v13", "v14", "v15", "v16"
+    );
+}
+
+void frodokem_sample_neon(word16* mat, int cnt, const word16* cdf, int cdflen)
+{
+    __asm__ __volatile__ (
+        "cmp	%w[cnt], #16\n\t"
+        "b.lt	L_frodokem_sample_neon_rem_%=\n\t"
+        "\n"
+    "L_frodokem_sample_neon_blk16_%=:\n\t"
+        "ld1	{v0.8h}, [%x[mat]], #16\n\t"
+        "ld1	{v1.8h}, [%x[mat]], #16\n\t"
+        "sub	%x[mat], %x[mat], #32\n\t"
+        "ushr	v2.8h, v0.8h, #1\n\t"
+        "movi	v4.8h, #1\n\t"
+        "and	v4.16b, v4.16b, v0.16b\n\t"
+        "movi	v6.8h, #0\n\t"
+        "ushr	v3.8h, v1.8h, #1\n\t"
+        "movi	v5.8h, #1\n\t"
+        "and	v5.16b, v5.16b, v1.16b\n\t"
+        "movi	v7.8h, #0\n\t"
+        "mov	x4, %x[cdf]\n\t"
+        "mov	w5, %w[cdflen]\n\t"
+        "\n"
+    "L_frodokem_sample_neon_cdf16_%=:\n\t"
+        "ld1r	{v12.8h}, [x4], #2\n\t"
+        "sub	v10.8h, v12.8h, v2.8h\n\t"
+        "ushr	v10.8h, v10.8h, #15\n\t"
+        "add	v6.8h, v6.8h, v10.8h\n\t"
+        "sub	v11.8h, v12.8h, v3.8h\n\t"
+        "ushr	v11.8h, v11.8h, #15\n\t"
+        "add	v7.8h, v7.8h, v11.8h\n\t"
+        "subs	w5, w5, #1\n\t"
+        "b.ne	L_frodokem_sample_neon_cdf16_%=\n\t"
+        "neg	v8.8h, v4.8h\n\t"
+        "eor	v6.16b, v6.16b, v8.16b\n\t"
+        "add	v6.8h, v6.8h, v4.8h\n\t"
+        "st1	{v6.8h}, [%x[mat]], #16\n\t"
+        "neg	v9.8h, v5.8h\n\t"
+        "eor	v7.16b, v7.16b, v9.16b\n\t"
+        "add	v7.8h, v7.8h, v5.8h\n\t"
+        "st1	{v7.8h}, [%x[mat]], #16\n\t"
+        "subs	%w[cnt], %w[cnt], #16\n\t"
+        "cmp	%w[cnt], #16\n\t"
+        "b.ge	L_frodokem_sample_neon_blk16_%=\n\t"
+        "\n"
+    "L_frodokem_sample_neon_rem_%=:\n\t"
+        "cmp	%w[cnt], #0\n\t"
+        "b.eq	L_frodokem_sample_neon_done_%=\n\t"
+        "\n"
+    "L_frodokem_sample_neon_blk_%=:\n\t"
+        "ld1	{v0.8h}, [%x[mat]]\n\t"
+        "ushr	v2.8h, v0.8h, #1\n\t"
+        "movi	v4.8h, #1\n\t"
+        "and	v4.16b, v4.16b, v0.16b\n\t"
+        "movi	v6.8h, #0\n\t"
+        "mov	x4, %x[cdf]\n\t"
+        "mov	w5, %w[cdflen]\n\t"
+        "\n"
+    "L_frodokem_sample_neon_cdf_%=:\n\t"
+        "ld1r	{v12.8h}, [x4], #2\n\t"
+        "sub	v12.8h, v12.8h, v2.8h\n\t"
+        "ushr	v12.8h, v12.8h, #15\n\t"
+        "add	v6.8h, v6.8h, v12.8h\n\t"
+        "subs	w5, w5, #1\n\t"
+        "b.ne	L_frodokem_sample_neon_cdf_%=\n\t"
+        "neg	v8.8h, v4.8h\n\t"
+        "eor	v6.16b, v6.16b, v8.16b\n\t"
+        "add	v6.8h, v6.8h, v4.8h\n\t"
+        "st1	{v6.8h}, [%x[mat]], #16\n\t"
+        "subs	%w[cnt], %w[cnt], #8\n\t"
+        "b.ne	L_frodokem_sample_neon_blk_%=\n\t"
+        "\n"
+    "L_frodokem_sample_neon_done_%=:\n\t"
+        : [mat] "+r" (mat), [cnt] "+r" (cnt), [cdflen] "+r" (cdflen)
+        : [cdf] "r" (cdf)
+        : "memory", "cc", "x4", "x5", "v0", "v1", "v2", "v3", "v4", "v5", "v6",
+            "v7", "v8", "v9", "v10", "v11", "v12"
+    );
+}
+
+void frodokem_sa_accum_neon(word16* out, const word16* s, const word16* row,
+    int j, int n)
+{
+    __asm__ __volatile__ (
+        "sxtw	x5, %w[n]\n\t"
+        "lsl	x5, x5, #1\n\t"
+        "lsl	x6, x5, #2\n\t"
+        "sxtw	x7, %w[j]\n\t"
+        "lsl	x7, x7, #1\n\t"
+        "add	x7, %x[s], x7\n\t"
+        "mov	x8, %x[out]\n\t"
+        "mov	x12, #2\n\t"
+        "\n"
+    "L_frodokem_sa_accum_neon_t_%=:\n\t"
+        "ldr	w13, [x7]\n\t"
+        "dup	v0.8h, w13\n\t"
+        "lsr	w13, w13, #16\n\t"
+        "dup	v4.8h, w13\n\t"
+        "add	x7, x7, x5\n\t"
+        "ldr	w13, [x7]\n\t"
+        "dup	v1.8h, w13\n\t"
+        "lsr	w13, w13, #16\n\t"
+        "dup	v5.8h, w13\n\t"
+        "add	x7, x7, x5\n\t"
+        "ldr	w13, [x7]\n\t"
+        "dup	v2.8h, w13\n\t"
+        "lsr	w13, w13, #16\n\t"
+        "dup	v6.8h, w13\n\t"
+        "add	x7, x7, x5\n\t"
+        "ldr	w13, [x7]\n\t"
+        "dup	v3.8h, w13\n\t"
+        "lsr	w13, w13, #16\n\t"
+        "dup	v7.8h, w13\n\t"
+        "add	x7, x7, x5\n\t"
+        "mov	x14, x8\n\t"
+        "add	x15, x14, x5\n\t"
+        "add	x16, x15, x5\n\t"
+        "add	x17, x16, x5\n\t"
+        "mov	x9, %x[row]\n\t"
+        "add	x10, %x[row], x5\n\t"
+        "lsr	x11, x5, #4\n\t"
+        "\n"
+    "L_frodokem_sa_accum_neon_k_%=:\n\t"
+        "ld1	{v8.8h}, [x9], #16\n\t"
+        "ld1	{v9.8h}, [x10], #16\n\t"
+        "ld1	{v10.8h}, [x14]\n\t"
+        "mla	v10.8h, v8.8h, v0.8h\n\t"
+        "mla	v10.8h, v9.8h, v4.8h\n\t"
+        "st1	{v10.8h}, [x14], #16\n\t"
+        "ld1	{v11.8h}, [x15]\n\t"
+        "mla	v11.8h, v8.8h, v1.8h\n\t"
+        "mla	v11.8h, v9.8h, v5.8h\n\t"
+        "st1	{v11.8h}, [x15], #16\n\t"
+        "ld1	{v12.8h}, [x16]\n\t"
+        "mla	v12.8h, v8.8h, v2.8h\n\t"
+        "mla	v12.8h, v9.8h, v6.8h\n\t"
+        "st1	{v12.8h}, [x16], #16\n\t"
+        "ld1	{v13.8h}, [x17]\n\t"
+        "mla	v13.8h, v8.8h, v3.8h\n\t"
+        "mla	v13.8h, v9.8h, v7.8h\n\t"
+        "st1	{v13.8h}, [x17], #16\n\t"
+        "subs	x11, x11, #1\n\t"
+        "b.ne	L_frodokem_sa_accum_neon_k_%=\n\t"
+        "add	x8, x8, x6\n\t"
+        "subs	x12, x12, #1\n\t"
+        "b.ne	L_frodokem_sa_accum_neon_t_%=\n\t"
+        : [out] "+r" (out), [j] "+r" (j), [n] "+r" (n)
+        : [s] "r" (s), [row] "r" (row)
+        : "memory", "cc", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12",
+            "x13", "x14", "x15", "x16", "x17", "v0", "v1", "v2", "v3", "v4",
+            "v5", "v6", "v7", "v8", "v9", "v10", "v11", "v12", "v13"
+    );
+}
+
+void frodokem_sa_accum_x4_neon(word16* out, const word16* s, const word16* row,
+    int j, int n)
+{
+    __asm__ __volatile__ (
+        "sxtw	x5, %w[n]\n\t"
+        "lsl	x5, x5, #1\n\t"
+        "lsl	x6, x5, #2\n\t"
+        "sxtw	x7, %w[j]\n\t"
+        "lsl	x7, x7, #1\n\t"
+        "add	x7, %x[s], x7\n\t"
+        "mov	x8, %x[out]\n\t"
+        "mov	x14, #2\n\t"
+        "\n"
+    "L_frodokem_sa_accum_x4_neon_t_%=:\n\t"
+        "ldr	x15, [x7]\n\t"
+        "dup	v0.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v1.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v2.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v3.8h, w15\n\t"
+        "add	x7, x7, x5\n\t"
+        "ldr	x15, [x7]\n\t"
+        "dup	v4.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v5.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v6.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v7.8h, w15\n\t"
+        "add	x7, x7, x5\n\t"
+        "ldr	x15, [x7]\n\t"
+        "dup	v8.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v9.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v10.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v11.8h, w15\n\t"
+        "add	x7, x7, x5\n\t"
+        "ldr	x15, [x7]\n\t"
+        "dup	v12.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v13.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v14.8h, w15\n\t"
+        "lsr	x15, x15, #16\n\t"
+        "dup	v15.8h, w15\n\t"
+        "add	x7, x7, x5\n\t"
+        "mov	x16, x8\n\t"
+        "add	x17, x16, x5\n\t"
+        "add	x19, x17, x5\n\t"
+        "add	x20, x19, x5\n\t"
+        "mov	x9, %x[row]\n\t"
+        "add	x10, x9, x5\n\t"
+        "add	x11, x10, x5\n\t"
+        "add	x12, x11, x5\n\t"
+        "lsr	x13, x5, #4\n\t"
+        "\n"
+    "L_frodokem_sa_accum_x4_neon_k_%=:\n\t"
+        "ld1	{v16.8h}, [x9], #16\n\t"
+        "ld1	{v17.8h}, [x10], #16\n\t"
+        "ld1	{v18.8h}, [x11], #16\n\t"
+        "ld1	{v19.8h}, [x12], #16\n\t"
+        "ld1	{v20.8h}, [x16]\n\t"
+        "mla	v20.8h, v16.8h, v0.8h\n\t"
+        "mla	v20.8h, v17.8h, v1.8h\n\t"
+        "mla	v20.8h, v18.8h, v2.8h\n\t"
+        "mla	v20.8h, v19.8h, v3.8h\n\t"
+        "st1	{v20.8h}, [x16], #16\n\t"
+        "ld1	{v21.8h}, [x17]\n\t"
+        "mla	v21.8h, v16.8h, v4.8h\n\t"
+        "mla	v21.8h, v17.8h, v5.8h\n\t"
+        "mla	v21.8h, v18.8h, v6.8h\n\t"
+        "mla	v21.8h, v19.8h, v7.8h\n\t"
+        "st1	{v21.8h}, [x17], #16\n\t"
+        "ld1	{v22.8h}, [x19]\n\t"
+        "mla	v22.8h, v16.8h, v8.8h\n\t"
+        "mla	v22.8h, v17.8h, v9.8h\n\t"
+        "mla	v22.8h, v18.8h, v10.8h\n\t"
+        "mla	v22.8h, v19.8h, v11.8h\n\t"
+        "st1	{v22.8h}, [x19], #16\n\t"
+        "ld1	{v23.8h}, [x20]\n\t"
+        "mla	v23.8h, v16.8h, v12.8h\n\t"
+        "mla	v23.8h, v17.8h, v13.8h\n\t"
+        "mla	v23.8h, v18.8h, v14.8h\n\t"
+        "mla	v23.8h, v19.8h, v15.8h\n\t"
+        "st1	{v23.8h}, [x20], #16\n\t"
+        "subs	x13, x13, #1\n\t"
+        "b.ne	L_frodokem_sa_accum_x4_neon_k_%=\n\t"
+        "add	x8, x8, x6\n\t"
+        "subs	x14, x14, #1\n\t"
+        "b.ne	L_frodokem_sa_accum_x4_neon_t_%=\n\t"
+        : [out] "+r" (out), [j] "+r" (j), [n] "+r" (n)
+        : [s] "r" (s), [row] "r" (row)
+        : "memory", "cc", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12",
+            "x13", "x14", "x15", "x16", "x17", "x19", "x20", "v0", "v1", "v2",
+            "v3", "v4", "v5", "v6", "v7", "v8", "v9", "v10", "v11", "v12",
+            "v13", "v14", "v15", "v16", "v17", "v18", "v19", "v20", "v21",
+            "v22", "v23"
+    );
+}
+
+void frodokem_as_accum_neon(word16* out, const word16* s, const word16* row,
+    int i, int n)
+{
+    __asm__ __volatile__ (
+        "sxtw	x5, %w[n]\n\t"
+        "lsl	x5, x5, #1\n\t"
+        "lsl	x6, x5, #2\n\t"
+        "sxtw	x15, %w[i]\n\t"
+        "lsl	x15, x15, #4\n\t"
+        "add	x7, %x[out], x15\n\t"
+        "add	x8, x7, #16\n\t"
+        "mov	x9, %x[row]\n\t"
+        "add	x10, %x[row], x5\n\t"
+        "mov	x13, %x[s]\n\t"
+        "mov	x16, x13\n\t"
+        "add	x17, x16, x5\n\t"
+        "add	x19, x17, x5\n\t"
+        "add	x20, x19, x5\n\t"
+        "mov	x11, x9\n\t"
+        "mov	x12, x10\n\t"
+        "movi	v0.8h, #0\n\t"
+        "movi	v1.8h, #0\n\t"
+        "movi	v2.8h, #0\n\t"
+        "movi	v3.8h, #0\n\t"
+        "movi	v4.8h, #0\n\t"
+        "movi	v5.8h, #0\n\t"
+        "movi	v6.8h, #0\n\t"
+        "movi	v7.8h, #0\n\t"
+        "lsr	x14, x5, #4\n\t"
+        "\n"
+    "L_frodokem_as_accum_neon_k0_%=:\n\t"
+        "ld1	{v8.8h}, [x11], #16\n\t"
+        "ld1	{v9.8h}, [x12], #16\n\t"
+        "ld1	{v10.8h}, [x16], #16\n\t"
+        "mla	v0.8h, v8.8h, v10.8h\n\t"
+        "mla	v4.8h, v9.8h, v10.8h\n\t"
+        "ld1	{v10.8h}, [x17], #16\n\t"
+        "mla	v1.8h, v8.8h, v10.8h\n\t"
+        "mla	v5.8h, v9.8h, v10.8h\n\t"
+        "ld1	{v10.8h}, [x19], #16\n\t"
+        "mla	v2.8h, v8.8h, v10.8h\n\t"
+        "mla	v6.8h, v9.8h, v10.8h\n\t"
+        "ld1	{v10.8h}, [x20], #16\n\t"
+        "mla	v3.8h, v8.8h, v10.8h\n\t"
+        "mla	v7.8h, v9.8h, v10.8h\n\t"
+        "subs	x14, x14, #1\n\t"
+        "b.ne	L_frodokem_as_accum_neon_k0_%=\n\t"
+        "addv	h13, v0.8h\n\t"
+        "ins	v11.h[0], v13.h[0]\n\t"
+        "addv	h13, v4.8h\n\t"
+        "ins	v12.h[0], v13.h[0]\n\t"
+        "addv	h13, v1.8h\n\t"
+        "ins	v11.h[1], v13.h[0]\n\t"
+        "addv	h13, v5.8h\n\t"
+        "ins	v12.h[1], v13.h[0]\n\t"
+        "addv	h13, v2.8h\n\t"
+        "ins	v11.h[2], v13.h[0]\n\t"
+        "addv	h13, v6.8h\n\t"
+        "ins	v12.h[2], v13.h[0]\n\t"
+        "addv	h13, v3.8h\n\t"
+        "ins	v11.h[3], v13.h[0]\n\t"
+        "addv	h13, v7.8h\n\t"
+        "ins	v12.h[3], v13.h[0]\n\t"
+        "add	x13, x13, x6\n\t"
+        "mov	x16, x13\n\t"
+        "add	x17, x16, x5\n\t"
+        "add	x19, x17, x5\n\t"
+        "add	x20, x19, x5\n\t"
+        "mov	x11, x9\n\t"
+        "mov	x12, x10\n\t"
+        "movi	v0.8h, #0\n\t"
+        "movi	v1.8h, #0\n\t"
+        "movi	v2.8h, #0\n\t"
+        "movi	v3.8h, #0\n\t"
+        "movi	v4.8h, #0\n\t"
+        "movi	v5.8h, #0\n\t"
+        "movi	v6.8h, #0\n\t"
+        "movi	v7.8h, #0\n\t"
+        "lsr	x14, x5, #4\n\t"
+        "\n"
+    "L_frodokem_as_accum_neon_k1_%=:\n\t"
+        "ld1	{v8.8h}, [x11], #16\n\t"
+        "ld1	{v9.8h}, [x12], #16\n\t"
+        "ld1	{v10.8h}, [x16], #16\n\t"
+        "mla	v0.8h, v8.8h, v10.8h\n\t"
+        "mla	v4.8h, v9.8h, v10.8h\n\t"
+        "ld1	{v10.8h}, [x17], #16\n\t"
+        "mla	v1.8h, v8.8h, v10.8h\n\t"
+        "mla	v5.8h, v9.8h, v10.8h\n\t"
+        "ld1	{v10.8h}, [x19], #16\n\t"
+        "mla	v2.8h, v8.8h, v10.8h\n\t"
+        "mla	v6.8h, v9.8h, v10.8h\n\t"
+        "ld1	{v10.8h}, [x20], #16\n\t"
+        "mla	v3.8h, v8.8h, v10.8h\n\t"
+        "mla	v7.8h, v9.8h, v10.8h\n\t"
+        "subs	x14, x14, #1\n\t"
+        "b.ne	L_frodokem_as_accum_neon_k1_%=\n\t"
+        "addv	h13, v0.8h\n\t"
+        "ins	v11.h[4], v13.h[0]\n\t"
+        "addv	h13, v4.8h\n\t"
+        "ins	v12.h[4], v13.h[0]\n\t"
+        "addv	h13, v1.8h\n\t"
+        "ins	v11.h[5], v13.h[0]\n\t"
+        "addv	h13, v5.8h\n\t"
+        "ins	v12.h[5], v13.h[0]\n\t"
+        "addv	h13, v2.8h\n\t"
+        "ins	v11.h[6], v13.h[0]\n\t"
+        "addv	h13, v6.8h\n\t"
+        "ins	v12.h[6], v13.h[0]\n\t"
+        "addv	h13, v3.8h\n\t"
+        "ins	v11.h[7], v13.h[0]\n\t"
+        "addv	h13, v7.8h\n\t"
+        "ins	v12.h[7], v13.h[0]\n\t"
+        "add	x13, x13, x6\n\t"
+        "ld1	{v8.8h}, [x7]\n\t"
+        "add	v11.8h, v11.8h, v8.8h\n\t"
+        "st1	{v11.8h}, [x7], #16\n\t"
+        "ld1	{v9.8h}, [x8]\n\t"
+        "add	v12.8h, v12.8h, v9.8h\n\t"
+        "st1	{v12.8h}, [x8], #16\n\t"
+        : [out] "+r" (out), [i] "+r" (i), [n] "+r" (n)
+        : [s] "r" (s), [row] "r" (row)
+        : "memory", "cc", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12",
+            "x13", "x14", "x15", "x16", "x17", "x19", "x20", "v0", "v1", "v2",
+            "v3", "v4", "v5", "v6", "v7", "v8", "v9", "v10", "v11", "v12",
+            "v13"
+    );
+}
+
+void frodokem_as_accum_x4_neon(word16* out, const word16* s, const word16* row,
+    int i, int n)
+{
+    __asm__ __volatile__ (
+        "sxtw	x5, %w[n]\n\t"
+        "lsl	x5, x5, #1\n\t"
+        "lsl	x6, x5, #2\n\t"
+        "sxtw	x22, %w[i]\n\t"
+        "lsl	x22, x22, #4\n\t"
+        "add	x7, %x[out], x22\n\t"
+        "add	x8, x7, #16\n\t"
+        "add	x9, x8, #16\n\t"
+        "add	x10, x9, #16\n\t"
+        "mov	x11, %x[row]\n\t"
+        "add	x12, x11, x5\n\t"
+        "add	x13, x12, x5\n\t"
+        "add	x14, x13, x5\n\t"
+        "mov	x20, %x[s]\n\t"
+        "mov	x23, x20\n\t"
+        "add	x24, x23, x5\n\t"
+        "add	x25, x24, x5\n\t"
+        "add	x26, x25, x5\n\t"
+        "mov	x15, x11\n\t"
+        "mov	x16, x12\n\t"
+        "mov	x17, x13\n\t"
+        "mov	x19, x14\n\t"
+        "movi	v0.8h, #0\n\t"
+        "movi	v1.8h, #0\n\t"
+        "movi	v2.8h, #0\n\t"
+        "movi	v3.8h, #0\n\t"
+        "movi	v4.8h, #0\n\t"
+        "movi	v5.8h, #0\n\t"
+        "movi	v6.8h, #0\n\t"
+        "movi	v7.8h, #0\n\t"
+        "movi	v8.8h, #0\n\t"
+        "movi	v9.8h, #0\n\t"
+        "movi	v10.8h, #0\n\t"
+        "movi	v11.8h, #0\n\t"
+        "movi	v12.8h, #0\n\t"
+        "movi	v13.8h, #0\n\t"
+        "movi	v14.8h, #0\n\t"
+        "movi	v15.8h, #0\n\t"
+        "lsr	x21, x5, #4\n\t"
+        "\n"
+    "L_frodokem_as_accum_x4_neon_k0_%=:\n\t"
+        "ld1	{v16.8h}, [x15], #16\n\t"
+        "ld1	{v17.8h}, [x16], #16\n\t"
+        "ld1	{v18.8h}, [x17], #16\n\t"
+        "ld1	{v19.8h}, [x19], #16\n\t"
+        "ld1	{v20.8h}, [x23], #16\n\t"
+        "mla	v0.8h, v16.8h, v20.8h\n\t"
+        "mla	v4.8h, v17.8h, v20.8h\n\t"
+        "mla	v8.8h, v18.8h, v20.8h\n\t"
+        "mla	v12.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x24], #16\n\t"
+        "mla	v1.8h, v16.8h, v20.8h\n\t"
+        "mla	v5.8h, v17.8h, v20.8h\n\t"
+        "mla	v9.8h, v18.8h, v20.8h\n\t"
+        "mla	v13.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x25], #16\n\t"
+        "mla	v2.8h, v16.8h, v20.8h\n\t"
+        "mla	v6.8h, v17.8h, v20.8h\n\t"
+        "mla	v10.8h, v18.8h, v20.8h\n\t"
+        "mla	v14.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x26], #16\n\t"
+        "mla	v3.8h, v16.8h, v20.8h\n\t"
+        "mla	v7.8h, v17.8h, v20.8h\n\t"
+        "mla	v11.8h, v18.8h, v20.8h\n\t"
+        "mla	v15.8h, v19.8h, v20.8h\n\t"
+        "subs	x21, x21, #1\n\t"
+        "b.ne	L_frodokem_as_accum_x4_neon_k0_%=\n\t"
+        "addv	h25, v0.8h\n\t"
+        "ins	v21.h[0], v25.h[0]\n\t"
+        "addv	h25, v4.8h\n\t"
+        "ins	v22.h[0], v25.h[0]\n\t"
+        "addv	h25, v8.8h\n\t"
+        "ins	v23.h[0], v25.h[0]\n\t"
+        "addv	h25, v12.8h\n\t"
+        "ins	v24.h[0], v25.h[0]\n\t"
+        "addv	h25, v1.8h\n\t"
+        "ins	v21.h[1], v25.h[0]\n\t"
+        "addv	h25, v5.8h\n\t"
+        "ins	v22.h[1], v25.h[0]\n\t"
+        "addv	h25, v9.8h\n\t"
+        "ins	v23.h[1], v25.h[0]\n\t"
+        "addv	h25, v13.8h\n\t"
+        "ins	v24.h[1], v25.h[0]\n\t"
+        "addv	h25, v2.8h\n\t"
+        "ins	v21.h[2], v25.h[0]\n\t"
+        "addv	h25, v6.8h\n\t"
+        "ins	v22.h[2], v25.h[0]\n\t"
+        "addv	h25, v10.8h\n\t"
+        "ins	v23.h[2], v25.h[0]\n\t"
+        "addv	h25, v14.8h\n\t"
+        "ins	v24.h[2], v25.h[0]\n\t"
+        "addv	h25, v3.8h\n\t"
+        "ins	v21.h[3], v25.h[0]\n\t"
+        "addv	h25, v7.8h\n\t"
+        "ins	v22.h[3], v25.h[0]\n\t"
+        "addv	h25, v11.8h\n\t"
+        "ins	v23.h[3], v25.h[0]\n\t"
+        "addv	h25, v15.8h\n\t"
+        "ins	v24.h[3], v25.h[0]\n\t"
+        "add	x20, x20, x6\n\t"
+        "mov	x23, x20\n\t"
+        "add	x24, x23, x5\n\t"
+        "add	x25, x24, x5\n\t"
+        "add	x26, x25, x5\n\t"
+        "mov	x15, x11\n\t"
+        "mov	x16, x12\n\t"
+        "mov	x17, x13\n\t"
+        "mov	x19, x14\n\t"
+        "movi	v0.8h, #0\n\t"
+        "movi	v1.8h, #0\n\t"
+        "movi	v2.8h, #0\n\t"
+        "movi	v3.8h, #0\n\t"
+        "movi	v4.8h, #0\n\t"
+        "movi	v5.8h, #0\n\t"
+        "movi	v6.8h, #0\n\t"
+        "movi	v7.8h, #0\n\t"
+        "movi	v8.8h, #0\n\t"
+        "movi	v9.8h, #0\n\t"
+        "movi	v10.8h, #0\n\t"
+        "movi	v11.8h, #0\n\t"
+        "movi	v12.8h, #0\n\t"
+        "movi	v13.8h, #0\n\t"
+        "movi	v14.8h, #0\n\t"
+        "movi	v15.8h, #0\n\t"
+        "lsr	x21, x5, #4\n\t"
+        "\n"
+    "L_frodokem_as_accum_x4_neon_k1_%=:\n\t"
+        "ld1	{v16.8h}, [x15], #16\n\t"
+        "ld1	{v17.8h}, [x16], #16\n\t"
+        "ld1	{v18.8h}, [x17], #16\n\t"
+        "ld1	{v19.8h}, [x19], #16\n\t"
+        "ld1	{v20.8h}, [x23], #16\n\t"
+        "mla	v0.8h, v16.8h, v20.8h\n\t"
+        "mla	v4.8h, v17.8h, v20.8h\n\t"
+        "mla	v8.8h, v18.8h, v20.8h\n\t"
+        "mla	v12.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x24], #16\n\t"
+        "mla	v1.8h, v16.8h, v20.8h\n\t"
+        "mla	v5.8h, v17.8h, v20.8h\n\t"
+        "mla	v9.8h, v18.8h, v20.8h\n\t"
+        "mla	v13.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x25], #16\n\t"
+        "mla	v2.8h, v16.8h, v20.8h\n\t"
+        "mla	v6.8h, v17.8h, v20.8h\n\t"
+        "mla	v10.8h, v18.8h, v20.8h\n\t"
+        "mla	v14.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x26], #16\n\t"
+        "mla	v3.8h, v16.8h, v20.8h\n\t"
+        "mla	v7.8h, v17.8h, v20.8h\n\t"
+        "mla	v11.8h, v18.8h, v20.8h\n\t"
+        "mla	v15.8h, v19.8h, v20.8h\n\t"
+        "subs	x21, x21, #1\n\t"
+        "b.ne	L_frodokem_as_accum_x4_neon_k1_%=\n\t"
+        "addv	h25, v0.8h\n\t"
+        "ins	v21.h[4], v25.h[0]\n\t"
+        "addv	h25, v4.8h\n\t"
+        "ins	v22.h[4], v25.h[0]\n\t"
+        "addv	h25, v8.8h\n\t"
+        "ins	v23.h[4], v25.h[0]\n\t"
+        "addv	h25, v12.8h\n\t"
+        "ins	v24.h[4], v25.h[0]\n\t"
+        "addv	h25, v1.8h\n\t"
+        "ins	v21.h[5], v25.h[0]\n\t"
+        "addv	h25, v5.8h\n\t"
+        "ins	v22.h[5], v25.h[0]\n\t"
+        "addv	h25, v9.8h\n\t"
+        "ins	v23.h[5], v25.h[0]\n\t"
+        "addv	h25, v13.8h\n\t"
+        "ins	v24.h[5], v25.h[0]\n\t"
+        "addv	h25, v2.8h\n\t"
+        "ins	v21.h[6], v25.h[0]\n\t"
+        "addv	h25, v6.8h\n\t"
+        "ins	v22.h[6], v25.h[0]\n\t"
+        "addv	h25, v10.8h\n\t"
+        "ins	v23.h[6], v25.h[0]\n\t"
+        "addv	h25, v14.8h\n\t"
+        "ins	v24.h[6], v25.h[0]\n\t"
+        "addv	h25, v3.8h\n\t"
+        "ins	v21.h[7], v25.h[0]\n\t"
+        "addv	h25, v7.8h\n\t"
+        "ins	v22.h[7], v25.h[0]\n\t"
+        "addv	h25, v11.8h\n\t"
+        "ins	v23.h[7], v25.h[0]\n\t"
+        "addv	h25, v15.8h\n\t"
+        "ins	v24.h[7], v25.h[0]\n\t"
+        "add	x20, x20, x6\n\t"
+        "ld1	{v16.8h}, [x7]\n\t"
+        "add	v21.8h, v21.8h, v16.8h\n\t"
+        "st1	{v21.8h}, [x7], #16\n\t"
+        "ld1	{v16.8h}, [x8]\n\t"
+        "add	v22.8h, v22.8h, v16.8h\n\t"
+        "st1	{v22.8h}, [x8], #16\n\t"
+        "ld1	{v16.8h}, [x9]\n\t"
+        "add	v23.8h, v23.8h, v16.8h\n\t"
+        "st1	{v23.8h}, [x9], #16\n\t"
+        "ld1	{v16.8h}, [x10]\n\t"
+        "add	v24.8h, v24.8h, v16.8h\n\t"
+        "st1	{v24.8h}, [x10], #16\n\t"
+        : [out] "+r" (out), [i] "+r" (i), [n] "+r" (n)
+        : [s] "r" (s), [row] "r" (row)
+        : "memory", "cc", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12",
+            "x13", "x14", "x15", "x16", "x17", "x19", "x20", "x21", "x22",
+            "x23", "x24", "x25", "x26", "v0", "v1", "v2", "v3", "v4", "v5",
+            "v6", "v7", "v8", "v9", "v10", "v11", "v12", "v13", "v14", "v15",
+            "v16", "v17", "v18", "v19", "v20", "v21", "v22", "v23", "v24",
+            "v25"
+    );
+}
+
+void frodokem_mul_bs_neon(word16* out, const word16* b, const word16* s, int n,
+    int qmask)
+{
+    __asm__ __volatile__ (
+        "sxtw	x5, %w[n]\n\t"
+        "lsl	x5, x5, #1\n\t"
+        "lsl	x6, x5, #2\n\t"
+        "dup	v26.8h, %w[qmask]\n\t"
+        "mov	x7, %x[out]\n\t"
+        "add	x8, x7, #16\n\t"
+        "add	x9, x8, #16\n\t"
+        "add	x10, x9, #16\n\t"
+        "mov	x11, %x[b]\n\t"
+        "mov	x23, #2\n\t"
+        "\n"
+    "L_frodokem_mul_bs_neon_p_%=:\n\t"
+        "mov	x12, x11\n\t"
+        "add	x13, x12, x5\n\t"
+        "add	x14, x13, x5\n\t"
+        "add	x15, x14, x5\n\t"
+        "mov	x21, %x[s]\n\t"
+        "mov	x24, x21\n\t"
+        "add	x25, x24, x5\n\t"
+        "add	x26, x25, x5\n\t"
+        "add	x27, x26, x5\n\t"
+        "mov	x16, x12\n\t"
+        "mov	x17, x13\n\t"
+        "mov	x19, x14\n\t"
+        "mov	x20, x15\n\t"
+        "movi	v0.8h, #0\n\t"
+        "movi	v1.8h, #0\n\t"
+        "movi	v2.8h, #0\n\t"
+        "movi	v3.8h, #0\n\t"
+        "movi	v4.8h, #0\n\t"
+        "movi	v5.8h, #0\n\t"
+        "movi	v6.8h, #0\n\t"
+        "movi	v7.8h, #0\n\t"
+        "movi	v8.8h, #0\n\t"
+        "movi	v9.8h, #0\n\t"
+        "movi	v10.8h, #0\n\t"
+        "movi	v11.8h, #0\n\t"
+        "movi	v12.8h, #0\n\t"
+        "movi	v13.8h, #0\n\t"
+        "movi	v14.8h, #0\n\t"
+        "movi	v15.8h, #0\n\t"
+        "lsr	x22, x5, #4\n\t"
+        "\n"
+    "L_frodokem_mul_bs_neon_k0_%=:\n\t"
+        "ld1	{v16.8h}, [x16], #16\n\t"
+        "ld1	{v17.8h}, [x17], #16\n\t"
+        "ld1	{v18.8h}, [x19], #16\n\t"
+        "ld1	{v19.8h}, [x20], #16\n\t"
+        "ld1	{v20.8h}, [x24], #16\n\t"
+        "mla	v0.8h, v16.8h, v20.8h\n\t"
+        "mla	v4.8h, v17.8h, v20.8h\n\t"
+        "mla	v8.8h, v18.8h, v20.8h\n\t"
+        "mla	v12.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x25], #16\n\t"
+        "mla	v1.8h, v16.8h, v20.8h\n\t"
+        "mla	v5.8h, v17.8h, v20.8h\n\t"
+        "mla	v9.8h, v18.8h, v20.8h\n\t"
+        "mla	v13.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x26], #16\n\t"
+        "mla	v2.8h, v16.8h, v20.8h\n\t"
+        "mla	v6.8h, v17.8h, v20.8h\n\t"
+        "mla	v10.8h, v18.8h, v20.8h\n\t"
+        "mla	v14.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x27], #16\n\t"
+        "mla	v3.8h, v16.8h, v20.8h\n\t"
+        "mla	v7.8h, v17.8h, v20.8h\n\t"
+        "mla	v11.8h, v18.8h, v20.8h\n\t"
+        "mla	v15.8h, v19.8h, v20.8h\n\t"
+        "subs	x22, x22, #1\n\t"
+        "b.ne	L_frodokem_mul_bs_neon_k0_%=\n\t"
+        "addv	h25, v0.8h\n\t"
+        "ins	v21.h[0], v25.h[0]\n\t"
+        "addv	h25, v4.8h\n\t"
+        "ins	v22.h[0], v25.h[0]\n\t"
+        "addv	h25, v8.8h\n\t"
+        "ins	v23.h[0], v25.h[0]\n\t"
+        "addv	h25, v12.8h\n\t"
+        "ins	v24.h[0], v25.h[0]\n\t"
+        "addv	h25, v1.8h\n\t"
+        "ins	v21.h[1], v25.h[0]\n\t"
+        "addv	h25, v5.8h\n\t"
+        "ins	v22.h[1], v25.h[0]\n\t"
+        "addv	h25, v9.8h\n\t"
+        "ins	v23.h[1], v25.h[0]\n\t"
+        "addv	h25, v13.8h\n\t"
+        "ins	v24.h[1], v25.h[0]\n\t"
+        "addv	h25, v2.8h\n\t"
+        "ins	v21.h[2], v25.h[0]\n\t"
+        "addv	h25, v6.8h\n\t"
+        "ins	v22.h[2], v25.h[0]\n\t"
+        "addv	h25, v10.8h\n\t"
+        "ins	v23.h[2], v25.h[0]\n\t"
+        "addv	h25, v14.8h\n\t"
+        "ins	v24.h[2], v25.h[0]\n\t"
+        "addv	h25, v3.8h\n\t"
+        "ins	v21.h[3], v25.h[0]\n\t"
+        "addv	h25, v7.8h\n\t"
+        "ins	v22.h[3], v25.h[0]\n\t"
+        "addv	h25, v11.8h\n\t"
+        "ins	v23.h[3], v25.h[0]\n\t"
+        "addv	h25, v15.8h\n\t"
+        "ins	v24.h[3], v25.h[0]\n\t"
+        "add	x21, x21, x6\n\t"
+        "mov	x24, x21\n\t"
+        "add	x25, x24, x5\n\t"
+        "add	x26, x25, x5\n\t"
+        "add	x27, x26, x5\n\t"
+        "mov	x16, x12\n\t"
+        "mov	x17, x13\n\t"
+        "mov	x19, x14\n\t"
+        "mov	x20, x15\n\t"
+        "movi	v0.8h, #0\n\t"
+        "movi	v1.8h, #0\n\t"
+        "movi	v2.8h, #0\n\t"
+        "movi	v3.8h, #0\n\t"
+        "movi	v4.8h, #0\n\t"
+        "movi	v5.8h, #0\n\t"
+        "movi	v6.8h, #0\n\t"
+        "movi	v7.8h, #0\n\t"
+        "movi	v8.8h, #0\n\t"
+        "movi	v9.8h, #0\n\t"
+        "movi	v10.8h, #0\n\t"
+        "movi	v11.8h, #0\n\t"
+        "movi	v12.8h, #0\n\t"
+        "movi	v13.8h, #0\n\t"
+        "movi	v14.8h, #0\n\t"
+        "movi	v15.8h, #0\n\t"
+        "lsr	x22, x5, #4\n\t"
+        "\n"
+    "L_frodokem_mul_bs_neon_k1_%=:\n\t"
+        "ld1	{v16.8h}, [x16], #16\n\t"
+        "ld1	{v17.8h}, [x17], #16\n\t"
+        "ld1	{v18.8h}, [x19], #16\n\t"
+        "ld1	{v19.8h}, [x20], #16\n\t"
+        "ld1	{v20.8h}, [x24], #16\n\t"
+        "mla	v0.8h, v16.8h, v20.8h\n\t"
+        "mla	v4.8h, v17.8h, v20.8h\n\t"
+        "mla	v8.8h, v18.8h, v20.8h\n\t"
+        "mla	v12.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x25], #16\n\t"
+        "mla	v1.8h, v16.8h, v20.8h\n\t"
+        "mla	v5.8h, v17.8h, v20.8h\n\t"
+        "mla	v9.8h, v18.8h, v20.8h\n\t"
+        "mla	v13.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x26], #16\n\t"
+        "mla	v2.8h, v16.8h, v20.8h\n\t"
+        "mla	v6.8h, v17.8h, v20.8h\n\t"
+        "mla	v10.8h, v18.8h, v20.8h\n\t"
+        "mla	v14.8h, v19.8h, v20.8h\n\t"
+        "ld1	{v20.8h}, [x27], #16\n\t"
+        "mla	v3.8h, v16.8h, v20.8h\n\t"
+        "mla	v7.8h, v17.8h, v20.8h\n\t"
+        "mla	v11.8h, v18.8h, v20.8h\n\t"
+        "mla	v15.8h, v19.8h, v20.8h\n\t"
+        "subs	x22, x22, #1\n\t"
+        "b.ne	L_frodokem_mul_bs_neon_k1_%=\n\t"
+        "addv	h25, v0.8h\n\t"
+        "ins	v21.h[4], v25.h[0]\n\t"
+        "addv	h25, v4.8h\n\t"
+        "ins	v22.h[4], v25.h[0]\n\t"
+        "addv	h25, v8.8h\n\t"
+        "ins	v23.h[4], v25.h[0]\n\t"
+        "addv	h25, v12.8h\n\t"
+        "ins	v24.h[4], v25.h[0]\n\t"
+        "addv	h25, v1.8h\n\t"
+        "ins	v21.h[5], v25.h[0]\n\t"
+        "addv	h25, v5.8h\n\t"
+        "ins	v22.h[5], v25.h[0]\n\t"
+        "addv	h25, v9.8h\n\t"
+        "ins	v23.h[5], v25.h[0]\n\t"
+        "addv	h25, v13.8h\n\t"
+        "ins	v24.h[5], v25.h[0]\n\t"
+        "addv	h25, v2.8h\n\t"
+        "ins	v21.h[6], v25.h[0]\n\t"
+        "addv	h25, v6.8h\n\t"
+        "ins	v22.h[6], v25.h[0]\n\t"
+        "addv	h25, v10.8h\n\t"
+        "ins	v23.h[6], v25.h[0]\n\t"
+        "addv	h25, v14.8h\n\t"
+        "ins	v24.h[6], v25.h[0]\n\t"
+        "addv	h25, v3.8h\n\t"
+        "ins	v21.h[7], v25.h[0]\n\t"
+        "addv	h25, v7.8h\n\t"
+        "ins	v22.h[7], v25.h[0]\n\t"
+        "addv	h25, v11.8h\n\t"
+        "ins	v23.h[7], v25.h[0]\n\t"
+        "addv	h25, v15.8h\n\t"
+        "ins	v24.h[7], v25.h[0]\n\t"
+        "add	x21, x21, x6\n\t"
+        "and	v21.16b, v21.16b, v26.16b\n\t"
+        "st1	{v21.8h}, [x7]\n\t"
+        "and	v22.16b, v22.16b, v26.16b\n\t"
+        "st1	{v22.8h}, [x8]\n\t"
+        "and	v23.16b, v23.16b, v26.16b\n\t"
+        "st1	{v23.8h}, [x9]\n\t"
+        "and	v24.16b, v24.16b, v26.16b\n\t"
+        "st1	{v24.8h}, [x10]\n\t"
+        "add	x11, x11, x6\n\t"
+        "add	x7, x7, #0x40\n\t"
+        "add	x8, x8, #0x40\n\t"
+        "add	x9, x9, #0x40\n\t"
+        "add	x10, x10, #0x40\n\t"
+        "subs	x23, x23, #1\n\t"
+        "b.ne	L_frodokem_mul_bs_neon_p_%=\n\t"
+        : [out] "+r" (out), [n] "+r" (n), [qmask] "+r" (qmask)
+        : [b] "r" (b), [s] "r" (s)
+        : "memory", "cc", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12",
+            "x13", "x14", "x15", "x16", "x17", "x19", "x20", "x21", "x22",
+            "x23", "x24", "x25", "x26", "x27", "v0", "v1", "v2", "v3", "v4",
+            "v5", "v6", "v7", "v8", "v9", "v10", "v11", "v12", "v13", "v14",
+            "v15", "v16", "v17", "v18", "v19", "v20", "v21", "v22", "v23",
+            "v24", "v25", "v26"
+    );
+}
+
+void frodokem_mul_add_sb_plus_e_neon(word16* out, const word16* b,
+    const word16* s, int n, int qmask)
+{
+    __asm__ __volatile__ (
+        "sxtw	x5, %w[n]\n\t"
+        "lsl	x5, x5, #1\n\t"
+        "dup	v10.8h, %w[qmask]\n\t"
+        "mov	x6, %x[s]\n\t"
+        "add	x7, x6, x5\n\t"
+        "add	x8, x7, x5\n\t"
+        "add	x9, x8, x5\n\t"
+        "add	x10, x9, x5\n\t"
+        "add	x11, x10, x5\n\t"
+        "add	x12, x11, x5\n\t"
+        "add	x13, x12, x5\n\t"
+        "mov	x14, %x[b]\n\t"
+        "mov	x16, %x[out]\n\t"
+        "ld1	{v0.8h, v1.8h, v2.8h, v3.8h}, [x16], #0x40\n\t"
+        "ld1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x16], #0x40\n\t"
+        "sub	x16, x16, #0x80\n\t"
+        "sxtw	x15, %w[n]\n\t"
+        "\n"
+    "L_frodokem_mul_add_sb_plus_e_neon_j_%=:\n\t"
+        "ld1	{v8.8h}, [x14], #16\n\t"
+        "ld1r	{v9.8h}, [x6], #2\n\t"
+        "mla	v0.8h, v8.8h, v9.8h\n\t"
+        "ld1r	{v9.8h}, [x7], #2\n\t"
+        "mla	v1.8h, v8.8h, v9.8h\n\t"
+        "ld1r	{v9.8h}, [x8], #2\n\t"
+        "mla	v2.8h, v8.8h, v9.8h\n\t"
+        "ld1r	{v9.8h}, [x9], #2\n\t"
+        "mla	v3.8h, v8.8h, v9.8h\n\t"
+        "ld1r	{v9.8h}, [x10], #2\n\t"
+        "mla	v4.8h, v8.8h, v9.8h\n\t"
+        "ld1r	{v9.8h}, [x11], #2\n\t"
+        "mla	v5.8h, v8.8h, v9.8h\n\t"
+        "ld1r	{v9.8h}, [x12], #2\n\t"
+        "mla	v6.8h, v8.8h, v9.8h\n\t"
+        "ld1r	{v9.8h}, [x13], #2\n\t"
+        "mla	v7.8h, v8.8h, v9.8h\n\t"
+        "subs	x15, x15, #1\n\t"
+        "b.ne	L_frodokem_mul_add_sb_plus_e_neon_j_%=\n\t"
+        "and	v0.16b, v0.16b, v10.16b\n\t"
+        "and	v1.16b, v1.16b, v10.16b\n\t"
+        "and	v2.16b, v2.16b, v10.16b\n\t"
+        "and	v3.16b, v3.16b, v10.16b\n\t"
+        "and	v4.16b, v4.16b, v10.16b\n\t"
+        "and	v5.16b, v5.16b, v10.16b\n\t"
+        "and	v6.16b, v6.16b, v10.16b\n\t"
+        "and	v7.16b, v7.16b, v10.16b\n\t"
+        "st1	{v0.8h, v1.8h, v2.8h, v3.8h}, [x16], #0x40\n\t"
+        "st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x16], #0x40\n\t"
+        : [out] "+r" (out), [n] "+r" (n), [qmask] "+r" (qmask)
+        : [b] "r" (b), [s] "r" (s)
+        : "memory", "cc", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12",
+            "x13", "x14", "x15", "x16", "v0", "v1", "v2", "v3", "v4", "v5",
+            "v6", "v7", "v8", "v9", "v10"
+    );
+}
+
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#endif /* __aarch64__ */
+#endif /* WOLFSSL_ARMASM */
+#endif /* WOLFSSL_ARMASM_INLINE */
diff --git a/wolfcrypt/src/port/arm/thumb2-aes-asm.S b/wolfcrypt/src/port/arm/thumb2-aes-asm.S
index b01645c8ecf..e8c952537df 100644
--- a/wolfcrypt/src/port/arm/thumb2-aes-asm.S
+++ b/wolfcrypt/src/port/arm/thumb2-aes-asm.S
@@ -8861,10 +8861,10 @@ L_AES_GCMSIV_ctr_thumb2_end:
 	.size	AES_GCMSIV_ctr_thumb2,.-AES_GCMSIV_ctr_thumb2
 #endif /* WOLFSSL_AESGCM_SIV */
 #endif /* !NO_AES */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-aes-asm_c.c b/wolfcrypt/src/port/arm/thumb2-aes-asm_c.c
index 51da9475634..07773174da3 100644
--- a/wolfcrypt/src/port/arm/thumb2-aes-asm_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-aes-asm_c.c
@@ -374,6 +374,7 @@ WC_OMIT_FRAME_POINTER void AES_set_encrypt_key(const unsigned char* key,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
+        "PUSH	{%[L_AES_Thumb2_rcon]}\n\t"
         "MOV	r10, %[L_AES_Thumb2_te]\n\t"
         "MOV	lr, %[L_AES_Thumb2_rcon]\n\t"
         "CMP	%[len], #0x80\n\t"
@@ -632,6 +633,7 @@ WC_OMIT_FRAME_POINTER void AES_set_encrypt_key(const unsigned char* key,
 #else
     "L_AES_set_encrypt_key_end_%=:\n\t"
 #endif
+        "POP	{%[L_AES_Thumb2_rcon]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [key] "+r" (key), [len] "+r" (len), [ks] "+r" (ks),
           [L_AES_Thumb2_te] "+r" (L_AES_Thumb2_te_c),
@@ -926,13 +928,10 @@ WC_OMIT_FRAME_POINTER void AES_ECB_encrypt(const unsigned char* in,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
+        "PUSH	{%[nr], %[L_AES_Thumb2_te_ecb]}\n\t"
         "MOV	lr, %[in]\n\t"
         "MOV	r0, %[L_AES_Thumb2_te_ecb]\n\t"
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r12, r4\n\t"
-#else
-        "MOV	r12, %[nr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        "LDR	r12, [sp]\n\t"
         "PUSH	{%[ks]}\n\t"
         "CMP	r12, #10\n\t"
 #if defined(__GNUC__)
@@ -1763,6 +1762,7 @@ WC_OMIT_FRAME_POINTER void AES_ECB_encrypt(const unsigned char* in,
     "L_AES_ECB_encrypt_end_%=:\n\t"
 #endif
         "POP	{%[ks]}\n\t"
+        "POP	{%[nr], %[L_AES_Thumb2_te_ecb]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [in] "+r" (in), [out] "+r" (out), [len] "+r" (len), [ks] "+r" (ks),
           [nr] "+r" (nr), [L_AES_Thumb2_te_ecb] "+r" (L_AES_Thumb2_te_ecb_c)
@@ -1808,16 +1808,10 @@ WC_OMIT_FRAME_POINTER void AES_CBC_encrypt(const unsigned char* in,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r8, r4\n\t"
-#else
-        "MOV	r8, %[nr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r9, r5\n\t"
-#else
-        "MOV	r9, %[iv]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        "PUSH	{%[L_AES_Thumb2_te_ecb]}\n\t"
+        "PUSH	{%[nr], %[iv]}\n\t"
+        "LDR	r8, [sp]\n\t"
+        "LDR	r9, [sp, #4]\n\t"
         "MOV	lr, %[in]\n\t"
         "MOV	r0, %[L_AES_Thumb2_te_ecb]\n\t"
         "LDM	r9, {r4, r5, r6, r7}\n\t"
@@ -2664,6 +2658,8 @@ WC_OMIT_FRAME_POINTER void AES_CBC_encrypt(const unsigned char* in,
 #endif
         "POP	{%[ks], r9}\n\t"
         "STM	r9, {r4, r5, r6, r7}\n\t"
+        "POP	{%[nr], %[iv]}\n\t"
+        "POP	{%[L_AES_Thumb2_te_ecb]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [in] "+r" (in), [out] "+r" (out), [len] "+r" (len), [ks] "+r" (ks),
           [nr] "+r" (nr), [iv] "+r" (iv),
@@ -2711,16 +2707,10 @@ WC_OMIT_FRAME_POINTER void AES_CTR_encrypt(const unsigned char* in,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r12, r4\n\t"
-#else
-        "MOV	r12, %[nr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r8, r5\n\t"
-#else
-        "MOV	r8, %[ctr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        "PUSH	{%[L_AES_Thumb2_te_ctr]}\n\t"
+        "PUSH	{%[nr], %[ctr]}\n\t"
+        "LDR	r12, [sp]\n\t"
+        "LDR	r8, [sp, #4]\n\t"
         "MOV	lr, %[in]\n\t"
         "MOV	r0, %[L_AES_Thumb2_te_ctr]\n\t"
         "LDM	r8, {r4, r5, r6, r7}\n\t"
@@ -3588,6 +3578,8 @@ WC_OMIT_FRAME_POINTER void AES_CTR_encrypt(const unsigned char* in,
         "REV	r6, r6\n\t"
         "REV	r7, r7\n\t"
         "STM	r8, {r4, r5, r6, r7}\n\t"
+        "POP	{%[nr], %[ctr]}\n\t"
+        "POP	{%[L_AES_Thumb2_te_ctr]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [in] "+r" (in), [out] "+r" (out), [len] "+r" (len), [ks] "+r" (ks),
           [nr] "+r" (nr), [ctr] "+r" (ctr),
@@ -3917,11 +3909,9 @@ WC_OMIT_FRAME_POINTER void AES_ECB_decrypt(const unsigned char* in,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r8, r4\n\t"
-#else
-        "MOV	r8, %[nr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        "PUSH	{%[L_AES_Thumb2_td4]}\n\t"
+        "PUSH	{%[nr], %[L_AES_Thumb2_td_ecb]}\n\t"
+        "LDR	r8, [sp]\n\t"
         "MOV	lr, %[in]\n\t"
         "MOV	r0, %[L_AES_Thumb2_td_ecb]\n\t"
         "MOV	r12, %[len]\n\t"
@@ -4751,6 +4741,8 @@ WC_OMIT_FRAME_POINTER void AES_ECB_decrypt(const unsigned char* in,
 #else
     "L_AES_ECB_decrypt_end_%=:\n\t"
 #endif
+        "POP	{%[nr], %[L_AES_Thumb2_td_ecb]}\n\t"
+        "POP	{%[L_AES_Thumb2_td4]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [in] "+r" (in), [out] "+r" (out), [len] "+r" (len), [ks] "+r" (ks),
           [nr] "+r" (nr), [L_AES_Thumb2_td_ecb] "+r" (L_AES_Thumb2_td_ecb_c),
@@ -4800,20 +4792,14 @@ WC_OMIT_FRAME_POINTER void AES_CBC_decrypt(const unsigned char* in,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
+        "PUSH	{%[L_AES_Thumb2_td_ecb], %[L_AES_Thumb2_td4]}\n\t"
+        "PUSH	{%[nr], %[iv]}\n\t"
         "MOV	lr, %[in]\n\t"
         "MOV	r0, %[L_AES_Thumb2_td_ecb]\n\t"
         "MOV	r12, %[len]\n\t"
         "MOV	r2, %[L_AES_Thumb2_td4]\n\t"
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r8, r4\n\t"
-#else
-        "MOV	r8, %[nr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r4, r5\n\t"
-#else
-        "MOV	r4, %[iv]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        "LDR	r8, [sp]\n\t"
+        "LDR	r4, [sp, #4]\n\t"
         "PUSH	{%[ks], r4}\n\t"
         "CMP	r8, #10\n\t"
 #if defined(__GNUC__)
@@ -6469,6 +6455,8 @@ WC_OMIT_FRAME_POINTER void AES_CBC_decrypt(const unsigned char* in,
     "L_AES_CBC_decrypt_end_%=:\n\t"
 #endif
         "POP	{%[ks], r4}\n\t"
+        "POP	{%[nr], %[iv]}\n\t"
+        "POP	{%[L_AES_Thumb2_td_ecb], %[L_AES_Thumb2_td4]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [in] "+r" (in), [out] "+r" (out), [len] "+r" (len), [ks] "+r" (ks),
           [nr] "+r" (nr), [iv] "+r" (iv),
@@ -6522,6 +6510,7 @@ WC_OMIT_FRAME_POINTER void GCM_gmult_len(unsigned char* x,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
+        "PUSH	{%[L_GCM_gmult_len_r]}\n\t"
         "MOV	lr, %[L_GCM_gmult_len_r]\n\t"
         "\n"
 #if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
@@ -7056,6 +7045,7 @@ WC_OMIT_FRAME_POINTER void GCM_gmult_len(unsigned char* x,
 #else
         "BNE.W	L_GCM_gmult_len_start_block_%=\n\t"
 #endif
+        "POP	{%[L_GCM_gmult_len_r]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [x] "+r" (x), [m] "+r" (m), [data] "+r" (data), [len] "+r" (len),
           [L_GCM_gmult_len_r] "+r" (L_GCM_gmult_len_r_c)
@@ -7100,16 +7090,10 @@ WC_OMIT_FRAME_POINTER void AES_GCM_encrypt(const unsigned char* in,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r12, r4\n\t"
-#else
-        "MOV	r12, %[nr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r8, r5\n\t"
-#else
-        "MOV	r8, %[ctr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        "PUSH	{%[L_AES_Thumb2_te_gcm]}\n\t"
+        "PUSH	{%[nr], %[ctr]}\n\t"
+        "LDR	r12, [sp]\n\t"
+        "LDR	r8, [sp, #4]\n\t"
         "MOV	lr, %[in]\n\t"
         "MOV	r0, %[L_AES_Thumb2_te_gcm]\n\t"
         "LDM	r8, {r4, r5, r6, r7}\n\t"
@@ -7968,6 +7952,8 @@ WC_OMIT_FRAME_POINTER void AES_GCM_encrypt(const unsigned char* in,
         "REV	r6, r6\n\t"
         "REV	r7, r7\n\t"
         "STM	r8, {r4, r5, r6, r7}\n\t"
+        "POP	{%[nr], %[ctr]}\n\t"
+        "POP	{%[L_AES_Thumb2_te_gcm]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [in] "+r" (in), [out] "+r" (out), [len] "+r" (len), [ks] "+r" (ks),
           [nr] "+r" (nr), [ctr] "+r" (ctr),
@@ -8018,6 +8004,7 @@ WC_OMIT_FRAME_POINTER void AES_GCMSIV_polyval_thumb2(unsigned char* s,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
+        "PUSH	{%[L_AES_Thumb2_te_gcm], %[L_AES_GCMSIV_polyval_thumb2_r]}\n\t"
         "MOV	r8, %[L_AES_GCMSIV_polyval_thumb2_r]\n\t"
         "CMP	%[blocks], #0\n\t"
 #if defined(__GNUC__)
@@ -8714,6 +8701,7 @@ WC_OMIT_FRAME_POINTER void AES_GCMSIV_polyval_thumb2(unsigned char* s,
 #else
     "L_AES_GCMSIV_polyval_thumb2_done_%=:\n\t"
 #endif
+        "POP	{%[L_AES_Thumb2_te_gcm], %[L_AES_GCMSIV_polyval_thumb2_r]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [s] "+r" (s), [m] "+r" (m), [data] "+r" (data),
           [blocks] "+r" (blocks),
@@ -8825,16 +8813,10 @@ WC_OMIT_FRAME_POINTER void AES_GCMSIV_ctr_thumb2(const unsigned char* in,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r12, r4\n\t"
-#else
-        "MOV	r12, %[nr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
-#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
-        "MOV	r8, r5\n\t"
-#else
-        "MOV	r8, %[ctr]\n\t"
-#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        "PUSH	{%[L_AES_GCMSIV_ctr_thumb2_te]}\n\t"
+        "PUSH	{%[nr], %[ctr]}\n\t"
+        "LDR	r12, [sp]\n\t"
+        "LDR	r8, [sp, #4]\n\t"
         "MOV	lr, %[in]\n\t"
         "MOV	r0, %[L_AES_GCMSIV_ctr_thumb2_te]\n\t"
         "LDM	r8, {r4, r5, r6, r7}\n\t"
@@ -9708,6 +9690,8 @@ WC_OMIT_FRAME_POINTER void AES_GCMSIV_ctr_thumb2(const unsigned char* in,
         "REV	r6, r6\n\t"
         "REV	r7, r7\n\t"
         "STM	r8, {r4, r5, r6, r7}\n\t"
+        "POP	{%[nr], %[ctr]}\n\t"
+        "POP	{%[L_AES_GCMSIV_ctr_thumb2_te]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [in] "+r" (in), [out] "+r" (out), [length] "+r" (length),
           [KS] "+r" (KS), [nr] "+r" (nr), [ctr] "+r" (ctr),
@@ -9725,7 +9709,7 @@ WC_OMIT_FRAME_POINTER void AES_GCMSIV_ctr_thumb2(const unsigned char* in,
 
 #endif /* WOLFSSL_AESGCM_SIV */
 #endif /* !NO_AES */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-chacha-asm.S b/wolfcrypt/src/port/arm/thumb2-chacha-asm.S
index 22e5a640e5b..982f9e54be2 100644
--- a/wolfcrypt/src/port/arm/thumb2-chacha-asm.S
+++ b/wolfcrypt/src/port/arm/thumb2-chacha-asm.S
@@ -567,10 +567,10 @@ L_chacha_thumb2_over_done:
 	/* Cycle Count = 108 */
 	.size	wc_chacha_use_over,.-wc_chacha_use_over
 #endif /* HAVE_CHACHA */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-chacha-asm_c.c b/wolfcrypt/src/port/arm/thumb2-chacha-asm_c.c
index 36b0184fbb1..b8ccc51a549 100644
--- a/wolfcrypt/src/port/arm/thumb2-chacha-asm_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-chacha-asm_c.c
@@ -760,7 +760,7 @@ WC_OMIT_FRAME_POINTER void wc_chacha_use_over(byte* over, byte* output,
 }
 
 #endif /* HAVE_CHACHA */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-curve25519.S b/wolfcrypt/src/port/arm/thumb2-curve25519.S
index 621a20e5f1c..b4f3ace2c26 100644
--- a/wolfcrypt/src/port/arm/thumb2-curve25519.S
+++ b/wolfcrypt/src/port/arm/thumb2-curve25519.S
@@ -7519,10 +7519,10 @@ sc_muladd:
 
 #endif /* !CURVE25519_SMALL || !ED25519_SMALL */
 #endif /* HAVE_CURVE25519 || HAVE_ED25519 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-curve25519_c.c b/wolfcrypt/src/port/arm/thumb2-curve25519_c.c
index 1bb0b7adce1..938cf1ab00b 100644
--- a/wolfcrypt/src/port/arm/thumb2-curve25519_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-curve25519_c.c
@@ -8450,7 +8450,7 @@ WC_OMIT_FRAME_POINTER void sc_muladd(byte* s, const byte* a, const byte* b,
 
 #endif /* !CURVE25519_SMALL || !ED25519_SMALL */
 #endif /* HAVE_CURVE25519 || HAVE_ED25519 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-frodokem-asm.S b/wolfcrypt/src/port/arm/thumb2-frodokem-asm.S
new file mode 100644
index 00000000000..dba4d3927c6
--- /dev/null
+++ b/wolfcrypt/src/port/arm/thumb2-frodokem-asm.S
@@ -0,0 +1,264 @@
+/* thumb2-frodokem-asm
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Generated using (from wolfssl):
+ *   cd ../scripts
+ *   ruby ./frodokem/frodokem.rb \
+ *       thumb2 ../wolfssl/wolfcrypt/src/port/arm/thumb2-frodokem-asm.S
+ */
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources_asm.h>
+
+#ifdef WOLFSSL_ARMASM
+#ifdef WOLFSSL_ARMASM_THUMB2
+#ifndef WOLFSSL_ARMASM_INLINE
+	.thumb
+	.syntax unified
+#ifdef WOLFSSL_HAVE_FRODOKEM
+	.text
+	.align	4
+	.globl	frodokem_add_thumb2
+	.type	frodokem_add_thumb2, %function
+frodokem_add_thumb2:
+	PUSH	{r4, r5, lr}
+	ORR	r2, r2, r2, LSL #16
+	MOV	r3, #32
+L_frodokem_add_thumb2_blk:
+	LDR	r4, [r0]
+	LDR	r5, [r1], #4
+	SADD16	r4, r4, r5
+	AND	r4, r4, r2
+	STR	r4, [r0], #4
+	SUBS	r3, r3, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_add_thumb2_blk
+#else
+	BNE.N	L_frodokem_add_thumb2_blk
+#endif
+	POP	{r4, r5, pc}
+	/* Cycle Count = 23 */
+	.size	frodokem_add_thumb2,.-frodokem_add_thumb2
+	.text
+	.align	4
+	.globl	frodokem_sa_accum_thumb2
+	.type	frodokem_sa_accum_thumb2, %function
+frodokem_sa_accum_thumb2:
+	PUSH	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	LDR	r4, [sp, #36]
+	LSL	r4, r4, #1
+	ADD	r5, r1, r3, LSL #1
+	MOV	r8, #8
+L_frodokem_sa_accum_thumb2_i:
+	LDRH	r9, [r5]
+	ADD	r5, r5, r4
+	MOV	r6, r2
+	LSR	r7, r4, #2
+L_frodokem_sa_accum_thumb2_k:
+	LDR	r11, [r0]
+	LDR	r10, [r6], #4
+	SMULBB	r12, r9, r10
+	SMULBT	lr, r9, r10
+	PKHBT	r12, r12, lr, LSL #16
+	SADD16	r11, r11, r12
+	STR	r11, [r0], #4
+	SUBS	r7, r7, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_sa_accum_thumb2_k
+#else
+	BNE.N	L_frodokem_sa_accum_thumb2_k
+#endif
+	SUBS	r8, r8, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_sa_accum_thumb2_i
+#else
+	BNE.N	L_frodokem_sa_accum_thumb2_i
+#endif
+	POP	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	/* Cycle Count = 50 */
+	.size	frodokem_sa_accum_thumb2,.-frodokem_sa_accum_thumb2
+	.text
+	.align	4
+	.globl	frodokem_as_accum_thumb2
+	.type	frodokem_as_accum_thumb2, %function
+frodokem_as_accum_thumb2:
+	PUSH	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	LDR	r4, [sp, #36]
+	LSL	r4, r4, #1
+	ADD	r5, r0, r3, LSL #4
+	MOV	r6, r1
+	MOV	r9, #8
+L_frodokem_as_accum_thumb2_c:
+	MOV	r11, #0
+	MOV	r7, r2
+	MOV	r8, r6
+	LSR	r10, r4, #2
+L_frodokem_as_accum_thumb2_j:
+	LDR	r12, [r7], #4
+	LDR	lr, [r8], #4
+	SMLAD	r11, r12, lr, r11
+	SUBS	r10, r10, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_as_accum_thumb2_j
+#else
+	BNE.N	L_frodokem_as_accum_thumb2_j
+#endif
+	LDRH	r12, [r5]
+	ADD	r12, r12, r11
+	STRH	r12, [r5]
+	ADD	r5, r5, #2
+	ADD	r6, r6, r4
+	SUBS	r9, r9, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_as_accum_thumb2_c
+#else
+	BNE.N	L_frodokem_as_accum_thumb2_c
+#endif
+	POP	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	/* Cycle Count = 52 */
+	.size	frodokem_as_accum_thumb2,.-frodokem_as_accum_thumb2
+	.text
+	.align	4
+	.globl	frodokem_mul_bs_thumb2
+	.type	frodokem_mul_bs_thumb2, %function
+frodokem_mul_bs_thumb2:
+	PUSH	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	MOV	r4, r1
+	MOV	r8, #8
+L_frodokem_mul_bs_thumb2_i:
+	MOV	r5, r2
+	MOV	r9, #8
+L_frodokem_mul_bs_thumb2_c:
+	MOV	r11, #0
+	MOV	r6, r4
+	MOV	r7, r5
+	LSR	r10, r3, #1
+L_frodokem_mul_bs_thumb2_j:
+	LDR	r12, [r6], #4
+	LDR	lr, [r7], #4
+	SMLAD	r11, r12, lr, r11
+	SUBS	r10, r10, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_mul_bs_thumb2_j
+#else
+	BNE.N	L_frodokem_mul_bs_thumb2_j
+#endif
+	LDR	r12, [sp, #36]
+	ORR	r12, r12, r12, LSL #16
+	AND	r11, r11, r12
+	STRH	r11, [r0]
+	ADD	r0, r0, #2
+	ADD	r5, r5, r3, LSL #1
+	SUBS	r9, r9, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_mul_bs_thumb2_c
+#else
+	BNE.N	L_frodokem_mul_bs_thumb2_c
+#endif
+	ADD	r4, r4, r3, LSL #1
+	SUBS	r8, r8, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_mul_bs_thumb2_i
+#else
+	BNE.N	L_frodokem_mul_bs_thumb2_i
+#endif
+	POP	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	/* Cycle Count = 57 */
+	.size	frodokem_mul_bs_thumb2,.-frodokem_mul_bs_thumb2
+	.text
+	.align	4
+	.globl	frodokem_mul_add_sb_plus_e_thumb2
+	.type	frodokem_mul_add_sb_plus_e_thumb2, %function
+frodokem_mul_add_sb_plus_e_thumb2:
+	PUSH	{r4, r5, r6, r7, r8, r9, r10, r11, lr}
+	SUB	sp, sp, #8
+	LSL	r11, r3, #1
+	STR	r11, [sp, #4]
+	STR	r1, [sp]
+	MOV	r4, #8
+L_frodokem_mul_add_sb_plus_e_thumb2_i:
+	LDR	r11, [sp, #4]
+	ADD	r3, r2, r11
+	LDR	r1, [sp]
+	MOV	r5, r2
+	LDR	r6, [r0]
+	LDR	r7, [r0, #4]
+	LDR	r8, [r0, #8]
+	LDR	r9, [r0, #12]
+L_frodokem_mul_add_sb_plus_e_thumb2_j:
+	LDRH	r10, [r5]
+	ADD	r5, r5, #2
+	LDR	r11, [r1]
+	SMULBB	r12, r10, r11
+	SMULBT	lr, r10, r11
+	PKHBT	r12, r12, lr, LSL #16
+	SADD16	r6, r6, r12
+	LDR	r11, [r1, #4]
+	SMULBB	r12, r10, r11
+	SMULBT	lr, r10, r11
+	PKHBT	r12, r12, lr, LSL #16
+	SADD16	r7, r7, r12
+	LDR	r11, [r1, #8]
+	SMULBB	r12, r10, r11
+	SMULBT	lr, r10, r11
+	PKHBT	r12, r12, lr, LSL #16
+	SADD16	r8, r8, r12
+	LDR	r11, [r1, #12]
+	SMULBB	r12, r10, r11
+	SMULBT	lr, r10, r11
+	PKHBT	r12, r12, lr, LSL #16
+	SADD16	r9, r9, r12
+	ADD	r1, r1, #16
+	CMP	r5, r3
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_mul_add_sb_plus_e_thumb2_j
+#else
+	BNE.N	L_frodokem_mul_add_sb_plus_e_thumb2_j
+#endif
+	LDR	r11, [sp, #44]
+	ORR	r11, r11, r11, LSL #16
+	AND	r6, r6, r11
+	AND	r7, r7, r11
+	AND	r8, r8, r11
+	AND	r9, r9, r11
+	STR	r6, [r0]
+	STR	r7, [r0, #4]
+	STR	r8, [r0, #8]
+	STR	r9, [r0, #12]
+	ADD	r0, r0, #16
+	MOV	r2, r3
+	SUBS	r4, r4, #1
+#if defined(__GNUC__) || defined(__ICCARM__) || defined(__IAR_SYSTEMS_ICC__)
+	BNE	L_frodokem_mul_add_sb_plus_e_thumb2_i
+#else
+	BNE.N	L_frodokem_mul_add_sb_plus_e_thumb2_i
+#endif
+	ADD	sp, sp, #8
+	POP	{r4, r5, r6, r7, r8, r9, r10, r11, pc}
+	/* Cycle Count = 97 */
+	.size	frodokem_mul_add_sb_plus_e_thumb2,.-frodokem_mul_add_sb_plus_e_thumb2
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+#if defined(__linux__) && defined(__ELF__)
+.section	.note.GNU-stack,"",%progbits
+#endif
+#endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-frodokem-asm_c.c b/wolfcrypt/src/port/arm/thumb2-frodokem-asm_c.c
new file mode 100644
index 00000000000..a98b576fcd7
--- /dev/null
+++ b/wolfcrypt/src/port/arm/thumb2-frodokem-asm_c.c
@@ -0,0 +1,461 @@
+/* thumb2-frodokem-asm
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Generated using (from wolfssl):
+ *   cd ../scripts
+ *   ruby ./frodokem/frodokem.rb \
+ *       thumb2 ../wolfssl/wolfcrypt/src/port/arm/thumb2-frodokem-asm.c
+ */
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources_asm.h>
+#include <wolfssl/wolfcrypt/error-crypt.h>
+
+#ifdef WOLFSSL_ARMASM
+#ifdef WOLFSSL_ARMASM_THUMB2
+#ifdef WOLFSSL_ARMASM_INLINE
+
+#ifdef __IAR_SYSTEMS_ICC__
+#define __asm__        asm
+#define __volatile__   volatile
+#define WOLFSSL_NO_VAR_ASSIGN_REG
+#endif /* __IAR_SYSTEMS_ICC__ */
+#ifdef __KEIL__
+#define __asm__        __asm
+#define __volatile__   volatile
+#endif /* __KEIL__ */
+#ifdef __ghs__
+#define __asm__        __asm
+#define __volatile__
+#define WOLFSSL_NO_VAR_ASSIGN_REG
+#endif /* __ghs__ */
+
+#include <wolfssl/wolfcrypt/wc_frodokem_mat.h>
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_add_thumb2(word16* a_p, const word16* b_p,
+    int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_add_thumb2(word16* a, const word16* b,
+    int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* a __asm__ ("r0") = (word16*)a_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register int qmask __asm__ ("r2") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "ORR	%[qmask], %[qmask], %[qmask], LSL #16\n\t"
+        "MOV	r3, #32\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_add_thumb2_blk:\n\t"
+#else
+    "L_frodokem_add_thumb2_blk_%=:\n\t"
+#endif
+        "LDR	r4, [%[a]]\n\t"
+        "LDR	r5, [%[b]], #4\n\t"
+        "SADD16	r4, r4, r5\n\t"
+        "AND	r4, r4, %[qmask]\n\t"
+        "STR	r4, [%[a]], #4\n\t"
+        "SUBS	r3, r3, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_add_thumb2_blk_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_add_thumb2_blk\n\t"
+#else
+        "BNE.N	L_frodokem_add_thumb2_blk_%=\n\t"
+#endif
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [a] "+r" (a), [b] "+r" (b), [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [a] "r" (a), [b] "r" (b), [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r3", "r4", "r5"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_sa_accum_thumb2(word16* out_p,
+    const word16* s_p, const word16* row_p, int j_p, int n_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_sa_accum_thumb2(word16* out,
+    const word16* s, const word16* row, int j, int n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* s __asm__ ("r1") = (const word16*)s_p;
+    register const word16* row __asm__ ("r2") = (const word16*)row_p;
+    register int j __asm__ ("r3") = (int)j_p;
+    register int n __asm__ ("r4") = (int)n_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "PUSH	{%[n]}\n\t"
+        "LDR	r4, [sp]\n\t"
+        "LSL	r4, r4, #1\n\t"
+        "ADD	r5, %[s], %[j], LSL #1\n\t"
+        "MOV	r8, #8\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_sa_accum_thumb2_i:\n\t"
+#else
+    "L_frodokem_sa_accum_thumb2_i_%=:\n\t"
+#endif
+        "LDRH	r9, [r5]\n\t"
+        "ADD	r5, r5, r4\n\t"
+        "MOV	r6, %[row]\n\t"
+        "LSR	r7, r4, #2\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_sa_accum_thumb2_k:\n\t"
+#else
+    "L_frodokem_sa_accum_thumb2_k_%=:\n\t"
+#endif
+        "LDR	r11, [%[out]]\n\t"
+        "LDR	r10, [r6], #4\n\t"
+        "SMULBB	r12, r9, r10\n\t"
+        "SMULBT	lr, r9, r10\n\t"
+        "PKHBT	r12, r12, lr, LSL #16\n\t"
+        "SADD16	r11, r11, r12\n\t"
+        "STR	r11, [%[out]], #4\n\t"
+        "SUBS	r7, r7, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_sa_accum_thumb2_k_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_sa_accum_thumb2_k\n\t"
+#else
+        "BNE.N	L_frodokem_sa_accum_thumb2_k_%=\n\t"
+#endif
+        "SUBS	r8, r8, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_sa_accum_thumb2_i_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_sa_accum_thumb2_i\n\t"
+#else
+        "BNE.N	L_frodokem_sa_accum_thumb2_i_%=\n\t"
+#endif
+        "POP	{%[n]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [s] "+r" (s), [row] "+r" (row), [j] "+r" (j),
+          [n] "+r" (n)
+        :
+#else
+        :
+        : [out] "r" (out), [s] "r" (s), [row] "r" (row), [j] "r" (j),
+          [n] "r" (n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12",
+            "lr"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_as_accum_thumb2(word16* out_p,
+    const word16* s_p, const word16* row_p, int i_p, int n_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_as_accum_thumb2(word16* out,
+    const word16* s, const word16* row, int i, int n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* s __asm__ ("r1") = (const word16*)s_p;
+    register const word16* row __asm__ ("r2") = (const word16*)row_p;
+    register int i __asm__ ("r3") = (int)i_p;
+    register int n __asm__ ("r4") = (int)n_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "PUSH	{%[n]}\n\t"
+        "LDR	r4, [sp]\n\t"
+        "LSL	r4, r4, #1\n\t"
+        "ADD	r5, %[out], %[i], LSL #4\n\t"
+        "MOV	r6, %[s]\n\t"
+        "MOV	r9, #8\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_as_accum_thumb2_c:\n\t"
+#else
+    "L_frodokem_as_accum_thumb2_c_%=:\n\t"
+#endif
+        "MOV	r11, #0\n\t"
+        "MOV	r7, %[row]\n\t"
+        "MOV	r8, r6\n\t"
+        "LSR	r10, r4, #2\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_as_accum_thumb2_j:\n\t"
+#else
+    "L_frodokem_as_accum_thumb2_j_%=:\n\t"
+#endif
+        "LDR	r12, [r7], #4\n\t"
+        "LDR	lr, [r8], #4\n\t"
+        "SMLAD	r11, r12, lr, r11\n\t"
+        "SUBS	r10, r10, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_as_accum_thumb2_j_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_as_accum_thumb2_j\n\t"
+#else
+        "BNE.N	L_frodokem_as_accum_thumb2_j_%=\n\t"
+#endif
+        "LDRH	r12, [r5]\n\t"
+        "ADD	r12, r12, r11\n\t"
+        "STRH	r12, [r5]\n\t"
+        "ADD	r5, r5, #2\n\t"
+        "ADD	r6, r6, r4\n\t"
+        "SUBS	r9, r9, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_as_accum_thumb2_c_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_as_accum_thumb2_c\n\t"
+#else
+        "BNE.N	L_frodokem_as_accum_thumb2_c_%=\n\t"
+#endif
+        "POP	{%[n]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [s] "+r" (s), [row] "+r" (row), [i] "+r" (i),
+          [n] "+r" (n)
+        :
+#else
+        :
+        : [out] "r" (out), [s] "r" (s), [row] "r" (row), [i] "r" (i),
+          [n] "r" (n)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12",
+            "lr"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_mul_bs_thumb2(word16* out_p,
+    const word16* b_p, const word16* s_p, int n_p, int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_mul_bs_thumb2(word16* out, const word16* b,
+    const word16* s, int n, int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register const word16* s __asm__ ("r2") = (const word16*)s_p;
+    register int n __asm__ ("r3") = (int)n_p;
+    register int qmask __asm__ ("r4") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "PUSH	{%[qmask]}\n\t"
+        "MOV	r4, %[b]\n\t"
+        "MOV	r8, #8\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_mul_bs_thumb2_i:\n\t"
+#else
+    "L_frodokem_mul_bs_thumb2_i_%=:\n\t"
+#endif
+        "MOV	r5, %[s]\n\t"
+        "MOV	r9, #8\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_mul_bs_thumb2_c:\n\t"
+#else
+    "L_frodokem_mul_bs_thumb2_c_%=:\n\t"
+#endif
+        "MOV	r11, #0\n\t"
+        "MOV	r6, r4\n\t"
+        "MOV	r7, r5\n\t"
+        "LSR	r10, %[n], #1\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_mul_bs_thumb2_j:\n\t"
+#else
+    "L_frodokem_mul_bs_thumb2_j_%=:\n\t"
+#endif
+        "LDR	r12, [r6], #4\n\t"
+        "LDR	lr, [r7], #4\n\t"
+        "SMLAD	r11, r12, lr, r11\n\t"
+        "SUBS	r10, r10, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_mul_bs_thumb2_j_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_mul_bs_thumb2_j\n\t"
+#else
+        "BNE.N	L_frodokem_mul_bs_thumb2_j_%=\n\t"
+#endif
+        "LDR	r12, [sp]\n\t"
+        "ORR	r12, r12, r12, LSL #16\n\t"
+        "AND	r11, r11, r12\n\t"
+        "STRH	r11, [%[out]]\n\t"
+        "ADD	%[out], %[out], #2\n\t"
+        "ADD	r5, r5, %[n], LSL #1\n\t"
+        "SUBS	r9, r9, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_mul_bs_thumb2_c_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_mul_bs_thumb2_c\n\t"
+#else
+        "BNE.N	L_frodokem_mul_bs_thumb2_c_%=\n\t"
+#endif
+        "ADD	r4, r4, %[n], LSL #1\n\t"
+        "SUBS	r8, r8, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_mul_bs_thumb2_i_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_mul_bs_thumb2_i\n\t"
+#else
+        "BNE.N	L_frodokem_mul_bs_thumb2_i_%=\n\t"
+#endif
+        "POP	{%[qmask]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [b] "+r" (b), [s] "+r" (s), [n] "+r" (n),
+          [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [out] "r" (out), [b] "r" (b), [s] "r" (s), [n] "r" (n),
+          [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12",
+            "lr"
+    );
+}
+
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+WC_OMIT_FRAME_POINTER void frodokem_mul_add_sb_plus_e_thumb2(word16* out_p,
+    const word16* b_p, const word16* s_p, int n_p, int qmask_p)
+#else
+WC_OMIT_FRAME_POINTER void frodokem_mul_add_sb_plus_e_thumb2(word16* out,
+    const word16* b, const word16* s, int n, int qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+{
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+    register word16* out __asm__ ("r0") = (word16*)out_p;
+    register const word16* b __asm__ ("r1") = (const word16*)b_p;
+    register const word16* s __asm__ ("r2") = (const word16*)s_p;
+    register int n __asm__ ("r3") = (int)n_p;
+    register int qmask __asm__ ("r4") = (int)qmask_p;
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+
+    __asm__ __volatile__ (
+        "PUSH	{%[qmask]}\n\t"
+        "SUB	sp, sp, #8\n\t"
+        "LSL	r11, %[n], #1\n\t"
+        "STR	r11, [sp, #4]\n\t"
+        "STR	%[b], [sp]\n\t"
+        "MOV	r4, #8\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_mul_add_sb_plus_e_thumb2_i:\n\t"
+#else
+    "L_frodokem_mul_add_sb_plus_e_thumb2_i_%=:\n\t"
+#endif
+        "LDR	r11, [sp, #4]\n\t"
+        "ADD	%[n], %[s], r11\n\t"
+        "LDR	%[b], [sp]\n\t"
+        "MOV	r5, %[s]\n\t"
+        "LDR	r6, [%[out]]\n\t"
+        "LDR	r7, [%[out], #4]\n\t"
+        "LDR	r8, [%[out], #8]\n\t"
+        "LDR	r9, [%[out], #12]\n\t"
+        "\n"
+#if defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+    "L_frodokem_mul_add_sb_plus_e_thumb2_j:\n\t"
+#else
+    "L_frodokem_mul_add_sb_plus_e_thumb2_j_%=:\n\t"
+#endif
+        "LDRH	r10, [r5]\n\t"
+        "ADD	r5, r5, #2\n\t"
+        "LDR	r11, [%[b]]\n\t"
+        "SMULBB	r12, r10, r11\n\t"
+        "SMULBT	lr, r10, r11\n\t"
+        "PKHBT	r12, r12, lr, LSL #16\n\t"
+        "SADD16	r6, r6, r12\n\t"
+        "LDR	r11, [%[b], #4]\n\t"
+        "SMULBB	r12, r10, r11\n\t"
+        "SMULBT	lr, r10, r11\n\t"
+        "PKHBT	r12, r12, lr, LSL #16\n\t"
+        "SADD16	r7, r7, r12\n\t"
+        "LDR	r11, [%[b], #8]\n\t"
+        "SMULBB	r12, r10, r11\n\t"
+        "SMULBT	lr, r10, r11\n\t"
+        "PKHBT	r12, r12, lr, LSL #16\n\t"
+        "SADD16	r8, r8, r12\n\t"
+        "LDR	r11, [%[b], #12]\n\t"
+        "SMULBB	r12, r10, r11\n\t"
+        "SMULBT	lr, r10, r11\n\t"
+        "PKHBT	r12, r12, lr, LSL #16\n\t"
+        "SADD16	r9, r9, r12\n\t"
+        "ADD	%[b], %[b], #16\n\t"
+        "CMP	r5, %[n]\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_mul_add_sb_plus_e_thumb2_j_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_mul_add_sb_plus_e_thumb2_j\n\t"
+#else
+        "BNE.N	L_frodokem_mul_add_sb_plus_e_thumb2_j_%=\n\t"
+#endif
+        "LDR	r11, [sp, #8]\n\t"
+        "ORR	r11, r11, r11, LSL #16\n\t"
+        "AND	r6, r6, r11\n\t"
+        "AND	r7, r7, r11\n\t"
+        "AND	r8, r8, r11\n\t"
+        "AND	r9, r9, r11\n\t"
+        "STR	r6, [%[out]]\n\t"
+        "STR	r7, [%[out], #4]\n\t"
+        "STR	r8, [%[out], #8]\n\t"
+        "STR	r9, [%[out], #12]\n\t"
+        "ADD	%[out], %[out], #16\n\t"
+        "MOV	%[s], %[n]\n\t"
+        "SUBS	r4, r4, #1\n\t"
+#if defined(__GNUC__)
+        "BNE	L_frodokem_mul_add_sb_plus_e_thumb2_i_%=\n\t"
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ < 9000000)
+        "BNE.N	L_frodokem_mul_add_sb_plus_e_thumb2_i\n\t"
+#else
+        "BNE.N	L_frodokem_mul_add_sb_plus_e_thumb2_i_%=\n\t"
+#endif
+        "ADD	sp, sp, #8\n\t"
+        "POP	{%[qmask]}\n\t"
+#ifndef WOLFSSL_NO_VAR_ASSIGN_REG
+        : [out] "+r" (out), [b] "+r" (b), [s] "+r" (s), [n] "+r" (n),
+          [qmask] "+r" (qmask)
+        :
+#else
+        :
+        : [out] "r" (out), [b] "r" (b), [s] "r" (s), [n] "r" (n),
+          [qmask] "r" (qmask)
+#endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
+        : "memory", "cc", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12",
+            "lr"
+    );
+}
+
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+#endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-mlkem-asm.S b/wolfcrypt/src/port/arm/thumb2-mlkem-asm.S
index 936cd6e3195..bb762423547 100644
--- a/wolfcrypt/src/port/arm/thumb2-mlkem-asm.S
+++ b/wolfcrypt/src/port/arm/thumb2-mlkem-asm.S
@@ -3583,10 +3583,10 @@ L_mlkem_thumb2_rej_uniform_done:
 	/* Cycle Count = 225 */
 	.size	mlkem_thumb2_rej_uniform,.-mlkem_thumb2_rej_uniform
 #endif /* WOLFSSL_HAVE_MLKEM */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-mlkem-asm_c.c b/wolfcrypt/src/port/arm/thumb2-mlkem-asm_c.c
index 15a09893a69..065b4c18b3c 100644
--- a/wolfcrypt/src/port/arm/thumb2-mlkem-asm_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-mlkem-asm_c.c
@@ -3550,6 +3550,7 @@ WC_OMIT_FRAME_POINTER unsigned int mlkem_thumb2_rej_uniform(sword16* p,
 #endif /* !WOLFSSL_NO_VAR_ASSIGN_REG */
 
     __asm__ __volatile__ (
+        "PUSH	{%[L_mlkem_basemul_mont_zetas]}\n\t"
         "MOV	r8, #0xd01\n\t"
         "MOV	r9, #0\n\t"
         "\n"
@@ -3870,6 +3871,7 @@ WC_OMIT_FRAME_POINTER unsigned int mlkem_thumb2_rej_uniform(sword16* p,
     "L_mlkem_thumb2_rej_uniform_done_%=:\n\t"
 #endif
         "LSR	r0, r9, #1\n\t"
+        "POP	{%[L_mlkem_basemul_mont_zetas]}\n\t"
 #ifndef WOLFSSL_NO_VAR_ASSIGN_REG
         : [p] "+r" (p), [len] "+r" (len), [r] "+r" (r), [rLen] "+r" (rLen),
           [L_mlkem_basemul_mont_zetas] "+r" (L_mlkem_basemul_mont_zetas_c)
@@ -3885,7 +3887,7 @@ WC_OMIT_FRAME_POINTER unsigned int mlkem_thumb2_rej_uniform(sword16* p,
 }
 
 #endif /* WOLFSSL_HAVE_MLKEM */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-poly1305-asm.S b/wolfcrypt/src/port/arm/thumb2-poly1305-asm.S
index 26880f21add..bc90492a499 100644
--- a/wolfcrypt/src/port/arm/thumb2-poly1305-asm.S
+++ b/wolfcrypt/src/port/arm/thumb2-poly1305-asm.S
@@ -364,10 +364,10 @@ poly1305_final:
 	/* Cycle Count = 82 */
 	.size	poly1305_final,.-poly1305_final
 #endif /* HAVE_POLY1305 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-poly1305-asm_c.c b/wolfcrypt/src/port/arm/thumb2-poly1305-asm_c.c
index b1f28f96548..12785d19b59 100644
--- a/wolfcrypt/src/port/arm/thumb2-poly1305-asm_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-poly1305-asm_c.c
@@ -441,7 +441,7 @@ WC_OMIT_FRAME_POINTER void poly1305_final(Poly1305* ctx, byte* mac)
 }
 
 #endif /* HAVE_POLY1305 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-sha256-asm.S b/wolfcrypt/src/port/arm/thumb2-sha256-asm.S
index 3b46daf07b1..43d0d3dcd90 100644
--- a/wolfcrypt/src/port/arm/thumb2-sha256-asm.S
+++ b/wolfcrypt/src/port/arm/thumb2-sha256-asm.S
@@ -2322,10 +2322,10 @@ L_SHA256_transform_len_blk_end_15:
 	.size	Transform_Sha256_Len_base,.-Transform_Sha256_Len_base
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* !NO_SHA256 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-sha256-asm_c.c b/wolfcrypt/src/port/arm/thumb2-sha256-asm_c.c
index f3d5f338d7f..7df45dc3571 100644
--- a/wolfcrypt/src/port/arm/thumb2-sha256-asm_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-sha256-asm_c.c
@@ -2488,7 +2488,7 @@ WC_OMIT_FRAME_POINTER void Transform_Sha256_Len_base(wc_Sha256* sha256,
 
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* !NO_SHA256 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-sha3-asm.S b/wolfcrypt/src/port/arm/thumb2-sha3-asm.S
index 27c111674bb..6457653c23b 100644
--- a/wolfcrypt/src/port/arm/thumb2-sha3-asm.S
+++ b/wolfcrypt/src/port/arm/thumb2-sha3-asm.S
@@ -1138,10 +1138,10 @@ L_sha3_thumb2_begin:
 	/* Cycle Count = 1505 */
 	.size	BlockSha3,.-BlockSha3
 #endif /* WOLFSSL_SHA3 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-sha3-asm_c.c b/wolfcrypt/src/port/arm/thumb2-sha3-asm_c.c
index 52c25988d5d..81d40f821f2 100644
--- a/wolfcrypt/src/port/arm/thumb2-sha3-asm_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-sha3-asm_c.c
@@ -1169,7 +1169,7 @@ WC_OMIT_FRAME_POINTER void BlockSha3(word64* state)
 }
 
 #endif /* WOLFSSL_SHA3 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-sha512-asm.S b/wolfcrypt/src/port/arm/thumb2-sha512-asm.S
index 3f8e1de9d9c..8a0a9d165b6 100644
--- a/wolfcrypt/src/port/arm/thumb2-sha512-asm.S
+++ b/wolfcrypt/src/port/arm/thumb2-sha512-asm.S
@@ -3555,10 +3555,10 @@ L_SHA512_transform_len_start:
 	.size	Transform_Sha512_Len_base,.-Transform_Sha512_Len_base
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* WOLFSSL_SHA512 || WOLFSSL_SHA384 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #if defined(__linux__) && defined(__ELF__)
 .section	.note.GNU-stack,"",%progbits
 #endif
 #endif /* !WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/port/arm/thumb2-sha512-asm_c.c b/wolfcrypt/src/port/arm/thumb2-sha512-asm_c.c
index 120ba454df9..04ce8e318bc 100644
--- a/wolfcrypt/src/port/arm/thumb2-sha512-asm_c.c
+++ b/wolfcrypt/src/port/arm/thumb2-sha512-asm_c.c
@@ -3602,7 +3602,7 @@ WC_OMIT_FRAME_POINTER void Transform_Sha512_Len_base(wc_Sha512* sha512,
 
 #endif /* WOLFSSL_ARMASM_NO_NEON */
 #endif /* WOLFSSL_SHA512 || WOLFSSL_SHA384 */
-#endif /* WOLFSSL_ARMASM_THUMB2 */
-#endif /* WOLFSSL_ARMASM */
 
 #endif /* WOLFSSL_ARMASM_INLINE */
+#endif /* WOLFSSL_ARMASM_THUMB2 */
+#endif /* WOLFSSL_ARMASM */
diff --git a/wolfcrypt/src/sha3_asm.S b/wolfcrypt/src/sha3_asm.S
index 810a1c67433..ce57189e8e9 100644
--- a/wolfcrypt/src/sha3_asm.S
+++ b/wolfcrypt/src/sha3_asm.S
@@ -9938,7 +9938,7 @@ L_sha3_block_n_avx2_rounds:
 #ifndef __APPLE__
 .size	sha3_block_n_avx2,.-sha3_block_n_avx2
 #endif /* __APPLE__ */
-#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA)
+#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA) || defined(WOLFSSL_HAVE_FRODOKEM)
 #ifndef __APPLE__
 .text
 .globl	sha3_blocksx4_avx2
@@ -15297,6 +15297,8 @@ _sha3_blocksx4_avx2:
 #ifndef __APPLE__
 .size	sha3_blocksx4_avx2,.-sha3_blocksx4_avx2
 #endif /* __APPLE__ */
+#endif /* defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA) || defined(WOLFSSL_HAVE_FRODOKEM) */
+#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA)
 #ifndef __APPLE__
 .data
 #else
@@ -20675,72 +20677,65 @@ _sha3_128_blocksx4_seed_avx2:
 .size	sha3_128_blocksx4_seed_avx2,.-sha3_128_blocksx4_seed_avx2
 #endif /* __APPLE__ */
 #endif /* defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA) */
-#ifdef WOLFSSL_HAVE_MLKEM
-#ifndef __APPLE__
-.data
-#else
-.section	__DATA,__data
-#endif /* __APPLE__ */
-#ifndef __APPLE__
-.align	32
-#else
-.p2align	5
-#endif /* __APPLE__ */
-L_sha3_256_blockx4_seed_avx2_end_mark:
-.quad	0x8000000000000000,0x8000000000000000
-.quad	0x8000000000000000,0x8000000000000000
+#ifdef WOLFSSL_HAVE_FRODOKEM
 #ifndef __APPLE__
 .text
-.globl	sha3_256_blocksx4_seed_avx2
-.type	sha3_256_blocksx4_seed_avx2,@function
+.globl	sha3_blocksx4_out_avx2
+.type	sha3_blocksx4_out_avx2,@function
 .align	16
-sha3_256_blocksx4_seed_avx2:
+sha3_blocksx4_out_avx2:
 #else
 .section	__TEXT,__text
-.globl	_sha3_256_blocksx4_seed_avx2
+.globl	_sha3_blocksx4_out_avx2
 .p2align	4
-_sha3_256_blocksx4_seed_avx2:
+_sha3_blocksx4_out_avx2:
 #endif /* __APPLE__ */
-        leaq	L_sha3_x4_avx2_r(%rip), %rdx
-        movq	%rdi, %rax
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        leaq	L_sha3_x4_avx2_r(%rip), %rax
+        movl	%edx, %r12d
+        movq	%rsi, %r9
+        addq	%r12, %r9
+        movq	%r9, %r10
+        addq	%r12, %r10
+        movq	%r10, %r11
+        addq	%r12, %r11
+        shrq	$3, %r12
+L_sha3_blocksx4_out_avx2_block:
+        vmovdqu	(%rdi), %ymm15
         movq	%rdi, %rcx
-        vpbroadcastq	(%rsi), %ymm15
+        movq	%rdi, %r8
         addq	$0x80, %rdi
-        vpbroadcastq	8(%rsi), %ymm11
-        addq	$0x180, %rax
-        vpbroadcastq	16(%rsi), %ymm12
-        addq	$0x280, %rcx
-        vpbroadcastq	24(%rsi), %ymm13
-        vmovdqu	L_sha3_256_blockx4_seed_avx2_end_mark(%rip), %ymm5
-        vpxor	%ymm6, %ymm6, %ymm6
-        vmovdqu	%ymm11, -96(%rdi)
-        vmovdqu	%ymm12, -64(%rdi)
-        vmovdqu	%ymm13, -32(%rdi)
-        vmovdqu	(%rdi), %ymm14
-        vmovdqu	%ymm6, 32(%rdi)
-        vmovdqu	%ymm6, 64(%rdi)
-        vmovdqu	%ymm6, 96(%rdi)
-        vmovdqu	%ymm6, 128(%rdi)
-        vmovdqu	%ymm6, -96(%rax)
-        vmovdqu	%ymm6, -64(%rax)
-        vmovdqu	%ymm6, -32(%rax)
-        vmovdqu	%ymm6, (%rax)
-        vmovdqu	%ymm6, 32(%rax)
-        vmovdqu	%ymm6, 64(%rax)
-        vmovdqu	%ymm6, 96(%rax)
-        vmovdqu	%ymm5, 128(%rax)
-        vmovdqu	%ymm6, -96(%rcx)
-        vmovdqu	%ymm6, -64(%rcx)
-        vmovdqu	%ymm6, -32(%rcx)
-        vmovdqu	%ymm6, (%rcx)
-        vmovdqu	%ymm6, 32(%rcx)
-        vmovdqu	%ymm6, 64(%rcx)
-        vmovdqu	%ymm6, 96(%rcx)
-        vmovdqu	%ymm6, 128(%rcx)
-        vmovdqu	%ymm15, %ymm10
-        vpxor	%ymm5, %ymm11, %ymm11
+        addq	$0x180, %rcx
+        addq	$0x280, %r8
         # Round 0
         # Calc b[0..4]
+        vmovdqu	-96(%rdi), %ymm11
+        vmovdqu	-64(%rdi), %ymm12
+        vmovdqu	-32(%rdi), %ymm13
+        vmovdqu	(%rdi), %ymm14
+        vpxor	32(%rdi), %ymm15, %ymm10
+        vpxor	64(%rdi), %ymm11, %ymm11
+        vpxor	96(%rdi), %ymm12, %ymm12
+        vpxor	128(%rdi), %ymm13, %ymm13
+        vpxor	-96(%rcx), %ymm14, %ymm14
+        vpxor	-64(%rcx), %ymm10, %ymm10
+        vpxor	-32(%rcx), %ymm11, %ymm11
+        vpxor	(%rcx), %ymm12, %ymm12
+        vpxor	32(%rcx), %ymm13, %ymm13
+        vpxor	64(%rcx), %ymm14, %ymm14
+        vpxor	96(%rcx), %ymm10, %ymm10
+        vpxor	128(%rcx), %ymm11, %ymm11
+        vpxor	-96(%r8), %ymm12, %ymm12
+        vpxor	-64(%r8), %ymm13, %ymm13
+        vpxor	-32(%r8), %ymm14, %ymm14
+        vpxor	(%r8), %ymm10, %ymm10
+        vpxor	32(%r8), %ymm11, %ymm11
+        vpxor	64(%r8), %ymm12, %ymm12
+        vpxor	96(%r8), %ymm13, %ymm13
+        vpxor	128(%r8), %ymm14, %ymm14
         # Calc t[0..4]
         vpsrlq	$63, %ymm11, %ymm0
         vpsrlq	$63, %ymm12, %ymm1
@@ -20766,9 +20761,9 @@ _sha3_256_blocksx4_seed_avx2:
         # Row 0
         vpxor	%ymm15, %ymm5, %ymm10
         vpxor	64(%rdi), %ymm6, %ymm11
-        vpxor	(%rax), %ymm7, %ymm12
-        vpxor	-64(%rcx), %ymm8, %ymm13
-        vpxor	128(%rcx), %ymm9, %ymm14
+        vpxor	(%rcx), %ymm7, %ymm12
+        vpxor	-64(%r8), %ymm8, %ymm13
+        vpxor	128(%r8), %ymm9, %ymm14
         vpsrlq	$20, %ymm11, %ymm0
         vpsrlq	$21, %ymm12, %ymm1
         vpsrlq	$43, %ymm13, %ymm2
@@ -20790,19 +20785,19 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm11, %ymm1, %ymm1
         vpxor	%ymm12, %ymm2, %ymm2
         # XOR in constant
-        vpxor	(%rdx), %ymm15, %ymm15
+        vpxor	(%rax), %ymm15, %ymm15
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
         vmovdqu	%ymm1, 64(%rdi)
-        vmovdqu	%ymm2, (%rax)
-        vmovdqu	%ymm3, -64(%rcx)
-        vmovdqu	%ymm4, 128(%rcx)
+        vmovdqu	%ymm2, (%rcx)
+        vmovdqu	%ymm3, -64(%r8)
+        vmovdqu	%ymm4, 128(%r8)
         # Row 1
         vpxor	-32(%rdi), %ymm8, %ymm10
-        vpxor	-96(%rax), %ymm9, %ymm11
-        vpxor	-64(%rax), %ymm5, %ymm12
-        vpxor	128(%rax), %ymm6, %ymm13
-        vpxor	64(%rcx), %ymm7, %ymm14
+        vpxor	-96(%rcx), %ymm9, %ymm11
+        vpxor	-64(%rcx), %ymm5, %ymm12
+        vpxor	128(%rcx), %ymm6, %ymm13
+        vpxor	64(%r8), %ymm7, %ymm14
         vpsrlq	$36, %ymm10, %ymm0
         vpsrlq	$44, %ymm11, %ymm1
         vpsrlq	$61, %ymm12, %ymm2
@@ -20829,16 +20824,16 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
         vmovdqu	%ymm0, -32(%rdi)
-        vmovdqu	%ymm1, -96(%rax)
-        vmovdqu	%ymm2, -64(%rax)
-        vmovdqu	%ymm3, 128(%rax)
-        vmovdqu	%ymm4, 64(%rcx)
+        vmovdqu	%ymm1, -96(%rcx)
+        vmovdqu	%ymm2, -64(%rcx)
+        vmovdqu	%ymm3, 128(%rcx)
+        vmovdqu	%ymm4, 64(%r8)
         # Row 2
         vpxor	-96(%rdi), %ymm6, %ymm10
         vpxor	96(%rdi), %ymm7, %ymm11
-        vpxor	32(%rax), %ymm8, %ymm12
-        vpxor	-32(%rcx), %ymm9, %ymm13
-        vpxor	(%rcx), %ymm5, %ymm14
+        vpxor	32(%rcx), %ymm8, %ymm12
+        vpxor	-32(%r8), %ymm9, %ymm13
+        vpxor	(%r8), %ymm5, %ymm14
         vpsrlq	$63, %ymm10, %ymm0
         vpsrlq	$58, %ymm11, %ymm1
         vpsrlq	$39, %ymm12, %ymm2
@@ -20866,15 +20861,15 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm14, %ymm4, %ymm4
         vmovdqu	%ymm0, -96(%rdi)
         vmovdqu	%ymm1, 96(%rdi)
-        vmovdqu	%ymm2, 32(%rax)
-        vmovdqu	%ymm3, -32(%rcx)
-        vmovdqu	%ymm4, (%rcx)
+        vmovdqu	%ymm2, 32(%rcx)
+        vmovdqu	%ymm3, -32(%r8)
+        vmovdqu	%ymm4, (%r8)
         # Row 3
         vpxor	(%rdi), %ymm9, %ymm10
         vpxor	32(%rdi), %ymm5, %ymm11
-        vpxor	-32(%rax), %ymm6, %ymm12
-        vpxor	-96(%rcx), %ymm7, %ymm13
-        vpxor	96(%rcx), %ymm8, %ymm14
+        vpxor	-32(%rcx), %ymm6, %ymm12
+        vpxor	-96(%r8), %ymm7, %ymm13
+        vpxor	96(%r8), %ymm8, %ymm14
         vpsrlq	$37, %ymm10, %ymm0
         vpsrlq	$28, %ymm11, %ymm1
         vpsrlq	$54, %ymm12, %ymm2
@@ -20902,15 +20897,15 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm14, %ymm4, %ymm4
         vmovdqu	%ymm0, (%rdi)
         vmovdqu	%ymm1, 32(%rdi)
-        vmovdqu	%ymm2, -32(%rax)
-        vmovdqu	%ymm3, -96(%rcx)
-        vmovdqu	%ymm4, 96(%rcx)
+        vmovdqu	%ymm2, -32(%rcx)
+        vmovdqu	%ymm3, -96(%r8)
+        vmovdqu	%ymm4, 96(%r8)
         # Row 4
         vpxor	-64(%rdi), %ymm7, %ymm10
         vpxor	128(%rdi), %ymm8, %ymm11
-        vpxor	64(%rax), %ymm9, %ymm12
-        vpxor	96(%rax), %ymm5, %ymm13
-        vpxor	32(%rcx), %ymm6, %ymm14
+        vpxor	64(%rcx), %ymm9, %ymm12
+        vpxor	96(%rcx), %ymm5, %ymm13
+        vpxor	32(%r8), %ymm6, %ymm14
         vpsrlq	$2, %ymm10, %ymm0
         vpsrlq	$9, %ymm11, %ymm1
         vpsrlq	$25, %ymm12, %ymm2
@@ -20938,9 +20933,9 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm14, %ymm4, %ymm4
         vmovdqu	%ymm0, -64(%rdi)
         vmovdqu	%ymm1, 128(%rdi)
-        vmovdqu	%ymm2, 64(%rax)
-        vmovdqu	%ymm3, 96(%rax)
-        vmovdqu	%ymm4, 32(%rcx)
+        vmovdqu	%ymm2, 64(%rcx)
+        vmovdqu	%ymm3, 96(%rcx)
+        vmovdqu	%ymm4, 32(%r8)
         # Round 1
         # Calc b[0..4]
         vpxor	%ymm15, %ymm0, %ymm10
@@ -20950,19 +20945,19 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	32(%rdi), %ymm1, %ymm11
         vpxor	64(%rdi), %ymm11, %ymm11
         vpxor	96(%rdi), %ymm11, %ymm11
-        vpxor	-96(%rax), %ymm11, %ymm11
-        vpxor	-64(%rax), %ymm2, %ymm12
-        vpxor	-32(%rax), %ymm12, %ymm12
-        vpxor	(%rax), %ymm12, %ymm12
-        vpxor	32(%rax), %ymm12, %ymm12
-        vpxor	128(%rax), %ymm3, %ymm13
-        vpxor	-96(%rcx), %ymm13, %ymm13
-        vpxor	-64(%rcx), %ymm13, %ymm13
-        vpxor	-32(%rcx), %ymm13, %ymm13
-        vpxor	(%rcx), %ymm4, %ymm14
-        vpxor	64(%rcx), %ymm14, %ymm14
-        vpxor	96(%rcx), %ymm14, %ymm14
-        vpxor	128(%rcx), %ymm14, %ymm14
+        vpxor	-96(%rcx), %ymm11, %ymm11
+        vpxor	-64(%rcx), %ymm2, %ymm12
+        vpxor	-32(%rcx), %ymm12, %ymm12
+        vpxor	(%rcx), %ymm12, %ymm12
+        vpxor	32(%rcx), %ymm12, %ymm12
+        vpxor	128(%rcx), %ymm3, %ymm13
+        vpxor	-96(%r8), %ymm13, %ymm13
+        vpxor	-64(%r8), %ymm13, %ymm13
+        vpxor	-32(%r8), %ymm13, %ymm13
+        vpxor	(%r8), %ymm4, %ymm14
+        vpxor	64(%r8), %ymm14, %ymm14
+        vpxor	96(%r8), %ymm14, %ymm14
+        vpxor	128(%r8), %ymm14, %ymm14
         # Calc t[0..4]
         vpsrlq	$63, %ymm11, %ymm0
         vpsrlq	$63, %ymm12, %ymm1
@@ -20987,10 +20982,10 @@ _sha3_256_blocksx4_seed_avx2:
         # Row Mix
         # Row 0
         vpxor	%ymm15, %ymm5, %ymm10
-        vpxor	-96(%rax), %ymm6, %ymm11
-        vpxor	32(%rax), %ymm7, %ymm12
-        vpxor	-96(%rcx), %ymm8, %ymm13
-        vpxor	32(%rcx), %ymm9, %ymm14
+        vpxor	-96(%rcx), %ymm6, %ymm11
+        vpxor	32(%rcx), %ymm7, %ymm12
+        vpxor	-96(%r8), %ymm8, %ymm13
+        vpxor	32(%r8), %ymm9, %ymm14
         vpsrlq	$20, %ymm11, %ymm0
         vpsrlq	$21, %ymm12, %ymm1
         vpsrlq	$43, %ymm13, %ymm2
@@ -21012,19 +21007,19 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm11, %ymm1, %ymm1
         vpxor	%ymm12, %ymm2, %ymm2
         # XOR in constant
-        vpxor	32(%rdx), %ymm15, %ymm15
+        vpxor	32(%rax), %ymm15, %ymm15
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm1, -96(%rax)
-        vmovdqu	%ymm2, 32(%rax)
-        vmovdqu	%ymm3, -96(%rcx)
-        vmovdqu	%ymm4, 32(%rcx)
+        vmovdqu	%ymm1, -96(%rcx)
+        vmovdqu	%ymm2, 32(%rcx)
+        vmovdqu	%ymm3, -96(%r8)
+        vmovdqu	%ymm4, 32(%r8)
         # Row 1
-        vpxor	-64(%rcx), %ymm8, %ymm10
-        vpxor	64(%rcx), %ymm9, %ymm11
+        vpxor	-64(%r8), %ymm8, %ymm10
+        vpxor	64(%r8), %ymm9, %ymm11
         vpxor	-96(%rdi), %ymm5, %ymm12
         vpxor	32(%rdi), %ymm6, %ymm13
-        vpxor	64(%rax), %ymm7, %ymm14
+        vpxor	64(%rcx), %ymm7, %ymm14
         vpsrlq	$36, %ymm10, %ymm0
         vpsrlq	$44, %ymm11, %ymm1
         vpsrlq	$61, %ymm12, %ymm2
@@ -21050,16 +21045,16 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm12, %ymm2, %ymm2
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm0, -64(%rcx)
-        vmovdqu	%ymm1, 64(%rcx)
+        vmovdqu	%ymm0, -64(%r8)
+        vmovdqu	%ymm1, 64(%r8)
         vmovdqu	%ymm2, -96(%rdi)
         vmovdqu	%ymm3, 32(%rdi)
-        vmovdqu	%ymm4, 64(%rax)
+        vmovdqu	%ymm4, 64(%rcx)
         # Row 2
         vpxor	64(%rdi), %ymm6, %ymm10
-        vpxor	-64(%rax), %ymm7, %ymm11
-        vpxor	-32(%rcx), %ymm8, %ymm12
-        vpxor	96(%rcx), %ymm9, %ymm13
+        vpxor	-64(%rcx), %ymm7, %ymm11
+        vpxor	-32(%r8), %ymm8, %ymm12
+        vpxor	96(%r8), %ymm9, %ymm13
         vpxor	-64(%rdi), %ymm5, %ymm14
         vpsrlq	$63, %ymm10, %ymm0
         vpsrlq	$58, %ymm11, %ymm1
@@ -21087,16 +21082,16 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
         vmovdqu	%ymm0, 64(%rdi)
-        vmovdqu	%ymm1, -64(%rax)
-        vmovdqu	%ymm2, -32(%rcx)
-        vmovdqu	%ymm3, 96(%rcx)
+        vmovdqu	%ymm1, -64(%rcx)
+        vmovdqu	%ymm2, -32(%r8)
+        vmovdqu	%ymm3, 96(%r8)
         vmovdqu	%ymm4, -64(%rdi)
         # Row 3
-        vpxor	128(%rcx), %ymm9, %ymm10
+        vpxor	128(%r8), %ymm9, %ymm10
         vpxor	-32(%rdi), %ymm5, %ymm11
         vpxor	96(%rdi), %ymm6, %ymm12
-        vpxor	-32(%rax), %ymm7, %ymm13
-        vpxor	96(%rax), %ymm8, %ymm14
+        vpxor	-32(%rcx), %ymm7, %ymm13
+        vpxor	96(%rcx), %ymm8, %ymm14
         vpsrlq	$37, %ymm10, %ymm0
         vpsrlq	$28, %ymm11, %ymm1
         vpsrlq	$54, %ymm12, %ymm2
@@ -21122,15 +21117,15 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm12, %ymm2, %ymm2
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm0, 128(%rcx)
+        vmovdqu	%ymm0, 128(%r8)
         vmovdqu	%ymm1, -32(%rdi)
         vmovdqu	%ymm2, 96(%rdi)
-        vmovdqu	%ymm3, -32(%rax)
-        vmovdqu	%ymm4, 96(%rax)
+        vmovdqu	%ymm3, -32(%rcx)
+        vmovdqu	%ymm4, 96(%rcx)
         # Row 4
-        vpxor	(%rax), %ymm7, %ymm10
-        vpxor	128(%rax), %ymm8, %ymm11
-        vpxor	(%rcx), %ymm9, %ymm12
+        vpxor	(%rcx), %ymm7, %ymm10
+        vpxor	128(%rcx), %ymm8, %ymm11
+        vpxor	(%r8), %ymm9, %ymm12
         vpxor	(%rdi), %ymm5, %ymm13
         vpxor	128(%rdi), %ymm6, %ymm14
         vpsrlq	$2, %ymm10, %ymm0
@@ -21158,9 +21153,9 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm12, %ymm2, %ymm2
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm0, (%rax)
-        vmovdqu	%ymm1, 128(%rax)
-        vmovdqu	%ymm2, (%rcx)
+        vmovdqu	%ymm0, (%rcx)
+        vmovdqu	%ymm1, 128(%rcx)
+        vmovdqu	%ymm2, (%r8)
         vmovdqu	%ymm3, (%rdi)
         vmovdqu	%ymm4, 128(%rdi)
         # Round 2
@@ -21172,19 +21167,19 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	32(%rdi), %ymm3, %ymm13
         vpxor	64(%rdi), %ymm10, %ymm10
         vpxor	96(%rdi), %ymm12, %ymm12
-        vpxor	-96(%rax), %ymm11, %ymm11
-        vpxor	-64(%rax), %ymm11, %ymm11
-        vpxor	-32(%rax), %ymm13, %ymm13
-        vpxor	32(%rax), %ymm12, %ymm12
-        vpxor	64(%rax), %ymm14, %ymm14
-        vpxor	96(%rax), %ymm14, %ymm14
-        vpxor	-96(%rcx), %ymm13, %ymm13
-        vpxor	-64(%rcx), %ymm10, %ymm10
-        vpxor	-32(%rcx), %ymm12, %ymm12
-        vpxor	32(%rcx), %ymm14, %ymm14
-        vpxor	64(%rcx), %ymm11, %ymm11
-        vpxor	96(%rcx), %ymm13, %ymm13
-        vpxor	128(%rcx), %ymm10, %ymm10
+        vpxor	-96(%rcx), %ymm11, %ymm11
+        vpxor	-64(%rcx), %ymm11, %ymm11
+        vpxor	-32(%rcx), %ymm13, %ymm13
+        vpxor	32(%rcx), %ymm12, %ymm12
+        vpxor	64(%rcx), %ymm14, %ymm14
+        vpxor	96(%rcx), %ymm14, %ymm14
+        vpxor	-96(%r8), %ymm13, %ymm13
+        vpxor	-64(%r8), %ymm10, %ymm10
+        vpxor	-32(%r8), %ymm12, %ymm12
+        vpxor	32(%r8), %ymm14, %ymm14
+        vpxor	64(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm13, %ymm13
+        vpxor	128(%r8), %ymm10, %ymm10
         # Calc t[0..4]
         vpsrlq	$63, %ymm11, %ymm0
         vpsrlq	$63, %ymm12, %ymm1
@@ -21209,9 +21204,9 @@ _sha3_256_blocksx4_seed_avx2:
         # Row Mix
         # Row 0
         vpxor	%ymm15, %ymm5, %ymm10
-        vpxor	64(%rcx), %ymm6, %ymm11
-        vpxor	-32(%rcx), %ymm7, %ymm12
-        vpxor	-32(%rax), %ymm8, %ymm13
+        vpxor	64(%r8), %ymm6, %ymm11
+        vpxor	-32(%r8), %ymm7, %ymm12
+        vpxor	-32(%rcx), %ymm8, %ymm13
         vpxor	128(%rdi), %ymm9, %ymm14
         vpsrlq	$20, %ymm11, %ymm0
         vpsrlq	$21, %ymm12, %ymm1
@@ -21234,19 +21229,19 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm11, %ymm1, %ymm1
         vpxor	%ymm12, %ymm2, %ymm2
         # XOR in constant
-        vpxor	64(%rdx), %ymm15, %ymm15
+        vpxor	64(%rax), %ymm15, %ymm15
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm1, 64(%rcx)
-        vmovdqu	%ymm2, -32(%rcx)
-        vmovdqu	%ymm3, -32(%rax)
+        vmovdqu	%ymm1, 64(%r8)
+        vmovdqu	%ymm2, -32(%r8)
+        vmovdqu	%ymm3, -32(%rcx)
         vmovdqu	%ymm4, 128(%rdi)
         # Row 1
-        vpxor	-96(%rcx), %ymm8, %ymm10
-        vpxor	64(%rax), %ymm9, %ymm11
+        vpxor	-96(%r8), %ymm8, %ymm10
+        vpxor	64(%rcx), %ymm9, %ymm11
         vpxor	64(%rdi), %ymm5, %ymm12
         vpxor	-32(%rdi), %ymm6, %ymm13
-        vpxor	(%rcx), %ymm7, %ymm14
+        vpxor	(%r8), %ymm7, %ymm14
         vpsrlq	$36, %ymm10, %ymm0
         vpsrlq	$44, %ymm11, %ymm1
         vpsrlq	$61, %ymm12, %ymm2
@@ -21272,17 +21267,17 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm12, %ymm2, %ymm2
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm0, -96(%rcx)
-        vmovdqu	%ymm1, 64(%rax)
+        vmovdqu	%ymm0, -96(%r8)
+        vmovdqu	%ymm1, 64(%rcx)
         vmovdqu	%ymm2, 64(%rdi)
         vmovdqu	%ymm3, -32(%rdi)
-        vmovdqu	%ymm4, (%rcx)
+        vmovdqu	%ymm4, (%r8)
         # Row 2
-        vpxor	-96(%rax), %ymm6, %ymm10
+        vpxor	-96(%rcx), %ymm6, %ymm10
         vpxor	-96(%rdi), %ymm7, %ymm11
-        vpxor	96(%rcx), %ymm8, %ymm12
-        vpxor	96(%rax), %ymm9, %ymm13
-        vpxor	(%rax), %ymm5, %ymm14
+        vpxor	96(%r8), %ymm8, %ymm12
+        vpxor	96(%rcx), %ymm9, %ymm13
+        vpxor	(%rcx), %ymm5, %ymm14
         vpsrlq	$63, %ymm10, %ymm0
         vpsrlq	$58, %ymm11, %ymm1
         vpsrlq	$39, %ymm12, %ymm2
@@ -21308,15 +21303,15 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm12, %ymm2, %ymm2
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm0, -96(%rax)
+        vmovdqu	%ymm0, -96(%rcx)
         vmovdqu	%ymm1, -96(%rdi)
-        vmovdqu	%ymm2, 96(%rcx)
-        vmovdqu	%ymm3, 96(%rax)
-        vmovdqu	%ymm4, (%rax)
+        vmovdqu	%ymm2, 96(%r8)
+        vmovdqu	%ymm3, 96(%rcx)
+        vmovdqu	%ymm4, (%rcx)
         # Row 3
-        vpxor	32(%rcx), %ymm9, %ymm10
-        vpxor	-64(%rcx), %ymm5, %ymm11
-        vpxor	-64(%rax), %ymm6, %ymm12
+        vpxor	32(%r8), %ymm9, %ymm10
+        vpxor	-64(%r8), %ymm5, %ymm11
+        vpxor	-64(%rcx), %ymm6, %ymm12
         vpxor	96(%rdi), %ymm7, %ymm13
         vpxor	(%rdi), %ymm8, %ymm14
         vpsrlq	$37, %ymm10, %ymm0
@@ -21344,17 +21339,5423 @@ _sha3_256_blocksx4_seed_avx2:
         vpxor	%ymm12, %ymm2, %ymm2
         vpxor	%ymm13, %ymm3, %ymm3
         vpxor	%ymm14, %ymm4, %ymm4
-        vmovdqu	%ymm0, 32(%rcx)
-        vmovdqu	%ymm1, -64(%rcx)
-        vmovdqu	%ymm2, -64(%rax)
+        vmovdqu	%ymm0, 32(%r8)
+        vmovdqu	%ymm1, -64(%r8)
+        vmovdqu	%ymm2, -64(%rcx)
         vmovdqu	%ymm3, 96(%rdi)
         vmovdqu	%ymm4, (%rdi)
         # Row 4
-        vpxor	32(%rax), %ymm7, %ymm10
+        vpxor	32(%rcx), %ymm7, %ymm10
         vpxor	32(%rdi), %ymm8, %ymm11
         vpxor	-64(%rdi), %ymm9, %ymm12
-        vpxor	128(%rcx), %ymm5, %ymm13
-        vpxor	128(%rax), %ymm6, %ymm14
+        vpxor	128(%r8), %ymm5, %ymm13
+        vpxor	128(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rcx)
+        vmovdqu	%ymm1, 32(%rdi)
+        vmovdqu	%ymm2, -64(%rdi)
+        vmovdqu	%ymm3, 128(%r8)
+        vmovdqu	%ymm4, 128(%rcx)
+        # Round 3
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm1, %ymm11
+        vpxor	-32(%rdi), %ymm3, %ymm13
+        vpxor	(%rdi), %ymm4, %ymm14
+        vpxor	64(%rdi), %ymm2, %ymm12
+        vpxor	96(%rdi), %ymm13, %ymm13
+        vpxor	128(%rdi), %ymm14, %ymm14
+        vpxor	-96(%rcx), %ymm10, %ymm10
+        vpxor	-64(%rcx), %ymm12, %ymm12
+        vpxor	-32(%rcx), %ymm13, %ymm13
+        vpxor	(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm11, %ymm11
+        vpxor	96(%rcx), %ymm13, %ymm13
+        vpxor	-96(%r8), %ymm10, %ymm10
+        vpxor	-64(%r8), %ymm11, %ymm11
+        vpxor	-32(%r8), %ymm12, %ymm12
+        vpxor	(%r8), %ymm14, %ymm14
+        vpxor	32(%r8), %ymm10, %ymm10
+        vpxor	64(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm12, %ymm12
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	64(%rcx), %ymm6, %ymm11
+        vpxor	96(%r8), %ymm7, %ymm12
+        vpxor	96(%rdi), %ymm8, %ymm13
+        vpxor	128(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	96(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 64(%rcx)
+        vmovdqu	%ymm2, 96(%r8)
+        vmovdqu	%ymm3, 96(%rdi)
+        vmovdqu	%ymm4, 128(%rcx)
+        # Row 1
+        vpxor	-32(%rcx), %ymm8, %ymm10
+        vpxor	(%r8), %ymm9, %ymm11
+        vpxor	-96(%rcx), %ymm5, %ymm12
+        vpxor	-64(%r8), %ymm6, %ymm13
+        vpxor	-64(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rcx)
+        vmovdqu	%ymm1, (%r8)
+        vmovdqu	%ymm2, -96(%rcx)
+        vmovdqu	%ymm3, -64(%r8)
+        vmovdqu	%ymm4, -64(%rdi)
+        # Row 2
+        vpxor	64(%r8), %ymm6, %ymm10
+        vpxor	64(%rdi), %ymm7, %ymm11
+        vpxor	96(%rcx), %ymm8, %ymm12
+        vpxor	(%rdi), %ymm9, %ymm13
+        vpxor	32(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%r8)
+        vmovdqu	%ymm1, 64(%rdi)
+        vmovdqu	%ymm2, 96(%rcx)
+        vmovdqu	%ymm3, (%rdi)
+        vmovdqu	%ymm4, 32(%rcx)
+        # Row 3
+        vpxor	128(%rdi), %ymm9, %ymm10
+        vpxor	-96(%r8), %ymm5, %ymm11
+        vpxor	-96(%rdi), %ymm6, %ymm12
+        vpxor	-64(%rcx), %ymm7, %ymm13
+        vpxor	128(%r8), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rdi)
+        vmovdqu	%ymm1, -96(%r8)
+        vmovdqu	%ymm2, -96(%rdi)
+        vmovdqu	%ymm3, -64(%rcx)
+        vmovdqu	%ymm4, 128(%r8)
+        # Row 4
+        vpxor	-32(%r8), %ymm7, %ymm10
+        vpxor	-32(%rdi), %ymm8, %ymm11
+        vpxor	(%rcx), %ymm9, %ymm12
+        vpxor	32(%r8), %ymm5, %ymm13
+        vpxor	32(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%r8)
+        vmovdqu	%ymm1, -32(%rdi)
+        vmovdqu	%ymm2, (%rcx)
+        vmovdqu	%ymm3, 32(%r8)
+        vmovdqu	%ymm4, 32(%rdi)
+        # Round 4
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm2, %ymm12
+        vpxor	-64(%rdi), %ymm4, %ymm14
+        vpxor	(%rdi), %ymm3, %ymm13
+        vpxor	64(%rdi), %ymm1, %ymm11
+        vpxor	96(%rdi), %ymm13, %ymm13
+        vpxor	128(%rdi), %ymm10, %ymm10
+        vpxor	-96(%rcx), %ymm12, %ymm12
+        vpxor	-64(%rcx), %ymm13, %ymm13
+        vpxor	-32(%rcx), %ymm10, %ymm10
+        vpxor	32(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm11, %ymm11
+        vpxor	96(%rcx), %ymm12, %ymm12
+        vpxor	128(%rcx), %ymm14, %ymm14
+        vpxor	-96(%r8), %ymm11, %ymm11
+        vpxor	-64(%r8), %ymm13, %ymm13
+        vpxor	(%r8), %ymm11, %ymm11
+        vpxor	64(%r8), %ymm10, %ymm10
+        vpxor	96(%r8), %ymm12, %ymm12
+        vpxor	128(%r8), %ymm14, %ymm14
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	(%r8), %ymm6, %ymm11
+        vpxor	96(%rcx), %ymm7, %ymm12
+        vpxor	-64(%rcx), %ymm8, %ymm13
+        vpxor	32(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	128(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, (%r8)
+        vmovdqu	%ymm2, 96(%rcx)
+        vmovdqu	%ymm3, -64(%rcx)
+        vmovdqu	%ymm4, 32(%rdi)
+        # Row 1
+        vpxor	96(%rdi), %ymm8, %ymm10
+        vpxor	-64(%rdi), %ymm9, %ymm11
+        vpxor	64(%r8), %ymm5, %ymm12
+        vpxor	-96(%r8), %ymm6, %ymm13
+        vpxor	(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rdi)
+        vmovdqu	%ymm1, -64(%rdi)
+        vmovdqu	%ymm2, 64(%r8)
+        vmovdqu	%ymm3, -96(%r8)
+        vmovdqu	%ymm4, (%rcx)
+        # Row 2
+        vpxor	64(%rcx), %ymm6, %ymm10
+        vpxor	-96(%rcx), %ymm7, %ymm11
+        vpxor	(%rdi), %ymm8, %ymm12
+        vpxor	128(%r8), %ymm9, %ymm13
+        vpxor	-32(%r8), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rcx)
+        vmovdqu	%ymm1, -96(%rcx)
+        vmovdqu	%ymm2, (%rdi)
+        vmovdqu	%ymm3, 128(%r8)
+        vmovdqu	%ymm4, -32(%r8)
+        # Row 3
+        vpxor	128(%rcx), %ymm9, %ymm10
+        vpxor	-32(%rcx), %ymm5, %ymm11
+        vpxor	64(%rdi), %ymm6, %ymm12
+        vpxor	-96(%rdi), %ymm7, %ymm13
+        vpxor	32(%r8), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rcx)
+        vmovdqu	%ymm1, -32(%rcx)
+        vmovdqu	%ymm2, 64(%rdi)
+        vmovdqu	%ymm3, -96(%rdi)
+        vmovdqu	%ymm4, 32(%r8)
+        # Row 4
+        vpxor	96(%r8), %ymm7, %ymm10
+        vpxor	-64(%r8), %ymm8, %ymm11
+        vpxor	32(%rcx), %ymm9, %ymm12
+        vpxor	128(%rdi), %ymm5, %ymm13
+        vpxor	-32(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%r8)
+        vmovdqu	%ymm1, -64(%r8)
+        vmovdqu	%ymm2, 32(%rcx)
+        vmovdqu	%ymm3, 128(%rdi)
+        vmovdqu	%ymm4, -32(%rdi)
+        # Round 5
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm3, %ymm13
+        vpxor	-64(%rdi), %ymm1, %ymm11
+        vpxor	(%rdi), %ymm2, %ymm12
+        vpxor	32(%rdi), %ymm4, %ymm14
+        vpxor	64(%rdi), %ymm12, %ymm12
+        vpxor	96(%rdi), %ymm10, %ymm10
+        vpxor	-96(%rcx), %ymm11, %ymm11
+        vpxor	-64(%rcx), %ymm13, %ymm13
+        vpxor	-32(%rcx), %ymm11, %ymm11
+        vpxor	(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm10, %ymm10
+        vpxor	96(%rcx), %ymm12, %ymm12
+        vpxor	128(%rcx), %ymm10, %ymm10
+        vpxor	-96(%r8), %ymm13, %ymm13
+        vpxor	-32(%r8), %ymm14, %ymm14
+        vpxor	(%r8), %ymm11, %ymm11
+        vpxor	32(%r8), %ymm14, %ymm14
+        vpxor	64(%r8), %ymm12, %ymm12
+        vpxor	128(%r8), %ymm13, %ymm13
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-64(%rdi), %ymm6, %ymm11
+        vpxor	(%rdi), %ymm7, %ymm12
+        vpxor	-96(%rdi), %ymm8, %ymm13
+        vpxor	-32(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	160(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -64(%rdi)
+        vmovdqu	%ymm2, (%rdi)
+        vmovdqu	%ymm3, -96(%rdi)
+        vmovdqu	%ymm4, -32(%rdi)
+        # Row 1
+        vpxor	-64(%rcx), %ymm8, %ymm10
+        vpxor	(%rcx), %ymm9, %ymm11
+        vpxor	64(%rcx), %ymm5, %ymm12
+        vpxor	-32(%rcx), %ymm6, %ymm13
+        vpxor	32(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rcx)
+        vmovdqu	%ymm1, (%rcx)
+        vmovdqu	%ymm2, 64(%rcx)
+        vmovdqu	%ymm3, -32(%rcx)
+        vmovdqu	%ymm4, 32(%rcx)
+        # Row 2
+        vpxor	(%r8), %ymm6, %ymm10
+        vpxor	64(%r8), %ymm7, %ymm11
+        vpxor	128(%r8), %ymm8, %ymm12
+        vpxor	32(%r8), %ymm9, %ymm13
+        vpxor	96(%r8), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%r8)
+        vmovdqu	%ymm1, 64(%r8)
+        vmovdqu	%ymm2, 128(%r8)
+        vmovdqu	%ymm3, 32(%r8)
+        vmovdqu	%ymm4, 96(%r8)
+        # Row 3
+        vpxor	32(%rdi), %ymm9, %ymm10
+        vpxor	96(%rdi), %ymm5, %ymm11
+        vpxor	-96(%rcx), %ymm6, %ymm12
+        vpxor	64(%rdi), %ymm7, %ymm13
+        vpxor	128(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rdi)
+        vmovdqu	%ymm1, 96(%rdi)
+        vmovdqu	%ymm2, -96(%rcx)
+        vmovdqu	%ymm3, 64(%rdi)
+        vmovdqu	%ymm4, 128(%rdi)
+        # Row 4
+        vpxor	96(%rcx), %ymm7, %ymm10
+        vpxor	-96(%r8), %ymm8, %ymm11
+        vpxor	-32(%r8), %ymm9, %ymm12
+        vpxor	128(%rcx), %ymm5, %ymm13
+        vpxor	-64(%r8), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rcx)
+        vmovdqu	%ymm1, -96(%r8)
+        vmovdqu	%ymm2, -32(%r8)
+        vmovdqu	%ymm3, 128(%rcx)
+        vmovdqu	%ymm4, -64(%r8)
+        # Round 6
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm3, %ymm13
+        vpxor	-64(%rdi), %ymm1, %ymm11
+        vpxor	-32(%rdi), %ymm4, %ymm14
+        vpxor	(%rdi), %ymm2, %ymm12
+        vpxor	32(%rdi), %ymm10, %ymm10
+        vpxor	64(%rdi), %ymm13, %ymm13
+        vpxor	96(%rdi), %ymm11, %ymm11
+        vpxor	128(%rdi), %ymm14, %ymm14
+        vpxor	-96(%rcx), %ymm12, %ymm12
+        vpxor	-64(%rcx), %ymm10, %ymm10
+        vpxor	-32(%rcx), %ymm13, %ymm13
+        vpxor	(%rcx), %ymm11, %ymm11
+        vpxor	32(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm12, %ymm12
+        vpxor	(%r8), %ymm10, %ymm10
+        vpxor	32(%r8), %ymm13, %ymm13
+        vpxor	64(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm14, %ymm14
+        vpxor	128(%r8), %ymm12, %ymm12
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	(%rcx), %ymm6, %ymm11
+        vpxor	128(%r8), %ymm7, %ymm12
+        vpxor	64(%rdi), %ymm8, %ymm13
+        vpxor	-64(%r8), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	192(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, (%rcx)
+        vmovdqu	%ymm2, 128(%r8)
+        vmovdqu	%ymm3, 64(%rdi)
+        vmovdqu	%ymm4, -64(%r8)
+        # Row 1
+        vpxor	-96(%rdi), %ymm8, %ymm10
+        vpxor	32(%rcx), %ymm9, %ymm11
+        vpxor	(%r8), %ymm5, %ymm12
+        vpxor	96(%rdi), %ymm6, %ymm13
+        vpxor	-32(%r8), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rdi)
+        vmovdqu	%ymm1, 32(%rcx)
+        vmovdqu	%ymm2, (%r8)
+        vmovdqu	%ymm3, 96(%rdi)
+        vmovdqu	%ymm4, -32(%r8)
+        # Row 2
+        vpxor	-64(%rdi), %ymm6, %ymm10
+        vpxor	64(%rcx), %ymm7, %ymm11
+        vpxor	32(%r8), %ymm8, %ymm12
+        vpxor	128(%rdi), %ymm9, %ymm13
+        vpxor	96(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rdi)
+        vmovdqu	%ymm1, 64(%rcx)
+        vmovdqu	%ymm2, 32(%r8)
+        vmovdqu	%ymm3, 128(%rdi)
+        vmovdqu	%ymm4, 96(%rcx)
+        # Row 3
+        vpxor	-32(%rdi), %ymm9, %ymm10
+        vpxor	-64(%rcx), %ymm5, %ymm11
+        vpxor	64(%r8), %ymm6, %ymm12
+        vpxor	-96(%rcx), %ymm7, %ymm13
+        vpxor	128(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rdi)
+        vmovdqu	%ymm1, -64(%rcx)
+        vmovdqu	%ymm2, 64(%r8)
+        vmovdqu	%ymm3, -96(%rcx)
+        vmovdqu	%ymm4, 128(%rcx)
+        # Row 4
+        vpxor	(%rdi), %ymm7, %ymm10
+        vpxor	-32(%rcx), %ymm8, %ymm11
+        vpxor	96(%r8), %ymm9, %ymm12
+        vpxor	32(%rdi), %ymm5, %ymm13
+        vpxor	-96(%r8), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rdi)
+        vmovdqu	%ymm1, -32(%rcx)
+        vmovdqu	%ymm2, 96(%r8)
+        vmovdqu	%ymm3, 32(%rdi)
+        vmovdqu	%ymm4, -96(%r8)
+        # Round 7
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm10, %ymm10
+        vpxor	-64(%rdi), %ymm10, %ymm10
+        vpxor	-32(%rdi), %ymm10, %ymm10
+        vpxor	64(%rdi), %ymm3, %ymm13
+        vpxor	96(%rdi), %ymm13, %ymm13
+        vpxor	128(%rdi), %ymm13, %ymm13
+        vpxor	-96(%rcx), %ymm13, %ymm13
+        vpxor	-64(%rcx), %ymm1, %ymm11
+        vpxor	(%rcx), %ymm11, %ymm11
+        vpxor	32(%rcx), %ymm11, %ymm11
+        vpxor	64(%rcx), %ymm11, %ymm11
+        vpxor	96(%rcx), %ymm4, %ymm14
+        vpxor	128(%rcx), %ymm14, %ymm14
+        vpxor	-64(%r8), %ymm14, %ymm14
+        vpxor	-32(%r8), %ymm14, %ymm14
+        vpxor	(%r8), %ymm2, %ymm12
+        vpxor	32(%r8), %ymm12, %ymm12
+        vpxor	64(%r8), %ymm12, %ymm12
+        vpxor	128(%r8), %ymm12, %ymm12
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	32(%rcx), %ymm6, %ymm11
+        vpxor	32(%r8), %ymm7, %ymm12
+        vpxor	-96(%rcx), %ymm8, %ymm13
+        vpxor	-96(%r8), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	224(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 32(%rcx)
+        vmovdqu	%ymm2, 32(%r8)
+        vmovdqu	%ymm3, -96(%rcx)
+        vmovdqu	%ymm4, -96(%r8)
+        # Row 1
+        vpxor	64(%rdi), %ymm8, %ymm10
+        vpxor	-32(%r8), %ymm9, %ymm11
+        vpxor	-64(%rdi), %ymm5, %ymm12
+        vpxor	-64(%rcx), %ymm6, %ymm13
+        vpxor	96(%r8), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rdi)
+        vmovdqu	%ymm1, -32(%r8)
+        vmovdqu	%ymm2, -64(%rdi)
+        vmovdqu	%ymm3, -64(%rcx)
+        vmovdqu	%ymm4, 96(%r8)
+        # Row 2
+        vpxor	(%rcx), %ymm6, %ymm10
+        vpxor	(%r8), %ymm7, %ymm11
+        vpxor	128(%rdi), %ymm8, %ymm12
+        vpxor	128(%rcx), %ymm9, %ymm13
+        vpxor	(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rcx)
+        vmovdqu	%ymm1, (%r8)
+        vmovdqu	%ymm2, 128(%rdi)
+        vmovdqu	%ymm3, 128(%rcx)
+        vmovdqu	%ymm4, (%rdi)
+        # Row 3
+        vpxor	-64(%r8), %ymm9, %ymm10
+        vpxor	-96(%rdi), %ymm5, %ymm11
+        vpxor	64(%rcx), %ymm6, %ymm12
+        vpxor	64(%r8), %ymm7, %ymm13
+        vpxor	32(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%r8)
+        vmovdqu	%ymm1, -96(%rdi)
+        vmovdqu	%ymm2, 64(%rcx)
+        vmovdqu	%ymm3, 64(%r8)
+        vmovdqu	%ymm4, 32(%rdi)
+        # Row 4
+        vpxor	128(%r8), %ymm7, %ymm10
+        vpxor	96(%rdi), %ymm8, %ymm11
+        vpxor	96(%rcx), %ymm9, %ymm12
+        vpxor	-32(%rdi), %ymm5, %ymm13
+        vpxor	-32(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%r8)
+        vmovdqu	%ymm1, 96(%rdi)
+        vmovdqu	%ymm2, 96(%rcx)
+        vmovdqu	%ymm3, -32(%rdi)
+        vmovdqu	%ymm4, -32(%rcx)
+        # Round 8
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm1, %ymm11
+        vpxor	-64(%rdi), %ymm2, %ymm12
+        vpxor	(%rdi), %ymm4, %ymm14
+        vpxor	32(%rdi), %ymm14, %ymm14
+        vpxor	64(%rdi), %ymm10, %ymm10
+        vpxor	128(%rdi), %ymm12, %ymm12
+        vpxor	-96(%rcx), %ymm3, %ymm13
+        vpxor	-64(%rcx), %ymm13, %ymm13
+        vpxor	(%rcx), %ymm10, %ymm10
+        vpxor	32(%rcx), %ymm11, %ymm11
+        vpxor	64(%rcx), %ymm12, %ymm12
+        vpxor	128(%rcx), %ymm13, %ymm13
+        vpxor	-96(%r8), %ymm14, %ymm14
+        vpxor	-64(%r8), %ymm10, %ymm10
+        vpxor	-32(%r8), %ymm11, %ymm11
+        vpxor	(%r8), %ymm11, %ymm11
+        vpxor	32(%r8), %ymm12, %ymm12
+        vpxor	64(%r8), %ymm13, %ymm13
+        vpxor	96(%r8), %ymm14, %ymm14
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-32(%r8), %ymm6, %ymm11
+        vpxor	128(%rdi), %ymm7, %ymm12
+        vpxor	64(%r8), %ymm8, %ymm13
+        vpxor	-32(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	256(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -32(%r8)
+        vmovdqu	%ymm2, 128(%rdi)
+        vmovdqu	%ymm3, 64(%r8)
+        vmovdqu	%ymm4, -32(%rcx)
+        # Row 1
+        vpxor	-96(%rcx), %ymm8, %ymm10
+        vpxor	96(%r8), %ymm9, %ymm11
+        vpxor	(%rcx), %ymm5, %ymm12
+        vpxor	-96(%rdi), %ymm6, %ymm13
+        vpxor	96(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rcx)
+        vmovdqu	%ymm1, 96(%r8)
+        vmovdqu	%ymm2, (%rcx)
+        vmovdqu	%ymm3, -96(%rdi)
+        vmovdqu	%ymm4, 96(%rcx)
+        # Row 2
+        vpxor	32(%rcx), %ymm6, %ymm10
+        vpxor	-64(%rdi), %ymm7, %ymm11
+        vpxor	128(%rcx), %ymm8, %ymm12
+        vpxor	32(%rdi), %ymm9, %ymm13
+        vpxor	128(%r8), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rcx)
+        vmovdqu	%ymm1, -64(%rdi)
+        vmovdqu	%ymm2, 128(%rcx)
+        vmovdqu	%ymm3, 32(%rdi)
+        vmovdqu	%ymm4, 128(%r8)
+        # Row 3
+        vpxor	-96(%r8), %ymm9, %ymm10
+        vpxor	64(%rdi), %ymm5, %ymm11
+        vpxor	(%r8), %ymm6, %ymm12
+        vpxor	64(%rcx), %ymm7, %ymm13
+        vpxor	-32(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%r8)
+        vmovdqu	%ymm1, 64(%rdi)
+        vmovdqu	%ymm2, (%r8)
+        vmovdqu	%ymm3, 64(%rcx)
+        vmovdqu	%ymm4, -32(%rdi)
+        # Row 4
+        vpxor	32(%r8), %ymm7, %ymm10
+        vpxor	-64(%rcx), %ymm8, %ymm11
+        vpxor	(%rdi), %ymm9, %ymm12
+        vpxor	-64(%r8), %ymm5, %ymm13
+        vpxor	96(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%r8)
+        vmovdqu	%ymm1, -64(%rcx)
+        vmovdqu	%ymm2, (%rdi)
+        vmovdqu	%ymm3, -64(%r8)
+        vmovdqu	%ymm4, 96(%rdi)
+        # Round 9
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm3, %ymm13
+        vpxor	-64(%rdi), %ymm1, %ymm11
+        vpxor	-32(%rdi), %ymm4, %ymm14
+        vpxor	32(%rdi), %ymm13, %ymm13
+        vpxor	64(%rdi), %ymm11, %ymm11
+        vpxor	128(%rdi), %ymm2, %ymm12
+        vpxor	-96(%rcx), %ymm10, %ymm10
+        vpxor	-32(%rcx), %ymm14, %ymm14
+        vpxor	(%rcx), %ymm12, %ymm12
+        vpxor	32(%rcx), %ymm10, %ymm10
+        vpxor	64(%rcx), %ymm13, %ymm13
+        vpxor	96(%rcx), %ymm14, %ymm14
+        vpxor	128(%rcx), %ymm12, %ymm12
+        vpxor	-96(%r8), %ymm10, %ymm10
+        vpxor	-32(%r8), %ymm11, %ymm11
+        vpxor	(%r8), %ymm12, %ymm12
+        vpxor	64(%r8), %ymm13, %ymm13
+        vpxor	96(%r8), %ymm11, %ymm11
+        vpxor	128(%r8), %ymm14, %ymm14
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	96(%r8), %ymm6, %ymm11
+        vpxor	128(%rcx), %ymm7, %ymm12
+        vpxor	64(%rcx), %ymm8, %ymm13
+        vpxor	96(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	288(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 96(%r8)
+        vmovdqu	%ymm2, 128(%rcx)
+        vmovdqu	%ymm3, 64(%rcx)
+        vmovdqu	%ymm4, 96(%rdi)
+        # Row 1
+        vpxor	64(%r8), %ymm8, %ymm10
+        vpxor	96(%rcx), %ymm9, %ymm11
+        vpxor	32(%rcx), %ymm5, %ymm12
+        vpxor	64(%rdi), %ymm6, %ymm13
+        vpxor	(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%r8)
+        vmovdqu	%ymm1, 96(%rcx)
+        vmovdqu	%ymm2, 32(%rcx)
+        vmovdqu	%ymm3, 64(%rdi)
+        vmovdqu	%ymm4, (%rdi)
+        # Row 2
+        vpxor	-32(%r8), %ymm6, %ymm10
+        vpxor	(%rcx), %ymm7, %ymm11
+        vpxor	32(%rdi), %ymm8, %ymm12
+        vpxor	-32(%rdi), %ymm9, %ymm13
+        vpxor	32(%r8), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%r8)
+        vmovdqu	%ymm1, (%rcx)
+        vmovdqu	%ymm2, 32(%rdi)
+        vmovdqu	%ymm3, -32(%rdi)
+        vmovdqu	%ymm4, 32(%r8)
+        # Row 3
+        vpxor	-32(%rcx), %ymm9, %ymm10
+        vpxor	-96(%rcx), %ymm5, %ymm11
+        vpxor	-64(%rdi), %ymm6, %ymm12
+        vpxor	(%r8), %ymm7, %ymm13
+        vpxor	-64(%r8), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rcx)
+        vmovdqu	%ymm1, -96(%rcx)
+        vmovdqu	%ymm2, -64(%rdi)
+        vmovdqu	%ymm3, (%r8)
+        vmovdqu	%ymm4, -64(%r8)
+        # Row 4
+        vpxor	128(%rdi), %ymm7, %ymm10
+        vpxor	-96(%rdi), %ymm8, %ymm11
+        vpxor	128(%r8), %ymm9, %ymm12
+        vpxor	-96(%r8), %ymm5, %ymm13
+        vpxor	-64(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rdi)
+        vmovdqu	%ymm1, -96(%rdi)
+        vmovdqu	%ymm2, 128(%r8)
+        vmovdqu	%ymm3, -96(%r8)
+        vmovdqu	%ymm4, -64(%rcx)
+        # Round 10
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-64(%rdi), %ymm2, %ymm12
+        vpxor	-32(%rdi), %ymm3, %ymm13
+        vpxor	(%rdi), %ymm4, %ymm14
+        vpxor	32(%rdi), %ymm12, %ymm12
+        vpxor	64(%rdi), %ymm13, %ymm13
+        vpxor	96(%rdi), %ymm14, %ymm14
+        vpxor	-96(%rcx), %ymm1, %ymm11
+        vpxor	-32(%rcx), %ymm10, %ymm10
+        vpxor	(%rcx), %ymm11, %ymm11
+        vpxor	32(%rcx), %ymm12, %ymm12
+        vpxor	64(%rcx), %ymm13, %ymm13
+        vpxor	96(%rcx), %ymm11, %ymm11
+        vpxor	128(%rcx), %ymm12, %ymm12
+        vpxor	-64(%r8), %ymm14, %ymm14
+        vpxor	-32(%r8), %ymm10, %ymm10
+        vpxor	(%r8), %ymm13, %ymm13
+        vpxor	32(%r8), %ymm14, %ymm14
+        vpxor	64(%r8), %ymm10, %ymm10
+        vpxor	96(%r8), %ymm11, %ymm11
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	96(%rcx), %ymm6, %ymm11
+        vpxor	32(%rdi), %ymm7, %ymm12
+        vpxor	(%r8), %ymm8, %ymm13
+        vpxor	-64(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	320(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 96(%rcx)
+        vmovdqu	%ymm2, 32(%rdi)
+        vmovdqu	%ymm3, (%r8)
+        vmovdqu	%ymm4, -64(%rcx)
+        # Row 1
+        vpxor	64(%rcx), %ymm8, %ymm10
+        vpxor	(%rdi), %ymm9, %ymm11
+        vpxor	-32(%r8), %ymm5, %ymm12
+        vpxor	-96(%rcx), %ymm6, %ymm13
+        vpxor	128(%r8), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rcx)
+        vmovdqu	%ymm1, (%rdi)
+        vmovdqu	%ymm2, -32(%r8)
+        vmovdqu	%ymm3, -96(%rcx)
+        vmovdqu	%ymm4, 128(%r8)
+        # Row 2
+        vpxor	96(%r8), %ymm6, %ymm10
+        vpxor	32(%rcx), %ymm7, %ymm11
+        vpxor	-32(%rdi), %ymm8, %ymm12
+        vpxor	-64(%r8), %ymm9, %ymm13
+        vpxor	128(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%r8)
+        vmovdqu	%ymm1, 32(%rcx)
+        vmovdqu	%ymm2, -32(%rdi)
+        vmovdqu	%ymm3, -64(%r8)
+        vmovdqu	%ymm4, 128(%rdi)
+        # Row 3
+        vpxor	96(%rdi), %ymm9, %ymm10
+        vpxor	64(%r8), %ymm5, %ymm11
+        vpxor	(%rcx), %ymm6, %ymm12
+        vpxor	-64(%rdi), %ymm7, %ymm13
+        vpxor	-96(%r8), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rdi)
+        vmovdqu	%ymm1, 64(%r8)
+        vmovdqu	%ymm2, (%rcx)
+        vmovdqu	%ymm3, -64(%rdi)
+        vmovdqu	%ymm4, -96(%r8)
+        # Row 4
+        vpxor	128(%rcx), %ymm7, %ymm10
+        vpxor	64(%rdi), %ymm8, %ymm11
+        vpxor	32(%r8), %ymm9, %ymm12
+        vpxor	-32(%rcx), %ymm5, %ymm13
+        vpxor	-96(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rcx)
+        vmovdqu	%ymm1, 64(%rdi)
+        vmovdqu	%ymm2, 32(%r8)
+        vmovdqu	%ymm3, -32(%rcx)
+        vmovdqu	%ymm4, -96(%rdi)
+        # Round 11
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-64(%rdi), %ymm3, %ymm13
+        vpxor	-32(%rdi), %ymm2, %ymm12
+        vpxor	(%rdi), %ymm1, %ymm11
+        vpxor	32(%rdi), %ymm12, %ymm12
+        vpxor	96(%rdi), %ymm10, %ymm10
+        vpxor	128(%rdi), %ymm4, %ymm14
+        vpxor	-96(%rcx), %ymm13, %ymm13
+        vpxor	-64(%rcx), %ymm14, %ymm14
+        vpxor	(%rcx), %ymm12, %ymm12
+        vpxor	32(%rcx), %ymm11, %ymm11
+        vpxor	64(%rcx), %ymm10, %ymm10
+        vpxor	96(%rcx), %ymm11, %ymm11
+        vpxor	-96(%r8), %ymm14, %ymm14
+        vpxor	-64(%r8), %ymm13, %ymm13
+        vpxor	-32(%r8), %ymm12, %ymm12
+        vpxor	(%r8), %ymm13, %ymm13
+        vpxor	64(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm10, %ymm10
+        vpxor	128(%r8), %ymm14, %ymm14
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	(%rdi), %ymm6, %ymm11
+        vpxor	-32(%rdi), %ymm7, %ymm12
+        vpxor	-64(%rdi), %ymm8, %ymm13
+        vpxor	-96(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	352(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, (%rdi)
+        vmovdqu	%ymm2, -32(%rdi)
+        vmovdqu	%ymm3, -64(%rdi)
+        vmovdqu	%ymm4, -96(%rdi)
+        # Row 1
+        vpxor	(%r8), %ymm8, %ymm10
+        vpxor	128(%r8), %ymm9, %ymm11
+        vpxor	96(%r8), %ymm5, %ymm12
+        vpxor	64(%r8), %ymm6, %ymm13
+        vpxor	32(%r8), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%r8)
+        vmovdqu	%ymm1, 128(%r8)
+        vmovdqu	%ymm2, 96(%r8)
+        vmovdqu	%ymm3, 64(%r8)
+        vmovdqu	%ymm4, 32(%r8)
+        # Row 2
+        vpxor	96(%rcx), %ymm6, %ymm10
+        vpxor	-32(%r8), %ymm7, %ymm11
+        vpxor	-64(%r8), %ymm8, %ymm12
+        vpxor	-96(%r8), %ymm9, %ymm13
+        vpxor	128(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rcx)
+        vmovdqu	%ymm1, -32(%r8)
+        vmovdqu	%ymm2, -64(%r8)
+        vmovdqu	%ymm3, -96(%r8)
+        vmovdqu	%ymm4, 128(%rcx)
+        # Row 3
+        vpxor	-64(%rcx), %ymm9, %ymm10
+        vpxor	64(%rcx), %ymm5, %ymm11
+        vpxor	32(%rcx), %ymm6, %ymm12
+        vpxor	(%rcx), %ymm7, %ymm13
+        vpxor	-32(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rcx)
+        vmovdqu	%ymm1, 64(%rcx)
+        vmovdqu	%ymm2, 32(%rcx)
+        vmovdqu	%ymm3, (%rcx)
+        vmovdqu	%ymm4, -32(%rcx)
+        # Row 4
+        vpxor	32(%rdi), %ymm7, %ymm10
+        vpxor	-96(%rcx), %ymm8, %ymm11
+        vpxor	128(%rdi), %ymm9, %ymm12
+        vpxor	96(%rdi), %ymm5, %ymm13
+        vpxor	64(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rdi)
+        vmovdqu	%ymm1, -96(%rcx)
+        vmovdqu	%ymm2, 128(%rdi)
+        vmovdqu	%ymm3, 96(%rdi)
+        vmovdqu	%ymm4, 64(%rdi)
+        # Round 12
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm4, %ymm14
+        vpxor	-64(%rdi), %ymm3, %ymm13
+        vpxor	-32(%rdi), %ymm2, %ymm12
+        vpxor	(%rdi), %ymm1, %ymm11
+        vpxor	-64(%rcx), %ymm10, %ymm10
+        vpxor	-32(%rcx), %ymm14, %ymm14
+        vpxor	(%rcx), %ymm13, %ymm13
+        vpxor	32(%rcx), %ymm12, %ymm12
+        vpxor	64(%rcx), %ymm11, %ymm11
+        vpxor	96(%rcx), %ymm10, %ymm10
+        vpxor	128(%rcx), %ymm14, %ymm14
+        vpxor	-96(%r8), %ymm13, %ymm13
+        vpxor	-64(%r8), %ymm12, %ymm12
+        vpxor	-32(%r8), %ymm11, %ymm11
+        vpxor	(%r8), %ymm10, %ymm10
+        vpxor	32(%r8), %ymm14, %ymm14
+        vpxor	64(%r8), %ymm13, %ymm13
+        vpxor	96(%r8), %ymm12, %ymm12
+        vpxor	128(%r8), %ymm11, %ymm11
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	128(%r8), %ymm6, %ymm11
+        vpxor	-64(%r8), %ymm7, %ymm12
+        vpxor	(%rcx), %ymm8, %ymm13
+        vpxor	64(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	384(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 128(%r8)
+        vmovdqu	%ymm2, -64(%r8)
+        vmovdqu	%ymm3, (%rcx)
+        vmovdqu	%ymm4, 64(%rdi)
+        # Row 1
+        vpxor	-64(%rdi), %ymm8, %ymm10
+        vpxor	32(%r8), %ymm9, %ymm11
+        vpxor	96(%rcx), %ymm5, %ymm12
+        vpxor	64(%rcx), %ymm6, %ymm13
+        vpxor	128(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rdi)
+        vmovdqu	%ymm1, 32(%r8)
+        vmovdqu	%ymm2, 96(%rcx)
+        vmovdqu	%ymm3, 64(%rcx)
+        vmovdqu	%ymm4, 128(%rdi)
+        # Row 2
+        vpxor	(%rdi), %ymm6, %ymm10
+        vpxor	96(%r8), %ymm7, %ymm11
+        vpxor	-96(%r8), %ymm8, %ymm12
+        vpxor	-32(%rcx), %ymm9, %ymm13
+        vpxor	32(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rdi)
+        vmovdqu	%ymm1, 96(%r8)
+        vmovdqu	%ymm2, -96(%r8)
+        vmovdqu	%ymm3, -32(%rcx)
+        vmovdqu	%ymm4, 32(%rdi)
+        # Row 3
+        vpxor	-96(%rdi), %ymm9, %ymm10
+        vpxor	(%r8), %ymm5, %ymm11
+        vpxor	-32(%r8), %ymm6, %ymm12
+        vpxor	32(%rcx), %ymm7, %ymm13
+        vpxor	96(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rdi)
+        vmovdqu	%ymm1, (%r8)
+        vmovdqu	%ymm2, -32(%r8)
+        vmovdqu	%ymm3, 32(%rcx)
+        vmovdqu	%ymm4, 96(%rdi)
+        # Row 4
+        vpxor	-32(%rdi), %ymm7, %ymm10
+        vpxor	64(%r8), %ymm8, %ymm11
+        vpxor	128(%rcx), %ymm9, %ymm12
+        vpxor	-64(%rcx), %ymm5, %ymm13
+        vpxor	-96(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rdi)
+        vmovdqu	%ymm1, 64(%r8)
+        vmovdqu	%ymm2, 128(%rcx)
+        vmovdqu	%ymm3, -64(%rcx)
+        vmovdqu	%ymm4, -96(%rcx)
+        # Round 13
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm10, %ymm10
+        vpxor	-64(%rdi), %ymm10, %ymm10
+        vpxor	(%rdi), %ymm10, %ymm10
+        vpxor	32(%rdi), %ymm4, %ymm14
+        vpxor	64(%rdi), %ymm14, %ymm14
+        vpxor	96(%rdi), %ymm14, %ymm14
+        vpxor	128(%rdi), %ymm14, %ymm14
+        vpxor	-32(%rcx), %ymm3, %ymm13
+        vpxor	(%rcx), %ymm13, %ymm13
+        vpxor	32(%rcx), %ymm13, %ymm13
+        vpxor	64(%rcx), %ymm13, %ymm13
+        vpxor	96(%rcx), %ymm2, %ymm12
+        vpxor	-96(%r8), %ymm12, %ymm12
+        vpxor	-64(%r8), %ymm12, %ymm12
+        vpxor	-32(%r8), %ymm12, %ymm12
+        vpxor	(%r8), %ymm1, %ymm11
+        vpxor	32(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm11, %ymm11
+        vpxor	128(%r8), %ymm11, %ymm11
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	32(%r8), %ymm6, %ymm11
+        vpxor	-96(%r8), %ymm7, %ymm12
+        vpxor	32(%rcx), %ymm8, %ymm13
+        vpxor	-96(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	416(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 32(%r8)
+        vmovdqu	%ymm2, -96(%r8)
+        vmovdqu	%ymm3, 32(%rcx)
+        vmovdqu	%ymm4, -96(%rcx)
+        # Row 1
+        vpxor	(%rcx), %ymm8, %ymm10
+        vpxor	128(%rdi), %ymm9, %ymm11
+        vpxor	(%rdi), %ymm5, %ymm12
+        vpxor	(%r8), %ymm6, %ymm13
+        vpxor	128(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rcx)
+        vmovdqu	%ymm1, 128(%rdi)
+        vmovdqu	%ymm2, (%rdi)
+        vmovdqu	%ymm3, (%r8)
+        vmovdqu	%ymm4, 128(%rcx)
+        # Row 2
+        vpxor	128(%r8), %ymm6, %ymm10
+        vpxor	96(%rcx), %ymm7, %ymm11
+        vpxor	-32(%rcx), %ymm8, %ymm12
+        vpxor	96(%rdi), %ymm9, %ymm13
+        vpxor	-32(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%r8)
+        vmovdqu	%ymm1, 96(%rcx)
+        vmovdqu	%ymm2, -32(%rcx)
+        vmovdqu	%ymm3, 96(%rdi)
+        vmovdqu	%ymm4, -32(%rdi)
+        # Row 3
+        vpxor	64(%rdi), %ymm9, %ymm10
+        vpxor	-64(%rdi), %ymm5, %ymm11
+        vpxor	96(%r8), %ymm6, %ymm12
+        vpxor	-32(%r8), %ymm7, %ymm13
+        vpxor	-64(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rdi)
+        vmovdqu	%ymm1, -64(%rdi)
+        vmovdqu	%ymm2, 96(%r8)
+        vmovdqu	%ymm3, -32(%r8)
+        vmovdqu	%ymm4, -64(%rcx)
+        # Row 4
+        vpxor	-64(%r8), %ymm7, %ymm10
+        vpxor	64(%rcx), %ymm8, %ymm11
+        vpxor	32(%rdi), %ymm9, %ymm12
+        vpxor	-96(%rdi), %ymm5, %ymm13
+        vpxor	64(%r8), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%r8)
+        vmovdqu	%ymm1, 64(%rcx)
+        vmovdqu	%ymm2, 32(%rdi)
+        vmovdqu	%ymm3, -96(%rdi)
+        vmovdqu	%ymm4, 64(%r8)
+        # Round 14
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-64(%rdi), %ymm1, %ymm11
+        vpxor	-32(%rdi), %ymm4, %ymm14
+        vpxor	(%rdi), %ymm2, %ymm12
+        vpxor	64(%rdi), %ymm10, %ymm10
+        vpxor	96(%rdi), %ymm3, %ymm13
+        vpxor	128(%rdi), %ymm11, %ymm11
+        vpxor	-96(%rcx), %ymm14, %ymm14
+        vpxor	-64(%rcx), %ymm14, %ymm14
+        vpxor	-32(%rcx), %ymm12, %ymm12
+        vpxor	(%rcx), %ymm10, %ymm10
+        vpxor	32(%rcx), %ymm13, %ymm13
+        vpxor	96(%rcx), %ymm11, %ymm11
+        vpxor	128(%rcx), %ymm14, %ymm14
+        vpxor	-96(%r8), %ymm12, %ymm12
+        vpxor	-32(%r8), %ymm13, %ymm13
+        vpxor	(%r8), %ymm13, %ymm13
+        vpxor	32(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm12, %ymm12
+        vpxor	128(%r8), %ymm10, %ymm10
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	128(%rdi), %ymm6, %ymm11
+        vpxor	-32(%rcx), %ymm7, %ymm12
+        vpxor	-32(%r8), %ymm8, %ymm13
+        vpxor	64(%r8), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	448(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 128(%rdi)
+        vmovdqu	%ymm2, -32(%rcx)
+        vmovdqu	%ymm3, -32(%r8)
+        vmovdqu	%ymm4, 64(%r8)
+        # Row 1
+        vpxor	32(%rcx), %ymm8, %ymm10
+        vpxor	128(%rcx), %ymm9, %ymm11
+        vpxor	128(%r8), %ymm5, %ymm12
+        vpxor	-64(%rdi), %ymm6, %ymm13
+        vpxor	32(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rcx)
+        vmovdqu	%ymm1, 128(%rcx)
+        vmovdqu	%ymm2, 128(%r8)
+        vmovdqu	%ymm3, -64(%rdi)
+        vmovdqu	%ymm4, 32(%rdi)
+        # Row 2
+        vpxor	32(%r8), %ymm6, %ymm10
+        vpxor	(%rdi), %ymm7, %ymm11
+        vpxor	96(%rdi), %ymm8, %ymm12
+        vpxor	-64(%rcx), %ymm9, %ymm13
+        vpxor	-64(%r8), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%r8)
+        vmovdqu	%ymm1, (%rdi)
+        vmovdqu	%ymm2, 96(%rdi)
+        vmovdqu	%ymm3, -64(%rcx)
+        vmovdqu	%ymm4, -64(%r8)
+        # Row 3
+        vpxor	-96(%rcx), %ymm9, %ymm10
+        vpxor	(%rcx), %ymm5, %ymm11
+        vpxor	96(%rcx), %ymm6, %ymm12
+        vpxor	96(%r8), %ymm7, %ymm13
+        vpxor	-96(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rcx)
+        vmovdqu	%ymm1, (%rcx)
+        vmovdqu	%ymm2, 96(%rcx)
+        vmovdqu	%ymm3, 96(%r8)
+        vmovdqu	%ymm4, -96(%rdi)
+        # Row 4
+        vpxor	-96(%r8), %ymm7, %ymm10
+        vpxor	(%r8), %ymm8, %ymm11
+        vpxor	-32(%rdi), %ymm9, %ymm12
+        vpxor	64(%rdi), %ymm5, %ymm13
+        vpxor	64(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%r8)
+        vmovdqu	%ymm1, (%r8)
+        vmovdqu	%ymm2, -32(%rdi)
+        vmovdqu	%ymm3, 64(%rdi)
+        vmovdqu	%ymm4, 64(%rcx)
+        # Round 15
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm4, %ymm14
+        vpxor	-64(%rdi), %ymm3, %ymm13
+        vpxor	(%rdi), %ymm1, %ymm11
+        vpxor	32(%rdi), %ymm14, %ymm14
+        vpxor	96(%rdi), %ymm2, %ymm12
+        vpxor	128(%rdi), %ymm11, %ymm11
+        vpxor	-96(%rcx), %ymm10, %ymm10
+        vpxor	-64(%rcx), %ymm13, %ymm13
+        vpxor	-32(%rcx), %ymm12, %ymm12
+        vpxor	(%rcx), %ymm11, %ymm11
+        vpxor	32(%rcx), %ymm10, %ymm10
+        vpxor	96(%rcx), %ymm12, %ymm12
+        vpxor	128(%rcx), %ymm11, %ymm11
+        vpxor	-64(%r8), %ymm14, %ymm14
+        vpxor	-32(%r8), %ymm13, %ymm13
+        vpxor	32(%r8), %ymm10, %ymm10
+        vpxor	64(%r8), %ymm14, %ymm14
+        vpxor	96(%r8), %ymm13, %ymm13
+        vpxor	128(%r8), %ymm12, %ymm12
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	128(%rcx), %ymm6, %ymm11
+        vpxor	96(%rdi), %ymm7, %ymm12
+        vpxor	96(%r8), %ymm8, %ymm13
+        vpxor	64(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	480(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 128(%rcx)
+        vmovdqu	%ymm2, 96(%rdi)
+        vmovdqu	%ymm3, 96(%r8)
+        vmovdqu	%ymm4, 64(%rcx)
+        # Row 1
+        vpxor	-32(%r8), %ymm8, %ymm10
+        vpxor	32(%rdi), %ymm9, %ymm11
+        vpxor	32(%r8), %ymm5, %ymm12
+        vpxor	(%rcx), %ymm6, %ymm13
+        vpxor	-32(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%r8)
+        vmovdqu	%ymm1, 32(%rdi)
+        vmovdqu	%ymm2, 32(%r8)
+        vmovdqu	%ymm3, (%rcx)
+        vmovdqu	%ymm4, -32(%rdi)
+        # Row 2
+        vpxor	128(%rdi), %ymm6, %ymm10
+        vpxor	128(%r8), %ymm7, %ymm11
+        vpxor	-64(%rcx), %ymm8, %ymm12
+        vpxor	-96(%rdi), %ymm9, %ymm13
+        vpxor	-96(%r8), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rdi)
+        vmovdqu	%ymm1, 128(%r8)
+        vmovdqu	%ymm2, -64(%rcx)
+        vmovdqu	%ymm3, -96(%rdi)
+        vmovdqu	%ymm4, -96(%r8)
+        # Row 3
+        vpxor	64(%r8), %ymm9, %ymm10
+        vpxor	32(%rcx), %ymm5, %ymm11
+        vpxor	(%rdi), %ymm6, %ymm12
+        vpxor	96(%rcx), %ymm7, %ymm13
+        vpxor	64(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%r8)
+        vmovdqu	%ymm1, 32(%rcx)
+        vmovdqu	%ymm2, (%rdi)
+        vmovdqu	%ymm3, 96(%rcx)
+        vmovdqu	%ymm4, 64(%rdi)
+        # Row 4
+        vpxor	-32(%rcx), %ymm7, %ymm10
+        vpxor	-64(%rdi), %ymm8, %ymm11
+        vpxor	-64(%r8), %ymm9, %ymm12
+        vpxor	-96(%rcx), %ymm5, %ymm13
+        vpxor	(%r8), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rcx)
+        vmovdqu	%ymm1, -64(%rdi)
+        vmovdqu	%ymm2, -64(%r8)
+        vmovdqu	%ymm3, -96(%rcx)
+        vmovdqu	%ymm4, (%r8)
+        # Round 16
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm3, %ymm13
+        vpxor	-32(%rdi), %ymm4, %ymm14
+        vpxor	(%rdi), %ymm2, %ymm12
+        vpxor	32(%rdi), %ymm1, %ymm11
+        vpxor	64(%rdi), %ymm14, %ymm14
+        vpxor	96(%rdi), %ymm12, %ymm12
+        vpxor	128(%rdi), %ymm10, %ymm10
+        vpxor	-64(%rcx), %ymm12, %ymm12
+        vpxor	(%rcx), %ymm13, %ymm13
+        vpxor	32(%rcx), %ymm11, %ymm11
+        vpxor	64(%rcx), %ymm14, %ymm14
+        vpxor	96(%rcx), %ymm13, %ymm13
+        vpxor	128(%rcx), %ymm11, %ymm11
+        vpxor	-96(%r8), %ymm14, %ymm14
+        vpxor	-32(%r8), %ymm10, %ymm10
+        vpxor	32(%r8), %ymm12, %ymm12
+        vpxor	64(%r8), %ymm10, %ymm10
+        vpxor	96(%r8), %ymm13, %ymm13
+        vpxor	128(%r8), %ymm11, %ymm11
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	32(%rdi), %ymm6, %ymm11
+        vpxor	-64(%rcx), %ymm7, %ymm12
+        vpxor	96(%rcx), %ymm8, %ymm13
+        vpxor	(%r8), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	512(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 32(%rdi)
+        vmovdqu	%ymm2, -64(%rcx)
+        vmovdqu	%ymm3, 96(%rcx)
+        vmovdqu	%ymm4, (%r8)
+        # Row 1
+        vpxor	96(%r8), %ymm8, %ymm10
+        vpxor	-32(%rdi), %ymm9, %ymm11
+        vpxor	128(%rdi), %ymm5, %ymm12
+        vpxor	32(%rcx), %ymm6, %ymm13
+        vpxor	-64(%r8), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%r8)
+        vmovdqu	%ymm1, -32(%rdi)
+        vmovdqu	%ymm2, 128(%rdi)
+        vmovdqu	%ymm3, 32(%rcx)
+        vmovdqu	%ymm4, -64(%r8)
+        # Row 2
+        vpxor	128(%rcx), %ymm6, %ymm10
+        vpxor	32(%r8), %ymm7, %ymm11
+        vpxor	-96(%rdi), %ymm8, %ymm12
+        vpxor	64(%rdi), %ymm9, %ymm13
+        vpxor	-32(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rcx)
+        vmovdqu	%ymm1, 32(%r8)
+        vmovdqu	%ymm2, -96(%rdi)
+        vmovdqu	%ymm3, 64(%rdi)
+        vmovdqu	%ymm4, -32(%rcx)
+        # Row 3
+        vpxor	64(%rcx), %ymm9, %ymm10
+        vpxor	-32(%r8), %ymm5, %ymm11
+        vpxor	128(%r8), %ymm6, %ymm12
+        vpxor	(%rdi), %ymm7, %ymm13
+        vpxor	-96(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rcx)
+        vmovdqu	%ymm1, -32(%r8)
+        vmovdqu	%ymm2, 128(%r8)
+        vmovdqu	%ymm3, (%rdi)
+        vmovdqu	%ymm4, -96(%rcx)
+        # Row 4
+        vpxor	96(%rdi), %ymm7, %ymm10
+        vpxor	(%rcx), %ymm8, %ymm11
+        vpxor	-96(%r8), %ymm9, %ymm12
+        vpxor	64(%r8), %ymm5, %ymm13
+        vpxor	-64(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rdi)
+        vmovdqu	%ymm1, (%rcx)
+        vmovdqu	%ymm2, -96(%r8)
+        vmovdqu	%ymm3, 64(%r8)
+        vmovdqu	%ymm4, -64(%rdi)
+        # Round 17
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm2, %ymm12
+        vpxor	-32(%rdi), %ymm1, %ymm11
+        vpxor	(%rdi), %ymm3, %ymm13
+        vpxor	32(%rdi), %ymm11, %ymm11
+        vpxor	64(%rdi), %ymm13, %ymm13
+        vpxor	128(%rdi), %ymm12, %ymm12
+        vpxor	-96(%rcx), %ymm4, %ymm14
+        vpxor	-64(%rcx), %ymm12, %ymm12
+        vpxor	-32(%rcx), %ymm14, %ymm14
+        vpxor	32(%rcx), %ymm13, %ymm13
+        vpxor	64(%rcx), %ymm10, %ymm10
+        vpxor	96(%rcx), %ymm13, %ymm13
+        vpxor	128(%rcx), %ymm10, %ymm10
+        vpxor	-64(%r8), %ymm14, %ymm14
+        vpxor	-32(%r8), %ymm11, %ymm11
+        vpxor	(%r8), %ymm14, %ymm14
+        vpxor	32(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm10, %ymm10
+        vpxor	128(%r8), %ymm12, %ymm12
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-32(%rdi), %ymm6, %ymm11
+        vpxor	-96(%rdi), %ymm7, %ymm12
+        vpxor	(%rdi), %ymm8, %ymm13
+        vpxor	-64(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	544(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -32(%rdi)
+        vmovdqu	%ymm2, -96(%rdi)
+        vmovdqu	%ymm3, (%rdi)
+        vmovdqu	%ymm4, -64(%rdi)
+        # Row 1
+        vpxor	96(%rcx), %ymm8, %ymm10
+        vpxor	-64(%r8), %ymm9, %ymm11
+        vpxor	128(%rcx), %ymm5, %ymm12
+        vpxor	-32(%r8), %ymm6, %ymm13
+        vpxor	-96(%r8), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rcx)
+        vmovdqu	%ymm1, -64(%r8)
+        vmovdqu	%ymm2, 128(%rcx)
+        vmovdqu	%ymm3, -32(%r8)
+        vmovdqu	%ymm4, -96(%r8)
+        # Row 2
+        vpxor	32(%rdi), %ymm6, %ymm10
+        vpxor	128(%rdi), %ymm7, %ymm11
+        vpxor	64(%rdi), %ymm8, %ymm12
+        vpxor	-96(%rcx), %ymm9, %ymm13
+        vpxor	96(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rdi)
+        vmovdqu	%ymm1, 128(%rdi)
+        vmovdqu	%ymm2, 64(%rdi)
+        vmovdqu	%ymm3, -96(%rcx)
+        vmovdqu	%ymm4, 96(%rdi)
+        # Row 3
+        vpxor	(%r8), %ymm9, %ymm10
+        vpxor	96(%r8), %ymm5, %ymm11
+        vpxor	32(%r8), %ymm6, %ymm12
+        vpxor	128(%r8), %ymm7, %ymm13
+        vpxor	64(%r8), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%r8)
+        vmovdqu	%ymm1, 96(%r8)
+        vmovdqu	%ymm2, 32(%r8)
+        vmovdqu	%ymm3, 128(%r8)
+        vmovdqu	%ymm4, 64(%r8)
+        # Row 4
+        vpxor	-64(%rcx), %ymm7, %ymm10
+        vpxor	32(%rcx), %ymm8, %ymm11
+        vpxor	-32(%rcx), %ymm9, %ymm12
+        vpxor	64(%rcx), %ymm5, %ymm13
+        vpxor	(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rcx)
+        vmovdqu	%ymm1, 32(%rcx)
+        vmovdqu	%ymm2, -32(%rcx)
+        vmovdqu	%ymm3, 64(%rcx)
+        vmovdqu	%ymm4, (%rcx)
+        # Round 18
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm2, %ymm12
+        vpxor	-64(%rdi), %ymm4, %ymm14
+        vpxor	-32(%rdi), %ymm1, %ymm11
+        vpxor	(%rdi), %ymm3, %ymm13
+        vpxor	32(%rdi), %ymm10, %ymm10
+        vpxor	64(%rdi), %ymm12, %ymm12
+        vpxor	96(%rdi), %ymm14, %ymm14
+        vpxor	128(%rdi), %ymm11, %ymm11
+        vpxor	-96(%rcx), %ymm13, %ymm13
+        vpxor	96(%rcx), %ymm10, %ymm10
+        vpxor	128(%rcx), %ymm12, %ymm12
+        vpxor	-96(%r8), %ymm14, %ymm14
+        vpxor	-64(%r8), %ymm11, %ymm11
+        vpxor	-32(%r8), %ymm13, %ymm13
+        vpxor	(%r8), %ymm10, %ymm10
+        vpxor	32(%r8), %ymm12, %ymm12
+        vpxor	64(%r8), %ymm14, %ymm14
+        vpxor	96(%r8), %ymm11, %ymm11
+        vpxor	128(%r8), %ymm13, %ymm13
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-64(%r8), %ymm6, %ymm11
+        vpxor	64(%rdi), %ymm7, %ymm12
+        vpxor	128(%r8), %ymm8, %ymm13
+        vpxor	(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	576(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -64(%r8)
+        vmovdqu	%ymm2, 64(%rdi)
+        vmovdqu	%ymm3, 128(%r8)
+        vmovdqu	%ymm4, (%rcx)
+        # Row 1
+        vpxor	(%rdi), %ymm8, %ymm10
+        vpxor	-96(%r8), %ymm9, %ymm11
+        vpxor	32(%rdi), %ymm5, %ymm12
+        vpxor	96(%r8), %ymm6, %ymm13
+        vpxor	-32(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rdi)
+        vmovdqu	%ymm1, -96(%r8)
+        vmovdqu	%ymm2, 32(%rdi)
+        vmovdqu	%ymm3, 96(%r8)
+        vmovdqu	%ymm4, -32(%rcx)
+        # Row 2
+        vpxor	-32(%rdi), %ymm6, %ymm10
+        vpxor	128(%rcx), %ymm7, %ymm11
+        vpxor	-96(%rcx), %ymm8, %ymm12
+        vpxor	64(%r8), %ymm9, %ymm13
+        vpxor	-64(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rdi)
+        vmovdqu	%ymm1, 128(%rcx)
+        vmovdqu	%ymm2, -96(%rcx)
+        vmovdqu	%ymm3, 64(%r8)
+        vmovdqu	%ymm4, -64(%rcx)
+        # Row 3
+        vpxor	-64(%rdi), %ymm9, %ymm10
+        vpxor	96(%rcx), %ymm5, %ymm11
+        vpxor	128(%rdi), %ymm6, %ymm12
+        vpxor	32(%r8), %ymm7, %ymm13
+        vpxor	64(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rdi)
+        vmovdqu	%ymm1, 96(%rcx)
+        vmovdqu	%ymm2, 128(%rdi)
+        vmovdqu	%ymm3, 32(%r8)
+        vmovdqu	%ymm4, 64(%rcx)
+        # Row 4
+        vpxor	-96(%rdi), %ymm7, %ymm10
+        vpxor	-32(%r8), %ymm8, %ymm11
+        vpxor	96(%rdi), %ymm9, %ymm12
+        vpxor	(%r8), %ymm5, %ymm13
+        vpxor	32(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rdi)
+        vmovdqu	%ymm1, -32(%r8)
+        vmovdqu	%ymm2, 96(%rdi)
+        vmovdqu	%ymm3, (%r8)
+        vmovdqu	%ymm4, 32(%rcx)
+        # Round 19
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-64(%rdi), %ymm10, %ymm10
+        vpxor	-32(%rdi), %ymm10, %ymm10
+        vpxor	(%rdi), %ymm10, %ymm10
+        vpxor	32(%rdi), %ymm2, %ymm12
+        vpxor	64(%rdi), %ymm12, %ymm12
+        vpxor	128(%rdi), %ymm12, %ymm12
+        vpxor	-96(%rcx), %ymm12, %ymm12
+        vpxor	-64(%rcx), %ymm4, %ymm14
+        vpxor	-32(%rcx), %ymm14, %ymm14
+        vpxor	(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm14, %ymm14
+        vpxor	96(%rcx), %ymm1, %ymm11
+        vpxor	128(%rcx), %ymm11, %ymm11
+        vpxor	-96(%r8), %ymm11, %ymm11
+        vpxor	-64(%r8), %ymm11, %ymm11
+        vpxor	32(%r8), %ymm3, %ymm13
+        vpxor	64(%r8), %ymm13, %ymm13
+        vpxor	96(%r8), %ymm13, %ymm13
+        vpxor	128(%r8), %ymm13, %ymm13
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-96(%r8), %ymm6, %ymm11
+        vpxor	-96(%rcx), %ymm7, %ymm12
+        vpxor	32(%r8), %ymm8, %ymm13
+        vpxor	32(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	608(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -96(%r8)
+        vmovdqu	%ymm2, -96(%rcx)
+        vmovdqu	%ymm3, 32(%r8)
+        vmovdqu	%ymm4, 32(%rcx)
+        # Row 1
+        vpxor	128(%r8), %ymm8, %ymm10
+        vpxor	-32(%rcx), %ymm9, %ymm11
+        vpxor	-32(%rdi), %ymm5, %ymm12
+        vpxor	96(%rcx), %ymm6, %ymm13
+        vpxor	96(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%r8)
+        vmovdqu	%ymm1, -32(%rcx)
+        vmovdqu	%ymm2, -32(%rdi)
+        vmovdqu	%ymm3, 96(%rcx)
+        vmovdqu	%ymm4, 96(%rdi)
+        # Row 2
+        vpxor	-64(%r8), %ymm6, %ymm10
+        vpxor	32(%rdi), %ymm7, %ymm11
+        vpxor	64(%r8), %ymm8, %ymm12
+        vpxor	64(%rcx), %ymm9, %ymm13
+        vpxor	-96(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%r8)
+        vmovdqu	%ymm1, 32(%rdi)
+        vmovdqu	%ymm2, 64(%r8)
+        vmovdqu	%ymm3, 64(%rcx)
+        vmovdqu	%ymm4, -96(%rdi)
+        # Row 3
+        vpxor	(%rcx), %ymm9, %ymm10
+        vpxor	(%rdi), %ymm5, %ymm11
+        vpxor	128(%rcx), %ymm6, %ymm12
+        vpxor	128(%rdi), %ymm7, %ymm13
+        vpxor	(%r8), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rcx)
+        vmovdqu	%ymm1, (%rdi)
+        vmovdqu	%ymm2, 128(%rcx)
+        vmovdqu	%ymm3, 128(%rdi)
+        vmovdqu	%ymm4, (%r8)
+        # Row 4
+        vpxor	64(%rdi), %ymm7, %ymm10
+        vpxor	96(%r8), %ymm8, %ymm11
+        vpxor	-64(%rcx), %ymm9, %ymm12
+        vpxor	-64(%rdi), %ymm5, %ymm13
+        vpxor	-32(%r8), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rdi)
+        vmovdqu	%ymm1, 96(%r8)
+        vmovdqu	%ymm2, -64(%rcx)
+        vmovdqu	%ymm3, -64(%rdi)
+        vmovdqu	%ymm4, -32(%r8)
+        # Round 20
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm4, %ymm14
+        vpxor	-32(%rdi), %ymm2, %ymm12
+        vpxor	(%rdi), %ymm1, %ymm11
+        vpxor	32(%rdi), %ymm11, %ymm11
+        vpxor	96(%rdi), %ymm14, %ymm14
+        vpxor	128(%rdi), %ymm3, %ymm13
+        vpxor	-96(%rcx), %ymm12, %ymm12
+        vpxor	-32(%rcx), %ymm11, %ymm11
+        vpxor	(%rcx), %ymm10, %ymm10
+        vpxor	32(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm13, %ymm13
+        vpxor	96(%rcx), %ymm13, %ymm13
+        vpxor	128(%rcx), %ymm12, %ymm12
+        vpxor	-96(%r8), %ymm11, %ymm11
+        vpxor	-64(%r8), %ymm10, %ymm10
+        vpxor	(%r8), %ymm14, %ymm14
+        vpxor	32(%r8), %ymm13, %ymm13
+        vpxor	64(%r8), %ymm12, %ymm12
+        vpxor	128(%r8), %ymm10, %ymm10
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-32(%rcx), %ymm6, %ymm11
+        vpxor	64(%r8), %ymm7, %ymm12
+        vpxor	128(%rdi), %ymm8, %ymm13
+        vpxor	-32(%r8), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	640(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -32(%rcx)
+        vmovdqu	%ymm2, 64(%r8)
+        vmovdqu	%ymm3, 128(%rdi)
+        vmovdqu	%ymm4, -32(%r8)
+        # Row 1
+        vpxor	32(%r8), %ymm8, %ymm10
+        vpxor	96(%rdi), %ymm9, %ymm11
+        vpxor	-64(%r8), %ymm5, %ymm12
+        vpxor	(%rdi), %ymm6, %ymm13
+        vpxor	-64(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%r8)
+        vmovdqu	%ymm1, 96(%rdi)
+        vmovdqu	%ymm2, -64(%r8)
+        vmovdqu	%ymm3, (%rdi)
+        vmovdqu	%ymm4, -64(%rcx)
+        # Row 2
+        vpxor	-96(%r8), %ymm6, %ymm10
+        vpxor	-32(%rdi), %ymm7, %ymm11
+        vpxor	64(%rcx), %ymm8, %ymm12
+        vpxor	(%r8), %ymm9, %ymm13
+        vpxor	64(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%r8)
+        vmovdqu	%ymm1, -32(%rdi)
+        vmovdqu	%ymm2, 64(%rcx)
+        vmovdqu	%ymm3, (%r8)
+        vmovdqu	%ymm4, 64(%rdi)
+        # Row 3
+        vpxor	32(%rcx), %ymm9, %ymm10
+        vpxor	128(%r8), %ymm5, %ymm11
+        vpxor	32(%rdi), %ymm6, %ymm12
+        vpxor	128(%rcx), %ymm7, %ymm13
+        vpxor	-64(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rcx)
+        vmovdqu	%ymm1, 128(%r8)
+        vmovdqu	%ymm2, 32(%rdi)
+        vmovdqu	%ymm3, 128(%rcx)
+        vmovdqu	%ymm4, -64(%rdi)
+        # Row 4
+        vpxor	-96(%rcx), %ymm7, %ymm10
+        vpxor	96(%rcx), %ymm8, %ymm11
+        vpxor	-96(%rdi), %ymm9, %ymm12
+        vpxor	(%rcx), %ymm5, %ymm13
+        vpxor	96(%r8), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rcx)
+        vmovdqu	%ymm1, 96(%rcx)
+        vmovdqu	%ymm2, -96(%rdi)
+        vmovdqu	%ymm3, (%rcx)
+        vmovdqu	%ymm4, 96(%r8)
+        # Round 21
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-64(%rdi), %ymm4, %ymm14
+        vpxor	-32(%rdi), %ymm1, %ymm11
+        vpxor	(%rdi), %ymm3, %ymm13
+        vpxor	32(%rdi), %ymm2, %ymm12
+        vpxor	64(%rdi), %ymm14, %ymm14
+        vpxor	96(%rdi), %ymm11, %ymm11
+        vpxor	128(%rdi), %ymm13, %ymm13
+        vpxor	-64(%rcx), %ymm14, %ymm14
+        vpxor	-32(%rcx), %ymm11, %ymm11
+        vpxor	32(%rcx), %ymm10, %ymm10
+        vpxor	64(%rcx), %ymm12, %ymm12
+        vpxor	128(%rcx), %ymm13, %ymm13
+        vpxor	-96(%r8), %ymm10, %ymm10
+        vpxor	-64(%r8), %ymm12, %ymm12
+        vpxor	-32(%r8), %ymm14, %ymm14
+        vpxor	(%r8), %ymm13, %ymm13
+        vpxor	32(%r8), %ymm10, %ymm10
+        vpxor	64(%r8), %ymm12, %ymm12
+        vpxor	128(%r8), %ymm11, %ymm11
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	96(%rdi), %ymm6, %ymm11
+        vpxor	64(%rcx), %ymm7, %ymm12
+        vpxor	128(%rcx), %ymm8, %ymm13
+        vpxor	96(%r8), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	672(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 96(%rdi)
+        vmovdqu	%ymm2, 64(%rcx)
+        vmovdqu	%ymm3, 128(%rcx)
+        vmovdqu	%ymm4, 96(%r8)
+        # Row 1
+        vpxor	128(%rdi), %ymm8, %ymm10
+        vpxor	-64(%rcx), %ymm9, %ymm11
+        vpxor	-96(%r8), %ymm5, %ymm12
+        vpxor	128(%r8), %ymm6, %ymm13
+        vpxor	-96(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rdi)
+        vmovdqu	%ymm1, -64(%rcx)
+        vmovdqu	%ymm2, -96(%r8)
+        vmovdqu	%ymm3, 128(%r8)
+        vmovdqu	%ymm4, -96(%rdi)
+        # Row 2
+        vpxor	-32(%rcx), %ymm6, %ymm10
+        vpxor	-64(%r8), %ymm7, %ymm11
+        vpxor	(%r8), %ymm8, %ymm12
+        vpxor	-64(%rdi), %ymm9, %ymm13
+        vpxor	-96(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rcx)
+        vmovdqu	%ymm1, -64(%r8)
+        vmovdqu	%ymm2, (%r8)
+        vmovdqu	%ymm3, -64(%rdi)
+        vmovdqu	%ymm4, -96(%rcx)
+        # Row 3
+        vpxor	-32(%r8), %ymm9, %ymm10
+        vpxor	32(%r8), %ymm5, %ymm11
+        vpxor	-32(%rdi), %ymm6, %ymm12
+        vpxor	32(%rdi), %ymm7, %ymm13
+        vpxor	(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%r8)
+        vmovdqu	%ymm1, 32(%r8)
+        vmovdqu	%ymm2, -32(%rdi)
+        vmovdqu	%ymm3, 32(%rdi)
+        vmovdqu	%ymm4, (%rcx)
+        # Row 4
+        vpxor	64(%r8), %ymm7, %ymm10
+        vpxor	(%rdi), %ymm8, %ymm11
+        vpxor	64(%rdi), %ymm9, %ymm12
+        vpxor	32(%rcx), %ymm5, %ymm13
+        vpxor	96(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%r8)
+        vmovdqu	%ymm1, (%rdi)
+        vmovdqu	%ymm2, 64(%rdi)
+        vmovdqu	%ymm3, 32(%rcx)
+        vmovdqu	%ymm4, 96(%rcx)
+        # Round 22
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm4, %ymm14
+        vpxor	-64(%rdi), %ymm3, %ymm13
+        vpxor	-32(%rdi), %ymm2, %ymm12
+        vpxor	32(%rdi), %ymm13, %ymm13
+        vpxor	96(%rdi), %ymm1, %ymm11
+        vpxor	128(%rdi), %ymm10, %ymm10
+        vpxor	-96(%rcx), %ymm14, %ymm14
+        vpxor	-64(%rcx), %ymm11, %ymm11
+        vpxor	-32(%rcx), %ymm10, %ymm10
+        vpxor	(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm12, %ymm12
+        vpxor	128(%rcx), %ymm13, %ymm13
+        vpxor	-96(%r8), %ymm12, %ymm12
+        vpxor	-64(%r8), %ymm11, %ymm11
+        vpxor	-32(%r8), %ymm10, %ymm10
+        vpxor	(%r8), %ymm12, %ymm12
+        vpxor	32(%r8), %ymm11, %ymm11
+        vpxor	96(%r8), %ymm14, %ymm14
+        vpxor	128(%r8), %ymm13, %ymm13
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-64(%rcx), %ymm6, %ymm11
+        vpxor	(%r8), %ymm7, %ymm12
+        vpxor	32(%rdi), %ymm8, %ymm13
+        vpxor	96(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	704(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -64(%rcx)
+        vmovdqu	%ymm2, (%r8)
+        vmovdqu	%ymm3, 32(%rdi)
+        vmovdqu	%ymm4, 96(%rcx)
+        # Row 1
+        vpxor	128(%rcx), %ymm8, %ymm10
+        vpxor	-96(%rdi), %ymm9, %ymm11
+        vpxor	-32(%rcx), %ymm5, %ymm12
+        vpxor	32(%r8), %ymm6, %ymm13
+        vpxor	64(%rdi), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rcx)
+        vmovdqu	%ymm1, -96(%rdi)
+        vmovdqu	%ymm2, -32(%rcx)
+        vmovdqu	%ymm3, 32(%r8)
+        vmovdqu	%ymm4, 64(%rdi)
+        # Row 2
+        vpxor	96(%rdi), %ymm6, %ymm10
+        vpxor	-96(%r8), %ymm7, %ymm11
+        vpxor	-64(%rdi), %ymm8, %ymm12
+        vpxor	(%rcx), %ymm9, %ymm13
+        vpxor	64(%r8), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rdi)
+        vmovdqu	%ymm1, -96(%r8)
+        vmovdqu	%ymm2, -64(%rdi)
+        vmovdqu	%ymm3, (%rcx)
+        vmovdqu	%ymm4, 64(%r8)
+        # Row 3
+        vpxor	96(%r8), %ymm9, %ymm10
+        vpxor	128(%rdi), %ymm5, %ymm11
+        vpxor	-64(%r8), %ymm6, %ymm12
+        vpxor	-32(%rdi), %ymm7, %ymm13
+        vpxor	32(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%r8)
+        vmovdqu	%ymm1, 128(%rdi)
+        vmovdqu	%ymm2, -64(%r8)
+        vmovdqu	%ymm3, -32(%rdi)
+        vmovdqu	%ymm4, 32(%rcx)
+        # Row 4
+        vpxor	64(%rcx), %ymm7, %ymm10
+        vpxor	128(%r8), %ymm8, %ymm11
+        vpxor	-96(%rcx), %ymm9, %ymm12
+        vpxor	-32(%r8), %ymm5, %ymm13
+        vpxor	(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rcx)
+        vmovdqu	%ymm1, 128(%r8)
+        vmovdqu	%ymm2, -96(%rcx)
+        vmovdqu	%ymm3, -32(%r8)
+        vmovdqu	%ymm4, (%rdi)
+        # Round 23
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm1, %ymm11
+        vpxor	-64(%rdi), %ymm2, %ymm12
+        vpxor	-32(%rdi), %ymm3, %ymm13
+        vpxor	32(%rdi), %ymm13, %ymm13
+        vpxor	64(%rdi), %ymm4, %ymm14
+        vpxor	96(%rdi), %ymm10, %ymm10
+        vpxor	128(%rdi), %ymm11, %ymm11
+        vpxor	-64(%rcx), %ymm11, %ymm11
+        vpxor	-32(%rcx), %ymm12, %ymm12
+        vpxor	(%rcx), %ymm13, %ymm13
+        vpxor	32(%rcx), %ymm14, %ymm14
+        vpxor	96(%rcx), %ymm14, %ymm14
+        vpxor	128(%rcx), %ymm10, %ymm10
+        vpxor	-96(%r8), %ymm11, %ymm11
+        vpxor	-64(%r8), %ymm12, %ymm12
+        vpxor	(%r8), %ymm12, %ymm12
+        vpxor	32(%r8), %ymm13, %ymm13
+        vpxor	64(%r8), %ymm14, %ymm14
+        vpxor	96(%r8), %ymm10, %ymm10
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-96(%rdi), %ymm6, %ymm11
+        vpxor	-64(%rdi), %ymm7, %ymm12
+        vpxor	-32(%rdi), %ymm8, %ymm13
+        vpxor	(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	736(%rax), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -96(%rdi)
+        vmovdqu	%ymm2, -64(%rdi)
+        vmovdqu	%ymm3, -32(%rdi)
+        vmovdqu	%ymm4, (%rdi)
+        # Row 1
+        vpxor	32(%rdi), %ymm8, %ymm10
+        vpxor	64(%rdi), %ymm9, %ymm11
+        vpxor	96(%rdi), %ymm5, %ymm12
+        vpxor	128(%rdi), %ymm6, %ymm13
+        vpxor	-96(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rdi)
+        vmovdqu	%ymm1, 64(%rdi)
+        vmovdqu	%ymm2, 96(%rdi)
+        vmovdqu	%ymm3, 128(%rdi)
+        vmovdqu	%ymm4, -96(%rcx)
+        # Row 2
+        vpxor	-64(%rcx), %ymm6, %ymm10
+        vpxor	-32(%rcx), %ymm7, %ymm11
+        vpxor	(%rcx), %ymm8, %ymm12
+        vpxor	32(%rcx), %ymm9, %ymm13
+        vpxor	64(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rcx)
+        vmovdqu	%ymm1, -32(%rcx)
+        vmovdqu	%ymm2, (%rcx)
+        vmovdqu	%ymm3, 32(%rcx)
+        vmovdqu	%ymm4, 64(%rcx)
+        # Row 3
+        vpxor	96(%rcx), %ymm9, %ymm10
+        vpxor	128(%rcx), %ymm5, %ymm11
+        vpxor	-96(%r8), %ymm6, %ymm12
+        vpxor	-64(%r8), %ymm7, %ymm13
+        vpxor	-32(%r8), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 96(%rcx)
+        vmovdqu	%ymm1, 128(%rcx)
+        vmovdqu	%ymm2, -96(%r8)
+        vmovdqu	%ymm3, -64(%r8)
+        vmovdqu	%ymm4, -32(%r8)
+        # Row 4
+        vpxor	(%r8), %ymm7, %ymm10
+        vpxor	32(%r8), %ymm8, %ymm11
+        vpxor	64(%r8), %ymm9, %ymm12
+        vpxor	96(%r8), %ymm5, %ymm13
+        vpxor	128(%r8), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%r8)
+        vmovdqu	%ymm1, 32(%r8)
+        vmovdqu	%ymm2, 64(%r8)
+        vmovdqu	%ymm3, 96(%r8)
+        vmovdqu	%ymm4, 128(%r8)
+        subq	$0x80, %rdi
+        vmovdqu	%ymm15, (%rdi)
+        leaq	(%rdi), %r14
+        movq	$21, %r13
+L_sha3_blocksx4_out_avx2_word:
+        movq	(%r14), %r15
+        movq	%r15, (%rsi)
+        movq	8(%r14), %r15
+        movq	%r15, (%r9)
+        movq	16(%r14), %r15
+        movq	%r15, (%r10)
+        movq	24(%r14), %r15
+        movq	%r15, (%r11)
+        addq	$32, %r14
+        addq	$8, %rsi
+        addq	$8, %r9
+        addq	$8, %r10
+        addq	$8, %r11
+        subq	$0x01, %r12
+        jz	L_sha3_blocksx4_out_avx2_done
+        subq	$0x01, %r13
+        jnz	L_sha3_blocksx4_out_avx2_word
+        jmp	L_sha3_blocksx4_out_avx2_block
+L_sha3_blocksx4_out_avx2_done:
+        vzeroupper
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	sha3_blocksx4_out_avx2,.-sha3_blocksx4_out_avx2
+#endif /* __APPLE__ */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_MLKEM
+#ifndef __APPLE__
+.data
+#else
+.section	__DATA,__data
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.align	32
+#else
+.p2align	5
+#endif /* __APPLE__ */
+L_sha3_256_blockx4_seed_avx2_end_mark:
+.quad	0x8000000000000000,0x8000000000000000
+.quad	0x8000000000000000,0x8000000000000000
+#ifndef __APPLE__
+.text
+.globl	sha3_256_blocksx4_seed_avx2
+.type	sha3_256_blocksx4_seed_avx2,@function
+.align	16
+sha3_256_blocksx4_seed_avx2:
+#else
+.section	__TEXT,__text
+.globl	_sha3_256_blocksx4_seed_avx2
+.p2align	4
+_sha3_256_blocksx4_seed_avx2:
+#endif /* __APPLE__ */
+        leaq	L_sha3_x4_avx2_r(%rip), %rdx
+        movq	%rdi, %rax
+        movq	%rdi, %rcx
+        vpbroadcastq	(%rsi), %ymm15
+        addq	$0x80, %rdi
+        vpbroadcastq	8(%rsi), %ymm11
+        addq	$0x180, %rax
+        vpbroadcastq	16(%rsi), %ymm12
+        addq	$0x280, %rcx
+        vpbroadcastq	24(%rsi), %ymm13
+        vmovdqu	L_sha3_256_blockx4_seed_avx2_end_mark(%rip), %ymm5
+        vpxor	%ymm6, %ymm6, %ymm6
+        vmovdqu	%ymm11, -96(%rdi)
+        vmovdqu	%ymm12, -64(%rdi)
+        vmovdqu	%ymm13, -32(%rdi)
+        vmovdqu	(%rdi), %ymm14
+        vmovdqu	%ymm6, 32(%rdi)
+        vmovdqu	%ymm6, 64(%rdi)
+        vmovdqu	%ymm6, 96(%rdi)
+        vmovdqu	%ymm6, 128(%rdi)
+        vmovdqu	%ymm6, -96(%rax)
+        vmovdqu	%ymm6, -64(%rax)
+        vmovdqu	%ymm6, -32(%rax)
+        vmovdqu	%ymm6, (%rax)
+        vmovdqu	%ymm6, 32(%rax)
+        vmovdqu	%ymm6, 64(%rax)
+        vmovdqu	%ymm6, 96(%rax)
+        vmovdqu	%ymm5, 128(%rax)
+        vmovdqu	%ymm6, -96(%rcx)
+        vmovdqu	%ymm6, -64(%rcx)
+        vmovdqu	%ymm6, -32(%rcx)
+        vmovdqu	%ymm6, (%rcx)
+        vmovdqu	%ymm6, 32(%rcx)
+        vmovdqu	%ymm6, 64(%rcx)
+        vmovdqu	%ymm6, 96(%rcx)
+        vmovdqu	%ymm6, 128(%rcx)
+        vmovdqu	%ymm15, %ymm10
+        vpxor	%ymm5, %ymm11, %ymm11
+        # Round 0
+        # Calc b[0..4]
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	64(%rdi), %ymm6, %ymm11
+        vpxor	(%rax), %ymm7, %ymm12
+        vpxor	-64(%rcx), %ymm8, %ymm13
+        vpxor	128(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	(%rdx), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 64(%rdi)
+        vmovdqu	%ymm2, (%rax)
+        vmovdqu	%ymm3, -64(%rcx)
+        vmovdqu	%ymm4, 128(%rcx)
+        # Row 1
+        vpxor	-32(%rdi), %ymm8, %ymm10
+        vpxor	-96(%rax), %ymm9, %ymm11
+        vpxor	-64(%rax), %ymm5, %ymm12
+        vpxor	128(%rax), %ymm6, %ymm13
+        vpxor	64(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -32(%rdi)
+        vmovdqu	%ymm1, -96(%rax)
+        vmovdqu	%ymm2, -64(%rax)
+        vmovdqu	%ymm3, 128(%rax)
+        vmovdqu	%ymm4, 64(%rcx)
+        # Row 2
+        vpxor	-96(%rdi), %ymm6, %ymm10
+        vpxor	96(%rdi), %ymm7, %ymm11
+        vpxor	32(%rax), %ymm8, %ymm12
+        vpxor	-32(%rcx), %ymm9, %ymm13
+        vpxor	(%rcx), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rdi)
+        vmovdqu	%ymm1, 96(%rdi)
+        vmovdqu	%ymm2, 32(%rax)
+        vmovdqu	%ymm3, -32(%rcx)
+        vmovdqu	%ymm4, (%rcx)
+        # Row 3
+        vpxor	(%rdi), %ymm9, %ymm10
+        vpxor	32(%rdi), %ymm5, %ymm11
+        vpxor	-32(%rax), %ymm6, %ymm12
+        vpxor	-96(%rcx), %ymm7, %ymm13
+        vpxor	96(%rcx), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rdi)
+        vmovdqu	%ymm1, 32(%rdi)
+        vmovdqu	%ymm2, -32(%rax)
+        vmovdqu	%ymm3, -96(%rcx)
+        vmovdqu	%ymm4, 96(%rcx)
+        # Row 4
+        vpxor	-64(%rdi), %ymm7, %ymm10
+        vpxor	128(%rdi), %ymm8, %ymm11
+        vpxor	64(%rax), %ymm9, %ymm12
+        vpxor	96(%rax), %ymm5, %ymm13
+        vpxor	32(%rcx), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rdi)
+        vmovdqu	%ymm1, 128(%rdi)
+        vmovdqu	%ymm2, 64(%rax)
+        vmovdqu	%ymm3, 96(%rax)
+        vmovdqu	%ymm4, 32(%rcx)
+        # Round 1
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm10, %ymm10
+        vpxor	-32(%rdi), %ymm10, %ymm10
+        vpxor	(%rdi), %ymm10, %ymm10
+        vpxor	32(%rdi), %ymm1, %ymm11
+        vpxor	64(%rdi), %ymm11, %ymm11
+        vpxor	96(%rdi), %ymm11, %ymm11
+        vpxor	-96(%rax), %ymm11, %ymm11
+        vpxor	-64(%rax), %ymm2, %ymm12
+        vpxor	-32(%rax), %ymm12, %ymm12
+        vpxor	(%rax), %ymm12, %ymm12
+        vpxor	32(%rax), %ymm12, %ymm12
+        vpxor	128(%rax), %ymm3, %ymm13
+        vpxor	-96(%rcx), %ymm13, %ymm13
+        vpxor	-64(%rcx), %ymm13, %ymm13
+        vpxor	-32(%rcx), %ymm13, %ymm13
+        vpxor	(%rcx), %ymm4, %ymm14
+        vpxor	64(%rcx), %ymm14, %ymm14
+        vpxor	96(%rcx), %ymm14, %ymm14
+        vpxor	128(%rcx), %ymm14, %ymm14
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	-96(%rax), %ymm6, %ymm11
+        vpxor	32(%rax), %ymm7, %ymm12
+        vpxor	-96(%rcx), %ymm8, %ymm13
+        vpxor	32(%rcx), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	32(%rdx), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, -96(%rax)
+        vmovdqu	%ymm2, 32(%rax)
+        vmovdqu	%ymm3, -96(%rcx)
+        vmovdqu	%ymm4, 32(%rcx)
+        # Row 1
+        vpxor	-64(%rcx), %ymm8, %ymm10
+        vpxor	64(%rcx), %ymm9, %ymm11
+        vpxor	-96(%rdi), %ymm5, %ymm12
+        vpxor	32(%rdi), %ymm6, %ymm13
+        vpxor	64(%rax), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -64(%rcx)
+        vmovdqu	%ymm1, 64(%rcx)
+        vmovdqu	%ymm2, -96(%rdi)
+        vmovdqu	%ymm3, 32(%rdi)
+        vmovdqu	%ymm4, 64(%rax)
+        # Row 2
+        vpxor	64(%rdi), %ymm6, %ymm10
+        vpxor	-64(%rax), %ymm7, %ymm11
+        vpxor	-32(%rcx), %ymm8, %ymm12
+        vpxor	96(%rcx), %ymm9, %ymm13
+        vpxor	-64(%rdi), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 64(%rdi)
+        vmovdqu	%ymm1, -64(%rax)
+        vmovdqu	%ymm2, -32(%rcx)
+        vmovdqu	%ymm3, 96(%rcx)
+        vmovdqu	%ymm4, -64(%rdi)
+        # Row 3
+        vpxor	128(%rcx), %ymm9, %ymm10
+        vpxor	-32(%rdi), %ymm5, %ymm11
+        vpxor	96(%rdi), %ymm6, %ymm12
+        vpxor	-32(%rax), %ymm7, %ymm13
+        vpxor	96(%rax), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 128(%rcx)
+        vmovdqu	%ymm1, -32(%rdi)
+        vmovdqu	%ymm2, 96(%rdi)
+        vmovdqu	%ymm3, -32(%rax)
+        vmovdqu	%ymm4, 96(%rax)
+        # Row 4
+        vpxor	(%rax), %ymm7, %ymm10
+        vpxor	128(%rax), %ymm8, %ymm11
+        vpxor	(%rcx), %ymm9, %ymm12
+        vpxor	(%rdi), %ymm5, %ymm13
+        vpxor	128(%rdi), %ymm6, %ymm14
+        vpsrlq	$2, %ymm10, %ymm0
+        vpsrlq	$9, %ymm11, %ymm1
+        vpsrlq	$25, %ymm12, %ymm2
+        vpsrlq	$23, %ymm13, %ymm3
+        vpsrlq	$62, %ymm14, %ymm4
+        vpsllq	$62, %ymm10, %ymm10
+        vpsllq	$55, %ymm11, %ymm11
+        vpsllq	$39, %ymm12, %ymm12
+        vpsllq	$41, %ymm13, %ymm13
+        vpsllq	$2, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, (%rax)
+        vmovdqu	%ymm1, 128(%rax)
+        vmovdqu	%ymm2, (%rcx)
+        vmovdqu	%ymm3, (%rdi)
+        vmovdqu	%ymm4, 128(%rdi)
+        # Round 2
+        # Calc b[0..4]
+        vpxor	%ymm15, %ymm0, %ymm10
+        vpxor	-96(%rdi), %ymm2, %ymm12
+        vpxor	-64(%rdi), %ymm4, %ymm14
+        vpxor	-32(%rdi), %ymm1, %ymm11
+        vpxor	32(%rdi), %ymm3, %ymm13
+        vpxor	64(%rdi), %ymm10, %ymm10
+        vpxor	96(%rdi), %ymm12, %ymm12
+        vpxor	-96(%rax), %ymm11, %ymm11
+        vpxor	-64(%rax), %ymm11, %ymm11
+        vpxor	-32(%rax), %ymm13, %ymm13
+        vpxor	32(%rax), %ymm12, %ymm12
+        vpxor	64(%rax), %ymm14, %ymm14
+        vpxor	96(%rax), %ymm14, %ymm14
+        vpxor	-96(%rcx), %ymm13, %ymm13
+        vpxor	-64(%rcx), %ymm10, %ymm10
+        vpxor	-32(%rcx), %ymm12, %ymm12
+        vpxor	32(%rcx), %ymm14, %ymm14
+        vpxor	64(%rcx), %ymm11, %ymm11
+        vpxor	96(%rcx), %ymm13, %ymm13
+        vpxor	128(%rcx), %ymm10, %ymm10
+        # Calc t[0..4]
+        vpsrlq	$63, %ymm11, %ymm0
+        vpsrlq	$63, %ymm12, %ymm1
+        vpsrlq	$63, %ymm13, %ymm2
+        vpsrlq	$63, %ymm14, %ymm3
+        vpsrlq	$63, %ymm10, %ymm4
+        vpaddq	%ymm11, %ymm11, %ymm5
+        vpaddq	%ymm12, %ymm12, %ymm6
+        vpaddq	%ymm13, %ymm13, %ymm7
+        vpaddq	%ymm14, %ymm14, %ymm8
+        vpaddq	%ymm10, %ymm10, %ymm9
+        vpor	%ymm0, %ymm5, %ymm5
+        vpor	%ymm1, %ymm6, %ymm6
+        vpor	%ymm2, %ymm7, %ymm7
+        vpor	%ymm3, %ymm8, %ymm8
+        vpor	%ymm4, %ymm9, %ymm9
+        vpxor	%ymm14, %ymm5, %ymm5
+        vpxor	%ymm10, %ymm6, %ymm6
+        vpxor	%ymm11, %ymm7, %ymm7
+        vpxor	%ymm12, %ymm8, %ymm8
+        vpxor	%ymm13, %ymm9, %ymm9
+        # Row Mix
+        # Row 0
+        vpxor	%ymm15, %ymm5, %ymm10
+        vpxor	64(%rcx), %ymm6, %ymm11
+        vpxor	-32(%rcx), %ymm7, %ymm12
+        vpxor	-32(%rax), %ymm8, %ymm13
+        vpxor	128(%rdi), %ymm9, %ymm14
+        vpsrlq	$20, %ymm11, %ymm0
+        vpsrlq	$21, %ymm12, %ymm1
+        vpsrlq	$43, %ymm13, %ymm2
+        vpsrlq	$50, %ymm14, %ymm3
+        vpsllq	$44, %ymm11, %ymm11
+        vpsllq	$43, %ymm12, %ymm12
+        vpsllq	$21, %ymm13, %ymm13
+        vpsllq	$14, %ymm14, %ymm14
+        vpor	%ymm0, %ymm11, %ymm11
+        vpor	%ymm1, %ymm12, %ymm12
+        vpor	%ymm2, %ymm13, %ymm13
+        vpor	%ymm3, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm15
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm15, %ymm15
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        # XOR in constant
+        vpxor	64(%rdx), %ymm15, %ymm15
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm1, 64(%rcx)
+        vmovdqu	%ymm2, -32(%rcx)
+        vmovdqu	%ymm3, -32(%rax)
+        vmovdqu	%ymm4, 128(%rdi)
+        # Row 1
+        vpxor	-96(%rcx), %ymm8, %ymm10
+        vpxor	64(%rax), %ymm9, %ymm11
+        vpxor	64(%rdi), %ymm5, %ymm12
+        vpxor	-32(%rdi), %ymm6, %ymm13
+        vpxor	(%rcx), %ymm7, %ymm14
+        vpsrlq	$36, %ymm10, %ymm0
+        vpsrlq	$44, %ymm11, %ymm1
+        vpsrlq	$61, %ymm12, %ymm2
+        vpsrlq	$19, %ymm13, %ymm3
+        vpsrlq	$3, %ymm14, %ymm4
+        vpsllq	$28, %ymm10, %ymm10
+        vpsllq	$20, %ymm11, %ymm11
+        vpsllq	$3, %ymm12, %ymm12
+        vpsllq	$45, %ymm13, %ymm13
+        vpsllq	$61, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rcx)
+        vmovdqu	%ymm1, 64(%rax)
+        vmovdqu	%ymm2, 64(%rdi)
+        vmovdqu	%ymm3, -32(%rdi)
+        vmovdqu	%ymm4, (%rcx)
+        # Row 2
+        vpxor	-96(%rax), %ymm6, %ymm10
+        vpxor	-96(%rdi), %ymm7, %ymm11
+        vpxor	96(%rcx), %ymm8, %ymm12
+        vpxor	96(%rax), %ymm9, %ymm13
+        vpxor	(%rax), %ymm5, %ymm14
+        vpsrlq	$63, %ymm10, %ymm0
+        vpsrlq	$58, %ymm11, %ymm1
+        vpsrlq	$39, %ymm12, %ymm2
+        vpsrlq	$56, %ymm13, %ymm3
+        vpsrlq	$46, %ymm14, %ymm4
+        vpaddq	%ymm10, %ymm10, %ymm10
+        vpsllq	$6, %ymm11, %ymm11
+        vpsllq	$25, %ymm12, %ymm12
+        vpsllq	$8, %ymm13, %ymm13
+        vpsllq	$18, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, -96(%rax)
+        vmovdqu	%ymm1, -96(%rdi)
+        vmovdqu	%ymm2, 96(%rcx)
+        vmovdqu	%ymm3, 96(%rax)
+        vmovdqu	%ymm4, (%rax)
+        # Row 3
+        vpxor	32(%rcx), %ymm9, %ymm10
+        vpxor	-64(%rcx), %ymm5, %ymm11
+        vpxor	-64(%rax), %ymm6, %ymm12
+        vpxor	96(%rdi), %ymm7, %ymm13
+        vpxor	(%rdi), %ymm8, %ymm14
+        vpsrlq	$37, %ymm10, %ymm0
+        vpsrlq	$28, %ymm11, %ymm1
+        vpsrlq	$54, %ymm12, %ymm2
+        vpsrlq	$49, %ymm13, %ymm3
+        vpsrlq	$8, %ymm14, %ymm4
+        vpsllq	$27, %ymm10, %ymm10
+        vpsllq	$36, %ymm11, %ymm11
+        vpsllq	$10, %ymm12, %ymm12
+        vpsllq	$15, %ymm13, %ymm13
+        vpsllq	$56, %ymm14, %ymm14
+        vpor	%ymm0, %ymm10, %ymm10
+        vpor	%ymm1, %ymm11, %ymm11
+        vpor	%ymm2, %ymm12, %ymm12
+        vpor	%ymm3, %ymm13, %ymm13
+        vpor	%ymm4, %ymm14, %ymm14
+        vpandn	%ymm12, %ymm11, %ymm0
+        vpandn	%ymm13, %ymm12, %ymm1
+        vpandn	%ymm14, %ymm13, %ymm2
+        vpandn	%ymm10, %ymm14, %ymm3
+        vpandn	%ymm11, %ymm10, %ymm4
+        vpxor	%ymm10, %ymm0, %ymm0
+        vpxor	%ymm11, %ymm1, %ymm1
+        vpxor	%ymm12, %ymm2, %ymm2
+        vpxor	%ymm13, %ymm3, %ymm3
+        vpxor	%ymm14, %ymm4, %ymm4
+        vmovdqu	%ymm0, 32(%rcx)
+        vmovdqu	%ymm1, -64(%rcx)
+        vmovdqu	%ymm2, -64(%rax)
+        vmovdqu	%ymm3, 96(%rdi)
+        vmovdqu	%ymm4, (%rdi)
+        # Row 4
+        vpxor	32(%rax), %ymm7, %ymm10
+        vpxor	32(%rdi), %ymm8, %ymm11
+        vpxor	-64(%rdi), %ymm9, %ymm12
+        vpxor	128(%rcx), %ymm5, %ymm13
+        vpxor	128(%rax), %ymm6, %ymm14
         vpsrlq	$2, %ymm10, %ymm0
         vpsrlq	$9, %ymm11, %ymm1
         vpsrlq	$25, %ymm12, %ymm2
@@ -31459,6 +36860,3056 @@ _sha3_256_blocksx4_seed_64_avx2:
 .size	sha3_256_blocksx4_seed_64_avx2,.-sha3_256_blocksx4_seed_64_avx2
 #endif /* __APPLE__ */
 #endif /* WOLFSSL_HAVE_MLDSA */
+#ifdef HAVE_INTEL_AVX512
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifndef __APPLE__
+.data
+#else
+.section	__DATA,__data
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.align	32
+#else
+.p2align	5
+#endif /* __APPLE__ */
+L_sha3_x8_avx512_r:
+.quad	0x0000000000000001,0x0000000000000001
+.quad	0x0000000000000001,0x0000000000000001
+.quad	0x0000000000000001,0x0000000000000001
+.quad	0x0000000000000001,0x0000000000000001
+.quad	0x0000000000008082,0x0000000000008082
+.quad	0x0000000000008082,0x0000000000008082
+.quad	0x0000000000008082,0x0000000000008082
+.quad	0x0000000000008082,0x0000000000008082
+.quad	0x800000000000808a,0x800000000000808a
+.quad	0x800000000000808a,0x800000000000808a
+.quad	0x800000000000808a,0x800000000000808a
+.quad	0x800000000000808a,0x800000000000808a
+.quad	0x8000000080008000,0x8000000080008000
+.quad	0x8000000080008000,0x8000000080008000
+.quad	0x8000000080008000,0x8000000080008000
+.quad	0x8000000080008000,0x8000000080008000
+.quad	0x000000000000808b,0x000000000000808b
+.quad	0x000000000000808b,0x000000000000808b
+.quad	0x000000000000808b,0x000000000000808b
+.quad	0x000000000000808b,0x000000000000808b
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000000008009,0x8000000000008009
+.quad	0x8000000000008009,0x8000000000008009
+.quad	0x8000000000008009,0x8000000000008009
+.quad	0x8000000000008009,0x8000000000008009
+.quad	0x000000000000008a,0x000000000000008a
+.quad	0x000000000000008a,0x000000000000008a
+.quad	0x000000000000008a,0x000000000000008a
+.quad	0x000000000000008a,0x000000000000008a
+.quad	0x0000000000000088,0x0000000000000088
+.quad	0x0000000000000088,0x0000000000000088
+.quad	0x0000000000000088,0x0000000000000088
+.quad	0x0000000000000088,0x0000000000000088
+.quad	0x0000000080008009,0x0000000080008009
+.quad	0x0000000080008009,0x0000000080008009
+.quad	0x0000000080008009,0x0000000080008009
+.quad	0x0000000080008009,0x0000000080008009
+.quad	0x000000008000000a,0x000000008000000a
+.quad	0x000000008000000a,0x000000008000000a
+.quad	0x000000008000000a,0x000000008000000a
+.quad	0x000000008000000a,0x000000008000000a
+.quad	0x000000008000808b,0x000000008000808b
+.quad	0x000000008000808b,0x000000008000808b
+.quad	0x000000008000808b,0x000000008000808b
+.quad	0x000000008000808b,0x000000008000808b
+.quad	0x800000000000008b,0x800000000000008b
+.quad	0x800000000000008b,0x800000000000008b
+.quad	0x800000000000008b,0x800000000000008b
+.quad	0x800000000000008b,0x800000000000008b
+.quad	0x8000000000008089,0x8000000000008089
+.quad	0x8000000000008089,0x8000000000008089
+.quad	0x8000000000008089,0x8000000000008089
+.quad	0x8000000000008089,0x8000000000008089
+.quad	0x8000000000008003,0x8000000000008003
+.quad	0x8000000000008003,0x8000000000008003
+.quad	0x8000000000008003,0x8000000000008003
+.quad	0x8000000000008003,0x8000000000008003
+.quad	0x8000000000008002,0x8000000000008002
+.quad	0x8000000000008002,0x8000000000008002
+.quad	0x8000000000008002,0x8000000000008002
+.quad	0x8000000000008002,0x8000000000008002
+.quad	0x8000000000000080,0x8000000000000080
+.quad	0x8000000000000080,0x8000000000000080
+.quad	0x8000000000000080,0x8000000000000080
+.quad	0x8000000000000080,0x8000000000000080
+.quad	0x000000000000800a,0x000000000000800a
+.quad	0x000000000000800a,0x000000000000800a
+.quad	0x000000000000800a,0x000000000000800a
+.quad	0x000000000000800a,0x000000000000800a
+.quad	0x800000008000000a,0x800000008000000a
+.quad	0x800000008000000a,0x800000008000000a
+.quad	0x800000008000000a,0x800000008000000a
+.quad	0x800000008000000a,0x800000008000000a
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000080008081,0x8000000080008081
+.quad	0x8000000000008080,0x8000000000008080
+.quad	0x8000000000008080,0x8000000000008080
+.quad	0x8000000000008080,0x8000000000008080
+.quad	0x8000000000008080,0x8000000000008080
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x0000000080000001,0x0000000080000001
+.quad	0x8000000080008008,0x8000000080008008
+.quad	0x8000000080008008,0x8000000080008008
+.quad	0x8000000080008008,0x8000000080008008
+.quad	0x8000000080008008,0x8000000080008008
+#ifndef __APPLE__
+.text
+.globl	sha3_blocksx8_out_avx512
+.type	sha3_blocksx8_out_avx512,@function
+.align	16
+sha3_blocksx8_out_avx512:
+#else
+.section	__TEXT,__text
+.globl	_sha3_blocksx8_out_avx512
+.p2align	4
+_sha3_blocksx8_out_avx512:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        pushq	%rbp
+        leaq	L_sha3_x8_avx512_r(%rip), %rax
+        movl	%edx, %r14d
+        movq	%rsi, %rcx
+        addq	%r14, %rcx
+        movq	%rcx, %r8
+        addq	%r14, %r8
+        movq	%r8, %r9
+        addq	%r14, %r9
+        movq	%r9, %r10
+        addq	%r14, %r10
+        movq	%r10, %r11
+        addq	%r14, %r11
+        movq	%r11, %r12
+        addq	%r14, %r12
+        movq	%r12, %r13
+        addq	%r14, %r13
+        shrq	$3, %r14
+        vmovdqu64	(%rdi), %zmm0
+        vmovdqu64	64(%rdi), %zmm1
+        vmovdqu64	128(%rdi), %zmm2
+        vmovdqu64	192(%rdi), %zmm3
+        vmovdqu64	256(%rdi), %zmm4
+        vmovdqu64	320(%rdi), %zmm5
+        vmovdqu64	384(%rdi), %zmm6
+        vmovdqu64	448(%rdi), %zmm7
+        vmovdqu64	512(%rdi), %zmm8
+        vmovdqu64	576(%rdi), %zmm9
+        vmovdqu64	640(%rdi), %zmm10
+        vmovdqu64	704(%rdi), %zmm11
+        vmovdqu64	768(%rdi), %zmm12
+        vmovdqu64	832(%rdi), %zmm13
+        vmovdqu64	896(%rdi), %zmm14
+        vmovdqu64	960(%rdi), %zmm15
+        vmovdqu64	1024(%rdi), %zmm16
+        vmovdqu64	1088(%rdi), %zmm17
+        vmovdqu64	1152(%rdi), %zmm18
+        vmovdqu64	1216(%rdi), %zmm19
+        vmovdqu64	1280(%rdi), %zmm20
+        vmovdqu64	1344(%rdi), %zmm21
+        vmovdqu64	1408(%rdi), %zmm22
+        vmovdqu64	1472(%rdi), %zmm23
+        vmovdqu64	1536(%rdi), %zmm24
+L_sha3_blocksx8_out_avx512_block:
+        # Round 0
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm10, %zmm5, %zmm25
+        vpternlogq	$0x96, %zmm20, %zmm15, %zmm25
+        vmovdqu64	%zmm1, %zmm26
+        vpternlogq	$0x96, %zmm11, %zmm6, %zmm26
+        vpternlogq	$0x96, %zmm21, %zmm16, %zmm26
+        vmovdqu64	%zmm2, %zmm27
+        vpternlogq	$0x96, %zmm12, %zmm7, %zmm27
+        vpternlogq	$0x96, %zmm22, %zmm17, %zmm27
+        vmovdqu64	%zmm3, %zmm28
+        vpternlogq	$0x96, %zmm13, %zmm8, %zmm28
+        vpternlogq	$0x96, %zmm23, %zmm18, %zmm28
+        vmovdqu64	%zmm4, %zmm29
+        vpternlogq	$0x96, %zmm14, %zmm9, %zmm29
+        vpternlogq	$0x96, %zmm24, %zmm19, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm24, %zmm24
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm1, %zmm1
+        vprolq	$62, %zmm2, %zmm2
+        vprolq	$28, %zmm3, %zmm3
+        vprolq	$27, %zmm4, %zmm4
+        vprolq	$36, %zmm5, %zmm5
+        vprolq	$44, %zmm6, %zmm6
+        vprolq	$6, %zmm7, %zmm7
+        vprolq	$55, %zmm8, %zmm8
+        vprolq	$20, %zmm9, %zmm9
+        vprolq	$3, %zmm10, %zmm10
+        vprolq	$10, %zmm11, %zmm11
+        vprolq	$43, %zmm12, %zmm12
+        vprolq	$25, %zmm13, %zmm13
+        vprolq	$39, %zmm14, %zmm14
+        vprolq	$41, %zmm15, %zmm15
+        vprolq	$45, %zmm16, %zmm16
+        vprolq	$15, %zmm17, %zmm17
+        vprolq	$21, %zmm18, %zmm18
+        vprolq	$8, %zmm19, %zmm19
+        vprolq	$18, %zmm20, %zmm20
+        vprolq	$2, %zmm21, %zmm21
+        vprolq	$61, %zmm22, %zmm22
+        vprolq	$56, %zmm23, %zmm23
+        vprolq	$14, %zmm24, %zmm24
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm6, %zmm31
+        vpternlogq	$0xd2, %zmm12, %zmm6, %zmm0
+        vpternlogq	$0xd2, %zmm18, %zmm12, %zmm6
+        vpternlogq	$0xd2, %zmm24, %zmm18, %zmm12
+        vpternlogq	$0xd2, %zmm30, %zmm24, %zmm18
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm24
+        vmovdqu64	%zmm3, %zmm30
+        vmovdqu64	%zmm9, %zmm31
+        vpternlogq	$0xd2, %zmm10, %zmm9, %zmm3
+        vpternlogq	$0xd2, %zmm16, %zmm10, %zmm9
+        vpternlogq	$0xd2, %zmm22, %zmm16, %zmm10
+        vpternlogq	$0xd2, %zmm30, %zmm22, %zmm16
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm22
+        vmovdqu64	%zmm1, %zmm30
+        vmovdqu64	%zmm7, %zmm31
+        vpternlogq	$0xd2, %zmm13, %zmm7, %zmm1
+        vpternlogq	$0xd2, %zmm19, %zmm13, %zmm7
+        vpternlogq	$0xd2, %zmm20, %zmm19, %zmm13
+        vpternlogq	$0xd2, %zmm30, %zmm20, %zmm19
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm20
+        vmovdqu64	%zmm4, %zmm30
+        vmovdqu64	%zmm5, %zmm31
+        vpternlogq	$0xd2, %zmm11, %zmm5, %zmm4
+        vpternlogq	$0xd2, %zmm17, %zmm11, %zmm5
+        vpternlogq	$0xd2, %zmm23, %zmm17, %zmm11
+        vpternlogq	$0xd2, %zmm30, %zmm23, %zmm17
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm23
+        vmovdqu64	%zmm2, %zmm30
+        vmovdqu64	%zmm8, %zmm31
+        vpternlogq	$0xd2, %zmm14, %zmm8, %zmm2
+        vpternlogq	$0xd2, %zmm15, %zmm14, %zmm8
+        vpternlogq	$0xd2, %zmm21, %zmm15, %zmm14
+        vpternlogq	$0xd2, %zmm30, %zmm21, %zmm15
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm21
+        # Iota
+        vpxorq	(%rax), %zmm0, %zmm0
+        # Round 1
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm1, %zmm3, %zmm25
+        vpternlogq	$0x96, %zmm2, %zmm4, %zmm25
+        vmovdqu64	%zmm6, %zmm26
+        vpternlogq	$0x96, %zmm7, %zmm9, %zmm26
+        vpternlogq	$0x96, %zmm8, %zmm5, %zmm26
+        vmovdqu64	%zmm12, %zmm27
+        vpternlogq	$0x96, %zmm13, %zmm10, %zmm27
+        vpternlogq	$0x96, %zmm14, %zmm11, %zmm27
+        vmovdqu64	%zmm18, %zmm28
+        vpternlogq	$0x96, %zmm19, %zmm16, %zmm28
+        vpternlogq	$0x96, %zmm15, %zmm17, %zmm28
+        vmovdqu64	%zmm24, %zmm29
+        vpternlogq	$0x96, %zmm20, %zmm22, %zmm29
+        vpternlogq	$0x96, %zmm21, %zmm23, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm21, %zmm21
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm6, %zmm6
+        vprolq	$62, %zmm12, %zmm12
+        vprolq	$28, %zmm18, %zmm18
+        vprolq	$27, %zmm24, %zmm24
+        vprolq	$36, %zmm3, %zmm3
+        vprolq	$44, %zmm9, %zmm9
+        vprolq	$6, %zmm10, %zmm10
+        vprolq	$55, %zmm16, %zmm16
+        vprolq	$20, %zmm22, %zmm22
+        vprolq	$3, %zmm1, %zmm1
+        vprolq	$10, %zmm7, %zmm7
+        vprolq	$43, %zmm13, %zmm13
+        vprolq	$25, %zmm19, %zmm19
+        vprolq	$39, %zmm20, %zmm20
+        vprolq	$41, %zmm4, %zmm4
+        vprolq	$45, %zmm5, %zmm5
+        vprolq	$15, %zmm11, %zmm11
+        vprolq	$21, %zmm17, %zmm17
+        vprolq	$8, %zmm23, %zmm23
+        vprolq	$18, %zmm2, %zmm2
+        vprolq	$2, %zmm8, %zmm8
+        vprolq	$61, %zmm14, %zmm14
+        vprolq	$56, %zmm15, %zmm15
+        vprolq	$14, %zmm21, %zmm21
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm9, %zmm31
+        vpternlogq	$0xd2, %zmm13, %zmm9, %zmm0
+        vpternlogq	$0xd2, %zmm17, %zmm13, %zmm9
+        vpternlogq	$0xd2, %zmm21, %zmm17, %zmm13
+        vpternlogq	$0xd2, %zmm30, %zmm21, %zmm17
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm21
+        vmovdqu64	%zmm18, %zmm30
+        vmovdqu64	%zmm22, %zmm31
+        vpternlogq	$0xd2, %zmm1, %zmm22, %zmm18
+        vpternlogq	$0xd2, %zmm5, %zmm1, %zmm22
+        vpternlogq	$0xd2, %zmm14, %zmm5, %zmm1
+        vpternlogq	$0xd2, %zmm30, %zmm14, %zmm5
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm14
+        vmovdqu64	%zmm6, %zmm30
+        vmovdqu64	%zmm10, %zmm31
+        vpternlogq	$0xd2, %zmm19, %zmm10, %zmm6
+        vpternlogq	$0xd2, %zmm23, %zmm19, %zmm10
+        vpternlogq	$0xd2, %zmm2, %zmm23, %zmm19
+        vpternlogq	$0xd2, %zmm30, %zmm2, %zmm23
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm2
+        vmovdqu64	%zmm24, %zmm30
+        vmovdqu64	%zmm3, %zmm31
+        vpternlogq	$0xd2, %zmm7, %zmm3, %zmm24
+        vpternlogq	$0xd2, %zmm11, %zmm7, %zmm3
+        vpternlogq	$0xd2, %zmm15, %zmm11, %zmm7
+        vpternlogq	$0xd2, %zmm30, %zmm15, %zmm11
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm15
+        vmovdqu64	%zmm12, %zmm30
+        vmovdqu64	%zmm16, %zmm31
+        vpternlogq	$0xd2, %zmm20, %zmm16, %zmm12
+        vpternlogq	$0xd2, %zmm4, %zmm20, %zmm16
+        vpternlogq	$0xd2, %zmm8, %zmm4, %zmm20
+        vpternlogq	$0xd2, %zmm30, %zmm8, %zmm4
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm8
+        # Iota
+        vpxorq	64(%rax), %zmm0, %zmm0
+        # Round 2
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm6, %zmm18, %zmm25
+        vpternlogq	$0x96, %zmm12, %zmm24, %zmm25
+        vmovdqu64	%zmm9, %zmm26
+        vpternlogq	$0x96, %zmm10, %zmm22, %zmm26
+        vpternlogq	$0x96, %zmm16, %zmm3, %zmm26
+        vmovdqu64	%zmm13, %zmm27
+        vpternlogq	$0x96, %zmm19, %zmm1, %zmm27
+        vpternlogq	$0x96, %zmm20, %zmm7, %zmm27
+        vmovdqu64	%zmm17, %zmm28
+        vpternlogq	$0x96, %zmm23, %zmm5, %zmm28
+        vpternlogq	$0x96, %zmm4, %zmm11, %zmm28
+        vmovdqu64	%zmm21, %zmm29
+        vpternlogq	$0x96, %zmm2, %zmm14, %zmm29
+        vpternlogq	$0x96, %zmm8, %zmm15, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm8, %zmm8
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm9, %zmm9
+        vprolq	$62, %zmm13, %zmm13
+        vprolq	$28, %zmm17, %zmm17
+        vprolq	$27, %zmm21, %zmm21
+        vprolq	$36, %zmm18, %zmm18
+        vprolq	$44, %zmm22, %zmm22
+        vprolq	$6, %zmm1, %zmm1
+        vprolq	$55, %zmm5, %zmm5
+        vprolq	$20, %zmm14, %zmm14
+        vprolq	$3, %zmm6, %zmm6
+        vprolq	$10, %zmm10, %zmm10
+        vprolq	$43, %zmm19, %zmm19
+        vprolq	$25, %zmm23, %zmm23
+        vprolq	$39, %zmm2, %zmm2
+        vprolq	$41, %zmm24, %zmm24
+        vprolq	$45, %zmm3, %zmm3
+        vprolq	$15, %zmm7, %zmm7
+        vprolq	$21, %zmm11, %zmm11
+        vprolq	$8, %zmm15, %zmm15
+        vprolq	$18, %zmm12, %zmm12
+        vprolq	$2, %zmm16, %zmm16
+        vprolq	$61, %zmm20, %zmm20
+        vprolq	$56, %zmm4, %zmm4
+        vprolq	$14, %zmm8, %zmm8
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm22, %zmm31
+        vpternlogq	$0xd2, %zmm19, %zmm22, %zmm0
+        vpternlogq	$0xd2, %zmm11, %zmm19, %zmm22
+        vpternlogq	$0xd2, %zmm8, %zmm11, %zmm19
+        vpternlogq	$0xd2, %zmm30, %zmm8, %zmm11
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm8
+        vmovdqu64	%zmm17, %zmm30
+        vmovdqu64	%zmm14, %zmm31
+        vpternlogq	$0xd2, %zmm6, %zmm14, %zmm17
+        vpternlogq	$0xd2, %zmm3, %zmm6, %zmm14
+        vpternlogq	$0xd2, %zmm20, %zmm3, %zmm6
+        vpternlogq	$0xd2, %zmm30, %zmm20, %zmm3
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm20
+        vmovdqu64	%zmm9, %zmm30
+        vmovdqu64	%zmm1, %zmm31
+        vpternlogq	$0xd2, %zmm23, %zmm1, %zmm9
+        vpternlogq	$0xd2, %zmm15, %zmm23, %zmm1
+        vpternlogq	$0xd2, %zmm12, %zmm15, %zmm23
+        vpternlogq	$0xd2, %zmm30, %zmm12, %zmm15
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm12
+        vmovdqu64	%zmm21, %zmm30
+        vmovdqu64	%zmm18, %zmm31
+        vpternlogq	$0xd2, %zmm10, %zmm18, %zmm21
+        vpternlogq	$0xd2, %zmm7, %zmm10, %zmm18
+        vpternlogq	$0xd2, %zmm4, %zmm7, %zmm10
+        vpternlogq	$0xd2, %zmm30, %zmm4, %zmm7
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm4
+        vmovdqu64	%zmm13, %zmm30
+        vmovdqu64	%zmm5, %zmm31
+        vpternlogq	$0xd2, %zmm2, %zmm5, %zmm13
+        vpternlogq	$0xd2, %zmm24, %zmm2, %zmm5
+        vpternlogq	$0xd2, %zmm16, %zmm24, %zmm2
+        vpternlogq	$0xd2, %zmm30, %zmm16, %zmm24
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm16
+        # Iota
+        vpxorq	128(%rax), %zmm0, %zmm0
+        # Round 3
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm9, %zmm17, %zmm25
+        vpternlogq	$0x96, %zmm13, %zmm21, %zmm25
+        vmovdqu64	%zmm22, %zmm26
+        vpternlogq	$0x96, %zmm1, %zmm14, %zmm26
+        vpternlogq	$0x96, %zmm5, %zmm18, %zmm26
+        vmovdqu64	%zmm19, %zmm27
+        vpternlogq	$0x96, %zmm23, %zmm6, %zmm27
+        vpternlogq	$0x96, %zmm2, %zmm10, %zmm27
+        vmovdqu64	%zmm11, %zmm28
+        vpternlogq	$0x96, %zmm15, %zmm3, %zmm28
+        vpternlogq	$0x96, %zmm24, %zmm7, %zmm28
+        vmovdqu64	%zmm8, %zmm29
+        vpternlogq	$0x96, %zmm12, %zmm20, %zmm29
+        vpternlogq	$0x96, %zmm16, %zmm4, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm16, %zmm16
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm22, %zmm22
+        vprolq	$62, %zmm19, %zmm19
+        vprolq	$28, %zmm11, %zmm11
+        vprolq	$27, %zmm8, %zmm8
+        vprolq	$36, %zmm17, %zmm17
+        vprolq	$44, %zmm14, %zmm14
+        vprolq	$6, %zmm6, %zmm6
+        vprolq	$55, %zmm3, %zmm3
+        vprolq	$20, %zmm20, %zmm20
+        vprolq	$3, %zmm9, %zmm9
+        vprolq	$10, %zmm1, %zmm1
+        vprolq	$43, %zmm23, %zmm23
+        vprolq	$25, %zmm15, %zmm15
+        vprolq	$39, %zmm12, %zmm12
+        vprolq	$41, %zmm21, %zmm21
+        vprolq	$45, %zmm18, %zmm18
+        vprolq	$15, %zmm10, %zmm10
+        vprolq	$21, %zmm7, %zmm7
+        vprolq	$8, %zmm4, %zmm4
+        vprolq	$18, %zmm13, %zmm13
+        vprolq	$2, %zmm5, %zmm5
+        vprolq	$61, %zmm2, %zmm2
+        vprolq	$56, %zmm24, %zmm24
+        vprolq	$14, %zmm16, %zmm16
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm14, %zmm31
+        vpternlogq	$0xd2, %zmm23, %zmm14, %zmm0
+        vpternlogq	$0xd2, %zmm7, %zmm23, %zmm14
+        vpternlogq	$0xd2, %zmm16, %zmm7, %zmm23
+        vpternlogq	$0xd2, %zmm30, %zmm16, %zmm7
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm16
+        vmovdqu64	%zmm11, %zmm30
+        vmovdqu64	%zmm20, %zmm31
+        vpternlogq	$0xd2, %zmm9, %zmm20, %zmm11
+        vpternlogq	$0xd2, %zmm18, %zmm9, %zmm20
+        vpternlogq	$0xd2, %zmm2, %zmm18, %zmm9
+        vpternlogq	$0xd2, %zmm30, %zmm2, %zmm18
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm2
+        vmovdqu64	%zmm22, %zmm30
+        vmovdqu64	%zmm6, %zmm31
+        vpternlogq	$0xd2, %zmm15, %zmm6, %zmm22
+        vpternlogq	$0xd2, %zmm4, %zmm15, %zmm6
+        vpternlogq	$0xd2, %zmm13, %zmm4, %zmm15
+        vpternlogq	$0xd2, %zmm30, %zmm13, %zmm4
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm13
+        vmovdqu64	%zmm8, %zmm30
+        vmovdqu64	%zmm17, %zmm31
+        vpternlogq	$0xd2, %zmm1, %zmm17, %zmm8
+        vpternlogq	$0xd2, %zmm10, %zmm1, %zmm17
+        vpternlogq	$0xd2, %zmm24, %zmm10, %zmm1
+        vpternlogq	$0xd2, %zmm30, %zmm24, %zmm10
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm24
+        vmovdqu64	%zmm19, %zmm30
+        vmovdqu64	%zmm3, %zmm31
+        vpternlogq	$0xd2, %zmm12, %zmm3, %zmm19
+        vpternlogq	$0xd2, %zmm21, %zmm12, %zmm3
+        vpternlogq	$0xd2, %zmm5, %zmm21, %zmm12
+        vpternlogq	$0xd2, %zmm30, %zmm5, %zmm21
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm5
+        # Iota
+        vpxorq	192(%rax), %zmm0, %zmm0
+        # Round 4
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm22, %zmm11, %zmm25
+        vpternlogq	$0x96, %zmm19, %zmm8, %zmm25
+        vmovdqu64	%zmm14, %zmm26
+        vpternlogq	$0x96, %zmm6, %zmm20, %zmm26
+        vpternlogq	$0x96, %zmm3, %zmm17, %zmm26
+        vmovdqu64	%zmm23, %zmm27
+        vpternlogq	$0x96, %zmm15, %zmm9, %zmm27
+        vpternlogq	$0x96, %zmm12, %zmm1, %zmm27
+        vmovdqu64	%zmm7, %zmm28
+        vpternlogq	$0x96, %zmm4, %zmm18, %zmm28
+        vpternlogq	$0x96, %zmm21, %zmm10, %zmm28
+        vmovdqu64	%zmm16, %zmm29
+        vpternlogq	$0x96, %zmm13, %zmm2, %zmm29
+        vpternlogq	$0x96, %zmm5, %zmm24, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm5, %zmm5
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm14, %zmm14
+        vprolq	$62, %zmm23, %zmm23
+        vprolq	$28, %zmm7, %zmm7
+        vprolq	$27, %zmm16, %zmm16
+        vprolq	$36, %zmm11, %zmm11
+        vprolq	$44, %zmm20, %zmm20
+        vprolq	$6, %zmm9, %zmm9
+        vprolq	$55, %zmm18, %zmm18
+        vprolq	$20, %zmm2, %zmm2
+        vprolq	$3, %zmm22, %zmm22
+        vprolq	$10, %zmm6, %zmm6
+        vprolq	$43, %zmm15, %zmm15
+        vprolq	$25, %zmm4, %zmm4
+        vprolq	$39, %zmm13, %zmm13
+        vprolq	$41, %zmm8, %zmm8
+        vprolq	$45, %zmm17, %zmm17
+        vprolq	$15, %zmm1, %zmm1
+        vprolq	$21, %zmm10, %zmm10
+        vprolq	$8, %zmm24, %zmm24
+        vprolq	$18, %zmm19, %zmm19
+        vprolq	$2, %zmm3, %zmm3
+        vprolq	$61, %zmm12, %zmm12
+        vprolq	$56, %zmm21, %zmm21
+        vprolq	$14, %zmm5, %zmm5
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm20, %zmm31
+        vpternlogq	$0xd2, %zmm15, %zmm20, %zmm0
+        vpternlogq	$0xd2, %zmm10, %zmm15, %zmm20
+        vpternlogq	$0xd2, %zmm5, %zmm10, %zmm15
+        vpternlogq	$0xd2, %zmm30, %zmm5, %zmm10
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm5
+        vmovdqu64	%zmm7, %zmm30
+        vmovdqu64	%zmm2, %zmm31
+        vpternlogq	$0xd2, %zmm22, %zmm2, %zmm7
+        vpternlogq	$0xd2, %zmm17, %zmm22, %zmm2
+        vpternlogq	$0xd2, %zmm12, %zmm17, %zmm22
+        vpternlogq	$0xd2, %zmm30, %zmm12, %zmm17
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm12
+        vmovdqu64	%zmm14, %zmm30
+        vmovdqu64	%zmm9, %zmm31
+        vpternlogq	$0xd2, %zmm4, %zmm9, %zmm14
+        vpternlogq	$0xd2, %zmm24, %zmm4, %zmm9
+        vpternlogq	$0xd2, %zmm19, %zmm24, %zmm4
+        vpternlogq	$0xd2, %zmm30, %zmm19, %zmm24
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm19
+        vmovdqu64	%zmm16, %zmm30
+        vmovdqu64	%zmm11, %zmm31
+        vpternlogq	$0xd2, %zmm6, %zmm11, %zmm16
+        vpternlogq	$0xd2, %zmm1, %zmm6, %zmm11
+        vpternlogq	$0xd2, %zmm21, %zmm1, %zmm6
+        vpternlogq	$0xd2, %zmm30, %zmm21, %zmm1
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm21
+        vmovdqu64	%zmm23, %zmm30
+        vmovdqu64	%zmm18, %zmm31
+        vpternlogq	$0xd2, %zmm13, %zmm18, %zmm23
+        vpternlogq	$0xd2, %zmm8, %zmm13, %zmm18
+        vpternlogq	$0xd2, %zmm3, %zmm8, %zmm13
+        vpternlogq	$0xd2, %zmm30, %zmm3, %zmm8
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm3
+        # Iota
+        vpxorq	256(%rax), %zmm0, %zmm0
+        # Round 5
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm14, %zmm7, %zmm25
+        vpternlogq	$0x96, %zmm23, %zmm16, %zmm25
+        vmovdqu64	%zmm20, %zmm26
+        vpternlogq	$0x96, %zmm9, %zmm2, %zmm26
+        vpternlogq	$0x96, %zmm18, %zmm11, %zmm26
+        vmovdqu64	%zmm15, %zmm27
+        vpternlogq	$0x96, %zmm4, %zmm22, %zmm27
+        vpternlogq	$0x96, %zmm13, %zmm6, %zmm27
+        vmovdqu64	%zmm10, %zmm28
+        vpternlogq	$0x96, %zmm24, %zmm17, %zmm28
+        vpternlogq	$0x96, %zmm8, %zmm1, %zmm28
+        vmovdqu64	%zmm5, %zmm29
+        vpternlogq	$0x96, %zmm19, %zmm12, %zmm29
+        vpternlogq	$0x96, %zmm3, %zmm21, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm3, %zmm3
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm20, %zmm20
+        vprolq	$62, %zmm15, %zmm15
+        vprolq	$28, %zmm10, %zmm10
+        vprolq	$27, %zmm5, %zmm5
+        vprolq	$36, %zmm7, %zmm7
+        vprolq	$44, %zmm2, %zmm2
+        vprolq	$6, %zmm22, %zmm22
+        vprolq	$55, %zmm17, %zmm17
+        vprolq	$20, %zmm12, %zmm12
+        vprolq	$3, %zmm14, %zmm14
+        vprolq	$10, %zmm9, %zmm9
+        vprolq	$43, %zmm4, %zmm4
+        vprolq	$25, %zmm24, %zmm24
+        vprolq	$39, %zmm19, %zmm19
+        vprolq	$41, %zmm16, %zmm16
+        vprolq	$45, %zmm11, %zmm11
+        vprolq	$15, %zmm6, %zmm6
+        vprolq	$21, %zmm1, %zmm1
+        vprolq	$8, %zmm21, %zmm21
+        vprolq	$18, %zmm23, %zmm23
+        vprolq	$2, %zmm18, %zmm18
+        vprolq	$61, %zmm13, %zmm13
+        vprolq	$56, %zmm8, %zmm8
+        vprolq	$14, %zmm3, %zmm3
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm2, %zmm31
+        vpternlogq	$0xd2, %zmm4, %zmm2, %zmm0
+        vpternlogq	$0xd2, %zmm1, %zmm4, %zmm2
+        vpternlogq	$0xd2, %zmm3, %zmm1, %zmm4
+        vpternlogq	$0xd2, %zmm30, %zmm3, %zmm1
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm3
+        vmovdqu64	%zmm10, %zmm30
+        vmovdqu64	%zmm12, %zmm31
+        vpternlogq	$0xd2, %zmm14, %zmm12, %zmm10
+        vpternlogq	$0xd2, %zmm11, %zmm14, %zmm12
+        vpternlogq	$0xd2, %zmm13, %zmm11, %zmm14
+        vpternlogq	$0xd2, %zmm30, %zmm13, %zmm11
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm13
+        vmovdqu64	%zmm20, %zmm30
+        vmovdqu64	%zmm22, %zmm31
+        vpternlogq	$0xd2, %zmm24, %zmm22, %zmm20
+        vpternlogq	$0xd2, %zmm21, %zmm24, %zmm22
+        vpternlogq	$0xd2, %zmm23, %zmm21, %zmm24
+        vpternlogq	$0xd2, %zmm30, %zmm23, %zmm21
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm23
+        vmovdqu64	%zmm5, %zmm30
+        vmovdqu64	%zmm7, %zmm31
+        vpternlogq	$0xd2, %zmm9, %zmm7, %zmm5
+        vpternlogq	$0xd2, %zmm6, %zmm9, %zmm7
+        vpternlogq	$0xd2, %zmm8, %zmm6, %zmm9
+        vpternlogq	$0xd2, %zmm30, %zmm8, %zmm6
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm8
+        vmovdqu64	%zmm15, %zmm30
+        vmovdqu64	%zmm17, %zmm31
+        vpternlogq	$0xd2, %zmm19, %zmm17, %zmm15
+        vpternlogq	$0xd2, %zmm16, %zmm19, %zmm17
+        vpternlogq	$0xd2, %zmm18, %zmm16, %zmm19
+        vpternlogq	$0xd2, %zmm30, %zmm18, %zmm16
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm18
+        # Iota
+        vpxorq	320(%rax), %zmm0, %zmm0
+        # Round 6
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm20, %zmm10, %zmm25
+        vpternlogq	$0x96, %zmm15, %zmm5, %zmm25
+        vmovdqu64	%zmm2, %zmm26
+        vpternlogq	$0x96, %zmm22, %zmm12, %zmm26
+        vpternlogq	$0x96, %zmm17, %zmm7, %zmm26
+        vmovdqu64	%zmm4, %zmm27
+        vpternlogq	$0x96, %zmm24, %zmm14, %zmm27
+        vpternlogq	$0x96, %zmm19, %zmm9, %zmm27
+        vmovdqu64	%zmm1, %zmm28
+        vpternlogq	$0x96, %zmm21, %zmm11, %zmm28
+        vpternlogq	$0x96, %zmm16, %zmm6, %zmm28
+        vmovdqu64	%zmm3, %zmm29
+        vpternlogq	$0x96, %zmm23, %zmm13, %zmm29
+        vpternlogq	$0x96, %zmm18, %zmm8, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm18, %zmm18
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm2, %zmm2
+        vprolq	$62, %zmm4, %zmm4
+        vprolq	$28, %zmm1, %zmm1
+        vprolq	$27, %zmm3, %zmm3
+        vprolq	$36, %zmm10, %zmm10
+        vprolq	$44, %zmm12, %zmm12
+        vprolq	$6, %zmm14, %zmm14
+        vprolq	$55, %zmm11, %zmm11
+        vprolq	$20, %zmm13, %zmm13
+        vprolq	$3, %zmm20, %zmm20
+        vprolq	$10, %zmm22, %zmm22
+        vprolq	$43, %zmm24, %zmm24
+        vprolq	$25, %zmm21, %zmm21
+        vprolq	$39, %zmm23, %zmm23
+        vprolq	$41, %zmm5, %zmm5
+        vprolq	$45, %zmm7, %zmm7
+        vprolq	$15, %zmm9, %zmm9
+        vprolq	$21, %zmm6, %zmm6
+        vprolq	$8, %zmm8, %zmm8
+        vprolq	$18, %zmm15, %zmm15
+        vprolq	$2, %zmm17, %zmm17
+        vprolq	$61, %zmm19, %zmm19
+        vprolq	$56, %zmm16, %zmm16
+        vprolq	$14, %zmm18, %zmm18
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm12, %zmm31
+        vpternlogq	$0xd2, %zmm24, %zmm12, %zmm0
+        vpternlogq	$0xd2, %zmm6, %zmm24, %zmm12
+        vpternlogq	$0xd2, %zmm18, %zmm6, %zmm24
+        vpternlogq	$0xd2, %zmm30, %zmm18, %zmm6
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm18
+        vmovdqu64	%zmm1, %zmm30
+        vmovdqu64	%zmm13, %zmm31
+        vpternlogq	$0xd2, %zmm20, %zmm13, %zmm1
+        vpternlogq	$0xd2, %zmm7, %zmm20, %zmm13
+        vpternlogq	$0xd2, %zmm19, %zmm7, %zmm20
+        vpternlogq	$0xd2, %zmm30, %zmm19, %zmm7
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm19
+        vmovdqu64	%zmm2, %zmm30
+        vmovdqu64	%zmm14, %zmm31
+        vpternlogq	$0xd2, %zmm21, %zmm14, %zmm2
+        vpternlogq	$0xd2, %zmm8, %zmm21, %zmm14
+        vpternlogq	$0xd2, %zmm15, %zmm8, %zmm21
+        vpternlogq	$0xd2, %zmm30, %zmm15, %zmm8
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm15
+        vmovdqu64	%zmm3, %zmm30
+        vmovdqu64	%zmm10, %zmm31
+        vpternlogq	$0xd2, %zmm22, %zmm10, %zmm3
+        vpternlogq	$0xd2, %zmm9, %zmm22, %zmm10
+        vpternlogq	$0xd2, %zmm16, %zmm9, %zmm22
+        vpternlogq	$0xd2, %zmm30, %zmm16, %zmm9
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm16
+        vmovdqu64	%zmm4, %zmm30
+        vmovdqu64	%zmm11, %zmm31
+        vpternlogq	$0xd2, %zmm23, %zmm11, %zmm4
+        vpternlogq	$0xd2, %zmm5, %zmm23, %zmm11
+        vpternlogq	$0xd2, %zmm17, %zmm5, %zmm23
+        vpternlogq	$0xd2, %zmm30, %zmm17, %zmm5
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm17
+        # Iota
+        vpxorq	384(%rax), %zmm0, %zmm0
+        # Round 7
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm2, %zmm1, %zmm25
+        vpternlogq	$0x96, %zmm4, %zmm3, %zmm25
+        vmovdqu64	%zmm12, %zmm26
+        vpternlogq	$0x96, %zmm14, %zmm13, %zmm26
+        vpternlogq	$0x96, %zmm11, %zmm10, %zmm26
+        vmovdqu64	%zmm24, %zmm27
+        vpternlogq	$0x96, %zmm21, %zmm20, %zmm27
+        vpternlogq	$0x96, %zmm23, %zmm22, %zmm27
+        vmovdqu64	%zmm6, %zmm28
+        vpternlogq	$0x96, %zmm8, %zmm7, %zmm28
+        vpternlogq	$0x96, %zmm5, %zmm9, %zmm28
+        vmovdqu64	%zmm18, %zmm29
+        vpternlogq	$0x96, %zmm15, %zmm19, %zmm29
+        vpternlogq	$0x96, %zmm17, %zmm16, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm17, %zmm17
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm12, %zmm12
+        vprolq	$62, %zmm24, %zmm24
+        vprolq	$28, %zmm6, %zmm6
+        vprolq	$27, %zmm18, %zmm18
+        vprolq	$36, %zmm1, %zmm1
+        vprolq	$44, %zmm13, %zmm13
+        vprolq	$6, %zmm20, %zmm20
+        vprolq	$55, %zmm7, %zmm7
+        vprolq	$20, %zmm19, %zmm19
+        vprolq	$3, %zmm2, %zmm2
+        vprolq	$10, %zmm14, %zmm14
+        vprolq	$43, %zmm21, %zmm21
+        vprolq	$25, %zmm8, %zmm8
+        vprolq	$39, %zmm15, %zmm15
+        vprolq	$41, %zmm3, %zmm3
+        vprolq	$45, %zmm10, %zmm10
+        vprolq	$15, %zmm22, %zmm22
+        vprolq	$21, %zmm9, %zmm9
+        vprolq	$8, %zmm16, %zmm16
+        vprolq	$18, %zmm4, %zmm4
+        vprolq	$2, %zmm11, %zmm11
+        vprolq	$61, %zmm23, %zmm23
+        vprolq	$56, %zmm5, %zmm5
+        vprolq	$14, %zmm17, %zmm17
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm13, %zmm31
+        vpternlogq	$0xd2, %zmm21, %zmm13, %zmm0
+        vpternlogq	$0xd2, %zmm9, %zmm21, %zmm13
+        vpternlogq	$0xd2, %zmm17, %zmm9, %zmm21
+        vpternlogq	$0xd2, %zmm30, %zmm17, %zmm9
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm17
+        vmovdqu64	%zmm6, %zmm30
+        vmovdqu64	%zmm19, %zmm31
+        vpternlogq	$0xd2, %zmm2, %zmm19, %zmm6
+        vpternlogq	$0xd2, %zmm10, %zmm2, %zmm19
+        vpternlogq	$0xd2, %zmm23, %zmm10, %zmm2
+        vpternlogq	$0xd2, %zmm30, %zmm23, %zmm10
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm23
+        vmovdqu64	%zmm12, %zmm30
+        vmovdqu64	%zmm20, %zmm31
+        vpternlogq	$0xd2, %zmm8, %zmm20, %zmm12
+        vpternlogq	$0xd2, %zmm16, %zmm8, %zmm20
+        vpternlogq	$0xd2, %zmm4, %zmm16, %zmm8
+        vpternlogq	$0xd2, %zmm30, %zmm4, %zmm16
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm4
+        vmovdqu64	%zmm18, %zmm30
+        vmovdqu64	%zmm1, %zmm31
+        vpternlogq	$0xd2, %zmm14, %zmm1, %zmm18
+        vpternlogq	$0xd2, %zmm22, %zmm14, %zmm1
+        vpternlogq	$0xd2, %zmm5, %zmm22, %zmm14
+        vpternlogq	$0xd2, %zmm30, %zmm5, %zmm22
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm5
+        vmovdqu64	%zmm24, %zmm30
+        vmovdqu64	%zmm7, %zmm31
+        vpternlogq	$0xd2, %zmm15, %zmm7, %zmm24
+        vpternlogq	$0xd2, %zmm3, %zmm15, %zmm7
+        vpternlogq	$0xd2, %zmm11, %zmm3, %zmm15
+        vpternlogq	$0xd2, %zmm30, %zmm11, %zmm3
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm11
+        # Iota
+        vpxorq	448(%rax), %zmm0, %zmm0
+        # Round 8
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm12, %zmm6, %zmm25
+        vpternlogq	$0x96, %zmm24, %zmm18, %zmm25
+        vmovdqu64	%zmm13, %zmm26
+        vpternlogq	$0x96, %zmm20, %zmm19, %zmm26
+        vpternlogq	$0x96, %zmm7, %zmm1, %zmm26
+        vmovdqu64	%zmm21, %zmm27
+        vpternlogq	$0x96, %zmm8, %zmm2, %zmm27
+        vpternlogq	$0x96, %zmm15, %zmm14, %zmm27
+        vmovdqu64	%zmm9, %zmm28
+        vpternlogq	$0x96, %zmm16, %zmm10, %zmm28
+        vpternlogq	$0x96, %zmm3, %zmm22, %zmm28
+        vmovdqu64	%zmm17, %zmm29
+        vpternlogq	$0x96, %zmm4, %zmm23, %zmm29
+        vpternlogq	$0x96, %zmm11, %zmm5, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm11, %zmm11
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm13, %zmm13
+        vprolq	$62, %zmm21, %zmm21
+        vprolq	$28, %zmm9, %zmm9
+        vprolq	$27, %zmm17, %zmm17
+        vprolq	$36, %zmm6, %zmm6
+        vprolq	$44, %zmm19, %zmm19
+        vprolq	$6, %zmm2, %zmm2
+        vprolq	$55, %zmm10, %zmm10
+        vprolq	$20, %zmm23, %zmm23
+        vprolq	$3, %zmm12, %zmm12
+        vprolq	$10, %zmm20, %zmm20
+        vprolq	$43, %zmm8, %zmm8
+        vprolq	$25, %zmm16, %zmm16
+        vprolq	$39, %zmm4, %zmm4
+        vprolq	$41, %zmm18, %zmm18
+        vprolq	$45, %zmm1, %zmm1
+        vprolq	$15, %zmm14, %zmm14
+        vprolq	$21, %zmm22, %zmm22
+        vprolq	$8, %zmm5, %zmm5
+        vprolq	$18, %zmm24, %zmm24
+        vprolq	$2, %zmm7, %zmm7
+        vprolq	$61, %zmm15, %zmm15
+        vprolq	$56, %zmm3, %zmm3
+        vprolq	$14, %zmm11, %zmm11
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm19, %zmm31
+        vpternlogq	$0xd2, %zmm8, %zmm19, %zmm0
+        vpternlogq	$0xd2, %zmm22, %zmm8, %zmm19
+        vpternlogq	$0xd2, %zmm11, %zmm22, %zmm8
+        vpternlogq	$0xd2, %zmm30, %zmm11, %zmm22
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm11
+        vmovdqu64	%zmm9, %zmm30
+        vmovdqu64	%zmm23, %zmm31
+        vpternlogq	$0xd2, %zmm12, %zmm23, %zmm9
+        vpternlogq	$0xd2, %zmm1, %zmm12, %zmm23
+        vpternlogq	$0xd2, %zmm15, %zmm1, %zmm12
+        vpternlogq	$0xd2, %zmm30, %zmm15, %zmm1
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm15
+        vmovdqu64	%zmm13, %zmm30
+        vmovdqu64	%zmm2, %zmm31
+        vpternlogq	$0xd2, %zmm16, %zmm2, %zmm13
+        vpternlogq	$0xd2, %zmm5, %zmm16, %zmm2
+        vpternlogq	$0xd2, %zmm24, %zmm5, %zmm16
+        vpternlogq	$0xd2, %zmm30, %zmm24, %zmm5
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm24
+        vmovdqu64	%zmm17, %zmm30
+        vmovdqu64	%zmm6, %zmm31
+        vpternlogq	$0xd2, %zmm20, %zmm6, %zmm17
+        vpternlogq	$0xd2, %zmm14, %zmm20, %zmm6
+        vpternlogq	$0xd2, %zmm3, %zmm14, %zmm20
+        vpternlogq	$0xd2, %zmm30, %zmm3, %zmm14
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm3
+        vmovdqu64	%zmm21, %zmm30
+        vmovdqu64	%zmm10, %zmm31
+        vpternlogq	$0xd2, %zmm4, %zmm10, %zmm21
+        vpternlogq	$0xd2, %zmm18, %zmm4, %zmm10
+        vpternlogq	$0xd2, %zmm7, %zmm18, %zmm4
+        vpternlogq	$0xd2, %zmm30, %zmm7, %zmm18
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm7
+        # Iota
+        vpxorq	512(%rax), %zmm0, %zmm0
+        # Round 9
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm13, %zmm9, %zmm25
+        vpternlogq	$0x96, %zmm21, %zmm17, %zmm25
+        vmovdqu64	%zmm19, %zmm26
+        vpternlogq	$0x96, %zmm2, %zmm23, %zmm26
+        vpternlogq	$0x96, %zmm10, %zmm6, %zmm26
+        vmovdqu64	%zmm8, %zmm27
+        vpternlogq	$0x96, %zmm16, %zmm12, %zmm27
+        vpternlogq	$0x96, %zmm4, %zmm20, %zmm27
+        vmovdqu64	%zmm22, %zmm28
+        vpternlogq	$0x96, %zmm5, %zmm1, %zmm28
+        vpternlogq	$0x96, %zmm18, %zmm14, %zmm28
+        vmovdqu64	%zmm11, %zmm29
+        vpternlogq	$0x96, %zmm24, %zmm15, %zmm29
+        vpternlogq	$0x96, %zmm7, %zmm3, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm7, %zmm7
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm19, %zmm19
+        vprolq	$62, %zmm8, %zmm8
+        vprolq	$28, %zmm22, %zmm22
+        vprolq	$27, %zmm11, %zmm11
+        vprolq	$36, %zmm9, %zmm9
+        vprolq	$44, %zmm23, %zmm23
+        vprolq	$6, %zmm12, %zmm12
+        vprolq	$55, %zmm1, %zmm1
+        vprolq	$20, %zmm15, %zmm15
+        vprolq	$3, %zmm13, %zmm13
+        vprolq	$10, %zmm2, %zmm2
+        vprolq	$43, %zmm16, %zmm16
+        vprolq	$25, %zmm5, %zmm5
+        vprolq	$39, %zmm24, %zmm24
+        vprolq	$41, %zmm17, %zmm17
+        vprolq	$45, %zmm6, %zmm6
+        vprolq	$15, %zmm20, %zmm20
+        vprolq	$21, %zmm14, %zmm14
+        vprolq	$8, %zmm3, %zmm3
+        vprolq	$18, %zmm21, %zmm21
+        vprolq	$2, %zmm10, %zmm10
+        vprolq	$61, %zmm4, %zmm4
+        vprolq	$56, %zmm18, %zmm18
+        vprolq	$14, %zmm7, %zmm7
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm23, %zmm31
+        vpternlogq	$0xd2, %zmm16, %zmm23, %zmm0
+        vpternlogq	$0xd2, %zmm14, %zmm16, %zmm23
+        vpternlogq	$0xd2, %zmm7, %zmm14, %zmm16
+        vpternlogq	$0xd2, %zmm30, %zmm7, %zmm14
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm7
+        vmovdqu64	%zmm22, %zmm30
+        vmovdqu64	%zmm15, %zmm31
+        vpternlogq	$0xd2, %zmm13, %zmm15, %zmm22
+        vpternlogq	$0xd2, %zmm6, %zmm13, %zmm15
+        vpternlogq	$0xd2, %zmm4, %zmm6, %zmm13
+        vpternlogq	$0xd2, %zmm30, %zmm4, %zmm6
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm4
+        vmovdqu64	%zmm19, %zmm30
+        vmovdqu64	%zmm12, %zmm31
+        vpternlogq	$0xd2, %zmm5, %zmm12, %zmm19
+        vpternlogq	$0xd2, %zmm3, %zmm5, %zmm12
+        vpternlogq	$0xd2, %zmm21, %zmm3, %zmm5
+        vpternlogq	$0xd2, %zmm30, %zmm21, %zmm3
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm21
+        vmovdqu64	%zmm11, %zmm30
+        vmovdqu64	%zmm9, %zmm31
+        vpternlogq	$0xd2, %zmm2, %zmm9, %zmm11
+        vpternlogq	$0xd2, %zmm20, %zmm2, %zmm9
+        vpternlogq	$0xd2, %zmm18, %zmm20, %zmm2
+        vpternlogq	$0xd2, %zmm30, %zmm18, %zmm20
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm18
+        vmovdqu64	%zmm8, %zmm30
+        vmovdqu64	%zmm1, %zmm31
+        vpternlogq	$0xd2, %zmm24, %zmm1, %zmm8
+        vpternlogq	$0xd2, %zmm17, %zmm24, %zmm1
+        vpternlogq	$0xd2, %zmm10, %zmm17, %zmm24
+        vpternlogq	$0xd2, %zmm30, %zmm10, %zmm17
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm10
+        # Iota
+        vpxorq	576(%rax), %zmm0, %zmm0
+        # Round 10
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm19, %zmm22, %zmm25
+        vpternlogq	$0x96, %zmm8, %zmm11, %zmm25
+        vmovdqu64	%zmm23, %zmm26
+        vpternlogq	$0x96, %zmm12, %zmm15, %zmm26
+        vpternlogq	$0x96, %zmm1, %zmm9, %zmm26
+        vmovdqu64	%zmm16, %zmm27
+        vpternlogq	$0x96, %zmm5, %zmm13, %zmm27
+        vpternlogq	$0x96, %zmm24, %zmm2, %zmm27
+        vmovdqu64	%zmm14, %zmm28
+        vpternlogq	$0x96, %zmm3, %zmm6, %zmm28
+        vpternlogq	$0x96, %zmm17, %zmm20, %zmm28
+        vmovdqu64	%zmm7, %zmm29
+        vpternlogq	$0x96, %zmm21, %zmm4, %zmm29
+        vpternlogq	$0x96, %zmm10, %zmm18, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm10, %zmm10
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm23, %zmm23
+        vprolq	$62, %zmm16, %zmm16
+        vprolq	$28, %zmm14, %zmm14
+        vprolq	$27, %zmm7, %zmm7
+        vprolq	$36, %zmm22, %zmm22
+        vprolq	$44, %zmm15, %zmm15
+        vprolq	$6, %zmm13, %zmm13
+        vprolq	$55, %zmm6, %zmm6
+        vprolq	$20, %zmm4, %zmm4
+        vprolq	$3, %zmm19, %zmm19
+        vprolq	$10, %zmm12, %zmm12
+        vprolq	$43, %zmm5, %zmm5
+        vprolq	$25, %zmm3, %zmm3
+        vprolq	$39, %zmm21, %zmm21
+        vprolq	$41, %zmm11, %zmm11
+        vprolq	$45, %zmm9, %zmm9
+        vprolq	$15, %zmm2, %zmm2
+        vprolq	$21, %zmm20, %zmm20
+        vprolq	$8, %zmm18, %zmm18
+        vprolq	$18, %zmm8, %zmm8
+        vprolq	$2, %zmm1, %zmm1
+        vprolq	$61, %zmm24, %zmm24
+        vprolq	$56, %zmm17, %zmm17
+        vprolq	$14, %zmm10, %zmm10
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm15, %zmm31
+        vpternlogq	$0xd2, %zmm5, %zmm15, %zmm0
+        vpternlogq	$0xd2, %zmm20, %zmm5, %zmm15
+        vpternlogq	$0xd2, %zmm10, %zmm20, %zmm5
+        vpternlogq	$0xd2, %zmm30, %zmm10, %zmm20
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm10
+        vmovdqu64	%zmm14, %zmm30
+        vmovdqu64	%zmm4, %zmm31
+        vpternlogq	$0xd2, %zmm19, %zmm4, %zmm14
+        vpternlogq	$0xd2, %zmm9, %zmm19, %zmm4
+        vpternlogq	$0xd2, %zmm24, %zmm9, %zmm19
+        vpternlogq	$0xd2, %zmm30, %zmm24, %zmm9
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm24
+        vmovdqu64	%zmm23, %zmm30
+        vmovdqu64	%zmm13, %zmm31
+        vpternlogq	$0xd2, %zmm3, %zmm13, %zmm23
+        vpternlogq	$0xd2, %zmm18, %zmm3, %zmm13
+        vpternlogq	$0xd2, %zmm8, %zmm18, %zmm3
+        vpternlogq	$0xd2, %zmm30, %zmm8, %zmm18
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm8
+        vmovdqu64	%zmm7, %zmm30
+        vmovdqu64	%zmm22, %zmm31
+        vpternlogq	$0xd2, %zmm12, %zmm22, %zmm7
+        vpternlogq	$0xd2, %zmm2, %zmm12, %zmm22
+        vpternlogq	$0xd2, %zmm17, %zmm2, %zmm12
+        vpternlogq	$0xd2, %zmm30, %zmm17, %zmm2
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm17
+        vmovdqu64	%zmm16, %zmm30
+        vmovdqu64	%zmm6, %zmm31
+        vpternlogq	$0xd2, %zmm21, %zmm6, %zmm16
+        vpternlogq	$0xd2, %zmm11, %zmm21, %zmm6
+        vpternlogq	$0xd2, %zmm1, %zmm11, %zmm21
+        vpternlogq	$0xd2, %zmm30, %zmm1, %zmm11
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm1
+        # Iota
+        vpxorq	640(%rax), %zmm0, %zmm0
+        # Round 11
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm23, %zmm14, %zmm25
+        vpternlogq	$0x96, %zmm16, %zmm7, %zmm25
+        vmovdqu64	%zmm15, %zmm26
+        vpternlogq	$0x96, %zmm13, %zmm4, %zmm26
+        vpternlogq	$0x96, %zmm6, %zmm22, %zmm26
+        vmovdqu64	%zmm5, %zmm27
+        vpternlogq	$0x96, %zmm3, %zmm19, %zmm27
+        vpternlogq	$0x96, %zmm21, %zmm12, %zmm27
+        vmovdqu64	%zmm20, %zmm28
+        vpternlogq	$0x96, %zmm18, %zmm9, %zmm28
+        vpternlogq	$0x96, %zmm11, %zmm2, %zmm28
+        vmovdqu64	%zmm10, %zmm29
+        vpternlogq	$0x96, %zmm8, %zmm24, %zmm29
+        vpternlogq	$0x96, %zmm1, %zmm17, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm1, %zmm1
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm15, %zmm15
+        vprolq	$62, %zmm5, %zmm5
+        vprolq	$28, %zmm20, %zmm20
+        vprolq	$27, %zmm10, %zmm10
+        vprolq	$36, %zmm14, %zmm14
+        vprolq	$44, %zmm4, %zmm4
+        vprolq	$6, %zmm19, %zmm19
+        vprolq	$55, %zmm9, %zmm9
+        vprolq	$20, %zmm24, %zmm24
+        vprolq	$3, %zmm23, %zmm23
+        vprolq	$10, %zmm13, %zmm13
+        vprolq	$43, %zmm3, %zmm3
+        vprolq	$25, %zmm18, %zmm18
+        vprolq	$39, %zmm8, %zmm8
+        vprolq	$41, %zmm7, %zmm7
+        vprolq	$45, %zmm22, %zmm22
+        vprolq	$15, %zmm12, %zmm12
+        vprolq	$21, %zmm2, %zmm2
+        vprolq	$8, %zmm17, %zmm17
+        vprolq	$18, %zmm16, %zmm16
+        vprolq	$2, %zmm6, %zmm6
+        vprolq	$61, %zmm21, %zmm21
+        vprolq	$56, %zmm11, %zmm11
+        vprolq	$14, %zmm1, %zmm1
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm4, %zmm31
+        vpternlogq	$0xd2, %zmm3, %zmm4, %zmm0
+        vpternlogq	$0xd2, %zmm2, %zmm3, %zmm4
+        vpternlogq	$0xd2, %zmm1, %zmm2, %zmm3
+        vpternlogq	$0xd2, %zmm30, %zmm1, %zmm2
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm1
+        vmovdqu64	%zmm20, %zmm30
+        vmovdqu64	%zmm24, %zmm31
+        vpternlogq	$0xd2, %zmm23, %zmm24, %zmm20
+        vpternlogq	$0xd2, %zmm22, %zmm23, %zmm24
+        vpternlogq	$0xd2, %zmm21, %zmm22, %zmm23
+        vpternlogq	$0xd2, %zmm30, %zmm21, %zmm22
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm21
+        vmovdqu64	%zmm15, %zmm30
+        vmovdqu64	%zmm19, %zmm31
+        vpternlogq	$0xd2, %zmm18, %zmm19, %zmm15
+        vpternlogq	$0xd2, %zmm17, %zmm18, %zmm19
+        vpternlogq	$0xd2, %zmm16, %zmm17, %zmm18
+        vpternlogq	$0xd2, %zmm30, %zmm16, %zmm17
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm16
+        vmovdqu64	%zmm10, %zmm30
+        vmovdqu64	%zmm14, %zmm31
+        vpternlogq	$0xd2, %zmm13, %zmm14, %zmm10
+        vpternlogq	$0xd2, %zmm12, %zmm13, %zmm14
+        vpternlogq	$0xd2, %zmm11, %zmm12, %zmm13
+        vpternlogq	$0xd2, %zmm30, %zmm11, %zmm12
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm11
+        vmovdqu64	%zmm5, %zmm30
+        vmovdqu64	%zmm9, %zmm31
+        vpternlogq	$0xd2, %zmm8, %zmm9, %zmm5
+        vpternlogq	$0xd2, %zmm7, %zmm8, %zmm9
+        vpternlogq	$0xd2, %zmm6, %zmm7, %zmm8
+        vpternlogq	$0xd2, %zmm30, %zmm6, %zmm7
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm6
+        # Iota
+        vpxorq	704(%rax), %zmm0, %zmm0
+        # Round 12
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm15, %zmm20, %zmm25
+        vpternlogq	$0x96, %zmm5, %zmm10, %zmm25
+        vmovdqu64	%zmm4, %zmm26
+        vpternlogq	$0x96, %zmm19, %zmm24, %zmm26
+        vpternlogq	$0x96, %zmm9, %zmm14, %zmm26
+        vmovdqu64	%zmm3, %zmm27
+        vpternlogq	$0x96, %zmm18, %zmm23, %zmm27
+        vpternlogq	$0x96, %zmm8, %zmm13, %zmm27
+        vmovdqu64	%zmm2, %zmm28
+        vpternlogq	$0x96, %zmm17, %zmm22, %zmm28
+        vpternlogq	$0x96, %zmm7, %zmm12, %zmm28
+        vmovdqu64	%zmm1, %zmm29
+        vpternlogq	$0x96, %zmm16, %zmm21, %zmm29
+        vpternlogq	$0x96, %zmm6, %zmm11, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm6, %zmm6
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm4, %zmm4
+        vprolq	$62, %zmm3, %zmm3
+        vprolq	$28, %zmm2, %zmm2
+        vprolq	$27, %zmm1, %zmm1
+        vprolq	$36, %zmm20, %zmm20
+        vprolq	$44, %zmm24, %zmm24
+        vprolq	$6, %zmm23, %zmm23
+        vprolq	$55, %zmm22, %zmm22
+        vprolq	$20, %zmm21, %zmm21
+        vprolq	$3, %zmm15, %zmm15
+        vprolq	$10, %zmm19, %zmm19
+        vprolq	$43, %zmm18, %zmm18
+        vprolq	$25, %zmm17, %zmm17
+        vprolq	$39, %zmm16, %zmm16
+        vprolq	$41, %zmm10, %zmm10
+        vprolq	$45, %zmm14, %zmm14
+        vprolq	$15, %zmm13, %zmm13
+        vprolq	$21, %zmm12, %zmm12
+        vprolq	$8, %zmm11, %zmm11
+        vprolq	$18, %zmm5, %zmm5
+        vprolq	$2, %zmm9, %zmm9
+        vprolq	$61, %zmm8, %zmm8
+        vprolq	$56, %zmm7, %zmm7
+        vprolq	$14, %zmm6, %zmm6
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm24, %zmm31
+        vpternlogq	$0xd2, %zmm18, %zmm24, %zmm0
+        vpternlogq	$0xd2, %zmm12, %zmm18, %zmm24
+        vpternlogq	$0xd2, %zmm6, %zmm12, %zmm18
+        vpternlogq	$0xd2, %zmm30, %zmm6, %zmm12
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm6
+        vmovdqu64	%zmm2, %zmm30
+        vmovdqu64	%zmm21, %zmm31
+        vpternlogq	$0xd2, %zmm15, %zmm21, %zmm2
+        vpternlogq	$0xd2, %zmm14, %zmm15, %zmm21
+        vpternlogq	$0xd2, %zmm8, %zmm14, %zmm15
+        vpternlogq	$0xd2, %zmm30, %zmm8, %zmm14
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm8
+        vmovdqu64	%zmm4, %zmm30
+        vmovdqu64	%zmm23, %zmm31
+        vpternlogq	$0xd2, %zmm17, %zmm23, %zmm4
+        vpternlogq	$0xd2, %zmm11, %zmm17, %zmm23
+        vpternlogq	$0xd2, %zmm5, %zmm11, %zmm17
+        vpternlogq	$0xd2, %zmm30, %zmm5, %zmm11
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm5
+        vmovdqu64	%zmm1, %zmm30
+        vmovdqu64	%zmm20, %zmm31
+        vpternlogq	$0xd2, %zmm19, %zmm20, %zmm1
+        vpternlogq	$0xd2, %zmm13, %zmm19, %zmm20
+        vpternlogq	$0xd2, %zmm7, %zmm13, %zmm19
+        vpternlogq	$0xd2, %zmm30, %zmm7, %zmm13
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm7
+        vmovdqu64	%zmm3, %zmm30
+        vmovdqu64	%zmm22, %zmm31
+        vpternlogq	$0xd2, %zmm16, %zmm22, %zmm3
+        vpternlogq	$0xd2, %zmm10, %zmm16, %zmm22
+        vpternlogq	$0xd2, %zmm9, %zmm10, %zmm16
+        vpternlogq	$0xd2, %zmm30, %zmm9, %zmm10
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm9
+        # Iota
+        vpxorq	768(%rax), %zmm0, %zmm0
+        # Round 13
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm4, %zmm2, %zmm25
+        vpternlogq	$0x96, %zmm3, %zmm1, %zmm25
+        vmovdqu64	%zmm24, %zmm26
+        vpternlogq	$0x96, %zmm23, %zmm21, %zmm26
+        vpternlogq	$0x96, %zmm22, %zmm20, %zmm26
+        vmovdqu64	%zmm18, %zmm27
+        vpternlogq	$0x96, %zmm17, %zmm15, %zmm27
+        vpternlogq	$0x96, %zmm16, %zmm19, %zmm27
+        vmovdqu64	%zmm12, %zmm28
+        vpternlogq	$0x96, %zmm11, %zmm14, %zmm28
+        vpternlogq	$0x96, %zmm10, %zmm13, %zmm28
+        vmovdqu64	%zmm6, %zmm29
+        vpternlogq	$0x96, %zmm5, %zmm8, %zmm29
+        vpternlogq	$0x96, %zmm9, %zmm7, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm9, %zmm9
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm24, %zmm24
+        vprolq	$62, %zmm18, %zmm18
+        vprolq	$28, %zmm12, %zmm12
+        vprolq	$27, %zmm6, %zmm6
+        vprolq	$36, %zmm2, %zmm2
+        vprolq	$44, %zmm21, %zmm21
+        vprolq	$6, %zmm15, %zmm15
+        vprolq	$55, %zmm14, %zmm14
+        vprolq	$20, %zmm8, %zmm8
+        vprolq	$3, %zmm4, %zmm4
+        vprolq	$10, %zmm23, %zmm23
+        vprolq	$43, %zmm17, %zmm17
+        vprolq	$25, %zmm11, %zmm11
+        vprolq	$39, %zmm5, %zmm5
+        vprolq	$41, %zmm1, %zmm1
+        vprolq	$45, %zmm20, %zmm20
+        vprolq	$15, %zmm19, %zmm19
+        vprolq	$21, %zmm13, %zmm13
+        vprolq	$8, %zmm7, %zmm7
+        vprolq	$18, %zmm3, %zmm3
+        vprolq	$2, %zmm22, %zmm22
+        vprolq	$61, %zmm16, %zmm16
+        vprolq	$56, %zmm10, %zmm10
+        vprolq	$14, %zmm9, %zmm9
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm21, %zmm31
+        vpternlogq	$0xd2, %zmm17, %zmm21, %zmm0
+        vpternlogq	$0xd2, %zmm13, %zmm17, %zmm21
+        vpternlogq	$0xd2, %zmm9, %zmm13, %zmm17
+        vpternlogq	$0xd2, %zmm30, %zmm9, %zmm13
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm9
+        vmovdqu64	%zmm12, %zmm30
+        vmovdqu64	%zmm8, %zmm31
+        vpternlogq	$0xd2, %zmm4, %zmm8, %zmm12
+        vpternlogq	$0xd2, %zmm20, %zmm4, %zmm8
+        vpternlogq	$0xd2, %zmm16, %zmm20, %zmm4
+        vpternlogq	$0xd2, %zmm30, %zmm16, %zmm20
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm16
+        vmovdqu64	%zmm24, %zmm30
+        vmovdqu64	%zmm15, %zmm31
+        vpternlogq	$0xd2, %zmm11, %zmm15, %zmm24
+        vpternlogq	$0xd2, %zmm7, %zmm11, %zmm15
+        vpternlogq	$0xd2, %zmm3, %zmm7, %zmm11
+        vpternlogq	$0xd2, %zmm30, %zmm3, %zmm7
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm3
+        vmovdqu64	%zmm6, %zmm30
+        vmovdqu64	%zmm2, %zmm31
+        vpternlogq	$0xd2, %zmm23, %zmm2, %zmm6
+        vpternlogq	$0xd2, %zmm19, %zmm23, %zmm2
+        vpternlogq	$0xd2, %zmm10, %zmm19, %zmm23
+        vpternlogq	$0xd2, %zmm30, %zmm10, %zmm19
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm10
+        vmovdqu64	%zmm18, %zmm30
+        vmovdqu64	%zmm14, %zmm31
+        vpternlogq	$0xd2, %zmm5, %zmm14, %zmm18
+        vpternlogq	$0xd2, %zmm1, %zmm5, %zmm14
+        vpternlogq	$0xd2, %zmm22, %zmm1, %zmm5
+        vpternlogq	$0xd2, %zmm30, %zmm22, %zmm1
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm22
+        # Iota
+        vpxorq	832(%rax), %zmm0, %zmm0
+        # Round 14
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm24, %zmm12, %zmm25
+        vpternlogq	$0x96, %zmm18, %zmm6, %zmm25
+        vmovdqu64	%zmm21, %zmm26
+        vpternlogq	$0x96, %zmm15, %zmm8, %zmm26
+        vpternlogq	$0x96, %zmm14, %zmm2, %zmm26
+        vmovdqu64	%zmm17, %zmm27
+        vpternlogq	$0x96, %zmm11, %zmm4, %zmm27
+        vpternlogq	$0x96, %zmm5, %zmm23, %zmm27
+        vmovdqu64	%zmm13, %zmm28
+        vpternlogq	$0x96, %zmm7, %zmm20, %zmm28
+        vpternlogq	$0x96, %zmm1, %zmm19, %zmm28
+        vmovdqu64	%zmm9, %zmm29
+        vpternlogq	$0x96, %zmm3, %zmm16, %zmm29
+        vpternlogq	$0x96, %zmm22, %zmm10, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm22, %zmm22
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm21, %zmm21
+        vprolq	$62, %zmm17, %zmm17
+        vprolq	$28, %zmm13, %zmm13
+        vprolq	$27, %zmm9, %zmm9
+        vprolq	$36, %zmm12, %zmm12
+        vprolq	$44, %zmm8, %zmm8
+        vprolq	$6, %zmm4, %zmm4
+        vprolq	$55, %zmm20, %zmm20
+        vprolq	$20, %zmm16, %zmm16
+        vprolq	$3, %zmm24, %zmm24
+        vprolq	$10, %zmm15, %zmm15
+        vprolq	$43, %zmm11, %zmm11
+        vprolq	$25, %zmm7, %zmm7
+        vprolq	$39, %zmm3, %zmm3
+        vprolq	$41, %zmm6, %zmm6
+        vprolq	$45, %zmm2, %zmm2
+        vprolq	$15, %zmm23, %zmm23
+        vprolq	$21, %zmm19, %zmm19
+        vprolq	$8, %zmm10, %zmm10
+        vprolq	$18, %zmm18, %zmm18
+        vprolq	$2, %zmm14, %zmm14
+        vprolq	$61, %zmm5, %zmm5
+        vprolq	$56, %zmm1, %zmm1
+        vprolq	$14, %zmm22, %zmm22
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm8, %zmm31
+        vpternlogq	$0xd2, %zmm11, %zmm8, %zmm0
+        vpternlogq	$0xd2, %zmm19, %zmm11, %zmm8
+        vpternlogq	$0xd2, %zmm22, %zmm19, %zmm11
+        vpternlogq	$0xd2, %zmm30, %zmm22, %zmm19
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm22
+        vmovdqu64	%zmm13, %zmm30
+        vmovdqu64	%zmm16, %zmm31
+        vpternlogq	$0xd2, %zmm24, %zmm16, %zmm13
+        vpternlogq	$0xd2, %zmm2, %zmm24, %zmm16
+        vpternlogq	$0xd2, %zmm5, %zmm2, %zmm24
+        vpternlogq	$0xd2, %zmm30, %zmm5, %zmm2
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm5
+        vmovdqu64	%zmm21, %zmm30
+        vmovdqu64	%zmm4, %zmm31
+        vpternlogq	$0xd2, %zmm7, %zmm4, %zmm21
+        vpternlogq	$0xd2, %zmm10, %zmm7, %zmm4
+        vpternlogq	$0xd2, %zmm18, %zmm10, %zmm7
+        vpternlogq	$0xd2, %zmm30, %zmm18, %zmm10
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm18
+        vmovdqu64	%zmm9, %zmm30
+        vmovdqu64	%zmm12, %zmm31
+        vpternlogq	$0xd2, %zmm15, %zmm12, %zmm9
+        vpternlogq	$0xd2, %zmm23, %zmm15, %zmm12
+        vpternlogq	$0xd2, %zmm1, %zmm23, %zmm15
+        vpternlogq	$0xd2, %zmm30, %zmm1, %zmm23
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm1
+        vmovdqu64	%zmm17, %zmm30
+        vmovdqu64	%zmm20, %zmm31
+        vpternlogq	$0xd2, %zmm3, %zmm20, %zmm17
+        vpternlogq	$0xd2, %zmm6, %zmm3, %zmm20
+        vpternlogq	$0xd2, %zmm14, %zmm6, %zmm3
+        vpternlogq	$0xd2, %zmm30, %zmm14, %zmm6
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm14
+        # Iota
+        vpxorq	896(%rax), %zmm0, %zmm0
+        # Round 15
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm21, %zmm13, %zmm25
+        vpternlogq	$0x96, %zmm17, %zmm9, %zmm25
+        vmovdqu64	%zmm8, %zmm26
+        vpternlogq	$0x96, %zmm4, %zmm16, %zmm26
+        vpternlogq	$0x96, %zmm20, %zmm12, %zmm26
+        vmovdqu64	%zmm11, %zmm27
+        vpternlogq	$0x96, %zmm7, %zmm24, %zmm27
+        vpternlogq	$0x96, %zmm3, %zmm15, %zmm27
+        vmovdqu64	%zmm19, %zmm28
+        vpternlogq	$0x96, %zmm10, %zmm2, %zmm28
+        vpternlogq	$0x96, %zmm6, %zmm23, %zmm28
+        vmovdqu64	%zmm22, %zmm29
+        vpternlogq	$0x96, %zmm18, %zmm5, %zmm29
+        vpternlogq	$0x96, %zmm14, %zmm1, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm14, %zmm14
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm8, %zmm8
+        vprolq	$62, %zmm11, %zmm11
+        vprolq	$28, %zmm19, %zmm19
+        vprolq	$27, %zmm22, %zmm22
+        vprolq	$36, %zmm13, %zmm13
+        vprolq	$44, %zmm16, %zmm16
+        vprolq	$6, %zmm24, %zmm24
+        vprolq	$55, %zmm2, %zmm2
+        vprolq	$20, %zmm5, %zmm5
+        vprolq	$3, %zmm21, %zmm21
+        vprolq	$10, %zmm4, %zmm4
+        vprolq	$43, %zmm7, %zmm7
+        vprolq	$25, %zmm10, %zmm10
+        vprolq	$39, %zmm18, %zmm18
+        vprolq	$41, %zmm9, %zmm9
+        vprolq	$45, %zmm12, %zmm12
+        vprolq	$15, %zmm15, %zmm15
+        vprolq	$21, %zmm23, %zmm23
+        vprolq	$8, %zmm1, %zmm1
+        vprolq	$18, %zmm17, %zmm17
+        vprolq	$2, %zmm20, %zmm20
+        vprolq	$61, %zmm3, %zmm3
+        vprolq	$56, %zmm6, %zmm6
+        vprolq	$14, %zmm14, %zmm14
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm16, %zmm31
+        vpternlogq	$0xd2, %zmm7, %zmm16, %zmm0
+        vpternlogq	$0xd2, %zmm23, %zmm7, %zmm16
+        vpternlogq	$0xd2, %zmm14, %zmm23, %zmm7
+        vpternlogq	$0xd2, %zmm30, %zmm14, %zmm23
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm14
+        vmovdqu64	%zmm19, %zmm30
+        vmovdqu64	%zmm5, %zmm31
+        vpternlogq	$0xd2, %zmm21, %zmm5, %zmm19
+        vpternlogq	$0xd2, %zmm12, %zmm21, %zmm5
+        vpternlogq	$0xd2, %zmm3, %zmm12, %zmm21
+        vpternlogq	$0xd2, %zmm30, %zmm3, %zmm12
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm3
+        vmovdqu64	%zmm8, %zmm30
+        vmovdqu64	%zmm24, %zmm31
+        vpternlogq	$0xd2, %zmm10, %zmm24, %zmm8
+        vpternlogq	$0xd2, %zmm1, %zmm10, %zmm24
+        vpternlogq	$0xd2, %zmm17, %zmm1, %zmm10
+        vpternlogq	$0xd2, %zmm30, %zmm17, %zmm1
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm17
+        vmovdqu64	%zmm22, %zmm30
+        vmovdqu64	%zmm13, %zmm31
+        vpternlogq	$0xd2, %zmm4, %zmm13, %zmm22
+        vpternlogq	$0xd2, %zmm15, %zmm4, %zmm13
+        vpternlogq	$0xd2, %zmm6, %zmm15, %zmm4
+        vpternlogq	$0xd2, %zmm30, %zmm6, %zmm15
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm6
+        vmovdqu64	%zmm11, %zmm30
+        vmovdqu64	%zmm2, %zmm31
+        vpternlogq	$0xd2, %zmm18, %zmm2, %zmm11
+        vpternlogq	$0xd2, %zmm9, %zmm18, %zmm2
+        vpternlogq	$0xd2, %zmm20, %zmm9, %zmm18
+        vpternlogq	$0xd2, %zmm30, %zmm20, %zmm9
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm20
+        # Iota
+        vpxorq	960(%rax), %zmm0, %zmm0
+        # Round 16
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm8, %zmm19, %zmm25
+        vpternlogq	$0x96, %zmm11, %zmm22, %zmm25
+        vmovdqu64	%zmm16, %zmm26
+        vpternlogq	$0x96, %zmm24, %zmm5, %zmm26
+        vpternlogq	$0x96, %zmm2, %zmm13, %zmm26
+        vmovdqu64	%zmm7, %zmm27
+        vpternlogq	$0x96, %zmm10, %zmm21, %zmm27
+        vpternlogq	$0x96, %zmm18, %zmm4, %zmm27
+        vmovdqu64	%zmm23, %zmm28
+        vpternlogq	$0x96, %zmm1, %zmm12, %zmm28
+        vpternlogq	$0x96, %zmm9, %zmm15, %zmm28
+        vmovdqu64	%zmm14, %zmm29
+        vpternlogq	$0x96, %zmm17, %zmm3, %zmm29
+        vpternlogq	$0x96, %zmm20, %zmm6, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm20, %zmm20
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm16, %zmm16
+        vprolq	$62, %zmm7, %zmm7
+        vprolq	$28, %zmm23, %zmm23
+        vprolq	$27, %zmm14, %zmm14
+        vprolq	$36, %zmm19, %zmm19
+        vprolq	$44, %zmm5, %zmm5
+        vprolq	$6, %zmm21, %zmm21
+        vprolq	$55, %zmm12, %zmm12
+        vprolq	$20, %zmm3, %zmm3
+        vprolq	$3, %zmm8, %zmm8
+        vprolq	$10, %zmm24, %zmm24
+        vprolq	$43, %zmm10, %zmm10
+        vprolq	$25, %zmm1, %zmm1
+        vprolq	$39, %zmm17, %zmm17
+        vprolq	$41, %zmm22, %zmm22
+        vprolq	$45, %zmm13, %zmm13
+        vprolq	$15, %zmm4, %zmm4
+        vprolq	$21, %zmm15, %zmm15
+        vprolq	$8, %zmm6, %zmm6
+        vprolq	$18, %zmm11, %zmm11
+        vprolq	$2, %zmm2, %zmm2
+        vprolq	$61, %zmm18, %zmm18
+        vprolq	$56, %zmm9, %zmm9
+        vprolq	$14, %zmm20, %zmm20
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm5, %zmm31
+        vpternlogq	$0xd2, %zmm10, %zmm5, %zmm0
+        vpternlogq	$0xd2, %zmm15, %zmm10, %zmm5
+        vpternlogq	$0xd2, %zmm20, %zmm15, %zmm10
+        vpternlogq	$0xd2, %zmm30, %zmm20, %zmm15
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm20
+        vmovdqu64	%zmm23, %zmm30
+        vmovdqu64	%zmm3, %zmm31
+        vpternlogq	$0xd2, %zmm8, %zmm3, %zmm23
+        vpternlogq	$0xd2, %zmm13, %zmm8, %zmm3
+        vpternlogq	$0xd2, %zmm18, %zmm13, %zmm8
+        vpternlogq	$0xd2, %zmm30, %zmm18, %zmm13
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm18
+        vmovdqu64	%zmm16, %zmm30
+        vmovdqu64	%zmm21, %zmm31
+        vpternlogq	$0xd2, %zmm1, %zmm21, %zmm16
+        vpternlogq	$0xd2, %zmm6, %zmm1, %zmm21
+        vpternlogq	$0xd2, %zmm11, %zmm6, %zmm1
+        vpternlogq	$0xd2, %zmm30, %zmm11, %zmm6
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm11
+        vmovdqu64	%zmm14, %zmm30
+        vmovdqu64	%zmm19, %zmm31
+        vpternlogq	$0xd2, %zmm24, %zmm19, %zmm14
+        vpternlogq	$0xd2, %zmm4, %zmm24, %zmm19
+        vpternlogq	$0xd2, %zmm9, %zmm4, %zmm24
+        vpternlogq	$0xd2, %zmm30, %zmm9, %zmm4
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm9
+        vmovdqu64	%zmm7, %zmm30
+        vmovdqu64	%zmm12, %zmm31
+        vpternlogq	$0xd2, %zmm17, %zmm12, %zmm7
+        vpternlogq	$0xd2, %zmm22, %zmm17, %zmm12
+        vpternlogq	$0xd2, %zmm2, %zmm22, %zmm17
+        vpternlogq	$0xd2, %zmm30, %zmm2, %zmm22
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm2
+        # Iota
+        vpxorq	1024(%rax), %zmm0, %zmm0
+        # Round 17
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm16, %zmm23, %zmm25
+        vpternlogq	$0x96, %zmm7, %zmm14, %zmm25
+        vmovdqu64	%zmm5, %zmm26
+        vpternlogq	$0x96, %zmm21, %zmm3, %zmm26
+        vpternlogq	$0x96, %zmm12, %zmm19, %zmm26
+        vmovdqu64	%zmm10, %zmm27
+        vpternlogq	$0x96, %zmm1, %zmm8, %zmm27
+        vpternlogq	$0x96, %zmm17, %zmm24, %zmm27
+        vmovdqu64	%zmm15, %zmm28
+        vpternlogq	$0x96, %zmm6, %zmm13, %zmm28
+        vpternlogq	$0x96, %zmm22, %zmm4, %zmm28
+        vmovdqu64	%zmm20, %zmm29
+        vpternlogq	$0x96, %zmm11, %zmm18, %zmm29
+        vpternlogq	$0x96, %zmm2, %zmm9, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm2, %zmm2
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm5, %zmm5
+        vprolq	$62, %zmm10, %zmm10
+        vprolq	$28, %zmm15, %zmm15
+        vprolq	$27, %zmm20, %zmm20
+        vprolq	$36, %zmm23, %zmm23
+        vprolq	$44, %zmm3, %zmm3
+        vprolq	$6, %zmm8, %zmm8
+        vprolq	$55, %zmm13, %zmm13
+        vprolq	$20, %zmm18, %zmm18
+        vprolq	$3, %zmm16, %zmm16
+        vprolq	$10, %zmm21, %zmm21
+        vprolq	$43, %zmm1, %zmm1
+        vprolq	$25, %zmm6, %zmm6
+        vprolq	$39, %zmm11, %zmm11
+        vprolq	$41, %zmm14, %zmm14
+        vprolq	$45, %zmm19, %zmm19
+        vprolq	$15, %zmm24, %zmm24
+        vprolq	$21, %zmm4, %zmm4
+        vprolq	$8, %zmm9, %zmm9
+        vprolq	$18, %zmm7, %zmm7
+        vprolq	$2, %zmm12, %zmm12
+        vprolq	$61, %zmm17, %zmm17
+        vprolq	$56, %zmm22, %zmm22
+        vprolq	$14, %zmm2, %zmm2
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm3, %zmm31
+        vpternlogq	$0xd2, %zmm1, %zmm3, %zmm0
+        vpternlogq	$0xd2, %zmm4, %zmm1, %zmm3
+        vpternlogq	$0xd2, %zmm2, %zmm4, %zmm1
+        vpternlogq	$0xd2, %zmm30, %zmm2, %zmm4
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm2
+        vmovdqu64	%zmm15, %zmm30
+        vmovdqu64	%zmm18, %zmm31
+        vpternlogq	$0xd2, %zmm16, %zmm18, %zmm15
+        vpternlogq	$0xd2, %zmm19, %zmm16, %zmm18
+        vpternlogq	$0xd2, %zmm17, %zmm19, %zmm16
+        vpternlogq	$0xd2, %zmm30, %zmm17, %zmm19
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm17
+        vmovdqu64	%zmm5, %zmm30
+        vmovdqu64	%zmm8, %zmm31
+        vpternlogq	$0xd2, %zmm6, %zmm8, %zmm5
+        vpternlogq	$0xd2, %zmm9, %zmm6, %zmm8
+        vpternlogq	$0xd2, %zmm7, %zmm9, %zmm6
+        vpternlogq	$0xd2, %zmm30, %zmm7, %zmm9
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm7
+        vmovdqu64	%zmm20, %zmm30
+        vmovdqu64	%zmm23, %zmm31
+        vpternlogq	$0xd2, %zmm21, %zmm23, %zmm20
+        vpternlogq	$0xd2, %zmm24, %zmm21, %zmm23
+        vpternlogq	$0xd2, %zmm22, %zmm24, %zmm21
+        vpternlogq	$0xd2, %zmm30, %zmm22, %zmm24
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm22
+        vmovdqu64	%zmm10, %zmm30
+        vmovdqu64	%zmm13, %zmm31
+        vpternlogq	$0xd2, %zmm11, %zmm13, %zmm10
+        vpternlogq	$0xd2, %zmm14, %zmm11, %zmm13
+        vpternlogq	$0xd2, %zmm12, %zmm14, %zmm11
+        vpternlogq	$0xd2, %zmm30, %zmm12, %zmm14
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm12
+        # Iota
+        vpxorq	1088(%rax), %zmm0, %zmm0
+        # Round 18
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm5, %zmm15, %zmm25
+        vpternlogq	$0x96, %zmm10, %zmm20, %zmm25
+        vmovdqu64	%zmm3, %zmm26
+        vpternlogq	$0x96, %zmm8, %zmm18, %zmm26
+        vpternlogq	$0x96, %zmm13, %zmm23, %zmm26
+        vmovdqu64	%zmm1, %zmm27
+        vpternlogq	$0x96, %zmm6, %zmm16, %zmm27
+        vpternlogq	$0x96, %zmm11, %zmm21, %zmm27
+        vmovdqu64	%zmm4, %zmm28
+        vpternlogq	$0x96, %zmm9, %zmm19, %zmm28
+        vpternlogq	$0x96, %zmm14, %zmm24, %zmm28
+        vmovdqu64	%zmm2, %zmm29
+        vpternlogq	$0x96, %zmm7, %zmm17, %zmm29
+        vpternlogq	$0x96, %zmm12, %zmm22, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm12, %zmm12
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm3, %zmm3
+        vprolq	$62, %zmm1, %zmm1
+        vprolq	$28, %zmm4, %zmm4
+        vprolq	$27, %zmm2, %zmm2
+        vprolq	$36, %zmm15, %zmm15
+        vprolq	$44, %zmm18, %zmm18
+        vprolq	$6, %zmm16, %zmm16
+        vprolq	$55, %zmm19, %zmm19
+        vprolq	$20, %zmm17, %zmm17
+        vprolq	$3, %zmm5, %zmm5
+        vprolq	$10, %zmm8, %zmm8
+        vprolq	$43, %zmm6, %zmm6
+        vprolq	$25, %zmm9, %zmm9
+        vprolq	$39, %zmm7, %zmm7
+        vprolq	$41, %zmm20, %zmm20
+        vprolq	$45, %zmm23, %zmm23
+        vprolq	$15, %zmm21, %zmm21
+        vprolq	$21, %zmm24, %zmm24
+        vprolq	$8, %zmm22, %zmm22
+        vprolq	$18, %zmm10, %zmm10
+        vprolq	$2, %zmm13, %zmm13
+        vprolq	$61, %zmm11, %zmm11
+        vprolq	$56, %zmm14, %zmm14
+        vprolq	$14, %zmm12, %zmm12
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm18, %zmm31
+        vpternlogq	$0xd2, %zmm6, %zmm18, %zmm0
+        vpternlogq	$0xd2, %zmm24, %zmm6, %zmm18
+        vpternlogq	$0xd2, %zmm12, %zmm24, %zmm6
+        vpternlogq	$0xd2, %zmm30, %zmm12, %zmm24
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm12
+        vmovdqu64	%zmm4, %zmm30
+        vmovdqu64	%zmm17, %zmm31
+        vpternlogq	$0xd2, %zmm5, %zmm17, %zmm4
+        vpternlogq	$0xd2, %zmm23, %zmm5, %zmm17
+        vpternlogq	$0xd2, %zmm11, %zmm23, %zmm5
+        vpternlogq	$0xd2, %zmm30, %zmm11, %zmm23
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm11
+        vmovdqu64	%zmm3, %zmm30
+        vmovdqu64	%zmm16, %zmm31
+        vpternlogq	$0xd2, %zmm9, %zmm16, %zmm3
+        vpternlogq	$0xd2, %zmm22, %zmm9, %zmm16
+        vpternlogq	$0xd2, %zmm10, %zmm22, %zmm9
+        vpternlogq	$0xd2, %zmm30, %zmm10, %zmm22
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm10
+        vmovdqu64	%zmm2, %zmm30
+        vmovdqu64	%zmm15, %zmm31
+        vpternlogq	$0xd2, %zmm8, %zmm15, %zmm2
+        vpternlogq	$0xd2, %zmm21, %zmm8, %zmm15
+        vpternlogq	$0xd2, %zmm14, %zmm21, %zmm8
+        vpternlogq	$0xd2, %zmm30, %zmm14, %zmm21
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm14
+        vmovdqu64	%zmm1, %zmm30
+        vmovdqu64	%zmm19, %zmm31
+        vpternlogq	$0xd2, %zmm7, %zmm19, %zmm1
+        vpternlogq	$0xd2, %zmm20, %zmm7, %zmm19
+        vpternlogq	$0xd2, %zmm13, %zmm20, %zmm7
+        vpternlogq	$0xd2, %zmm30, %zmm13, %zmm20
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm13
+        # Iota
+        vpxorq	1152(%rax), %zmm0, %zmm0
+        # Round 19
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm3, %zmm4, %zmm25
+        vpternlogq	$0x96, %zmm1, %zmm2, %zmm25
+        vmovdqu64	%zmm18, %zmm26
+        vpternlogq	$0x96, %zmm16, %zmm17, %zmm26
+        vpternlogq	$0x96, %zmm19, %zmm15, %zmm26
+        vmovdqu64	%zmm6, %zmm27
+        vpternlogq	$0x96, %zmm9, %zmm5, %zmm27
+        vpternlogq	$0x96, %zmm7, %zmm8, %zmm27
+        vmovdqu64	%zmm24, %zmm28
+        vpternlogq	$0x96, %zmm22, %zmm23, %zmm28
+        vpternlogq	$0x96, %zmm20, %zmm21, %zmm28
+        vmovdqu64	%zmm12, %zmm29
+        vpternlogq	$0x96, %zmm10, %zmm11, %zmm29
+        vpternlogq	$0x96, %zmm13, %zmm14, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm13, %zmm13
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm18, %zmm18
+        vprolq	$62, %zmm6, %zmm6
+        vprolq	$28, %zmm24, %zmm24
+        vprolq	$27, %zmm12, %zmm12
+        vprolq	$36, %zmm4, %zmm4
+        vprolq	$44, %zmm17, %zmm17
+        vprolq	$6, %zmm5, %zmm5
+        vprolq	$55, %zmm23, %zmm23
+        vprolq	$20, %zmm11, %zmm11
+        vprolq	$3, %zmm3, %zmm3
+        vprolq	$10, %zmm16, %zmm16
+        vprolq	$43, %zmm9, %zmm9
+        vprolq	$25, %zmm22, %zmm22
+        vprolq	$39, %zmm10, %zmm10
+        vprolq	$41, %zmm2, %zmm2
+        vprolq	$45, %zmm15, %zmm15
+        vprolq	$15, %zmm8, %zmm8
+        vprolq	$21, %zmm21, %zmm21
+        vprolq	$8, %zmm14, %zmm14
+        vprolq	$18, %zmm1, %zmm1
+        vprolq	$2, %zmm19, %zmm19
+        vprolq	$61, %zmm7, %zmm7
+        vprolq	$56, %zmm20, %zmm20
+        vprolq	$14, %zmm13, %zmm13
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm17, %zmm31
+        vpternlogq	$0xd2, %zmm9, %zmm17, %zmm0
+        vpternlogq	$0xd2, %zmm21, %zmm9, %zmm17
+        vpternlogq	$0xd2, %zmm13, %zmm21, %zmm9
+        vpternlogq	$0xd2, %zmm30, %zmm13, %zmm21
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm13
+        vmovdqu64	%zmm24, %zmm30
+        vmovdqu64	%zmm11, %zmm31
+        vpternlogq	$0xd2, %zmm3, %zmm11, %zmm24
+        vpternlogq	$0xd2, %zmm15, %zmm3, %zmm11
+        vpternlogq	$0xd2, %zmm7, %zmm15, %zmm3
+        vpternlogq	$0xd2, %zmm30, %zmm7, %zmm15
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm7
+        vmovdqu64	%zmm18, %zmm30
+        vmovdqu64	%zmm5, %zmm31
+        vpternlogq	$0xd2, %zmm22, %zmm5, %zmm18
+        vpternlogq	$0xd2, %zmm14, %zmm22, %zmm5
+        vpternlogq	$0xd2, %zmm1, %zmm14, %zmm22
+        vpternlogq	$0xd2, %zmm30, %zmm1, %zmm14
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm1
+        vmovdqu64	%zmm12, %zmm30
+        vmovdqu64	%zmm4, %zmm31
+        vpternlogq	$0xd2, %zmm16, %zmm4, %zmm12
+        vpternlogq	$0xd2, %zmm8, %zmm16, %zmm4
+        vpternlogq	$0xd2, %zmm20, %zmm8, %zmm16
+        vpternlogq	$0xd2, %zmm30, %zmm20, %zmm8
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm20
+        vmovdqu64	%zmm6, %zmm30
+        vmovdqu64	%zmm23, %zmm31
+        vpternlogq	$0xd2, %zmm10, %zmm23, %zmm6
+        vpternlogq	$0xd2, %zmm2, %zmm10, %zmm23
+        vpternlogq	$0xd2, %zmm19, %zmm2, %zmm10
+        vpternlogq	$0xd2, %zmm30, %zmm19, %zmm2
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm19
+        # Iota
+        vpxorq	1216(%rax), %zmm0, %zmm0
+        # Round 20
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm18, %zmm24, %zmm25
+        vpternlogq	$0x96, %zmm6, %zmm12, %zmm25
+        vmovdqu64	%zmm17, %zmm26
+        vpternlogq	$0x96, %zmm5, %zmm11, %zmm26
+        vpternlogq	$0x96, %zmm23, %zmm4, %zmm26
+        vmovdqu64	%zmm9, %zmm27
+        vpternlogq	$0x96, %zmm22, %zmm3, %zmm27
+        vpternlogq	$0x96, %zmm10, %zmm16, %zmm27
+        vmovdqu64	%zmm21, %zmm28
+        vpternlogq	$0x96, %zmm14, %zmm15, %zmm28
+        vpternlogq	$0x96, %zmm2, %zmm8, %zmm28
+        vmovdqu64	%zmm13, %zmm29
+        vpternlogq	$0x96, %zmm1, %zmm7, %zmm29
+        vpternlogq	$0x96, %zmm19, %zmm20, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm19, %zmm19
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm17, %zmm17
+        vprolq	$62, %zmm9, %zmm9
+        vprolq	$28, %zmm21, %zmm21
+        vprolq	$27, %zmm13, %zmm13
+        vprolq	$36, %zmm24, %zmm24
+        vprolq	$44, %zmm11, %zmm11
+        vprolq	$6, %zmm3, %zmm3
+        vprolq	$55, %zmm15, %zmm15
+        vprolq	$20, %zmm7, %zmm7
+        vprolq	$3, %zmm18, %zmm18
+        vprolq	$10, %zmm5, %zmm5
+        vprolq	$43, %zmm22, %zmm22
+        vprolq	$25, %zmm14, %zmm14
+        vprolq	$39, %zmm1, %zmm1
+        vprolq	$41, %zmm12, %zmm12
+        vprolq	$45, %zmm4, %zmm4
+        vprolq	$15, %zmm16, %zmm16
+        vprolq	$21, %zmm8, %zmm8
+        vprolq	$8, %zmm20, %zmm20
+        vprolq	$18, %zmm6, %zmm6
+        vprolq	$2, %zmm23, %zmm23
+        vprolq	$61, %zmm10, %zmm10
+        vprolq	$56, %zmm2, %zmm2
+        vprolq	$14, %zmm19, %zmm19
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm11, %zmm31
+        vpternlogq	$0xd2, %zmm22, %zmm11, %zmm0
+        vpternlogq	$0xd2, %zmm8, %zmm22, %zmm11
+        vpternlogq	$0xd2, %zmm19, %zmm8, %zmm22
+        vpternlogq	$0xd2, %zmm30, %zmm19, %zmm8
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm19
+        vmovdqu64	%zmm21, %zmm30
+        vmovdqu64	%zmm7, %zmm31
+        vpternlogq	$0xd2, %zmm18, %zmm7, %zmm21
+        vpternlogq	$0xd2, %zmm4, %zmm18, %zmm7
+        vpternlogq	$0xd2, %zmm10, %zmm4, %zmm18
+        vpternlogq	$0xd2, %zmm30, %zmm10, %zmm4
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm10
+        vmovdqu64	%zmm17, %zmm30
+        vmovdqu64	%zmm3, %zmm31
+        vpternlogq	$0xd2, %zmm14, %zmm3, %zmm17
+        vpternlogq	$0xd2, %zmm20, %zmm14, %zmm3
+        vpternlogq	$0xd2, %zmm6, %zmm20, %zmm14
+        vpternlogq	$0xd2, %zmm30, %zmm6, %zmm20
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm6
+        vmovdqu64	%zmm13, %zmm30
+        vmovdqu64	%zmm24, %zmm31
+        vpternlogq	$0xd2, %zmm5, %zmm24, %zmm13
+        vpternlogq	$0xd2, %zmm16, %zmm5, %zmm24
+        vpternlogq	$0xd2, %zmm2, %zmm16, %zmm5
+        vpternlogq	$0xd2, %zmm30, %zmm2, %zmm16
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm2
+        vmovdqu64	%zmm9, %zmm30
+        vmovdqu64	%zmm15, %zmm31
+        vpternlogq	$0xd2, %zmm1, %zmm15, %zmm9
+        vpternlogq	$0xd2, %zmm12, %zmm1, %zmm15
+        vpternlogq	$0xd2, %zmm23, %zmm12, %zmm1
+        vpternlogq	$0xd2, %zmm30, %zmm23, %zmm12
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm23
+        # Iota
+        vpxorq	1280(%rax), %zmm0, %zmm0
+        # Round 21
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm17, %zmm21, %zmm25
+        vpternlogq	$0x96, %zmm9, %zmm13, %zmm25
+        vmovdqu64	%zmm11, %zmm26
+        vpternlogq	$0x96, %zmm3, %zmm7, %zmm26
+        vpternlogq	$0x96, %zmm15, %zmm24, %zmm26
+        vmovdqu64	%zmm22, %zmm27
+        vpternlogq	$0x96, %zmm14, %zmm18, %zmm27
+        vpternlogq	$0x96, %zmm1, %zmm5, %zmm27
+        vmovdqu64	%zmm8, %zmm28
+        vpternlogq	$0x96, %zmm20, %zmm4, %zmm28
+        vpternlogq	$0x96, %zmm12, %zmm16, %zmm28
+        vmovdqu64	%zmm19, %zmm29
+        vpternlogq	$0x96, %zmm6, %zmm10, %zmm29
+        vpternlogq	$0x96, %zmm23, %zmm2, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm23, %zmm23
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm11, %zmm11
+        vprolq	$62, %zmm22, %zmm22
+        vprolq	$28, %zmm8, %zmm8
+        vprolq	$27, %zmm19, %zmm19
+        vprolq	$36, %zmm21, %zmm21
+        vprolq	$44, %zmm7, %zmm7
+        vprolq	$6, %zmm18, %zmm18
+        vprolq	$55, %zmm4, %zmm4
+        vprolq	$20, %zmm10, %zmm10
+        vprolq	$3, %zmm17, %zmm17
+        vprolq	$10, %zmm3, %zmm3
+        vprolq	$43, %zmm14, %zmm14
+        vprolq	$25, %zmm20, %zmm20
+        vprolq	$39, %zmm6, %zmm6
+        vprolq	$41, %zmm13, %zmm13
+        vprolq	$45, %zmm24, %zmm24
+        vprolq	$15, %zmm5, %zmm5
+        vprolq	$21, %zmm16, %zmm16
+        vprolq	$8, %zmm2, %zmm2
+        vprolq	$18, %zmm9, %zmm9
+        vprolq	$2, %zmm15, %zmm15
+        vprolq	$61, %zmm1, %zmm1
+        vprolq	$56, %zmm12, %zmm12
+        vprolq	$14, %zmm23, %zmm23
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm7, %zmm31
+        vpternlogq	$0xd2, %zmm14, %zmm7, %zmm0
+        vpternlogq	$0xd2, %zmm16, %zmm14, %zmm7
+        vpternlogq	$0xd2, %zmm23, %zmm16, %zmm14
+        vpternlogq	$0xd2, %zmm30, %zmm23, %zmm16
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm23
+        vmovdqu64	%zmm8, %zmm30
+        vmovdqu64	%zmm10, %zmm31
+        vpternlogq	$0xd2, %zmm17, %zmm10, %zmm8
+        vpternlogq	$0xd2, %zmm24, %zmm17, %zmm10
+        vpternlogq	$0xd2, %zmm1, %zmm24, %zmm17
+        vpternlogq	$0xd2, %zmm30, %zmm1, %zmm24
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm1
+        vmovdqu64	%zmm11, %zmm30
+        vmovdqu64	%zmm18, %zmm31
+        vpternlogq	$0xd2, %zmm20, %zmm18, %zmm11
+        vpternlogq	$0xd2, %zmm2, %zmm20, %zmm18
+        vpternlogq	$0xd2, %zmm9, %zmm2, %zmm20
+        vpternlogq	$0xd2, %zmm30, %zmm9, %zmm2
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm9
+        vmovdqu64	%zmm19, %zmm30
+        vmovdqu64	%zmm21, %zmm31
+        vpternlogq	$0xd2, %zmm3, %zmm21, %zmm19
+        vpternlogq	$0xd2, %zmm5, %zmm3, %zmm21
+        vpternlogq	$0xd2, %zmm12, %zmm5, %zmm3
+        vpternlogq	$0xd2, %zmm30, %zmm12, %zmm5
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm12
+        vmovdqu64	%zmm22, %zmm30
+        vmovdqu64	%zmm4, %zmm31
+        vpternlogq	$0xd2, %zmm6, %zmm4, %zmm22
+        vpternlogq	$0xd2, %zmm13, %zmm6, %zmm4
+        vpternlogq	$0xd2, %zmm15, %zmm13, %zmm6
+        vpternlogq	$0xd2, %zmm30, %zmm15, %zmm13
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm15
+        # Iota
+        vpxorq	1344(%rax), %zmm0, %zmm0
+        # Round 22
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm11, %zmm8, %zmm25
+        vpternlogq	$0x96, %zmm22, %zmm19, %zmm25
+        vmovdqu64	%zmm7, %zmm26
+        vpternlogq	$0x96, %zmm18, %zmm10, %zmm26
+        vpternlogq	$0x96, %zmm4, %zmm21, %zmm26
+        vmovdqu64	%zmm14, %zmm27
+        vpternlogq	$0x96, %zmm20, %zmm17, %zmm27
+        vpternlogq	$0x96, %zmm6, %zmm3, %zmm27
+        vmovdqu64	%zmm16, %zmm28
+        vpternlogq	$0x96, %zmm2, %zmm24, %zmm28
+        vpternlogq	$0x96, %zmm13, %zmm5, %zmm28
+        vmovdqu64	%zmm23, %zmm29
+        vpternlogq	$0x96, %zmm9, %zmm1, %zmm29
+        vpternlogq	$0x96, %zmm15, %zmm12, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm4, %zmm4
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm15, %zmm15
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm7, %zmm7
+        vprolq	$62, %zmm14, %zmm14
+        vprolq	$28, %zmm16, %zmm16
+        vprolq	$27, %zmm23, %zmm23
+        vprolq	$36, %zmm8, %zmm8
+        vprolq	$44, %zmm10, %zmm10
+        vprolq	$6, %zmm17, %zmm17
+        vprolq	$55, %zmm24, %zmm24
+        vprolq	$20, %zmm1, %zmm1
+        vprolq	$3, %zmm11, %zmm11
+        vprolq	$10, %zmm18, %zmm18
+        vprolq	$43, %zmm20, %zmm20
+        vprolq	$25, %zmm2, %zmm2
+        vprolq	$39, %zmm9, %zmm9
+        vprolq	$41, %zmm19, %zmm19
+        vprolq	$45, %zmm21, %zmm21
+        vprolq	$15, %zmm3, %zmm3
+        vprolq	$21, %zmm5, %zmm5
+        vprolq	$8, %zmm12, %zmm12
+        vprolq	$18, %zmm22, %zmm22
+        vprolq	$2, %zmm4, %zmm4
+        vprolq	$61, %zmm6, %zmm6
+        vprolq	$56, %zmm13, %zmm13
+        vprolq	$14, %zmm15, %zmm15
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm10, %zmm31
+        vpternlogq	$0xd2, %zmm20, %zmm10, %zmm0
+        vpternlogq	$0xd2, %zmm5, %zmm20, %zmm10
+        vpternlogq	$0xd2, %zmm15, %zmm5, %zmm20
+        vpternlogq	$0xd2, %zmm30, %zmm15, %zmm5
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm15
+        vmovdqu64	%zmm16, %zmm30
+        vmovdqu64	%zmm1, %zmm31
+        vpternlogq	$0xd2, %zmm11, %zmm1, %zmm16
+        vpternlogq	$0xd2, %zmm21, %zmm11, %zmm1
+        vpternlogq	$0xd2, %zmm6, %zmm21, %zmm11
+        vpternlogq	$0xd2, %zmm30, %zmm6, %zmm21
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm6
+        vmovdqu64	%zmm7, %zmm30
+        vmovdqu64	%zmm17, %zmm31
+        vpternlogq	$0xd2, %zmm2, %zmm17, %zmm7
+        vpternlogq	$0xd2, %zmm12, %zmm2, %zmm17
+        vpternlogq	$0xd2, %zmm22, %zmm12, %zmm2
+        vpternlogq	$0xd2, %zmm30, %zmm22, %zmm12
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm22
+        vmovdqu64	%zmm23, %zmm30
+        vmovdqu64	%zmm8, %zmm31
+        vpternlogq	$0xd2, %zmm18, %zmm8, %zmm23
+        vpternlogq	$0xd2, %zmm3, %zmm18, %zmm8
+        vpternlogq	$0xd2, %zmm13, %zmm3, %zmm18
+        vpternlogq	$0xd2, %zmm30, %zmm13, %zmm3
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm13
+        vmovdqu64	%zmm14, %zmm30
+        vmovdqu64	%zmm24, %zmm31
+        vpternlogq	$0xd2, %zmm9, %zmm24, %zmm14
+        vpternlogq	$0xd2, %zmm19, %zmm9, %zmm24
+        vpternlogq	$0xd2, %zmm4, %zmm19, %zmm9
+        vpternlogq	$0xd2, %zmm30, %zmm4, %zmm19
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm4
+        # Iota
+        vpxorq	1408(%rax), %zmm0, %zmm0
+        # Round 23
+        # Theta - column parity
+        vmovdqu64	%zmm0, %zmm25
+        vpternlogq	$0x96, %zmm7, %zmm16, %zmm25
+        vpternlogq	$0x96, %zmm14, %zmm23, %zmm25
+        vmovdqu64	%zmm10, %zmm26
+        vpternlogq	$0x96, %zmm17, %zmm1, %zmm26
+        vpternlogq	$0x96, %zmm24, %zmm8, %zmm26
+        vmovdqu64	%zmm20, %zmm27
+        vpternlogq	$0x96, %zmm2, %zmm11, %zmm27
+        vpternlogq	$0x96, %zmm9, %zmm18, %zmm27
+        vmovdqu64	%zmm5, %zmm28
+        vpternlogq	$0x96, %zmm12, %zmm21, %zmm28
+        vpternlogq	$0x96, %zmm19, %zmm3, %zmm28
+        vmovdqu64	%zmm15, %zmm29
+        vpternlogq	$0x96, %zmm22, %zmm6, %zmm29
+        vpternlogq	$0x96, %zmm4, %zmm13, %zmm29
+        # Theta - D and apply in place
+        vprolq	$0x01, %zmm26, %zmm30
+        vpxorq	%zmm29, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm0, %zmm0
+        vpxorq	%zmm30, %zmm16, %zmm16
+        vpxorq	%zmm30, %zmm7, %zmm7
+        vpxorq	%zmm30, %zmm23, %zmm23
+        vpxorq	%zmm30, %zmm14, %zmm14
+        vprolq	$0x01, %zmm27, %zmm30
+        vpxorq	%zmm25, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm10, %zmm10
+        vpxorq	%zmm30, %zmm1, %zmm1
+        vpxorq	%zmm30, %zmm17, %zmm17
+        vpxorq	%zmm30, %zmm8, %zmm8
+        vpxorq	%zmm30, %zmm24, %zmm24
+        vprolq	$0x01, %zmm28, %zmm30
+        vpxorq	%zmm26, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm20, %zmm20
+        vpxorq	%zmm30, %zmm11, %zmm11
+        vpxorq	%zmm30, %zmm2, %zmm2
+        vpxorq	%zmm30, %zmm18, %zmm18
+        vpxorq	%zmm30, %zmm9, %zmm9
+        vprolq	$0x01, %zmm29, %zmm30
+        vpxorq	%zmm27, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm5, %zmm5
+        vpxorq	%zmm30, %zmm21, %zmm21
+        vpxorq	%zmm30, %zmm12, %zmm12
+        vpxorq	%zmm30, %zmm3, %zmm3
+        vpxorq	%zmm30, %zmm19, %zmm19
+        vprolq	$0x01, %zmm25, %zmm30
+        vpxorq	%zmm28, %zmm30, %zmm30
+        vpxorq	%zmm30, %zmm15, %zmm15
+        vpxorq	%zmm30, %zmm6, %zmm6
+        vpxorq	%zmm30, %zmm22, %zmm22
+        vpxorq	%zmm30, %zmm13, %zmm13
+        vpxorq	%zmm30, %zmm4, %zmm4
+        # Rho - rotate each lane in place
+        vprolq	$0x01, %zmm10, %zmm10
+        vprolq	$62, %zmm20, %zmm20
+        vprolq	$28, %zmm5, %zmm5
+        vprolq	$27, %zmm15, %zmm15
+        vprolq	$36, %zmm16, %zmm16
+        vprolq	$44, %zmm1, %zmm1
+        vprolq	$6, %zmm11, %zmm11
+        vprolq	$55, %zmm21, %zmm21
+        vprolq	$20, %zmm6, %zmm6
+        vprolq	$3, %zmm7, %zmm7
+        vprolq	$10, %zmm17, %zmm17
+        vprolq	$43, %zmm2, %zmm2
+        vprolq	$25, %zmm12, %zmm12
+        vprolq	$39, %zmm22, %zmm22
+        vprolq	$41, %zmm23, %zmm23
+        vprolq	$45, %zmm8, %zmm8
+        vprolq	$15, %zmm18, %zmm18
+        vprolq	$21, %zmm3, %zmm3
+        vprolq	$8, %zmm13, %zmm13
+        vprolq	$18, %zmm14, %zmm14
+        vprolq	$2, %zmm24, %zmm24
+        vprolq	$61, %zmm9, %zmm9
+        vprolq	$56, %zmm19, %zmm19
+        vprolq	$14, %zmm4, %zmm4
+        # Pi - relabel logical -> physical
+        # Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	%zmm0, %zmm30
+        vmovdqu64	%zmm1, %zmm31
+        vpternlogq	$0xd2, %zmm2, %zmm1, %zmm0
+        vpternlogq	$0xd2, %zmm3, %zmm2, %zmm1
+        vpternlogq	$0xd2, %zmm4, %zmm3, %zmm2
+        vpternlogq	$0xd2, %zmm30, %zmm4, %zmm3
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm4
+        vmovdqu64	%zmm5, %zmm30
+        vmovdqu64	%zmm6, %zmm31
+        vpternlogq	$0xd2, %zmm7, %zmm6, %zmm5
+        vpternlogq	$0xd2, %zmm8, %zmm7, %zmm6
+        vpternlogq	$0xd2, %zmm9, %zmm8, %zmm7
+        vpternlogq	$0xd2, %zmm30, %zmm9, %zmm8
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm9
+        vmovdqu64	%zmm10, %zmm30
+        vmovdqu64	%zmm11, %zmm31
+        vpternlogq	$0xd2, %zmm12, %zmm11, %zmm10
+        vpternlogq	$0xd2, %zmm13, %zmm12, %zmm11
+        vpternlogq	$0xd2, %zmm14, %zmm13, %zmm12
+        vpternlogq	$0xd2, %zmm30, %zmm14, %zmm13
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm14
+        vmovdqu64	%zmm15, %zmm30
+        vmovdqu64	%zmm16, %zmm31
+        vpternlogq	$0xd2, %zmm17, %zmm16, %zmm15
+        vpternlogq	$0xd2, %zmm18, %zmm17, %zmm16
+        vpternlogq	$0xd2, %zmm19, %zmm18, %zmm17
+        vpternlogq	$0xd2, %zmm30, %zmm19, %zmm18
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm19
+        vmovdqu64	%zmm20, %zmm30
+        vmovdqu64	%zmm21, %zmm31
+        vpternlogq	$0xd2, %zmm22, %zmm21, %zmm20
+        vpternlogq	$0xd2, %zmm23, %zmm22, %zmm21
+        vpternlogq	$0xd2, %zmm24, %zmm23, %zmm22
+        vpternlogq	$0xd2, %zmm30, %zmm24, %zmm23
+        vpternlogq	$0xd2, %zmm31, %zmm30, %zmm24
+        # Iota
+        vpxorq	1472(%rax), %zmm0, %zmm0
+        vmovdqu64	%zmm0, (%rdi)
+        vmovdqu64	%zmm1, 64(%rdi)
+        vmovdqu64	%zmm2, 128(%rdi)
+        vmovdqu64	%zmm3, 192(%rdi)
+        vmovdqu64	%zmm4, 256(%rdi)
+        vmovdqu64	%zmm5, 320(%rdi)
+        vmovdqu64	%zmm6, 384(%rdi)
+        vmovdqu64	%zmm7, 448(%rdi)
+        vmovdqu64	%zmm8, 512(%rdi)
+        vmovdqu64	%zmm9, 576(%rdi)
+        vmovdqu64	%zmm10, 640(%rdi)
+        vmovdqu64	%zmm11, 704(%rdi)
+        vmovdqu64	%zmm12, 768(%rdi)
+        vmovdqu64	%zmm13, 832(%rdi)
+        vmovdqu64	%zmm14, 896(%rdi)
+        vmovdqu64	%zmm15, 960(%rdi)
+        vmovdqu64	%zmm16, 1024(%rdi)
+        vmovdqu64	%zmm17, 1088(%rdi)
+        vmovdqu64	%zmm18, 1152(%rdi)
+        vmovdqu64	%zmm19, 1216(%rdi)
+        vmovdqu64	%zmm20, 1280(%rdi)
+        vmovdqu64	%zmm21, 1344(%rdi)
+        vmovdqu64	%zmm22, 1408(%rdi)
+        vmovdqu64	%zmm23, 1472(%rdi)
+        vmovdqu64	%zmm24, 1536(%rdi)
+        movq	%rdi, %rbx
+        movq	$21, %r15
+L_sha3_blocksx8_out_avx512_word:
+        movq	(%rbx), %rbp
+        movq	%rbp, (%rsi)
+        movq	8(%rbx), %rbp
+        movq	%rbp, (%rcx)
+        movq	16(%rbx), %rbp
+        movq	%rbp, (%r8)
+        movq	24(%rbx), %rbp
+        movq	%rbp, (%r9)
+        movq	32(%rbx), %rbp
+        movq	%rbp, (%r10)
+        movq	40(%rbx), %rbp
+        movq	%rbp, (%r11)
+        movq	48(%rbx), %rbp
+        movq	%rbp, (%r12)
+        movq	56(%rbx), %rbp
+        movq	%rbp, (%r13)
+        addq	$0x40, %rbx
+        addq	$8, %rsi
+        addq	$8, %rcx
+        addq	$8, %r8
+        addq	$8, %r9
+        addq	$8, %r10
+        addq	$8, %r11
+        addq	$8, %r12
+        addq	$8, %r13
+        subq	$0x01, %r14
+        jz	L_sha3_blocksx8_out_avx512_done
+        subq	$0x01, %r15
+        jnz	L_sha3_blocksx8_out_avx512_word
+        jmp	L_sha3_blocksx8_out_avx512_block
+L_sha3_blocksx8_out_avx512_done:
+        vzeroupper
+        popq	%rbp
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	sha3_blocksx8_out_avx512,.-sha3_blocksx8_out_avx512
+#endif /* __APPLE__ */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#endif /* HAVE_INTEL_AVX512 */
 #endif /* HAVE_INTEL_AVX2 */
 
 #if defined(__linux__) && defined(__ELF__)
diff --git a/wolfcrypt/src/sha3_asm.asm b/wolfcrypt/src/sha3_asm.asm
index 8f4db30ff57..874875b3df0 100644
--- a/wolfcrypt/src/sha3_asm.asm
+++ b/wolfcrypt/src/sha3_asm.asm
@@ -9900,6 +9900,9 @@ ENDIF
 IFDEF WOLFSSL_HAVE_SLHDSA
 wc_masm_cond_0 = 1
 ENDIF
+IFDEF WOLFSSL_HAVE_FRODOKEM
+wc_masm_cond_0 = 1
+ENDIF
 IF wc_masm_cond_0
 _TEXT SEGMENT READONLY PARA
 sha3_blocksx4_avx2 PROC
@@ -15270,6 +15273,18 @@ sha3_blocksx4_avx2 PROC
         ret
 sha3_blocksx4_avx2 ENDP
 _TEXT ENDS
+ENDIF
+wc_masm_cond_1 = 0
+IFDEF WOLFSSL_HAVE_MLKEM
+wc_masm_cond_1 = 1
+ENDIF
+IFDEF WOLFSSL_HAVE_MLDSA
+wc_masm_cond_1 = 1
+ENDIF
+IFDEF WOLFSSL_HAVE_SLHDSA
+wc_masm_cond_1 = 1
+ENDIF
+IF wc_masm_cond_1
 _DATA SEGMENT
 ALIGN 16
 L_sha3_128_blockx4_seed_avx2_end_mark QWORD 8000000000000000h, 8000000000000000h
@@ -20652,15 +20667,15 @@ sha3_128_blocksx4_seed_avx2 PROC
 sha3_128_blocksx4_seed_avx2 ENDP
 _TEXT ENDS
 ENDIF
-IFDEF WOLFSSL_HAVE_MLKEM
-_DATA SEGMENT
-ALIGN 16
-L_sha3_256_blockx4_seed_avx2_end_mark QWORD 8000000000000000h, 8000000000000000h
-        QWORD 8000000000000000h, 8000000000000000h
-ptr_L_sha3_256_blockx4_seed_avx2_end_mark QWORD L_sha3_256_blockx4_seed_avx2_end_mark
-_DATA ENDS
+IFDEF WOLFSSL_HAVE_FRODOKEM
 _TEXT SEGMENT READONLY PARA
-sha3_256_blocksx4_seed_avx2 PROC
+sha3_blocksx4_out_avx2 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
         sub	rsp, 160
         vmovdqu	OWORD PTR [rsp], xmm6
         vmovdqu	OWORD PTR [rsp+16], xmm7
@@ -20673,45 +20688,47 @@ sha3_256_blocksx4_seed_avx2 PROC
         vmovdqu	OWORD PTR [rsp+128], xmm14
         vmovdqu	OWORD PTR [rsp+144], xmm15
         mov	rax, QWORD PTR [ptr_L_sha3_x4_avx2_r]
-        mov	r8, rcx
+        mov	r14d, r8d
+        mov	r11, rdx
+        add	r11, r14
+        mov	r12, r11
+        add	r12, r14
+        mov	r13, r12
+        add	r13, r14
+        shr	r14, 3
+L_sha3_blocksx4_out_avx2_block:
+        vmovdqu	ymm15, YMMWORD PTR [rcx]
         mov	r9, rcx
-        vpbroadcastq	ymm15, QWORD PTR [rdx]
+        mov	r10, rcx
         add	rcx, 128
-        vpbroadcastq	ymm11, QWORD PTR [rdx+8]
-        add	r8, 384
-        vpbroadcastq	ymm12, QWORD PTR [rdx+16]
-        add	r9, 640
-        vpbroadcastq	ymm13, QWORD PTR [rdx+24]
-        vmovdqu	ymm5, YMMWORD PTR L_sha3_256_blockx4_seed_avx2_end_mark
-        vpxor	ymm6, ymm6, ymm6
-        vmovdqu	YMMWORD PTR [rcx+-96], ymm11
-        vmovdqu	YMMWORD PTR [rcx+-64], ymm12
-        vmovdqu	YMMWORD PTR [rcx+-32], ymm13
-        vmovdqu	ymm14, YMMWORD PTR [rcx]
-        vmovdqu	YMMWORD PTR [rcx+32], ymm6
-        vmovdqu	YMMWORD PTR [rcx+64], ymm6
-        vmovdqu	YMMWORD PTR [rcx+96], ymm6
-        vmovdqu	YMMWORD PTR [rcx+128], ymm6
-        vmovdqu	YMMWORD PTR [r8+-96], ymm6
-        vmovdqu	YMMWORD PTR [r8+-64], ymm6
-        vmovdqu	YMMWORD PTR [r8+-32], ymm6
-        vmovdqu	YMMWORD PTR [r8], ymm6
-        vmovdqu	YMMWORD PTR [r8+32], ymm6
-        vmovdqu	YMMWORD PTR [r8+64], ymm6
-        vmovdqu	YMMWORD PTR [r8+96], ymm6
-        vmovdqu	YMMWORD PTR [r8+128], ymm5
-        vmovdqu	YMMWORD PTR [r9+-96], ymm6
-        vmovdqu	YMMWORD PTR [r9+-64], ymm6
-        vmovdqu	YMMWORD PTR [r9+-32], ymm6
-        vmovdqu	YMMWORD PTR [r9], ymm6
-        vmovdqu	YMMWORD PTR [r9+32], ymm6
-        vmovdqu	YMMWORD PTR [r9+64], ymm6
-        vmovdqu	YMMWORD PTR [r9+96], ymm6
-        vmovdqu	YMMWORD PTR [r9+128], ymm6
-        vmovdqu	ymm10, ymm15
-        vpxor	ymm11, ymm11, ymm5
+        add	r9, 384
+        add	r10, 640
         ; Round 0
         ; Calc b[0..4]
+        vmovdqu	ymm11, YMMWORD PTR [rcx+-96]
+        vmovdqu	ymm12, YMMWORD PTR [rcx+-64]
+        vmovdqu	ymm13, YMMWORD PTR [rcx+-32]
+        vmovdqu	ymm14, YMMWORD PTR [rcx]
+        vpxor	ymm10, ymm15, [rcx+32]
+        vpxor	ymm11, ymm11, [rcx+64]
+        vpxor	ymm12, ymm12, [rcx+96]
+        vpxor	ymm13, ymm13, [rcx+128]
+        vpxor	ymm14, ymm14, [r9+-96]
+        vpxor	ymm10, ymm10, [r9+-64]
+        vpxor	ymm11, ymm11, [r9+-32]
+        vpxor	ymm12, ymm12, [r9]
+        vpxor	ymm13, ymm13, [r9+32]
+        vpxor	ymm14, ymm14, [r9+64]
+        vpxor	ymm10, ymm10, [r9+96]
+        vpxor	ymm11, ymm11, [r9+128]
+        vpxor	ymm12, ymm12, [r10+-96]
+        vpxor	ymm13, ymm13, [r10+-64]
+        vpxor	ymm14, ymm14, [r10+-32]
+        vpxor	ymm10, ymm10, [r10]
+        vpxor	ymm11, ymm11, [r10+32]
+        vpxor	ymm12, ymm12, [r10+64]
+        vpxor	ymm13, ymm13, [r10+96]
+        vpxor	ymm14, ymm14, [r10+128]
         ; Calc t[0..4]
         vpsrlq	ymm0, ymm11, 63
         vpsrlq	ymm1, ymm12, 63
@@ -20737,9 +20754,9 @@ sha3_256_blocksx4_seed_avx2 PROC
         ; Row 0
         vpxor	ymm10, ymm5, ymm15
         vpxor	ymm11, ymm6, [rcx+64]
-        vpxor	ymm12, ymm7, [r8]
-        vpxor	ymm13, ymm8, [r9+-64]
-        vpxor	ymm14, ymm9, [r9+128]
+        vpxor	ymm12, ymm7, [r9]
+        vpxor	ymm13, ymm8, [r10+-64]
+        vpxor	ymm14, ymm9, [r10+128]
         vpsrlq	ymm0, ymm11, 20
         vpsrlq	ymm1, ymm12, 21
         vpsrlq	ymm2, ymm13, 43
@@ -20765,15 +20782,15 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
         vmovdqu	YMMWORD PTR [rcx+64], ymm1
-        vmovdqu	YMMWORD PTR [r8], ymm2
-        vmovdqu	YMMWORD PTR [r9+-64], ymm3
-        vmovdqu	YMMWORD PTR [r9+128], ymm4
+        vmovdqu	YMMWORD PTR [r9], ymm2
+        vmovdqu	YMMWORD PTR [r10+-64], ymm3
+        vmovdqu	YMMWORD PTR [r10+128], ymm4
         ; Row 1
         vpxor	ymm10, ymm8, [rcx+-32]
-        vpxor	ymm11, ymm9, [r8+-96]
-        vpxor	ymm12, ymm5, [r8+-64]
-        vpxor	ymm13, ymm6, [r8+128]
-        vpxor	ymm14, ymm7, [r9+64]
+        vpxor	ymm11, ymm9, [r9+-96]
+        vpxor	ymm12, ymm5, [r9+-64]
+        vpxor	ymm13, ymm6, [r9+128]
+        vpxor	ymm14, ymm7, [r10+64]
         vpsrlq	ymm0, ymm10, 36
         vpsrlq	ymm1, ymm11, 44
         vpsrlq	ymm2, ymm12, 61
@@ -20800,16 +20817,16 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
         vmovdqu	YMMWORD PTR [rcx+-32], ymm0
-        vmovdqu	YMMWORD PTR [r8+-96], ymm1
-        vmovdqu	YMMWORD PTR [r8+-64], ymm2
-        vmovdqu	YMMWORD PTR [r8+128], ymm3
-        vmovdqu	YMMWORD PTR [r9+64], ymm4
+        vmovdqu	YMMWORD PTR [r9+-96], ymm1
+        vmovdqu	YMMWORD PTR [r9+-64], ymm2
+        vmovdqu	YMMWORD PTR [r9+128], ymm3
+        vmovdqu	YMMWORD PTR [r10+64], ymm4
         ; Row 2
         vpxor	ymm10, ymm6, [rcx+-96]
         vpxor	ymm11, ymm7, [rcx+96]
-        vpxor	ymm12, ymm8, [r8+32]
-        vpxor	ymm13, ymm9, [r9+-32]
-        vpxor	ymm14, ymm5, [r9]
+        vpxor	ymm12, ymm8, [r9+32]
+        vpxor	ymm13, ymm9, [r10+-32]
+        vpxor	ymm14, ymm5, [r10]
         vpsrlq	ymm0, ymm10, 63
         vpsrlq	ymm1, ymm11, 58
         vpsrlq	ymm2, ymm12, 39
@@ -20837,15 +20854,15 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm4, ymm4, ymm14
         vmovdqu	YMMWORD PTR [rcx+-96], ymm0
         vmovdqu	YMMWORD PTR [rcx+96], ymm1
-        vmovdqu	YMMWORD PTR [r8+32], ymm2
-        vmovdqu	YMMWORD PTR [r9+-32], ymm3
-        vmovdqu	YMMWORD PTR [r9], ymm4
+        vmovdqu	YMMWORD PTR [r9+32], ymm2
+        vmovdqu	YMMWORD PTR [r10+-32], ymm3
+        vmovdqu	YMMWORD PTR [r10], ymm4
         ; Row 3
         vpxor	ymm10, ymm9, [rcx]
         vpxor	ymm11, ymm5, [rcx+32]
-        vpxor	ymm12, ymm6, [r8+-32]
-        vpxor	ymm13, ymm7, [r9+-96]
-        vpxor	ymm14, ymm8, [r9+96]
+        vpxor	ymm12, ymm6, [r9+-32]
+        vpxor	ymm13, ymm7, [r10+-96]
+        vpxor	ymm14, ymm8, [r10+96]
         vpsrlq	ymm0, ymm10, 37
         vpsrlq	ymm1, ymm11, 28
         vpsrlq	ymm2, ymm12, 54
@@ -20873,15 +20890,15 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm4, ymm4, ymm14
         vmovdqu	YMMWORD PTR [rcx], ymm0
         vmovdqu	YMMWORD PTR [rcx+32], ymm1
-        vmovdqu	YMMWORD PTR [r8+-32], ymm2
-        vmovdqu	YMMWORD PTR [r9+-96], ymm3
-        vmovdqu	YMMWORD PTR [r9+96], ymm4
+        vmovdqu	YMMWORD PTR [r9+-32], ymm2
+        vmovdqu	YMMWORD PTR [r10+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10+96], ymm4
         ; Row 4
         vpxor	ymm10, ymm7, [rcx+-64]
         vpxor	ymm11, ymm8, [rcx+128]
-        vpxor	ymm12, ymm9, [r8+64]
-        vpxor	ymm13, ymm5, [r8+96]
-        vpxor	ymm14, ymm6, [r9+32]
+        vpxor	ymm12, ymm9, [r9+64]
+        vpxor	ymm13, ymm5, [r9+96]
+        vpxor	ymm14, ymm6, [r10+32]
         vpsrlq	ymm0, ymm10, 2
         vpsrlq	ymm1, ymm11, 9
         vpsrlq	ymm2, ymm12, 25
@@ -20909,9 +20926,9 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm4, ymm4, ymm14
         vmovdqu	YMMWORD PTR [rcx+-64], ymm0
         vmovdqu	YMMWORD PTR [rcx+128], ymm1
-        vmovdqu	YMMWORD PTR [r8+64], ymm2
-        vmovdqu	YMMWORD PTR [r8+96], ymm3
-        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        vmovdqu	YMMWORD PTR [r9+64], ymm2
+        vmovdqu	YMMWORD PTR [r9+96], ymm3
+        vmovdqu	YMMWORD PTR [r10+32], ymm4
         ; Round 1
         ; Calc b[0..4]
         vpxor	ymm10, ymm0, ymm15
@@ -20921,19 +20938,19 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm11, ymm1, [rcx+32]
         vpxor	ymm11, ymm11, [rcx+64]
         vpxor	ymm11, ymm11, [rcx+96]
-        vpxor	ymm11, ymm11, [r8+-96]
-        vpxor	ymm12, ymm2, [r8+-64]
-        vpxor	ymm12, ymm12, [r8+-32]
-        vpxor	ymm12, ymm12, [r8]
-        vpxor	ymm12, ymm12, [r8+32]
-        vpxor	ymm13, ymm3, [r8+128]
-        vpxor	ymm13, ymm13, [r9+-96]
-        vpxor	ymm13, ymm13, [r9+-64]
-        vpxor	ymm13, ymm13, [r9+-32]
-        vpxor	ymm14, ymm4, [r9]
-        vpxor	ymm14, ymm14, [r9+64]
-        vpxor	ymm14, ymm14, [r9+96]
-        vpxor	ymm14, ymm14, [r9+128]
+        vpxor	ymm11, ymm11, [r9+-96]
+        vpxor	ymm12, ymm2, [r9+-64]
+        vpxor	ymm12, ymm12, [r9+-32]
+        vpxor	ymm12, ymm12, [r9]
+        vpxor	ymm12, ymm12, [r9+32]
+        vpxor	ymm13, ymm3, [r9+128]
+        vpxor	ymm13, ymm13, [r10+-96]
+        vpxor	ymm13, ymm13, [r10+-64]
+        vpxor	ymm13, ymm13, [r10+-32]
+        vpxor	ymm14, ymm4, [r10]
+        vpxor	ymm14, ymm14, [r10+64]
+        vpxor	ymm14, ymm14, [r10+96]
+        vpxor	ymm14, ymm14, [r10+128]
         ; Calc t[0..4]
         vpsrlq	ymm0, ymm11, 63
         vpsrlq	ymm1, ymm12, 63
@@ -20958,10 +20975,10 @@ sha3_256_blocksx4_seed_avx2 PROC
         ; Row Mix
         ; Row 0
         vpxor	ymm10, ymm5, ymm15
-        vpxor	ymm11, ymm6, [r8+-96]
-        vpxor	ymm12, ymm7, [r8+32]
-        vpxor	ymm13, ymm8, [r9+-96]
-        vpxor	ymm14, ymm9, [r9+32]
+        vpxor	ymm11, ymm6, [r9+-96]
+        vpxor	ymm12, ymm7, [r9+32]
+        vpxor	ymm13, ymm8, [r10+-96]
+        vpxor	ymm14, ymm9, [r10+32]
         vpsrlq	ymm0, ymm11, 20
         vpsrlq	ymm1, ymm12, 21
         vpsrlq	ymm2, ymm13, 43
@@ -20986,16 +21003,16 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm15, ymm15, [rax+32]
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r8+-96], ymm1
-        vmovdqu	YMMWORD PTR [r8+32], ymm2
-        vmovdqu	YMMWORD PTR [r9+-96], ymm3
-        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        vmovdqu	YMMWORD PTR [r9+-96], ymm1
+        vmovdqu	YMMWORD PTR [r9+32], ymm2
+        vmovdqu	YMMWORD PTR [r10+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10+32], ymm4
         ; Row 1
-        vpxor	ymm10, ymm8, [r9+-64]
-        vpxor	ymm11, ymm9, [r9+64]
+        vpxor	ymm10, ymm8, [r10+-64]
+        vpxor	ymm11, ymm9, [r10+64]
         vpxor	ymm12, ymm5, [rcx+-96]
         vpxor	ymm13, ymm6, [rcx+32]
-        vpxor	ymm14, ymm7, [r8+64]
+        vpxor	ymm14, ymm7, [r9+64]
         vpsrlq	ymm0, ymm10, 36
         vpsrlq	ymm1, ymm11, 44
         vpsrlq	ymm2, ymm12, 61
@@ -21021,16 +21038,16 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm2, ymm2, ymm12
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r9+-64], ymm0
-        vmovdqu	YMMWORD PTR [r9+64], ymm1
+        vmovdqu	YMMWORD PTR [r10+-64], ymm0
+        vmovdqu	YMMWORD PTR [r10+64], ymm1
         vmovdqu	YMMWORD PTR [rcx+-96], ymm2
         vmovdqu	YMMWORD PTR [rcx+32], ymm3
-        vmovdqu	YMMWORD PTR [r8+64], ymm4
+        vmovdqu	YMMWORD PTR [r9+64], ymm4
         ; Row 2
         vpxor	ymm10, ymm6, [rcx+64]
-        vpxor	ymm11, ymm7, [r8+-64]
-        vpxor	ymm12, ymm8, [r9+-32]
-        vpxor	ymm13, ymm9, [r9+96]
+        vpxor	ymm11, ymm7, [r9+-64]
+        vpxor	ymm12, ymm8, [r10+-32]
+        vpxor	ymm13, ymm9, [r10+96]
         vpxor	ymm14, ymm5, [rcx+-64]
         vpsrlq	ymm0, ymm10, 63
         vpsrlq	ymm1, ymm11, 58
@@ -21058,16 +21075,16 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
         vmovdqu	YMMWORD PTR [rcx+64], ymm0
-        vmovdqu	YMMWORD PTR [r8+-64], ymm1
-        vmovdqu	YMMWORD PTR [r9+-32], ymm2
-        vmovdqu	YMMWORD PTR [r9+96], ymm3
+        vmovdqu	YMMWORD PTR [r9+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10+-32], ymm2
+        vmovdqu	YMMWORD PTR [r10+96], ymm3
         vmovdqu	YMMWORD PTR [rcx+-64], ymm4
         ; Row 3
-        vpxor	ymm10, ymm9, [r9+128]
+        vpxor	ymm10, ymm9, [r10+128]
         vpxor	ymm11, ymm5, [rcx+-32]
         vpxor	ymm12, ymm6, [rcx+96]
-        vpxor	ymm13, ymm7, [r8+-32]
-        vpxor	ymm14, ymm8, [r8+96]
+        vpxor	ymm13, ymm7, [r9+-32]
+        vpxor	ymm14, ymm8, [r9+96]
         vpsrlq	ymm0, ymm10, 37
         vpsrlq	ymm1, ymm11, 28
         vpsrlq	ymm2, ymm12, 54
@@ -21093,15 +21110,15 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm2, ymm2, ymm12
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r9+128], ymm0
+        vmovdqu	YMMWORD PTR [r10+128], ymm0
         vmovdqu	YMMWORD PTR [rcx+-32], ymm1
         vmovdqu	YMMWORD PTR [rcx+96], ymm2
-        vmovdqu	YMMWORD PTR [r8+-32], ymm3
-        vmovdqu	YMMWORD PTR [r8+96], ymm4
+        vmovdqu	YMMWORD PTR [r9+-32], ymm3
+        vmovdqu	YMMWORD PTR [r9+96], ymm4
         ; Row 4
-        vpxor	ymm10, ymm7, [r8]
-        vpxor	ymm11, ymm8, [r8+128]
-        vpxor	ymm12, ymm9, [r9]
+        vpxor	ymm10, ymm7, [r9]
+        vpxor	ymm11, ymm8, [r9+128]
+        vpxor	ymm12, ymm9, [r10]
         vpxor	ymm13, ymm5, [rcx]
         vpxor	ymm14, ymm6, [rcx+128]
         vpsrlq	ymm0, ymm10, 2
@@ -21129,9 +21146,9 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm2, ymm2, ymm12
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r8], ymm0
-        vmovdqu	YMMWORD PTR [r8+128], ymm1
-        vmovdqu	YMMWORD PTR [r9], ymm2
+        vmovdqu	YMMWORD PTR [r9], ymm0
+        vmovdqu	YMMWORD PTR [r9+128], ymm1
+        vmovdqu	YMMWORD PTR [r10], ymm2
         vmovdqu	YMMWORD PTR [rcx], ymm3
         vmovdqu	YMMWORD PTR [rcx+128], ymm4
         ; Round 2
@@ -21143,19 +21160,19 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm13, ymm3, [rcx+32]
         vpxor	ymm10, ymm10, [rcx+64]
         vpxor	ymm12, ymm12, [rcx+96]
-        vpxor	ymm11, ymm11, [r8+-96]
-        vpxor	ymm11, ymm11, [r8+-64]
-        vpxor	ymm13, ymm13, [r8+-32]
-        vpxor	ymm12, ymm12, [r8+32]
-        vpxor	ymm14, ymm14, [r8+64]
-        vpxor	ymm14, ymm14, [r8+96]
-        vpxor	ymm13, ymm13, [r9+-96]
-        vpxor	ymm10, ymm10, [r9+-64]
-        vpxor	ymm12, ymm12, [r9+-32]
-        vpxor	ymm14, ymm14, [r9+32]
-        vpxor	ymm11, ymm11, [r9+64]
-        vpxor	ymm13, ymm13, [r9+96]
-        vpxor	ymm10, ymm10, [r9+128]
+        vpxor	ymm11, ymm11, [r9+-96]
+        vpxor	ymm11, ymm11, [r9+-64]
+        vpxor	ymm13, ymm13, [r9+-32]
+        vpxor	ymm12, ymm12, [r9+32]
+        vpxor	ymm14, ymm14, [r9+64]
+        vpxor	ymm14, ymm14, [r9+96]
+        vpxor	ymm13, ymm13, [r10+-96]
+        vpxor	ymm10, ymm10, [r10+-64]
+        vpxor	ymm12, ymm12, [r10+-32]
+        vpxor	ymm14, ymm14, [r10+32]
+        vpxor	ymm11, ymm11, [r10+64]
+        vpxor	ymm13, ymm13, [r10+96]
+        vpxor	ymm10, ymm10, [r10+128]
         ; Calc t[0..4]
         vpsrlq	ymm0, ymm11, 63
         vpsrlq	ymm1, ymm12, 63
@@ -21180,9 +21197,9 @@ sha3_256_blocksx4_seed_avx2 PROC
         ; Row Mix
         ; Row 0
         vpxor	ymm10, ymm5, ymm15
-        vpxor	ymm11, ymm6, [r9+64]
-        vpxor	ymm12, ymm7, [r9+-32]
-        vpxor	ymm13, ymm8, [r8+-32]
+        vpxor	ymm11, ymm6, [r10+64]
+        vpxor	ymm12, ymm7, [r10+-32]
+        vpxor	ymm13, ymm8, [r9+-32]
         vpxor	ymm14, ymm9, [rcx+128]
         vpsrlq	ymm0, ymm11, 20
         vpsrlq	ymm1, ymm12, 21
@@ -21208,16 +21225,16 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm15, ymm15, [rax+64]
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r9+64], ymm1
-        vmovdqu	YMMWORD PTR [r9+-32], ymm2
-        vmovdqu	YMMWORD PTR [r8+-32], ymm3
+        vmovdqu	YMMWORD PTR [r10+64], ymm1
+        vmovdqu	YMMWORD PTR [r10+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+-32], ymm3
         vmovdqu	YMMWORD PTR [rcx+128], ymm4
         ; Row 1
-        vpxor	ymm10, ymm8, [r9+-96]
-        vpxor	ymm11, ymm9, [r8+64]
+        vpxor	ymm10, ymm8, [r10+-96]
+        vpxor	ymm11, ymm9, [r9+64]
         vpxor	ymm12, ymm5, [rcx+64]
         vpxor	ymm13, ymm6, [rcx+-32]
-        vpxor	ymm14, ymm7, [r9]
+        vpxor	ymm14, ymm7, [r10]
         vpsrlq	ymm0, ymm10, 36
         vpsrlq	ymm1, ymm11, 44
         vpsrlq	ymm2, ymm12, 61
@@ -21243,17 +21260,17 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm2, ymm2, ymm12
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r9+-96], ymm0
-        vmovdqu	YMMWORD PTR [r8+64], ymm1
+        vmovdqu	YMMWORD PTR [r10+-96], ymm0
+        vmovdqu	YMMWORD PTR [r9+64], ymm1
         vmovdqu	YMMWORD PTR [rcx+64], ymm2
         vmovdqu	YMMWORD PTR [rcx+-32], ymm3
-        vmovdqu	YMMWORD PTR [r9], ymm4
+        vmovdqu	YMMWORD PTR [r10], ymm4
         ; Row 2
-        vpxor	ymm10, ymm6, [r8+-96]
+        vpxor	ymm10, ymm6, [r9+-96]
         vpxor	ymm11, ymm7, [rcx+-96]
-        vpxor	ymm12, ymm8, [r9+96]
-        vpxor	ymm13, ymm9, [r8+96]
-        vpxor	ymm14, ymm5, [r8]
+        vpxor	ymm12, ymm8, [r10+96]
+        vpxor	ymm13, ymm9, [r9+96]
+        vpxor	ymm14, ymm5, [r9]
         vpsrlq	ymm0, ymm10, 63
         vpsrlq	ymm1, ymm11, 58
         vpsrlq	ymm2, ymm12, 39
@@ -21279,15 +21296,15 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm2, ymm2, ymm12
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r8+-96], ymm0
+        vmovdqu	YMMWORD PTR [r9+-96], ymm0
         vmovdqu	YMMWORD PTR [rcx+-96], ymm1
-        vmovdqu	YMMWORD PTR [r9+96], ymm2
-        vmovdqu	YMMWORD PTR [r8+96], ymm3
-        vmovdqu	YMMWORD PTR [r8], ymm4
+        vmovdqu	YMMWORD PTR [r10+96], ymm2
+        vmovdqu	YMMWORD PTR [r9+96], ymm3
+        vmovdqu	YMMWORD PTR [r9], ymm4
         ; Row 3
-        vpxor	ymm10, ymm9, [r9+32]
-        vpxor	ymm11, ymm5, [r9+-64]
-        vpxor	ymm12, ymm6, [r8+-64]
+        vpxor	ymm10, ymm9, [r10+32]
+        vpxor	ymm11, ymm5, [r10+-64]
+        vpxor	ymm12, ymm6, [r9+-64]
         vpxor	ymm13, ymm7, [rcx+96]
         vpxor	ymm14, ymm8, [rcx]
         vpsrlq	ymm0, ymm10, 37
@@ -21315,17 +21332,17 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm2, ymm2, ymm12
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r9+32], ymm0
-        vmovdqu	YMMWORD PTR [r9+-64], ymm1
-        vmovdqu	YMMWORD PTR [r8+-64], ymm2
+        vmovdqu	YMMWORD PTR [r10+32], ymm0
+        vmovdqu	YMMWORD PTR [r10+-64], ymm1
+        vmovdqu	YMMWORD PTR [r9+-64], ymm2
         vmovdqu	YMMWORD PTR [rcx+96], ymm3
         vmovdqu	YMMWORD PTR [rcx], ymm4
         ; Row 4
-        vpxor	ymm10, ymm7, [r8+32]
+        vpxor	ymm10, ymm7, [r9+32]
         vpxor	ymm11, ymm8, [rcx+32]
         vpxor	ymm12, ymm9, [rcx+-64]
-        vpxor	ymm13, ymm5, [r9+128]
-        vpxor	ymm14, ymm6, [r8+128]
+        vpxor	ymm13, ymm5, [r10+128]
+        vpxor	ymm14, ymm6, [r9+128]
         vpsrlq	ymm0, ymm10, 2
         vpsrlq	ymm1, ymm11, 9
         vpsrlq	ymm2, ymm12, 25
@@ -21351,11 +21368,11 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm2, ymm2, ymm12
         vpxor	ymm3, ymm3, ymm13
         vpxor	ymm4, ymm4, ymm14
-        vmovdqu	YMMWORD PTR [r8+32], ymm0
+        vmovdqu	YMMWORD PTR [r9+32], ymm0
         vmovdqu	YMMWORD PTR [rcx+32], ymm1
         vmovdqu	YMMWORD PTR [rcx+-64], ymm2
-        vmovdqu	YMMWORD PTR [r9+128], ymm3
-        vmovdqu	YMMWORD PTR [r8+128], ymm4
+        vmovdqu	YMMWORD PTR [r10+128], ymm3
+        vmovdqu	YMMWORD PTR [r9+128], ymm4
         ; Round 3
         ; Calc b[0..4]
         vpxor	ymm10, ymm0, ymm15
@@ -21365,7 +21382,5419 @@ sha3_256_blocksx4_seed_avx2 PROC
         vpxor	ymm12, ymm2, [rcx+64]
         vpxor	ymm13, ymm13, [rcx+96]
         vpxor	ymm14, ymm14, [rcx+128]
-        vpxor	ymm10, ymm10, [r8+-96]
+        vpxor	ymm10, ymm10, [r9+-96]
+        vpxor	ymm12, ymm12, [r9+-64]
+        vpxor	ymm13, ymm13, [r9+-32]
+        vpxor	ymm14, ymm14, [r9]
+        vpxor	ymm11, ymm11, [r9+64]
+        vpxor	ymm13, ymm13, [r9+96]
+        vpxor	ymm10, ymm10, [r10+-96]
+        vpxor	ymm11, ymm11, [r10+-64]
+        vpxor	ymm12, ymm12, [r10+-32]
+        vpxor	ymm14, ymm14, [r10]
+        vpxor	ymm10, ymm10, [r10+32]
+        vpxor	ymm11, ymm11, [r10+64]
+        vpxor	ymm12, ymm12, [r10+96]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9+64]
+        vpxor	ymm12, ymm7, [r10+96]
+        vpxor	ymm13, ymm8, [rcx+96]
+        vpxor	ymm14, ymm9, [r9+128]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+96]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+64], ymm1
+        vmovdqu	YMMWORD PTR [r10+96], ymm2
+        vmovdqu	YMMWORD PTR [rcx+96], ymm3
+        vmovdqu	YMMWORD PTR [r9+128], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+-32]
+        vpxor	ymm11, ymm9, [r10]
+        vpxor	ymm12, ymm5, [r9+-96]
+        vpxor	ymm13, ymm6, [r10+-64]
+        vpxor	ymm14, ymm7, [rcx+-64]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-32], ymm0
+        vmovdqu	YMMWORD PTR [r10], ymm1
+        vmovdqu	YMMWORD PTR [r9+-96], ymm2
+        vmovdqu	YMMWORD PTR [r10+-64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10+64]
+        vpxor	ymm11, ymm7, [rcx+64]
+        vpxor	ymm12, ymm8, [r9+96]
+        vpxor	ymm13, ymm9, [rcx]
+        vpxor	ymm14, ymm5, [r9+32]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+64], ymm0
+        vmovdqu	YMMWORD PTR [rcx+64], ymm1
+        vmovdqu	YMMWORD PTR [r9+96], ymm2
+        vmovdqu	YMMWORD PTR [rcx], ymm3
+        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx+128]
+        vpxor	ymm11, ymm5, [r10+-96]
+        vpxor	ymm12, ymm6, [rcx+-96]
+        vpxor	ymm13, ymm7, [r9+-64]
+        vpxor	ymm14, ymm8, [r10+128]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+128], ymm0
+        vmovdqu	YMMWORD PTR [r10+-96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm2
+        vmovdqu	YMMWORD PTR [r9+-64], ymm3
+        vmovdqu	YMMWORD PTR [r10+128], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10+-32]
+        vpxor	ymm11, ymm8, [rcx+-32]
+        vpxor	ymm12, ymm9, [r9]
+        vpxor	ymm13, ymm5, [r10+32]
+        vpxor	ymm14, ymm6, [rcx+32]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm1
+        vmovdqu	YMMWORD PTR [r9], ymm2
+        vmovdqu	YMMWORD PTR [r10+32], ymm3
+        vmovdqu	YMMWORD PTR [rcx+32], ymm4
+        ; Round 4
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm12, ymm2, [rcx+-96]
+        vpxor	ymm14, ymm4, [rcx+-64]
+        vpxor	ymm13, ymm3, [rcx]
+        vpxor	ymm11, ymm1, [rcx+64]
+        vpxor	ymm13, ymm13, [rcx+96]
+        vpxor	ymm10, ymm10, [rcx+128]
+        vpxor	ymm12, ymm12, [r9+-96]
+        vpxor	ymm13, ymm13, [r9+-64]
+        vpxor	ymm10, ymm10, [r9+-32]
+        vpxor	ymm14, ymm14, [r9+32]
+        vpxor	ymm11, ymm11, [r9+64]
+        vpxor	ymm12, ymm12, [r9+96]
+        vpxor	ymm14, ymm14, [r9+128]
+        vpxor	ymm11, ymm11, [r10+-96]
+        vpxor	ymm13, ymm13, [r10+-64]
+        vpxor	ymm11, ymm11, [r10]
+        vpxor	ymm10, ymm10, [r10+64]
+        vpxor	ymm12, ymm12, [r10+96]
+        vpxor	ymm14, ymm14, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r10]
+        vpxor	ymm12, ymm7, [r9+96]
+        vpxor	ymm13, ymm8, [r9+-64]
+        vpxor	ymm14, ymm9, [rcx+32]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+128]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10], ymm1
+        vmovdqu	YMMWORD PTR [r9+96], ymm2
+        vmovdqu	YMMWORD PTR [r9+-64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+32], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx+96]
+        vpxor	ymm11, ymm9, [rcx+-64]
+        vpxor	ymm12, ymm5, [r10+64]
+        vpxor	ymm13, ymm6, [r10+-96]
+        vpxor	ymm14, ymm7, [r9]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+96], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10+64], ymm2
+        vmovdqu	YMMWORD PTR [r10+-96], ymm3
+        vmovdqu	YMMWORD PTR [r9], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r9+64]
+        vpxor	ymm11, ymm7, [r9+-96]
+        vpxor	ymm12, ymm8, [rcx]
+        vpxor	ymm13, ymm9, [r10+128]
+        vpxor	ymm14, ymm5, [r10+-32]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+64], ymm0
+        vmovdqu	YMMWORD PTR [r9+-96], ymm1
+        vmovdqu	YMMWORD PTR [rcx], ymm2
+        vmovdqu	YMMWORD PTR [r10+128], ymm3
+        vmovdqu	YMMWORD PTR [r10+-32], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+128]
+        vpxor	ymm11, ymm5, [r9+-32]
+        vpxor	ymm12, ymm6, [rcx+64]
+        vpxor	ymm13, ymm7, [rcx+-96]
+        vpxor	ymm14, ymm8, [r10+32]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+128], ymm0
+        vmovdqu	YMMWORD PTR [r9+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10+32], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10+96]
+        vpxor	ymm11, ymm8, [r10+-64]
+        vpxor	ymm12, ymm9, [r9+32]
+        vpxor	ymm13, ymm5, [rcx+128]
+        vpxor	ymm14, ymm6, [rcx+-32]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+96], ymm0
+        vmovdqu	YMMWORD PTR [r10+-64], ymm1
+        vmovdqu	YMMWORD PTR [r9+32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+128], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm4
+        ; Round 5
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm13, ymm3, [rcx+-96]
+        vpxor	ymm11, ymm1, [rcx+-64]
+        vpxor	ymm12, ymm2, [rcx]
+        vpxor	ymm14, ymm4, [rcx+32]
+        vpxor	ymm12, ymm12, [rcx+64]
+        vpxor	ymm10, ymm10, [rcx+96]
+        vpxor	ymm11, ymm11, [r9+-96]
+        vpxor	ymm13, ymm13, [r9+-64]
+        vpxor	ymm11, ymm11, [r9+-32]
+        vpxor	ymm14, ymm14, [r9]
+        vpxor	ymm10, ymm10, [r9+64]
+        vpxor	ymm12, ymm12, [r9+96]
+        vpxor	ymm10, ymm10, [r9+128]
+        vpxor	ymm13, ymm13, [r10+-96]
+        vpxor	ymm14, ymm14, [r10+-32]
+        vpxor	ymm11, ymm11, [r10]
+        vpxor	ymm14, ymm14, [r10+32]
+        vpxor	ymm12, ymm12, [r10+64]
+        vpxor	ymm13, ymm13, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx+-64]
+        vpxor	ymm12, ymm7, [rcx]
+        vpxor	ymm13, ymm8, [rcx+-96]
+        vpxor	ymm14, ymm9, [rcx+-32]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+160]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm1
+        vmovdqu	YMMWORD PTR [rcx], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+-64]
+        vpxor	ymm11, ymm9, [r9]
+        vpxor	ymm12, ymm5, [r9+64]
+        vpxor	ymm13, ymm6, [r9+-32]
+        vpxor	ymm14, ymm7, [r9+32]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9], ymm1
+        vmovdqu	YMMWORD PTR [r9+64], ymm2
+        vmovdqu	YMMWORD PTR [r9+-32], ymm3
+        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10]
+        vpxor	ymm11, ymm7, [r10+64]
+        vpxor	ymm12, ymm8, [r10+128]
+        vpxor	ymm13, ymm9, [r10+32]
+        vpxor	ymm14, ymm5, [r10+96]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10], ymm0
+        vmovdqu	YMMWORD PTR [r10+64], ymm1
+        vmovdqu	YMMWORD PTR [r10+128], ymm2
+        vmovdqu	YMMWORD PTR [r10+32], ymm3
+        vmovdqu	YMMWORD PTR [r10+96], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx+32]
+        vpxor	ymm11, ymm5, [rcx+96]
+        vpxor	ymm12, ymm6, [r9+-96]
+        vpxor	ymm13, ymm7, [rcx+64]
+        vpxor	ymm14, ymm8, [rcx+128]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+96], ymm1
+        vmovdqu	YMMWORD PTR [r9+-96], ymm2
+        vmovdqu	YMMWORD PTR [rcx+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+128], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r9+96]
+        vpxor	ymm11, ymm8, [r10+-96]
+        vpxor	ymm12, ymm9, [r10+-32]
+        vpxor	ymm13, ymm5, [r9+128]
+        vpxor	ymm14, ymm6, [r10+-64]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+96], ymm0
+        vmovdqu	YMMWORD PTR [r10+-96], ymm1
+        vmovdqu	YMMWORD PTR [r10+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+128], ymm3
+        vmovdqu	YMMWORD PTR [r10+-64], ymm4
+        ; Round 6
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm13, ymm3, [rcx+-96]
+        vpxor	ymm11, ymm1, [rcx+-64]
+        vpxor	ymm14, ymm4, [rcx+-32]
+        vpxor	ymm12, ymm2, [rcx]
+        vpxor	ymm10, ymm10, [rcx+32]
+        vpxor	ymm13, ymm13, [rcx+64]
+        vpxor	ymm11, ymm11, [rcx+96]
+        vpxor	ymm14, ymm14, [rcx+128]
+        vpxor	ymm12, ymm12, [r9+-96]
+        vpxor	ymm10, ymm10, [r9+-64]
+        vpxor	ymm13, ymm13, [r9+-32]
+        vpxor	ymm11, ymm11, [r9]
+        vpxor	ymm14, ymm14, [r9+32]
+        vpxor	ymm12, ymm12, [r9+64]
+        vpxor	ymm10, ymm10, [r10]
+        vpxor	ymm13, ymm13, [r10+32]
+        vpxor	ymm11, ymm11, [r10+64]
+        vpxor	ymm14, ymm14, [r10+96]
+        vpxor	ymm12, ymm12, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9]
+        vpxor	ymm12, ymm7, [r10+128]
+        vpxor	ymm13, ymm8, [rcx+64]
+        vpxor	ymm14, ymm9, [r10+-64]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+192]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9], ymm1
+        vmovdqu	YMMWORD PTR [r10+128], ymm2
+        vmovdqu	YMMWORD PTR [rcx+64], ymm3
+        vmovdqu	YMMWORD PTR [r10+-64], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx+-96]
+        vpxor	ymm11, ymm9, [r9+32]
+        vpxor	ymm12, ymm5, [r10]
+        vpxor	ymm13, ymm6, [rcx+96]
+        vpxor	ymm14, ymm7, [r10+-32]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm0
+        vmovdqu	YMMWORD PTR [r9+32], ymm1
+        vmovdqu	YMMWORD PTR [r10], ymm2
+        vmovdqu	YMMWORD PTR [rcx+96], ymm3
+        vmovdqu	YMMWORD PTR [r10+-32], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx+-64]
+        vpxor	ymm11, ymm7, [r9+64]
+        vpxor	ymm12, ymm8, [r10+32]
+        vpxor	ymm13, ymm9, [rcx+128]
+        vpxor	ymm14, ymm5, [r9+96]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9+64], ymm1
+        vmovdqu	YMMWORD PTR [r10+32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+128], ymm3
+        vmovdqu	YMMWORD PTR [r9+96], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx+-32]
+        vpxor	ymm11, ymm5, [r9+-64]
+        vpxor	ymm12, ymm6, [r10+64]
+        vpxor	ymm13, ymm7, [r9+-96]
+        vpxor	ymm14, ymm8, [r9+128]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm0
+        vmovdqu	YMMWORD PTR [r9+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10+64], ymm2
+        vmovdqu	YMMWORD PTR [r9+-96], ymm3
+        vmovdqu	YMMWORD PTR [r9+128], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx]
+        vpxor	ymm11, ymm8, [r9+-32]
+        vpxor	ymm12, ymm9, [r10+96]
+        vpxor	ymm13, ymm5, [rcx+32]
+        vpxor	ymm14, ymm6, [r10+-96]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx], ymm0
+        vmovdqu	YMMWORD PTR [r9+-32], ymm1
+        vmovdqu	YMMWORD PTR [r10+96], ymm2
+        vmovdqu	YMMWORD PTR [rcx+32], ymm3
+        vmovdqu	YMMWORD PTR [r10+-96], ymm4
+        ; Round 7
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm10, ymm10, [rcx+-96]
+        vpxor	ymm10, ymm10, [rcx+-64]
+        vpxor	ymm10, ymm10, [rcx+-32]
+        vpxor	ymm13, ymm3, [rcx+64]
+        vpxor	ymm13, ymm13, [rcx+96]
+        vpxor	ymm13, ymm13, [rcx+128]
+        vpxor	ymm13, ymm13, [r9+-96]
+        vpxor	ymm11, ymm1, [r9+-64]
+        vpxor	ymm11, ymm11, [r9]
+        vpxor	ymm11, ymm11, [r9+32]
+        vpxor	ymm11, ymm11, [r9+64]
+        vpxor	ymm14, ymm4, [r9+96]
+        vpxor	ymm14, ymm14, [r9+128]
+        vpxor	ymm14, ymm14, [r10+-64]
+        vpxor	ymm14, ymm14, [r10+-32]
+        vpxor	ymm12, ymm2, [r10]
+        vpxor	ymm12, ymm12, [r10+32]
+        vpxor	ymm12, ymm12, [r10+64]
+        vpxor	ymm12, ymm12, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9+32]
+        vpxor	ymm12, ymm7, [r10+32]
+        vpxor	ymm13, ymm8, [r9+-96]
+        vpxor	ymm14, ymm9, [r10+-96]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+224]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+32], ymm1
+        vmovdqu	YMMWORD PTR [r10+32], ymm2
+        vmovdqu	YMMWORD PTR [r9+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10+-96], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx+64]
+        vpxor	ymm11, ymm9, [r10+-32]
+        vpxor	ymm12, ymm5, [rcx+-64]
+        vpxor	ymm13, ymm6, [r9+-64]
+        vpxor	ymm14, ymm7, [r10+96]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+64], ymm0
+        vmovdqu	YMMWORD PTR [r10+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm2
+        vmovdqu	YMMWORD PTR [r9+-64], ymm3
+        vmovdqu	YMMWORD PTR [r10+96], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r9]
+        vpxor	ymm11, ymm7, [r10]
+        vpxor	ymm12, ymm8, [rcx+128]
+        vpxor	ymm13, ymm9, [r9+128]
+        vpxor	ymm14, ymm5, [rcx]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9], ymm0
+        vmovdqu	YMMWORD PTR [r10], ymm1
+        vmovdqu	YMMWORD PTR [rcx+128], ymm2
+        vmovdqu	YMMWORD PTR [r9+128], ymm3
+        vmovdqu	YMMWORD PTR [rcx], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r10+-64]
+        vpxor	ymm11, ymm5, [rcx+-96]
+        vpxor	ymm12, ymm6, [r9+64]
+        vpxor	ymm13, ymm7, [r10+64]
+        vpxor	ymm14, ymm8, [rcx+32]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-64], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm1
+        vmovdqu	YMMWORD PTR [r9+64], ymm2
+        vmovdqu	YMMWORD PTR [r10+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+32], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10+128]
+        vpxor	ymm11, ymm8, [rcx+96]
+        vpxor	ymm12, ymm9, [r9+96]
+        vpxor	ymm13, ymm5, [rcx+-32]
+        vpxor	ymm14, ymm6, [r9+-32]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+128], ymm0
+        vmovdqu	YMMWORD PTR [rcx+96], ymm1
+        vmovdqu	YMMWORD PTR [r9+96], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm3
+        vmovdqu	YMMWORD PTR [r9+-32], ymm4
+        ; Round 8
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm11, ymm1, [rcx+-96]
+        vpxor	ymm12, ymm2, [rcx+-64]
+        vpxor	ymm14, ymm4, [rcx]
+        vpxor	ymm14, ymm14, [rcx+32]
+        vpxor	ymm10, ymm10, [rcx+64]
+        vpxor	ymm12, ymm12, [rcx+128]
+        vpxor	ymm13, ymm3, [r9+-96]
+        vpxor	ymm13, ymm13, [r9+-64]
+        vpxor	ymm10, ymm10, [r9]
+        vpxor	ymm11, ymm11, [r9+32]
+        vpxor	ymm12, ymm12, [r9+64]
+        vpxor	ymm13, ymm13, [r9+128]
+        vpxor	ymm14, ymm14, [r10+-96]
+        vpxor	ymm10, ymm10, [r10+-64]
+        vpxor	ymm11, ymm11, [r10+-32]
+        vpxor	ymm11, ymm11, [r10]
+        vpxor	ymm12, ymm12, [r10+32]
+        vpxor	ymm13, ymm13, [r10+64]
+        vpxor	ymm14, ymm14, [r10+96]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r10+-32]
+        vpxor	ymm12, ymm7, [rcx+128]
+        vpxor	ymm13, ymm8, [r10+64]
+        vpxor	ymm14, ymm9, [r9+-32]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+256]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+128], ymm2
+        vmovdqu	YMMWORD PTR [r10+64], ymm3
+        vmovdqu	YMMWORD PTR [r9+-32], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+-96]
+        vpxor	ymm11, ymm9, [r10+96]
+        vpxor	ymm12, ymm5, [r9]
+        vpxor	ymm13, ymm6, [rcx+-96]
+        vpxor	ymm14, ymm7, [r9+96]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-96], ymm0
+        vmovdqu	YMMWORD PTR [r10+96], ymm1
+        vmovdqu	YMMWORD PTR [r9], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm3
+        vmovdqu	YMMWORD PTR [r9+96], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r9+32]
+        vpxor	ymm11, ymm7, [rcx+-64]
+        vpxor	ymm12, ymm8, [r9+128]
+        vpxor	ymm13, ymm9, [rcx+32]
+        vpxor	ymm14, ymm5, [r10+128]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm1
+        vmovdqu	YMMWORD PTR [r9+128], ymm2
+        vmovdqu	YMMWORD PTR [rcx+32], ymm3
+        vmovdqu	YMMWORD PTR [r10+128], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r10+-96]
+        vpxor	ymm11, ymm5, [rcx+64]
+        vpxor	ymm12, ymm6, [r10]
+        vpxor	ymm13, ymm7, [r9+64]
+        vpxor	ymm14, ymm8, [rcx+-32]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-96], ymm0
+        vmovdqu	YMMWORD PTR [rcx+64], ymm1
+        vmovdqu	YMMWORD PTR [r10], ymm2
+        vmovdqu	YMMWORD PTR [r9+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10+32]
+        vpxor	ymm11, ymm8, [r9+-64]
+        vpxor	ymm12, ymm9, [rcx]
+        vpxor	ymm13, ymm5, [r10+-64]
+        vpxor	ymm14, ymm6, [rcx+96]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+32], ymm0
+        vmovdqu	YMMWORD PTR [r9+-64], ymm1
+        vmovdqu	YMMWORD PTR [rcx], ymm2
+        vmovdqu	YMMWORD PTR [r10+-64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+96], ymm4
+        ; Round 9
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm13, ymm3, [rcx+-96]
+        vpxor	ymm11, ymm1, [rcx+-64]
+        vpxor	ymm14, ymm4, [rcx+-32]
+        vpxor	ymm13, ymm13, [rcx+32]
+        vpxor	ymm11, ymm11, [rcx+64]
+        vpxor	ymm12, ymm2, [rcx+128]
+        vpxor	ymm10, ymm10, [r9+-96]
+        vpxor	ymm14, ymm14, [r9+-32]
+        vpxor	ymm12, ymm12, [r9]
+        vpxor	ymm10, ymm10, [r9+32]
+        vpxor	ymm13, ymm13, [r9+64]
+        vpxor	ymm14, ymm14, [r9+96]
+        vpxor	ymm12, ymm12, [r9+128]
+        vpxor	ymm10, ymm10, [r10+-96]
+        vpxor	ymm11, ymm11, [r10+-32]
+        vpxor	ymm12, ymm12, [r10]
+        vpxor	ymm13, ymm13, [r10+64]
+        vpxor	ymm11, ymm11, [r10+96]
+        vpxor	ymm14, ymm14, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r10+96]
+        vpxor	ymm12, ymm7, [r9+128]
+        vpxor	ymm13, ymm8, [r9+64]
+        vpxor	ymm14, ymm9, [rcx+96]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+288]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+96], ymm1
+        vmovdqu	YMMWORD PTR [r9+128], ymm2
+        vmovdqu	YMMWORD PTR [r9+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+96], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r10+64]
+        vpxor	ymm11, ymm9, [r9+96]
+        vpxor	ymm12, ymm5, [r9+32]
+        vpxor	ymm13, ymm6, [rcx+64]
+        vpxor	ymm14, ymm7, [rcx]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+64], ymm0
+        vmovdqu	YMMWORD PTR [r9+96], ymm1
+        vmovdqu	YMMWORD PTR [r9+32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10+-32]
+        vpxor	ymm11, ymm7, [r9]
+        vpxor	ymm12, ymm8, [rcx+32]
+        vpxor	ymm13, ymm9, [rcx+-32]
+        vpxor	ymm14, ymm5, [r10+32]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-32], ymm0
+        vmovdqu	YMMWORD PTR [r9], ymm1
+        vmovdqu	YMMWORD PTR [rcx+32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm3
+        vmovdqu	YMMWORD PTR [r10+32], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+-32]
+        vpxor	ymm11, ymm5, [r9+-96]
+        vpxor	ymm12, ymm6, [rcx+-64]
+        vpxor	ymm13, ymm7, [r10]
+        vpxor	ymm14, ymm8, [r10+-64]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-32], ymm0
+        vmovdqu	YMMWORD PTR [r9+-96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm2
+        vmovdqu	YMMWORD PTR [r10], ymm3
+        vmovdqu	YMMWORD PTR [r10+-64], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx+128]
+        vpxor	ymm11, ymm8, [rcx+-96]
+        vpxor	ymm12, ymm9, [r10+128]
+        vpxor	ymm13, ymm5, [r10+-96]
+        vpxor	ymm14, ymm6, [r9+-64]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+128], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm1
+        vmovdqu	YMMWORD PTR [r10+128], ymm2
+        vmovdqu	YMMWORD PTR [r10+-96], ymm3
+        vmovdqu	YMMWORD PTR [r9+-64], ymm4
+        ; Round 10
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm12, ymm2, [rcx+-64]
+        vpxor	ymm13, ymm3, [rcx+-32]
+        vpxor	ymm14, ymm4, [rcx]
+        vpxor	ymm12, ymm12, [rcx+32]
+        vpxor	ymm13, ymm13, [rcx+64]
+        vpxor	ymm14, ymm14, [rcx+96]
+        vpxor	ymm11, ymm1, [r9+-96]
+        vpxor	ymm10, ymm10, [r9+-32]
+        vpxor	ymm11, ymm11, [r9]
+        vpxor	ymm12, ymm12, [r9+32]
+        vpxor	ymm13, ymm13, [r9+64]
+        vpxor	ymm11, ymm11, [r9+96]
+        vpxor	ymm12, ymm12, [r9+128]
+        vpxor	ymm14, ymm14, [r10+-64]
+        vpxor	ymm10, ymm10, [r10+-32]
+        vpxor	ymm13, ymm13, [r10]
+        vpxor	ymm14, ymm14, [r10+32]
+        vpxor	ymm10, ymm10, [r10+64]
+        vpxor	ymm11, ymm11, [r10+96]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9+96]
+        vpxor	ymm12, ymm7, [rcx+32]
+        vpxor	ymm13, ymm8, [r10]
+        vpxor	ymm14, ymm9, [r9+-64]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+320]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+32], ymm2
+        vmovdqu	YMMWORD PTR [r10], ymm3
+        vmovdqu	YMMWORD PTR [r9+-64], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+64]
+        vpxor	ymm11, ymm9, [rcx]
+        vpxor	ymm12, ymm5, [r10+-32]
+        vpxor	ymm13, ymm6, [r9+-96]
+        vpxor	ymm14, ymm7, [r10+128]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+64], ymm0
+        vmovdqu	YMMWORD PTR [rcx], ymm1
+        vmovdqu	YMMWORD PTR [r10+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10+128], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10+96]
+        vpxor	ymm11, ymm7, [r9+32]
+        vpxor	ymm12, ymm8, [rcx+-32]
+        vpxor	ymm13, ymm9, [r10+-64]
+        vpxor	ymm14, ymm5, [rcx+128]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+96], ymm0
+        vmovdqu	YMMWORD PTR [r9+32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm2
+        vmovdqu	YMMWORD PTR [r10+-64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+128], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx+96]
+        vpxor	ymm11, ymm5, [r10+64]
+        vpxor	ymm12, ymm6, [r9]
+        vpxor	ymm13, ymm7, [rcx+-64]
+        vpxor	ymm14, ymm8, [r10+-96]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+96], ymm0
+        vmovdqu	YMMWORD PTR [r10+64], ymm1
+        vmovdqu	YMMWORD PTR [r9], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm3
+        vmovdqu	YMMWORD PTR [r10+-96], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r9+128]
+        vpxor	ymm11, ymm8, [rcx+64]
+        vpxor	ymm12, ymm9, [r10+32]
+        vpxor	ymm13, ymm5, [r9+-32]
+        vpxor	ymm14, ymm6, [rcx+-96]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+128], ymm0
+        vmovdqu	YMMWORD PTR [rcx+64], ymm1
+        vmovdqu	YMMWORD PTR [r10+32], ymm2
+        vmovdqu	YMMWORD PTR [r9+-32], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm4
+        ; Round 11
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm13, ymm3, [rcx+-64]
+        vpxor	ymm12, ymm2, [rcx+-32]
+        vpxor	ymm11, ymm1, [rcx]
+        vpxor	ymm12, ymm12, [rcx+32]
+        vpxor	ymm10, ymm10, [rcx+96]
+        vpxor	ymm14, ymm4, [rcx+128]
+        vpxor	ymm13, ymm13, [r9+-96]
+        vpxor	ymm14, ymm14, [r9+-64]
+        vpxor	ymm12, ymm12, [r9]
+        vpxor	ymm11, ymm11, [r9+32]
+        vpxor	ymm10, ymm10, [r9+64]
+        vpxor	ymm11, ymm11, [r9+96]
+        vpxor	ymm14, ymm14, [r10+-96]
+        vpxor	ymm13, ymm13, [r10+-64]
+        vpxor	ymm12, ymm12, [r10+-32]
+        vpxor	ymm13, ymm13, [r10]
+        vpxor	ymm11, ymm11, [r10+64]
+        vpxor	ymm10, ymm10, [r10+96]
+        vpxor	ymm14, ymm14, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx]
+        vpxor	ymm12, ymm7, [rcx+-32]
+        vpxor	ymm13, ymm8, [rcx+-64]
+        vpxor	ymm14, ymm9, [rcx+-96]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+352]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r10]
+        vpxor	ymm11, ymm9, [r10+128]
+        vpxor	ymm12, ymm5, [r10+96]
+        vpxor	ymm13, ymm6, [r10+64]
+        vpxor	ymm14, ymm7, [r10+32]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10], ymm0
+        vmovdqu	YMMWORD PTR [r10+128], ymm1
+        vmovdqu	YMMWORD PTR [r10+96], ymm2
+        vmovdqu	YMMWORD PTR [r10+64], ymm3
+        vmovdqu	YMMWORD PTR [r10+32], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r9+96]
+        vpxor	ymm11, ymm7, [r10+-32]
+        vpxor	ymm12, ymm8, [r10+-64]
+        vpxor	ymm13, ymm9, [r10+-96]
+        vpxor	ymm14, ymm5, [r9+128]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+96], ymm0
+        vmovdqu	YMMWORD PTR [r10+-32], ymm1
+        vmovdqu	YMMWORD PTR [r10+-64], ymm2
+        vmovdqu	YMMWORD PTR [r10+-96], ymm3
+        vmovdqu	YMMWORD PTR [r9+128], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+-64]
+        vpxor	ymm11, ymm5, [r9+64]
+        vpxor	ymm12, ymm6, [r9+32]
+        vpxor	ymm13, ymm7, [r9]
+        vpxor	ymm14, ymm8, [r9+-32]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9+64], ymm1
+        vmovdqu	YMMWORD PTR [r9+32], ymm2
+        vmovdqu	YMMWORD PTR [r9], ymm3
+        vmovdqu	YMMWORD PTR [r9+-32], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx+32]
+        vpxor	ymm11, ymm8, [r9+-96]
+        vpxor	ymm12, ymm9, [rcx+128]
+        vpxor	ymm13, ymm5, [rcx+96]
+        vpxor	ymm14, ymm6, [rcx+64]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+32], ymm0
+        vmovdqu	YMMWORD PTR [r9+-96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+128], ymm2
+        vmovdqu	YMMWORD PTR [rcx+96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+64], ymm4
+        ; Round 12
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm14, ymm4, [rcx+-96]
+        vpxor	ymm13, ymm3, [rcx+-64]
+        vpxor	ymm12, ymm2, [rcx+-32]
+        vpxor	ymm11, ymm1, [rcx]
+        vpxor	ymm10, ymm10, [r9+-64]
+        vpxor	ymm14, ymm14, [r9+-32]
+        vpxor	ymm13, ymm13, [r9]
+        vpxor	ymm12, ymm12, [r9+32]
+        vpxor	ymm11, ymm11, [r9+64]
+        vpxor	ymm10, ymm10, [r9+96]
+        vpxor	ymm14, ymm14, [r9+128]
+        vpxor	ymm13, ymm13, [r10+-96]
+        vpxor	ymm12, ymm12, [r10+-64]
+        vpxor	ymm11, ymm11, [r10+-32]
+        vpxor	ymm10, ymm10, [r10]
+        vpxor	ymm14, ymm14, [r10+32]
+        vpxor	ymm13, ymm13, [r10+64]
+        vpxor	ymm12, ymm12, [r10+96]
+        vpxor	ymm11, ymm11, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r10+128]
+        vpxor	ymm12, ymm7, [r10+-64]
+        vpxor	ymm13, ymm8, [r9]
+        vpxor	ymm14, ymm9, [rcx+64]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+384]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+128], ymm1
+        vmovdqu	YMMWORD PTR [r10+-64], ymm2
+        vmovdqu	YMMWORD PTR [r9], ymm3
+        vmovdqu	YMMWORD PTR [rcx+64], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx+-64]
+        vpxor	ymm11, ymm9, [r10+32]
+        vpxor	ymm12, ymm5, [r9+96]
+        vpxor	ymm13, ymm6, [r9+64]
+        vpxor	ymm14, ymm7, [rcx+128]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm0
+        vmovdqu	YMMWORD PTR [r10+32], ymm1
+        vmovdqu	YMMWORD PTR [r9+96], ymm2
+        vmovdqu	YMMWORD PTR [r9+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+128], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx]
+        vpxor	ymm11, ymm7, [r10+96]
+        vpxor	ymm12, ymm8, [r10+-96]
+        vpxor	ymm13, ymm9, [r9+-32]
+        vpxor	ymm14, ymm5, [rcx+32]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx], ymm0
+        vmovdqu	YMMWORD PTR [r10+96], ymm1
+        vmovdqu	YMMWORD PTR [r10+-96], ymm2
+        vmovdqu	YMMWORD PTR [r9+-32], ymm3
+        vmovdqu	YMMWORD PTR [rcx+32], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx+-96]
+        vpxor	ymm11, ymm5, [r10]
+        vpxor	ymm12, ymm6, [r10+-32]
+        vpxor	ymm13, ymm7, [r9+32]
+        vpxor	ymm14, ymm8, [rcx+96]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm0
+        vmovdqu	YMMWORD PTR [r10], ymm1
+        vmovdqu	YMMWORD PTR [r10+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+32], ymm3
+        vmovdqu	YMMWORD PTR [rcx+96], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx+-32]
+        vpxor	ymm11, ymm8, [r10+64]
+        vpxor	ymm12, ymm9, [r9+128]
+        vpxor	ymm13, ymm5, [r9+-64]
+        vpxor	ymm14, ymm6, [r9+-96]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm0
+        vmovdqu	YMMWORD PTR [r10+64], ymm1
+        vmovdqu	YMMWORD PTR [r9+128], ymm2
+        vmovdqu	YMMWORD PTR [r9+-64], ymm3
+        vmovdqu	YMMWORD PTR [r9+-96], ymm4
+        ; Round 13
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm10, ymm10, [rcx+-96]
+        vpxor	ymm10, ymm10, [rcx+-64]
+        vpxor	ymm10, ymm10, [rcx]
+        vpxor	ymm14, ymm4, [rcx+32]
+        vpxor	ymm14, ymm14, [rcx+64]
+        vpxor	ymm14, ymm14, [rcx+96]
+        vpxor	ymm14, ymm14, [rcx+128]
+        vpxor	ymm13, ymm3, [r9+-32]
+        vpxor	ymm13, ymm13, [r9]
+        vpxor	ymm13, ymm13, [r9+32]
+        vpxor	ymm13, ymm13, [r9+64]
+        vpxor	ymm12, ymm2, [r9+96]
+        vpxor	ymm12, ymm12, [r10+-96]
+        vpxor	ymm12, ymm12, [r10+-64]
+        vpxor	ymm12, ymm12, [r10+-32]
+        vpxor	ymm11, ymm1, [r10]
+        vpxor	ymm11, ymm11, [r10+32]
+        vpxor	ymm11, ymm11, [r10+96]
+        vpxor	ymm11, ymm11, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r10+32]
+        vpxor	ymm12, ymm7, [r10+-96]
+        vpxor	ymm13, ymm8, [r9+32]
+        vpxor	ymm14, ymm9, [r9+-96]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+416]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+32], ymm1
+        vmovdqu	YMMWORD PTR [r10+-96], ymm2
+        vmovdqu	YMMWORD PTR [r9+32], ymm3
+        vmovdqu	YMMWORD PTR [r9+-96], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9]
+        vpxor	ymm11, ymm9, [rcx+128]
+        vpxor	ymm12, ymm5, [rcx]
+        vpxor	ymm13, ymm6, [r10]
+        vpxor	ymm14, ymm7, [r9+128]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9], ymm0
+        vmovdqu	YMMWORD PTR [rcx+128], ymm1
+        vmovdqu	YMMWORD PTR [rcx], ymm2
+        vmovdqu	YMMWORD PTR [r10], ymm3
+        vmovdqu	YMMWORD PTR [r9+128], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10+128]
+        vpxor	ymm11, ymm7, [r9+96]
+        vpxor	ymm12, ymm8, [r9+-32]
+        vpxor	ymm13, ymm9, [rcx+96]
+        vpxor	ymm14, ymm5, [rcx+-32]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+128], ymm0
+        vmovdqu	YMMWORD PTR [r9+96], ymm1
+        vmovdqu	YMMWORD PTR [r9+-32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx+64]
+        vpxor	ymm11, ymm5, [rcx+-64]
+        vpxor	ymm12, ymm6, [r10+96]
+        vpxor	ymm13, ymm7, [r10+-32]
+        vpxor	ymm14, ymm8, [r9+-64]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+64], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10+96], ymm2
+        vmovdqu	YMMWORD PTR [r10+-32], ymm3
+        vmovdqu	YMMWORD PTR [r9+-64], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10+-64]
+        vpxor	ymm11, ymm8, [r9+64]
+        vpxor	ymm12, ymm9, [rcx+32]
+        vpxor	ymm13, ymm5, [rcx+-96]
+        vpxor	ymm14, ymm6, [r10+64]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9+64], ymm1
+        vmovdqu	YMMWORD PTR [rcx+32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10+64], ymm4
+        ; Round 14
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm11, ymm1, [rcx+-64]
+        vpxor	ymm14, ymm4, [rcx+-32]
+        vpxor	ymm12, ymm2, [rcx]
+        vpxor	ymm10, ymm10, [rcx+64]
+        vpxor	ymm13, ymm3, [rcx+96]
+        vpxor	ymm11, ymm11, [rcx+128]
+        vpxor	ymm14, ymm14, [r9+-96]
+        vpxor	ymm14, ymm14, [r9+-64]
+        vpxor	ymm12, ymm12, [r9+-32]
+        vpxor	ymm10, ymm10, [r9]
+        vpxor	ymm13, ymm13, [r9+32]
+        vpxor	ymm11, ymm11, [r9+96]
+        vpxor	ymm14, ymm14, [r9+128]
+        vpxor	ymm12, ymm12, [r10+-96]
+        vpxor	ymm13, ymm13, [r10+-32]
+        vpxor	ymm13, ymm13, [r10]
+        vpxor	ymm11, ymm11, [r10+32]
+        vpxor	ymm12, ymm12, [r10+96]
+        vpxor	ymm10, ymm10, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx+128]
+        vpxor	ymm12, ymm7, [r9+-32]
+        vpxor	ymm13, ymm8, [r10+-32]
+        vpxor	ymm14, ymm9, [r10+64]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+448]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+128], ymm1
+        vmovdqu	YMMWORD PTR [r9+-32], ymm2
+        vmovdqu	YMMWORD PTR [r10+-32], ymm3
+        vmovdqu	YMMWORD PTR [r10+64], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+32]
+        vpxor	ymm11, ymm9, [r9+128]
+        vpxor	ymm12, ymm5, [r10+128]
+        vpxor	ymm13, ymm6, [rcx+-64]
+        vpxor	ymm14, ymm7, [rcx+32]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+32], ymm0
+        vmovdqu	YMMWORD PTR [r9+128], ymm1
+        vmovdqu	YMMWORD PTR [r10+128], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+32], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10+32]
+        vpxor	ymm11, ymm7, [rcx]
+        vpxor	ymm12, ymm8, [rcx+96]
+        vpxor	ymm13, ymm9, [r9+-64]
+        vpxor	ymm14, ymm5, [r10+-64]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+32], ymm0
+        vmovdqu	YMMWORD PTR [rcx], ymm1
+        vmovdqu	YMMWORD PTR [rcx+96], ymm2
+        vmovdqu	YMMWORD PTR [r9+-64], ymm3
+        vmovdqu	YMMWORD PTR [r10+-64], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+-96]
+        vpxor	ymm11, ymm5, [r9]
+        vpxor	ymm12, ymm6, [r9+96]
+        vpxor	ymm13, ymm7, [r10+96]
+        vpxor	ymm14, ymm8, [rcx+-96]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-96], ymm0
+        vmovdqu	YMMWORD PTR [r9], ymm1
+        vmovdqu	YMMWORD PTR [r9+96], ymm2
+        vmovdqu	YMMWORD PTR [r10+96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10+-96]
+        vpxor	ymm11, ymm8, [r10]
+        vpxor	ymm12, ymm9, [rcx+-32]
+        vpxor	ymm13, ymm5, [rcx+64]
+        vpxor	ymm14, ymm6, [r9+64]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-96], ymm0
+        vmovdqu	YMMWORD PTR [r10], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+64], ymm3
+        vmovdqu	YMMWORD PTR [r9+64], ymm4
+        ; Round 15
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm14, ymm4, [rcx+-96]
+        vpxor	ymm13, ymm3, [rcx+-64]
+        vpxor	ymm11, ymm1, [rcx]
+        vpxor	ymm14, ymm14, [rcx+32]
+        vpxor	ymm12, ymm2, [rcx+96]
+        vpxor	ymm11, ymm11, [rcx+128]
+        vpxor	ymm10, ymm10, [r9+-96]
+        vpxor	ymm13, ymm13, [r9+-64]
+        vpxor	ymm12, ymm12, [r9+-32]
+        vpxor	ymm11, ymm11, [r9]
+        vpxor	ymm10, ymm10, [r9+32]
+        vpxor	ymm12, ymm12, [r9+96]
+        vpxor	ymm11, ymm11, [r9+128]
+        vpxor	ymm14, ymm14, [r10+-64]
+        vpxor	ymm13, ymm13, [r10+-32]
+        vpxor	ymm10, ymm10, [r10+32]
+        vpxor	ymm14, ymm14, [r10+64]
+        vpxor	ymm13, ymm13, [r10+96]
+        vpxor	ymm12, ymm12, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9+128]
+        vpxor	ymm12, ymm7, [rcx+96]
+        vpxor	ymm13, ymm8, [r10+96]
+        vpxor	ymm14, ymm9, [r9+64]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+480]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+128], ymm1
+        vmovdqu	YMMWORD PTR [rcx+96], ymm2
+        vmovdqu	YMMWORD PTR [r10+96], ymm3
+        vmovdqu	YMMWORD PTR [r9+64], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r10+-32]
+        vpxor	ymm11, ymm9, [rcx+32]
+        vpxor	ymm12, ymm5, [r10+32]
+        vpxor	ymm13, ymm6, [r9]
+        vpxor	ymm14, ymm7, [rcx+-32]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+32], ymm1
+        vmovdqu	YMMWORD PTR [r10+32], ymm2
+        vmovdqu	YMMWORD PTR [r9], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx+128]
+        vpxor	ymm11, ymm7, [r10+128]
+        vpxor	ymm12, ymm8, [r9+-64]
+        vpxor	ymm13, ymm9, [rcx+-96]
+        vpxor	ymm14, ymm5, [r10+-96]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+128], ymm0
+        vmovdqu	YMMWORD PTR [r10+128], ymm1
+        vmovdqu	YMMWORD PTR [r9+-64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10+-96], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r10+64]
+        vpxor	ymm11, ymm5, [r9+32]
+        vpxor	ymm12, ymm6, [rcx]
+        vpxor	ymm13, ymm7, [r9+96]
+        vpxor	ymm14, ymm8, [rcx+64]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+64], ymm0
+        vmovdqu	YMMWORD PTR [r9+32], ymm1
+        vmovdqu	YMMWORD PTR [rcx], ymm2
+        vmovdqu	YMMWORD PTR [r9+96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+64], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r9+-32]
+        vpxor	ymm11, ymm8, [rcx+-64]
+        vpxor	ymm12, ymm9, [r10+-64]
+        vpxor	ymm13, ymm5, [r9+-96]
+        vpxor	ymm14, ymm6, [r10]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10+-64], ymm2
+        vmovdqu	YMMWORD PTR [r9+-96], ymm3
+        vmovdqu	YMMWORD PTR [r10], ymm4
+        ; Round 16
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm13, ymm3, [rcx+-96]
+        vpxor	ymm14, ymm4, [rcx+-32]
+        vpxor	ymm12, ymm2, [rcx]
+        vpxor	ymm11, ymm1, [rcx+32]
+        vpxor	ymm14, ymm14, [rcx+64]
+        vpxor	ymm12, ymm12, [rcx+96]
+        vpxor	ymm10, ymm10, [rcx+128]
+        vpxor	ymm12, ymm12, [r9+-64]
+        vpxor	ymm13, ymm13, [r9]
+        vpxor	ymm11, ymm11, [r9+32]
+        vpxor	ymm14, ymm14, [r9+64]
+        vpxor	ymm13, ymm13, [r9+96]
+        vpxor	ymm11, ymm11, [r9+128]
+        vpxor	ymm14, ymm14, [r10+-96]
+        vpxor	ymm10, ymm10, [r10+-32]
+        vpxor	ymm12, ymm12, [r10+32]
+        vpxor	ymm10, ymm10, [r10+64]
+        vpxor	ymm13, ymm13, [r10+96]
+        vpxor	ymm11, ymm11, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx+32]
+        vpxor	ymm12, ymm7, [r9+-64]
+        vpxor	ymm13, ymm8, [r9+96]
+        vpxor	ymm14, ymm9, [r10]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+512]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+32], ymm1
+        vmovdqu	YMMWORD PTR [r9+-64], ymm2
+        vmovdqu	YMMWORD PTR [r9+96], ymm3
+        vmovdqu	YMMWORD PTR [r10], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r10+96]
+        vpxor	ymm11, ymm9, [rcx+-32]
+        vpxor	ymm12, ymm5, [rcx+128]
+        vpxor	ymm13, ymm6, [r9+32]
+        vpxor	ymm14, ymm7, [r10+-64]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+96], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+128], ymm2
+        vmovdqu	YMMWORD PTR [r9+32], ymm3
+        vmovdqu	YMMWORD PTR [r10+-64], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r9+128]
+        vpxor	ymm11, ymm7, [r10+32]
+        vpxor	ymm12, ymm8, [rcx+-96]
+        vpxor	ymm13, ymm9, [rcx+64]
+        vpxor	ymm14, ymm5, [r9+-32]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+128], ymm0
+        vmovdqu	YMMWORD PTR [r10+32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm2
+        vmovdqu	YMMWORD PTR [rcx+64], ymm3
+        vmovdqu	YMMWORD PTR [r9+-32], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+64]
+        vpxor	ymm11, ymm5, [r10+-32]
+        vpxor	ymm12, ymm6, [r10+128]
+        vpxor	ymm13, ymm7, [rcx]
+        vpxor	ymm14, ymm8, [r9+-96]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+64], ymm0
+        vmovdqu	YMMWORD PTR [r10+-32], ymm1
+        vmovdqu	YMMWORD PTR [r10+128], ymm2
+        vmovdqu	YMMWORD PTR [rcx], ymm3
+        vmovdqu	YMMWORD PTR [r9+-96], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx+96]
+        vpxor	ymm11, ymm8, [r9]
+        vpxor	ymm12, ymm9, [r10+-96]
+        vpxor	ymm13, ymm5, [r10+64]
+        vpxor	ymm14, ymm6, [rcx+-64]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+96], ymm0
+        vmovdqu	YMMWORD PTR [r9], ymm1
+        vmovdqu	YMMWORD PTR [r10+-96], ymm2
+        vmovdqu	YMMWORD PTR [r10+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm4
+        ; Round 17
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm12, ymm2, [rcx+-96]
+        vpxor	ymm11, ymm1, [rcx+-32]
+        vpxor	ymm13, ymm3, [rcx]
+        vpxor	ymm11, ymm11, [rcx+32]
+        vpxor	ymm13, ymm13, [rcx+64]
+        vpxor	ymm12, ymm12, [rcx+128]
+        vpxor	ymm14, ymm4, [r9+-96]
+        vpxor	ymm12, ymm12, [r9+-64]
+        vpxor	ymm14, ymm14, [r9+-32]
+        vpxor	ymm13, ymm13, [r9+32]
+        vpxor	ymm10, ymm10, [r9+64]
+        vpxor	ymm13, ymm13, [r9+96]
+        vpxor	ymm10, ymm10, [r9+128]
+        vpxor	ymm14, ymm14, [r10+-64]
+        vpxor	ymm11, ymm11, [r10+-32]
+        vpxor	ymm14, ymm14, [r10]
+        vpxor	ymm11, ymm11, [r10+32]
+        vpxor	ymm10, ymm10, [r10+96]
+        vpxor	ymm12, ymm12, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx+-32]
+        vpxor	ymm12, ymm7, [rcx+-96]
+        vpxor	ymm13, ymm8, [rcx]
+        vpxor	ymm14, ymm9, [rcx+-64]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+544]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm2
+        vmovdqu	YMMWORD PTR [rcx], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+96]
+        vpxor	ymm11, ymm9, [r10+-64]
+        vpxor	ymm12, ymm5, [r9+128]
+        vpxor	ymm13, ymm6, [r10+-32]
+        vpxor	ymm14, ymm7, [r10+-96]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+96], ymm0
+        vmovdqu	YMMWORD PTR [r10+-64], ymm1
+        vmovdqu	YMMWORD PTR [r9+128], ymm2
+        vmovdqu	YMMWORD PTR [r10+-32], ymm3
+        vmovdqu	YMMWORD PTR [r10+-96], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx+32]
+        vpxor	ymm11, ymm7, [rcx+128]
+        vpxor	ymm12, ymm8, [rcx+64]
+        vpxor	ymm13, ymm9, [r9+-96]
+        vpxor	ymm14, ymm5, [rcx+96]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+128], ymm1
+        vmovdqu	YMMWORD PTR [rcx+64], ymm2
+        vmovdqu	YMMWORD PTR [r9+-96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+96], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r10]
+        vpxor	ymm11, ymm5, [r10+96]
+        vpxor	ymm12, ymm6, [r10+32]
+        vpxor	ymm13, ymm7, [r10+128]
+        vpxor	ymm14, ymm8, [r10+64]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10], ymm0
+        vmovdqu	YMMWORD PTR [r10+96], ymm1
+        vmovdqu	YMMWORD PTR [r10+32], ymm2
+        vmovdqu	YMMWORD PTR [r10+128], ymm3
+        vmovdqu	YMMWORD PTR [r10+64], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r9+-64]
+        vpxor	ymm11, ymm8, [r9+32]
+        vpxor	ymm12, ymm9, [r9+-32]
+        vpxor	ymm13, ymm5, [r9+64]
+        vpxor	ymm14, ymm6, [r9]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9+32], ymm1
+        vmovdqu	YMMWORD PTR [r9+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+64], ymm3
+        vmovdqu	YMMWORD PTR [r9], ymm4
+        ; Round 18
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm12, ymm2, [rcx+-96]
+        vpxor	ymm14, ymm4, [rcx+-64]
+        vpxor	ymm11, ymm1, [rcx+-32]
+        vpxor	ymm13, ymm3, [rcx]
+        vpxor	ymm10, ymm10, [rcx+32]
+        vpxor	ymm12, ymm12, [rcx+64]
+        vpxor	ymm14, ymm14, [rcx+96]
+        vpxor	ymm11, ymm11, [rcx+128]
+        vpxor	ymm13, ymm13, [r9+-96]
+        vpxor	ymm10, ymm10, [r9+96]
+        vpxor	ymm12, ymm12, [r9+128]
+        vpxor	ymm14, ymm14, [r10+-96]
+        vpxor	ymm11, ymm11, [r10+-64]
+        vpxor	ymm13, ymm13, [r10+-32]
+        vpxor	ymm10, ymm10, [r10]
+        vpxor	ymm12, ymm12, [r10+32]
+        vpxor	ymm14, ymm14, [r10+64]
+        vpxor	ymm11, ymm11, [r10+96]
+        vpxor	ymm13, ymm13, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r10+-64]
+        vpxor	ymm12, ymm7, [rcx+64]
+        vpxor	ymm13, ymm8, [r10+128]
+        vpxor	ymm14, ymm9, [r9]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+576]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-64], ymm1
+        vmovdqu	YMMWORD PTR [rcx+64], ymm2
+        vmovdqu	YMMWORD PTR [r10+128], ymm3
+        vmovdqu	YMMWORD PTR [r9], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx]
+        vpxor	ymm11, ymm9, [r10+-96]
+        vpxor	ymm12, ymm5, [rcx+32]
+        vpxor	ymm13, ymm6, [r10+96]
+        vpxor	ymm14, ymm7, [r9+-32]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx], ymm0
+        vmovdqu	YMMWORD PTR [r10+-96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+32], ymm2
+        vmovdqu	YMMWORD PTR [r10+96], ymm3
+        vmovdqu	YMMWORD PTR [r9+-32], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx+-32]
+        vpxor	ymm11, ymm7, [r9+128]
+        vpxor	ymm12, ymm8, [r9+-96]
+        vpxor	ymm13, ymm9, [r10+64]
+        vpxor	ymm14, ymm5, [r9+-64]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm0
+        vmovdqu	YMMWORD PTR [r9+128], ymm1
+        vmovdqu	YMMWORD PTR [r9+-96], ymm2
+        vmovdqu	YMMWORD PTR [r10+64], ymm3
+        vmovdqu	YMMWORD PTR [r9+-64], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx+-64]
+        vpxor	ymm11, ymm5, [r9+96]
+        vpxor	ymm12, ymm6, [rcx+128]
+        vpxor	ymm13, ymm7, [r10+32]
+        vpxor	ymm14, ymm8, [r9+64]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9+96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+128], ymm2
+        vmovdqu	YMMWORD PTR [r10+32], ymm3
+        vmovdqu	YMMWORD PTR [r9+64], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx+-96]
+        vpxor	ymm11, ymm8, [r10+-32]
+        vpxor	ymm12, ymm9, [rcx+96]
+        vpxor	ymm13, ymm5, [r10]
+        vpxor	ymm14, ymm6, [r9+32]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm0
+        vmovdqu	YMMWORD PTR [r10+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+96], ymm2
+        vmovdqu	YMMWORD PTR [r10], ymm3
+        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        ; Round 19
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm10, ymm10, [rcx+-64]
+        vpxor	ymm10, ymm10, [rcx+-32]
+        vpxor	ymm10, ymm10, [rcx]
+        vpxor	ymm12, ymm2, [rcx+32]
+        vpxor	ymm12, ymm12, [rcx+64]
+        vpxor	ymm12, ymm12, [rcx+128]
+        vpxor	ymm12, ymm12, [r9+-96]
+        vpxor	ymm14, ymm4, [r9+-64]
+        vpxor	ymm14, ymm14, [r9+-32]
+        vpxor	ymm14, ymm14, [r9]
+        vpxor	ymm14, ymm14, [r9+64]
+        vpxor	ymm11, ymm1, [r9+96]
+        vpxor	ymm11, ymm11, [r9+128]
+        vpxor	ymm11, ymm11, [r10+-96]
+        vpxor	ymm11, ymm11, [r10+-64]
+        vpxor	ymm13, ymm3, [r10+32]
+        vpxor	ymm13, ymm13, [r10+64]
+        vpxor	ymm13, ymm13, [r10+96]
+        vpxor	ymm13, ymm13, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r10+-96]
+        vpxor	ymm12, ymm7, [r9+-96]
+        vpxor	ymm13, ymm8, [r10+32]
+        vpxor	ymm14, ymm9, [r9+32]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+608]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-96], ymm1
+        vmovdqu	YMMWORD PTR [r9+-96], ymm2
+        vmovdqu	YMMWORD PTR [r10+32], ymm3
+        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r10+128]
+        vpxor	ymm11, ymm9, [r9+-32]
+        vpxor	ymm12, ymm5, [rcx+-32]
+        vpxor	ymm13, ymm6, [r9+96]
+        vpxor	ymm14, ymm7, [rcx+96]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+128], ymm0
+        vmovdqu	YMMWORD PTR [r9+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+96], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10+-64]
+        vpxor	ymm11, ymm7, [rcx+32]
+        vpxor	ymm12, ymm8, [r10+64]
+        vpxor	ymm13, ymm9, [r9+64]
+        vpxor	ymm14, ymm5, [rcx+-96]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-64], ymm0
+        vmovdqu	YMMWORD PTR [rcx+32], ymm1
+        vmovdqu	YMMWORD PTR [r10+64], ymm2
+        vmovdqu	YMMWORD PTR [r9+64], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9]
+        vpxor	ymm11, ymm5, [rcx]
+        vpxor	ymm12, ymm6, [r9+128]
+        vpxor	ymm13, ymm7, [rcx+128]
+        vpxor	ymm14, ymm8, [r10]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9], ymm0
+        vmovdqu	YMMWORD PTR [rcx], ymm1
+        vmovdqu	YMMWORD PTR [r9+128], ymm2
+        vmovdqu	YMMWORD PTR [rcx+128], ymm3
+        vmovdqu	YMMWORD PTR [r10], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx+64]
+        vpxor	ymm11, ymm8, [r10+96]
+        vpxor	ymm12, ymm9, [r9+-64]
+        vpxor	ymm13, ymm5, [rcx+-64]
+        vpxor	ymm14, ymm6, [r10+-32]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+64], ymm0
+        vmovdqu	YMMWORD PTR [r10+96], ymm1
+        vmovdqu	YMMWORD PTR [r9+-64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm3
+        vmovdqu	YMMWORD PTR [r10+-32], ymm4
+        ; Round 20
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm14, ymm4, [rcx+-96]
+        vpxor	ymm12, ymm2, [rcx+-32]
+        vpxor	ymm11, ymm1, [rcx]
+        vpxor	ymm11, ymm11, [rcx+32]
+        vpxor	ymm14, ymm14, [rcx+96]
+        vpxor	ymm13, ymm3, [rcx+128]
+        vpxor	ymm12, ymm12, [r9+-96]
+        vpxor	ymm11, ymm11, [r9+-32]
+        vpxor	ymm10, ymm10, [r9]
+        vpxor	ymm14, ymm14, [r9+32]
+        vpxor	ymm13, ymm13, [r9+64]
+        vpxor	ymm13, ymm13, [r9+96]
+        vpxor	ymm12, ymm12, [r9+128]
+        vpxor	ymm11, ymm11, [r10+-96]
+        vpxor	ymm10, ymm10, [r10+-64]
+        vpxor	ymm14, ymm14, [r10]
+        vpxor	ymm13, ymm13, [r10+32]
+        vpxor	ymm12, ymm12, [r10+64]
+        vpxor	ymm10, ymm10, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9+-32]
+        vpxor	ymm12, ymm7, [r10+64]
+        vpxor	ymm13, ymm8, [rcx+128]
+        vpxor	ymm14, ymm9, [r10+-32]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+640]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-32], ymm1
+        vmovdqu	YMMWORD PTR [r10+64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+128], ymm3
+        vmovdqu	YMMWORD PTR [r10+-32], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r10+32]
+        vpxor	ymm11, ymm9, [rcx+96]
+        vpxor	ymm12, ymm5, [r10+-64]
+        vpxor	ymm13, ymm6, [rcx]
+        vpxor	ymm14, ymm7, [r9+-64]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+96], ymm1
+        vmovdqu	YMMWORD PTR [r10+-64], ymm2
+        vmovdqu	YMMWORD PTR [rcx], ymm3
+        vmovdqu	YMMWORD PTR [r9+-64], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r10+-96]
+        vpxor	ymm11, ymm7, [rcx+-32]
+        vpxor	ymm12, ymm8, [r9+64]
+        vpxor	ymm13, ymm9, [r10]
+        vpxor	ymm14, ymm5, [rcx+64]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-96], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm1
+        vmovdqu	YMMWORD PTR [r9+64], ymm2
+        vmovdqu	YMMWORD PTR [r10], ymm3
+        vmovdqu	YMMWORD PTR [rcx+64], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+32]
+        vpxor	ymm11, ymm5, [r10+128]
+        vpxor	ymm12, ymm6, [rcx+32]
+        vpxor	ymm13, ymm7, [r9+128]
+        vpxor	ymm14, ymm8, [rcx+-64]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+32], ymm0
+        vmovdqu	YMMWORD PTR [r10+128], ymm1
+        vmovdqu	YMMWORD PTR [rcx+32], ymm2
+        vmovdqu	YMMWORD PTR [r9+128], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r9+-96]
+        vpxor	ymm11, ymm8, [r9+96]
+        vpxor	ymm12, ymm9, [rcx+-96]
+        vpxor	ymm13, ymm5, [r9]
+        vpxor	ymm14, ymm6, [r10+96]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-96], ymm0
+        vmovdqu	YMMWORD PTR [r9+96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm2
+        vmovdqu	YMMWORD PTR [r9], ymm3
+        vmovdqu	YMMWORD PTR [r10+96], ymm4
+        ; Round 21
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm14, ymm4, [rcx+-64]
+        vpxor	ymm11, ymm1, [rcx+-32]
+        vpxor	ymm13, ymm3, [rcx]
+        vpxor	ymm12, ymm2, [rcx+32]
+        vpxor	ymm14, ymm14, [rcx+64]
+        vpxor	ymm11, ymm11, [rcx+96]
+        vpxor	ymm13, ymm13, [rcx+128]
+        vpxor	ymm14, ymm14, [r9+-64]
+        vpxor	ymm11, ymm11, [r9+-32]
+        vpxor	ymm10, ymm10, [r9+32]
+        vpxor	ymm12, ymm12, [r9+64]
+        vpxor	ymm13, ymm13, [r9+128]
+        vpxor	ymm10, ymm10, [r10+-96]
+        vpxor	ymm12, ymm12, [r10+-64]
+        vpxor	ymm14, ymm14, [r10+-32]
+        vpxor	ymm13, ymm13, [r10]
+        vpxor	ymm10, ymm10, [r10+32]
+        vpxor	ymm12, ymm12, [r10+64]
+        vpxor	ymm11, ymm11, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx+96]
+        vpxor	ymm12, ymm7, [r9+64]
+        vpxor	ymm13, ymm8, [r9+128]
+        vpxor	ymm14, ymm9, [r10+96]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+672]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+96], ymm1
+        vmovdqu	YMMWORD PTR [r9+64], ymm2
+        vmovdqu	YMMWORD PTR [r9+128], ymm3
+        vmovdqu	YMMWORD PTR [r10+96], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx+128]
+        vpxor	ymm11, ymm9, [r9+-64]
+        vpxor	ymm12, ymm5, [r10+-96]
+        vpxor	ymm13, ymm6, [r10+128]
+        vpxor	ymm14, ymm7, [rcx+-96]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+128], ymm0
+        vmovdqu	YMMWORD PTR [r9+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10+-96], ymm2
+        vmovdqu	YMMWORD PTR [r10+128], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r9+-32]
+        vpxor	ymm11, ymm7, [r10+-64]
+        vpxor	ymm12, ymm8, [r10]
+        vpxor	ymm13, ymm9, [rcx+-64]
+        vpxor	ymm14, ymm5, [r9+-96]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-32], ymm0
+        vmovdqu	YMMWORD PTR [r10+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm3
+        vmovdqu	YMMWORD PTR [r9+-96], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r10+-32]
+        vpxor	ymm11, ymm5, [r10+32]
+        vpxor	ymm12, ymm6, [rcx+-32]
+        vpxor	ymm13, ymm7, [rcx+32]
+        vpxor	ymm14, ymm8, [r9]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+-32], ymm0
+        vmovdqu	YMMWORD PTR [r10+32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm2
+        vmovdqu	YMMWORD PTR [rcx+32], ymm3
+        vmovdqu	YMMWORD PTR [r9], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10+64]
+        vpxor	ymm11, ymm8, [rcx]
+        vpxor	ymm12, ymm9, [rcx+64]
+        vpxor	ymm13, ymm5, [r9+32]
+        vpxor	ymm14, ymm6, [r9+96]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+64], ymm0
+        vmovdqu	YMMWORD PTR [rcx], ymm1
+        vmovdqu	YMMWORD PTR [rcx+64], ymm2
+        vmovdqu	YMMWORD PTR [r9+32], ymm3
+        vmovdqu	YMMWORD PTR [r9+96], ymm4
+        ; Round 22
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm14, ymm4, [rcx+-96]
+        vpxor	ymm13, ymm3, [rcx+-64]
+        vpxor	ymm12, ymm2, [rcx+-32]
+        vpxor	ymm13, ymm13, [rcx+32]
+        vpxor	ymm11, ymm1, [rcx+96]
+        vpxor	ymm10, ymm10, [rcx+128]
+        vpxor	ymm14, ymm14, [r9+-96]
+        vpxor	ymm11, ymm11, [r9+-64]
+        vpxor	ymm10, ymm10, [r9+-32]
+        vpxor	ymm14, ymm14, [r9]
+        vpxor	ymm12, ymm12, [r9+64]
+        vpxor	ymm13, ymm13, [r9+128]
+        vpxor	ymm12, ymm12, [r10+-96]
+        vpxor	ymm11, ymm11, [r10+-64]
+        vpxor	ymm10, ymm10, [r10+-32]
+        vpxor	ymm12, ymm12, [r10]
+        vpxor	ymm11, ymm11, [r10+32]
+        vpxor	ymm14, ymm14, [r10+96]
+        vpxor	ymm13, ymm13, [r10+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9+-64]
+        vpxor	ymm12, ymm7, [r10]
+        vpxor	ymm13, ymm8, [rcx+32]
+        vpxor	ymm14, ymm9, [r9+96]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+704]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-64], ymm1
+        vmovdqu	YMMWORD PTR [r10], ymm2
+        vmovdqu	YMMWORD PTR [rcx+32], ymm3
+        vmovdqu	YMMWORD PTR [r9+96], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+128]
+        vpxor	ymm11, ymm9, [rcx+-96]
+        vpxor	ymm12, ymm5, [r9+-32]
+        vpxor	ymm13, ymm6, [r10+32]
+        vpxor	ymm14, ymm7, [rcx+64]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+128], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm1
+        vmovdqu	YMMWORD PTR [r9+-32], ymm2
+        vmovdqu	YMMWORD PTR [r10+32], ymm3
+        vmovdqu	YMMWORD PTR [rcx+64], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx+96]
+        vpxor	ymm11, ymm7, [r10+-96]
+        vpxor	ymm12, ymm8, [rcx+-64]
+        vpxor	ymm13, ymm9, [r9]
+        vpxor	ymm14, ymm5, [r10+64]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+96], ymm0
+        vmovdqu	YMMWORD PTR [r10+-96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm2
+        vmovdqu	YMMWORD PTR [r9], ymm3
+        vmovdqu	YMMWORD PTR [r10+64], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r10+96]
+        vpxor	ymm11, ymm5, [rcx+128]
+        vpxor	ymm12, ymm6, [r10+-64]
+        vpxor	ymm13, ymm7, [rcx+-32]
+        vpxor	ymm14, ymm8, [r9+32]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10+96], ymm0
+        vmovdqu	YMMWORD PTR [rcx+128], ymm1
+        vmovdqu	YMMWORD PTR [r10+-64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm3
+        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r9+64]
+        vpxor	ymm11, ymm8, [r10+128]
+        vpxor	ymm12, ymm9, [r9+-96]
+        vpxor	ymm13, ymm5, [r10+-32]
+        vpxor	ymm14, ymm6, [rcx]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+64], ymm0
+        vmovdqu	YMMWORD PTR [r10+128], ymm1
+        vmovdqu	YMMWORD PTR [r9+-96], ymm2
+        vmovdqu	YMMWORD PTR [r10+-32], ymm3
+        vmovdqu	YMMWORD PTR [rcx], ymm4
+        ; Round 23
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm11, ymm1, [rcx+-96]
+        vpxor	ymm12, ymm2, [rcx+-64]
+        vpxor	ymm13, ymm3, [rcx+-32]
+        vpxor	ymm13, ymm13, [rcx+32]
+        vpxor	ymm14, ymm4, [rcx+64]
+        vpxor	ymm10, ymm10, [rcx+96]
+        vpxor	ymm11, ymm11, [rcx+128]
+        vpxor	ymm11, ymm11, [r9+-64]
+        vpxor	ymm12, ymm12, [r9+-32]
+        vpxor	ymm13, ymm13, [r9]
+        vpxor	ymm14, ymm14, [r9+32]
+        vpxor	ymm14, ymm14, [r9+96]
+        vpxor	ymm10, ymm10, [r9+128]
+        vpxor	ymm11, ymm11, [r10+-96]
+        vpxor	ymm12, ymm12, [r10+-64]
+        vpxor	ymm12, ymm12, [r10]
+        vpxor	ymm13, ymm13, [r10+32]
+        vpxor	ymm14, ymm14, [r10+64]
+        vpxor	ymm10, ymm10, [r10+96]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx+-96]
+        vpxor	ymm12, ymm7, [rcx+-64]
+        vpxor	ymm13, ymm8, [rcx+-32]
+        vpxor	ymm14, ymm9, [rcx]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+736]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm3
+        vmovdqu	YMMWORD PTR [rcx], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx+32]
+        vpxor	ymm11, ymm9, [rcx+64]
+        vpxor	ymm12, ymm5, [rcx+96]
+        vpxor	ymm13, ymm6, [rcx+128]
+        vpxor	ymm14, ymm7, [r9+-96]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+64], ymm1
+        vmovdqu	YMMWORD PTR [rcx+96], ymm2
+        vmovdqu	YMMWORD PTR [rcx+128], ymm3
+        vmovdqu	YMMWORD PTR [r9+-96], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r9+-64]
+        vpxor	ymm11, ymm7, [r9+-32]
+        vpxor	ymm12, ymm8, [r9]
+        vpxor	ymm13, ymm9, [r9+32]
+        vpxor	ymm14, ymm5, [r9+64]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9+-32], ymm1
+        vmovdqu	YMMWORD PTR [r9], ymm2
+        vmovdqu	YMMWORD PTR [r9+32], ymm3
+        vmovdqu	YMMWORD PTR [r9+64], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+96]
+        vpxor	ymm11, ymm5, [r9+128]
+        vpxor	ymm12, ymm6, [r10+-96]
+        vpxor	ymm13, ymm7, [r10+-64]
+        vpxor	ymm14, ymm8, [r10+-32]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+96], ymm0
+        vmovdqu	YMMWORD PTR [r9+128], ymm1
+        vmovdqu	YMMWORD PTR [r10+-96], ymm2
+        vmovdqu	YMMWORD PTR [r10+-64], ymm3
+        vmovdqu	YMMWORD PTR [r10+-32], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r10]
+        vpxor	ymm11, ymm8, [r10+32]
+        vpxor	ymm12, ymm9, [r10+64]
+        vpxor	ymm13, ymm5, [r10+96]
+        vpxor	ymm14, ymm6, [r10+128]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r10], ymm0
+        vmovdqu	YMMWORD PTR [r10+32], ymm1
+        vmovdqu	YMMWORD PTR [r10+64], ymm2
+        vmovdqu	YMMWORD PTR [r10+96], ymm3
+        vmovdqu	YMMWORD PTR [r10+128], ymm4
+        sub	rcx, 128
+        vmovdqu	YMMWORD PTR [rcx], ymm15
+        lea	rdi, QWORD PTR [rcx]
+        mov	r15, 21
+L_sha3_blocksx4_out_avx2_word:
+        mov	rsi, QWORD PTR [rdi]
+        mov	QWORD PTR [rdx], rsi
+        mov	rsi, QWORD PTR [rdi+8]
+        mov	QWORD PTR [r11], rsi
+        mov	rsi, QWORD PTR [rdi+16]
+        mov	QWORD PTR [r12], rsi
+        mov	rsi, QWORD PTR [rdi+24]
+        mov	QWORD PTR [r13], rsi
+        add	rdi, 32
+        add	rdx, 8
+        add	r11, 8
+        add	r12, 8
+        add	r13, 8
+        sub	r14, 1
+        jz	L_sha3_blocksx4_out_avx2_done
+        sub	r15, 1
+        jnz	L_sha3_blocksx4_out_avx2_word
+        jmp	L_sha3_blocksx4_out_avx2_block
+L_sha3_blocksx4_out_avx2_done:
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        vmovdqu	xmm13, OWORD PTR [rsp+112]
+        vmovdqu	xmm14, OWORD PTR [rsp+128]
+        vmovdqu	xmm15, OWORD PTR [rsp+144]
+        add	rsp, 160
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+sha3_blocksx4_out_avx2 ENDP
+_TEXT ENDS
+ENDIF
+IFDEF WOLFSSL_HAVE_MLKEM
+_DATA SEGMENT
+ALIGN 16
+L_sha3_256_blockx4_seed_avx2_end_mark QWORD 8000000000000000h, 8000000000000000h
+        QWORD 8000000000000000h, 8000000000000000h
+ptr_L_sha3_256_blockx4_seed_avx2_end_mark QWORD L_sha3_256_blockx4_seed_avx2_end_mark
+_DATA ENDS
+_TEXT SEGMENT READONLY PARA
+sha3_256_blocksx4_seed_avx2 PROC
+        sub	rsp, 160
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        vmovdqu	OWORD PTR [rsp+112], xmm13
+        vmovdqu	OWORD PTR [rsp+128], xmm14
+        vmovdqu	OWORD PTR [rsp+144], xmm15
+        mov	rax, QWORD PTR [ptr_L_sha3_x4_avx2_r]
+        mov	r8, rcx
+        mov	r9, rcx
+        vpbroadcastq	ymm15, QWORD PTR [rdx]
+        add	rcx, 128
+        vpbroadcastq	ymm11, QWORD PTR [rdx+8]
+        add	r8, 384
+        vpbroadcastq	ymm12, QWORD PTR [rdx+16]
+        add	r9, 640
+        vpbroadcastq	ymm13, QWORD PTR [rdx+24]
+        vmovdqu	ymm5, YMMWORD PTR L_sha3_256_blockx4_seed_avx2_end_mark
+        vpxor	ymm6, ymm6, ymm6
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm11
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm12
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm13
+        vmovdqu	ymm14, YMMWORD PTR [rcx]
+        vmovdqu	YMMWORD PTR [rcx+32], ymm6
+        vmovdqu	YMMWORD PTR [rcx+64], ymm6
+        vmovdqu	YMMWORD PTR [rcx+96], ymm6
+        vmovdqu	YMMWORD PTR [rcx+128], ymm6
+        vmovdqu	YMMWORD PTR [r8+-96], ymm6
+        vmovdqu	YMMWORD PTR [r8+-64], ymm6
+        vmovdqu	YMMWORD PTR [r8+-32], ymm6
+        vmovdqu	YMMWORD PTR [r8], ymm6
+        vmovdqu	YMMWORD PTR [r8+32], ymm6
+        vmovdqu	YMMWORD PTR [r8+64], ymm6
+        vmovdqu	YMMWORD PTR [r8+96], ymm6
+        vmovdqu	YMMWORD PTR [r8+128], ymm5
+        vmovdqu	YMMWORD PTR [r9+-96], ymm6
+        vmovdqu	YMMWORD PTR [r9+-64], ymm6
+        vmovdqu	YMMWORD PTR [r9+-32], ymm6
+        vmovdqu	YMMWORD PTR [r9], ymm6
+        vmovdqu	YMMWORD PTR [r9+32], ymm6
+        vmovdqu	YMMWORD PTR [r9+64], ymm6
+        vmovdqu	YMMWORD PTR [r9+96], ymm6
+        vmovdqu	YMMWORD PTR [r9+128], ymm6
+        vmovdqu	ymm10, ymm15
+        vpxor	ymm11, ymm11, ymm5
+        ; Round 0
+        ; Calc b[0..4]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [rcx+64]
+        vpxor	ymm12, ymm7, [r8]
+        vpxor	ymm13, ymm8, [r9+-64]
+        vpxor	ymm14, ymm9, [r9+128]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+64], ymm1
+        vmovdqu	YMMWORD PTR [r8], ymm2
+        vmovdqu	YMMWORD PTR [r9+-64], ymm3
+        vmovdqu	YMMWORD PTR [r9+128], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [rcx+-32]
+        vpxor	ymm11, ymm9, [r8+-96]
+        vpxor	ymm12, ymm5, [r8+-64]
+        vpxor	ymm13, ymm6, [r8+128]
+        vpxor	ymm14, ymm7, [r9+64]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm0
+        vmovdqu	YMMWORD PTR [r8+-96], ymm1
+        vmovdqu	YMMWORD PTR [r8+-64], ymm2
+        vmovdqu	YMMWORD PTR [r8+128], ymm3
+        vmovdqu	YMMWORD PTR [r9+64], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx+-96]
+        vpxor	ymm11, ymm7, [rcx+96]
+        vpxor	ymm12, ymm8, [r8+32]
+        vpxor	ymm13, ymm9, [r9+-32]
+        vpxor	ymm14, ymm5, [r9]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm0
+        vmovdqu	YMMWORD PTR [rcx+96], ymm1
+        vmovdqu	YMMWORD PTR [r8+32], ymm2
+        vmovdqu	YMMWORD PTR [r9+-32], ymm3
+        vmovdqu	YMMWORD PTR [r9], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [rcx]
+        vpxor	ymm11, ymm5, [rcx+32]
+        vpxor	ymm12, ymm6, [r8+-32]
+        vpxor	ymm13, ymm7, [r9+-96]
+        vpxor	ymm14, ymm8, [r9+96]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx], ymm0
+        vmovdqu	YMMWORD PTR [rcx+32], ymm1
+        vmovdqu	YMMWORD PTR [r8+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+-96], ymm3
+        vmovdqu	YMMWORD PTR [r9+96], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [rcx+-64]
+        vpxor	ymm11, ymm8, [rcx+128]
+        vpxor	ymm12, ymm9, [r8+64]
+        vpxor	ymm13, ymm5, [r8+96]
+        vpxor	ymm14, ymm6, [r9+32]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm0
+        vmovdqu	YMMWORD PTR [rcx+128], ymm1
+        vmovdqu	YMMWORD PTR [r8+64], ymm2
+        vmovdqu	YMMWORD PTR [r8+96], ymm3
+        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        ; Round 1
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm10, ymm10, [rcx+-96]
+        vpxor	ymm10, ymm10, [rcx+-32]
+        vpxor	ymm10, ymm10, [rcx]
+        vpxor	ymm11, ymm1, [rcx+32]
+        vpxor	ymm11, ymm11, [rcx+64]
+        vpxor	ymm11, ymm11, [rcx+96]
+        vpxor	ymm11, ymm11, [r8+-96]
+        vpxor	ymm12, ymm2, [r8+-64]
+        vpxor	ymm12, ymm12, [r8+-32]
+        vpxor	ymm12, ymm12, [r8]
+        vpxor	ymm12, ymm12, [r8+32]
+        vpxor	ymm13, ymm3, [r8+128]
+        vpxor	ymm13, ymm13, [r9+-96]
+        vpxor	ymm13, ymm13, [r9+-64]
+        vpxor	ymm13, ymm13, [r9+-32]
+        vpxor	ymm14, ymm4, [r9]
+        vpxor	ymm14, ymm14, [r9+64]
+        vpxor	ymm14, ymm14, [r9+96]
+        vpxor	ymm14, ymm14, [r9+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r8+-96]
+        vpxor	ymm12, ymm7, [r8+32]
+        vpxor	ymm13, ymm8, [r9+-96]
+        vpxor	ymm14, ymm9, [r9+32]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+32]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r8+-96], ymm1
+        vmovdqu	YMMWORD PTR [r8+32], ymm2
+        vmovdqu	YMMWORD PTR [r9+-96], ymm3
+        vmovdqu	YMMWORD PTR [r9+32], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+-64]
+        vpxor	ymm11, ymm9, [r9+64]
+        vpxor	ymm12, ymm5, [rcx+-96]
+        vpxor	ymm13, ymm6, [rcx+32]
+        vpxor	ymm14, ymm7, [r8+64]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-64], ymm0
+        vmovdqu	YMMWORD PTR [r9+64], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm2
+        vmovdqu	YMMWORD PTR [rcx+32], ymm3
+        vmovdqu	YMMWORD PTR [r8+64], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [rcx+64]
+        vpxor	ymm11, ymm7, [r8+-64]
+        vpxor	ymm12, ymm8, [r9+-32]
+        vpxor	ymm13, ymm9, [r9+96]
+        vpxor	ymm14, ymm5, [rcx+-64]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [rcx+64], ymm0
+        vmovdqu	YMMWORD PTR [r8+-64], ymm1
+        vmovdqu	YMMWORD PTR [r9+-32], ymm2
+        vmovdqu	YMMWORD PTR [r9+96], ymm3
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+128]
+        vpxor	ymm11, ymm5, [rcx+-32]
+        vpxor	ymm12, ymm6, [rcx+96]
+        vpxor	ymm13, ymm7, [r8+-32]
+        vpxor	ymm14, ymm8, [r8+96]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+128], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+96], ymm2
+        vmovdqu	YMMWORD PTR [r8+-32], ymm3
+        vmovdqu	YMMWORD PTR [r8+96], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r8]
+        vpxor	ymm11, ymm8, [r8+128]
+        vpxor	ymm12, ymm9, [r9]
+        vpxor	ymm13, ymm5, [rcx]
+        vpxor	ymm14, ymm6, [rcx+128]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r8], ymm0
+        vmovdqu	YMMWORD PTR [r8+128], ymm1
+        vmovdqu	YMMWORD PTR [r9], ymm2
+        vmovdqu	YMMWORD PTR [rcx], ymm3
+        vmovdqu	YMMWORD PTR [rcx+128], ymm4
+        ; Round 2
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm12, ymm2, [rcx+-96]
+        vpxor	ymm14, ymm4, [rcx+-64]
+        vpxor	ymm11, ymm1, [rcx+-32]
+        vpxor	ymm13, ymm3, [rcx+32]
+        vpxor	ymm10, ymm10, [rcx+64]
+        vpxor	ymm12, ymm12, [rcx+96]
+        vpxor	ymm11, ymm11, [r8+-96]
+        vpxor	ymm11, ymm11, [r8+-64]
+        vpxor	ymm13, ymm13, [r8+-32]
+        vpxor	ymm12, ymm12, [r8+32]
+        vpxor	ymm14, ymm14, [r8+64]
+        vpxor	ymm14, ymm14, [r8+96]
+        vpxor	ymm13, ymm13, [r9+-96]
+        vpxor	ymm10, ymm10, [r9+-64]
+        vpxor	ymm12, ymm12, [r9+-32]
+        vpxor	ymm14, ymm14, [r9+32]
+        vpxor	ymm11, ymm11, [r9+64]
+        vpxor	ymm13, ymm13, [r9+96]
+        vpxor	ymm10, ymm10, [r9+128]
+        ; Calc t[0..4]
+        vpsrlq	ymm0, ymm11, 63
+        vpsrlq	ymm1, ymm12, 63
+        vpsrlq	ymm2, ymm13, 63
+        vpsrlq	ymm3, ymm14, 63
+        vpsrlq	ymm4, ymm10, 63
+        vpaddq	ymm5, ymm11, ymm11
+        vpaddq	ymm6, ymm12, ymm12
+        vpaddq	ymm7, ymm13, ymm13
+        vpaddq	ymm8, ymm14, ymm14
+        vpaddq	ymm9, ymm10, ymm10
+        vpor	ymm5, ymm5, ymm0
+        vpor	ymm6, ymm6, ymm1
+        vpor	ymm7, ymm7, ymm2
+        vpor	ymm8, ymm8, ymm3
+        vpor	ymm9, ymm9, ymm4
+        vpxor	ymm5, ymm5, ymm14
+        vpxor	ymm6, ymm6, ymm10
+        vpxor	ymm7, ymm7, ymm11
+        vpxor	ymm8, ymm8, ymm12
+        vpxor	ymm9, ymm9, ymm13
+        ; Row Mix
+        ; Row 0
+        vpxor	ymm10, ymm5, ymm15
+        vpxor	ymm11, ymm6, [r9+64]
+        vpxor	ymm12, ymm7, [r9+-32]
+        vpxor	ymm13, ymm8, [r8+-32]
+        vpxor	ymm14, ymm9, [rcx+128]
+        vpsrlq	ymm0, ymm11, 20
+        vpsrlq	ymm1, ymm12, 21
+        vpsrlq	ymm2, ymm13, 43
+        vpsrlq	ymm3, ymm14, 50
+        vpsllq	ymm11, ymm11, 44
+        vpsllq	ymm12, ymm12, 43
+        vpsllq	ymm13, ymm13, 21
+        vpsllq	ymm14, ymm14, 14
+        vpor	ymm11, ymm11, ymm0
+        vpor	ymm12, ymm12, ymm1
+        vpor	ymm13, ymm13, ymm2
+        vpor	ymm14, ymm14, ymm3
+        vpandn	ymm15, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm15, ymm15, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        ; XOR in constant
+        vpxor	ymm15, ymm15, [rax+64]
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+64], ymm1
+        vmovdqu	YMMWORD PTR [r9+-32], ymm2
+        vmovdqu	YMMWORD PTR [r8+-32], ymm3
+        vmovdqu	YMMWORD PTR [rcx+128], ymm4
+        ; Row 1
+        vpxor	ymm10, ymm8, [r9+-96]
+        vpxor	ymm11, ymm9, [r8+64]
+        vpxor	ymm12, ymm5, [rcx+64]
+        vpxor	ymm13, ymm6, [rcx+-32]
+        vpxor	ymm14, ymm7, [r9]
+        vpsrlq	ymm0, ymm10, 36
+        vpsrlq	ymm1, ymm11, 44
+        vpsrlq	ymm2, ymm12, 61
+        vpsrlq	ymm3, ymm13, 19
+        vpsrlq	ymm4, ymm14, 3
+        vpsllq	ymm10, ymm10, 28
+        vpsllq	ymm11, ymm11, 20
+        vpsllq	ymm12, ymm12, 3
+        vpsllq	ymm13, ymm13, 45
+        vpsllq	ymm14, ymm14, 61
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+-96], ymm0
+        vmovdqu	YMMWORD PTR [r8+64], ymm1
+        vmovdqu	YMMWORD PTR [rcx+64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+-32], ymm3
+        vmovdqu	YMMWORD PTR [r9], ymm4
+        ; Row 2
+        vpxor	ymm10, ymm6, [r8+-96]
+        vpxor	ymm11, ymm7, [rcx+-96]
+        vpxor	ymm12, ymm8, [r9+96]
+        vpxor	ymm13, ymm9, [r8+96]
+        vpxor	ymm14, ymm5, [r8]
+        vpsrlq	ymm0, ymm10, 63
+        vpsrlq	ymm1, ymm11, 58
+        vpsrlq	ymm2, ymm12, 39
+        vpsrlq	ymm3, ymm13, 56
+        vpsrlq	ymm4, ymm14, 46
+        vpaddq	ymm10, ymm10, ymm10
+        vpsllq	ymm11, ymm11, 6
+        vpsllq	ymm12, ymm12, 25
+        vpsllq	ymm13, ymm13, 8
+        vpsllq	ymm14, ymm14, 18
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r8+-96], ymm0
+        vmovdqu	YMMWORD PTR [rcx+-96], ymm1
+        vmovdqu	YMMWORD PTR [r9+96], ymm2
+        vmovdqu	YMMWORD PTR [r8+96], ymm3
+        vmovdqu	YMMWORD PTR [r8], ymm4
+        ; Row 3
+        vpxor	ymm10, ymm9, [r9+32]
+        vpxor	ymm11, ymm5, [r9+-64]
+        vpxor	ymm12, ymm6, [r8+-64]
+        vpxor	ymm13, ymm7, [rcx+96]
+        vpxor	ymm14, ymm8, [rcx]
+        vpsrlq	ymm0, ymm10, 37
+        vpsrlq	ymm1, ymm11, 28
+        vpsrlq	ymm2, ymm12, 54
+        vpsrlq	ymm3, ymm13, 49
+        vpsrlq	ymm4, ymm14, 8
+        vpsllq	ymm10, ymm10, 27
+        vpsllq	ymm11, ymm11, 36
+        vpsllq	ymm12, ymm12, 10
+        vpsllq	ymm13, ymm13, 15
+        vpsllq	ymm14, ymm14, 56
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r9+32], ymm0
+        vmovdqu	YMMWORD PTR [r9+-64], ymm1
+        vmovdqu	YMMWORD PTR [r8+-64], ymm2
+        vmovdqu	YMMWORD PTR [rcx+96], ymm3
+        vmovdqu	YMMWORD PTR [rcx], ymm4
+        ; Row 4
+        vpxor	ymm10, ymm7, [r8+32]
+        vpxor	ymm11, ymm8, [rcx+32]
+        vpxor	ymm12, ymm9, [rcx+-64]
+        vpxor	ymm13, ymm5, [r9+128]
+        vpxor	ymm14, ymm6, [r8+128]
+        vpsrlq	ymm0, ymm10, 2
+        vpsrlq	ymm1, ymm11, 9
+        vpsrlq	ymm2, ymm12, 25
+        vpsrlq	ymm3, ymm13, 23
+        vpsrlq	ymm4, ymm14, 62
+        vpsllq	ymm10, ymm10, 62
+        vpsllq	ymm11, ymm11, 55
+        vpsllq	ymm12, ymm12, 39
+        vpsllq	ymm13, ymm13, 41
+        vpsllq	ymm14, ymm14, 2
+        vpor	ymm10, ymm10, ymm0
+        vpor	ymm11, ymm11, ymm1
+        vpor	ymm12, ymm12, ymm2
+        vpor	ymm13, ymm13, ymm3
+        vpor	ymm14, ymm14, ymm4
+        vpandn	ymm0, ymm11, ymm12
+        vpandn	ymm1, ymm12, ymm13
+        vpandn	ymm2, ymm13, ymm14
+        vpandn	ymm3, ymm14, ymm10
+        vpandn	ymm4, ymm10, ymm11
+        vpxor	ymm0, ymm0, ymm10
+        vpxor	ymm1, ymm1, ymm11
+        vpxor	ymm2, ymm2, ymm12
+        vpxor	ymm3, ymm3, ymm13
+        vpxor	ymm4, ymm4, ymm14
+        vmovdqu	YMMWORD PTR [r8+32], ymm0
+        vmovdqu	YMMWORD PTR [rcx+32], ymm1
+        vmovdqu	YMMWORD PTR [rcx+-64], ymm2
+        vmovdqu	YMMWORD PTR [r9+128], ymm3
+        vmovdqu	YMMWORD PTR [r8+128], ymm4
+        ; Round 3
+        ; Calc b[0..4]
+        vpxor	ymm10, ymm0, ymm15
+        vpxor	ymm11, ymm1, [rcx+-96]
+        vpxor	ymm13, ymm3, [rcx+-32]
+        vpxor	ymm14, ymm4, [rcx]
+        vpxor	ymm12, ymm2, [rcx+64]
+        vpxor	ymm13, ymm13, [rcx+96]
+        vpxor	ymm14, ymm14, [rcx+128]
+        vpxor	ymm10, ymm10, [r8+-96]
         vpxor	ymm12, ymm12, [r8+-64]
         vpxor	ymm13, ymm13, [r8+-32]
         vpxor	ymm14, ymm14, [r8]
@@ -31444,5 +36873,3063 @@ sha3_256_blocksx4_seed_64_avx2 PROC
 sha3_256_blocksx4_seed_64_avx2 ENDP
 _TEXT ENDS
 ENDIF
+IFDEF HAVE_INTEL_AVX512
+IFDEF WOLFSSL_HAVE_FRODOKEM
+_DATA SEGMENT
+ALIGN 16
+L_sha3_x8_avx512_r QWORD 0000000000000001h, 0000000000000001h
+        QWORD 0000000000000001h, 0000000000000001h
+        QWORD 0000000000000001h, 0000000000000001h
+        QWORD 0000000000000001h, 0000000000000001h
+        QWORD 0000000000008082h, 0000000000008082h
+        QWORD 0000000000008082h, 0000000000008082h
+        QWORD 0000000000008082h, 0000000000008082h
+        QWORD 0000000000008082h, 0000000000008082h
+        QWORD 800000000000808ah, 800000000000808ah
+        QWORD 800000000000808ah, 800000000000808ah
+        QWORD 800000000000808ah, 800000000000808ah
+        QWORD 800000000000808ah, 800000000000808ah
+        QWORD 8000000080008000h, 8000000080008000h
+        QWORD 8000000080008000h, 8000000080008000h
+        QWORD 8000000080008000h, 8000000080008000h
+        QWORD 8000000080008000h, 8000000080008000h
+        QWORD 000000000000808bh, 000000000000808bh
+        QWORD 000000000000808bh, 000000000000808bh
+        QWORD 000000000000808bh, 000000000000808bh
+        QWORD 000000000000808bh, 000000000000808bh
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000000008009h, 8000000000008009h
+        QWORD 8000000000008009h, 8000000000008009h
+        QWORD 8000000000008009h, 8000000000008009h
+        QWORD 8000000000008009h, 8000000000008009h
+        QWORD 000000000000008ah, 000000000000008ah
+        QWORD 000000000000008ah, 000000000000008ah
+        QWORD 000000000000008ah, 000000000000008ah
+        QWORD 000000000000008ah, 000000000000008ah
+        QWORD 0000000000000088h, 0000000000000088h
+        QWORD 0000000000000088h, 0000000000000088h
+        QWORD 0000000000000088h, 0000000000000088h
+        QWORD 0000000000000088h, 0000000000000088h
+        QWORD 0000000080008009h, 0000000080008009h
+        QWORD 0000000080008009h, 0000000080008009h
+        QWORD 0000000080008009h, 0000000080008009h
+        QWORD 0000000080008009h, 0000000080008009h
+        QWORD 000000008000000ah, 000000008000000ah
+        QWORD 000000008000000ah, 000000008000000ah
+        QWORD 000000008000000ah, 000000008000000ah
+        QWORD 000000008000000ah, 000000008000000ah
+        QWORD 000000008000808bh, 000000008000808bh
+        QWORD 000000008000808bh, 000000008000808bh
+        QWORD 000000008000808bh, 000000008000808bh
+        QWORD 000000008000808bh, 000000008000808bh
+        QWORD 800000000000008bh, 800000000000008bh
+        QWORD 800000000000008bh, 800000000000008bh
+        QWORD 800000000000008bh, 800000000000008bh
+        QWORD 800000000000008bh, 800000000000008bh
+        QWORD 8000000000008089h, 8000000000008089h
+        QWORD 8000000000008089h, 8000000000008089h
+        QWORD 8000000000008089h, 8000000000008089h
+        QWORD 8000000000008089h, 8000000000008089h
+        QWORD 8000000000008003h, 8000000000008003h
+        QWORD 8000000000008003h, 8000000000008003h
+        QWORD 8000000000008003h, 8000000000008003h
+        QWORD 8000000000008003h, 8000000000008003h
+        QWORD 8000000000008002h, 8000000000008002h
+        QWORD 8000000000008002h, 8000000000008002h
+        QWORD 8000000000008002h, 8000000000008002h
+        QWORD 8000000000008002h, 8000000000008002h
+        QWORD 8000000000000080h, 8000000000000080h
+        QWORD 8000000000000080h, 8000000000000080h
+        QWORD 8000000000000080h, 8000000000000080h
+        QWORD 8000000000000080h, 8000000000000080h
+        QWORD 000000000000800ah, 000000000000800ah
+        QWORD 000000000000800ah, 000000000000800ah
+        QWORD 000000000000800ah, 000000000000800ah
+        QWORD 000000000000800ah, 000000000000800ah
+        QWORD 800000008000000ah, 800000008000000ah
+        QWORD 800000008000000ah, 800000008000000ah
+        QWORD 800000008000000ah, 800000008000000ah
+        QWORD 800000008000000ah, 800000008000000ah
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000080008081h, 8000000080008081h
+        QWORD 8000000000008080h, 8000000000008080h
+        QWORD 8000000000008080h, 8000000000008080h
+        QWORD 8000000000008080h, 8000000000008080h
+        QWORD 8000000000008080h, 8000000000008080h
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 0000000080000001h, 0000000080000001h
+        QWORD 8000000080008008h, 8000000080008008h
+        QWORD 8000000080008008h, 8000000080008008h
+        QWORD 8000000080008008h, 8000000080008008h
+        QWORD 8000000080008008h, 8000000080008008h
+ptr_L_sha3_x8_avx512_r QWORD L_sha3_x8_avx512_r
+_DATA ENDS
+_TEXT SEGMENT READONLY PARA
+sha3_blocksx8_out_avx512 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        push	rbp
+        sub	rsp, 160
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        vmovdqu	OWORD PTR [rsp+112], xmm13
+        vmovdqu	OWORD PTR [rsp+128], xmm14
+        vmovdqu	OWORD PTR [rsp+144], xmm15
+        mov	rax, QWORD PTR [ptr_L_sha3_x8_avx512_r]
+        mov	edi, r8d
+        mov	r9, rdx
+        add	r9, rdi
+        mov	r10, r9
+        add	r10, rdi
+        mov	r11, r10
+        add	r11, rdi
+        mov	r12, r11
+        add	r12, rdi
+        mov	r13, r12
+        add	r13, rdi
+        mov	r14, r13
+        add	r14, rdi
+        mov	r15, r14
+        add	r15, rdi
+        shr	rdi, 3
+        vmovdqu64	zmm0, [rcx]
+        vmovdqu64	zmm1, [rcx+64]
+        vmovdqu64	zmm2, [rcx+128]
+        vmovdqu64	zmm3, [rcx+192]
+        vmovdqu64	zmm4, [rcx+256]
+        vmovdqu64	zmm5, [rcx+320]
+        vmovdqu64	zmm6, [rcx+384]
+        vmovdqu64	zmm7, [rcx+448]
+        vmovdqu64	zmm8, [rcx+512]
+        vmovdqu64	zmm9, [rcx+576]
+        vmovdqu64	zmm10, [rcx+640]
+        vmovdqu64	zmm11, [rcx+704]
+        vmovdqu64	zmm12, [rcx+768]
+        vmovdqu64	zmm13, [rcx+832]
+        vmovdqu64	zmm14, [rcx+896]
+        vmovdqu64	zmm15, [rcx+960]
+        vmovdqu64	zmm16, [rcx+1024]
+        vmovdqu64	zmm17, [rcx+1088]
+        vmovdqu64	zmm18, [rcx+1152]
+        vmovdqu64	zmm19, [rcx+1216]
+        vmovdqu64	zmm20, [rcx+1280]
+        vmovdqu64	zmm21, [rcx+1344]
+        vmovdqu64	zmm22, [rcx+1408]
+        vmovdqu64	zmm23, [rcx+1472]
+        vmovdqu64	zmm24, [rcx+1536]
+L_sha3_blocksx8_out_avx512_block:
+        ; Round 0
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm5, zmm10, 150
+        vpternlogq	zmm25, zmm15, zmm20, 150
+        vmovdqu64	zmm26, zmm1
+        vpternlogq	zmm26, zmm6, zmm11, 150
+        vpternlogq	zmm26, zmm16, zmm21, 150
+        vmovdqu64	zmm27, zmm2
+        vpternlogq	zmm27, zmm7, zmm12, 150
+        vpternlogq	zmm27, zmm17, zmm22, 150
+        vmovdqu64	zmm28, zmm3
+        vpternlogq	zmm28, zmm8, zmm13, 150
+        vpternlogq	zmm28, zmm18, zmm23, 150
+        vmovdqu64	zmm29, zmm4
+        vpternlogq	zmm29, zmm9, zmm14, 150
+        vpternlogq	zmm29, zmm19, zmm24, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm1, zmm1, 1
+        vprolq	zmm2, zmm2, 62
+        vprolq	zmm3, zmm3, 28
+        vprolq	zmm4, zmm4, 27
+        vprolq	zmm5, zmm5, 36
+        vprolq	zmm6, zmm6, 44
+        vprolq	zmm7, zmm7, 6
+        vprolq	zmm8, zmm8, 55
+        vprolq	zmm9, zmm9, 20
+        vprolq	zmm10, zmm10, 3
+        vprolq	zmm11, zmm11, 10
+        vprolq	zmm12, zmm12, 43
+        vprolq	zmm13, zmm13, 25
+        vprolq	zmm14, zmm14, 39
+        vprolq	zmm15, zmm15, 41
+        vprolq	zmm16, zmm16, 45
+        vprolq	zmm17, zmm17, 15
+        vprolq	zmm18, zmm18, 21
+        vprolq	zmm19, zmm19, 8
+        vprolq	zmm20, zmm20, 18
+        vprolq	zmm21, zmm21, 2
+        vprolq	zmm22, zmm22, 61
+        vprolq	zmm23, zmm23, 56
+        vprolq	zmm24, zmm24, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm6
+        vpternlogq	zmm0, zmm6, zmm12, 210
+        vpternlogq	zmm6, zmm12, zmm18, 210
+        vpternlogq	zmm12, zmm18, zmm24, 210
+        vpternlogq	zmm18, zmm24, zmm30, 210
+        vpternlogq	zmm24, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm3
+        vmovdqu64	zmm31, zmm9
+        vpternlogq	zmm3, zmm9, zmm10, 210
+        vpternlogq	zmm9, zmm10, zmm16, 210
+        vpternlogq	zmm10, zmm16, zmm22, 210
+        vpternlogq	zmm16, zmm22, zmm30, 210
+        vpternlogq	zmm22, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm1
+        vmovdqu64	zmm31, zmm7
+        vpternlogq	zmm1, zmm7, zmm13, 210
+        vpternlogq	zmm7, zmm13, zmm19, 210
+        vpternlogq	zmm13, zmm19, zmm20, 210
+        vpternlogq	zmm19, zmm20, zmm30, 210
+        vpternlogq	zmm20, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm4
+        vmovdqu64	zmm31, zmm5
+        vpternlogq	zmm4, zmm5, zmm11, 210
+        vpternlogq	zmm5, zmm11, zmm17, 210
+        vpternlogq	zmm11, zmm17, zmm23, 210
+        vpternlogq	zmm17, zmm23, zmm30, 210
+        vpternlogq	zmm23, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm2
+        vmovdqu64	zmm31, zmm8
+        vpternlogq	zmm2, zmm8, zmm14, 210
+        vpternlogq	zmm8, zmm14, zmm15, 210
+        vpternlogq	zmm14, zmm15, zmm21, 210
+        vpternlogq	zmm15, zmm21, zmm30, 210
+        vpternlogq	zmm21, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax]
+        ; Round 1
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm3, zmm1, 150
+        vpternlogq	zmm25, zmm4, zmm2, 150
+        vmovdqu64	zmm26, zmm6
+        vpternlogq	zmm26, zmm9, zmm7, 150
+        vpternlogq	zmm26, zmm5, zmm8, 150
+        vmovdqu64	zmm27, zmm12
+        vpternlogq	zmm27, zmm10, zmm13, 150
+        vpternlogq	zmm27, zmm11, zmm14, 150
+        vmovdqu64	zmm28, zmm18
+        vpternlogq	zmm28, zmm16, zmm19, 150
+        vpternlogq	zmm28, zmm17, zmm15, 150
+        vmovdqu64	zmm29, zmm24
+        vpternlogq	zmm29, zmm22, zmm20, 150
+        vpternlogq	zmm29, zmm23, zmm21, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm6, zmm6, 1
+        vprolq	zmm12, zmm12, 62
+        vprolq	zmm18, zmm18, 28
+        vprolq	zmm24, zmm24, 27
+        vprolq	zmm3, zmm3, 36
+        vprolq	zmm9, zmm9, 44
+        vprolq	zmm10, zmm10, 6
+        vprolq	zmm16, zmm16, 55
+        vprolq	zmm22, zmm22, 20
+        vprolq	zmm1, zmm1, 3
+        vprolq	zmm7, zmm7, 10
+        vprolq	zmm13, zmm13, 43
+        vprolq	zmm19, zmm19, 25
+        vprolq	zmm20, zmm20, 39
+        vprolq	zmm4, zmm4, 41
+        vprolq	zmm5, zmm5, 45
+        vprolq	zmm11, zmm11, 15
+        vprolq	zmm17, zmm17, 21
+        vprolq	zmm23, zmm23, 8
+        vprolq	zmm2, zmm2, 18
+        vprolq	zmm8, zmm8, 2
+        vprolq	zmm14, zmm14, 61
+        vprolq	zmm15, zmm15, 56
+        vprolq	zmm21, zmm21, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm9
+        vpternlogq	zmm0, zmm9, zmm13, 210
+        vpternlogq	zmm9, zmm13, zmm17, 210
+        vpternlogq	zmm13, zmm17, zmm21, 210
+        vpternlogq	zmm17, zmm21, zmm30, 210
+        vpternlogq	zmm21, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm18
+        vmovdqu64	zmm31, zmm22
+        vpternlogq	zmm18, zmm22, zmm1, 210
+        vpternlogq	zmm22, zmm1, zmm5, 210
+        vpternlogq	zmm1, zmm5, zmm14, 210
+        vpternlogq	zmm5, zmm14, zmm30, 210
+        vpternlogq	zmm14, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm6
+        vmovdqu64	zmm31, zmm10
+        vpternlogq	zmm6, zmm10, zmm19, 210
+        vpternlogq	zmm10, zmm19, zmm23, 210
+        vpternlogq	zmm19, zmm23, zmm2, 210
+        vpternlogq	zmm23, zmm2, zmm30, 210
+        vpternlogq	zmm2, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm24
+        vmovdqu64	zmm31, zmm3
+        vpternlogq	zmm24, zmm3, zmm7, 210
+        vpternlogq	zmm3, zmm7, zmm11, 210
+        vpternlogq	zmm7, zmm11, zmm15, 210
+        vpternlogq	zmm11, zmm15, zmm30, 210
+        vpternlogq	zmm15, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm12
+        vmovdqu64	zmm31, zmm16
+        vpternlogq	zmm12, zmm16, zmm20, 210
+        vpternlogq	zmm16, zmm20, zmm4, 210
+        vpternlogq	zmm20, zmm4, zmm8, 210
+        vpternlogq	zmm4, zmm8, zmm30, 210
+        vpternlogq	zmm8, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+64]
+        ; Round 2
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm18, zmm6, 150
+        vpternlogq	zmm25, zmm24, zmm12, 150
+        vmovdqu64	zmm26, zmm9
+        vpternlogq	zmm26, zmm22, zmm10, 150
+        vpternlogq	zmm26, zmm3, zmm16, 150
+        vmovdqu64	zmm27, zmm13
+        vpternlogq	zmm27, zmm1, zmm19, 150
+        vpternlogq	zmm27, zmm7, zmm20, 150
+        vmovdqu64	zmm28, zmm17
+        vpternlogq	zmm28, zmm5, zmm23, 150
+        vpternlogq	zmm28, zmm11, zmm4, 150
+        vmovdqu64	zmm29, zmm21
+        vpternlogq	zmm29, zmm14, zmm2, 150
+        vpternlogq	zmm29, zmm15, zmm8, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm9, zmm9, 1
+        vprolq	zmm13, zmm13, 62
+        vprolq	zmm17, zmm17, 28
+        vprolq	zmm21, zmm21, 27
+        vprolq	zmm18, zmm18, 36
+        vprolq	zmm22, zmm22, 44
+        vprolq	zmm1, zmm1, 6
+        vprolq	zmm5, zmm5, 55
+        vprolq	zmm14, zmm14, 20
+        vprolq	zmm6, zmm6, 3
+        vprolq	zmm10, zmm10, 10
+        vprolq	zmm19, zmm19, 43
+        vprolq	zmm23, zmm23, 25
+        vprolq	zmm2, zmm2, 39
+        vprolq	zmm24, zmm24, 41
+        vprolq	zmm3, zmm3, 45
+        vprolq	zmm7, zmm7, 15
+        vprolq	zmm11, zmm11, 21
+        vprolq	zmm15, zmm15, 8
+        vprolq	zmm12, zmm12, 18
+        vprolq	zmm16, zmm16, 2
+        vprolq	zmm20, zmm20, 61
+        vprolq	zmm4, zmm4, 56
+        vprolq	zmm8, zmm8, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm22
+        vpternlogq	zmm0, zmm22, zmm19, 210
+        vpternlogq	zmm22, zmm19, zmm11, 210
+        vpternlogq	zmm19, zmm11, zmm8, 210
+        vpternlogq	zmm11, zmm8, zmm30, 210
+        vpternlogq	zmm8, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm17
+        vmovdqu64	zmm31, zmm14
+        vpternlogq	zmm17, zmm14, zmm6, 210
+        vpternlogq	zmm14, zmm6, zmm3, 210
+        vpternlogq	zmm6, zmm3, zmm20, 210
+        vpternlogq	zmm3, zmm20, zmm30, 210
+        vpternlogq	zmm20, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm9
+        vmovdqu64	zmm31, zmm1
+        vpternlogq	zmm9, zmm1, zmm23, 210
+        vpternlogq	zmm1, zmm23, zmm15, 210
+        vpternlogq	zmm23, zmm15, zmm12, 210
+        vpternlogq	zmm15, zmm12, zmm30, 210
+        vpternlogq	zmm12, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm21
+        vmovdqu64	zmm31, zmm18
+        vpternlogq	zmm21, zmm18, zmm10, 210
+        vpternlogq	zmm18, zmm10, zmm7, 210
+        vpternlogq	zmm10, zmm7, zmm4, 210
+        vpternlogq	zmm7, zmm4, zmm30, 210
+        vpternlogq	zmm4, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm13
+        vmovdqu64	zmm31, zmm5
+        vpternlogq	zmm13, zmm5, zmm2, 210
+        vpternlogq	zmm5, zmm2, zmm24, 210
+        vpternlogq	zmm2, zmm24, zmm16, 210
+        vpternlogq	zmm24, zmm16, zmm30, 210
+        vpternlogq	zmm16, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+128]
+        ; Round 3
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm17, zmm9, 150
+        vpternlogq	zmm25, zmm21, zmm13, 150
+        vmovdqu64	zmm26, zmm22
+        vpternlogq	zmm26, zmm14, zmm1, 150
+        vpternlogq	zmm26, zmm18, zmm5, 150
+        vmovdqu64	zmm27, zmm19
+        vpternlogq	zmm27, zmm6, zmm23, 150
+        vpternlogq	zmm27, zmm10, zmm2, 150
+        vmovdqu64	zmm28, zmm11
+        vpternlogq	zmm28, zmm3, zmm15, 150
+        vpternlogq	zmm28, zmm7, zmm24, 150
+        vmovdqu64	zmm29, zmm8
+        vpternlogq	zmm29, zmm20, zmm12, 150
+        vpternlogq	zmm29, zmm4, zmm16, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm22, zmm22, 1
+        vprolq	zmm19, zmm19, 62
+        vprolq	zmm11, zmm11, 28
+        vprolq	zmm8, zmm8, 27
+        vprolq	zmm17, zmm17, 36
+        vprolq	zmm14, zmm14, 44
+        vprolq	zmm6, zmm6, 6
+        vprolq	zmm3, zmm3, 55
+        vprolq	zmm20, zmm20, 20
+        vprolq	zmm9, zmm9, 3
+        vprolq	zmm1, zmm1, 10
+        vprolq	zmm23, zmm23, 43
+        vprolq	zmm15, zmm15, 25
+        vprolq	zmm12, zmm12, 39
+        vprolq	zmm21, zmm21, 41
+        vprolq	zmm18, zmm18, 45
+        vprolq	zmm10, zmm10, 15
+        vprolq	zmm7, zmm7, 21
+        vprolq	zmm4, zmm4, 8
+        vprolq	zmm13, zmm13, 18
+        vprolq	zmm5, zmm5, 2
+        vprolq	zmm2, zmm2, 61
+        vprolq	zmm24, zmm24, 56
+        vprolq	zmm16, zmm16, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm14
+        vpternlogq	zmm0, zmm14, zmm23, 210
+        vpternlogq	zmm14, zmm23, zmm7, 210
+        vpternlogq	zmm23, zmm7, zmm16, 210
+        vpternlogq	zmm7, zmm16, zmm30, 210
+        vpternlogq	zmm16, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm11
+        vmovdqu64	zmm31, zmm20
+        vpternlogq	zmm11, zmm20, zmm9, 210
+        vpternlogq	zmm20, zmm9, zmm18, 210
+        vpternlogq	zmm9, zmm18, zmm2, 210
+        vpternlogq	zmm18, zmm2, zmm30, 210
+        vpternlogq	zmm2, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm22
+        vmovdqu64	zmm31, zmm6
+        vpternlogq	zmm22, zmm6, zmm15, 210
+        vpternlogq	zmm6, zmm15, zmm4, 210
+        vpternlogq	zmm15, zmm4, zmm13, 210
+        vpternlogq	zmm4, zmm13, zmm30, 210
+        vpternlogq	zmm13, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm8
+        vmovdqu64	zmm31, zmm17
+        vpternlogq	zmm8, zmm17, zmm1, 210
+        vpternlogq	zmm17, zmm1, zmm10, 210
+        vpternlogq	zmm1, zmm10, zmm24, 210
+        vpternlogq	zmm10, zmm24, zmm30, 210
+        vpternlogq	zmm24, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm19
+        vmovdqu64	zmm31, zmm3
+        vpternlogq	zmm19, zmm3, zmm12, 210
+        vpternlogq	zmm3, zmm12, zmm21, 210
+        vpternlogq	zmm12, zmm21, zmm5, 210
+        vpternlogq	zmm21, zmm5, zmm30, 210
+        vpternlogq	zmm5, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+192]
+        ; Round 4
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm11, zmm22, 150
+        vpternlogq	zmm25, zmm8, zmm19, 150
+        vmovdqu64	zmm26, zmm14
+        vpternlogq	zmm26, zmm20, zmm6, 150
+        vpternlogq	zmm26, zmm17, zmm3, 150
+        vmovdqu64	zmm27, zmm23
+        vpternlogq	zmm27, zmm9, zmm15, 150
+        vpternlogq	zmm27, zmm1, zmm12, 150
+        vmovdqu64	zmm28, zmm7
+        vpternlogq	zmm28, zmm18, zmm4, 150
+        vpternlogq	zmm28, zmm10, zmm21, 150
+        vmovdqu64	zmm29, zmm16
+        vpternlogq	zmm29, zmm2, zmm13, 150
+        vpternlogq	zmm29, zmm24, zmm5, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm14, zmm14, 1
+        vprolq	zmm23, zmm23, 62
+        vprolq	zmm7, zmm7, 28
+        vprolq	zmm16, zmm16, 27
+        vprolq	zmm11, zmm11, 36
+        vprolq	zmm20, zmm20, 44
+        vprolq	zmm9, zmm9, 6
+        vprolq	zmm18, zmm18, 55
+        vprolq	zmm2, zmm2, 20
+        vprolq	zmm22, zmm22, 3
+        vprolq	zmm6, zmm6, 10
+        vprolq	zmm15, zmm15, 43
+        vprolq	zmm4, zmm4, 25
+        vprolq	zmm13, zmm13, 39
+        vprolq	zmm8, zmm8, 41
+        vprolq	zmm17, zmm17, 45
+        vprolq	zmm1, zmm1, 15
+        vprolq	zmm10, zmm10, 21
+        vprolq	zmm24, zmm24, 8
+        vprolq	zmm19, zmm19, 18
+        vprolq	zmm3, zmm3, 2
+        vprolq	zmm12, zmm12, 61
+        vprolq	zmm21, zmm21, 56
+        vprolq	zmm5, zmm5, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm20
+        vpternlogq	zmm0, zmm20, zmm15, 210
+        vpternlogq	zmm20, zmm15, zmm10, 210
+        vpternlogq	zmm15, zmm10, zmm5, 210
+        vpternlogq	zmm10, zmm5, zmm30, 210
+        vpternlogq	zmm5, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm7
+        vmovdqu64	zmm31, zmm2
+        vpternlogq	zmm7, zmm2, zmm22, 210
+        vpternlogq	zmm2, zmm22, zmm17, 210
+        vpternlogq	zmm22, zmm17, zmm12, 210
+        vpternlogq	zmm17, zmm12, zmm30, 210
+        vpternlogq	zmm12, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm14
+        vmovdqu64	zmm31, zmm9
+        vpternlogq	zmm14, zmm9, zmm4, 210
+        vpternlogq	zmm9, zmm4, zmm24, 210
+        vpternlogq	zmm4, zmm24, zmm19, 210
+        vpternlogq	zmm24, zmm19, zmm30, 210
+        vpternlogq	zmm19, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm16
+        vmovdqu64	zmm31, zmm11
+        vpternlogq	zmm16, zmm11, zmm6, 210
+        vpternlogq	zmm11, zmm6, zmm1, 210
+        vpternlogq	zmm6, zmm1, zmm21, 210
+        vpternlogq	zmm1, zmm21, zmm30, 210
+        vpternlogq	zmm21, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm23
+        vmovdqu64	zmm31, zmm18
+        vpternlogq	zmm23, zmm18, zmm13, 210
+        vpternlogq	zmm18, zmm13, zmm8, 210
+        vpternlogq	zmm13, zmm8, zmm3, 210
+        vpternlogq	zmm8, zmm3, zmm30, 210
+        vpternlogq	zmm3, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+256]
+        ; Round 5
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm7, zmm14, 150
+        vpternlogq	zmm25, zmm16, zmm23, 150
+        vmovdqu64	zmm26, zmm20
+        vpternlogq	zmm26, zmm2, zmm9, 150
+        vpternlogq	zmm26, zmm11, zmm18, 150
+        vmovdqu64	zmm27, zmm15
+        vpternlogq	zmm27, zmm22, zmm4, 150
+        vpternlogq	zmm27, zmm6, zmm13, 150
+        vmovdqu64	zmm28, zmm10
+        vpternlogq	zmm28, zmm17, zmm24, 150
+        vpternlogq	zmm28, zmm1, zmm8, 150
+        vmovdqu64	zmm29, zmm5
+        vpternlogq	zmm29, zmm12, zmm19, 150
+        vpternlogq	zmm29, zmm21, zmm3, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm20, zmm20, 1
+        vprolq	zmm15, zmm15, 62
+        vprolq	zmm10, zmm10, 28
+        vprolq	zmm5, zmm5, 27
+        vprolq	zmm7, zmm7, 36
+        vprolq	zmm2, zmm2, 44
+        vprolq	zmm22, zmm22, 6
+        vprolq	zmm17, zmm17, 55
+        vprolq	zmm12, zmm12, 20
+        vprolq	zmm14, zmm14, 3
+        vprolq	zmm9, zmm9, 10
+        vprolq	zmm4, zmm4, 43
+        vprolq	zmm24, zmm24, 25
+        vprolq	zmm19, zmm19, 39
+        vprolq	zmm16, zmm16, 41
+        vprolq	zmm11, zmm11, 45
+        vprolq	zmm6, zmm6, 15
+        vprolq	zmm1, zmm1, 21
+        vprolq	zmm21, zmm21, 8
+        vprolq	zmm23, zmm23, 18
+        vprolq	zmm18, zmm18, 2
+        vprolq	zmm13, zmm13, 61
+        vprolq	zmm8, zmm8, 56
+        vprolq	zmm3, zmm3, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm2
+        vpternlogq	zmm0, zmm2, zmm4, 210
+        vpternlogq	zmm2, zmm4, zmm1, 210
+        vpternlogq	zmm4, zmm1, zmm3, 210
+        vpternlogq	zmm1, zmm3, zmm30, 210
+        vpternlogq	zmm3, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm10
+        vmovdqu64	zmm31, zmm12
+        vpternlogq	zmm10, zmm12, zmm14, 210
+        vpternlogq	zmm12, zmm14, zmm11, 210
+        vpternlogq	zmm14, zmm11, zmm13, 210
+        vpternlogq	zmm11, zmm13, zmm30, 210
+        vpternlogq	zmm13, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm20
+        vmovdqu64	zmm31, zmm22
+        vpternlogq	zmm20, zmm22, zmm24, 210
+        vpternlogq	zmm22, zmm24, zmm21, 210
+        vpternlogq	zmm24, zmm21, zmm23, 210
+        vpternlogq	zmm21, zmm23, zmm30, 210
+        vpternlogq	zmm23, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm5
+        vmovdqu64	zmm31, zmm7
+        vpternlogq	zmm5, zmm7, zmm9, 210
+        vpternlogq	zmm7, zmm9, zmm6, 210
+        vpternlogq	zmm9, zmm6, zmm8, 210
+        vpternlogq	zmm6, zmm8, zmm30, 210
+        vpternlogq	zmm8, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm15
+        vmovdqu64	zmm31, zmm17
+        vpternlogq	zmm15, zmm17, zmm19, 210
+        vpternlogq	zmm17, zmm19, zmm16, 210
+        vpternlogq	zmm19, zmm16, zmm18, 210
+        vpternlogq	zmm16, zmm18, zmm30, 210
+        vpternlogq	zmm18, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+320]
+        ; Round 6
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm10, zmm20, 150
+        vpternlogq	zmm25, zmm5, zmm15, 150
+        vmovdqu64	zmm26, zmm2
+        vpternlogq	zmm26, zmm12, zmm22, 150
+        vpternlogq	zmm26, zmm7, zmm17, 150
+        vmovdqu64	zmm27, zmm4
+        vpternlogq	zmm27, zmm14, zmm24, 150
+        vpternlogq	zmm27, zmm9, zmm19, 150
+        vmovdqu64	zmm28, zmm1
+        vpternlogq	zmm28, zmm11, zmm21, 150
+        vpternlogq	zmm28, zmm6, zmm16, 150
+        vmovdqu64	zmm29, zmm3
+        vpternlogq	zmm29, zmm13, zmm23, 150
+        vpternlogq	zmm29, zmm8, zmm18, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm2, zmm2, 1
+        vprolq	zmm4, zmm4, 62
+        vprolq	zmm1, zmm1, 28
+        vprolq	zmm3, zmm3, 27
+        vprolq	zmm10, zmm10, 36
+        vprolq	zmm12, zmm12, 44
+        vprolq	zmm14, zmm14, 6
+        vprolq	zmm11, zmm11, 55
+        vprolq	zmm13, zmm13, 20
+        vprolq	zmm20, zmm20, 3
+        vprolq	zmm22, zmm22, 10
+        vprolq	zmm24, zmm24, 43
+        vprolq	zmm21, zmm21, 25
+        vprolq	zmm23, zmm23, 39
+        vprolq	zmm5, zmm5, 41
+        vprolq	zmm7, zmm7, 45
+        vprolq	zmm9, zmm9, 15
+        vprolq	zmm6, zmm6, 21
+        vprolq	zmm8, zmm8, 8
+        vprolq	zmm15, zmm15, 18
+        vprolq	zmm17, zmm17, 2
+        vprolq	zmm19, zmm19, 61
+        vprolq	zmm16, zmm16, 56
+        vprolq	zmm18, zmm18, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm12
+        vpternlogq	zmm0, zmm12, zmm24, 210
+        vpternlogq	zmm12, zmm24, zmm6, 210
+        vpternlogq	zmm24, zmm6, zmm18, 210
+        vpternlogq	zmm6, zmm18, zmm30, 210
+        vpternlogq	zmm18, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm1
+        vmovdqu64	zmm31, zmm13
+        vpternlogq	zmm1, zmm13, zmm20, 210
+        vpternlogq	zmm13, zmm20, zmm7, 210
+        vpternlogq	zmm20, zmm7, zmm19, 210
+        vpternlogq	zmm7, zmm19, zmm30, 210
+        vpternlogq	zmm19, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm2
+        vmovdqu64	zmm31, zmm14
+        vpternlogq	zmm2, zmm14, zmm21, 210
+        vpternlogq	zmm14, zmm21, zmm8, 210
+        vpternlogq	zmm21, zmm8, zmm15, 210
+        vpternlogq	zmm8, zmm15, zmm30, 210
+        vpternlogq	zmm15, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm3
+        vmovdqu64	zmm31, zmm10
+        vpternlogq	zmm3, zmm10, zmm22, 210
+        vpternlogq	zmm10, zmm22, zmm9, 210
+        vpternlogq	zmm22, zmm9, zmm16, 210
+        vpternlogq	zmm9, zmm16, zmm30, 210
+        vpternlogq	zmm16, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm4
+        vmovdqu64	zmm31, zmm11
+        vpternlogq	zmm4, zmm11, zmm23, 210
+        vpternlogq	zmm11, zmm23, zmm5, 210
+        vpternlogq	zmm23, zmm5, zmm17, 210
+        vpternlogq	zmm5, zmm17, zmm30, 210
+        vpternlogq	zmm17, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+384]
+        ; Round 7
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm1, zmm2, 150
+        vpternlogq	zmm25, zmm3, zmm4, 150
+        vmovdqu64	zmm26, zmm12
+        vpternlogq	zmm26, zmm13, zmm14, 150
+        vpternlogq	zmm26, zmm10, zmm11, 150
+        vmovdqu64	zmm27, zmm24
+        vpternlogq	zmm27, zmm20, zmm21, 150
+        vpternlogq	zmm27, zmm22, zmm23, 150
+        vmovdqu64	zmm28, zmm6
+        vpternlogq	zmm28, zmm7, zmm8, 150
+        vpternlogq	zmm28, zmm9, zmm5, 150
+        vmovdqu64	zmm29, zmm18
+        vpternlogq	zmm29, zmm19, zmm15, 150
+        vpternlogq	zmm29, zmm16, zmm17, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm12, zmm12, 1
+        vprolq	zmm24, zmm24, 62
+        vprolq	zmm6, zmm6, 28
+        vprolq	zmm18, zmm18, 27
+        vprolq	zmm1, zmm1, 36
+        vprolq	zmm13, zmm13, 44
+        vprolq	zmm20, zmm20, 6
+        vprolq	zmm7, zmm7, 55
+        vprolq	zmm19, zmm19, 20
+        vprolq	zmm2, zmm2, 3
+        vprolq	zmm14, zmm14, 10
+        vprolq	zmm21, zmm21, 43
+        vprolq	zmm8, zmm8, 25
+        vprolq	zmm15, zmm15, 39
+        vprolq	zmm3, zmm3, 41
+        vprolq	zmm10, zmm10, 45
+        vprolq	zmm22, zmm22, 15
+        vprolq	zmm9, zmm9, 21
+        vprolq	zmm16, zmm16, 8
+        vprolq	zmm4, zmm4, 18
+        vprolq	zmm11, zmm11, 2
+        vprolq	zmm23, zmm23, 61
+        vprolq	zmm5, zmm5, 56
+        vprolq	zmm17, zmm17, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm13
+        vpternlogq	zmm0, zmm13, zmm21, 210
+        vpternlogq	zmm13, zmm21, zmm9, 210
+        vpternlogq	zmm21, zmm9, zmm17, 210
+        vpternlogq	zmm9, zmm17, zmm30, 210
+        vpternlogq	zmm17, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm6
+        vmovdqu64	zmm31, zmm19
+        vpternlogq	zmm6, zmm19, zmm2, 210
+        vpternlogq	zmm19, zmm2, zmm10, 210
+        vpternlogq	zmm2, zmm10, zmm23, 210
+        vpternlogq	zmm10, zmm23, zmm30, 210
+        vpternlogq	zmm23, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm12
+        vmovdqu64	zmm31, zmm20
+        vpternlogq	zmm12, zmm20, zmm8, 210
+        vpternlogq	zmm20, zmm8, zmm16, 210
+        vpternlogq	zmm8, zmm16, zmm4, 210
+        vpternlogq	zmm16, zmm4, zmm30, 210
+        vpternlogq	zmm4, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm18
+        vmovdqu64	zmm31, zmm1
+        vpternlogq	zmm18, zmm1, zmm14, 210
+        vpternlogq	zmm1, zmm14, zmm22, 210
+        vpternlogq	zmm14, zmm22, zmm5, 210
+        vpternlogq	zmm22, zmm5, zmm30, 210
+        vpternlogq	zmm5, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm24
+        vmovdqu64	zmm31, zmm7
+        vpternlogq	zmm24, zmm7, zmm15, 210
+        vpternlogq	zmm7, zmm15, zmm3, 210
+        vpternlogq	zmm15, zmm3, zmm11, 210
+        vpternlogq	zmm3, zmm11, zmm30, 210
+        vpternlogq	zmm11, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+448]
+        ; Round 8
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm6, zmm12, 150
+        vpternlogq	zmm25, zmm18, zmm24, 150
+        vmovdqu64	zmm26, zmm13
+        vpternlogq	zmm26, zmm19, zmm20, 150
+        vpternlogq	zmm26, zmm1, zmm7, 150
+        vmovdqu64	zmm27, zmm21
+        vpternlogq	zmm27, zmm2, zmm8, 150
+        vpternlogq	zmm27, zmm14, zmm15, 150
+        vmovdqu64	zmm28, zmm9
+        vpternlogq	zmm28, zmm10, zmm16, 150
+        vpternlogq	zmm28, zmm22, zmm3, 150
+        vmovdqu64	zmm29, zmm17
+        vpternlogq	zmm29, zmm23, zmm4, 150
+        vpternlogq	zmm29, zmm5, zmm11, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm13, zmm13, 1
+        vprolq	zmm21, zmm21, 62
+        vprolq	zmm9, zmm9, 28
+        vprolq	zmm17, zmm17, 27
+        vprolq	zmm6, zmm6, 36
+        vprolq	zmm19, zmm19, 44
+        vprolq	zmm2, zmm2, 6
+        vprolq	zmm10, zmm10, 55
+        vprolq	zmm23, zmm23, 20
+        vprolq	zmm12, zmm12, 3
+        vprolq	zmm20, zmm20, 10
+        vprolq	zmm8, zmm8, 43
+        vprolq	zmm16, zmm16, 25
+        vprolq	zmm4, zmm4, 39
+        vprolq	zmm18, zmm18, 41
+        vprolq	zmm1, zmm1, 45
+        vprolq	zmm14, zmm14, 15
+        vprolq	zmm22, zmm22, 21
+        vprolq	zmm5, zmm5, 8
+        vprolq	zmm24, zmm24, 18
+        vprolq	zmm7, zmm7, 2
+        vprolq	zmm15, zmm15, 61
+        vprolq	zmm3, zmm3, 56
+        vprolq	zmm11, zmm11, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm19
+        vpternlogq	zmm0, zmm19, zmm8, 210
+        vpternlogq	zmm19, zmm8, zmm22, 210
+        vpternlogq	zmm8, zmm22, zmm11, 210
+        vpternlogq	zmm22, zmm11, zmm30, 210
+        vpternlogq	zmm11, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm9
+        vmovdqu64	zmm31, zmm23
+        vpternlogq	zmm9, zmm23, zmm12, 210
+        vpternlogq	zmm23, zmm12, zmm1, 210
+        vpternlogq	zmm12, zmm1, zmm15, 210
+        vpternlogq	zmm1, zmm15, zmm30, 210
+        vpternlogq	zmm15, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm13
+        vmovdqu64	zmm31, zmm2
+        vpternlogq	zmm13, zmm2, zmm16, 210
+        vpternlogq	zmm2, zmm16, zmm5, 210
+        vpternlogq	zmm16, zmm5, zmm24, 210
+        vpternlogq	zmm5, zmm24, zmm30, 210
+        vpternlogq	zmm24, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm17
+        vmovdqu64	zmm31, zmm6
+        vpternlogq	zmm17, zmm6, zmm20, 210
+        vpternlogq	zmm6, zmm20, zmm14, 210
+        vpternlogq	zmm20, zmm14, zmm3, 210
+        vpternlogq	zmm14, zmm3, zmm30, 210
+        vpternlogq	zmm3, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm21
+        vmovdqu64	zmm31, zmm10
+        vpternlogq	zmm21, zmm10, zmm4, 210
+        vpternlogq	zmm10, zmm4, zmm18, 210
+        vpternlogq	zmm4, zmm18, zmm7, 210
+        vpternlogq	zmm18, zmm7, zmm30, 210
+        vpternlogq	zmm7, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+512]
+        ; Round 9
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm9, zmm13, 150
+        vpternlogq	zmm25, zmm17, zmm21, 150
+        vmovdqu64	zmm26, zmm19
+        vpternlogq	zmm26, zmm23, zmm2, 150
+        vpternlogq	zmm26, zmm6, zmm10, 150
+        vmovdqu64	zmm27, zmm8
+        vpternlogq	zmm27, zmm12, zmm16, 150
+        vpternlogq	zmm27, zmm20, zmm4, 150
+        vmovdqu64	zmm28, zmm22
+        vpternlogq	zmm28, zmm1, zmm5, 150
+        vpternlogq	zmm28, zmm14, zmm18, 150
+        vmovdqu64	zmm29, zmm11
+        vpternlogq	zmm29, zmm15, zmm24, 150
+        vpternlogq	zmm29, zmm3, zmm7, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm19, zmm19, 1
+        vprolq	zmm8, zmm8, 62
+        vprolq	zmm22, zmm22, 28
+        vprolq	zmm11, zmm11, 27
+        vprolq	zmm9, zmm9, 36
+        vprolq	zmm23, zmm23, 44
+        vprolq	zmm12, zmm12, 6
+        vprolq	zmm1, zmm1, 55
+        vprolq	zmm15, zmm15, 20
+        vprolq	zmm13, zmm13, 3
+        vprolq	zmm2, zmm2, 10
+        vprolq	zmm16, zmm16, 43
+        vprolq	zmm5, zmm5, 25
+        vprolq	zmm24, zmm24, 39
+        vprolq	zmm17, zmm17, 41
+        vprolq	zmm6, zmm6, 45
+        vprolq	zmm20, zmm20, 15
+        vprolq	zmm14, zmm14, 21
+        vprolq	zmm3, zmm3, 8
+        vprolq	zmm21, zmm21, 18
+        vprolq	zmm10, zmm10, 2
+        vprolq	zmm4, zmm4, 61
+        vprolq	zmm18, zmm18, 56
+        vprolq	zmm7, zmm7, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm23
+        vpternlogq	zmm0, zmm23, zmm16, 210
+        vpternlogq	zmm23, zmm16, zmm14, 210
+        vpternlogq	zmm16, zmm14, zmm7, 210
+        vpternlogq	zmm14, zmm7, zmm30, 210
+        vpternlogq	zmm7, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm22
+        vmovdqu64	zmm31, zmm15
+        vpternlogq	zmm22, zmm15, zmm13, 210
+        vpternlogq	zmm15, zmm13, zmm6, 210
+        vpternlogq	zmm13, zmm6, zmm4, 210
+        vpternlogq	zmm6, zmm4, zmm30, 210
+        vpternlogq	zmm4, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm19
+        vmovdqu64	zmm31, zmm12
+        vpternlogq	zmm19, zmm12, zmm5, 210
+        vpternlogq	zmm12, zmm5, zmm3, 210
+        vpternlogq	zmm5, zmm3, zmm21, 210
+        vpternlogq	zmm3, zmm21, zmm30, 210
+        vpternlogq	zmm21, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm11
+        vmovdqu64	zmm31, zmm9
+        vpternlogq	zmm11, zmm9, zmm2, 210
+        vpternlogq	zmm9, zmm2, zmm20, 210
+        vpternlogq	zmm2, zmm20, zmm18, 210
+        vpternlogq	zmm20, zmm18, zmm30, 210
+        vpternlogq	zmm18, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm8
+        vmovdqu64	zmm31, zmm1
+        vpternlogq	zmm8, zmm1, zmm24, 210
+        vpternlogq	zmm1, zmm24, zmm17, 210
+        vpternlogq	zmm24, zmm17, zmm10, 210
+        vpternlogq	zmm17, zmm10, zmm30, 210
+        vpternlogq	zmm10, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+576]
+        ; Round 10
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm22, zmm19, 150
+        vpternlogq	zmm25, zmm11, zmm8, 150
+        vmovdqu64	zmm26, zmm23
+        vpternlogq	zmm26, zmm15, zmm12, 150
+        vpternlogq	zmm26, zmm9, zmm1, 150
+        vmovdqu64	zmm27, zmm16
+        vpternlogq	zmm27, zmm13, zmm5, 150
+        vpternlogq	zmm27, zmm2, zmm24, 150
+        vmovdqu64	zmm28, zmm14
+        vpternlogq	zmm28, zmm6, zmm3, 150
+        vpternlogq	zmm28, zmm20, zmm17, 150
+        vmovdqu64	zmm29, zmm7
+        vpternlogq	zmm29, zmm4, zmm21, 150
+        vpternlogq	zmm29, zmm18, zmm10, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm23, zmm23, 1
+        vprolq	zmm16, zmm16, 62
+        vprolq	zmm14, zmm14, 28
+        vprolq	zmm7, zmm7, 27
+        vprolq	zmm22, zmm22, 36
+        vprolq	zmm15, zmm15, 44
+        vprolq	zmm13, zmm13, 6
+        vprolq	zmm6, zmm6, 55
+        vprolq	zmm4, zmm4, 20
+        vprolq	zmm19, zmm19, 3
+        vprolq	zmm12, zmm12, 10
+        vprolq	zmm5, zmm5, 43
+        vprolq	zmm3, zmm3, 25
+        vprolq	zmm21, zmm21, 39
+        vprolq	zmm11, zmm11, 41
+        vprolq	zmm9, zmm9, 45
+        vprolq	zmm2, zmm2, 15
+        vprolq	zmm20, zmm20, 21
+        vprolq	zmm18, zmm18, 8
+        vprolq	zmm8, zmm8, 18
+        vprolq	zmm1, zmm1, 2
+        vprolq	zmm24, zmm24, 61
+        vprolq	zmm17, zmm17, 56
+        vprolq	zmm10, zmm10, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm15
+        vpternlogq	zmm0, zmm15, zmm5, 210
+        vpternlogq	zmm15, zmm5, zmm20, 210
+        vpternlogq	zmm5, zmm20, zmm10, 210
+        vpternlogq	zmm20, zmm10, zmm30, 210
+        vpternlogq	zmm10, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm14
+        vmovdqu64	zmm31, zmm4
+        vpternlogq	zmm14, zmm4, zmm19, 210
+        vpternlogq	zmm4, zmm19, zmm9, 210
+        vpternlogq	zmm19, zmm9, zmm24, 210
+        vpternlogq	zmm9, zmm24, zmm30, 210
+        vpternlogq	zmm24, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm23
+        vmovdqu64	zmm31, zmm13
+        vpternlogq	zmm23, zmm13, zmm3, 210
+        vpternlogq	zmm13, zmm3, zmm18, 210
+        vpternlogq	zmm3, zmm18, zmm8, 210
+        vpternlogq	zmm18, zmm8, zmm30, 210
+        vpternlogq	zmm8, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm7
+        vmovdqu64	zmm31, zmm22
+        vpternlogq	zmm7, zmm22, zmm12, 210
+        vpternlogq	zmm22, zmm12, zmm2, 210
+        vpternlogq	zmm12, zmm2, zmm17, 210
+        vpternlogq	zmm2, zmm17, zmm30, 210
+        vpternlogq	zmm17, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm16
+        vmovdqu64	zmm31, zmm6
+        vpternlogq	zmm16, zmm6, zmm21, 210
+        vpternlogq	zmm6, zmm21, zmm11, 210
+        vpternlogq	zmm21, zmm11, zmm1, 210
+        vpternlogq	zmm11, zmm1, zmm30, 210
+        vpternlogq	zmm1, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+640]
+        ; Round 11
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm14, zmm23, 150
+        vpternlogq	zmm25, zmm7, zmm16, 150
+        vmovdqu64	zmm26, zmm15
+        vpternlogq	zmm26, zmm4, zmm13, 150
+        vpternlogq	zmm26, zmm22, zmm6, 150
+        vmovdqu64	zmm27, zmm5
+        vpternlogq	zmm27, zmm19, zmm3, 150
+        vpternlogq	zmm27, zmm12, zmm21, 150
+        vmovdqu64	zmm28, zmm20
+        vpternlogq	zmm28, zmm9, zmm18, 150
+        vpternlogq	zmm28, zmm2, zmm11, 150
+        vmovdqu64	zmm29, zmm10
+        vpternlogq	zmm29, zmm24, zmm8, 150
+        vpternlogq	zmm29, zmm17, zmm1, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm15, zmm15, 1
+        vprolq	zmm5, zmm5, 62
+        vprolq	zmm20, zmm20, 28
+        vprolq	zmm10, zmm10, 27
+        vprolq	zmm14, zmm14, 36
+        vprolq	zmm4, zmm4, 44
+        vprolq	zmm19, zmm19, 6
+        vprolq	zmm9, zmm9, 55
+        vprolq	zmm24, zmm24, 20
+        vprolq	zmm23, zmm23, 3
+        vprolq	zmm13, zmm13, 10
+        vprolq	zmm3, zmm3, 43
+        vprolq	zmm18, zmm18, 25
+        vprolq	zmm8, zmm8, 39
+        vprolq	zmm7, zmm7, 41
+        vprolq	zmm22, zmm22, 45
+        vprolq	zmm12, zmm12, 15
+        vprolq	zmm2, zmm2, 21
+        vprolq	zmm17, zmm17, 8
+        vprolq	zmm16, zmm16, 18
+        vprolq	zmm6, zmm6, 2
+        vprolq	zmm21, zmm21, 61
+        vprolq	zmm11, zmm11, 56
+        vprolq	zmm1, zmm1, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm4
+        vpternlogq	zmm0, zmm4, zmm3, 210
+        vpternlogq	zmm4, zmm3, zmm2, 210
+        vpternlogq	zmm3, zmm2, zmm1, 210
+        vpternlogq	zmm2, zmm1, zmm30, 210
+        vpternlogq	zmm1, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm20
+        vmovdqu64	zmm31, zmm24
+        vpternlogq	zmm20, zmm24, zmm23, 210
+        vpternlogq	zmm24, zmm23, zmm22, 210
+        vpternlogq	zmm23, zmm22, zmm21, 210
+        vpternlogq	zmm22, zmm21, zmm30, 210
+        vpternlogq	zmm21, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm15
+        vmovdqu64	zmm31, zmm19
+        vpternlogq	zmm15, zmm19, zmm18, 210
+        vpternlogq	zmm19, zmm18, zmm17, 210
+        vpternlogq	zmm18, zmm17, zmm16, 210
+        vpternlogq	zmm17, zmm16, zmm30, 210
+        vpternlogq	zmm16, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm10
+        vmovdqu64	zmm31, zmm14
+        vpternlogq	zmm10, zmm14, zmm13, 210
+        vpternlogq	zmm14, zmm13, zmm12, 210
+        vpternlogq	zmm13, zmm12, zmm11, 210
+        vpternlogq	zmm12, zmm11, zmm30, 210
+        vpternlogq	zmm11, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm5
+        vmovdqu64	zmm31, zmm9
+        vpternlogq	zmm5, zmm9, zmm8, 210
+        vpternlogq	zmm9, zmm8, zmm7, 210
+        vpternlogq	zmm8, zmm7, zmm6, 210
+        vpternlogq	zmm7, zmm6, zmm30, 210
+        vpternlogq	zmm6, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+704]
+        ; Round 12
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm20, zmm15, 150
+        vpternlogq	zmm25, zmm10, zmm5, 150
+        vmovdqu64	zmm26, zmm4
+        vpternlogq	zmm26, zmm24, zmm19, 150
+        vpternlogq	zmm26, zmm14, zmm9, 150
+        vmovdqu64	zmm27, zmm3
+        vpternlogq	zmm27, zmm23, zmm18, 150
+        vpternlogq	zmm27, zmm13, zmm8, 150
+        vmovdqu64	zmm28, zmm2
+        vpternlogq	zmm28, zmm22, zmm17, 150
+        vpternlogq	zmm28, zmm12, zmm7, 150
+        vmovdqu64	zmm29, zmm1
+        vpternlogq	zmm29, zmm21, zmm16, 150
+        vpternlogq	zmm29, zmm11, zmm6, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm4, zmm4, 1
+        vprolq	zmm3, zmm3, 62
+        vprolq	zmm2, zmm2, 28
+        vprolq	zmm1, zmm1, 27
+        vprolq	zmm20, zmm20, 36
+        vprolq	zmm24, zmm24, 44
+        vprolq	zmm23, zmm23, 6
+        vprolq	zmm22, zmm22, 55
+        vprolq	zmm21, zmm21, 20
+        vprolq	zmm15, zmm15, 3
+        vprolq	zmm19, zmm19, 10
+        vprolq	zmm18, zmm18, 43
+        vprolq	zmm17, zmm17, 25
+        vprolq	zmm16, zmm16, 39
+        vprolq	zmm10, zmm10, 41
+        vprolq	zmm14, zmm14, 45
+        vprolq	zmm13, zmm13, 15
+        vprolq	zmm12, zmm12, 21
+        vprolq	zmm11, zmm11, 8
+        vprolq	zmm5, zmm5, 18
+        vprolq	zmm9, zmm9, 2
+        vprolq	zmm8, zmm8, 61
+        vprolq	zmm7, zmm7, 56
+        vprolq	zmm6, zmm6, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm24
+        vpternlogq	zmm0, zmm24, zmm18, 210
+        vpternlogq	zmm24, zmm18, zmm12, 210
+        vpternlogq	zmm18, zmm12, zmm6, 210
+        vpternlogq	zmm12, zmm6, zmm30, 210
+        vpternlogq	zmm6, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm2
+        vmovdqu64	zmm31, zmm21
+        vpternlogq	zmm2, zmm21, zmm15, 210
+        vpternlogq	zmm21, zmm15, zmm14, 210
+        vpternlogq	zmm15, zmm14, zmm8, 210
+        vpternlogq	zmm14, zmm8, zmm30, 210
+        vpternlogq	zmm8, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm4
+        vmovdqu64	zmm31, zmm23
+        vpternlogq	zmm4, zmm23, zmm17, 210
+        vpternlogq	zmm23, zmm17, zmm11, 210
+        vpternlogq	zmm17, zmm11, zmm5, 210
+        vpternlogq	zmm11, zmm5, zmm30, 210
+        vpternlogq	zmm5, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm1
+        vmovdqu64	zmm31, zmm20
+        vpternlogq	zmm1, zmm20, zmm19, 210
+        vpternlogq	zmm20, zmm19, zmm13, 210
+        vpternlogq	zmm19, zmm13, zmm7, 210
+        vpternlogq	zmm13, zmm7, zmm30, 210
+        vpternlogq	zmm7, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm3
+        vmovdqu64	zmm31, zmm22
+        vpternlogq	zmm3, zmm22, zmm16, 210
+        vpternlogq	zmm22, zmm16, zmm10, 210
+        vpternlogq	zmm16, zmm10, zmm9, 210
+        vpternlogq	zmm10, zmm9, zmm30, 210
+        vpternlogq	zmm9, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+768]
+        ; Round 13
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm2, zmm4, 150
+        vpternlogq	zmm25, zmm1, zmm3, 150
+        vmovdqu64	zmm26, zmm24
+        vpternlogq	zmm26, zmm21, zmm23, 150
+        vpternlogq	zmm26, zmm20, zmm22, 150
+        vmovdqu64	zmm27, zmm18
+        vpternlogq	zmm27, zmm15, zmm17, 150
+        vpternlogq	zmm27, zmm19, zmm16, 150
+        vmovdqu64	zmm28, zmm12
+        vpternlogq	zmm28, zmm14, zmm11, 150
+        vpternlogq	zmm28, zmm13, zmm10, 150
+        vmovdqu64	zmm29, zmm6
+        vpternlogq	zmm29, zmm8, zmm5, 150
+        vpternlogq	zmm29, zmm7, zmm9, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm24, zmm24, 1
+        vprolq	zmm18, zmm18, 62
+        vprolq	zmm12, zmm12, 28
+        vprolq	zmm6, zmm6, 27
+        vprolq	zmm2, zmm2, 36
+        vprolq	zmm21, zmm21, 44
+        vprolq	zmm15, zmm15, 6
+        vprolq	zmm14, zmm14, 55
+        vprolq	zmm8, zmm8, 20
+        vprolq	zmm4, zmm4, 3
+        vprolq	zmm23, zmm23, 10
+        vprolq	zmm17, zmm17, 43
+        vprolq	zmm11, zmm11, 25
+        vprolq	zmm5, zmm5, 39
+        vprolq	zmm1, zmm1, 41
+        vprolq	zmm20, zmm20, 45
+        vprolq	zmm19, zmm19, 15
+        vprolq	zmm13, zmm13, 21
+        vprolq	zmm7, zmm7, 8
+        vprolq	zmm3, zmm3, 18
+        vprolq	zmm22, zmm22, 2
+        vprolq	zmm16, zmm16, 61
+        vprolq	zmm10, zmm10, 56
+        vprolq	zmm9, zmm9, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm21
+        vpternlogq	zmm0, zmm21, zmm17, 210
+        vpternlogq	zmm21, zmm17, zmm13, 210
+        vpternlogq	zmm17, zmm13, zmm9, 210
+        vpternlogq	zmm13, zmm9, zmm30, 210
+        vpternlogq	zmm9, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm12
+        vmovdqu64	zmm31, zmm8
+        vpternlogq	zmm12, zmm8, zmm4, 210
+        vpternlogq	zmm8, zmm4, zmm20, 210
+        vpternlogq	zmm4, zmm20, zmm16, 210
+        vpternlogq	zmm20, zmm16, zmm30, 210
+        vpternlogq	zmm16, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm24
+        vmovdqu64	zmm31, zmm15
+        vpternlogq	zmm24, zmm15, zmm11, 210
+        vpternlogq	zmm15, zmm11, zmm7, 210
+        vpternlogq	zmm11, zmm7, zmm3, 210
+        vpternlogq	zmm7, zmm3, zmm30, 210
+        vpternlogq	zmm3, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm6
+        vmovdqu64	zmm31, zmm2
+        vpternlogq	zmm6, zmm2, zmm23, 210
+        vpternlogq	zmm2, zmm23, zmm19, 210
+        vpternlogq	zmm23, zmm19, zmm10, 210
+        vpternlogq	zmm19, zmm10, zmm30, 210
+        vpternlogq	zmm10, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm18
+        vmovdqu64	zmm31, zmm14
+        vpternlogq	zmm18, zmm14, zmm5, 210
+        vpternlogq	zmm14, zmm5, zmm1, 210
+        vpternlogq	zmm5, zmm1, zmm22, 210
+        vpternlogq	zmm1, zmm22, zmm30, 210
+        vpternlogq	zmm22, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+832]
+        ; Round 14
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm12, zmm24, 150
+        vpternlogq	zmm25, zmm6, zmm18, 150
+        vmovdqu64	zmm26, zmm21
+        vpternlogq	zmm26, zmm8, zmm15, 150
+        vpternlogq	zmm26, zmm2, zmm14, 150
+        vmovdqu64	zmm27, zmm17
+        vpternlogq	zmm27, zmm4, zmm11, 150
+        vpternlogq	zmm27, zmm23, zmm5, 150
+        vmovdqu64	zmm28, zmm13
+        vpternlogq	zmm28, zmm20, zmm7, 150
+        vpternlogq	zmm28, zmm19, zmm1, 150
+        vmovdqu64	zmm29, zmm9
+        vpternlogq	zmm29, zmm16, zmm3, 150
+        vpternlogq	zmm29, zmm10, zmm22, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm21, zmm21, 1
+        vprolq	zmm17, zmm17, 62
+        vprolq	zmm13, zmm13, 28
+        vprolq	zmm9, zmm9, 27
+        vprolq	zmm12, zmm12, 36
+        vprolq	zmm8, zmm8, 44
+        vprolq	zmm4, zmm4, 6
+        vprolq	zmm20, zmm20, 55
+        vprolq	zmm16, zmm16, 20
+        vprolq	zmm24, zmm24, 3
+        vprolq	zmm15, zmm15, 10
+        vprolq	zmm11, zmm11, 43
+        vprolq	zmm7, zmm7, 25
+        vprolq	zmm3, zmm3, 39
+        vprolq	zmm6, zmm6, 41
+        vprolq	zmm2, zmm2, 45
+        vprolq	zmm23, zmm23, 15
+        vprolq	zmm19, zmm19, 21
+        vprolq	zmm10, zmm10, 8
+        vprolq	zmm18, zmm18, 18
+        vprolq	zmm14, zmm14, 2
+        vprolq	zmm5, zmm5, 61
+        vprolq	zmm1, zmm1, 56
+        vprolq	zmm22, zmm22, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm8
+        vpternlogq	zmm0, zmm8, zmm11, 210
+        vpternlogq	zmm8, zmm11, zmm19, 210
+        vpternlogq	zmm11, zmm19, zmm22, 210
+        vpternlogq	zmm19, zmm22, zmm30, 210
+        vpternlogq	zmm22, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm13
+        vmovdqu64	zmm31, zmm16
+        vpternlogq	zmm13, zmm16, zmm24, 210
+        vpternlogq	zmm16, zmm24, zmm2, 210
+        vpternlogq	zmm24, zmm2, zmm5, 210
+        vpternlogq	zmm2, zmm5, zmm30, 210
+        vpternlogq	zmm5, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm21
+        vmovdqu64	zmm31, zmm4
+        vpternlogq	zmm21, zmm4, zmm7, 210
+        vpternlogq	zmm4, zmm7, zmm10, 210
+        vpternlogq	zmm7, zmm10, zmm18, 210
+        vpternlogq	zmm10, zmm18, zmm30, 210
+        vpternlogq	zmm18, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm9
+        vmovdqu64	zmm31, zmm12
+        vpternlogq	zmm9, zmm12, zmm15, 210
+        vpternlogq	zmm12, zmm15, zmm23, 210
+        vpternlogq	zmm15, zmm23, zmm1, 210
+        vpternlogq	zmm23, zmm1, zmm30, 210
+        vpternlogq	zmm1, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm17
+        vmovdqu64	zmm31, zmm20
+        vpternlogq	zmm17, zmm20, zmm3, 210
+        vpternlogq	zmm20, zmm3, zmm6, 210
+        vpternlogq	zmm3, zmm6, zmm14, 210
+        vpternlogq	zmm6, zmm14, zmm30, 210
+        vpternlogq	zmm14, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+896]
+        ; Round 15
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm13, zmm21, 150
+        vpternlogq	zmm25, zmm9, zmm17, 150
+        vmovdqu64	zmm26, zmm8
+        vpternlogq	zmm26, zmm16, zmm4, 150
+        vpternlogq	zmm26, zmm12, zmm20, 150
+        vmovdqu64	zmm27, zmm11
+        vpternlogq	zmm27, zmm24, zmm7, 150
+        vpternlogq	zmm27, zmm15, zmm3, 150
+        vmovdqu64	zmm28, zmm19
+        vpternlogq	zmm28, zmm2, zmm10, 150
+        vpternlogq	zmm28, zmm23, zmm6, 150
+        vmovdqu64	zmm29, zmm22
+        vpternlogq	zmm29, zmm5, zmm18, 150
+        vpternlogq	zmm29, zmm1, zmm14, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm8, zmm8, 1
+        vprolq	zmm11, zmm11, 62
+        vprolq	zmm19, zmm19, 28
+        vprolq	zmm22, zmm22, 27
+        vprolq	zmm13, zmm13, 36
+        vprolq	zmm16, zmm16, 44
+        vprolq	zmm24, zmm24, 6
+        vprolq	zmm2, zmm2, 55
+        vprolq	zmm5, zmm5, 20
+        vprolq	zmm21, zmm21, 3
+        vprolq	zmm4, zmm4, 10
+        vprolq	zmm7, zmm7, 43
+        vprolq	zmm10, zmm10, 25
+        vprolq	zmm18, zmm18, 39
+        vprolq	zmm9, zmm9, 41
+        vprolq	zmm12, zmm12, 45
+        vprolq	zmm15, zmm15, 15
+        vprolq	zmm23, zmm23, 21
+        vprolq	zmm1, zmm1, 8
+        vprolq	zmm17, zmm17, 18
+        vprolq	zmm20, zmm20, 2
+        vprolq	zmm3, zmm3, 61
+        vprolq	zmm6, zmm6, 56
+        vprolq	zmm14, zmm14, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm16
+        vpternlogq	zmm0, zmm16, zmm7, 210
+        vpternlogq	zmm16, zmm7, zmm23, 210
+        vpternlogq	zmm7, zmm23, zmm14, 210
+        vpternlogq	zmm23, zmm14, zmm30, 210
+        vpternlogq	zmm14, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm19
+        vmovdqu64	zmm31, zmm5
+        vpternlogq	zmm19, zmm5, zmm21, 210
+        vpternlogq	zmm5, zmm21, zmm12, 210
+        vpternlogq	zmm21, zmm12, zmm3, 210
+        vpternlogq	zmm12, zmm3, zmm30, 210
+        vpternlogq	zmm3, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm8
+        vmovdqu64	zmm31, zmm24
+        vpternlogq	zmm8, zmm24, zmm10, 210
+        vpternlogq	zmm24, zmm10, zmm1, 210
+        vpternlogq	zmm10, zmm1, zmm17, 210
+        vpternlogq	zmm1, zmm17, zmm30, 210
+        vpternlogq	zmm17, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm22
+        vmovdqu64	zmm31, zmm13
+        vpternlogq	zmm22, zmm13, zmm4, 210
+        vpternlogq	zmm13, zmm4, zmm15, 210
+        vpternlogq	zmm4, zmm15, zmm6, 210
+        vpternlogq	zmm15, zmm6, zmm30, 210
+        vpternlogq	zmm6, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm11
+        vmovdqu64	zmm31, zmm2
+        vpternlogq	zmm11, zmm2, zmm18, 210
+        vpternlogq	zmm2, zmm18, zmm9, 210
+        vpternlogq	zmm18, zmm9, zmm20, 210
+        vpternlogq	zmm9, zmm20, zmm30, 210
+        vpternlogq	zmm20, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+960]
+        ; Round 16
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm19, zmm8, 150
+        vpternlogq	zmm25, zmm22, zmm11, 150
+        vmovdqu64	zmm26, zmm16
+        vpternlogq	zmm26, zmm5, zmm24, 150
+        vpternlogq	zmm26, zmm13, zmm2, 150
+        vmovdqu64	zmm27, zmm7
+        vpternlogq	zmm27, zmm21, zmm10, 150
+        vpternlogq	zmm27, zmm4, zmm18, 150
+        vmovdqu64	zmm28, zmm23
+        vpternlogq	zmm28, zmm12, zmm1, 150
+        vpternlogq	zmm28, zmm15, zmm9, 150
+        vmovdqu64	zmm29, zmm14
+        vpternlogq	zmm29, zmm3, zmm17, 150
+        vpternlogq	zmm29, zmm6, zmm20, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm16, zmm16, 1
+        vprolq	zmm7, zmm7, 62
+        vprolq	zmm23, zmm23, 28
+        vprolq	zmm14, zmm14, 27
+        vprolq	zmm19, zmm19, 36
+        vprolq	zmm5, zmm5, 44
+        vprolq	zmm21, zmm21, 6
+        vprolq	zmm12, zmm12, 55
+        vprolq	zmm3, zmm3, 20
+        vprolq	zmm8, zmm8, 3
+        vprolq	zmm24, zmm24, 10
+        vprolq	zmm10, zmm10, 43
+        vprolq	zmm1, zmm1, 25
+        vprolq	zmm17, zmm17, 39
+        vprolq	zmm22, zmm22, 41
+        vprolq	zmm13, zmm13, 45
+        vprolq	zmm4, zmm4, 15
+        vprolq	zmm15, zmm15, 21
+        vprolq	zmm6, zmm6, 8
+        vprolq	zmm11, zmm11, 18
+        vprolq	zmm2, zmm2, 2
+        vprolq	zmm18, zmm18, 61
+        vprolq	zmm9, zmm9, 56
+        vprolq	zmm20, zmm20, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm5
+        vpternlogq	zmm0, zmm5, zmm10, 210
+        vpternlogq	zmm5, zmm10, zmm15, 210
+        vpternlogq	zmm10, zmm15, zmm20, 210
+        vpternlogq	zmm15, zmm20, zmm30, 210
+        vpternlogq	zmm20, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm23
+        vmovdqu64	zmm31, zmm3
+        vpternlogq	zmm23, zmm3, zmm8, 210
+        vpternlogq	zmm3, zmm8, zmm13, 210
+        vpternlogq	zmm8, zmm13, zmm18, 210
+        vpternlogq	zmm13, zmm18, zmm30, 210
+        vpternlogq	zmm18, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm16
+        vmovdqu64	zmm31, zmm21
+        vpternlogq	zmm16, zmm21, zmm1, 210
+        vpternlogq	zmm21, zmm1, zmm6, 210
+        vpternlogq	zmm1, zmm6, zmm11, 210
+        vpternlogq	zmm6, zmm11, zmm30, 210
+        vpternlogq	zmm11, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm14
+        vmovdqu64	zmm31, zmm19
+        vpternlogq	zmm14, zmm19, zmm24, 210
+        vpternlogq	zmm19, zmm24, zmm4, 210
+        vpternlogq	zmm24, zmm4, zmm9, 210
+        vpternlogq	zmm4, zmm9, zmm30, 210
+        vpternlogq	zmm9, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm7
+        vmovdqu64	zmm31, zmm12
+        vpternlogq	zmm7, zmm12, zmm17, 210
+        vpternlogq	zmm12, zmm17, zmm22, 210
+        vpternlogq	zmm17, zmm22, zmm2, 210
+        vpternlogq	zmm22, zmm2, zmm30, 210
+        vpternlogq	zmm2, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1024]
+        ; Round 17
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm23, zmm16, 150
+        vpternlogq	zmm25, zmm14, zmm7, 150
+        vmovdqu64	zmm26, zmm5
+        vpternlogq	zmm26, zmm3, zmm21, 150
+        vpternlogq	zmm26, zmm19, zmm12, 150
+        vmovdqu64	zmm27, zmm10
+        vpternlogq	zmm27, zmm8, zmm1, 150
+        vpternlogq	zmm27, zmm24, zmm17, 150
+        vmovdqu64	zmm28, zmm15
+        vpternlogq	zmm28, zmm13, zmm6, 150
+        vpternlogq	zmm28, zmm4, zmm22, 150
+        vmovdqu64	zmm29, zmm20
+        vpternlogq	zmm29, zmm18, zmm11, 150
+        vpternlogq	zmm29, zmm9, zmm2, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm5, zmm5, 1
+        vprolq	zmm10, zmm10, 62
+        vprolq	zmm15, zmm15, 28
+        vprolq	zmm20, zmm20, 27
+        vprolq	zmm23, zmm23, 36
+        vprolq	zmm3, zmm3, 44
+        vprolq	zmm8, zmm8, 6
+        vprolq	zmm13, zmm13, 55
+        vprolq	zmm18, zmm18, 20
+        vprolq	zmm16, zmm16, 3
+        vprolq	zmm21, zmm21, 10
+        vprolq	zmm1, zmm1, 43
+        vprolq	zmm6, zmm6, 25
+        vprolq	zmm11, zmm11, 39
+        vprolq	zmm14, zmm14, 41
+        vprolq	zmm19, zmm19, 45
+        vprolq	zmm24, zmm24, 15
+        vprolq	zmm4, zmm4, 21
+        vprolq	zmm9, zmm9, 8
+        vprolq	zmm7, zmm7, 18
+        vprolq	zmm12, zmm12, 2
+        vprolq	zmm17, zmm17, 61
+        vprolq	zmm22, zmm22, 56
+        vprolq	zmm2, zmm2, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm3
+        vpternlogq	zmm0, zmm3, zmm1, 210
+        vpternlogq	zmm3, zmm1, zmm4, 210
+        vpternlogq	zmm1, zmm4, zmm2, 210
+        vpternlogq	zmm4, zmm2, zmm30, 210
+        vpternlogq	zmm2, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm15
+        vmovdqu64	zmm31, zmm18
+        vpternlogq	zmm15, zmm18, zmm16, 210
+        vpternlogq	zmm18, zmm16, zmm19, 210
+        vpternlogq	zmm16, zmm19, zmm17, 210
+        vpternlogq	zmm19, zmm17, zmm30, 210
+        vpternlogq	zmm17, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm5
+        vmovdqu64	zmm31, zmm8
+        vpternlogq	zmm5, zmm8, zmm6, 210
+        vpternlogq	zmm8, zmm6, zmm9, 210
+        vpternlogq	zmm6, zmm9, zmm7, 210
+        vpternlogq	zmm9, zmm7, zmm30, 210
+        vpternlogq	zmm7, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm20
+        vmovdqu64	zmm31, zmm23
+        vpternlogq	zmm20, zmm23, zmm21, 210
+        vpternlogq	zmm23, zmm21, zmm24, 210
+        vpternlogq	zmm21, zmm24, zmm22, 210
+        vpternlogq	zmm24, zmm22, zmm30, 210
+        vpternlogq	zmm22, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm10
+        vmovdqu64	zmm31, zmm13
+        vpternlogq	zmm10, zmm13, zmm11, 210
+        vpternlogq	zmm13, zmm11, zmm14, 210
+        vpternlogq	zmm11, zmm14, zmm12, 210
+        vpternlogq	zmm14, zmm12, zmm30, 210
+        vpternlogq	zmm12, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1088]
+        ; Round 18
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm15, zmm5, 150
+        vpternlogq	zmm25, zmm20, zmm10, 150
+        vmovdqu64	zmm26, zmm3
+        vpternlogq	zmm26, zmm18, zmm8, 150
+        vpternlogq	zmm26, zmm23, zmm13, 150
+        vmovdqu64	zmm27, zmm1
+        vpternlogq	zmm27, zmm16, zmm6, 150
+        vpternlogq	zmm27, zmm21, zmm11, 150
+        vmovdqu64	zmm28, zmm4
+        vpternlogq	zmm28, zmm19, zmm9, 150
+        vpternlogq	zmm28, zmm24, zmm14, 150
+        vmovdqu64	zmm29, zmm2
+        vpternlogq	zmm29, zmm17, zmm7, 150
+        vpternlogq	zmm29, zmm22, zmm12, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm3, zmm3, 1
+        vprolq	zmm1, zmm1, 62
+        vprolq	zmm4, zmm4, 28
+        vprolq	zmm2, zmm2, 27
+        vprolq	zmm15, zmm15, 36
+        vprolq	zmm18, zmm18, 44
+        vprolq	zmm16, zmm16, 6
+        vprolq	zmm19, zmm19, 55
+        vprolq	zmm17, zmm17, 20
+        vprolq	zmm5, zmm5, 3
+        vprolq	zmm8, zmm8, 10
+        vprolq	zmm6, zmm6, 43
+        vprolq	zmm9, zmm9, 25
+        vprolq	zmm7, zmm7, 39
+        vprolq	zmm20, zmm20, 41
+        vprolq	zmm23, zmm23, 45
+        vprolq	zmm21, zmm21, 15
+        vprolq	zmm24, zmm24, 21
+        vprolq	zmm22, zmm22, 8
+        vprolq	zmm10, zmm10, 18
+        vprolq	zmm13, zmm13, 2
+        vprolq	zmm11, zmm11, 61
+        vprolq	zmm14, zmm14, 56
+        vprolq	zmm12, zmm12, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm18
+        vpternlogq	zmm0, zmm18, zmm6, 210
+        vpternlogq	zmm18, zmm6, zmm24, 210
+        vpternlogq	zmm6, zmm24, zmm12, 210
+        vpternlogq	zmm24, zmm12, zmm30, 210
+        vpternlogq	zmm12, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm4
+        vmovdqu64	zmm31, zmm17
+        vpternlogq	zmm4, zmm17, zmm5, 210
+        vpternlogq	zmm17, zmm5, zmm23, 210
+        vpternlogq	zmm5, zmm23, zmm11, 210
+        vpternlogq	zmm23, zmm11, zmm30, 210
+        vpternlogq	zmm11, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm3
+        vmovdqu64	zmm31, zmm16
+        vpternlogq	zmm3, zmm16, zmm9, 210
+        vpternlogq	zmm16, zmm9, zmm22, 210
+        vpternlogq	zmm9, zmm22, zmm10, 210
+        vpternlogq	zmm22, zmm10, zmm30, 210
+        vpternlogq	zmm10, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm2
+        vmovdqu64	zmm31, zmm15
+        vpternlogq	zmm2, zmm15, zmm8, 210
+        vpternlogq	zmm15, zmm8, zmm21, 210
+        vpternlogq	zmm8, zmm21, zmm14, 210
+        vpternlogq	zmm21, zmm14, zmm30, 210
+        vpternlogq	zmm14, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm1
+        vmovdqu64	zmm31, zmm19
+        vpternlogq	zmm1, zmm19, zmm7, 210
+        vpternlogq	zmm19, zmm7, zmm20, 210
+        vpternlogq	zmm7, zmm20, zmm13, 210
+        vpternlogq	zmm20, zmm13, zmm30, 210
+        vpternlogq	zmm13, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1152]
+        ; Round 19
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm4, zmm3, 150
+        vpternlogq	zmm25, zmm2, zmm1, 150
+        vmovdqu64	zmm26, zmm18
+        vpternlogq	zmm26, zmm17, zmm16, 150
+        vpternlogq	zmm26, zmm15, zmm19, 150
+        vmovdqu64	zmm27, zmm6
+        vpternlogq	zmm27, zmm5, zmm9, 150
+        vpternlogq	zmm27, zmm8, zmm7, 150
+        vmovdqu64	zmm28, zmm24
+        vpternlogq	zmm28, zmm23, zmm22, 150
+        vpternlogq	zmm28, zmm21, zmm20, 150
+        vmovdqu64	zmm29, zmm12
+        vpternlogq	zmm29, zmm11, zmm10, 150
+        vpternlogq	zmm29, zmm14, zmm13, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm18, zmm18, 1
+        vprolq	zmm6, zmm6, 62
+        vprolq	zmm24, zmm24, 28
+        vprolq	zmm12, zmm12, 27
+        vprolq	zmm4, zmm4, 36
+        vprolq	zmm17, zmm17, 44
+        vprolq	zmm5, zmm5, 6
+        vprolq	zmm23, zmm23, 55
+        vprolq	zmm11, zmm11, 20
+        vprolq	zmm3, zmm3, 3
+        vprolq	zmm16, zmm16, 10
+        vprolq	zmm9, zmm9, 43
+        vprolq	zmm22, zmm22, 25
+        vprolq	zmm10, zmm10, 39
+        vprolq	zmm2, zmm2, 41
+        vprolq	zmm15, zmm15, 45
+        vprolq	zmm8, zmm8, 15
+        vprolq	zmm21, zmm21, 21
+        vprolq	zmm14, zmm14, 8
+        vprolq	zmm1, zmm1, 18
+        vprolq	zmm19, zmm19, 2
+        vprolq	zmm7, zmm7, 61
+        vprolq	zmm20, zmm20, 56
+        vprolq	zmm13, zmm13, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm17
+        vpternlogq	zmm0, zmm17, zmm9, 210
+        vpternlogq	zmm17, zmm9, zmm21, 210
+        vpternlogq	zmm9, zmm21, zmm13, 210
+        vpternlogq	zmm21, zmm13, zmm30, 210
+        vpternlogq	zmm13, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm24
+        vmovdqu64	zmm31, zmm11
+        vpternlogq	zmm24, zmm11, zmm3, 210
+        vpternlogq	zmm11, zmm3, zmm15, 210
+        vpternlogq	zmm3, zmm15, zmm7, 210
+        vpternlogq	zmm15, zmm7, zmm30, 210
+        vpternlogq	zmm7, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm18
+        vmovdqu64	zmm31, zmm5
+        vpternlogq	zmm18, zmm5, zmm22, 210
+        vpternlogq	zmm5, zmm22, zmm14, 210
+        vpternlogq	zmm22, zmm14, zmm1, 210
+        vpternlogq	zmm14, zmm1, zmm30, 210
+        vpternlogq	zmm1, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm12
+        vmovdqu64	zmm31, zmm4
+        vpternlogq	zmm12, zmm4, zmm16, 210
+        vpternlogq	zmm4, zmm16, zmm8, 210
+        vpternlogq	zmm16, zmm8, zmm20, 210
+        vpternlogq	zmm8, zmm20, zmm30, 210
+        vpternlogq	zmm20, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm6
+        vmovdqu64	zmm31, zmm23
+        vpternlogq	zmm6, zmm23, zmm10, 210
+        vpternlogq	zmm23, zmm10, zmm2, 210
+        vpternlogq	zmm10, zmm2, zmm19, 210
+        vpternlogq	zmm2, zmm19, zmm30, 210
+        vpternlogq	zmm19, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1216]
+        ; Round 20
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm24, zmm18, 150
+        vpternlogq	zmm25, zmm12, zmm6, 150
+        vmovdqu64	zmm26, zmm17
+        vpternlogq	zmm26, zmm11, zmm5, 150
+        vpternlogq	zmm26, zmm4, zmm23, 150
+        vmovdqu64	zmm27, zmm9
+        vpternlogq	zmm27, zmm3, zmm22, 150
+        vpternlogq	zmm27, zmm16, zmm10, 150
+        vmovdqu64	zmm28, zmm21
+        vpternlogq	zmm28, zmm15, zmm14, 150
+        vpternlogq	zmm28, zmm8, zmm2, 150
+        vmovdqu64	zmm29, zmm13
+        vpternlogq	zmm29, zmm7, zmm1, 150
+        vpternlogq	zmm29, zmm20, zmm19, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm17, zmm17, 1
+        vprolq	zmm9, zmm9, 62
+        vprolq	zmm21, zmm21, 28
+        vprolq	zmm13, zmm13, 27
+        vprolq	zmm24, zmm24, 36
+        vprolq	zmm11, zmm11, 44
+        vprolq	zmm3, zmm3, 6
+        vprolq	zmm15, zmm15, 55
+        vprolq	zmm7, zmm7, 20
+        vprolq	zmm18, zmm18, 3
+        vprolq	zmm5, zmm5, 10
+        vprolq	zmm22, zmm22, 43
+        vprolq	zmm14, zmm14, 25
+        vprolq	zmm1, zmm1, 39
+        vprolq	zmm12, zmm12, 41
+        vprolq	zmm4, zmm4, 45
+        vprolq	zmm16, zmm16, 15
+        vprolq	zmm8, zmm8, 21
+        vprolq	zmm20, zmm20, 8
+        vprolq	zmm6, zmm6, 18
+        vprolq	zmm23, zmm23, 2
+        vprolq	zmm10, zmm10, 61
+        vprolq	zmm2, zmm2, 56
+        vprolq	zmm19, zmm19, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm11
+        vpternlogq	zmm0, zmm11, zmm22, 210
+        vpternlogq	zmm11, zmm22, zmm8, 210
+        vpternlogq	zmm22, zmm8, zmm19, 210
+        vpternlogq	zmm8, zmm19, zmm30, 210
+        vpternlogq	zmm19, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm21
+        vmovdqu64	zmm31, zmm7
+        vpternlogq	zmm21, zmm7, zmm18, 210
+        vpternlogq	zmm7, zmm18, zmm4, 210
+        vpternlogq	zmm18, zmm4, zmm10, 210
+        vpternlogq	zmm4, zmm10, zmm30, 210
+        vpternlogq	zmm10, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm17
+        vmovdqu64	zmm31, zmm3
+        vpternlogq	zmm17, zmm3, zmm14, 210
+        vpternlogq	zmm3, zmm14, zmm20, 210
+        vpternlogq	zmm14, zmm20, zmm6, 210
+        vpternlogq	zmm20, zmm6, zmm30, 210
+        vpternlogq	zmm6, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm13
+        vmovdqu64	zmm31, zmm24
+        vpternlogq	zmm13, zmm24, zmm5, 210
+        vpternlogq	zmm24, zmm5, zmm16, 210
+        vpternlogq	zmm5, zmm16, zmm2, 210
+        vpternlogq	zmm16, zmm2, zmm30, 210
+        vpternlogq	zmm2, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm9
+        vmovdqu64	zmm31, zmm15
+        vpternlogq	zmm9, zmm15, zmm1, 210
+        vpternlogq	zmm15, zmm1, zmm12, 210
+        vpternlogq	zmm1, zmm12, zmm23, 210
+        vpternlogq	zmm12, zmm23, zmm30, 210
+        vpternlogq	zmm23, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1280]
+        ; Round 21
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm21, zmm17, 150
+        vpternlogq	zmm25, zmm13, zmm9, 150
+        vmovdqu64	zmm26, zmm11
+        vpternlogq	zmm26, zmm7, zmm3, 150
+        vpternlogq	zmm26, zmm24, zmm15, 150
+        vmovdqu64	zmm27, zmm22
+        vpternlogq	zmm27, zmm18, zmm14, 150
+        vpternlogq	zmm27, zmm5, zmm1, 150
+        vmovdqu64	zmm28, zmm8
+        vpternlogq	zmm28, zmm4, zmm20, 150
+        vpternlogq	zmm28, zmm16, zmm12, 150
+        vmovdqu64	zmm29, zmm19
+        vpternlogq	zmm29, zmm10, zmm6, 150
+        vpternlogq	zmm29, zmm2, zmm23, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm11, zmm11, 1
+        vprolq	zmm22, zmm22, 62
+        vprolq	zmm8, zmm8, 28
+        vprolq	zmm19, zmm19, 27
+        vprolq	zmm21, zmm21, 36
+        vprolq	zmm7, zmm7, 44
+        vprolq	zmm18, zmm18, 6
+        vprolq	zmm4, zmm4, 55
+        vprolq	zmm10, zmm10, 20
+        vprolq	zmm17, zmm17, 3
+        vprolq	zmm3, zmm3, 10
+        vprolq	zmm14, zmm14, 43
+        vprolq	zmm20, zmm20, 25
+        vprolq	zmm6, zmm6, 39
+        vprolq	zmm13, zmm13, 41
+        vprolq	zmm24, zmm24, 45
+        vprolq	zmm5, zmm5, 15
+        vprolq	zmm16, zmm16, 21
+        vprolq	zmm2, zmm2, 8
+        vprolq	zmm9, zmm9, 18
+        vprolq	zmm15, zmm15, 2
+        vprolq	zmm1, zmm1, 61
+        vprolq	zmm12, zmm12, 56
+        vprolq	zmm23, zmm23, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm7
+        vpternlogq	zmm0, zmm7, zmm14, 210
+        vpternlogq	zmm7, zmm14, zmm16, 210
+        vpternlogq	zmm14, zmm16, zmm23, 210
+        vpternlogq	zmm16, zmm23, zmm30, 210
+        vpternlogq	zmm23, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm8
+        vmovdqu64	zmm31, zmm10
+        vpternlogq	zmm8, zmm10, zmm17, 210
+        vpternlogq	zmm10, zmm17, zmm24, 210
+        vpternlogq	zmm17, zmm24, zmm1, 210
+        vpternlogq	zmm24, zmm1, zmm30, 210
+        vpternlogq	zmm1, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm11
+        vmovdqu64	zmm31, zmm18
+        vpternlogq	zmm11, zmm18, zmm20, 210
+        vpternlogq	zmm18, zmm20, zmm2, 210
+        vpternlogq	zmm20, zmm2, zmm9, 210
+        vpternlogq	zmm2, zmm9, zmm30, 210
+        vpternlogq	zmm9, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm19
+        vmovdqu64	zmm31, zmm21
+        vpternlogq	zmm19, zmm21, zmm3, 210
+        vpternlogq	zmm21, zmm3, zmm5, 210
+        vpternlogq	zmm3, zmm5, zmm12, 210
+        vpternlogq	zmm5, zmm12, zmm30, 210
+        vpternlogq	zmm12, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm22
+        vmovdqu64	zmm31, zmm4
+        vpternlogq	zmm22, zmm4, zmm6, 210
+        vpternlogq	zmm4, zmm6, zmm13, 210
+        vpternlogq	zmm6, zmm13, zmm15, 210
+        vpternlogq	zmm13, zmm15, zmm30, 210
+        vpternlogq	zmm15, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1344]
+        ; Round 22
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm8, zmm11, 150
+        vpternlogq	zmm25, zmm19, zmm22, 150
+        vmovdqu64	zmm26, zmm7
+        vpternlogq	zmm26, zmm10, zmm18, 150
+        vpternlogq	zmm26, zmm21, zmm4, 150
+        vmovdqu64	zmm27, zmm14
+        vpternlogq	zmm27, zmm17, zmm20, 150
+        vpternlogq	zmm27, zmm3, zmm6, 150
+        vmovdqu64	zmm28, zmm16
+        vpternlogq	zmm28, zmm24, zmm2, 150
+        vpternlogq	zmm28, zmm5, zmm13, 150
+        vmovdqu64	zmm29, zmm23
+        vpternlogq	zmm29, zmm1, zmm9, 150
+        vpternlogq	zmm29, zmm12, zmm15, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm14, zmm14, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm15, zmm15, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm7, zmm7, 1
+        vprolq	zmm14, zmm14, 62
+        vprolq	zmm16, zmm16, 28
+        vprolq	zmm23, zmm23, 27
+        vprolq	zmm8, zmm8, 36
+        vprolq	zmm10, zmm10, 44
+        vprolq	zmm17, zmm17, 6
+        vprolq	zmm24, zmm24, 55
+        vprolq	zmm1, zmm1, 20
+        vprolq	zmm11, zmm11, 3
+        vprolq	zmm18, zmm18, 10
+        vprolq	zmm20, zmm20, 43
+        vprolq	zmm2, zmm2, 25
+        vprolq	zmm9, zmm9, 39
+        vprolq	zmm19, zmm19, 41
+        vprolq	zmm21, zmm21, 45
+        vprolq	zmm3, zmm3, 15
+        vprolq	zmm5, zmm5, 21
+        vprolq	zmm12, zmm12, 8
+        vprolq	zmm22, zmm22, 18
+        vprolq	zmm4, zmm4, 2
+        vprolq	zmm6, zmm6, 61
+        vprolq	zmm13, zmm13, 56
+        vprolq	zmm15, zmm15, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm10
+        vpternlogq	zmm0, zmm10, zmm20, 210
+        vpternlogq	zmm10, zmm20, zmm5, 210
+        vpternlogq	zmm20, zmm5, zmm15, 210
+        vpternlogq	zmm5, zmm15, zmm30, 210
+        vpternlogq	zmm15, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm16
+        vmovdqu64	zmm31, zmm1
+        vpternlogq	zmm16, zmm1, zmm11, 210
+        vpternlogq	zmm1, zmm11, zmm21, 210
+        vpternlogq	zmm11, zmm21, zmm6, 210
+        vpternlogq	zmm21, zmm6, zmm30, 210
+        vpternlogq	zmm6, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm7
+        vmovdqu64	zmm31, zmm17
+        vpternlogq	zmm7, zmm17, zmm2, 210
+        vpternlogq	zmm17, zmm2, zmm12, 210
+        vpternlogq	zmm2, zmm12, zmm22, 210
+        vpternlogq	zmm12, zmm22, zmm30, 210
+        vpternlogq	zmm22, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm23
+        vmovdqu64	zmm31, zmm8
+        vpternlogq	zmm23, zmm8, zmm18, 210
+        vpternlogq	zmm8, zmm18, zmm3, 210
+        vpternlogq	zmm18, zmm3, zmm13, 210
+        vpternlogq	zmm3, zmm13, zmm30, 210
+        vpternlogq	zmm13, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm14
+        vmovdqu64	zmm31, zmm24
+        vpternlogq	zmm14, zmm24, zmm9, 210
+        vpternlogq	zmm24, zmm9, zmm19, 210
+        vpternlogq	zmm9, zmm19, zmm4, 210
+        vpternlogq	zmm19, zmm4, zmm30, 210
+        vpternlogq	zmm4, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1408]
+        ; Round 23
+        ; Theta - column parity
+        vmovdqu64	zmm25, zmm0
+        vpternlogq	zmm25, zmm16, zmm7, 150
+        vpternlogq	zmm25, zmm23, zmm14, 150
+        vmovdqu64	zmm26, zmm10
+        vpternlogq	zmm26, zmm1, zmm17, 150
+        vpternlogq	zmm26, zmm8, zmm24, 150
+        vmovdqu64	zmm27, zmm20
+        vpternlogq	zmm27, zmm11, zmm2, 150
+        vpternlogq	zmm27, zmm18, zmm9, 150
+        vmovdqu64	zmm28, zmm5
+        vpternlogq	zmm28, zmm21, zmm12, 150
+        vpternlogq	zmm28, zmm3, zmm19, 150
+        vmovdqu64	zmm29, zmm15
+        vpternlogq	zmm29, zmm6, zmm22, 150
+        vpternlogq	zmm29, zmm13, zmm4, 150
+        ; Theta - D and apply in place
+        vprolq	zmm30, zmm26, 1
+        vpxorq	zmm30, zmm30, zmm29
+        vpxorq	zmm0, zmm0, zmm30
+        vpxorq	zmm16, zmm16, zmm30
+        vpxorq	zmm7, zmm7, zmm30
+        vpxorq	zmm23, zmm23, zmm30
+        vpxorq	zmm14, zmm14, zmm30
+        vprolq	zmm30, zmm27, 1
+        vpxorq	zmm30, zmm30, zmm25
+        vpxorq	zmm10, zmm10, zmm30
+        vpxorq	zmm1, zmm1, zmm30
+        vpxorq	zmm17, zmm17, zmm30
+        vpxorq	zmm8, zmm8, zmm30
+        vpxorq	zmm24, zmm24, zmm30
+        vprolq	zmm30, zmm28, 1
+        vpxorq	zmm30, zmm30, zmm26
+        vpxorq	zmm20, zmm20, zmm30
+        vpxorq	zmm11, zmm11, zmm30
+        vpxorq	zmm2, zmm2, zmm30
+        vpxorq	zmm18, zmm18, zmm30
+        vpxorq	zmm9, zmm9, zmm30
+        vprolq	zmm30, zmm29, 1
+        vpxorq	zmm30, zmm30, zmm27
+        vpxorq	zmm5, zmm5, zmm30
+        vpxorq	zmm21, zmm21, zmm30
+        vpxorq	zmm12, zmm12, zmm30
+        vpxorq	zmm3, zmm3, zmm30
+        vpxorq	zmm19, zmm19, zmm30
+        vprolq	zmm30, zmm25, 1
+        vpxorq	zmm30, zmm30, zmm28
+        vpxorq	zmm15, zmm15, zmm30
+        vpxorq	zmm6, zmm6, zmm30
+        vpxorq	zmm22, zmm22, zmm30
+        vpxorq	zmm13, zmm13, zmm30
+        vpxorq	zmm4, zmm4, zmm30
+        ; Rho - rotate each lane in place
+        vprolq	zmm10, zmm10, 1
+        vprolq	zmm20, zmm20, 62
+        vprolq	zmm5, zmm5, 28
+        vprolq	zmm15, zmm15, 27
+        vprolq	zmm16, zmm16, 36
+        vprolq	zmm1, zmm1, 44
+        vprolq	zmm11, zmm11, 6
+        vprolq	zmm21, zmm21, 55
+        vprolq	zmm6, zmm6, 20
+        vprolq	zmm7, zmm7, 3
+        vprolq	zmm17, zmm17, 10
+        vprolq	zmm2, zmm2, 43
+        vprolq	zmm12, zmm12, 25
+        vprolq	zmm22, zmm22, 39
+        vprolq	zmm23, zmm23, 41
+        vprolq	zmm8, zmm8, 45
+        vprolq	zmm18, zmm18, 15
+        vprolq	zmm3, zmm3, 21
+        vprolq	zmm13, zmm13, 8
+        vprolq	zmm14, zmm14, 18
+        vprolq	zmm24, zmm24, 2
+        vprolq	zmm9, zmm9, 61
+        vprolq	zmm19, zmm19, 56
+        vprolq	zmm4, zmm4, 14
+        ; Pi - relabel logical -> physical
+        ; Chi - per row, in place, fused with vpternlogq (imm 0xd2)
+        vmovdqu64	zmm30, zmm0
+        vmovdqu64	zmm31, zmm1
+        vpternlogq	zmm0, zmm1, zmm2, 210
+        vpternlogq	zmm1, zmm2, zmm3, 210
+        vpternlogq	zmm2, zmm3, zmm4, 210
+        vpternlogq	zmm3, zmm4, zmm30, 210
+        vpternlogq	zmm4, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm5
+        vmovdqu64	zmm31, zmm6
+        vpternlogq	zmm5, zmm6, zmm7, 210
+        vpternlogq	zmm6, zmm7, zmm8, 210
+        vpternlogq	zmm7, zmm8, zmm9, 210
+        vpternlogq	zmm8, zmm9, zmm30, 210
+        vpternlogq	zmm9, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm10
+        vmovdqu64	zmm31, zmm11
+        vpternlogq	zmm10, zmm11, zmm12, 210
+        vpternlogq	zmm11, zmm12, zmm13, 210
+        vpternlogq	zmm12, zmm13, zmm14, 210
+        vpternlogq	zmm13, zmm14, zmm30, 210
+        vpternlogq	zmm14, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm15
+        vmovdqu64	zmm31, zmm16
+        vpternlogq	zmm15, zmm16, zmm17, 210
+        vpternlogq	zmm16, zmm17, zmm18, 210
+        vpternlogq	zmm17, zmm18, zmm19, 210
+        vpternlogq	zmm18, zmm19, zmm30, 210
+        vpternlogq	zmm19, zmm30, zmm31, 210
+        vmovdqu64	zmm30, zmm20
+        vmovdqu64	zmm31, zmm21
+        vpternlogq	zmm20, zmm21, zmm22, 210
+        vpternlogq	zmm21, zmm22, zmm23, 210
+        vpternlogq	zmm22, zmm23, zmm24, 210
+        vpternlogq	zmm23, zmm24, zmm30, 210
+        vpternlogq	zmm24, zmm30, zmm31, 210
+        ; Iota
+        vpxorq	zmm0, zmm0, [rax+1472]
+        vmovdqu64	[rcx], zmm0
+        vmovdqu64	[rcx+64], zmm1
+        vmovdqu64	[rcx+128], zmm2
+        vmovdqu64	[rcx+192], zmm3
+        vmovdqu64	[rcx+256], zmm4
+        vmovdqu64	[rcx+320], zmm5
+        vmovdqu64	[rcx+384], zmm6
+        vmovdqu64	[rcx+448], zmm7
+        vmovdqu64	[rcx+512], zmm8
+        vmovdqu64	[rcx+576], zmm9
+        vmovdqu64	[rcx+640], zmm10
+        vmovdqu64	[rcx+704], zmm11
+        vmovdqu64	[rcx+768], zmm12
+        vmovdqu64	[rcx+832], zmm13
+        vmovdqu64	[rcx+896], zmm14
+        vmovdqu64	[rcx+960], zmm15
+        vmovdqu64	[rcx+1024], zmm16
+        vmovdqu64	[rcx+1088], zmm17
+        vmovdqu64	[rcx+1152], zmm18
+        vmovdqu64	[rcx+1216], zmm19
+        vmovdqu64	[rcx+1280], zmm20
+        vmovdqu64	[rcx+1344], zmm21
+        vmovdqu64	[rcx+1408], zmm22
+        vmovdqu64	[rcx+1472], zmm23
+        vmovdqu64	[rcx+1536], zmm24
+        mov	rbx, rcx
+        mov	rsi, 21
+L_sha3_blocksx8_out_avx512_word:
+        mov	rbp, QWORD PTR [rbx]
+        mov	QWORD PTR [rdx], rbp
+        mov	rbp, QWORD PTR [rbx+8]
+        mov	QWORD PTR [r9], rbp
+        mov	rbp, QWORD PTR [rbx+16]
+        mov	QWORD PTR [r10], rbp
+        mov	rbp, QWORD PTR [rbx+24]
+        mov	QWORD PTR [r11], rbp
+        mov	rbp, QWORD PTR [rbx+32]
+        mov	QWORD PTR [r12], rbp
+        mov	rbp, QWORD PTR [rbx+40]
+        mov	QWORD PTR [r13], rbp
+        mov	rbp, QWORD PTR [rbx+48]
+        mov	QWORD PTR [r14], rbp
+        mov	rbp, QWORD PTR [rbx+56]
+        mov	QWORD PTR [r15], rbp
+        add	rbx, 64
+        add	rdx, 8
+        add	r9, 8
+        add	r10, 8
+        add	r11, 8
+        add	r12, 8
+        add	r13, 8
+        add	r14, 8
+        add	r15, 8
+        sub	rdi, 1
+        jz	L_sha3_blocksx8_out_avx512_done
+        sub	rsi, 1
+        jnz	L_sha3_blocksx8_out_avx512_word
+        jmp	L_sha3_blocksx8_out_avx512_block
+L_sha3_blocksx8_out_avx512_done:
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        vmovdqu	xmm13, OWORD PTR [rsp+112]
+        vmovdqu	xmm14, OWORD PTR [rsp+128]
+        vmovdqu	xmm15, OWORD PTR [rsp+144]
+        add	rsp, 160
+        pop	rbp
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+sha3_blocksx8_out_avx512 ENDP
+_TEXT ENDS
+ENDIF
+ENDIF
 ENDIF
 END
diff --git a/wolfcrypt/src/sp_x86_64_asm.asm b/wolfcrypt/src/sp_x86_64_asm.asm
index 4fcf7b20a9a..7d847de179e 100644
--- a/wolfcrypt/src/sp_x86_64_asm.asm
+++ b/wolfcrypt/src/sp_x86_64_asm.asm
@@ -45883,60 +45883,52 @@ _TEXT ENDS
 IFDEF HAVE_INTEL_AVX2
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_order DWORD \
-     00632551h,  01e84f3bh,  03bce6fah,  03ffffffh,
-     03ff0000h,  00000000h,  00000000h,  00000000h,
-     0272b0bfh,  02b69c5eh,  03ffffffh,  000003ffh,
-     003fffffh,  00000000h,  00000000h,  00000000h
+L_sp256_mod_inv_avx2_4_order DWORD 00632551h, 01e84f3bh, 03bce6fah, 03ffffffh
+        DWORD 03ff0000h, 00000000h, 00000000h, 00000000h
+        DWORD 0272b0bfh, 02b69c5eh, 03ffffffh, 000003ffh
+        DWORD 003fffffh, 00000000h, 00000000h, 00000000h
 ptr_L_sp256_mod_inv_avx2_4_order QWORD L_sp256_mod_inv_avx2_4_order
 _DATA ENDS
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_one QWORD \
-     0000000000000001h,  0000000000000000h,
-     0000000000000000h,  0000000000000000h
+L_sp256_mod_inv_avx2_4_one QWORD 0000000000000001h, 0000000000000000h
+        QWORD 0000000000000000h, 0000000000000000h
 ptr_L_sp256_mod_inv_avx2_4_one QWORD L_sp256_mod_inv_avx2_4_one
 _DATA ENDS
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_all_one DWORD \
-     00000001h,  00000001h,  00000001h,  00000001h,
-     00000001h,  00000001h,  00000001h,  00000001h
+L_sp256_mod_inv_avx2_4_all_one DWORD 00000001h, 00000001h, 00000001h, 00000001h
+        DWORD 00000001h, 00000001h, 00000001h, 00000001h
 ptr_L_sp256_mod_inv_avx2_4_all_one QWORD L_sp256_mod_inv_avx2_4_all_one
 _DATA ENDS
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_mask01111 DWORD \
-     00000000h,  00000001h,  00000001h,  00000001h,
-     00000001h,  00000000h,  00000000h,  00000000h
+L_sp256_mod_inv_avx2_4_mask01111 DWORD 00000000h, 00000001h, 00000001h, 00000001h
+        DWORD 00000001h, 00000000h, 00000000h, 00000000h
 ptr_L_sp256_mod_inv_avx2_4_mask01111 QWORD L_sp256_mod_inv_avx2_4_mask01111
 _DATA ENDS
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_down_one_dword DWORD \
-     00000001h,  00000002h,  00000003h,  00000004h,
-     00000005h,  00000006h,  00000007h,  00000007h
+L_sp256_mod_inv_avx2_4_down_one_dword DWORD 00000001h, 00000002h, 00000003h, 00000004h
+        DWORD 00000005h, 00000006h, 00000007h, 00000007h
 ptr_L_sp256_mod_inv_avx2_4_down_one_dword QWORD L_sp256_mod_inv_avx2_4_down_one_dword
 _DATA ENDS
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_neg DWORD \
-     00000000h,  00000000h,  00000000h,  00000000h,
-     80000000h,  00000000h,  00000000h,  00000000h
+L_sp256_mod_inv_avx2_4_neg DWORD 00000000h, 00000000h, 00000000h, 00000000h
+        DWORD 80000000h, 00000000h, 00000000h, 00000000h
 ptr_L_sp256_mod_inv_avx2_4_neg QWORD L_sp256_mod_inv_avx2_4_neg
 _DATA ENDS
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_up_one_dword DWORD \
-     00000007h,  00000000h,  00000001h,  00000002h,
-     00000003h,  00000007h,  00000007h,  00000007h
+L_sp256_mod_inv_avx2_4_up_one_dword DWORD 00000007h, 00000000h, 00000001h, 00000002h
+        DWORD 00000003h, 00000007h, 00000007h, 00000007h
 ptr_L_sp256_mod_inv_avx2_4_up_one_dword QWORD L_sp256_mod_inv_avx2_4_up_one_dword
 _DATA ENDS
 _DATA SEGMENT
 ALIGN 16
-L_sp256_mod_inv_avx2_4_mask26 DWORD \
-     03ffffffh,  03ffffffh,  03ffffffh,  03ffffffh,
-     03ffffffh,  00000000h,  00000000h,  00000000h
+L_sp256_mod_inv_avx2_4_mask26 DWORD 03ffffffh, 03ffffffh, 03ffffffh, 03ffffffh
+        DWORD 03ffffffh, 00000000h, 00000000h, 00000000h
 ptr_L_sp256_mod_inv_avx2_4_mask26 QWORD L_sp256_mod_inv_avx2_4_mask26
 _DATA ENDS
 ; /* Non-constant time modular inversion.
diff --git a/wolfcrypt/src/wc_frodokem.c b/wolfcrypt/src/wc_frodokem.c
new file mode 100644
index 00000000000..2725d70c1e9
--- /dev/null
+++ b/wolfcrypt/src/wc_frodokem.c
@@ -0,0 +1,1439 @@
+/* wc_frodokem.c
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Reference implementation of FrodoKEM.
+ *
+ * Implementation based on:
+ *   https://www.ietf.org/archive/id/draft-longa-cfrg-frodokem-03.txt
+ *
+ * Matrix A is generated using SHAKE128 (Section 6.7.2 of the draft) and the
+ * hashing function SHAKE is SHAKE128 for FrodoKEM-640 and SHAKE256 for
+ * FrodoKEM-976 and FrodoKEM-1344 (Table 1).  The "standard" (salted) FrodoKEM
+ * variants are implemented.
+ *
+ * The API mirrors the wolfCrypt ML-KEM API (see wc_mlkem.c), using FrodoKem in
+ * the names in place of MlKem.
+ */
+
+#define _WC_BUILDING_WC_FRODOKEM_C
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
+
+#include <wolfssl/wolfcrypt/wc_frodokem_mat.h>
+#include <wolfssl/wolfcrypt/hash.h>
+#include <wolfssl/wolfcrypt/memory.h>
+
+#ifdef NO_INLINE
+    #include <wolfssl/wolfcrypt/misc.h>
+#else
+    #define WOLFSSL_MISC_INCLUDED
+    #include <wolfcrypt/src/misc.c>
+#endif
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+
+/* Domain separator prepended to seedSE when generating key generation noise. */
+#define FRODOKEM_DOMAIN_KEYGEN  0x5F
+/* Domain separator prepended to seedSE when generating encapsulation noise. */
+#define FRODOKEM_DOMAIN_ENCAPS  0x96
+
+/******************************************************************************/
+/* Parameter sets.                                                            */
+/******************************************************************************/
+
+#ifdef WOLFSSL_WC_FRODOKEM_640
+/* CDF table for FrodoKEM-640 (Table 5). */
+static const word16 frodokem_cdf_640[] = {
+    4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745,
+    32762, 32766, 32767
+};
+#endif
+
+#ifdef WOLFSSL_WC_FRODOKEM_976
+/* CDF table for FrodoKEM-976 (Table 5). */
+static const word16 frodokem_cdf_976[] = {
+    5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767
+};
+#endif
+
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+/* CDF table for FrodoKEM-1344 (Table 5). */
+static const word16 frodokem_cdf_1344[] = {
+    9142, 23462, 30338, 32361, 32725, 32765, 32767
+};
+#endif
+
+/* Constant parameter sets.
+ *
+ * FrodoKemParams field order:
+ *   n, d, qMask, b, cdf, cdfLen, lenSec, useShake256, pkSize, skSize,
+ *   lenSE, lenSalt, ctSize, useAes
+ * A base macro supplies the fields common to all variants of a parameter set
+ * (through skSize); the per-type initializer appends lenSE, lenSalt, ctSize and
+ * useAes. Standard FrodoKEM uses lenSE = lenSalt = 2 * lenSec and a salted
+ * ciphertext; eFrodoKEM (ephemeral) uses lenSE = lenSec and no salt.
+ */
+#ifdef WOLFSSL_WC_FRODOKEM_640
+#define FRODOKEM_BASE_640 \
+    WC_FRODOKEM_640_N, WC_FRODOKEM_640_D, 0x7FFF, 2, frodokem_cdf_640, \
+    (int)(sizeof(frodokem_cdf_640) / sizeof(frodokem_cdf_640[0])), \
+    WC_FRODOKEM_640_LENSEC, 0, \
+    WC_FRODOKEM_640_PUBLIC_KEY_SIZE, WC_FRODOKEM_640_PRIVATE_KEY_SIZE
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+static const FrodoKemParams frodokem_p_640_shake =
+    { FRODOKEM_BASE_640, WC_FRODOKEM_640_LENSE, WC_FRODOKEM_640_LENSALT,
+      WC_FRODOKEM_640_CIPHER_TEXT_SIZE, 0 };
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+static const FrodoKemParams frodokem_ep_640_shake =
+    { FRODOKEM_BASE_640, WC_FRODOKEM_640_LENSEC, 0,
+      FRODOKEM_CT_SZ(WC_FRODOKEM_640_N, WC_FRODOKEM_640_D, 0), 0 };
+#endif
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+static const FrodoKemParams frodokem_p_640_aes =
+    { FRODOKEM_BASE_640, WC_FRODOKEM_640_LENSE, WC_FRODOKEM_640_LENSALT,
+      WC_FRODOKEM_640_CIPHER_TEXT_SIZE, 1 };
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+static const FrodoKemParams frodokem_ep_640_aes =
+    { FRODOKEM_BASE_640, WC_FRODOKEM_640_LENSEC, 0,
+      FRODOKEM_CT_SZ(WC_FRODOKEM_640_N, WC_FRODOKEM_640_D, 0), 1 };
+#endif
+#endif
+#endif /* WOLFSSL_WC_FRODOKEM_640 */
+
+#ifdef WOLFSSL_WC_FRODOKEM_976
+#define FRODOKEM_BASE_976 \
+    WC_FRODOKEM_976_N, WC_FRODOKEM_976_D, 0xFFFF, 3, frodokem_cdf_976, \
+    (int)(sizeof(frodokem_cdf_976) / sizeof(frodokem_cdf_976[0])), \
+    WC_FRODOKEM_976_LENSEC, 1, \
+    WC_FRODOKEM_976_PUBLIC_KEY_SIZE, WC_FRODOKEM_976_PRIVATE_KEY_SIZE
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+static const FrodoKemParams frodokem_p_976_shake =
+    { FRODOKEM_BASE_976, WC_FRODOKEM_976_LENSE, WC_FRODOKEM_976_LENSALT,
+      WC_FRODOKEM_976_CIPHER_TEXT_SIZE, 0 };
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+static const FrodoKemParams frodokem_ep_976_shake =
+    { FRODOKEM_BASE_976, WC_FRODOKEM_976_LENSEC, 0,
+      FRODOKEM_CT_SZ(WC_FRODOKEM_976_N, WC_FRODOKEM_976_D, 0), 0 };
+#endif
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+static const FrodoKemParams frodokem_p_976_aes =
+    { FRODOKEM_BASE_976, WC_FRODOKEM_976_LENSE, WC_FRODOKEM_976_LENSALT,
+      WC_FRODOKEM_976_CIPHER_TEXT_SIZE, 1 };
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+static const FrodoKemParams frodokem_ep_976_aes =
+    { FRODOKEM_BASE_976, WC_FRODOKEM_976_LENSEC, 0,
+      FRODOKEM_CT_SZ(WC_FRODOKEM_976_N, WC_FRODOKEM_976_D, 0), 1 };
+#endif
+#endif
+#endif /* WOLFSSL_WC_FRODOKEM_976 */
+
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+#define FRODOKEM_BASE_1344 \
+    WC_FRODOKEM_1344_N, WC_FRODOKEM_1344_D, 0xFFFF, 4, frodokem_cdf_1344, \
+    (int)(sizeof(frodokem_cdf_1344) / sizeof(frodokem_cdf_1344[0])), \
+    WC_FRODOKEM_1344_LENSEC, 1, \
+    WC_FRODOKEM_1344_PUBLIC_KEY_SIZE, WC_FRODOKEM_1344_PRIVATE_KEY_SIZE
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+static const FrodoKemParams frodokem_p_1344_shake =
+    { FRODOKEM_BASE_1344, WC_FRODOKEM_1344_LENSE, WC_FRODOKEM_1344_LENSALT,
+      WC_FRODOKEM_1344_CIPHER_TEXT_SIZE, 0 };
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+static const FrodoKemParams frodokem_ep_1344_shake =
+    { FRODOKEM_BASE_1344, WC_FRODOKEM_1344_LENSEC, 0,
+      FRODOKEM_CT_SZ(WC_FRODOKEM_1344_N, WC_FRODOKEM_1344_D, 0), 0 };
+#endif
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+static const FrodoKemParams frodokem_p_1344_aes =
+    { FRODOKEM_BASE_1344, WC_FRODOKEM_1344_LENSE, WC_FRODOKEM_1344_LENSALT,
+      WC_FRODOKEM_1344_CIPHER_TEXT_SIZE, 1 };
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+static const FrodoKemParams frodokem_ep_1344_aes =
+    { FRODOKEM_BASE_1344, WC_FRODOKEM_1344_LENSEC, 0,
+      FRODOKEM_CT_SZ(WC_FRODOKEM_1344_N, WC_FRODOKEM_1344_D, 0), 1 };
+#endif
+#endif
+#endif /* WOLFSSL_WC_FRODOKEM_1344 */
+
+/* Get the constant parameters for a key type.
+ *
+ * A type is a base parameter set (WC_FRODOKEM_640/976/1344) optionally OR'd
+ * with FRODOKEM_AES (AES-128 matrix A) and/or FRODOKEM_EPHEMERAL (eFrodoKEM).
+ *
+ * @param  [in]  type  Type of key.
+ * @return  Pointer to the constant parameters, or NULL when the type or a
+ *          requested modifier is not compiled in.
+ */
+static const FrodoKemParams* frodokem_get_params(int type)
+{
+    const FrodoKemParams* p = NULL;
+
+    switch (type) {
+#ifdef WOLFSSL_WC_FRODOKEM_640
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+    case WC_FRODOKEM_640_SHAKE:
+        p = &frodokem_p_640_shake;
+        break;
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+    case WC_EFRODOKEM_640_SHAKE:
+        p = &frodokem_ep_640_shake;
+        break;
+#endif
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+    case WC_FRODOKEM_640_AES:
+        p = &frodokem_p_640_aes;
+        break;
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+    case WC_EFRODOKEM_640_AES:
+        p = &frodokem_ep_640_aes;
+        break;
+#endif
+#endif
+#endif /* WOLFSSL_WC_FRODOKEM_640 */
+#ifdef WOLFSSL_WC_FRODOKEM_976
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+    case WC_FRODOKEM_976_SHAKE:
+        p = &frodokem_p_976_shake;
+        break;
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+    case WC_EFRODOKEM_976_SHAKE:
+        p = &frodokem_ep_976_shake;
+        break;
+#endif
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+    case WC_FRODOKEM_976_AES:
+        p = &frodokem_p_976_aes;
+        break;
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+    case WC_EFRODOKEM_976_AES:
+        p = &frodokem_ep_976_aes;
+        break;
+#endif
+#endif
+#endif /* WOLFSSL_WC_FRODOKEM_976 */
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+    case WC_FRODOKEM_1344_SHAKE:
+        p = &frodokem_p_1344_shake;
+        break;
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+    case WC_EFRODOKEM_1344_SHAKE:
+        p = &frodokem_ep_1344_shake;
+        break;
+#endif
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+    case WC_FRODOKEM_1344_AES:
+        p = &frodokem_p_1344_aes;
+        break;
+#ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+    case WC_EFRODOKEM_1344_AES:
+        p = &frodokem_ep_1344_aes;
+        break;
+#endif
+#endif
+#endif /* WOLFSSL_WC_FRODOKEM_1344 */
+    default:
+        break;
+    }
+
+    return p;
+}
+
+/******************************************************************************/
+/* Key object management.                                                     */
+/******************************************************************************/
+
+#ifndef WC_NO_CONSTRUCTORS
+/* Create a new FrodoKEM key object.
+ *
+ * @param  [in]  type   Type of key.
+ * @param  [in]  heap   Dynamic memory hint.
+ * @param  [in]  devId  Device Id.
+ * @return  Pointer to new FrodoKemKey object on success.
+ * @return  NULL on failure.
+ */
+FrodoKemKey* wc_FrodoKemKey_New(int type, void* heap, int devId)
+{
+    int ret;
+    FrodoKemKey* key;
+
+    key = (FrodoKemKey*)XMALLOC(sizeof(FrodoKemKey), heap,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    if (key != NULL) {
+        ret = wc_FrodoKemKey_Init(key, type, heap, devId);
+        if (ret != 0) {
+            XFREE(key, heap, DYNAMIC_TYPE_TMP_BUFFER);
+            key = NULL;
+        }
+    }
+
+    return key;
+}
+
+/* Delete and free a FrodoKEM key object.
+ *
+ * @param  [in]       key    FrodoKEM key object to delete.
+ * @param  [in, out]  key_p  Pointer to key pointer to set to NULL.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key is NULL.
+ */
+int wc_FrodoKemKey_Delete(FrodoKemKey* key, FrodoKemKey** key_p)
+{
+    int ret = 0;
+
+    if (key == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        void* heap = key->heap;
+
+        wc_FrodoKemKey_Free(key);
+        XFREE(key, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (key_p != NULL) {
+            *key_p = NULL;
+        }
+    }
+
+    return ret;
+}
+#endif /* !WC_NO_CONSTRUCTORS */
+
+/* Initialize the FrodoKEM key.
+ *
+ * @param  [out]  key    FrodoKEM key object to initialize.
+ * @param  [in]   type   Type of key.
+ * @param  [in]   heap   Dynamic memory hint.
+ * @param  [in]   devId  Device Id.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key is NULL or type has invalid bits set.
+ * @return  NOT_COMPILED_IN when the key type is not compiled in.
+ */
+int wc_FrodoKemKey_Init(FrodoKemKey* key, int type, void* heap, int devId)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+
+    if (key == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    /* Reject types with bits outside the known base and modifier ranges. */
+    else if ((type & ~(FRODOKEM_BASE_MASK | FRODOKEM_AES | FRODOKEM_EPHEMERAL))
+            != 0) {
+        ret = BAD_FUNC_ARG;
+    }
+    /* Reject undefined base parameter sets: only 640/976/1344 exist, so a base
+     * value above WC_FRODOKEM_1344 is a bad argument, not a disabled feature. */
+    else if ((type & FRODOKEM_BASE_MASK) > WC_FRODOKEM_1344) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        /* Resolve the constant parameters. NULL means the base parameter set
+         * or a requested modifier (AES / ephemeral) is not compiled in. */
+        p = frodokem_get_params(type);
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+    }
+
+    if (ret == 0) {
+        XMEMSET(key, 0, sizeof(*key));
+        key->type = type;
+        key->params = p;
+        key->heap = heap;
+        key->devId = devId;
+        key->flags = 0;
+
+        /* Cache CPU feature flags for SIMD dispatch in matrix-A generation. */
+        frodokem_init();
+
+        /* Initialize the reusable SHAKE object. Init is variant-agnostic and
+         * the hashing/matrix-A helpers re-initialize it as SHAKE-128 or -256
+         * as needed, so the always-present SHAKE-128 init is used here. */
+        ret = wc_InitShake128(&key->shake, NULL, INVALID_DEVID);
+#ifdef WOLFSSL_FRODOKEM_AES
+        /* Initialize the reusable AES object; re-keyed with seedA per op. */
+        if (ret == 0) {
+            ret = wc_AesInit(&key->aes, heap, INVALID_DEVID);
+            if (ret != 0) {
+                /* Free the SHAKE state so a caller that treats an Init failure
+                 * as needing no cleanup does not leak it. */
+                wc_Shake128_Free(&key->shake);
+            }
+        }
+#endif
+    }
+
+    return ret;
+}
+
+/* Free the FrodoKEM key.
+ *
+ * Zeroizes secret material.
+ *
+ * @param  [in, out]  key  FrodoKEM key object.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key is NULL.
+ */
+int wc_FrodoKemKey_Free(FrodoKemKey* key)
+{
+    int ret = 0;
+
+    if (key == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        /* Zeroize secret material. */
+        ForceZero(key->s, sizeof(key->s));
+        ForceZero(key->sMat, sizeof(key->sMat));
+        ForceZero(key->pkh, sizeof(key->pkh));
+        /* Free the reusable SHAKE object (zeroizes its state). Free is variant
+         * agnostic; SHAKE-128 is always compiled in, so use it. */
+        wc_Shake128_Free(&key->shake);
+#ifdef WOLFSSL_FRODOKEM_AES
+        /* Free the reusable AES object (zeroizes its key schedule). */
+        wc_AesFree(&key->aes);
+#endif
+        key->flags = 0;
+    }
+
+    return ret;
+}
+
+/******************************************************************************/
+/* Sizes.                                                                     */
+/******************************************************************************/
+
+/* Get the size in bytes of the ciphertext.
+ *
+ * @param  [in]   key  FrodoKEM key object.
+ * @param  [out]  len  Ciphertext size in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or len is NULL.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ */
+int wc_FrodoKemKey_CipherTextSize(const FrodoKemKey* key, word32* len)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+
+    if ((key == NULL) || (len == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+    }
+
+    if (ret == 0) {
+        *len = (word32)p->ctSize;
+    }
+
+    return ret;
+}
+
+/* Get the size in bytes of the shared secret.
+ *
+ * @param  [in]   key  FrodoKEM key object.
+ * @param  [out]  len  Shared secret size in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or len is NULL.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ */
+int wc_FrodoKemKey_SharedSecretSize(const FrodoKemKey* key, word32* len)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+
+    if ((key == NULL) || (len == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+    }
+
+    if (ret == 0) {
+        *len = (word32)p->lenSec;
+    }
+
+    return ret;
+}
+
+/* Get the size in bytes of an encoded private key.
+ *
+ * @param  [in]   key  FrodoKEM key object.
+ * @param  [out]  len  Private key size in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or len is NULL.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ */
+int wc_FrodoKemKey_PrivateKeySize(const FrodoKemKey* key, word32* len)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+
+    if ((key == NULL) || (len == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+    }
+
+    if (ret == 0) {
+        *len = (word32)p->skSize;
+    }
+
+    return ret;
+}
+
+/* Get the size in bytes of an encoded public key.
+ *
+ * @param  [in]   key  FrodoKEM key object.
+ * @param  [out]  len  Public key size in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or len is NULL.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ */
+int wc_FrodoKemKey_PublicKeySize(const FrodoKemKey* key, word32* len)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+
+    if ((key == NULL) || (len == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+    }
+
+    if (ret == 0) {
+        *len = (word32)p->pkSize;
+    }
+
+    return ret;
+}
+
+/* Wipe the secret-derived Keccak state retained in the reusable SHAKE object
+ * after an operation.
+ *
+ * Encapsulation and decapsulation finish by hashing the shared-secret key
+ * material, leaving it in the reusable SHAKE state until the next use. Every
+ * SHAKE use re-initializes the object first, so re-initializing here zeroizes
+ * that residue (InitSha3 clears the state) and leaves it ready. Best-effort: an
+ * init failure is not propagated as the object is re-initialized on next use.
+ *
+ * @param  [in, out]  key  FrodoKEM key object whose SHAKE state is wiped.
+ */
+static void frodokem_wipe_shake(FrodoKemKey* key)
+{
+    if (key != NULL) {
+        (void)wc_InitShake128(&key->shake, NULL, INVALID_DEVID);
+    }
+}
+
+/******************************************************************************/
+/* Key generation.                                                            */
+/******************************************************************************/
+
+#ifndef WOLFSSL_FRODOKEM_NO_MAKE_KEY
+
+/* Make a FrodoKEM key object using random data.
+ *
+ * Implements FrodoKEM.KeyGenInternal(s, seedSE, z).  The random data is the
+ * concatenation s || seedSE || z.
+ *
+ * @param  [in, out]  key   FrodoKEM key object.
+ * @param  [in]       rand  Random data.
+ * @param  [in]       len   Length of random data in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or rand is NULL.
+ * @return  BUFFER_E when len is not the expected size.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ * @return  MEMORY_E when dynamic memory allocation failed.
+ */
+int wc_FrodoKemKey_MakeKeyWithRandom(FrodoKemKey* key,
+    const unsigned char* rand, int len)
+{
+    const FrodoKemParams* p = NULL;
+    int ret = 0;
+    int n = 0;
+    void* heap = NULL;
+    const byte* seedSE;
+    const byte* z;
+    /* One buffer holds E (B computed in place over it), a scratch slot of
+     * FRODOKEM_ROW_MULT A-rows for on-the-fly matrix-A generation, and seInput
+     * (the domain-prefixed seed) in a trailing byte region. */
+    word16* bMat = NULL;
+    word16* row = NULL;
+    byte* seInput = NULL;
+
+    if ((key == NULL) || (rand == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+        else if (len != p->lenSec + p->lenSE + FRODOKEM_SEEDA_SZ) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        n = p->n;
+        heap = key->heap;
+        seedSE = rand + p->lenSec;
+        z = rand + p->lenSec + p->lenSE;
+
+        /* Store s (implicit rejection value). */
+        XMEMCPY(key->s, rand, (size_t)p->lenSec);
+
+        /* seedA = SHAKE(z, lenA). */
+        ret = frodokem_shake_seeda(p, &key->shake, z, key->seedA);
+    }
+    if (ret == 0) {
+        bMat = (word16*)XMALLOC(
+            (size_t)(n * FRODOKEM_NBAR + FRODOKEM_ROW_MULT * n) *
+                sizeof(word16) + (size_t)(1 + p->lenSE),
+            heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (bMat == NULL) {
+            ret = MEMORY_E;
+        }
+        else {
+            row = bMat + n * FRODOKEM_NBAR;
+            /* seInput (domain || seedSE) follows the word16 arena. */
+            seInput = (byte*)(bMat + n * FRODOKEM_NBAR +
+                FRODOKEM_ROW_MULT * n);
+        }
+    }
+
+    if (ret == 0) {
+        /* Generate and sample S^T (nbar x n) into key->sMat and E (n x nbar)
+         * into bMat (separate buffers) from SHAKE(0x5F || seedSE). Assemble the
+         * domain-prefixed seed; the row scratch is free here, so use it as the
+         * SHAKE block scratch. */
+        seInput[0] = FRODOKEM_DOMAIN_KEYGEN;
+        XMEMCPY(seInput + 1, seedSE, (size_t)p->lenSE);
+        ret = frodokem_gen_noise(p, &key->shake, seInput, (byte*)row,
+            key->sMat, FRODOKEM_NBAR * n, bMat, n * FRODOKEM_NBAR);
+    }
+    if (ret == 0) {
+        /* B = A * S + E, accumulated in place over E in bMat. */
+        ret = frodokem_mul_add_as_plus_e(key, bMat, key->sMat, row);
+    }
+    if (ret == 0) {
+        /* b = Pack(B, n, nbar). */
+        frodokem_pack(key->b, bMat, n * FRODOKEM_NBAR, p->d);
+        /* pkh = SHAKE(pk, lensec). seedA and b are contiguous in the key so
+         * the public key is a single buffer of length pkSize. */
+        ret = frodokem_shake_oneshot(p, &key->shake, key->seedA,
+            (word32)p->pkSize, key->pkh, (word32)p->lenSec);
+    }
+    if (ret == 0) {
+        key->flags |= FRODOKEM_FLAG_PRIV_SET | FRODOKEM_FLAG_PUB_SET |
+            FRODOKEM_FLAG_PKH_SET;
+    }
+
+    /* bMat held the secret error matrix E and the seed (in seInput), so
+     * zeroize it before freeing. */
+    if (bMat != NULL) {
+        ForceZero(bMat,
+            (word32)(n * FRODOKEM_NBAR + FRODOKEM_ROW_MULT * n) *
+                sizeof(word16) + (word32)(1 + p->lenSE));
+        XFREE(bMat, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+
+    /* Wipe secret-derived residue from the reusable SHAKE state. */
+    frodokem_wipe_shake(key);
+
+    return ret;
+}
+
+/* Make a FrodoKEM key object using a random number generator.
+ *
+ * @param  [in, out]  key  FrodoKEM key object.
+ * @param  [in]       rng  Random number generator.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or rng is NULL.
+ * @return  NOT_COMPILED_IN when no RNG is compiled in or key type unsupported.
+ * @return  MEMORY_E when dynamic memory allocation fails.
+ */
+int wc_FrodoKemKey_MakeKey(FrodoKemKey* key, WC_RNG* rng)
+{
+    int ret = 0;
+#ifndef WC_NO_RNG
+    const FrodoKemParams* p = NULL;
+    int randLen = 0;
+#ifdef WOLFSSL_SMALL_STACK
+    byte* rand = NULL;
+#else
+    byte rand[WC_FRODOKEM_1344_MAKEKEY_RAND_SZ];
+#endif
+
+    if ((key == NULL) || (rng == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+    }
+
+    if (ret == 0) {
+        randLen = p->lenSec + p->lenSE + FRODOKEM_SEEDA_SZ;
+    }
+#ifdef WOLFSSL_SMALL_STACK
+    /* Keep the random data off the stack. */
+    if (ret == 0) {
+        rand = (byte*)XMALLOC((size_t)randLen, key->heap,
+            DYNAMIC_TYPE_TMP_BUFFER);
+        if (rand == NULL) {
+            ret = MEMORY_E;
+        }
+    }
+#endif
+    if (ret == 0) {
+        ret = wc_RNG_GenerateBlock(rng, rand, (word32)randLen);
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_MakeKeyWithRandom(key, rand, randLen);
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    if (rand != NULL) {
+        ForceZero(rand, (word32)randLen);
+        XFREE(rand, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+#else
+    ForceZero(rand, sizeof(rand));
+#endif
+#else
+    (void)key;
+    (void)rng;
+    ret = NOT_COMPILED_IN;
+#endif
+    return ret;
+}
+#endif /* !WOLFSSL_FRODOKEM_NO_MAKE_KEY */
+
+/******************************************************************************/
+/* Encapsulation.                                                             */
+/******************************************************************************/
+
+#ifndef WOLFSSL_FRODOKEM_NO_ENCAPSULATE
+
+/* Encapsulate to a FrodoKEM public key using random data.
+ *
+ * Implements FrodoKEM.Encaps with the random data being u || salt.
+ *
+ * @param  [in]   key   FrodoKEM key object with public key set.
+ * @param  [out]  ct    Ciphertext.
+ * @param  [out]  ss    Shared secret.
+ * @param  [in]   rand  Random data (u || salt).
+ * @param  [in]   len   Length of random data in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when a pointer is NULL.
+ * @return  BUFFER_E when len is not the expected size.
+ * @return  BAD_STATE_E when public key is not set.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ * @return  MEMORY_E when dynamic memory allocation failed.
+ */
+int wc_FrodoKemKey_EncapsulateWithRandom(FrodoKemKey* key, unsigned char* ct,
+    unsigned char* ss, const unsigned char* rand, int len)
+{
+    const FrodoKemParams* p = NULL;
+    int ret = 0;
+    int n = 0;
+    int nn = FRODOKEM_NBAR_SQ;
+    void* heap = NULL;
+    const byte* u;
+    const byte* salt;
+    byte* c1;
+    byte* c2;
+    byte* saltOut;
+    /* One arena holds S' (nbar x n), a reused slot (E' -> B' -> B) (nbar x n)
+     * and E'' (nbar x nbar), contiguous so their noise is one region, plus a
+     * FRODOKEM_ROW_MULT-row scratch slot for matrix-A generation. */
+    word16* mat = NULL;
+    word16* sp = NULL;
+    word16* work = NULL;
+    word16* epp = NULL;
+    word16* row = NULL;
+#ifdef WOLFSSL_SMALL_STACK
+    /* seedSEk and pkh are carved from the mat allocation to keep them off the
+     * stack. */
+    byte* seedSEk = NULL;
+    byte* pkh = NULL;
+#else
+    byte seedSEk[1 + FRODOKEM_MAX_LENSE + FRODOKEM_MAX_LENSEC];
+    byte pkh[FRODOKEM_MAX_LENSEC];
+#endif
+    byte* kVal;
+    size_t matSz = 0;
+
+    if ((key == NULL) || (ct == NULL) || (ss == NULL) || (rand == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+        else if ((key->flags & FRODOKEM_FLAG_PUB_SET) == 0) {
+            ret = BAD_STATE_E;
+        }
+        else if (len != p->lenSec + p->lenSalt) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        n = p->n;
+        heap = key->heap;
+        u = rand;
+        salt = rand + p->lenSec;
+        c1 = ct;
+        c2 = ct + (p->d * n);
+        saltOut = ct + (p->d * n) + (p->d * FRODOKEM_NBAR);
+
+        matSz = (size_t)(2 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ +
+            FRODOKEM_ROW_MULT * n) * sizeof(word16);
+#ifdef WOLFSSL_SMALL_STACK
+        /* seedSEk (1 + lenSE + lenSec) and pkh (lenSec) follow the arena. */
+        matSz += (size_t)(1 + p->lenSE + 2 * p->lenSec);
+#endif
+        mat = (word16*)XMALLOC(matSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (mat == NULL) {
+            ret = MEMORY_E;
+        }
+        else {
+            sp = mat;
+            work = mat + FRODOKEM_NBAR * n;
+            epp = mat + 2 * FRODOKEM_NBAR * n;
+            row = mat + 2 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ;
+#ifdef WOLFSSL_SMALL_STACK
+            seedSEk = (byte*)(mat + 2 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ +
+                FRODOKEM_ROW_MULT * n);
+            pkh = seedSEk + (1 + p->lenSE + p->lenSec);
+#endif
+        }
+    }
+
+    if (ret == 0) {
+        /* pkh = SHAKE(pk, lensec). seedA and b are contiguous in the key so
+         * the public key is a single buffer of length pkSize. */
+        ret = frodokem_shake_oneshot(p, &key->shake, key->seedA,
+            (word32)p->pkSize, pkh, (word32)p->lenSec);
+    }
+    if (ret == 0) {
+        /* seedSEk = domain || seedSE || k: the leading byte is the noise domain
+         * and seedSE || k = SHAKE(pkh || u || salt, lenSE + lensec) is written
+         * after it. rand is the message u || salt, one contiguous buffer. */
+        seedSEk[0] = FRODOKEM_DOMAIN_ENCAPS;
+        ret = frodokem_gen_seedse_k(p, &key->shake, pkh, rand, seedSEk + 1);
+    }
+    if (ret == 0) {
+        kVal = seedSEk + 1 + p->lenSE;
+
+        /* Generate and sample S' | E' | E'' from SHAKE(domain || seedSE). The
+         * three are contiguous from sp, so they form a single noise region. The
+         * row scratch is free here, so use it as the SHAKE block scratch. */
+        ret = frodokem_gen_noise(p, &key->shake, seedSEk, (byte*)row,
+            sp, 2 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ, NULL, 0);
+    }
+    if (ret == 0) {
+        /* B' = S' * A + E', accumulated in place over E' in work. */
+        ret = frodokem_mul_add_sa_plus_e(key, work, sp, row);
+    }
+    if (ret == 0) {
+        /* c1 = Pack(B', nbar, n). */
+        frodokem_pack(c1, work, FRODOKEM_NBAR * n, p->d);
+        /* B' no longer needed: reuse work for B = Unpack(b, n, nbar). */
+        frodokem_unpack(work, key->b, n * FRODOKEM_NBAR, p->d);
+        /* V = S' * B + E'', accumulated in place over E'' in epp. */
+        frodokem_mul_add_sb_plus_e(epp, work, sp, p->n, (int)p->qMask);
+        /* C = V + Encode(u). B is finished, so reuse work for Encode(u). */
+        frodokem_key_encode(work, u, p->d, p->b);
+        frodokem_add(epp, work, (int)p->qMask);
+        /* c2 = Pack(C, nbar, nbar). */
+        frodokem_pack(c2, epp, nn, p->d);
+        /* salt is appended to the ciphertext. */
+        XMEMCPY(saltOut, salt, (size_t)p->lenSalt);
+
+        /* ss = SHAKE(c1 || c2 || salt || k, lensec). c1 || c2 || salt is the
+         * leading part of ct. */
+        ret = frodokem_shake(p, &key->shake, ct,
+            (word32)((p->d * n) + (p->d * FRODOKEM_NBAR) + p->lenSalt),
+            kVal, (word32)p->lenSec, ss, (word32)p->lenSec);
+    }
+
+#ifndef WOLFSSL_SMALL_STACK
+    ForceZero(pkh, sizeof(pkh));
+    ForceZero(seedSEk, sizeof(seedSEk));
+#endif
+    /* Encode(u), V/E'' and B' live in mat (as do seedSEk and pkh under small
+     * stack), all zeroized on free below. */
+    if (mat != NULL) {
+        ForceZero(mat, (word32)matSz);
+        XFREE(mat, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+
+    /* Wipe secret-derived residue from the reusable SHAKE state. */
+    frodokem_wipe_shake(key);
+
+    return ret;
+}
+
+/* Encapsulate to a FrodoKEM public key using a random number generator.
+ *
+ * @param  [in]   key  FrodoKEM key object with public key set.
+ * @param  [out]  ct   Ciphertext.
+ * @param  [out]  ss   Shared secret.
+ * @param  [in]   rng  Random number generator.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when a pointer is NULL.
+ * @return  NOT_COMPILED_IN when no RNG is compiled in or key type unsupported.
+ * @return  MEMORY_E when dynamic memory allocation fails.
+ */
+int wc_FrodoKemKey_Encapsulate(FrodoKemKey* key, unsigned char* ct,
+    unsigned char* ss, WC_RNG* rng)
+{
+    int ret = 0;
+#ifndef WC_NO_RNG
+    const FrodoKemParams* p = NULL;
+    int randLen = 0;
+#ifdef WOLFSSL_SMALL_STACK
+    byte* rand = NULL;
+#else
+    byte rand[WC_FRODOKEM_1344_ENC_RAND_SZ];
+#endif
+
+    if ((key == NULL) || (ct == NULL) || (ss == NULL) || (rng == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+    }
+
+    if (ret == 0) {
+        randLen = p->lenSec + p->lenSalt;
+    }
+#ifdef WOLFSSL_SMALL_STACK
+    /* Keep the random data off the stack. */
+    if (ret == 0) {
+        rand = (byte*)XMALLOC((size_t)randLen, key->heap,
+            DYNAMIC_TYPE_TMP_BUFFER);
+        if (rand == NULL) {
+            ret = MEMORY_E;
+        }
+    }
+#endif
+    if (ret == 0) {
+        ret = wc_RNG_GenerateBlock(rng, rand, (word32)randLen);
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, rand, randLen);
+    }
+
+#ifdef WOLFSSL_SMALL_STACK
+    if (rand != NULL) {
+        ForceZero(rand, (word32)randLen);
+        XFREE(rand, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+#else
+    ForceZero(rand, sizeof(rand));
+#endif
+#else
+    (void)key;
+    (void)ct;
+    (void)ss;
+    (void)rng;
+    ret = NOT_COMPILED_IN;
+#endif
+    return ret;
+}
+#endif /* !WOLFSSL_FRODOKEM_NO_ENCAPSULATE */
+
+/******************************************************************************/
+/* Decapsulation.                                                             */
+/******************************************************************************/
+
+#ifndef WOLFSSL_FRODOKEM_NO_DECAPSULATE
+/* Decapsulate a FrodoKEM ciphertext.
+ *
+ * Implements FrodoKEM.Decaps with implicit rejection.
+ *
+ * @param  [in]   key  FrodoKEM key object with private key set.
+ * @param  [out]  ss   Shared secret.
+ * @param  [in]   ct   Ciphertext.
+ * @param  [in]   len  Length of ciphertext in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when a pointer is NULL.
+ * @return  BUFFER_E when len is not the expected size.
+ * @return  BAD_STATE_E when private key is not set.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ * @return  MEMORY_E when dynamic memory allocation failed.
+ */
+int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
+    const unsigned char* ct, word32 len)
+{
+    const FrodoKemParams* p = NULL;
+    int ret = 0;
+    int n = 0;
+    int i;
+    int nn = FRODOKEM_NBAR_SQ;
+    void* heap = NULL;
+    const byte* c1;
+    const byte* c2;
+    const byte* salt;
+    /* Arena: B' (kept for compare), then S' | E'(-> B'' -> B) | E'' contiguous
+     * so their noise is one region, plus a FRODOKEM_ROW_MULT-row scratch slot
+     * for matrix-A generation. */
+    word16* mat = NULL;
+    word16* bpIn = NULL;
+    word16* sp = NULL;
+    word16* work = NULL;
+    word16* epp = NULL;
+    word16* row = NULL;
+    /* uSalt holds the decoded u' followed by a copy of the ciphertext salt, so
+     * u' || salt is contiguous for gen_seedse_k. */
+#ifdef WOLFSSL_SMALL_STACK
+    /* cIn, v, cEnc, seedSEk and uSalt are carved from the mat allocation to
+     * keep them off the stack. */
+    word16* cIn = NULL;
+    word16* v = NULL;
+    word16* cEnc = NULL;
+    byte* seedSEk = NULL;
+    byte* uSalt = NULL;
+#else
+    byte seedSEk[1 + FRODOKEM_MAX_LENSE + FRODOKEM_MAX_LENSEC];
+    byte uSalt[FRODOKEM_MAX_LENSEC + FRODOKEM_MAX_LENSALT];
+    word16 cIn[FRODOKEM_NBAR_SQ];
+    word16 v[FRODOKEM_NBAR_SQ];
+    word16 cEnc[FRODOKEM_NBAR_SQ];
+#endif
+    byte* kPrime;
+    word16 diff = 0;
+    word32 isEq;
+    byte mask;
+    size_t matSz = 0;
+
+    if ((key == NULL) || (ss == NULL) || (ct == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+        else if ((key->flags & FRODOKEM_FLAG_PRIV_SET) == 0) {
+            ret = BAD_STATE_E;
+        }
+        else if (len != (word32)p->ctSize) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        n = p->n;
+        heap = key->heap;
+        c1 = ct;
+        c2 = ct + (p->d * n);
+        salt = ct + (p->d * n) + (p->d * FRODOKEM_NBAR);
+
+        matSz = (size_t)(3 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ +
+            FRODOKEM_ROW_MULT * n) * sizeof(word16);
+#ifdef WOLFSSL_SMALL_STACK
+        /* cIn, v, cEnc (3 * nbar^2 words), then seedSEk (1 + lenSE + lenSec)
+         * and uSalt (lenSec + lensalt) bytes, all follow the matrix arena. */
+        matSz += (size_t)(3 * FRODOKEM_NBAR_SQ) * sizeof(word16);
+        matSz += (size_t)(1 + p->lenSE + 2 * p->lenSec + p->lenSalt);
+#endif
+        mat = (word16*)XMALLOC(matSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        if (mat == NULL) {
+            ret = MEMORY_E;
+        }
+        else {
+            bpIn = mat;
+            sp = mat + FRODOKEM_NBAR * n;
+            work = mat + 2 * FRODOKEM_NBAR * n;
+            epp = mat + 3 * FRODOKEM_NBAR * n;
+            row = mat + 3 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ;
+#ifdef WOLFSSL_SMALL_STACK
+            cIn = row + FRODOKEM_ROW_MULT * n;
+            v = cIn + FRODOKEM_NBAR_SQ;
+            cEnc = v + FRODOKEM_NBAR_SQ;
+            seedSEk = (byte*)(cEnc + FRODOKEM_NBAR_SQ);
+            uSalt = seedSEk + (1 + p->lenSE + p->lenSec);
+#endif
+        }
+    }
+
+    if (ret == 0) {
+        /* B' = Unpack(c1, nbar, n) and C = Unpack(c2, nbar, nbar). */
+        frodokem_unpack(bpIn, c1, FRODOKEM_NBAR * n, p->d);
+        frodokem_unpack(cIn, c2, nn, p->d);
+        /* M = C - B' * S, computed in place: v holds B' * S, then M. */
+        frodokem_mul_bs(v, bpIn, key->sMat, p->n, (int)p->qMask);
+        for (i = 0; i < nn; i++) {
+            v[i] = (word16)((cIn[i] - v[i]) & p->qMask);
+        }
+        /* u' = Decode(M), placed next to a copy of the ciphertext salt so
+         * u' || salt is contiguous for the hash below. */
+        frodokem_key_decode(uSalt, v, p);
+        XMEMCPY(uSalt + p->lenSec, salt, (size_t)p->lenSalt);
+
+        /* seedSEk = domain || seedSE' || k': seedSE' || k' = SHAKE(pkh || u' ||
+         * salt, lenSE + lensec) written after the leading domain byte. */
+        seedSEk[0] = FRODOKEM_DOMAIN_ENCAPS;
+        ret = frodokem_gen_seedse_k(p, &key->shake, key->pkh, uSalt,
+            seedSEk + 1);
+    }
+    if (ret == 0) {
+        /* Generate and sample S' | E' | E'' from SHAKE(domain || seedSE'). The
+         * three are contiguous from sp, so they form a single noise region. The
+         * row scratch is free here, so use it as the SHAKE block scratch. */
+        ret = frodokem_gen_noise(p, &key->shake, seedSEk, (byte*)row,
+            sp, 2 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ, NULL, 0);
+    }
+    if (ret == 0) {
+        /* B'' = S' * A + E', accumulated in place over E' in work. */
+        ret = frodokem_mul_add_sa_plus_e(key, work, sp, row);
+    }
+    if (ret == 0) {
+        /* Compare B' (bpIn) against B'' (work) before reusing work. */
+        for (i = 0; i < FRODOKEM_NBAR * n; i++) {
+            diff |= (word16)(bpIn[i] ^ work[i]);
+        }
+        /* B'' no longer needed: reuse work for B = Unpack(b, n, nbar). */
+        frodokem_unpack(work, key->b, n * FRODOKEM_NBAR, p->d);
+        /* V = S' * B + E'' (in place over E'' in epp); C' = V + Encode(u'). */
+        frodokem_mul_add_sb_plus_e(epp, work, sp, p->n, (int)p->qMask);
+        frodokem_key_encode(cEnc, uSalt, p->d, p->b);
+        frodokem_add(epp, cEnc, (int)p->qMask);
+        /* Compare C (cIn) against C' (epp). */
+        for (i = 0; i < nn; i++) {
+            diff |= (word16)(cIn[i] ^ epp[i]);
+        }
+
+        kPrime = seedSEk + 1 + p->lenSE;
+        /* isEq is 1 when diff == 0, else 0. */
+        isEq = (word32)(((word32)diff - 1) >> 31);
+        mask = (byte)(0 - isEq);
+
+        /* kHat = k' if ciphertext valid, else s (implicit rejection). Selected
+         * in place over k' (kPrime) in seedSEk. */
+        for (i = 0; i < p->lenSec; i++) {
+            kPrime[i] = (byte)((kPrime[i] & mask) | (key->s[i] & (byte)~mask));
+        }
+
+        /* ss = SHAKE(c1 || c2 || salt || kHat, lensec). c1 || c2 || salt is
+         * the leading part of ct. */
+        ret = frodokem_shake(p, &key->shake, ct,
+            (word32)((p->d * n) + (p->d * FRODOKEM_NBAR) + p->lenSalt),
+            kPrime, (word32)p->lenSec, ss, (word32)p->lenSec);
+    }
+
+#ifndef WOLFSSL_SMALL_STACK
+    ForceZero(uSalt, sizeof(uSalt));
+    ForceZero(seedSEk, sizeof(seedSEk));
+    /* Zeroize the secret-derived stack matrices (E'' lives in mat). */
+    ForceZero(v, sizeof(v));
+    ForceZero(cEnc, sizeof(cEnc));
+#endif
+    /* Under small stack uSalt, seedSEk, cIn, v and cEnc live in mat, zeroized
+     * below along with the rest of the arena. */
+    if (mat != NULL) {
+        ForceZero(mat, (word32)matSz);
+        XFREE(mat, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+
+    /* Wipe secret-derived residue from the reusable SHAKE state. */
+    frodokem_wipe_shake(key);
+
+    return ret;
+}
+#endif /* !WOLFSSL_FRODOKEM_NO_DECAPSULATE */
+
+/******************************************************************************/
+/* Key encoding and decoding.                                                 */
+/******************************************************************************/
+
+/* Encode the FrodoKEM public key: seedA || b.
+ *
+ * @param  [in]   key  FrodoKEM key object with public key set.
+ * @param  [out]  out  Output buffer.
+ * @param  [in]   len  Length of output buffer in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or out is NULL.
+ * @return  BAD_STATE_E when public key is not set.
+ * @return  BUFFER_E when len is not the expected size.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ */
+int wc_FrodoKemKey_EncodePublicKey(FrodoKemKey* key, unsigned char* out,
+    word32 len)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+
+    if ((key == NULL) || (out == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+        else if ((key->flags & FRODOKEM_FLAG_PUB_SET) == 0) {
+            ret = BAD_STATE_E;
+        }
+        else if (len != (word32)p->pkSize) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        XMEMCPY(out, key->seedA, FRODOKEM_SEEDA_SZ);
+        XMEMCPY(out + FRODOKEM_SEEDA_SZ, key->b, (size_t)(p->d * p->n));
+    }
+
+    return ret;
+}
+
+/* Decode a FrodoKEM public key: seedA || b.
+ *
+ * @param  [in, out]  key  FrodoKEM key object.
+ * @param  [in]       in   Encoded public key.
+ * @param  [in]       len  Length of encoded public key in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or in is NULL.
+ * @return  BUFFER_E when len is not the expected size.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ */
+int wc_FrodoKemKey_DecodePublicKey(FrodoKemKey* key, const unsigned char* in,
+    word32 len)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+
+    if ((key == NULL) || (in == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+        else if (len != (word32)p->pkSize) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        XMEMCPY(key->seedA, in, FRODOKEM_SEEDA_SZ);
+        XMEMCPY(key->b, in + FRODOKEM_SEEDA_SZ, (size_t)(p->d * p->n));
+        /* No value validation is required: seedA is an unconstrained seed and,
+         * because q is a power of two, every coefficient unpacked from b is
+         * already a valid residue in [0, q). No embedded hash to check. */
+        /* This object now holds only a public key: replace any prior state
+         * (e.g. from a private key) rather than OR-ing in, so the flags cannot
+         * describe a mismatched public/private pair. Wipe any secret material
+         * (implicit-rejection s and secret matrix S^T) left from a prior
+         * private key so it is not retained in a public-only object. */
+        ForceZero(key->s, sizeof(key->s));
+        ForceZero(key->sMat, sizeof(key->sMat));
+        key->flags = FRODOKEM_FLAG_PUB_SET;
+    }
+
+    return ret;
+}
+
+/* Encode the FrodoKEM private key: s || seedA || b || S^T || pkh.
+ *
+ * The secret matrix S^T is stored as little-endian 16-bit residues.
+ *
+ * @param  [in]   key  FrodoKEM key object with private key set.
+ * @param  [out]  out  Output buffer.
+ * @param  [in]   len  Length of output buffer in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or out is NULL.
+ * @return  BAD_STATE_E when private key is not set.
+ * @return  BUFFER_E when len is not the expected size.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ */
+int wc_FrodoKemKey_EncodePrivateKey(FrodoKemKey* key, unsigned char* out,
+    word32 len)
+{
+    int ret = 0;
+    const FrodoKemParams* p = NULL;
+    int sCnt;
+    byte* o;
+
+    if ((key == NULL) || (out == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+        else if (((key->flags & FRODOKEM_FLAG_BOTH_SET) !=
+                FRODOKEM_FLAG_BOTH_SET) ||
+                ((key->flags & FRODOKEM_FLAG_PKH_SET) == 0)) {
+            ret = BAD_STATE_E;
+        }
+        else if (len != (word32)p->skSize) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        sCnt = FRODOKEM_NBAR * p->n;
+        o = out;
+        XMEMCPY(o, key->s, (size_t)p->lenSec);
+        o += p->lenSec;
+        XMEMCPY(o, key->seedA, FRODOKEM_SEEDA_SZ);
+        o += FRODOKEM_SEEDA_SZ;
+        XMEMCPY(o, key->b, (size_t)(p->d * p->n));
+        o += p->d * p->n;
+        frodokem_store_matrix(o, key->sMat, sCnt);
+        o += 2 * sCnt;
+        XMEMCPY(o, key->pkh, (size_t)p->lenSec);
+    }
+
+    return ret;
+}
+
+/* Validate a decoded FrodoKEM private key.
+ *
+ * The only decoded value with a condition on it is the stored public-key hash:
+ * it must equal SHAKE(seedA || b). (seedA, b and the secret matrix are
+ * otherwise unconstrained - q is a power of two, so every unpacked coefficient
+ * is already a valid residue in [0, q).)
+ *
+ * @param  [in]  p    FrodoKEM parameters.
+ * @param  [in]  key  Key with seedA, b and pkh populated.
+ * @return  0 when the stored hash matches.
+ * @return  WC_KEY_MISMATCH_E when the stored hash is inconsistent.
+ * @return  Negative on hash error.
+ */
+static int frodokem_check_priv_key(const FrodoKemParams* p, FrodoKemKey* key)
+{
+    byte pkh[FRODOKEM_MAX_LENSEC];
+    int ret;
+
+    ret = frodokem_shake_oneshot(p, &key->shake, key->seedA, (word32)p->pkSize,
+        pkh, (word32)p->lenSec);
+    if ((ret == 0) && (XMEMCMP(pkh, key->pkh, (size_t)p->lenSec) != 0)) {
+        ret = WC_KEY_MISMATCH_E;
+    }
+
+    return ret;
+}
+
+/* Decode a FrodoKEM private key: s || seedA || b || S^T || pkh.
+ *
+ * @param  [in, out]  key  FrodoKEM key object.
+ * @param  [in]       in   Encoded private key.
+ * @param  [in]       len  Length of encoded private key in bytes.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when key or in is NULL.
+ * @return  BUFFER_E when len is not the expected size.
+ * @return  NOT_COMPILED_IN when key type is not supported.
+ * @return  WC_KEY_MISMATCH_E when the embedded public-key hash is inconsistent.
+ */
+int wc_FrodoKemKey_DecodePrivateKey(FrodoKemKey* key, const unsigned char* in,
+    word32 len)
+{
+    const FrodoKemParams* p = NULL;
+    int ret = 0;
+    int sCnt;
+    const byte* o;
+
+    if ((key == NULL) || (in == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    else {
+        p = key->params;
+        if (p == NULL) {
+            ret = NOT_COMPILED_IN;
+        }
+        else if (len != (word32)p->skSize) {
+            ret = BUFFER_E;
+        }
+    }
+
+    if (ret == 0) {
+        sCnt = FRODOKEM_NBAR * p->n;
+        o = in;
+        XMEMCPY(key->s, o, (size_t)p->lenSec);
+        o += p->lenSec;
+        XMEMCPY(key->seedA, o, FRODOKEM_SEEDA_SZ);
+        o += FRODOKEM_SEEDA_SZ;
+        XMEMCPY(key->b, o, (size_t)(p->d * p->n));
+        o += p->d * p->n;
+        frodokem_load_matrix(key->sMat, o, sCnt);
+        o += 2 * sCnt;
+        XMEMCPY(key->pkh, o, (size_t)p->lenSec);
+
+        /* Validate the decoded data before marking the key usable. */
+        ret = frodokem_check_priv_key(p, key);
+        if (ret == 0) {
+            key->flags |= FRODOKEM_FLAG_PRIV_SET | FRODOKEM_FLAG_PUB_SET |
+                FRODOKEM_FLAG_PKH_SET;
+        }
+        else {
+            /* Leave the key object unusable and wipe the secret material that
+             * was copied in before validation failed. Only the secrets (s and
+             * S^T) are wiped; the non-secret fields copied in above (pkh, seedA
+             * and b) are intentionally left in place, as they are public and
+             * unreachable while flags == 0 (every consumer gates on the
+             * FRODOKEM_FLAG_*_SET bits cleared here). */
+            ForceZero(key->s, sizeof(key->s));
+            ForceZero(key->sMat, sizeof(key->sMat));
+            key->flags = 0;
+        }
+    }
+
+    return ret;
+}
+
+#endif /* WOLFSSL_HAVE_FRODOKEM */
diff --git a/wolfcrypt/src/wc_frodokem_asm.S b/wolfcrypt/src/wc_frodokem_asm.S
new file mode 100644
index 00000000000..95c4ddbe5e0
--- /dev/null
+++ b/wolfcrypt/src/wc_frodokem_asm.S
@@ -0,0 +1,1590 @@
+/* wc_frodokem_asm.S */
+/*
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#ifdef WOLFSSL_USER_SETTINGS
+#ifdef WOLFSSL_USER_SETTINGS_ASM
+/*
+ * user_settings_asm.h is a file generated by the script user_settings_asm.sh.
+ * The script takes in a user_settings.h and produces user_settings_asm.h, which
+ * is a stripped down version of user_settings.h containing only preprocessor
+ * directives. This makes the header safe to include in assembly (.S) files.
+ */
+#include "user_settings_asm.h"
+#else
+/*
+ * Note: if user_settings.h contains any C code (e.g. a typedef or function
+ * prototype), including it here in an assembly (.S) file will cause an
+ * assembler failure. See user_settings_asm.h above.
+ */
+#include "user_settings.h"
+#endif /* WOLFSSL_USER_SETTINGS_ASM */
+#endif /* WOLFSSL_USER_SETTINGS */
+
+#ifndef HAVE_INTEL_AVX1
+#define HAVE_INTEL_AVX1
+#endif /* HAVE_INTEL_AVX1 */
+#ifndef NO_AVX2_SUPPORT
+#ifndef HAVE_INTEL_AVX2
+#define HAVE_INTEL_AVX2
+#endif /* HAVE_INTEL_AVX2 */
+#endif /* NO_AVX2_SUPPORT */
+#ifndef NO_VAES_SUPPORT
+#ifndef HAVE_INTEL_VAES
+#define HAVE_INTEL_VAES
+#endif /* HAVE_INTEL_VAES */
+#endif /* NO_VAES_SUPPORT */
+#ifndef NO_AVX512_SUPPORT
+#ifndef HAVE_INTEL_AVX512
+#define HAVE_INTEL_AVX512
+#endif /* HAVE_INTEL_AVX512 */
+#endif /* NO_AVX512_SUPPORT */
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifdef HAVE_INTEL_AVX2
+#ifndef __APPLE__
+.text
+.globl	frodokem_sa_accum_avx2
+.type	frodokem_sa_accum_avx2,@function
+.align	16
+frodokem_sa_accum_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sa_accum_avx2
+.p2align	4
+_frodokem_sa_accum_avx2:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        movslq	%ecx, %rcx
+        shlq	$1, %rcx
+        addq	%rcx, %rsi
+        movslq	%r8d, %rax
+        shlq	$1, %rax
+        movq	%rdx, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	$8, %r13
+L_frodokem_sa_accum_avx2_i:
+        vpbroadcastw	(%rsi), %ymm0
+        vpbroadcastw	2(%rsi), %ymm1
+        vpbroadcastw	4(%rsi), %ymm2
+        vpbroadcastw	6(%rsi), %ymm3
+        xorq	%r12, %r12
+L_frodokem_sa_accum_avx2_k:
+        vmovdqu	(%rdi,%r12,1), %ymm4
+        vpmullw	(%rdx,%r12,1), %ymm0, %ymm5
+        vpaddw	%ymm5, %ymm4, %ymm4
+        vpmullw	(%r9,%r12,1), %ymm1, %ymm5
+        vpaddw	%ymm5, %ymm4, %ymm4
+        vpmullw	(%r10,%r12,1), %ymm2, %ymm5
+        vpaddw	%ymm5, %ymm4, %ymm4
+        vpmullw	(%r11,%r12,1), %ymm3, %ymm5
+        vpaddw	%ymm5, %ymm4, %ymm4
+        vmovdqu	%ymm4, (%rdi,%r12,1)
+        addq	$32, %r12
+        cmpq	%rax, %r12
+        jl	L_frodokem_sa_accum_avx2_k
+        addq	%rax, %rdi
+        addq	%rax, %rsi
+        subq	$0x01, %r13
+        jnz	L_frodokem_sa_accum_avx2_i
+        vzeroupper
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_sa_accum_avx2,.-frodokem_sa_accum_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_as_accum_avx2
+.type	frodokem_as_accum_avx2,@function
+.align	16
+frodokem_as_accum_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_as_accum_avx2
+.p2align	4
+_frodokem_as_accum_avx2:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        pushq	%rbp
+        movslq	%ecx, %rcx
+        shlq	$4, %rcx
+        addq	%rcx, %rdi
+        movslq	%r8d, %rax
+        shlq	$1, %rax
+        movq	%rsi, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	%r11, %r12
+        addq	%rax, %r12
+        movq	%r12, %r13
+        addq	%rax, %r13
+        movq	%r13, %r14
+        addq	%rax, %r14
+        movq	%r14, %r15
+        addq	%rax, %r15
+        movq	$4, %rbp
+        vpcmpeqd	%xmm12, %xmm12, %xmm12
+        vpsrld	$16, %xmm12, %xmm12
+L_frodokem_as_accum_avx2_r:
+        vpxor	%ymm0, %ymm0, %ymm0
+        vpxor	%ymm1, %ymm1, %ymm1
+        vpxor	%ymm2, %ymm2, %ymm2
+        vpxor	%ymm3, %ymm3, %ymm3
+        vpxor	%ymm4, %ymm4, %ymm4
+        vpxor	%ymm5, %ymm5, %ymm5
+        vpxor	%ymm6, %ymm6, %ymm6
+        vpxor	%ymm7, %ymm7, %ymm7
+        xorq	%rbx, %rbx
+L_frodokem_as_accum_avx2_j:
+        vmovdqu	(%rdx,%rbx,1), %ymm8
+        vpmaddwd	(%rsi,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm0, %ymm0
+        vpmaddwd	(%r9,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm1, %ymm1
+        vpmaddwd	(%r10,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm2, %ymm2
+        vpmaddwd	(%r11,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm3, %ymm3
+        vpmaddwd	(%r12,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm4, %ymm4
+        vpmaddwd	(%r13,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm5, %ymm5
+        vpmaddwd	(%r14,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm6, %ymm6
+        vpmaddwd	(%r15,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm7, %ymm7
+        addq	$32, %rbx
+        cmpq	%rax, %rbx
+        jl	L_frodokem_as_accum_avx2_j
+        vextracti128	$0x01, %ymm0, %xmm8
+        vpaddd	%xmm8, %xmm0, %xmm0
+        vextracti128	$0x01, %ymm1, %xmm8
+        vpaddd	%xmm8, %xmm1, %xmm1
+        vextracti128	$0x01, %ymm2, %xmm8
+        vpaddd	%xmm8, %xmm2, %xmm2
+        vextracti128	$0x01, %ymm3, %xmm8
+        vpaddd	%xmm8, %xmm3, %xmm3
+        vextracti128	$0x01, %ymm4, %xmm8
+        vpaddd	%xmm8, %xmm4, %xmm4
+        vextracti128	$0x01, %ymm5, %xmm8
+        vpaddd	%xmm8, %xmm5, %xmm5
+        vextracti128	$0x01, %ymm6, %xmm8
+        vpaddd	%xmm8, %xmm6, %xmm6
+        vextracti128	$0x01, %ymm7, %xmm8
+        vpaddd	%xmm8, %xmm7, %xmm7
+        vphaddd	%xmm1, %xmm0, %xmm10
+        vphaddd	%xmm3, %xmm2, %xmm11
+        vphaddd	%xmm11, %xmm10, %xmm9
+        vphaddd	%xmm5, %xmm4, %xmm10
+        vphaddd	%xmm7, %xmm6, %xmm11
+        vphaddd	%xmm11, %xmm10, %xmm10
+        vpand	%xmm12, %xmm9, %xmm9
+        vpand	%xmm12, %xmm10, %xmm10
+        vpackusdw	%xmm10, %xmm9, %xmm9
+        vpaddw	(%rdi), %xmm9, %xmm9
+        vmovdqu	%xmm9, (%rdi)
+        addq	%rax, %rdx
+        addq	$16, %rdi
+        subq	$0x01, %rbp
+        jnz	L_frodokem_as_accum_avx2_r
+        vzeroupper
+        popq	%rbp
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_as_accum_avx2,.-frodokem_as_accum_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_bs_avx2
+.type	frodokem_mul_bs_avx2,@function
+.align	16
+frodokem_mul_bs_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_bs_avx2
+.p2align	4
+_frodokem_mul_bs_avx2:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        pushq	%rbp
+        movslq	%ecx, %rax
+        shlq	$1, %rax
+        movq	%rdx, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	%r11, %r12
+        addq	%rax, %r12
+        movq	%r12, %r13
+        addq	%rax, %r13
+        movq	%r13, %r14
+        addq	%rax, %r14
+        movq	%r14, %r15
+        addq	%rax, %r15
+        movq	$8, %rbp
+        vmovd	%r8, %xmm12
+        vpbroadcastd	%xmm12, %xmm12
+L_frodokem_mul_bs_avx2_r:
+        vpxor	%ymm0, %ymm0, %ymm0
+        vpxor	%ymm1, %ymm1, %ymm1
+        vpxor	%ymm2, %ymm2, %ymm2
+        vpxor	%ymm3, %ymm3, %ymm3
+        vpxor	%ymm4, %ymm4, %ymm4
+        vpxor	%ymm5, %ymm5, %ymm5
+        vpxor	%ymm6, %ymm6, %ymm6
+        vpxor	%ymm7, %ymm7, %ymm7
+        xorq	%rbx, %rbx
+L_frodokem_mul_bs_avx2_j:
+        vmovdqu	(%rsi,%rbx,1), %ymm8
+        vpmaddwd	(%rdx,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm0, %ymm0
+        vpmaddwd	(%r9,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm1, %ymm1
+        vpmaddwd	(%r10,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm2, %ymm2
+        vpmaddwd	(%r11,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm3, %ymm3
+        vpmaddwd	(%r12,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm4, %ymm4
+        vpmaddwd	(%r13,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm5, %ymm5
+        vpmaddwd	(%r14,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm6, %ymm6
+        vpmaddwd	(%r15,%rbx,1), %ymm8, %ymm10
+        vpaddd	%ymm10, %ymm7, %ymm7
+        addq	$32, %rbx
+        cmpq	%rax, %rbx
+        jl	L_frodokem_mul_bs_avx2_j
+        vextracti128	$0x01, %ymm0, %xmm8
+        vpaddd	%xmm8, %xmm0, %xmm0
+        vextracti128	$0x01, %ymm1, %xmm8
+        vpaddd	%xmm8, %xmm1, %xmm1
+        vextracti128	$0x01, %ymm2, %xmm8
+        vpaddd	%xmm8, %xmm2, %xmm2
+        vextracti128	$0x01, %ymm3, %xmm8
+        vpaddd	%xmm8, %xmm3, %xmm3
+        vextracti128	$0x01, %ymm4, %xmm8
+        vpaddd	%xmm8, %xmm4, %xmm4
+        vextracti128	$0x01, %ymm5, %xmm8
+        vpaddd	%xmm8, %xmm5, %xmm5
+        vextracti128	$0x01, %ymm6, %xmm8
+        vpaddd	%xmm8, %xmm6, %xmm6
+        vextracti128	$0x01, %ymm7, %xmm8
+        vpaddd	%xmm8, %xmm7, %xmm7
+        vphaddd	%xmm1, %xmm0, %xmm10
+        vphaddd	%xmm3, %xmm2, %xmm11
+        vphaddd	%xmm11, %xmm10, %xmm9
+        vphaddd	%xmm5, %xmm4, %xmm10
+        vphaddd	%xmm7, %xmm6, %xmm11
+        vphaddd	%xmm11, %xmm10, %xmm10
+        vpand	%xmm12, %xmm9, %xmm9
+        vpand	%xmm12, %xmm10, %xmm10
+        vpackusdw	%xmm10, %xmm9, %xmm9
+        vmovdqu	%xmm9, (%rdi)
+        addq	%rax, %rsi
+        addq	$16, %rdi
+        subq	$0x01, %rbp
+        jnz	L_frodokem_mul_bs_avx2_r
+        vzeroupper
+        popq	%rbp
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_mul_bs_avx2,.-frodokem_mul_bs_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_add_sb_plus_e_avx2
+.type	frodokem_mul_add_sb_plus_e_avx2,@function
+.align	16
+frodokem_mul_add_sb_plus_e_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_add_sb_plus_e_avx2
+.p2align	4
+_frodokem_mul_add_sb_plus_e_avx2:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        movslq	%ecx, %rax
+        shlq	$1, %rax
+        movq	%rdx, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	%r11, %r12
+        addq	%rax, %r12
+        movq	%r12, %r13
+        addq	%rax, %r13
+        movq	%r13, %r14
+        addq	%rax, %r14
+        movq	%r14, %r15
+        addq	%rax, %r15
+        vmovd	%r8, %xmm7
+        vpbroadcastw	%xmm7, %ymm7
+        vmovdqu	(%rdi), %ymm0
+        vmovdqu	32(%rdi), %ymm1
+        vmovdqu	64(%rdi), %ymm2
+        vmovdqu	96(%rdi), %ymm3
+        xorq	%rbx, %rbx
+L_frodokem_mul_add_sb_plus_e_avx2_j:
+        vbroadcasti128	(%rsi), %ymm4
+        vpbroadcastw	(%rdx,%rbx,1), %ymm5
+        vpbroadcastw	(%r9,%rbx,1), %ymm6
+        vinserti128	$0x01, %xmm6, %ymm5, %ymm5
+        vpmullw	%ymm4, %ymm5, %ymm6
+        vpaddw	%ymm6, %ymm0, %ymm0
+        vpbroadcastw	(%r10,%rbx,1), %ymm5
+        vpbroadcastw	(%r11,%rbx,1), %ymm6
+        vinserti128	$0x01, %xmm6, %ymm5, %ymm5
+        vpmullw	%ymm4, %ymm5, %ymm6
+        vpaddw	%ymm6, %ymm1, %ymm1
+        vpbroadcastw	(%r12,%rbx,1), %ymm5
+        vpbroadcastw	(%r13,%rbx,1), %ymm6
+        vinserti128	$0x01, %xmm6, %ymm5, %ymm5
+        vpmullw	%ymm4, %ymm5, %ymm6
+        vpaddw	%ymm6, %ymm2, %ymm2
+        vpbroadcastw	(%r14,%rbx,1), %ymm5
+        vpbroadcastw	(%r15,%rbx,1), %ymm6
+        vinserti128	$0x01, %xmm6, %ymm5, %ymm5
+        vpmullw	%ymm4, %ymm5, %ymm6
+        vpaddw	%ymm6, %ymm3, %ymm3
+        addq	$16, %rsi
+        addq	$2, %rbx
+        cmpq	%rax, %rbx
+        jl	L_frodokem_mul_add_sb_plus_e_avx2_j
+        vpand	%ymm7, %ymm0, %ymm0
+        vmovdqu	%ymm0, (%rdi)
+        vpand	%ymm7, %ymm1, %ymm1
+        vmovdqu	%ymm1, 32(%rdi)
+        vpand	%ymm7, %ymm2, %ymm2
+        vmovdqu	%ymm2, 64(%rdi)
+        vpand	%ymm7, %ymm3, %ymm3
+        vmovdqu	%ymm3, 96(%rdi)
+        vzeroupper
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_mul_add_sb_plus_e_avx2,.-frodokem_mul_add_sb_plus_e_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_add_avx2
+.type	frodokem_add_avx2,@function
+.align	16
+frodokem_add_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_add_avx2
+.p2align	4
+_frodokem_add_avx2:
+#endif /* __APPLE__ */
+        vmovd	%rdx, %xmm0
+        vpbroadcastw	%xmm0, %ymm0
+        vmovdqu	(%rdi), %ymm1
+        vpaddw	(%rsi), %ymm1, %ymm1
+        vpand	%ymm0, %ymm1, %ymm1
+        vmovdqu	%ymm1, (%rdi)
+        vmovdqu	32(%rdi), %ymm2
+        vpaddw	32(%rsi), %ymm2, %ymm2
+        vpand	%ymm0, %ymm2, %ymm2
+        vmovdqu	%ymm2, 32(%rdi)
+        vmovdqu	64(%rdi), %ymm3
+        vpaddw	64(%rsi), %ymm3, %ymm3
+        vpand	%ymm0, %ymm3, %ymm3
+        vmovdqu	%ymm3, 64(%rdi)
+        vmovdqu	96(%rdi), %ymm4
+        vpaddw	96(%rsi), %ymm4, %ymm4
+        vpand	%ymm0, %ymm4, %ymm4
+        vmovdqu	%ymm4, 96(%rdi)
+        vzeroupper
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_add_avx2,.-frodokem_add_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_a_rows_reduce_avx2
+.type	frodokem_a_rows_reduce_avx2,@function
+.align	16
+frodokem_a_rows_reduce_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_a_rows_reduce_avx2
+.p2align	4
+_frodokem_a_rows_reduce_avx2:
+#endif /* __APPLE__ */
+        vmovd	%rdx, %xmm0
+        vpbroadcastw	%xmm0, %ymm0
+        movl	%esi, %eax
+L_frodokem_a_rows_reduce_avx2_blk:
+        cmpq	$16, %rax
+        jl	L_frodokem_a_rows_reduce_avx2_tail
+        vpand	(%rdi), %ymm0, %ymm1
+        vmovdqu	%ymm1, (%rdi)
+        addq	$32, %rdi
+        subq	$16, %rax
+        jmp	L_frodokem_a_rows_reduce_avx2_blk
+L_frodokem_a_rows_reduce_avx2_tail:
+        cmpq	$0x00, %rax
+        jle	L_frodokem_a_rows_reduce_avx2_done
+L_frodokem_a_rows_reduce_avx2_word:
+        movzwl	(%rdi), %ecx
+        andl	%edx, %ecx
+        movw	%cx, (%rdi)
+        addq	$2, %rdi
+        subq	$0x01, %rax
+        jg	L_frodokem_a_rows_reduce_avx2_word
+L_frodokem_a_rows_reduce_avx2_done:
+        vzeroupper
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_a_rows_reduce_avx2,.-frodokem_a_rows_reduce_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_sample_avx2
+.type	frodokem_sample_avx2,@function
+.align	16
+frodokem_sample_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sample_avx2
+.p2align	4
+_frodokem_sample_avx2:
+#endif /* __APPLE__ */
+        movslq	%esi, %rax
+        shlq	$1, %rax
+        vpcmpeqw	%ymm0, %ymm0, %ymm0
+        vpsrlw	$15, %ymm0, %ymm0
+        vpxor	%ymm1, %ymm1, %ymm1
+        xorq	%r8, %r8
+L_frodokem_sample_avx2_blk:
+        vmovdqu	(%rdi,%r8,1), %ymm2
+        vpsrlw	$0x01, %ymm2, %ymm3
+        vpand	%ymm0, %ymm2, %ymm4
+        vpxor	%ymm5, %ymm5, %ymm5
+        movq	%rdx, %r9
+        movl	%ecx, %r10d
+L_frodokem_sample_avx2_cdf:
+        vpbroadcastw	(%r9), %ymm6
+        vpsubw	%ymm3, %ymm6, %ymm6
+        vpsrlw	$15, %ymm6, %ymm6
+        vpaddw	%ymm6, %ymm5, %ymm5
+        addq	$2, %r9
+        subq	$0x01, %r10
+        jnz	L_frodokem_sample_avx2_cdf
+        vpsubw	%ymm4, %ymm1, %ymm7
+        vpxor	%ymm7, %ymm5, %ymm5
+        vpaddw	%ymm4, %ymm5, %ymm5
+        vmovdqu	%ymm5, (%rdi,%r8,1)
+        addq	$32, %r8
+        cmpq	%rax, %r8
+        jl	L_frodokem_sample_avx2_blk
+        vzeroupper
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_sample_avx2,.-frodokem_sample_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_gen_a_rows_aes_avx2
+.type	frodokem_gen_a_rows_aes_avx2,@function
+.align	16
+frodokem_gen_a_rows_aes_avx2:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_gen_a_rows_aes_avx2
+.p2align	4
+_frodokem_gen_a_rows_aes_avx2:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        movq	40(%rsp), %rax
+        vbroadcasti128	(%rdx), %ymm0
+        vbroadcasti128	16(%rdx), %ymm1
+        vbroadcasti128	32(%rdx), %ymm2
+        vbroadcasti128	48(%rdx), %ymm3
+        vbroadcasti128	64(%rdx), %ymm4
+        vbroadcasti128	80(%rdx), %ymm5
+        vbroadcasti128	96(%rdx), %ymm6
+        vbroadcasti128	112(%rdx), %ymm7
+        vbroadcasti128	128(%rdx), %ymm8
+        vbroadcasti128	144(%rdx), %ymm9
+        vbroadcasti128	160(%rdx), %ymm10
+        vmovd	%rax, %xmm15
+        vpbroadcastw	%xmm15, %ymm15
+        movslq	%r9d, %r10
+        shrq	$3, %r10
+        movslq	%r8d, %r11
+        movslq	%ecx, %rcx
+        xorq	%r12, %r12
+L_frodokem_gen_a_rows_aes_avx2_row:
+        movq	%rcx, %r14
+        addq	%r12, %r14
+        xorq	%r13, %r13
+L_frodokem_gen_a_rows_aes_avx2_blk:
+        leaq	8(%r13), %r15
+        cmpq	%r10, %r15
+        jg	L_frodokem_gen_a_rows_aes_avx2_tail
+        vmovd	%r14d, %xmm11
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm0
+        addq	$0x80000, %r14
+        vinserti128	$0x01, %xmm0, %ymm11, %ymm11
+        vmovd	%r14d, %xmm12
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm0
+        addq	$0x80000, %r14
+        vinserti128	$0x01, %xmm0, %ymm12, %ymm12
+        vmovd	%r14d, %xmm13
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm0
+        addq	$0x80000, %r14
+        vinserti128	$0x01, %xmm0, %ymm13, %ymm13
+        vmovd	%r14d, %xmm14
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm0
+        addq	$0x80000, %r14
+        vinserti128	$0x01, %xmm0, %ymm14, %ymm14
+        vbroadcasti128	(%rdx), %ymm0
+        vpxor	%ymm0, %ymm11, %ymm11
+        vpxor	%ymm0, %ymm12, %ymm12
+        vpxor	%ymm0, %ymm13, %ymm13
+        vpxor	%ymm0, %ymm14, %ymm14
+        vaesenc	%ymm1, %ymm11, %ymm11
+        vaesenc	%ymm1, %ymm12, %ymm12
+        vaesenc	%ymm1, %ymm13, %ymm13
+        vaesenc	%ymm1, %ymm14, %ymm14
+        vaesenc	%ymm2, %ymm11, %ymm11
+        vaesenc	%ymm2, %ymm12, %ymm12
+        vaesenc	%ymm2, %ymm13, %ymm13
+        vaesenc	%ymm2, %ymm14, %ymm14
+        vaesenc	%ymm3, %ymm11, %ymm11
+        vaesenc	%ymm3, %ymm12, %ymm12
+        vaesenc	%ymm3, %ymm13, %ymm13
+        vaesenc	%ymm3, %ymm14, %ymm14
+        vaesenc	%ymm4, %ymm11, %ymm11
+        vaesenc	%ymm4, %ymm12, %ymm12
+        vaesenc	%ymm4, %ymm13, %ymm13
+        vaesenc	%ymm4, %ymm14, %ymm14
+        vaesenc	%ymm5, %ymm11, %ymm11
+        vaesenc	%ymm5, %ymm12, %ymm12
+        vaesenc	%ymm5, %ymm13, %ymm13
+        vaesenc	%ymm5, %ymm14, %ymm14
+        vaesenc	%ymm6, %ymm11, %ymm11
+        vaesenc	%ymm6, %ymm12, %ymm12
+        vaesenc	%ymm6, %ymm13, %ymm13
+        vaesenc	%ymm6, %ymm14, %ymm14
+        vaesenc	%ymm7, %ymm11, %ymm11
+        vaesenc	%ymm7, %ymm12, %ymm12
+        vaesenc	%ymm7, %ymm13, %ymm13
+        vaesenc	%ymm7, %ymm14, %ymm14
+        vaesenc	%ymm8, %ymm11, %ymm11
+        vaesenc	%ymm8, %ymm12, %ymm12
+        vaesenc	%ymm8, %ymm13, %ymm13
+        vaesenc	%ymm8, %ymm14, %ymm14
+        vaesenc	%ymm9, %ymm11, %ymm11
+        vaesenc	%ymm9, %ymm12, %ymm12
+        vaesenc	%ymm9, %ymm13, %ymm13
+        vaesenc	%ymm9, %ymm14, %ymm14
+        vaesenclast	%ymm10, %ymm11, %ymm11
+        vaesenclast	%ymm10, %ymm12, %ymm12
+        vaesenclast	%ymm10, %ymm13, %ymm13
+        vaesenclast	%ymm10, %ymm14, %ymm14
+        vpand	%ymm15, %ymm11, %ymm11
+        vmovdqu	%ymm11, (%rsi)
+        vpand	%ymm15, %ymm12, %ymm12
+        vmovdqu	%ymm12, 32(%rsi)
+        vpand	%ymm15, %ymm13, %ymm13
+        vmovdqu	%ymm13, 64(%rsi)
+        vpand	%ymm15, %ymm14, %ymm14
+        vmovdqu	%ymm14, 96(%rsi)
+        addq	$0x80, %rsi
+        addq	$8, %r13
+        jmp	L_frodokem_gen_a_rows_aes_avx2_blk
+L_frodokem_gen_a_rows_aes_avx2_tail:
+        cmpq	%r10, %r13
+        jge	L_frodokem_gen_a_rows_aes_avx2_next
+        vmovd	%r14d, %xmm11
+        addq	$0x80000, %r14
+        vpxor	%xmm0, %xmm11, %xmm11
+        vaesenc	%xmm1, %xmm11, %xmm11
+        vaesenc	%xmm2, %xmm11, %xmm11
+        vaesenc	%xmm3, %xmm11, %xmm11
+        vaesenc	%xmm4, %xmm11, %xmm11
+        vaesenc	%xmm5, %xmm11, %xmm11
+        vaesenc	%xmm6, %xmm11, %xmm11
+        vaesenc	%xmm7, %xmm11, %xmm11
+        vaesenc	%xmm8, %xmm11, %xmm11
+        vaesenc	%xmm9, %xmm11, %xmm11
+        vaesenclast	%xmm10, %xmm11, %xmm11
+        vpand	%xmm15, %xmm11, %xmm11
+        vmovdqu	%xmm11, (%rsi)
+        addq	$16, %rsi
+        addq	$0x01, %r13
+        jmp	L_frodokem_gen_a_rows_aes_avx2_tail
+L_frodokem_gen_a_rows_aes_avx2_next:
+        addq	$0x01, %r12
+        cmpq	%r11, %r12
+        jl	L_frodokem_gen_a_rows_aes_avx2_row
+        vzeroupper
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_gen_a_rows_aes_avx2,.-frodokem_gen_a_rows_aes_avx2
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_gen_a_rows_aes_aesni
+.type	frodokem_gen_a_rows_aes_aesni,@function
+.align	16
+frodokem_gen_a_rows_aes_aesni:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_gen_a_rows_aes_aesni
+.p2align	4
+_frodokem_gen_a_rows_aes_aesni:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        movq	40(%rsp), %rax
+        vmovd	%rax, %xmm8
+        vpbroadcastw	%xmm8, %xmm8
+        movslq	%r9d, %r10
+        shrq	$3, %r10
+        movslq	%r8d, %r11
+        movslq	%ecx, %rcx
+        xorq	%r12, %r12
+L_frodokem_gen_a_rows_aes_aesni_row:
+        movq	%rcx, %r14
+        addq	%r12, %r14
+        xorq	%r13, %r13
+L_frodokem_gen_a_rows_aes_aesni_blk:
+        leaq	8(%r13), %r15
+        cmpq	%r10, %r15
+        jg	L_frodokem_gen_a_rows_aes_aesni_tail
+        vmovd	%r14d, %xmm0
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm1
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm2
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm3
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm4
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm5
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm6
+        addq	$0x80000, %r14
+        vmovd	%r14d, %xmm7
+        addq	$0x80000, %r14
+        vpxor	(%rdx), %xmm0, %xmm0
+        vpxor	(%rdx), %xmm1, %xmm1
+        vpxor	(%rdx), %xmm2, %xmm2
+        vpxor	(%rdx), %xmm3, %xmm3
+        vpxor	(%rdx), %xmm4, %xmm4
+        vpxor	(%rdx), %xmm5, %xmm5
+        vpxor	(%rdx), %xmm6, %xmm6
+        vpxor	(%rdx), %xmm7, %xmm7
+        vaesenc	16(%rdx), %xmm0, %xmm0
+        vaesenc	16(%rdx), %xmm1, %xmm1
+        vaesenc	16(%rdx), %xmm2, %xmm2
+        vaesenc	16(%rdx), %xmm3, %xmm3
+        vaesenc	16(%rdx), %xmm4, %xmm4
+        vaesenc	16(%rdx), %xmm5, %xmm5
+        vaesenc	16(%rdx), %xmm6, %xmm6
+        vaesenc	16(%rdx), %xmm7, %xmm7
+        vaesenc	32(%rdx), %xmm0, %xmm0
+        vaesenc	32(%rdx), %xmm1, %xmm1
+        vaesenc	32(%rdx), %xmm2, %xmm2
+        vaesenc	32(%rdx), %xmm3, %xmm3
+        vaesenc	32(%rdx), %xmm4, %xmm4
+        vaesenc	32(%rdx), %xmm5, %xmm5
+        vaesenc	32(%rdx), %xmm6, %xmm6
+        vaesenc	32(%rdx), %xmm7, %xmm7
+        vaesenc	48(%rdx), %xmm0, %xmm0
+        vaesenc	48(%rdx), %xmm1, %xmm1
+        vaesenc	48(%rdx), %xmm2, %xmm2
+        vaesenc	48(%rdx), %xmm3, %xmm3
+        vaesenc	48(%rdx), %xmm4, %xmm4
+        vaesenc	48(%rdx), %xmm5, %xmm5
+        vaesenc	48(%rdx), %xmm6, %xmm6
+        vaesenc	48(%rdx), %xmm7, %xmm7
+        vaesenc	64(%rdx), %xmm0, %xmm0
+        vaesenc	64(%rdx), %xmm1, %xmm1
+        vaesenc	64(%rdx), %xmm2, %xmm2
+        vaesenc	64(%rdx), %xmm3, %xmm3
+        vaesenc	64(%rdx), %xmm4, %xmm4
+        vaesenc	64(%rdx), %xmm5, %xmm5
+        vaesenc	64(%rdx), %xmm6, %xmm6
+        vaesenc	64(%rdx), %xmm7, %xmm7
+        vaesenc	80(%rdx), %xmm0, %xmm0
+        vaesenc	80(%rdx), %xmm1, %xmm1
+        vaesenc	80(%rdx), %xmm2, %xmm2
+        vaesenc	80(%rdx), %xmm3, %xmm3
+        vaesenc	80(%rdx), %xmm4, %xmm4
+        vaesenc	80(%rdx), %xmm5, %xmm5
+        vaesenc	80(%rdx), %xmm6, %xmm6
+        vaesenc	80(%rdx), %xmm7, %xmm7
+        vaesenc	96(%rdx), %xmm0, %xmm0
+        vaesenc	96(%rdx), %xmm1, %xmm1
+        vaesenc	96(%rdx), %xmm2, %xmm2
+        vaesenc	96(%rdx), %xmm3, %xmm3
+        vaesenc	96(%rdx), %xmm4, %xmm4
+        vaesenc	96(%rdx), %xmm5, %xmm5
+        vaesenc	96(%rdx), %xmm6, %xmm6
+        vaesenc	96(%rdx), %xmm7, %xmm7
+        vaesenc	112(%rdx), %xmm0, %xmm0
+        vaesenc	112(%rdx), %xmm1, %xmm1
+        vaesenc	112(%rdx), %xmm2, %xmm2
+        vaesenc	112(%rdx), %xmm3, %xmm3
+        vaesenc	112(%rdx), %xmm4, %xmm4
+        vaesenc	112(%rdx), %xmm5, %xmm5
+        vaesenc	112(%rdx), %xmm6, %xmm6
+        vaesenc	112(%rdx), %xmm7, %xmm7
+        vaesenc	128(%rdx), %xmm0, %xmm0
+        vaesenc	128(%rdx), %xmm1, %xmm1
+        vaesenc	128(%rdx), %xmm2, %xmm2
+        vaesenc	128(%rdx), %xmm3, %xmm3
+        vaesenc	128(%rdx), %xmm4, %xmm4
+        vaesenc	128(%rdx), %xmm5, %xmm5
+        vaesenc	128(%rdx), %xmm6, %xmm6
+        vaesenc	128(%rdx), %xmm7, %xmm7
+        vaesenc	144(%rdx), %xmm0, %xmm0
+        vaesenc	144(%rdx), %xmm1, %xmm1
+        vaesenc	144(%rdx), %xmm2, %xmm2
+        vaesenc	144(%rdx), %xmm3, %xmm3
+        vaesenc	144(%rdx), %xmm4, %xmm4
+        vaesenc	144(%rdx), %xmm5, %xmm5
+        vaesenc	144(%rdx), %xmm6, %xmm6
+        vaesenc	144(%rdx), %xmm7, %xmm7
+        vaesenclast	160(%rdx), %xmm0, %xmm0
+        vaesenclast	160(%rdx), %xmm1, %xmm1
+        vaesenclast	160(%rdx), %xmm2, %xmm2
+        vaesenclast	160(%rdx), %xmm3, %xmm3
+        vaesenclast	160(%rdx), %xmm4, %xmm4
+        vaesenclast	160(%rdx), %xmm5, %xmm5
+        vaesenclast	160(%rdx), %xmm6, %xmm6
+        vaesenclast	160(%rdx), %xmm7, %xmm7
+        vpand	%xmm8, %xmm0, %xmm0
+        vmovdqu	%xmm0, (%rsi)
+        vpand	%xmm8, %xmm1, %xmm1
+        vmovdqu	%xmm1, 16(%rsi)
+        vpand	%xmm8, %xmm2, %xmm2
+        vmovdqu	%xmm2, 32(%rsi)
+        vpand	%xmm8, %xmm3, %xmm3
+        vmovdqu	%xmm3, 48(%rsi)
+        vpand	%xmm8, %xmm4, %xmm4
+        vmovdqu	%xmm4, 64(%rsi)
+        vpand	%xmm8, %xmm5, %xmm5
+        vmovdqu	%xmm5, 80(%rsi)
+        vpand	%xmm8, %xmm6, %xmm6
+        vmovdqu	%xmm6, 96(%rsi)
+        vpand	%xmm8, %xmm7, %xmm7
+        vmovdqu	%xmm7, 112(%rsi)
+        addq	$0x80, %rsi
+        addq	$8, %r13
+        jmp	L_frodokem_gen_a_rows_aes_aesni_blk
+L_frodokem_gen_a_rows_aes_aesni_tail:
+        cmpq	%r10, %r13
+        jge	L_frodokem_gen_a_rows_aes_aesni_next
+        vmovd	%r14d, %xmm0
+        addq	$0x80000, %r14
+        vpxor	(%rdx), %xmm0, %xmm0
+        vaesenc	16(%rdx), %xmm0, %xmm0
+        vaesenc	32(%rdx), %xmm0, %xmm0
+        vaesenc	48(%rdx), %xmm0, %xmm0
+        vaesenc	64(%rdx), %xmm0, %xmm0
+        vaesenc	80(%rdx), %xmm0, %xmm0
+        vaesenc	96(%rdx), %xmm0, %xmm0
+        vaesenc	112(%rdx), %xmm0, %xmm0
+        vaesenc	128(%rdx), %xmm0, %xmm0
+        vaesenc	144(%rdx), %xmm0, %xmm0
+        vaesenclast	160(%rdx), %xmm0, %xmm0
+        vpand	%xmm8, %xmm0, %xmm0
+        vmovdqu	%xmm0, (%rsi)
+        addq	$16, %rsi
+        addq	$0x01, %r13
+        jmp	L_frodokem_gen_a_rows_aes_aesni_tail
+L_frodokem_gen_a_rows_aes_aesni_next:
+        addq	$0x01, %r12
+        cmpq	%r11, %r12
+        jl	L_frodokem_gen_a_rows_aes_aesni_row
+        vzeroupper
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_gen_a_rows_aes_aesni,.-frodokem_gen_a_rows_aes_aesni
+#endif /* __APPLE__ */
+#endif /* HAVE_INTEL_AVX2 */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+#ifdef HAVE_INTEL_AVX512
+#ifndef __APPLE__
+.text
+.globl	frodokem_sa_accum_avx512
+.type	frodokem_sa_accum_avx512,@function
+.align	16
+frodokem_sa_accum_avx512:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sa_accum_avx512
+.p2align	4
+_frodokem_sa_accum_avx512:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        pushq	%rbp
+        movslq	%ecx, %rcx
+        shlq	$1, %rcx
+        addq	%rcx, %rsi
+        movslq	%r8d, %rax
+        shlq	$1, %rax
+        movq	%rax, %rcx
+        andq	$-64, %rcx
+        movq	%rdx, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	%r11, %r12
+        addq	%rax, %r12
+        movq	%r12, %r13
+        addq	%rax, %r13
+        movq	%r13, %r14
+        addq	%rax, %r14
+        movq	%r14, %r15
+        addq	%rax, %r15
+        movq	$8, %rbp
+L_frodokem_sa_accum_avx512_i:
+        vpbroadcastw	(%rsi), %zmm0
+        vpbroadcastw	2(%rsi), %zmm1
+        vpbroadcastw	4(%rsi), %zmm2
+        vpbroadcastw	6(%rsi), %zmm3
+        vpbroadcastw	8(%rsi), %zmm4
+        vpbroadcastw	10(%rsi), %zmm5
+        vpbroadcastw	12(%rsi), %zmm6
+        vpbroadcastw	14(%rsi), %zmm7
+        xorq	%rbx, %rbx
+L_frodokem_sa_accum_avx512_k:
+        vmovdqu64	(%rdi,%rbx,1), %zmm8
+        vpmullw	(%rdx,%rbx,1), %zmm0, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vpmullw	(%r9,%rbx,1), %zmm1, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vpmullw	(%r10,%rbx,1), %zmm2, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vpmullw	(%r11,%rbx,1), %zmm3, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vpmullw	(%r12,%rbx,1), %zmm4, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vpmullw	(%r13,%rbx,1), %zmm5, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vpmullw	(%r14,%rbx,1), %zmm6, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vpmullw	(%r15,%rbx,1), %zmm7, %zmm9
+        vpaddw	%zmm9, %zmm8, %zmm8
+        vmovdqu64	%zmm8, (%rdi,%rbx,1)
+        addq	$0x40, %rbx
+        cmpq	%rcx, %rbx
+        jl	L_frodokem_sa_accum_avx512_k
+        cmpq	%rax, %rbx
+        jge	L_frodokem_sa_accum_avx512_tail
+        vmovdqu	(%rdi,%rbx,1), %ymm8
+        vpmullw	(%rdx,%rbx,1), %ymm0, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vpmullw	(%r9,%rbx,1), %ymm1, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vpmullw	(%r10,%rbx,1), %ymm2, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vpmullw	(%r11,%rbx,1), %ymm3, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vpmullw	(%r12,%rbx,1), %ymm4, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vpmullw	(%r13,%rbx,1), %ymm5, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vpmullw	(%r14,%rbx,1), %ymm6, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vpmullw	(%r15,%rbx,1), %ymm7, %ymm9
+        vpaddw	%ymm9, %ymm8, %ymm8
+        vmovdqu	%ymm8, (%rdi,%rbx,1)
+L_frodokem_sa_accum_avx512_tail:
+        addq	%rax, %rdi
+        addq	%rax, %rsi
+        subq	$0x01, %rbp
+        jnz	L_frodokem_sa_accum_avx512_i
+        vzeroupper
+        popq	%rbp
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_sa_accum_avx512,.-frodokem_sa_accum_avx512
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_as_accum_avx512
+.type	frodokem_as_accum_avx512,@function
+.align	16
+frodokem_as_accum_avx512:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_as_accum_avx512
+.p2align	4
+_frodokem_as_accum_avx512:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        pushq	%rbp
+        movslq	%ecx, %rcx
+        shlq	$4, %rcx
+        addq	%rcx, %rdi
+        movslq	%r8d, %rax
+        shlq	$1, %rax
+        movq	%rax, %rcx
+        andq	$-64, %rcx
+        movq	%rsi, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	%r11, %r12
+        addq	%rax, %r12
+        movq	%r12, %r13
+        addq	%rax, %r13
+        movq	%r13, %r14
+        addq	%rax, %r14
+        movq	%r14, %r15
+        addq	%rax, %r15
+        movq	$8, %rbp
+        vpcmpeqd	%xmm13, %xmm13, %xmm13
+        vpsrld	$16, %xmm13, %xmm13
+L_frodokem_as_accum_avx512_r:
+        vpxorq	%zmm14, %zmm14, %zmm14
+        vpxorq	%ymm22, %ymm22, %ymm22
+        vpxorq	%zmm15, %zmm15, %zmm15
+        vpxorq	%ymm23, %ymm23, %ymm23
+        vpxorq	%zmm16, %zmm16, %zmm16
+        vpxorq	%ymm24, %ymm24, %ymm24
+        vpxorq	%zmm17, %zmm17, %zmm17
+        vpxorq	%ymm25, %ymm25, %ymm25
+        vpxorq	%zmm18, %zmm18, %zmm18
+        vpxorq	%ymm26, %ymm26, %ymm26
+        vpxorq	%zmm19, %zmm19, %zmm19
+        vpxorq	%ymm27, %ymm27, %ymm27
+        vpxorq	%zmm20, %zmm20, %zmm20
+        vpxorq	%ymm28, %ymm28, %ymm28
+        vpxorq	%zmm21, %zmm21, %zmm21
+        vpxorq	%ymm29, %ymm29, %ymm29
+        xorq	%rbx, %rbx
+L_frodokem_as_accum_avx512_j:
+        vmovdqu64	(%rdx,%rbx,1), %zmm0
+        vpmaddwd	(%rsi,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm14, %zmm14
+        vpmaddwd	(%r9,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm15, %zmm15
+        vpmaddwd	(%r10,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm16, %zmm16
+        vpmaddwd	(%r11,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm17, %zmm17
+        vpmaddwd	(%r12,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm18, %zmm18
+        vpmaddwd	(%r13,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm19, %zmm19
+        vpmaddwd	(%r14,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm20, %zmm20
+        vpmaddwd	(%r15,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm21, %zmm21
+        addq	$0x40, %rbx
+        cmpq	%rcx, %rbx
+        jl	L_frodokem_as_accum_avx512_j
+        cmpq	%rax, %rbx
+        jge	L_frodokem_as_accum_avx512_tail
+        vmovdqu	(%rdx,%rbx,1), %ymm0
+        vpmaddwd	(%rsi,%rbx,1), %ymm0, %ymm22
+        vpmaddwd	(%r9,%rbx,1), %ymm0, %ymm23
+        vpmaddwd	(%r10,%rbx,1), %ymm0, %ymm24
+        vpmaddwd	(%r11,%rbx,1), %ymm0, %ymm25
+        vpmaddwd	(%r12,%rbx,1), %ymm0, %ymm26
+        vpmaddwd	(%r13,%rbx,1), %ymm0, %ymm27
+        vpmaddwd	(%r14,%rbx,1), %ymm0, %ymm28
+        vpmaddwd	(%r15,%rbx,1), %ymm0, %ymm29
+L_frodokem_as_accum_avx512_tail:
+        vextracti64x4	$0x01, %zmm14, %ymm1
+        vpaddd	%ymm1, %ymm14, %ymm1
+        vpaddd	%ymm22, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm2
+        vextracti64x4	$0x01, %zmm15, %ymm1
+        vpaddd	%ymm1, %ymm15, %ymm1
+        vpaddd	%ymm23, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm3
+        vextracti64x4	$0x01, %zmm16, %ymm1
+        vpaddd	%ymm1, %ymm16, %ymm1
+        vpaddd	%ymm24, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm4
+        vextracti64x4	$0x01, %zmm17, %ymm1
+        vpaddd	%ymm1, %ymm17, %ymm1
+        vpaddd	%ymm25, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm5
+        vextracti64x4	$0x01, %zmm18, %ymm1
+        vpaddd	%ymm1, %ymm18, %ymm1
+        vpaddd	%ymm26, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm6
+        vextracti64x4	$0x01, %zmm19, %ymm1
+        vpaddd	%ymm1, %ymm19, %ymm1
+        vpaddd	%ymm27, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm7
+        vextracti64x4	$0x01, %zmm20, %ymm1
+        vpaddd	%ymm1, %ymm20, %ymm1
+        vpaddd	%ymm28, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm8
+        vextracti64x4	$0x01, %zmm21, %ymm1
+        vpaddd	%ymm1, %ymm21, %ymm1
+        vpaddd	%ymm29, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm9
+        vphaddd	%xmm3, %xmm2, %xmm11
+        vphaddd	%xmm5, %xmm4, %xmm12
+        vphaddd	%xmm12, %xmm11, %xmm10
+        vphaddd	%xmm7, %xmm6, %xmm11
+        vphaddd	%xmm9, %xmm8, %xmm12
+        vphaddd	%xmm12, %xmm11, %xmm11
+        vpand	%xmm13, %xmm10, %xmm10
+        vpand	%xmm13, %xmm11, %xmm11
+        vpackusdw	%xmm11, %xmm10, %xmm10
+        vpaddw	(%rdi), %xmm10, %xmm10
+        vmovdqu	%xmm10, (%rdi)
+        addq	%rax, %rdx
+        addq	$16, %rdi
+        subq	$0x01, %rbp
+        jnz	L_frodokem_as_accum_avx512_r
+        vzeroupper
+        popq	%rbp
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_as_accum_avx512,.-frodokem_as_accum_avx512
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_bs_avx512
+.type	frodokem_mul_bs_avx512,@function
+.align	16
+frodokem_mul_bs_avx512:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_bs_avx512
+.p2align	4
+_frodokem_mul_bs_avx512:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        pushq	%rbp
+        movslq	%ecx, %rax
+        shlq	$1, %rax
+        movq	%rax, %rcx
+        andq	$-64, %rcx
+        movq	%rdx, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	%r11, %r12
+        addq	%rax, %r12
+        movq	%r12, %r13
+        addq	%rax, %r13
+        movq	%r13, %r14
+        addq	%rax, %r14
+        movq	%r14, %r15
+        addq	%rax, %r15
+        movq	$8, %rbp
+        vmovd	%r8, %xmm13
+        vpbroadcastd	%xmm13, %xmm13
+L_frodokem_mul_bs_avx512_r:
+        vpxorq	%zmm14, %zmm14, %zmm14
+        vpxorq	%ymm22, %ymm22, %ymm22
+        vpxorq	%zmm15, %zmm15, %zmm15
+        vpxorq	%ymm23, %ymm23, %ymm23
+        vpxorq	%zmm16, %zmm16, %zmm16
+        vpxorq	%ymm24, %ymm24, %ymm24
+        vpxorq	%zmm17, %zmm17, %zmm17
+        vpxorq	%ymm25, %ymm25, %ymm25
+        vpxorq	%zmm18, %zmm18, %zmm18
+        vpxorq	%ymm26, %ymm26, %ymm26
+        vpxorq	%zmm19, %zmm19, %zmm19
+        vpxorq	%ymm27, %ymm27, %ymm27
+        vpxorq	%zmm20, %zmm20, %zmm20
+        vpxorq	%ymm28, %ymm28, %ymm28
+        vpxorq	%zmm21, %zmm21, %zmm21
+        vpxorq	%ymm29, %ymm29, %ymm29
+        xorq	%rbx, %rbx
+L_frodokem_mul_bs_avx512_j:
+        vmovdqu64	(%rsi,%rbx,1), %zmm0
+        vpmaddwd	(%rdx,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm14, %zmm14
+        vpmaddwd	(%r9,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm15, %zmm15
+        vpmaddwd	(%r10,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm16, %zmm16
+        vpmaddwd	(%r11,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm17, %zmm17
+        vpmaddwd	(%r12,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm18, %zmm18
+        vpmaddwd	(%r13,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm19, %zmm19
+        vpmaddwd	(%r14,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm20, %zmm20
+        vpmaddwd	(%r15,%rbx,1), %zmm0, %zmm1
+        vpaddd	%zmm1, %zmm21, %zmm21
+        addq	$0x40, %rbx
+        cmpq	%rcx, %rbx
+        jl	L_frodokem_mul_bs_avx512_j
+        cmpq	%rax, %rbx
+        jge	L_frodokem_mul_bs_avx512_tail
+        vmovdqu	(%rsi,%rbx,1), %ymm0
+        vpmaddwd	(%rdx,%rbx,1), %ymm0, %ymm22
+        vpmaddwd	(%r9,%rbx,1), %ymm0, %ymm23
+        vpmaddwd	(%r10,%rbx,1), %ymm0, %ymm24
+        vpmaddwd	(%r11,%rbx,1), %ymm0, %ymm25
+        vpmaddwd	(%r12,%rbx,1), %ymm0, %ymm26
+        vpmaddwd	(%r13,%rbx,1), %ymm0, %ymm27
+        vpmaddwd	(%r14,%rbx,1), %ymm0, %ymm28
+        vpmaddwd	(%r15,%rbx,1), %ymm0, %ymm29
+L_frodokem_mul_bs_avx512_tail:
+        vextracti64x4	$0x01, %zmm14, %ymm1
+        vpaddd	%ymm1, %ymm14, %ymm1
+        vpaddd	%ymm22, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm2
+        vextracti64x4	$0x01, %zmm15, %ymm1
+        vpaddd	%ymm1, %ymm15, %ymm1
+        vpaddd	%ymm23, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm3
+        vextracti64x4	$0x01, %zmm16, %ymm1
+        vpaddd	%ymm1, %ymm16, %ymm1
+        vpaddd	%ymm24, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm4
+        vextracti64x4	$0x01, %zmm17, %ymm1
+        vpaddd	%ymm1, %ymm17, %ymm1
+        vpaddd	%ymm25, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm5
+        vextracti64x4	$0x01, %zmm18, %ymm1
+        vpaddd	%ymm1, %ymm18, %ymm1
+        vpaddd	%ymm26, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm6
+        vextracti64x4	$0x01, %zmm19, %ymm1
+        vpaddd	%ymm1, %ymm19, %ymm1
+        vpaddd	%ymm27, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm7
+        vextracti64x4	$0x01, %zmm20, %ymm1
+        vpaddd	%ymm1, %ymm20, %ymm1
+        vpaddd	%ymm28, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm8
+        vextracti64x4	$0x01, %zmm21, %ymm1
+        vpaddd	%ymm1, %ymm21, %ymm1
+        vpaddd	%ymm29, %ymm1, %ymm1
+        vextracti128	$0x01, %ymm1, %xmm0
+        vpaddd	%xmm0, %xmm1, %xmm9
+        vphaddd	%xmm3, %xmm2, %xmm11
+        vphaddd	%xmm5, %xmm4, %xmm12
+        vphaddd	%xmm12, %xmm11, %xmm10
+        vphaddd	%xmm7, %xmm6, %xmm11
+        vphaddd	%xmm9, %xmm8, %xmm12
+        vphaddd	%xmm12, %xmm11, %xmm11
+        vpand	%xmm13, %xmm10, %xmm10
+        vpand	%xmm13, %xmm11, %xmm11
+        vpackusdw	%xmm11, %xmm10, %xmm10
+        vmovdqu	%xmm10, (%rdi)
+        addq	%rax, %rsi
+        addq	$16, %rdi
+        subq	$0x01, %rbp
+        jnz	L_frodokem_mul_bs_avx512_r
+        vzeroupper
+        popq	%rbp
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_mul_bs_avx512,.-frodokem_mul_bs_avx512
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_mul_add_sb_plus_e_avx512
+.type	frodokem_mul_add_sb_plus_e_avx512,@function
+.align	16
+frodokem_mul_add_sb_plus_e_avx512:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_mul_add_sb_plus_e_avx512
+.p2align	4
+_frodokem_mul_add_sb_plus_e_avx512:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        pushq	%rbx
+        movslq	%ecx, %rax
+        shlq	$1, %rax
+        movq	%rdx, %r9
+        addq	%rax, %r9
+        movq	%r9, %r10
+        addq	%rax, %r10
+        movq	%r10, %r11
+        addq	%rax, %r11
+        movq	%r11, %r12
+        addq	%rax, %r12
+        movq	%r12, %r13
+        addq	%rax, %r13
+        movq	%r13, %r14
+        addq	%rax, %r14
+        movq	%r14, %r15
+        addq	%rax, %r15
+        vmovd	%r8, %xmm5
+        vpbroadcastw	%xmm5, %zmm5
+        vmovdqu64	(%rdi), %zmm0
+        vmovdqu64	64(%rdi), %zmm1
+        xorq	%rbx, %rbx
+L_frodokem_mul_add_sb_plus_e_avx512_j:
+        vbroadcasti32x4	(%rsi), %zmm2
+        vpbroadcastw	(%rdx,%rbx,1), %zmm3
+        vpbroadcastw	(%r9,%rbx,1), %zmm4
+        vinserti32x4	$0x01, %xmm4, %zmm3, %zmm3
+        vpbroadcastw	(%r10,%rbx,1), %zmm4
+        vinserti32x4	$2, %xmm4, %zmm3, %zmm3
+        vpbroadcastw	(%r11,%rbx,1), %zmm4
+        vinserti32x4	$3, %xmm4, %zmm3, %zmm3
+        vpmullw	%zmm2, %zmm3, %zmm4
+        vpaddw	%zmm4, %zmm0, %zmm0
+        vpbroadcastw	(%r12,%rbx,1), %zmm3
+        vpbroadcastw	(%r13,%rbx,1), %zmm4
+        vinserti32x4	$0x01, %xmm4, %zmm3, %zmm3
+        vpbroadcastw	(%r14,%rbx,1), %zmm4
+        vinserti32x4	$2, %xmm4, %zmm3, %zmm3
+        vpbroadcastw	(%r15,%rbx,1), %zmm4
+        vinserti32x4	$3, %xmm4, %zmm3, %zmm3
+        vpmullw	%zmm2, %zmm3, %zmm4
+        vpaddw	%zmm4, %zmm1, %zmm1
+        addq	$16, %rsi
+        addq	$2, %rbx
+        cmpq	%rax, %rbx
+        jl	L_frodokem_mul_add_sb_plus_e_avx512_j
+        vpandq	%zmm5, %zmm0, %zmm0
+        vmovdqu64	%zmm0, (%rdi)
+        vpandq	%zmm5, %zmm1, %zmm1
+        vmovdqu64	%zmm1, 64(%rdi)
+        vzeroupper
+        popq	%rbx
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_mul_add_sb_plus_e_avx512,.-frodokem_mul_add_sb_plus_e_avx512
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_add_avx512
+.type	frodokem_add_avx512,@function
+.align	16
+frodokem_add_avx512:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_add_avx512
+.p2align	4
+_frodokem_add_avx512:
+#endif /* __APPLE__ */
+        vmovd	%rdx, %xmm0
+        vpbroadcastw	%xmm0, %zmm0
+        vmovdqu64	(%rdi), %zmm1
+        vpaddw	(%rsi), %zmm1, %zmm1
+        vpandq	%zmm0, %zmm1, %zmm1
+        vmovdqu64	%zmm1, (%rdi)
+        vmovdqu64	64(%rdi), %zmm2
+        vpaddw	64(%rsi), %zmm2, %zmm2
+        vpandq	%zmm0, %zmm2, %zmm2
+        vmovdqu64	%zmm2, 64(%rdi)
+        vzeroupper
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_add_avx512,.-frodokem_add_avx512
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_sample_avx512
+.type	frodokem_sample_avx512,@function
+.align	16
+frodokem_sample_avx512:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_sample_avx512
+.p2align	4
+_frodokem_sample_avx512:
+#endif /* __APPLE__ */
+        movslq	%esi, %rax
+        shlq	$1, %rax
+        vpternlogd	$0xff, %zmm0, %zmm0, %zmm0
+        vpsrlw	$15, %zmm0, %zmm0
+        vpxorq	%zmm1, %zmm1, %zmm1
+        xorq	%r8, %r8
+L_frodokem_sample_avx512_blk:
+        vmovdqu64	(%rdi,%r8,1), %zmm2
+        vpsrlw	$0x01, %zmm2, %zmm3
+        vpandq	%zmm0, %zmm2, %zmm4
+        vpxorq	%zmm5, %zmm5, %zmm5
+        movq	%rdx, %r9
+        movl	%ecx, %r10d
+L_frodokem_sample_avx512_cdf:
+        vpbroadcastw	(%r9), %zmm6
+        vpsubw	%zmm3, %zmm6, %zmm6
+        vpsrlw	$15, %zmm6, %zmm6
+        vpaddw	%zmm6, %zmm5, %zmm5
+        addq	$2, %r9
+        subq	$0x01, %r10
+        jnz	L_frodokem_sample_avx512_cdf
+        vpsubw	%zmm4, %zmm1, %zmm7
+        vpxorq	%zmm7, %zmm5, %zmm5
+        vpaddw	%zmm4, %zmm5, %zmm5
+        vmovdqu64	%zmm5, (%rdi,%r8,1)
+        addq	$0x40, %r8
+        cmpq	%rax, %r8
+        jl	L_frodokem_sample_avx512_blk
+        vzeroupper
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_sample_avx512,.-frodokem_sample_avx512
+#endif /* __APPLE__ */
+#ifndef __APPLE__
+.text
+.globl	frodokem_gen_a_rows_aes_avx512
+.type	frodokem_gen_a_rows_aes_avx512,@function
+.align	16
+frodokem_gen_a_rows_aes_avx512:
+#else
+.section	__TEXT,__text
+.globl	_frodokem_gen_a_rows_aes_avx512
+.p2align	4
+_frodokem_gen_a_rows_aes_avx512:
+#endif /* __APPLE__ */
+        pushq	%r12
+        pushq	%r13
+        pushq	%r14
+        pushq	%r15
+        movq	40(%rsp), %rax
+        vbroadcasti32x4	(%rdx), %zmm0
+        vbroadcasti32x4	16(%rdx), %zmm1
+        vbroadcasti32x4	32(%rdx), %zmm2
+        vbroadcasti32x4	48(%rdx), %zmm3
+        vbroadcasti32x4	64(%rdx), %zmm4
+        vbroadcasti32x4	80(%rdx), %zmm5
+        vbroadcasti32x4	96(%rdx), %zmm6
+        vbroadcasti32x4	112(%rdx), %zmm7
+        vbroadcasti32x4	128(%rdx), %zmm8
+        vbroadcasti32x4	144(%rdx), %zmm9
+        vbroadcasti32x4	160(%rdx), %zmm10
+        vmovd	%rax, %xmm15
+        vpbroadcastw	%xmm15, %zmm15
+        movslq	%r9d, %r10
+        shlq	$1, %r10
+        movslq	%r8d, %r11
+        imulq	%r10, %r11
+        movslq	%ecx, %rcx
+        xorq	%r15, %r15
+        movq	%rdi, %r12
+L_frodokem_gen_a_rows_aes_avx512_row:
+        movl	%ecx, %r14d
+        movq	%r12, %r13
+        addq	%r10, %r13
+L_frodokem_gen_a_rows_aes_avx512_blk:
+        movq	%r14, (%r12)
+        movq	%r15, 8(%r12)
+        addq	$0x80000, %r14
+        addq	$16, %r12
+        cmpq	%r13, %r12
+        jl	L_frodokem_gen_a_rows_aes_avx512_blk
+        addq	$0x01, %rcx
+        movq	%rdi, %r13
+        addq	%r11, %r13
+        cmpq	%r13, %r12
+        jl	L_frodokem_gen_a_rows_aes_avx512_row
+        xorq	%r14, %r14
+L_frodokem_gen_a_rows_aes_avx512_aes:
+        vmovdqu64	(%rdi), %zmm11
+        vmovdqu64	64(%rdi), %zmm12
+        vmovdqu64	128(%rdi), %zmm13
+        vmovdqu64	192(%rdi), %zmm14
+        vpxorq	%zmm0, %zmm11, %zmm11
+        vpxorq	%zmm0, %zmm12, %zmm12
+        vpxorq	%zmm0, %zmm13, %zmm13
+        vpxorq	%zmm0, %zmm14, %zmm14
+        vaesenc	%zmm1, %zmm11, %zmm11
+        vaesenc	%zmm1, %zmm12, %zmm12
+        vaesenc	%zmm1, %zmm13, %zmm13
+        vaesenc	%zmm1, %zmm14, %zmm14
+        vaesenc	%zmm2, %zmm11, %zmm11
+        vaesenc	%zmm2, %zmm12, %zmm12
+        vaesenc	%zmm2, %zmm13, %zmm13
+        vaesenc	%zmm2, %zmm14, %zmm14
+        vaesenc	%zmm3, %zmm11, %zmm11
+        vaesenc	%zmm3, %zmm12, %zmm12
+        vaesenc	%zmm3, %zmm13, %zmm13
+        vaesenc	%zmm3, %zmm14, %zmm14
+        vaesenc	%zmm4, %zmm11, %zmm11
+        vaesenc	%zmm4, %zmm12, %zmm12
+        vaesenc	%zmm4, %zmm13, %zmm13
+        vaesenc	%zmm4, %zmm14, %zmm14
+        vaesenc	%zmm5, %zmm11, %zmm11
+        vaesenc	%zmm5, %zmm12, %zmm12
+        vaesenc	%zmm5, %zmm13, %zmm13
+        vaesenc	%zmm5, %zmm14, %zmm14
+        vaesenc	%zmm6, %zmm11, %zmm11
+        vaesenc	%zmm6, %zmm12, %zmm12
+        vaesenc	%zmm6, %zmm13, %zmm13
+        vaesenc	%zmm6, %zmm14, %zmm14
+        vaesenc	%zmm7, %zmm11, %zmm11
+        vaesenc	%zmm7, %zmm12, %zmm12
+        vaesenc	%zmm7, %zmm13, %zmm13
+        vaesenc	%zmm7, %zmm14, %zmm14
+        vaesenc	%zmm8, %zmm11, %zmm11
+        vaesenc	%zmm8, %zmm12, %zmm12
+        vaesenc	%zmm8, %zmm13, %zmm13
+        vaesenc	%zmm8, %zmm14, %zmm14
+        vaesenc	%zmm9, %zmm11, %zmm11
+        vaesenc	%zmm9, %zmm12, %zmm12
+        vaesenc	%zmm9, %zmm13, %zmm13
+        vaesenc	%zmm9, %zmm14, %zmm14
+        vaesenclast	%zmm10, %zmm11, %zmm11
+        vaesenclast	%zmm10, %zmm12, %zmm12
+        vaesenclast	%zmm10, %zmm13, %zmm13
+        vaesenclast	%zmm10, %zmm14, %zmm14
+        vpandq	%zmm15, %zmm11, %zmm11
+        vpandq	%zmm15, %zmm12, %zmm12
+        vpandq	%zmm15, %zmm13, %zmm13
+        vpandq	%zmm15, %zmm14, %zmm14
+        vmovdqu64	%zmm11, (%rsi)
+        vmovdqu64	%zmm12, 64(%rsi)
+        vmovdqu64	%zmm13, 128(%rsi)
+        vmovdqu64	%zmm14, 192(%rsi)
+        addq	$0x100, %rdi
+        addq	$0x100, %rsi
+        addq	$0x100, %r14
+        cmpq	%r11, %r14
+        jl	L_frodokem_gen_a_rows_aes_avx512_aes
+        vzeroupper
+        popq	%r15
+        popq	%r14
+        popq	%r13
+        popq	%r12
+        repz retq
+#ifndef __APPLE__
+.size	frodokem_gen_a_rows_aes_avx512,.-frodokem_gen_a_rows_aes_avx512
+#endif /* __APPLE__ */
+#endif /* HAVE_INTEL_AVX512 */
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+#if defined(__linux__) && defined(__ELF__)
+.section	.note.GNU-stack,"",%progbits
+#endif
diff --git a/wolfcrypt/src/wc_frodokem_asm.asm b/wolfcrypt/src/wc_frodokem_asm.asm
new file mode 100644
index 00000000000..1ce1e92c2b6
--- /dev/null
+++ b/wolfcrypt/src/wc_frodokem_asm.asm
@@ -0,0 +1,1613 @@
+; /* wc_frodokem_asm.asm */
+; /*
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+IF @Version LT 1200
+; AVX2 instructions not recognized by old versions of MASM
+IFNDEF NO_AVX2_SUPPORT
+NO_AVX2_SUPPORT = 1
+ENDIF
+; MOVBE instruction not recognized by old versions of MASM
+IFNDEF NO_MOVBE_SUPPORT
+NO_MOVBE_SUPPORT = 1
+ENDIF
+ENDIF
+
+IFNDEF HAVE_INTEL_AVX1
+HAVE_INTEL_AVX1 = 1
+ENDIF
+IFNDEF NO_AVX2_SUPPORT
+HAVE_INTEL_AVX2 = 1
+ENDIF
+
+IFNDEF _WIN64
+_WIN64 = 1
+ENDIF
+
+IFDEF WOLFSSL_HAVE_FRODOKEM
+IFDEF HAVE_INTEL_AVX2
+_TEXT SEGMENT READONLY PARA
+frodokem_sa_accum_avx2 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        mov	rax, QWORD PTR [rsp+72]
+        movsxd	r9, r9d
+        shl	r9, 1
+        add	rdx, r9
+        movsxd	r10, eax
+        shl	r10, 1
+        mov	r11, r8
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r15, 8
+L_frodokem_sa_accum_avx2_i:
+        vpbroadcastw	ymm0, WORD PTR [rdx]
+        vpbroadcastw	ymm1, WORD PTR [rdx+2]
+        vpbroadcastw	ymm2, WORD PTR [rdx+4]
+        vpbroadcastw	ymm3, WORD PTR [rdx+6]
+        xor	r14, r14
+L_frodokem_sa_accum_avx2_k:
+        vmovdqu	ymm4, YMMWORD PTR [rcx+r14]
+        vpmullw	ymm5, ymm0, [r8+r14]
+        vpaddw	ymm4, ymm4, ymm5
+        vpmullw	ymm5, ymm1, [r11+r14]
+        vpaddw	ymm4, ymm4, ymm5
+        vpmullw	ymm5, ymm2, [r12+r14]
+        vpaddw	ymm4, ymm4, ymm5
+        vpmullw	ymm5, ymm3, [r13+r14]
+        vpaddw	ymm4, ymm4, ymm5
+        vmovdqu	YMMWORD PTR [rcx+r14], ymm4
+        add	r14, 32
+        cmp	r14, r10
+        jl	L_frodokem_sa_accum_avx2_k
+        add	rcx, r10
+        add	rdx, r10
+        sub	r15, 1
+        jnz	L_frodokem_sa_accum_avx2_i
+        vzeroupper
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_sa_accum_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_as_accum_avx2 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        push	rbp
+        mov	rax, QWORD PTR [rsp+104]
+        sub	rsp, 112
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        movsxd	r9, r9d
+        shl	r9, 4
+        add	rcx, r9
+        movsxd	r10, eax
+        shl	r10, 1
+        mov	r11, rdx
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r14, r13
+        add	r14, r10
+        mov	r15, r14
+        add	r15, r10
+        mov	rdi, r15
+        add	rdi, r10
+        mov	rsi, rdi
+        add	rsi, r10
+        mov	rbp, 4
+        vpcmpeqd	xmm12, xmm12, xmm12
+        vpsrld	xmm12, xmm12, 16
+L_frodokem_as_accum_avx2_r:
+        vpxor	ymm0, ymm0, ymm0
+        vpxor	ymm1, ymm1, ymm1
+        vpxor	ymm2, ymm2, ymm2
+        vpxor	ymm3, ymm3, ymm3
+        vpxor	ymm4, ymm4, ymm4
+        vpxor	ymm5, ymm5, ymm5
+        vpxor	ymm6, ymm6, ymm6
+        vpxor	ymm7, ymm7, ymm7
+        xor	rbx, rbx
+L_frodokem_as_accum_avx2_j:
+        vmovdqu	ymm8, YMMWORD PTR [r8+rbx]
+        vpmaddwd	ymm10, ymm8, [rdx+rbx]
+        vpaddd	ymm0, ymm0, ymm10
+        vpmaddwd	ymm10, ymm8, [r11+rbx]
+        vpaddd	ymm1, ymm1, ymm10
+        vpmaddwd	ymm10, ymm8, [r12+rbx]
+        vpaddd	ymm2, ymm2, ymm10
+        vpmaddwd	ymm10, ymm8, [r13+rbx]
+        vpaddd	ymm3, ymm3, ymm10
+        vpmaddwd	ymm10, ymm8, [r14+rbx]
+        vpaddd	ymm4, ymm4, ymm10
+        vpmaddwd	ymm10, ymm8, [r15+rbx]
+        vpaddd	ymm5, ymm5, ymm10
+        vpmaddwd	ymm10, ymm8, [rdi+rbx]
+        vpaddd	ymm6, ymm6, ymm10
+        vpmaddwd	ymm10, ymm8, [rsi+rbx]
+        vpaddd	ymm7, ymm7, ymm10
+        add	rbx, 32
+        cmp	rbx, r10
+        jl	L_frodokem_as_accum_avx2_j
+        vextracti128	xmm8, ymm0, 1
+        vpaddd	xmm0, xmm0, xmm8
+        vextracti128	xmm8, ymm1, 1
+        vpaddd	xmm1, xmm1, xmm8
+        vextracti128	xmm8, ymm2, 1
+        vpaddd	xmm2, xmm2, xmm8
+        vextracti128	xmm8, ymm3, 1
+        vpaddd	xmm3, xmm3, xmm8
+        vextracti128	xmm8, ymm4, 1
+        vpaddd	xmm4, xmm4, xmm8
+        vextracti128	xmm8, ymm5, 1
+        vpaddd	xmm5, xmm5, xmm8
+        vextracti128	xmm8, ymm6, 1
+        vpaddd	xmm6, xmm6, xmm8
+        vextracti128	xmm8, ymm7, 1
+        vpaddd	xmm7, xmm7, xmm8
+        vphaddd	xmm10, xmm0, xmm1
+        vphaddd	xmm11, xmm2, xmm3
+        vphaddd	xmm9, xmm10, xmm11
+        vphaddd	xmm10, xmm4, xmm5
+        vphaddd	xmm11, xmm6, xmm7
+        vphaddd	xmm10, xmm10, xmm11
+        vpand	xmm9, xmm9, xmm12
+        vpand	xmm10, xmm10, xmm12
+        vpackusdw	xmm9, xmm9, xmm10
+        vpaddw	xmm9, xmm9, [rcx]
+        vmovdqu	OWORD PTR [rcx], xmm9
+        add	r8, r10
+        add	rcx, 16
+        sub	rbp, 1
+        jnz	L_frodokem_as_accum_avx2_r
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        add	rsp, 112
+        pop	rbp
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_as_accum_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_mul_bs_avx2 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        push	rbp
+        mov	rax, QWORD PTR [rsp+104]
+        sub	rsp, 112
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        movsxd	r10, r9d
+        shl	r10, 1
+        mov	r11, r8
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r14, r13
+        add	r14, r10
+        mov	r15, r14
+        add	r15, r10
+        mov	rdi, r15
+        add	rdi, r10
+        mov	rsi, rdi
+        add	rsi, r10
+        mov	rbp, 8
+        vmovd	xmm12, rax
+        vpbroadcastd	xmm12, xmm12
+L_frodokem_mul_bs_avx2_r:
+        vpxor	ymm0, ymm0, ymm0
+        vpxor	ymm1, ymm1, ymm1
+        vpxor	ymm2, ymm2, ymm2
+        vpxor	ymm3, ymm3, ymm3
+        vpxor	ymm4, ymm4, ymm4
+        vpxor	ymm5, ymm5, ymm5
+        vpxor	ymm6, ymm6, ymm6
+        vpxor	ymm7, ymm7, ymm7
+        xor	rbx, rbx
+L_frodokem_mul_bs_avx2_j:
+        vmovdqu	ymm8, YMMWORD PTR [rdx+rbx]
+        vpmaddwd	ymm10, ymm8, [r8+rbx]
+        vpaddd	ymm0, ymm0, ymm10
+        vpmaddwd	ymm10, ymm8, [r11+rbx]
+        vpaddd	ymm1, ymm1, ymm10
+        vpmaddwd	ymm10, ymm8, [r12+rbx]
+        vpaddd	ymm2, ymm2, ymm10
+        vpmaddwd	ymm10, ymm8, [r13+rbx]
+        vpaddd	ymm3, ymm3, ymm10
+        vpmaddwd	ymm10, ymm8, [r14+rbx]
+        vpaddd	ymm4, ymm4, ymm10
+        vpmaddwd	ymm10, ymm8, [r15+rbx]
+        vpaddd	ymm5, ymm5, ymm10
+        vpmaddwd	ymm10, ymm8, [rdi+rbx]
+        vpaddd	ymm6, ymm6, ymm10
+        vpmaddwd	ymm10, ymm8, [rsi+rbx]
+        vpaddd	ymm7, ymm7, ymm10
+        add	rbx, 32
+        cmp	rbx, r10
+        jl	L_frodokem_mul_bs_avx2_j
+        vextracti128	xmm8, ymm0, 1
+        vpaddd	xmm0, xmm0, xmm8
+        vextracti128	xmm8, ymm1, 1
+        vpaddd	xmm1, xmm1, xmm8
+        vextracti128	xmm8, ymm2, 1
+        vpaddd	xmm2, xmm2, xmm8
+        vextracti128	xmm8, ymm3, 1
+        vpaddd	xmm3, xmm3, xmm8
+        vextracti128	xmm8, ymm4, 1
+        vpaddd	xmm4, xmm4, xmm8
+        vextracti128	xmm8, ymm5, 1
+        vpaddd	xmm5, xmm5, xmm8
+        vextracti128	xmm8, ymm6, 1
+        vpaddd	xmm6, xmm6, xmm8
+        vextracti128	xmm8, ymm7, 1
+        vpaddd	xmm7, xmm7, xmm8
+        vphaddd	xmm10, xmm0, xmm1
+        vphaddd	xmm11, xmm2, xmm3
+        vphaddd	xmm9, xmm10, xmm11
+        vphaddd	xmm10, xmm4, xmm5
+        vphaddd	xmm11, xmm6, xmm7
+        vphaddd	xmm10, xmm10, xmm11
+        vpand	xmm9, xmm9, xmm12
+        vpand	xmm10, xmm10, xmm12
+        vpackusdw	xmm9, xmm9, xmm10
+        vmovdqu	OWORD PTR [rcx], xmm9
+        add	rdx, r10
+        add	rcx, 16
+        sub	rbp, 1
+        jnz	L_frodokem_mul_bs_avx2_r
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        add	rsp, 112
+        pop	rbp
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_mul_bs_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_mul_add_sb_plus_e_avx2 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        mov	rax, QWORD PTR [rsp+96]
+        sub	rsp, 32
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        movsxd	r10, r9d
+        shl	r10, 1
+        mov	r11, r8
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r14, r13
+        add	r14, r10
+        mov	r15, r14
+        add	r15, r10
+        mov	rdi, r15
+        add	rdi, r10
+        mov	rsi, rdi
+        add	rsi, r10
+        vmovd	xmm7, rax
+        vpbroadcastw	ymm7, xmm7
+        vmovdqu	ymm0, YMMWORD PTR [rcx]
+        vmovdqu	ymm1, YMMWORD PTR [rcx+32]
+        vmovdqu	ymm2, YMMWORD PTR [rcx+64]
+        vmovdqu	ymm3, YMMWORD PTR [rcx+96]
+        xor	rbx, rbx
+L_frodokem_mul_add_sb_plus_e_avx2_j:
+        vbroadcasti128	ymm4, OWORD PTR [rdx]
+        vpbroadcastw	ymm5, WORD PTR [r8+rbx]
+        vpbroadcastw	ymm6, WORD PTR [r11+rbx]
+        vinserti128	ymm5, ymm5, xmm6, 1
+        vpmullw	ymm6, ymm5, ymm4
+        vpaddw	ymm0, ymm0, ymm6
+        vpbroadcastw	ymm5, WORD PTR [r12+rbx]
+        vpbroadcastw	ymm6, WORD PTR [r13+rbx]
+        vinserti128	ymm5, ymm5, xmm6, 1
+        vpmullw	ymm6, ymm5, ymm4
+        vpaddw	ymm1, ymm1, ymm6
+        vpbroadcastw	ymm5, WORD PTR [r14+rbx]
+        vpbroadcastw	ymm6, WORD PTR [r15+rbx]
+        vinserti128	ymm5, ymm5, xmm6, 1
+        vpmullw	ymm6, ymm5, ymm4
+        vpaddw	ymm2, ymm2, ymm6
+        vpbroadcastw	ymm5, WORD PTR [rdi+rbx]
+        vpbroadcastw	ymm6, WORD PTR [rsi+rbx]
+        vinserti128	ymm5, ymm5, xmm6, 1
+        vpmullw	ymm6, ymm5, ymm4
+        vpaddw	ymm3, ymm3, ymm6
+        add	rdx, 16
+        add	rbx, 2
+        cmp	rbx, r10
+        jl	L_frodokem_mul_add_sb_plus_e_avx2_j
+        vpand	ymm0, ymm0, ymm7
+        vmovdqu	YMMWORD PTR [rcx], ymm0
+        vpand	ymm1, ymm1, ymm7
+        vmovdqu	YMMWORD PTR [rcx+32], ymm1
+        vpand	ymm2, ymm2, ymm7
+        vmovdqu	YMMWORD PTR [rcx+64], ymm2
+        vpand	ymm3, ymm3, ymm7
+        vmovdqu	YMMWORD PTR [rcx+96], ymm3
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        add	rsp, 32
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_mul_add_sb_plus_e_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_add_avx2 PROC
+        vmovd	xmm0, r8
+        vpbroadcastw	ymm0, xmm0
+        vmovdqu	ymm1, YMMWORD PTR [rcx]
+        vpaddw	ymm1, ymm1, [rdx]
+        vpand	ymm1, ymm1, ymm0
+        vmovdqu	YMMWORD PTR [rcx], ymm1
+        vmovdqu	ymm2, YMMWORD PTR [rcx+32]
+        vpaddw	ymm2, ymm2, [rdx+32]
+        vpand	ymm2, ymm2, ymm0
+        vmovdqu	YMMWORD PTR [rcx+32], ymm2
+        vmovdqu	ymm3, YMMWORD PTR [rcx+64]
+        vpaddw	ymm3, ymm3, [rdx+64]
+        vpand	ymm3, ymm3, ymm0
+        vmovdqu	YMMWORD PTR [rcx+64], ymm3
+        vmovdqu	ymm4, YMMWORD PTR [rcx+96]
+        vpaddw	ymm4, ymm4, [rdx+96]
+        vpand	ymm4, ymm4, ymm0
+        vmovdqu	YMMWORD PTR [rcx+96], ymm4
+        vzeroupper
+        ret
+frodokem_add_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_a_rows_reduce_avx2 PROC
+        vmovd	xmm0, r8
+        vpbroadcastw	ymm0, xmm0
+        mov	eax, edx
+L_frodokem_a_rows_reduce_avx2_blk:
+        cmp	rax, 16
+        jl	L_frodokem_a_rows_reduce_avx2_tail
+        vpand	ymm1, ymm0, YMMWORD PTR [rcx]
+        vmovdqu	YMMWORD PTR [rcx], ymm1
+        add	rcx, 32
+        sub	rax, 16
+        jmp	L_frodokem_a_rows_reduce_avx2_blk
+L_frodokem_a_rows_reduce_avx2_tail:
+        cmp	rax, 0
+        jle	L_frodokem_a_rows_reduce_avx2_done
+L_frodokem_a_rows_reduce_avx2_word:
+        movzx	r9d, WORD PTR [rcx]
+        and	r9d, r8d
+        mov	WORD PTR [rcx], r9w
+        add	rcx, 2
+        sub	rax, 1
+        jg	L_frodokem_a_rows_reduce_avx2_word
+L_frodokem_a_rows_reduce_avx2_done:
+        vzeroupper
+        ret
+frodokem_a_rows_reduce_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_sample_avx2 PROC
+        push	r12
+        sub	rsp, 32
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        movsxd	rax, edx
+        shl	rax, 1
+        vpcmpeqw	ymm0, ymm0, ymm0
+        vpsrlw	ymm0, ymm0, 15
+        vpxor	ymm1, ymm1, ymm1
+        xor	r10, r10
+L_frodokem_sample_avx2_blk:
+        vmovdqu	ymm2, YMMWORD PTR [rcx+r10]
+        vpsrlw	ymm3, ymm2, 1
+        vpand	ymm4, ymm2, ymm0
+        vpxor	ymm5, ymm5, ymm5
+        mov	r11, r8
+        mov	r12d, r9d
+L_frodokem_sample_avx2_cdf:
+        vpbroadcastw	ymm6, WORD PTR [r11]
+        vpsubw	ymm6, ymm6, ymm3
+        vpsrlw	ymm6, ymm6, 15
+        vpaddw	ymm5, ymm5, ymm6
+        add	r11, 2
+        sub	r12, 1
+        jnz	L_frodokem_sample_avx2_cdf
+        vpsubw	ymm7, ymm1, ymm4
+        vpxor	ymm5, ymm5, ymm7
+        vpaddw	ymm5, ymm5, ymm4
+        vmovdqu	YMMWORD PTR [rcx+r10], ymm5
+        add	r10, 32
+        cmp	r10, rax
+        jl	L_frodokem_sample_avx2_blk
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        add	rsp, 32
+        pop	r12
+        ret
+frodokem_sample_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_gen_a_rows_aes_avx2 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        mov	rax, QWORD PTR [rsp+88]
+        mov	r10, QWORD PTR [rsp+96]
+        mov	r11, QWORD PTR [rsp+104]
+        sub	rsp, 160
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        vmovdqu	OWORD PTR [rsp+112], xmm13
+        vmovdqu	OWORD PTR [rsp+128], xmm14
+        vmovdqu	OWORD PTR [rsp+144], xmm15
+        vbroadcasti128	ymm0, OWORD PTR [r8]
+        vbroadcasti128	ymm1, OWORD PTR [r8+16]
+        vbroadcasti128	ymm2, OWORD PTR [r8+32]
+        vbroadcasti128	ymm3, OWORD PTR [r8+48]
+        vbroadcasti128	ymm4, OWORD PTR [r8+64]
+        vbroadcasti128	ymm5, OWORD PTR [r8+80]
+        vbroadcasti128	ymm6, OWORD PTR [r8+96]
+        vbroadcasti128	ymm7, OWORD PTR [r8+112]
+        vbroadcasti128	ymm8, OWORD PTR [r8+128]
+        vbroadcasti128	ymm9, OWORD PTR [r8+144]
+        vbroadcasti128	ymm10, OWORD PTR [r8+160]
+        vmovd	xmm15, r11
+        vpbroadcastw	ymm15, xmm15
+        movsxd	r12, r10d
+        shr	r12, 3
+        movsxd	r13, eax
+        movsxd	r9, r9d
+        xor	r14, r14
+L_frodokem_gen_a_rows_aes_avx2_row:
+        mov	rdi, r9
+        add	rdi, r14
+        xor	r15, r15
+L_frodokem_gen_a_rows_aes_avx2_blk:
+        lea	rsi, QWORD PTR [r15+8]
+        cmp	rsi, r12
+        jg	L_frodokem_gen_a_rows_aes_avx2_tail
+        vmovd	xmm11, edi
+        add	rdi, 524288
+        vmovd	xmm0, edi
+        add	rdi, 524288
+        vinserti128	ymm11, ymm11, xmm0, 1
+        vmovd	xmm12, edi
+        add	rdi, 524288
+        vmovd	xmm0, edi
+        add	rdi, 524288
+        vinserti128	ymm12, ymm12, xmm0, 1
+        vmovd	xmm13, edi
+        add	rdi, 524288
+        vmovd	xmm0, edi
+        add	rdi, 524288
+        vinserti128	ymm13, ymm13, xmm0, 1
+        vmovd	xmm14, edi
+        add	rdi, 524288
+        vmovd	xmm0, edi
+        add	rdi, 524288
+        vinserti128	ymm14, ymm14, xmm0, 1
+        vbroadcasti128	ymm0, OWORD PTR [r8]
+        vpxor	ymm11, ymm11, ymm0
+        vpxor	ymm12, ymm12, ymm0
+        vpxor	ymm13, ymm13, ymm0
+        vpxor	ymm14, ymm14, ymm0
+        vaesenc	ymm11, ymm11, ymm1
+        vaesenc	ymm12, ymm12, ymm1
+        vaesenc	ymm13, ymm13, ymm1
+        vaesenc	ymm14, ymm14, ymm1
+        vaesenc	ymm11, ymm11, ymm2
+        vaesenc	ymm12, ymm12, ymm2
+        vaesenc	ymm13, ymm13, ymm2
+        vaesenc	ymm14, ymm14, ymm2
+        vaesenc	ymm11, ymm11, ymm3
+        vaesenc	ymm12, ymm12, ymm3
+        vaesenc	ymm13, ymm13, ymm3
+        vaesenc	ymm14, ymm14, ymm3
+        vaesenc	ymm11, ymm11, ymm4
+        vaesenc	ymm12, ymm12, ymm4
+        vaesenc	ymm13, ymm13, ymm4
+        vaesenc	ymm14, ymm14, ymm4
+        vaesenc	ymm11, ymm11, ymm5
+        vaesenc	ymm12, ymm12, ymm5
+        vaesenc	ymm13, ymm13, ymm5
+        vaesenc	ymm14, ymm14, ymm5
+        vaesenc	ymm11, ymm11, ymm6
+        vaesenc	ymm12, ymm12, ymm6
+        vaesenc	ymm13, ymm13, ymm6
+        vaesenc	ymm14, ymm14, ymm6
+        vaesenc	ymm11, ymm11, ymm7
+        vaesenc	ymm12, ymm12, ymm7
+        vaesenc	ymm13, ymm13, ymm7
+        vaesenc	ymm14, ymm14, ymm7
+        vaesenc	ymm11, ymm11, ymm8
+        vaesenc	ymm12, ymm12, ymm8
+        vaesenc	ymm13, ymm13, ymm8
+        vaesenc	ymm14, ymm14, ymm8
+        vaesenc	ymm11, ymm11, ymm9
+        vaesenc	ymm12, ymm12, ymm9
+        vaesenc	ymm13, ymm13, ymm9
+        vaesenc	ymm14, ymm14, ymm9
+        vaesenclast	ymm11, ymm11, ymm10
+        vaesenclast	ymm12, ymm12, ymm10
+        vaesenclast	ymm13, ymm13, ymm10
+        vaesenclast	ymm14, ymm14, ymm10
+        vpand	ymm11, ymm11, ymm15
+        vmovdqu	YMMWORD PTR [rdx], ymm11
+        vpand	ymm12, ymm12, ymm15
+        vmovdqu	YMMWORD PTR [rdx+32], ymm12
+        vpand	ymm13, ymm13, ymm15
+        vmovdqu	YMMWORD PTR [rdx+64], ymm13
+        vpand	ymm14, ymm14, ymm15
+        vmovdqu	YMMWORD PTR [rdx+96], ymm14
+        add	rdx, 128
+        add	r15, 8
+        jmp	L_frodokem_gen_a_rows_aes_avx2_blk
+L_frodokem_gen_a_rows_aes_avx2_tail:
+        cmp	r15, r12
+        jge	L_frodokem_gen_a_rows_aes_avx2_next
+        vmovd	xmm11, edi
+        add	rdi, 524288
+        vpxor	xmm11, xmm11, xmm0
+        vaesenc	xmm11, xmm11, xmm1
+        vaesenc	xmm11, xmm11, xmm2
+        vaesenc	xmm11, xmm11, xmm3
+        vaesenc	xmm11, xmm11, xmm4
+        vaesenc	xmm11, xmm11, xmm5
+        vaesenc	xmm11, xmm11, xmm6
+        vaesenc	xmm11, xmm11, xmm7
+        vaesenc	xmm11, xmm11, xmm8
+        vaesenc	xmm11, xmm11, xmm9
+        vaesenclast	xmm11, xmm11, xmm10
+        vpand	xmm11, xmm11, xmm15
+        vmovdqu	OWORD PTR [rdx], xmm11
+        add	rdx, 16
+        add	r15, 1
+        jmp	L_frodokem_gen_a_rows_aes_avx2_tail
+L_frodokem_gen_a_rows_aes_avx2_next:
+        add	r14, 1
+        cmp	r14, r13
+        jl	L_frodokem_gen_a_rows_aes_avx2_row
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        vmovdqu	xmm13, OWORD PTR [rsp+112]
+        vmovdqu	xmm14, OWORD PTR [rsp+128]
+        vmovdqu	xmm15, OWORD PTR [rsp+144]
+        add	rsp, 160
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_gen_a_rows_aes_avx2 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_gen_a_rows_aes_aesni PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        mov	rax, QWORD PTR [rsp+88]
+        mov	r10, QWORD PTR [rsp+96]
+        mov	r11, QWORD PTR [rsp+104]
+        sub	rsp, 48
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovd	xmm8, r11
+        vpbroadcastw	xmm8, xmm8
+        movsxd	r12, r10d
+        shr	r12, 3
+        movsxd	r13, eax
+        movsxd	r9, r9d
+        xor	r14, r14
+L_frodokem_gen_a_rows_aes_aesni_row:
+        mov	rdi, r9
+        add	rdi, r14
+        xor	r15, r15
+L_frodokem_gen_a_rows_aes_aesni_blk:
+        lea	rsi, QWORD PTR [r15+8]
+        cmp	rsi, r12
+        jg	L_frodokem_gen_a_rows_aes_aesni_tail
+        vmovd	xmm0, edi
+        add	rdi, 524288
+        vmovd	xmm1, edi
+        add	rdi, 524288
+        vmovd	xmm2, edi
+        add	rdi, 524288
+        vmovd	xmm3, edi
+        add	rdi, 524288
+        vmovd	xmm4, edi
+        add	rdi, 524288
+        vmovd	xmm5, edi
+        add	rdi, 524288
+        vmovd	xmm6, edi
+        add	rdi, 524288
+        vmovd	xmm7, edi
+        add	rdi, 524288
+        vpxor	xmm0, xmm0, [r8]
+        vpxor	xmm1, xmm1, [r8]
+        vpxor	xmm2, xmm2, [r8]
+        vpxor	xmm3, xmm3, [r8]
+        vpxor	xmm4, xmm4, [r8]
+        vpxor	xmm5, xmm5, [r8]
+        vpxor	xmm6, xmm6, [r8]
+        vpxor	xmm7, xmm7, [r8]
+        vaesenc	xmm0, xmm0, [r8+16]
+        vaesenc	xmm1, xmm1, [r8+16]
+        vaesenc	xmm2, xmm2, [r8+16]
+        vaesenc	xmm3, xmm3, [r8+16]
+        vaesenc	xmm4, xmm4, [r8+16]
+        vaesenc	xmm5, xmm5, [r8+16]
+        vaesenc	xmm6, xmm6, [r8+16]
+        vaesenc	xmm7, xmm7, [r8+16]
+        vaesenc	xmm0, xmm0, [r8+32]
+        vaesenc	xmm1, xmm1, [r8+32]
+        vaesenc	xmm2, xmm2, [r8+32]
+        vaesenc	xmm3, xmm3, [r8+32]
+        vaesenc	xmm4, xmm4, [r8+32]
+        vaesenc	xmm5, xmm5, [r8+32]
+        vaesenc	xmm6, xmm6, [r8+32]
+        vaesenc	xmm7, xmm7, [r8+32]
+        vaesenc	xmm0, xmm0, [r8+48]
+        vaesenc	xmm1, xmm1, [r8+48]
+        vaesenc	xmm2, xmm2, [r8+48]
+        vaesenc	xmm3, xmm3, [r8+48]
+        vaesenc	xmm4, xmm4, [r8+48]
+        vaesenc	xmm5, xmm5, [r8+48]
+        vaesenc	xmm6, xmm6, [r8+48]
+        vaesenc	xmm7, xmm7, [r8+48]
+        vaesenc	xmm0, xmm0, [r8+64]
+        vaesenc	xmm1, xmm1, [r8+64]
+        vaesenc	xmm2, xmm2, [r8+64]
+        vaesenc	xmm3, xmm3, [r8+64]
+        vaesenc	xmm4, xmm4, [r8+64]
+        vaesenc	xmm5, xmm5, [r8+64]
+        vaesenc	xmm6, xmm6, [r8+64]
+        vaesenc	xmm7, xmm7, [r8+64]
+        vaesenc	xmm0, xmm0, [r8+80]
+        vaesenc	xmm1, xmm1, [r8+80]
+        vaesenc	xmm2, xmm2, [r8+80]
+        vaesenc	xmm3, xmm3, [r8+80]
+        vaesenc	xmm4, xmm4, [r8+80]
+        vaesenc	xmm5, xmm5, [r8+80]
+        vaesenc	xmm6, xmm6, [r8+80]
+        vaesenc	xmm7, xmm7, [r8+80]
+        vaesenc	xmm0, xmm0, [r8+96]
+        vaesenc	xmm1, xmm1, [r8+96]
+        vaesenc	xmm2, xmm2, [r8+96]
+        vaesenc	xmm3, xmm3, [r8+96]
+        vaesenc	xmm4, xmm4, [r8+96]
+        vaesenc	xmm5, xmm5, [r8+96]
+        vaesenc	xmm6, xmm6, [r8+96]
+        vaesenc	xmm7, xmm7, [r8+96]
+        vaesenc	xmm0, xmm0, [r8+112]
+        vaesenc	xmm1, xmm1, [r8+112]
+        vaesenc	xmm2, xmm2, [r8+112]
+        vaesenc	xmm3, xmm3, [r8+112]
+        vaesenc	xmm4, xmm4, [r8+112]
+        vaesenc	xmm5, xmm5, [r8+112]
+        vaesenc	xmm6, xmm6, [r8+112]
+        vaesenc	xmm7, xmm7, [r8+112]
+        vaesenc	xmm0, xmm0, [r8+128]
+        vaesenc	xmm1, xmm1, [r8+128]
+        vaesenc	xmm2, xmm2, [r8+128]
+        vaesenc	xmm3, xmm3, [r8+128]
+        vaesenc	xmm4, xmm4, [r8+128]
+        vaesenc	xmm5, xmm5, [r8+128]
+        vaesenc	xmm6, xmm6, [r8+128]
+        vaesenc	xmm7, xmm7, [r8+128]
+        vaesenc	xmm0, xmm0, [r8+144]
+        vaesenc	xmm1, xmm1, [r8+144]
+        vaesenc	xmm2, xmm2, [r8+144]
+        vaesenc	xmm3, xmm3, [r8+144]
+        vaesenc	xmm4, xmm4, [r8+144]
+        vaesenc	xmm5, xmm5, [r8+144]
+        vaesenc	xmm6, xmm6, [r8+144]
+        vaesenc	xmm7, xmm7, [r8+144]
+        vaesenclast	xmm0, xmm0, [r8+160]
+        vaesenclast	xmm1, xmm1, [r8+160]
+        vaesenclast	xmm2, xmm2, [r8+160]
+        vaesenclast	xmm3, xmm3, [r8+160]
+        vaesenclast	xmm4, xmm4, [r8+160]
+        vaesenclast	xmm5, xmm5, [r8+160]
+        vaesenclast	xmm6, xmm6, [r8+160]
+        vaesenclast	xmm7, xmm7, [r8+160]
+        vpand	xmm0, xmm0, xmm8
+        vmovdqu	OWORD PTR [rdx], xmm0
+        vpand	xmm1, xmm1, xmm8
+        vmovdqu	OWORD PTR [rdx+16], xmm1
+        vpand	xmm2, xmm2, xmm8
+        vmovdqu	OWORD PTR [rdx+32], xmm2
+        vpand	xmm3, xmm3, xmm8
+        vmovdqu	OWORD PTR [rdx+48], xmm3
+        vpand	xmm4, xmm4, xmm8
+        vmovdqu	OWORD PTR [rdx+64], xmm4
+        vpand	xmm5, xmm5, xmm8
+        vmovdqu	OWORD PTR [rdx+80], xmm5
+        vpand	xmm6, xmm6, xmm8
+        vmovdqu	OWORD PTR [rdx+96], xmm6
+        vpand	xmm7, xmm7, xmm8
+        vmovdqu	OWORD PTR [rdx+112], xmm7
+        add	rdx, 128
+        add	r15, 8
+        jmp	L_frodokem_gen_a_rows_aes_aesni_blk
+L_frodokem_gen_a_rows_aes_aesni_tail:
+        cmp	r15, r12
+        jge	L_frodokem_gen_a_rows_aes_aesni_next
+        vmovd	xmm0, edi
+        add	rdi, 524288
+        vpxor	xmm0, xmm0, [r8]
+        vaesenc	xmm0, xmm0, [r8+16]
+        vaesenc	xmm0, xmm0, [r8+32]
+        vaesenc	xmm0, xmm0, [r8+48]
+        vaesenc	xmm0, xmm0, [r8+64]
+        vaesenc	xmm0, xmm0, [r8+80]
+        vaesenc	xmm0, xmm0, [r8+96]
+        vaesenc	xmm0, xmm0, [r8+112]
+        vaesenc	xmm0, xmm0, [r8+128]
+        vaesenc	xmm0, xmm0, [r8+144]
+        vaesenclast	xmm0, xmm0, [r8+160]
+        vpand	xmm0, xmm0, xmm8
+        vmovdqu	OWORD PTR [rdx], xmm0
+        add	rdx, 16
+        add	r15, 1
+        jmp	L_frodokem_gen_a_rows_aes_aesni_tail
+L_frodokem_gen_a_rows_aes_aesni_next:
+        add	r14, 1
+        cmp	r14, r13
+        jl	L_frodokem_gen_a_rows_aes_aesni_row
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        add	rsp, 48
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_gen_a_rows_aes_aesni ENDP
+_TEXT ENDS
+ENDIF
+ENDIF
+IFDEF WOLFSSL_HAVE_FRODOKEM
+IFDEF HAVE_INTEL_AVX512
+_TEXT SEGMENT READONLY PARA
+frodokem_sa_accum_avx512 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        push	rbp
+        mov	rax, QWORD PTR [rsp+104]
+        sub	rsp, 64
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        movsxd	r9, r9d
+        shl	r9, 1
+        add	rdx, r9
+        movsxd	r10, eax
+        shl	r10, 1
+        mov	r9, r10
+        and	r9, -64
+        mov	r11, r8
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r14, r13
+        add	r14, r10
+        mov	r15, r14
+        add	r15, r10
+        mov	rdi, r15
+        add	rdi, r10
+        mov	rsi, rdi
+        add	rsi, r10
+        mov	rbp, 8
+L_frodokem_sa_accum_avx512_i:
+        vpbroadcastw	zmm0, WORD PTR [rdx]
+        vpbroadcastw	zmm1, WORD PTR [rdx+2]
+        vpbroadcastw	zmm2, WORD PTR [rdx+4]
+        vpbroadcastw	zmm3, WORD PTR [rdx+6]
+        vpbroadcastw	zmm4, WORD PTR [rdx+8]
+        vpbroadcastw	zmm5, WORD PTR [rdx+10]
+        vpbroadcastw	zmm6, WORD PTR [rdx+12]
+        vpbroadcastw	zmm7, WORD PTR [rdx+14]
+        xor	rbx, rbx
+L_frodokem_sa_accum_avx512_k:
+        vmovdqu64	zmm8, [rcx+rbx]
+        vpmullw	zmm9, zmm0, [r8+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vpmullw	zmm9, zmm1, [r11+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vpmullw	zmm9, zmm2, [r12+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vpmullw	zmm9, zmm3, [r13+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vpmullw	zmm9, zmm4, [r14+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vpmullw	zmm9, zmm5, [r15+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vpmullw	zmm9, zmm6, [rdi+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vpmullw	zmm9, zmm7, [rsi+rbx]
+        vpaddw	zmm8, zmm8, zmm9
+        vmovdqu64	[rcx+rbx], zmm8
+        add	rbx, 64
+        cmp	rbx, r9
+        jl	L_frodokem_sa_accum_avx512_k
+        cmp	rbx, r10
+        jge	L_frodokem_sa_accum_avx512_tail
+        vmovdqu	ymm8, YMMWORD PTR [rcx+rbx]
+        vpmullw	ymm9, ymm0, [r8+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vpmullw	ymm9, ymm1, [r11+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vpmullw	ymm9, ymm2, [r12+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vpmullw	ymm9, ymm3, [r13+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vpmullw	ymm9, ymm4, [r14+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vpmullw	ymm9, ymm5, [r15+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vpmullw	ymm9, ymm6, [rdi+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vpmullw	ymm9, ymm7, [rsi+rbx]
+        vpaddw	ymm8, ymm8, ymm9
+        vmovdqu	YMMWORD PTR [rcx+rbx], ymm8
+L_frodokem_sa_accum_avx512_tail:
+        add	rcx, r10
+        add	rdx, r10
+        sub	rbp, 1
+        jnz	L_frodokem_sa_accum_avx512_i
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        add	rsp, 64
+        pop	rbp
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_sa_accum_avx512 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_as_accum_avx512 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        push	rbp
+        mov	rax, QWORD PTR [rsp+104]
+        sub	rsp, 160
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        vmovdqu	OWORD PTR [rsp+112], xmm13
+        vmovdqu	OWORD PTR [rsp+128], xmm14
+        vmovdqu	OWORD PTR [rsp+144], xmm15
+        movsxd	r9, r9d
+        shl	r9, 4
+        add	rcx, r9
+        movsxd	r10, eax
+        shl	r10, 1
+        mov	r9, r10
+        and	r9, -64
+        mov	r11, rdx
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r14, r13
+        add	r14, r10
+        mov	r15, r14
+        add	r15, r10
+        mov	rdi, r15
+        add	rdi, r10
+        mov	rsi, rdi
+        add	rsi, r10
+        mov	rbp, 8
+        vpcmpeqd	xmm13, xmm13, xmm13
+        vpsrld	xmm13, xmm13, 16
+L_frodokem_as_accum_avx512_r:
+        vpxorq	zmm14, zmm14, zmm14
+        vpxorq	ymm22, ymm22, ymm22
+        vpxorq	zmm15, zmm15, zmm15
+        vpxorq	ymm23, ymm23, ymm23
+        vpxorq	zmm16, zmm16, zmm16
+        vpxorq	ymm24, ymm24, ymm24
+        vpxorq	zmm17, zmm17, zmm17
+        vpxorq	ymm25, ymm25, ymm25
+        vpxorq	zmm18, zmm18, zmm18
+        vpxorq	ymm26, ymm26, ymm26
+        vpxorq	zmm19, zmm19, zmm19
+        vpxorq	ymm27, ymm27, ymm27
+        vpxorq	zmm20, zmm20, zmm20
+        vpxorq	ymm28, ymm28, ymm28
+        vpxorq	zmm21, zmm21, zmm21
+        vpxorq	ymm29, ymm29, ymm29
+        xor	rbx, rbx
+L_frodokem_as_accum_avx512_j:
+        vmovdqu64	zmm0, [r8+rbx]
+        vpmaddwd	zmm1, zmm0, [rdx+rbx]
+        vpaddd	zmm14, zmm14, zmm1
+        vpmaddwd	zmm1, zmm0, [r11+rbx]
+        vpaddd	zmm15, zmm15, zmm1
+        vpmaddwd	zmm1, zmm0, [r12+rbx]
+        vpaddd	zmm16, zmm16, zmm1
+        vpmaddwd	zmm1, zmm0, [r13+rbx]
+        vpaddd	zmm17, zmm17, zmm1
+        vpmaddwd	zmm1, zmm0, [r14+rbx]
+        vpaddd	zmm18, zmm18, zmm1
+        vpmaddwd	zmm1, zmm0, [r15+rbx]
+        vpaddd	zmm19, zmm19, zmm1
+        vpmaddwd	zmm1, zmm0, [rdi+rbx]
+        vpaddd	zmm20, zmm20, zmm1
+        vpmaddwd	zmm1, zmm0, [rsi+rbx]
+        vpaddd	zmm21, zmm21, zmm1
+        add	rbx, 64
+        cmp	rbx, r9
+        jl	L_frodokem_as_accum_avx512_j
+        cmp	rbx, r10
+        jge	L_frodokem_as_accum_avx512_tail
+        vmovdqu	ymm0, YMMWORD PTR [r8+rbx]
+        vpmaddwd	ymm22, ymm0, [rdx+rbx]
+        vpmaddwd	ymm23, ymm0, [r11+rbx]
+        vpmaddwd	ymm24, ymm0, [r12+rbx]
+        vpmaddwd	ymm25, ymm0, [r13+rbx]
+        vpmaddwd	ymm26, ymm0, [r14+rbx]
+        vpmaddwd	ymm27, ymm0, [r15+rbx]
+        vpmaddwd	ymm28, ymm0, [rdi+rbx]
+        vpmaddwd	ymm29, ymm0, [rsi+rbx]
+L_frodokem_as_accum_avx512_tail:
+        vextracti64x4	ymm1, zmm14, 1
+        vpaddd	ymm1, ymm14, ymm1
+        vpaddd	ymm1, ymm1, ymm22
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm2, xmm1, xmm0
+        vextracti64x4	ymm1, zmm15, 1
+        vpaddd	ymm1, ymm15, ymm1
+        vpaddd	ymm1, ymm1, ymm23
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm3, xmm1, xmm0
+        vextracti64x4	ymm1, zmm16, 1
+        vpaddd	ymm1, ymm16, ymm1
+        vpaddd	ymm1, ymm1, ymm24
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm4, xmm1, xmm0
+        vextracti64x4	ymm1, zmm17, 1
+        vpaddd	ymm1, ymm17, ymm1
+        vpaddd	ymm1, ymm1, ymm25
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm5, xmm1, xmm0
+        vextracti64x4	ymm1, zmm18, 1
+        vpaddd	ymm1, ymm18, ymm1
+        vpaddd	ymm1, ymm1, ymm26
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm6, xmm1, xmm0
+        vextracti64x4	ymm1, zmm19, 1
+        vpaddd	ymm1, ymm19, ymm1
+        vpaddd	ymm1, ymm1, ymm27
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm7, xmm1, xmm0
+        vextracti64x4	ymm1, zmm20, 1
+        vpaddd	ymm1, ymm20, ymm1
+        vpaddd	ymm1, ymm1, ymm28
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm8, xmm1, xmm0
+        vextracti64x4	ymm1, zmm21, 1
+        vpaddd	ymm1, ymm21, ymm1
+        vpaddd	ymm1, ymm1, ymm29
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm9, xmm1, xmm0
+        vphaddd	xmm11, xmm2, xmm3
+        vphaddd	xmm12, xmm4, xmm5
+        vphaddd	xmm10, xmm11, xmm12
+        vphaddd	xmm11, xmm6, xmm7
+        vphaddd	xmm12, xmm8, xmm9
+        vphaddd	xmm11, xmm11, xmm12
+        vpand	xmm10, xmm10, xmm13
+        vpand	xmm11, xmm11, xmm13
+        vpackusdw	xmm10, xmm10, xmm11
+        vpaddw	xmm10, xmm10, [rcx]
+        vmovdqu	OWORD PTR [rcx], xmm10
+        add	r8, r10
+        add	rcx, 16
+        sub	rbp, 1
+        jnz	L_frodokem_as_accum_avx512_r
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        vmovdqu	xmm13, OWORD PTR [rsp+112]
+        vmovdqu	xmm14, OWORD PTR [rsp+128]
+        vmovdqu	xmm15, OWORD PTR [rsp+144]
+        add	rsp, 160
+        pop	rbp
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_as_accum_avx512 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_mul_bs_avx512 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        push	rbp
+        mov	rax, QWORD PTR [rsp+104]
+        sub	rsp, 160
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        vmovdqu	OWORD PTR [rsp+112], xmm13
+        vmovdqu	OWORD PTR [rsp+128], xmm14
+        vmovdqu	OWORD PTR [rsp+144], xmm15
+        movsxd	r10, r9d
+        shl	r10, 1
+        mov	r9, r10
+        and	r9, -64
+        mov	r11, r8
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r14, r13
+        add	r14, r10
+        mov	r15, r14
+        add	r15, r10
+        mov	rdi, r15
+        add	rdi, r10
+        mov	rsi, rdi
+        add	rsi, r10
+        mov	rbp, 8
+        vmovd	xmm13, rax
+        vpbroadcastd	xmm13, xmm13
+L_frodokem_mul_bs_avx512_r:
+        vpxorq	zmm14, zmm14, zmm14
+        vpxorq	ymm22, ymm22, ymm22
+        vpxorq	zmm15, zmm15, zmm15
+        vpxorq	ymm23, ymm23, ymm23
+        vpxorq	zmm16, zmm16, zmm16
+        vpxorq	ymm24, ymm24, ymm24
+        vpxorq	zmm17, zmm17, zmm17
+        vpxorq	ymm25, ymm25, ymm25
+        vpxorq	zmm18, zmm18, zmm18
+        vpxorq	ymm26, ymm26, ymm26
+        vpxorq	zmm19, zmm19, zmm19
+        vpxorq	ymm27, ymm27, ymm27
+        vpxorq	zmm20, zmm20, zmm20
+        vpxorq	ymm28, ymm28, ymm28
+        vpxorq	zmm21, zmm21, zmm21
+        vpxorq	ymm29, ymm29, ymm29
+        xor	rbx, rbx
+L_frodokem_mul_bs_avx512_j:
+        vmovdqu64	zmm0, [rdx+rbx]
+        vpmaddwd	zmm1, zmm0, [r8+rbx]
+        vpaddd	zmm14, zmm14, zmm1
+        vpmaddwd	zmm1, zmm0, [r11+rbx]
+        vpaddd	zmm15, zmm15, zmm1
+        vpmaddwd	zmm1, zmm0, [r12+rbx]
+        vpaddd	zmm16, zmm16, zmm1
+        vpmaddwd	zmm1, zmm0, [r13+rbx]
+        vpaddd	zmm17, zmm17, zmm1
+        vpmaddwd	zmm1, zmm0, [r14+rbx]
+        vpaddd	zmm18, zmm18, zmm1
+        vpmaddwd	zmm1, zmm0, [r15+rbx]
+        vpaddd	zmm19, zmm19, zmm1
+        vpmaddwd	zmm1, zmm0, [rdi+rbx]
+        vpaddd	zmm20, zmm20, zmm1
+        vpmaddwd	zmm1, zmm0, [rsi+rbx]
+        vpaddd	zmm21, zmm21, zmm1
+        add	rbx, 64
+        cmp	rbx, r9
+        jl	L_frodokem_mul_bs_avx512_j
+        cmp	rbx, r10
+        jge	L_frodokem_mul_bs_avx512_tail
+        vmovdqu	ymm0, YMMWORD PTR [rdx+rbx]
+        vpmaddwd	ymm22, ymm0, [r8+rbx]
+        vpmaddwd	ymm23, ymm0, [r11+rbx]
+        vpmaddwd	ymm24, ymm0, [r12+rbx]
+        vpmaddwd	ymm25, ymm0, [r13+rbx]
+        vpmaddwd	ymm26, ymm0, [r14+rbx]
+        vpmaddwd	ymm27, ymm0, [r15+rbx]
+        vpmaddwd	ymm28, ymm0, [rdi+rbx]
+        vpmaddwd	ymm29, ymm0, [rsi+rbx]
+L_frodokem_mul_bs_avx512_tail:
+        vextracti64x4	ymm1, zmm14, 1
+        vpaddd	ymm1, ymm14, ymm1
+        vpaddd	ymm1, ymm1, ymm22
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm2, xmm1, xmm0
+        vextracti64x4	ymm1, zmm15, 1
+        vpaddd	ymm1, ymm15, ymm1
+        vpaddd	ymm1, ymm1, ymm23
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm3, xmm1, xmm0
+        vextracti64x4	ymm1, zmm16, 1
+        vpaddd	ymm1, ymm16, ymm1
+        vpaddd	ymm1, ymm1, ymm24
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm4, xmm1, xmm0
+        vextracti64x4	ymm1, zmm17, 1
+        vpaddd	ymm1, ymm17, ymm1
+        vpaddd	ymm1, ymm1, ymm25
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm5, xmm1, xmm0
+        vextracti64x4	ymm1, zmm18, 1
+        vpaddd	ymm1, ymm18, ymm1
+        vpaddd	ymm1, ymm1, ymm26
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm6, xmm1, xmm0
+        vextracti64x4	ymm1, zmm19, 1
+        vpaddd	ymm1, ymm19, ymm1
+        vpaddd	ymm1, ymm1, ymm27
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm7, xmm1, xmm0
+        vextracti64x4	ymm1, zmm20, 1
+        vpaddd	ymm1, ymm20, ymm1
+        vpaddd	ymm1, ymm1, ymm28
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm8, xmm1, xmm0
+        vextracti64x4	ymm1, zmm21, 1
+        vpaddd	ymm1, ymm21, ymm1
+        vpaddd	ymm1, ymm1, ymm29
+        vextracti128	xmm0, ymm1, 1
+        vpaddd	xmm9, xmm1, xmm0
+        vphaddd	xmm11, xmm2, xmm3
+        vphaddd	xmm12, xmm4, xmm5
+        vphaddd	xmm10, xmm11, xmm12
+        vphaddd	xmm11, xmm6, xmm7
+        vphaddd	xmm12, xmm8, xmm9
+        vphaddd	xmm11, xmm11, xmm12
+        vpand	xmm10, xmm10, xmm13
+        vpand	xmm11, xmm11, xmm13
+        vpackusdw	xmm10, xmm10, xmm11
+        vmovdqu	OWORD PTR [rcx], xmm10
+        add	rdx, r10
+        add	rcx, 16
+        sub	rbp, 1
+        jnz	L_frodokem_mul_bs_avx512_r
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        vmovdqu	xmm13, OWORD PTR [rsp+112]
+        vmovdqu	xmm14, OWORD PTR [rsp+128]
+        vmovdqu	xmm15, OWORD PTR [rsp+144]
+        add	rsp, 160
+        pop	rbp
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_mul_bs_avx512 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_mul_add_sb_plus_e_avx512 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        push	rbx
+        mov	rax, QWORD PTR [rsp+96]
+        movsxd	r10, r9d
+        shl	r10, 1
+        mov	r11, r8
+        add	r11, r10
+        mov	r12, r11
+        add	r12, r10
+        mov	r13, r12
+        add	r13, r10
+        mov	r14, r13
+        add	r14, r10
+        mov	r15, r14
+        add	r15, r10
+        mov	rdi, r15
+        add	rdi, r10
+        mov	rsi, rdi
+        add	rsi, r10
+        vmovd	xmm5, rax
+        vpbroadcastw	zmm5, xmm5
+        vmovdqu64	zmm0, [rcx]
+        vmovdqu64	zmm1, [rcx+64]
+        xor	rbx, rbx
+L_frodokem_mul_add_sb_plus_e_avx512_j:
+        vbroadcasti32x4	zmm2, OWORD PTR [rdx]
+        vpbroadcastw	zmm3, WORD PTR [r8+rbx]
+        vpbroadcastw	zmm4, WORD PTR [r11+rbx]
+        vinserti32x4	zmm3, zmm3, xmm4, 1
+        vpbroadcastw	zmm4, WORD PTR [r12+rbx]
+        vinserti32x4	zmm3, zmm3, xmm4, 2
+        vpbroadcastw	zmm4, WORD PTR [r13+rbx]
+        vinserti32x4	zmm3, zmm3, xmm4, 3
+        vpmullw	zmm4, zmm3, zmm2
+        vpaddw	zmm0, zmm0, zmm4
+        vpbroadcastw	zmm3, WORD PTR [r14+rbx]
+        vpbroadcastw	zmm4, WORD PTR [r15+rbx]
+        vinserti32x4	zmm3, zmm3, xmm4, 1
+        vpbroadcastw	zmm4, WORD PTR [rdi+rbx]
+        vinserti32x4	zmm3, zmm3, xmm4, 2
+        vpbroadcastw	zmm4, WORD PTR [rsi+rbx]
+        vinserti32x4	zmm3, zmm3, xmm4, 3
+        vpmullw	zmm4, zmm3, zmm2
+        vpaddw	zmm1, zmm1, zmm4
+        add	rdx, 16
+        add	rbx, 2
+        cmp	rbx, r10
+        jl	L_frodokem_mul_add_sb_plus_e_avx512_j
+        vpandq	zmm0, zmm0, zmm5
+        vmovdqu64	[rcx], zmm0
+        vpandq	zmm1, zmm1, zmm5
+        vmovdqu64	[rcx+64], zmm1
+        vzeroupper
+        pop	rbx
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_mul_add_sb_plus_e_avx512 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_add_avx512 PROC
+        vmovd	xmm0, r8
+        vpbroadcastw	zmm0, xmm0
+        vmovdqu64	zmm1, [rcx]
+        vpaddw	zmm1, zmm1, [rdx]
+        vpandq	zmm1, zmm1, zmm0
+        vmovdqu64	[rcx], zmm1
+        vmovdqu64	zmm2, [rcx+64]
+        vpaddw	zmm2, zmm2, [rdx+64]
+        vpandq	zmm2, zmm2, zmm0
+        vmovdqu64	[rcx+64], zmm2
+        vzeroupper
+        ret
+frodokem_add_avx512 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_sample_avx512 PROC
+        push	r12
+        sub	rsp, 32
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        movsxd	rax, edx
+        shl	rax, 1
+        vpternlogd	zmm0, zmm0, zmm0, 255
+        vpsrlw	zmm0, zmm0, 15
+        vpxorq	zmm1, zmm1, zmm1
+        xor	r10, r10
+L_frodokem_sample_avx512_blk:
+        vmovdqu64	zmm2, [rcx+r10]
+        vpsrlw	zmm3, zmm2, 1
+        vpandq	zmm4, zmm2, zmm0
+        vpxorq	zmm5, zmm5, zmm5
+        mov	r11, r8
+        mov	r12d, r9d
+L_frodokem_sample_avx512_cdf:
+        vpbroadcastw	zmm6, WORD PTR [r11]
+        vpsubw	zmm6, zmm6, zmm3
+        vpsrlw	zmm6, zmm6, 15
+        vpaddw	zmm5, zmm5, zmm6
+        add	r11, 2
+        sub	r12, 1
+        jnz	L_frodokem_sample_avx512_cdf
+        vpsubw	zmm7, zmm1, zmm4
+        vpxorq	zmm5, zmm5, zmm7
+        vpaddw	zmm5, zmm5, zmm4
+        vmovdqu64	[rcx+r10], zmm5
+        add	r10, 64
+        cmp	r10, rax
+        jl	L_frodokem_sample_avx512_blk
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        add	rsp, 32
+        pop	r12
+        ret
+frodokem_sample_avx512 ENDP
+_TEXT ENDS
+_TEXT SEGMENT READONLY PARA
+frodokem_gen_a_rows_aes_avx512 PROC
+        push	r12
+        push	r13
+        push	r14
+        push	r15
+        push	rdi
+        push	rsi
+        mov	rax, QWORD PTR [rsp+88]
+        mov	r10, QWORD PTR [rsp+96]
+        mov	r11, QWORD PTR [rsp+104]
+        sub	rsp, 160
+        vmovdqu	OWORD PTR [rsp], xmm6
+        vmovdqu	OWORD PTR [rsp+16], xmm7
+        vmovdqu	OWORD PTR [rsp+32], xmm8
+        vmovdqu	OWORD PTR [rsp+48], xmm9
+        vmovdqu	OWORD PTR [rsp+64], xmm10
+        vmovdqu	OWORD PTR [rsp+80], xmm11
+        vmovdqu	OWORD PTR [rsp+96], xmm12
+        vmovdqu	OWORD PTR [rsp+112], xmm13
+        vmovdqu	OWORD PTR [rsp+128], xmm14
+        vmovdqu	OWORD PTR [rsp+144], xmm15
+        vbroadcasti32x4	zmm0, OWORD PTR [r8]
+        vbroadcasti32x4	zmm1, OWORD PTR [r8+16]
+        vbroadcasti32x4	zmm2, OWORD PTR [r8+32]
+        vbroadcasti32x4	zmm3, OWORD PTR [r8+48]
+        vbroadcasti32x4	zmm4, OWORD PTR [r8+64]
+        vbroadcasti32x4	zmm5, OWORD PTR [r8+80]
+        vbroadcasti32x4	zmm6, OWORD PTR [r8+96]
+        vbroadcasti32x4	zmm7, OWORD PTR [r8+112]
+        vbroadcasti32x4	zmm8, OWORD PTR [r8+128]
+        vbroadcasti32x4	zmm9, OWORD PTR [r8+144]
+        vbroadcasti32x4	zmm10, OWORD PTR [r8+160]
+        vmovd	xmm15, r11
+        vpbroadcastw	zmm15, xmm15
+        movsxd	r12, r10d
+        shl	r12, 1
+        movsxd	r13, eax
+        imul	r13, r12
+        movsxd	r9, r9d
+        xor	rsi, rsi
+        mov	r14, rcx
+L_frodokem_gen_a_rows_aes_avx512_row:
+        mov	edi, r9d
+        mov	r15, r14
+        add	r15, r12
+L_frodokem_gen_a_rows_aes_avx512_blk:
+        mov	QWORD PTR [r14], rdi
+        mov	QWORD PTR [r14+8], rsi
+        add	rdi, 524288
+        add	r14, 16
+        cmp	r14, r15
+        jl	L_frodokem_gen_a_rows_aes_avx512_blk
+        add	r9, 1
+        mov	r15, rcx
+        add	r15, r13
+        cmp	r14, r15
+        jl	L_frodokem_gen_a_rows_aes_avx512_row
+        xor	rdi, rdi
+L_frodokem_gen_a_rows_aes_avx512_aes:
+        vmovdqu64	zmm11, [rcx]
+        vmovdqu64	zmm12, [rcx+64]
+        vmovdqu64	zmm13, [rcx+128]
+        vmovdqu64	zmm14, [rcx+192]
+        vpxorq	zmm11, zmm11, zmm0
+        vpxorq	zmm12, zmm12, zmm0
+        vpxorq	zmm13, zmm13, zmm0
+        vpxorq	zmm14, zmm14, zmm0
+        vaesenc	zmm11, zmm11, zmm1
+        vaesenc	zmm12, zmm12, zmm1
+        vaesenc	zmm13, zmm13, zmm1
+        vaesenc	zmm14, zmm14, zmm1
+        vaesenc	zmm11, zmm11, zmm2
+        vaesenc	zmm12, zmm12, zmm2
+        vaesenc	zmm13, zmm13, zmm2
+        vaesenc	zmm14, zmm14, zmm2
+        vaesenc	zmm11, zmm11, zmm3
+        vaesenc	zmm12, zmm12, zmm3
+        vaesenc	zmm13, zmm13, zmm3
+        vaesenc	zmm14, zmm14, zmm3
+        vaesenc	zmm11, zmm11, zmm4
+        vaesenc	zmm12, zmm12, zmm4
+        vaesenc	zmm13, zmm13, zmm4
+        vaesenc	zmm14, zmm14, zmm4
+        vaesenc	zmm11, zmm11, zmm5
+        vaesenc	zmm12, zmm12, zmm5
+        vaesenc	zmm13, zmm13, zmm5
+        vaesenc	zmm14, zmm14, zmm5
+        vaesenc	zmm11, zmm11, zmm6
+        vaesenc	zmm12, zmm12, zmm6
+        vaesenc	zmm13, zmm13, zmm6
+        vaesenc	zmm14, zmm14, zmm6
+        vaesenc	zmm11, zmm11, zmm7
+        vaesenc	zmm12, zmm12, zmm7
+        vaesenc	zmm13, zmm13, zmm7
+        vaesenc	zmm14, zmm14, zmm7
+        vaesenc	zmm11, zmm11, zmm8
+        vaesenc	zmm12, zmm12, zmm8
+        vaesenc	zmm13, zmm13, zmm8
+        vaesenc	zmm14, zmm14, zmm8
+        vaesenc	zmm11, zmm11, zmm9
+        vaesenc	zmm12, zmm12, zmm9
+        vaesenc	zmm13, zmm13, zmm9
+        vaesenc	zmm14, zmm14, zmm9
+        vaesenclast	zmm11, zmm11, zmm10
+        vaesenclast	zmm12, zmm12, zmm10
+        vaesenclast	zmm13, zmm13, zmm10
+        vaesenclast	zmm14, zmm14, zmm10
+        vpandq	zmm11, zmm11, zmm15
+        vpandq	zmm12, zmm12, zmm15
+        vpandq	zmm13, zmm13, zmm15
+        vpandq	zmm14, zmm14, zmm15
+        vmovdqu64	[rdx], zmm11
+        vmovdqu64	[rdx+64], zmm12
+        vmovdqu64	[rdx+128], zmm13
+        vmovdqu64	[rdx+192], zmm14
+        add	rcx, 256
+        add	rdx, 256
+        add	rdi, 256
+        cmp	rdi, r13
+        jl	L_frodokem_gen_a_rows_aes_avx512_aes
+        vzeroupper
+        vmovdqu	xmm6, OWORD PTR [rsp]
+        vmovdqu	xmm7, OWORD PTR [rsp+16]
+        vmovdqu	xmm8, OWORD PTR [rsp+32]
+        vmovdqu	xmm9, OWORD PTR [rsp+48]
+        vmovdqu	xmm10, OWORD PTR [rsp+64]
+        vmovdqu	xmm11, OWORD PTR [rsp+80]
+        vmovdqu	xmm12, OWORD PTR [rsp+96]
+        vmovdqu	xmm13, OWORD PTR [rsp+112]
+        vmovdqu	xmm14, OWORD PTR [rsp+128]
+        vmovdqu	xmm15, OWORD PTR [rsp+144]
+        add	rsp, 160
+        pop	rsi
+        pop	rdi
+        pop	r15
+        pop	r14
+        pop	r13
+        pop	r12
+        ret
+frodokem_gen_a_rows_aes_avx512 ENDP
+_TEXT ENDS
+ENDIF
+ENDIF
+END
diff --git a/wolfcrypt/src/wc_frodokem_mat.c b/wolfcrypt/src/wc_frodokem_mat.c
new file mode 100644
index 00000000000..b8506cc16d1
--- /dev/null
+++ b/wolfcrypt/src/wc_frodokem_mat.c
@@ -0,0 +1,3037 @@
+/* wc_frodokem_mat.c
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Low-level matrix arithmetic and encoding routines for the FrodoKEM reference
+ * implementation.
+ *
+ * Implementation based on:
+ *   https://www.ietf.org/archive/id/draft-longa-cfrg-frodokem-03.txt
+ *
+ * The matrix A is generated on the fly (a row at a time) using AES-128
+ * (Section 6.7.1) or SHAKE128 (Section 6.7.2) of the draft, selected per
+ * parameter set and build.  The full matrix is never stored, keeping memory
+ * usage independent of q and small relative to n^2.
+ */
+
+#define _WC_BUILDING_WC_FRODOKEM_MAT_C
+
+#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
+
+#include <wolfssl/wolfcrypt/wc_frodokem_mat.h>
+#include <wolfssl/wolfcrypt/hash.h>
+#include <wolfssl/wolfcrypt/memory.h>
+#if defined(USE_INTEL_SPEEDUP) || defined(FRODOKEM_HAVE_SVE) || \
+    (defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__))
+#include <wolfssl/wolfcrypt/cpuid.h>
+#endif
+#ifdef WOLFSSL_FRODOKEM_AES
+    #include <wolfssl/wolfcrypt/aes.h>
+    #if defined(NO_AES) || !defined(WOLFSSL_AES_DIRECT) || \
+        !defined(HAVE_AES_ECB)
+        #error "WOLFSSL_FRODOKEM_AES needs WOLFSSL_AES_DIRECT and HAVE_AES_ECB."
+    #endif
+#endif
+
+#ifdef NO_INLINE
+    #include <wolfssl/wolfcrypt/misc.h>
+#else
+    #define WOLFSSL_MISC_INCLUDED
+    #include <wolfcrypt/src/misc.c>
+#endif
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+
+/* On AArch64 the presence of NEON (Advanced SIMD) is verified at run time via
+ * IS_AARCH64_ASIMD, so the NEON asm and the portable-C matrix path are both
+ * compiled and the choice is made per call (matching the sha256/chacha
+ * pattern). AArch32 NEON and Thumb2 guarantee their SIMD at compile time
+ * (-mfpu / DSP) and always use the asm. */
+#if defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__)
+    #define FRODOKEM_HAVE_NEON_RUNTIME
+#endif
+
+/* Prefix for the S * A dispatch: use SME when the CPU has it (a small S-column
+ * gather then the ZA-tile outer product), else fall through. Empty when SME is
+ * not compiled in. */
+#ifdef FRODOKEM_HAVE_SME
+#define FRODOKEM_SA_ACCUM_SME(out, s, row, j, n)                               \
+        if (frodokem_sme_svl_ok) {                                             \
+            frodokem_sa_accum_sme_wrap((out), (s), (row), (j), (n));           \
+        }                                                                      \
+        else
+#define FRODOKEM_AS_ACCUM_SME(out, s, row, i, n)                               \
+        if (frodokem_sme_svl_ok) {                                             \
+            frodokem_as_accum_sme_wrap((out), (s), (row), (i), (n));           \
+        }                                                                      \
+        else
+#else
+#define FRODOKEM_SA_ACCUM_SME(out, s, row, j, n) /* SME not compiled in */
+#define FRODOKEM_AS_ACCUM_SME(out, s, row, i, n) /* SME not compiled in */
+#endif
+
+/* Dispatch the S * A and A * S accumulates. SME > SVE > NEON (if Advanced SIMD)
+ * > portable C, chosen per call from the cached CPU flags. */
+#if defined(FRODOKEM_HAVE_SVE)
+#define FRODOKEM_SA_ACCUM(out, s, row, j, n)                                   \
+    do {                                                                       \
+        FRODOKEM_SA_ACCUM_SME(out, s, row, j, n)                               \
+        if (IS_AARCH64_SVE(cpuid_flags)) {                                     \
+            frodokem_sa_accum_sve((out), (s), (row), (j), (n));                \
+        }                                                                      \
+        else if (IS_AARCH64_ASIMD(cpuid_flags)) {                             \
+            frodokem_sa_accum_arm((out), (s), (row), (j), (n));                \
+        }                                                                      \
+        else {                                                                 \
+            frodokem_sa_accum((out), (s), (row), (j), (n));                    \
+        }                                                                      \
+    } while (0)
+#define FRODOKEM_AS_ACCUM(out, s, row, i, n)                                   \
+    do {                                                                       \
+        FRODOKEM_AS_ACCUM_SME(out, s, row, i, n)                               \
+        if (IS_AARCH64_SVE(cpuid_flags)) {                                     \
+            frodokem_as_accum_sve((out), (s), (row), (i), (n));                \
+        }                                                                      \
+        else if (IS_AARCH64_ASIMD(cpuid_flags)) {                             \
+            frodokem_as_accum_arm((out), (s), (row), (i), (n));                \
+        }                                                                      \
+        else {                                                                 \
+            frodokem_as_accum((out), (s), (row), (i), (n));                    \
+        }                                                                      \
+    } while (0)
+#elif defined(FRODOKEM_HAVE_NEON_RUNTIME)
+#define FRODOKEM_SA_ACCUM(out, s, row, j, n)                                   \
+    do {                                                                       \
+        FRODOKEM_SA_ACCUM_SME(out, s, row, j, n)                               \
+        if (IS_AARCH64_ASIMD(cpuid_flags)) {                                   \
+            frodokem_sa_accum_arm((out), (s), (row), (j), (n));                \
+        }                                                                      \
+        else {                                                                 \
+            frodokem_sa_accum((out), (s), (row), (j), (n));                    \
+        }                                                                      \
+    } while (0)
+#define FRODOKEM_AS_ACCUM(out, s, row, i, n)                                   \
+    do {                                                                       \
+        FRODOKEM_AS_ACCUM_SME(out, s, row, i, n)                               \
+        if (IS_AARCH64_ASIMD(cpuid_flags)) {                                   \
+            frodokem_as_accum_arm((out), (s), (row), (i), (n));                \
+        }                                                                      \
+        else {                                                                 \
+            frodokem_as_accum((out), (s), (row), (i), (n));                    \
+        }                                                                      \
+    } while (0)
+#elif defined(FRODOKEM_HAVE_ARM_ASM)
+#define FRODOKEM_SA_ACCUM(out, s, row, j, n)                                   \
+    frodokem_sa_accum_arm((out), (s), (row), (j), (n))
+#define FRODOKEM_AS_ACCUM(out, s, row, i, n)                                   \
+    frodokem_as_accum_arm((out), (s), (row), (i), (n))
+#endif
+
+/* Accumulate a whole FRODOKEM_ROW_MULT-row A*S batch (as generated per AES gen
+ * call). On AArch64 NEON without SVE/SME, FRODOKEM_ROW_MULT is 4 and a dedicated
+ * 4-row routine fuses all four rows so each S column block is loaded once and
+ * multiply-accumulated into all four output rows (halving S-load issue pressure).
+ * Otherwise accumulate FRODOKEM_AS_ACCUM_ROWS rows at a time with the base
+ * routine (which the macro dispatches to SME/SVE/NEON/portable at run time). */
+#if defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__) && \
+    !defined(FRODOKEM_HAVE_SVE) && !defined(FRODOKEM_HAVE_SME)
+#define FRODOKEM_AS_ACCUM_BATCH(out, s, row, i, n)                             \
+    frodokem_as_accum_x4_neon((out), (s), (row), (i), (n))
+#define FRODOKEM_SA_ACCUM_BATCH(out, s, row, j, n)                             \
+    frodokem_sa_accum_x4_neon((out), (s), (row), (j), (n))
+#elif defined(FRODOKEM_HAVE_ARM_ASM)
+#define FRODOKEM_AS_ACCUM_BATCH(out, s, row, i, n)                             \
+    do {                                                                       \
+        int k_;                                                                \
+        for (k_ = 0; k_ < FRODOKEM_ROW_MULT; k_ += FRODOKEM_AS_ACCUM_ROWS) {   \
+            FRODOKEM_AS_ACCUM((out), (s), (row) + k_ * (n), (i) + k_, (n));     \
+        }                                                                      \
+    } while (0)
+#define FRODOKEM_SA_ACCUM_BATCH(out, s, row, j, n)                             \
+    do {                                                                       \
+        int k_;                                                                \
+        for (k_ = 0; k_ < FRODOKEM_ROW_MULT; k_ += FRODOKEM_AS_ACCUM_ROWS) {   \
+            FRODOKEM_SA_ACCUM((out), (s), (row) + k_ * (n), (j) + k_, (n));     \
+        }                                                                      \
+    } while (0)
+#endif
+
+/* FrodoKEM-976 and -1344 use D=16 packing and SHAKE-256 noise generation;
+ * FrodoKEM-640 uses D=15 packing and SHAKE-128. Only compile the code paths
+ * the enabled parameter sets can actually reach. */
+#if defined(WOLFSSL_WC_FRODOKEM_976) || defined(WOLFSSL_WC_FRODOKEM_1344)
+    #define FRODOKEM_D16_SHAKE256
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_640
+    #define FRODOKEM_D15_SHAKE128
+#endif
+
+/* restrict qualifier for the matrix multiply inner loops. The A-row scratch
+ * and the output-row slices never overlap, so flagging them lets the compiler
+ * vectorize each contiguous accumulation stream (without it the aliasing
+ * analysis gives up and the loops stay scalar). Falls back to nothing on
+ * compilers without a restrict keyword - the code stays correct either way. */
+#if defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L)
+    #define FRODOKEM_RESTRICT restrict
+#elif defined(__GNUC__) || defined(__clang__) || defined(_MSC_VER)
+    #define FRODOKEM_RESTRICT __restrict
+#else
+    #define FRODOKEM_RESTRICT
+#endif
+
+#if defined(USE_INTEL_SPEEDUP) || defined(FRODOKEM_HAVE_SVE) || \
+    defined(FRODOKEM_HAVE_NEON_RUNTIME)
+/* Cached CPU feature flags used to select SIMD routines: AVX2 / BMI2 Keccak in
+ * matrix-A generation on Intel, and the SVE / NEON matrix ops on AArch64 (NEON
+ * is gated on Advanced SIMD). Populated once by frodokem_init(). */
+static cpuid_flags_t cpuid_flags = WC_CPUID_INITIALIZER;
+#endif
+
+#ifdef FRODOKEM_HAVE_SME
+/* The SME kernels compute the whole nbar x nbar (8 x 8) product in one ZA.S
+ * tile, which needs a streaming vector length (SVL) of at least 256 bits (32
+ * bytes). HWCAP2_SME alone does not guarantee that, so the SVL is measured and
+ * the SME path is selected only when it is wide enough (else SVE / NEON runs).
+ * Set by frodokem_init(); 0 until then, so SME stays off until measured. */
+static int frodokem_sme_svl_ok = 0;
+
+/* Streaming vector length in bytes (SVL / 8), read with RDSVL. Encoded as a raw
+ * instruction so no SME assembler support is required. Only called when SME is
+ * present (IS_AARCH64_SME), so RDSVL will not trap. */
+static WC_INLINE int frodokem_sme_svl_bytes(void)
+{
+    word64 svl;
+    __asm__ volatile(".inst 0x04bf5820\n\t"   /* rdsvl x0, #1 */
+                     "mov %0, x0"
+                     : "=r"(svl) : : "x0");
+    return (int)svl;
+}
+#endif
+
+/* Initialize FrodoKEM internal state. Caches the CPU feature flags used to
+ * dispatch the SIMD implementations. Called from wc_FrodoKemKey_Init; safe to
+ * call repeatedly (the flags are read from the CPU only once). */
+void frodokem_init(void)
+{
+#if defined(USE_INTEL_SPEEDUP) || defined(FRODOKEM_HAVE_SVE) || \
+    defined(FRODOKEM_HAVE_NEON_RUNTIME)
+    cpuid_get_flags_ex(&cpuid_flags);
+#endif
+#ifdef FRODOKEM_HAVE_SME
+    /* SME needs SVL >= 256 bits (>= 32 bytes) for the 8 x 8 ZA.S tile. */
+    frodokem_sme_svl_ok = IS_AARCH64_SME(cpuid_flags) &&
+        (frodokem_sme_svl_bytes() >= 32);
+#endif
+}
+
+#ifdef FRODOKEM_HAVE_SME
+/* Portable-C A * S accumulate (defined later): the SME fallback on allocation
+ * failure. Compiled here since FRODOKEM_HAVE_SME implies AArch64 NEON
+ * runtime. */
+static void frodokem_as_accum(word16* out, const word16* s, const word16* row,
+    int i, int n);
+
+/* Reshape a rows x n matrix (row-major) into the SME UMOPA interleaved layout:
+ * dst[t*rows*2 + 2*r + e] = m[r*n + 2*t + e].
+ *
+ * @param  [out]  dst   Interleaved output (rows * n word16).
+ * @param  [in]   m     Source matrix (rows * n, row-major).
+ * @param  [in]   rows  Number of rows in the source matrix.
+ * @param  [in]   n     Number of columns (a multiple of 2).
+ */
+static void frodokem_sme_interleave(word16* dst, const word16* m, int rows,
+    int n)
+{
+    int t;
+    int r;
+    for (t = 0; t < n / 2; t++) {
+        for (r = 0; r < rows; r++) {
+            dst[t * rows * 2 + 2 * r + 0] = m[r * n + 2 * t + 0];
+            dst[t * rows * 2 + 2 * r + 1] = m[r * n + 2 * t + 1];
+        }
+    }
+}
+
+/* Gather the S column pair for column j (sc[2*i + e] = s[i*n + j + e]) into a
+ * small stack buffer and run the SME S * A accumulate. The A-row interleave is
+ * done inside the asm, so no large scratch is needed.
+ *
+ * @param  [in, out]  out  S * A accumulator (nbar * n, row-major).
+ * @param  [in]       s    Matrix S (nbar * n, row-major).
+ * @param  [in]       row  The two generated A rows (2 * n coefficients).
+ * @param  [in]       j    First column of the S column pair.
+ * @param  [in]       n    Matrix dimension n.
+ */
+static void frodokem_sa_accum_sme_wrap(word16* out, const word16* s,
+    const word16* row, int j, int n)
+{
+    word16 sc[2 * FRODOKEM_NBAR];
+    int i;
+
+    for (i = 0; i < FRODOKEM_NBAR; i++) {
+        sc[2 * i + 0] = s[i * n + j + 0];
+        sc[2 * i + 1] = s[i * n + j + 1];
+    }
+    frodokem_sa_accum_sme(out, sc, row, n);
+    /* sc held two columns of the secret matrix S^T. */
+    ForceZero(sc, sizeof(sc));
+}
+
+/* Transpose the two A rows and S into the SME interleaved layout, then run the
+ * SME A * S accumulate. Both need reshaping (unlike S * A), so this uses
+ * scratch and falls back to the portable-C accumulate if it cannot be had.
+ *
+ * @param  [in, out]  out  A * S accumulator (n * nbar, row-major).
+ * @param  [in]       s    Matrix S^T (nbar * n, row-major).
+ * @param  [in]       row  The two generated A rows (2 * n coefficients).
+ * @param  [in]       i    Index of the first of the two generated A rows.
+ * @param  [in]       n    Matrix dimension n.
+ */
+static void frodokem_as_accum_sme_wrap(word16* out, const word16* s,
+    const word16* row, int i, int n)
+{
+    word16* at;
+    word16* st;
+
+    at = (word16*)XMALLOC((size_t)2 * (size_t)n * sizeof(word16), NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    st = (word16*)XMALLOC((size_t)FRODOKEM_NBAR * (size_t)n * sizeof(word16),
+        NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if ((at != NULL) && (st != NULL)) {
+        frodokem_sme_interleave(at, row, 2, n);
+        frodokem_sme_interleave(st, s, FRODOKEM_NBAR, n);
+        frodokem_as_accum_sme(out, at, st, i, n);
+    }
+    else {
+        frodokem_as_accum(out, s, row, i, n);
+    }
+    /* st held the interleaved secret matrix S^T. */
+    if (st != NULL) {
+        ForceZero(st, (size_t)FRODOKEM_NBAR * (size_t)n * sizeof(word16));
+    }
+    XFREE(at, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(st, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+}
+#endif /* FRODOKEM_HAVE_SME */
+
+/******************************************************************************/
+/* Packing and unpacking of matrices to/from byte strings (Section 6.2).      */
+/******************************************************************************/
+
+/* Pack a matrix of nElem coefficients into a byte string.
+ *
+ * Each coefficient contributes its low 'd' bits, most-significant bit first,
+ * and the resulting bit string is packed into bytes most-significant bit first
+ * (Section 6.2).
+ *
+ * @param  [out]  out    Output byte string. Must be (nElem * d + 7) / 8 bytes.
+ * @param  [in]   in     Matrix coefficients in row-major order.
+ * @param  [in]   nElem  Number of coefficients.
+ * @param  [in]   d      Number of bits per coefficient.
+ */
+void frodokem_pack(byte* out, const word16* in, int nElem, int d)
+{
+#if !defined(FRODOKEM_D16_SHAKE256) || !defined(FRODOKEM_D15_SHAKE128)
+    (void)d;
+#endif
+
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    if (d == 16)
+#endif
+#ifdef FRODOKEM_D16_SHAKE256
+    {
+        /* Coefficients are byte-aligned: each is stored as a big-endian 16-bit
+         * value (most-significant byte first). */
+#ifdef BIG_ENDIAN_ORDER
+        /* word16 memory is already big-endian: a straight copy. */
+        XMEMCPY(out, in, (size_t)nElem * sizeof(word16));
+#else
+        int i;
+
+        for (i = 0; i < nElem; i++) {
+            out[2 * i]     = (byte)(in[i] >> 8);
+            out[2 * i + 1] = (byte)(in[i] & 0xff);
+        }
+#endif
+    }
+#endif
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    else
+#endif
+#ifdef FRODOKEM_D15_SHAKE128
+    {
+        /* d == 15 (FrodoKEM-640): stream 15 significant bits per coefficient,
+         * most-significant bit first, through a bit accumulator, emitting a
+         * byte whenever 8 bits are buffered. nElem is a multiple of nbar (8),
+         * so packing ends on a byte boundary and every output byte is fully
+         * assigned - no pre-clear needed. This is endian-independent. */
+        word32 acc = 0;
+        int accBits = 0;
+        int oi = 0;
+        int i;
+
+        for (i = 0; i < nElem; i++) {
+            acc = (acc << 15) | (word32)(in[i] & 0x7fff);
+            accBits += 15;
+            do {
+                accBits -= 8;
+                out[oi++] = (byte)(acc >> accBits);
+            } while (accBits >= 8);
+            acc &= ((word32)1 << accBits) - 1;
+        }
+    }
+#endif
+}
+
+/* Unpack a byte string into a matrix of nElem coefficients.
+ *
+ * The inverse of frodokem_pack().
+ *
+ * @param  [out]  out    Output matrix coefficients in row-major order.
+ * @param  [in]   in     Input byte string.
+ * @param  [in]   nElem  Number of coefficients.
+ * @param  [in]   d      Number of bits per coefficient.
+ */
+void frodokem_unpack(word16* out, const byte* in, int nElem, int d)
+{
+#if !defined(FRODOKEM_D16_SHAKE256) || !defined(FRODOKEM_D15_SHAKE128)
+    (void)d;
+#endif
+
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    if (d == 16)
+#endif
+#ifdef FRODOKEM_D16_SHAKE256
+    {
+        /* Byte-aligned coefficients: inverse of the big-endian byte swap. */
+#ifdef BIG_ENDIAN_ORDER
+        /* word16 memory is already big-endian: a straight copy. */
+        XMEMCPY(out, in, (size_t)nElem * sizeof(word16));
+#else
+        int i;
+
+        for (i = 0; i < nElem; i++) {
+            out[i] = (word16)(((word16)in[2 * i] << 8) | in[2 * i + 1]);
+        }
+#endif
+    }
+#endif
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    else
+#endif
+#ifdef FRODOKEM_D15_SHAKE128
+    {
+        /* d == 15 (FrodoKEM-640): read 15 bits per coefficient, most-
+         * significant bit first, through a bit accumulator fed a byte at a
+         * time. nElem is a multiple of nbar (8), so the stream is consumed
+         * exactly. This is endian-independent. */
+        word32 acc = 0;
+        int accBits = 0;
+        int ii = 0;
+        int i;
+
+        for (i = 0; i < nElem; i++) {
+            while (accBits < 15) {
+                acc = (acc << 8) | in[ii++];
+                accBits += 8;
+            }
+            accBits -= 15;
+            out[i] = (word16)((acc >> accBits) & 0x7fff);
+            acc &= ((word32)1 << accBits) - 1;
+        }
+    }
+#endif
+}
+
+/* Serialize a matrix of word16 coefficients as little-endian 16-bit values.
+ *
+ * Used for the secret matrix S^T in the private key, whose two's-complement
+ * samples are stored as full 16-bit little-endian words (Section 6.3).
+ *
+ * @param  [out]  out  Output byte string (2 * cnt bytes).
+ * @param  [in]   mat  Matrix coefficients.
+ * @param  [in]   cnt  Number of coefficients.
+ */
+void frodokem_store_matrix(byte* out, const word16* mat, int cnt)
+{
+#ifdef BIG_ENDIAN_ORDER
+    int i;
+
+    /* Swap each coefficient from big-endian memory to little-endian bytes. */
+    for (i = 0; i < cnt; i++) {
+        out[2 * i]     = (byte)(mat[i] & 0xff);
+        out[2 * i + 1] = (byte)((mat[i] >> 8) & 0xff);
+    }
+#else
+    /* Coefficients are already little-endian in memory: a straight copy. */
+    XMEMCPY(out, mat, (size_t)cnt * sizeof(word16));
+#endif
+}
+
+/* Deserialize little-endian 16-bit values into a matrix of word16 coefficients.
+ *
+ * The inverse of frodokem_store_matrix(): loads the secret matrix S^T from the
+ * private key.
+ *
+ * @param  [out]  mat  Output matrix coefficients.
+ * @param  [in]   in   Input byte string (2 * cnt bytes).
+ * @param  [in]   cnt  Number of coefficients.
+ */
+void frodokem_load_matrix(word16* mat, const byte* in, int cnt)
+{
+#ifdef BIG_ENDIAN_ORDER
+    int i;
+
+    /* Swap each coefficient from little-endian bytes to big-endian memory. */
+    for (i = 0; i < cnt; i++) {
+        mat[i] = (word16)(in[2 * i] | ((word16)in[2 * i + 1] << 8));
+    }
+#else
+    /* Coefficients are already little-endian in memory: a straight copy. */
+    XMEMCPY(mat, in, (size_t)cnt * sizeof(word16));
+#endif
+}
+
+/******************************************************************************/
+/* Encoding and decoding of messages to/from matrices (Section 6.1).          */
+/******************************************************************************/
+
+/* Encode a message bit string into an nbar x nbar matrix.
+ *
+ * Groups of B bits (least-significant bit of each byte first, Section 6.1) are
+ * turned into a coefficient scaled by q / 2^B, i.e. shifted left by (D - B).
+ *
+ * @param  [out]  c     Output matrix (nbar * nbar coefficients).
+ * @param  [in]   msg   Message of B * nbar * nbar bits (lenSec bytes).
+ * @param  [in]   d     Number of bits per coefficient (D).
+ * @param  [in]   bits  Number of message bits per coefficient (B).
+ */
+void frodokem_key_encode(word16* c, const byte* msg, int d, int bits)
+{
+    int idx;
+    int k;
+    word32 bitPos = 0;
+    int nElem = FRODOKEM_NBAR_SQ;
+    int shift = d - bits;
+
+    for (idx = 0; idx < nElem; idx++) {
+        unsigned int val = 0;
+
+        for (k = 0; k < bits; k++) {
+            /* Bits taken least-significant first within each byte. */
+            int bit = (msg[bitPos >> 3] >> (bitPos & 7)) & 1;
+            val |= ((unsigned int)bit) << k;
+            bitPos++;
+        }
+        c[idx] = (word16)(val << shift);
+    }
+}
+
+/* Decode an nbar x nbar matrix into a message bit string.
+ *
+ * The inverse of frodokem_key_encode(): each coefficient is rounded to
+ * the nearest multiple of q / 2^B and the resulting B bits are emitted
+ * least-significant bit first.
+ *
+ * @param  [out]  msg  Output message of B * nbar * nbar bits (lenSec bytes).
+ * @param  [in]   c    Input matrix (nbar * nbar coefficients).
+ * @param  [in]   p    FrodoKEM parameters.
+ */
+void frodokem_key_decode(byte* msg, const word16* c, const FrodoKemParams* p)
+{
+    int idx;
+    int k;
+    word32 bitPos = 0;
+    int nElem = FRODOKEM_NBAR_SQ;
+    int shift = p->d - p->b;
+    /* Rounding constant: q / 2^(B+1) = 2^(D - B - 1). */
+    unsigned int rnd = 1u << (shift - 1);
+    unsigned int mask = (1u << p->b) - 1;
+
+    XMEMSET(msg, 0, (size_t)p->lenSec);
+
+    for (idx = 0; idx < nElem; idx++) {
+        /* Reduce the coefficient modulo q before rounding. */
+        unsigned int v = (unsigned int)(c[idx] & p->qMask);
+        unsigned int dec = ((v + rnd) >> shift) & mask;
+
+        for (k = 0; k < p->b; k++) {
+            int bit = (dec >> k) & 1;
+            msg[bitPos >> 3] |= (byte)(bit << (bitPos & 7));
+            bitPos++;
+        }
+    }
+}
+
+/******************************************************************************/
+/* SHAKE hashing.                                                             */
+/******************************************************************************/
+
+#ifdef FRODOKEM_D15_SHAKE128
+/* Compute out = SHAKE128(in0 || in1, outLen). Used for the hashing function
+ * of FrodoKEM-640 (D=15).
+ *
+ * @param  [in]   shake   Reusable SHAKE object (re-initialized here).
+ * @param  [in]   in0     First input buffer.
+ * @param  [in]   len0    Length in bytes of the first input.
+ * @param  [in]   in1     Second input buffer.
+ * @param  [in]   len1    Length in bytes of the second input.
+ * @param  [out]  out     Output buffer.
+ * @param  [in]   outLen  Number of bytes to output.
+ * @return  0 on success, negative on hash error.
+ */
+static int frodokem_shake128(wc_Shake* shake, const byte* in0, word32 len0,
+    const byte* in1, word32 len1, byte* out, word32 outLen)
+{
+    int ret;
+
+    ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+    if (ret == 0) {
+        ret = wc_Shake128_Update(shake, in0, len0);
+    }
+    if (ret == 0) {
+        ret = wc_Shake128_Update(shake, in1, len1);
+    }
+    if (ret == 0) {
+        ret = wc_Shake128_Final(shake, out, outLen);
+    }
+
+    return ret;
+}
+#endif /* FRODOKEM_D15_SHAKE128 */
+
+#ifdef FRODOKEM_D16_SHAKE256
+/* Compute out = SHAKE256(in0 || in1, outLen). Used for the hashing function
+ * of FrodoKEM-976 / -1344 (D=16).
+ *
+ * @param  [in]   shake   Reusable SHAKE object (re-initialized here).
+ * @param  [in]   in0     First input buffer.
+ * @param  [in]   len0    Length in bytes of the first input.
+ * @param  [in]   in1     Second input buffer.
+ * @param  [in]   len1    Length in bytes of the second input.
+ * @param  [out]  out     Output buffer.
+ * @param  [in]   outLen  Number of bytes to output.
+ * @return  0 on success, negative on hash error.
+ */
+static int frodokem_shake256(wc_Shake* shake, const byte* in0, word32 len0,
+    const byte* in1, word32 len1, byte* out, word32 outLen)
+{
+    int ret;
+
+    ret = wc_InitShake256(shake, NULL, INVALID_DEVID);
+    if (ret == 0) {
+        ret = wc_Shake256_Update(shake, in0, len0);
+    }
+    if (ret == 0) {
+        ret = wc_Shake256_Update(shake, in1, len1);
+    }
+    if (ret == 0) {
+        ret = wc_Shake256_Final(shake, out, outLen);
+    }
+
+    return ret;
+}
+#endif /* FRODOKEM_D16_SHAKE256 */
+
+/* Compute out = SHAKE(in0 || in1, outLen), selecting SHAKE128 for FrodoKEM-640
+ * and SHAKE256 for FrodoKEM-976 / -1344.
+ *
+ * @param  [in]   p       FrodoKEM parameters.
+ * @param  [in]   shake   Reusable SHAKE object (re-initialized here).
+ * @param  [in]   in0     First input buffer.
+ * @param  [in]   len0    Length in bytes of the first input.
+ * @param  [in]   in1     Second input buffer.
+ * @param  [in]   len1    Length in bytes of the second input.
+ * @param  [out]  out     Output buffer.
+ * @param  [in]   outLen  Number of bytes to output.
+ * @return  0 on success, negative on hash error.
+ */
+int frodokem_shake(const FrodoKemParams* p, wc_Shake* shake, const byte* in0,
+    word32 len0, const byte* in1, word32 len1, byte* out, word32 outLen)
+{
+    int ret = 0;
+
+#if !defined(FRODOKEM_D16_SHAKE256) || !defined(FRODOKEM_D15_SHAKE128)
+    (void)p;
+#endif
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    if (p->useShake256)
+#endif
+#ifdef FRODOKEM_D16_SHAKE256
+    {
+        ret = frodokem_shake256(shake, in0, len0, in1, len1, out, outLen);
+    }
+#endif
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    else
+#endif
+#ifdef FRODOKEM_D15_SHAKE128
+    {
+        ret = frodokem_shake128(shake, in0, len0, in1, len1, out, outLen);
+    }
+#endif
+
+    return ret;
+}
+
+/* One-shot SHAKE over a single contiguous input buffer, selecting SHAKE128 for
+ * FrodoKEM-640 and SHAKE256 for FrodoKEM-976 / -1344.
+ *
+ * @param  [in]   p       FrodoKEM parameters.
+ * @param  [in]   shake   Reusable SHAKE object (re-initialized here).
+ * @param  [in]   in      Input buffer.
+ * @param  [in]   inLen   Length of input in bytes.
+ * @param  [out]  out     Output buffer.
+ * @param  [in]   outLen  Number of bytes to output.
+ * @return  0 on success, negative on hash error.
+ */
+int frodokem_shake_oneshot(const FrodoKemParams* p, wc_Shake* shake,
+    const byte* in, word32 inLen, byte* out, word32 outLen)
+{
+    int ret = 0;
+
+#if !defined(FRODOKEM_D16_SHAKE256) || !defined(FRODOKEM_D15_SHAKE128)
+    (void)p;
+#endif
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    if (p->useShake256)
+#endif
+#ifdef FRODOKEM_D16_SHAKE256
+    {
+        ret = wc_InitShake256(shake, NULL, INVALID_DEVID);
+        if (ret == 0) {
+            ret = wc_Shake256_Update(shake, in, inLen);
+        }
+        if (ret == 0) {
+            ret = wc_Shake256_Final(shake, out, outLen);
+        }
+    }
+#endif
+#if defined(FRODOKEM_D16_SHAKE256) && defined(FRODOKEM_D15_SHAKE128)
+    else
+#endif
+#ifdef FRODOKEM_D15_SHAKE128
+    {
+        ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+        if (ret == 0) {
+            ret = wc_Shake128_Update(shake, in, inLen);
+        }
+        if (ret == 0) {
+            ret = wc_Shake128_Final(shake, out, outLen);
+        }
+    }
+#endif
+
+    return ret;
+}
+
+/******************************************************************************/
+/* Error sampling (Section 6.5).                                              */
+/******************************************************************************/
+
+/* The sign/magnitude split of the 16-bit random value: bit 0 is the sign, the
+ * remaining 15 bits form the magnitude looked up against the CDF table. */
+#define FRODOKEM_SAMPLE_PRND(val)  ((word16)((val) >> 1))
+#define FRODOKEM_SAMPLE_SIGN(val)  ((word16)((val) & 1))
+
+/* Apply the sign: e = (-1)^sign * e, held as a 16-bit two's complement value.
+ * It is deliberately NOT reduced modulo q: the secret and error matrices are
+ * stored (and serialized in the secret key) in this form, and all downstream
+ * matrix arithmetic reduces modulo q at the end. */
+#define FRODOKEM_SAMPLE_APPLY_SIGN(e, sign) \
+    ((word16)(((e) ^ (word16)(0 - (sign))) + (sign)))
+
+/* The scalar-C samplers are the fallback for CPUs without the SIMD sampler.
+ * On AArch64 they are also compiled as the run-time fallback used when the CPU
+ * lacks Advanced SIMD (NEON). */
+#if !defined(FRODOKEM_HAVE_NEON_ASM) || defined(FRODOKEM_HAVE_NEON_RUNTIME)
+#ifdef WOLFSSL_FRODOKEM_SMALL
+/* Sample a single value from the error distribution using the parameter set's
+ * CDF table (Section 6.5).
+ *
+ * @param  [in]  val  16-bit random value (little-endian bytes assembled by the
+ *                    caller: bit 0 is the sign, bits 1..15 the magnitude).
+ * @param  [in]  p    FrodoKEM parameters.
+ * @return  Sampled value (16-bit two's complement, not reduced modulo q).
+ */
+static word16 frodokem_sample(word16 val, const FrodoKemParams* p)
+{
+    int i;
+    word16 prnd = FRODOKEM_SAMPLE_PRND(val);
+    word16 sign = FRODOKEM_SAMPLE_SIGN(val);
+    word16 e = 0;
+
+    /* Constant-time count of table entries strictly less than prnd. The final
+     * table entry (2^15 - 1) can never be exceeded, so it contributes zero. */
+    for (i = 0; i < p->cdfLen; i++) {
+        e = (word16)(e + (word16)((word16)(p->cdf[i] - prnd) >> 15));
+    }
+
+    return FRODOKEM_SAMPLE_APPLY_SIGN(e, sign);
+}
+#else
+/* One constant-time CDF comparison: add 1 to e when table entry V < prnd, i.e.
+ * when the 16-bit difference V - prnd borrows and sets bit 15. */
+#define FRODOKEM_CDF_STEP(V) \
+    e = (word16)(e + (word16)((word16)((V) - prnd) >> 15))
+
+/* Per-parameter samplers with the CDF loop fully unrolled and the CDF values
+ * (Table 5) used as literals - no table load or loop overhead. Each performs
+ * the same constant-time count as the generic sampler above. */
+#ifdef WOLFSSL_WC_FRODOKEM_640
+/* Sample a single FrodoKEM-640 error value from its 13-entry CDF (Table 5).
+ *
+ * @param  [in]  val  16-bit random value (bit 0 is the sign, bits 1..15 the
+ *                    magnitude).
+ * @return  Sampled value (16-bit two's complement, not reduced modulo q).
+ */
+static word16 frodokem_sample_640(word16 val)
+{
+    word16 prnd = FRODOKEM_SAMPLE_PRND(val);
+    word16 sign = FRODOKEM_SAMPLE_SIGN(val);
+    word16 e = 0;
+
+    FRODOKEM_CDF_STEP(4643);
+    FRODOKEM_CDF_STEP(13363);
+    FRODOKEM_CDF_STEP(20579);
+    FRODOKEM_CDF_STEP(25843);
+    FRODOKEM_CDF_STEP(29227);
+    FRODOKEM_CDF_STEP(31145);
+    FRODOKEM_CDF_STEP(32103);
+    FRODOKEM_CDF_STEP(32525);
+    FRODOKEM_CDF_STEP(32689);
+    FRODOKEM_CDF_STEP(32745);
+    FRODOKEM_CDF_STEP(32762);
+    FRODOKEM_CDF_STEP(32766);
+    FRODOKEM_CDF_STEP(32767);
+
+    return FRODOKEM_SAMPLE_APPLY_SIGN(e, sign);
+}
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_976
+/* Sample a single FrodoKEM-976 error value from its 11-entry CDF (Table 5).
+ *
+ * @param  [in]  val  16-bit random value (bit 0 is the sign, bits 1..15 the
+ *                    magnitude).
+ * @return  Sampled value (16-bit two's complement, not reduced modulo q).
+ */
+static word16 frodokem_sample_976(word16 val)
+{
+    word16 prnd = FRODOKEM_SAMPLE_PRND(val);
+    word16 sign = FRODOKEM_SAMPLE_SIGN(val);
+    word16 e = 0;
+
+    FRODOKEM_CDF_STEP(5638);
+    FRODOKEM_CDF_STEP(15915);
+    FRODOKEM_CDF_STEP(23689);
+    FRODOKEM_CDF_STEP(28571);
+    FRODOKEM_CDF_STEP(31116);
+    FRODOKEM_CDF_STEP(32217);
+    FRODOKEM_CDF_STEP(32613);
+    FRODOKEM_CDF_STEP(32731);
+    FRODOKEM_CDF_STEP(32760);
+    FRODOKEM_CDF_STEP(32766);
+    FRODOKEM_CDF_STEP(32767);
+
+    return FRODOKEM_SAMPLE_APPLY_SIGN(e, sign);
+}
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+/* Sample a single FrodoKEM-1344 error value from its 7-entry CDF (Table 5).
+ *
+ * @param  [in]  val  16-bit random value (bit 0 is the sign, bits 1..15 the
+ *                    magnitude).
+ * @return  Sampled value (16-bit two's complement, not reduced modulo q).
+ */
+static word16 frodokem_sample_1344(word16 val)
+{
+    word16 prnd = FRODOKEM_SAMPLE_PRND(val);
+    word16 sign = FRODOKEM_SAMPLE_SIGN(val);
+    word16 e = 0;
+
+    FRODOKEM_CDF_STEP(9142);
+    FRODOKEM_CDF_STEP(23462);
+    FRODOKEM_CDF_STEP(30338);
+    FRODOKEM_CDF_STEP(32361);
+    FRODOKEM_CDF_STEP(32725);
+    FRODOKEM_CDF_STEP(32765);
+    FRODOKEM_CDF_STEP(32767);
+
+    return FRODOKEM_SAMPLE_APPLY_SIGN(e, sign);
+}
+#endif
+#undef FRODOKEM_CDF_STEP
+#endif /* WOLFSSL_FRODOKEM_SMALL */
+#endif /* !FRODOKEM_HAVE_NEON_ASM || FRODOKEM_HAVE_NEON_RUNTIME */
+
+/* The i-th 16-bit little-endian noise value. Sampling is in place on little-
+ * endian (r aliases mat), so the native word16 is read directly; on big-endian
+ * the two little-endian bytes are assembled. */
+#ifdef BIG_ENDIAN_ORDER
+    #define FRODOKEM_NOISE_VAL(mat, r, i) \
+        ((word16)((r)[2 * (i)] | ((word16)(r)[2 * (i) + 1] << 8)))
+#else
+    #define FRODOKEM_NOISE_VAL(mat, r, i)  ((mat)[i])
+#endif
+
+/* Sample cnt error coefficients from a buffer of random bytes.
+ *
+ * Sampling is elementwise, so the matrix shape is irrelevant - only the total
+ * coefficient count is needed. The per-parameter sampler is chosen once, ahead
+ * of the loop.
+ *
+ * @param  [in, out]  mat  Little-endian: raw noise bytes in place, replaced by
+ *                         the sampled coefficients. Big-endian: coefficients
+ *                         out (bytes come from r).
+ * @param  [in]       cnt  Number of coefficients.
+ * @param  [in]       r    Random bytes (2 * cnt); used on big-endian only.
+ * @param  [in]       p    FrodoKEM parameters.
+ */
+static void frodokem_sample_matrix(word16* mat, int cnt, const byte* r,
+    const FrodoKemParams* p)
+{
+    int i;
+
+#ifndef BIG_ENDIAN_ORDER
+    /* Little-endian reads the value straight from mat (sampled in place). */
+    (void)r;
+#endif
+
+#if defined(FRODOKEM_HAVE_NEON_ASM) && !defined(FRODOKEM_HAVE_NEON_RUNTIME)
+    (void)i;
+    frodokem_sample_neon(mat, cnt, p->cdf, p->cdfLen);
+#else
+#ifdef FRODOKEM_HAVE_NEON_RUNTIME
+    if (IS_AARCH64_ASIMD(cpuid_flags)) {
+        frodokem_sample_neon(mat, cnt, p->cdf, p->cdfLen);
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+    if (IS_INTEL_AVX512(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_sample_avx512(mat, cnt, p->cdf, p->cdfLen);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_sample_avx2(mat, cnt, p->cdf, p->cdfLen);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+    {
+#ifdef WOLFSSL_FRODOKEM_SMALL
+    for (i = 0; i < cnt; i++) {
+        mat[i] = frodokem_sample(FRODOKEM_NOISE_VAL(mat, r, i), p);
+    }
+#else
+    switch (p->n) {
+#ifdef WOLFSSL_WC_FRODOKEM_640
+    case WC_FRODOKEM_640_N:
+        for (i = 0; i < cnt; i++) {
+            mat[i] = frodokem_sample_640(FRODOKEM_NOISE_VAL(mat, r, i));
+        }
+        break;
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_976
+    case WC_FRODOKEM_976_N:
+        for (i = 0; i < cnt; i++) {
+            mat[i] = frodokem_sample_976(FRODOKEM_NOISE_VAL(mat, r, i));
+        }
+        break;
+#endif
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+    case WC_FRODOKEM_1344_N:
+        for (i = 0; i < cnt; i++) {
+            mat[i] = frodokem_sample_1344(FRODOKEM_NOISE_VAL(mat, r, i));
+        }
+        break;
+#endif
+    default:
+        break;
+    }
+#endif /* WOLFSSL_FRODOKEM_SMALL */
+    }
+#endif /* FRODOKEM_HAVE_NEON_ASM */
+}
+
+/* SHAKE-128 rate (block size) in bytes. */
+#define FRODOKEM_SHAKE128_RATE  168
+/* SHAKE-256 rate (block size) in bytes. */
+#define FRODOKEM_SHAKE256_RATE  136
+
+/* Generate and sample the noise matrices for one FrodoKEM operation.
+ *
+ * Absorbs the caller-assembled 'domain || seedSE' (seInput, 1 + lenSE bytes)
+ * into a SHAKE XOF and squeezes the noise stream. Whole SHAKE blocks are
+ * squeezed straight into the destination buffers; tmp holds only the final
+ * partial block of a region, whose unused tail continues the stream into the
+ * next region. This is byte-identical to a single large SHAKE squeeze but
+ * avoids copying full blocks. A region of cnt word16 occupies exactly 2 * cnt
+ * bytes - the same as its noise - so each region is sampled in place, needing
+ * no separate noise buffer. The second region is optional (cnt1 == 0 to skip
+ * it): MakeKey's two matrices live in separate buffers, whereas Encapsulate and
+ * Decapsulate pass everything as one region. Region 1, when present, is much
+ * larger than one SHAKE block. The SHAKE variant is chosen once; each branch
+ * uses only its own primitives - SHAKE-256 for FrodoKEM-976/-1344, SHAKE-128
+ * for -640.
+ *
+ * The caller owns seInput and tmp: seInput is a small buffer whose first byte
+ * holds the domain and whose next lenSE bytes hold the seed (so no seed copy or
+ * seed zeroize happens here); tmp is scratch of at least a SHAKE block, for
+ * which callers pass the matrix-A row scratch (unused during noise generation).
+ *
+ * @param  [in]   p        FrodoKEM parameters.
+ * @param  [in]   shake    Reusable SHAKE object (re-initialized here).
+ * @param  [in]   seInput  Domain byte followed by the seed (1 + lenSE bytes).
+ * @param  [out]  tmp      Scratch for one squeezed block (>= SHAKE rate bytes).
+ * @param  [out]  mat0     First region output buffer (cnt0 coefficients).
+ * @param  [in]   cnt0     Number of coefficients in the first region.
+ * @param  [out]  mat1     Second region output buffer, or NULL when cnt1 == 0.
+ * @param  [in]   cnt1     Number of coefficients in the second region, or 0.
+ *                         Precondition: a non-zero cnt1 must span more than one
+ *                         SHAKE block (2 * cnt1 >= the SHAKE rate) so the
+ *                         region-1 partial-block length (2 * cnt1 - lead) does
+ *                         not underflow; MakeKey, the only cnt1 > 0 caller,
+ *                         passes cnt1 = n * nbar and always satisfies this.
+ * @return  0 on success, negative on error.
+ */
+int frodokem_gen_noise(const FrodoKemParams* p, wc_Shake* shake,
+    const byte* seInput, byte* tmp, word16* mat0, int cnt0, word16* mat1,
+    int cnt1)
+{
+    /* Initialized: with a single parameter set built, only one SHAKE branch is
+     * compiled and the compiler cannot see that p->useShake256 always selects
+     * it, so ret needs a defined value on the (unreachable) fall-through. */
+    int ret = 0;
+    word32 inLen;
+    byte* mat0_8 = (byte*)mat0;
+    byte* mat1_8 = (byte*)mat1;
+
+    inLen = (word32)(1 + p->lenSE);
+
+#ifdef FRODOKEM_D16_SHAKE256
+    if (p->useShake256 &&
+        ((ret = wc_InitShake256(shake, NULL, INVALID_DEVID)) == 0)) {
+        word32 len0 = (word32)(2 * cnt0);
+        word32 full = len0 / FRODOKEM_SHAKE256_RATE;
+
+        ret = wc_Shake256_Absorb(shake, seInput, inLen);
+        /* Whole blocks straight into mat0, final partial block via tmp. */
+        if (ret == 0) {
+            ret = wc_Shake256_SqueezeBlocks(shake, mat0_8, full);
+        }
+        if (ret == 0) {
+            ret = wc_Shake256_SqueezeBlocks(shake, tmp, 1);
+        }
+        if (ret == 0) {
+            len0 -= full * FRODOKEM_SHAKE256_RATE;
+            XMEMCPY(mat0_8 + full * FRODOKEM_SHAKE256_RATE, tmp, len0);
+            frodokem_sample_matrix(mat0, cnt0, mat0_8, p);
+        }
+        if ((ret == 0) && (cnt1 > 0)) {
+            /* tmp[len0 ..] is the start of region 1 (stream continues). The
+             * only cnt1 > 0 caller (MakeKey) passes a region 1 of many blocks,
+             * so 2 * cnt1 > lead and the unsigned rest cannot underflow. */
+            word32 lead = FRODOKEM_SHAKE256_RATE - len0;
+            word32 rest = (word32)(2 * cnt1) - lead;
+
+            XMEMCPY(mat1_8, tmp + len0, lead);
+            full = rest / FRODOKEM_SHAKE256_RATE;
+            ret = wc_Shake256_SqueezeBlocks(shake, mat1_8 + lead, full);
+            if (ret == 0) {
+                ret = wc_Shake256_SqueezeBlocks(shake, tmp, 1);
+                if (ret == 0) {
+                    rest -= full * FRODOKEM_SHAKE256_RATE;
+                    XMEMCPY(mat1_8 + lead + full * FRODOKEM_SHAKE256_RATE, tmp,
+                        rest);
+                }
+            }
+            if (ret == 0) {
+                frodokem_sample_matrix(mat1, cnt1, mat1_8, p);
+            }
+        }
+    }
+#endif
+#ifdef FRODOKEM_D15_SHAKE128
+    if ((!p->useShake256) &&
+        ((ret = wc_InitShake128(shake, NULL, INVALID_DEVID)) == 0)) {
+        word32 len0 = (word32)(2 * cnt0);
+        word32 full = len0 / FRODOKEM_SHAKE128_RATE;
+
+        ret = wc_Shake128_Absorb(shake, seInput, inLen);
+        /* Whole blocks straight into mat0, final partial block via tmp. */
+        if (ret == 0) {
+            ret = wc_Shake128_SqueezeBlocks(shake, mat0_8, full);
+        }
+        if (ret == 0) {
+            ret = wc_Shake128_SqueezeBlocks(shake, tmp, 1);
+        }
+        if (ret == 0) {
+            len0 -= full * FRODOKEM_SHAKE128_RATE;
+            XMEMCPY(mat0_8 + full * FRODOKEM_SHAKE128_RATE, tmp, len0);
+            frodokem_sample_matrix(mat0, cnt0, mat0_8, p);
+        }
+        if ((ret == 0) && (cnt1 > 0)) {
+            /* tmp[len0 ..] is the start of region 1 (stream continues). The
+             * only cnt1 > 0 caller (MakeKey) passes a region 1 of many blocks,
+             * so 2 * cnt1 > lead and the unsigned rest cannot underflow. */
+            word32 lead = FRODOKEM_SHAKE128_RATE - len0;
+            word32 rest = (word32)(2 * cnt1) - lead;
+
+            XMEMCPY(mat1_8, tmp + len0, lead);
+            full = rest / FRODOKEM_SHAKE128_RATE;
+            ret = wc_Shake128_SqueezeBlocks(shake, mat1_8 + lead, full);
+            if (ret == 0) {
+                ret = wc_Shake128_SqueezeBlocks(shake, tmp, 1);
+                if (ret == 0) {
+                    rest -= full * FRODOKEM_SHAKE128_RATE;
+                    XMEMCPY(mat1_8 + lead + full * FRODOKEM_SHAKE128_RATE, tmp,
+                        rest);
+                }
+            }
+            if (ret == 0) {
+                frodokem_sample_matrix(mat1, cnt1, mat1_8, p);
+            }
+        }
+    }
+#endif
+
+    return ret;
+}
+
+/******************************************************************************/
+/* Generation of matrix A and matrix multiplications (Sections 6.7, 6.4).     */
+/******************************************************************************/
+
+/* Reduce a freshly generated A row (n coefficients) in place, once the AES/
+ * SHAKE output has been written into row as bytes. On big-endian each little-
+ * endian 16-bit value is reassembled (no reduction). Then, only when q != 2^16,
+ * the values are reduced mod q with qmask - for q == 2^16 (FrodoKEM-976/-1344)
+ * the 16-bit values are already valid coefficients so no mask is applied. The
+ * nbar (== 8) step is unrolled; n is a multiple of nbar.
+ *
+ * @param  [in, out]  row    A row bytes in; reduced coefficients out (n).
+ * @param  [in]       n      Number of coefficients in the row.
+ * @param  [in]       qmask  Reduction mask (q - 1); 0xFFFF when q == 2^16.
+ */
+static void frodokem_a_row_reduce(word16* row, int n, int qmask)
+{
+#ifdef BIG_ENDIAN_ORDER
+    /* Reassemble each little-endian 16-bit value in place (no reduction). */
+    {
+        const byte* rowBytes = (const byte*)row;
+        int k;
+
+        for (k = 0; k < n; k += FRODOKEM_NBAR) {
+            row[k + 0] = (word16)(rowBytes[2 * (k + 0)] |
+                ((word16)rowBytes[2 * (k + 0) + 1] << 8));
+            row[k + 1] = (word16)(rowBytes[2 * (k + 1)] |
+                ((word16)rowBytes[2 * (k + 1) + 1] << 8));
+            row[k + 2] = (word16)(rowBytes[2 * (k + 2)] |
+                ((word16)rowBytes[2 * (k + 2) + 1] << 8));
+            row[k + 3] = (word16)(rowBytes[2 * (k + 3)] |
+                ((word16)rowBytes[2 * (k + 3) + 1] << 8));
+            row[k + 4] = (word16)(rowBytes[2 * (k + 4)] |
+                ((word16)rowBytes[2 * (k + 4) + 1] << 8));
+            row[k + 5] = (word16)(rowBytes[2 * (k + 5)] |
+                ((word16)rowBytes[2 * (k + 5) + 1] << 8));
+            row[k + 6] = (word16)(rowBytes[2 * (k + 6)] |
+                ((word16)rowBytes[2 * (k + 6) + 1] << 8));
+            row[k + 7] = (word16)(rowBytes[2 * (k + 7)] |
+                ((word16)rowBytes[2 * (k + 7) + 1] << 8));
+        }
+    }
+#endif
+
+    /* Reduce mod q only when necessary: q == 2^16 (976/1344) values are already
+     * valid coefficients; only q == 2^15 (640) needs the reduction. */
+#ifdef FRODOKEM_D15_SHAKE128
+#ifdef FRODOKEM_D16_SHAKE256
+    if (qmask != 0xffff)
+#endif
+    {
+        int k;
+
+        for (k = 0; k < n; k += FRODOKEM_NBAR) {
+            row[k + 0] = (word16)(row[k + 0] & qmask);
+            row[k + 1] = (word16)(row[k + 1] & qmask);
+            row[k + 2] = (word16)(row[k + 2] & qmask);
+            row[k + 3] = (word16)(row[k + 3] & qmask);
+            row[k + 4] = (word16)(row[k + 4] & qmask);
+            row[k + 5] = (word16)(row[k + 5] & qmask);
+            row[k + 6] = (word16)(row[k + 6] & qmask);
+            row[k + 7] = (word16)(row[k + 7] & qmask);
+        }
+    }
+#endif
+
+#ifndef FRODOKEM_D15_SHAKE128
+    /* q == 2^16 only: no reduction (qmask unused). */
+    (void)qmask;
+#ifndef BIG_ENDIAN_ORDER
+    /* Little-endian too: nothing at all to do. */
+    (void)row;
+    (void)n;
+#endif
+#endif
+}
+
+#ifdef WOLFSSL_FRODOKEM_AES
+#ifndef FRODOKEM_HAVE_ARM_AES_ASM
+/* Per-row C generator. On ARM with the crypto extension the whole batch is done
+ * by frodokem_gen_a_rows_aes_arm, so this fallback is compiled out there. */
+/* Generate cnt consecutive rows of matrix A (indices i .. i+cnt-1) using
+ * AES-128 (Section 6.7.1). Each row is built, ECB-encrypted and reduced before
+ * the next - keeping it hot in L1 - which measured faster than one ECB call
+ * over the whole group (that spills the working set to L2). Consuming cnt rows
+ * per accumulate call is still a win over one dispatch call per row.
+ *
+ * @param  [out]  rows  Output rows (cnt * n coefficients, contiguous).
+ * @param  [in]   aes   AES object keyed with seedA.
+ * @param  [in]   i     Index of the first row.
+ * @param  [in]   cnt   Number of consecutive rows to generate.
+ * @param  [in]   p     FrodoKEM parameters.
+ * @return  0 on success.
+ * @return  Negative on error from AES.
+ */
+static int frodokem_gen_a_rows_aes(word16* rows, Aes* aes, int i, int cnt,
+    const FrodoKemParams* p)
+{
+    int ret;
+    int r;
+    int j;
+    int n = p->n;
+    byte* rowBytes = (byte*)rows;
+
+    ret = 0;
+    /* Process one row at a time (build its input blocks, ECB the whole row,
+     * reduce) so each row stays hot in L1 through all three passes - measured
+     * faster than one big ECB over the whole group, whose larger working set
+     * spills to L2. For row i + r, block j is i+r || j || 0..0 (16-bit LE) and
+     * an AES block yields FRODOKEM_NBAR (== 8) coefficients, so it lands at
+     * rows[r*n] + 2*j = rowBytes + r*(2*n) + 2*j. In-place ECB is safe: each
+     * block's output depends only on its own input. */
+    for (r = 0; (ret == 0) && (r < cnt); r++) {
+        byte* rowR = rowBytes + r * (2 * n);
+        int idx = i + r;
+
+        for (j = 0; j < n; j += FRODOKEM_NBAR) {
+            byte* blk = rowR + 2 * j;
+
+            blk[0] = (byte)(idx & 0xff);
+            blk[1] = (byte)((idx >> 8) & 0xff);
+            blk[2] = (byte)(j & 0xff);
+            blk[3] = (byte)((j >> 8) & 0xff);
+            XMEMSET(blk + 4, 0, 12);
+        }
+
+        ret = wc_AesEcbEncrypt(aes, rowR, rowR, (word32)(2 * n));
+        if (ret == 0) {
+            frodokem_a_row_reduce(rows + r * n, n, (int)p->qMask);
+        }
+    }
+
+    return ret;
+}
+#endif /* !FRODOKEM_HAVE_ARM_AES_ASM */
+#endif /* WOLFSSL_FRODOKEM_AES */
+
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+/* The single-row scalar SHAKE generator is the fallback used when the 2-way
+ * NEON permute is unavailable: on non-NEON targets, and on AArch64 at run time
+ * when the CPU lacks Advanced SIMD. */
+#if !defined(FRODOKEM_HAVE_SHAKE_NEON) || defined(FRODOKEM_HAVE_NEON_RUNTIME)
+/* Generate a single row of matrix A using SHAKE128 (Section 6.7.2).
+ *
+ * The SHAKE output is squeezed into the row buffer itself and converted to
+ * coefficients in place (ascending index), avoiding a separate scratch buffer.
+ * The caller initializes shake as SHAKE-128 once before its row loop; each
+ * wc_Shake128_Final here resets the state ready for the next row.
+ *
+ * @param  [in]   shake Reusable SHAKE object (SHAKE-128, ready to absorb).
+ * @param  [out]  row   Output row of n coefficients (2 * n bytes).
+ * @param  [in]   seedA Seed for A (FRODOKEM_SEEDA_SZ bytes).
+ * @param  [in]   i     Row index.
+ * @param  [in]   p     FrodoKEM parameters.
+ * @return  0 on success.
+ * @return  Negative on error from the hash function.
+ */
+static int frodokem_gen_a_row_shake(wc_Shake* shake, word16* row,
+    const byte* seedA, int i, const FrodoKemParams* p)
+{
+    int ret;
+#ifdef WOLFSSL_X86_64_BUILD
+    byte* rowBytes = (byte*)row;
+    word64* state = shake->s;
+    word8 *state8 = (word8*)state;
+    word16 l;
+    static word16 inc = WC_SHA3_128_BLOCK_SIZE;
+
+    /* The fast path writes the padded SHAKE-128 block straight into the Keccak
+     * state and indexes it by lane, so the wc_Sha3 layout it relies on - a
+     * 200-byte (25-lane) state and a rate of WC_SHA3_128_COUNT lanes - must
+     * hold. Fail the build if wc_Sha3 ever changes rather than silently
+     * generating wrong matrix-A output. */
+    wc_static_assert(sizeof(shake->s) == 200);
+    wc_static_assert(WC_SHA3_128_COUNT * 8 == WC_SHA3_128_BLOCK_SIZE);
+
+    state8[0] = (byte)(i & 0xff);
+    state8[1] = (byte)((i >> 8) & 0xff);
+    XMEMCPY(state8 + 2, seedA, FRODOKEM_SEEDA_SZ);
+    state8[2 + FRODOKEM_SEEDA_SZ] = 0x1f;
+    XMEMSET(state8 + 2 + FRODOKEM_SEEDA_SZ + 1, 0,
+        sizeof(shake->s) - (2 + FRODOKEM_SEEDA_SZ + 1));
+    state8[WC_SHA3_128_COUNT * 8 - 1] = 0x80;
+
+    for (l = 0; l + inc < 2 * p->n; l += inc) {
+        BlockSha3(state);
+        XMEMCPY(rowBytes + l, state8, WC_SHA3_128_BLOCK_SIZE);
+    }
+    BlockSha3(state);
+    XMEMCPY(rowBytes + l, state8, (word32)(2 * p->n - l));
+
+    ret = 0;
+#else
+    byte in[2 + FRODOKEM_SEEDA_SZ];
+    byte* rowBytes = (byte*)row;
+
+    /* Row index as 16-bit little-endian, followed by seedA. */
+    in[0] = (byte)(i & 0xff);
+    in[1] = (byte)((i >> 8) & 0xff);
+    XMEMCPY(in + 2, seedA, FRODOKEM_SEEDA_SZ);
+
+    ret = wc_Shake128_Update(shake, in, (word32)sizeof(in));
+    if (ret == 0) {
+        ret = wc_Shake128_Final(shake, rowBytes, (word32)(2 * p->n));
+    }
+#endif
+
+    if (ret == 0) {
+        /* Endian fix-up and mod-q reduction, done once over the whole row. */
+        frodokem_a_row_reduce(row, p->n, (int)p->qMask);
+    }
+
+    return ret;
+}
+#endif /* !FRODOKEM_HAVE_SHAKE_NEON || FRODOKEM_HAVE_NEON_RUNTIME */
+
+#ifdef FRODOKEM_HAVE_SHAKE_X4
+/* Generate four rows of matrix A at once (indices i, i+1, i+2, i+3) with the
+ * 4-way AVX2 SHAKE-128 permutation (Section 6.7.2). Byte-identical to four
+ * frodokem_gen_a_row_shake calls, just computed in parallel lanes. Only built
+ * on little-endian x86 with AVX2 (the layout below assumes little-endian).
+ *
+ * @param  [out]  rows   Four contiguous output rows (4 * n coefficients).
+ * @param  [in]   seedA  Seed for A (FRODOKEM_SEEDA_SZ bytes).
+ * @param  [in]   i      Index of the first of the four rows (i % 4 == 0).
+ * @param  [in]   p      FrodoKEM parameters.
+ * @return  0 on success.
+ */
+static int frodokem_gen_a_row_shake_x4(word16* rows, const byte* seedA,
+    int i, const FrodoKemParams* p)
+{
+    /* Four interleaved SHAKE-128 states (Keccak-1600 is 25 word64 each): state
+     * word m of lane k is at state[m * 4 + k]. */
+    word64 state[25 * 4];
+    int n = p->n;
+    int lane;
+    /* seedA-derived state words - the same in all four lanes. The bytes each
+     * lane absorbs are: i (16-bit LE) || seedA (16) || 0x1f domain byte. */
+    word64 w0 = ((word64)seedA[0] << 16) | ((word64)seedA[1] << 24) |
+                ((word64)seedA[2] << 32) | ((word64)seedA[3] << 40) |
+                ((word64)seedA[4] << 48) | ((word64)seedA[5] << 56);
+    word64 w1 = (word64)seedA[6] | ((word64)seedA[7] << 8) |
+                ((word64)seedA[8] << 16) | ((word64)seedA[9] << 24) |
+                ((word64)seedA[10] << 32) | ((word64)seedA[11] << 40) |
+                ((word64)seedA[12] << 48) | ((word64)seedA[13] << 56);
+    word64 w2 = (word64)seedA[14] | ((word64)seedA[15] << 8) |
+                ((word64)0x1f << 16);
+
+    XMEMSET(state, 0, sizeof(state));
+    for (lane = 0; lane < 4; lane++) {
+        state[0 * 4 + lane] = w0 | (word64)((word32)(i + lane) & 0xffffU);
+        state[1 * 4 + lane] = w1;
+        state[2 * 4 + lane] = w2;
+        /* pad10*1: top bit of last rate byte (byte 167 = word 20, byte 7). */
+        state[(WC_SHA3_128_COUNT - 1) * 4 + lane] = (word64)0x80 << 56;
+    }
+
+    /* Squeeze 2*n bytes per lane, de-interleaved into the four rows. The rows
+     * are contiguous, so lane k's output lands at (byte*)rows + k * (2 * n) =
+     * rows + k * n, matching the row layout. 2*n is a multiple of 8. */
+    sha3_blocksx4_out_avx2(state, (byte*)rows, (word32)(2 * n));
+
+    /* 640 (q == 2^15) needs the mod-q mask; 976/1344 (q == 2^16) are already
+     * valid coefficients. The four rows are contiguous, so mask all 4*n at
+     * once with a single AVX2 pass (faster than four scalar per-lane passes;
+     * we are already inside the AVX2 vector-register region). */
+    if (p->qMask != 0xffff) {
+        frodokem_a_rows_reduce_avx2(rows, (word32)(4 * n), (int)p->qMask);
+    }
+
+    return 0;
+}
+#endif /* FRODOKEM_HAVE_SHAKE_X4 */
+
+#ifdef FRODOKEM_HAVE_SHAKE_X8
+/* Generate eight rows of matrix A at once (indices i .. i+7) with the 8-way
+ * AVX512 SHAKE-128 permutation (Section 6.7.2). Byte-identical to eight
+ * frodokem_gen_a_row_shake calls, just computed in parallel lanes. Only built
+ * on little-endian x86 with AVX512 (the layout below assumes little-endian).
+ *
+ * @param  [out]  rows   Eight contiguous output rows (8 * n coefficients).
+ * @param  [in]   seedA  Seed for A (FRODOKEM_SEEDA_SZ bytes).
+ * @param  [in]   i      Index of the first of the eight rows (i % 8 == 0).
+ * @param  [in]   p      FrodoKEM parameters.
+ * @return  0 on success.
+ */
+static int frodokem_gen_a_row_shake_x8(word16* rows, const byte* seedA,
+    int i, const FrodoKemParams* p)
+{
+    /* Eight interleaved SHAKE-128 states (Keccak-1600 is 25 word64 each): state
+     * word m of lane k is at state[m * 8 + k]. */
+    word64 state[25 * 8];
+    int n = p->n;
+    int lane;
+    /* seedA-derived state words - the same in all eight lanes. The bytes each
+     * lane absorbs are: i (16-bit LE) || seedA (16) || 0x1f domain byte. */
+    word64 w0 = ((word64)seedA[0] << 16) | ((word64)seedA[1] << 24) |
+                ((word64)seedA[2] << 32) | ((word64)seedA[3] << 40) |
+                ((word64)seedA[4] << 48) | ((word64)seedA[5] << 56);
+    word64 w1 = (word64)seedA[6] | ((word64)seedA[7] << 8) |
+                ((word64)seedA[8] << 16) | ((word64)seedA[9] << 24) |
+                ((word64)seedA[10] << 32) | ((word64)seedA[11] << 40) |
+                ((word64)seedA[12] << 48) | ((word64)seedA[13] << 56);
+    word64 w2 = (word64)seedA[14] | ((word64)seedA[15] << 8) |
+                ((word64)0x1f << 16);
+
+    XMEMSET(state, 0, sizeof(state));
+    for (lane = 0; lane < 8; lane++) {
+        state[0 * 8 + lane] = w0 | (word64)((word32)(i + lane) & 0xffffU);
+        state[1 * 8 + lane] = w1;
+        state[2 * 8 + lane] = w2;
+        /* pad10*1: top bit of last rate byte (byte 167 = word 20, byte 7). */
+        state[(WC_SHA3_128_COUNT - 1) * 8 + lane] = (word64)0x80 << 56;
+    }
+
+    /* Squeeze 2*n bytes per lane, de-interleaved into the eight rows. Lane k's
+     * output lands at (byte*)rows + k * (2 * n) = rows + k * n. 2*n is a
+     * multiple of 8. */
+    sha3_blocksx8_out_avx512(state, (byte*)rows, (word32)(2 * n));
+
+    /* 640 (q == 2^15) needs the mod-q mask; 976/1344 (q == 2^16) are already
+     * valid coefficients. The eight rows are contiguous, so mask all 8*n at
+     * once (the AVX2 ymm pass runs fine inside this AVX512 region). */
+    if (p->qMask != 0xffff) {
+        frodokem_a_rows_reduce_avx2(rows, (word32)(8 * n), (int)p->qMask);
+    }
+
+    return 0;
+}
+#endif /* FRODOKEM_HAVE_SHAKE_X8 */
+
+#ifdef FRODOKEM_HAVE_SHAKE_NEON
+/* Generate two rows of matrix A at once (indices i, i+1) with the 2-way NEON
+ * SHAKE-128 permutation (Section 6.7.2). Byte-identical to two
+ * frodokem_gen_a_row_shake calls. The two Keccak states are laid out
+ * contiguously - state[0..24] for row i, state[25..49] for row i+1 - so each
+ * squeezed rate block copies straight to its row (no lane de-interleave).
+ *
+ * @param  [out]  rows   Two contiguous output rows (2 * n coefficients).
+ * @param  [in]   seedA  Seed for A (FRODOKEM_SEEDA_SZ bytes).
+ * @param  [in]   i      Index of the first of the two rows (i % 2 == 0).
+ * @param  [in]   p      FrodoKEM parameters.
+ * @return  0 on success.
+ */
+static int frodokem_gen_a_row_shake_x2(word16* rows, const byte* seedA,
+    int i, const FrodoKemParams* p)
+{
+    /* Two 25-word Keccak states, contiguous: A then B. */
+    word64 state[50];
+    int n = p->n;
+    int total = 2 * n;              /* output bytes per row */
+    int off;
+    byte* sA = (byte*)(state + 0);
+    byte* sB = (byte*)(state + 25);
+    byte* rowA = (byte*)(rows + 0);
+    byte* rowB = (byte*)(rows + n);
+
+    XMEMSET(state, 0, sizeof(state));
+    /* Absorb i || seedA || 0x1f pad, with pad10*1 top bit at the last rate
+     * byte (167). State A is index i, state B is index i+1. */
+    sA[0] = (byte)(i & 0xff);
+    sA[1] = (byte)((i >> 8) & 0xff);
+    XMEMCPY(sA + 2, seedA, FRODOKEM_SEEDA_SZ);
+    sA[2 + FRODOKEM_SEEDA_SZ] = 0x1f;
+    sA[WC_SHA3_128_COUNT * 8 - 1] = 0x80;
+    sB[0] = (byte)((i + 1) & 0xff);
+    sB[1] = (byte)(((i + 1) >> 8) & 0xff);
+    XMEMCPY(sB + 2, seedA, FRODOKEM_SEEDA_SZ);
+    sB[2 + FRODOKEM_SEEDA_SZ] = 0x1f;
+    sB[WC_SHA3_128_COUNT * 8 - 1] = 0x80;
+
+    /* Squeeze 2*n bytes per row, a rate block per permutation. */
+    for (off = 0; off < total; off += WC_SHA3_128_BLOCK_SIZE) {
+        int blk = total - off;
+
+        if (blk > WC_SHA3_128_BLOCK_SIZE) {
+            blk = WC_SHA3_128_BLOCK_SIZE;
+        }
+#ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
+        /* Use the SHA3 crypto extension (EOR3/RAX1/XAR/BCAX) when present. */
+        if (IS_AARCH64_SHA3(cpuid_flags)) {
+            frodokem_sha3_x2_crypto(state);
+        }
+        else
+#endif
+        {
+            frodokem_sha3_x2_neon(state);
+        }
+        XMEMCPY(rowA + off, sA, (size_t)blk);
+        XMEMCPY(rowB + off, sB, (size_t)blk);
+    }
+
+    frodokem_a_row_reduce(rows + 0, n, (int)p->qMask);
+    frodokem_a_row_reduce(rows + n, n, (int)p->qMask);
+
+    return 0;
+}
+#endif /* FRODOKEM_HAVE_SHAKE_NEON */
+#endif /* WOLFSSL_FRODOKEM_SHAKE */
+
+/* The A-generating multiplies below have separate implementations per matrix-A
+ * method (AES-128 or SHAKE128) so the method is chosen once, not per row. */
+
+/* The scalar-C accumulates are the fallback for CPUs without the wide SIMD or
+ * packed accumulate. AArch32 NEON and Thumb2 always use their asm, so these are
+ * not compiled there; on AArch64 they are compiled as the run-time fallback for
+ * CPUs without Advanced SIMD (NEON). */
+#if !defined(FRODOKEM_HAVE_ARM_ASM) || defined(FRODOKEM_HAVE_NEON_RUNTIME)
+/* Accumulate the contribution of one generated A row (index j) into S * A:
+ * out[i*n + k] += s[i*n + j] * row[k] for i in [0, nbar), k in [0, n).
+ *
+ * Each output row is a separate contiguous accumulation stream. Flagging row
+ * and the output slice as non-aliasing (they never overlap) lets the compiler
+ * vectorize each stream; a form that updates all nbar rows in one fused loop
+ * has too many possibly-aliasing pointers and stays scalar. Shared by the AES
+ * and SHAKE paths (the arithmetic is identical; only A generation differs).
+ *
+ * @param  [in, out]  out  S * A accumulator (nbar * n, row-major).
+ * @param  [in]       s    Matrix S (nbar * n, row-major).
+ * @param  [in]       row  Generated A row j (n coefficients).
+ * @param  [in]       j    Index of the generated A row.
+ * @param  [in]       n    Matrix dimension n.
+ */
+static void frodokem_sa_accum(word16* out, const word16* s,
+    const word16* FRODOKEM_RESTRICT row, int j, int n)
+{
+    int k;
+#ifdef WOLFSSL_FRODOKEM_SMALL
+    int i;
+
+    for (i = 0; i < FRODOKEM_NBAR; i++) {
+        word16 sij = s[i * n + j];
+        word16* FRODOKEM_RESTRICT o = out + i * n;
+
+        for (k = 0; k < n; k++) {
+            o[k] = (word16)(o[k] + sij * row[k]);
+        }
+    }
+#else
+#if FRODOKEM_NBAR != 8
+    #error "Unrolled frodokem_sa_accum assumes FRODOKEM_NBAR == 8."
+#endif
+    /* Unroll the nbar (== 8) output rows into 8 independent contiguous streams.
+     * Each stays a single-stream accumulation the compiler vectorizes; the
+     * unroll drops the outer-loop overhead. A single advancing output pointer,
+     * with each S coefficient read just before its loop, keeps only one stream
+     * live at a time (low register pressure). The output slice, wherever o
+     * points, never overlaps row. */
+    word16* FRODOKEM_RESTRICT o = out;
+    word16 sij;
+
+    sij = s[0 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+    o += n;
+    sij = s[1 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+    o += n;
+    sij = s[2 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+    o += n;
+    sij = s[3 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+    o += n;
+    sij = s[4 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+    o += n;
+    sij = s[5 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+    o += n;
+    sij = s[6 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+    o += n;
+    sij = s[7 * n + j];
+    for (k = 0; k < n; k++) {
+        o[k] = (word16)(o[k] + sij * row[k]);
+    }
+#endif
+}
+
+/* Accumulate the contribution of one generated A row (index i) into A * S:
+ * out[i*nbar + k] += sum_j row[j] * s[k*n + j] for k in [0, nbar). row is the
+ * generated A row i; column k of S is row k of S^T. out holds E on entry, so
+ * the accumulation is in place. Shared by the AES and SHAKE paths (the
+ * arithmetic is identical; only A generation differs).
+ *
+ * @param  [in, out]  out  A * S accumulator (n * nbar, row-major).
+ * @param  [in]       s    Matrix S^T (nbar * n, row-major).
+ * @param  [in]       row  Generated A row i (n coefficients).
+ * @param  [in]       i    Index of the generated A row.
+ * @param  [in]       n    Matrix dimension n.
+ */
+static void frodokem_as_accum(word16* out, const word16* s,
+    const word16* row, int i, int n)
+{
+    int j;
+#ifdef WOLFSSL_FRODOKEM_SMALL
+    int k;
+
+    for (k = 0; k < FRODOKEM_NBAR; k++) {
+        /* column k of S == row k of S^T. out holds E on entry; word16 wraps
+         * mod 2^16, reduced to mod q by the final mask. */
+        const word16* sCol = s + k * n;
+        word16 acc = out[i * FRODOKEM_NBAR + k];
+
+        for (j = 0; j < n; j++) {
+            acc = (word16)(acc + row[j] * sCol[j]);
+        }
+        out[i * FRODOKEM_NBAR + k] = acc;
+    }
+#else
+#if FRODOKEM_NBAR != 8
+    #error "Unrolled frodokem_as_accum assumes FRODOKEM_NBAR == 8."
+#endif
+    /* Unroll the nbar (== 8) output columns: keep 8 accumulators so each A
+     * element row[j] is loaded once and reused across all 8 columns (8x less
+     * row traffic than a separate dot product per column). Column k of S is
+     * row k of S^T (s + k*n); out holds E on entry. */
+    const word16* s0 = s;
+    const word16* s1 = s + n;
+    const word16* s2 = s + 2 * n;
+    const word16* s3 = s + 3 * n;
+    const word16* s4 = s + 4 * n;
+    const word16* s5 = s + 5 * n;
+    const word16* s6 = s + 6 * n;
+    const word16* s7 = s + 7 * n;
+    word16* outRow = out + i * FRODOKEM_NBAR;
+    word16 a0 = outRow[0];
+    word16 a1 = outRow[1];
+    word16 a2 = outRow[2];
+    word16 a3 = outRow[3];
+    word16 a4 = outRow[4];
+    word16 a5 = outRow[5];
+    word16 a6 = outRow[6];
+    word16 a7 = outRow[7];
+
+    for (j = 0; j < n; j++) {
+        word16 rj = row[j];
+
+        a0 = (word16)(a0 + rj * s0[j]);
+        a1 = (word16)(a1 + rj * s1[j]);
+        a2 = (word16)(a2 + rj * s2[j]);
+        a3 = (word16)(a3 + rj * s3[j]);
+        a4 = (word16)(a4 + rj * s4[j]);
+        a5 = (word16)(a5 + rj * s5[j]);
+        a6 = (word16)(a6 + rj * s6[j]);
+        a7 = (word16)(a7 + rj * s7[j]);
+    }
+
+    outRow[0] = a0;
+    outRow[1] = a1;
+    outRow[2] = a2;
+    outRow[3] = a3;
+    outRow[4] = a4;
+    outRow[5] = a5;
+    outRow[6] = a6;
+    outRow[7] = a7;
+#endif
+}
+#endif /* !FRODOKEM_HAVE_ARM_ASM || FRODOKEM_HAVE_NEON_RUNTIME */
+
+#ifdef WOLFSSL_FRODOKEM_AES
+/* Compute out += A * S (out holds E on entry) with A generated by AES-128.
+ * See frodokem_mul_add_as_plus_e for the interface.
+ *
+ * @param  [in, out]  out    E on entry; out + A*S on exit (n * nbar).
+ * @param  [in]       s      Secret matrix S^T (nbar * n, row-major).
+ * @param  [in]       seedA  Seed for matrix-A generation (FRODOKEM_SEEDA_SZ).
+ * @param  [in]       p      FrodoKEM parameters.
+ * @param  [out]      row    Scratch for the generated A rows (ROW_MULT * n).
+ * @param  [in]       aes    AES object for matrix-A generation.
+ * @return  0 on success, negative on error.
+ */
+static int frodokem_mul_add_as_plus_e_aes(word16* out, const word16* s,
+    const byte* seedA, const FrodoKemParams* p, word16* row, Aes* aes)
+{
+    int ret;
+    int i;
+    int n = p->n;
+
+    /* Key the reusable AES object with seedA (the object is wc_AesInit'd once
+     * in wc_FrodoKemKey_Init, so no per-call init/free here). */
+    ret = wc_AesSetKeyDirect(aes, seedA, FRODOKEM_SEEDA_SZ, NULL,
+        AES_ENCRYPTION);
+
+    /* Generate the A rows in batches matching the fused asm accumulate (eight
+     * with AVX512, four with AVX2); n is a multiple of 8 for every set. */
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+    if ((ret == 0) && IS_INTEL_AVX512(cpuid_flags) &&
+            (SAVE_VECTOR_REGISTERS2() == 0)) {
+        for (i = 0; i < n; i += 8) {
+            /* Widest matrix-A generator available at run time (cf. aes.c):
+             * VAES (whole batch in one asm call), else the AES-NI register
+             * kernel, else the per-row C generator. */
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_VAES
+            if (IS_INTEL_VAES(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_avx512((byte*)row, row,
+                    (const byte*)aes->key, i, 8, n, (int)p->qMask);
+            }
+            else
+#endif
+            if (IS_INTEL_AESNI(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_aesni((byte*)row, row,
+                    (const byte*)aes->key, i, 8, n, (int)p->qMask);
+            }
+            else {
+                ret = frodokem_gen_a_rows_aes(row, aes, i, 8, p);
+                if (ret != 0) {
+                    break;
+                }
+            }
+            frodokem_as_accum_avx512(out, s, row, i, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+    if ((ret == 0) && IS_INTEL_AVX2(cpuid_flags) &&
+            (SAVE_VECTOR_REGISTERS2() == 0)) {
+        for (i = 0; i < n; i += 4) {
+            /* Widest matrix-A generator available at run time (cf. aes.c):
+             * VAES (whole batch in one asm call), else the AES-NI register
+             * kernel, else the per-row C generator. */
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_VAES
+            if (IS_INTEL_VAES(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_avx2((byte*)row, row,
+                    (const byte*)aes->key, i, 4, n, (int)p->qMask);
+            }
+            else
+#endif
+            if (IS_INTEL_AESNI(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_aesni((byte*)row, row,
+                    (const byte*)aes->key, i, 4, n, (int)p->qMask);
+            }
+            else {
+                ret = frodokem_gen_a_rows_aes(row, aes, i, 4, p);
+                if (ret != 0) {
+                    break;
+                }
+            }
+            frodokem_as_accum_avx2(out, s, row, i, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_ARM_ASM
+    if (ret == 0) {
+        for (i = 0; i < n; i += FRODOKEM_ROW_MULT) {
+        #ifdef FRODOKEM_HAVE_ARM_AES_ASM
+            /* The whole build + AES-ECB + reduce is one crypto-extension asm
+             * call (in place). */
+            frodokem_gen_a_rows_aes_arm((byte*)row, row,
+                (const byte*)aes->key, i, FRODOKEM_ROW_MULT, n, (int)p->qMask);
+        #else
+            ret = frodokem_gen_a_rows_aes(row, aes, i, FRODOKEM_ROW_MULT, p);
+            if (ret != 0) {
+                break;
+            }
+        #endif
+            /* Accumulate the whole FRODOKEM_ROW_MULT-row batch just generated. */
+            FRODOKEM_AS_ACCUM_BATCH(out, s, row, i, n);
+        }
+    }
+#else
+    {
+        for (i = 0; (ret == 0) && (i < n); i++) {
+            ret = frodokem_gen_a_rows_aes(row, aes, i, 1, p);
+            if (ret == 0) {
+                frodokem_as_accum(out, s, row, i, n);
+            }
+        }
+    }
+#endif /* FRODOKEM_HAVE_ARM_ASM */
+
+#ifdef FRODOKEM_D15_SHAKE128
+    /* q == 2^15 (640) needs a final reduction mod q; for q == 2^16 (976/1344)
+     * the word16 accumulation already reduced. */
+#ifdef FRODOKEM_D16_SHAKE256
+    if ((ret == 0) && (p->qMask != 0xffff))
+#else
+    if (ret == 0)
+#endif
+    {
+        for (i = 0; i < FRODOKEM_NBAR * n; i++) {
+            out[i] = (word16)(out[i] & p->qMask);
+        }
+    }
+#endif /* FRODOKEM_D15_SHAKE128 */
+
+    return ret;
+}
+#endif /* WOLFSSL_FRODOKEM_AES */
+
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+/* Compute out += A * S (out holds E on entry) with A generated by SHAKE128.
+ * See frodokem_mul_add_as_plus_e for the interface.
+ *
+ * @param  [in, out]  out    E on entry; out + A*S on exit (n * nbar).
+ * @param  [in]       s      Secret matrix S^T (nbar * n, row-major).
+ * @param  [in]       seedA  Seed for matrix-A generation (FRODOKEM_SEEDA_SZ).
+ * @param  [in]       p      FrodoKEM parameters.
+ * @param  [out]      row    Scratch for the generated A rows (ROW_MULT * n).
+ * @param  [in]       shake  SHAKE object for matrix-A generation.
+ * @return  0 on success, negative on error.
+ */
+static int frodokem_mul_add_as_plus_e_shake(word16* out, const word16* s,
+    const byte* seedA, const FrodoKemParams* p, word16* row, wc_Shake* shake)
+{
+    int ret;
+    int i;
+    int n = p->n;
+
+#ifdef FRODOKEM_HAVE_SHAKE_X8
+    /* When AVX512 is available, generate and consume eight A rows at a time
+     * with the 8-way SHAKE permutation. n is a multiple of 8 for every param
+     * set, so there is no remainder loop. */
+    if (IS_INTEL_AVX512(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        ret = 0;
+        for (i = 0; i < n; i += 8) {
+            ret = frodokem_gen_a_row_shake_x8(row, seedA, i, p);
+            if (ret != 0) {
+                break;
+            }
+            /* Fused 8-row A * S accumulate for all nbar output columns. */
+            frodokem_as_accum_avx512(out, s, row, i, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif /* FRODOKEM_HAVE_SHAKE_X8 */
+#ifdef FRODOKEM_HAVE_SHAKE_X4
+    /* When AVX2 is available, generate and consume four A rows at a time with
+     * the 4-way SHAKE permutation. n is a multiple of 4 for every parameter
+     * set, so there is no remainder loop. */
+    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        ret = 0;
+        for (i = 0; i < n; i += 4) {
+            ret = frodokem_gen_a_row_shake_x4(row, seedA, i, p);
+            if (ret != 0) {
+                break;
+            }
+            /* Fused 4-row A * S accumulate for all nbar output columns. */
+            frodokem_as_accum_avx2(out, s, row, i, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif /* FRODOKEM_HAVE_SHAKE_X4 */
+#ifdef FRODOKEM_HAVE_SHAKE_NEON
+    /* AArch64: with Advanced SIMD, generate and consume two A rows at a time
+     * with the 2-way NEON SHAKE; without it, fall back to the scalar SHAKE and
+     * portable-C accumulate (the 2-way permute is itself NEON). n is a multiple
+     * of 2 for every set. */
+    if (IS_AARCH64_ASIMD(cpuid_flags)) {
+        (void)shake;
+        ret = 0;
+        for (i = 0; i < n; i += 2) {
+            ret = frodokem_gen_a_row_shake_x2(row, seedA, i, p);
+            if (ret != 0) {
+                break;
+            }
+            FRODOKEM_AS_ACCUM(out, s, row, i, n);
+        }
+    }
+    else {
+        ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+        for (i = 0; (ret == 0) && (i < n); i++) {
+            ret = frodokem_gen_a_row_shake(shake, row, seedA, i, p);
+            if (ret == 0) {
+                frodokem_as_accum(out, s, row, i, n);
+            }
+        }
+    }
+#elif defined(FRODOKEM_HAVE_ARM_ASM)
+    /* AArch32 (NEON or Thumb2): no parallel Keccak, so generate one A row at a
+     * time with SHAKE-128 and consume it with the AArch32 A * S accumulate. */
+    {
+        ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+
+        for (i = 0; (ret == 0) && (i < n); i++) {
+            ret = frodokem_gen_a_row_shake(shake, row, seedA, i, p);
+            if (ret == 0) {
+                FRODOKEM_AS_ACCUM(out, s, row, i, n);
+            }
+        }
+    }
+#else
+    {
+        /* Matrix A is generated with SHAKE-128 for every parameter set.
+         * Initialize the shared object once here; each row's Final resets it
+         * for the next. */
+        ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+
+        for (i = 0; (ret == 0) && (i < n); i++) {
+            ret = frodokem_gen_a_row_shake(shake, row, seedA, i, p);
+            if (ret == 0) {
+                frodokem_as_accum(out, s, row, i, n);
+            }
+        }
+    }
+#endif /* FRODOKEM_HAVE_SHAKE_NEON */
+
+#ifdef FRODOKEM_D15_SHAKE128
+    /* q == 2^15 (640) needs a final reduction mod q; for q == 2^16 (976/1344)
+     * the word16 accumulation already reduced. */
+#ifdef FRODOKEM_D16_SHAKE256
+    if ((ret == 0) && (p->qMask != 0xffff))
+#else
+    if (ret == 0)
+#endif
+    {
+        for (i = 0; i < FRODOKEM_NBAR * n; i++) {
+            out[i] = (word16)(out[i] & p->qMask);
+        }
+    }
+#endif /* FRODOKEM_D15_SHAKE128 */
+
+    return ret;
+}
+#endif /* WOLFSSL_FRODOKEM_SHAKE */
+
+/* Compute out = out + A * S, accumulating A * S into out which holds the error
+ * matrix E on entry (all n x nbar); A is n x n and S is n x nbar. Taking E in
+ * place saves the caller a copy (it samples E straight into out).
+ *
+ * S is supplied transposed (S^T, nbar x n) so column k of S is row k of s.
+ * seedA, the parameters and the SHAKE / AES objects for matrix-A generation are
+ * taken from key; dispatch is by the key parameters' useAes.
+ *
+ * @param  [in]       key    FrodoKEM key (provides seedA, params, SHAKE / AES).
+ * @param  [in, out]  out    E on entry; out + A*S on exit (n * nbar).
+ * @param  [in]       s      Secret matrix S^T (nbar * n, row-major).
+ * @param  [out]      row    Scratch for the generated A rows (ROW_MULT * n).
+ * @return  0 on success, negative on error.
+ */
+int frodokem_mul_add_as_plus_e(FrodoKemKey* key, word16* out, const word16* s,
+    word16* row)
+{
+    const FrodoKemParams* p = key->params;
+    int ret;
+
+#ifdef WOLFSSL_FRODOKEM_AES
+    if (p->useAes) {
+        ret = frodokem_mul_add_as_plus_e_aes(out, s, key->seedA, p, row,
+            &key->aes);
+    }
+    else
+#endif
+    {
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+        ret = frodokem_mul_add_as_plus_e_shake(out, s, key->seedA, p, row,
+            &key->shake);
+#else
+        ret = NOT_COMPILED_IN;
+#endif
+    }
+
+    return ret;
+}
+
+#ifdef WOLFSSL_FRODOKEM_AES
+/* Compute out = S * A + E (out holds E on entry) with A generated by AES-128.
+ * See frodokem_mul_add_sa_plus_e for the interface.
+ *
+ * @param  [in, out]  out    E on entry; out + S*A on exit (nbar * n).
+ * @param  [in]       s      Matrix S (nbar * n, row-major).
+ * @param  [in]       seedA  Seed for matrix-A generation (FRODOKEM_SEEDA_SZ).
+ * @param  [in]       p      FrodoKEM parameters.
+ * @param  [out]      row    Scratch for the generated A rows (ROW_MULT * n).
+ * @param  [in]       aes    AES object for matrix-A generation.
+ * @return  0 on success, negative on error.
+ */
+static int frodokem_mul_add_sa_plus_e_aes(word16* out, const word16* s,
+    const byte* seedA, const FrodoKemParams* p, word16* row, Aes* aes)
+{
+    int ret;
+#ifdef FRODOKEM_D15_SHAKE128
+    int i;
+#endif
+    int j;
+    int n = p->n;
+
+    /* Key the reusable AES object with seedA (the object is wc_AesInit'd once
+     * in wc_FrodoKemKey_Init, so no per-call init/free here). */
+    ret = wc_AesSetKeyDirect(aes, seedA, FRODOKEM_SEEDA_SZ, NULL,
+        AES_ENCRYPTION);
+
+    /* Generate the A rows in batches matching the fused asm accumulate (eight
+     * with AVX512, four with AVX2); n is a multiple of 8 for every set. */
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+    if ((ret == 0) && IS_INTEL_AVX512(cpuid_flags) &&
+            (SAVE_VECTOR_REGISTERS2() == 0)) {
+        for (j = 0; j < n; j += 8) {
+            /* Widest matrix-A generator available at run time (cf. aes.c):
+             * VAES (whole batch in one asm call), else the AES-NI register
+             * kernel, else the per-row C generator. */
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_VAES
+            if (IS_INTEL_VAES(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_avx512((byte*)row, row,
+                    (const byte*)aes->key, j, 8, n, (int)p->qMask);
+            }
+            else
+#endif
+            if (IS_INTEL_AESNI(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_aesni((byte*)row, row,
+                    (const byte*)aes->key, j, 8, n, (int)p->qMask);
+            }
+            else {
+                ret = frodokem_gen_a_rows_aes(row, aes, j, 8, p);
+                if (ret != 0) {
+                    break;
+                }
+            }
+            frodokem_sa_accum_avx512(out, s, row, j, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+    if ((ret == 0) && IS_INTEL_AVX2(cpuid_flags) &&
+            (SAVE_VECTOR_REGISTERS2() == 0)) {
+        for (j = 0; j < n; j += 4) {
+            /* Widest matrix-A generator available at run time (cf. aes.c):
+             * VAES (whole batch in one asm call), else the AES-NI register
+             * kernel, else the per-row C generator. */
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_VAES
+            if (IS_INTEL_VAES(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_avx2((byte*)row, row,
+                    (const byte*)aes->key, j, 4, n, (int)p->qMask);
+            }
+            else
+#endif
+            if (IS_INTEL_AESNI(cpuid_flags)) {
+                frodokem_gen_a_rows_aes_aesni((byte*)row, row,
+                    (const byte*)aes->key, j, 4, n, (int)p->qMask);
+            }
+            else {
+                ret = frodokem_gen_a_rows_aes(row, aes, j, 4, p);
+                if (ret != 0) {
+                    break;
+                }
+            }
+            frodokem_sa_accum_avx2(out, s, row, j, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_ARM_ASM
+    if (ret == 0) {
+        for (j = 0; j < n; j += FRODOKEM_ROW_MULT) {
+        #ifdef FRODOKEM_HAVE_ARM_AES_ASM
+            /* The whole build + AES-ECB + reduce is one crypto-extension asm
+             * call (in place). */
+            frodokem_gen_a_rows_aes_arm((byte*)row, row,
+                (const byte*)aes->key, j, FRODOKEM_ROW_MULT, n, (int)p->qMask);
+        #else
+            ret = frodokem_gen_a_rows_aes(row, aes, j, FRODOKEM_ROW_MULT, p);
+            if (ret != 0) {
+                break;
+            }
+        #endif
+            /* Accumulate the whole FRODOKEM_ROW_MULT-row batch just generated. */
+            FRODOKEM_SA_ACCUM_BATCH(out, s, row, j, n);
+        }
+    }
+#else
+    {
+        /* Generate A a row at a time (index j) and accumulate its part. */
+        for (j = 0; (ret == 0) && (j < n); j++) {
+            ret = frodokem_gen_a_rows_aes(row, aes, j, 1, p);
+            if (ret == 0) {
+                frodokem_sa_accum(out, s, row, j, n);
+            }
+        }
+    }
+#endif /* FRODOKEM_HAVE_ARM_ASM */
+
+#ifdef FRODOKEM_D15_SHAKE128
+    /* q == 2^15 (640) needs a final reduction mod q; for q == 2^16 (976/1344)
+     * the word16 accumulation already reduced. */
+#ifdef FRODOKEM_D16_SHAKE256
+    if ((ret == 0) && (p->qMask != 0xffff))
+#else
+    if (ret == 0)
+#endif
+    {
+        for (i = 0; i < FRODOKEM_NBAR * n; i++) {
+            out[i] = (word16)(out[i] & p->qMask);
+        }
+    }
+#endif /* FRODOKEM_D15_SHAKE128 */
+
+    return ret;
+}
+#endif /* WOLFSSL_FRODOKEM_AES */
+
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+/* Compute out = S * A + E (out holds E on entry) with A generated by SHAKE128.
+ * See frodokem_mul_add_sa_plus_e for the interface.
+ *
+ * @param  [in, out]  out    E on entry; out + S*A on exit (nbar * n).
+ * @param  [in]       s      Matrix S (nbar * n, row-major).
+ * @param  [in]       seedA  Seed for matrix-A generation (FRODOKEM_SEEDA_SZ).
+ * @param  [in]       p      FrodoKEM parameters.
+ * @param  [out]      row    Scratch for the generated A rows (ROW_MULT * n).
+ * @param  [in]       shake  SHAKE object for matrix-A generation.
+ * @return  0 on success, negative on error.
+ */
+static int frodokem_mul_add_sa_plus_e_shake(word16* out, const word16* s,
+    const byte* seedA, const FrodoKemParams* p, word16* row, wc_Shake* shake)
+{
+    int ret;
+#ifdef FRODOKEM_D15_SHAKE128
+    int i;
+#endif
+    int j;
+    int n = p->n;
+
+#ifdef FRODOKEM_HAVE_SHAKE_X8
+    /* When AVX512 is available, generate and consume eight A rows at a time
+     * with the 8-way SHAKE permutation. n is a multiple of 8 for every param
+     * set, so there is no remainder loop. */
+    if (IS_INTEL_AVX512(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        ret = 0;
+        for (j = 0; j < n; j += 8) {
+            ret = frodokem_gen_a_row_shake_x8(row, seedA, j, p);
+            if (ret != 0) {
+                break;
+            }
+            /* Fused 8-row S * A accumulate for all nbar output rows. */
+            frodokem_sa_accum_avx512(out, s, row, j, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif /* FRODOKEM_HAVE_SHAKE_X8 */
+#ifdef FRODOKEM_HAVE_SHAKE_X4
+    /* When AVX2 is available, generate and consume four A rows at a time with
+     * the 4-way SHAKE permutation. n is a multiple of 4 for every parameter
+     * set, so there is no remainder loop. */
+    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        ret = 0;
+        for (j = 0; j < n; j += 4) {
+            ret = frodokem_gen_a_row_shake_x4(row, seedA, j, p);
+            if (ret != 0) {
+                break;
+            }
+            /* Fused 4-row S * A accumulate for all nbar output rows. */
+            frodokem_sa_accum_avx2(out, s, row, j, n);
+        }
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif /* FRODOKEM_HAVE_SHAKE_X4 */
+#ifdef FRODOKEM_HAVE_SHAKE_NEON
+    /* AArch64: with Advanced SIMD, generate and consume two A rows at a time
+     * with the 2-way NEON SHAKE (SVE or NEON accumulate); without it, fall back
+     * to the scalar SHAKE and portable-C accumulate (the 2-way permute is
+     * itself NEON). n is a multiple of 2 for every set. */
+    if (IS_AARCH64_ASIMD(cpuid_flags)) {
+        (void)shake;
+        ret = 0;
+        for (j = 0; j < n; j += 2) {
+            ret = frodokem_gen_a_row_shake_x2(row, seedA, j, p);
+            if (ret != 0) {
+                break;
+            }
+            FRODOKEM_SA_ACCUM(out, s, row, j, n);
+        }
+    }
+    else {
+        ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+        for (j = 0; (ret == 0) && (j < n); j++) {
+            ret = frodokem_gen_a_row_shake(shake, row, seedA, j, p);
+            if (ret == 0) {
+                frodokem_sa_accum(out, s, row, j, n);
+            }
+        }
+    }
+#elif defined(FRODOKEM_HAVE_ARM_ASM)
+    /* AArch32 (NEON or Thumb2): no parallel Keccak, so generate one A row at a
+     * time with SHAKE-128 and consume it with the AArch32 S * A accumulate. */
+    {
+        ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+
+        for (j = 0; (ret == 0) && (j < n); j++) {
+            ret = frodokem_gen_a_row_shake(shake, row, seedA, j, p);
+            if (ret == 0) {
+                FRODOKEM_SA_ACCUM(out, s, row, j, n);
+            }
+        }
+    }
+#else
+    {
+        /* Matrix A is generated with SHAKE-128 for every parameter set.
+         * Initialize the shared object once here; each row's Final resets it
+         * for the next. */
+        ret = wc_InitShake128(shake, NULL, INVALID_DEVID);
+
+        /* Generate A a row at a time (index j) and accumulate it. */
+        for (j = 0; (ret == 0) && (j < n); j++) {
+            ret = frodokem_gen_a_row_shake(shake, row, seedA, j, p);
+            if (ret == 0) {
+                frodokem_sa_accum(out, s, row, j, n);
+            }
+        }
+    }
+#endif /* FRODOKEM_HAVE_SHAKE_NEON */
+
+#ifdef FRODOKEM_D15_SHAKE128
+    /* q == 2^15 (640) needs a final reduction mod q; for q == 2^16 (976/1344)
+     * the word16 accumulation already reduced. */
+#ifdef FRODOKEM_D16_SHAKE256
+    if ((ret == 0) && (p->qMask != 0xffff))
+#else
+    if (ret == 0)
+#endif
+    {
+        for (i = 0; i < FRODOKEM_NBAR * n; i++) {
+            out[i] = (word16)(out[i] & p->qMask);
+        }
+    }
+#endif /* FRODOKEM_D15_SHAKE128 */
+
+    return ret;
+}
+#endif /* WOLFSSL_FRODOKEM_SHAKE */
+
+/* Compute out = out + S * A, accumulating S * A into out which holds the error
+ * matrix E on entry (all nbar x n); S is nbar x n and A is n x n. Taking E in
+ * place saves the caller a copy (it samples E' straight into out). seedA, the
+ * parameters and the SHAKE / AES objects for matrix-A generation are taken from
+ * key; dispatch is by the key parameters' useAes.
+ *
+ * @param  [in]       key    FrodoKEM key (provides seedA, params, SHAKE / AES).
+ * @param  [in, out]  out    E on entry; out + S*A on exit (nbar * n).
+ * @param  [in]       s      Matrix S (nbar * n, row-major).
+ * @param  [out]      row    Scratch for the generated A rows (ROW_MULT * n).
+ * @return  0 on success, negative on error.
+ */
+int frodokem_mul_add_sa_plus_e(FrodoKemKey* key, word16* out, const word16* s,
+    word16* row)
+{
+    const FrodoKemParams* p = key->params;
+    int ret;
+
+#ifdef WOLFSSL_FRODOKEM_AES
+    if (p->useAes) {
+        ret = frodokem_mul_add_sa_plus_e_aes(out, s, key->seedA, p, row,
+            &key->aes);
+    }
+    else
+#endif
+    {
+#ifdef WOLFSSL_FRODOKEM_SHAKE
+        ret = frodokem_mul_add_sa_plus_e_shake(out, s, key->seedA, p, row,
+            &key->shake);
+#else
+        ret = NOT_COMPILED_IN;
+#endif
+    }
+
+    return ret;
+}
+
+/* Compute out = out + S * B, accumulating S * B into out which holds the error
+ * matrix E on entry (all nbar x nbar). S is nbar x n and B is n x nbar. Taking
+ * E in place saves the caller a copy (it samples E'' straight into out).
+ *
+ * @param  [in, out]  out  E on entry; out + S*B on exit (nbar * nbar).
+ * @param  [in]       b    Matrix B (n * nbar, row-major).
+ * @param  [in]       s    Matrix S (nbar * n, row-major).
+ * @param  [in]       n      Matrix dimension n.
+ * @param  [in]       qmask  Reduction mask (q - 1).
+ */
+void frodokem_mul_add_sb_plus_e(word16* out, const word16* b, const word16* s,
+    int n, int qmask)
+{
+#if defined(FRODOKEM_HAVE_ARM_ASM) && !defined(FRODOKEM_HAVE_NEON_RUNTIME)
+    frodokem_mul_add_sb_plus_e_arm(out, b, s, n, qmask);
+#else
+#ifdef FRODOKEM_HAVE_NEON_RUNTIME
+    if (IS_AARCH64_ASIMD(cpuid_flags)) {
+        frodokem_mul_add_sb_plus_e_arm(out, b, s, n, qmask);
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+    if (IS_INTEL_AVX512(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_mul_add_sb_plus_e_avx512(out, b, s, n, qmask);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_mul_add_sb_plus_e_avx2(out, b, s, n, qmask);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+    {
+#ifdef WOLFSSL_FRODOKEM_SMALL
+    int i;
+    int j;
+    int k;
+
+    /* Keep FRODOKEM_NBAR accumulators per row of S (one per output column), as
+     * in the FrodoKEM reference: the inner loop then reads a contiguous row of
+     * B (b[j*nbar + 0..nbar)) and reuses the single S coefficient, which is
+     * cache-friendly and lets the compiler vectorize the nbar-wide update.
+     * Accumulation order per output element is unchanged, so results match. */
+    for (i = 0; i < FRODOKEM_NBAR; i++) {
+        word16 acc[FRODOKEM_NBAR];
+        const word16* sRow = s + i * n;
+
+        for (k = 0; k < FRODOKEM_NBAR; k++) {
+            acc[k] = out[i * FRODOKEM_NBAR + k];
+        }
+        for (j = 0; j < n; j++) {
+            word16 sij = sRow[j];
+            const word16* bRow = b + j * FRODOKEM_NBAR;
+
+            for (k = 0; k < FRODOKEM_NBAR; k++) {
+                acc[k] = (word16)(acc[k] + sij * bRow[k]);
+            }
+        }
+        for (k = 0; k < FRODOKEM_NBAR; k++) {
+            out[i * FRODOKEM_NBAR + k] = (word16)(acc[k] & qmask);
+        }
+    }
+#else
+#if FRODOKEM_NBAR != 8
+    #error "Unrolled frodokem_mul_add_sb_plus_e assumes FRODOKEM_NBAR == 8."
+#endif
+    int j;
+    const word16* s0 = s;
+    const word16* s1 = s + n;
+    const word16* s2 = s + 2 * n;
+    const word16* s3 = s + 3 * n;
+    const word16* s4 = s + 4 * n;
+    const word16* s5 = s + 5 * n;
+    const word16* s6 = s + 6 * n;
+    const word16* s7 = s + 7 * n;
+
+    /* out holds E on entry. Both nbar dimensions are fully unrolled, leaving
+     * only the loop over n; each B row is loaded once and reused across all 8
+     * output rows. Accumulate directly into out - the word16 stores wrap mod
+     * 2^16, the final reduction for q == 2^16 (976/1344). For q == 2^15 (640)
+     * one &qMask pass at the very end reduces mod q (q divides 2^16). */
+    for (j = 0; j < n; j++) {
+        const word16* bRow = b + j * FRODOKEM_NBAR;
+        word16 b0 = bRow[0];
+        word16 b1 = bRow[1];
+        word16 b2 = bRow[2];
+        word16 b3 = bRow[3];
+        word16 b4 = bRow[4];
+        word16 b5 = bRow[5];
+        word16 b6 = bRow[6];
+        word16 b7 = bRow[7];
+        word16 sij;
+
+        sij = s0[j];
+        out[0]  = (word16)(out[0]  + sij * b0);
+        out[1]  = (word16)(out[1]  + sij * b1);
+        out[2]  = (word16)(out[2]  + sij * b2);
+        out[3]  = (word16)(out[3]  + sij * b3);
+        out[4]  = (word16)(out[4]  + sij * b4);
+        out[5]  = (word16)(out[5]  + sij * b5);
+        out[6]  = (word16)(out[6]  + sij * b6);
+        out[7]  = (word16)(out[7]  + sij * b7);
+        sij = s1[j];
+        out[8]  = (word16)(out[8]  + sij * b0);
+        out[9]  = (word16)(out[9]  + sij * b1);
+        out[10] = (word16)(out[10] + sij * b2);
+        out[11] = (word16)(out[11] + sij * b3);
+        out[12] = (word16)(out[12] + sij * b4);
+        out[13] = (word16)(out[13] + sij * b5);
+        out[14] = (word16)(out[14] + sij * b6);
+        out[15] = (word16)(out[15] + sij * b7);
+        sij = s2[j];
+        out[16] = (word16)(out[16] + sij * b0);
+        out[17] = (word16)(out[17] + sij * b1);
+        out[18] = (word16)(out[18] + sij * b2);
+        out[19] = (word16)(out[19] + sij * b3);
+        out[20] = (word16)(out[20] + sij * b4);
+        out[21] = (word16)(out[21] + sij * b5);
+        out[22] = (word16)(out[22] + sij * b6);
+        out[23] = (word16)(out[23] + sij * b7);
+        sij = s3[j];
+        out[24] = (word16)(out[24] + sij * b0);
+        out[25] = (word16)(out[25] + sij * b1);
+        out[26] = (word16)(out[26] + sij * b2);
+        out[27] = (word16)(out[27] + sij * b3);
+        out[28] = (word16)(out[28] + sij * b4);
+        out[29] = (word16)(out[29] + sij * b5);
+        out[30] = (word16)(out[30] + sij * b6);
+        out[31] = (word16)(out[31] + sij * b7);
+        sij = s4[j];
+        out[32] = (word16)(out[32] + sij * b0);
+        out[33] = (word16)(out[33] + sij * b1);
+        out[34] = (word16)(out[34] + sij * b2);
+        out[35] = (word16)(out[35] + sij * b3);
+        out[36] = (word16)(out[36] + sij * b4);
+        out[37] = (word16)(out[37] + sij * b5);
+        out[38] = (word16)(out[38] + sij * b6);
+        out[39] = (word16)(out[39] + sij * b7);
+        sij = s5[j];
+        out[40] = (word16)(out[40] + sij * b0);
+        out[41] = (word16)(out[41] + sij * b1);
+        out[42] = (word16)(out[42] + sij * b2);
+        out[43] = (word16)(out[43] + sij * b3);
+        out[44] = (word16)(out[44] + sij * b4);
+        out[45] = (word16)(out[45] + sij * b5);
+        out[46] = (word16)(out[46] + sij * b6);
+        out[47] = (word16)(out[47] + sij * b7);
+        sij = s6[j];
+        out[48] = (word16)(out[48] + sij * b0);
+        out[49] = (word16)(out[49] + sij * b1);
+        out[50] = (word16)(out[50] + sij * b2);
+        out[51] = (word16)(out[51] + sij * b3);
+        out[52] = (word16)(out[52] + sij * b4);
+        out[53] = (word16)(out[53] + sij * b5);
+        out[54] = (word16)(out[54] + sij * b6);
+        out[55] = (word16)(out[55] + sij * b7);
+        sij = s7[j];
+        out[56] = (word16)(out[56] + sij * b0);
+        out[57] = (word16)(out[57] + sij * b1);
+        out[58] = (word16)(out[58] + sij * b2);
+        out[59] = (word16)(out[59] + sij * b3);
+        out[60] = (word16)(out[60] + sij * b4);
+        out[61] = (word16)(out[61] + sij * b5);
+        out[62] = (word16)(out[62] + sij * b6);
+        out[63] = (word16)(out[63] + sij * b7);
+    }
+
+#ifdef FRODOKEM_D15_SHAKE128
+    /* q == 2^15 (640) needs a final reduction mod q; for q == 2^16 (976/1344)
+     * the word16 stores already reduced, so no mask. */
+#ifdef FRODOKEM_D16_SHAKE256
+    if (qmask != 0xffff)
+#endif
+    {
+        out[0] = (word16)(out[0] & qmask);
+        out[1] = (word16)(out[1] & qmask);
+        out[2] = (word16)(out[2] & qmask);
+        out[3] = (word16)(out[3] & qmask);
+        out[4] = (word16)(out[4] & qmask);
+        out[5] = (word16)(out[5] & qmask);
+        out[6] = (word16)(out[6] & qmask);
+        out[7] = (word16)(out[7] & qmask);
+        out[8] = (word16)(out[8] & qmask);
+        out[9] = (word16)(out[9] & qmask);
+        out[10] = (word16)(out[10] & qmask);
+        out[11] = (word16)(out[11] & qmask);
+        out[12] = (word16)(out[12] & qmask);
+        out[13] = (word16)(out[13] & qmask);
+        out[14] = (word16)(out[14] & qmask);
+        out[15] = (word16)(out[15] & qmask);
+        out[16] = (word16)(out[16] & qmask);
+        out[17] = (word16)(out[17] & qmask);
+        out[18] = (word16)(out[18] & qmask);
+        out[19] = (word16)(out[19] & qmask);
+        out[20] = (word16)(out[20] & qmask);
+        out[21] = (word16)(out[21] & qmask);
+        out[22] = (word16)(out[22] & qmask);
+        out[23] = (word16)(out[23] & qmask);
+        out[24] = (word16)(out[24] & qmask);
+        out[25] = (word16)(out[25] & qmask);
+        out[26] = (word16)(out[26] & qmask);
+        out[27] = (word16)(out[27] & qmask);
+        out[28] = (word16)(out[28] & qmask);
+        out[29] = (word16)(out[29] & qmask);
+        out[30] = (word16)(out[30] & qmask);
+        out[31] = (word16)(out[31] & qmask);
+        out[32] = (word16)(out[32] & qmask);
+        out[33] = (word16)(out[33] & qmask);
+        out[34] = (word16)(out[34] & qmask);
+        out[35] = (word16)(out[35] & qmask);
+        out[36] = (word16)(out[36] & qmask);
+        out[37] = (word16)(out[37] & qmask);
+        out[38] = (word16)(out[38] & qmask);
+        out[39] = (word16)(out[39] & qmask);
+        out[40] = (word16)(out[40] & qmask);
+        out[41] = (word16)(out[41] & qmask);
+        out[42] = (word16)(out[42] & qmask);
+        out[43] = (word16)(out[43] & qmask);
+        out[44] = (word16)(out[44] & qmask);
+        out[45] = (word16)(out[45] & qmask);
+        out[46] = (word16)(out[46] & qmask);
+        out[47] = (word16)(out[47] & qmask);
+        out[48] = (word16)(out[48] & qmask);
+        out[49] = (word16)(out[49] & qmask);
+        out[50] = (word16)(out[50] & qmask);
+        out[51] = (word16)(out[51] & qmask);
+        out[52] = (word16)(out[52] & qmask);
+        out[53] = (word16)(out[53] & qmask);
+        out[54] = (word16)(out[54] & qmask);
+        out[55] = (word16)(out[55] & qmask);
+        out[56] = (word16)(out[56] & qmask);
+        out[57] = (word16)(out[57] & qmask);
+        out[58] = (word16)(out[58] & qmask);
+        out[59] = (word16)(out[59] & qmask);
+        out[60] = (word16)(out[60] & qmask);
+        out[61] = (word16)(out[61] & qmask);
+        out[62] = (word16)(out[62] & qmask);
+        out[63] = (word16)(out[63] & qmask);
+    }
+#else
+    (void)qmask;
+#endif /* FRODOKEM_D15_SHAKE128 */
+#endif /* WOLFSSL_FRODOKEM_SMALL */
+    }
+#endif /* FRODOKEM_HAVE_ARM_ASM */
+}
+
+/* Compute out = B * S where B is nbar x n and S (supplied as S^T, nbar x n)
+ * is n x nbar.
+ *
+ * @param  [out]  out  Output matrix (nbar * nbar, row-major).
+ * @param  [in]   b      Matrix B (nbar * n, row-major).
+ * @param  [in]   s      Secret matrix S^T (nbar * n, row-major).
+ * @param  [in]   n      Matrix dimension n.
+ * @param  [in]   qmask  Reduction mask (q - 1).
+ */
+void frodokem_mul_bs(word16* out, const word16* b, const word16* s,
+    int n, int qmask)
+{
+#ifdef FRODOKEM_HAVE_SME
+    /* SME computes the whole nbar x nbar tile with the ZA UMOPA, but needs B
+     * and S in the interleaved MOPA layout, so transpose into scratch first.
+     * Falls through to SVE/NEON/C if SME is absent or scratch cannot be had. */
+    word16* bt = NULL;
+    word16* st = NULL;
+    int sme = 0;
+
+    if (frodokem_sme_svl_ok) {
+        size_t sz = (size_t)FRODOKEM_NBAR * (size_t)n * sizeof(word16);
+        bt = (word16*)XMALLOC(sz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        st = (word16*)XMALLOC(sz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        if ((bt != NULL) && (st != NULL)) {
+            frodokem_sme_interleave(bt, b, FRODOKEM_NBAR, n);
+            frodokem_sme_interleave(st, s, FRODOKEM_NBAR, n);
+            frodokem_mul_bs_sme(out, bt, st, n, qmask);
+            sme = 1;
+        }
+    }
+    if (!sme)
+#endif /* FRODOKEM_HAVE_SME */
+    {
+#if defined(FRODOKEM_HAVE_ARM_ASM) && !defined(FRODOKEM_HAVE_NEON_RUNTIME)
+    frodokem_mul_bs_arm(out, b, s, n, qmask);
+#else
+#ifdef FRODOKEM_HAVE_SVE
+    if (IS_AARCH64_SVE(cpuid_flags)) {
+        frodokem_mul_bs_sve(out, b, s, n, qmask);
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_NEON_RUNTIME
+    if (IS_AARCH64_ASIMD(cpuid_flags)) {
+        frodokem_mul_bs_arm(out, b, s, n, qmask);
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+    if (IS_INTEL_AVX512(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_mul_bs_avx512(out, b, s, n, qmask);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_mul_bs_avx2(out, b, s, n, qmask);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+    {
+#ifdef WOLFSSL_FRODOKEM_SMALL
+    int i;
+    int j;
+    int k;
+
+    for (i = 0; i < FRODOKEM_NBAR; i++) {
+        for (k = 0; k < FRODOKEM_NBAR; k++) {
+            word16 acc = 0;
+            /* column k of S == row k of S^T. */
+            const word16* sCol = s + k * n;
+
+            for (j = 0; j < n; j++) {
+                acc = (word16)(acc + b[i * n + j] * sCol[j]);
+            }
+            out[i * FRODOKEM_NBAR + k] = (word16)(acc & qmask);
+        }
+    }
+#else
+#if FRODOKEM_NBAR != 8
+    #error "Unrolled frodokem_mul_bs assumes FRODOKEM_NBAR == 8."
+#endif
+    int j;
+    const word16* b0 = b;
+    const word16* b1 = b + n;
+    const word16* b2 = b + 2 * n;
+    const word16* b3 = b + 3 * n;
+    const word16* b4 = b + 4 * n;
+    const word16* b5 = b + 5 * n;
+    const word16* b6 = b + 6 * n;
+    const word16* b7 = b + 7 * n;
+    const word16* s0 = s;
+    const word16* s1 = s + n;
+    const word16* s2 = s + 2 * n;
+    const word16* s3 = s + 3 * n;
+    const word16* s4 = s + 4 * n;
+    const word16* s5 = s + 5 * n;
+    const word16* s6 = s + 6 * n;
+    const word16* s7 = s + 7 * n;
+
+    XMEMSET(out, 0, sizeof(word16) * FRODOKEM_NBAR_SQ);
+
+    /* Both nbar dimensions are fully unrolled, leaving only the loop over n.
+     * Each row of B and column of S (row of S^T) is loaded once per j and
+     * combined as an outer product accumulated into out. The word16 stores
+     * wrap mod 2^16, the final reduction for q == 2^16 (976/1344). For
+     * q == 2^15 (640) one &qMask pass at the very end reduces mod q (q
+     * divides 2^16). */
+    for (j = 0; j < n; j++) {
+        word16 sc0 = s0[j];
+        word16 sc1 = s1[j];
+        word16 sc2 = s2[j];
+        word16 sc3 = s3[j];
+        word16 sc4 = s4[j];
+        word16 sc5 = s5[j];
+        word16 sc6 = s6[j];
+        word16 sc7 = s7[j];
+        word16 bij;
+
+        bij = b0[j];
+        out[0]  = (word16)(out[0]  + bij * sc0);
+        out[1]  = (word16)(out[1]  + bij * sc1);
+        out[2]  = (word16)(out[2]  + bij * sc2);
+        out[3]  = (word16)(out[3]  + bij * sc3);
+        out[4]  = (word16)(out[4]  + bij * sc4);
+        out[5]  = (word16)(out[5]  + bij * sc5);
+        out[6]  = (word16)(out[6]  + bij * sc6);
+        out[7]  = (word16)(out[7]  + bij * sc7);
+        bij = b1[j];
+        out[8]  = (word16)(out[8]  + bij * sc0);
+        out[9]  = (word16)(out[9]  + bij * sc1);
+        out[10] = (word16)(out[10] + bij * sc2);
+        out[11] = (word16)(out[11] + bij * sc3);
+        out[12] = (word16)(out[12] + bij * sc4);
+        out[13] = (word16)(out[13] + bij * sc5);
+        out[14] = (word16)(out[14] + bij * sc6);
+        out[15] = (word16)(out[15] + bij * sc7);
+        bij = b2[j];
+        out[16] = (word16)(out[16] + bij * sc0);
+        out[17] = (word16)(out[17] + bij * sc1);
+        out[18] = (word16)(out[18] + bij * sc2);
+        out[19] = (word16)(out[19] + bij * sc3);
+        out[20] = (word16)(out[20] + bij * sc4);
+        out[21] = (word16)(out[21] + bij * sc5);
+        out[22] = (word16)(out[22] + bij * sc6);
+        out[23] = (word16)(out[23] + bij * sc7);
+        bij = b3[j];
+        out[24] = (word16)(out[24] + bij * sc0);
+        out[25] = (word16)(out[25] + bij * sc1);
+        out[26] = (word16)(out[26] + bij * sc2);
+        out[27] = (word16)(out[27] + bij * sc3);
+        out[28] = (word16)(out[28] + bij * sc4);
+        out[29] = (word16)(out[29] + bij * sc5);
+        out[30] = (word16)(out[30] + bij * sc6);
+        out[31] = (word16)(out[31] + bij * sc7);
+        bij = b4[j];
+        out[32] = (word16)(out[32] + bij * sc0);
+        out[33] = (word16)(out[33] + bij * sc1);
+        out[34] = (word16)(out[34] + bij * sc2);
+        out[35] = (word16)(out[35] + bij * sc3);
+        out[36] = (word16)(out[36] + bij * sc4);
+        out[37] = (word16)(out[37] + bij * sc5);
+        out[38] = (word16)(out[38] + bij * sc6);
+        out[39] = (word16)(out[39] + bij * sc7);
+        bij = b5[j];
+        out[40] = (word16)(out[40] + bij * sc0);
+        out[41] = (word16)(out[41] + bij * sc1);
+        out[42] = (word16)(out[42] + bij * sc2);
+        out[43] = (word16)(out[43] + bij * sc3);
+        out[44] = (word16)(out[44] + bij * sc4);
+        out[45] = (word16)(out[45] + bij * sc5);
+        out[46] = (word16)(out[46] + bij * sc6);
+        out[47] = (word16)(out[47] + bij * sc7);
+        bij = b6[j];
+        out[48] = (word16)(out[48] + bij * sc0);
+        out[49] = (word16)(out[49] + bij * sc1);
+        out[50] = (word16)(out[50] + bij * sc2);
+        out[51] = (word16)(out[51] + bij * sc3);
+        out[52] = (word16)(out[52] + bij * sc4);
+        out[53] = (word16)(out[53] + bij * sc5);
+        out[54] = (word16)(out[54] + bij * sc6);
+        out[55] = (word16)(out[55] + bij * sc7);
+        bij = b7[j];
+        out[56] = (word16)(out[56] + bij * sc0);
+        out[57] = (word16)(out[57] + bij * sc1);
+        out[58] = (word16)(out[58] + bij * sc2);
+        out[59] = (word16)(out[59] + bij * sc3);
+        out[60] = (word16)(out[60] + bij * sc4);
+        out[61] = (word16)(out[61] + bij * sc5);
+        out[62] = (word16)(out[62] + bij * sc6);
+        out[63] = (word16)(out[63] + bij * sc7);
+    }
+
+#ifdef FRODOKEM_D15_SHAKE128
+    /* q == 2^15 (640) needs a final reduction mod q; for q == 2^16 (976/1344)
+     * the word16 stores already reduced, so no mask. */
+#ifdef FRODOKEM_D16_SHAKE256
+    if (qmask != 0xffff)
+#endif
+    {
+        out[0] = (word16)(out[0] & qmask);
+        out[1] = (word16)(out[1] & qmask);
+        out[2] = (word16)(out[2] & qmask);
+        out[3] = (word16)(out[3] & qmask);
+        out[4] = (word16)(out[4] & qmask);
+        out[5] = (word16)(out[5] & qmask);
+        out[6] = (word16)(out[6] & qmask);
+        out[7] = (word16)(out[7] & qmask);
+        out[8] = (word16)(out[8] & qmask);
+        out[9] = (word16)(out[9] & qmask);
+        out[10] = (word16)(out[10] & qmask);
+        out[11] = (word16)(out[11] & qmask);
+        out[12] = (word16)(out[12] & qmask);
+        out[13] = (word16)(out[13] & qmask);
+        out[14] = (word16)(out[14] & qmask);
+        out[15] = (word16)(out[15] & qmask);
+        out[16] = (word16)(out[16] & qmask);
+        out[17] = (word16)(out[17] & qmask);
+        out[18] = (word16)(out[18] & qmask);
+        out[19] = (word16)(out[19] & qmask);
+        out[20] = (word16)(out[20] & qmask);
+        out[21] = (word16)(out[21] & qmask);
+        out[22] = (word16)(out[22] & qmask);
+        out[23] = (word16)(out[23] & qmask);
+        out[24] = (word16)(out[24] & qmask);
+        out[25] = (word16)(out[25] & qmask);
+        out[26] = (word16)(out[26] & qmask);
+        out[27] = (word16)(out[27] & qmask);
+        out[28] = (word16)(out[28] & qmask);
+        out[29] = (word16)(out[29] & qmask);
+        out[30] = (word16)(out[30] & qmask);
+        out[31] = (word16)(out[31] & qmask);
+        out[32] = (word16)(out[32] & qmask);
+        out[33] = (word16)(out[33] & qmask);
+        out[34] = (word16)(out[34] & qmask);
+        out[35] = (word16)(out[35] & qmask);
+        out[36] = (word16)(out[36] & qmask);
+        out[37] = (word16)(out[37] & qmask);
+        out[38] = (word16)(out[38] & qmask);
+        out[39] = (word16)(out[39] & qmask);
+        out[40] = (word16)(out[40] & qmask);
+        out[41] = (word16)(out[41] & qmask);
+        out[42] = (word16)(out[42] & qmask);
+        out[43] = (word16)(out[43] & qmask);
+        out[44] = (word16)(out[44] & qmask);
+        out[45] = (word16)(out[45] & qmask);
+        out[46] = (word16)(out[46] & qmask);
+        out[47] = (word16)(out[47] & qmask);
+        out[48] = (word16)(out[48] & qmask);
+        out[49] = (word16)(out[49] & qmask);
+        out[50] = (word16)(out[50] & qmask);
+        out[51] = (word16)(out[51] & qmask);
+        out[52] = (word16)(out[52] & qmask);
+        out[53] = (word16)(out[53] & qmask);
+        out[54] = (word16)(out[54] & qmask);
+        out[55] = (word16)(out[55] & qmask);
+        out[56] = (word16)(out[56] & qmask);
+        out[57] = (word16)(out[57] & qmask);
+        out[58] = (word16)(out[58] & qmask);
+        out[59] = (word16)(out[59] & qmask);
+        out[60] = (word16)(out[60] & qmask);
+        out[61] = (word16)(out[61] & qmask);
+        out[62] = (word16)(out[62] & qmask);
+        out[63] = (word16)(out[63] & qmask);
+    }
+#else
+    (void)qmask;
+#endif /* FRODOKEM_D15_SHAKE128 */
+#endif /* WOLFSSL_FRODOKEM_SMALL */
+    }
+#endif /* FRODOKEM_HAVE_ARM_ASM */
+    }
+#ifdef FRODOKEM_HAVE_SME
+    /* st held the interleaved secret matrix S^T; bt is the public B matrix. */
+    if (st != NULL) {
+        ForceZero(st, (size_t)FRODOKEM_NBAR * (size_t)n * sizeof(word16));
+    }
+    XFREE(bt, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(st, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif /* FRODOKEM_HAVE_SME */
+}
+
+/* Add matrix b into matrix a modulo q, element-wise (nbar x nbar).
+ *
+ * Used to form C = V + Encode(u): a is V (updated in place), b is Encode(u).
+ *
+ * @param  [in, out]  a      Matrix accumulated into (nbar * nbar, row-major).
+ * @param  [in]       b      Matrix added to a (nbar * nbar, row-major).
+ * @param  [in]       qmask  Reduction mask (q - 1).
+ */
+void frodokem_add(word16* a, const word16* b, int qmask)
+{
+#if defined(FRODOKEM_HAVE_ARM_ASM) && !defined(FRODOKEM_HAVE_NEON_RUNTIME)
+    frodokem_add_arm(a, b, qmask);
+#else
+#ifdef FRODOKEM_HAVE_SVE
+    if (IS_AARCH64_SVE(cpuid_flags)) {
+        frodokem_add_sve(a, b, qmask);
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_NEON_RUNTIME
+    if (IS_AARCH64_ASIMD(cpuid_flags)) {
+        frodokem_add_arm(a, b, qmask);
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+    if (IS_INTEL_AVX512(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_add_avx512(a, b, qmask);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+    if (IS_INTEL_AVX2(cpuid_flags) && (SAVE_VECTOR_REGISTERS2() == 0)) {
+        frodokem_add_avx2(a, b, qmask);
+        RESTORE_VECTOR_REGISTERS();
+    }
+    else
+#endif
+    {
+#ifdef WOLFSSL_FRODOKEM_SMALL
+    int i;
+
+    for (i = 0; i < FRODOKEM_NBAR_SQ; i++) {
+        a[i] = (word16)((a[i] + b[i]) & qmask);
+    }
+#else
+#if FRODOKEM_NBAR_SQ != 64
+    #error "Unrolled frodokem_add assumes FRODOKEM_NBAR_SQ == 64."
+#endif
+    /* nbar x nbar = FRODOKEM_NBAR_SQ (64) elements; the i loop is fully
+     * unrolled. word16 stores wrap mod 2^16, the reduction for q == 2^16
+     * (976/1344). */
+    a[0] = (word16)(a[0] + b[0]);
+    a[1] = (word16)(a[1] + b[1]);
+    a[2] = (word16)(a[2] + b[2]);
+    a[3] = (word16)(a[3] + b[3]);
+    a[4] = (word16)(a[4] + b[4]);
+    a[5] = (word16)(a[5] + b[5]);
+    a[6] = (word16)(a[6] + b[6]);
+    a[7] = (word16)(a[7] + b[7]);
+    a[8] = (word16)(a[8] + b[8]);
+    a[9] = (word16)(a[9] + b[9]);
+    a[10] = (word16)(a[10] + b[10]);
+    a[11] = (word16)(a[11] + b[11]);
+    a[12] = (word16)(a[12] + b[12]);
+    a[13] = (word16)(a[13] + b[13]);
+    a[14] = (word16)(a[14] + b[14]);
+    a[15] = (word16)(a[15] + b[15]);
+    a[16] = (word16)(a[16] + b[16]);
+    a[17] = (word16)(a[17] + b[17]);
+    a[18] = (word16)(a[18] + b[18]);
+    a[19] = (word16)(a[19] + b[19]);
+    a[20] = (word16)(a[20] + b[20]);
+    a[21] = (word16)(a[21] + b[21]);
+    a[22] = (word16)(a[22] + b[22]);
+    a[23] = (word16)(a[23] + b[23]);
+    a[24] = (word16)(a[24] + b[24]);
+    a[25] = (word16)(a[25] + b[25]);
+    a[26] = (word16)(a[26] + b[26]);
+    a[27] = (word16)(a[27] + b[27]);
+    a[28] = (word16)(a[28] + b[28]);
+    a[29] = (word16)(a[29] + b[29]);
+    a[30] = (word16)(a[30] + b[30]);
+    a[31] = (word16)(a[31] + b[31]);
+    a[32] = (word16)(a[32] + b[32]);
+    a[33] = (word16)(a[33] + b[33]);
+    a[34] = (word16)(a[34] + b[34]);
+    a[35] = (word16)(a[35] + b[35]);
+    a[36] = (word16)(a[36] + b[36]);
+    a[37] = (word16)(a[37] + b[37]);
+    a[38] = (word16)(a[38] + b[38]);
+    a[39] = (word16)(a[39] + b[39]);
+    a[40] = (word16)(a[40] + b[40]);
+    a[41] = (word16)(a[41] + b[41]);
+    a[42] = (word16)(a[42] + b[42]);
+    a[43] = (word16)(a[43] + b[43]);
+    a[44] = (word16)(a[44] + b[44]);
+    a[45] = (word16)(a[45] + b[45]);
+    a[46] = (word16)(a[46] + b[46]);
+    a[47] = (word16)(a[47] + b[47]);
+    a[48] = (word16)(a[48] + b[48]);
+    a[49] = (word16)(a[49] + b[49]);
+    a[50] = (word16)(a[50] + b[50]);
+    a[51] = (word16)(a[51] + b[51]);
+    a[52] = (word16)(a[52] + b[52]);
+    a[53] = (word16)(a[53] + b[53]);
+    a[54] = (word16)(a[54] + b[54]);
+    a[55] = (word16)(a[55] + b[55]);
+    a[56] = (word16)(a[56] + b[56]);
+    a[57] = (word16)(a[57] + b[57]);
+    a[58] = (word16)(a[58] + b[58]);
+    a[59] = (word16)(a[59] + b[59]);
+    a[60] = (word16)(a[60] + b[60]);
+    a[61] = (word16)(a[61] + b[61]);
+    a[62] = (word16)(a[62] + b[62]);
+    a[63] = (word16)(a[63] + b[63]);
+
+#ifdef FRODOKEM_D15_SHAKE128
+    /* q == 2^15 (640) needs a final reduction mod q. */
+#ifdef FRODOKEM_D16_SHAKE256
+    if (qmask != 0xffff)
+#endif
+    {
+        a[0] = (word16)(a[0] & qmask);
+        a[1] = (word16)(a[1] & qmask);
+        a[2] = (word16)(a[2] & qmask);
+        a[3] = (word16)(a[3] & qmask);
+        a[4] = (word16)(a[4] & qmask);
+        a[5] = (word16)(a[5] & qmask);
+        a[6] = (word16)(a[6] & qmask);
+        a[7] = (word16)(a[7] & qmask);
+        a[8] = (word16)(a[8] & qmask);
+        a[9] = (word16)(a[9] & qmask);
+        a[10] = (word16)(a[10] & qmask);
+        a[11] = (word16)(a[11] & qmask);
+        a[12] = (word16)(a[12] & qmask);
+        a[13] = (word16)(a[13] & qmask);
+        a[14] = (word16)(a[14] & qmask);
+        a[15] = (word16)(a[15] & qmask);
+        a[16] = (word16)(a[16] & qmask);
+        a[17] = (word16)(a[17] & qmask);
+        a[18] = (word16)(a[18] & qmask);
+        a[19] = (word16)(a[19] & qmask);
+        a[20] = (word16)(a[20] & qmask);
+        a[21] = (word16)(a[21] & qmask);
+        a[22] = (word16)(a[22] & qmask);
+        a[23] = (word16)(a[23] & qmask);
+        a[24] = (word16)(a[24] & qmask);
+        a[25] = (word16)(a[25] & qmask);
+        a[26] = (word16)(a[26] & qmask);
+        a[27] = (word16)(a[27] & qmask);
+        a[28] = (word16)(a[28] & qmask);
+        a[29] = (word16)(a[29] & qmask);
+        a[30] = (word16)(a[30] & qmask);
+        a[31] = (word16)(a[31] & qmask);
+        a[32] = (word16)(a[32] & qmask);
+        a[33] = (word16)(a[33] & qmask);
+        a[34] = (word16)(a[34] & qmask);
+        a[35] = (word16)(a[35] & qmask);
+        a[36] = (word16)(a[36] & qmask);
+        a[37] = (word16)(a[37] & qmask);
+        a[38] = (word16)(a[38] & qmask);
+        a[39] = (word16)(a[39] & qmask);
+        a[40] = (word16)(a[40] & qmask);
+        a[41] = (word16)(a[41] & qmask);
+        a[42] = (word16)(a[42] & qmask);
+        a[43] = (word16)(a[43] & qmask);
+        a[44] = (word16)(a[44] & qmask);
+        a[45] = (word16)(a[45] & qmask);
+        a[46] = (word16)(a[46] & qmask);
+        a[47] = (word16)(a[47] & qmask);
+        a[48] = (word16)(a[48] & qmask);
+        a[49] = (word16)(a[49] & qmask);
+        a[50] = (word16)(a[50] & qmask);
+        a[51] = (word16)(a[51] & qmask);
+        a[52] = (word16)(a[52] & qmask);
+        a[53] = (word16)(a[53] & qmask);
+        a[54] = (word16)(a[54] & qmask);
+        a[55] = (word16)(a[55] & qmask);
+        a[56] = (word16)(a[56] & qmask);
+        a[57] = (word16)(a[57] & qmask);
+        a[58] = (word16)(a[58] & qmask);
+        a[59] = (word16)(a[59] & qmask);
+        a[60] = (word16)(a[60] & qmask);
+        a[61] = (word16)(a[61] & qmask);
+        a[62] = (word16)(a[62] & qmask);
+        a[63] = (word16)(a[63] & qmask);
+    }
+#else
+    (void)qmask;
+#endif /* FRODOKEM_D15_SHAKE128 */
+#endif /* WOLFSSL_FRODOKEM_SMALL */
+    }
+#endif /* FRODOKEM_HAVE_ARM_ASM */
+}
+
+#endif /* WOLFSSL_HAVE_FRODOKEM */
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index e4227d9ebbc..eb0c48bd390 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -395,6 +395,9 @@ static const byte const_byte_array[] = "A+Gd\0\0\0";
 #ifdef WOLFSSL_HAVE_MLKEM
     #include <wolfssl/wolfcrypt/wc_mlkem.h>
 #endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    #include <wolfssl/wolfcrypt/wc_frodokem.h>
+#endif
 #ifdef WOLFSSL_HAVE_MLDSA
     #include <wolfssl/wolfcrypt/wc_mldsa.h>
 #endif
@@ -974,6 +977,9 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t scrypt_test(void);
 #ifdef WOLFSSL_HAVE_MLKEM
     WOLFSSL_TEST_SUBROUTINE wc_test_ret_t  mlkem_test(void);
 #endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    WOLFSSL_TEST_SUBROUTINE wc_test_ret_t  frodokem_test(void);
+#endif
 #ifdef WOLFSSL_HAVE_MLDSA
     WOLFSSL_TEST_SUBROUTINE wc_test_ret_t  mldsa_test(void);
 #endif
@@ -3189,6 +3195,13 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
     PRIVATE_KEY_LOCK();
 #endif
 
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    if ( (ret = frodokem_test()) != 0)
+        TEST_FAIL("FRODOKEM test failed!\n", ret);
+    else
+        TEST_PASS("FRODOKEM test passed!\n");
+#endif
+
 #ifdef WOLFSSL_HAVE_MLDSA
     PRIVATE_KEY_UNLOCK();
     if ( (ret = mldsa_test()) != 0)
@@ -53563,6 +53576,152 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mlkem_test(void)
 }
 #endif /* WOLFSSL_HAVE_MLKEM */
 
+#ifdef WOLFSSL_HAVE_FRODOKEM
+/* Basic FrodoKEM test: for each compiled variant generate a key, encapsulate
+ * and decapsulate (shared secrets must match), then confirm an encode/decode
+ * round trip of the private key still decapsulates correctly. */
+WOLFSSL_TEST_SUBROUTINE wc_test_ret_t frodokem_test(void)
+{
+    wc_test_ret_t ret = 0;
+#if !defined(WC_NO_RNG) && !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    static const int types[] = {
+    #ifdef WOLFSSL_FRODOKEM_SHAKE
+        #ifdef WOLFSSL_WC_FRODOKEM_640
+        WC_FRODOKEM_640_SHAKE,
+        #endif
+        #ifdef WOLFSSL_WC_FRODOKEM_976
+        WC_FRODOKEM_976_SHAKE,
+        #endif
+        #ifdef WOLFSSL_WC_FRODOKEM_1344
+        WC_FRODOKEM_1344_SHAKE,
+        #endif
+    #endif
+    #ifdef WOLFSSL_FRODOKEM_AES
+        #ifdef WOLFSSL_WC_FRODOKEM_640
+        WC_FRODOKEM_640_AES,
+        #endif
+        #ifdef WOLFSSL_WC_FRODOKEM_976
+        WC_FRODOKEM_976_AES,
+        #endif
+        #ifdef WOLFSSL_WC_FRODOKEM_1344
+        WC_FRODOKEM_1344_AES,
+        #endif
+    #endif
+    #ifdef WOLFSSL_FRODOKEM_EPHEMERAL
+        #ifdef WOLFSSL_FRODOKEM_SHAKE
+            #ifdef WOLFSSL_WC_FRODOKEM_640
+        WC_EFRODOKEM_640_SHAKE,
+            #endif
+            #ifdef WOLFSSL_WC_FRODOKEM_976
+        WC_EFRODOKEM_976_SHAKE,
+            #endif
+            #ifdef WOLFSSL_WC_FRODOKEM_1344
+        WC_EFRODOKEM_1344_SHAKE,
+            #endif
+        #endif
+        #ifdef WOLFSSL_FRODOKEM_AES
+            #ifdef WOLFSSL_WC_FRODOKEM_640
+        WC_EFRODOKEM_640_AES,
+            #endif
+            #ifdef WOLFSSL_WC_FRODOKEM_976
+        WC_EFRODOKEM_976_AES,
+            #endif
+            #ifdef WOLFSSL_WC_FRODOKEM_1344
+        WC_EFRODOKEM_1344_AES,
+            #endif
+        #endif
+    #endif
+        0 /* sentinel so the array is never empty */
+    };
+    int numTypes = (int)(sizeof(types) / sizeof(types[0])) - 1;
+    int i;
+    WC_RNG rng;
+    int rngInit = 0;
+    FrodoKemKey* key = NULL;
+    byte* ct = NULL;
+    byte* pk = NULL;
+    byte* sk = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte ss2[FRODOKEM_MAX_LENSEC];
+    word32 pkLen = 0;
+    word32 skLen = 0;
+    word32 ctLen = 0;
+    word32 ssLen = 0;
+
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    pk = (byte*)XMALLOC(FRODOKEM_MAX_PUBLIC_KEY_SIZE, HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    sk = (byte*)XMALLOC(FRODOKEM_MAX_PRIVATE_KEY_SIZE, HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    if ((key == NULL) || (ct == NULL) || (pk == NULL) || (sk == NULL)) {
+        ret = WC_TEST_RET_ENC_NC;
+        goto out;
+    }
+
+    ret = wc_InitRng_ex(&rng, HEAP_HINT, devId);
+    if (ret != 0) {
+        ret = WC_TEST_RET_ENC_EC(ret);
+        goto out;
+    }
+    rngInit = 1;
+
+    for (i = 0; i < numTypes; i++) {
+        ret = wc_FrodoKemKey_Init(key, types[i], HEAP_HINT, devId);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_PublicKeySize(key, &pkLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_PrivateKeySize(key, &skLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_CipherTextSize(key, &ctLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_SharedSecretSize(key, &ssLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+
+        ret = wc_FrodoKemKey_MakeKey(key, &rng);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_Decapsulate(key, ss2, ct, ctLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        if (XMEMCMP(ss, ss2, ssLen) != 0) {
+            ret = WC_TEST_RET_ENC_NC; break;
+        }
+
+        /* Encode then decode the private key and decapsulate again. */
+        ret = wc_FrodoKemKey_EncodePublicKey(key, pk, pkLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_EncodePrivateKey(key, sk, skLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_DecodePrivateKey(key, sk, skLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        ret = wc_FrodoKemKey_Decapsulate(key, ss2, ct, ctLen);
+        if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+        if (XMEMCMP(ss, ss2, ssLen) != 0) {
+            ret = WC_TEST_RET_ENC_NC; break;
+        }
+
+        wc_FrodoKemKey_Free(key);
+    }
+
+out:
+    if (key != NULL)
+        wc_FrodoKemKey_Free(key);
+    if (rngInit)
+        wc_FreeRng(&rng);
+    XFREE(sk, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(pk, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(ct, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+#endif /* !WC_NO_RNG */
+    return ret;
+}
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
 #ifdef WOLFSSL_HAVE_MLDSA
 #ifndef WOLFSSL_MLDSA_NO_VERIFY
 static wc_test_ret_t mldsa_param_vfy_test(int param, const byte* pubKey,
@@ -78285,6 +78444,10 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t cryptocb_test(void)
     if (ret == 0)
         ret = mlkem_test();
 #endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    if (ret == 0)
+        ret = frodokem_test();
+#endif
 #ifdef WOLFSSL_HAVE_MLDSA
     if (ret == 0)
         ret = mldsa_test();
diff --git a/wolfssl-VS2022.vcxproj b/wolfssl-VS2022.vcxproj
index b7178b0c48a..d6cc484bf47 100644
--- a/wolfssl-VS2022.vcxproj
+++ b/wolfssl-VS2022.vcxproj
@@ -76,7 +76,7 @@
          the WOLFSSL_ARMASM* defines below); a symbol that is left undefined
          here simply drops the matching assembly (safe - the C caller then uses
          a C fallback), while a symbol enabled here but not in C is dead code. -->
-    <WolfSSLArmAsmDefs>-PreDefine "HAVE_AES_CBC SETL {TRUE}" -PreDefine "HAVE_AESCCM SETL {TRUE}" -PreDefine "HAVE_AESGCM SETL {TRUE}" -PreDefine "HAVE_AES_ECB SETL {TRUE}" -PreDefine "HAVE_AES_DECRYPT SETL {TRUE}" -PreDefine "WOLFSSL_AES_COUNTER SETL {TRUE}" -PreDefine "WOLFSSL_AES_DIRECT SETL {TRUE}" -PreDefine "WOLFSSL_AES_XTS SETL {TRUE}" -PreDefine "WOLFSSL_AESGCM_STREAM SETL {TRUE}" -PreDefine "WOLFSSL_SHA224 SETL {TRUE}" -PreDefine "WOLFSSL_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_SHA384 SETL {TRUE}" -PreDefine "WOLFSSL_SHA512 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA512 SETL {TRUE}" -PreDefine "HAVE_CHACHA SETL {TRUE}" -PreDefine "HAVE_CURVE25519 SETL {TRUE}" -PreDefine "HAVE_ED25519 SETL {TRUE}" -PreDefine "WOLFSSL_HAVE_MLKEM SETL {TRUE}"</WolfSSLArmAsmDefs>
+    <WolfSSLArmAsmDefs>-PreDefine "HAVE_AES_CBC SETL {TRUE}" -PreDefine "HAVE_AESCCM SETL {TRUE}" -PreDefine "HAVE_AESGCM SETL {TRUE}" -PreDefine "HAVE_AES_ECB SETL {TRUE}" -PreDefine "HAVE_AES_DECRYPT SETL {TRUE}" -PreDefine "WOLFSSL_AES_COUNTER SETL {TRUE}" -PreDefine "WOLFSSL_AES_DIRECT SETL {TRUE}" -PreDefine "WOLFSSL_AES_XTS SETL {TRUE}" -PreDefine "WOLFSSL_AESGCM_STREAM SETL {TRUE}" -PreDefine "WOLFSSL_SHA224 SETL {TRUE}" -PreDefine "WOLFSSL_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_SHA384 SETL {TRUE}" -PreDefine "WOLFSSL_SHA512 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA512 SETL {TRUE}" -PreDefine "HAVE_CHACHA SETL {TRUE}" -PreDefine "HAVE_CURVE25519 SETL {TRUE}" -PreDefine "HAVE_ED25519 SETL {TRUE}" -PreDefine "WOLFSSL_HAVE_MLKEM SETL {TRUE}" -PreDefine "WOLFSSL_HAVE_FRODOKEM SETL {TRUE}"</WolfSSLArmAsmDefs>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
@@ -462,6 +462,8 @@
     <ClCompile Include="wolfcrypt\src\kdf.c" />
     <ClCompile Include="wolfcrypt\src\wc_mlkem.c" />
     <ClCompile Include="wolfcrypt\src\wc_mlkem_poly.c" />
+    <ClCompile Include="wolfcrypt\src\wc_frodokem.c" />
+    <ClCompile Include="wolfcrypt\src\wc_frodokem_mat.c" />
     <ClCompile Include="wolfcrypt\src\logging.c" />
     <ClCompile Include="wolfcrypt\src\md2.c" />
     <ClCompile Include="wolfcrypt\src\md4.c" />
@@ -677,6 +679,12 @@
       <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
       <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
     </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-frodokem-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
     <CustomBuild Include="wolfcrypt\src\port\arm\armv8-poly1305-asm.asm">
       <ExcludedFromBuild>true</ExcludedFromBuild>
       <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
@@ -701,6 +709,12 @@
       <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
       <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
     </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\wc_frodokem_asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">ml64.exe /c /Zi /DWOLFSSL_X86_64_BUILD /DWOLFSSL_HAVE_FRODOKEM /Fo"$(IntDir)%(Filename).obj" %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
     <ClInclude Include="IDE\WIN\user_settings.h" />
   </ItemGroup>
   <ItemGroup>
diff --git a/wolfssl.vcxproj b/wolfssl.vcxproj
index 63b17ef9cc2..1bd3220bb83 100644
--- a/wolfssl.vcxproj
+++ b/wolfssl.vcxproj
@@ -75,7 +75,7 @@
          the WOLFSSL_ARMASM* defines below); a symbol that is left undefined
          here simply drops the matching assembly (safe - the C caller then uses
          a C fallback), while a symbol enabled here but not in C is dead code. -->
-    <WolfSSLArmAsmDefs>-PreDefine "HAVE_AES_CBC SETL {TRUE}" -PreDefine "HAVE_AESCCM SETL {TRUE}" -PreDefine "HAVE_AESGCM SETL {TRUE}" -PreDefine "HAVE_AES_ECB SETL {TRUE}" -PreDefine "HAVE_AES_DECRYPT SETL {TRUE}" -PreDefine "WOLFSSL_AES_COUNTER SETL {TRUE}" -PreDefine "WOLFSSL_AES_DIRECT SETL {TRUE}" -PreDefine "WOLFSSL_AES_XTS SETL {TRUE}" -PreDefine "WOLFSSL_AESGCM_STREAM SETL {TRUE}" -PreDefine "WOLFSSL_SHA224 SETL {TRUE}" -PreDefine "WOLFSSL_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_SHA384 SETL {TRUE}" -PreDefine "WOLFSSL_SHA512 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA512 SETL {TRUE}" -PreDefine "HAVE_CHACHA SETL {TRUE}" -PreDefine "HAVE_CURVE25519 SETL {TRUE}" -PreDefine "HAVE_ED25519 SETL {TRUE}" -PreDefine "WOLFSSL_HAVE_MLKEM SETL {TRUE}"</WolfSSLArmAsmDefs>
+    <WolfSSLArmAsmDefs>-PreDefine "HAVE_AES_CBC SETL {TRUE}" -PreDefine "HAVE_AESCCM SETL {TRUE}" -PreDefine "HAVE_AESGCM SETL {TRUE}" -PreDefine "HAVE_AES_ECB SETL {TRUE}" -PreDefine "HAVE_AES_DECRYPT SETL {TRUE}" -PreDefine "WOLFSSL_AES_COUNTER SETL {TRUE}" -PreDefine "WOLFSSL_AES_DIRECT SETL {TRUE}" -PreDefine "WOLFSSL_AES_XTS SETL {TRUE}" -PreDefine "WOLFSSL_AESGCM_STREAM SETL {TRUE}" -PreDefine "WOLFSSL_SHA224 SETL {TRUE}" -PreDefine "WOLFSSL_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA3 SETL {TRUE}" -PreDefine "WOLFSSL_SHA384 SETL {TRUE}" -PreDefine "WOLFSSL_SHA512 SETL {TRUE}" -PreDefine "WOLFSSL_ARMASM_CRYPTO_SHA512 SETL {TRUE}" -PreDefine "HAVE_CHACHA SETL {TRUE}" -PreDefine "HAVE_CURVE25519 SETL {TRUE}" -PreDefine "HAVE_ED25519 SETL {TRUE}" -PreDefine "WOLFSSL_HAVE_MLKEM SETL {TRUE}" -PreDefine "WOLFSSL_HAVE_FRODOKEM SETL {TRUE}"</WolfSSLArmAsmDefs>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
@@ -462,6 +462,8 @@
     <ClCompile Include="wolfcrypt\src\kdf.c" />
     <ClCompile Include="wolfcrypt\src\wc_mlkem.c" />
     <ClCompile Include="wolfcrypt\src\wc_mlkem_poly.c" />
+    <ClCompile Include="wolfcrypt\src\wc_frodokem.c" />
+    <ClCompile Include="wolfcrypt\src\wc_frodokem_mat.c" />
     <ClCompile Include="wolfcrypt\src\logging.c" />
     <ClCompile Include="wolfcrypt\src\md2.c" />
     <ClCompile Include="wolfcrypt\src\md4.c" />
@@ -677,6 +679,12 @@
       <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
       <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
     </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-frodokem-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
     <CustomBuild Include="wolfcrypt\src\port\arm\armv8-poly1305-asm.asm">
       <ExcludedFromBuild>true</ExcludedFromBuild>
       <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
@@ -701,6 +709,12 @@
       <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
       <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
     </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\wc_frodokem_asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">ml64.exe /c /Zi /DWOLFSSL_X86_64_BUILD /DWOLFSSL_HAVE_FRODOKEM /Fo"$(IntDir)%(Filename).obj" %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
     <ClInclude Include="IDE\WIN\user_settings.h" />
   </ItemGroup>
   <ItemGroup>
diff --git a/wolfssl/wolfcrypt/cpuid.h b/wolfssl/wolfcrypt/cpuid.h
index b393100f975..106bd509099 100644
--- a/wolfssl/wolfcrypt/cpuid.h
+++ b/wolfssl/wolfcrypt/cpuid.h
@@ -99,6 +99,8 @@ typedef word32 cpuid_flags_t;
     #define CPUID_SM4         0x0080    /* SM4 enc/dec */
     #define CPUID_SB          0x0100    /* Speculation barrier */
     #define CPUID_ASIMD       0x0200    /* ASIMD - NEON */
+    #define CPUID_SVE         0x0400    /* Scalable Vector Extension */
+    #define CPUID_SME         0x0800    /* Scalable Matrix Extension */
 
     #define IS_AARCH64_AES(f)     (WOLFSSL_ATOMIC_COERCE_UINT(f) & CPUID_AES)
     #define IS_AARCH64_PMULL(f)   (WOLFSSL_ATOMIC_COERCE_UINT(f) & CPUID_PMULL)
@@ -110,6 +112,8 @@ typedef word32 cpuid_flags_t;
     #define IS_AARCH64_SM4(f)     (WOLFSSL_ATOMIC_COERCE_UINT(f) & CPUID_SM4)
     #define IS_AARCH64_SB(f)      (WOLFSSL_ATOMIC_COERCE_UINT(f) & CPUID_SB)
     #define IS_AARCH64_ASIMD(f)   (WOLFSSL_ATOMIC_COERCE_UINT(f) & CPUID_ASIMD)
+    #define IS_AARCH64_SVE(f)     (WOLFSSL_ATOMIC_COERCE_UINT(f) & CPUID_SVE)
+    #define IS_AARCH64_SME(f)     (WOLFSSL_ATOMIC_COERCE_UINT(f) & CPUID_SME)
 
 #elif defined(HAVE_CPUID_PPC64)
 
diff --git a/wolfssl/wolfcrypt/include.am b/wolfssl/wolfcrypt/include.am
index c9fd93ae6e9..1841813f4fe 100644
--- a/wolfssl/wolfcrypt/include.am
+++ b/wolfssl/wolfcrypt/include.am
@@ -79,6 +79,8 @@ nobase_include_HEADERS+= \
                          wolfssl/wolfcrypt/cryptocb.h \
                          wolfssl/wolfcrypt/wc_mldsa.h \
                          wolfssl/wolfcrypt/wc_mlkem.h \
+                         wolfssl/wolfcrypt/wc_frodokem.h \
+                         wolfssl/wolfcrypt/wc_frodokem_mat.h \
                          wolfssl/wolfcrypt/sm2.h \
                          wolfssl/wolfcrypt/sm3.h \
                          wolfssl/wolfcrypt/sm4.h \
diff --git a/wolfssl/wolfcrypt/sha3.h b/wolfssl/wolfcrypt/sha3.h
index e0c529b8af1..ff187e63855 100644
--- a/wolfssl/wolfcrypt/sha3.h
+++ b/wolfssl/wolfcrypt/sha3.h
@@ -262,6 +262,10 @@ WOLFSSL_LOCAL void BlockSha3(word64 *s);
         word64 c);
     WOLFSSL_LOCAL void sha3_block_avx2(word64* s);
     WOLFSSL_LOCAL void sha3_blocksx4_avx2(word64* s);
+    WOLFSSL_LOCAL void sha3_blocksx4_out_avx2(word64* s, byte* out,
+        word32 len);
+    WOLFSSL_LOCAL void sha3_blocksx8_out_avx512(word64* s, byte* out,
+        word32 len);
 
     WOLFSSL_LOCAL void sha3_128_blocksx4_seed_avx2(word64* s, byte* seed);
     WOLFSSL_LOCAL void sha3_256_blocksx4_seed_avx2(word64* s, byte* seed);
diff --git a/wolfssl/wolfcrypt/wc_frodokem.h b/wolfssl/wolfcrypt/wc_frodokem.h
new file mode 100644
index 00000000000..264eb5dd2be
--- /dev/null
+++ b/wolfssl/wolfcrypt/wc_frodokem.h
@@ -0,0 +1,328 @@
+/* wc_frodokem.h
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/*!
+    \file wolfssl/wolfcrypt/wc_frodokem.h
+*/
+
+#ifndef WOLF_CRYPT_WC_FRODOKEM_H
+#define WOLF_CRYPT_WC_FRODOKEM_H
+
+#include <wolfssl/wolfcrypt/types.h>
+#include <wolfssl/wolfcrypt/random.h>
+#include <wolfssl/wolfcrypt/sha3.h>
+#ifdef WOLFSSL_FRODOKEM_AES
+    #include <wolfssl/wolfcrypt/aes.h>
+#endif
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+
+#ifdef __cplusplus
+    extern "C" {
+#endif
+
+/* Define algorithm parameter sets when not excluded. */
+#ifndef WOLFSSL_NO_FRODOKEM_640
+    #define WOLFSSL_WC_FRODOKEM_640
+#endif
+#ifndef WOLFSSL_NO_FRODOKEM_976
+    #define WOLFSSL_WC_FRODOKEM_976
+#endif
+#ifndef WOLFSSL_NO_FRODOKEM_1344
+    #define WOLFSSL_WC_FRODOKEM_1344
+#endif
+
+#if !defined(WOLFSSL_WC_FRODOKEM_640) && !defined(WOLFSSL_WC_FRODOKEM_976) && \
+    !defined(WOLFSSL_WC_FRODOKEM_1344)
+    #error "No FrodoKEM parameter set chosen."
+#endif
+
+/* Matrix A generation method(s). AES-128 (Section 6.7.1) and SHAKE-128
+ * (Section 6.7.2) are independently selectable build options; at least one
+ * must be enabled. */
+#if !defined(WOLFSSL_FRODOKEM_AES) && !defined(WOLFSSL_FRODOKEM_SHAKE)
+    #error "FrodoKEM needs WOLFSSL_FRODOKEM_AES and/or WOLFSSL_FRODOKEM_SHAKE."
+#endif
+
+/* WOLFSSL_FRODOKEM_EPHEMERAL enables the eFrodoKEM (ephemeral, salt-less)
+ * parameter set types. */
+
+/* Operations are individually selectable: define WOLFSSL_FRODOKEM_NO_MAKE_KEY,
+ * WOLFSSL_FRODOKEM_NO_ENCAPSULATE and/or WOLFSSL_FRODOKEM_NO_DECAPSULATE to
+ * exclude them. At least one operation must remain. */
+#if defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    #error "No FrodoKEM operations to be built."
+#endif
+
+/* Number of columns in the "small" matrices - constant across all parameter
+ * sets (n-bar = m-bar = 8). */
+#define FRODOKEM_NBAR       8
+
+/* Number of elements in an nbar x nbar matrix. */
+#define FRODOKEM_NBAR_SQ    (FRODOKEM_NBAR * FRODOKEM_NBAR)
+
+/* Length of the seed for generating matrix A (lenA / 8 = 128 / 8). */
+#define FRODOKEM_SEEDA_SZ   16
+
+/* Size in bytes of a public key: seedA || b (b = nbar * n coefficients of D
+ * bits each = D * n bytes, nbar == 8). */
+#define FRODOKEM_PK_SZ(n, d)        (FRODOKEM_SEEDA_SZ + ((d) * (n)))
+/* Size in bytes of a private key: s || seedA || b || S^T || pkh.
+ * S^T holds nbar * n coefficients, each stored as 2 bytes. */
+#define FRODOKEM_SK_SZ(n, d, ls)    ((ls) + FRODOKEM_SEEDA_SZ + ((d) * (n)) + \
+                                     (2 * FRODOKEM_NBAR * (n)) + (ls))
+/* Size in bytes of a ciphertext: c1 || c2 || salt.
+ * c1 = D * nbar * n bits, c2 = D * nbar * nbar bits. */
+#define FRODOKEM_CT_SZ(n, d, lsalt) (((d) * (n)) + ((d) * FRODOKEM_NBAR) + \
+                                     (lsalt))
+
+/* FrodoKEM-640 parameters. */
+#define WC_FRODOKEM_640_N               640
+#define WC_FRODOKEM_640_D               15
+#define WC_FRODOKEM_640_LENSEC          16      /* lensec  / 8 = 128 / 8  */
+#define WC_FRODOKEM_640_LENSE           32      /* lenSE   / 8 = 256 / 8  */
+#define WC_FRODOKEM_640_LENSALT         32      /* lensalt / 8 = 256 / 8  */
+#define WC_FRODOKEM_640_PUBLIC_KEY_SIZE \
+    FRODOKEM_PK_SZ(WC_FRODOKEM_640_N, WC_FRODOKEM_640_D)
+#define WC_FRODOKEM_640_PRIVATE_KEY_SIZE \
+    FRODOKEM_SK_SZ(WC_FRODOKEM_640_N, WC_FRODOKEM_640_D, WC_FRODOKEM_640_LENSEC)
+#define WC_FRODOKEM_640_CIPHER_TEXT_SIZE \
+    FRODOKEM_CT_SZ(WC_FRODOKEM_640_N, WC_FRODOKEM_640_D, \
+        WC_FRODOKEM_640_LENSALT)
+#define WC_FRODOKEM_640_SS_SIZE         WC_FRODOKEM_640_LENSEC
+#define WC_FRODOKEM_640_MAKEKEY_RAND_SZ \
+    (WC_FRODOKEM_640_LENSEC + WC_FRODOKEM_640_LENSE + FRODOKEM_SEEDA_SZ)
+#define WC_FRODOKEM_640_ENC_RAND_SZ \
+    (WC_FRODOKEM_640_LENSEC + WC_FRODOKEM_640_LENSALT)
+
+/* FrodoKEM-976 parameters. */
+#define WC_FRODOKEM_976_N               976
+#define WC_FRODOKEM_976_D               16
+#define WC_FRODOKEM_976_LENSEC          24      /* lensec  / 8 = 192 / 8  */
+#define WC_FRODOKEM_976_LENSE           48      /* lenSE   / 8 = 384 / 8  */
+#define WC_FRODOKEM_976_LENSALT         48      /* lensalt / 8 = 384 / 8  */
+#define WC_FRODOKEM_976_PUBLIC_KEY_SIZE \
+    FRODOKEM_PK_SZ(WC_FRODOKEM_976_N, WC_FRODOKEM_976_D)
+#define WC_FRODOKEM_976_PRIVATE_KEY_SIZE \
+    FRODOKEM_SK_SZ(WC_FRODOKEM_976_N, WC_FRODOKEM_976_D, WC_FRODOKEM_976_LENSEC)
+#define WC_FRODOKEM_976_CIPHER_TEXT_SIZE \
+    FRODOKEM_CT_SZ(WC_FRODOKEM_976_N, WC_FRODOKEM_976_D, \
+        WC_FRODOKEM_976_LENSALT)
+#define WC_FRODOKEM_976_SS_SIZE         WC_FRODOKEM_976_LENSEC
+#define WC_FRODOKEM_976_MAKEKEY_RAND_SZ \
+    (WC_FRODOKEM_976_LENSEC + WC_FRODOKEM_976_LENSE + FRODOKEM_SEEDA_SZ)
+#define WC_FRODOKEM_976_ENC_RAND_SZ \
+    (WC_FRODOKEM_976_LENSEC + WC_FRODOKEM_976_LENSALT)
+
+/* FrodoKEM-1344 parameters. */
+#define WC_FRODOKEM_1344_N              1344
+#define WC_FRODOKEM_1344_D              16
+#define WC_FRODOKEM_1344_LENSEC         32      /* lensec  / 8 = 256 / 8  */
+#define WC_FRODOKEM_1344_LENSE          64      /* lenSE   / 8 = 512 / 8  */
+#define WC_FRODOKEM_1344_LENSALT        64      /* lensalt / 8 = 512 / 8  */
+#define WC_FRODOKEM_1344_PUBLIC_KEY_SIZE \
+    FRODOKEM_PK_SZ(WC_FRODOKEM_1344_N, WC_FRODOKEM_1344_D)
+#define WC_FRODOKEM_1344_PRIVATE_KEY_SIZE \
+    FRODOKEM_SK_SZ(WC_FRODOKEM_1344_N, WC_FRODOKEM_1344_D, \
+        WC_FRODOKEM_1344_LENSEC)
+#define WC_FRODOKEM_1344_CIPHER_TEXT_SIZE \
+    FRODOKEM_CT_SZ(WC_FRODOKEM_1344_N, WC_FRODOKEM_1344_D, \
+        WC_FRODOKEM_1344_LENSALT)
+#define WC_FRODOKEM_1344_SS_SIZE        WC_FRODOKEM_1344_LENSEC
+#define WC_FRODOKEM_1344_MAKEKEY_RAND_SZ \
+    (WC_FRODOKEM_1344_LENSEC + WC_FRODOKEM_1344_LENSE + FRODOKEM_SEEDA_SZ)
+#define WC_FRODOKEM_1344_ENC_RAND_SZ \
+    (WC_FRODOKEM_1344_LENSEC + WC_FRODOKEM_1344_LENSALT)
+
+/* Maximum dimensions and sizes over the enabled parameter sets. */
+#ifdef WOLFSSL_WC_FRODOKEM_1344
+    #define FRODOKEM_MAX_N                  WC_FRODOKEM_1344_N
+    #define FRODOKEM_MAX_LENSEC             WC_FRODOKEM_1344_LENSEC
+    #define FRODOKEM_MAX_LENSE              WC_FRODOKEM_1344_LENSE
+    #define FRODOKEM_MAX_LENSALT            WC_FRODOKEM_1344_LENSALT
+    #define FRODOKEM_MAX_D                  WC_FRODOKEM_1344_D
+    #define FRODOKEM_MAX_PUBLIC_KEY_SIZE    WC_FRODOKEM_1344_PUBLIC_KEY_SIZE
+    #define FRODOKEM_MAX_PRIVATE_KEY_SIZE   WC_FRODOKEM_1344_PRIVATE_KEY_SIZE
+    #define FRODOKEM_MAX_CIPHER_TEXT_SIZE   WC_FRODOKEM_1344_CIPHER_TEXT_SIZE
+#elif defined(WOLFSSL_WC_FRODOKEM_976)
+    #define FRODOKEM_MAX_N                  WC_FRODOKEM_976_N
+    #define FRODOKEM_MAX_LENSEC             WC_FRODOKEM_976_LENSEC
+    #define FRODOKEM_MAX_LENSE              WC_FRODOKEM_976_LENSE
+    #define FRODOKEM_MAX_LENSALT            WC_FRODOKEM_976_LENSALT
+    #define FRODOKEM_MAX_D                  WC_FRODOKEM_976_D
+    #define FRODOKEM_MAX_PUBLIC_KEY_SIZE    WC_FRODOKEM_976_PUBLIC_KEY_SIZE
+    #define FRODOKEM_MAX_PRIVATE_KEY_SIZE   WC_FRODOKEM_976_PRIVATE_KEY_SIZE
+    #define FRODOKEM_MAX_CIPHER_TEXT_SIZE   WC_FRODOKEM_976_CIPHER_TEXT_SIZE
+#else
+    #define FRODOKEM_MAX_N                  WC_FRODOKEM_640_N
+    #define FRODOKEM_MAX_LENSEC             WC_FRODOKEM_640_LENSEC
+    #define FRODOKEM_MAX_LENSE              WC_FRODOKEM_640_LENSE
+    #define FRODOKEM_MAX_LENSALT            WC_FRODOKEM_640_LENSALT
+    #define FRODOKEM_MAX_D                  WC_FRODOKEM_640_D
+    #define FRODOKEM_MAX_PUBLIC_KEY_SIZE    WC_FRODOKEM_640_PUBLIC_KEY_SIZE
+    #define FRODOKEM_MAX_PRIVATE_KEY_SIZE   WC_FRODOKEM_640_PRIVATE_KEY_SIZE
+    #define FRODOKEM_MAX_CIPHER_TEXT_SIZE   WC_FRODOKEM_640_CIPHER_TEXT_SIZE
+#endif
+
+/* Size in bytes of the packed public matrix b (D * n bits => D * n bytes as
+ * nbar == 8). */
+#define FRODOKEM_MAX_B_SZ       (FRODOKEM_MAX_D * FRODOKEM_MAX_N)
+/* Number of coefficients in the secret matrix S^T (nbar * n). */
+#define FRODOKEM_MAX_S_CNT      (FRODOKEM_NBAR * FRODOKEM_MAX_N)
+
+
+enum {
+    /* Base parameter sets. On their own these select the standard (salted)
+     * FrodoKEM using SHAKE-128 to generate matrix A. */
+    WC_FRODOKEM_640  = 0,
+    WC_FRODOKEM_976  = 1,
+    WC_FRODOKEM_1344 = 2,
+
+    /* Modifier bits OR'd with a base parameter set to form a key type. */
+    FRODOKEM_AES        = 0x10, /* Generate matrix A with AES-128. */
+    FRODOKEM_EPHEMERAL  = 0x20, /* eFrodoKEM: ephemeral, no salt. */
+
+    /* Mask to extract the base parameter set from a type. */
+    FRODOKEM_BASE_MASK  = 0x0F,
+
+    /* Explicit named types: FrodoKEM (standard, salted). */
+    WC_FRODOKEM_640_SHAKE   = WC_FRODOKEM_640,
+    WC_FRODOKEM_976_SHAKE   = WC_FRODOKEM_976,
+    WC_FRODOKEM_1344_SHAKE  = WC_FRODOKEM_1344,
+    WC_FRODOKEM_640_AES     = WC_FRODOKEM_640  | FRODOKEM_AES,
+    WC_FRODOKEM_976_AES     = WC_FRODOKEM_976  | FRODOKEM_AES,
+    WC_FRODOKEM_1344_AES    = WC_FRODOKEM_1344 | FRODOKEM_AES,
+
+    /* Explicit named types: eFrodoKEM (ephemeral). */
+    WC_EFRODOKEM_640_SHAKE  = WC_FRODOKEM_640  | FRODOKEM_EPHEMERAL,
+    WC_EFRODOKEM_976_SHAKE  = WC_FRODOKEM_976  | FRODOKEM_EPHEMERAL,
+    WC_EFRODOKEM_1344_SHAKE = WC_FRODOKEM_1344 | FRODOKEM_EPHEMERAL,
+    WC_EFRODOKEM_640_AES    = WC_EFRODOKEM_640_SHAKE  | FRODOKEM_AES,
+    WC_EFRODOKEM_976_AES    = WC_EFRODOKEM_976_SHAKE  | FRODOKEM_AES,
+    WC_EFRODOKEM_1344_AES   = WC_EFRODOKEM_1344_SHAKE | FRODOKEM_AES,
+
+    /* Flags indicating what is stored in a key. */
+    FRODOKEM_FLAG_PRIV_SET = 0x0001,
+    FRODOKEM_FLAG_PUB_SET  = 0x0002,
+    FRODOKEM_FLAG_BOTH_SET = 0x0003,
+    FRODOKEM_FLAG_PKH_SET  = 0x0004
+};
+
+
+/* Run-time parameters for a FrodoKEM parameter set. The definition is internal
+ * (see wc_frodokem_mat.h); a key only holds a pointer to a constant instance. */
+typedef struct FrodoKemParams FrodoKemParams;
+
+
+/* FrodoKEM key. */
+typedef struct FrodoKemKey {
+    /* Type of key: a base parameter set optionally OR'd with FRODOKEM_AES
+     * and/or FRODOKEM_EPHEMERAL. */
+    int type;
+    /* Parameters for this key type (points to a constant). Set by Init. */
+    const FrodoKemParams* params;
+    /* Dynamic memory allocation hint. */
+    void* heap;
+    /* Device Id. */
+    int devId;
+    /* Flags indicating what is stored in the key. */
+    int flags;
+
+    /* Secret value used for implicit rejection (length lenSec). */
+    byte s[FRODOKEM_MAX_LENSEC];
+    /* Secret matrix S^T (nbar x n) stored row-major as residues modulo q. */
+    word16 sMat[FRODOKEM_MAX_S_CNT];
+
+    /* Seed used to generate matrix A. */
+    byte seedA[FRODOKEM_SEEDA_SZ];
+    /* Packed public matrix B (D * n bytes). */
+    byte b[FRODOKEM_MAX_B_SZ];
+    /* Hash of the public key (length lenSec). */
+    byte pkh[FRODOKEM_MAX_LENSEC];
+
+    /* Reusable SHAKE object for all hashing and matrix-A generation. Embedded
+     * (not allocated); initialized by wc_FrodoKemKey_Init for the key's SHAKE
+     * variant. Matrix-A generation always uses SHAKE-128; the hashing SHAKE is
+     * SHAKE-128 for FrodoKEM-640 and SHAKE-256 for -976 / -1344. */
+    wc_Shake shake;
+#ifdef WOLFSSL_FRODOKEM_AES
+    /* Reusable AES-128 object for matrix-A generation (AES key type). Embedded
+     * (not allocated); wc_AesInit'd by wc_FrodoKemKey_Init and re-keyed with
+     * seedA per operation. */
+    Aes aes;
+#endif
+} FrodoKemKey;
+
+
+WOLFSSL_API FrodoKemKey* wc_FrodoKemKey_New(int type, void* heap, int devId);
+WOLFSSL_API int wc_FrodoKemKey_Delete(FrodoKemKey* key, FrodoKemKey** key_p);
+
+WOLFSSL_API int wc_FrodoKemKey_Init(FrodoKemKey* key, int type, void* heap,
+    int devId);
+WOLFSSL_API int wc_FrodoKemKey_Free(FrodoKemKey* key);
+
+#ifndef WOLFSSL_FRODOKEM_NO_MAKE_KEY
+WOLFSSL_API int wc_FrodoKemKey_MakeKey(FrodoKemKey* key, WC_RNG* rng);
+WOLFSSL_API int wc_FrodoKemKey_MakeKeyWithRandom(FrodoKemKey* key,
+    const unsigned char* rand, int len);
+#endif
+
+WOLFSSL_API int wc_FrodoKemKey_CipherTextSize(const FrodoKemKey* key,
+    word32* len);
+WOLFSSL_API int wc_FrodoKemKey_SharedSecretSize(const FrodoKemKey* key,
+    word32* len);
+
+#ifndef WOLFSSL_FRODOKEM_NO_ENCAPSULATE
+WOLFSSL_API int wc_FrodoKemKey_Encapsulate(FrodoKemKey* key, unsigned char* ct,
+    unsigned char* ss, WC_RNG* rng);
+WOLFSSL_API int wc_FrodoKemKey_EncapsulateWithRandom(FrodoKemKey* key,
+    unsigned char* ct, unsigned char* ss, const unsigned char* rand, int len);
+#endif
+#ifndef WOLFSSL_FRODOKEM_NO_DECAPSULATE
+WOLFSSL_API int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
+    const unsigned char* ct, word32 len);
+#endif
+
+WOLFSSL_API int wc_FrodoKemKey_DecodePrivateKey(FrodoKemKey* key,
+    const unsigned char* in, word32 len);
+WOLFSSL_API int wc_FrodoKemKey_DecodePublicKey(FrodoKemKey* key,
+    const unsigned char* in, word32 len);
+
+WOLFSSL_API int wc_FrodoKemKey_PrivateKeySize(const FrodoKemKey* key,
+    word32* len);
+WOLFSSL_API int wc_FrodoKemKey_PublicKeySize(const FrodoKemKey* key,
+    word32* len);
+WOLFSSL_API int wc_FrodoKemKey_EncodePrivateKey(FrodoKemKey* key,
+    unsigned char* out, word32 len);
+WOLFSSL_API int wc_FrodoKemKey_EncodePublicKey(FrodoKemKey* key,
+    unsigned char* out, word32 len);
+
+
+
+#ifdef __cplusplus
+    } /* extern "C" */
+#endif
+
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+#endif /* WOLF_CRYPT_WC_FRODOKEM_H */
diff --git a/wolfssl/wolfcrypt/wc_frodokem_mat.h b/wolfssl/wolfcrypt/wc_frodokem_mat.h
new file mode 100644
index 00000000000..7ab86badd90
--- /dev/null
+++ b/wolfssl/wolfcrypt/wc_frodokem_mat.h
@@ -0,0 +1,466 @@
+/* wc_frodokem_mat.h
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/*!
+    \file wolfssl/wolfcrypt/wc_frodokem_mat.h
+*/
+
+/* Internal-only declarations for the FrodoKEM reference implementation: the
+ * run-time parameter set, the assembly dispatch configuration and the low-level
+ * matrix / encoding operations shared by wc_frodokem.c and wc_frodokem_mat.c
+ * (and the generated inline-assembly _c.c files). The public API and the
+ * FrodoKemKey object live in wc_frodokem.h. */
+
+#ifndef WOLF_CRYPT_WC_FRODOKEM_MAT_H
+#define WOLF_CRYPT_WC_FRODOKEM_MAT_H
+
+#include <wolfssl/wolfcrypt/wc_frodokem.h>
+
+#ifdef WOLFSSL_HAVE_FRODOKEM
+
+#ifdef __cplusplus
+    extern "C" {
+#endif
+
+/* When the multi-way AVX2/AVX512 Keccak squeeze routines are compiled in,
+ * matrix-A rows for the SHAKE method are generated several at a time: four with
+ * AVX2 (sha3_blocksx4_out_avx2), eight with AVX512 (sha3_blocksx8_out_avx512).
+ * The one-A-row scratch buffer is widened to hold FRODOKEM_ROW_MULT rows (the
+ * widest path compiled in); the runtime path is chosen by CPU features. */
+#if defined(WOLFSSL_FRODOKEM_SHAKE) && defined(USE_INTEL_SPEEDUP) && \
+    !defined(WC_SHA3_NO_ASM)
+    #define FRODOKEM_HAVE_SHAKE_X4
+    #ifndef NO_AVX512_SUPPORT
+        #define FRODOKEM_HAVE_SHAKE_X8
+    #endif
+#endif
+
+/* AVX2/AVX512 assembly for the matrix operations: the fused S*A / A*S row
+ * accumulates, the small nbar x nbar ops (mul_bs, mul_add_sb_plus_e, add) and
+ * the CDF sampler. Available whenever the Intel assembly is built, independent
+ * of the matrix-A generation method (AES or SHAKE). */
+#if defined(USE_INTEL_SPEEDUP)
+    #define FRODOKEM_HAVE_MATRIX_ASM
+    #ifndef NO_AVX512_SUPPORT
+        #define FRODOKEM_HAVE_MATRIX_ASM_AVX512
+    #endif
+    /* VAES (vector AES over YMM/ZMM) matrix-A generation. Follows aes.c: the
+     * VAES asm is compiled and dispatched unless the build opts out with
+     * NO_VAES_SUPPORT, in which case the AES-NI kernel is the widest path. */
+    #ifndef NO_VAES_SUPPORT
+        #define FRODOKEM_HAVE_MATRIX_ASM_VAES
+    #endif
+#endif
+
+/* AArch64 NEON assembly: a 2-way SHAKE (two matrix-A rows at once) and NEON
+ * matrix ops. NEON is baseline on AArch64, so no runtime feature check. */
+#if defined(WOLFSSL_ARMASM) && defined(__aarch64__)
+    #define FRODOKEM_HAVE_NEON_ASM
+    #ifdef WOLFSSL_FRODOKEM_SHAKE
+        #define FRODOKEM_HAVE_SHAKE_NEON
+    #endif
+/* AArch32 NEON assembly: NEON matrix ops only. There is no 2-way NEON Keccak on
+ * AArch32 (the single-stream permutation already uses all 32 d-registers), so
+ * matrix A rows are generated one at a time (FRODOKEM_ROW_MULT is 1). Requires
+ * NEON (-mfpu=neon) - excludes Thumb2, ARMv6 and other non-NEON ARM targets. */
+#elif defined(WOLFSSL_ARMASM) && !defined(WOLFSSL_ARMASM_THUMB2) && \
+      !defined(WOLFSSL_ARMASM_NO_NEON) && \
+      (defined(__ARM_NEON) || defined(__ARM_NEON__))
+    #define FRODOKEM_HAVE_NEON_ASM
+/* ARMv7 Thumb2 assembly: matrix ops using the packed dual-16-bit DSP
+ * instructions (no NEON). Two coefficients per 32-bit register. Requires the
+ * DSP extension (__ARM_FEATURE_DSP, e.g. Cortex-M4/M7/R) - the CDF sampler
+ * stays on the C path. Matrix A rows are generated one at a time. */
+#elif defined(WOLFSSL_ARMASM) && defined(WOLFSSL_ARMASM_THUMB2) && \
+      defined(__ARM_FEATURE_DSP)
+    #define FRODOKEM_HAVE_THUMB2_ASM
+/* AArch32 (A32) scalar assembly: the same packed dual-16-bit matrix ops as the
+ * Thumb2 path, in A32 encoding, for ARMv7-A without NEON (reached only when the
+ * NEON branch above did not match, i.e. NEON is absent or disabled via
+ * WOLFSSL_ARMASM_NO_NEON) when the 32-bit SIMD instructions (SMLAD/SADD16/PKHBT)
+ * are present. The CDF sampler stays on the C path. Matrix A rows are generated
+ * one at a time. */
+#elif defined(WOLFSSL_ARMASM) && !defined(__aarch64__) && \
+      !defined(WOLFSSL_ARMASM_THUMB2) && defined(__ARM_FEATURE_SIMD32)
+    #define FRODOKEM_HAVE_ARM32_SIMD32_ASM
+#endif
+
+/* The ARM asm variants (AArch64 NEON, AArch32 NEON/Thumb2/SIMD32) present the
+ * same matrix-op interface. Alias them to arch-neutral names so the dispatch
+ * has a single ARM path; each call generates FRODOKEM_ROW_MULT A rows (four on
+ * AArch64 NEON, one on AArch32). The CDF sampler is NEON-only. */
+#if defined(FRODOKEM_HAVE_NEON_ASM)
+    #define FRODOKEM_HAVE_ARM_ASM
+    #define frodokem_add_arm                frodokem_add_neon
+    #define frodokem_sa_accum_arm           frodokem_sa_accum_neon
+    #define frodokem_as_accum_arm           frodokem_as_accum_neon
+    #define frodokem_mul_bs_arm             frodokem_mul_bs_neon
+    #define frodokem_mul_add_sb_plus_e_arm  frodokem_mul_add_sb_plus_e_neon
+#elif defined(FRODOKEM_HAVE_THUMB2_ASM)
+    #define FRODOKEM_HAVE_ARM_ASM
+    #define frodokem_add_arm                frodokem_add_thumb2
+    #define frodokem_sa_accum_arm           frodokem_sa_accum_thumb2
+    #define frodokem_as_accum_arm           frodokem_as_accum_thumb2
+    #define frodokem_mul_bs_arm             frodokem_mul_bs_thumb2
+    #define frodokem_mul_add_sb_plus_e_arm  frodokem_mul_add_sb_plus_e_thumb2
+#elif defined(FRODOKEM_HAVE_ARM32_SIMD32_ASM)
+    #define FRODOKEM_HAVE_ARM_ASM
+    #define frodokem_add_arm                frodokem_add_simd32
+    #define frodokem_sa_accum_arm           frodokem_sa_accum_simd32
+    #define frodokem_as_accum_arm           frodokem_as_accum_simd32
+    #define frodokem_mul_bs_arm             frodokem_mul_bs_simd32
+    #define frodokem_mul_add_sb_plus_e_arm  frodokem_mul_add_sb_plus_e_simd32
+#endif
+
+/* AArch64 SVE: a length-agnostic scalable-vector S * A accumulate, emitted
+ * into armv8-frodokem-asm.S alongside NEON. Compiled only when explicitly
+ * enabled (WOLFSSL_FRODOKEM_SVE) and selected at run time by an AT_HWCAP
+ * check, since SVE is optional per CPU (NEON is the always-present fallback).
+ * Not available under inline assembly (WOLFSSL_ARMASM_INLINE): the SVE
+ * routines are only emitted into the .S file, not the inline C twin, so inline
+ * builds fall back to NEON. */
+#if defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__) && \
+    defined(WOLFSSL_FRODOKEM_SVE) && !defined(WOLFSSL_ARMASM_INLINE)
+    #define FRODOKEM_HAVE_SVE
+#endif
+
+/* AArch64 SME: the B * S product via the ZA-tile integer outer product (UMOPA),
+ * emitted into armv8-frodokem-asm.S alongside NEON. Compiled only when
+ * explicitly enabled (WOLFSSL_FRODOKEM_SME) and selected at run time by an
+ * AT_HWCAP2 check. The MOPA needs the B/S matrices in an interleaved layout, so
+ * the wrapper transposes into a scratch buffer first. Not available under
+ * inline assembly (see FRODOKEM_HAVE_SVE): the SME routines are only in the .S
+ * file. */
+#if defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__) && \
+    defined(WOLFSSL_FRODOKEM_SME) && !defined(WOLFSSL_ARMASM_INLINE)
+    #define FRODOKEM_HAVE_SME
+#endif
+
+/* ARMv8 AES matrix-A generation via the crypto extension (AESE/AESMC), emitted
+ * into armv8-frodokem-asm.S (AArch64) or armv8-32-frodokem-asm.S (AArch32).
+ * Available whenever the ARMv8 AES hardware crypto is present and the NEON
+ * matrix path is compiled (AArch32 also requires NEON) - the crypto condition
+ * wc_AesEcbEncrypt uses. A single frodokem_gen_a_rows_aes_arm name aliases the
+ * arch-specific routine so the dispatch has one AES A-gen call. Not available
+ * under inline assembly (WOLFSSL_ARMASM_INLINE): the generator is only in the
+ * .S file, not the inline C twin, so inline builds fall back to the per-row C
+ * AES A-generator (frodokem_gen_a_rows_aes). */
+#if defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__) && \
+    defined(WOLFSSL_FRODOKEM_AES) && !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO) && \
+    !defined(WOLFSSL_ARMASM_INLINE)
+    #define FRODOKEM_HAVE_ARM64_AES_ASM
+    #define FRODOKEM_HAVE_ARM_AES_ASM
+    #define frodokem_gen_a_rows_aes_arm  frodokem_gen_a_rows_aes_arm64
+#elif defined(FRODOKEM_HAVE_NEON_ASM) && !defined(__aarch64__) && \
+    !defined(WOLFSSL_ARMASM_THUMB2) && defined(WOLFSSL_FRODOKEM_AES) && \
+    !defined(WOLFSSL_ARMASM_NO_HW_CRYPTO) && !defined(WOLFSSL_ARMASM_INLINE)
+    #define FRODOKEM_HAVE_ARM32_AES_ASM
+    #define FRODOKEM_HAVE_ARM_AES_ASM
+    #define frodokem_gen_a_rows_aes_arm  frodokem_gen_a_rows_aes_arm32
+#endif
+
+/* The A-row scratch buffer holds this many rows: the number of A rows generated
+ * per generator call (also the outer accumulate loop's row step), used by both
+ * the SHAKE and AES paths; the runtime path is chosen by CPU features. On x86
+ * this matches the fused accumulate width (8 with AVX512, 4 with AVX2). On
+ * AArch64 the AES generator batches four rows so its AES-ECB loop keeps enough
+ * blocks in flight to saturate the crypto unit; the driver then accumulates them
+ * FRODOKEM_AS_ACCUM_ROWS (two) at a time. */
+#if defined(FRODOKEM_HAVE_MATRIX_ASM_AVX512)
+    #define FRODOKEM_ROW_MULT   8
+#elif defined(USE_INTEL_SPEEDUP)
+    #define FRODOKEM_ROW_MULT   4
+#elif defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__)
+    #define FRODOKEM_ROW_MULT   4
+#else
+    /* AArch32 NEON and the portable C path both consume one A row per call. */
+    #define FRODOKEM_ROW_MULT   1
+#endif
+
+/* Number of A rows a single fused A * S / S * A accumulate call consumes on the
+ * ARM paths. The AArch64 accumulate (NEON, and the runtime-interchangeable
+ * SVE/SME variants) fuses two rows; AArch32 and the portable C path do one.
+ * FRODOKEM_ROW_MULT is a multiple of this, so a generated batch of rows is
+ * accumulated this many at a time. */
+#if defined(FRODOKEM_HAVE_NEON_ASM) && defined(__aarch64__)
+    #define FRODOKEM_AS_ACCUM_ROWS  2
+#else
+    #define FRODOKEM_AS_ACCUM_ROWS  1
+#endif
+
+
+/* Run-time parameters for a FrodoKEM parameter set. */
+struct FrodoKemParams {
+    /* Number of rows/columns in the big matrix A. */
+    int n;
+    /* Number of bits per coefficient - log2 of the modulus q. */
+    int d;
+    /* Mask to reduce a value modulo q (q - 1). */
+    word16 qMask;
+    /* Number of bits extracted per coefficient in Encode/Decode. */
+    int b;
+    /* Cumulative distribution table for error sampling. */
+    const word16* cdf;
+    /* Number of entries in the CDF table. */
+    int cdfLen;
+    /* Length of s / pkh / shared secret / message in bytes (lensec / 8). */
+    int lenSec;
+    /* Use SHAKE256 (1) or SHAKE128 (0) for the hashing function SHAKE. */
+    int useShake256;
+    /* Encoded public key size in bytes (base parameter set only). */
+    int pkSize;
+    /* Encoded private key size in bytes (base parameter set only). */
+    int skSize;
+    /* Length of seedSE in bytes (lenSE / 8). */
+    int lenSE;
+    /* Length of salt in bytes (lensalt / 8). 0 for eFrodoKEM (ephemeral). */
+    int lenSalt;
+    /* Ciphertext size in bytes (depends on salt length). */
+    int ctSize;
+    /* Generate matrix A with AES-128 (1) or SHAKE-128 (0). */
+    int useAes;
+};
+
+
+/* Low-level matrix and encoding operations (wc_frodokem_mat.c). */
+
+WOLFSSL_LOCAL void frodokem_init(void);
+
+WOLFSSL_LOCAL void frodokem_pack(byte* out, const word16* in, int nElem, int d);
+WOLFSSL_LOCAL void frodokem_unpack(word16* out, const byte* in, int nElem,
+    int d);
+WOLFSSL_LOCAL void frodokem_store_matrix(byte* out, const word16* mat, int cnt);
+WOLFSSL_LOCAL void frodokem_load_matrix(word16* mat, const byte* in, int cnt);
+
+WOLFSSL_LOCAL void frodokem_key_encode(word16* c, const byte* msg, int d,
+    int bits);
+WOLFSSL_LOCAL void frodokem_key_decode(byte* msg, const word16* c,
+    const FrodoKemParams* p);
+
+WOLFSSL_LOCAL int frodokem_shake(const FrodoKemParams* p, wc_Shake* shake,
+    const byte* in0, word32 len0, const byte* in1, word32 len1, byte* out,
+    word32 outLen);
+WOLFSSL_LOCAL int frodokem_shake_oneshot(const FrodoKemParams* p,
+    wc_Shake* shake, const byte* in, word32 inLen, byte* out, word32 outLen);
+/* seedA = SHAKE(z); z and seedA are both FRODOKEM_SEEDA_SZ bytes, so this is
+ * just the one-shot path with those fixed lengths. */
+#define frodokem_shake_seeda(p, shake, in, out)                     \
+    frodokem_shake_oneshot(p, shake, in, FRODOKEM_SEEDA_SZ, out,     \
+        FRODOKEM_SEEDA_SZ)
+/* seedSE || k = SHAKE(pkh || u || salt, lenSE + lensec). pkh is lensec bytes;
+ * uSalt is u (lensec) followed by salt (lensalt). */
+#define frodokem_gen_seedse_k(p, shake, pkh, uSalt, out)            \
+    frodokem_shake(p, shake, pkh, (word32)(p)->lenSec, uSalt,       \
+        (word32)((p)->lenSec + (p)->lenSalt), out,                  \
+        (word32)((p)->lenSE + (p)->lenSec))
+
+WOLFSSL_LOCAL int frodokem_gen_noise(const FrodoKemParams* p, wc_Shake* shake,
+    const byte* seInput, byte* tmp, word16* mat0, int cnt0, word16* mat1,
+    int cnt1);
+
+/* Compute out += A * S + E (keygen) and out += S * A + E (encaps/decaps),
+ * generating matrix A a row (batch) at a time. seedA, the parameters and the
+ * SHAKE / AES objects for matrix-A generation are taken from key. */
+WOLFSSL_LOCAL int frodokem_mul_add_as_plus_e(FrodoKemKey* key, word16* out,
+    const word16* s, word16* row);
+WOLFSSL_LOCAL int frodokem_mul_add_sa_plus_e(FrodoKemKey* key, word16* out,
+    const word16* s, word16* row);
+WOLFSSL_LOCAL void frodokem_mul_add_sb_plus_e(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_mul_bs(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_add(word16* a, const word16* b, int qmask);
+
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+/* Mask cnt contiguous matrix-A coefficients with qmask in one AVX2 pass - the
+ * mod-q reduction for the 640 SHAKE path (q == 2^15). cnt is a coefficient
+ * count; any leftover after the 16-wide loop is masked one word at a time. */
+WOLFSSL_LOCAL void frodokem_a_rows_reduce_avx2(word16* rows, word32 cnt,
+    int qmask);
+/* Assembly S*A / A*S accumulate for four generated A rows at once (AVX2). */
+WOLFSSL_LOCAL void frodokem_sa_accum_avx2(word16* out, const word16* s,
+    const word16* row, int j, int n);
+WOLFSSL_LOCAL void frodokem_as_accum_avx2(word16* out, const word16* s,
+    const word16* row, int i, int n);
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_VAES
+/* Assembly AES-128-ECB matrix-A row generation + mod-q reduction for cnt rows
+ * (AVX2 + VAES). Builds the counter blocks in registers, ECB-encrypts and
+ * masks; in is unused. ks is the eleven expanded AES-128 round keys (Aes.key).
+ * n must be a multiple of 8 (cnt need not be). */
+WOLFSSL_LOCAL void frodokem_gen_a_rows_aes_avx2(byte* in, word16* out,
+    const byte* ks, int i, int cnt, int n, int qmask);
+#endif
+/* Assembly AES-128-ECB matrix-A row generation + mod-q reduction for cnt rows
+ * (AVX + AES-NI, no VAES). Builds the AES-ECB counter blocks in registers (no
+ * memory build pass), encrypts eight at a time and folds the mask into the
+ * store. Used when AVX2 is present but VAES is not (pre-Ice-Lake Intel,
+ * pre-Zen4 AMD). in is unused (kept for signature parity); out receives the
+ * cnt*n coefficients. ks is the eleven expanded AES-128 round keys (Aes.key).
+ * Handles any n that is a multiple of 8 (cnt and n need not be 8-aligned). */
+WOLFSSL_LOCAL void frodokem_gen_a_rows_aes_aesni(byte* in, word16* out,
+    const byte* ks, int i, int cnt, int n, int qmask);
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+/* Assembly S * A / A * S accumulate for eight generated A rows at once
+ * (AVX512). */
+WOLFSSL_LOCAL void frodokem_sa_accum_avx512(word16* out, const word16* s,
+    const word16* row, int j, int n);
+WOLFSSL_LOCAL void frodokem_as_accum_avx512(word16* out, const word16* s,
+    const word16* row, int i, int n);
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_VAES
+/* Assembly AES-128-ECB matrix-A row generation + mod-q reduction for cnt rows
+ * (AVX512 + VAES). Builds the input blocks, ECB-encrypts and masks; in may
+ * alias out. ks is the eleven expanded AES-128 round keys (Aes.key). cnt*2*n
+ * must be a multiple of 256 (holds for cnt == 8). */
+WOLFSSL_LOCAL void frodokem_gen_a_rows_aes_avx512(byte* in, word16* out,
+    const byte* ks, int i, int cnt, int n, int qmask);
+#endif
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM
+/* AVX2 nbar x nbar matrix ops (B*S, S*B+E, add). */
+WOLFSSL_LOCAL void frodokem_mul_bs_avx2(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_mul_add_sb_plus_e_avx2(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_add_avx2(word16* a, const word16* b, int qmask);
+WOLFSSL_LOCAL void frodokem_sample_avx2(word16* mat, int cnt,
+    const word16* cdf, int cdflen);
+#endif
+#ifdef FRODOKEM_HAVE_MATRIX_ASM_AVX512
+/* AVX512 nbar x nbar matrix ops (B*S, S*B+E, add). */
+WOLFSSL_LOCAL void frodokem_mul_bs_avx512(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_mul_add_sb_plus_e_avx512(word16* out,
+    const word16* b, const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_add_avx512(word16* a, const word16* b, int qmask);
+WOLFSSL_LOCAL void frodokem_sample_avx512(word16* mat, int cnt,
+    const word16* cdf, int cdflen);
+#endif
+#ifdef FRODOKEM_HAVE_SHAKE_NEON
+/* AArch64 NEON Keccak-f[1600] permutation on two interleaved states at once
+ * (state[0..24] and state[25..49]) - matrix-A SHAKE generates two rows at a
+ * time. */
+WOLFSSL_LOCAL void frodokem_sha3_x2_neon(word64* state);
+#ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
+/* SHA3-crypto-extension twin of frodokem_sha3_x2_neon (EOR3/RAX1/XAR/BCAX),
+ * used at run time when the CPU reports FEAT_SHA3. */
+WOLFSSL_LOCAL void frodokem_sha3_x2_crypto(word64* state);
+#endif
+#endif
+#ifdef FRODOKEM_HAVE_NEON_ASM
+/* AArch64/AArch32 NEON matrix operations. sa/as accumulate FRODOKEM_ROW_MULT
+ * generated A rows per call (two on AArch64, one on AArch32); the rest match the
+ * Intel routines. */
+WOLFSSL_LOCAL void frodokem_sa_accum_neon(word16* out, const word16* s,
+    const word16* row, int j, int n);
+WOLFSSL_LOCAL void frodokem_sa_accum_x4_neon(word16* out, const word16* s,
+    const word16* row, int j, int n);
+WOLFSSL_LOCAL void frodokem_as_accum_neon(word16* out, const word16* s,
+    const word16* row, int i, int n);
+WOLFSSL_LOCAL void frodokem_as_accum_x4_neon(word16* out, const word16* s,
+    const word16* row, int i, int n);
+WOLFSSL_LOCAL void frodokem_mul_bs_neon(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_mul_add_sb_plus_e_neon(word16* out,
+    const word16* b, const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_add_neon(word16* a, const word16* b, int qmask);
+WOLFSSL_LOCAL void frodokem_sample_neon(word16* mat, int cnt,
+    const word16* cdf, int cdflen);
+#endif
+#ifdef FRODOKEM_HAVE_ARM64_AES_ASM
+/* AArch64 AES-128-ECB matrix-A row generation + mod-q reduction for cnt rows
+ * (ARMv8 crypto extension). Builds the input blocks, ECB-encrypts and masks; in
+ * may alias out. ks is the eleven expanded AES-128 round keys (Aes.key). cnt*2*n
+ * must be a multiple of 64 (holds for cnt == 2). */
+WOLFSSL_LOCAL void frodokem_gen_a_rows_aes_arm64(byte* in, word16* out,
+    const byte* ks, int i, int cnt, int n, int qmask);
+#endif
+#ifdef FRODOKEM_HAVE_ARM32_AES_ASM
+/* AArch32 AES-128-ECB matrix-A row generation + mod-q reduction for cnt rows
+ * (ARMv8 crypto extension). Builds the input blocks, ECB-encrypts and masks; in
+ * may alias out. ks is the eleven expanded AES-128 round keys (Aes.key). cnt*2*n
+ * must be a multiple of 32 (holds for cnt == 1). */
+WOLFSSL_LOCAL void frodokem_gen_a_rows_aes_arm32(byte* in, word16* out,
+    const byte* ks, int i, int cnt, int n, int qmask);
+#endif
+#ifdef FRODOKEM_HAVE_THUMB2_ASM
+/* ARMv7 Thumb2 packed dual-16-bit matrix operations (no NEON). sa/as accumulate
+ * one A row per call; the CDF sampler stays on the C path. */
+WOLFSSL_LOCAL void frodokem_sa_accum_thumb2(word16* out, const word16* s,
+    const word16* row, int j, int n);
+WOLFSSL_LOCAL void frodokem_as_accum_thumb2(word16* out, const word16* s,
+    const word16* row, int i, int n);
+WOLFSSL_LOCAL void frodokem_mul_bs_thumb2(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_mul_add_sb_plus_e_thumb2(word16* out,
+    const word16* b, const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_add_thumb2(word16* a, const word16* b, int qmask);
+#endif
+#ifdef FRODOKEM_HAVE_ARM32_SIMD32_ASM
+/* AArch32 (A32) packed dual-16-bit matrix operations (no NEON) using the 32-bit
+ * SIMD instructions (SMLAD/SADD16/PKHBT/...), the A32 encoding of the same
+ * kernels as the Thumb2 path. sa/as accumulate one A row per call; the CDF
+ * sampler stays on the C path. */
+WOLFSSL_LOCAL void frodokem_sa_accum_simd32(word16* out, const word16* s,
+    const word16* row, int j, int n);
+WOLFSSL_LOCAL void frodokem_as_accum_simd32(word16* out, const word16* s,
+    const word16* row, int i, int n);
+WOLFSSL_LOCAL void frodokem_mul_bs_simd32(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_mul_add_sb_plus_e_simd32(word16* out,
+    const word16* b, const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_add_simd32(word16* a, const word16* b, int qmask);
+#endif
+#ifdef FRODOKEM_HAVE_SVE
+/* AArch64 SVE scalable-vector matrix accumulates (two A rows per call, matching
+ * the NEON interface). Length-agnostic: run on any SVE vector length. */
+WOLFSSL_LOCAL void frodokem_sa_accum_sve(word16* out, const word16* s,
+    const word16* row, int j, int n);
+WOLFSSL_LOCAL void frodokem_as_accum_sve(word16* out, const word16* s,
+    const word16* row, int i, int n);
+WOLFSSL_LOCAL void frodokem_mul_bs_sve(word16* out, const word16* b,
+    const word16* s, int n, int qmask);
+WOLFSSL_LOCAL void frodokem_add_sve(word16* a, const word16* b, int qmask);
+#endif
+#ifdef FRODOKEM_HAVE_SME
+/* AArch64 SME B * S (nbar x nbar) via the ZA-tile UMOPA. bt/st are B and S in
+ * the interleaved MOPA layout (bt[t*nbar*2 + 2*i + e] = b[i*n + 2*t + e]). */
+WOLFSSL_LOCAL void frodokem_mul_bs_sme(word16* out, const word16* bt,
+    const word16* st, int n, int qmask);
+/* AArch64 SME S * A accumulate (two A rows) via the ZA-tile UMOPA tiled over the
+ * n columns. sc is the S column pair (sc[2*i + e] = s[i*n + j + e], 2*nbar
+ * word16); row is the natural pair of A rows (the interleave is done in-asm). */
+WOLFSSL_LOCAL void frodokem_sa_accum_sme(word16* out, const word16* sc,
+    const word16* row, int n);
+/* AArch64 SME A * S accumulate (two A rows) via the ZA-tile UMOPA. at/st are the
+ * A rows and S in the interleaved MOPA layout (at[t*4 + 2*r + e] = row[r*n + 2*t
+ * + e], st[t*nbar*2 + 2*k + e] = s[k*n + 2*t + e]). */
+WOLFSSL_LOCAL void frodokem_as_accum_sme(word16* out, const word16* at,
+    const word16* st, int i, int n);
+#endif
+
+#ifdef __cplusplus
+    } /* extern "C" */
+#endif
+
+#endif /* WOLFSSL_HAVE_FRODOKEM */
+
+#endif /* WOLF_CRYPT_WC_FRODOKEM_MAT_H */

From 78df69d051d11983310eb2ad49d81a02d7812e1e Mon Sep 17 00:00:00 2001
From: Sean Parkinson <sean@wolfssl.com>
Date: Mon, 13 Jul 2026 16:10:42 +1000
Subject: [PATCH 2/2] FrodoKEM: ASN.1 keys, X.509 certicates

Added support for encoding and decoding keys in ASN.1.
Added support for X.509 certificates and CSRs.
Generated certificates and CSRs. Not fo FrodoKEM-640 as is not in the specs.
---
 .wolfssl_known_macro_extras                   |   1 +
 certs/frodokem/README.txt                     |  42 +
 certs/frodokem/frodokem-ca-ecc-cert.der       | Bin 0 -> 535 bytes
 certs/frodokem/frodokem-ca-ecc-cert.pem       |  14 +
 certs/frodokem/frodokem-ca-ecc-key.der        | Bin 0 -> 121 bytes
 certs/frodokem/frodokem-ca-ecc-key.pem        |   5 +
 certs/frodokem/frodokem1344-cert.der          | Bin 0 -> 21997 bytes
 certs/frodokem/frodokem1344-cert.pem          | 461 +++++++++
 certs/frodokem/frodokem1344-key.der           | Bin 0 -> 43115 bytes
 certs/frodokem/frodokem1344-key.pem           | 901 ++++++++++++++++++
 certs/frodokem/frodokem1344-req.der           | Bin 0 -> 21749 bytes
 certs/frodokem/frodokem1344-req.pem           | 456 +++++++++
 certs/frodokem/frodokem1344_pub-spki.der      | Bin 0 -> 21541 bytes
 certs/frodokem/frodokem976-cert.der           | Bin 0 -> 16107 bytes
 certs/frodokem/frodokem976-cert.pem           | 338 +++++++
 certs/frodokem/frodokem976-key.der            | Bin 0 -> 31323 bytes
 certs/frodokem/frodokem976-key.pem            | 655 +++++++++++++
 certs/frodokem/frodokem976-req.der            | Bin 0 -> 15859 bytes
 certs/frodokem/frodokem976-req.pem            | 333 +++++++
 certs/frodokem/frodokem976_pub-spki.der       | Bin 0 -> 15653 bytes
 certs/frodokem/gen_frodokem.c                 | 241 +++++
 certs/frodokem/include.am                     |  31 +
 certs/include.am                              |   1 +
 certs/renewcerts.sh                           |  15 +
 doc/dox_comments/header_files/wc_frodokem.h   |  15 +-
 scripts/asn1_oid_sum.pl                       |  20 +
 tests/api/test_frodokem.c                     | 475 ++++++++-
 tests/api/test_frodokem.h                     |  12 +-
 wolfcrypt/src/asn.c                           | 353 ++++++-
 wolfcrypt/src/asn_orig.c                      |  15 +-
 wolfcrypt/src/cryptocb.c                      |  11 +-
 wolfcrypt/src/port/arm/armv8-frodokem-asm.S   |   4 +-
 wolfcrypt/src/port/arm/armv8-frodokem-asm.asm |   2 +-
 wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c |   4 +-
 wolfcrypt/src/wc_frodokem.c                   | 393 +++++++-
 wolfcrypt/test/test.c                         | 133 ++-
 wolfssl/wolfcrypt/asn.h                       |   6 +-
 wolfssl/wolfcrypt/asn_public.h                |   3 +-
 wolfssl/wolfcrypt/cryptocb.h                  |   9 +-
 wolfssl/wolfcrypt/memory.h                    |   6 +-
 wolfssl/wolfcrypt/oid_sum.h                   |  36 +-
 wolfssl/wolfcrypt/settings.h                  |   2 +
 wolfssl/wolfcrypt/types.h                     |   7 +-
 wolfssl/wolfcrypt/wc_frodokem.h               |  24 +
 44 files changed, 4958 insertions(+), 66 deletions(-)
 create mode 100644 certs/frodokem/README.txt
 create mode 100644 certs/frodokem/frodokem-ca-ecc-cert.der
 create mode 100644 certs/frodokem/frodokem-ca-ecc-cert.pem
 create mode 100644 certs/frodokem/frodokem-ca-ecc-key.der
 create mode 100644 certs/frodokem/frodokem-ca-ecc-key.pem
 create mode 100644 certs/frodokem/frodokem1344-cert.der
 create mode 100644 certs/frodokem/frodokem1344-cert.pem
 create mode 100644 certs/frodokem/frodokem1344-key.der
 create mode 100644 certs/frodokem/frodokem1344-key.pem
 create mode 100644 certs/frodokem/frodokem1344-req.der
 create mode 100644 certs/frodokem/frodokem1344-req.pem
 create mode 100644 certs/frodokem/frodokem1344_pub-spki.der
 create mode 100644 certs/frodokem/frodokem976-cert.der
 create mode 100644 certs/frodokem/frodokem976-cert.pem
 create mode 100644 certs/frodokem/frodokem976-key.der
 create mode 100644 certs/frodokem/frodokem976-key.pem
 create mode 100644 certs/frodokem/frodokem976-req.der
 create mode 100644 certs/frodokem/frodokem976-req.pem
 create mode 100644 certs/frodokem/frodokem976_pub-spki.der
 create mode 100644 certs/frodokem/gen_frodokem.c
 create mode 100644 certs/frodokem/include.am

diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index f682cdfcd17..4cf3e477328 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -840,6 +840,7 @@ WOLFSSL_EXTRA
 WOLFSSL_FORCE_OCSP_NONCE_CHECK
 WOLFSSL_FRDM_K64
 WOLFSSL_FRDM_K64_JENKINS
+WOLFSSL_FRODOKEM_NO_ASN1
 WOLFSSL_FUNC_TIME
 WOLFSSL_FUNC_TIME_LOG
 WOLFSSL_GEN_CERT
diff --git a/certs/frodokem/README.txt b/certs/frodokem/README.txt
new file mode 100644
index 00000000000..a2ea67d0f17
--- /dev/null
+++ b/certs/frodokem/README.txt
@@ -0,0 +1,42 @@
+FrodoKEM test key material for wolfSSL tests.
+
+IMPORTANT - these files are NOT generated by OpenSSL.
+
+FrodoKEM is a Key Encapsulation Mechanism (KEM). Neither OpenSSL nor the
+liboqs oqs-provider expose it as a certificate / key-encoding algorithm with
+the ISO/IEC 18033-2 key OIDs (arc 1.0.18033.2.2.7.x) that wolfSSL uses - their
+FrodoKEM support is KEM-only, for TLS key exchange, and is not going to be
+present as a signature/certificate algorithm. So, unlike the ML-DSA material
+in certs/mldsa/ (produced with OpenSSL 3.5+), these fixtures are generated by
+wolfSSL itself using wc_MakeCert_ex() / wc_MakeCertReq_ex().
+
+A KEM public key cannot sign, so the certificate and the request are signed by
+an ECC (P-256) issuer key; the FrodoKEM key is only ever the subject public
+key.
+
+Files (material is provided for parameter sets N in {976, 1344}; the 640 set
+has no standardised OID and cannot be encoded):
+  gen_frodokem.c              Generator (the "regeneration" tool; see below).
+  frodokem-ca-ecc-key.der     ECC P-256 issuer (CA) private key (DER / PEM).
+  frodokem-ca-ecc-key.pem
+  frodokem-ca-ecc-cert.der    Self-signed ECC issuer (CA) certificate.
+  frodokem-ca-ecc-cert.pem
+  frodokem<N>-key.der         FrodoKEM-<N> (SHAKE) private key, PKCS#8.
+  frodokem<N>-key.pem
+  frodokem<N>_pub-spki.der    FrodoKEM-<N> public key, SubjectPublicKeyInfo.
+  frodokem<N>-cert.der        FrodoKEM-<N> leaf certificate signed by the ECC
+  frodokem<N>-cert.pem        CA (subject key is FrodoKEM, signature is ECDSA).
+  frodokem<N>-req.der         FrodoKEM-<N> certificate request (PKCS#10),
+  frodokem<N>-req.pem         signed by the ECC key.
+
+Regenerating:
+  wolfSSL must be built with (at least):
+    --enable-experimental --enable-frodokem --enable-certgen --enable-certreq
+    --enable-certext --enable-keygen --enable-ecc
+    CPPFLAGS="-DHAVE_PKCS8 -DWOLFSSL_DER_TO_PEM"
+  then:
+    cc gen_frodokem.c -lwolfssl -o gen_frodokem
+    (cd certs/frodokem && ./gen_frodokem)
+
+  The keys are generated fresh each run, so the output bytes differ every time;
+  the committed copies are a stable snapshot for the test suite.
diff --git a/certs/frodokem/frodokem-ca-ecc-cert.der b/certs/frodokem/frodokem-ca-ecc-cert.der
new file mode 100644
index 0000000000000000000000000000000000000000..631de706f2c8d440fb9e138062ce56f91ddf1c6d
GIT binary patch
literal 535
zcmXqLViGoJV%)ianTe5!NkH$A&yl&B`-N<C+hz62Bq9yC*f_M>JkHs&Ff$nx8gd(O
zvN4CUun9AT1{(?(@PRlSJnX*tc_oQ?i7*j%9(Jevs?^-XJeUX<4|{ojPFirVk0GxC
zH%J#Z4@*dDafzX<fi#HA%p>Afl%JCC?dq!l5?63_c2;n9G*FV@H!?6XGcY$aGB7bT
zH@1iZ3K#+f%nU7|0t4Z!NCROuc5t{bF+u}~nUS5@iGgKW*2(<`Ez@s)JbR`!swBq2
zMj&LZQEF~UsczD3(TQ@a=Ra%?f1rOko>g>(;w&$=$-y$x9I+R+$`w7X{IzCr#H_{o
z2D%13z#x$oW??m8W@P+tAPeI0v52vVJPupJR{Z0+Uyh04qej<Mi|8-fH;`k9*@MBr
zl}VA|OYte!y*l%i7!98GG+GvIEc-u=srgBSf$VhY)a<bKZYBkXu-;Q`qHUZrgr@R(
Z&I+6~Bl5KIR;kXKBfigS7OSm_0RV)Ol0yIh

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem-ca-ecc-cert.pem b/certs/frodokem/frodokem-ca-ecc-cert.pem
new file mode 100644
index 00000000000..231ab210855
--- /dev/null
+++ b/certs/frodokem/frodokem-ca-ecc-cert.pem
@@ -0,0 +1,14 @@
+-----BEGIN CERTIFICATE-----
+MIICEzCCAbmgAwIBAgIQLsJMxJ0pvxI9bYcdLnYYWTAKBggqhkjOPQQDAjBxMQsw
+CQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQ
+MA4GA1UECgwHd29sZlNTTDENMAsGA1UECwwEVGVzdDEdMBsGA1UEAwwURnJvZG9L
+RU0gVGVzdCBFQ0MgQ0EwIhgPMjAyNjA3MTIwNDE3MzhaGA8yMTI2MDYxOTA0MTcz
+OFowcTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxDTALBgNVBAsMBFRlc3QxHTAbBgNVBAMM
+FEZyb2RvS0VNIFRlc3QgRUNDIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
+lmrJv8E5Z9nxzcyFWnRcQDwQVK0yZW10dS1i2xWRHquf4YNX4C/TXwUVqCGaSgaT
+UxwbCF3QtR5y43n6rKNYmqMvMC0wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU41ak
+BnP4505sNDHigUVlOFv0K9gwCgYIKoZIzj0EAwIDSAAwRQIhAPRzykW9LJ8iATDl
+jIE5crF2/5YCg+RYMB2XG2VrVoeLAiBAVo3KhhWGCZgSlQ1JmlGSmFnLM7UaiXzE
+TeZ8oyaqXA==
+-----END CERTIFICATE-----
diff --git a/certs/frodokem/frodokem-ca-ecc-key.der b/certs/frodokem/frodokem-ca-ecc-key.der
new file mode 100644
index 0000000000000000000000000000000000000000..ee16a404d6f349358e5902a21f7aa3716270a101
GIT binary patch
literal 121
zcmV-<0EYiCcLD(c1Rx+*IBZ@|kX21vJlO)!?^dBuz}|G-;+%$Is>FU%&r_fZ1_&yK
zNX|V20SBQ(13~}<mTJkr!8vEy@y*PIT6A1MJP=f^GG%RabuD7s6_FmRpW%a7;4jl(
b1r?|vno0(fQyd!zUC^~2a^rdWtfN?(i`O#F

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem-ca-ecc-key.pem b/certs/frodokem/frodokem-ca-ecc-key.pem
new file mode 100644
index 00000000000..4688f4b55b0
--- /dev/null
+++ b/certs/frodokem/frodokem-ca-ecc-key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEICBWOGxeT5BVTVs82QLQ71ahUMDedN3inIZhqsR+U89ToAoGCCqGSM49
+AwEHoUQDQgAElmrJv8E5Z9nxzcyFWnRcQDwQVK0yZW10dS1i2xWRHquf4YNX4C/T
+XwUVqCGaSgaTUxwbCF3QtR5y43n6rKNYmg==
+-----END EC PRIVATE KEY-----
diff --git a/certs/frodokem/frodokem1344-cert.der b/certs/frodokem/frodokem1344-cert.der
new file mode 100644
index 0000000000000000000000000000000000000000..d9365c2e48fdabaa55c4b5ff49983d2ac52a206b
GIT binary patch
literal 21997
zcmcG#Q?D>g*Mzxk+qUg{+qP}nwr$(CZQHhO?|I(Ld_Q3h*Ohcq-A7$jSqy<H7Yu<a
zarwYNfIvV9ykNQDn1NbOlwes!HaLOl3{YSYRH5Rt|3H9&7#tX(86d%cRY1UyfmD<j
z5g6e9H$cFE%h=gE8`v8B9|4B}7qs&<u`#gyKLP~<?q+9gs-z^%2+IKdzf;gKAj&3A
z&WyMW*#8@WVNgUJ?TqcDL}Up5#|cD)gb0KL7>F?7nHZSZ7}yz^7+4tDnK?B71C0Lx
zHb&0>4=`B%{~!yE0p<Ud1^a)pXc?JVSQrA83IF#b6amo=KtSL?z=6t$06Ow@7q*hE
zcYQQ<#hOLdzwWQno88W*(%g`@{1Mrn`hNGyIa<_nFnmGr(KW(u4(Rqdmm=Sh#j~Dl
z-5bIFk6ESKD_;B6rAWk$580q7T(Mu+0Cp#c--~#ov=CDZ1O%(gvBe*PbTP*EL|Q>7
z+;IZX9J*w<MAs3&Tq*i<20~ttLU#N|smYfFJH+vJjE$NuhH{|$4a!yd1lB+}7lDxU
z_>#slLEg>Z_wNI0fNg^lCZ8W)qVjE$2R*U>O4!9<?1u|O#l5eLL;C+@E<KO{6v^pA
zK3NGksIotlTxUkO)UHacQXsK0)ts7$nA3b>Qs>P9^U#KE8!EoKu+lL2ofGLl><UrO
zNh4&&hD)ko3%7O!sPp}^W*7qYecXx^NkR<JqW7^xH8MHC+<~n(-orEoNY;b{mWfYX
zW{%Rm2%`}w74f|Bq&;$L3asejI@EcovmgvBjPX*Ptyz%p4R=l}KoUv9h%hx5Qkqk5
zmy**3Yiz?HzW|u38S+tw7*XLGH?xmVieHI7RJUwTX9QN|;`7U%TrnSDy}k7ji3S#I
zZIt!!)C4LJ0)bE!O#Knd%f6>ctBlQ1`5%z%<#Ll6d9vuyo)9XN@$%>tal7(cR@eYN
z@KVdfh(U*2FjAw2M3|R7Sv1Q+IlcSW^|5!7|6u3J<0K25mp3M(>X;l%oGydfZcj?1
zHK4gm77>9@Q#P{*5oAWDh0j+6Hl%|q-%fBGPBUmhTNP*8B~}$0&<i}SB+IYMz%BH{
zE~9?x$2dWmaiOc+=JmXrb<@PxNIcxhi!}WWJG<fqC^G67)-qUbnfe@?FS=r#I}2`Y
zMH>tt6t~bQR0o+AL=zIf{41E;`&uBz`-(3e@c>b@{1bfXVRhzuHtj>t&_6G!Mst%w
zvAB*5NHP(p+IupvQC&QxVZ9LXb+l%e^aknX{N|th<R{3Am_j;`|L!nV6Tr)an3^l9
z)ahg{GY{fSoGpQ|JG>o%Xl3osa<z?M^#J~%;Ne6D|5EKVheZBEdsSA%L`}#czluFr
zCeUd6e!~;YJ+o>apG#>oGv)`mPeyW_g{^b7g-qKx(qk!IPzOTRb(qwa;thv&9s&9q
zH~@{Ud?xrpdf9Vhu9nd>B-7WRRNhbGr}j*o?y5wmcGRI&M3l1mJaP)|@<9Isilk(d
zCj^Y=Qd!PdE+NZ0v0%ZEw}=Yx-$2AVP6|=OB~+5BF<(s0n@vT*3*U%n+PBsg=htdi
z>g1wGXc^`@;Kz?NDQaH@zUi#ycrrrA{OP5g?Fmwzkc=eIEQJdk2HQ4Y2`(4*pnwp1
zgN=Woxi8Fx-%X}IAGLle#R}{|k_p~NZ5^)aq@k`p=tp<u5|7QXOhVkEsEM!`06Cha
z_(05p5u`&<-(gZT<zP+$n`!rVldfEzO0cVpgTo=ZCy+50)~Hj4YF~Gwn<R|AbOR_&
zy1?kSwh1}fd0HDEQOFuMTIWG?1Z$4ibaGqy=EN=V!7;8wAe%Mx>f>JMxV)=F+Kt~&
zke}VR9Jqriu{Auu7*ZLp4^){Y6Oq2+DOtDKKaf2pqNszdW~sQi9r+c-()K$#)Ww6|
z6@8kqXfHRZ6@bt<$N?MCREuqnG0|23ytth@py^)c*f=|H3eW3A@yy{_XeS-)DU$II
zlB#JfDy7(9f5!)BxOn3qXq$pqLbI5fawxnkmSlA}uYeL<c~GW=iA0qqL4g{mOvfmy
z(?e~X1M%V1Mv+=@7hND?#c+K)rB|_vb<~aJQZBMb&7qo%yyL!Qdb@SY+#B{BWQNx{
zzAc>TFBZo6fi7B%M7-&yWWRK7r2N%EsuSC-_G2V^XQKi8LUEFaOo6zBH$-caa+eOX
zb(T(iG04Nn$|ZSvfZ({(-vp4ZUaCV&3kmK^I8;n~Z$?QC<6emT(v@K^o!pn4M4hWG
zu^eLRm%1AteWs)=#|s-*My>r2a$8kLeIh@ALy!LB{0LD1*Lhop{bmT2v<|Jj*jq7f
zqbK61@Fyb7FJn>586;;_2zJ38MhcF*IhnDFCqciIU}0%bz1LGR!Xqs)O-Fpvf|7dF
ztVh&ud(Iy{d-?N}ybebGMuyqY`Ig2$(xq3{D7FPa;9YB<WKFm&tTf?P<E?#0z=;z8
zNcTHLu~S{V^Rd^z4jwobBuFeLF|eNc&ChVY76n>7`KkR(4)MzdNOidsL!J&4i8$n=
zlx5HI9+G!WJ=RR4hd3*943gvz%~rz7jmI&8+b5zV;7*H4pU}{0lr6?0NpgEAb%dK6
zi%H+2N!{q-J(MozvRo{Ggj>9*pVJv(i&K2&BK5QO2ifZ~b3&<N7rvsD{p$xQ+z$hx
z%>&?23a-e~Pn9!h;#Y&jfdW)4k<p)pfU}v~%e4pF5i4e}Xl&=dn(ERX+tS0*4ge<#
zbW*upG<}5U9C)5w`!-<8y~|X7$1dcIk)YPIadeBr;TPH|yNzXxm5OyQ0SrJf(g$f@
zS~)s4z9Q?S0i~?S|9N(?-RH;4i}_bjd_VTWr^kI&`x(^sVHBVWxZrI#36H<=%7LL=
zk!F7r==(4#^RxhyhqdhywVZ=e+498Ch39u8GEqMQ0`R!{6)w=c$E|&bn>|#(Q1njk
z)v7zi@zNg^lASIxSD$sV|7V&D*ypk{J?*AmL|>p|kujoH^rc8P*e0qqNlLXREMY_i
z2VsNW=Z@Pi?sk}0Y5Ikm9G?hNnr(5bFh$WkbIh|orIpJ&8d_;-wf2W%9wh=Sqec~r
zi|oJc8Ft20do{JoWv?eQA6<1BGa_%vhwC}hP_tguG%~<1+PjZ0lz*oid;XoRUCFU!
zCLu|>68GsZp`cA>>52b$KPy<K3u;Z)dQE;|1D)A}DI8JE2=g4B(9Q$VxsEmXTE}j$
zu|tDics?oUABhLG)^@CdSahxz&gU0Z8RiO8hDnBCqVMw?aSxA1ASn9y<}>A{ia`74
z5QPt_jqix6;#)>7WS9pqb*Yw)`2DzV%#eo*%61xLAS%(9Sd3~mFO}Z*$XGUEHRBxz
znbffA2Ii-9_2T2Swmnr(j($w;<t|y_O76-!Ry!!9V$ahFJy{;datQW3K5&fSD^dWJ
zz9xf7IZ9Hb9~!g9-u6NR_5c!!a+t=f+qgWqMm<MxDXh<+?2+Wk`>d8oKrGuo&+(-^
zYakEA)F?7WZwGgC_6@xw^pkx<Bjb~O$d&8Rqs<~|)HbeRWEl(`B&p>xoaWA`N;V>h
z``8bW&k*WB3-FnabxwBrC{^<HI3fZrmMj_(G_Al$3k^rOMQWwCsU$5#n;CC0iT*Eg
zGT8KelXyKut1Iii6RWP~wA5XDfr7B9JD{MyexcsX(E+Sfq$AF>%=`DZ@=&ebg<@nA
zA;Ki*%(DH63=@8?>4wkhPMdBcA)hb{HJHGyM^pZdi`J;$=3Qbi#IL%e`2u(FiJOY~
zYJFKKqeqfokJg|<+1jX4ll&iLywXM66RFu|Wt_~*v$R!j>3(60Kusnyq<UfB^+=lv
zZ%oG+lP6B*w7W)0)^N5}muz!_X;W54;{4!hoeXu8W>^JkD4A1(B#4-(s!C=*7Dpc*
zxmylD9P=>vHz7s#A9k4cLi3oyzxMfaOaQFE)8K?cjN$Xb3RZm&oo?PV9?Xec^Cm=A
zAZ}oHiE=QpNu5Wg)@zi<sDb{y30Oz{X=sOm&}1ldHy)*&^FX(_mYg4*U$nJCx%RbA
zZedi99df$w76$s08g3w6)f<0I^`T!gNECxwOq2qGUb3I7vVE>4@FB5z#_no<Z|^I(
z-Vl9ljkjtA9Z71}95H@iT_uL5gL8a2s6NHQLYYSTB&@ey#zKtaqYY9gLfBEB5x3?i
zc9$5<v^ZL%ltHJo1=pz)VMMQ@;35{Ikm5m%>6bN3zb6*u9z*Bg8?ncZlk%RW!?)+*
z(cdm#9Z7#ISc~KOMp_ThObKtirr+)RZr!_H*7+L91IpTKX!Qb?5an}zN!<@^1L#XF
zG$tAxxV!V|w^;|!H!bcV`;CO-1m;@|z7j)e8g4qII`_qb@HSMIobh5r+(E2MQsINm
zSbUl&WjF$mg4Y~20)#<L`CUkYaX9E?)~gBUNDxs+iQZ@gqp0F>ua_AZGFjJJ-tFr#
zHlGCl=sw0)xg(tL%!f^>y~Z_JflqE~dO*aLG%QmwC@lgIXVFT(86IH_pjDQZ^0bE4
zdn{M84dw&LH`*wBN7I?^xq>Q$Mw))<=jM_3op*F&w)*2ww9}MX&rmx+7YF(BTP-gP
zUEbfQC&<ewBlm594stkj+Ulw(r);#{2qh;)ZCjDgz~J@bI+<_08nkHTJFEl@CxnFH
zZxDPlfb^UpGW1x*od?KiFb|AMN<Mu&@W6!Wrw*rONTYW4aU{O6-mQL8D^SNvcjjqL
zL7;km3}r`aUSXlS%G$|v@9LXXVbZ%wVq`~#i>eZACsHigmW^jLZnE?Ddf~B>)h2D$
zRMHkq$^`aU#oeD>XE&PA$1Z^vO+S=ca6&+#hkcilf$~Id3iW_PV8LI%hdlnlTFVN&
z7J<BQY}zkG*K_iDM3OgBL|wa_Ow*o!_^ZkZ3Ju~)ScU5Fync86f3r0H%^OSIoZ{@#
zwDE2Q;EiZTj%;(NRZ3AnS7%bgL0v(PR9tcRFnZb)w^EgSM(6(L{An+Yh{IM?RLMoI
zvGXK3IaI>EW>Y+Gi)R2|DV{gV|I|*W@``_PU(7MkXtLH&ABv&+BTvNu#oyXfzm2-h
z<2e&sNf@5vPKoTOio`7orMCVQkxpvwP^^JGnu&ZJ@!|x|^M!r6IDdQ8&f(i8p=E6H
zPryc$1J>iAcWh_#JAUlY0k}8D=-|is=#s`)3h&u6b*2)}xW<o&*SSqv8a`Q4zgM+l
zcUop>!rf1TSVMEO)E#=`8~=f@PYMkm($BJJ%d&eWx@Z7!`-MV`5H3eO#NgX%s2Ogc
zjsH&Br2L_=>~)~xF|t7^9yKWg*>(o1AVP4knr-MeqmT;OAvS|;^^MA|8I=sySB+g1
zV$cZlt2Gph{%A^AY~oF-$ItXu(>yM_s$ebB8<BV`cuV(u&IVyNX{AbXKKO#;NA4<o
zFvV4_D0{@yJ)MUbiCG~%-AkHh0`{dmO2#59bGhc4084%wqc#8>_hph|^O?Ikz+2L0
z!sV9&%_h4Oqa{2(^6_EIxpPM3f$&?9CTMKBHRW1bxy8Jdt}gfY_xcT#8%#;0J*Z|q
zzZ(hqaNW705H$AjYq4n;$v6X^@l4?rDyE&2nNHY~kr0NyLf;1WSA8JmNeK=Giph$U
z>?VFl2ds|!Ega5}^19$Q*5*F==iU+SD{eVY=_3ewlvZ>vcDUF$Eyb$1M6~otaDL&P
zii8=(8Eblz;~(T9n*7>&81w+u8{|F<6b-OebR>I?qGlH7;!rpN2(U!x9hzebMeDkv
zA`Ty=eBOJLx@4z5#4$sC@NBvmd~<YiG2A=2q0lIgLD|F<%wH|uYo0u}q=d5hV$r^l
zxLsL}MV5;5PWTzT;abN$I(mj|_l@EyH9Nr0gX+zRapSLSqQiF@>w+rXAQ9%bBFE#6
zO@3B8IZSM^Mg9SnvNld(3Mlii_QY7{-(;ZcwZaWOXd?3WG87fZ@V?74GS5A-8okHs
z<({t6hPVS|`CpY&<g!LZPt5HyE9Z?p7DhMn`VEbAwq-~neuhI&HKIT6k{8*0@b$L&
z(OL<T_wIWOoi|rOp^ktQMa*AdISm7B30!jc)f|KnAEskz(GZlYSrEgwn&P>?)|C9k
z5{>6H86p<U^%E|QMp@|v07)-07+WhwwEa_^54(%9Aa22E*^v>lNT?9Uur?{A{a&{a
zV(+gK_w2-!WFaKvce_637GbmE=n!`CuUd@u4f>9r$0wqv(kumUU3bh^fRNOOW)ERv
z<zy8~zkicgk6qIW^o`wu1N;}|Jd^uX?ZcopqaxUoOW@p%+z}<eXf|<(3I<Qhgx^ug
zB`Cb_B#qo_vS_HSLY%^r#fvHWI@~q%8|n(ZT)qo@44NNScXPN|AeRH#HtkPUY9h!7
znDU#cBk1LkBIdE~e^_U>S%~qp1SE^~fdl~dMD|!wjSp@^_(Ej(k2eqqUX1;?cEU+X
z_HbEOVhRx!tc4vS&MS{$ho{XqJiWL9Hw3x3S6u}|X$O(W7aoZ2s$2vbyncklcnmr9
zg>&2LD059zL8t*R5zl@{W`o`UbGQ$kF8Q>Qxzxp?h}w=ib*@$&+0v@TO2SR%YOeKG
zR+oNF85-PnaD<br?k(Ytr4gV%Oikh0pc0bD4LJUyTsTK{#Sof@c*Ems!Oviu#U8zX
zk7;^hC)|df8aro-F{iCVsDp$-Nbj6J*X9r0ZR2sh-WvEt)x#zqT3G3>Hg(-k(0S%a
z-mpSFIe6Z8u;YUid>73JrcDbyQNZMD1`n_dC|pHXfFPFWe7%$MCe{}uiJ7KM0-ZPn
zHNV=-OW<P*JxvM}rk`ZP1?8j0u+&=ElSweL+x@7@PYGdcb`Ga;AmfUFInNuog!?9N
zkXhgpf!d~**H@`+iq)QNU^nn1E#QD`&QinNbE5??61IqIUXaZIMZ;mNauY|*3;$T%
z_?vWZL^{;&r}-H9R(`lL^N^w_OI_)qHqX`M(1|}1+WXdq#Gai=`6cIcBiWI~Fq@lM
zq}P{mE;tFqYx}^^Y$1YWdB>|Y=39$+`C-Dea4iBdd`)1lY|V?z@ts^YRSY0*gGpey
zrXqm4Q`Srv32N<AF)O_nYL-Zg8MH9_yqX{FxxT)A1m5&%VD1{kAYX;u<yQ>*XggG)
zL*4-4wkdL5Y>=TBF^ghO4g#!sh4Wfoh11G)5<f?={Ckwxnh`1?fkH(*p(vZ}DLB|B
zsMJqSIEE`HzSFKsL>!3{rsP@*G}|}!;j$*&j+=r>4jEGNlLi>~7;lbw7uTDWMf1CV
z)xGV`QHFdZ-Hj1KoD39`OhZs|sm9+KbhItZD)<PXBF?&RoUK<EQW~<~l=RCn+g(@X
zscK?t*G)+{=kHW8ys{4kT*AvRTZI!NaZ&2FHlnEn5!h{T3*pUDLL4;88{2rX7koq8
zK_09+gt!z&3Q*;shqtb>8(m}Y$Ro(D0YCW%Iqf%+@8?FXgLa@8qu6J8pG)|%aY9h6
zx_z!$@#*hen8QfrQRwwU5tjYI;7Q3!N+cbzUb~KdixD5uA*Wp^sn9x#sin{ig`P;2
z>?;VG`B@v^2mbDfVBnn~ksNrh`;smr3X~8)PTWafIxl9h$-;uxpV^kFj<?y<{Y=7)
zqT)-97(tM(*Gr~U8Fp2M^MOq(7{N$h0iItTVsB*Nt8vo92eWOLIqShmy-HM!q@`;u
z#)@x(Par;NpGKv2R9CqQtzx&)JV=wgv0=@jlbmuwkj>$~pf%tl2r257*N9=2V#owk
z4{ByXi$oSW*{4FtWTkOt$hs50kIhTzPP`GGuo9=$AkR3^z6vpmkGX!zeCjRZpZSY_
z2_cG$`8R6#xi`4b89f<%1CH5pv6R#&VCd?7uTS@<1rTn_b#w?iz{LY8i9o7H9}7=0
zIYWefNt1Sl38Dr-@=9lG5$h%Hx7ZD|-0>qU$GZt!3rV%VMgi<t_Ae9x7@)|?c)d~2
zwd7+*ca=SLGtTvNBpnFE%Z6{i(EwKD)kryShH_<D=tRbPCw@swob}Vji^oYym{sZp
zY1Q{;<Uk~LV+mPg4*fN-<6Q$MrXQd5{B@gq$LOY7Q;9lRYWr%29sO*6;jiTV&qcTP
zMT*?p-hKw)1%h+ct&}#<0mEc^v6pI=CFne1Wc#M>A4(B`wMUm0G3n$t^L?22McMA!
zJ|)jMn$8f(fPGOh^|0VVq)28`>=&9m$PG_7C}ke2;&AqmtVNcG#4VnY^D)JA0!E@(
zdq7$%f~<2K`4g@#lwQTwcLVKm`RI?99chg2KnXncx%m*OG7rG{Pwq$HFX8r`DM69r
zP-GqT7^v}r``C~R`yVEzcev0MymCj;iVidyKrNlR2li4*jBp0jt)5kXUT;#&!B)8T
z{&Z&fuP_!EK*qhf3jenshKwP;<4_Sa6^A<V)LwAZ**Nuxmz=ZZh})MKH?7LYs*gGk
z-36LbtsX6E?iU_4>f|w9BSYQiXFJj7b1zMzS_2xPtOEN_`w)36-x>$~0n5<6GICB$
z^k<%;G#EUg9RztA#Nq^(E$(RDaIj;$%$lf2v9p4;lQ2pg5~vuDROUOS#u5u-Hd2P`
z>k{PHiHJdXqVVw7^27%52y#Mf&YrvO-yQ)$0DW=LSkz!iaKJle>>6Y$-_5{z0jI=w
z;%R*fDI4?sAS0)IV)W`@x1YI`YJ407oH}zst&tW21j9503(#GuS-4hss!A4Uk0;n9
z7z5-@-oopOcCsHVTSg;fr3r}UzVz{}_j%z1GmkHCWK-|*r1u?&DDFsiQHtZaTGk?A
zd^bS<4LE7c^}wIzY7gJuD}A-j$~6=pXro6yth?VQ<1Ih?KuoS|%LGnK{JWSU&r-Uh
zFJ2AcX+%?mJvjmDC_(wuVKakGKels|^z+E7Ukhq4B{@d4W6>GUG!A3_qu}h_wC>iF
zx2Q3oZQ*JJ?c&<)zYNXRvk*fR_epoY!O6l<g9a|;kxm6RZ2!Db;2oE-_(At@5v}+Q
zn+Q^rKr&S;3LSazfj{!QkfCYLJCV?)S?4+%i-(1I!?C0TDnquforZc0?HS04CB{;>
zpH%Otlx+fKrDN?G6?y(}1B+QeHJEn|;k2~f;KQ|vXauZVS45ZK^O#ZjmhHnaf#DEs
zN-&DPWZ5Bf?4nzhYLX1SfGO%inTO%;Pn(jSCXK4Z!oj!HnKK08DN@9`<-uf?aJK+e
zEdjsE=M|R|wt?0sXQE!BFbFm7SxjNXhUy+%BH_Ea90|M*%}jZ<A-XV2!0R4C(&>A#
z1Mzw5<jR*cZh*l~$5*BT_;{i;4$+8Wye{9%$CaV1Jg)EW{<U~1^z;;Hd3s_7{p?2R
z{W2^@{UN!Sy$jkK?+@(95*7isQQ{H~C~bfIP!OTGa7Dqd(5J5d{6(LYQ`UrA>yijq
z1k_xMFzc>PK?#_8jr(9w<e5u@=11P@-dqbv(FqFXu6q7PyHdj1PgKQ@;0L_y1deS2
z+J3;LFZYI{6Ulo=0TYcPzmKd2wI)%zWn8#<`MRBCII2?qUS92HhOYCOlY`!$&?-*F
z5$WAoHH8I%8k#NS9`S03R6V48^IA~Sb}2gzhpt3_tn<Wh;qtXAFaS*#!j7O6T3%YX
zbg9u_GWS=WN&0Q_kzJ7$HWJN%%sl23j^JegZ70Jhx3kt}FZ1sEF%cGtz={j_yDmWQ
zJFhy(2`oREjv#%G1{o5unxCx<fq+Nat_I@l$DiHi#Z>-)^ERP3g<G3Po?qCzfi3~E
zhx9YFyVfYEQWK|(_sc6YlgaSQuu73!DG?*M-JtWUlC`R@v*@#L?(!`3(U~LO&1u+2
zO=XFWcP#+qFhY*303#^Kg$t2`Mn>WE5q7ZB&B78KM!WUmcT!Yk0K<l~yLcG+4V8`5
z4;qz#JE#N^JIUQ*uMsS;pv|_YbK9_GTW*sW1DGEqi>l>1-xc+SL1%GQj`uc1GXban
zJpJdc6bxwU`doLJMYsMFg?5Noq7v|I03Lx-q-|3Q(B70WO`dHXXEA|&R`7_NoO=p*
zK{L~8+6T{-T~dEF@#v;Mit=4|o1OBUlT>su4u3k4gV4V<&rhV07P(@W7HB+?4z@&u
z$Uj=Hnhl>x%2Y?<?Q+TzN+{vQ@Voq|JJ&i;nwd|9G(FH0j(#{wFIlb!&9eyqKrb|?
z-~GDqa9O|OYC*YTQ)IF4A<w8e<iupprCuj5kBt<@(43};dU_c9;@D$VqJ`u=i`@Dy
zc|rkYM&w`$So~Og(adtXcHxBL1WZjnY%5ms+PIayV#b5A38FBmI^i6VaNG;I__d1~
zHPR#caH@0><LSrd5~@NaMTh|Gu0GM`ZFOw1X*YhERhm0GOY`NAhp}($)N!b_ka3|a
z?_g(XGdTd5oQPa6V^VIZYniHSJt20}=Ffz}HEf{gz8KuqGk?Cf$_vh%T+C;{peSXP
z|58r)&0IpF(pmzm&CJ;I;yxAC=+aiW*T#-ukk+UD;uY&(K921;k~CCVer5RLHiS<5
z-jkjpq#Gv-2_P~}$Al5iw63lM*BIhfcsV^>QUdVW6AXeKe#Mm(->}ImX8z8g*QQy;
zk#YjN4TU!yV#-cjT81n{8>o3cDn7snOKiBPb+6D%_@D+~aRU_qFVXWG<dG?ahc1U3
zs+KSc*{BZa6A8__`a%sr?qq?juy6zxHupeA1ccpuIbj||>8_FG*^7_Yos5<8hi`Bh
z(O?35-%ahibT#;n5mqZJ+j{UW?Px=3iyni2|0RV2#G9XDrsuX9n7wJ2yfKF%9;;=J
zTU+GeeLl#+5?dWNLmv7He$gXKFgI}R_n)ju<@RF?vygG^;EZPZC&U4|#=LW<)U*PU
z@tW8D!>!C3Dj`q}F6In&ld$4)T;`L~4*3Wk751r1O!{z_ShzYNXZ{>7z;w6w{J=I3
zp7^FCr%DSy?X9C2YIWd7MgV;OHp*zZn4JV;90je`W98Kt0D}jS*}Fgf`xTE%+;PmY
zWd4c9J!|C!#y1}UHDgV=9si6bK|sv02VSDCuAz6{IDX8E>6Kp<?CkXPS0ferrRprY
zl^9YA>d?yVfE5zE58XKo#Lp-yrxuFro59jTu;$&-^ll4UZuAn-{Uey#X{2o{DiQbV
zXTTVlDcj+*+R7g>*21=QX|N<2J)C-`Lb?XPmgh?)myApF>xr%MwH9Sg$Kze62=VZ<
zEF1V|X&M!OYM*PDRoStX$i0Fu>2ZNC!@In5UOpMex!B#T&tELMXqgx}mtZ$-Ztety
z^qJm=1bxIJw$)48eLoRWvH|VlQUGZ<@Q*+$jlW=sQ&~bkajC;f|8~#%SS~lDBU1xM
zIr*HVAXx$Oa9MIGtxj+9xMvW;g<VP5Y5{xelm+;E>ZEucT2EHdU!mZ-4}LTKN57yL
zd!0gjg@U;!2)LN%vpQv<c~)8PWw5cizgTt_DUZxddlq8+LT>L5a`nk~(Db{{E22LY
z1Msvw{y~K0Vz$3_x=Ifeq{*!I4_`H$^)c#>x5iy3%)IV&;0=9KQl>aSccX$FM6e{;
zIX|idkt;7rd^ckb+B=_R7RY#N$jq|Krxd1}gwWY+W)Q-`=%dpwrFE|ET!v>M9A*BZ
z$R>7Dt&WG;WqqKxlltI8aGFBFz`@K42MR*Acxz7WS2DSd0bUEbR?Nr#{WBYY*g2jV
z8F8&k@-EY@-OOMJuor<oQ-qizka{Q=ni(8{Gq%gL9ies&Uo>vm^fz1#Vb{u{{YhvD
zx`Q+m`6P;4U?&@_US9TBw0U9>hbH>_1-)0Wbp%{*wVTZ}TY7HT&`;lfm5{i$P1=T_
zC0jJuYjz5<T7k9^C%Vt}$)<fU<ORm_5J=gKjKv%~h{Xy(RPwH_lC17D9(1p6KODO>
z=mvY3gA91J9aPIX$Za3jKzbk;n?+M5<hV|l-t;-=y@S_K?~FHT>IWto`Ps)1bpzzB
z<0NXj^}-vf_lM<dMa_mL2%IV0s=ejjpJqR*YY*ri=>P_f=~ZS4w76g9-lQ4y!$i<V
zKArhMn|*?}JL$eBYjdC<t(~aoqTq7ab0sRiT-lSFYCE#|1}R&{(8?0gT1iErzoI(m
z07=t8<v{*FgE90g!KtjOG<|{rq`FpmiaI<6Vkbmpeo4$u;Ykh|P3}|M2&&xc1mJSO
zjJTkAp3P{>P8*aB_Nrcnv{8|w1g%SVpl#-O%)7EJn$Jq(sTHfHN6G5@mI94Q`s?~P
z!7P+hgt<V8s$AjF8j*z}ZX{XBop<OSgZ73PvVNA6${!B=(D-IeFi07pazd$%Q<>g0
zb_fkKARxud^zK*}N)5!eLisIp6}ePD%l(v@h@}y0)zNi+&xpC>+;>!U)Y6`fK@;^I
z5C9;55MN7HobW_4NoNPnDT?SgrS9YhwG>8weQ`hlZ~J(+9?v}S1sews>x`!dN)(!%
zzP5=$y{xN@D*$W+DMcQIn|l;VI3Ck7weu&$BNCB-u+a*)k#FDskWCi<_;2?I=mlDa
zn}#&@CoUCXUcw2ctdYQOB2XSR$}IUI&)kc3n$bUQzS4Zj7NQF}Vu!KN!xeIrok=Ho
zB0&?DsEC}uXx30=igaI46uFdQJhsOln<ZDhpChl5ULpkypPyVbTL~@mS|_r|_uODR
z<if5b(%(?BbEj8@V9%sXVbnH)_m`Wbl%Q*ZiYpuDJ1!b9>-@}dxwxMUUy6KV>wbsg
zOa!qz)Px!4+%$}@ddg0iH-5A*d`Z`&Fp5M7yl6f7LXe@_%r@O?Fv0Ug$Sa%IpaYe0
zzV4TtQ#Q#wgC>ct4R#wyydaMOFs%;p@=V&6GEoSn;)Y<kqzq?wILS_=>UQyGEg|So
z)~xgyDiWE;8tR-nfHY_8JXM25?CI&R8x^k4>b!)I*9I34{8*mR=>UJHD;G`Jdn)7P
zEIlW4_O6FzMaE&q8M|ZX{snp|`CEsr#eoiv+Y)ou8u>i`W2Zd)#)C$KK2vYcXzrK;
zA<@?j?bUF@Im0{uU?T#PO}Kn$lL|K9qUhPa<$BR5i~1|Xd1%iquv#!7PWfL#2LIH2
zSG9TX@7E04*tnxd!Xn$$9hv!jQe2$LuMI@bLIul^e|nB7$$pf<vwT<DF&QxAg`b+?
ze6!?}y$xnh4_HcVKtV*bu%>7s6tAPjxG_!<;902PGzu_d#mgbSgC&Dg|MT*}#f2ja
zlo`Rl0KtX8Z2{%nXGbAF`%>&{V-g(%V$yL2Tdim5&(dp7?t2o9FdCusDtOO9SknR`
zLB+4GJ)c<p-%ayA5-TsqY2FX4)a^!jg1$>GIL-ro3!+4ZHR93Bga&KVWR?AqquTl1
zvgq>p54H`3E9S_<Kv^)>LXpB9;x5h#iA9@&&-UQe62?sdI2_9n^Z1n-01pfMQ+?1&
z(v?kK$Z{ZV(i&Z-qxS6#XC(ApD>va=pFW#)P<%HQ+F_4LUi%Fh;#s45!s?v&;$D52
zUfBl=23EY~PPA6NjokhFs-uD646$QBFkVAd#x*j3FJ%yb)%*O=q`~~ci&ME+m;LX-
z0#hEnGY2(sLxoqm(@KY7?CK+)CJyix<g&yK4_^BoX%XhHuWu`e&iNw~EO+1Zpr=P`
z{x8m1MrE<gC`VvH8Qj<0OVeN@KtsHckO7}BO8}~YjB&wB{`;X;jD;Pr6X$kx`C6;E
zsX1fc{<e<Ud1L6jnTOK1GkK=28q2kD;M&v;)Ac7?8TM|r+RuyOzSy5YK-fDO9NV%T
z4zp~a<B8R89Vk@4&-q#oRDC4?O;j$Na_LGb;dI2*pIF84#L#tBq2%oEb?pM=B7$U@
zpNXjW<l>s|4VnZk0a9UE?_6SQH8jc|ca@fr1}JlhK)tt{y1xjF>;X~%rg8I&Rr-8b
zBNFR5qc|hKx2{Q&&YG4KGXc|Jlhg*Dytttb^pI8VcxC2bRMlM@f{7D>o?ccN{0w4$
z{;!Ox(!uT!eGmA0A+OBRf115)W|q|Jmx*Gsae)^iWJQ0uNHN}xw!2@+>IW<BS%FWa
zqcO4I>0$e`AS4nt(ND#~xc3wyg=~7uivTQsaq%k5gPm*OYC~`X^icDK#WTobhyziO
zcY-s2=T|($LdF}K<EwQ<JWjb>MLvd8bjQCMOCT2>gb?3K47vW79lixct^oPn&B4y9
zf2>UH;&1PQwsE!E-sq@@dtXMI+xO-Q<vm}P?lZk%wr7avC{Y^!bbhy4`<ctWX1fJy
zM`>$SdQDLN0npAfnTaV@ZLE<8AJkaEC_QCk2tgCmUZosY@4M3gf{OxH_8zI3)C(-3
z-3xf)sYH<kIX8|=f?m+da;)Husdi5_Og?1(I-n+!Tg~;*0m{k34im5^jh_l)2pU$P
z_-k@T7qU0(gvx)HhO^ivFmWicsS2|m8`RO&H4MV!rvRp!8z#`sz2y*<s|E!u^QrZx
z2pK4YIkZ$nn_s4vbg{Dv<$<G{+^a2;na49ASy4q)*W%P=bkl1C?DxvB!BT6NsmPeW
zF^4u(jy_R)#^v+zl^|R*LSEfBYErQEeUxbrgw@3KgvctBulu~~lWgFm)%6FD41=4!
zuHR^7a15~MowTzn*eUsLH+K#|*GawZy6XejZBHW`+>*o=@FM=yUEn;12Eo7AyR_|i
zPa9ucR#64C5rRStAhxDqO#PVdcy<#en}#+P8TxbjU4~MN&yiL*C$Tk1jN}b6F*Zxr
zo(f@KZFBY9V=W8Q&I1HU_YDbplMHAHG6<Q?FO`=4ld99D>u|H$&8}g}BL_?B&k5f%
zM0EJI%s<<rXjawS1R(4nN{9^a7GYN$0P5VHB>NR@IVfGp5}yqbrCd(*oj+bt(QrN~
zW}n5XuUt|V8FXB{;dcU{QI7bp<0e!<r<6hWfE`l~N~UaMo3k<L*pHX1gQDNj;A+q}
ztTyMj4H9jz$w`m!0vtZ5kK`Q&Be{i{%YFE){jyjL8`k;;D8v>zi4dW<GaFIL`UkS6
zWMo<fLhGr*2`e`M8Jl(^Ehs^x7tx^VVvJ@B%T=GC#(BF&Nu#GD@);FVa955<8EgG5
z)w)1w8r~`+M}Bv@zM;y{aI{RR%o1lIUl7?;AfJFtY|QWFT@lyo)Y2Q)pj*+2_R9{>
z$6WCx)Nq^u7mtdnaRMj~MCFV6IDL%u8gG7#E+Z*r)ZE(IoKUPK=y1ccnw5LlL%?T_
z$j$d}js_W)i|-X~+R&W%kH`ZEwprgU<}O}t&OoG1(6#Ki_BTr)a8h;oi@@$g<-)ZB
z+Ssg>WKFxC9Jh1`D)IBbeB2smoHeRniPte%-vsJXWOB~@IYz4;o}Tq~%@Rg<ZHSNM
zb6EM`o<Ff2jV$+8W%Y;2qZY4x0BsDKj>^By?+g?tbASFyNQOj*AxRiYk?(Jt)EBld
z?H}oJ)5-hNA(Fj|uoXebQV@46On>N04QzIS?{3h>ml;|akgJI3=^9AT{vHVqZCw!#
z9S?}#OSZFLiNhC(<lbW5J0kO|Y&~G%SCdQTfowg}BNMZE!2vqFNOE$EksmB~^U=J&
z>8nb`@D#)OLWCDRSGmXi)cE-HkULCKNLQ0i-IFZNc6a#~w}!dD4GcuH^AOzT^+Y?+
zxIYS<mWva(m6bm#<IMX#&KezcYzqd%L}H4Rx9`2D{Z|^=Hv()&iGGi**o(~@ky0@l
zrt1I#{ZbpN;mCx<RfoYen?_dCcAqu=Ee%{4rF{$D|7v9kE(J}Nmx5AQN$Y#~Tp&Li
zpW44y`6&vg7+!}+`evB~qwaB})5YGR!P$bfpKFzM?+)o7%WWZgQ@ZrGW)=!=dNhr%
z9<c<e6Mk83H83qfIGJmwYA11sB5BNEDgp$c^xSF6Q^W>y+N{ax3_i@@2WQ?d<EW-3
zEtPH+^*O?m9j1@=gg7KBMRjBMO;9kni$3ZsGR~(YU3ARX%wYNy8I5Gm+QP)=^pes3
zVW7z6@g!eAjb`_UF$Wp|I(~hO@9|G-z`&7oJIk+`IBs$_YsV1UXBZ-}pbnmPJM}3z
zHR1PldF4tG6xE`W%S$ynMAotU0i{7aqps#`Eh(6{Xz%6Y<kzRyb?G14X%hc~v7gqW
zs_Lo)3M~pzsJ73Xqq{%@bhRTURRxeqAVj1c6KvLpm*d!po^+F;p<tEtEbU8W_&*$6
za-Zqq<}>(2ITkZzMU}az$FVq=#;w{q>8hx6aK^D938LjR@}LVqh>j$LD7UM9<E4KQ
zmTz2t;>hq;XHhdve>4<~nt<O&>>!X<3K>a<u7)XpjKHkaO@+4{?*J8WD5-72st_`q
zG|<{6f~ha+GIO|;Q!c)k!m8q`V4QUvFKa_pq{|A<D9ca~18<K2D^`Zw=yuS1zXO~V
zkf*ZU69#@Av_#%9t+Y;|E<fU>fw_7qDS|F-M?D@@IePce2fMT%Y8&>zZL9-10v-Pb
z^|?yLn1so9&B|<2M9b;9dj%6j<_8!;Qb`VCL_u{GW<@W(THrH6vr#81DM=Xcyd2F+
z_+k>(ZPmeI(osIK18yyWco$Bm_it+<r(QtU>A#c^_v!0Qqd0u?Pn(o6IJv31iw^9F
z>u^gu4f0uQSLZvYB2x&N9o|Jc^?oz3U<Vk&n%As{j(Go>Ir(sNdNNKgW~21;>if6I
zY%)l3SkJBgo^qd(8QKX~glUoecYipUss}c9$SrIKF$raCa*7LPC81NYbEk-?N#swU
zUBz%Y%NNg>X2M21sArSf<LvO<PFlff{kVqIT3U6l_R@OaSm4?dX7-0&u*IYY@7F*f
zKvG}Z{$kZ6n9fWXx;-R(6x9tc@FqzwsH)Mc!!HULaeAUnxN*$|5k}yezF%bf4#Wz@
zQCyA$$G~*<y~I6=y|d!Wq9AL~#X%wswg;u9WmXe_ZQ&oF{0JhGCTu+PX&>XVr72==
zChy~TL97IT0n;Af?&33zcA~PzRN^bRhZxeI_IoPdA<%^i7b358kno0|)^Zh{^Ta@?
z;7MFdrdS|lrOHgH+%^wX)gejPM5R2t<0ovI39c+#@<u3-3t`Ma$j{o(1cQJ~dmNDp
z#M|6^y|2}hBEhQ2a#BWiYCgLLUN}wf9-U&wfEx0ej7UV<r&RW522n#M$xb$vB}c15
zj+Hau=rmUu0g*?;qil01;-KHu8B<AMJ^nQ?E0mOeQ=NvwqBWadcy2kKLURPrc*yFl
z9X#>0C9a_sWhQP-2wWp%Ni$t4Q3~yF8XL<L?4(2mM?h&YIcia9aEL#-r;#4tHpjoT
zF*Qql1JN`7`+`iZICJHdvTgytEAl1tvpw<x0UD&%oUrgm7)b(eF4$@};hXjq@8(wM
z_qjVwv~9UJ#I+d0IBBX_HR!MIE-?k(<$^kXran_XbI`75U+%&=#{ELm!U!2Rz~m1x
z;fO%X1Lq}{HuW9i)32dyi*j#Q1FwN&^Oxc_z|bbfgiSiYG+DcmM=*0(uuQX=U6$zJ
za>rvV&dn2NcPM{o!C!g<HfUd=+`TSFA##A&31N39(3_8tK9?yE!KF()EpTcml6+VL
z-eH}gNA03ZSMkfX{N{@uCbUl6D)&k0f6H)R1|04c^R&tqK5y-EB03f_e5_4}_WZu_
zwjLTwY7FwD4`d+;1YCWE0buw6e<~D(3pQNjf9*4}Mr>k9e`d3QU(->W<lY+lX+@!H
zKo_eN)H;f98ZPG+M3fV*SWip5y3=ZTA<Q%r1)08?$t+mPvk=3EcRtw>7g5@`H>`t;
z_LS$>PtP|AFNVFAY>k3?MbDY9(>MgDL$VYas&~LF`I1LX*>RAY`nBXzhUE1C2JwnM
zP%i5q)}sRixL^gat|5(=hRRmo1$jtnApAw+OmB5Y2K`w`<j~7wp*yX2Li(NBKvg!$
zpJa+rbIfbR8`^B+I<Rr>m`q`O@NHj;uKGwtj+z1CEiUBmAc!(xBkq|sx8oTEi89be
zcmgJk{V0@LpZl41kFflpdhF2wueB*-dlNU}-i*_n9rd9^oQhL4PH~mJe9Ck5B_GhX
zC+aZBNb)J(yk0BeHEd(;s_pyG>UepfMnEQ0CZJ`>6ZH`HrV5viOWT|uv|M>Xy0pL=
zzT&5XfsdQpny^w!Ym+fc&%>nK0Q-J1f(1IOeaAWZqzOLTFeBoQE-GwWWY)%ND3-VH
zEr>3MXQ}vaj@ht5(0%7Q<-T!HvRZR~)}vrrb=h-R*oV}wXIwCw|5~ena+s~+yP?9K
zG58;jMz}`<lh(s3M_!7kK|E;^g8gEACe(S+1Jx^^7j^k~ix^|d!V&0UELP<E$<U5|
z`4YfZ3=T!I+uaW?-Y^2gML%+|lK6ic(OU4fqjfQe^<EU28_&@|X@iQW++pd42tf`-
z0(|TeCH>&q6RBpR^2*u%rhjbMY~M4qBaf+szgPl&l=)vbxld^3@g@gP{4HLW5sYkb
zY%?~LKPknNHtyf`4}dJN?@xPcN|O1}*PdWb8hd}-&55Wi+*x(_B<eu{oD&PzQ7F(~
zF5Hs=I1W+ks+(k^i3{`*Y3Ccw_mUlxqq_bpJBE5+MJFz32w0yix$hE15nb5Px1ZNt
z9gnT-|8;~vKvu*;+t)LecGlu;L#GON?6C@H(ZH^4JJyzh=keIPVrOrFApF!)65^Gp
zwP!=zs_6yU!u@I5^B`%A|073&zZB_ST_SK}lLoTo-8lSp>!tPJ%)Ji@`z-$9yfv#0
zDLSuhkTe>|^bbGrBb5kLyx`)fC;G<`?ndvJwV@ZVT+Z@(g!1zjrvEyaY(KbO>&PC$
ztk<{x@5W%^#gD$Vqx*DKdazp`+$I`Yp)s}No1_MiW2pwAsIRyd(N!fhLy0wK5eOvJ
zjEt^1opNiq<FFz6eI-sG;?9kG!X;Pp95EoRL4Cmd9cxYquIt&rxu@^3mjGgm4E>87
znH^9RF&Z_hP~D2M-|$e8I*LubuFv+92Bt<z{-_R07v;CNeMXW?+O3NIwOPth<@`p`
zuEi+G2<B=Y+@Mr>-gDbR6i)3n5Hk~ZfySZZg&bf<&N%i=_ViH#4>2cvF*;9Kqn5JG
zaNn;d#-3%yOVeMQ#V0mSgs6{h2lahuL9*&(*;BXwy_06}qI8Defp77thc=C=SKfj&
z`cM`5cZ_WvC0WO-(13zN4PXh!3YXCeoNFL?fz_RS_hNxo4^wt>tmG-mxE_0Hf=suh
zJ)TRVWW*v_1Ukn~1xgAAKGA~bb|U<@oHbz!B^(@YjmP(qIR-F9M69v{-BA6_H>|-4
zh5X67dmFNdfBx^i1e1D+I7}0_c^D36@QOObjh%%Wkmf%Fs!=X`+2^64%NB1p-2Fa{
zN?GLEwPW^qO09bhx{}0O+vgcLm)>)FB!7*>>f>6+sXgPG8#KrBw)veCt#10rpq^(i
z#mZu;Hm9~(t3gkXrS7eimW2t6{^Np(?$jg<fIpvy0Rm5vMOki1ddd)6b?Ym34?p!&
z-SOd*&~ul&?3sSMt^i!zt=Suv<6l=Fu7h-wyW+=ROurFoScCZirnt4NZyzipP#O6b
z_BFfwYTo-cz|Jr8jf`FTpkRtL=*Kw$Dy%6@7Byh(cWLhX+*Yn>We5UcA6)P8q9I7m
z?@anB=sZqeYgrs+zE{)UKd2|agP;}`*^p?ZaC*I8z)pgkK+%0tsqc7N1&^qLkj>*r
zbLyM6aMegLW3nGdBf^ElOJprdSkQf(H{Cb&J~k53HIghUhp2?vD|-pN;{0ipgiLMZ
z8*!9Wa!ZY8J<;_5co2e5JNfUD1iOAInRiQ}zF-zp7Wihu#Ka0-f3iLiTT4<+PO`s}
z<IxHNfZJ@*Q1K$emCpp&0{aCh74J9CPuN~VUC*%3^&AKD6MFDBadBgHA<e2%A}A6S
zEdr&faVy4B(I-~r_=6-o{%YtHWaCO4rC;?0<IFPbh*GG|Q19(_{ZnzuknKBIVia-H
zb58P*bwU?7!|A*D?K)%g&|BzAiw6hQ!(bH!FodR!>sw{5cZ%O>wO>v>hfJaJxftiP
zplc`bsRllI4`EE?x_w_*tZ4y`wJl91?uJ#`S2(+&@Z%4X%X}2}+D0iTZ}KjacC8GG
z2$p;&NW|3HWlkRLnBdH!%`yb-cjh$6jd@N(HUSBV)IXHv{c7YQ7{LmF9cLP?>yOl7
zH)kP8nCnp>y?lLXXSQ%I9G?{^&XD3-i>-3e2NB2C*8!b&)@)gRld)hq=V2+FdMH}m
z=qCt1HSZn+ob40dlHTxib1tU!fZ!I~a2<I0axv~0cTDN?XRT<H)PQXV^T$XHMckl>
z$ogp|i?Dqu01<NlbXJ)m`kI%}59nX)-s6%mN__79e80TO6(c|S2rK~;;1yz}@|nSo
z7mUl0){371yrmrnp0PQbI{`y%DpyoKj$xlkwW;LG?S@e~FpKPu!|4q;yiEm<b9%y<
z{y}ksdQRZx4JV^&kY@9V7bIWymC514Hc#~iwOFJK?ka1E5hUCje?rzpc1?o7uyj9$
z+-3w+rbJoHU3+4GN>krFKR=@-c8Bfi3(K5-*w2ej1PIXga}WM*V>k+{I$M%O?LNTo
zR46oqfa-1^OApnx3iZ8Ck4*GhGS-sT;)yRMMi!x>Rv+ahgE<vq6b5kVJP9(wF_ce}
zb0s|OLIUJ6fZ0bBQIaMN7*h}?X3=>O{*akwP6X9_v~RMFnXKy%hbUE0G8`c2AEv;1
z$$`yB>C{jWPk)eF6Q6*HMfthsJoC476h=_vq&!Sk_uM7`T^xXyEy-ayi8tx%?qQ>v
zSewov)M^zpmZnP$^gTogGapsUO1lKXRIJ4OzV_I(d2YT8GhP!PPSj!AHVpaR10ZAK
zfcYnY#@6GMYL>L-BgEwVf-0Q2bCBfm7(8xI;Z~o(35F3ABC*G~{Y+$Ch1W=>k<VVI
z&#Zd5mf8-itd<Ze;H747f-K!@DI2=V;IJTDq!78eS6ir=!O?v+#|!BkXFJ>t>*uyP
z%|3{f#b_XY+M3!7<3@c!bp7vu*Svh$C0@%kmU(^THnz1oh3Cx?0bHn-I9=#WUSUnV
zIB2_sPcj|9IUGiVwa9XT@P|k)P8$@<1;t~yn$vueIEoq4c$wgGg7{Pg9NN%c7Q#`m
zJgZb>Gi;LaFY(CBS^Lk0uO1J;5VW|S>aKjV@IUy!)=%2P_JxDtRDt|@eXYumf^+2>
z<KtWl4ri-M9B(9FW;f^o<pKJ;k8T!|cU<ggt5r}^yiBb*OtA1>IJAf}&6Y_vZw?5M
z-<~!yTl|8RXaDRy%Crvgg<udo&*Fxk%@AP4<u4W1U*iFMXPl77E2{Vl)S$+7UyB8U
zulQ187;OEa<qXq#2#8bTi3&buKI<SfX81U(zNr{!1)M{R^M%rmc!4$V=;KjC7W-1A
z2|B&J&jX`dFys9OUG1If#{YJoBuiFurMm@9YM<l&H1$7J3n!j!UYjy?Gyw6dYXrDj
zjgq=uvOnPVvPM_vs^DQAWwbm;6Q-7jDVKd1%?4?FQH;7pm8o_6VN_`<Sq$_ogd$+@
ze1bIN#L+wPp03XEVzGb2;j)D#siSV*evq?f7gpvpsI>=1BwE)t5_*VNKOR?X<-5y~
zOY0JQ`1oL9g6!&S7<+KsA90O-y750Uj=qG4+QBo+zRS;6-6&eaLcSoXhpihxvIJX}
zbGa=|!M^u&fphp`QJ07t7&HDJ8dxYiLv4ll^013CqkRwAD%}Y!jvKMo+M8d%5fF%y
zXV<jhlgKFIgAN-f4MXMhm1*FKW=mEG=O!aIJ=Y-h#Ihe4Csa~|`~*<`p8!!6uIjFD
zp7<5&$MAc$R*YR{-1feJ1F}i=ze+%sp80R-uq)-`xlvZWMmWY3E9bSyVHx>60jjk#
z^zq|5gzwBJOPN2}CLCJN*>+Wixx)PL8Z*59U|EIgnyo3=aNzGB2g7yN5q5NtWTdx5
z1G!e%F5BYQocVcyWsSKu<v>c_n1?C3kBFOkPw5SY679xu1NB^EjCUJQ&<OQ<qD1cU
zS|06NJ<_;~rOkvWR;`2H)f+Gl(L~H}xYswtV*amm=JMnr<B(kF@jIaX|4&X~WH_jA
zlWOP&`<>I}RAqTGtQuHvA}?vCX{c6E$1uGO?#0I@>(AM^&yQlPW^uL>qDD;C_1e7r
zq99e%sG=J7`C2ayP?o~)Y)D_t)j4M<5E!I4q6fR|vy?{Hy8>HfGx`@3M20Vr2!pWB
zQ)>89Uq}E{)a~)Qw|AxxO+#(o6qW9^_M1uNqmE;B+}gVN@@&2}Ktx5m_+YNb_Bdf>
zyb*RhyA8V|$PvjNMJwni2_V4ZF)uN^<SNrwr=#|6K|>7+7w_y8bRlMWT{tHui@SCJ
zZA0}GE#bk!aSGMIO&8mTra{hl@<9~g`#mO`<CRy0;JmY*(>q`|MV6Wb*Wbo2iul+d
zT7nZYAKAFf(h}|-nlySuknqqaHJN<Fa?)0OQwN=g8@fL*HPNko|1ahIxZQ&1An8P3
z^tiv9z^36|Zja!_WmX)Sv;Gzm1%##xq?DPrhy{0Gg<OBz&exmCKc9zfkl{1H=Dw}C
zhcJ45KbILcox?6Ax`d_uz{I-j$(%QD3_Sc3C41^cgwLO#TnRSX913Yu5xRX71vK!;
zqoP*`OU_ivYI2iTpRM=^8DrZ*Wp2=s4QWZf8n-VzwQsPR(PVlf@uTjEuZGo<tvukv
zb4~vwaL8aqv0T=fPrYa<8nkByjM5B4|K2gTd>6Vh=mFN3C9yk3o9zB}R+$9fyQ=HX
zjPmU^9|$<SgkrCnNBdKs=O%$bBSzPMToglMA=2VApj3LiQnQL+k?fCe&JZvkd-B4s
z=631kx@(19fNOECX@ZuGM9DF>y2GuWXLZeVR9!_bjTH@e0F^IeF6&u{<XBz%l7hg-
z;_TDNG<aI*68RALe`@jT!?3h$!BMbKb`albO7C&%^6OA%pB%bUs>eNp*KtN!C=8HO
zi}x3j&ur0227BL)=%|m-UqWh+d$h52&4>dz3;>0xd!YE?^mJt95mOKC5X=s4uf!o4
z7nX>jpDj<$mc`BcCku!-MJ7ms-mD~6LM_)a2Cx~0dq9~0YPdR66EoUyB+djX528h~
zZ?;6%IvphgFD=T2OLbvazl$pI7A*+QQ+}nqEe<qU>V+tB8e-CVOkzcSA9%Jd`W)YR
z7o@=wR9Ww?5`2;n0)?-i%=>F8Dbs&7r3djgbFCE0Z3ZYd+Dnv*(0dtu?JRPQe94J`
zfy!*~vrhzst0qntdU|OG?7%6mrstiLprq0?+z#7ua5-(P1qpEbvJkEG?p01T>lWe$
zp0Eom2GE8GIpuQFw7wiBVH9xe4e%tSwe{aLt}wvgK}+$&i~BBJ(vxsWhE>(-|7!H;
zwSMm`7wE@BhO6bcG|fmUFNb}34xG{%Bjbuwb1Uf4{iNN`uMhya2EY*XWSn-Kbv+TD
zS6i9sSN^oFJR#f^c<;F*QlqQFD)z_=NoSu))us6*<@D6K?>v)-LT7(MAR`$qO8e{l
z=X1#3+fSz3=}KILaMORQkftAEDmuE>{GnJ1GOwBTF*@y_a`I0A1dl|vmSx|HgK}`o
zXuOAKSLrIQh=8r2R(ZQeb-=ZR4rc7TTB^T<h9G!7%vr`Ar6>`1c0ppGB1W!I0jUeT
zW}V)u;ZD+|mo3?_(Z;8=*?p8Yoi69MUXEu9EbjAPW^ybLbRFU6_OZCe5&K@X*23FK
z$EM(LT01nkA#`Ip{L>OSfu|n&7xo8p`2A~YTlTl>GRKDW>0$`I_w18q0~DM=M+V8k
z5Z+%A9?~dX2Tg9Gt+9Yzx&W8kVG(-q-r21}Nta?Yy?IBJl}k^HBuL1|*V-q{2_ygf
zixzk_*%co0x8u#(`1dIVL{gv*7TEJQ0)U=?uu+P{u6M`1+L1kh%a*|@NMg!5%N;?f
zVC0zrTn`@<j^K>urAna(Q!G~9(va|+A5PHb-5)~Bm0IBdF7MoPqrLIua@wps7a=Bn
zldY%k^=O)czMK6IVA+ZlSpZE=EWW1}081!4q{$fzwIU?BQ9~O*K&2MtY*5ie;LLEW
z;Iexk8Wt=?Eg-@5(L@V<6j$vNT(@nXJDr2gp{f|g_2v6~%T4_Nj&uLJ$o<=pSp_6;
zBo?Sly$DZ2UnY)ln9`_)=nngts*gCwYuVQRtO!#hC}J*U999i72OlqU9tS*L%{P+5
zeN_muxGUfa0rI-cs@96b{qtCxZbZ|GXT!z)ga?+**>uP|LAqeDV7CkIAIMcptZ?1Q
z-WVb^G8W+D76i6@R3PfZhwr~acR`*bRv~&##stTYzhh}ywXOtLe0PZAeW*>?E5-T1
zb!QM5^UD87dazMpQXa^6iRn!cOJki_tjFqH-BclzY}M~BGL_oYmwxEck4P*4xvqH(
zcjisW&c2{a)1E6wxsAPtN7t4v70dI7RN(6)p7ITr^&u1?37n<uP>*<O>t=+Gje+${
z8Bmp~*)r<lNI}MNCNy<BFt=foN<nUbh+vi8?BZ~%<agBME=f}KkM+d-0=!u#Z(|Fm
zsOJiszBz03Ew+}|63Q+|661J7G2I3>k3RAiOXYx!y?CI?NE(WEV4(^~?}W}hM5ReK
zb&99{+efg|_Arfv>8hasaH`X+`GhD9#wP<oDdU$PYs;D&^dw+<GQC>miT9WExmKbJ
zMNsK7w@Ge{Tq|x-4HvHP=T5Rm<5tbjSR1S}!rv^%Z!TiOgg^i&eG@tytg<7br0#2B
zrL@?}MBPhI-~28pN4&mHS9M&>Jj62J{ywWISh@wHMeze#<MSrBvdD9|<k8t}<zM!?
zHw7#LaSvW;MGAVIJUr+^!8Zb3C~`jrvMlFdS^yDUI?N@eC%L2%4&!LX)*1>}DV9Vo
zMQiw;sweVH`@QjiqE~f@4MhV!Od<QbO#HlU8y~8M)a)--MRAR`p_EYQ@2QKOgY{)K
zpzjb1zW38kN?GOy*@4=;{##@*0#m?RMZoYfgeO>I3%P=7`JJXPoI+8Cpi19sKWFnw
zqKa6#Mx0hwv^n-8!Se;Q<L{(V?R5RDVXvn*<zr08Vf;cEPSOC<4M4PvZ^{mLv<#jT
z=<0u}q1E9Gapd<_TLDDTg!-HeH`(L$%0zH&^6JD?RoXRlyj>M^*=Og_F@n|+m-DS&
zdP^F~>5(n&fyXK$G9MC}G!t$1$AnC%9DOmut{$bFnZp|t&Aj}Xt8t0725Y1}Gc#m>
zzksBi5`Z{9av#{KudUKJ!SJM5-V{Vm@c30(Q>OsJNT6Yo(GM<RmQ@QTAqI{0rWF2k
z+@R0itv+;}T=XYW>rKYtI_5+5?T})T)(#<=zx}nujTUp@s)avNT*<CFtsp8GL`rS@
zw>UAj3q=j<=CP~#>j^*tulsz<CAce3W$4A_68#}BSZ89x^^3pQ@i15$*|_m#TxbUe
z+8x{zM}Y3CHx{zppdI*BN7`9$qB^QS(=aUa5BYdSM0wrNGr44-H3d0ivNOy&r$nqI
zo!^p;z`TfU$MBFL)t_#xgc9`YgK0Q<_EvM#*siC1Y3yRd1qfevZx6NYsm^xCt+8#R
zFh3G^`_ofRm*3-q2<UkEmA~d!&XJax0`BSY<R#f~_NB?qooP>I*`JU!pwbsVbxju=
zt`?AUNpi+ryp!H+MnZ8H88u9}((Zx0r?4v1FpPN5F_k5ps_A|y89|w}%+>DCobC*}
z$wy(fgpI3wA(xUjnvL7Sc>5~t;!0;aHR|I;{H~h(^(E0_gi)Wuw6@w=7Y3Gp4#eL+
z5h2nXbIPVW&q<v8K`7iaA}2q1{^4s{4tvHxaRt@oCyb+^g}$1R7XC^miO6KDV>nHY
zW_IAoGdaGH$Clqj#f<Uz$r+H0*EeWzG~#mZ5iPK&@<cJT9H=Jzjz*37EpLRrUKBhN
zES0EqvNtJHDpM;Y159Vna4345T}iPNHA3mKM)=7w)_Aje9DwI0>PHYaU9NkGL*iz@
z+rNP1UlA3A=-zIa1}aa_=~5*%vXY&6a&rkLbL_G`c)><5i1bX%dxsTc_=r2Ve#5U*
zLP}#Q9;A~VXylbEu0#UkhzjY2rPofi;(VPh-bo^XLEfo|OZj!r|K(7@(FNTOv@8cD
z_o`;vw6g!bqD^qyOw#?R`^1CK=0qxXPt_cA46$Ro3X^Lp4VMHF$F9b*QaL`S>rNp{
zx$mV15Nqo|I4ykB415+%A&ib&m0=~TxdPtBE<olB#)h+f#w+{@+Vp`SP|AU<+YRQx
z=u9G$F3b;V45K`3UW@EsgTLN>TkD4$?p~qFkw;cFQjoi<FGvLU26?1u-k3)TaS0WJ
zb$LMN$XqFl)pOY05fj5;g0@v!`}PM(nzjq|RQoq!1$j%Y3m*+Ii9u`$We;TazV1^0
z^COmAL(kwN`SFX{$oSyDjVn*pU5qx<_gz1#*$l4M@R1`imi)f=Q{iT<0Kw@pgtl`f
zHIZp*Ieo71lfg@*z+l}~%^wX;o)-#Eb-Cs50szlI`*Vd6+XrHq?gaD=C_tNTu31ci
z9(t$Tj^|eERLT+Zl{OTws(q0eRvbg)@Y;wFBLZeryi}l2UKrwD1XSyqBNvO4D~|t8
zMtVyirK7Bd&@9rEFqNW#Y9R^wGtC$)U%;0s`o6vnDNNk14^^Rf%^VNMLpKDTtMW3R
zPZn7Zz1|qZ&jf*rUOzu8Yu0ZrS2Jf_(1d7hvvQj1FO*Z0FObrW;Z4%jaJx#!<A{X_
zlIXv|udKZD{8CYyrK0DQ_>PyAOn9O4cTCoa4Vb+Rj%k-OMY!l3$dK|*r3B7#wDR;f
zQuc`pX6QTyZZ0~P+H>f1<8OqM`#9s&Mio5MlLbsLVh5n4z?gjiVI9XhGRB-H`~Q<j
zK&0NP2fVNoNJokGXbJ`PlcZ*nh&gqvJ?e=)rr`o6cq$`rPEj1Z2IKRZMut+ZBmER+
z6U<S}<@-~$>B1!7x>n)iPH^1G@ATV!e%ic<$n}li#Yd%5SzUsspB0u1OVrTq)aHy2
zf~k57X+0QTtm=;Gh0Rp&p>_>hx@@!Ubvb)))zHd+WY?YKpQ8H@iMmR$e&1Aa{a04z
zku7*l{jl_=1S+~}X-iUaaE%{9MNa->qm~ln>l(V?dtRncVMYYv$xPm>h6!l2H4@c=
z7ekt_n4sUghV<abGv{Z9;{$I7{D{cC)v)kyj8yE7&&e*7b94{kCALa54f@BMJw)vQ
znDrOJ4UK8!mt(qcue(uT(+!$S@+79JvcOLItW^Cd;xe_3%M)qNJLfdzM-yq+W(fO0
zhS~$~0jm?ncK&Q}&j|Fu&tt0p3cIx0CmlXVe+TwP%Q}Ap>MjPm;&dqzmqQP;;vwel
z9-fDQdWHp_Wgz7Bp-MH8=-N8$F(Q;)_(8{`=hD@&WXdbgGVbEjMl0Zr@p0V@C%<4k
z5CC}eA>o9ucj|^CB)i}%tM#4D96&7HyXpH{^-Gi2g7xY#8MmA6RYr*{&Jqd9?^8(6
zJPSM(O*<uAXH#aJ+cktMY&JY|Q8r}FFKq4#H+E<T`wi$Isf_^gS`A31D$HdawNat=
zJbNVS_?)l20<Z3MpW^2HlSra}V4F(9+it+j#D%`aM~X!nCPfnLym{v*)`K#TmDoFD
z!dQ>gh86(H1TemS4X6t60v?Z!A0Vklg2IYAA^FE#*%M?Iu!#M?ZmbRlL|P{!VMv0O
zz8HDM190AUwjfsk|K_K=TpOe?X^KqIro}DHXv@uKf;9K#kXT(+;)EbEP2E-UyZDKw
zY<*kWqE&fID%%5?dnyBTDF0{^0>*S=EZ{vJAKyU!V>&&>edqcrpSzX_d<~hwPDB#T
zS76`p)J?2^fFt17_C_Yu=sm)1(3d*@0}CLwuaXzZdB}`oDd~e;&*+<04lU@EO8v{F
zIg%D9YgYlhDAxL!YD)v1`pbRmr%^v=;9B|$m7eW|gOEsB#tEc;Jr}UQxmX)mk>&yF
zHU5@y&B0;U`t+mOC*f~%J7fC82x#?A?R%8D1|*U_YuGjQq+=FMF9Fk$z?tXwU+*@A
zJ&i9DHpG$roS!=2gk03iC+ZMJ(v4+GzP1V!Io@5cMG#$4h56$(I&&17UrP75i1UZ&
zmO_;`lFIY0*UkSwMm2&kM}eCN!Rnb~*ioG!9G(pz`ex-PLk|=e*CWMPsH57ID1kZ=
zV9e)~>{q^oiqf1NhetlIl*!$)bI#16V2nGRg^Yb3=6{2Q182FtAO|-(<o$)&)?@vP
z_}5j)h1Sjkj`%~%3Okmv%#S|SROR#LSh-XI8}bSlf*6?BD47@ETnpE_4sJk_(31mm
zSAX>;+9LN`K_ItDD~!steZx_c_O=Dl7amY<4Lo*_TRu`-`39CheM`l>FSOd1iLY=b
zsRyOF`I}&FzhC5#dBt41xS1~fbx+{W3X`F>hXyk;t=mEy&qc?RgpN(s-@Wpd);u=*
zRjar_<E>V{62m__xDffb>FP83D&evNZye!(+9HTF@Bh-TilRpc_K%edHe4miUY?W(
zaZ_T5(zr#ZSy5}Ks7ylV`ow^LNo@0D8bZ24S?&oh@HfrLLXzwXK7#h;EEh4{VBlkq
zM^2bv`>&M33<lzPd>c;4%`rEzZ1dS9O^Iat(Jei@zK?a&b&fR32Oy~0qpR7XEd9L{
zrFKWW;Y7REL4bTr>$UxkJnees4~W{Hl&6LFWDp<W;o)RJ4)%MXvBZ1|pN7`z0gi*e
zv9cw1d`g0MfaBgt9|YJ)*%O&S0fR-~uu&|b>8w912pGuQ`L@N><iKeXe?DJvKBGb~
zKrkH!163Uk1QrAo;8}UcDI|f5^Uc2`hNmKbl)LB(Fdqg3RUIP)7%&!q6ysK;26Oo5
zPHZ$W;(<kFI9v29*f0tP2r7n1&OHPJ0s}|@Fhv3&Eluv)1U1Ov(F7m}f(HPqxAQZf
yQGV^_*Y#GOhMs0%0wDmWl*_#L`DJ%er_z$iyV~T~maab5`D4!cU#kXtf7Liqcxx5_

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem1344-cert.pem b/certs/frodokem/frodokem1344-cert.pem
new file mode 100644
index 00000000000..1793924c1b5
--- /dev/null
+++ b/certs/frodokem/frodokem1344-cert.pem
@@ -0,0 +1,461 @@
+-----BEGIN CERTIFICATE-----
+MIJV6TCCVY+gAwIBAgIQPgaeBxmCW3MpBpujbRyCmDAKBggqhkjOPQQDAjBxMQsw
+CQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQ
+MA4GA1UECgwHd29sZlNTTDENMAsGA1UECwwEVGVzdDEdMBsGA1UEAwwURnJvZG9L
+RU0gVGVzdCBFQ0MgQ0EwIhgPMjAyNjA3MTIwNDE3MzhaGA8yMTI2MDYxOTA0MTcz
+OFowajELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxDTALBgNVBAsMBFRlc3QxFjAUBgNVBAMM
+DUZyb2RvS0VNLTEzNDQwglQhMAoGCCiBjHECAgcCA4JUEQBdUK/pbkq2778sr6Ra
+o2z+ePZM2rx05kw7Ce5AiZx6YH/wVJ1bK88MP4OQjK1Ed3EXcJ3qRfyKpM56NrzZ
+hIDym6Zc1XvgrKYSI7LxnAUUOo77GwBv5RH80h7GLQjL0SAg1tSOpPlCLo1kcCJb
+g+U7j0ELOF4mHSLsif46lWDPYUN7CUNvQOOWlOog3SOQbzGyWnViTwXgsVSroCBs
+AhzpggkvH0pkTYN8tPzw+MFXAbfCyWX6+ftGULdK4b2OPaU3RwxwxKKGSHzrZIXA
+/03qeRIAUicuhfo1IDgqnPlTds3FOlfrpmuVCRsZV3OzIjOXfY2W0GgBnxbEbrGp
++7salxhAdJIv+W+iFegliU3HxKWrDaLb3kEroICbzTCB4H13o1IkhWEWjOAaRlma
+OAZ4A2zZ+IdZwSTXRIHUI+V1zeOYeyGMEClSHnweTHmeraFrLo+5WD4rmwhiqWQe
+lnRsNBIfYt3mqQSSJIciGVrRlbSW7tOUmEKtbocJ+wAyrDCgFcMxFQ6y2pzk5aT2
+IvlW227mzUHWT5Cgp/N2GfENfHxgESLB0W5tVF8eV0GpEIICFVFmgBGop/zMJatk
+ZxVA8RJwT56TsjybLxbzEKqUHp8uUh27oLXVNgF5HpanRyMFxLUYlovDRTPUejRa
+p4Y5fMDYYBvdlP8Nz6iPSqF01NnKi68ycWVz6oO37uWmjFkLO6XSEQPmldqbIRBN
+xcxE6NVB2UyEqvflHHHmmS0FtlLNuEnWUbEXoXnrSqjspwdpYIfqi/2wxzkFMx0L
+q3fQX3y0XpdI1yR5eCejWoBiuruQQSiZsNHXmTTuMr9ytOm7jnS6oe5uRrFhCFLb
+FihWwjNRRpGS+4CpMni/tQjIv6Tqch4BFFuAkX4vDV3PvdpwhucX+uoqxp6Thho6
+42EkmhHLuL2ZGxV1ekwNexEfXVvO01/CLs9/0PN/UMkmozKFuRP/7xlWkQenQzK0
+qatYLk3qmuGPZXRqAxu5fHICLU5w555cYw1fAD0UHhyKhP4q3bSFij0W9lRSGRWR
+nSfrjuHUIFm3/PceQp7na7TIz5W3Z2RABPCUEnLODa92bgmX2eNfNKbRWAITXnHK
+XEs+iA10xQL7weEFjqr0IPsS9d93M6xNWmImYFkpVOCTQCt6ksy7qhcrcl0tUhFL
+bfrjc4S7eRf/AoopNlAhAZA6VdSgVKUmm+VpNB+QaYuBgNkRGuSThVcdIVNNrWjS
+lp/OlhQeiNmJs+BsXEhAW7hTujookbXEOuFAH4plo7jWA+26rDjzYxcZ/b4tzr2D
+VMlKiiBapg6CxAbcaNWEqER5KAhD9w2Q9Szwop4P3pQr6MZs86YagrkSTYTgFbbE
+q7osK6zhwBd2OkiOnWqTEdsorYlpwQTjzij5EZsMQi4QWN0yUmY4M5UGzbiAd0yq
+1MuRb6qPDhwi8CBNaERZr1QKuNh3Lsohjup3AKaT6RjAbG2F493z18jFUZvIY9g8
+FnIGtInac3fV/DkdoX0cZK8QJs5ie7870bnq768S3pDgkVDO4GrB7wylbmLo6cNV
+yLCCVc4mRUzrPKXYbeDhTuQiKK8NrDSp6e7F/kYaXH/j4l4eC95G881puKhlrkEI
+WeGdBsVaV460jWVeWPrp7svhLLzYONnn6LOIn7oUep080bglwr2jTYCDS622o6Yo
+2Tf4Hwcw6fdAwbfLCNMWacvLcaLqpEo1ceipCkLV8VQpDIoVTCQUCsGqmBijr18V
+ss8EfTlcFEvReEbRIjUYdvfmL1VrjnJejjpUo3AVnSrKiu877jL37nea38R6wjMP
+XeTuos3ApEQc/Quj0ooR7bwpN+p0sin+XRKvR96sfzEi+DYsBvsUc0mKlQjqD2IW
+s0t4TIdudEyS9WGfGJueJPPxCDjvYNoATKzTrxaXhYS/keJSl/i0FJaHO9GK+15N
+N6bK4ErKFc+upWrDMsBL78jG9CkpqB6HyFQVrvlDd9ZYFfMn4Q4XjP85+YVRB133
+1A38MIZKbIaq6d/VZLcvIjipgCIhoKc0V53CJzVRhHUdxBKEj+3lzWuQJBfqSTQ0
+uJbwX1NjHiWlZpgR81sKS/JasBFgt/Sgxuf1/3pK7IQT/BMM2V38TBvjXi9UWaRu
+ABA+17jKNZHuoqplO1c+rvQQHI9BAJh/4hRvVtLvfXBg7ITB5EIgkqgkYWzL/qCZ
+dOxGAtLl/a76lIV/nACWdepHE8yCRYniPylON5t8w1B2luRaly8I56dyg0pAhpxT
+Gp6QHGUO4CIpIDuXjZjJWV2yTqQaJJN38aZyDs/HjZjbLJbZvT7iTKg6atKo8g7S
+6bDPXcU2j1L0OiV/bIAE37tncxSrN0TrKU7/wASi4IcELZ8AOFOEqZtglk9hs0BX
+CRwKAVKlTWDOCA5tz9+ecAbdR6QwabK4QOvLu1zH218aXIEHIoJzVe7SZvIPOcH0
+ytf8YTKe75pU+BuiOY1JK19tcnePHEBD3afujjGOS454pQGBFGNgBLjT1ePkZOsm
+uiwFKamg/fR1buBAHp+NPaGk8Mf1P1876676g7f5Y4FWAdF8YsoPH9n2OBhUqZdw
+7YJ+8cZN89EMnxrceYvUnRSqtfNAOh5/7UXJsMUEAPLW+4hBtN87XO8dnMOhMKP4
+L3u2Xss49cCLhZyYRc+wm+Xg/2aeAb913czMd1ijL6FdaZnFV6P7UibCt0ZbyiUq
+30RJYyoOCG0Xv3gdwEh34p+qZvsdlJCSDKacae5Ryyi0zeQ82Mtbnj7Ghqpqa9f/
+FGiLRQNNVyqOHROA3HqH5zKu68veOnBfTdCMq+qNxVBqPx16zbGt2KuzxcFARr7g
+H0Og716O6PycXKo422dJSiXVj/qASVFcJmp6H//wzkKnXgVsJrbsJ+ltC5q9GUSJ
+pDEM9IyRuDwIutgawvavN3BZ3SwXoujKQoCKHgrXt+RVEaPoX4g/f4uqh3YMpxkm
+EGVgff6J8A8WIEJG8vd9y3dWEC3/cYsfBVwfchVVfqcrQ2KfAMvqV5gR/PLgZDCf
+HQU25oNhRkm/kqQVZ9BLmLfyMafJa818jwmTsdZ3Bn9T6/V9c9fcy7AnF+Qne3hK
+qXYndjXHrsJDVXA8ugvKqI804gb0yMHkEH5FoQqY100ZKcYko2CGjdc3t/UsBvEE
+hhTilzNestTC1yvPIOpEYDBUeZN2PvRXkiAjTsDQOPtUzmFQAjKyRccvbw7t5/wL
+3UP9nO0sTX2c4jqecb1cNEpjt8hZY2qEA4NKW3XEl3gxVibFQh3ywAigMIZxLQD6
+mBroJubyS6X78sVFB0eURomDzFExLQsOIdsla1faU0xDLZqQacoXPYrKhGb42iPY
+hVu7m/C6Gq+t5qZ4XNEoIbO8gaHAsNGwZ3JxBqZFuY9mp3z+/qriV7B1KMXaEIll
+nedquOMmGQ/Ps+0/a+9cLtmRoCGbFYQgd71aUPc6LWPAbfhJwoV/rLm06R3C8zsq
+M+vY1EOZvUpAXy1hqVRsY7JaJz0pkFPpt/MlZ9qqj0319ExrvqbgorVBrZozCVii
+v+zFt1U+jbnHMnocmsx4WaWbxJxru060kWazm5mS0MLWr00rs1qHqRWGJnOxSgRH
+RlZVmsAaOL8eJ3edQA4zxAf8ISic/xuHfNG0x1E9uNDoGQAa/+aEkaIYxOiiqTVg
+eV28Ppc8GcmeaLMRNQI7A3hJqAZHyl3yMrbsFPKLwcDfyQ1yYMwLccGGlAoXdzxT
+neiCd4+1nf1d/hbXok+417o7RBV53Scu/LUwL+WtOwJeVu2AGVjD/mcJFGGuGRSh
+IL4m/eun4DrTB8NH0DG8rEB8fOsOvoVgXFn3rFFdSit2nUdAA15TMLPh6B9PCr9S
+oqJNsi+TGve+MaIY5OPZJXMhDcY8xXe08zd1jVqXjy0SlcJzl9F2y+VEEXujhKM0
+Y4WkwhjM9dcZf/M0VL1idITtR/K55ai90+L39MTG/rt+XUqAGg1p5LCyLXkFmkl8
+HrP+3PC8Xu++NdCtCeEpruwLWKE0hVToQEpe+VxhC+pbFjIsHA7v6Mz3znEF91s7
+w3DZkeSRM+4YP6ViTCw7LhKveNKhiLcVNJ3IpBEdwhrqJUTh2o4fLItUDiAEofad
+NiAQwlpQ3gkgyA4LlDXryXSKBEZySb6MEGOLpMh79c0MJk52rj7c7Mc2fZGAjL8x
+tk/jHIia8dpL37LXTkH6OysvARHVlxpmRwpbIAR0Rqp/zTxEGALWNLWol7HW8Bp2
+Z9kz4Qn3LYtwcmbNvM+hqxCyLMBM9LTF+N34F2Q2sOT6FuaVznqGbwF1cVCo7lt7
+GF4+/ovzCerLY3jcALknDhctrKuLc5wW3olTc1JcbkX6goTYpK9N/B6tFoxU7xqR
+GHMQkYT8BB9nAJidwyYXjlLd8QnMBnkYqik/YB4HgpHM87lz1AljuDfIEj/HvtvA
+JWsFcup4M8xaQgKwQBhUcmw+REOvqq7KmHys7dZEJe+qIxNyMOmrpRtzJRpOtdn0
+Fjsm6PiwRMel1rNcNZYltRkpkTeOUt793nR3LIbyu0H1Wn8UrgchAUPx4HWlwaiS
+OyhYgeIDQv5/8Z9Awq5qqR61QZ+IGy37EXboJ9ARJPclEV5vnZpmvT0f1lSRUbFI
+UxqiWA8+f+/A/84sgLTZ07w5SDdMLZB3oQeyFmNyNs8Vq1OLAuvnS8SDu4NyKjqP
+HwxfXCjuS6o/Y+iA6ECX9TERxGsqKpSjdo7QJJ2dKkS+Z8s899LnAPuVeu1UPVfm
+y5+k/h31aBgWLJvXFfGkCsCK5kcBSPe4lvxjvGiQOZK2JDD0j+YibyqjSGqiS9v/
+UhLlru8UbAJ5tCJ+ch6PQeigRH46Of69V+gPt8oLTW2g5QbFVIHYkAvdbs6guf1v
+FwA72ccuD8g/LpPI1aLwNppdy5LnOsjjI9g7ZbWx+jSW/NZbjt21zSyIeOWDNYae
+m1hxvpCyPQQ3ykPE4i/ONFxON3qSdVkAO3+GCMUh1IvxjR9uWVdi2RbI/sttlf8W
+NN+5FR4xNgpS47NUAm66glURCDg1Z9lgtBQlQ28RtAbbv8ZO12OlwrCrx+miGCxE
+QFexpEb9Wklp2h7KWJDNvqws8tR2VRrSL2MkfFF8TL36zoMZs1uWSjnxfgcfit5R
++TKPqtVUeZAu8+iFY0drEvPwSmiaAb+V8kqOE1Q6dp5lA0r8ZBWxAOS/miUbP2h2
+cQ9qLZoOoKYCzpR4IxaR8vI/PxtPeDmJnwRAaSWRWdp3s55qa3eN96bW1MDAvn/B
+qGHLSZfxVpv0+GNCfTrvdhQgsr9AWzZco010Aec8yx6iUpfoJmbJcCYkIYb2C+6E
+wKv5Ep9LQsOCR05Fpd6S+UyB1sh/0eLNJT51HbKunvGAnu8h4FLbdMtgEEJ5pqm8
+0rl1bXPTjlV1ibW/STn7HuZFh2OPZFp8Jx/hnxFl/m55Yb0CsGGe9EGjwTWpuZR7
+xhWapJ4cKHMAQTSJX+JoGUOMXnYVEcTjlfrwfCV1nJbxjzMK+TzadWH8OLo6MPBx
+dxQsVMcKbY2h0OvS8Frl9LWVhjZ+Gi33JHfraseKpkg+yX9h9x1sjfJyeoXcv8Ye
+U7RxDdAFX89HOx/V2hcPumReBVPtEiGgthOQHsfK+qxzccnbNor/AaY1sssZQVQ8
+Nb2NbKDtmRdftg7D8VoRQL4wo6SNPvhQMTPP8jVj+JBfnubWLYV4ApuA66gonjWL
+jMnP3jNUn8fyooyyPn/Dxbq3mUoR+ogLy7IX8t4no235P763fy1rQie+4HxD6LSr
+ChXFBKOJ0Okac8QA20HqOH+t4YUj4pgaWywgqFdpIw+2Zh549q2l/44iyJ2zYhGh
+z8Ah08aLa1+BAkzSMGRsUom3PVbQh++LaSO1GLXdTUNpkalIGGxloi382GlDN8Cr
+SHq6GUo0ISFAd+zkO0U2azi5RHWAq9KMfoP8jNAfIi8qWqYHtthyoFEISmALN4Uy
+NTk1Q5jw91BYjtdbgn6O2w4BPYt0zZ77rH0wV81VQr2eIHS8E7mLUNJnyeIVBg8t
+Mh+5qjpCROBzTBO+ZdJiXFUjlTybPhlG9sS7w/6GdgvUqN4D5AWgh6/t4tqhT50J
+t8yAKqZlQj8Blf6aXUJ7eZVHediA4q9n2qIY89MCThr5EgAG8ybyqawfB20h9SJi
+PT6CAg9HN+SuyXNTTuLUXknLEQ0GtTcIj3ufMN08t36ImKSxHYUTpL5YVRhT3REi
+fg8CLuuoRQsHsMUkZMcTlvU53GvjmtdGUUOxAZIecN1N2S9hGcS/Fy6U5qozpnVp
+oytvK5bPrlgTamu1a0l3TevPtu5OXi/XVAsHbsLFOSav95HvNLIAwIdXUfRhqgk8
+dwOQ6ahEnVbVYgs8I9l5+9F/Ydw0cBfA3zLMyd2IbS8rG53LMZ23uUO5JDBDX+gv
+nm3/B3fZ8tiwbAP1VnltoAtEU++ulth/QnTN41BiqViUhNB+wrn5JQfeFn0Mt1sX
+kkFl+80eAacCiFVeQSCOIujYuintjn4EkzMsp0kXI4UVoKxne0H52xeXSwUMwCTZ
+dRT5rWKmbER6MkKKvHjjq39TEMfOzxyywZnrIDOffAOlO+2CwjNB+hArbb4+flO3
+yzVwNsHegvmXgeEmz2pZaHrZtQGKDaM60EI2YRRZcceq2hxXex/kWGT8Jd/FTIZv
+/bTkE+5QxKqa4iijm1hT8a6fdmXic0CKC3zubSRwNzJU9Z3m2ZRyNGKcOzNFvn4x
+z4STBHvc4WJn0Yk01N17to38WyPU8clmoteJCYjXQd+n13smcvgnTpZHAI/ZMkHU
+ramBK7pOZ0QSCtf6UpuYvgrOIlszBaKc6KxAFvSwsLjFD2bzwc/sBGGgVTd1/kcb
+49yGUblQYRDus4rYR8IwvhGbKM9PCAa01TnsUFU5a3bKH51SqPzGI2wxCpGRKFVI
+kaOcNvOEhG2Dpn9fRI06nZC6b6tFSBIpDKXsSwWcfo7x6q2IbzsoMk8TCUr6LAMd
+5B7PM94dfDU0WvzA1ni373JNJ8WYdzEISCYFGSZZQkrTrYB0Bca3h2uE4wCpj2y/
+yDa+XglMCcBmJftynHheVfOrydved1NEnf/mUoiqvxQHSXtinFU5GJLSS+6uibOl
+EQN3wtsQ92pJSAWLfBtk0r4H2VxxUAashSOmDEsBVeG9Pq+qvBdZwuN5g3exH5T9
+E5f+ij/97Ve5LcGkGKR91OA6ROqyyUJHrLjPtFLz/+hEOGNV8kP2+VINN/Fh81Nr
+S0WYEbBcry/bMR8RcZ24Q5OibIsytaJnFC8iVib7gwsz9FwffQ/v8yDB+CCSJwPf
+vOoumYsFIQBPSHNgTJ+NwrNpaS2AM24yrz60enjnSWcoqftXIxBCLr57TaZUDdZN
+OfE2W4QQY1BRD0BQCN/Fwfuyynl9GbfeM5vxc1irRkcktbvXjWs/yT9BkJPgLFWu
+xl5Uqxap3rJog1onsrHXcbonKclCNnHwobaB+YMSi/Y+YzDWKMNlBV8KzdFbJE4L
+lH2pQ2XVss3DbLoPvzZ7U+9Isg8hqhy2YZ9kgnCrEZs/M7DLaMv3mT1o9YClIRR1
+aPwViOh8B0PnLyYPsRxn1KRLS/oBhtbwvn28+mkCHbXsjIUXAOnxJSRBlnm/NDyk
+JzCJcKWzXJllEVkAlNW6tqM16h38R+0LT+TyDTj4ZQ61JKyAWaENx5z+CiAGAUXV
+yLBjvexK8rm8q3ArtBzszIouBAj12X7AY8EaiuvFqD6ZVKqnhsmZ2LofpbWPbPPZ
+9XnllYdrluklq/zaisGKG7KlJoqdL+wDcu+xORl/P0zQ7Ld4ucbaV7OlWCaWuNaZ
+by/OoKL+SvD96bxc6ZVP99/gmQHpEHSr7ktcAuEwypike1abagXQIYq42l7/FKMA
+bHm7WyMlyvwz8Id86afe1+ApPMgWXcMkwXCjpCvEQtGKRZqTjvsWUATtPLwFKZ81
+UsScw05pm3lJ7h5jdOQozJEYkke4gZe2EE50jyfzHV4KX6nb/LEt1KjG/VtvJY1e
+waUPK+howyVUPADo/Z75gv4h3O9mIKNyw4qvK8cFZNF4x8N1N/8ZGXyIQ+sPVLmj
+1V0LFgCuLlh5G9OVjUSZCu5fa8CfvpON4duIXODMmqj+RBoGAJnwaFVA/H8YTWIf
+csOjCyo4WBPL34SL58grxXtPdGrFd/tHOy1V+dZ9WDwu6RZTrl8tFZ77HisVyuQu
+sjCv+vq4Ivr0viySV7EWIU5RN/24wye2P9c4L+E0w/BUE52tjPqfUkwGDyFvCCeX
+CNLJOm4dxq/EhHK4TddGeaR0UWxzRBSPEgVHPEua+ClZ0zQxnBKZdvbTCcflRWGI
+kkTE+9TJ2SPFE5GOnd94Xv/fICCBL6SDx4vCpYSB+BmO1wmWP+3B6KE5SfyS5rCV
+JTYz8MIxOVCSjNbCvH9oS1aQjwgOWDOhrmNbEAgwzAg0Au+mZ4hbiJZVmwW9egbK
+BjAJ7Z/R9tVclH8NNpmyCaplBFrgTOTufOii8TM8fj6Ks77UynzvBEYdxbyjlXLo
+V5vSIZC8AMDtByWN7MH/Wta9P9/2L6xd1ewKPwWyeaANeH/6Me5AN8GNnk61yRy1
+kPhHUjzTmHJ+Hq0B5omziXAnIBXGIKjL4rQwbcAbdLNM9MXWf7UVviknGIxyo+c8
+zBwxoPJCzu/MXtvLfEZkAW6i1okt0tfuPZlatueFYhR4yng/wsqihmGxOlTFulE2
+G4CfxgPddceQwniIRVuQ2W2JJRSCJlZrKF1QSMH/J++Fw8w570WGs850r21p8dHQ
+YseT4SpiNvvdsbAYXM0JydMxpnf9lnyLldwgVFPkXM1VUECIYWnOAVcM+FlEl5fe
+hOLXyYwQGu52EXWE6I3GULXc4sdBxIVcKQYov5ROwxcbo+5VrCSZX4HLK6JN8cT8
++m2lvbNZq5KiwveWzecQRMslEa/UwpRViHeBVltBf6r01XXlNsG283QiviKHCFc7
+zhlEEbGsvR0iRO/PnUkeuVqaUFfDLodqAey9QiXM8EfhSNBslKr1lzsAwrpy9jKh
+D5AilzhGiaQeu37q8tXDm586/PzA15BLF5iVC1AvIzBgnLJM4KcaMWDDT43f6S3t
+fPkb8qU0QXfGI6U4ClyAH4YEQ4+IUkL7hvO7ZbWxv2tzm8l3ttNFBokKz7VENd5d
+oaUGWK14woOK53WxWvmf1t/PtQSj5RQZ3lig2bhTkdf9i6ndQvkPTskcbpEW4IHq
+fjvZcnMk+LmhMixSQH1OWStaIphqj4hoqNhvSogVU6Dfn67amV5053NxX/9D1hyp
+4yXv56woaSBXFm4J3yPWhUuwCVC014OT3KY3LDheScCOdMnEotTsVgMALLsQ3UJL
+Fp+XiEymY/+UO/ufZZjulONvo2sbEizBTdAZ8xxC6oEtujDGO3Rb2r4z3vjkIhok
+QdV1B/heAL74PlgE5Q1AJl1CL51ZJhIjV39uTSBBeZfeWRHO+f9v2unLoMF03CF8
+KHe3eZ9/h/hhXiATeUz0C3hbxgVTszl1fPX2MzJlxPXEVaNPpiIxB2/CdPZTbFZ+
+dEb0fp7Uzgvj53Ie7eaH+a2qpV18rgAJxBCdTkExBQTpdSJxWZmizOMbhFPt0dMO
+GLhs0vyTi6qBMNlMeEiHJ+0qbUv9FipBeAVJIjck79K+Yw0DQm3cenS3xGq3nrNH
+MAZ/CTRWatg/6yvZYbqkq5183Ai0IDmA0C/63ksMBZbYz7ynabxg8yhchUeSUwPO
+gR4gU4pus5UC38tkLJ9urzmkIHCbhMVPT3iVB6G0MtaX+Tzrb5PArCPG2oAUVO+8
+t29Uz3NLjKQcQJgicUM913r6EsW1T6QMtQseRbk2khCK/y06rdl9yimWciPcqCml
+KQpE0ojvoIvvdq8FLM36UZdfBeU4wA4pe0468VrniYCCexYK/uCviIhOf+SsQk+k
+ZhNH/MN6i88TkpR6075ze3nZlTGGnbPJsC8McKSO5FYi0ZTfaZ6wu1AhQVQxE4Qo
+DR+OH0aaqC64RJGkkRlaPxtrNSeuj9XfpDHhp8kih0uvRJ1FiB3pT5DX6a1XJeMv
+iCqYRWTM8rSlKqJTUgiBG7u/RrTcWBtHzHdATdYs7y5qaNT58cf8G5bICteFyEPr
+fIR0TGdPAAydiZ57ZCU7S+xNq5xfQzdmtPqRotcbAvS/jR3W54A/96rpOZ2eGfQB
+g4tUVQZ/Uw/aniEipq4ga9qajuikv1VWjKa2DvayuYQEtvPgpNVs/j843I8klxVO
+QFQPpLcQunC+5b2jEu1zaUkCJlpykcU5l7u7kXaNI7YPT18dJSAHruUYIN1AUtWV
+fofK6zNAuoP2s85Sxaggb9lR910jKbodLTCbEW0K0D8qPwGJahsOi9h7huoPg7F+
+SGFVAHtG6O0TxcsQ8btx7Sq1hyhOi7kL5Ular7CiWQE7lEHbh4gQNDZ4gjEQEN6g
+T0Q8EUy7xdTO6fn23ZnVqPH8B01GhCBwftpc75hXD7nFNWtrbrAHu1yMYkxpvWE9
+G4d8QSPa+kdm6G6ZGb6X6j6N4oV51qdy29sniL99E4RJ27ntw3lgUX+MxdMM7Q64
+8Po1k6hwxzDOCY+4BzFnoOUjgV5kPs/mKy1BSpBa7MDEtjNZVYUKsXVoMG/KDUhP
+OmjKTHGgEHmpcJbTMmAO6hodXYXngDj1Ay7u8EADbfF6H2bF5lPR/bi2xhhXrwdj
+YwA/PdmnLTozc0KNckJr2I5QVzABhMITN7z5SBIpyEnvOM80mv9Gj/Rbn4KQtOMC
+tBrLd+T9xpMICM83guoV1tcXuu1y+c5HX6jrod3dvcCsEqJ/ll3Sd6ViKUJdLU/d
+BqIjeMPvccGQzVJUlqJF4GcNLQg1n+8svtxCatm+Ii49IMvdsi23o6VIf8AwGMXN
+p90/a9ugxWRbG2p1sWokxuLL9CoS7AAbUD+WJ0qPkn+9jqt+bEYzmB4+2CiFeX9q
+p8E9amaLkOZwnm+bqrnbkjvVH0p56R9NPtTd6KjKjznSvLRgQKRG0mqSis+Rb8xo
+aHMKEvqYvxIL4zRH274lvPDJhaXZC3V1oQliwT0gS5dAocM5VElgktO5a2Du32zk
+T56FuZpZHFSU6CShlFEJ4tRK05evX8rkvcIIdTdTRGvRG9vmNAP8y+Wk0AtfTlKA
+UaHsvw/amP1goaQb2ChI1SgzvYMDpDz6rJXBtM5UX/XCsrTApE7OEp8mZ1zOCMjp
+T9//CdbzfsJm/L97icCWGAHmqJDxRTTpzsCuzKtfBQSzZ67/H1aINfKL7z6teF2H
+aK/mwfcX2kpNpIFe2aknBEKllHSgi6UROp+TSN6Zzwt8oDTOAmTLw2dqu32mDLwk
+IXRnzcIIcWP5un+Vts+v6E080YgU0OmjbY7KV688M3XYwb66K+H5QswoUWFxZ2sc
+CghOpNvPV/5KlK8wD1sLrkd9cPj6nAAjdJAzExHXu0rvmne4Z2HDAb4QL5pFIyiC
+K8OeCzMHEDmOu2a4EK7XH0aPxGb+iEcQ3mtpuPNDwwu5JZoT5Ys7Qd2cBrBQTv5G
+tMnCHCyM/PUXvkK2xQdf1rw2ZpxMz8Rif2Bw1iEjrrdMbSC1nEaEe87LCaxRLbIc
+jL9u8224woX1DHriAlRnJjRoG4M0awBGSu+vqiav5pAF36/giBumg+0bxDgmA9a4
+BVt0g3fgHWFMwYQbNFpNheSvRC9m9J34uT5iX+c+k8v9DIwT9H1iFdkE97nli8y2
+6XwKvv0059VXbSyDBzKIa7i18IAs4Iu73wLwEuEMDjL2TdMFpMBN8GW0BfllQm1Q
+mDPhXDfJPryT8L2b2sHAFrgio+mh6sR61YuQqFR6KyrcirTtEpxNYmtqEWxTVVHA
+qayD4RJaYVXhUBFZAMP+STlUVlPM5RgCVtem5hXEywRvQypo6iM3KHonCYwnfa6y
+BVS+cwB14TMR0VronDFuNy2DnAb2WKcS2amVUwteLuFcZ3LkPtXcRqA1LHpbjldf
+KTV+95ULGSX+dv/JM0OdoxnRKRVUqXG2iZsUSGNKqjuf4niNFvcRhdjnnZZAiAPx
+svdsIMIpiVXlKVwcqpizx+ILDMFBSz4y+HKvhisCNtUp/EPritOwzjvzmpIaWY5r
+ubvo8DEZ3XS/46vjtbicGCyL/IGBAFDhkK4mpJHzJMoubwc5RhFyy1hzfwrThy/s
+6eEgD27y79iQM8n7DY8PDXQeXwUihpyY19oYK9ReVB1BA2MJSyeLHZ7jiiHIjbXL
+3f9DPEWJkRDZtg7ZoHDA8ZwmkPI93v0C9QtNOywljv2PlhDQSXMMp7Igb8mCUBWL
+Z5Txn2h7NcwxgI/QqmjTbgi7C4ndMaJ5dgnGNzJdlMmRWg0ioydAo85iVcsl4EJG
+E6YoyI69gBs0nljAOJ+qL0mVBh9AJ0acUxaa7F2Ko37oYdyF6W+lioBiSrrdvlUg
+32WnUcZuiT7+OySmILvJKjqcDPyPjAGb6Ody1KTAJh9LJ9nb8N0o50URvIZlMwzo
+Zoc/rMtvRD6QxqKI015looskQwej2JTpQjCsZ26Ye8KReuVDe5w+YbkVMdCv/ic5
+TpNomSyTLrcN3AJIoZ8wAZevEernTG4pkkMUqe0g1KWnHN7Ek29Fq+7S/deRg+JO
+Z6b0CooTPGwK6CuBJZ3b6JZZNEfz8/+8FQ6/a+ilIT5tHR4H5FAxc+Ef3bueFkR8
+y5nl55idms7vvTTVTXHNdBu5w/D1C9OU/F02tXEuDjtqGc5sE+ig+d2oiO15LFkv
+ml/fY8/kOBCSfncW9mLZdJl8oOHZiRk2RKjD2ioNoGmj9HC17NJjmyv7hXTD33eC
+rEKRj1Q9kZlAy9C7rGi+/vvNFsfIcnmR0jbL7yZo0JOPj2X+bQid0ak0w4CYnWYk
+4Ith9FC7l+QmAwnpf1di0LRK83BtGb29BpWugaGJjERaRqIKPnJpyGQcowHnhkLM
+FAMxqfXiH3FqMHPA9NTh6elyNApnID2BQtGC3EFUnvRyQ39wphvsZCRdECMlyDBu
+W/RM+qbsOTvwJBiHLEOYqw96wg1moSJCUvu7332OYP7aaL8ka3tyzD75GpbcslAg
+v+o6DjnhYGkikjDXI8bqkbFsZpRV4MXjrtDep4yo0Pk22VHrM4rigk4GNaJFot0j
+uzmpSdJtofq4hNalMdpBDhxqxWiQ1a0AeWlw5mAF6iXV2j4JqAI7Ja1ec+O43Jl0
+Ehfea3dE7n2/bdgFH3c0LcR5yj5w2U0jzmOwIayd+KS+YAy+TvFpMDUe1LoWtl/Z
+nuDwq+PBhJlH5H8GPmJWMdcmgHtUBADW8KCGk8KgounmT4514PzCoWY8X+dxV0hi
+UfYu5qpxxBus4zyzOAe1E6eS2Xk+cL1MRTP7+/xrCLrQ42UaeH6Yg/PybED7Oc4x
+VEeai3IDQk0d9p7qZoRjAWIehYXBfftqACrBmchC6kDww7YY0d0G5XS4F1Cua4/L
+z2R+wLe5ztBkC5/N8ab351Ayu61q18gDrpbZZtjzbk03vDau+unEv479ggEN700c
+bqfdOGecAuTJ1vxdChV/+tCuOBVgUwBaFTocqEyqS0SYEZb9jlKIkobYVkOUnPzY
+XKEToyCUTf3Ji5CUpK382SyRW0ElRE58niNsVxYpvXhVtcWxCmhJgl/37a//iRic
+wSVBMsho6dYvoA1jJGzPY49jf/e7yiS6rbWVZ0FmhGWWsTyfj8O5F4XWO5BUM4QV
+Vt5tIMnlQb2+NU0fmSOAQPuZq6bCvIVgeQ+wQ3uapj1avjZnaivY6pJHTo+C6UUm
+o/+eEo18sm7e+5RY4dW4m4LzJcaNjgeYh+DOBCRJbYzzpEQd8ChFojZf1NIANH+P
+kFUzwrrXB1fDDsEvCtCipM0TxxHBiwnvQs3/6Os8I0Nk2VrI1q8iPHOeOqN9Yssu
+5P5Z0wTpeSEI/FMwnoDquX6ho3YAoLy0hHRW/zUyuEj3+EJuj65cfBcV4t/7Y9rc
+8GhRqL37anjNvodu5xHoFItZPV3+3DXAM6f7zrxBrsYtrlW+ZRQ9AC3QMmdHUqvZ
+1yeE4a1rDFPznBhDCyMt65XkrOB4LAEHRgGqvuNXZbBB0xbwQXoeVYskg3SyyEoF
+6S1OONUex1a8y7HK8Zr+cRWSJ2vPvS4BT04NxCA3k8jmQhhCYqkUgFo5jKI3sd2G
+UPymiDRukTI4UzZWRDXkYa8ur7HCDKCVAZZoYpEtz/edIqhWg4HUP1fAlUNhVAZx
+tamMaOqYpbs3NUOfBxdl8FfSJmiQMBJrKomsrhyvmbwvXADgvk02DStcp1VNaPcz
+hrGqxvMreo+gPz+lEOwxCevwslooNr/5p1zBh62NvYVOVCfYffhgJNkcl6/AhMXE
+B2f22O1bmTjBNF/luDdRb1N+3LS6wQuvS/beeGAAb9zME2HuJI6hPhH9r+kc8oaD
+D/iwdbfdfMxk6eqrKoG3IQUIwRG2lxjL/WbderwhlGaGsqNigDl/6oYrSM8lqXST
+NrFJxZ/CMjG0TK7mQxvr3Dq98BrURC3QAIFMv8NCfCTBW0IwQ2fQ06anPUuvXi65
+d2venK0ynycGk8CdiN9iEXH+aqDn2yi0VlraACG5IpGKiLxFN1LBArrcyib+RrXh
+ptWbSM6FRinUkn7Q5NVVWXTlpDfOGrCq01RFwnLS7UBzACxUiSAQwiFRFylNF3kN
+x1SDlCm3Ns9tZbngkE+vCi/dWTqxYGKsaEBug0axbZ2YiXsBxOGwij7EBiTuDM+e
+8fqu+2nSh8Rb/ACiG0PliUUo72fFU5s9BNdTY2anBC16VTkNT8EJjpftTEJJIl+J
+sVZ1ZBZuDTqwkVc57tcpLF9dRfqLjaHvqBEpjmz8S7bRKWaItk1PJ+/m2NlWMLHj
+1ClUNI9pUKGKs6FQkRMjZEB7fKmPvnO1voexXqm6Fv43Dz8zqftDseSZDpAVFVnl
+AUgCKn4V8szkGvaQaOQXTUpLY7S2trSRpFtCce081pue4r0gP2gROz89zywTDTo/
+9g7MYmgj/yJ5Ag20YG+N75BPz2FFt0J2p+Su/ptBgspW1Psgb+VV6XapC2RntiTX
+XLAnHabDCpL6eYN3bBzINYvAUz5ylGBlCupFys9o9I1buA8vNe7XagxE18M/NPrE
+VD3fgCNvLE4726qs+WXyWz5QgS2NFl1VPdr8mRRzaIBAqgkwknHDSgwpRfz8bZb1
+Nvtc/UzIZsrwpsMk3+mH1UIJpgR4GhmAC+pZGzdB/LwFsvXNLU0E64mMzK0JBcC9
+SThcXkU4XXkI/uo25/5J4vVJlL6kPu8iaOucXwNE9mXqM8GcXyXjZWfQQsEuHoon
+J2nF/Rp4aMaf/8zrqlKIlWLQohD1X3ZP8uCWkJCYhe8ZRgl2Zbpe5Zs5uHhQ9Xex
+z//ZGBFn6IUdtNiSbwWP/ygctenlDtXV/ypkmvDfOa1dWBtpMGKSIyiV9/zf8+D2
+LC33IBtyScB5247p2u1FpkcsMuyBIGCmbWvEipGS1nHCl22yNWa4fddA21kdDFPg
+aT6FY0dJOlFaNPWhpg1KbPAPngJ/bX2u//ZQyyhzjT5xii+0TZFjvMgS5tK+o8LO
+odf97FXYfLlM/WrcQy9mLpj3tDQoOy8WWfu9R5FL5UBOXFcGW0IOTexzrHNICKNM
+GYQqIBACmJ7MKeYRsWgtm8rMmT8ZhPF0Pvtki7PTW1W8VVjPIeXdMvm4kY8SKlJY
+ZHjaBQYO6b8rmyY585NeFxn2moQvlU1ZlHquopL0mKXGwMQCitTIk35/WbR48cdx
+LAAuQGAY/Mj6bAGCxZhvavvNjzsnNmxyhS30DCJHg7k8uG9Yyw5XRPjYUFSqRRRW
+o+Xq6lcuETXH8MFTwh5ju7ScW0sM94x81OSU9vP22Ez9LcwkgOHH/bajq6yrkShb
+KEYKt/qd4++CYRdX4zJWUQTKAhES3WUbNfH15I7JvZhlw8OEVZibXOpUD/8cHSd9
+zKS05w+STzRnVFJVz4vyx48Mstuur0yri+gHMceDSSLUlyeD6QEIuZMQi3fr4GTT
+PYlq9zr/SBMPa+eLzbP/LCgxWgH84zcECWtRmZPidmKV/zEDNSuzou44+ACpDhSW
+t0RWCE05LAtcZUKW9VhNzx0py3V+GURWSFYGOa849dfDqyXUUXQU1AoIwffyANVr
+YjsXbwvf/sE5qQnmTrzJYX+5LSJ8jbYtc4Z1/Uimgp5flZVCdbfjvXmrnV/wjOHe
+LflX2XADtzXBnUG5PcJgOqZHMkQn3menbZVGqC87vkKRRdDBMIWWJOGNRgVeUc5G
+6nu1D5mGnBXJqikkMB57cmelP42SWG5YBo2YFPobge5qAj7R5szg7q4Jy/UF2C/7
+UxHgL69mizh+oOazVBg5Oyq8o+FvI68dprphoDWu1tC6y4qVITNx+EW6X/6ZGg3B
+MIe012zD4z49Z3N9Ozl6MczSnBTAPmCAtU3aMEs4bM/W/uY75iZib0Sph1smOPXX
+Dk2r8TY3CdsbcUdJVBsnKOkzU0PmJuhziYvKE/oC3lKIT2r1eo20IbIeCvRlruSc
+iJ66LULMYI+xlq4tWHu4prB+jgOu5TM38d4G0pPxfPaCQwElfm7ApFaTDLqaDC7f
+Eh8UVtl7B7NKewqrxuvi+ygMSC8i2g7IWtFFMQOtv/4TcLkRqVLGHTiRcoKYN9+S
+3yjf56Tqo4NsBdLCIlk28VPT1DVlANxE/QKgiSJlsxseF8x9ZKfTyyM7MnzkkEIa
+kQDBZr0DvKTnWbgip7KWI+sO8Y0l/bjwKn7DBdGpdSJ7mASIsf22qFVd6JKCCoTK
+HWoyjgJUU6qaS563eRVWw0oNklOfb+TzGyzJOptuJ7IKBOlEGYIJ+q76kWGBmnAc
+RakR7p7wX/vWpaNCq4qoJTE3Kz9vsT4OWny9XaQxga0nrZmKES3zljf0MEZiMkq6
+NlXTcmuiONXnA4yXdk1BRfJi45xoCiOD/pbNZkoDX0DXBmsUlcBmXbGio9dtvg87
+TzyiaBAFkAms290eSJfTOsO1VDI7WggdYxNKZ14qRihciCxtapUbk5JRcgFMR08r
+RkwHCP9P88W9frdy/5fHV2pgYUbnQPChmluPaFTVp7xBf+sn02jn3yehQSwStp2H
+iPIMSiB8Og2sd0TtuNV8tLYL+M/vWhbcT/cR140hj0wqjlcL+7y7R1E+1KGvQDK/
+Zj9oBbv0fjuizzHgomaiiU13AZT5R0SJgmrhdNM0t1jdI+b7w5xpqHx2YXvB5Gj1
+pLcBhrMxkdouAZdOb8XyBmgNBppnzd40jISocuQaOdrldHgKgAtC/i9hNgt+Q57f
+uzFDJwCOyUR4cwXt+YW/dct5QtPqHlsHKwokoA1hPsRdw/Jco+p2SOq3oLTpvTIW
+uh2reMpMPdQO+2E4eKnQLVRpffe4T0VdaU0/NbPicEB+kG55WdNXMFDG8SaFkSA6
+v6KBBh+B/1UootFtOif/uM1OYzZHk/9nzgH7zIvaJ3xZ4JejhtcC6dYoK11S91l1
+6GkiKcl2GvPTPl7MV5+FMyzJoZp+mpQ0GlTOCMRi732ciemLXO7tNcLScCno7PP0
+7ZH1Yr5qNrJCX6P0mvbMHCDmw04oWVbvAzSgSuOznI8J2mCuJ0tiJ7AAYZBSfQp1
+2PlsxsEgHQahDXaFsupiVGv8oZ8SVwRAo8gy969jYcCbEicL1MeG3bbvQ2C6XAKr
+bZT6JlKLzzPXI9lcNshdDY94GTKHPw+3+1J2YBKjclqBiLV1J/gEEU0GxXiare7I
+mSCSTQtjHkFlssAUKVv64Jpv8g1ABV83jIH2rpXH38ntSHwxzDm5sIYiOVLLLHOP
+qr4/VM8vpfkLbuVYDBMSUJV8PnvViK02x7hWuOALWB6fhmMCZctlBaeUybAI8GZR
+6nLT3Dn5LTqfg14tA1l+SOZCgvLa3FoNS9PXyo3T9MQl3ADgf41CoV3Wv+SdoCWR
+fdwMxUhydVU22yZsZFcUau74tRF14ueWH/dynA2DC7/onah+jwpOW89/bMYGW6+c
+zxob4iv25zoM2j22qwKdM2uQvAqH9BhA8ePFO8aCk9iHqsX1oysEeiyRhH+NfclY
+PheCWKr00l4/PqMxjaeIEC8MadVQwCYW4/4/kQbVYeJFnLh44en3GIKIRvmdGpNA
+/rIWtR7cjF4YI1/1UjOy6BYFLYOjKngNLsMhBOJFgX1vkkp/DriSKs2Ln6g2/8z9
+bTZu+JlciuQqRPs0gn1UQPbaO+Us0B7KwuWAafbUEGNtHG6Z2VT6KUiT2fD4YOEC
+aRvw5r6tpZRAF9fzDOWyvv14aCIqaXg1XT9JsAUAdJKi2BQoF/XpeJQAOOIVr6yz
+TowjoWARLdCyaN+UcpSLu8W1T8O+9kbJ6SwgNfNqO++SRhF1Nxfc9Nh2cuRrcD25
+iPEJqY4LcLAxprquHtwLlkS53zVBWywN19xyrqYHnzxwdhuc2QQQ/a4pIR6lV7ic
+CO5XX4NuDv9acDwSWcg9JxIP6kW81tMgdzZMAm4+2eL+d74teTme8IWH+qT9Oe5n
+roWj6K6xSmPBmoCI5X8lSYJS6To4sCI9OIh3L3Kb2V+B1Kg09uMU/f+HYPbClHDC
+2K5yN4UzX7/YPe1h0fV/L7a5vObWTMK8YAdtjAtRspa5/CStATjTrRCjv6SuEXZV
+hplTNZ3SAgSWZyYutJgp28S54rGM+NWPYAjvdzvJdZ5a6BGBl7FYwWj4Gs9DDrv0
+YXS9v/K+IAjbJhf7JxM3AUYRjBWLolhrKcBi4lIrizZYr79u+iwMrUtQ468KXhT+
+vrjNSjpMd6sv9rRLclXo7VJvtWODYwzr0AdhplTQetxpRg5X7oIZmh3RLHG59ScA
+3U9kjudO5vJJHhGdiNKMn1RZrim3YuB/vY1wNM17WoBcNH2Oj0Uivy7dFfjD0Uqr
+5dR6XsD4uizC6abNQHE/0vO9LZcyvlBpJYziVhP+xzbYFJRde6JhKDhXANMcax0x
+awc6wZTRNXgn3unRLV8ZTsrHpfOLZLAb08kmXqW4kDpJpcVplEULnW9VCksMD5Jp
+PO7JiP6oNZHbFIgHHtc8fvIzjQGFRUequRdiWPd+h7FzFCfzbLzcCaNA0P/4pRkr
+0yOHWh20xA4MwusrhXc3NCsBLKaINFmoTuq/eVFeNpBvxLz4zBUpo3a73Wf65ite
+7AXVkz6uv3qCz5i95uNQ7BI1fXavOVzNdp6Dzzz32vydjFhm8jBYn2HLNTRmV89X
+2q5ZLy8aWHxTl5sZDRf9dREXc7NEAB/QnxgEDyibKahqJeYwjqvufkfwD8v9rLn5
+fZG9757Uepju2FEDpLxavoedgK+wiF0S7Z7Vf0CkL9mGYq0Z+QZS29RgcIRNQaqK
+/4f7ztT2aL73wTdATfwTG6bxUWYSwn85yQVEWkwmi8Fkf+pofvS3qFprYgQIcISw
+efVZQidAdCX6QnTIL65qpIto3624wMJfUN0QV4eKsZJrUebs4KE3JBORKLzlqmBy
+5qsPEVUQnDxyLOZ+l9HrsijNZeCPLEU6HD4ibEYhobzkn8y/y/jHxYm7xZRGTxFT
+Gb5O6gPVdPpjkxMrY36J45Ol7isebMm78QHhhR8tyj3qJBuw05Q+21Gwoc4ZTgPt
+yWVlaw9gyrCSG1tKV09KwKo48msIADtn0mJS6Zl2P2UDaRv1ApYe/p9/RHBZWF9i
+v3boHBn6C8L+ktLZ1tGXa6pJg4oVFokUs7LbjWpSfY5V5PkkiJDrw+YE2etIFMBW
+9RjnaofjKUOvYl/37tj6UstiNvyEScYR2nrPSuI1yV4DmXP8pPfsmdrifEPrWzwc
+FXlh1hQBhSy3OvxV177LQHPWwE9YnSZRqvSkHOahu92S860PlN8Qx0XsuOBER7PR
+DjW3l02P7TVMfkScsaL5/wk6aMYN7G1Tg5/K75ot16cKIg0n3YNFZnR1z1AW5CDn
+abdqhRb+zeaDdzPPWU6REhIlgIY0+OvF6YQQawA3HMwWu/8lcd6d0YNEOvJBmKjY
+093Oos+IHzUCj2Io7Fs2qtJ9ERxufnEXLc5n1FDaMaHUnfHTiCvDjFhj/YMPlp/w
+GAc2+g9qL2Lm2s+NtuEg7gdi2APU6tKP5B3HU/r916PaJWE23Rn9Y1cUSGGjImzz
+1ZshuNOBERnBBc5UMIzsPiF/Aj2O3/LTRBSQnvDQwFBl6zFAJ8UNIDIB6xGqVOdh
+3XsMdcNb1X9BD2pvOB5kaDZ4IDCOljqLoBxiv2WsZkr17tljqAM0Tv1x5u0HD22p
+PHSYkcdg4aSJWJ2C2u05MVaDWrTlewk/nOtl4tHcPKzZK0eKTR3WNaVjCQ73QJGb
+6ZytkUHETMAYT9qJCppJp43vuJLAlbO/0EBAMWobuW7W9TTPYIf99V2JBAL89L0f
+3rKIFDVYNpNpruAA/suGCzBBVt6/NL0q7FUr8F29TYzXlBrTW9LlfikYmyFSW78p
+6jBoKhGLGAOm0CQTEOQKfbN0qg8t0ZEJ1ABn+Ysik1osBjKDGRmj6KMfw2danYkq
+0Ix+lG1nTnb9OEYqg5QOAQX/GUHYpeFt+abLw6M8wINXsz9BRWmo6HrQM/xMixiD
+sspQDJu8z9oALo8Ae24k4qgkfCX23uKyV0e3XeIK1qsLGlp1rQvwCKUzPyq11bhJ
+IMuOSdDgXMfMaJ6gTTMesz8ci+KX3Awn3/EBMZLBaPoAWdvyy1abTFryCMrQ0VYO
+SHSDSuTHDx29otu/QeUYYwoRI3nIcM2Kr6l7xapjfd+6fc5YiFtX3Q1OW0MVAepa
+vpFOLvamNhdVwsRCNopDJ2h7t4ZnYePwrDj1Jc85uA7tNfrcaCzgBEtpxoIfl9dX
+zTHZsKGMsP7Be9BQp+oetcwaaLCK3BtsWCh67eMgDoZbSC6GzZ+irZBIBbhJfZQu
+QGgOGLFsRdShRPlFnhy3CjTpKPKIV3PQk0gUZxLIp0LUkUjLqQ4Ww9+bEOOEUDVL
+irQNk2T+I8X157j96X5fPADDC0hfVt5QtEQ9D/+2+i2iuNHhxJZBoLBgW6r5oehU
+rWTknmk4dGuqHHwSfjN3C8FUwS/v+bw0ZfgdG8xr1gUlHppbzxkGiN4OFonnWrXK
+Nnw4CAT+vbcmbh+h1fSAnN8pl7lI0YQEHnqksf3ahQNS1PtVNf5kwR90HIXy6yqQ
+6RWDsth+adFh+5CmIwwbYMPUmWbQCAjmZMmpPzM/bIMWMw+Pa7/LjQtRHOJp6NGm
+uZBB13yM5MZiNHCmU8kuX5/64WPuBmTgsV5c3ayy4pczSqXVnky8QmWu9I//WmD5
+VqLJ9G32s5pdWQEfrK1BOrZjk7x1nPkO35vG1S6rDw1yTVt6xpHL1MQp1H0xZ8Is
+fhRjvEZUK17ADFYsqjRhYGlDiQwefYNaj0gXuh7z6+gejhv+iA6cREori+33/ROb
+ztHVz1krXMHFSbbX2ZG9I9b58tVuULyoE6avkr0/Pw0Mg2+vbTG9HHjyHWP9vB/5
+meP7RMO4B5qn/Kjn1ncotoeF+wisxGyxBJtCtdSeO2pmBvzfXgOdP44V0yOxMZn/
+8bE0KHqGbkM/nxujmox+4jaqeCFp5LIa17i09QcQECKUztdcD5MmKJCD4rLKYoZP
+YFQsDyLOpdUhz8qJ2nrXCV9HnPExyVWVQ39BFK5vnvgV6sfwe7ZWjF1m3Pa+gAOy
+SfW/SkCWnvlv6bAr5eO5UVa+RjjGEyvntchhGfk8Aaq1M/Tx4zqE78wnS5k/2SYc
+Ws/ZdlWGucL88BozvP5gWYXqmq0p2HDg7x8Hw3XWEXZ0kGSkt0QDuVbYLtvi15z5
+eYFljbk25UBK3piHKbmPiJt6T+kNhhLtxnED9VxjjHcbUNAI9XqiRO7yWh7tWz3S
+uIulzYQoVq2D3tUbMA7RRMxwuNc3xGL+r3Tm8uQh45Bc6PE7oP3/T05hZDiob5Nq
+6Ab7ndPlVGV5MqwaWG8iL2mmaahWUMcwvQ3uxccm68/ZuM+PYqxmcbYSokZM1vXa
+vPyiIFXTqKIa9vlaLw5QlsLvbEhfzdU5ZygQGKQ3oge77LOURte7AltlM/oXE0SG
+L5AIg7DOU2r4Ul9IAFTU7fG6t3emEE1Dbd4Ule619ptJ5aOOY3Xc2rr58my+NUBE
+Rbv4YK7H9jhhZbwRdjy7DbsjyBHJHkUr6CgJIMDjMS8xvOQq01eno/ZuQUMNChfv
+7BR0IWZ5XTgnJou7dgBtQ/UULeHBwnEK1cBNF9uHpkHOePJBFOH7PSab45VXhOC8
+s57TO2A4RZaaBNffxi6K+NggWoITMh/ZuMzSEu4emjR6RJDw0Cc1mXzDctJWfFMH
+nYcbuj8wNdGtff8v5fy43YLnIOlEX/S4v5vApuFebo/gxWVWHJmz/hYSBYSmC6SU
+mbeIBXdghVx/287Xm8k/n4dtkOEzwOa+rbiHMHp9P5cZNp3DLiW6hKX9wMS67Mmc
+N28MPPwTJXvqRYTPn6BcCTbaHAppUxG6fRMFNPDIo6JXCEvOVMpqcpNXn634CBlj
+20JlbtCRDWlJvhq3Lzy1b7Ca0WR6I/Gj7omvhtWSrTzgw3NN/yRwyGBFsVzWmU+9
+aCkatGcGjNIMQ//eMbd8F7oy6AHWlyWxO0ab7P52VpkE37uq686M8u02Hwg4vIRi
+r5pH+1Of5yaBQCNG139cFENiIdLiM6BUerxSs4pgkeyPb84QMB978sKv5nbp5rpr
+hV2Aa3GuaYKWjUTJMba6w62eZ3XNdFRdRS6NFQ14AJUvYy7rWYjkWF37koLAxuLs
+08g0eFroEvkQ+H9q8evDsLRswVGwUHYQ32lK73Hq8utQZ58culKqxz2D13FGWSgM
+kFOL9xeSz2zRSQZ7343oqI/QX0Jqj3u0sXXNiAM5DACFqXug+OH0dGTlEVMP7RDM
+Dm6vxCEZF5aIoZ8tT86Wxc37JwuIN0UmSILerCRWQi3XMgawGYV7QJkAarg6UxMz
+2nAkzgQqD6JFsm+2RNY6HSUDLy3KhUt1YVe/iyrxFi0IzlN+pbwtDjRZ6oUochpi
+0npMYkV9H3i2Lvoc33kXpMESVFnvrhJ8khACha+fzPtrKSnTfzWlB/E2c60Uym0G
+KDbaS5SK0HsZfe0sco18yYmAgcps8LNPBISrJk4XenppB+zAKa6m552ToKTSNNwO
+23FwOW2sBQlw+7IQrfTuVU416xbiBp6wCysG0IYIOeVy0rS+HCZhFHDsDfAkpLX1
+3zSuMMDfQUvxw4v7Ll3Sk3BJhlXV6v9q9Oi1fu8sF+jHQ4ar5bg0zUgpL4d9eQ6c
+0hkj44pTcyvo0f2k3c+vEAC5BsAQ9GScdpx1PRGeV1uZ6Vf+tK48IdwUeO+5I1Kj
+q8Iq9sgLSWefSdWl+SXl9NS57zyTh0Jnf0IgIxktSvvr/OdzyN7bT6bb6UpchHDT
+f6uQph9iKjq61vyhWAoyr5n2MTrtoHLyTwAEj0S2lmXfioNycMtovIdnV+kqroiA
+raBWebtHdcC1hA5m7Ltaqr+EhiB4PcxZxh2lKBF3dkFioCJGrlABqQu8Zp3equFO
+0qSXLdmw0cantNl9lDadLue3Xo5nCizu819mciwQdB3h5/axuMYR+1611sLbScem
+4HBaOzS5IXRjOvzTEjmBpx76F/YHc/j9a2pb9rfrMseG9OliCL337JNmAxScQUcG
+ycEQ3l8RHtIoXQdNbqKtsYBdugCX22ERevHe2a1CSZdiNL15R5SVS0+LJEjIx9fa
+J8wJI//8ixZ4NdkVHvK3483Z+PcpBURSoA4W2PM3AoCegLBRisSud8e92pE9gcuW
+wSlIYso6yx1BqWDkmQFcDx8UjuCM5qVKoQdTLFbd0pDwnB9O0ObdH0LLlVrhAC7v
+3HOjvfHkctqsPBchJn2Trafv9Wiagr6b/Q9g2YoVWQBNTiy+pxYASyg7pMkZC7Ui
+JLlRQxtAQKUW5WxQ0UTgzHCs4LJ7HxoWLEUtIMH10UQLfRRX7RNct22fO52DzaGq
+GMX15ft8y039AI5z/7vI/duQWQUkcCQWqEy9CE9CXyaOcJjSqIXoDvuZqo84x2vZ
+1v6sCFMjKGIuZRxWDTIHHy9zHgc8Xs03ksJ9VQiyuCvgCgHyusyq1orD/fNYm25E
+04lnw8X9hAeWzdl0yDtBumCwYLcL7h/IVUuscN3J3hgiNTIW4OMWBLZ8VCDqw4fv
+v0J3QZ4jViF6TcYEx4+/Y2lata4EV3x3iOJ9qE3YK8X5wHVnEBjzyv9IerBRYVIe
+yHeJ6U0QS2OdWKzH6lzdVCGUbNXvLjKV2tSXfujRj0gsALmueQx35k3Jzr6gS9Oe
+K0e5jb2HR9eWLhXL84dU4OsjnvINlvUhFCEJnKXsUI94autmhI6NgfVMGVCVqtky
+6uJIQcZxJjR1OzC3YZNKQW6AiGCV3uzicKvkd9TkLklS9I/1xPwCvFknb2MLp6jn
+Cpu+OWv0LbaW1xLKLkcS43hDMd0GNo8+8hZL5YCMvXigykgainZgoQpI74TOPUSl
+STZ1iqf+20ew0/YwjYTpqqEAcKrTrPmEKA3GJwNBKeOXH2vLmhv0JGB6Mr1a5Yn3
+l/S5VqILRVDpMrdJboxcK25RDReu8OdOskfjVs3PWBusM8LfLMdvLmLChEAAKH0T
+OhyssiOipO5rYaW02MpE3UtP3/wuKEe8vk5XdVzMPMQy3/4+qylYugWjRfEDWuPz
+JreyyHO45NHZbeVf9ro3BSwCcQ9eaUUKep08POhCwTcCXShyPwayLOdgWgARXTrM
+JaYnuaQRDuNoxtYaClgplkQuRWv4nqon8kz7vfGAold1iA1FAz5MIfu7TPy8bRsf
+qobU7C9WRXGNtqGUUOjvqYudg/VlNaDvEAu+99NOSlnmB9mB2rz+W2QxAlPAWkXA
+8DKEJ1hjC7mCavmdpjCcQlGGoErfaz9n80qiili5RpxWVrQ59iPB8wW04++kUe10
+/axhr6c35WNMx2H8QhhO0gDSDUC0jG/KDne0DJ4T6Op/qqHV4Qxx5PdWWwFE0YT6
+nAw32eP1ykRwbfLqxFRV2jV0vF0VdNln59AxgtYRl/OtXnpLGsnpkS3ugccqIjIf
+Epo0E232x4RMqBx9McKuHqWcmcMbFM28/JmrcYm1BmukPTMzZIC/gKScEoA4PnIf
+2KmvrdI4wfCkWN4URE7w+FVZU6cAwkigYZLRDy5hllULJiEGjfWmFP503KDP3q0+
+dJ1c9CdS603G4TrmQ/XtkGKR1g4hmb/9tcSNFnPgqoU/UlzJrjqtICoYREpt+7c4
+MbYLRQ3r5rGr+usJQAKv+3zLJbgrT2XoxeUS/SEvWGdiw/WLv9jxMFgb2bjxZVxo
+BwfaHdwTR4DuqjcWst2gHfhUR9pZb6I6qj/TMCzzD/l4RUR53dAzuWSgNQU5Y7Iz
+zDqnRKwknd+SjcC8iG3H8JAh1Z9urIQS9OuDaTh59lZz09iup3xp7GLDBQhfd28P
+te2pznbHrbFtozA/Enf701NNl9/jgwjoePmVv+ZXzpGWmQLu6fHkJdlw9qXJzZ1p
+T2bZn5A0oNIXP3VNFxuuFpBzSXLGXbyT3mxGQnEXGTVMuNLugbynsCrTMIx4zzGV
+JZyq6X4pGUGZtMzV7s+c7gy7yUdhtoSNq3whl5I3mo3bwnj7Ku3iSmc6NerjRPyu
+mvz1JdFihFGfwrS22lkXBpZ/DsTfPhEh0hxzyqY7z0mc/EEo3DMiJz94/uFrWg57
+xkBxBdXlJ4yjoYW+mpEW/komichkq2M4TY5mduDJMzm+kMeW30TFjPH4yRmQjNc3
+aHA04nLuES2wqPJEMbQcqCb8jkaN+S1vhL5eFDwTLJWodLI3KVMqUyskA0xnz3Ao
+epxdSbEUNULpskb4yTHWeLN6HIDnJupHEDddrnuIQ+JmwNu/gORfERWE6N5umAYq
+T8/pUiU1spKdeHJzCSZz7LI9eMFGL4j0TMx7hxVj+Ig7t37Dr1NCSmMqHqSTHmjk
+lSuuRALjiArphaXXTrXifJ0u3kkigUHeqYhL+XXP/+VQwdEF3Q60LAcl96pm2rSy
+/72iTXDbTNL9qPvEg8/mRCp2T9UccwyxY7sKk2sqDZcEEceuxrJSOT6n604hS7nv
+pQcQa+tAOC180wx8Fk0hjI5blWElq7kC3sUuQOYLxoazfcYr/Ana9IEgUMqBrNsN
+5sDoTCKTLswPagyjPGxei+xfg7/eflvrhxzuXqHKkUdWNVKQu6ovSAT3Bnmkad6Y
+RwlxCRWDdXlA58hcKYvVc9jdERPDYIK2VVr79gdJmrYL9VT7N2EFeUutCx8NMIlB
+bAllD2T1vu5S//MjllxDz+Aj+fGL2cj44L+NK0/VXYw20/ddP6rZDK7W8JEjMZb8
+vvdT4WatAMHpMoS2cyU1kWlqOX2u8JPBS6TAYN1VzR8NTp4XCk51ueXvAgDPQPtz
+hRHbB2KZ7gT0DShAm26uWUyCHnqn3I7nVutUyhHylTYUr6p9kRlWHEPj8NqIECMC
+ZlS8VKBQXhjiXgRU65ojF4uTK47/TkZ6SyClo6yG0CzSkzCVooFqIQn6M80YK1/A
+lyn6vr4OKUzcrg9VoXjNHA/HQzcEnqvyMp9PFlkPvd4Yw88EgYpePz8ra9ZvLlcz
+Z13QhGhts3Ka6i+UU5MvkNKN4U3S1XC7SsfjiIUIkui/wa+svPP8UlGbpaLnlPiO
+l5VMeKHyd0zWiQ2YvQ2OaZczRbjoHMiQ8k6lBM5xtPL0N1L2iQtm6DwGbi46l9pz
+6HTjb4ST+zjj1EYVPNOTBUwwYgegpMCYfQBhHcc6MsacJvv/k0hApN6qB7ywE0hH
+ifZoCgX2k6Rmkog5daw96ok9puECJngqI29OURy8BuPzmkaGUq4j/RRmE8xRzOX7
+U7XpwiTgulbh405w3Mnv9Nt9ftq8iMj1jd/FR6VSWV2Cp58VlgtL1NDt1OaMD4Kp
+egtpPRherOqO6YXNVO+hdg1bumyz7XU5e2/V0Mp/ZNed5J+i+w+Jukqxft9Ucf1X
+VuaRLXhN/bD0pgQqumppS1JycI0fQUVO/mOjlhLk6xq64HteplBhRgTiyUzeq4YJ
+aLQ1EtWCF0Oar5ig37uG9ODIM+dnhuMDbwb8iMi91bDwb4xU7I7PyS6Uc3QP4SW2
+SjQN+sebPUTtAJj1F8INjWnkl2O6cK+7UWDTDZpL8iSmqrLATvqsVP0o4jK1jcsT
+ac475zTlRxNp12YI+0CG2gPvAasTxnb+bHHPCPTAz2Oq/wq7tNonHT5Hfwf2Rss6
+fwPqLga74nQpEpdDD7PiIebuHp6HgHqGBZ5lIOT1oUo1kejaOuwxIpRc+EHHo+fS
+1bFkyivPMu7i00Yr4I3xcd0MJ79gPBAAePQh4YSwd+qGIyS74Cur9Z3NHEAs3bvp
++1r1S5PXgvXqMRm3m+5VRokszhIJye9TSM88CzwVTTslXGdTZpzbNYQrbDY8c1E2
+ZM0vbO4KN3ZoB/sN6CCpjQDyWg1IpirMZR21UaH2PHsk6vicr7wCr+51n+Lm/JNI
+on9gm0rC227AzMSFvsVHikUaJkUS7Lx55yfWgzKQldg7Y8JYj9SGFgDJBDC+fg2o
+CvACHo+OHyCpRoLCijoh+cdc2RNkFrCI/b9urA4GRFonI2FIgpa+GHnFA3DedrYg
+VwD/5qe7XBukMGmKTNGmxS3MaMvNZ4I09+WQWF1V4oQgMU3dVfK7+ImmbH1b2qJV
+eUsq2wOYeyoDdCj/aBMCxnRiLOA9Hh/fQP5jOj3Ffef6Kp+7lgh8DZnBTkQSzVdg
+3/DUTax/gCPg1/ZGJtToPcJt0Jc6/wMLILavkhfJeciMYynpg1zP6JtWDi3olEr9
+y6U5khYna1cBvCjW+plqSwOd+st966dRP2fgWvoKlZ7thYOQSFnGCaR+PRewv7lY
+G1iR5gHqNf6Wcc3BYdf69KPZJ+Fvcztj+sMIaPVO7XuUuQYkkj1r2DX1pGMWTS8B
+05HAmef3X+82hD2NLxM2xJH9nJ864IRc1Msn6hBG0o1lSr62ChQ53l2wRRBdUYX5
+4zU6cxSaX0r3uIjzh+iWQpU3ksrzrtfN/z9GNYIwR4GbCMHqmWPYUZ0hHJ4NIPpm
+5SdDDxQX1yPFWKij2pUogToRYMznlOxXvoSK0pwdh0c+r5TJ3bJzzsyhYIw7nYWM
+fR7mf4OFA2e5vSAHNzrk/YXZ1mP9i/jXVciF1s4DjvhDywo7lrLMjz7WVOXz5li5
+VAEb8goXghiY1yiZF99cC9e6Dm5AktCTA3NXf/Um2iL3W0Egt0krjMq0fcNRk/a2
+BdEXHlBuDTx2j1s+Ulv5BpY/fUvFvC+02peJr3AmqQeluPmbYG6/X+SQecVcuriZ
+Lv11T+DPCpOhtocGMzKt20Ibz0XHk4SOTdXfvfKW1jw2+1WruEDjrVa+EsM/OrgQ
++bfp6jP6KuGyA28c4YDaIog07//Sr4qiRwf2j5ULNlwlyV6elAdxU2KI0rhFp1lR
+a6ioTELn+sSAf0ls82MaQrpCWe4JL/A3zclCkuwKPoL25SwXMdxg4GOPR06YYPuv
+lMIMBuJ5fBtOyM0xN7Fs89kkTYlk+9EtPbu+j3XTdY40ygcgqNqjq9miLP29FKV2
+R7zhRLvWQYB8TOu1/Y487XrmD4janpSnhfdkEB/h4eFkQA72e6CxxHwKn4bW6gGO
+g7+xsiV3fEqCd4Dj3kkfBNhI2ROZQAGDRd+wUSyh6aw/KwgYyNv5tsXU5MBpEn8+
+X3E+o0IwQDAdBgNVHQ4EFgQU4Fl5xykkgYvzzb8khqcif5S76AowHwYDVR0jBBgw
+FoAU41akBnP4505sNDHigUVlOFv0K9gwCgYIKoZIzj0EAwIDSAAwRQIgLU3u2gQ1
+yOHRBCAIggcAqrfzM59Rfu3m1/VWnoaeZmACIQCnlMu89/lld1Gn0pLJu9rk2Jau
+Ptb5Y875X6sGe3/VOA==
+-----END CERTIFICATE-----
diff --git a/certs/frodokem/frodokem1344-key.der b/certs/frodokem/frodokem1344-key.der
new file mode 100644
index 0000000000000000000000000000000000000000..ad15beac7477c0d79376ba518d23d48b92984a00
GIT binary patch
literal 43115
zcmV(#K;*wLf~aQ#0RS)x1_&sDjBx@22Lc3ws8j@ks8E98^P%bk@QJ2}^0M~o#AGHA
zJJaAei!TxD^;Gs#wmMx<ujy_|w(q|zucTU|Z2oxmOxnD3=1e;Y?m&s0dSHL>RGnKZ
z&kR3<kc_QFcX1bRo$5vWilokZHoVz{fbyHBT-AHvtfmqpvhkb+6grOk8vt+R5&Y5~
z#w`fT(I6n!)Q+V2LN1MDa3WiS<vWi-3pidT9U|<B{yLRl&tXG*2}5r{<Cc`_Al)O7
zZ!xl3bz)Bi;IUMzpdf4l9O;4yFCR)|O@n;2{P6g}R{^)e$z}Ta`$kZ=O5weZJ*78C
z3~<DvhDdztWQD;0P3n0P08%F|h59uhI4Yd^Q+Cb8I#=taYn2Hb8CP?&A~TnLjh4`8
z0iPDcZn3HRyBe1mKy;EX`EQ~X=p~6w$Hb+p4WirLK`Wquo6RtR;C*+aQY3|87L4E;
zMp>FT26zK(+4zT9!6es2fz%`Ab<N|Ldm)SvDN-JM9!z<jt)Xi!kGWVrE1L*nsbn6O
zbZj&dA7b6+sRWWFhawqT(Ur88?$eZ*LalCx3HtyttT3Pz!!Z>Ovf7;F<)ro^`BvL*
z=FLIYPmrLe^L82W4SalH5hB6SZf#Uw9#=uB5P|{~QD%S<sHgnQC97m-6+rP4a8I6-
zvOJqF7V{9QlpdchQXRXXwbeEOc^;OhM<WHqwHTI*!$mXHdNf+6hB<t|*kBvol>ZIS
zsE<mabky0(i?1?qWpnC-x9;Vpj9CjirP2`t=9Su;ArMW)%tYwbLD@`%s`up_apsvV
z1-4SnxJlMgu@|9v>q@BXrw3_Zhw6*{u*W$CGaU=7chFyav|g7;*Ccs(C!<<`V!FGK
zK`5E9(bt(Y?lQk}wCTH!bh@GLZbq?T2vXY?C|1HVQAUxH`+%u3c)zs>$iJlOavlK`
zTY!;%FAZJKz1nbw=NJ0wD#o6Zh8jBKVI-On%ecLn8x?hWObvSxA6;9{(_g|a&wtSK
ze^ALLqcVlL6aViSR*?s%Lo&3ft5_~g>YCw?Wpru-8@YUP0xeE(=bl_+4PO8~6doLk
zg#Iesw1tX27WPz985NP8C+m*k)F4^6{P!M0p66?{$j_CxXJkMG@RSmA&JC}2ZV8v!
z<6ktU(O3c#UUAA?OFoDVbj1Su!Qlmts`McH67}DAGptQoVkTf&DOBK-Kr4EZ%)6==
zD{@^eQV~mS`r~tiyLlJ?0*Wa%P$2=3I#tx5RHY`H<!Lk@kZFs7fY}im<dcP09U)Uq
zt!UDgpU##P9*EhAv*2u8NI+Y-Q@T1Rk+sA+;XogXWuv&(1MRx3IP+r{8U4O3&b@<F
z$x4bKTBZ(y#0K1G)r6=-c_;`&_YIKsEbyY958jk3=*DdGrW%5|5>15Q6}H5yx-2WK
z;lLMmI!KP4YLgM$D6NTU!35*ZDESea3_>mtSlu#GW;ipI2F<vDcTB3(%aL!Yj}9Cn
z@E}cSL|Ly?3b@#JF3KT}>URL9lj#`1Y;A?(-SgMT#ZjBcW7s?vat5@C+H-f+{5c(=
zeH>)35GKxId%ru;x$5t)65f#Dkx<UyYQgUerEX&A>BCjXu!2?2CPhr^Jf+xe;Nec>
zA}Fs7tTd_V?#2E_8eD(l;$9vL-bVAyX}G9mu0aS{;hhG>T33#=jb&a~`swb=;Vit^
zIN9guvxuL%6ndRJ(YPhTy`xQlgG;Tpqoyd?H~1e1FzNR|!MDo@(-vvV%W<OWq)Ih$
z=&1@q)$vp*42l&@Boqq4s+bs~uU{3i&jfurTog;uct+78H5hjH<}X!ij&fd(I#i=@
z6`d-|itjt_GWYIxn%~5F!ZQzD<nE%)z@$VR{R^YgiV^L+DL3kLvMK&u60b+ztbZ{g
z_%<vC`xJ9Yij@fJ4`LRxOL$C&ZgfnN^<keFo1P@|@d!BYVA=potkbU+mxYACk>XO9
z__P$3hda@V`(8~qrpn+-$`#M9rE0@6z)SDQ#`GyEs2+#NR28oILwD9#74s+I4i}97
zIr)WA2VM8n4g4^MN^FLz>EG34w=W_%semFOpr<rfox&$IQG|6J#1e#$?d8pDkR%uC
zNi;OLmhfLwV;&`?W|$H4TMA3^TCfpdxAdUK=k@=3O6-Ia{1Xh>UHnWN<6bXRS)^_N
z5I)zq$~BShqN-&(S3a)v5FC#|0GNN`6mM42?|pD!?1aJOLLic;Bw=jJ{-Bw3>_!68
z<^8Vul!bqs0G4&?M-$9~MTz1+DNZ+=e8W(7mgHKOF9_$Sa)U}hhMZFxo{$`64&Wjw
zAUl_hn8{gPvQDHLB$IdXrg9F?$BmfVESA~5KH^NMI%?9W@($AJu+Lq^Hjh&DIwgN>
zfCS&WXLA&*H$>|xPXE9JqTq)FEuR25Q-rCTV3to|vp`n~90~zarA=VY2o7z}-=1&=
z-AAM_X|lLL>&v@b$J<{TT!9B7f^${w(q{4xIl=VG*Zg5Jp6{Ae_#2`*jY%tCZE|;y
z96&?er|yn1j!TYsr2&ByV_*ch)79hTWa}onECng4p#Ai9Zs0&3pN&1Cr0~b}KVLiR
zuKI(w`D1}r0nvP7$`2pe_Ba?+sh4o=f`0MFP4m$VpBmhGi`1PIs<rb#Iv#)RMai(m
z1OW2Z`-nlb-#c9I9h}3VFr)Y{d$wN7IQ77bg`Aj0&#;^2;QwZx0l#(K%*=OKqc5Rd
zX_>`Wqx(`O!na0S$|Wk_L`h>R4hU@*zjz(MNO$6&s%HBgl#r4PrkrW+QOhW_&E!1T
z%Uhm4#)hhDYuEo2Xp2PyO;;+89TR}udWYvSuItO*I&fc2(2T3<jm1!EKOK6_v8~vv
zv&F$cM!w)5L!j?oj_CZHT&g(RXGuyW)sOmsNl{!TYI-04@XkV~UIlC>w(KYAZ3~*c
z8AOSsF%0yKk+?hvy4V`R_OCZ^S=}rbqUg#(fQlXp*SF+V5u@l|h(CXes)u$Arx_*?
zWng{&iSQ2=AVNm+_kGKERuC=!af=@XTpw~3Req-{Lt>u*%j#E{5&ZJtWH6r{1vch`
zVMa;6lB5-9&`X%N@-e5$Yt4L*36rtbcLsk`>-Bwe*WAmnCl}-=dw5Ezb|-c<$F9Od
zRd77I3(BaEG~x#I$id_genp`QnAc4iDaItDV1|v?H@EdH2Jr-j6yldNUb57}*DKE;
z>O^2LRC$wjKJ-_TAR|t|&^Y^4&S6jjGO|U-FK-U*=ll!ZL;alXEKPl!;yRvjy<9X(
zW4FjzV`_v0gGyU<#Fuz6Rwl(l9rC~kpfHAUEdctM8t5kG@=K-r^2J35N0dg1gUnGe
zEej4I+a+sP+EYwJEt-&N$`?I~%7kY4+9TM7Tf3X^x*D&o=B9XD(I_Fayn&&>u+gw*
za&ZQxMY)e=r+ohYs^V9$btuK!5Q$}-=W4j)CK(UUv+X}??_4g~k)R=)6@(yny;@NB
zIxS<sZTLyTg@3HMwCNqf^E)at>)6yonY~ItUoBy&RBU6iS|>dzkW=Zm^Cf56s*g?e
z^h|5Mrr@HrL9LoI30R`P?8UcLK8?A@GI|`E%y?O)o5Y-JyH2!`X0w}_lF-7|uT3kn
zT8F6>h9+~dN(4tnR#lq78aTfmCwHAd4l~3D{2?fu{~L#V(X_`=J-E>582}pp=7f==
z7{utJsWo7EUA#V*JQ>NJXtNPD0y_hENvH-#%3bm@w(J!0i^0I($qjN~%nNbBhLj2y
zcRW*_=z@2TwVnN4{ubAwPq^2*J46+E-6t;mwJ<N`tvdo<R_%ZpSi}Bj2^3+j85E%)
zz9#+ar{Fr%2g66uF}$ome0=K;zJ*|1S@*0_T}mr<oku_eUQ;l$;piVv3cpgKqD`_d
zlN$HFF`^jc<Jl#1Aq~bn#doyxH+79#myazHmBMqE(RRz_L=k(VgrhWLg`~n5%=On9
zfAcg{y<&8P?ML#t<*2>W;`j8##{Rp0T}pr&4Qb@CvMqT9nn`>fv;N%hyk76VHPEdI
z;VG`{3s|8vg;eN3N?!R~VGHV87BVax4)5s9_s($z_gg!|aM_XMku&ZXKc!+!EITd|
zuXxg-h_@9qoyepS9l{#wB}C!cjvp+GR1P2nq4u3NAP~Y@P~Hh3$PNpXHS5WAiUdY-
zNxqB_V~eE7d-cr>CQf#)KHTibHhqzRjK49qPvabjn(^98-?G<ELHau@F98wNml|eA
z3R@rqbVjOw%{)XH0@gIOsF$(U@EUe!*)!n@_brQXa%RoE&!MXjvMj(%^t8qJ-S`(|
zHn8OS7Uq@CdWLTSb#YLr?pu2pUOxVd^9kz9V|d&ExhD=6Ev&1HbDS35iBoe@Ty91B
zf`r(luTA_Otrm<_?;4R9a}be)`~)9o0GOS_CKrxU-SG*`26-5&DL-Hy2ZE8z^SN`>
z31hf7$Pz!tzT3bhYXx%Zcr(meLISWr7*uj>K14&Ws;<hIe5~!(L?!R4BNK8k>8qt1
zb0r#1wb}F*J0|G(utdkD*0WqSmL;_rDUmmhQr`XEbayO<^1DIxT7ML-2O$AN@!)l(
z!KjiuC|H5w1490P@t;7#u4<_swLzbV8!h`0cIYS25hV8|5ngYdnr6K{AJ$ZnQL#u<
z8lqSaK7a4P|IRFcwAs_VIY>85Es%Gi2eKApayHKut5b^t>*q_vgS&%rDmsrJ3}0L*
z?n|maW9WeBK$rC~5yWdMDwLykj?g5Xohn4WXUjbI(&qsCm3r+|Jy+(-pQQdB^=KFt
zESuLA@uUjCisnZFNcXsw{A0XmkU5gJBrx=k<|1z@qeyC^OWXfa66LP%6l?-{v?6|T
z9*;rjphSK;IsUy@=nuEb3r%gH<p#x6f!L4>-EPjHx&3b!06W>oE)U2*E|bXBqVP7F
zUCWZ^I>_TA*gIvlvHCQY{MK8J-L=guh<N3LHHMy>SaH6PvONSh%0tBBFU~YvPB(gz
zby)yAe})LfA=HcUjUR4VS7O-~$o|W1mH!qr-?<eYF*XWP<Fix(Zn}b15ePUnXW3x1
z6eUA%5wr%|zs642W2M5dtH<f07%W6USFxl<{aQ(B+8)YSkj=iVEb`QLRT|PSV<dc0
zd`!Li&Vw1VTb4>W@qPy%ir!KAGLNd&RC$mt^XP?RM{5%E@JeW!0l$^<N{$m$I(D9A
z14{g46|n&1znUc*KWKJw4{9x%4xpw2&Xjl~7LoGuKR+8!csYrm1VCveky+Yzvz}^e
zca8U^*3`hjzJI}}VarLE@m8Dk_+vtSI`4KAAhN$eTQ*#yO>_b0Jj))UQkUo^X320S
zBq4_O3+{x#tN9Y2OG3kfM@~hh-jexDf!4@>(c;Y|K6M?kuAcFLp6?;xQrmRPU=Tui
zrm4Krxpi%G(~ebjiM78;Ir|>wMTcXLWLkVDAK{-7W&Un?VZ8#dVV?9sqro+)xs-dx
z6`G`;94K=DK{Sb9;%FH|j9zvX5yaz_`tW=ub)1&*k24DSJlb_({5ZNgFz|7A6f9K7
z3T=&{(CgChTIKY$m4-Hc8ZGxEck61$il#_D$$w$@9c+#Aa(ac_zs4R@v~dm41z*oc
zJ0I2B7Z18*UIkO_5+R_r6ObOq%KEHxamm{@ivIzoHL}YYK~y|7y^U<3?U@%}whqJb
zS`k3LFr%c6KKM{EGtcrhWB8C?p61pqg?Iv+fa|Czo;8b%$<N+1RG-K4qKvXWf5XMP
zx0y;2`iKk5vKR8+C!=loKfbqrEo(w2zTkXA=(MW}6~zRjiO}g9bHo7KLFzbvt>J|u
z;+Ps+EFh>?X(JD|W*&I<t)>5tBFLSyViBRwz#-Gdi)&wj0!-2{WNcE2w>?(ShwqDN
zBefW{-AzMjk*P=+Y-OS?{MczjH^8e%db$}(G$A2CckJXlMK)_VxkPn<tI~{qgZzxp
zA0jU*TBZlK*m9sz2uffJH-$1aIW<F=@b^$yj@Mg)evaD?0X>U!&7S+LeK1$eRYJX<
zAauMFxr<QJXUXCf1`jPVAGxYJLPX$mOcTCk(qddyBb7XxJ{d;##Jj`(hIR|osNMtQ
z1)zto?c&;@Pn`+3%z!GUWkNpzmHwJtLVJ0YM|s$Q;;(1gq8Rhj0!|wF5&#DCCi1DQ
z9|vtA^&(<DK7s-dM>piI$#YXq;?!PA%MlF*wKoWld!I1fJhy&`n53~Cg%hN{SXCHP
z-4P;w4+1Xhs6`70u*D=~#}k(IIoxaGn%72AL$Lvp9&p`F*)L%k#J?9Vl;)~4rgdqf
zD{m{7&#qV#YHPJ?Nq0@_&$jMPUN6^F3kPn(#W^Og_mS^3vH-w`S5fp~stG)I1CZ&c
zM4eXEVhcPY*?IfXe_`A-a2LSeGR(={h;1(`8=cEBowvC|xg;<{U+6EMZT|;%+49)1
zYy<UHd2OHzL{smsme_wnbj{;XVyRe^gwTG%x%njr-WGifw_6vIL1p{R9s#EUh*e%e
zAdVvF*t#k0j(!A_Gc2b`7bArgpsZ(mLHXMkmrDf<z$Dpq6#1=UrffudGD3>Hc;l;o
zQxM0_&m6MBnd=}kpL_$QJMDtPGeP<gD{a0$ep9#0HE=e;-h%m;f#D|4YFTJ{*|h<R
z4Wl~HLN;L(S#igz+8kGVALLkM{3YMTOong$wB!@+P{gX5;wYn=SX1$?pLS*9b3lp<
zeC}-|a5pkk^_}L~lyWp;oI5i`zJ4*!gp&k&+~Hzp(TOzF-Fvo;{97Z`@yTYQ*NF*;
z*FoQ>*Lx;%_$N-5M*xr6GC|a>sevoHPG>|C3fKBlo0z@|&LUeg1)`kjtUwm@u&}tr
z4`%bh&+G(Ypj9_@{zn_*+=fxPP+<`6vx?Y9!Z5xOn<&pu2nMv(IqXnXIcs*xADvRD
z{Kg|}F$$59C{;+2qntMLgoJH_rhi{VjXIr>x^JsRND?UwrR+-uoPLh+>aB=xJ18<w
z6A4QCECU_n9?vu09eg!3TKvG)c(?CzO((^ecQFV^CIuNLSwc$Ft$=g|#<z!SgyR6I
zk8HolHojg7ObNhdCHr!mcwSZWtI6BmcT+^2|K?JNs=pKmNqb_PRXG@v(o62HiL<2<
z19!sP5cg_HNCk_08)VYH2iaV4PzJ1pBc=>X0af9>KCi007g@sNd4qScAC&zQm;Q=B
z{q0w|Ey1K1q<z%jIz;NS$wEi0xX-jw^Z)2XIAc}vL-zSn4L9*&^HXa}MVJw=T(2+N
zF&`0eow!4jqHK#YwW4PfFCtbZ`-2NJ^jsf(5AX9J!T2DOCj;NS>Mog!1t9=WNONFJ
zpN+z^X=yEhGj1}kKD2sx=SgQMsry$W5JE1#drhWP4c1LL@itq85MxkL4?s`|-^IcE
zvdVdV8ModuoAGm4t42p8wY%4iYd^_9L6DQ+ELE<?UR0|Vsot_^gIXuDvDb0BCn?E7
zHgWKwwt@MB5{vdeV=&ez!(|0u3eC}5Bu)#IeW^ob)w0dQY`PD>HhWX=NU{$hsvNdq
zpJak?s}Y+&GqB5O%lDZ*X!U@lAry6J{1u4kd<R44FD4JM9B0&|OH29zhSu=DeZ2Z<
z0v)yNjD;5f>G35bL6&*HG(4myFo|%bvs{^F5m^9~)w;H$HR>JwN9_ww<nj$T_+<{Y
zB&>j0p$*5J{t6%l0Y%lwuw%XKO7gk9t8go{9PG@BE(8em*?z!d!5WI|#i%}+RH~<j
z$(h)?AEmXAZ1dUmdF7RdYnJIHtNhxE!HOHQr6!7<FYE(y@3A=<e?Lsn?6-Ki#@bi2
zrC27GxYn6(FV3K%{z~xu>AYO&l~4EI;F$sG5Ok~VOI!lsFv^&udsdrj1<)aixY}O-
z6r%uadAnO9CCdCW@P~Zqr{34#DLlv)UBe{7aHFIv#6r=EMVgb2`xa0H?L52%DW5e`
z#GJ!UX`6XT?jB=w<S5LM7?MZ0ftR)rPIQka^BrCaU#Z*tu`Sf7#{FAwC5>Ler4K9U
zXu~B`JOJqZp810QA>8j~Afs}_imxlj1!U29$HR3u{}~y4h(qfSRJo(oT?-Zft}a-4
z8`G7IM41ZiUu(dhzLSmN+lXA?%$lhFL>dMFneb>;K>U9gO=2H%!=no-I9L<Q--L_j
z$ScKrPjqU<cl$>>Emir}eONp$=@wJ2Uo91$`yMM5%H%GxFt7UhxFY)WzATbgu@)gt
zQ8)d#!zZ>s*ElcXG{f*z6P>M$`kzuv1`i=`2q%{a(#bk*9mcQ3gmSn|*G74ybWv<`
zL==w_1xGwfn)oSM(=;)h5}9`P(+S7rMPZ1NM8x~l$=M^t6OoRc-*{gC-yk4?FQkLV
zi^8RZf%qAY*9n$C?ZN1wIZ6DI=CG9|HZ$<TF*#6@jMl=ue`rfqkdFusSTmunV_Ogi
zFw6)v0`I10h+Bx3RhtF9dIrh{FbVCS(e~9`lz$C2nX(D0WdvH_Oyur-=%Vp6Jbpfk
zv%b{IeD4HC9mTw(m2&7;o6;eWya2%M2PKW{!T(y;y+7afFRWeF><T{xvU#8lcz^ma
z?m#!ejh;@m$sDzi_(xJa)0lF89<2f9iL;4tCm<EZAgIgYv@mVJ8+5Zw^u^YHwH3Z8
zCm4)!qvt%#95JBsLeB5ZUfaujMq~kQqSlEm(%0@inOe5zg<=$V%6LD*%A$s0u{u=6
zx=}V8fS<+#-F3&1!gz>9Taejpi6s<*CRS@GT~J8D|0nN-!^}DFMTWD^bgyk`@zKy?
z$CKeIVmABTv9K6i%?ZiVF{XF@mVAqq+#pm_<Xp{FP(X-bY0d#x4ER|@mzUmz;@8QH
z5E|}w5p{&<jmA*5+~UVU#D!cb1}MLjPQw=)qwZC#B$;1<%PXQy@x=W4ZKb`lS*wzw
z!uOWV=MY58B@wUG!jx5rcY#)0L4T_B)pg}I!M5{sBEBMr2v<AK8AK7Wti2r~MDNd?
zNglacnow86E{AFX?7c!I%<xCyNYHGQs`ZyU0K&R*_A;RlkRq2jMv0^zyMF5O)x(>g
zI{f^=*N{sWn3W4qFC#EuoU%;dry4O}!%vOh=`HPi`5W@3G(mU9Bc(VBT!0^j1VfLA
zQbPNN^SfoWvA=6`o5^>!(?te}3eUAfHQrsJr3P57c*28<=XJ4K`JdL`&$R@j<rEp-
zSfJUsQ<2yGi>cj0`43LX9Bz>o;DPFXJK1t`B>1_ZGAvR+eNI^`S|XTgkBDff*l$XR
z6;q(!pRU@OUUcVkabN#K)*PwhCGY2~C}|*97H$dOBi4mWunADK*MpPXrZ+4&UP-`?
zbjie`)a+IR04%!@-9k$ipO=VCrept<JNutynC_J0Z=-7)5-h<@&>8a_Lh6Anx-iB&
zbX(fKGv4^*A{rz?)pZB>UI4!MK3D|h4L~McLNA?JCK4l8e{M}6L3x+nSrN|p|8Lsq
z%b>w@+#!4@cei<;e~0*CULX^BO!NzQTgC-bvpIEq_4YF|WyJNwRijU)A~6SV!gTgi
zY*v1BM)ZE3)Xodz=W-tH=7;&Ms-<0gt^f(d5S>mzF$Dzabs}+DnWD_&8-!Es(bEnX
zxNOq=lZ&c>FxgCaNQWowDs4;s7Aiq_1xX?|B=6F`V+{jBZQOcvx5R3<p0h_V27d`O
zR%+Nk>nqt|x}>X}eB21MAUS~0FZ$j~3<Z|h&%CE;ykPSvT!lxHQv=R{9w1YSZnKpF
z-^*kypKh-?q#$scgvC!!c$EjCv@+J0`8?}ylfbMa#@c`sRPVgEZ&c57ON^u(K$s$N
zLp|4e`Vz&pPoxaB3m!$eHj)sE|1CPL*?r0>mU1K9s41l>3PjR~@1TqCcCQ62&H7Q7
zUj^kjzz!*UPCD^g=ZS!Vdlm}*;ID{?PJiUALQkY-6G!~RdW+8!l9YPWzH@td*_APd
zowLcXFAQ*`j^tJ%(Ujk5p0K-6Awg6z6ND%YAC4bJny4<gM3JPC8CpLZYc(gXkJaC#
zG2y4lB8N+_M4d&59qCVy*XgZSCF3uMDwsuN%<{CQDxy<T2!R{Bzecp&SQ|&ocR)?n
zEblIAXw>=f$NU?X$O_km$V2OVgmg@2PXG*^iJp68B|A&(O{<(=LpNr$`jMj78v^vd
zjUCqKfIs)D={cRA8T0{zi&Rwxe^U?Io*^Qpt{`jLnvUqCzg1R@rnV0Dvblr=w)5bm
z)olJhINXmUmlaMxR1c)L5V~-_<-Ma4?Q>~K0w!8=k;OTeyStHgjU%=XPhTA+AP27H
z7$Dt1Qq`4yhsx_SK)QqWv(8e*s333IQTJUVDY_jkFq;u=3eZ0)KLLqq8xD)udxq){
zgRy={VO0QoM(FJm#mf-!yK(I*wTCE9i@6KsNm{S4qFDhultJ5vh!8Y3c!Dty5Z<6q
zL_85pyT#Pb>G}5EnboNA{0B`&gdlK!+Fb9LR}Z<xHEU~bum`(bjABe_y<t5YhkQXJ
z+WJRk=x&)AzL)AgjpBuQ)~9mY+b4*>eG`O9+qvz-d0<h0jK$Lo?GCu``ZbfNaK|vt
z36Ho3F=wFVBY|FIKF{VWEkR0<TI|5Ywli5(g$l8CXfSWe4M<NqXv$1+pb&YfaF)|D
zU=HdU9bJXzfH?I7F7EI^18wnoA7;hoQ_=mnw#FD&uLome06#t1r!6`&b3%=BLTlKL
zP**Skgu)Xyy!l8HDac9hIL|bi|3;7WTc3iEwBrJ_8q0U&{l=3B2+ucy>J`@47rO0o
z`OZgQsOzEK-Mzr95~6>WUD9`@VktshEl=GBq9b_2?{UG9%~DjBqDA0m4J`;YpYJTb
z+(K&Ez9KF?Aj{pdEw`hkNPoaE7{$$}-9KyFpv7cc8)|j2Y9z+u%k(M|>;M~3Kb9v-
zkCK1Aj;nrbMl+ZmKG-OQd4FoB!98kbi;(7Uo^P9~x!aOE)gMZE=^sr#)ZOT)%8xnH
zytH6Iq(;(el8VofZ_H?Da|#mrn7<MW<1|Oxz9qcy$%Uoa3w3p&31Y!LAWN4(p~E>;
zNnn!GxocqV-)!Vho`t!ZSsYZ9=p><(Q3>MIO4FCGU&`dY!U%OYQ$%ag8{6hI1N_V7
zq|ggrPEvqTq3pj8+L--dp`;twC`i>PGrfZYq&)hpmBF;mRA2SNvb4aYPR<gaCTCpE
z2*~MA-~S2L^M1l+{J(pNz?K*R=BSYIMKtNoz^=@zUj+oSXRiMrR){t7i|;<IcwL8R
zujaw`7urfqq=8=9sV4+NrId7_i=`1dpOZ-5na>M+pft_`WXr>6YP)@=47?;EbZ5=N
z2ytWix__0n&#&lBJkf|0(CMRXj>=cBJTrCJ!M?gH;rT+$C{bZ?XKNe^2u`Hi&sY9R
zl&>%kTMMp7eQ@~toB$(qkTVkz*SkvZns>NoVZ#Bw5HFfVBPfC^!=4K>2M{@qyJol$
zuGb$%kHlvFh({3KYiYRiL&FQXC7KiEi#tKxoCdH^PX0!;$-*2gjQsT%zCyOe2Vd5_
zHfEem&%|PXU~twUBd)hhZ6LLrMudCL%L%MeEwUVpzi#twxWa|?40_@MRA(kMXd8nx
zYXC+{@2{#RujY^i->=|^8>WNp8^ky!1J<|&TXchW;2mL1!Gs$$T1|!IuS73q^qu&*
zK4M?zK9kG+42%=>ePR{a1oye+i_Es^d<wq(H0RY<Z7hQaGKg!qweWx};ETK80`L;y
z3=T5(P16OWz)kRFv<3NPLTyl(GvQn}$v(W3@V%Sb!N3-{BBSY{>co20i;$>PdMhg2
zinQ$#oK0eDY7uNxRZ+mHtb^eaT47b;P!U-G!~RJ*R8~{W<ro51*QVwb#LEP4Ln>(M
zBR42|Ckc!veXg<vRK9Znb>TA+(OT%7F>W_4gPaETSf>)%sg+X;UM}HWXL95|)!as)
zH7t5tj#pnPHGcP%3mGN;cK^vUL!F};(J2*Fsd2W6n-oZ6N~$}b;&_b~_YsBI=be^7
zhy(Gm_iP}-DT!6(DO?<?n6t;?3k<<QOFlCAa<7If0yfnt{6p)C)3DAv^O}+xS&nPD
zyXf#S8QpZh<E!JfxSSX)i~NCs08rtOt|p|B^CZeHZwEO>5pv5|bAJlchcE2u;UEug
z^6%J?Gs*i6j}HxW9$y6_hMbt!+88U;UQ``H17itGCyO1P<BB23jkU|&|3f@QiIEW5
zwhq~#aKQ1LCXn(y-u(jg3r#yLC64`%mJrZMa}1}lAaBWnP!)@3l<}Wvdo|24fRE6s
zXwz;8y9<fkF`{{P3C1@vU6jd@S`8wjCqSdlVpYo};6g?drYOjcy?`4uo>;&*pQ<lO
zl?ER`Cq|r87Mko`ilct$Vcdo3Z>5TWVoJK*zEvRKWv5ZbZiznrJ0zwcyU8j#oDBSr
zi~*bI=W^7fz$PC{C)wNZ-6-cp5xj<FGYsfvhd->#Z$v(j#-fPRUS*<-Btr+I*p%r)
zFsx^8n0vyJdgViVoIYW>6*17S{wFz3lW3VNlP<Rn+yY3UpD+QJuMz6!Ol~QXLlmj)
zAk?L&9Nxr}Z$+!_(*4(wgW^tSrt}Jm6Fh7R=qrIGo!jV^Su{uU^Z&dR4!>*Yr6E3T
z9UcedP%(4iAKkm27DRl@ndRr0otn<?y)@NLam{oaxx?`F3)7VRT{g9GE)F|t8P04I
z=%D%CsEF-(ELks_U*BWT<TwzLes>o3V%c<=e4ydki5WITsKeSS4WMbG^l-K8(qo$|
z`-ODF-*<wnLXnSDJ&~C}%h0>5XukgY%@)VVa(R)`Hp}lOXwZ|7k7fRC2%XWXG{b<H
zon|E9i(&LoyO-o90}1JWS7Ok#O7n1S8NIy*m9BxIiHt;AMxqKna%sq99HRl}hC<8~
z12L)f;vaEpFmu54)Zyvrax@BOAU%OX(SqDTRG##5Lw|6l8|-8xT@WKB$S`hO^i2Au
z>^VE|Bp8P*Lzt@%dcqB6p&~+3`@7$Lj$r=UXul+DdveS^`5KnovQQwu>N*ZN;b3VZ
zk}%gJ#_Ex=Y-W^I;Kk#v(B7wvsL=T~*-`5=isFJ!1~sBZqTM6AIjKp~ZK3+Ogw~}o
z+CdH+YQ<=f)vW+|X>jIX1?nZ$+CB-W0y`zGUUTEP+?jL|7v5`kMDBgRZP*1LcQh@;
zdCER;*-azPW3VBto%p1_U<|%a@o6wM9@M%PwqMzv;P9*C!GxJd<bMV}VpcKNCV+cX
z1OV3XpoWveprYyKPmXoq{KBDTJYVN=S4d(}_AchCal{*}<2<uC2elKYlG%AaaJ@`L
zGyD7eYY4i~<7FCnewc&v@@zo+InFUuN1BUr142z5_MYlygku3>9)*R$efw$vD#4k^
zLh3;9!?qaF-3H}!xED~aYmdv%WPZT6xz5mJ3!lyLruXMiGP|v6*T@5|mf2?5^KMNy
zyf&`->BPT|{el4v?@b(Tr`<SboC4&@*8E)x6@U8Bt~eE7Qvg~OIvl7>s!K$e5tjXq
zQizg<*j7W7oc!2ap%bGZluiA~i;$G0t^C<6ky}9}L{5C3BWza|DZO}AwZ*XtXi0)!
z_wBF$i5Q&0B|$RCXzA83pbcXrY|mqlV}JL%$|Sn2wUuW<W`t#yu{@uT!?_oQ);o|?
zGlUgZ-fbYs<w3o^HBBFxBY;5rnX9J4yoF$S53oafnx;KkzBXrSE7<CiM^2A|=|v`^
z|DF<!e6nud`;=JW)wr92^CiZOjt7{B;LZdjNo|btq(mL?C`F<+U)0h7G=GnfRWri6
z*9TX_4#6)9(4wTx6UPz3iwW;S&Hw1@JR?J7*;>ffuOd8io;ss_V#_Y%{#nxm>3Jat
z{8KQVfa<w^p`&&HpuDt%bXNa0GPp?h_(E=vu3UT<72@CfW7^#CXi=!W`)YX2zK3q-
z5$F_)Sv_6;+%>>6r~A&lL9WIvu2sHe6g>bf&@yL7Qmfh5CxqdxYYbEKoESq3BQ5Kd
z<gDO$ECB~b0jj>^S7oq4(-!bSdLC7aB!hIa$Vvt2ElxPq9>-R^%dyJwn*MPWk|%4=
zy)FSyP7TB$H<QTbLKs3~sT6=(IgFw=vE7DH{HBOBZjmxLQ#MvaHRNHhF0Zk|44{<(
zmS|#;EzkFzBB)k_fz&@&z?DN`R0eUisf=jqn5DZnHA9~V7iI8Q(k5t-FcNDjiL9<1
zubI3rTmay{O*RcHT&Gn{X!kRQv8u-ND|(NhKR=}q>@f-J@UmJcHoy6&T)~H}jlG3V
zR43Sd_+TX29G9=agvG=MXZG0bTbVe)G+*VoH&Jg>e%!RW!3(cT_TG440B_vP6JhQo
zj-fsg{jcd9@`i&C_^@@i-F(bs>FTR0fwv(A2*DAyml(_aX5D(cA(Uo@vZG>vIe+Sg
zD@e~JsdSSzu}Q_B!ZI<mOs?ib8|&OUz3>{;L@m$&flR-{LVP5_TS72HXVBB8r#(xr
zUM{(JYu=o#GM^^~lfa#b-(nGQ{%WA-+bFbFTG{|1xgwE@h`dENQo#bc+{z~YMz!Il
z)tgApg+?jVl77(S)m2$^<)k;x8nCL<R7Jva((OQV04!9AAP~YKQ5Pvq7kLfGRD+Z$
zw>HmhWx3#xPp=9u-B~)ZU}CIjKyHIZv2C50iF*OW;joH6#0Dhp49}kN`mXzF(uc%b
z`~adGL*<D@DDP**Q=2^m*HdF=rvxo}RXGh$!3mC+?My;RB43HIR&`_+ZVfuHkyknH
z*C{MtT}AqfjiK+T5h;#r{7bgcDQ1YaO;0E9=GfU*FtOv*DO5C%X;7hxv!PIt6C-3m
zdwi*nzH_y{hp}F%x)%O74?i=h`$MthnGTQ@6<Os0NCGN;74ppF8upNA<QGj!OJlUQ
zwzQF?TS9T|Jl30@;=Le0Xc0R<J<lu?4LU#e4$NX`BmW|K0u8iaZ;kJePtRdRw?cNO
z<gWgkL4wLw)cYWB<yGl+sS9Lhwj|eFuqPd+!wQo6d4qRs9LP0`z*9bQlwf5F>P5=W
zX!MO+xDPKi?$>GzMAySVH2TC;J>P&MZ!Atb+p4VjW%64-P=PIt7F|_6+WeUmb7+7-
zstGWXal=XsDMkGJZI<;m`&|7@$Y#p$ro$xP>4()q38n;i8X15K>RB5%LHxW0vh~d^
zO$6(SjLfYG1;D*YI9y&uI9+)N{^~a8{z>BXNtC{%KJOxE>zrQ$MD}IsGr^o+CF5mh
z&_cm39*QR?X~q2-cxc9-|IF*EQizpe(4r9aUv^LO;Fge(n1$~dMhSLhx?bg*Ik<RG
z^>?w)|JfK3XXu3;wAhkw1&{wI9JT4?4%OBFDrB1Q-#M*aSQ}|DVv-{$mG}JL^WgR@
zE%zWBa!J5>+m7kl?M0?XEHdnYAYi6#Ys89?lGbs;mu<2&X1IOVK-*az3{&7~K80gP
zNjgzlH1(mT4N7eA51s;lZGEo)_E5_xbB#W6iZ8THkz>5b66Vsrqr%Ri*Zu5O*nGK6
z{c7ApFJ>;7_p~%9J1-Vl`@KhzOXWaLTvrBLLJm#rbF6bn2%}6Hgeo8q0+^o6DdrKe
zXf2z{%$YwKgz<Df`(%r=(_2-%Ranm<<=ry*xRH+%DpFWvc-jR94(Y!un<hE)lU^4Y
z_L_t*l}%Zcdak09^q8f_z{CQI)X0;5e_6D6@yBs204_ja82rfkYypDBm~U$P&5t`L
zHf(Z*E%Xc`M}xUMxNlg?4p&6@*icleMHE(}<?8BJE)g}y@WE5U9%H+-oLfr__l$hh
z<dpXF_Sj7QEzBf<;m7^9qpPf|ktkazMhdt3o#XF<VHa29GFDLp$^sD*-DMj!@%7}6
z$-S6m!^4DCn44VcR1g0g9VdOvq_pP`l20^eR8m#Xi}J^h46@s<uS~0p=m#;!gGnOP
zmnVbi0SLL15Q}%~;AGQ1iE8&c|40)LYv+s2v;Qn8F<Jrq<2M8eYf+h#;&x({|1kqK
zE3=~RIQRgm4iuKRL{<n*IV=lYWkQzqSWV9zDa&<!8AMh{Rt7n*IQ7@Vt0mM?bQIJI
z2*LOA0M%<^I~Q*Y-~PclsR`yzyvbpIxh*1mjkYawhIRc&rh=Ydm6bwux8uEetDRr)
zjN#rb`B&L+1GhE7ok6)h!eBb4M>0ew-e;$6l}4y9JHA4ZMbN=8g_b1YjYb7tQO-u{
zd$kXlhMX12swpHe9(!_Ur9X|5SZ-JbjhGbr8-ea>0zT2^%;4^>3Cr~b*f0B25#TSc
zW{Ws}pysnw7&$vCyrbc7Bd;B%x?!L-uGY}H%ZimDGjaGux?ld88V$iPhqTvh!{a_Z
zXLEf!IeIb7(wr2)K45^gP1-O^IBd_>{^mR8CSq?ysfSx8IQ7>KO{?)XHwoJtaYsp1
z8z(5~GgCw6Cg^jCi^>!F0^U-HPipmgjkF=M9t!kjuH>AEp1LhU%wUhPmaZ*Wd$^{s
zevSjK<uf<&-UiZ>@qG4zLjfgzZos5glMK3=3@+ai9~4&Edk3>hdkU+@>*D(;3`j2`
z+78HC(M2%>t-t;gaJdnwQpO!Pk#d5VH{X)qDBtI#>Z5~f1=7MISvK)g)6_L(0Nh0V
z0-%W^WwRR|7tDQRr_;+LJ2HIakU|=f0KsOx1H7c?S-2vnvX&$34)Kj8{kZTde!~UP
zsdXZIm;{Ki{kEu8UFed63WUlXYBG)jR8y*&OP;rR6;{Ja4U$uzZ{+hEEXg{XZYQz|
z1nEQ>f(iPr`jKIQns6LNsS)m;@L&7ZrK3Wtil`+qH!DAHu|5u3e7#+yF@dcot(l4u
zE%TN)^e{$ZGD^BORnu~7qBzy(1B{n;O+iKSV&j}>3L}I5md$2L17ASb25S_Rz-C>s
zqNCSsz7IQ3Jfdh21&|4>+ua^Wm(x1KwNx@YS_mCu6G~@ZDn=+=h%9Ytl^c_iQE~xH
zM^7t8Oa}=6PxHmSez$V}m&aFXU|~k*K=7fOTaRc|)u+5cf9ogHXy@N2p+PJXww;HF
z@(fBKd^!!RcSP;D)qJ$J3;56PS{B?-_Yv2PA&*Qdj#mr&yt_wHKGdPFKr+8(KWGKJ
z^nN>{&oSVlW}=BrcL9|7M?{H&YT<O#G`CpYBj)?VoN1_hc42$L<Y@Jzw*iK;F_GFX
z0hdm1#qtJd4F;NL&E7POgs5`l8adkKba)DY3qt-cVKxhXL!RHeF+(Q+j>$xLa|P}B
zg}-&nc|z0b9$N=13M8NnVLrrN!}46C>UK!#x1hA?y)qWM9jkcCOg+>N`(ZeEsn9J{
zX?^#&Peom6O+PiW;&4EIkZyTd(^oK1#_=YFksvz1qJah<f&Wz~qS0+SC;zz3PGdGl
zlmBPV0sG90+9!Nj;FqI@*8=I*C@Wo3_gQu5X(B1fb{g~3K3>dMpM^6l$)TElnv^se
zRL%&*V()#NiRp`6?(H?g(r_v0?DO>Pk@aG}YBsV$U!(Mz_RJh0=EF`XSyt}@G@wf3
zvz(6!+F-6HOJXOm0AY|)eF}Bh`E16)ARPvw4R(dH>S9!D{Gp!`R|G(#$TIh@V`0FX
z5+@7P$A;au??Yg^Tmq|Yl=>!8i_bIHBiURw$XyMOco{N>KM%M2Qg&bxqjFk-h_!Vm
z_yiG62E}-qt?tN~Ad*cBV;(_evcME6Tl(OdZ}JU51z$Ief%dMI$KT2ANPIEOIk~Wg
zA~{maEOU>lzCTpYFQxelZsk}E6B1CBd_H^Ch^;oqxK_B}3s@eXhGPO{%Vh<pl*zCN
z@Mcl!a?{*7`7Ju1gI+BIS$;_7LW1(z+*%Dw)7Q$4)AYn8+yLNzjY6Sa*1zPPpe2!g
z+ziD?a&=WU+a_#eR}^aQ__Yyr;^&qh_i~&KgA2dtov40~3Qk+ke{9AETd$nY8XMv(
z_UAeb+C8?b0-ZB!kh}_q^cX<#<HbA1f|J;Xs>SuAD+GEhk%WJZeaTop7lK%-^wM5G
zKBF;>r-%?Q3~AL+z$O;s{y&ih)nVdAoVa-5>Gv3dh(`IH8k0c&vKF--+>BlrBVYAW
zGqUIw1ucW4DtHYp!yyFXMS*>9l1hILxRNT(i=U`A|IGbuHg5QtT#Do>MEf*?eN;g9
z+B@Ye&>qUd<$!7S)DUBB9B!G}RQf4MliBe2VBrF38}R17t)-Me7uWL)<+8s0cxWOj
zX?QhVKS{6!0CbX~*c2!i_33z&065|mudK69j3c375iQWNXy24_l#9E?wNJyo_D0F+
zEFd-WYCG?eMiF&47u@vNc5>uva6P$*@d>Gp3vjS8rn;^k+zXaOx!*NGTPzLN+;Xm_
z2cJA}b{m}81Q7kMDIp%ESGb%A?pI%fZVvxia6A%O$UP?#59&p{*3%$&HcSF;KH1{_
zcfKuoIiB!^hx(-bIqqk!g`?=Mu}WjXnt+Jqe<ewRQt3K4up&J;h<7h?o7rE1)TlJ}
z;}re>hhX-?lyJh>u5vepGhe^hJ?&x9^?xt6xxD7qOv1ci2W^ZCQL>h~{3NXbIMb~V
zqrarC5q4FEnNu~L(gFmQXC^MRm?_)Dx#F>m_|=bK2=8}0$#tGu=n;XJu~@-q_!`ec
z4!iVWbiKdwz90zOCKvlB6E^`y5sVd!qF8Gwz+&Q3D~mQ*ufJ~kEDWtnP~)!(UKIYm
zxXnsBOn0j<_OwfKRp{+fZ?$8CV+`xi2VtgE(0bfyMh;i*f*G0}(JXPf^(O$`Ph^hg
zPUiAS9ub|0(u|)}S*|I!V&H$hjc_#0ds={8G<}YbMIyg0-4*!5(Mqf3)OudP__{2@
z>88y<aX-@Yy)BnAzEEi;jN(=k{>L`h6qH?iqG2dFR{+x-YaKCb2Rgx&(KUD{-s#aT
zUl~ry$EEX&WUw34$tGT<xR5$YrNwEKMGKv8RSHWC50Ys-?#YP$s5Oz>6o>~N*F1jm
zGmQa-MMtW+7h+iVeuuGh6esg+yxa++K+ymAr5P*JBZpcYw8Rb!!s{!AcQ-UE0W7A7
zG+C%l>c4qWUN(?##Ju>-6)B^3yWMB{<||(81=W*2uD^PM&zQaD<527pHGOukIb6+l
zo`cUk_uBlOj96y!Fj${q%QZA+SI<}4u30ZH8d!W&mzx<47yWe+7jv^j03Xnw7z7U}
zn<=PjCFU@WtL}bB@DI!VthxDpk-hJp)Owii*ii$dyjs48oq(^fh+Puxp4ERqq%YZq
zVyzkZ22$J9U~q&@L8^-Xhx^Xd_GrHM!8brn{1Y3d@lj?H!hbo*1w>j*CX2yjf9hy{
z^tY&5YhnZlaD=dV^;tqEKy)SgLUhP4u4<%<Xy2{4z`|cp-4IuYim{SwQReL6p*JKG
zktn?7s$g>Fs}B)X5S%=6EarZf(d)7(&1K+^EJZpTJ|b*JA)&nFpUl6@_{YVGyTz17
zPZ3iYzE0``)pYt}lM^dreu?9grS2;pY{|Rv0pW!oEy_LWBpa~Pls?;0u%XTwP6O@9
zWo2s*V9KzP8(T_OPfEb5IPz-<06S;WVp8duc0XkUX&dzdmLC3}e?)LuSYKklcIX@#
z`U}GTlG54M(U)tgNrQ?N7Ks$IvfGVnQhkn9<oP6skn6+d1lj9I6u?&X80Tt-<0(V0
zVqf>}*!oh-VmADQNyZV{de2JYHOXEBnREQ4_w1S4;(SBvTRa>Ud12NR0fj8LI{a1F
zzRN&!*1%6#ohDJL^rRf-p}XCZ^Q{k*-w?+|?6}}WN3+omHMf^dkL@)~engzHqWS*`
zI%viX>}^wnpUUr=E!U?CA`K_qgGFX^b<a>1<RIs1w`zqJ{>|otcQemfPLUE4C4h!B
z`0K^#gb-^0Hyq3syZ<F|-ks5dL^|?8n5fv(-Oi%Vh#xfqk76k7TQ;iFeGwdPesLEq
z&S%t6+A*Qjo$=F%E5nRfWBr2<mY?t#2R8Z-YA<5u+Ru%);UMk@V%P)J>e7$o9miAp
z{nw+~C1Ez*8U15d6i8vCB5d>3n<2Q<fe{(O1<q73jO;!ke*!&@-}2K$6p)_q(7;e-
z>oGtl#SI`b0qYT}ROeycdkl5MTh)I-4{C2X9%N`Xcpxy2mO6`|9Adv^tY%8}?%89g
z12j(kapvs@4{fPDbeNIHVBw^RSe=5}?Kv@4gIcuZdkH_B>t*86+&rw=D@Te=9o99a
zV+juTK#`m2oUM^T#7w{#PuhtJnn|aP@3@k{m9xLlKtM5S8@X=Q^)%05hyC?ki39@t
z^t~V6vWOHlST>VsuHXRv%Z3XuK~~<sG`%Y9RV(may-keQlp51p(&c_B7@HwdTfZsl
zFlZ_fix>l@&?FNO<O+SWbgB<6(UA$%0B8A&B9mGy1~P*g8KdZ<AH!!_orx;YjDD1D
zXHItgI7TXilnwy}{~1BprQvP)rpv>lJivojvp+#aX{hLW&@=o@ix`8l%1{iOywBPI
zE{_0vZY1KUBzz_I-r}-XN4H(#3f8L&8d`O&3-Ab~Ge0V|)woF@%Z^FV;9SSdXr7==
zGaj=)9E;+Y+zcn*@c}WC!D#vbS=;i<R+~&(@(9Y%(N+#fbc0Id#}6I7qT9bg<rrfM
z5hHoXaLtOZse8q$V}0Mcea={jTUXr;PFq720qR=5kxnl5rZyK<!o)&0ibE%8d$)#X
zVdL<uIQ1pZIk*n(HTv9WEZ_u7X~u#dm)BR#G1;)8jIjQ}d(cp)>K?Vs8fdVJ+#76I
zD0=PVAP$CGNG^uWpQ5dhNCmh_eUvUhXbu>$Y(><eMEOOY9JdNI=_vAuS98#lNEBxh
z$frWokx0v_4i>}Tn-JrKP&G@6v<;JF{v*Zp=eYgpeqTHQ!wX1XR^CvwL_H7xw)!oi
zxY6OnmO-GfU|XvBq3BetWaOS{ICN{O9DEXfGj|KYRKYLr`Mfk`_#GR}Yt{uN9-3Rv
z83u^n4i<^$TD8hHd^iXM{=K&*ZXco5^nje-DVMoO(S!sZdZe-a+JysB)caL6{$#-)
zbR329>nf1x6@#+aereHR`;ew13>#p>)R|_`2ngn6$*DgxKWu{*GY^kzzsrpaQ5@oF
z=+UORkU`gcjO4~*G;pR<$u3`?`r%{l24vu|UR>R*vf`IBN~P7FOuRy6uJn)pT44EB
zqRI4a_OqH@SpgrctwB1rW0SmfocRvlo5s~Hs}BuwO<Q`#k;~M?Db#&2XTmIg6l1(b
zR4ZP<3|1_vG+|(ALx~I?eS=z$NEf;u^XupyjvM}n4xB_vD~s*-{S%wc(bdmcD_p_F
zNw(M7k-a0<`SR6nP`s!UrmvE{KR*o&gKw{GF})mk@*QLSydU|Q<NHLzxCff2{HW*F
zcPO@ph5HDs#B8wyn?kkJo;zx02K?V%1D!vP71JZJF`57Iu{0=phHgVYpBtl^jDF%a
zs(2x3<gyyqxU}^L5D+4i&evQIlO`yTgW|HvVunv(R4fl7&ZX5M&&r9~de;eGN1X97
z$yJp@e?b(kZ=U!S>c{YVwpNT?X599^fCI8g^}k9$mY(@<>98y1<GE2*zD7946D#Mn
z$YB}zJOQe;GxYJ}I)v}cCrg<>*(MxX&)IfWhPlH0@ES9`{$N>!>YA-7*l^(Q9|yyA
z))97ekYuE{L<6~2*e=`R*PQuzfn|-kHswG{-k66exsQmOdQVlH1$-6P^Th+fA$SQC
ziWGNuhXi+*push`7Yptdin|mEQk>utT!NKQG)QnwkPz~J-*-B{$A9^}x4ZYwoH=u5
z?%hqGeeN+a<?GY^+#`H^rw>Wr;7Wps;j6vgd}x*Nb?fpW`=+hC=%1_E*75glq%V~8
zs@Da-eYZ-U?D%8bz^5M`X9=6_6aK#J%IKK-^*VGawXyHK9^vt#mR)<&r1P*MTYhcP
z_xFO`*LUC8tU++0LmqEV1?PBq`S!lcvpR0+(r-`7)z#|Uj0g?-zB+T$Ya3Vp8u_(V
z!K4iWj=$|yqus?DrMu=zo_1}?)$tF$`g?x0TL)ve?p*YnXDY9W1!pH1zx`6<9$y-@
ztKrt<`s?=x_6}K}yl&Or_fju-vpaH0%_nPS`VRUx^uX5-y$%<z<mG+vOZ&j!$Wk3T
z2c;NX?x4rPtY=c3&FGysJXgZZN5cviEFAPW&$Z?o)<pKHT-76y=i67Q2WIIqtWBw$
zIi?*P?AE(#MC$wxj~(xq=*H2yo_8j#uY76fhsvoRMwQR8By2%*{|7;TFTYl{eJSsN
z#c^)kKV4wzmwz(18ked_rrY~2grt0vadENXUbEj_$yt2S$P@iTnvHB6f7zt;2PzgS
zes$}pn1WBf@4GwhS?1?n?LO^0vgGLchi&`JdT^?9vkZ&={*fkST>tfn*Un$GcXHez
z?I-w*zH{l;lCu?8OzJ)RVbP<G9|`tNDl~jl#f9lgEIUyk`vL!T(ML}ncy)GZ$-YU-
zeNUBr#0zi#%PUs;BrFk{AyN0nDGrQE6}Q;CGiz2iPf+_(lXE@#&uhM7>z4%SeD750
z+~>+1kM1=O|GKwex!rxYFTUDoc-Hr8-b~px@y6V(<sO_EP&X!<-<kH_JA7^~s(+|k
z?q7FxjW<0cN!6Hph4+s1JWwP&*3E_4ca*KR<kgSC%@#TSi`q>uFHQgOx<sY~rGorB
zZd+VEs_}|vImTAXTJ6?opVU=5W(j#zbY+v_L5=>N+J4TfS$!`hFO+G-hvVCx4u1ah
zK+g$n#`NqL*nM2U46n0=_Z&E}b$Qo87Y8<J<6U6JFCIhP78LX?@UrFP$1U1K%^i32
z^rKhT&J-KkDm>-a<X=Yjc>nUm_FcV>HQe4{aPs@zYrXCF;={`ZT~}l{&}dU|`SG{<
zRco0m$?V3{K6}o+-0N!1cq8u52;VsCO1mmOW{udjW6;IP?xmBsP55iX$}bN;4eazJ
zMdM_zlV3>MXWPjv={y4_uUe76{-uCZ7o&0}o?Oy9M~!j!wq$EoCI77=@wTU%Frv~T
zw;ub-G)`4C)GynmIC+w-_TJfdkJrsIzh!qXnE%{_+JibYKQb-P`!x9zTx$Hsx}f|?
zi?w_)Ay@xjJBAFe)6siWrlETZe9LfunCIGKDVwx>8<=wB+~lz*Y+G?5s%P%p*G3m#
z7yo^U0b5g_>m4swiO|~fr(PM6Zq)01{b!6kJ7vt+bG_dET|bWh<{b4rhY#-_|JBjl
zf$N_wo40apNU?vD-s$I8y7!j23H_pWCg1w$P1AbCU#58!Z~6AbdE;G~n4t8N{vo>#
zXUNeZwcjg`ciGnNj<{beu+Y)_m21C0F)gY<n~-^aH77Q`@gk<jr|{i>yv^qs9$a<e
z<|q4#U96G2;G|K*k}eHNmo;o^;{kcYuST!EdwE-OxBc;sCjZoF>ENY<%BNV~y!E2z
z&426)ESKfq)I;Cy&)R6s=Hq!H&m^wdbw$k^>%L}x^6C2ix8>$ds?v3ImCRYw<*ya>
z^82#^XYSppzy8kiT0Z`M*G6xiy*^XNJY^2t{JyG1q9WTCMHVjedS(9)_1)sk^4b&7
z`To@L{r%2&3!2om`SU!1lgDgb*=*Rs>VuB%_D|a7)xlPqj`&Z^Jhc3UmZyJPmn+4P
z!Ie9%{JmOWgIIqh4(hV(-lm83Le?(Ke|!7Y(;If(9yPzjvI5Wcww>8EQNA}H+jZ%m
zFZsaV9zKiQvF~(>sJ6Rr9=}sFc>M#vR%MIr&oa=r%=c?4OOM@<@tbF4`~hF0d-iA@
zx%Xv};EA7}cT8~T^Q(DX+*2>DTs_{|W6AHeOOY`oSDW~C`>fu&V@#U^ZVT^pNHP5V
zz1v%>)LhuH*r8$7=P#&Te_FO0XM%5q=Dd(FYs~j)X@(ZR{Y%CVd&4f?{_;6@T(3qe
zlcxFSW69WKmXF!qaO%mxA;E`2=ae6NKHymH8XeD-IsaSbzuG@u6w4=BrqnYZOn<tr
z)~fi8^EJC0GW*@qO!cljy_>1Z`30>Wx)pf)?|?Oj-aqaix}}_FmK>wzZQbxTqTAwe
zhnGYrYkzy{FD>2b*2{NzLmIc*xyr6Rn=bM0-?Qy+ST%j6O6$@*>DAz>*MkdwTORBj
zk?Geo`MmRIJ{ED+EAgn*&0nYT+1q<X*=6G|uG*CLRK%00k>~41yUiRBbMQ>`o!Kqp
zX7kIIW@DX03F=pAmt&^ipCKD3geQ$!v}snU;GVZ{{@9YBan@WN3v|xV%%e#BOa%vI
zj9;$p#gcQ6k7}A==f1oT62<y(;KHVxQ%^*HY_X(|*R?5KPn?SOj~{UH_P{e`D<5dT
zz5U+AZ!(=}T6>G%-Lv=7{$9LDng?NN;_MmOB=d_ClinVwGNkhItj)3vuX{R9@T?=g
z-COMrjMIGNkjalmZLIrG-cw(X4(ggb?Z<O5HHL3**r8FzGef34ubaHK@3IzKf?xRD
zZIWevuN!X*6j=~@ec>PBS7+78=e9p^Sdt-6>z=)IcxCNt%kx&>KjYA(>bC+4{Br)|
zq$UquW?lZlBOoG6>MRMDu6xyB*3cd=yZFzXF*c%3x&{k2-7fOtQH{!{`{gJ$sBEFV
z9p=@l+-J<>_6zR4dgQnH@sR6}3)F1%X;#F^@3Dhg=Ira6c*DkLiIyBL-SboaJps2;
zo-0s2W!TWFh402IF{{FdG_{|MnSN;K%5yb-ojSPvszf#3`d=#VwXSA~K~p#UxKn-m
zwa7v<{GV@H<>t5P+Lo`5e|UO2r+ekxVGA?$Jij>or)=$q7dh1G$&}9vKkaX}I<a?y
z=SB9`>@(dbZ=Z%9o`LV4)!SJ;tl7oOEz)l(di;LA;JyVq9`~>0mTOe1G8wk)%({B*
zo1Puk?fU1O*WKFn?|(0lt9sDkdd&y<Tqt+4$o(G`Hs@|}AnqFP_wKF2KIYiF^UQ#K
zkFVbD{iI#wfs%3a#qO7^ZFlcPj{oyUx$r8-O2%%JtAE9KJM%qj-^wjTn=%)&ug|%E
zZHlB}-A>>9HBpP)0bT{XdwyBIDd&eeQHS1-S>1flWDjrm3U#tX9jx;`sCW8In<id=
zRj`?NzZrX0&2JF?_OEHn#z%B6zVdDI#D_m$t5>V#)A+Z?h6ep;-KlWw#z$LuAAMKE
zKW7Wy#QVqf__}O;p`}$CPFz{*e$R?sKh|13wZ;BwOPe*@RXQ^3v5#?gg}q(d@b$px
zEgiOPDEY*<PH>0sRnpcAaSQRNv}=0bb4iEnO0qmv_>0k-R^51*q~GJu&05Fuy6XRJ
zX_At+!y?Xk`St$r;$)Mip~VLVwfSY>?XJ(R6drdo#lnwU+YYb&>)GdX^1m4yoagr<
znNlt;ma2DTuz#J68AcU89++|6(nTlIr@k2UebMHAQ+CJexwd@KqMgPZ8MAh2$}y!X
z^w0FqU)#2ZlsfiqZHs%Uz3RRD(zIpc4Q|J4tn4uNYO(?y0-7eyktN=Yi1n#|4E%TH
z<$GHz3|!{(DQBaXbx%Jm^R#Nj>)9RW+)SEf(UIugCugJ?@L<z~ij92E2A0{HIZs-z
zTD_z8mMXj_vA4&|r#m)(dzr9O>}`&voPA&3`klj1JxLjzrC^J$9Zy6|JMz!_LM_tY
z-uJ$<Pq+B-Lx1}>RrN7%HkC}X^X|&uzBH*G+OqHJGMg%1E0phJvadtEy@uVrQgnZ(
zmBr(h_T5?ZLYWO-Te2;?KX=B_pvk?1-_6c)V@01W{wY7b9N)dvu*hZuuKg3ZVPyAL
z9Z$qf&~8ZIWV>Jgb!l+$)*Zdq6snkVNYu5)br;?b8=oM2=+^~Do;JTUCty+RH_zWc
z&VJi3a^2aB%evR^a(l(>Vk<*DD-NpbnLaSh>;X0VpKcR0?_RHJRr-0RD_&<`$eXc2
z8@A`UR%rUr%Y_$YU%Kh}AGy<2UbO4NjW?H<zDaWMZ1oO%{AX+)nPuVJl8a~DIX*Nh
z&+A9Ex|S*aBFyW1;NtHQ*{^o=Z@A+4u05eGJ>vz8PI~fwg%nvrG7LDkzU<|iOTSmn
z^>5MNb5<Ps<6+NMNk^Qn)GzLhCpo9DSvBGC;yG!4)XFjCOsCDhrRvV?GWfySqNNYd
z4i32Qb!z(iFK5%uo_?!jH@{+!`oBq$fBVJ{UWIpM*qGz{%xW{f=I`r&xNYiksq!t@
zIB;jl+>P@z&YR7>PS?wRxrQ%oQ*%e^;#HpStoG$>;hRJM9-d*$vm7s~CokD1aKz-Q
zkGdSab7aipb}4@G55L#v&v<$2Uw+;wd-0ufmksSdAYqOHuXdIndaPQ($)D<67%}M=
z-!GHP?)~G$w#HRz`R2*Ec3#GAj~C<(^okueInnb8>u%NC{b=N}0{3eEKDP3`zb4oI
zI_PrDlLp7G#=V<#SHAe!KX2+1x@%|5q1AQ$?$im1-WYXq{N<-!c?Q?NkzqiR9li$>
z&Fh)RV_}>W!GWiDHY#0V!^?VEYVUu$E`IW!FDsSGKk{0Vk!k8?nLe}if)3d??~i@&
zRDnuQ6Q7>=_o&l(zb6d+G&XaCb7QyM@pyVPyw30Q3S3CmBgvX_z1mKD)o%Qedw;Zk
zIVr=NwyVy~sot!3quB>H6|52GbG%_|yWjh>dcuAQe;Ge$SfyuYd~#2_G2oxODN>zi
zKW<OcR#B1hYcAfCIHE~Z$qsRc)!v#olSiQ`m3t-ZoUBvC;Wv$9K4uN@se1WA*01lU
z-9Gc>!I2qx>)&WIy~MT8Z7OcMoh0z)yE$142Yf&Lx$(m;TiuR5FXF#vK=$Huy7wqO
zD)8OBW3|^FZGX4v#Y`UcmU||uH)#Kpx3S$WSBe@iA;q2e9T&Zc^T{Jur6qj=Th<wu
zarlORXFhB8vdOs=9~P8Iy=~K|Iq8~Zs2cVzbaL{nvAZ-0YO=CH+q93`#%c0$aaPZ1
z^YYG&saI`y?ab@eY?*i^U&y>d3s#TqktN}`q8HQVZFh8G?r(<=C(T{w-@s%|R}H<G
zAz5(Ml5v)A{!nB^{WL9;9lDqH#N{|+r?#zFF>lYCeG4=%+O^FU|8Bki?!Wj&!TF8n
z6`UP1<6+&98-53C1&2+ZkYH~3kz?Do1bzJ8sNs@ztDnvPGIQaAIzv}|7*glv6pud-
zdCcs-u&DRG@C;{Wf2g-E&ZU04K71<KC~`{TF5%_k^(jzhVd#MHfnk09=S7tYyI$>=
za@Xd?ty8FD{FQ5u{yEC6!*9W5ikx1WBPwQIjY@0pZHgbXJynhBQzE-1iW@m^ZI`)|
zOAp#o{>7B?>mSC>F*HxszV#Yr2#Oc>adEYYjRLbqr|y#KLc<GBq8jghemvWQ1I-?W
z)${xJ?AuRwM*R^QH2F-#jQgjmuWQt@&A1IKehEli`}&pF*Pl*LHtw(CiMy9i+jh%~
zna?L&Z1Q&1V2{=Zdj0)+Q0WnUZ(KPyy3?&?k5{aYN;c&{tsQ^dZ_+Qid9$Z;@(-;W
zz5UbrIC&2A=w7=~f4>=-Dtp)a;kzav<>QyX9(XXK?fM2Cs>OM9w$8oH6BBmZRXpX5
zah_EdZ~JrQ{eu%fJvdYJS=WhS?tSBZpM2)fjqUIHPH*yR=H;^m<_{Q{>|ypjwTgLs
z3tm#*>$TgT5uV3AW^{kN(D#7fwu24ZU-MX8`$M+%n|2<p_iam)=v<GA?4EHxRrgC}
zpA~yjJyrKxT@pl9ni%T-HrD1;rw9M&)$ekGPe(8NZi-2Ca93!~-zroe9Y3<#`7)#3
zUlfRU@X^5BDHm2v_V=SKPv2x*K55MGiE)>A&ipuHRjuN4!b8ivD*XF=pD&ez*E|ck
zv7^(uyqAl-d33E>-Ul<@_q&@U=aKg1lDiH4l;xrS_8~7OX3ci+LEg;~%PwZ9l<)4r
z=TWU9YR|hhF5*SubbFV)X<BVczDp?+o_*W6#^rK}%l%TfY<8cnjk_$pQ`|pquM*`3
zG%V5SV!>W-5|td>Eq;_oc;>%mxP55lQDc3c3!Q)4-EdW8xe?i3d|A3JDE78DgH}9x
z`h8xF)uY=lsdfBLpQ9H}PB?t3`c&^<b9kqG6*TNw&YR<l%wF(MS>NL=W?i3{#_epJ
zLWlqG*qG>D?2NN!X3G3mwQ<L%mdWxp*ynbtPHDDJjy}?7OVW5=t#W4VP-9%c;k3g}
zx%=H4yeD&Wx0t6J4*H~b{7;>x*15X=RQ?Oy&R^_0uGr@%vs<)j`p7?X;ktL5emMAL
z%KBcTT8FM~I;?h{JMMpu$m2dRS4_85u}=@|nD0UPjG69N`r%uq{HamTzU5hQFd)H5
zk44Aod8NGAy#4)m*XwQ>JtpgeTandrTn{gQy!VxbWn$bDXWp}IuIJfdXQun+em>sk
za`=*FN%M!#uN8fMUFo@La`tQ<D=62^Z;N`=c3<}G{HT{38dmK3pw+iT3zom0Fn)H8
zmZuZ0{iD3+_9OdSq;E0jX{;B;e+2Zqc&x*%Z=crO&iSzKfU>^dP9*3SQSbGL`TOH#
zn_Ir;KgA=~`lhK{FxIs>M;AT&-0p1&|MD{mrYdoAPV~|hWghtZTtA=lMe=GPGdkBg
zyeCoW()ZeI_fFoX;e@YY#mfvxy|`Vi&-*5SoD?2VWkJcg=ROABx)@WjTJdp(s*hcg
z;Mj{rzW+2_mL<b-kIdh?Jjq!#S!&N)Sx>dtxF&Q#uCZlOw7>9d{;TGP{ilX3{cTe9
z3ftzNy}NV3r3<UtPcOS{!t_xYpN<|s!M*GLLz&~3Eb};e!tI;B(bK-%YI<hE%}eex
zzf?V+sBFN_3$rTRZ1Uve(-!-i#7h4mk>|Lyf8NTq$n(BW;#&uj_Ng@Y$~^Z0%|}P%
z2>tzY>&lt;*33Ko+^$h48qSN{6ZfiT#s+;n$_<{?x<aGYU*iQ-998>NP{CcH3#V-J
z%kfwIb^E?9Y2W8ayT`MKo$@)bZ&88hLG>S8PBd@To=NeF7TJ2IO8U#*!SnoQ*1d86
z(1(DV<w`^~-Mp_-*w$u;Q=X_;W?%BJd!N53`Yq4Ho$h@zJRB4H`{ZJ8V?wq~U0pqX
z<g5jWOZa3z+jjZ<`28ApoE);xdqc~HJvVNwQ{~yWlVe8L?Df(2*D439w0x7W;JcC+
z&sLfHDp7@Tkx%k@7XG*W1K(NI>;2h2YTNwdN#Z>kHZpy^GZzb&+~N2SnzPlN(kbd{
z{_+P8&l+@X(9B}z;%D9%x@Pn3)%l_irCv9<deB3!gEuRW8CmD$?&z82UJrkoY;x%G
z`5PvD?vy;!!-o$$RZ1E;V&#sLBNMHdc=JW9nd6V_*qMFE$Xeruj0w9}GgF*@YTQn>
zs8X!)-uJgR%(v?KmWp{3q&;)z>z-5BA0O?Wa&(1u{VK#bj#zGPZk%Ic+}vWj#d2K#
za9+iBTtzuXV>!p%oZogA+vy`e?C{~h7CbjMcjq^E(T+J`VDZC=jt!BBsadda0f)Ib
zPXCygXve*~;~s0g+#P2{#0oFiiaFmu9J55^i2e^zS;-p<MaEBT@Q>w;%pBHY6Z=0s
zzB};nAuhH~aK{+<_<^J`W?{iN-(sLyMnG_PMl!8pJC#yIF*GdjiRn7v0J7Bn?wFO0
zR1<IJK_D8e(IbxIo`W$%P!w5GE7glw;HoMyF>(LHB1cAvA@#5z9}pQM76)-SV-@Rv
zsOHZsIhl6E;((d51JAN1=Fjy8)v{AAcq+1@iJe$riT<v7g2yO6bcd;@_>LjR0h+L>
zs^XEWYOT!pMlWS={Rt|a%AsB%BW%D?XY#FTnYUF9A7iF0l##}xoyc%wR809+J&7pR
z@RB!UrURB-!$OC$gfU7;d(EkywyMCA4)SL;bC9L72M-JJBm!vk2Dr?DA>LxC4Diqa
z9(I<C#ZVNB1&(-fmIoX-qzjQ1%_8V5FYI9L?yzD+T9}?vLf=%DD|vGVDr1Uf=q@|B
zTUBgT=-%P>pC1}Y56<w1Er({rTpSt2-xLvFR+GgxEo3Q$)p@YRif?JkH9TC}U{B>W
zZw#~|bSGQlQdempJn?1^Gp@pxAIMr)jKYqyscfr5y`uh6C4>hyIm4YZ`Qndm<n-OC
z3K0xJnX7}%nmaMJoUP(uxman`;&4{BimtswS)w*-afXp9@8Tv*vXttI3v29cmr)L?
z4Uy1Em4Ow9dInsSLoM|cS(@6gzyeQQYZhGoz!aU-T_BlyU<gHLvw@-Ih9<Vx!GZYr
zTPBRT>Inz3P-arkA~0&tHm+eU#iN}Wh>f1_%2HYBiHVLxjdrrPJoPRh4$Mj~qN|sU
znRN_)s+FRl7zcNztaHH0NKw>1T!Zd<g2_XfP*vvCGbjcdRZUe<WqA`()=~%?sU#fv
ziI3uet7n$=hPxvJaTPu*MRV4L<Rq@J1z(+jdPJ9!jOy7SZ5gGqwi9rLjxNPuFEsWE
zV$zfU-&;MdNJLehR!J1n7z~v&_u9v}$C8g2lRNYBQckjRgmxa{L?3ZrD_(X-z8un&
z-04s5_@i0jT3mZ#x}wPz6vd9?%vrg>l|$K30pd|3Y!y4&5z``mcZ?EWejtmntcm#}
zCXSOCGvI37qL2=khN=RiE=%;1CR#~C!2&zWS|0jV-XPe$SjBeiuEe)dT}wx-tp~AC
zo{YjBB-@b{m2VERWL6cx&;D3+qPaSQXj)t9GVMj!h!wGw6<)?w-D16sO3Z*NHTX#a
zf3aXs0>yA(sQ$%DarhPwu0YbWMR}_$uz;U_PEoJ0cEIIePG^w#IES6rh9Ffz6<6)~
z(pTPKk&pD{N_jI&_lYqK6#-6SAg<h#0f*|We8hkeJUPrx%7befTJ^Y>9%gSG!3PTr
zEcl3zjoGa7<mVB+E8A|*xEK)EIEba57n%h}@4{ryAx1D`1RNn)M5$!>ScA?ArQh*a
zR_qg&2jjNdh$r0{B~R;r;;1^D`4}3i{%nP%(6Nwe@=&e7BsPr5Q+dlmn!=U{uu(OI
zFE+AKrWz3=ct{iL3+o`bq7Z+yA2TBy)m!z0t*Rkbvd0cTJ7b|keMns9Ejxaiw?0#@
z%yMP=;h{CAI8q>vTU>_~wQ`vM&z?xCC;0XU3snkM%1$HPNe`_~Vr!l#wpS}_aS|)_
zllqE|RqpcS+TG#ngmS7(J*1z!!3JFxaMl$+je{Y*iAP1*y+FW@NO<c>uXT=xsi4k;
zfvnY0c*{#QCbE>^eGml<U(qyTTvbigO}N@e!~`q7b66L179V0N4rgLBCsoy}Rw44y
zy9`Q*tvUo|>QnOMBlVOCHmV<fs-CWR(wgS-v00&DC6>fRNxrSKQ3MNR#<eO;7V3FW
zl!N-(Is$eU2?U<N;$eO+b>O9n5>Kk)BUR`~I~Z~GwQT4<bs!$-VM<sQa3V|U4H6b0
z(G_|o>WPOx9V-My#~w^o!}^yv!eL%>vX><zc3^2tOl!+SIa>BVD}%mRDYmj!ZFr;L
z(7r=$h$YTaUCgi%3pk+={;Gm1p)7<%7K(@$I>4Dx9a=#|k=8K6UJ>P~I9R~I6!<v{
z@K7AS9QaE=F;X7X%jPv=8CgEg5KeAl0cUX)ANa#bdUK|(#G)4JQ5d2I*y>=1nbVRH
zdux-1s;#bFeT+3)*#|#Y?-0e+m&yQ6)=#i9PmNPqv9UFU4fRzF!-un}O9ZUM(0YPA
zQ6jD*Ga)k1p`S(3$23;`i2*l_tKS%dnVpq6cAyYf`xUris<#FzA%<|U{=`aA7*j5s
zsi0*;9kfHj!%#Vc8Rf8}i@8?LvT=2)RNy^bD;0*yizvJm$=4K<c0z#>R_YldSZ^v9
zc?wVYNl_xjINouw=C|PTcicD+m|Jx%d-<V)GK1mIy31ZWx4WZ;0D+31^4B$Z>R~*H
zWOl^lP;_0vl89P?T=8bE+~h4bvZ5yV$xiv=tH@lrs)pJ`!b5*6A!h6$;vsvYV8_QY
zrzeP^U01zk8p}rC+7I<}pcG~tbg9W1KlQ8Lhd{H)oTZ;t0lta{Z}Jfm9LdeNT7PP<
z5L@gGkqRg)cqu!3PN>G}I%eQ&p2WkGsPN>h`q-U#2~j^s;!T!%5-5skfWL9pn+-Vj
zcEyb05{JWf1B<HXqwZ7@Av$0j-qt;;DPyXg;<`G+vQl2GSQHd9e1xy~%>93sWJ``<
z^M^Z_5});}9>a?FUVJsH738>e-s`MBbM-r3!sE;pY_#&kN^D$Q!Il*(oEY>vhnNYC
zD)N(wo-FDfc;GEuy;WF7bRL?ha@b?7--)Q^_(>PBB%aW?hq0a%AcBIvah+GpgQy%7
z0Z(;=W75e>D@E0nrQRvj_3Sv{D0{Kfwbl%Cro1Y{&PO$1jjyaV2M1|pn!9>Q4DfN)
z+Ty7PSjl9=2Wt*SI8=XWBgVuhir6cA-NQ(=uu(>&o)gT8rz>#bs63SsPdqrP&f)<V
zc!9)-`at;;OZ=F@hTdgu{G2TaiX(Q!SN@i<u@IiwD+bnJn?}r%ovkYVW*TL&;;<c(
zE3pz6V<0YYr5lx*c2ZY76p%hT%a@p{6LHjCL{;S&<4$Z{dci{eQbr1EJ-|=De=r;M
z7NdIi5T13Stc1wQLIbdsC%zoq@y(2MF$?t+cc`R0>E^OlAEOTbnsr$!lIF-<Zy{)*
z81f-1s&E#bx)K{0izDb7*KThJ<SaY0Bp=m8dVs;<@{ql~`6z25%R=!qDjaDCE-2!u
zD_MajOR1?*?Bzjp@)v(brHsDuREKKbo==Qp37XBgGSwWJnjIPvg)yxFyy;f0LS?5O
z5Ca!$?3iJ{CNowpob@{ZTc^}Oos1`uu;F7F=?soC<_r?3QV3fPIBIu<m(&z@<ICGA
zIbkP-)j9H4RM)=*AO?1Hxl|`7eWVc<ic38CYlm{JNw8hrNH%&FN@w%IU)eB%y=GKT
zWzUFd4R774w(=q~<))~{3bvpdNASr^8euCh&10!LDsO!=$Mcz4)sk`eSgx+vLdK3c
zapPOQM00{UMx-lu>O)gUmWr%rF*8H}2VBs^Uux;60_!rm!^S~Y9G$_Iu6&!?>K-wX
z9$d@M*jV2v19dDMh$JNOQ-0)5t%aep7|7n(h=qA#4L)m|=e<^s^*<=EkPYZuDZ0H`
z>RlN;kZqor^tLK1C5?eF?asVRZIJMi9-Qr8@?ZfQJjF@;KrnBMkA{jZ?z-pNp4L`T
zbh8TEmCjmkQk=LyE2|wzN`T5NU9Vk-J5>c`r4-uAUJUT!0AIHF*ujV}u+U+w^z$JM
zWF<>^>nCDc&&JPH8%2=1aO2*ELUhzOg_W65uv6E<pF^3!!qhRX)G6ra${&A4GbQzg
zNgk@Tkfevj1cPgsN=L;8iC$$Ee>5R$DbK9-E>lq}RB@CA8t6ClSYxMJsN=NLSf3HW
zr4qJwugVimnoAS93>&^-$eea}^)GDXsobTYe1r`fuE<^aNjt?wRp#+io|c1H@N<Xa
zTV=E(OGi}D3KP1N00Be}MidtmT@edEzWHcW)nG)ugtv>c#?>#{o0J6+bfuocS9Mkt
z7=j2AT*!tqQBhL!AdoLRg8cO4k)2diCU7Mpcw%mS!ieR^S$csh3*)IXWBUDyn8*We
z`UneOxZ5hwC~QH&mV;RQ5d(cQrygdWJ9LrSvcMB<bha_=D9V@_>4CTUL6~R}*NKWB
zAFG?x!QVO#6!<fyaWZz*n3~wX&QtELwWsb@6_gQv-0M!-Nm137`VxyneynyXjY4pu
zJ75A+c%d;fF5S5TpW}xkPua^touZ84V!MGn)LlYiR_YiQeAJ1m2-n6G&Rk=|A-$C=
zoYk|M0~Jhp3yT?3i#a^WS<g7)iiO4CY!TJjx)Y`;D#hSpvoM3D_((U!VO&aa*0p*7
zG?-8!ow??>&)U)G50F3*ORiO0JFBMLx#qY=cSaP05&a%W>qcCKY#G4b5y;7ic^gM#
zc#DamlQ;V?GkPAA7r$lI+ct3x4-c1(YM^ZJW)^EApbAlKOzg=+f3IM^*kEPW*y~w^
zt;OZ643z=)c%UVE!--xH7tLZXRAZ(y<4$wuyikec>IdUWHXKsWdFkZJy{fMc7Eium
zpjBd=ge65)MRA3{*h&E~wS!>AyCox*1D5*0Tv@{aZse#vR4RdNzmK*Kl_kh@Av*B<
zr^=v#r+q@}ixsY#h=EHZU8x_XAz0D}#&AJLY3bTITvx<X##BkUNKGPY|5jxcTYnD@
zqH!_ZEHb&82bw4o^5jsh#ZU-RR&1q&I*nNlsbV>}Rv&dUtwD9d|K|fcb-kgGix}7l
zeJTe0oULBfK8>xtC1N98grL=ivfzX1B<b7}q=XbTB~=4)gB2d^7DN`VSTIB0)RGbG
z&{16l2fJbpJHE+ZjO?u%Hbi3{AD3QOYX$_V@UtdT-Da>f7G$oTbPoO(SF=PQ67$3+
zI%9OSX7I%puB;@wS%_wf_FS8qvd2nV{OpgX;#odYfp`{$`1;7wwW@6I7Yg`V<#@t?
zaru$~aXG6uG_IP+p9*o$-i)O_%3ryF%cxY6MtZv@4j*GmEG$t%zI;nl^TS$JSn7^9
zB3Y7)eq)1;RL2Glz|}YLxB`LR5fb0l=dfbG<G{xDL3t`4nCVKtqmnNSuo5Qgp4eCt
z9X!jLGyNb8b%r!j?wZA(Ir2AT!>}mKGB0oEjRV`(1d0$#Iw~sI>|)Y@Zy16nTdBi{
z_>&uTRuvQ%orR#^@nFqiER?4#@K&dpYT9|km37OZf7d1@l#?(ms%u6)hc|Zc5I&hm
zJ=;T+H!Q4L${Al`GRj$Rr1}Yzd)^3CG0@>5Tt&1jhzkyHC0sEJ6V9M8!nZJVwsH9?
zPbq1fu~VJoZAzLB8db&gek68^s#(6J9^TAg!=XB=I}}AoW+g?ilqTvMX8E9r*kYkW
zoj~R=R~+mtGFJF9tNs8-dlf5$Ir;&PFx7L?r7_;h5DV$7{?R=iifxfpb?F8sY_vbA
z)4)@HWG9}mkS!ckZRHB8*<cMbp@}gS)wr@Go(}HeW@~~hV8GtOobh+*My_B>F=?oK
z6w^+kSVF>r7(@Vt$jVMDL(J%Aa^q0PFb<9mU8B2v#b2Y~lEHtbj%&RaFfI$`#8j-6
zFY~G@dAbg2W1Wtc^5I*W3zKnaY$zJRhAZi3O6y(DItFw&2^)J?*AQK~@GZ5(fVlKx
zv~wTgObn2jmsaXStsU1GJ;a#BqdT-};LgAIk)H#|5t})&mqJtyRyJl_6&1Fy0v${$
zt<0#u6eF&3;EJBr>cGyd6#*+*(-EK&&EE6iDj(HHy&ztS4r447*Yp!6KE?t&Y)l2t
zQU^@qU`Sv}KX`-U@>E}ulh_IsPWou~5HIcCiUT)1#8j&UEi40FF~Xc`!kD<>#T{=o
z%HMj*{!J<j(T@0BVK3daXW*wlSTIY4UGEyqt4iRjI=T{P>7ZU96WE{(-3S`r8a2l1
zHFY<0785Ie;{^kFGVc0t#T;Xrvy9aZ(nl6#AbT-_4~KP`b}nL3O%7ozDva<@eT5@W
zEU}@})g9DDhpudWOGRenAyveRQLf;IvY;xaVi`6wL=kV;I1Qcm*b9L=yH=9^{S=m(
z*PDv+C9aeaDmGxN-rS+2)-VXz%R)Rf!cUA+RVc*9Q+mi=*(yuaf{XfJdaEPUW7G{i
zK8k>n%1t90g^gl?&XwZBUI%vgy7oBzt0!iO%ZzO4e~W=8#AZf_R(auYr`oC?l$9%n
zGInu<Gh=!da>qR*y4DIp6ZvqjHK@4CQtT8<6|oE)K>y2Fe6`Y)pP~^9JHDkP3{)j$
zVST5p8AC_TU`kW2R68;dK6b+93T15nz*ZTcuHGBecc9^~cU8`Kq7b7$YomKAt6C|l
z6m~c`al}a1rl}NBwz8A{L{Ue>TDbOK2Z$4qz$b6*a)v3!E{5tEX3a-BksXn#l4hhS
zeXq<df-{UGb0LEy)zMwbTjtUcrNEN<s<lS6KVq#ul7-%GxdzcZrGzm9h2ABe>L?wE
z$P6pSb@2WtB<ZJ~mR|guH0q0wI!6eaMH|?`MxDznmdZd`5lO2{tl`4*UVq?hhazcQ
zyz$T#m67(g3laHeos})K8fEqC3VesN<B;ZduX$CKjL=ziwAH5nZ-@0V%v}B8Vvg4O
zud1atkz%=hbD|N8cN&ce$*zf}Ybj;*LkGG=RUxW6fP0jdCeocb%g!_-iauB}iY>aR
zic!uH(C86ygQvY+!prs!{4IjCp_bNJ;zk5jO02n)KXG}|i3irqNojKA0AKyXtmaia
z^)NdKmSA(OgLvSmXYs;HqvFE6tmz$TXBmJ&R<JZijENck;ws)~V6*6omsX$R{ag>_
z%7`Hd9}Lq`^;I-`MsbG+{>n=J_%R{|WWfg{;VMg2PIh`HM=4buf9q%Rv)^o34$=rT
z^mTExIx#~&syWfAh4K?)F=3R02%6WPKt`H@k#+)XrJAx-HS9e`Rf01dT$!Vrw6{@b
zKnJRxo>(dy;){>*)cdGnItV&u$y6G#1JHq>YG)z`JY~T*Y^?HD8AZp6S*-N;<al$Z
zO4&8J>+gE;Ko#i%CyRv_v-CQLR3dMEury@O>K3P|<IBYhJLa(F%~5L{6pb;bN)bby
zNh}v*R;R|n)nR-!LYC4`oX}7f>J{aPC;ockaHUzekfTt<4;*2MmAJ}A9c61s*u*#1
z_)$^tq`&%yh{QoZ<Bu(t>Jrn!>HsfL)iL_p6%e&jnI$g2WrVf5NX+R?J*~laOgau_
zta(K+)nKJKE{?<mkwecn;z?OmTQm9{pYlXs+iz{9tAFqi55vTpDydVHr*X8ErFvnh
z41}e;6-(o=m)hb%7I2my*NU&TX>rxprVO^Kq3cX!ad4?FZ_`%KEzqqiP(Um|RvlDj
z^@lK3X;&s>fZnPLcT!pye5*ci17E61V^v2rRL0ubu(4_r6)x-#uv5QrmX3NV@olj<
z%Nrf>WlnpNX+ktzvqn*u5tu59e!gZDePk_Mm&RfvX0m|2xN9#{b=5cIswh@V;;Yu!
zfy03fd>PT0u<+(yACy!ySb@X1af3BjAQ*cvWdo8FC6@MW<tcluNBP-~2?s`~t#v0c
zr8+2L?Xplm=vhM*h;D4~)RV$6@K?Ud3ua<#-D9g$d!YT@6xm}54=^~Skj8|ezJ@pP
zq=Ph5<;e_7AzANX2fnJo9jjP>ha|3wBo0<(tZlDB6YUR9a7T2h0H%I_BLuBM@xqdM
z^iem!LiJ+A`U3vy47k8Sohol33f($d|LU3?Sq-WutmRDvX&{}5^)oLi#~AF?YuMng
zy5g<;tXHL{?qEnCXoYiau`Nq6H$3dMQpglsL;YDNRfpVJ-}o8_&P2gNU8=}j+a72+
z;fFQI%FY4f7?UFQ{|j(+qI6Q%@H2}J#THXK00h-U-ESR=AGr{N!#FcS-TCjWq$qW_
zog~^>Gci(biolAKBCh&tZRuw`X&?)f;1EY<$k%Y_03s?M`zhX@6L`TJ2C9VhBo>Ax
z3o0vIqN&bYx%Nlhi4E6M0WVZmj}ymYP&HwSF^Z!MqvoqC`0+<S8DS?Td<$7U1CH3L
z%d``Sxp7ujumpvgin02MHH1ACFb|kxi%wFPc`|{IdXEuxo>?=(PAL?kq7;mkql>Hc
zjYh-|cBZlR4H)Qvv3e2a#51OP_F8BD%okLt`*RL>OG9PIH*ByLGWwE(^a6tsyH^C&
xF^+?i%}QHpvMgjm;URynt@f>ZW*^^MPg1uFX_hPJjBhyyHfTLKW82Wb{tqn~Um^ei

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem1344-key.pem b/certs/frodokem/frodokem1344-key.pem
new file mode 100644
index 00000000000..abf71111ecd
--- /dev/null
+++ b/certs/frodokem/frodokem1344-key.pem
@@ -0,0 +1,901 @@
+-----BEGIN PRIVATE KEY-----
+MIKoZwIBADAKBggogYxxAgIHAgSCqFQEgqhQguHzoeoD8Immh/Ky9urEZCYQO9Pg
+OIsvEev1VPZTtjpdUK/pbkq2778sr6Rao2z+ePZM2rx05kw7Ce5AiZx6YH/wVJ1b
+K88MP4OQjK1Ed3EXcJ3qRfyKpM56NrzZhIDym6Zc1XvgrKYSI7LxnAUUOo77GwBv
+5RH80h7GLQjL0SAg1tSOpPlCLo1kcCJbg+U7j0ELOF4mHSLsif46lWDPYUN7CUNv
+QOOWlOog3SOQbzGyWnViTwXgsVSroCBsAhzpggkvH0pkTYN8tPzw+MFXAbfCyWX6
++ftGULdK4b2OPaU3RwxwxKKGSHzrZIXA/03qeRIAUicuhfo1IDgqnPlTds3FOlfr
+pmuVCRsZV3OzIjOXfY2W0GgBnxbEbrGp+7salxhAdJIv+W+iFegliU3HxKWrDaLb
+3kEroICbzTCB4H13o1IkhWEWjOAaRlmaOAZ4A2zZ+IdZwSTXRIHUI+V1zeOYeyGM
+EClSHnweTHmeraFrLo+5WD4rmwhiqWQelnRsNBIfYt3mqQSSJIciGVrRlbSW7tOU
+mEKtbocJ+wAyrDCgFcMxFQ6y2pzk5aT2IvlW227mzUHWT5Cgp/N2GfENfHxgESLB
+0W5tVF8eV0GpEIICFVFmgBGop/zMJatkZxVA8RJwT56TsjybLxbzEKqUHp8uUh27
+oLXVNgF5HpanRyMFxLUYlovDRTPUejRap4Y5fMDYYBvdlP8Nz6iPSqF01NnKi68y
+cWVz6oO37uWmjFkLO6XSEQPmldqbIRBNxcxE6NVB2UyEqvflHHHmmS0FtlLNuEnW
+UbEXoXnrSqjspwdpYIfqi/2wxzkFMx0Lq3fQX3y0XpdI1yR5eCejWoBiuruQQSiZ
+sNHXmTTuMr9ytOm7jnS6oe5uRrFhCFLbFihWwjNRRpGS+4CpMni/tQjIv6Tqch4B
+FFuAkX4vDV3PvdpwhucX+uoqxp6Thho642EkmhHLuL2ZGxV1ekwNexEfXVvO01/C
+Ls9/0PN/UMkmozKFuRP/7xlWkQenQzK0qatYLk3qmuGPZXRqAxu5fHICLU5w555c
+Yw1fAD0UHhyKhP4q3bSFij0W9lRSGRWRnSfrjuHUIFm3/PceQp7na7TIz5W3Z2RA
+BPCUEnLODa92bgmX2eNfNKbRWAITXnHKXEs+iA10xQL7weEFjqr0IPsS9d93M6xN
+WmImYFkpVOCTQCt6ksy7qhcrcl0tUhFLbfrjc4S7eRf/AoopNlAhAZA6VdSgVKUm
+m+VpNB+QaYuBgNkRGuSThVcdIVNNrWjSlp/OlhQeiNmJs+BsXEhAW7hTujookbXE
+OuFAH4plo7jWA+26rDjzYxcZ/b4tzr2DVMlKiiBapg6CxAbcaNWEqER5KAhD9w2Q
+9Szwop4P3pQr6MZs86YagrkSTYTgFbbEq7osK6zhwBd2OkiOnWqTEdsorYlpwQTj
+zij5EZsMQi4QWN0yUmY4M5UGzbiAd0yq1MuRb6qPDhwi8CBNaERZr1QKuNh3Lsoh
+jup3AKaT6RjAbG2F493z18jFUZvIY9g8FnIGtInac3fV/DkdoX0cZK8QJs5ie787
+0bnq768S3pDgkVDO4GrB7wylbmLo6cNVyLCCVc4mRUzrPKXYbeDhTuQiKK8NrDSp
+6e7F/kYaXH/j4l4eC95G881puKhlrkEIWeGdBsVaV460jWVeWPrp7svhLLzYONnn
+6LOIn7oUep080bglwr2jTYCDS622o6Yo2Tf4Hwcw6fdAwbfLCNMWacvLcaLqpEo1
+ceipCkLV8VQpDIoVTCQUCsGqmBijr18Vss8EfTlcFEvReEbRIjUYdvfmL1VrjnJe
+jjpUo3AVnSrKiu877jL37nea38R6wjMPXeTuos3ApEQc/Quj0ooR7bwpN+p0sin+
+XRKvR96sfzEi+DYsBvsUc0mKlQjqD2IWs0t4TIdudEyS9WGfGJueJPPxCDjvYNoA
+TKzTrxaXhYS/keJSl/i0FJaHO9GK+15NN6bK4ErKFc+upWrDMsBL78jG9CkpqB6H
+yFQVrvlDd9ZYFfMn4Q4XjP85+YVRB1331A38MIZKbIaq6d/VZLcvIjipgCIhoKc0
+V53CJzVRhHUdxBKEj+3lzWuQJBfqSTQ0uJbwX1NjHiWlZpgR81sKS/JasBFgt/Sg
+xuf1/3pK7IQT/BMM2V38TBvjXi9UWaRuABA+17jKNZHuoqplO1c+rvQQHI9BAJh/
+4hRvVtLvfXBg7ITB5EIgkqgkYWzL/qCZdOxGAtLl/a76lIV/nACWdepHE8yCRYni
+PylON5t8w1B2luRaly8I56dyg0pAhpxTGp6QHGUO4CIpIDuXjZjJWV2yTqQaJJN3
+8aZyDs/HjZjbLJbZvT7iTKg6atKo8g7S6bDPXcU2j1L0OiV/bIAE37tncxSrN0Tr
+KU7/wASi4IcELZ8AOFOEqZtglk9hs0BXCRwKAVKlTWDOCA5tz9+ecAbdR6QwabK4
+QOvLu1zH218aXIEHIoJzVe7SZvIPOcH0ytf8YTKe75pU+BuiOY1JK19tcnePHEBD
+3afujjGOS454pQGBFGNgBLjT1ePkZOsmuiwFKamg/fR1buBAHp+NPaGk8Mf1P187
+6676g7f5Y4FWAdF8YsoPH9n2OBhUqZdw7YJ+8cZN89EMnxrceYvUnRSqtfNAOh5/
+7UXJsMUEAPLW+4hBtN87XO8dnMOhMKP4L3u2Xss49cCLhZyYRc+wm+Xg/2aeAb91
+3czMd1ijL6FdaZnFV6P7UibCt0ZbyiUq30RJYyoOCG0Xv3gdwEh34p+qZvsdlJCS
+DKacae5Ryyi0zeQ82Mtbnj7Ghqpqa9f/FGiLRQNNVyqOHROA3HqH5zKu68veOnBf
+TdCMq+qNxVBqPx16zbGt2KuzxcFARr7gH0Og716O6PycXKo422dJSiXVj/qASVFc
+Jmp6H//wzkKnXgVsJrbsJ+ltC5q9GUSJpDEM9IyRuDwIutgawvavN3BZ3SwXoujK
+QoCKHgrXt+RVEaPoX4g/f4uqh3YMpxkmEGVgff6J8A8WIEJG8vd9y3dWEC3/cYsf
+BVwfchVVfqcrQ2KfAMvqV5gR/PLgZDCfHQU25oNhRkm/kqQVZ9BLmLfyMafJa818
+jwmTsdZ3Bn9T6/V9c9fcy7AnF+Qne3hKqXYndjXHrsJDVXA8ugvKqI804gb0yMHk
+EH5FoQqY100ZKcYko2CGjdc3t/UsBvEEhhTilzNestTC1yvPIOpEYDBUeZN2PvRX
+kiAjTsDQOPtUzmFQAjKyRccvbw7t5/wL3UP9nO0sTX2c4jqecb1cNEpjt8hZY2qE
+A4NKW3XEl3gxVibFQh3ywAigMIZxLQD6mBroJubyS6X78sVFB0eURomDzFExLQsO
+Idsla1faU0xDLZqQacoXPYrKhGb42iPYhVu7m/C6Gq+t5qZ4XNEoIbO8gaHAsNGw
+Z3JxBqZFuY9mp3z+/qriV7B1KMXaEIllnedquOMmGQ/Ps+0/a+9cLtmRoCGbFYQg
+d71aUPc6LWPAbfhJwoV/rLm06R3C8zsqM+vY1EOZvUpAXy1hqVRsY7JaJz0pkFPp
+t/MlZ9qqj0319ExrvqbgorVBrZozCViiv+zFt1U+jbnHMnocmsx4WaWbxJxru060
+kWazm5mS0MLWr00rs1qHqRWGJnOxSgRHRlZVmsAaOL8eJ3edQA4zxAf8ISic/xuH
+fNG0x1E9uNDoGQAa/+aEkaIYxOiiqTVgeV28Ppc8GcmeaLMRNQI7A3hJqAZHyl3y
+MrbsFPKLwcDfyQ1yYMwLccGGlAoXdzxTneiCd4+1nf1d/hbXok+417o7RBV53Scu
+/LUwL+WtOwJeVu2AGVjD/mcJFGGuGRShIL4m/eun4DrTB8NH0DG8rEB8fOsOvoVg
+XFn3rFFdSit2nUdAA15TMLPh6B9PCr9SoqJNsi+TGve+MaIY5OPZJXMhDcY8xXe0
+8zd1jVqXjy0SlcJzl9F2y+VEEXujhKM0Y4WkwhjM9dcZf/M0VL1idITtR/K55ai9
+0+L39MTG/rt+XUqAGg1p5LCyLXkFmkl8HrP+3PC8Xu++NdCtCeEpruwLWKE0hVTo
+QEpe+VxhC+pbFjIsHA7v6Mz3znEF91s7w3DZkeSRM+4YP6ViTCw7LhKveNKhiLcV
+NJ3IpBEdwhrqJUTh2o4fLItUDiAEofadNiAQwlpQ3gkgyA4LlDXryXSKBEZySb6M
+EGOLpMh79c0MJk52rj7c7Mc2fZGAjL8xtk/jHIia8dpL37LXTkH6OysvARHVlxpm
+RwpbIAR0Rqp/zTxEGALWNLWol7HW8Bp2Z9kz4Qn3LYtwcmbNvM+hqxCyLMBM9LTF
++N34F2Q2sOT6FuaVznqGbwF1cVCo7lt7GF4+/ovzCerLY3jcALknDhctrKuLc5wW
+3olTc1JcbkX6goTYpK9N/B6tFoxU7xqRGHMQkYT8BB9nAJidwyYXjlLd8QnMBnkY
+qik/YB4HgpHM87lz1AljuDfIEj/HvtvAJWsFcup4M8xaQgKwQBhUcmw+REOvqq7K
+mHys7dZEJe+qIxNyMOmrpRtzJRpOtdn0Fjsm6PiwRMel1rNcNZYltRkpkTeOUt79
+3nR3LIbyu0H1Wn8UrgchAUPx4HWlwaiSOyhYgeIDQv5/8Z9Awq5qqR61QZ+IGy37
+EXboJ9ARJPclEV5vnZpmvT0f1lSRUbFIUxqiWA8+f+/A/84sgLTZ07w5SDdMLZB3
+oQeyFmNyNs8Vq1OLAuvnS8SDu4NyKjqPHwxfXCjuS6o/Y+iA6ECX9TERxGsqKpSj
+do7QJJ2dKkS+Z8s899LnAPuVeu1UPVfmy5+k/h31aBgWLJvXFfGkCsCK5kcBSPe4
+lvxjvGiQOZK2JDD0j+YibyqjSGqiS9v/UhLlru8UbAJ5tCJ+ch6PQeigRH46Of69
+V+gPt8oLTW2g5QbFVIHYkAvdbs6guf1vFwA72ccuD8g/LpPI1aLwNppdy5LnOsjj
+I9g7ZbWx+jSW/NZbjt21zSyIeOWDNYaem1hxvpCyPQQ3ykPE4i/ONFxON3qSdVkA
+O3+GCMUh1IvxjR9uWVdi2RbI/sttlf8WNN+5FR4xNgpS47NUAm66glURCDg1Z9lg
+tBQlQ28RtAbbv8ZO12OlwrCrx+miGCxEQFexpEb9Wklp2h7KWJDNvqws8tR2VRrS
+L2MkfFF8TL36zoMZs1uWSjnxfgcfit5R+TKPqtVUeZAu8+iFY0drEvPwSmiaAb+V
+8kqOE1Q6dp5lA0r8ZBWxAOS/miUbP2h2cQ9qLZoOoKYCzpR4IxaR8vI/PxtPeDmJ
+nwRAaSWRWdp3s55qa3eN96bW1MDAvn/BqGHLSZfxVpv0+GNCfTrvdhQgsr9AWzZc
+o010Aec8yx6iUpfoJmbJcCYkIYb2C+6EwKv5Ep9LQsOCR05Fpd6S+UyB1sh/0eLN
+JT51HbKunvGAnu8h4FLbdMtgEEJ5pqm80rl1bXPTjlV1ibW/STn7HuZFh2OPZFp8
+Jx/hnxFl/m55Yb0CsGGe9EGjwTWpuZR7xhWapJ4cKHMAQTSJX+JoGUOMXnYVEcTj
+lfrwfCV1nJbxjzMK+TzadWH8OLo6MPBxdxQsVMcKbY2h0OvS8Frl9LWVhjZ+Gi33
+JHfraseKpkg+yX9h9x1sjfJyeoXcv8YeU7RxDdAFX89HOx/V2hcPumReBVPtEiGg
+thOQHsfK+qxzccnbNor/AaY1sssZQVQ8Nb2NbKDtmRdftg7D8VoRQL4wo6SNPvhQ
+MTPP8jVj+JBfnubWLYV4ApuA66gonjWLjMnP3jNUn8fyooyyPn/Dxbq3mUoR+ogL
+y7IX8t4no235P763fy1rQie+4HxD6LSrChXFBKOJ0Okac8QA20HqOH+t4YUj4pga
+WywgqFdpIw+2Zh549q2l/44iyJ2zYhGhz8Ah08aLa1+BAkzSMGRsUom3PVbQh++L
+aSO1GLXdTUNpkalIGGxloi382GlDN8CrSHq6GUo0ISFAd+zkO0U2azi5RHWAq9KM
+foP8jNAfIi8qWqYHtthyoFEISmALN4UyNTk1Q5jw91BYjtdbgn6O2w4BPYt0zZ77
+rH0wV81VQr2eIHS8E7mLUNJnyeIVBg8tMh+5qjpCROBzTBO+ZdJiXFUjlTybPhlG
+9sS7w/6GdgvUqN4D5AWgh6/t4tqhT50Jt8yAKqZlQj8Blf6aXUJ7eZVHediA4q9n
+2qIY89MCThr5EgAG8ybyqawfB20h9SJiPT6CAg9HN+SuyXNTTuLUXknLEQ0GtTcI
+j3ufMN08t36ImKSxHYUTpL5YVRhT3REifg8CLuuoRQsHsMUkZMcTlvU53GvjmtdG
+UUOxAZIecN1N2S9hGcS/Fy6U5qozpnVpoytvK5bPrlgTamu1a0l3TevPtu5OXi/X
+VAsHbsLFOSav95HvNLIAwIdXUfRhqgk8dwOQ6ahEnVbVYgs8I9l5+9F/Ydw0cBfA
+3zLMyd2IbS8rG53LMZ23uUO5JDBDX+gvnm3/B3fZ8tiwbAP1VnltoAtEU++ulth/
+QnTN41BiqViUhNB+wrn5JQfeFn0Mt1sXkkFl+80eAacCiFVeQSCOIujYuintjn4E
+kzMsp0kXI4UVoKxne0H52xeXSwUMwCTZdRT5rWKmbER6MkKKvHjjq39TEMfOzxyy
+wZnrIDOffAOlO+2CwjNB+hArbb4+flO3yzVwNsHegvmXgeEmz2pZaHrZtQGKDaM6
+0EI2YRRZcceq2hxXex/kWGT8Jd/FTIZv/bTkE+5QxKqa4iijm1hT8a6fdmXic0CK
+C3zubSRwNzJU9Z3m2ZRyNGKcOzNFvn4xz4STBHvc4WJn0Yk01N17to38WyPU8clm
+oteJCYjXQd+n13smcvgnTpZHAI/ZMkHUramBK7pOZ0QSCtf6UpuYvgrOIlszBaKc
+6KxAFvSwsLjFD2bzwc/sBGGgVTd1/kcb49yGUblQYRDus4rYR8IwvhGbKM9PCAa0
+1TnsUFU5a3bKH51SqPzGI2wxCpGRKFVIkaOcNvOEhG2Dpn9fRI06nZC6b6tFSBIp
+DKXsSwWcfo7x6q2IbzsoMk8TCUr6LAMd5B7PM94dfDU0WvzA1ni373JNJ8WYdzEI
+SCYFGSZZQkrTrYB0Bca3h2uE4wCpj2y/yDa+XglMCcBmJftynHheVfOrydved1NE
+nf/mUoiqvxQHSXtinFU5GJLSS+6uibOlEQN3wtsQ92pJSAWLfBtk0r4H2VxxUAas
+hSOmDEsBVeG9Pq+qvBdZwuN5g3exH5T9E5f+ij/97Ve5LcGkGKR91OA6ROqyyUJH
+rLjPtFLz/+hEOGNV8kP2+VINN/Fh81NrS0WYEbBcry/bMR8RcZ24Q5OibIsytaJn
+FC8iVib7gwsz9FwffQ/v8yDB+CCSJwPfvOoumYsFIQBPSHNgTJ+NwrNpaS2AM24y
+rz60enjnSWcoqftXIxBCLr57TaZUDdZNOfE2W4QQY1BRD0BQCN/Fwfuyynl9Gbfe
+M5vxc1irRkcktbvXjWs/yT9BkJPgLFWuxl5Uqxap3rJog1onsrHXcbonKclCNnHw
+obaB+YMSi/Y+YzDWKMNlBV8KzdFbJE4LlH2pQ2XVss3DbLoPvzZ7U+9Isg8hqhy2
+YZ9kgnCrEZs/M7DLaMv3mT1o9YClIRR1aPwViOh8B0PnLyYPsRxn1KRLS/oBhtbw
+vn28+mkCHbXsjIUXAOnxJSRBlnm/NDykJzCJcKWzXJllEVkAlNW6tqM16h38R+0L
+T+TyDTj4ZQ61JKyAWaENx5z+CiAGAUXVyLBjvexK8rm8q3ArtBzszIouBAj12X7A
+Y8EaiuvFqD6ZVKqnhsmZ2LofpbWPbPPZ9XnllYdrluklq/zaisGKG7KlJoqdL+wD
+cu+xORl/P0zQ7Ld4ucbaV7OlWCaWuNaZby/OoKL+SvD96bxc6ZVP99/gmQHpEHSr
+7ktcAuEwypike1abagXQIYq42l7/FKMAbHm7WyMlyvwz8Id86afe1+ApPMgWXcMk
+wXCjpCvEQtGKRZqTjvsWUATtPLwFKZ81UsScw05pm3lJ7h5jdOQozJEYkke4gZe2
+EE50jyfzHV4KX6nb/LEt1KjG/VtvJY1ewaUPK+howyVUPADo/Z75gv4h3O9mIKNy
+w4qvK8cFZNF4x8N1N/8ZGXyIQ+sPVLmj1V0LFgCuLlh5G9OVjUSZCu5fa8CfvpON
+4duIXODMmqj+RBoGAJnwaFVA/H8YTWIfcsOjCyo4WBPL34SL58grxXtPdGrFd/tH
+Oy1V+dZ9WDwu6RZTrl8tFZ77HisVyuQusjCv+vq4Ivr0viySV7EWIU5RN/24wye2
+P9c4L+E0w/BUE52tjPqfUkwGDyFvCCeXCNLJOm4dxq/EhHK4TddGeaR0UWxzRBSP
+EgVHPEua+ClZ0zQxnBKZdvbTCcflRWGIkkTE+9TJ2SPFE5GOnd94Xv/fICCBL6SD
+x4vCpYSB+BmO1wmWP+3B6KE5SfyS5rCVJTYz8MIxOVCSjNbCvH9oS1aQjwgOWDOh
+rmNbEAgwzAg0Au+mZ4hbiJZVmwW9egbKBjAJ7Z/R9tVclH8NNpmyCaplBFrgTOTu
+fOii8TM8fj6Ks77UynzvBEYdxbyjlXLoV5vSIZC8AMDtByWN7MH/Wta9P9/2L6xd
+1ewKPwWyeaANeH/6Me5AN8GNnk61yRy1kPhHUjzTmHJ+Hq0B5omziXAnIBXGIKjL
+4rQwbcAbdLNM9MXWf7UVviknGIxyo+c8zBwxoPJCzu/MXtvLfEZkAW6i1okt0tfu
+PZlatueFYhR4yng/wsqihmGxOlTFulE2G4CfxgPddceQwniIRVuQ2W2JJRSCJlZr
+KF1QSMH/J++Fw8w570WGs850r21p8dHQYseT4SpiNvvdsbAYXM0JydMxpnf9lnyL
+ldwgVFPkXM1VUECIYWnOAVcM+FlEl5fehOLXyYwQGu52EXWE6I3GULXc4sdBxIVc
+KQYov5ROwxcbo+5VrCSZX4HLK6JN8cT8+m2lvbNZq5KiwveWzecQRMslEa/UwpRV
+iHeBVltBf6r01XXlNsG283QiviKHCFc7zhlEEbGsvR0iRO/PnUkeuVqaUFfDLodq
+Aey9QiXM8EfhSNBslKr1lzsAwrpy9jKhD5AilzhGiaQeu37q8tXDm586/PzA15BL
+F5iVC1AvIzBgnLJM4KcaMWDDT43f6S3tfPkb8qU0QXfGI6U4ClyAH4YEQ4+IUkL7
+hvO7ZbWxv2tzm8l3ttNFBokKz7VENd5doaUGWK14woOK53WxWvmf1t/PtQSj5RQZ
+3lig2bhTkdf9i6ndQvkPTskcbpEW4IHqfjvZcnMk+LmhMixSQH1OWStaIphqj4ho
+qNhvSogVU6Dfn67amV5053NxX/9D1hyp4yXv56woaSBXFm4J3yPWhUuwCVC014OT
+3KY3LDheScCOdMnEotTsVgMALLsQ3UJLFp+XiEymY/+UO/ufZZjulONvo2sbEizB
+TdAZ8xxC6oEtujDGO3Rb2r4z3vjkIhokQdV1B/heAL74PlgE5Q1AJl1CL51ZJhIj
+V39uTSBBeZfeWRHO+f9v2unLoMF03CF8KHe3eZ9/h/hhXiATeUz0C3hbxgVTszl1
+fPX2MzJlxPXEVaNPpiIxB2/CdPZTbFZ+dEb0fp7Uzgvj53Ie7eaH+a2qpV18rgAJ
+xBCdTkExBQTpdSJxWZmizOMbhFPt0dMOGLhs0vyTi6qBMNlMeEiHJ+0qbUv9FipB
+eAVJIjck79K+Yw0DQm3cenS3xGq3nrNHMAZ/CTRWatg/6yvZYbqkq5183Ai0IDmA
+0C/63ksMBZbYz7ynabxg8yhchUeSUwPOgR4gU4pus5UC38tkLJ9urzmkIHCbhMVP
+T3iVB6G0MtaX+Tzrb5PArCPG2oAUVO+8t29Uz3NLjKQcQJgicUM913r6EsW1T6QM
+tQseRbk2khCK/y06rdl9yimWciPcqCmlKQpE0ojvoIvvdq8FLM36UZdfBeU4wA4p
+e0468VrniYCCexYK/uCviIhOf+SsQk+kZhNH/MN6i88TkpR6075ze3nZlTGGnbPJ
+sC8McKSO5FYi0ZTfaZ6wu1AhQVQxE4QoDR+OH0aaqC64RJGkkRlaPxtrNSeuj9Xf
+pDHhp8kih0uvRJ1FiB3pT5DX6a1XJeMviCqYRWTM8rSlKqJTUgiBG7u/RrTcWBtH
+zHdATdYs7y5qaNT58cf8G5bICteFyEPrfIR0TGdPAAydiZ57ZCU7S+xNq5xfQzdm
+tPqRotcbAvS/jR3W54A/96rpOZ2eGfQBg4tUVQZ/Uw/aniEipq4ga9qajuikv1VW
+jKa2DvayuYQEtvPgpNVs/j843I8klxVOQFQPpLcQunC+5b2jEu1zaUkCJlpykcU5
+l7u7kXaNI7YPT18dJSAHruUYIN1AUtWVfofK6zNAuoP2s85Sxaggb9lR910jKbod
+LTCbEW0K0D8qPwGJahsOi9h7huoPg7F+SGFVAHtG6O0TxcsQ8btx7Sq1hyhOi7kL
+5Ular7CiWQE7lEHbh4gQNDZ4gjEQEN6gT0Q8EUy7xdTO6fn23ZnVqPH8B01GhCBw
+ftpc75hXD7nFNWtrbrAHu1yMYkxpvWE9G4d8QSPa+kdm6G6ZGb6X6j6N4oV51qdy
+29sniL99E4RJ27ntw3lgUX+MxdMM7Q648Po1k6hwxzDOCY+4BzFnoOUjgV5kPs/m
+Ky1BSpBa7MDEtjNZVYUKsXVoMG/KDUhPOmjKTHGgEHmpcJbTMmAO6hodXYXngDj1
+Ay7u8EADbfF6H2bF5lPR/bi2xhhXrwdjYwA/PdmnLTozc0KNckJr2I5QVzABhMIT
+N7z5SBIpyEnvOM80mv9Gj/Rbn4KQtOMCtBrLd+T9xpMICM83guoV1tcXuu1y+c5H
+X6jrod3dvcCsEqJ/ll3Sd6ViKUJdLU/dBqIjeMPvccGQzVJUlqJF4GcNLQg1n+8s
+vtxCatm+Ii49IMvdsi23o6VIf8AwGMXNp90/a9ugxWRbG2p1sWokxuLL9CoS7AAb
+UD+WJ0qPkn+9jqt+bEYzmB4+2CiFeX9qp8E9amaLkOZwnm+bqrnbkjvVH0p56R9N
+PtTd6KjKjznSvLRgQKRG0mqSis+Rb8xoaHMKEvqYvxIL4zRH274lvPDJhaXZC3V1
+oQliwT0gS5dAocM5VElgktO5a2Du32zkT56FuZpZHFSU6CShlFEJ4tRK05evX8rk
+vcIIdTdTRGvRG9vmNAP8y+Wk0AtfTlKAUaHsvw/amP1goaQb2ChI1SgzvYMDpDz6
+rJXBtM5UX/XCsrTApE7OEp8mZ1zOCMjpT9//CdbzfsJm/L97icCWGAHmqJDxRTTp
+zsCuzKtfBQSzZ67/H1aINfKL7z6teF2HaK/mwfcX2kpNpIFe2aknBEKllHSgi6UR
+Op+TSN6Zzwt8oDTOAmTLw2dqu32mDLwkIXRnzcIIcWP5un+Vts+v6E080YgU0Omj
+bY7KV688M3XYwb66K+H5QswoUWFxZ2scCghOpNvPV/5KlK8wD1sLrkd9cPj6nAAj
+dJAzExHXu0rvmne4Z2HDAb4QL5pFIyiCK8OeCzMHEDmOu2a4EK7XH0aPxGb+iEcQ
+3mtpuPNDwwu5JZoT5Ys7Qd2cBrBQTv5GtMnCHCyM/PUXvkK2xQdf1rw2ZpxMz8Ri
+f2Bw1iEjrrdMbSC1nEaEe87LCaxRLbIcjL9u8224woX1DHriAlRnJjRoG4M0awBG
+Su+vqiav5pAF36/giBumg+0bxDgmA9a4BVt0g3fgHWFMwYQbNFpNheSvRC9m9J34
+uT5iX+c+k8v9DIwT9H1iFdkE97nli8y26XwKvv0059VXbSyDBzKIa7i18IAs4Iu7
+3wLwEuEMDjL2TdMFpMBN8GW0BfllQm1QmDPhXDfJPryT8L2b2sHAFrgio+mh6sR6
+1YuQqFR6KyrcirTtEpxNYmtqEWxTVVHAqayD4RJaYVXhUBFZAMP+STlUVlPM5RgC
+Vtem5hXEywRvQypo6iM3KHonCYwnfa6yBVS+cwB14TMR0VronDFuNy2DnAb2WKcS
+2amVUwteLuFcZ3LkPtXcRqA1LHpbjldfKTV+95ULGSX+dv/JM0OdoxnRKRVUqXG2
+iZsUSGNKqjuf4niNFvcRhdjnnZZAiAPxsvdsIMIpiVXlKVwcqpizx+ILDMFBSz4y
++HKvhisCNtUp/EPritOwzjvzmpIaWY5rubvo8DEZ3XS/46vjtbicGCyL/IGBAFDh
+kK4mpJHzJMoubwc5RhFyy1hzfwrThy/s6eEgD27y79iQM8n7DY8PDXQeXwUihpyY
+19oYK9ReVB1BA2MJSyeLHZ7jiiHIjbXL3f9DPEWJkRDZtg7ZoHDA8ZwmkPI93v0C
+9QtNOywljv2PlhDQSXMMp7Igb8mCUBWLZ5Txn2h7NcwxgI/QqmjTbgi7C4ndMaJ5
+dgnGNzJdlMmRWg0ioydAo85iVcsl4EJGE6YoyI69gBs0nljAOJ+qL0mVBh9AJ0ac
+Uxaa7F2Ko37oYdyF6W+lioBiSrrdvlUg32WnUcZuiT7+OySmILvJKjqcDPyPjAGb
+6Ody1KTAJh9LJ9nb8N0o50URvIZlMwzoZoc/rMtvRD6QxqKI015looskQwej2JTp
+QjCsZ26Ye8KReuVDe5w+YbkVMdCv/ic5TpNomSyTLrcN3AJIoZ8wAZevEernTG4p
+kkMUqe0g1KWnHN7Ek29Fq+7S/deRg+JOZ6b0CooTPGwK6CuBJZ3b6JZZNEfz8/+8
+FQ6/a+ilIT5tHR4H5FAxc+Ef3bueFkR8y5nl55idms7vvTTVTXHNdBu5w/D1C9OU
+/F02tXEuDjtqGc5sE+ig+d2oiO15LFkvml/fY8/kOBCSfncW9mLZdJl8oOHZiRk2
+RKjD2ioNoGmj9HC17NJjmyv7hXTD33eCrEKRj1Q9kZlAy9C7rGi+/vvNFsfIcnmR
+0jbL7yZo0JOPj2X+bQid0ak0w4CYnWYk4Ith9FC7l+QmAwnpf1di0LRK83BtGb29
+BpWugaGJjERaRqIKPnJpyGQcowHnhkLMFAMxqfXiH3FqMHPA9NTh6elyNApnID2B
+QtGC3EFUnvRyQ39wphvsZCRdECMlyDBuW/RM+qbsOTvwJBiHLEOYqw96wg1moSJC
+Uvu7332OYP7aaL8ka3tyzD75GpbcslAgv+o6DjnhYGkikjDXI8bqkbFsZpRV4MXj
+rtDep4yo0Pk22VHrM4rigk4GNaJFot0juzmpSdJtofq4hNalMdpBDhxqxWiQ1a0A
+eWlw5mAF6iXV2j4JqAI7Ja1ec+O43Jl0Ehfea3dE7n2/bdgFH3c0LcR5yj5w2U0j
+zmOwIayd+KS+YAy+TvFpMDUe1LoWtl/ZnuDwq+PBhJlH5H8GPmJWMdcmgHtUBADW
+8KCGk8KgounmT4514PzCoWY8X+dxV0hiUfYu5qpxxBus4zyzOAe1E6eS2Xk+cL1M
+RTP7+/xrCLrQ42UaeH6Yg/PybED7Oc4xVEeai3IDQk0d9p7qZoRjAWIehYXBfftq
+ACrBmchC6kDww7YY0d0G5XS4F1Cua4/Lz2R+wLe5ztBkC5/N8ab351Ayu61q18gD
+rpbZZtjzbk03vDau+unEv479ggEN700cbqfdOGecAuTJ1vxdChV/+tCuOBVgUwBa
+FTocqEyqS0SYEZb9jlKIkobYVkOUnPzYXKEToyCUTf3Ji5CUpK382SyRW0ElRE58
+niNsVxYpvXhVtcWxCmhJgl/37a//iRicwSVBMsho6dYvoA1jJGzPY49jf/e7yiS6
+rbWVZ0FmhGWWsTyfj8O5F4XWO5BUM4QVVt5tIMnlQb2+NU0fmSOAQPuZq6bCvIVg
+eQ+wQ3uapj1avjZnaivY6pJHTo+C6UUmo/+eEo18sm7e+5RY4dW4m4LzJcaNjgeY
+h+DOBCRJbYzzpEQd8ChFojZf1NIANH+PkFUzwrrXB1fDDsEvCtCipM0TxxHBiwnv
+Qs3/6Os8I0Nk2VrI1q8iPHOeOqN9Yssu5P5Z0wTpeSEI/FMwnoDquX6ho3YAoLy0
+hHRW/zUyuEj3+EJuj65cfBcV4t/7Y9rc8GhRqL37anjNvodu5xHoFItZPV3+3DXA
+M6f7zrxBrsYtrlW+ZRQ9AC3QMmdHUqvZ1yeE4a1rDFPznBhDCyMt65XkrOB4LAEH
+RgGqvuNXZbBB0xbwQXoeVYskg3SyyEoF6S1OONUex1a8y7HK8Zr+cRWSJ2vPvS4B
+T04NxCA3k8jmQhhCYqkUgFo5jKI3sd2GUPymiDRukTI4UzZWRDXkYa8ur7HCDKCV
+AZZoYpEtz/edIqhWg4HUP1fAlUNhVAZxtamMaOqYpbs3NUOfBxdl8FfSJmiQMBJr
+KomsrhyvmbwvXADgvk02DStcp1VNaPczhrGqxvMreo+gPz+lEOwxCevwslooNr/5
+p1zBh62NvYVOVCfYffhgJNkcl6/AhMXEB2f22O1bmTjBNF/luDdRb1N+3LS6wQuv
+S/beeGAAb9zME2HuJI6hPhH9r+kc8oaDD/iwdbfdfMxk6eqrKoG3IQUIwRG2lxjL
+/WbderwhlGaGsqNigDl/6oYrSM8lqXSTNrFJxZ/CMjG0TK7mQxvr3Dq98BrURC3Q
+AIFMv8NCfCTBW0IwQ2fQ06anPUuvXi65d2venK0ynycGk8CdiN9iEXH+aqDn2yi0
+VlraACG5IpGKiLxFN1LBArrcyib+RrXhptWbSM6FRinUkn7Q5NVVWXTlpDfOGrCq
+01RFwnLS7UBzACxUiSAQwiFRFylNF3kNx1SDlCm3Ns9tZbngkE+vCi/dWTqxYGKs
+aEBug0axbZ2YiXsBxOGwij7EBiTuDM+e8fqu+2nSh8Rb/ACiG0PliUUo72fFU5s9
+BNdTY2anBC16VTkNT8EJjpftTEJJIl+JsVZ1ZBZuDTqwkVc57tcpLF9dRfqLjaHv
+qBEpjmz8S7bRKWaItk1PJ+/m2NlWMLHj1ClUNI9pUKGKs6FQkRMjZEB7fKmPvnO1
+voexXqm6Fv43Dz8zqftDseSZDpAVFVnlAUgCKn4V8szkGvaQaOQXTUpLY7S2trSR
+pFtCce081pue4r0gP2gROz89zywTDTo/9g7MYmgj/yJ5Ag20YG+N75BPz2FFt0J2
+p+Su/ptBgspW1Psgb+VV6XapC2RntiTXXLAnHabDCpL6eYN3bBzINYvAUz5ylGBl
+CupFys9o9I1buA8vNe7XagxE18M/NPrEVD3fgCNvLE4726qs+WXyWz5QgS2NFl1V
+Pdr8mRRzaIBAqgkwknHDSgwpRfz8bZb1Nvtc/UzIZsrwpsMk3+mH1UIJpgR4GhmA
+C+pZGzdB/LwFsvXNLU0E64mMzK0JBcC9SThcXkU4XXkI/uo25/5J4vVJlL6kPu8i
+aOucXwNE9mXqM8GcXyXjZWfQQsEuHoonJ2nF/Rp4aMaf/8zrqlKIlWLQohD1X3ZP
+8uCWkJCYhe8ZRgl2Zbpe5Zs5uHhQ9Xexz//ZGBFn6IUdtNiSbwWP/ygctenlDtXV
+/ypkmvDfOa1dWBtpMGKSIyiV9/zf8+D2LC33IBtyScB5247p2u1FpkcsMuyBIGCm
+bWvEipGS1nHCl22yNWa4fddA21kdDFPgaT6FY0dJOlFaNPWhpg1KbPAPngJ/bX2u
+//ZQyyhzjT5xii+0TZFjvMgS5tK+o8LOodf97FXYfLlM/WrcQy9mLpj3tDQoOy8W
+Wfu9R5FL5UBOXFcGW0IOTexzrHNICKNMGYQqIBACmJ7MKeYRsWgtm8rMmT8ZhPF0
+Pvtki7PTW1W8VVjPIeXdMvm4kY8SKlJYZHjaBQYO6b8rmyY585NeFxn2moQvlU1Z
+lHquopL0mKXGwMQCitTIk35/WbR48cdxLAAuQGAY/Mj6bAGCxZhvavvNjzsnNmxy
+hS30DCJHg7k8uG9Yyw5XRPjYUFSqRRRWo+Xq6lcuETXH8MFTwh5ju7ScW0sM94x8
+1OSU9vP22Ez9LcwkgOHH/bajq6yrkShbKEYKt/qd4++CYRdX4zJWUQTKAhES3WUb
+NfH15I7JvZhlw8OEVZibXOpUD/8cHSd9zKS05w+STzRnVFJVz4vyx48Mstuur0yr
+i+gHMceDSSLUlyeD6QEIuZMQi3fr4GTTPYlq9zr/SBMPa+eLzbP/LCgxWgH84zcE
+CWtRmZPidmKV/zEDNSuzou44+ACpDhSWt0RWCE05LAtcZUKW9VhNzx0py3V+GURW
+SFYGOa849dfDqyXUUXQU1AoIwffyANVrYjsXbwvf/sE5qQnmTrzJYX+5LSJ8jbYt
+c4Z1/Uimgp5flZVCdbfjvXmrnV/wjOHeLflX2XADtzXBnUG5PcJgOqZHMkQn3men
+bZVGqC87vkKRRdDBMIWWJOGNRgVeUc5G6nu1D5mGnBXJqikkMB57cmelP42SWG5Y
+Bo2YFPobge5qAj7R5szg7q4Jy/UF2C/7UxHgL69mizh+oOazVBg5Oyq8o+FvI68d
+prphoDWu1tC6y4qVITNx+EW6X/6ZGg3BMIe012zD4z49Z3N9Ozl6MczSnBTAPmCA
+tU3aMEs4bM/W/uY75iZib0Sph1smOPXXDk2r8TY3CdsbcUdJVBsnKOkzU0PmJuhz
+iYvKE/oC3lKIT2r1eo20IbIeCvRlruSciJ66LULMYI+xlq4tWHu4prB+jgOu5TM3
+8d4G0pPxfPaCQwElfm7ApFaTDLqaDC7fEh8UVtl7B7NKewqrxuvi+ygMSC8i2g7I
+WtFFMQOtv/4TcLkRqVLGHTiRcoKYN9+S3yjf56Tqo4NsBdLCIlk28VPT1DVlANxE
+/QKgiSJlsxseF8x9ZKfTyyM7MnzkkEIakQDBZr0DvKTnWbgip7KWI+sO8Y0l/bjw
+Kn7DBdGpdSJ7mASIsf22qFVd6JKCCoTKHWoyjgJUU6qaS563eRVWw0oNklOfb+Tz
+GyzJOptuJ7IKBOlEGYIJ+q76kWGBmnAcRakR7p7wX/vWpaNCq4qoJTE3Kz9vsT4O
+Wny9XaQxga0nrZmKES3zljf0MEZiMkq6NlXTcmuiONXnA4yXdk1BRfJi45xoCiOD
+/pbNZkoDX0DXBmsUlcBmXbGio9dtvg87TzyiaBAFkAms290eSJfTOsO1VDI7Wggd
+YxNKZ14qRihciCxtapUbk5JRcgFMR08rRkwHCP9P88W9frdy/5fHV2pgYUbnQPCh
+mluPaFTVp7xBf+sn02jn3yehQSwStp2HiPIMSiB8Og2sd0TtuNV8tLYL+M/vWhbc
+T/cR140hj0wqjlcL+7y7R1E+1KGvQDK/Zj9oBbv0fjuizzHgomaiiU13AZT5R0SJ
+gmrhdNM0t1jdI+b7w5xpqHx2YXvB5Gj1pLcBhrMxkdouAZdOb8XyBmgNBppnzd40
+jISocuQaOdrldHgKgAtC/i9hNgt+Q57fuzFDJwCOyUR4cwXt+YW/dct5QtPqHlsH
+KwokoA1hPsRdw/Jco+p2SOq3oLTpvTIWuh2reMpMPdQO+2E4eKnQLVRpffe4T0Vd
+aU0/NbPicEB+kG55WdNXMFDG8SaFkSA6v6KBBh+B/1UootFtOif/uM1OYzZHk/9n
+zgH7zIvaJ3xZ4JejhtcC6dYoK11S91l16GkiKcl2GvPTPl7MV5+FMyzJoZp+mpQ0
+GlTOCMRi732ciemLXO7tNcLScCno7PP07ZH1Yr5qNrJCX6P0mvbMHCDmw04oWVbv
+AzSgSuOznI8J2mCuJ0tiJ7AAYZBSfQp12PlsxsEgHQahDXaFsupiVGv8oZ8SVwRA
+o8gy969jYcCbEicL1MeG3bbvQ2C6XAKrbZT6JlKLzzPXI9lcNshdDY94GTKHPw+3
++1J2YBKjclqBiLV1J/gEEU0GxXiare7ImSCSTQtjHkFlssAUKVv64Jpv8g1ABV83
+jIH2rpXH38ntSHwxzDm5sIYiOVLLLHOPqr4/VM8vpfkLbuVYDBMSUJV8PnvViK02
+x7hWuOALWB6fhmMCZctlBaeUybAI8GZR6nLT3Dn5LTqfg14tA1l+SOZCgvLa3FoN
+S9PXyo3T9MQl3ADgf41CoV3Wv+SdoCWRfdwMxUhydVU22yZsZFcUau74tRF14ueW
+H/dynA2DC7/onah+jwpOW89/bMYGW6+czxob4iv25zoM2j22qwKdM2uQvAqH9BhA
+8ePFO8aCk9iHqsX1oysEeiyRhH+NfclYPheCWKr00l4/PqMxjaeIEC8MadVQwCYW
+4/4/kQbVYeJFnLh44en3GIKIRvmdGpNA/rIWtR7cjF4YI1/1UjOy6BYFLYOjKngN
+LsMhBOJFgX1vkkp/DriSKs2Ln6g2/8z9bTZu+JlciuQqRPs0gn1UQPbaO+Us0B7K
+wuWAafbUEGNtHG6Z2VT6KUiT2fD4YOECaRvw5r6tpZRAF9fzDOWyvv14aCIqaXg1
+XT9JsAUAdJKi2BQoF/XpeJQAOOIVr6yzTowjoWARLdCyaN+UcpSLu8W1T8O+9kbJ
+6SwgNfNqO++SRhF1Nxfc9Nh2cuRrcD25iPEJqY4LcLAxprquHtwLlkS53zVBWywN
+19xyrqYHnzxwdhuc2QQQ/a4pIR6lV7icCO5XX4NuDv9acDwSWcg9JxIP6kW81tMg
+dzZMAm4+2eL+d74teTme8IWH+qT9Oe5nroWj6K6xSmPBmoCI5X8lSYJS6To4sCI9
+OIh3L3Kb2V+B1Kg09uMU/f+HYPbClHDC2K5yN4UzX7/YPe1h0fV/L7a5vObWTMK8
+YAdtjAtRspa5/CStATjTrRCjv6SuEXZVhplTNZ3SAgSWZyYutJgp28S54rGM+NWP
+YAjvdzvJdZ5a6BGBl7FYwWj4Gs9DDrv0YXS9v/K+IAjbJhf7JxM3AUYRjBWLolhr
+KcBi4lIrizZYr79u+iwMrUtQ468KXhT+vrjNSjpMd6sv9rRLclXo7VJvtWODYwzr
+0AdhplTQetxpRg5X7oIZmh3RLHG59ScA3U9kjudO5vJJHhGdiNKMn1RZrim3YuB/
+vY1wNM17WoBcNH2Oj0Uivy7dFfjD0Uqr5dR6XsD4uizC6abNQHE/0vO9LZcyvlBp
+JYziVhP+xzbYFJRde6JhKDhXANMcax0xawc6wZTRNXgn3unRLV8ZTsrHpfOLZLAb
+08kmXqW4kDpJpcVplEULnW9VCksMD5JpPO7JiP6oNZHbFIgHHtc8fvIzjQGFRUeq
+uRdiWPd+h7FzFCfzbLzcCaNA0P/4pRkr0yOHWh20xA4MwusrhXc3NCsBLKaINFmo
+Tuq/eVFeNpBvxLz4zBUpo3a73Wf65ite7AXVkz6uv3qCz5i95uNQ7BI1fXavOVzN
+dp6Dzzz32vydjFhm8jBYn2HLNTRmV89X2q5ZLy8aWHxTl5sZDRf9dREXc7NEAB/Q
+nxgEDyibKahqJeYwjqvufkfwD8v9rLn5fZG9757Uepju2FEDpLxavoedgK+wiF0S
+7Z7Vf0CkL9mGYq0Z+QZS29RgcIRNQaqK/4f7ztT2aL73wTdATfwTG6bxUWYSwn85
+yQVEWkwmi8Fkf+pofvS3qFprYgQIcISwefVZQidAdCX6QnTIL65qpIto3624wMJf
+UN0QV4eKsZJrUebs4KE3JBORKLzlqmBy5qsPEVUQnDxyLOZ+l9HrsijNZeCPLEU6
+HD4ibEYhobzkn8y/y/jHxYm7xZRGTxFTGb5O6gPVdPpjkxMrY36J45Ol7isebMm7
+8QHhhR8tyj3qJBuw05Q+21Gwoc4ZTgPtyWVlaw9gyrCSG1tKV09KwKo48msIADtn
+0mJS6Zl2P2UDaRv1ApYe/p9/RHBZWF9iv3boHBn6C8L+ktLZ1tGXa6pJg4oVFokU
+s7LbjWpSfY5V5PkkiJDrw+YE2etIFMBW9RjnaofjKUOvYl/37tj6UstiNvyEScYR
+2nrPSuI1yV4DmXP8pPfsmdrifEPrWzwcFXlh1hQBhSy3OvxV177LQHPWwE9YnSZR
+qvSkHOahu92S860PlN8Qx0XsuOBER7PRDjW3l02P7TVMfkScsaL5/wk6aMYN7G1T
+g5/K75ot16cKIg0n3YNFZnR1z1AW5CDnabdqhRb+zeaDdzPPWU6REhIlgIY0+OvF
+6YQQawA3HMwWu/8lcd6d0YNEOvJBmKjY093Oos+IHzUCj2Io7Fs2qtJ9ERxufnEX
+Lc5n1FDaMaHUnfHTiCvDjFhj/YMPlp/wGAc2+g9qL2Lm2s+NtuEg7gdi2APU6tKP
+5B3HU/r916PaJWE23Rn9Y1cUSGGjImzz1ZshuNOBERnBBc5UMIzsPiF/Aj2O3/LT
+RBSQnvDQwFBl6zFAJ8UNIDIB6xGqVOdh3XsMdcNb1X9BD2pvOB5kaDZ4IDCOljqL
+oBxiv2WsZkr17tljqAM0Tv1x5u0HD22pPHSYkcdg4aSJWJ2C2u05MVaDWrTlewk/
+nOtl4tHcPKzZK0eKTR3WNaVjCQ73QJGb6ZytkUHETMAYT9qJCppJp43vuJLAlbO/
+0EBAMWobuW7W9TTPYIf99V2JBAL89L0f3rKIFDVYNpNpruAA/suGCzBBVt6/NL0q
+7FUr8F29TYzXlBrTW9LlfikYmyFSW78p6jBoKhGLGAOm0CQTEOQKfbN0qg8t0ZEJ
+1ABn+Ysik1osBjKDGRmj6KMfw2danYkq0Ix+lG1nTnb9OEYqg5QOAQX/GUHYpeFt
++abLw6M8wINXsz9BRWmo6HrQM/xMixiDsspQDJu8z9oALo8Ae24k4qgkfCX23uKy
+V0e3XeIK1qsLGlp1rQvwCKUzPyq11bhJIMuOSdDgXMfMaJ6gTTMesz8ci+KX3Awn
+3/EBMZLBaPoAWdvyy1abTFryCMrQ0VYOSHSDSuTHDx29otu/QeUYYwoRI3nIcM2K
+r6l7xapjfd+6fc5YiFtX3Q1OW0MVAepavpFOLvamNhdVwsRCNopDJ2h7t4ZnYePw
+rDj1Jc85uA7tNfrcaCzgBEtpxoIfl9dXzTHZsKGMsP7Be9BQp+oetcwaaLCK3Bts
+WCh67eMgDoZbSC6GzZ+irZBIBbhJfZQuQGgOGLFsRdShRPlFnhy3CjTpKPKIV3PQ
+k0gUZxLIp0LUkUjLqQ4Ww9+bEOOEUDVLirQNk2T+I8X157j96X5fPADDC0hfVt5Q
+tEQ9D/+2+i2iuNHhxJZBoLBgW6r5oehUrWTknmk4dGuqHHwSfjN3C8FUwS/v+bw0
+ZfgdG8xr1gUlHppbzxkGiN4OFonnWrXKNnw4CAT+vbcmbh+h1fSAnN8pl7lI0YQE
+Hnqksf3ahQNS1PtVNf5kwR90HIXy6yqQ6RWDsth+adFh+5CmIwwbYMPUmWbQCAjm
+ZMmpPzM/bIMWMw+Pa7/LjQtRHOJp6NGmuZBB13yM5MZiNHCmU8kuX5/64WPuBmTg
+sV5c3ayy4pczSqXVnky8QmWu9I//WmD5VqLJ9G32s5pdWQEfrK1BOrZjk7x1nPkO
+35vG1S6rDw1yTVt6xpHL1MQp1H0xZ8IsfhRjvEZUK17ADFYsqjRhYGlDiQwefYNa
+j0gXuh7z6+gejhv+iA6cREori+33/RObztHVz1krXMHFSbbX2ZG9I9b58tVuULyo
+E6avkr0/Pw0Mg2+vbTG9HHjyHWP9vB/5meP7RMO4B5qn/Kjn1ncotoeF+wisxGyx
+BJtCtdSeO2pmBvzfXgOdP44V0yOxMZn/8bE0KHqGbkM/nxujmox+4jaqeCFp5LIa
+17i09QcQECKUztdcD5MmKJCD4rLKYoZPYFQsDyLOpdUhz8qJ2nrXCV9HnPExyVWV
+Q39BFK5vnvgV6sfwe7ZWjF1m3Pa+gAOySfW/SkCWnvlv6bAr5eO5UVa+RjjGEyvn
+tchhGfk8Aaq1M/Tx4zqE78wnS5k/2SYcWs/ZdlWGucL88BozvP5gWYXqmq0p2HDg
+7x8Hw3XWEXZ0kGSkt0QDuVbYLtvi15z5eYFljbk25UBK3piHKbmPiJt6T+kNhhLt
+xnED9VxjjHcbUNAI9XqiRO7yWh7tWz3SuIulzYQoVq2D3tUbMA7RRMxwuNc3xGL+
+r3Tm8uQh45Bc6PE7oP3/T05hZDiob5Nq6Ab7ndPlVGV5MqwaWG8iL2mmaahWUMcw
+vQ3uxccm68/ZuM+PYqxmcbYSokZM1vXavPyiIFXTqKIa9vlaLw5QlsLvbEhfzdU5
+ZygQGKQ3oge77LOURte7AltlM/oXE0SGL5AIg7DOU2r4Ul9IAFTU7fG6t3emEE1D
+bd4Ule619ptJ5aOOY3Xc2rr58my+NUBERbv4YK7H9jhhZbwRdjy7DbsjyBHJHkUr
+6CgJIMDjMS8xvOQq01eno/ZuQUMNChfv7BR0IWZ5XTgnJou7dgBtQ/UULeHBwnEK
+1cBNF9uHpkHOePJBFOH7PSab45VXhOC8s57TO2A4RZaaBNffxi6K+NggWoITMh/Z
+uMzSEu4emjR6RJDw0Cc1mXzDctJWfFMHnYcbuj8wNdGtff8v5fy43YLnIOlEX/S4
+v5vApuFebo/gxWVWHJmz/hYSBYSmC6SUmbeIBXdghVx/287Xm8k/n4dtkOEzwOa+
+rbiHMHp9P5cZNp3DLiW6hKX9wMS67MmcN28MPPwTJXvqRYTPn6BcCTbaHAppUxG6
+fRMFNPDIo6JXCEvOVMpqcpNXn634CBlj20JlbtCRDWlJvhq3Lzy1b7Ca0WR6I/Gj
+7omvhtWSrTzgw3NN/yRwyGBFsVzWmU+9aCkatGcGjNIMQ//eMbd8F7oy6AHWlyWx
+O0ab7P52VpkE37uq686M8u02Hwg4vIRir5pH+1Of5yaBQCNG139cFENiIdLiM6BU
+erxSs4pgkeyPb84QMB978sKv5nbp5rprhV2Aa3GuaYKWjUTJMba6w62eZ3XNdFRd
+RS6NFQ14AJUvYy7rWYjkWF37koLAxuLs08g0eFroEvkQ+H9q8evDsLRswVGwUHYQ
+32lK73Hq8utQZ58culKqxz2D13FGWSgMkFOL9xeSz2zRSQZ7343oqI/QX0Jqj3u0
+sXXNiAM5DACFqXug+OH0dGTlEVMP7RDMDm6vxCEZF5aIoZ8tT86Wxc37JwuIN0Um
+SILerCRWQi3XMgawGYV7QJkAarg6UxMz2nAkzgQqD6JFsm+2RNY6HSUDLy3KhUt1
+YVe/iyrxFi0IzlN+pbwtDjRZ6oUochpi0npMYkV9H3i2Lvoc33kXpMESVFnvrhJ8
+khACha+fzPtrKSnTfzWlB/E2c60Uym0GKDbaS5SK0HsZfe0sco18yYmAgcps8LNP
+BISrJk4XenppB+zAKa6m552ToKTSNNwO23FwOW2sBQlw+7IQrfTuVU416xbiBp6w
+CysG0IYIOeVy0rS+HCZhFHDsDfAkpLX13zSuMMDfQUvxw4v7Ll3Sk3BJhlXV6v9q
+9Oi1fu8sF+jHQ4ar5bg0zUgpL4d9eQ6c0hkj44pTcyvo0f2k3c+vEAC5BsAQ9GSc
+dpx1PRGeV1uZ6Vf+tK48IdwUeO+5I1Kjq8Iq9sgLSWefSdWl+SXl9NS57zyTh0Jn
+f0IgIxktSvvr/OdzyN7bT6bb6UpchHDTf6uQph9iKjq61vyhWAoyr5n2MTrtoHLy
+TwAEj0S2lmXfioNycMtovIdnV+kqroiAraBWebtHdcC1hA5m7Ltaqr+EhiB4PcxZ
+xh2lKBF3dkFioCJGrlABqQu8Zp3equFO0qSXLdmw0cantNl9lDadLue3Xo5nCizu
+819mciwQdB3h5/axuMYR+1611sLbScem4HBaOzS5IXRjOvzTEjmBpx76F/YHc/j9
+a2pb9rfrMseG9OliCL337JNmAxScQUcGycEQ3l8RHtIoXQdNbqKtsYBdugCX22ER
+evHe2a1CSZdiNL15R5SVS0+LJEjIx9faJ8wJI//8ixZ4NdkVHvK3483Z+PcpBURS
+oA4W2PM3AoCegLBRisSud8e92pE9gcuWwSlIYso6yx1BqWDkmQFcDx8UjuCM5qVK
+oQdTLFbd0pDwnB9O0ObdH0LLlVrhAC7v3HOjvfHkctqsPBchJn2Trafv9Wiagr6b
+/Q9g2YoVWQBNTiy+pxYASyg7pMkZC7UiJLlRQxtAQKUW5WxQ0UTgzHCs4LJ7HxoW
+LEUtIMH10UQLfRRX7RNct22fO52DzaGqGMX15ft8y039AI5z/7vI/duQWQUkcCQW
+qEy9CE9CXyaOcJjSqIXoDvuZqo84x2vZ1v6sCFMjKGIuZRxWDTIHHy9zHgc8Xs03
+ksJ9VQiyuCvgCgHyusyq1orD/fNYm25E04lnw8X9hAeWzdl0yDtBumCwYLcL7h/I
+VUuscN3J3hgiNTIW4OMWBLZ8VCDqw4fvv0J3QZ4jViF6TcYEx4+/Y2lata4EV3x3
+iOJ9qE3YK8X5wHVnEBjzyv9IerBRYVIeyHeJ6U0QS2OdWKzH6lzdVCGUbNXvLjKV
+2tSXfujRj0gsALmueQx35k3Jzr6gS9OeK0e5jb2HR9eWLhXL84dU4OsjnvINlvUh
+FCEJnKXsUI94autmhI6NgfVMGVCVqtky6uJIQcZxJjR1OzC3YZNKQW6AiGCV3uzi
+cKvkd9TkLklS9I/1xPwCvFknb2MLp6jnCpu+OWv0LbaW1xLKLkcS43hDMd0GNo8+
+8hZL5YCMvXigykgainZgoQpI74TOPUSlSTZ1iqf+20ew0/YwjYTpqqEAcKrTrPmE
+KA3GJwNBKeOXH2vLmhv0JGB6Mr1a5Yn3l/S5VqILRVDpMrdJboxcK25RDReu8OdO
+skfjVs3PWBusM8LfLMdvLmLChEAAKH0TOhyssiOipO5rYaW02MpE3UtP3/wuKEe8
+vk5XdVzMPMQy3/4+qylYugWjRfEDWuPzJreyyHO45NHZbeVf9ro3BSwCcQ9eaUUK
+ep08POhCwTcCXShyPwayLOdgWgARXTrMJaYnuaQRDuNoxtYaClgplkQuRWv4nqon
+8kz7vfGAold1iA1FAz5MIfu7TPy8bRsfqobU7C9WRXGNtqGUUOjvqYudg/VlNaDv
+EAu+99NOSlnmB9mB2rz+W2QxAlPAWkXA8DKEJ1hjC7mCavmdpjCcQlGGoErfaz9n
+80qiili5RpxWVrQ59iPB8wW04++kUe10/axhr6c35WNMx2H8QhhO0gDSDUC0jG/K
+Dne0DJ4T6Op/qqHV4Qxx5PdWWwFE0YT6nAw32eP1ykRwbfLqxFRV2jV0vF0VdNln
+59AxgtYRl/OtXnpLGsnpkS3ugccqIjIfEpo0E232x4RMqBx9McKuHqWcmcMbFM28
+/JmrcYm1BmukPTMzZIC/gKScEoA4PnIf2KmvrdI4wfCkWN4URE7w+FVZU6cAwkig
+YZLRDy5hllULJiEGjfWmFP503KDP3q0+dJ1c9CdS603G4TrmQ/XtkGKR1g4hmb/9
+tcSNFnPgqoU/UlzJrjqtICoYREpt+7c4MbYLRQ3r5rGr+usJQAKv+3zLJbgrT2Xo
+xeUS/SEvWGdiw/WLv9jxMFgb2bjxZVxoBwfaHdwTR4DuqjcWst2gHfhUR9pZb6I6
+qj/TMCzzD/l4RUR53dAzuWSgNQU5Y7IzzDqnRKwknd+SjcC8iG3H8JAh1Z9urIQS
+9OuDaTh59lZz09iup3xp7GLDBQhfd28Pte2pznbHrbFtozA/Enf701NNl9/jgwjo
+ePmVv+ZXzpGWmQLu6fHkJdlw9qXJzZ1pT2bZn5A0oNIXP3VNFxuuFpBzSXLGXbyT
+3mxGQnEXGTVMuNLugbynsCrTMIx4zzGVJZyq6X4pGUGZtMzV7s+c7gy7yUdhtoSN
+q3whl5I3mo3bwnj7Ku3iSmc6NerjRPyumvz1JdFihFGfwrS22lkXBpZ/DsTfPhEh
+0hxzyqY7z0mc/EEo3DMiJz94/uFrWg57xkBxBdXlJ4yjoYW+mpEW/komichkq2M4
+TY5mduDJMzm+kMeW30TFjPH4yRmQjNc3aHA04nLuES2wqPJEMbQcqCb8jkaN+S1v
+hL5eFDwTLJWodLI3KVMqUyskA0xnz3AoepxdSbEUNULpskb4yTHWeLN6HIDnJupH
+EDddrnuIQ+JmwNu/gORfERWE6N5umAYqT8/pUiU1spKdeHJzCSZz7LI9eMFGL4j0
+TMx7hxVj+Ig7t37Dr1NCSmMqHqSTHmjklSuuRALjiArphaXXTrXifJ0u3kkigUHe
+qYhL+XXP/+VQwdEF3Q60LAcl96pm2rSy/72iTXDbTNL9qPvEg8/mRCp2T9Uccwyx
+Y7sKk2sqDZcEEceuxrJSOT6n604hS7nvpQcQa+tAOC180wx8Fk0hjI5blWElq7kC
+3sUuQOYLxoazfcYr/Ana9IEgUMqBrNsN5sDoTCKTLswPagyjPGxei+xfg7/eflvr
+hxzuXqHKkUdWNVKQu6ovSAT3Bnmkad6YRwlxCRWDdXlA58hcKYvVc9jdERPDYIK2
+VVr79gdJmrYL9VT7N2EFeUutCx8NMIlBbAllD2T1vu5S//MjllxDz+Aj+fGL2cj4
+4L+NK0/VXYw20/ddP6rZDK7W8JEjMZb8vvdT4WatAMHpMoS2cyU1kWlqOX2u8JPB
+S6TAYN1VzR8NTp4XCk51ueXvAgDPQPtzhRHbB2KZ7gT0DShAm26uWUyCHnqn3I7n
+VutUyhHylTYUr6p9kRlWHEPj8NqIECMCZlS8VKBQXhjiXgRU65ojF4uTK47/TkZ6
+SyClo6yG0CzSkzCVooFqIQn6M80YK1/Alyn6vr4OKUzcrg9VoXjNHA/HQzcEnqvy
+Mp9PFlkPvd4Yw88EgYpePz8ra9ZvLlczZ13QhGhts3Ka6i+UU5MvkNKN4U3S1XC7
+SsfjiIUIkui/wa+svPP8UlGbpaLnlPiOl5VMeKHyd0zWiQ2YvQ2OaZczRbjoHMiQ
+8k6lBM5xtPL0N1L2iQtm6DwGbi46l9pz6HTjb4ST+zjj1EYVPNOTBUwwYgegpMCY
+fQBhHcc6MsacJvv/k0hApN6qB7ywE0hHifZoCgX2k6Rmkog5daw96ok9puECJngq
+I29OURy8BuPzmkaGUq4j/RRmE8xRzOX7U7XpwiTgulbh405w3Mnv9Nt9ftq8iMj1
+jd/FR6VSWV2Cp58VlgtL1NDt1OaMD4KpegtpPRherOqO6YXNVO+hdg1bumyz7XU5
+e2/V0Mp/ZNed5J+i+w+Jukqxft9Ucf1XVuaRLXhN/bD0pgQqumppS1JycI0fQUVO
+/mOjlhLk6xq64HteplBhRgTiyUzeq4YJaLQ1EtWCF0Oar5ig37uG9ODIM+dnhuMD
+bwb8iMi91bDwb4xU7I7PyS6Uc3QP4SW2SjQN+sebPUTtAJj1F8INjWnkl2O6cK+7
+UWDTDZpL8iSmqrLATvqsVP0o4jK1jcsTac475zTlRxNp12YI+0CG2gPvAasTxnb+
+bHHPCPTAz2Oq/wq7tNonHT5Hfwf2Rss6fwPqLga74nQpEpdDD7PiIebuHp6HgHqG
+BZ5lIOT1oUo1kejaOuwxIpRc+EHHo+fS1bFkyivPMu7i00Yr4I3xcd0MJ79gPBAA
+ePQh4YSwd+qGIyS74Cur9Z3NHEAs3bvp+1r1S5PXgvXqMRm3m+5VRokszhIJye9T
+SM88CzwVTTslXGdTZpzbNYQrbDY8c1E2ZM0vbO4KN3ZoB/sN6CCpjQDyWg1IpirM
+ZR21UaH2PHsk6vicr7wCr+51n+Lm/JNIon9gm0rC227AzMSFvsVHikUaJkUS7Lx5
+5yfWgzKQldg7Y8JYj9SGFgDJBDC+fg2oCvACHo+OHyCpRoLCijoh+cdc2RNkFrCI
+/b9urA4GRFonI2FIgpa+GHnFA3DedrYgVwD/5qe7XBukMGmKTNGmxS3MaMvNZ4I0
+9+WQWF1V4oQgMU3dVfK7+ImmbH1b2qJVeUsq2wOYeyoDdCj/aBMCxnRiLOA9Hh/f
+QP5jOj3Ffef6Kp+7lgh8DZnBTkQSzVdg3/DUTax/gCPg1/ZGJtToPcJt0Jc6/wML
+ILavkhfJeciMYynpg1zP6JtWDi3olEr9y6U5khYna1cBvCjW+plqSwOd+st966dR
+P2fgWvoKlZ7thYOQSFnGCaR+PRewv7lYG1iR5gHqNf6Wcc3BYdf69KPZJ+Fvcztj
++sMIaPVO7XuUuQYkkj1r2DX1pGMWTS8B05HAmef3X+82hD2NLxM2xJH9nJ864IRc
+1Msn6hBG0o1lSr62ChQ53l2wRRBdUYX54zU6cxSaX0r3uIjzh+iWQpU3ksrzrtfN
+/z9GNYIwR4GbCMHqmWPYUZ0hHJ4NIPpm5SdDDxQX1yPFWKij2pUogToRYMznlOxX
+voSK0pwdh0c+r5TJ3bJzzsyhYIw7nYWMfR7mf4OFA2e5vSAHNzrk/YXZ1mP9i/jX
+VciF1s4DjvhDywo7lrLMjz7WVOXz5li5VAEb8goXghiY1yiZF99cC9e6Dm5AktCT
+A3NXf/Um2iL3W0Egt0krjMq0fcNRk/a2BdEXHlBuDTx2j1s+Ulv5BpY/fUvFvC+0
+2peJr3AmqQeluPmbYG6/X+SQecVcuriZLv11T+DPCpOhtocGMzKt20Ibz0XHk4SO
+TdXfvfKW1jw2+1WruEDjrVa+EsM/OrgQ+bfp6jP6KuGyA28c4YDaIog07//Sr4qi
+Rwf2j5ULNlwlyV6elAdxU2KI0rhFp1lRa6ioTELn+sSAf0ls82MaQrpCWe4JL/A3
+zclCkuwKPoL25SwXMdxg4GOPR06YYPuvlMIMBuJ5fBtOyM0xN7Fs89kkTYlk+9Et
+Pbu+j3XTdY40ygcgqNqjq9miLP29FKV2R7zhRLvWQYB8TOu1/Y487XrmD4janpSn
+hfdkEB/h4eFkQA72e6CxxHwKn4bW6gGOg7+xsiV3fEqCd4Dj3kkfBNhI2ROZQAGD
+Rd+wUSyh6aw/KwgYyNv5tsXU5MBpEn8+X3E+/////wEAAAD///////8AAAIAAQD/
+//7/AAACAAIA///7////AQABAP//AAABAP////8BAAEA//8CAAAA//8AAP////8C
+AP/////+//////8BAAEAAQAAAAAAAwAAAAAAAQABAP3//v8BAAEA/////////v/+
+/wAAAQAAAAEA/////wAA/v8BAAEAAAD//wAAAAD+////AAABAAQAAAAAAP///f//
+/wMAAQABAP//AQAAAAMA//8CAP////8AAAEAAAD///7/AAAAAAIAAQAAAAIA/v8C
+AP3//v///////f8AAAAA/v8CAAEA//8BAAAAAwACAP7/AQD//////v8AAP7//v8A
+AAAAAAABAP7////+/wEAAgABAAAA//8AAAIAAgABAP///P/+/wEA//8CAP//AAAA
+AP////////7//f8AAAEA/v/+/wAA////////AAAAAAAAAgAAAAEAAgAAAP3/AAAA
+AAAA/////wEAAgACAP//AwD+//////8BAAEAAQACAAMAAAABAAAA//8BAAAAAwAA
+AP////////7//f///wIAAAAAAAAAAAAAAAEA//8AAAEA///+/////P////7//f//
+/wAA/v///wIAAQAAAAAAAQAAAP//AQACAP7/AQD+/wIABAD///////8BAAIA//8A
+AAEA//8AAP////8AAP//AQADAAAAAwAAAAAAAAAAAPz///8AAP7/AQD//wUAAAD/
+/wEA/v/+////AAACAAEAAQD/////AAD+/wIAAgACAP//AQABAP7/AQAAAAAA////
+/wAAAAABAP//AQADAAAAAAAAAP7//v///wAA////////AgD+//3/AAABAPz/////
+////AQACAAEA//8AAAIA/////wIAAAAAAP7///8DAP//AgD/////AAAAAAEAAQAA
+AP//AQABAAIA/////wEA/v8BAAAA//8BAAMAAQABAP//AAD/////AQAAAP3/AAAC
+AAEAAAD//wAA/v///wEAAAABAP7////9//7//f///wAA//8BAAIA/////////v8B
+AAEAAgD///7/AAABAAEAAAAAAP7//f8AAAEAAAAAAAEAAAAAAAMAAAACAAIA////
+/wMAAQABAAEA/v8DAAEAAAAAAP//AgD//wEA//8CAAIAAAABAAIA/v8CAAIA/v8A
+AP7///8AAAIAAgD//wIAAQAAAAAAAAD//wAAAQD+////AQABAP////8BAAMAAAD/
+/wAA/f8DAAEA/v8BAP//AQD/////////////AgD//wAAAAAAAAEAAQACAAAAAwAB
+AAEA//8AAAAAAAD/////AQD/////AAD//wEAAgAAAAAAAAD+/wEAAQABAP7//v//
+/wIAAQD//wIAAAAAAAIA//8BAP///v8AAAAAAQABAP7/AAABAAAA//8BAAEA/f//
+////AQAAAAIAAgD//wAAAAD+/wAAAAD//wAAAQACAAIAAQD+/wIA//8CAAAA/v8B
+AAEAAQD//wEAAAABAAEA//8BAP//AAAAAAAAAAAAAP////8AAP7/AgD//wAAAAAB
+AP3/////////AQAAAP//AQAAAAIA/v8BAAIAAQD//wEAAgD//wAA/v8AAAIAAAAA
+AP7/AQD//wIAAgD+/wEAAQD//wEA//8AAP//AQD//wIAAQD//wAAAAABAAAAAwAC
+AAIAAQABAAIAAAABAP//AQD//wEA/v/+/wEA/v/+/wMAAAABAP7///8BAP//AwAA
+AP7/AQAAAAEAAgAAAAAA//8BAP//AAADAAAAAQD+/////v8CAAEA/////////v8C
+AAIAAgABAP////8AAAAAAQACAAAA/v8AAAIAAAD+/wAAAgD//wAAAgD+///////+
+/wAAAgD+/wEAAQAAAAEAAAD/////AQD//wIA//8AAAAAAgABAAEAAQADAP//AQD/
+/wAAAQACAAEA////////AQABAAEAAQABAAAAAAAAAP7///8BAP7////+/wIA//8B
+AP7/AAAAAP7/AQABAP//AQABAAEA/v/+//7/AgD//////v8AAAIA///9//7////+
+/wAA/v8BAAEAAgABAAAA//8DAAAA/v////7/AgAAAAIA/v8DAP7/AAABAAAA//8A
+AAAA/v////7/AAABAAEA/f/+//3/AAAAAP////8AAAAAAQD//wEA//8DAAEAAAAA
+AAAA//8AAAIAAgD//wEAAQACAAMA/v8AAAAAAgACAP///v///wIA//8DAP//AAAA
+AAIAAAD//wEA/P8BAP//AQD9/wAA//8AAAIAAQABAAEA//8CAAEAAwD//wAAAAD/
+/wIAAwAAAP7/AAD+/wEAAQACAAIAAQABAAAAAAAAAP////8AAAAAAgACAAEAAgD/
+/wMA//8CAP//AQAAAP///v///wIAAAD9/wAA/v8AAAEAAQACAP7//v8BAAIA//8A
+AAMAAAABAP//AAAAAAIAAAAAAP////8BAP///v////7/AAD+/wEAAgAAAAIA///+
+//3///8AAAAA//8BAP//AQD+/wEAAAD9//7//v8AAAAAAAAAAAAAAAABAP//////
+/wAA/////wMAAQACAAEA//8BAAEAAAABAAAA///+/wEA//8AAP7/AAD+/wEA//8B
+AAEAAAD//wEAAQABAAIA/v/8/wEAAgD+////AAD//wIAAAD//wEAAQAAAAAAAQAA
+AAAAAAABAAEAAgD+///////+//7/AQACAP//AgACAP7//f8AAAEA/////wIAAQAC
+AAAAAAACAP///v//////AAABAP//AQD///7/AAD9//7/AAD//wEAAQAAAP//AAAB
+AAAAAAD+/wAAAgADAAAAAQD+/wAAAQD//wIAAgABAP3/AQD//wEAAAAAAP///f//
+/wIAAQD/////AAD+//3/AAAAAP7///8AAAAA/f8CAAAA/v8BAP//AQD9////AwD/
+////AAAAAAAAAQD/////AAD///7//v8CAAAAAQD//wEAAAACAAAA///+/wEAAwAA
+AAEAAQAAAAAAAAD+//////8BAAAAAgABAP//AQD///////8BAP///v8BAP////8C
+AAMA/v8BAAEA//8BAAMAAAAAAAAAAAACAAEA/v8AAAEAAgD/////AQACAP//AQAC
+AP7/AAAAAAAA/////wAA/v8BAP7//v8AAAIA/f///wIAAgAAAP//AQAAAAAAAQAA
+AP///v8AAAEA/v8AAAAA//8BAAAAAQABAP////////3/AAACAP7//v8AAAAAAwAD
+AAIAAQD//wAA/////wMA/v/+//7/AAADAAAAAQD///7///8BAP//AQABAAMAAQAA
+AAEAAQABAAAA/f///wIA//8AAAAAAAABAAMAAQABAP7///8AAP//AAACAAAAAQD+
+//7//v8AAAEA///+/wEAAwAAAAEAAQACAP3/AQAAAAEA/v8CAP7//v///wMA/v//
+/wAA//8AAAIAAAACAAAAAgAAAP3///8BAAEAAAD//wEA//8AAP7//f8BAAIAAQAA
+AP////8BAP7/AAABAAEAAAADAP//AQD+/wAA//8AAP//AAABAAEAAQD///3/AQAA
+AAIAAQAAAAEA//8BAP7/AAD/////////////AgD9/wEAAgACAAAAAAABAAAA/v/+
+////AAAAAAEAAAD//wIAAAAAAP//AQAAAAIA///9//7///8BAAEAAQD//wIAAAAB
+AP//AQAAAP//AAABAAAAAwABAAEAAQD//wEA/v8AAAEAAQABAAAAAAD+/wAA//8E
+AP7///8BAAIAAQD//wAAAAAAAAEA/v8AAAMAAAACAAAAAwADAP7/AAACAAAAAAD9
+//3///8BAAEAAQD8/wAA/v//////AAAAAAEAAQAAAP7//v/+/wAAAgABAP///v8E
+AAEA//8BAAAAAAABAAIA/v///wMA//////////8BAAIAAQAAAP///v8CAP7/////
+/wAAAAABAAIA/v/9/wEAAgD9/wEA///9////AQAAAAAA//8AAP////8BAAEAAQD/
+////AAAAAP//AAAAAAAA//8AAAAAAAD//wAAAAAAAAEAAQAAAAIA/P8AAAEA//8A
+AAAAAAAAAAEA/////wEAAAAAAAAAAgABAP//AAABAP//AgAAAAAAAAAAAAQAAQAA
+AP///f8AAP//AAD/////AQD///////////7/AAAAAP///v///wEA//8CAAIAAgAC
+AAIAAAD//wAAAAD//wAAAQD+/wAAAQABAP//AQACAP/////+////AAACAP7//f//
+/wAA//8AAAAAAQD/////AQABAAAAAQABAP//AAAAAAIAAQAAAAMAAQABAP7//v8C
+AAEA//8BAP7/AQAAAAAABAAAAP//AAD+////AQACAAMA////////AQABAAAAAAAA
+AAAA/f///wAA/////wAAAAD//wAAAgD///////8AAAEA/v8DAP//AAACAAAAAAD+
+/wAA//8AAAIAAgD+/wQAAAAAAAAA/v8AAAEAAwD//wEAAAAAAAIA/v8AAAAAAgAC
+AP//AgD//wAAAAAAAP//AgD+/wAA//8AAAAAAgABAAIAAAD+/wEAAAD//wMAAQD/
+/wIAAAD+/wAAAAABAAAAAgABAP3/AAD//wIAAQABAAEA///+/wAAAwAAAP////8A
+AAEA/v8CAP//AAACAAIA//8BAAAAAgAAAAAAAgACAAAAAQAAAAAAAQABAAAAAAAB
+AP7//v8AAP//AQABAP7/AgAAAAAAAgAAAAEAAAD+////AAD///////8BAP7/AQD+
+////AQD/////AQD//wAAAQAAAAAAAgAAAP7/AAAAAAEAAQAAAAEAAQACAAAA//8A
+AP//AAACAP//AAABAAIAAAD//wEAAQACAAAA/v8BAAAABAD///7/AwABAP3/AAAA
+AP7//v8BAAIAAAABAP/////+////AAD///7/AAD///3/AQD//wIAAAABAAEAAQD9
+/wMAAQADAAAAAAAAAP//AAABAAEA//8DAAAA/v8BAP/////+/wEAAQACAAAAAwAA
+AP///v8BAAIAAAD//wAA/v////3////8/wAAAAD//wEA//8AAP3//v8BAAAAAQAB
+AAAAAAD+/wIA/v///wEA/f8CAAEAAQAAAAAAAAABAP//AgAAAAAA/////wAAAgAB
+AP//AAD//wAAAAD//wEA//8BAP7///8CAAAAAAD///////////7/AQAAAAAA///+
+/wAAAAAAAP//AAD//wEAAAABAP//AQAAAPz/AAACAAAA/v8AAP//AAD//wAAAgAA
+AP/////8////AAABAP3/AQAAAAAA//8CAAAAAQD//wIAAgAAAP//AwAAAP//AQD/
+/wIA//8AAP//AQD+/wAA/v8BAAIAAgD//wEAAgABAAEAAQAAAAAAAQABAAEAAQAA
+AAMA//8CAAEAAgAAAP///v///wEAAgD//wAA///+//7///8AAAAA/v8AAAEAAQAA
+AAIAAAABAAAAAgAAAAEAAAD+/////////////v8CAP//AQD+/wEAAAD//wEAAAAB
+AAEABAD+/wIAAAAAAAEA//8BAAEAAAABAP//AAACAAEA//8BAP7/AwD//wAAAAD+
+/wAA/v8AAP//BAAFAAEA/f///wAAAAABAP//AAACAP/////+/wEAAgD//wEAAQAB
+AAEAAQAAAAAA/f8CAAEAAgAAAAAAAQABAAAA/f8CAAAAAAD//wAA//8DAP//AQAB
+AAAAAAABAAEA/v8AAP3///8BAAEA/v///wEAAQD//wAAAAACAAEAAwAAAP7///8D
+AAAABAD//wEAAQAAAAAAAQABAAEAAQADAP3/AAAAAAAA/v8AAP//AgACAAAA//8A
+AAIAAQD+/wAAAAD9/wAAAAAAAP////8AAAAAAAACAAQAAAABAAIAAQACAAEA///9
+/wEAAwABAP//AgD///////8BAP7/AAADAP7//v8AAAMAAAAAAAEA//8AAAAAAQD+
+/wIA/v8BAAEA///////////+/wAA//8CAP7/AAADAAIAAQABAP3/AAACAAAAAAD+
+//z/AAD/////AgD/////AQADAAEAAAD/////AAACAAEA/v8BAAAAAgABAP7/AQAB
+AP////8CAP//AQABAP7/AAAAAAIA/v/+/wAA/v8BAAAAAAD+/wEA//8AAAAA/v8A
+AAIAAAAAAAAAAgACAAEA/v8BAP3///8BAP3/AQAAAAEAAQABAAEAAwD+/wMAAgAB
+AAAAAAACAP7/AAD//wEAAAD//wIAAAD+/wEAAAABAAAAAQD+/wAAAAACAAEAAQD/
+/wEA//8AAP//AAAAAAEAAAAAAAAAAAABAP3//f8CAAAA//8AAAEA/v8AAAEAAAAA
+AAAAAQAAAAEAAAAAAP//AAAAAAMAAgAAAAMAAgAAAAIA//8AAP///////wAAAAD+
+//7/AAD//wAAAQABAAAAAgACAP7///8AAAEAAAD9/wEAAAD+/wIA//8DAAAA/v//
+//7/AAABAAAAAAAAAAAAAAACAP3/AgAAAP///v///wAAAQABAP//AAAAAP7/AQD+
+////AQD+//////8CAP//AQAAAAAAAQABAAEAAwD/////////////AQABAP7/AQAC
+AP//AQAAAAAAAQD//wMA//8DAAAAAAABAAIAAQD//wAA//8AAAIA//8AAP//AwAA
+AAAA///9/wAA/////wEA//8BAAEA///+/wMAAQABAAIAAwD//wAAAQADAP3/AQD/
+/wAAAQABAAEA/////wIAAQAAAAIA/v8CAAIAAAD//wEAAgD//wEA////////AAAC
+AP7/AQABAAEAAQAAAAIAAAACAAAAAAAAAAAAAgD//wIA//8AAP//AAD//wAAAAAB
+AAEA/v8BAAAAAQABAP7///8BAP7//v///wAAAQABAP//AgD+/wEAAQACAAEAAAAB
+AP7/AQADAAIAAAAAAAQAAAAAAP///v/+/wAA/v8CAAAAAQD//wAA/v8AAAEA//8B
+AP//AAAAAAIAAAAAAAEAAAD//wMAAwACAP3/AgAAAAIAAAD//wEAAgD//wAA///+
+////AAD+/wEAAQAAAAIAAQADAAIA/////wAAAAAAAAAA///+/wAAAQD/////AwAA
+AAEA/v/+/wEA/v8AAAEA/v8BAAEAAQAAAP//////////AQACAAAAAAAAAAEAAQAC
+AAEAAAABAP//AAADAAEAAAABAAAAAAABAP7///8AAAIAAgAAAP//AAABAP//AwAA
+AAEAAAAAAAEAAAABAP////8BAP//AAACAAAAAAABAP///////wAAAAD+//7/AQAA
+AAIA//8AAAAA/v8AAAEAAQADAP7/AQAAAP//AAABAAAAAwD9//7//////wIAAwAA
+AP7/AQACAP3/AgD//wEA/f8BAAAAAAAAAAAAAwD//wEABAABAAAA//8AAAIAAAAB
+AAEAAQAAAAIAAAD9/wIAAAD///7/AAAAAAIAAQACAAEAAgABAP//AQABAP//AAAB
+AAEAAwAAAP//AwAAAAAAAQD//wEA///+/wEA//8CAAEAAAABAAAAAgABAAIAAQD+
+/wEA//8AAAQA//8BAP3/AAD9/wEAAAABAAAA/v8CAAEAAgABAP//AQABAP//AgD/
+/wIAAAAAAAAA//8DAAEAAAABAAEAAQD///7//v8AAP/////+/wAABQD9////AQD9
+/wEAAQAAAAAA/f/+/wAAAQADAAAAAQAAAAAAAAD///7/AgABAAEA//8DAAAAAQAB
+AP7/AQACAAEA/v8BAAIAAQD+/wEA/f8CAAAAAQABAP3//v8DAAEAAwD+/wMAAAAA
+AAEAAAD+/////f//////AAD//wIAAAD+/wAA/v8CAAAAAQAAAAAAAgABAAEAAAD+
+////AQABAP7////+//7/AgAAAAAAAAD9/wEAAgACAAEAAwAAAAAAAQAAAP7/AAAB
+AP//AAD7/wIAAwADAP//AAABAAAAAQAAAAAAAQACAP////8AAAAAAQABAAEAAgD8
+/wIAAgAAAAEAAwABAAEA///+//7//f8DAP//AAABAAEAAAABAAEAAwABAAAAAAAA
+AAEA//8BAP7//v8AAP//AAAAAAEA/v///wAAAgD//wIAAAD//wAAAQADAAEAAQAA
+AP//AgABAAAAAAACAAIA//8EAP7////8//7/AAD//wAA//////////8BAP///v8B
+AP//AAACAAEAAQAAAAEAAAAAAAAA/v8AAAEA//8BAAEAAwAAAAEAAQD+/wEA/v8B
+AP///f/9/wIAAwAFAP////8AAP//AQAAAAMAAwD/////AQAAAAIAAQACAP3/AgD+
+/wEAAQD/////AAD//wEA///+//////8BAP///v//////AQACAP///v8AAAAAAwAB
+AP7/AAD+/wQA//8CAAAAAQABAP//AAABAP/////+/wAA/v8CAP/////+/wAA/v8A
+AP//AgAAAAAA//8BAAAAAAAAAP7/AgAAAAAAAAD8/wIAAQD//wIA//8BAAQAAAAC
+AAEAAgADAAIA/v//////AAAAAP7/AQABAAEA//8BAP//AAABAP//AQAAAAIA/v8A
+AP3/AQD//wEAAgABAAMAAQABAAAAAAABAP//AAABAP//AgD+/wEABAABAP//AAD/
+/wAAAAABAP7///8BAAAAAAD//wEAAwABAP7/AQACAP3///8AAAEAAgAAAAAA/v8B
+AAAAAAABAAAAAwACAAEAAQAAAP//AgABAAIAAQACAP//AAD+/wEAAAAAAAEAAQD+
+/wIAAQABAP//AQD+//7/AgAAAP3/AgD//wIA/v8AAP//AAAAAAAAAQAAAAIA/f8B
+AP//AQAAAP////8BAP//AgACAAAA//8AAP7/AAADAP//AAD//wEA/v///wAAAAAA
+AAEA/v8BAP3/AQABAAAAAgAAAAEAAAD+/wAAAAACAAAAAQAAAAIA//8AAP//AQD/
+/wAABAABAP//AAADAAEAAwACAAAAAgACAAAA/v///wEAAAABAAAAAQABAP//AQD9
+/wAAAgACAAAA/f8AAAAAAAABAAEAAgAAAAEAAAAAAP7//////wAA/f/+/wAA/v8A
+AAAAAgD9/wAA///+/wAAAAAAAP3/AQAAAAEAAQAAAAAAAQD///7/AAAAAAIA/v//
+/wAAAAAAAAIA/v8BAAAAAQAAAP//AQAAAAAAAQD9/wEAAQABAAAAAgACAAMA/v/+
+/wEAAQD//wAAAAD+/wAAAAD/////AAADAP7/AgAAAP3/AAAAAAAAAQD//wEAAAAD
+AAAAAgACAAIAAQAAAP//AAABAP///f8DAAIA//8BAP//AQAFAAEAAgAAAP//AAAB
+AAEAAwAAAAAAAAD//wAAAAAAAP//AQD//wAAAAADAAEA/v8AAP//AQABAAAA//8B
+AAEAAQAAAAAA/v8DAAAAAQD+/wAAAAD+/wIAAAABAAEA//8AAAAA//8AAAAAAAD+
+////BAABAAMA/P8CAAAAAAACAAEAAAABAAAA///9/wEAAAD8/wIAAwAAAAEA/v8C
+AAAA/////wAA/v8AAAAAAwD9/wEAAgACAAIAAQD//wIA/v/+//7///8BAAEA/v8A
+AP///f/9////AgD//wAAAAD+/wIAAAD9/wEAAAAAAAAAAgD//wAA/v8BAAAAAwAA
+AAQA//8BAAIAAgD+/////v8BAAUA/v///wEAAAABAP7/AQABAP///v///wEA//8A
+AP3/AAACAAAAAAD/////AwABAP7/AAABAAEAAQABAP//BAAAAAAAAgABAAEABQD/
+/wEAAAD//wAAAAD+/wAA/////wAAAAD//wIAAQABAAAAAgAAAP//AAAAAAEA////
+//z/AQACAP7/AgD//wEA//8AAAAAAAABAP///v///wIAAAAAAAEAAQAAAAAAAQD/
+//7/AAAAAAAAAQABAAIA//8CAAIAAQAAAP///v8AAP////8DAAAAAgD9/////v8B
+AP7/AQAAAAEAAAAAAP///v//////AQACAAAAAAACAP////8BAAAA/v8CAAEAAQAB
+AAAA///+////AQABAAEAAQD//wAA/v8AAAAA/v///wEAAQD//wAAAgD+////////
+//////8BAP///////wEAAgABAP//AQAAAAIAAgD//wEA/f/+/wIAAgAAAPz/AgAB
+AAAAAAAAAAAA/v8BAP//AAABAAAA/f8BAAAA//8BAP///v8AAAEAAgAAAAEAAAAB
+AP//AwACAAEA/f8CAP//AgACAAEAAAAAAAAA//8BAAAAAAD+/wAA//////7/AAD/
+/wEA/v8BAAAA//8BAAAAAgD+/wAAAQAAAAAA//8BAP//AQD///////8AAAEA/f//
+//7/AQAAAAAA/v///wMA/v8CAAAA+///////AgD//wAAAAAAAAEAAwABAP7/AAAB
+AAEAAAABAAIA//8CAP//AQAAAAAAAAD//wEAAQD//////f/+/wEA///9////AAD/
+/wEA////////AgAAAAEAAgABAAAAAQACAP//AQAAAP//AwD///7/AQAAAAAAAwAB
+AP7///8AAP7/AQD+/wAAAAD//wAA//8AAAEAAQD//wAAAQAAAAEAAQD//wEAAAAC
+AAEA/f/+/wIAAgABAP7/AAABAAAA///8/wAAAQD//wEAAAD+/wIA//8AAP///v8D
+AAEAAAD//wAAAAACAAAA//8BAP//AQABAAEA///+//7/AwD+////AQABAAAAAQD+
+/wIAAAAAAAEAAAAAAAEA//8BAAIA//8AAAEAAQAAAAEA///+////AQABAAEAAwD/
+//7//////wAAAAABAP//AQACAP////8CAAAA////////AQD//wAAAAD///7/////
+/wAAAQAAAAEA/////wEAAAD+/wIA/P8CAAMAAQABAAEAAAD//wEA//8CAP///v8B
+AAIA/////wIAAAD+/wAAAAABAAEA/v///wAAAQAAAAEA///+/wAAAAADAAEAAwAB
+AAEAAAD//wAA//8BAP7//////wAAAQAAAAAAAAACAAAAAQAAAP//AAD+////////
+/wEAAQAAAP//AAABAP7///8DAP//AAABAAIA//8AAP//AgABAAEAAAAAAAEAAAAC
+AP//AAACAAAAAQD+/wMA/v8AAAAA//8BAAIA////////AQACAAIA//8AAAEA/v8C
+AAAAAQABAAAAAAACAP//AAAAAAAAAAD//wEA/////wAA/v/+/wAAAAAAAAAAAQAA
+AAEAAQAAAAEAAgAAAP//AwD+//7/AAAAAP3/AAAAAAAAAgAAAAAAAQACAP///v8A
+AAAA/f8BAP7//////wAAAAAAAAEAAAACAAIAAAAAAAEA/v8BAAAA/v8AAAIAAQD9
+////AAABAP3////9/wEAAAABAAEAAAD+////AQAAAAEAAAD+/wIAAAABAAEAAQD9
+//7///8CAAMA//8BAAAA/f///wAA/P8AAP//AwACAAEA/f8BAP//AwABAP7//v8C
+AP7/AAD//wAA//8AAAAAAQAAAAEAAAABAAAA//8CAP//AAD+/wIA///9////AwD/
+/wIAAAABAAAAAAAAAAAAAgABAAIA/v8CAAEAAQD//wEAAgD+/wAAAgD///3/AQAA
+AP7//f/+/wEAAQACAAEA/v8CAAMAAQABAAAAAAAAAP//AAAAAPz/////////AQD/
+/wMAAgABAAMA/v8AAP//AQABAP3/AQD9/wEAAgACAAAA//8DAAAAAgABAAEA////
+/wAAAAAAAP3/AQD+/wEA/v8AAAAAAAAAAP///v8BAAIA//8AAAEAAwAAAAEAAAAC
+AAIA//8AAAAAAAABAP//AgAAAAEA//8AAP///v///wAAAAABAAAAAQD//wIA////
+/wAA/v///wEAAAADAAEAAAD+/////f8AAAAA//8AAP//AQABAAEAAgABAAAAAAD/
+/wEA/////wAAAgACAAIAAAD/////AAAAAP///v8CAAEA//8BAAIAAAAAAAEAAgAB
+AP////8AAAIAAAD+/wIAAAD+/wAA///+/wAA//////////8EAAIAAAAAAP3////+
+/wAA/v////7/AQD+/wAAAQABAAIAAQAAAAEA//8BAAAAAAD+/wEA//8AAP////8A
+AAIAAAAAAAAAAQD///////8AAAAA//8BAP////8BAP7///8BAAMAAAABAAIAAAAA
+AP7/AAD//wAAAwAAAAEAAwABAAEA//8AAAAA/v8AAAIA//8BAAIA///+/////P/+
+/wAAAAD9////AAADAP/////+/////P8BAP7/AAD//wEA/v8AAP//AgAAAAEAAAAB
+AAEAAAAAAP///v///wIAAQACAP////8BAAAAAQACAP////8AAP//AQACAAAAAAD+
+/wEAAgABAP7/AAABAP///v8CAP7///8BAP///v8AAAAA//8BAP//AAABAP/////+
+/wEAAwAAAAAA//8BAAAAAAD///7/AAD//////v8AAP7/AAD//wIAAQAAAAAAAQD/
+/wAAAQAAAP//AAABAP7//v/8/wEAAwD//wEA//8CAP//AAAAAAAAAQACAP//AAAB
+AAMAAAD//wAA/v8AAAAA/f8AAP///v8CAP3/AQABAP//AQAAAP//AAD+/wAA///+
+//z////+/wIAAAABAAEA///+/wAA//8CAAAAAQACAP7/AAD//wIAAQAAAP//AAAB
+AAEA//8AAAEA///+/wIA/////wAAAgD//wIABAD/////AQABAAEAAgD+/wAAAgD/
+/wAAAAAAAAEAAQAAAAEAAQD//wAA//8AAP7/AAACAAAA/v8CAAAA//8AAAEAAgAA
+AP7///8AAP3/AgD//wIAAAACAP//AQD+/wEAAAD+/wAAAgABAAAA/v8AAAEAAAD+
+////AwAAAP//AQD//wEAAgAAAP//AQAAAAAA///9/wEAAAD+/wAAAAD//wAAAgAA
+AAIAAgD9////AAACAAAAAQD/////AQD+//3/AAD//wEAAwD+/wAAAAD9/wIA////
+/wAAAAAAAP//AQABAP////8AAAEAAAAAAAAAAAABAP//AAABAP//AAD/////////
+/wEAAAD+////AgD9/wIA/f8BAAEA//8AAP//AAABAAAAAQAAAP7//f8DAP7///8A
+AAAA/v8AAAAA/////wEAAAD//wAAAQAAAAAAAgD/////AQD+/wEAAAABAP//AAD/
+/wAAAAAAAP///v/+/wAAAgD/////AAACAP7/AAAAAAAAAQACAAEAAgD9/wIAAAAA
+AP7//f8AAAEAAQABAAIAAAD/////AQD//wEAAwAAAP////8DAAEA/v/9/wAA//8A
+AAEAAQAAAAEAAgAAAP//AQD///z/AQD9/wEA/////wAAAQABAAEA//8BAAEA/v8A
+AAAAAAD//wMA/v8AAP7/AQD9/wAA//8CAAAAAAABAAAAAwD//wMA/v8BAP//AgD9
+//7///8CAAAAAQABAAAA/v///wEA//8AAAEA//8DAP//////////AAACAAEAAgAC
+AP//AQAEAP7/AQAAAP//AAAAAP//AQACAP//AgD+/////v8AAAIA//8AAAEA//8B
+AP//AAD//wAA//8AAP//AQD//wAAAAACAAAAAAD+//7///8AAP7//f8AAAAA/f8A
+AP///f8AAAMA/v/+////AwACAAEAAQACAP7/AwD//wAAAgAAAAEA/////wEAAQAC
+AP3/AAD//wAA//8BAAAAAAAAAP///v8AAAEA//8CAAEAAAABAP//AQD//wEA/v8A
+AAAAAQABAP7///8BAAEAAAD//wAA/v///wAA/f/9/wAA///9/wEAAgAAAP//AgAC
+AAAAAAD+/wEA//////7/AgD///7/AAABAAIA//8BAAEAAAAAAAEAAAAAAAIA//8A
+AAEA//8AAP//AAABAP//AQABAP///v8BAP//AQD//wAAAQD//wIAAAAAAP//AQD+
+/wEAAAAAAAAA/v8AAAEA//8CAP//AQD+//3/AgAAAAMAAAAAAAEAAAABAAAAAgAB
+AAAAAQABAAIAAQD+/wEAAwD+/wAAAQABAP///////wEA/v/+/wAAAgD///3/AAAC
+AP////8AAP//AwD/////AQABAAAA/v///wIA/v8BAAEA//8CAAIAAgD/////AAAB
+AP//AgACAP//AAAAAAEAAgABAP7/AAD//wAAAQACAAAAAQABAP7/AAAAAAEA//8B
+AAAAAQABAAIAAAAAAP7/AgAAAAEAAgABAAAAAQACAAEAAAACAAAABAD//wIA//8A
+AP//AAABAAEAAAACAAAAAgAAAAAAAAABAP7/AgD+//7/AwAAAP////8AAAAAAQAB
+AAAAAgABAAIAAAAAAAAAAQABAAEAAQD+/wAAAAD+/wAAAAACAAAA//8CAAAAAAAB
+AAIAAAABAAMAAQD//wAA/v8AAAAAAAAAAP//AQAAAAAA///+/wAAAAAAAP3/AgD/
+/wEA//8CAAAAAAD+/wEAAQAAAAEA/v///wAA//8CAAAAAgD//wUAAgAAAP7/AAD+
+/wAA//8BAP7/AQABAAIAAQABAP/////+/wAAAQAAAAAAAwAAAAEA//8BAP//////
+/wAA/v8BAAAAAAAAAP///f/9/wMAAQD+/wAAAgAAAP//AgAAAAEAAQADAP//AAD/
+////AAACAAAA///+/wEA/////wIAAAD/////AAD//wIAAQAAAP///f8AAP3/AAAA
+AAEAAAAAAP////8AAAEA/f///wMAAQABAP///v8DAP7///8BAAEAAgADAAAA/v8C
+AAEA//8AAAIAAAAAAAAAAAACAAIAAAAAAAAA/v8FAP7///8BAP//AAACAAEAAAD+
+//7/AAD///7/AQADAP///////wIAAgAAAP3/AAACAAAAAgAAAP7/AQD+/wAA/v8C
+AAAAAAAAAP/////+//7/AAABAAIAAAD+//7/AQAAAAAA//8AAAEAAQAAAP//////
+////AQD+////AQD//////v8DAAIA//////////////7/AAACAAAA/v8BAAAAAQAC
+AAAA/////wMA//8AAP//AgAAAAEA//8DAAEAAgD+/wAA///+/wIAAAAAAAEAAAD/
+////AQAAAAEAAQAAAP//AgD//wAAAQABAAAA/v8BAAAAAgABAAAA//8BAP///v8B
+AP7/AQABAAAA/v///wEAAAD//wIA/////wEA//8AAAMAAQACAAEAAAD+////AQAA
+AP7/AAD+///////+/wAAAgABAAEAAgD///3/AQACAP//AgD//wUA/f8DAP7//v8A
+AAMAAQD//wEAAAACAAAAAAD//wEA//8AAP//AQD//wAA//8AAAEAAAABAP////8B
+AP//AAD///////8CAAIA//8BAAIAAQABAP/////9/wMAAgACAP7//v8BAAAA////
+/wEAAAABAAEAAAD+/wAA//8AAAAAAQACAAEAAAABAAEAAAD+/wMAAgD+/wAAAQD/
+/wEA//8AAP///v8BAP7//f8CAP7//f///wAAAAD+/wMAAwD8//////8BAAIAAAD/
+/wAAAAD//wAA/f///wAAAAD+/wIAAAABAAIAAAAAAAIA/v///wAAAQACAP7/AAD/
+//7/AQABAP//AAABAAIAAQACAAEAAgD//wQAAQAAAAIAAAABAAIAAQABAAEA///+
+/wEAAQD/////AAAAAAMA//8CAP//AAD//wAAAAAAAP////8BAAAAAwACAP7////+
+//7/AQAAAAIA/f8BAP3//////wMAAgAAAAAA///+//7///8BAP7/AQABAP7///8A
+AAEA/v///wAA//8BAP///////wEA/v///wEAAAD//wAAAgABAAAA//8BAAEAAgAB
+AAIAAAABAAAAAAABAAAAAQAAAAAAAAABAP//AQAAAP7/AAD+/wEA/v//////AAD/
+////AAADAAIAAgACAAAAAQD9//////8BAAIAAQAAAP7/AwACAP//AQD9///////+
+//7/AgAAAAAAAQABAAEAAQAAAAMAAAABAAIA///8/wEAAQAAAP//AQD+/wEAAgAA
+AAIAAAACAP////8AAAIA/f/+/wAAAAABAP7/AQD+/wIA/v8AAP/////+//7//P8C
+AAEA//8AAP7//////wAAAAABAAIA//8DAAEA/v////3//v/+/wMA//8AAAAAAgAC
+AAMAAAD//wMA///9/wAAAQD///7/AAD//wEA//8BAAAA//8AAP//AQAAAAIAAgD/
+//////////7///8BAAAAAQABAAEA/v8BAAIAAQACAAEAAAABAAMA////////AQAD
+AP//////////AAABAAEAAQD///7///8AAAIAAAD+/wAAAQD//wEAAwABAP7/AQAA
+AAAA//8BAAQAAAABAAEAAgAAAP//AQD///7/AgAAAAAA/v///wEAAAD8/wIA/v8B
+AAAAAAD+/wAAAgADAAAAAwABAAAAAAABAP////8BAAAAAQAAAP//AQABAAEAAAAB
+AAEA/v/+/////f8CAP//AAAAAP////////7/AwD//wEAAgABAAAA//8CAAIA//8B
+AP3////+/wEA/v8CAAEA//8AAAAAAAD///////8CAAAA/v8AAP//AAD/////////
+/wEAAQAAAAAAAAD////////9/wEAAAD//wEAAAD8/wMAAgAAAAMA/v//////AQD9
+/wIAAAAAAAEAAAD+////AAD//wEAAQD9////AAABAP7//v8AAAEAAQD///////8C
+AAIA/v8CAAAA//8AAAEA//8AAAIAAAABAP7/AQAAAAAAAAACAAAAAQABAP3/AwAA
+AP///v///wAAAQAAAP//AAABAAIA//8CAAIAAQAAAAEAAQACAP7//v8AAAAAAAD+
+//7/AAAAAAAAAAABAP//AgABAP///v8BAP3///8AAAIA/f8CAP3//////wAAAAAC
+AAEA/v/+////AgACAP//AQD///7/AAAAAAIAAAABAAAA/////wEAAQAAAAAAAAD/
+/wIA//8AAAEAAAD/////AAAAAAAAAQABAAIA//8BAAAAAgACAAAAAAAAAP///v8B
+AAAAAQABAP7///8BAP7/AAACAP///////wAA/v///////f///wEA/v8BAAAAAAAB
+AP7/AQD///z//f8AAP//AQAAAP//AAD+////AwACAP//AAABAAEA/////wAAAAAB
+AAAA//8CAAEAAAAAAAAAAQD+/wEA/////wEAAQD+/wAA///+/wAAAAD///7/AQD/
+//3/AAABAP7/AQD+/////v////7/AQD+/wAAAwD//wAAAAACAAMA/v/+/wAA//8B
+AAEA//8CAAAAAwAAAAAAAQD//wAA//8BAP///v////////8AAAAA/////wMAAgAA
+AP///v///wIA/v/+////AQABAAEAAgACAP7/AwADAAAA//8AAP//AAAAAP7///8B
+AAEA//8AAAEAAAD///7///8BAAAAAgD//wAA/f8AAAEA//8BAP/////+/////v8A
+AAAAAAD//wIA//8BAAEA//8BAAEAAgD/////AAACAP//AAD/////AAAAAP//AAD/
+//////8AAAUAAgABAAEAAgACAAAA/f/+/wEAAAAAAAEAAAAAAP////8BAP7///8C
+AP7///8CAP///v/+////AAD//wEA/f8AAP////8AAP//AAD+////AAABAP///P8B
+AAAAAAD//wEAAAADAAAAAQD///7//v8BAAAA//8BAAIAAQAAAP//AAD8/wAAAAD+
+////AgAAAP///v8AAP////8CAAMAAQD+/wIAAQACAP7/AAAAAAEA//8BAP//AQD/
+//7/AQABAAAA///+/wEA///+////AQABAAEA//////7/AQAAAAEA/v8BAAAAAgAA
+AP///v8AAAAAAQD//wEA/v8AAP////8BAAAAAAACAP7///8BAAAAAAAAAP///f//
+/wAAAgAAAP3/AQD//wIA/////wEA///+/////v8EAAAA//8AAP////8AAAIAAQD+
+/wAA/f8BAP///v///wAAAQD+/wMAAQD+/wAA/v8CAAIAAAACAP///v8AAP///f/+
+/wAA//8AAAQAAgAAAAEA/v///////v///wEAAAABAP//AQAAAP//AAD+/wIA//8C
+AAAAAQACAAEAAAD9/wEAAAAAAAAAAAACAP3///////z/AAAAAP7/AQD//wEAAAAA
+AAEA/v///wAAAgD///7//v8BAP//AQAAAAIAAgD+/wAAAAABAAAA/v8AAAIA//8C
+AP//AAABAAEA//8CAAIAAQAAAP//AgD//wAA//8CAAEAAAD/////AAD//wAAAAD/
+////AgABAP////8DAAAA/v/9//7/////////BAABAAIA/v8AAP7/AAABAP7/AQAB
+AP//AAABAAAAAQACAAEAAAAAAAIAAAD///z///8CAAAAAAABAAIA//8AAAEA////
+/wAAAAD//wAA/v8AAAEAAAD+/wAA/////wAAAAAAAAIAAAABAAAAAAD+/wAA//8C
+AAIAAQAAAAAA/v8BAP///v8AAP//AAABAP//AQAAAAAAAgD///7/AAD//wAAAgAB
+AP7//v/9/////v8BAAEAAAABAP//AAD//wAAAAD//wEA/v///wEA//8AAAEA/v8B
+AAAAAAACAAIAAAD9////AAABAP///v8CAAEA/v///wAAAQD+/wIAAQD//wAAAAAD
+AAAA/v8CAP///////wAA//8AAAIA/v/+/wAA//8AAAAAAAAAAAAA/f/+/wAAAQAC
+AAAA/v/+/wEAAAACAP7/AQD//wAAAQAAAAAA//8AAAAA/v////7///8AAAIA/f8A
+AAEAAgADAP//AAD9/wEAAQD+/wAAAQADAAEAAAABAAIAAQAAAAAAAAD///7/AQAB
+AAEA/v8CAAAAAAD9/wEAAAABAP7/AgABAAMAAgAAAP7/AAAAAP//AAD//wIA//8B
+AP//AQD+/wAAAgD+/wMAAAD///3//////////v8AAAMAAAACAP//AQD//wAA//8A
+AP7/AAACAAAAAQABAAEA///+//7/AAAAAAAAAQD//wAA/////wEAAQACAAMAAAD/
+/wEA/v8AAP///////wEAAQD//wAAAAAAAAIAAAAAAAAA//8AAAMAAgD+////AQAA
+AP7/AQD9/////P8BAP//AAABAP7/AgABAAAA/v/+/wEAAAAAAP//AwAAAAAA//8A
+AP7/AQD//wMAAAAAAAIA/f/+/wIAAQD//wEAAQABAP3////+/wEAAAADAP7///8A
+AP7/AgAAAP///v8AAAEAAAD+//////8BAAQAAQD+/wAAAAAAAP7//f//////////
+/wEAAAAAAAAA/////wEAAwABAP///v8AAAIAAAAAAP////8BAP//AAACAP7/AAAA
+AAAAAAACAP3/AgAAAP//AAD/////AQD+/wAA/v8BAP//AAD//wAAAgD+//////8A
+AP3/AQABAAAAAQAAAAAAAAAAAAAA//8CAAIAAgABAAAAAQABAAAA//8AAAAA//8B
+AAEA////////AQABAAAAAwAAAP//AAD9/wEAAQABAAAAAwABAAEAAQAAAAEA//8A
+AAAAAgAAAAAAAQADAP//AQACAAEAAAACAAIA/v8AAAEAAAD//wEAAQD+/wIAAAAA
+AP3///8CAP7/AAAAAP7/AAACAAAA//8AAP//AAD/////AwD///3//P8AAP///f8B
+AP//AQADAAAA/////wEAAAD///7/AQD9////AAD/////AQAAAP//AgD///3///8B
+AAAA//8BAAIAAwACAP////8AAP3/AAAFAP///v8BAAAAAAD+/wMAAgABAP//AAD/
+/wAA/f/+//////8CAAEA//8AAP///v8CAAAAAAAAAP////8CAP7/AwD/////AQAC
+AP//AwD+/wAAAQAAAAEA/f8BAAEA//8BAAAAAAD//wAAAQAAAP7//v/9/wEAAAAA
+AAEA/v8AAAEAAAD//wIAAQAAAP//AQAAAAAABAABAP/////+/wIA/f8CAAAAAAD9
+/wAAAAABAP7/AgACAAEA///+/wAAAQD//wAAAQACAP////8AAAAAAQABAAEA//8A
+AAIAAAD/////AQAAAAIAAgAAAP//AAABAP//AAABAAEAAgD/////AAACAP//AQAA
+AP/////+////AQAAAAAAAAABAAEAAQAAAAAA/f///wEA/f8BAAIAAAABAAIA////
+/wAA/v8BAP///v/+///////+/wEAAQACAAEA//8BAP//AQADAP//AAD//wAAAAD9
+//7///8BAAAA//8AAAIA/////wEAAQD///7/AQAAAP7/AAD//wAAAAABAAAA//8A
+AP7/AAD+/wEAAwACAAEAAAD/////AQAAAAEAAQAAAP//AwADAAEA//8AAAIAAgD+
+/wAA/v/8/wAA//8BAAIA/v8CAAMA//8CAP7/AQAAAP7//f8BAP7//v8AAAMAAQAB
+AAEAAQADAP//AQAAAAIAAQD9/wAA/////wAAAwABAP3/AQAAAAEA/////wIAAQAB
+AP///////wEAAQABAAIAAAD+/wIAAAACAP//AAD//wIAAAADAAAAAQAAAAAAAQD/
+/wAA/////wEAAAABAAAA/f8AAAIA/v8AAAEA//8BAAAAAgABAP//AAAEAP//AAAC
+AP7/AQABAAAAAQAAAAEAAAABAAEAAAD//wAAAAABAAEAAQAAAAMAAQD//wAA/f8A
+AAAAAAD+/wEA//8AAAAAAgABAAEAAAD//wIA//8AAAIAAAAAAAAAAQD+/wAAAQD/
+/wMAAAAEAP///f////////8AAP//AAD+/wEAAQD//wEAAgAAAAIAAAABAAEAAAD/
+/wEA/v8AAP/////+/wEA/v8DAP7///8BAP7/AAAAAAAAAAD+/wAAAAABAAMA//8B
+AAAAAgABAAAAAAD///7/AQAAAP//AgABAAEAAAAAAAAAAQABAAIA///9/wEA////
+////AQACAAEAAAD//wMA/v///wEAAQD///7///8AAAEA/v8CAAAA////////AAAB
+AP//AQABAAIA///+//z//v/+//3/AQAAAAEABAAAAAAA//8BAAEAAgD8/wAAAAD/
+/wMAAAAAAAAAAgABAAEA/v///wAA//8BAAAAAQACAAEA/f///wEA/f8AAAMA////
+/wAA//8AAAAAAQAAAAEA///+//////8AAAAA/P8CAAIA//8AAP7///8AAP7//v8B
+AP3//v///wEAAQAAAAEAAAD//wIAAAABAAEAAQD+/wEAAQADAP//AAD9//////8B
+AP//AAD9/wAA//8AAP7/AgD//wIA/////wAAAAD+/wAAAQACAP///////wAA//8A
+AAAAAAAAAP7//v8BAAAA///+//7//v///wAAAgABAAAAAAAAAP//AAD+/wAA///9
+////AQAAAAAABAABAAAAAAD9////AAD//wEAAAAAAP7//f8AAAEAAgD//wAAAgAC
+AP//AQAAAP7///8AAAAAAgAAAAEA///9////AAACAP7/AAAAAAIAAAABAAAAAQAB
+AP///f///wEAAAABAAAAAQD//wAAAAAAAAAA/////wEAAAADAAAAAAD///////8B
+AAEAAAD//////////wIAAQD+/wEA//8AAAAA//8CAAMAAQABAAAAAgAAAAAA/v/+
+/wAAAQACAAAAAQABAAMA//////3///8AAP//AAAAAAEAAAAAAAAA/v///wAAAwAA
+AAEA//8AAP///////wEAAAD//wAAAAD//wAAAQACAP//AQABAAEA/f/+/wIAAAAB
+AP3/AQD/////AQAAAP7/AgAAAAIAAQACAAAA/v///wIAAQAAAP7////+/wEAAQD/
+/wEA//8AAP//AAACAP//AAAAAAAAAgACAP7/AwABAAEAAQD///7/AAACAAAA/v/9
+//z/AQD/////AwAAAAIAAQABAP////8EAAEA/////wIAAgAAAAMAAQD//wEAAQAA
+AP///////wEA//8BAP7//v8AAP//AQABAP//AAABAAAAAQAAAAAAAQABAP7/AQAB
+AAAAAQABAAAA////////AAABAAAA//8AAAEAAAAAAAEAAAADAAAAAgAAAAAAAwD/
+/wIA///+//7/AAACAAQAAAABAAEAAQD///7/AAABAAAAAAD+//3/AQAAAAAA////
+////AQD/////AQD//wEAAQAAAP7//f8AAAAA///+/wAAAQAAAP//AgABAAIAAQD/
+/wAAAwD///7/AAABAAEAAAD+/wEA/v8CAAEAAQAAAAEAAAAAAAAAAAAAAAIAAQD/
+////AAD//wAAAgABAAEAAgACAAAA/v/+//7/AAD//wAAAgAAAP////8BAAAA//8B
+AP///v///wAA//8BAAAAAgD+/wEA/v/+//7/AQD/////AQD///3//v8AAP//AQAB
+AAIAAQAAAP//AQAAAAMAAAD+/wAAAQABAP7///////3/AgAAAP//AAAAAAEAAQD/
+/wAAAgD/////AAAEAAAAAAAAAAAAAAD///z/AgABAAAAAgD///7/AwAAAAAAAQAA
+AAAAAwD9////AwD//wAAAQACAAAAAgD/////AQAAAAAA//8CAP7//v///wEA/f//
+/wAAAgD//wAAAQD//wEAAAAAAP//AQAAAAAAAgD+/wAA//8BAAEAAQABAAQAAQAB
+AAEAAQD+/wAAAAAAAAAAAAD//wMA//8BAAEAAQD//wAAAAD//wEA//8AAAAA/v/9
+/////v8AAP3//v///wEA/v/+/wIAAQD/////AAD//wIAAAD///3//v8CAAEA///9
+/wAAAgABAP//AAAAAP///////wAAAgAAAAAAAAD/////AAACAAEAAAADAP//AQAA
+AP7/AQAAAAEAAAADAAAAAQD///v///8BAP//AgACAAAAAQABAP//AgABAAIAAQD+
+/wAAAAAAAAAA///9/wEA/P8BAAAA//8AAP////8BAPr/AQAAAAAAAAACAP3/////
+/wEA//8CAAIA/////wEA//8BAAAA/////wEAAAD//wEA/v8AAAEAAQD//wMAAgAC
+AAIAAQAAAAEAAQD+/wEA//8CAAEAAQD9/wEA//8AAP7///8BAAEA/v8AAP//////
+////AAAAAP////8CAP//AgD//wEA/////wAA/v////7/AgAAAAEAAgD7/wAA/v8C
+AAEA/f8CAP3//////wAAAAABAAMAAAD//wEAAAD9/wEA///////////+/wAA////
+/wAAAQAAAAIA/v8CAAAA//8AAAEAAQD+////AAD//wEA//8CAAIAAgAAAP///f8B
+AP///v///wMA/v8BAP////8BAAEAAAD//wAA/v8BAAMAAgAAAAAA///+/wEA/f//
+/wEAAAAAAP//AAD9/wAAAgD///3/AgADAAEAAgAAAAIAAgADAAEAAAAAAAAA//8B
+AAAA/v8CAP///v8AAP//AQACAP//AQAAAP//AQD//wEAAAABAAAAAAD+//3/AgAB
+AAEAAAABAAAAAgAAAAAA/v8AAP3/AQAAAP//AAD+/wAAAAAAAP7/AQD//wEAAQAB
+AAAAAQD//////////wAAAAAAAP7///8CAP3/AQABAAIAAQD//wEAAAABAP//AAD+
+////AQD+/wEA//8BAP//AQABAAAAAQAAAP//AAD//////v8AAP///////wMAAgAA
+AAAA/v/9/wAAAQACAAAAAAABAAEA/v8BAP7/AgD//wEAAQAAAP////8BAP7///8A
+AAAAAgABAAIAAQD+/wAAAAD//wAAAQAAAAEAAQADAAAAAQD+////AwD+/wAAAwAB
+AP7////+////AQADAAAAAQD//wAA/v////z/AAAAAAEAAQACAAEAAQAAAAAAAAD/
+/wIAAwD+/wAA//////////8AAP7/AQAAAP//AQD//wIAAAD//wIAAQAAAAIA//8B
+AAEAAQABAP7/AAD//wAAAAACAAAAAAD+////AgD//wEA/f///wAA/v8BAAIAAAAA
+AAEA/v8CAP7/AAAAAAIAAQD//wAAAQABAAAAAAD+/wAA/P8AAAAA//8AAAEAAAAD
+AAAA//8AAP//AAAAAAIAAQD//wMA/f8BAAEAAAD//wAAAAAAAAAAAAD+/wMA////
+////AAABAAAAAAACAP//AAACAAAA//8BAAEAAQAAAP3/AAABAP//AAD/////AAD+
+/wAAAQD+////AAADAAEA/f8AAP//BAABAAEA/v//////AQAAAAEA/v8AAAEAAwAA
+AAIA/f8BAAEAAQABAAAA//8AAAAAAAABAAAAAwAAAAAAAQD9//3/AAD+////AAAB
+AAIAAQD+////AAABAAIA/v8CAAQA//8CAAEAAAD+/wEAAQACAAAAAQD/////AQAA
+AAEAAAABAAEAAAACAAIAAAAAAAIAAQD/////AwD//wMA////////AAABAAIAAQAA
+AAEA/v8BAP7/AAAAAAAAAAABAAEAAAD//wAA//////7/AQD//wAA/P/+//3/////
+/wMA//8BAP//AAD+/wEAAAD+////AAACAP///v8AAAIAAQACAAEA/v///wAAAwAC
+AP///v8AAAAAAQAAAAAAAAABAAIAAAABAAAAAQAAAP7///8BAP7//////wAAAQAD
+AAEAAQACAAAA//8CAAAAAAD+/wEAAAAAAAEAAAAEAAAAAAABAAAA//8CAAAAAwD/
+/wIAAAD+////AQD9/////////wAA//8AAAEAAAACAP//AQD//wAAAAD+////AgD/
+/wEA///+/wAA//8AAP7/AQD//wEAAgABAAIAAQD//wAA/v8AAP7////+////AAAD
+AAAA//8BAAAAAgAAAP//AwABAAIAAAABAP//AAAAAP7/AgD//wAA/v8BAAAA/v8B
+AP////8BAP//AgACAAEAAAD9/wAABAAAAAEA/v////3/AAABAP//AgD//wEABAAC
+AP3////+/wAAAQD//wAA///9/wEA/v/+/wEAAAAAAP///////wEAAAD/////AAD/
+/wEA////////AQD+////AgAAAAIAAQAAAAEAAAACAAAA//8AAP3//v8AAAAAAAD+
+//7/AgD//wIAAwABAAEAAQD+/wEAAAAAAP7////8/////v///wAAAAABAP///f8B
+AP//AQADAAAAAQACAAIAAAABAP7/AAD//////v8AAAAAAAAAAAAAAQABAAEAAQAA
+AAIAAgABAP//AQAAAP///f8BAAEAAAAAAAEAAAAAAAAA////////AgACAAAA//8C
+AP//AAABAP//////////AAACAP7////+//7///8AAAEAAAD+//7/AAD/////AAD+
+/wEA/v8AAAMA/////wAAAQABAAEAAgAAAAAA/////wEAAAAAAP//AQACAAEA//8B
+AAIAAQD//wAAAAAAAAEAAAD+/////f8AAAEAAAABAAEA/v/+/wEAAAABAP3/AgAB
+AP7/AgD//wEA//8BAP///v///wAA//////3/AQD+////AAAAAAIAAQACAAAAAAAA
+AP7/AQAAAP//AgD//wAAAQAAAAIA/f/+/wEA/////wAAAgADAAEAAQD//////f//
+////AgABAAAA//8BAP///v8BAAEAAAABAAMAAAD+//7/AgACAAAAAgAAAP////8C
+AP7/AAABAAEA//8AAP//AQAAAAAA/f8BAAAAAwD+////AgD//wAA//8CAAAAAQD/
+//3/AgABAP3/AgD/////AgABAP///////wAA///+/wAA/f8BAAIA//8EAAEAAQAA
+AAEAAAD+/wAA//8AAAEAAAADAAIAAwD//wAA//8CAAEAAwD+////AAAEAP////8A
+AP7/AgAAAP//AAD//////////wEAAgABAP///v///wIAAQAAAAMAAAD//wAAAgD+
+/wEAAQD//wMAAAAAAAAAAgD+//7/AAAAAP7//v///wAA//8DAP////8AAAAAAQD+
+//7/AAAAAAIAAQAAAAAAAAD//wAAAgD//wIAAQABAAAAAAADAAAAAAD+////AQAA
+AAEAAAABAP///v8CAP7/AQD/////AQD+/wEAAAD//wEAAgABAAAA/v8AAAAAAQAB
+AAIAAAD//wAAAgD//wEAAAD///7////9/wEAAAD//wAAAAADAAEAAAD+/wIAAQAB
+AAIA///+/wAAAgAAAP////8DAP////8DAAAAAgAAAAMAAQD+/wAA//////7/AQAC
+AP////8AAAAAAAACAP//AAADAAEA/v8AAAEA/////wMA/f8BAAAA/f///wEAAQAC
+AAAA///+/wEA/f8AAP///v8BAAIA//8AAAAAAQABAAAA/v8CAP7///8AAAEAAAD/
+/wIAAQAAAP/////9/wEA//8EAAAAAAADAAMAAAD///////8AAAEAAgD//wAAAAAA
+AAAAAQAAAAEAAQACAP//AQAAAP/////+/////v8AAP7/AQD//wEAAAABAP7/AQAD
+AP//AAACAAAAAQAAAAAAAQACAAEA//8AAP////8BAP////8CAP//AgD//wEAAgAC
+APz/AQAAAAEAAQAAAAEAAAABAP////8AAP7/AAAAAP7/AgD//wMAAQABAAEAAAAC
+AAIAAgABAAAAAAAAAP7///8BAAEA//8CAAQA//8AAAEAAAABAP7/AgD/////AQAA
+AAAAAAD//wIA/f8AAAAA//8AAAEA///9/wEAAAAAAAAAAgABAAEAAAABAP7/AwAA
+AAAAAQABAP/////+/wIAAAAAAP//AgD+/wIA//8BAAAAAQADAP7///8AAPz/AAD/
+/wAAAQD//wQAAAACAAAA/v8AAAEA//////3/AQABAAAAAAD+/wAA/v8AAAAA/v8C
+AP////8BAAAA/v8BAP//AAD+////AgAAAP//AQAAAAAAAAABAAEAAgAAAAEAAAD/
+/wEAAQD+////AQAAAAAAAQACAP7///8BAP////8AAP3/AgD+/wAA//8AAP7/AAAB
+AP//AAD//wAAAQAAAP//AgAAAAEAAQACAP////8DAP////8BAP7///8BAP7///8B
+AAAA//8BAAAAAAAAAP////8CAP/////+/wQAAQAAAAEAAAD//wEAAQAAAP////8A
+AP//AgACAP////8CAP7/AAACAP///v/+/wEAAAD+/wEA//8AAAAAAQD///////8B
+AP//AgAAAAAAAAABAAEAAQAAAAQA/v8CAAAAAgABAAAA/////wEAAAAAAAIAAAAB
+AAEA/P////////8BAAAA/////wEA/v8DAAEAAAABAP7/AgAAAP3///8BAP//AAAA
+AAAAAgAAAP7///8AAAAAAAAAAAEAAAD//wEA//8AAAIA/f8FAAEAAQACAAAA///9
+/wMAAAAAAAAA/f8EAAAAAQABAAAAAAD/////AQAAAAEAAAADAP//AQAAAP7/AgAA
+AAAA///9/wAA///9//7//////wAA/////wEAAAACAAIAAAAAAP//AQD+////AAAB
+AP//AQAAAAEAAAD9/wEA///9//z///////7//f8AAAAAAQD9/wIAAQAAAP//AAD+
+/wEAAQD+////AQD9/wEAAAAAAAEA/f///wAAAQD//wAA/v8BAP7/AAD//wEAAAAA
+AAAA/v8AAAEAAAAAAAIA/v8BAAEA//8AAAAAAgACAAAAAAAAAAAAAAABAAAAAAD/
+/wIAAQACAAEAAQABAP7//f8BAAAAAAACAP//AAD//wEAAQD//wEA/////wMAAAD/
+/wAAAAABAAAAAAAAAAAAAQABAAEAAQABAAMAAgAAAP///////wEAAAD//wEAAQAC
+AAEA//8CAP//AQD//wAA/v8BAAMA/////wMA//8AAP7/AAD//wAA/v8AAAEA//8A
+AAEAAgAAAP////8DAAEAAgAAAAAAAgD/////BAAAAP7/AAAAAAMAAAD+/wAAAQAC
+AAEA//////7/AQAAAAEA//8AAAAAAQD+/wMAAgACAP///v8AAAAA/v8BAP//AgAB
+AP////8AAAAAAwD9/wAA/v8AAP//AAACAP7///8BAAMAAAD//wEA//8AAP7/AQD+
+////AAAAAAEA//8AAP//AAABAAAA///+/wAAAQAAAAIA/f8AAP////////////8B
+AAIAAwABAAAAAgAAAAIAAQAAAP7/AAABAP7//v8CAP3///8BAP///v8BAAAAAQD/
+/wAA//8AAP//AwAAAAEAAAABAP//AAAAAAAAAgD//wEAAQABAP////8BAP///v//
+////AAAAAAIAAQABAAEA/f8AAAIAAAD//wAA//8BAAEAAAACAAAA///+/wEAAAAC
+AP//AAAEAAMA//8BAAEAAAAAAP///////wIAndKFMXeYpEb6aSBcY9flFF/SVign
+jfondFBbdh5e2qk=
+-----END PRIVATE KEY-----
diff --git a/certs/frodokem/frodokem1344-req.der b/certs/frodokem/frodokem1344-req.der
new file mode 100644
index 0000000000000000000000000000000000000000..ca13fc039656aef9402d6ee2a290a3aa92edaa83
GIT binary patch
literal 21749
zcmV)1K+V4}f>iM^f>f3Q0RS*+F$*vW1_M<D1``5RQ!x-Q4h92N1PBZVO>b^=VQyhD
z5HJn~162eE3<pAQdSz{4ZZQxr4h92N1PTlXcW-QFQ&UVa4KND^162eI3<OkVb96Bl
zFcby@RRjYJ4MuWrWN%AFO)W7qG&C@RR3R`51_&sDjBx@22Lc0vR1pAOP_OB3O1AI6
zEU%<mqip_o_DtHmbmmMu3GP6NoO)n?@Kl{!E6)r+gOH4^M0ar)aGmN!{EDQ`dN#b-
zgn;s!rd-u~;H;(+BeL<F1r$1t`x^jn<q`bS9>y&Q%h4bp*3^!q`9dy@WN;!|gXKGq
zK?^uuCLJQ|iT*m3V9#MgdkI5tK;xE_>LA@CkZ&=vT6JPi1>mt%tDqok0vzdr2`?W?
zWKDy7wEXb+!B+vd!pUX&`TIstw@Tr?jy<I}M+|VpqJ~I(>tuz%|4r(75&%*sE`|Cv
zAUG<V`BQey#X48(rfZc68yQz~vm!H>eT|mTXaS!V#BQ;v`@0&K7(jHAFZpkx73d|2
zO~=Hgs|}*t-a#v%fSb)Qf#7|2qf#V=VHS+w8b(=~I0kqFY}xpSS-~XNM1j;J<#o;D
zn0q0N5Ghg~d>%}Bo~@y4E|0lbJ}a9DVyR>vmUL`15+7pS=BWgdB!?myTG5rXmhRJ(
zm_n^?hY9-tGORG56~i$V4zk*u<mIIHBKcO^ZsyHF)=!Y2r}K6h@eO=@U=bq0(Qa*2
zUmjOMsStt!6;Wn@5vZs9%q6R2XB9y45^ztRld?RUFBbC<s+1m|E>a!4ptaRD0eK#l
zr$-|N#I+cfi^D}T)Os{pr-nIvz}R3L-IV_g&!~?|p>)*Q%8Rcuab<JrgSYPGri@t&
zJEhVQ1Ll?5n;{TQ#mq$L)j`=zgsS)D9C7BEEd{nx&A3U{QLz`HdFx83?5785V2A39
z{jkS51v4EBt9Q^}e6(JdNY^BJcqgM;fMUA4kU=P!u+i6<H10CLa<u8Yj&!=A?rui0
zVF*&&7ARK2Gf_s7lKX(EGI+nW2*|&r>T(_d6kC9ielHDO&%N4khUXXh>MF*blZF~P
z<6$J45zDx}nHv>#dQ1&_5g%P!&eLDQF3*3^^M6puCZjTixfB2I8CH=8r$aKdsjFBn
zP3oHAk7aaf0~@(~asn+*aOa*}V+~&bJro`siiG|u-L!>@Jr?#<QW+JIohR##;nW~m
zxBT}WLZ0Vqw8+nuw`XKP1n`s+a?TB}c5Vrm+2da{rqNge6JBx3TuVNP4Rpl<`@!J_
zj;iz^`x5ovcQdR_T4E+(St(TDlRztalFYlR7b|jIEm9FnZTjPLgu8hc{{o6BHc%k}
zkUCY=pj4$Mo8@UVACPH_fq>Z&8sw9OR~;c!O|59smY>d+6ds7#iL>BrTu4A$xKp}1
zD3P_qI^jScie;m?)&uRjtT^*y7a9G&EzZ4zRLM$;AX=slg2V>gXw`(MM0qF(L-!4k
z^(^qBo)6xXE9k~-^QIbtxe`r;;1#yStGX;Jtl_{Hb~;FooobU2+bFGxX~6{J&M5g2
zn+!rO5Ln$ZQf4?al?KhYfOkx))XR}?s*esFBJdzhXhd1BR0_D*cP`2yj_P*+rjzLy
zz-(=W<K6Su$i-2c$Ya<%7IFr(iQ02_)%-afp?w@=uMj5AVtc<k(YfmHuM*yn;E_<y
z;A+9|45e;j=;^~%$gqM{&L%}n>pZ2{ZQ$Wf<RU1q4XiY&>F&k;MjBjy<KkW(3*JWa
z&1tx(Wv)R8S>c@q#adU6w2ft6So-Pi%i%1%*f`ne=(C8Qx)geyJkhu%!o8zSfP+h|
zwxgyf**Ewf2QcaPK*6`m2-6m6%gb@1>ZD3Fap<WELe=q9DGZ7gOe7Qv!K#=Tqpx2T
zvd;v4Ib0M=(RfDDA~hIx_vSBEYmRbWjyhDMa21^@%8Kth?lSl8cbebCdcrdgUF7bf
z&A_BY9Q_NU(uxu7yeT*8bh0V_T@tTH-mHHyBKS5e2Ky9qNs5&S>JMTTvrBkPhi-IC
zlJ#Mq7@M9X^YI8c?_k;hOsvzd7MF#Dzmeinm-w_4mWMmhiu+zoH>S$qO3D?_uBB?j
zGQdmk$j0<3DX1QY$W#@s`9pWsSQYap;SLv!|2g@EQ3qZ3)D8SFhDvOPs_Ea=WVbIO
zIH`alA)u!;SDnHqHBp3h9mEoZkL~5nYmg)t>Pa*-xR&r=Q)3<_rDm8B^IHl_@>;MF
zV7K(3#^?3_dP?ks6Z{hl*<Jih8{=LtR9U2M01!UcxXLw=?xLz?J6Arg^bj16K>(P4
z;uLRI((iq6VC;m!<U$~ls3c)*%l@F5bnHd~(&hcG`jmx#oB)<}>PHjIf<=kqKPgT(
zn|#Aic9!H?moEtCr*eZzK!%)C8lI3GWe(sXDIhzSjhM+<U9wK38YGi<@uqSP&&Q3J
z+bovZy*}bhs5)xWsPYcd>9EgT#Ws&p^g1PfY=8vcyJvG0t2adJDNg^u1ft-F1TCKc
zI8%hFn_!ktVY5J22^<OmQl(8`&Ik@|&)=SK2Hi)bFln;5K<mr9T*upA8eD+~B7$>O
z?$T!R4>`f~%Gdm1GM?|6RQMaBIgLpxUu|-Cj~qZl-KXx3F^)@)c%=b>6k}inxYO0+
z<Yen6x-11Lsi6Jzb#CB59-oapp``G~^*>)b>#q8PxA|j%Rsqp`V#*I6+4eXXRH>J6
z?Sg*s#!d6l44)d@d5hGY6sooJKsp|O?M2D3#RLHI*87M-wBI{i?;V`Op)jNPFMGCL
z%Q*GGi-nw+MbEIC<>3Ejo&mpg-OS8)SfekYU1^!cSEKt<Cc?KyTgoLW-$Y4cDh>#3
z7r%HNz({xEpQ>j29h8ug45plE?orDqw9Vu^*vng<KE{TsYHQd36ljY@15H;djvW(#
z+<J%SGOp{(-a2q!P0)<1>W#%vYCj!%&9SZ6tFy(yKt{gcA48z;UXJMeoLs6n+h<8i
zCDo7mfJsqYCTe;g|M1R2r(OkYCbsM+>1_*|y%|J_q%jQijFGrJ2)fuB!uGE>a9Q0f
z7ozCOLV$`M3fH&fRS~1;Ux+_{i>ilq45t|;5M^L}{)zAp79c`K^7nnqcUBNB|8a{S
z1zaC;6;*zxD??(R0L$uEm=XN);AAkL9R)V#gJDKVzmlXCXV6QSxAHNk$!pDgj|r2p
z)^`SfQ|tA8bJyI<uqPMfCwq8GsdguJHOH>PLsf7*x(mvvk2K;2^vJ>F5Pn6W3YgbT
z87amjqhN-O*EhHIEC%reh7{tLGhVXP!q+R$AnHV5FjRSyc0Tl1k{}~az|c7RRL)^g
z0y45i$1iUV?dSXp-9!DH?JP}woZ>p3alKqLN@KUkSz~I11A|Iib;Or=F;*tULLKtJ
z2%s>AaV-G)m>TFN=JHFW`|`y_2S=1fiG$2hF)a%YA=@QuSK3odLoJ$+Y04Kpipqp$
z_}U}bg<HFu@VXkWt>&h9T+t{Yv%G<!z_8J<XL4}{rbW4rW~Y4q{;J|vuyrWK+7O9l
zo#$$}<0cso&$I16Ywuhx*^!_jn-zp0cfDFr_c|?Oz-{<R!i9gVxwPpW!t*;SGwayY
zLz%rwKwm9ksZ?xZvRWrSDUeg?xAP@u+NzID_4G_@zNX-!wLz_#GYMFtzwE`gRX&Zm
z$1-{xn#_1vrJKZ@Yr9Ugk!G`-nUc`L)~`(~vs#C#6^15ru}TC-Mpjjtz#2He9w&F5
zKn^p+2mB!@oc|k#e9^SWQ9ZcO=otVS|K@~|q8P;JqNz1td0o6dmpmECo@lcXH3B;W
zcuA-RN6KCDGPdj#@{7U1-^mSfV9X0~!G@Fy7k4~Uo#=vhkF}lsUH%r=qEEQjx;sP_
zdEF;2{IxJI<*hpcURLdZ8Cb*qX9*Nxt{D`eAigI3>!;v4(+9&x&@sHMKzw}b4!(t8
zTv_+5QC&(acAZB+171@wv*G9;PYS<MqM}W*FOwSgzA>U0<m1^Tb0H1JJjHjk^EY*k
zT9=P45|zSpm(h01<wOyCqlBY0V}+!`7|iw88GrLMRJ~$!gzZQ2x#g(6)8hB^#K!)+
zeqBm{8VzaWu(B<A1)52G9<%=3@Vs8{zBSOT3E?TO><d_-G=)^?KuTWuTwx39TNW}b
z91id3%=gZ51@~J!!*JP=<dHM(7(b<AOe{Mt60dmDp@_E?G@Zz#5go!B>Lo<s+KwMA
zi&PFE1flkwHXsnfT2S5zAjl32lr`(gbczH<a!J075Mzs^$b0q83?@!?u0GuC$2NVD
zfQ-K}wol_6h??=*OW(5BPC@!RD=z^N)t4G(M+#dY1awBKf6Y8Z7y{NbwWyb|*6<p3
zXW2913HL3FaB^nNyw9Pl5V9=5O!TzH_}%yyWHzwm`WEJu&U%J#0d;XusP0>P7+ya9
zi}MNU%VT)l0J$d)7cH!-i*uY7-icFlQe19D`htYmq_0i<9<3IPRPP#*7;_Mjg!}{_
zX8@R;!zLGwQr+<h%m#TFswqEU9tVPv%=5W()Cps_H^>q{$G+RZC2Iw8>UcBET0#P_
zKp0eVY(7Loud1%fn0&15)<h-msv{F}FzKtM8*?QZPPN(e7CR>B_^?FBrPi}tHI^l{
z87YxBj#A$J-gI{?hVr{X^;&-vt_L9jL-F8srNO9@J1AIz;sZkdfAOC{!metm9<@QA
zh#M{Y5q9V&&=Dl}B@te4otkF7Js;Lokx{WoQyQXJ4?chI!2ixHfVA1uyg5iWOf8Ui
zp$D=SV{$gn6{}N=0_*2X#Dlwoaw<BH9}HhyDDF$DKV#^C=s=hCF%iUTDk_wtc8<^_
zot-K~zGurk_tNJ8`;~g_R6SSb%b%qF9rb7!7A%|B74f7Bz>4Na0Z8|_mi%M9XplLQ
zwj?n0kLDt8Dx*khqD$NVQWE8^?-XnTd9)&aavqOC=%7S?IywHmSLhG7$_q_xpydX|
zRDsx#3*Bzcpt=2T7XUli$1V@ZKQ5EV)uQk=nqAA1=Q_yaBiK7-wXym%mi*RRj@`A*
zEQomJgEfYpn^<wakg`1lH_AiA;xEoLTuwK7l66@CJAZ}<#Ua#-@r@sDSyy7&7Rdg~
zZI%BPG~c-u9x*lwQsc8!0&cp3RS^g{HD}piv=k*nZxOTx+rP$6*JGu^u&c-Eq8Kbh
zKv%J(M*UhzY1$sjSdh)WtSs`>c2yeEFJmNpQG86j`p$zHvs;!*Iq`l6ABx^l`7)2H
z)l_+qF7xPxV@GQe^YBV&ngPF+@=A^qR62H^Wdln5WEHUh<iDCF8$W1vaSv)Onhv0*
z0?w3pBNmbJ@;^TtPk1?rp9DZ@C6QU$ce9>qYj=(Jrq<NJz`lRMsA0=Vm+@Ac^!Q^!
zeLC-U6d<y{KwCCkqfK-H=RC_EqEeUWCT7WSCL|$-_6zQWz^nNZpG!i+f=5n8rQVYH
zOo7(Of6?O2B|dc>vaX)-fS&Im;8NRk%U}>fd8Vnn(z$hQbJLDhb&0jVNjdu-=0%5N
zk7QbWCm-RT5oP{vd11W*uwkC`L8HMnskxMU#ub{Ro*XE106{c~U*c#PLyTT_6%oYa
zmHO~}C3T#Z@sBeK`8?WnVf;9{Ixz5YcN8pC#|mwYq0sBn@LJ{cwUvf8ei|+JBzNm-
z$BL#%KFNP!_Z@7F@^X5G+`q;iQ?zjn&;?)5M>`+Y+7}PHWL^bR?GhoNwiA#Z$IAMw
zb8*SrHj4iNrZuw589`J$HNA~&pzWC#U$zdz@mdi;zA&StjXwBLF*DEdHDmaYU!LaH
zEroajn}F-6D4sQojLFa5GgP0)@}i8gK7Yf-y0@815&DP=%d!{p-Y27N`9Hq5e=Tc5
zC%)i(L+G@t3Khi!qlwVz8gs+|+d=9$f34w#BjT7ETPz@`S7{>;wq_o9_N}G=jv~mN
zvtkjU&%hzm#*1rTfdWj@Fl1~}iMKsg(1-7fX(P25wcSlaX_2W&7;I&tE&SMNLpQ*y
zNP4;%N;DxMKzHoqJ4H5YIJrc1fUDAseuMms&>tc%Dq5xow%Br@Q3y(43pa%_H90jy
znDF;dSdQ0Qf_{$M4go!jbj_aotbH(7%~e9Zo*;C*6S<2}(r3xy6$TG2G9S6BIzmL?
zb4(MyWzu3?RU?%=n?4yv_Qbox{)To7)TrJA<OQIIukGU6p--I&x6FVlre#7u0hRum
zT|#?#l}CBlfa0%b+M*cq(*jN!`4RvI^Ct4CtRDw$A@w3+JwAd04@WoTuE}##PU6&F
zNy`xp2DLW`k9(gm-8{E`h?u0Y9fcF5zF1WlQ{53Feh&gJ>!?Kw2e8E?WXBVh^*P*Y
z<C@n-QA4o-k{)o~P1!GD8N|OAE|lh~Gp2QEqbqMKmd~zO6KZR<Ye{!a>(93CPF^q9
zR0{`g!o@izulJGfG_nA|hgVVbVX6r{cLR{=s6?Gs)nW@gBiVWT(SKpwG;kNd-!ja}
z-H2^3D;u55F`c)$L%Ad{Ltp4Go^AgJciHmTuxtbMR(Wlp3q(`zu9nz;LUhgJP-3ZA
zl!VZJ!nye+2i_Ka47Xbsl0jwr%^m@#0*F;!K_HGI=-9d`?T&r~lQS%*Nf#r96`-tV
zdqMfz7ne%~48SDWbrkunVy0|FdNM+aym;fQe^U_0&d(gO!I|qIGoO3|r916{!ZSho
z5G!rIK7LcT%QbK|!QO)Tmx19X&uUp{dfBxBiVdSW&_Xt06j^b{s@fb^dmrRjWc(%H
z#Y~28{j}s0?oh<4n&K#<n^;rvuAg>g;&VWX3w-WvBycw}RP~+a*_3iLVw^iOMZSJ9
z&xDf%d)(n-XVHl?)ZKfwjr?09)bYt?qSuKDh}S{ir`LNXa`-1smPY`O*)l=Yt*L=4
zx=v?A5(?M)Qk$5*3eF;1GX<iY=&V2%^sunF#Sdol!O!djVW3qvb^b>i<J^W(xlmyc
z?z4*6N5U|^5t}H_PY4FI)j8}?RXJ;R${(FlsQktwY%vOvktkJ2k)xb8^Mr(LgQkC9
zM2$L~kh*WHMMx4U45jQ#1)P44@#?LJZ#yV5PZJ4B`YZz-<Q~s6-W_~3G+O+?)_Aw?
za!n`2n0GM<NG1gtCRsvC)2)DX1;)3BYlPzfsgG>G$Tq%S2}}vVW+nS_oOoVU^Q+0*
z-gi?(o&V-ih^oI72T6NkoK-m(lG01=u8Fgy5d(L^+Yt9^Nk|2Yd>draz6aS{aZm=V
zg(Id6O955ky*{t1ycb!*<9UO3u^*KE6PNyqKmF}jxh=t@7^HpF;5tO=vdKb6thmp#
zQuF`lL^xwr@<aCdQVlopVe?aKOGTIwuw1V%+c6&zah<qBlcH>kGPR;-6fYuHCi{a6
zGxS^^eGl*RAi?+`k|zV-yy`BQiv=M7Pe^lMOrMRyvuSB9fHQ6~uRgSTc;`uHD5?8b
zBM?F^zI#okR1MZmIq^1Igb-s;Q4c^+2;arQ`?AV;eHpjjGn?^qSgS@yB(=NOjcY&2
zKS7X_;4D?H#$Hsb7OCE{XoFfOva#23x+f{gLN;;mp|*kfgA$AOK4UP}D8pq1Ukc69
zTO>{klzpi~W!19H!)&?_zczbQ??|!_A*vj<VV`7zaH|oUKQpk)Xv_DRJ!tiSr6Ck`
zX#5q3=zIr5=PxD?u^eaAq)SWs0fyG_zJ0v<X#yR!?2LsM0O|21Bte#Wzcf6gCoqX{
zrL$a_Wf55bl-0Vnqc!Rs{73BzPvr6qIQV4_wIr;7S)mQboc;<R1_4FY$gpF*>`L;v
zysL04v>fcriY^2Q_1S*FW5F7V>&2)(nN+H$hRK=Ox*w&rk8JbV^?Bu$hijJUC9C|}
ziouE-vZW@9oiFSIa__M@8Gk=a(CoK(xyIU8v!z%jmbliLZ!gZEqW((o{pq}1>6K6S
z-{6@6=@4|Q?n_((;V{aWq<dDIY6Z|Cin!Wd{}iJDY<as|BPGiGGw_Fe>8IY;;3+)F
z7G1+6!EmFbE5t(4iba}}j{6o+1noS$1u363QpB9YPHCHYN$wtFbmS<^kr<LkxPh0p
z5KeTDC-WU%3SX(){IM<6sK)(UZzYXh!KDu?=xD<wR6GFa{hs-P{vq7&W+0<-!-}sf
z#|323c*nzaH~$$Ke27Eq4^+9M)m;k~0In`rc^lJ}jYOFW?q6%bpT3ig;oFE@;LMt+
z{zMuE0GaS;RY3fI7)@dya>JtwDmYjZ%in~H=g2F?drx#~#drHhJ1tfD)_qt!F6kCi
zu3s$`p8Fmv70To;vM{gu`nV$c^u8>TSFsi$PEj}gxWgy5Ki4=f;WWeWR1=-8jQXEa
zOa>1jZwM!s2-3+qZXL$2#DsFVP1i<wq;yeib3_!65(P&*OPcs8S<^HzoD!LK_R|T+
z<waqLl0?M&)XCW+#S@W^o!@v~|KA`WfiI+k$BV+Hgn{@Oj@Jp6KkdQjp*czXlIF0L
zB{nng!ZA5el8n~Eynkp*R*;Vf4p=jxu47ve2r$eDGy?CYXNX&fmQ|Yty?O@91~3Wj
zpV9W!T$FzeHkq;ss$~RP;7sK1eCVR_GdzAiinG4d%6#txMjgexqm^>#SDVrykh}oE
z?FS`|?7{z9*1bR9_Ajhm)$9sC1+sad4S0Y0G44P&!Hu3ywaFZ{koZSZJkywRejcp>
z=83b3a3>%Y#vrK6;<PYrz#DY4O!URpf3+39DJK|=a--)w%p5VG@<Pt<%wF5ed`4se
zZlczSEz;NSJ(*gz=Y?Vvc*=M`!pfqCVX-<?#kx^88-Sn21KoAUkivL~MO%>BZHXlm
zf+kjLC|yuU!T%@kg~QA_??r~Q&UCMBY4Op}V#kx=Dq=SK-LbG3T+Io|(=n!Z{g!--
zmE0gyQ{-IDRZu{PVQJ0*R}A=BM3<M|gyPr9j1U^`b`f=i=#9ouwcO&zLBxezDF!IN
zlupAJ8>8-3tR$IVfy*nRP4UG1`fa7XvstT>qQdu<&F2tA%Ow%7)WVcih<AZjTS0%S
z^wo9cHo>;@bRxbYhX_|Y&KX1zv8=rvB1G@cok<?KTAEN-!!Czv0qng(CCu<g;YiSI
zl&bZYI{?DEa`rNz50E04I7W%29=m?(^3}tepE~^fz}JvV7nqd`P%k4eV4Si{;HMff
zV8c(1-{~#weEA#lr8Gfz#v`RT3S596h6F>8h*CoPhV#2+wXwfzbDPO`w$nuhi3-oP
zL^a-Bp``{`t$4zNisyB)TKS*W-_NxKqvaGC-dLd7xKokW{fnvHLirC)$sBHx7T|&E
zemmK6b0qk=p)xE|Kz&YGD_SC$YLAF$sMv2xh!s<y-=D79nO=0~b8%n)L)ILr<0bFs
ztSD(9R~Bvw-y_zAORx!0wAX`^+@?1yI9^G>j&#YyqSWkG0{|?$5Zyvc7N3`hOr~T1
zlso&MWti@i<8PyD8xkzRP0$(h975`WExItqJ9JyxzBAtV<RTg*LDh8!_+9|M_&!(!
z<qbe4T|zINStb%ASAT9zAVGPT-dPdO`TuX)>C2$Oblf3)D0jDcpMQt=VO}5;c}(;R
zcw5E=Q?ogBeD(G-GG)Z|#8snDrXn#1Z^Cr;Q*2g#bVl@kp483@<L7c7?dFI1t*WJ6
ze69cq#1NfMK`{jc>2)G;S(&2D;~Rui?a|W?7`SZG{F95SfiT%jcu0pQ?J8|c{T3=g
zcm+u!Hze=UzGDpoLT%i7bhpH6x1O^{Fb01KG*)WZKkF;mVY;NNoqXH~v>-Wv&@cMl
zOAG~;*w4JDX}n<bC|rd{l2ZfDfgT`Jif*%&0^iGIET3+#Iiw(Pn}o$rPk5CFp|mpA
zm-#&FZ<D~RBgWc*6jblLw{KL>b4!e*96*>NaYH@VdioN@wNIoBwF@3axi*pzivKM-
zt=WCbDVB00+^8v~DGEf=i0`0_?{=>REY12+mtO_tIKU1mdrms>TIY#?f_oMU{@|~O
zh)#dxtU^zuW)nyJ!+ML)6OxpA)4p?idD)dQhMlv?urCa7q>kiPBGHuJX`ZmVP$5B7
zF%yI+4IhplMw+NDxI~epkr`S)8*4Quu8-B<q%q;A$s&hKuSA_ih#l!qkk{$0S0&>w
zh$@&xWX$rkr7EIRQV4+?yT3-X+*lh&%y&Rd)-3NXYG~B?@yGldmdFa%g~&tee1vpN
zXHNhOor#`%WF<RG>`kkjUqd%$wEB^v*Bb)#zl|N%=YT)=s_8kMo*DE3gNsyE27glz
z+MXdIrmi4s+M15&q`y^GjHb2@_OiKz1h(_wq}6QxKRDcvB$pLVKvWN;w-CB;zU956
z676$oNdhKXa*@S3m%F=>c8w#p4^LkmB_Ic`<rpB{KvLC}euv8IGeEk7_Os4X#i$@}
z*-`ghBPqHaEijuAZ3@soDn9{<Y8wuV*n5WR4}-CONMTg~dq(K(6UECA@w;*DDz%3w
zPK&t<<w;tvu%cN3JCs4&hlmg~Hh6+D5D?y=PeeQsOuNO@&guE~-I>*>@%#r(MuZ@6
ze%f5`m{$+E#WibdZm<WtT#RB&X}w`R8;5*BBii~$X6SC28NQe5K8@mqdDf?L+uJ9I
zzkL&gN!z*Y!+Bs)e~iV`4DAlM@cK2AsBp(H&IymW2Qg=$<s*S!WIoU4D=k4vkXr1(
z#I`e8RfP(%b!aee$_+?QI%vvFai9=+sc@FlGGGqs8XaAQ=YTl%11|3HKm%>@dLL%R
z=2OxAxVFX^SFZ<SV*o!r*{3Z!Gjl?Xazbm^j!;)H0ffR6H@x{s5-G?@?>Nsin*T<R
z^jn{TkhJ3hv>MBI<o(8z2nf$Ng6b94*B83&a{10jU#RP$-QB&wtP-MsmR-_!rD7>U
zT`f=D2BIT)!|!pykj+w5mZC-AXALa~HJ|S+zT84;*}ft!Js`{7vMslxrAU9kFc`(n
zr`<nm+n~i{TN`S1v1%m7;>+|Z66^pQP(PL@N{^C%y^gDXY(_Jf9zNJ8g?WE!r@=jH
zW{Z&KaGr0Qs=3>eJJlabdFdZbKGfalsLGEy(!8`_K%_>}YLbf2k#EdsXmbh@`k22G
z3*$6L+rA~d@X3Xx*$Z`bp$THaJs?Y$K%v7qR7qfx)46M4?%!<WPo9OjnpqrFl;|X(
zlu-%d)JoHruV2dKy}}4}H&aAw(Hq<5Gz0w0<)qLHUrthhQK9U=589ahV4<WN*eFQV
zC^Nl-1Ef6qtd+sE&QxFZ!m_l$q)yHfpC)Hq&IriqPv8Fu*7JVCX8gZ<iNKZ^0p_TX
z@kKQ0&cLqBt6v2KvuCdVA6AGp@{8|2t$1CBXs_nM_ZQkqO{9Td*{LT4LZy^+po^su
zI-iqB-kHw}e4sSW0%Xg>XKK5BrVP9!A#`WW!U%C=`MQ6Vw$HEVO+3+v6wv9TZH~%U
zuRJq#*ulQKE8+P<%qUS|ac65B3J6Z5+s{}2N|diK4_gbaM}2Vk`kVkGbdWO>5!bs)
z@0xeGXJNwuz7Q{(MI$JJE5n`(GY1ekj=N^K5U$rBMvug1{)k5q-fL;N^FzZ6xh0wt
z<%>H(-JAxnP)`0vw8_F8ER6j17rsKa#Rp&3yf$W>OwYt(e_(LdAtSE0Ol=^woJNFu
z&dUj`Q7y6@jK6O4ZMedP^$dFA0#s)vG-w-xG;07xO7E|#Ca>m@1>djWh#RJZ?Hj~6
zCIi;E1zU83ci<giOu>X3G+IrC<gY|8X7ru-xjtfF=RT9m{S1r~^nGF#*#!5w<%`U=
z>3j;l{WRy*S8XhV2Qr9jxV7+rEZ~c~-vaOw;S3Hk_D$0Tq`*z^WwZtPWkPLGm^0yA
zH_1M{lkmNp+QGmUxFVzJq3XnX)r*j*RC+5a+={gA5}Zw9Yibc}Q&myGsjP$H5?WzZ
z;ZPA-0K@)CIaF3t%;gvYR@bKH6~xN~Z$m0*>LWKOdM62tCw;E61ysIs0CnLr5z$)c
zoH1@UErXl}_E@J9*{PLN3tleaTxW9RKGobtpfxOdTaH&>DK&ogl?xdq{&xS#Gee!D
z8PO>fRH<>ciJKHiV@j$!pW=9p7WWZ_*yo*=K!^kJviEEt!YPSW<tbbos+hCK;tLGH
zK}$X|_;Rm?D*`svDf~n0iqo*pJM)^78d;8Oxx47_F&W)-zvHXpwYZ!ZEQ|bsfdEk9
zkgg`Ak@F<VE^h}pMiFw$SaW|0(}yqY>ER#`Zu0NgkTc2q4UZ2EbRJ&?B8Hrp*V-5>
z)Lv8_K?7q6ODBsRp5uxk$c?qj-Ty;8MTwCR*|rYZpm4zPoF<U+J>LBS^$SfqEG3Tp
zkCqV7NplRRvLJ8Cf>0HUXO!`uXnQrxF@TTIs%X=02)hf3-7%thb_vEeGF_C(ky;HR
zqbES4&SF)|CE!9v6Q(H0j=g{zG@e+%IG?I7NtFg4Kqp3=Qx=-+U5cZA=waN2>2IZq
zfMQCz-M&>I-({y!#%_r|{yQY5AiK#bI-CsrkBkAE=;w0Oq`)R0ODEae@ZBiqMG?G)
zWit%uW`{ql%Wp(JkjA2j(_UqwizGt_qu7+`LNKgnZkT(*k$UArdz?ODxfL<cul^@F
zPLpVvER!y`4cr1qp`S1Tm#-1(=S*%Xl0y`!?I6^prySnIlW#?<?$Z6&k%Qt+XQuQD
ziW59+3g|0=C7s*omRU4M^Yj0_6%M~^=%pb(Z5<v5<WMnl;UC?*o)$!W%bDfpn4Ox=
z@4YnDO>xb18@a>q^$XLK{9QJ+aV`!!Y8lRK6X>A%-KdD|c`R8knqS{z&*V4|l74p<
z_F~y|nS7w(*@+o8M5x2sDh;4%qx5jK?9yYKEBl3X!{2v;tU{5GR6UWIK+Dj(tZ2Ue
z`^^@|$Z~m+(l*QQCTP%;kB?>kZ3vywsWiiYn4M-M;EQ4OP`j7pCIboSe^+AAv`X`E
zZ5h4229>UXp^1z{T1KJ@K5}WuWE`Ub=Y~Se6az7-_2M6KYA|!a^wi<$>2fp*XCOU+
zLeYZUK~$dfazlS`rW@>JBwY|ACCD&tTl7r&rtCR8@FW<AEJK*94|>84W}zZNQv18#
zeU4!M+GxKdYkP9cKKUA!+_F$0zv?;;IpJVwB9buIBgX2Hv213PRp7<ruF&46jHuB0
zHrY|@Gm7GZP6joiMWWp!yE&;z(ruyoxP;cFG1@^69BRdAkkzdKd1-LwU<K+W)!IG@
zr~*4BtzL8ExZIg^5*OZUcSP=ezirqBA9pk@#Cgg-aM?{G&SS74teyCzzF-W#PVs3l
zH6GNu7Pep6p5XAS<H3ZPN92D7K4Mle*Cv2_R0IIl@Suj1!l0t*=1-1w;QYd&W;|c#
zaaTxUQT8t8s&T{{tm8bhI0v;8r;^!uK5)HEMKk;R{A&oh(Bowqcz&3J^YUy!`#H`r
zR7aYNasxt59rm8;W`tt_VjhKs!F~H`04l+m$U^Es@WZwk(cK2+bhsB#u4|9W&t!hU
zx4F*HWDB3o@uv6ZP%^u%YS+jEu9n$m*z;~pH@r5k`su{Kj{SlG4ew1HZl~QiXPg4$
z$=3W`3Kf6)(5^TYU{e5E6*?TKOsY#nm=Tu!j#7w{hS*j^l$`w7T%i-AAe2r0$%~Mb
zq^<nfERkD5B}7hqo+E5m7Ad`WRkg*j3TR1!U-#{=|A`o!!6iX5$Y|--FQ5%$By7)P
zk7IxLyUHZGt+kbBL1u(yma#makHfhah1NTeR5OGXR^DwO$>l-4zBNrBnInKe`<bhz
z!n}oGc@MBddzz*_TD~@CYAe|4l1EODg6TyjqyL@~jeN3h-uskT;nldCg7YQDjgAMH
zhv3cxBuQ<I^Q1%_@F+#1Heb}z05pG(kX19ny4MF+!w$hO3ecjY%@fBF!HWs+Le2l^
z>pUYvWZ7EC)~_NwbDlb*ePYWl<o;RH1nGGp2>eqpo`CAPexajw0HD0IgmhN_H8QwJ
z_xM6?kFH#N7Zu{)`(xVN@Muw}z58l-&Ax|j=Mm@>i&;Hg{@gXdGpGB`yg{zUEv{9*
zWfVOCEzmM&M^dZV*C&MGt!oTZ^PCt%3nMM-mE^48cq{=2Mggk6<5y*{LDLrSL3$ol
zizI_|vdBsW=`Bt;)gH%Iyvwo5@tXc|6_O`w&%G`IPfiWQAUBi9=0X@kVyP5>S~-lO
zH?iG@Q2eHdG;WbHI8!!OL^b4LuP(2#!VI950hVZDkuA^nog%1KgMrjPSHP7+VN?cj
zwW*9~>X@awH#I|_2Nz}VSJEbEkT4Q!Dv7MF9Iu(YFI)iNzD+g_D_o~lO=$NshOw%~
z^DBCfpg%vQ5bQAt>+rH#C^o<Or(D5@t&P2fPE;q@efVG`*&LUzz=Xxb2WR%!?OT~R
z!8BjxxHnO6Q-0jEy1@&tOZMJ)U;uC2%oAbmB#xmz5&f^}9P);P5BRWkx7~cqWa;Xw
zDuK5l1qi_rwwD;o{bt>IydjikhO(n#fH{BahAT+VC8>0iHnB;?pTaURv`nt%LmTVd
zI=%23)I=@N0D(-u!$N!{!COKwLub&_rl&niuU;;>cWd69tumh{29v;@h~HunasFzc
z=i4Z>R$AHsA-N)viio^LH&Vd@y4=bp{zkRorq!EB&V@!P)RKPC<keMKbmgQs&Kj_)
z(^N&ma?<TUa{w$<i69WdAyF48O&56$$5exqDYrJyZDqOOkWa4)FWp%>v0!4XXh3d*
zMzL+3n2CD<#Nn`tKEwtj?hMbK@%pa&Y0`(pTl@f`8$;!ZMJVrQ#Z#L-1lLnzW~T%#
zdQ~|MPr(U}m+eeKNg`i~u~v0t7H$nXu#s0e?$;?SUtLA|i;bc0s1YfSZ2U{M(J5w#
zwoOkb@8;OqRxq*S)G1Unk7-b$inF0mkrN|iKzn?tkG^xYzK5}1sk#>aHxEBEsry5*
z<e3hT6%|?K0Z0NWeiib}<Qn#nXyg}7N=sw3wzjm9q+3F9?L5|-p5nbAKWGs<KRwSZ
z6Ad~)_72QqXe0k3c>)czU~i4@kWbHHMYlqBr{u2wn?ZugR@D0-Z{=0#cBu<wXSO8Q
zT(Bn{ro#%7`gwzQY#hini@;Mpa+F|Y3hG75&uH|GTeuG|HSX7H3`Ez%KQ#KpR6XB-
zBX2BDJKL(P`DOB3K2U)zjTT*1J=*-46mw{RK&lBal5xXI3@JtY{B4%?Hv3%tOvq-+
z@TS8g-|2_dLJ6h>cp4di3+h=LH$nWo1+w+cElmXLiHyvx2?fBtNjO|yML1n~2>$9e
z=l)6J^+}Yzq(1K=XzQF`14Q;^>NCNdUnS#ZXV5~yE*^>}Cuzm~8hB{Npa0D3s#1uR
zV$h-x^<Q>R^5B+`keG$<8Ab_qWx8JFn>o06Q1y4Q&;QvN5ohRy9kkezZv~J4C>*uv
z<qp-=|0-mf@ZUMDU054wFk+G;D3$m8-}B)1EG_pS8*)j&dE1WZ+U-TAM=UbzfgoU}
zZEM7ek&@PN!k2BbHD<Vd*Ff7@9Sl?8X+DKxM@c$SS~T^crVUDL@DH8>e{FrP|MpPJ
zD07WIaf&arO_5`~$P(t#zN5m<q1XNFRoHyFO#N!yLoa47nD?|aC_66}S^K?5kxS)3
zPFz<8TS5*^>~pMhNC=}$8H6ez5CWK<%qiv(v1l!u%FLNR8HDk4KKo>gv(sBuyj57w
zA?4jN`M8mf5-L(yWO&*I1`g@JE1M=c^OIf|8TOilFO^MMlzOhBlJuCR#=yh^iqy!H
zet%iCc=5+^EC4P*U>N+!`fLG$#h7nu`^}F#CpK(yg)Q_9B1eO{Jh*RI%MMpW_}EZX
zsznr5qvh)AS1u7X$MC^Z!X9J0w47T@4EKzD)Z~=*^Y++G{VmKSfZ@mewxg@8tC1*M
zC`Jmm`kmwNf?*d|<1$uJ1j+&t65VARHSzW2j>)~4Wy8aSRhXMx>QoQ^933Zp%%rsE
z50XzbXH-&E&x`WMj|{TguCGk1i|7Y2$Ad{C)R!lN=>Z72lMst{>)>S5J&9`fI{!!$
z4{PU(&9nb3C^1?A{NpzS32RZAlj3$_mH#mVH7m2C?l|}WsSXsDw?tM5O*t$JTxCL*
z^;k{M9VyFoei=koNLB_puQ>JB!>c9KQFIj43JAgX@&MIqVmlXa3*Y|1IjITePQ1xs
zf4MCpe2um(bB1;ONT!0GUzL?Yb+_Zad8?gY@QmT!E%{g3a09nB!JR?5J;Go*rbjYF
zC*EhLZIwo-FFU?MkwwtKFol*R;f+QGUQy0Q>U*^hnTDJd$*L(NFdlnyXQe-ll2~q7
z291~$`Wu1nY63pd=FH&kt_jQa1=uh9QxV`VuV#xlexT;FR2VrsD!ilNZzHcArn+IE
zHLljsy32}{Av1CKMY>=9nHmkjFo(3)Y{TO|J!f-$J2`qW%+j0`z&>DrwN2VEOE_%L
z*8b)@<|blqM5%{cCOGxi4o$1^Ha7{|8*xWTR2wHK=`&M9<|gQKiHph;`U2ikh)-(u
zdX2OpvK|WbWv=9$h@QGFLd;-~v6ikaSbMmpuzrpMuH`c~@!kf~lkt4^f<pl%er~{|
zR+9|6nhY-A5+4*+*?R}GN_z^c#_QtyC=5t1BH9kfTG2%@1FgUQ6L7f^sZz!rIFWLK
zm^a^&-zeYbr0S!CYz5N7B3U-^Q`6KnWdPhn{Q{tgB4x819v94gWT(^1BRevD<d8xd
zkpRJFy#u_Y=UKQSr?QqK>kjdaCH=VYDt^NS(W!MJdzb`>vHiBFRbA+kf(nGn9cnU;
z0#s9~noFLyc@<W}N)3`zpKs*z8!X8>n{Fqv3Iypy8G;G=uKJN-ftqj}MX3?)p73A$
z)}^CDtBR;4F*hqeZ?QfOT711-q%nc5C#{)^5iRqUH}o(@Vlqm)HdWJdYoa*S=L3wF
zc1=M=@?zthXbK~P{+7*VN&{a&*9L18mB40Qv7)2bZN3jXPduV%5CxD4tlQllNSD((
z!?jd0J6Z@GV-reeUMfZ?T!<`fYLy$4l2LL2Oh->EMob3?|4;M9y?(cH|Ch&CYG7eT
z=RokGnp=-(RMn@vL4WHf(`e`4C!s+s61JU(i1G|dAbdIvtan81xYc~LwhQ>r?^+hz
zPxlemjUkUrDvnnR`@FkHQ9jh6uRt=tW<O{JyYzlLqR%nlqGqCrO?Ls5`A0;Ff@<M(
z(=@kO-6Q7v!<=cTe0E`b!Q^Q5q_+WvvoVp{E&-QLZ^iNkXblFMXU*O;jD)Ci<Qh5J
z<#c!ofD1zYFJU$denXz$yD>v20FKE-cyk5q`GvoA%Xvc6>K<DMD+(l_4PidSUBmKR
zqw01@>bIb@>Af-*x*e-{%1k}f4*Ov^c&X4WRB3(pxKBl0X-z*hv*K_-evoc?S<_cA
zP{#2lg^?gSzoLN#AA$c>D5BAAIw$|Q%}!%BN0a|&&H?+(i`plAS>TtWhSvh=)+j4o
zQukSP=xHJ;$#xp^(>`9zSD%G5EXkpoewvgt8dS~*#A5G#oQdg+T<+~P!qRXl=<M_K
z?UD6jzG^nILSLiwn)b{bAm+nPC|OqT12mvY<FlNP3EE(;Cre@{umE9@Qhf?_*!gV6
z!5|$5p$&G0vg%?~Yy6>~5?2I3qsTJ%uVZ1rn-V7r)W?S1w(mn=x?BRQZIt>ZQj5<s
z*CW|nHppEKk9Zj}hd&Ru`%-pb5~FfjfrzzrC-?*rO$Nnynyv20nIMu)3u7KZWwO8&
zDO>vBns4$AKm}hnjDhy9mB-)7?MQqv%sIKRh9Wsq%Pez`s=hx|&o8C<3vT6D3=<Mi
zm3%&X)rhS&$GBFw;0stDpN3-sWy@s+r<BRC2=Hc6>T=WEIr%L*pMzd416h7Z=0bw<
z+T2<VOViiNjnnkRCENhue~m(+UDm(kouDO=ecTMiNOE;mHrpm_WLFew?)bG4b>ioi
zANO*c4TB56=$)v3j|xs(&wp&j23xP3&l(%zEB5C)4B9=ms{)-fYmmGOhx8ag@#Doi
z#)6aBhpNT(qbme@ERlqNjeW^jJ{N*ms`S!cKR%-|ji-nZFAQnbP{1Y@<NiO92GwEW
zMVz>J;pz7nf`~@>of?xs{<0Re9^8yx7$aZxQZusX76mPXqbhg}F2f-N;zfadZ<0!X
z4!Dvk&5NI?Hvi21Z8mQBnOutGDn$D<f_+p#_S!q;EYKdx!sUQz_S6t#Z5(cy*;M)|
zNR!#{_+a4zX&dn7zOAK{Ko{5Z4CS)E{dj01DrtB%T|Y^%1psuCqSzED7xn3QlmIy5
z6|bzbPK+a=U=c0QvS{Cwa+Hg^#kEhvzV=4R=`0{M^J+Wql134AHy7OW*miQ{Yj8ce
zi17)jjtg+GF{Zk%9^4C-M7iHJL0c>h*W7ZhrU#!qaCRG<*#r>%t|=iNrB}F|2<}&3
zgKiH0T5voPS;##n5)bM{yw=kocQ#A{Za&%K{&&7Dc{!f&g@^j2{W<Puu7#uMuCYpE
z!J2@G<$onff>P-^IIto;IEZ&Ia+}#-fz+rp_Tv=&|A%1q!jy2r*sgLng)?8j*gfrG
z(e-~Xwz<6K)=a{@U<YlC3sJI`x%?!p0XWmG5Tn1Ot`T-shM7|}ozemXmS-j|w3sQ|
z#JS?JjQG`$U<mJbJIQsPTIdmhm$6vEX!sh>Lk_$2VRXH}^1dJl+a?$LClfaTMiGn^
zi=tR-DZpalQY(u#Sg*fs`Ya5sOHkvl3SJcczPQawI!t$~FZQ%ca#iT<Qg5|mgJTTq
z&<A0rRM2|dX+{oL?t&Sb9nmatx%DRi-A`nW=T7GGNgffMh|-LoR9UVmw_@Oby^U}*
z&3jsaTr_=-k3}NCF5MOQ!_i8s<<xp!!1%f>!s({XKyg3P^Sv#XGQLo0C5+-$6aL3G
z*c6mqd!k_|I9CAE9BUmhYX>^Pl+iVKC*JANEngW<%EzVii)64H)5#`YrMQqfNu|YU
zltl}jZ&eCQ3=fiNJnqSe{-`yP+Z2cg9@jj6@-vMAg+)iIxffzs_kM@5a}+1@Y`okF
zqd?IA_@x;u(<6sk9kj#_48rRxg?BeJD*-H~h%{NKPU^pTQC>EXZ^XR#%oQo4cDvnY
z`sOQM>;=`6KCZudg3p+}=HpQ85;c8xuQ^=JcAkUJJonoCos3v!@-SGRVaqi%W>?Qw
z+OAnIFB({UQ<s|=4Hx}&5f^i_L;xSqpBMxWD4Qv$Y9;0{j;ro|NAM5J{j9n9eUZKI
zp457n?$}WSq`X?bhn;}0u!vm}?Vi<tK%_6(hGMN5`36$k)L?LgO+l)P|A+g|)b?n;
z_rW(nP5cuZrtwi`62gBu$pu7OOeTxLWPj>te)PAfT5Dni2yle3dG%RBCqQ&1`a*Qb
zFRp5&i)i1ixWK|+P~8w$hl;V1Yf<Lx;Gs7p6Okyq<*HzE=Bp18RS=v!axCV4m(lC8
zD9vTyk1Rzx96lm!Mj@fR<e$vH%lOB|iMz#=Mo$q_8NN>H1J!i;W0MmrV}6O_lcnw}
z9&E|G@d4q5A1%r~>LeSm)095jQLv%T8BPQ3$z^404`9l$k{eq}S5Hd7syOm%2mm{0
z(qdBSnRY*A18E!e0+t^BpMOMfSy*3Uzjo*x8Tt#t{*uz!*3p-1s!4;26&8sUv$ETb
zYEpfURpj|3h>+{U<^<X6NEE<U^%&=BhvO+juVP>K?%4WL%VIYCgh|E`+Ir7Q;x)-$
z1DSLDr1$KZ+Twge>sve=6?tLS6aj@Sw>tb)*S^a@bJoC5Se+(Os`R8B=ApaYlJl((
zl;04?MeMlXL`SpH4mG!zO^@w0OnyY1v7-6^2|8%T4eV`GgP+Rpnl0C-3L*_B-GfDD
zbal^A7UUr3X}4;H7XHoVgLgB}Sx%7>5+#6!H2CYq>4Xq#05=@W7Q6o?ao(NLgG4&=
zL71r6)7{RZ&xjv20*_)S>{~Xf(tQyeZhmnWEzW1uP}(t})SdCuh%3X4SY!Qz50;<s
z7zZ}`4{9%B=GxDVw&5V|2V&R*)aufY<Q>OT`u*3V+9hE&-5LF3R}@HLqatkc)te!>
z(}58g!3EA#FpTUzA%6lrj^FarL==#o@X)|eW$Q6OC&djQG6Cxms#ND;-Fpmm!&}vV
zK@VzgI38qZHh3T~j+Q!$pd4bqWvpgO_3qhYr~@=k{c+~)2M=wjJam|m$6(>4iCCS2
z+U+?pR)bo!<$DP~oa<%c(cC<&*(*niO&!)XrDF*W_dt=G>71>RLBveJ7*E=X3Ytl$
zjqkXUz?HMV&_F;jY8$z3*7Y>cV2AznU5Nw&{Peva-m-`kHCQ&2X|CV^{>z37FhN${
zzcjrn>{To9UA;|=*OVI5ThirzDHxj}Qd_?%>M&?35sMfDrqCo45abGdvvjHtEzyw)
z)BtDsiz1U+ECw=z85yJKqaVX(TAhh1(2RbRZD&q){WwM{gOm;d1^*dA*rnlZ`KHUm
zqddTaSF=AsMQNz$deAfcOp6$UvdT~lo4n8304|RJdu}A+s3d$P_TJ*MS4X#9;tJNQ
z3mRH=tqbr7r87S&wbi&uAj^(P(BNFh%xIpVO*0;|KOBqVm)r~|-|+!4lEG;D09o7e
z%T}9ATJi|W(9u>7NOXfr<i`&ky`tN{LFE`@3K1iD$Z*Yyuc>>*s$+fMx_!=Ah+9|P
z4NhA_6#?p6zL8EY_NF!$Rl>wVHi|<hXnVJYXJO;;tT^>0&pEgb?KS$`Xe{6aOKHY}
zAD7ox%`w@qp^UKp!F$k9r|KTH%o=F0irgD)SSWh!;~)-(TSzX3&7Y#JkVpl%Nqv+q
zKxhsav1~=up+xybo*cIdH0dbvh*xvalSmY263C}Q)R9QbsSXyy-<uHQgitk0inI-r
zWd0+?_2;<#>3&~40K*GNUsm2wv_w4*|F-%qqPWrF#FjyzuwYxN`Jw1ktz_h$X*hIi
zsvLY0elvFq!BoL7@A<qmW%wN%%xl&KB_5hv&lv`Y-VPRt=UTPOHhee;1pd9ZCT<_0
z)%1Xz-zk^5NYR7@9(ts){n~{CQq=oZHU4D5A9Ngr^6M&)=@o;r*nVlzVf&D#BMcj0
z!_=8(&<F_TWXY*NGe2yD7BdfzYro5l3sD^6Y3R|WxsXBEe2nDAVl;53Q^_u0pZeir
z?gnJwv0hx=tg_;lGfJh^o=m(#Wv=v(|5{-AR-(!DZT7R8U0DGitgS&hwqujLb)5MQ
z-<!tOE~^g>a!p%$#*xd^#3|H$F=xUoeiUQ8MpP?azzkL_sx)C>X+wz&9({vak4P7~
z9`ozy9*!IShz^`YN-K-)_x%%_&e7G+Su0$@#Ywi;*^#{?*7@?)Zcx0a6Q-|{y+1z<
z41;g4Z85zZc=8=%{k$LfndAFJ!?*{Ur~Ihr)^{kjhlTqHti)`w1e-#&)Sf$PW(NG<
zUIU#!juq1*u`!wd@v$^0dWLR8Kc5?;nv8zpHmZ0bY2>mR*SNIx2M`b<l+M>&50fS+
zkb~l~%3_93U{ov*BF?4NA<xQ*+IrUsUq_trG09bxLw`XOu5X_B73#<Ed$v}LU1r?&
zzJLR=N%g-<K$f2QZ|Sfr<>R?gR=!3!#uF>&wa8%^`8)xtwKMeb<2r=z%qL5kKiMW6
zTF=>bRff63`~kxhJnQfpGray_S%vDFttr@W;O`#?!*$jXc65+rq_;!^xmMUN+v3-p
z`FVk5jkz}EKuX@2hbg&_h?{y(=?#Vw?Z$Bf^;~0&cN<X92=#iRMDFrh9_?E_(zuJI
z&4egct%Kgx8!!&hM9grw*Ehss{;zcA^5h}okX-2TJD~mlPflTEIH+%vYUl?0ozvx1
zWqC5J8dz^4FKMP}s8&$NFue`##m6S=&)K-ok7BH5akdhoMoiZA+PwUtAXU?-q8j%3
zS}zVzmcs9BNMFs>IcF#k7^F9%2fOUElt$OP0$XJ>`WF*KhA)r^gRst1YWPxLNB~sS
z?eV&|ccu_cLv7v^mF~6nn@Q!Pj$?J)+PeAjY`!%>L`A#!V6MmZIALYH5q3Pg4Z9=A
z5y>7!E9fW*Ai(1>FEPC2D$`e|qxNn=Lk$WS@9Y$GA!d19I435HyLJF=L-iCb;laXj
z3e~_(7u$!XLC$#cK@{QpJtmvul~;t|ytAIuJ773PmYM|D-^MPA_}Cy?f)g?y*|^No
z67C+FG<rmk@X#kUnS8@?(pG#^2c3r-x<4>A(XD;|FXjBW-Gb*J=|o@jxWAjgrr}<0
zkKn~+RvekL{uUAigr*Cml$p1P1$SVDTz}in*PF>dpNDOb;WNPIzOA^2FnWDIml-yl
z!!9Mdgr)t!#JcRsoHuU_Jp2<Sd+J4m&!3=N2{zgs3Taajx_uJ`H1NoyqE`q@&Q!{3
za+6n|t@sETW7|SyZqShpX-U2sw=X=kZ?KxtWO^g<qwa~XhSid-JmAA~P5&ft$Y4dW
zT-KRSy=W;Kv}Xp4(hNiY-Z8g)7rHX&0oIo#u{%ba?EZFEnFQavs_V{-^6fSs2spfi
zVy~J<`%|CiCV@aBM%RB_6hmSm(&96qRC>Hpvx;Dm?2m8G5HKHm^1`p?cIoE2YlU5a
zYjLh=f|iX$$uYLN!>yiYb<K2CT}3X96%BX*l`ms1>sg58SY7*)g22Y&?9<3Jcv|QZ
z`4ISjYVqsCu(WK!QLs>U5Z`G^?{Vt#>riK(9J*4f$327BaYk7v43JZc_ZO1SY|%*u
zd*6-dsE^QJLTZnDw6S%~hyytc0EMZ0p!nhRbY$fbQxEMB%noj^#330MmWZLBEl<vt
z#m)OC3y3#GCP;$btRz-KE!Q#zuo;DWK$!q)xH?l4Gum(@&IBqCqD8WAwnWxC9VG)V
zEy{&UbzxV(iz@LJEeOt2ex<xE4m4Tng(z|wV$ym{Vnux)c(yM39N&2tq`?wYS?{hA
ze3B3Xg|DB?`)esF(|<Lk2k|y@trW^_1}HY#OO%Sxdl`N0EOL!}$%%l0%53nnPXvUk
zCQcW6dT9sjz$vb#=be+Fq|!9p4%=~XIc=;332^(e5Uup?RZcbQ7UBk;unQ{&(1r*(
z<#N)rz8ofD6maYf@Fb+Q_1`qEFu>nIOYy^t`z~G5lW<9fRn_YMYV_!}e(x+7=*L5b
ztL3;f%}6OPhkbbtoYEO1<BC&rE9lYvq}|W25CFLbz!3CgoOYabJrSN)Tbb!s{<N+<
zA>0&r@3|vVqpQLy_Q(rKXP-&crTHc0^whcUJd=k)XMaK<BN;79`|JGYbI9J?Po~@H
zN?e3+(|@awrXOM|I=a^Up;!tsubK8SI_;ox@=pK+k3_bXW#5W}a&XINyoYC3=_;;>
zfUTfbdAmn-z_o-9X6(CKs=tJWAb35@S;ifuC=qvdL1LgHMy^l+sSCVjo!+Y9PST{8
zE!nWq#;3H|eUvtxF6Xyij%Nxi?(<(}ax4&Z9pUHpvAD(&`(Cxy!rMv5rr>Z|J2bf=
zbYnXF(-Jv>rylwj_6KwL{cCDl_P6UY$A<LjVhFwW?2~2#6r4dv2Fbw?-d_<O(kNXA
zO>UyCv4CB=0GHcg5qk07*{woJmtr)%c}J9$OHYd=NXW<6+9%8jBmex17I-z;6&~`p
z<IUOl_bCNLQlJhN*z-36fS!P`QHsQ_cgMZjkv)OSmcc1VV#+$p9YLvJ<e33n4<8hc
z;Ed*_N}&f+ELPppkno%zPSEDvA41EOTHydL@7!~vz47F7+N?YmAtrs3t*7txXqtk)
zoBa=9*@_ie08LITzNZ!dODH>}$r%f^A|$y{LmNOqr55FEP|-x-%y6vWvU?vI7A!?A
zAi?#~L<@ZsSM3vAw{4$0orBGxsu;!f<@<cgP5l6lbN{=@{o9aP1tf4J7N|_U2v0&^
zCXR5J(x`>#4*Qv^k2uF`+1CE72vZ{{VlHJIRt+)-A1`wr2RvTQH<H4ARS2@UE8q$N
z^195b){4XZ^H`g1MAM09!^QoC2bRs*bjUkFx?r$iw+rqc$W=?MaNWt?7$P+?7U1I+
z1h#xsAnL=1@4rHKL7pR4A$m>51jmoRV`*Bot^`+ncZlMBs7=@_#reQ>XAl_k%Ku1u
zuu)-B9>{lz=}izzW1U#6$Ld_&R3VgX)$cAcmD<#oe(2GUNGt%ku6Yc1=1s}YzMxCf
zo-0SWjlG9Q*Oo37%kzg+;Oirv@(q^tArv7AoTcngk9cb9W`vH7f%QxoP?f6LGV0<;
zLB??=G<7>Lw_%e?L2iJEV3pqN;&7|vchuxANmBHW^~C%Fyjdr2V+*IK=L(y?IcxMS
zwwBit$}UF|<9I_c-3B&~KJpez<$#R6c%aHi8j5ycp$bUvgw8!grAan*il_eDN3hfO
zFpY%is-XaIs?)6bgeVQhCj&t#<Ch<6%bFYXBw%_ny;|jo_m}j!R-y|<Q0X$aNp6f>
zD{fH@7q0N<PO?YiR?W{?8>}<J-z>*(E@HxjKmaIx6FMBMvLm9T?rUMCwAji--Ahm3
z{4OX*yuMCXbzICm#4_LhKC3BMx&@;}@dH}p^Cq{l$aA>l(b;X~U-r5;1uOz_4_;|S
z3VNM9Jm^BfHv(NKaz6&LEazZa01;g}%q6BLxug*e<7md#8VXn`mP9T^Yxth3C-O}D
zz43seS9ORDMFT!eA^W>b{Jd=&AF77b>@QYDagDa2lu+pJsf(S1^<_1n?+^>V_tQ>F
zS>^}Xf!e(OTVyc;Q@~n9!0<AJCs<<(xq@o>ou)9HLQ#gGO5bZgXY)#;ideZuoK{w}
zIrbyL^98iy@1#-fbp5PhuctTVV@$_k{6ZK`(g4y8K(vf+$_{t544xC{>VK-C)!__r
z<o8xv0YuS+`kV|m+2i%fL~w2L>cmu4+BI~%T@`fMXXnr{g4Pk2^Q~TbOB%`PkuC0l
z$0{N+9}=206K(d#giNR$eKEqW9;KX_!y6RMy!@G~af!7CYot9hGh~3jfTWxffH*#K
zAK0m{t<pHb@T6GY6huz&_*Gd`rvSo8pkb2H4=!PrRSPB|295Qm6#jJFpwHf|K6IU2
z^e0m5O~&Cm=0o-EkYbV64k4Mp{k6o67IWaLg+EeU$*wxBASxI{N^SeMI5D;hMGfob
zv8(#)2|xm``+UnKxGPU(=*8s{{UI+{XJW(ki@(_MFjyPexbbCNXa@({9o!Q~fbOa{
z7P8%-9r#p7+F5U+I;ua@Ff8*A`FKS{dEL-6xn!U<1vz7~Gt4@tM64v8-;#~Myohbb
z@Q@+ZpKh##67=hXX*hZIR&&$XuBUuy>|(<O2w!(^54G*7&UVMGv2CL;KN5HQ(^E~C
z-{XS_=y>^+zvfrYk(QYP?&<O5CE0NHrOC~mX-{U^pO7@5(icB<O&1%k7LapEa>iY}
zliqAbLU9)vHB7kD?t#3guqx9qjCjv6l_i|2>3%60L7BA7)$Y%n?hL!hM`5;vjjMbi
zmy$P{joZR_`zr0?N@qGX>f=QGuA2PyCDCGpQJ=!Jw%S=229|#g#NR#<A<`Uk%BDNd
zNu2yaDBLq5CqH=p;cHqBd&WR<1=ZyzjH982zM7F1{z@i^$YiTyI8BabcHqe~Ilhp`
zmfu9hjPdx%8IX+EH)wD);&Sd0EwHHaL@~4+s3!c5MveI`Z-l;H6g(3wm8f*GHz`vp
zQ!69`OlQw<D0-Y-NwE|)Lg}(b_{lNWc(ZyOfafOaM-Vq%u6u|>;%30xzkuXl5fy~!
z-fox%Do@YpQYAIAlAU;Ra|tGM?6N(0!A38L^i0fqhZSS^h&#7_!>?09N@FS>q>~<K
z<drL~L;~Z83h9NV*G{$Ke4Q@dNg{zk-l>R7`E}3#<xs)V1>Fv`EC(g`s%F}>vj4rJ
zO>o;x(*3CW#DmY~L@IVq)f{sSv17XmlWQssmjn^VuEw%bIX<WBP9aOV@1+M2YwJKb
zEqv1qd=^b1jE-BCVI`}%0^Y?gK;{d^hO>RfEBp!C^noBy%7Lug4d%e;Od^vm%nxb|
zqdaV0i|k*6zutaZ>xUffUZKj7M^-gbkh`icNCfu=d8BFHm`4e52^E8Nc|hmLTq%py
zbJ*Px6T@JFwpCjD_6JFtwhQ%C`!`_)c}uMe9}O^xL2L<S4`lVe?o$8rBbHo4&)_5Z
z@r&8W_~5^dD^Jy3j5gEvT|cVX46fGjks~pd{J!^7;byG>!Ra!DwsR#lk!fl<eXj76
z!AqpTVBJ;C9}P~P7Ya^wx#jNy0M9`CbA=Jx2V$A-1oRCkK$~u^SxkZ+dZ*lu=T_@f
z$`SIFHWaU_eUTYf97E&q+K3P%0%laaRG?5^7~)<8RO^}}7mJfCj{i<ZdP^XsqpXI|
zEYg!Om7;-aAqo03%@`|Rz?UidzP=7AOx&&yRiSvz91q7sHw2!m@-m-K7FiFy-WbEr
z1c8cPKR+vL)^9FXGiP1UglKKEa+>Ndlv9&0kkXCeP14nHyGqC7h=mA}=)b|Qti1F5
zQc;_wqUV(Oj+d28c%kxlOxB4Fn7s{-X_qraxab_nkn&EY1kQ1^^7J=S_K6E-=sX5)
zE;^UmbLe#AZ-kTkIOEht6+F|E1xzqv2cV?Dn0)|Y9mhH{#+)Ym|C2~Sq~59rys#5U
zM~U`m3I+C)q-K(cId!Z(>WMw3;Q}UjDkE=BQ5?Jm<MWzEhElF0{S;;s%u&qc`%|^)
z!X)6jR^j7LaNNo7^xJ)Y+PsL!^^M=fN2O9(U4o~d6_yK2)X?qJ=8O-5sd@`(Js4iB
z>W=A!%~bE9b`4v)Y_sikIeTx_(8_;g*PY~_qWcetx=OKr-&Aq^S61ecEqG1+u=J(`
zD!OWEOHy)hjUPcpPX1$~mJ;Oa8oJ<nUZzlCMg-!?Ox~-8323x664iniLz=Icpx?WO
z^x()d=VylF18)ZWh{(Owu<&n;RP2t=$u5+0bPwSrwn{V&`p26+MC|~W^%ueojcMeU
zW4ds!yHQ}%4Vp{xB&Mpez)t$CRQ)L8GPRA%6KT#n=QQO<6KU6G2>U>W+5_(as}sg{
z{%mp22=u_uW2*lOyR_OT9X>~Y2lhtGI)4M|E(W{ebSV;-Ll3j!A?EHLo`-;Xh6SEw
zAmsI-N;Q$_+B)npB9vVCLC2%#($%qK$}7(@?&8x%E8vasaor3jzhFEN0C@Bv;e@bv
z>V_jEyWlIU^_|TeKrG$6>HAvsOOw}v_3AMhx0~)&Mu{xW5(&xgQ%KJ|3p^D~J0)Ca
zQ)ZmoHH0f{Hav4tHe}5&Z0-s-c4!Ct4d@`LjR5jm4M?Uc%w-+5QK9xcdnD@koUgnB
zukLl9;^zF5NTPpWn@YmlZotgMg}%i{ibWbGMH1}1dFLnAgEEkn*gIpwSdY|(768cv
zFur~bs0#1`9*>S6AgM-z!iqW}`Nv$@6J!>!i2c8AtPTc5S|=l6NP?EW7<t75aNc&d
zAXfnY=BK+{8>BF4icHa_#VyQe%gtwkH239@SY1`(gdj0Z-Bt3t_=%=$eOub1Re4J)
z+XI+;Dg$&V|7a5e#&lvV;5{B6-$4FjIz7dG=lUw2yOs!i4Vl4CL=w$cVBhf6O{{-_
zBjDHeMkdtgJ;H6!mpcCg3m~?yk{8K&$c$qt>4RL)=$lp!E$Ea={mZ2}k`^axR{^{z
z*7})hO9P$y%YEyoQ9ozkTKWo=p6!K$kVsj^38a2K7qGv%SQ}W8<^k$8{+4mg!C}|>
z^rP7);cs(0WBS7gX!TC*dz85bB$7RA*fsT}V-`&>0n?GdndkRk?>2-zjV}{6#F71+
zpE}@#T-3`a>JUcKjb%!{wh9zE-d(Uo5M5D)`QtS@a}=6iO82;k^M~k`LX|g?%JZ(*
z&Hq0}HG(ilftv`y>X~EMQJo<io(&-SX5}YC4-^;IBgI&#quP}yfjSXj%;%KsSH6Ub
z(wrTKM?SBV$=$MZ&di};j60o$jC~&Fe}jbsXSux~2RAz8{e{`qWBrTx*Hy@c*3JWt
z_(RJIJC?G{k3QB^<@4rPxl{og@(LG%7?{^6nHS$&3)i|1Za|XIlLK>CfAuEXBKKQC
zAh$^?jLNiq!%>s=wgu4_9#C!#Ja&&;K2lrx29`g4OU1k|wAz=6uW%-*2c@|An_zCg
zU*wQ^#az0$nJ)cxPvFlAlcBbU1~W3P+d>=9MaPqbj!o6yz4DgUJU07PtGGbptyaDg
z!#_H>5c#+1>NEN(;j#m79N~c4B8W8a|I)9DqDKezkCh8HTqVg~o|Ff1Q(}nHxJ9Q~
zQERBEOhV`S#DITEZ1ZCpLb^g(?g=mOH_gdHlI#jTg7)Ps7ctym;A4+RPMBc(uav?J
z2I6^q8&1g0F*mVn^VuX#iDdiHEj_!wk9E^^jx@>#AgJ1-tJ$I~{k;^Wc1OJ7M7!2O
zfP75rwf&Af?Rw@9h}xc%r-k=q5Fg>;;bcG#_IseQ#C!^$hSur<j)T9kvL$zXN`iNQ
z<K9Uh1lUN~6PZ8(gGJx4Q7ob9tUoIV7|7fCw#C%sz-bbHK3{P@pa3um1_&yKNX|V3
z0|Em{05C=ZApnS2W#7#72Q1_tm)@rfBZ4@=%c_pmXoSE@MKk|3pA7;b0F#BvI$RWn
cbK609rXmK_DQGSHO~6bX{8;I@W6*jBaZ3y)!vFvP

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem1344-req.pem b/certs/frodokem/frodokem1344-req.pem
new file mode 100644
index 00000000000..33659d5fecf
--- /dev/null
+++ b/certs/frodokem/frodokem1344-req.pem
@@ -0,0 +1,456 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIJU8TCCVJYCAQAwajELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAO
+BgNVBAcMB0JvemVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxDTALBgNVBAsMBFRlc3Qx
+FjAUBgNVBAMMDUZyb2RvS0VNLTEzNDQwglQhMAoGCCiBjHECAgcCA4JUEQBdUK/p
+bkq2778sr6Rao2z+ePZM2rx05kw7Ce5AiZx6YH/wVJ1bK88MP4OQjK1Ed3EXcJ3q
+RfyKpM56NrzZhIDym6Zc1XvgrKYSI7LxnAUUOo77GwBv5RH80h7GLQjL0SAg1tSO
+pPlCLo1kcCJbg+U7j0ELOF4mHSLsif46lWDPYUN7CUNvQOOWlOog3SOQbzGyWnVi
+TwXgsVSroCBsAhzpggkvH0pkTYN8tPzw+MFXAbfCyWX6+ftGULdK4b2OPaU3Rwxw
+xKKGSHzrZIXA/03qeRIAUicuhfo1IDgqnPlTds3FOlfrpmuVCRsZV3OzIjOXfY2W
+0GgBnxbEbrGp+7salxhAdJIv+W+iFegliU3HxKWrDaLb3kEroICbzTCB4H13o1Ik
+hWEWjOAaRlmaOAZ4A2zZ+IdZwSTXRIHUI+V1zeOYeyGMEClSHnweTHmeraFrLo+5
+WD4rmwhiqWQelnRsNBIfYt3mqQSSJIciGVrRlbSW7tOUmEKtbocJ+wAyrDCgFcMx
+FQ6y2pzk5aT2IvlW227mzUHWT5Cgp/N2GfENfHxgESLB0W5tVF8eV0GpEIICFVFm
+gBGop/zMJatkZxVA8RJwT56TsjybLxbzEKqUHp8uUh27oLXVNgF5HpanRyMFxLUY
+lovDRTPUejRap4Y5fMDYYBvdlP8Nz6iPSqF01NnKi68ycWVz6oO37uWmjFkLO6XS
+EQPmldqbIRBNxcxE6NVB2UyEqvflHHHmmS0FtlLNuEnWUbEXoXnrSqjspwdpYIfq
+i/2wxzkFMx0Lq3fQX3y0XpdI1yR5eCejWoBiuruQQSiZsNHXmTTuMr9ytOm7jnS6
+oe5uRrFhCFLbFihWwjNRRpGS+4CpMni/tQjIv6Tqch4BFFuAkX4vDV3PvdpwhucX
++uoqxp6Thho642EkmhHLuL2ZGxV1ekwNexEfXVvO01/CLs9/0PN/UMkmozKFuRP/
+7xlWkQenQzK0qatYLk3qmuGPZXRqAxu5fHICLU5w555cYw1fAD0UHhyKhP4q3bSF
+ij0W9lRSGRWRnSfrjuHUIFm3/PceQp7na7TIz5W3Z2RABPCUEnLODa92bgmX2eNf
+NKbRWAITXnHKXEs+iA10xQL7weEFjqr0IPsS9d93M6xNWmImYFkpVOCTQCt6ksy7
+qhcrcl0tUhFLbfrjc4S7eRf/AoopNlAhAZA6VdSgVKUmm+VpNB+QaYuBgNkRGuST
+hVcdIVNNrWjSlp/OlhQeiNmJs+BsXEhAW7hTujookbXEOuFAH4plo7jWA+26rDjz
+YxcZ/b4tzr2DVMlKiiBapg6CxAbcaNWEqER5KAhD9w2Q9Szwop4P3pQr6MZs86Ya
+grkSTYTgFbbEq7osK6zhwBd2OkiOnWqTEdsorYlpwQTjzij5EZsMQi4QWN0yUmY4
+M5UGzbiAd0yq1MuRb6qPDhwi8CBNaERZr1QKuNh3Lsohjup3AKaT6RjAbG2F493z
+18jFUZvIY9g8FnIGtInac3fV/DkdoX0cZK8QJs5ie7870bnq768S3pDgkVDO4GrB
+7wylbmLo6cNVyLCCVc4mRUzrPKXYbeDhTuQiKK8NrDSp6e7F/kYaXH/j4l4eC95G
+881puKhlrkEIWeGdBsVaV460jWVeWPrp7svhLLzYONnn6LOIn7oUep080bglwr2j
+TYCDS622o6Yo2Tf4Hwcw6fdAwbfLCNMWacvLcaLqpEo1ceipCkLV8VQpDIoVTCQU
+CsGqmBijr18Vss8EfTlcFEvReEbRIjUYdvfmL1VrjnJejjpUo3AVnSrKiu877jL3
+7nea38R6wjMPXeTuos3ApEQc/Quj0ooR7bwpN+p0sin+XRKvR96sfzEi+DYsBvsU
+c0mKlQjqD2IWs0t4TIdudEyS9WGfGJueJPPxCDjvYNoATKzTrxaXhYS/keJSl/i0
+FJaHO9GK+15NN6bK4ErKFc+upWrDMsBL78jG9CkpqB6HyFQVrvlDd9ZYFfMn4Q4X
+jP85+YVRB1331A38MIZKbIaq6d/VZLcvIjipgCIhoKc0V53CJzVRhHUdxBKEj+3l
+zWuQJBfqSTQ0uJbwX1NjHiWlZpgR81sKS/JasBFgt/Sgxuf1/3pK7IQT/BMM2V38
+TBvjXi9UWaRuABA+17jKNZHuoqplO1c+rvQQHI9BAJh/4hRvVtLvfXBg7ITB5EIg
+kqgkYWzL/qCZdOxGAtLl/a76lIV/nACWdepHE8yCRYniPylON5t8w1B2luRaly8I
+56dyg0pAhpxTGp6QHGUO4CIpIDuXjZjJWV2yTqQaJJN38aZyDs/HjZjbLJbZvT7i
+TKg6atKo8g7S6bDPXcU2j1L0OiV/bIAE37tncxSrN0TrKU7/wASi4IcELZ8AOFOE
+qZtglk9hs0BXCRwKAVKlTWDOCA5tz9+ecAbdR6QwabK4QOvLu1zH218aXIEHIoJz
+Ve7SZvIPOcH0ytf8YTKe75pU+BuiOY1JK19tcnePHEBD3afujjGOS454pQGBFGNg
+BLjT1ePkZOsmuiwFKamg/fR1buBAHp+NPaGk8Mf1P1876676g7f5Y4FWAdF8YsoP
+H9n2OBhUqZdw7YJ+8cZN89EMnxrceYvUnRSqtfNAOh5/7UXJsMUEAPLW+4hBtN87
+XO8dnMOhMKP4L3u2Xss49cCLhZyYRc+wm+Xg/2aeAb913czMd1ijL6FdaZnFV6P7
+UibCt0ZbyiUq30RJYyoOCG0Xv3gdwEh34p+qZvsdlJCSDKacae5Ryyi0zeQ82Mtb
+nj7Ghqpqa9f/FGiLRQNNVyqOHROA3HqH5zKu68veOnBfTdCMq+qNxVBqPx16zbGt
+2KuzxcFARr7gH0Og716O6PycXKo422dJSiXVj/qASVFcJmp6H//wzkKnXgVsJrbs
+J+ltC5q9GUSJpDEM9IyRuDwIutgawvavN3BZ3SwXoujKQoCKHgrXt+RVEaPoX4g/
+f4uqh3YMpxkmEGVgff6J8A8WIEJG8vd9y3dWEC3/cYsfBVwfchVVfqcrQ2KfAMvq
+V5gR/PLgZDCfHQU25oNhRkm/kqQVZ9BLmLfyMafJa818jwmTsdZ3Bn9T6/V9c9fc
+y7AnF+Qne3hKqXYndjXHrsJDVXA8ugvKqI804gb0yMHkEH5FoQqY100ZKcYko2CG
+jdc3t/UsBvEEhhTilzNestTC1yvPIOpEYDBUeZN2PvRXkiAjTsDQOPtUzmFQAjKy
+Rccvbw7t5/wL3UP9nO0sTX2c4jqecb1cNEpjt8hZY2qEA4NKW3XEl3gxVibFQh3y
+wAigMIZxLQD6mBroJubyS6X78sVFB0eURomDzFExLQsOIdsla1faU0xDLZqQacoX
+PYrKhGb42iPYhVu7m/C6Gq+t5qZ4XNEoIbO8gaHAsNGwZ3JxBqZFuY9mp3z+/qri
+V7B1KMXaEIllnedquOMmGQ/Ps+0/a+9cLtmRoCGbFYQgd71aUPc6LWPAbfhJwoV/
+rLm06R3C8zsqM+vY1EOZvUpAXy1hqVRsY7JaJz0pkFPpt/MlZ9qqj0319Exrvqbg
+orVBrZozCViiv+zFt1U+jbnHMnocmsx4WaWbxJxru060kWazm5mS0MLWr00rs1qH
+qRWGJnOxSgRHRlZVmsAaOL8eJ3edQA4zxAf8ISic/xuHfNG0x1E9uNDoGQAa/+aE
+kaIYxOiiqTVgeV28Ppc8GcmeaLMRNQI7A3hJqAZHyl3yMrbsFPKLwcDfyQ1yYMwL
+ccGGlAoXdzxTneiCd4+1nf1d/hbXok+417o7RBV53Scu/LUwL+WtOwJeVu2AGVjD
+/mcJFGGuGRShIL4m/eun4DrTB8NH0DG8rEB8fOsOvoVgXFn3rFFdSit2nUdAA15T
+MLPh6B9PCr9SoqJNsi+TGve+MaIY5OPZJXMhDcY8xXe08zd1jVqXjy0SlcJzl9F2
+y+VEEXujhKM0Y4WkwhjM9dcZf/M0VL1idITtR/K55ai90+L39MTG/rt+XUqAGg1p
+5LCyLXkFmkl8HrP+3PC8Xu++NdCtCeEpruwLWKE0hVToQEpe+VxhC+pbFjIsHA7v
+6Mz3znEF91s7w3DZkeSRM+4YP6ViTCw7LhKveNKhiLcVNJ3IpBEdwhrqJUTh2o4f
+LItUDiAEofadNiAQwlpQ3gkgyA4LlDXryXSKBEZySb6MEGOLpMh79c0MJk52rj7c
+7Mc2fZGAjL8xtk/jHIia8dpL37LXTkH6OysvARHVlxpmRwpbIAR0Rqp/zTxEGALW
+NLWol7HW8Bp2Z9kz4Qn3LYtwcmbNvM+hqxCyLMBM9LTF+N34F2Q2sOT6FuaVznqG
+bwF1cVCo7lt7GF4+/ovzCerLY3jcALknDhctrKuLc5wW3olTc1JcbkX6goTYpK9N
+/B6tFoxU7xqRGHMQkYT8BB9nAJidwyYXjlLd8QnMBnkYqik/YB4HgpHM87lz1Alj
+uDfIEj/HvtvAJWsFcup4M8xaQgKwQBhUcmw+REOvqq7KmHys7dZEJe+qIxNyMOmr
+pRtzJRpOtdn0Fjsm6PiwRMel1rNcNZYltRkpkTeOUt793nR3LIbyu0H1Wn8Urgch
+AUPx4HWlwaiSOyhYgeIDQv5/8Z9Awq5qqR61QZ+IGy37EXboJ9ARJPclEV5vnZpm
+vT0f1lSRUbFIUxqiWA8+f+/A/84sgLTZ07w5SDdMLZB3oQeyFmNyNs8Vq1OLAuvn
+S8SDu4NyKjqPHwxfXCjuS6o/Y+iA6ECX9TERxGsqKpSjdo7QJJ2dKkS+Z8s899Ln
+APuVeu1UPVfmy5+k/h31aBgWLJvXFfGkCsCK5kcBSPe4lvxjvGiQOZK2JDD0j+Yi
+byqjSGqiS9v/UhLlru8UbAJ5tCJ+ch6PQeigRH46Of69V+gPt8oLTW2g5QbFVIHY
+kAvdbs6guf1vFwA72ccuD8g/LpPI1aLwNppdy5LnOsjjI9g7ZbWx+jSW/NZbjt21
+zSyIeOWDNYaem1hxvpCyPQQ3ykPE4i/ONFxON3qSdVkAO3+GCMUh1IvxjR9uWVdi
+2RbI/sttlf8WNN+5FR4xNgpS47NUAm66glURCDg1Z9lgtBQlQ28RtAbbv8ZO12Ol
+wrCrx+miGCxEQFexpEb9Wklp2h7KWJDNvqws8tR2VRrSL2MkfFF8TL36zoMZs1uW
+Sjnxfgcfit5R+TKPqtVUeZAu8+iFY0drEvPwSmiaAb+V8kqOE1Q6dp5lA0r8ZBWx
+AOS/miUbP2h2cQ9qLZoOoKYCzpR4IxaR8vI/PxtPeDmJnwRAaSWRWdp3s55qa3eN
+96bW1MDAvn/BqGHLSZfxVpv0+GNCfTrvdhQgsr9AWzZco010Aec8yx6iUpfoJmbJ
+cCYkIYb2C+6EwKv5Ep9LQsOCR05Fpd6S+UyB1sh/0eLNJT51HbKunvGAnu8h4FLb
+dMtgEEJ5pqm80rl1bXPTjlV1ibW/STn7HuZFh2OPZFp8Jx/hnxFl/m55Yb0CsGGe
+9EGjwTWpuZR7xhWapJ4cKHMAQTSJX+JoGUOMXnYVEcTjlfrwfCV1nJbxjzMK+Tza
+dWH8OLo6MPBxdxQsVMcKbY2h0OvS8Frl9LWVhjZ+Gi33JHfraseKpkg+yX9h9x1s
+jfJyeoXcv8YeU7RxDdAFX89HOx/V2hcPumReBVPtEiGgthOQHsfK+qxzccnbNor/
+AaY1sssZQVQ8Nb2NbKDtmRdftg7D8VoRQL4wo6SNPvhQMTPP8jVj+JBfnubWLYV4
+ApuA66gonjWLjMnP3jNUn8fyooyyPn/Dxbq3mUoR+ogLy7IX8t4no235P763fy1r
+Qie+4HxD6LSrChXFBKOJ0Okac8QA20HqOH+t4YUj4pgaWywgqFdpIw+2Zh549q2l
+/44iyJ2zYhGhz8Ah08aLa1+BAkzSMGRsUom3PVbQh++LaSO1GLXdTUNpkalIGGxl
+oi382GlDN8CrSHq6GUo0ISFAd+zkO0U2azi5RHWAq9KMfoP8jNAfIi8qWqYHtthy
+oFEISmALN4UyNTk1Q5jw91BYjtdbgn6O2w4BPYt0zZ77rH0wV81VQr2eIHS8E7mL
+UNJnyeIVBg8tMh+5qjpCROBzTBO+ZdJiXFUjlTybPhlG9sS7w/6GdgvUqN4D5AWg
+h6/t4tqhT50Jt8yAKqZlQj8Blf6aXUJ7eZVHediA4q9n2qIY89MCThr5EgAG8yby
+qawfB20h9SJiPT6CAg9HN+SuyXNTTuLUXknLEQ0GtTcIj3ufMN08t36ImKSxHYUT
+pL5YVRhT3REifg8CLuuoRQsHsMUkZMcTlvU53GvjmtdGUUOxAZIecN1N2S9hGcS/
+Fy6U5qozpnVpoytvK5bPrlgTamu1a0l3TevPtu5OXi/XVAsHbsLFOSav95HvNLIA
+wIdXUfRhqgk8dwOQ6ahEnVbVYgs8I9l5+9F/Ydw0cBfA3zLMyd2IbS8rG53LMZ23
+uUO5JDBDX+gvnm3/B3fZ8tiwbAP1VnltoAtEU++ulth/QnTN41BiqViUhNB+wrn5
+JQfeFn0Mt1sXkkFl+80eAacCiFVeQSCOIujYuintjn4EkzMsp0kXI4UVoKxne0H5
+2xeXSwUMwCTZdRT5rWKmbER6MkKKvHjjq39TEMfOzxyywZnrIDOffAOlO+2CwjNB
++hArbb4+flO3yzVwNsHegvmXgeEmz2pZaHrZtQGKDaM60EI2YRRZcceq2hxXex/k
+WGT8Jd/FTIZv/bTkE+5QxKqa4iijm1hT8a6fdmXic0CKC3zubSRwNzJU9Z3m2ZRy
+NGKcOzNFvn4xz4STBHvc4WJn0Yk01N17to38WyPU8clmoteJCYjXQd+n13smcvgn
+TpZHAI/ZMkHUramBK7pOZ0QSCtf6UpuYvgrOIlszBaKc6KxAFvSwsLjFD2bzwc/s
+BGGgVTd1/kcb49yGUblQYRDus4rYR8IwvhGbKM9PCAa01TnsUFU5a3bKH51SqPzG
+I2wxCpGRKFVIkaOcNvOEhG2Dpn9fRI06nZC6b6tFSBIpDKXsSwWcfo7x6q2Ibzso
+Mk8TCUr6LAMd5B7PM94dfDU0WvzA1ni373JNJ8WYdzEISCYFGSZZQkrTrYB0Bca3
+h2uE4wCpj2y/yDa+XglMCcBmJftynHheVfOrydved1NEnf/mUoiqvxQHSXtinFU5
+GJLSS+6uibOlEQN3wtsQ92pJSAWLfBtk0r4H2VxxUAashSOmDEsBVeG9Pq+qvBdZ
+wuN5g3exH5T9E5f+ij/97Ve5LcGkGKR91OA6ROqyyUJHrLjPtFLz/+hEOGNV8kP2
++VINN/Fh81NrS0WYEbBcry/bMR8RcZ24Q5OibIsytaJnFC8iVib7gwsz9FwffQ/v
+8yDB+CCSJwPfvOoumYsFIQBPSHNgTJ+NwrNpaS2AM24yrz60enjnSWcoqftXIxBC
+Lr57TaZUDdZNOfE2W4QQY1BRD0BQCN/Fwfuyynl9GbfeM5vxc1irRkcktbvXjWs/
+yT9BkJPgLFWuxl5Uqxap3rJog1onsrHXcbonKclCNnHwobaB+YMSi/Y+YzDWKMNl
+BV8KzdFbJE4LlH2pQ2XVss3DbLoPvzZ7U+9Isg8hqhy2YZ9kgnCrEZs/M7DLaMv3
+mT1o9YClIRR1aPwViOh8B0PnLyYPsRxn1KRLS/oBhtbwvn28+mkCHbXsjIUXAOnx
+JSRBlnm/NDykJzCJcKWzXJllEVkAlNW6tqM16h38R+0LT+TyDTj4ZQ61JKyAWaEN
+x5z+CiAGAUXVyLBjvexK8rm8q3ArtBzszIouBAj12X7AY8EaiuvFqD6ZVKqnhsmZ
+2LofpbWPbPPZ9XnllYdrluklq/zaisGKG7KlJoqdL+wDcu+xORl/P0zQ7Ld4ucba
+V7OlWCaWuNaZby/OoKL+SvD96bxc6ZVP99/gmQHpEHSr7ktcAuEwypike1abagXQ
+IYq42l7/FKMAbHm7WyMlyvwz8Id86afe1+ApPMgWXcMkwXCjpCvEQtGKRZqTjvsW
+UATtPLwFKZ81UsScw05pm3lJ7h5jdOQozJEYkke4gZe2EE50jyfzHV4KX6nb/LEt
+1KjG/VtvJY1ewaUPK+howyVUPADo/Z75gv4h3O9mIKNyw4qvK8cFZNF4x8N1N/8Z
+GXyIQ+sPVLmj1V0LFgCuLlh5G9OVjUSZCu5fa8CfvpON4duIXODMmqj+RBoGAJnw
+aFVA/H8YTWIfcsOjCyo4WBPL34SL58grxXtPdGrFd/tHOy1V+dZ9WDwu6RZTrl8t
+FZ77HisVyuQusjCv+vq4Ivr0viySV7EWIU5RN/24wye2P9c4L+E0w/BUE52tjPqf
+UkwGDyFvCCeXCNLJOm4dxq/EhHK4TddGeaR0UWxzRBSPEgVHPEua+ClZ0zQxnBKZ
+dvbTCcflRWGIkkTE+9TJ2SPFE5GOnd94Xv/fICCBL6SDx4vCpYSB+BmO1wmWP+3B
+6KE5SfyS5rCVJTYz8MIxOVCSjNbCvH9oS1aQjwgOWDOhrmNbEAgwzAg0Au+mZ4hb
+iJZVmwW9egbKBjAJ7Z/R9tVclH8NNpmyCaplBFrgTOTufOii8TM8fj6Ks77Uynzv
+BEYdxbyjlXLoV5vSIZC8AMDtByWN7MH/Wta9P9/2L6xd1ewKPwWyeaANeH/6Me5A
+N8GNnk61yRy1kPhHUjzTmHJ+Hq0B5omziXAnIBXGIKjL4rQwbcAbdLNM9MXWf7UV
+viknGIxyo+c8zBwxoPJCzu/MXtvLfEZkAW6i1okt0tfuPZlatueFYhR4yng/wsqi
+hmGxOlTFulE2G4CfxgPddceQwniIRVuQ2W2JJRSCJlZrKF1QSMH/J++Fw8w570WG
+s850r21p8dHQYseT4SpiNvvdsbAYXM0JydMxpnf9lnyLldwgVFPkXM1VUECIYWnO
+AVcM+FlEl5fehOLXyYwQGu52EXWE6I3GULXc4sdBxIVcKQYov5ROwxcbo+5VrCSZ
+X4HLK6JN8cT8+m2lvbNZq5KiwveWzecQRMslEa/UwpRViHeBVltBf6r01XXlNsG2
+83QiviKHCFc7zhlEEbGsvR0iRO/PnUkeuVqaUFfDLodqAey9QiXM8EfhSNBslKr1
+lzsAwrpy9jKhD5AilzhGiaQeu37q8tXDm586/PzA15BLF5iVC1AvIzBgnLJM4Kca
+MWDDT43f6S3tfPkb8qU0QXfGI6U4ClyAH4YEQ4+IUkL7hvO7ZbWxv2tzm8l3ttNF
+BokKz7VENd5doaUGWK14woOK53WxWvmf1t/PtQSj5RQZ3lig2bhTkdf9i6ndQvkP
+TskcbpEW4IHqfjvZcnMk+LmhMixSQH1OWStaIphqj4hoqNhvSogVU6Dfn67amV50
+53NxX/9D1hyp4yXv56woaSBXFm4J3yPWhUuwCVC014OT3KY3LDheScCOdMnEotTs
+VgMALLsQ3UJLFp+XiEymY/+UO/ufZZjulONvo2sbEizBTdAZ8xxC6oEtujDGO3Rb
+2r4z3vjkIhokQdV1B/heAL74PlgE5Q1AJl1CL51ZJhIjV39uTSBBeZfeWRHO+f9v
+2unLoMF03CF8KHe3eZ9/h/hhXiATeUz0C3hbxgVTszl1fPX2MzJlxPXEVaNPpiIx
+B2/CdPZTbFZ+dEb0fp7Uzgvj53Ie7eaH+a2qpV18rgAJxBCdTkExBQTpdSJxWZmi
+zOMbhFPt0dMOGLhs0vyTi6qBMNlMeEiHJ+0qbUv9FipBeAVJIjck79K+Yw0DQm3c
+enS3xGq3nrNHMAZ/CTRWatg/6yvZYbqkq5183Ai0IDmA0C/63ksMBZbYz7ynabxg
+8yhchUeSUwPOgR4gU4pus5UC38tkLJ9urzmkIHCbhMVPT3iVB6G0MtaX+Tzrb5PA
+rCPG2oAUVO+8t29Uz3NLjKQcQJgicUM913r6EsW1T6QMtQseRbk2khCK/y06rdl9
+yimWciPcqCmlKQpE0ojvoIvvdq8FLM36UZdfBeU4wA4pe0468VrniYCCexYK/uCv
+iIhOf+SsQk+kZhNH/MN6i88TkpR6075ze3nZlTGGnbPJsC8McKSO5FYi0ZTfaZ6w
+u1AhQVQxE4QoDR+OH0aaqC64RJGkkRlaPxtrNSeuj9XfpDHhp8kih0uvRJ1FiB3p
+T5DX6a1XJeMviCqYRWTM8rSlKqJTUgiBG7u/RrTcWBtHzHdATdYs7y5qaNT58cf8
+G5bICteFyEPrfIR0TGdPAAydiZ57ZCU7S+xNq5xfQzdmtPqRotcbAvS/jR3W54A/
+96rpOZ2eGfQBg4tUVQZ/Uw/aniEipq4ga9qajuikv1VWjKa2DvayuYQEtvPgpNVs
+/j843I8klxVOQFQPpLcQunC+5b2jEu1zaUkCJlpykcU5l7u7kXaNI7YPT18dJSAH
+ruUYIN1AUtWVfofK6zNAuoP2s85Sxaggb9lR910jKbodLTCbEW0K0D8qPwGJahsO
+i9h7huoPg7F+SGFVAHtG6O0TxcsQ8btx7Sq1hyhOi7kL5Ular7CiWQE7lEHbh4gQ
+NDZ4gjEQEN6gT0Q8EUy7xdTO6fn23ZnVqPH8B01GhCBwftpc75hXD7nFNWtrbrAH
+u1yMYkxpvWE9G4d8QSPa+kdm6G6ZGb6X6j6N4oV51qdy29sniL99E4RJ27ntw3lg
+UX+MxdMM7Q648Po1k6hwxzDOCY+4BzFnoOUjgV5kPs/mKy1BSpBa7MDEtjNZVYUK
+sXVoMG/KDUhPOmjKTHGgEHmpcJbTMmAO6hodXYXngDj1Ay7u8EADbfF6H2bF5lPR
+/bi2xhhXrwdjYwA/PdmnLTozc0KNckJr2I5QVzABhMITN7z5SBIpyEnvOM80mv9G
+j/Rbn4KQtOMCtBrLd+T9xpMICM83guoV1tcXuu1y+c5HX6jrod3dvcCsEqJ/ll3S
+d6ViKUJdLU/dBqIjeMPvccGQzVJUlqJF4GcNLQg1n+8svtxCatm+Ii49IMvdsi23
+o6VIf8AwGMXNp90/a9ugxWRbG2p1sWokxuLL9CoS7AAbUD+WJ0qPkn+9jqt+bEYz
+mB4+2CiFeX9qp8E9amaLkOZwnm+bqrnbkjvVH0p56R9NPtTd6KjKjznSvLRgQKRG
+0mqSis+Rb8xoaHMKEvqYvxIL4zRH274lvPDJhaXZC3V1oQliwT0gS5dAocM5VElg
+ktO5a2Du32zkT56FuZpZHFSU6CShlFEJ4tRK05evX8rkvcIIdTdTRGvRG9vmNAP8
+y+Wk0AtfTlKAUaHsvw/amP1goaQb2ChI1SgzvYMDpDz6rJXBtM5UX/XCsrTApE7O
+Ep8mZ1zOCMjpT9//CdbzfsJm/L97icCWGAHmqJDxRTTpzsCuzKtfBQSzZ67/H1aI
+NfKL7z6teF2HaK/mwfcX2kpNpIFe2aknBEKllHSgi6UROp+TSN6Zzwt8oDTOAmTL
+w2dqu32mDLwkIXRnzcIIcWP5un+Vts+v6E080YgU0OmjbY7KV688M3XYwb66K+H5
+QswoUWFxZ2scCghOpNvPV/5KlK8wD1sLrkd9cPj6nAAjdJAzExHXu0rvmne4Z2HD
+Ab4QL5pFIyiCK8OeCzMHEDmOu2a4EK7XH0aPxGb+iEcQ3mtpuPNDwwu5JZoT5Ys7
+Qd2cBrBQTv5GtMnCHCyM/PUXvkK2xQdf1rw2ZpxMz8Rif2Bw1iEjrrdMbSC1nEaE
+e87LCaxRLbIcjL9u8224woX1DHriAlRnJjRoG4M0awBGSu+vqiav5pAF36/giBum
+g+0bxDgmA9a4BVt0g3fgHWFMwYQbNFpNheSvRC9m9J34uT5iX+c+k8v9DIwT9H1i
+FdkE97nli8y26XwKvv0059VXbSyDBzKIa7i18IAs4Iu73wLwEuEMDjL2TdMFpMBN
+8GW0BfllQm1QmDPhXDfJPryT8L2b2sHAFrgio+mh6sR61YuQqFR6KyrcirTtEpxN
+YmtqEWxTVVHAqayD4RJaYVXhUBFZAMP+STlUVlPM5RgCVtem5hXEywRvQypo6iM3
+KHonCYwnfa6yBVS+cwB14TMR0VronDFuNy2DnAb2WKcS2amVUwteLuFcZ3LkPtXc
+RqA1LHpbjldfKTV+95ULGSX+dv/JM0OdoxnRKRVUqXG2iZsUSGNKqjuf4niNFvcR
+hdjnnZZAiAPxsvdsIMIpiVXlKVwcqpizx+ILDMFBSz4y+HKvhisCNtUp/EPritOw
+zjvzmpIaWY5rubvo8DEZ3XS/46vjtbicGCyL/IGBAFDhkK4mpJHzJMoubwc5RhFy
+y1hzfwrThy/s6eEgD27y79iQM8n7DY8PDXQeXwUihpyY19oYK9ReVB1BA2MJSyeL
+HZ7jiiHIjbXL3f9DPEWJkRDZtg7ZoHDA8ZwmkPI93v0C9QtNOywljv2PlhDQSXMM
+p7Igb8mCUBWLZ5Txn2h7NcwxgI/QqmjTbgi7C4ndMaJ5dgnGNzJdlMmRWg0ioydA
+o85iVcsl4EJGE6YoyI69gBs0nljAOJ+qL0mVBh9AJ0acUxaa7F2Ko37oYdyF6W+l
+ioBiSrrdvlUg32WnUcZuiT7+OySmILvJKjqcDPyPjAGb6Ody1KTAJh9LJ9nb8N0o
+50URvIZlMwzoZoc/rMtvRD6QxqKI015looskQwej2JTpQjCsZ26Ye8KReuVDe5w+
+YbkVMdCv/ic5TpNomSyTLrcN3AJIoZ8wAZevEernTG4pkkMUqe0g1KWnHN7Ek29F
+q+7S/deRg+JOZ6b0CooTPGwK6CuBJZ3b6JZZNEfz8/+8FQ6/a+ilIT5tHR4H5FAx
+c+Ef3bueFkR8y5nl55idms7vvTTVTXHNdBu5w/D1C9OU/F02tXEuDjtqGc5sE+ig
++d2oiO15LFkvml/fY8/kOBCSfncW9mLZdJl8oOHZiRk2RKjD2ioNoGmj9HC17NJj
+myv7hXTD33eCrEKRj1Q9kZlAy9C7rGi+/vvNFsfIcnmR0jbL7yZo0JOPj2X+bQid
+0ak0w4CYnWYk4Ith9FC7l+QmAwnpf1di0LRK83BtGb29BpWugaGJjERaRqIKPnJp
+yGQcowHnhkLMFAMxqfXiH3FqMHPA9NTh6elyNApnID2BQtGC3EFUnvRyQ39wphvs
+ZCRdECMlyDBuW/RM+qbsOTvwJBiHLEOYqw96wg1moSJCUvu7332OYP7aaL8ka3ty
+zD75GpbcslAgv+o6DjnhYGkikjDXI8bqkbFsZpRV4MXjrtDep4yo0Pk22VHrM4ri
+gk4GNaJFot0juzmpSdJtofq4hNalMdpBDhxqxWiQ1a0AeWlw5mAF6iXV2j4JqAI7
+Ja1ec+O43Jl0Ehfea3dE7n2/bdgFH3c0LcR5yj5w2U0jzmOwIayd+KS+YAy+TvFp
+MDUe1LoWtl/ZnuDwq+PBhJlH5H8GPmJWMdcmgHtUBADW8KCGk8KgounmT4514PzC
+oWY8X+dxV0hiUfYu5qpxxBus4zyzOAe1E6eS2Xk+cL1MRTP7+/xrCLrQ42UaeH6Y
+g/PybED7Oc4xVEeai3IDQk0d9p7qZoRjAWIehYXBfftqACrBmchC6kDww7YY0d0G
+5XS4F1Cua4/Lz2R+wLe5ztBkC5/N8ab351Ayu61q18gDrpbZZtjzbk03vDau+unE
+v479ggEN700cbqfdOGecAuTJ1vxdChV/+tCuOBVgUwBaFTocqEyqS0SYEZb9jlKI
+kobYVkOUnPzYXKEToyCUTf3Ji5CUpK382SyRW0ElRE58niNsVxYpvXhVtcWxCmhJ
+gl/37a//iRicwSVBMsho6dYvoA1jJGzPY49jf/e7yiS6rbWVZ0FmhGWWsTyfj8O5
+F4XWO5BUM4QVVt5tIMnlQb2+NU0fmSOAQPuZq6bCvIVgeQ+wQ3uapj1avjZnaivY
+6pJHTo+C6UUmo/+eEo18sm7e+5RY4dW4m4LzJcaNjgeYh+DOBCRJbYzzpEQd8ChF
+ojZf1NIANH+PkFUzwrrXB1fDDsEvCtCipM0TxxHBiwnvQs3/6Os8I0Nk2VrI1q8i
+PHOeOqN9Yssu5P5Z0wTpeSEI/FMwnoDquX6ho3YAoLy0hHRW/zUyuEj3+EJuj65c
+fBcV4t/7Y9rc8GhRqL37anjNvodu5xHoFItZPV3+3DXAM6f7zrxBrsYtrlW+ZRQ9
+AC3QMmdHUqvZ1yeE4a1rDFPznBhDCyMt65XkrOB4LAEHRgGqvuNXZbBB0xbwQXoe
+VYskg3SyyEoF6S1OONUex1a8y7HK8Zr+cRWSJ2vPvS4BT04NxCA3k8jmQhhCYqkU
+gFo5jKI3sd2GUPymiDRukTI4UzZWRDXkYa8ur7HCDKCVAZZoYpEtz/edIqhWg4HU
+P1fAlUNhVAZxtamMaOqYpbs3NUOfBxdl8FfSJmiQMBJrKomsrhyvmbwvXADgvk02
+DStcp1VNaPczhrGqxvMreo+gPz+lEOwxCevwslooNr/5p1zBh62NvYVOVCfYffhg
+JNkcl6/AhMXEB2f22O1bmTjBNF/luDdRb1N+3LS6wQuvS/beeGAAb9zME2HuJI6h
+PhH9r+kc8oaDD/iwdbfdfMxk6eqrKoG3IQUIwRG2lxjL/WbderwhlGaGsqNigDl/
+6oYrSM8lqXSTNrFJxZ/CMjG0TK7mQxvr3Dq98BrURC3QAIFMv8NCfCTBW0IwQ2fQ
+06anPUuvXi65d2venK0ynycGk8CdiN9iEXH+aqDn2yi0VlraACG5IpGKiLxFN1LB
+Arrcyib+RrXhptWbSM6FRinUkn7Q5NVVWXTlpDfOGrCq01RFwnLS7UBzACxUiSAQ
+wiFRFylNF3kNx1SDlCm3Ns9tZbngkE+vCi/dWTqxYGKsaEBug0axbZ2YiXsBxOGw
+ij7EBiTuDM+e8fqu+2nSh8Rb/ACiG0PliUUo72fFU5s9BNdTY2anBC16VTkNT8EJ
+jpftTEJJIl+JsVZ1ZBZuDTqwkVc57tcpLF9dRfqLjaHvqBEpjmz8S7bRKWaItk1P
+J+/m2NlWMLHj1ClUNI9pUKGKs6FQkRMjZEB7fKmPvnO1voexXqm6Fv43Dz8zqftD
+seSZDpAVFVnlAUgCKn4V8szkGvaQaOQXTUpLY7S2trSRpFtCce081pue4r0gP2gR
+Oz89zywTDTo/9g7MYmgj/yJ5Ag20YG+N75BPz2FFt0J2p+Su/ptBgspW1Psgb+VV
+6XapC2RntiTXXLAnHabDCpL6eYN3bBzINYvAUz5ylGBlCupFys9o9I1buA8vNe7X
+agxE18M/NPrEVD3fgCNvLE4726qs+WXyWz5QgS2NFl1VPdr8mRRzaIBAqgkwknHD
+SgwpRfz8bZb1Nvtc/UzIZsrwpsMk3+mH1UIJpgR4GhmAC+pZGzdB/LwFsvXNLU0E
+64mMzK0JBcC9SThcXkU4XXkI/uo25/5J4vVJlL6kPu8iaOucXwNE9mXqM8GcXyXj
+ZWfQQsEuHoonJ2nF/Rp4aMaf/8zrqlKIlWLQohD1X3ZP8uCWkJCYhe8ZRgl2Zbpe
+5Zs5uHhQ9Xexz//ZGBFn6IUdtNiSbwWP/ygctenlDtXV/ypkmvDfOa1dWBtpMGKS
+IyiV9/zf8+D2LC33IBtyScB5247p2u1FpkcsMuyBIGCmbWvEipGS1nHCl22yNWa4
+fddA21kdDFPgaT6FY0dJOlFaNPWhpg1KbPAPngJ/bX2u//ZQyyhzjT5xii+0TZFj
+vMgS5tK+o8LOodf97FXYfLlM/WrcQy9mLpj3tDQoOy8WWfu9R5FL5UBOXFcGW0IO
+TexzrHNICKNMGYQqIBACmJ7MKeYRsWgtm8rMmT8ZhPF0Pvtki7PTW1W8VVjPIeXd
+Mvm4kY8SKlJYZHjaBQYO6b8rmyY585NeFxn2moQvlU1ZlHquopL0mKXGwMQCitTI
+k35/WbR48cdxLAAuQGAY/Mj6bAGCxZhvavvNjzsnNmxyhS30DCJHg7k8uG9Yyw5X
+RPjYUFSqRRRWo+Xq6lcuETXH8MFTwh5ju7ScW0sM94x81OSU9vP22Ez9LcwkgOHH
+/bajq6yrkShbKEYKt/qd4++CYRdX4zJWUQTKAhES3WUbNfH15I7JvZhlw8OEVZib
+XOpUD/8cHSd9zKS05w+STzRnVFJVz4vyx48Mstuur0yri+gHMceDSSLUlyeD6QEI
+uZMQi3fr4GTTPYlq9zr/SBMPa+eLzbP/LCgxWgH84zcECWtRmZPidmKV/zEDNSuz
+ou44+ACpDhSWt0RWCE05LAtcZUKW9VhNzx0py3V+GURWSFYGOa849dfDqyXUUXQU
+1AoIwffyANVrYjsXbwvf/sE5qQnmTrzJYX+5LSJ8jbYtc4Z1/Uimgp5flZVCdbfj
+vXmrnV/wjOHeLflX2XADtzXBnUG5PcJgOqZHMkQn3menbZVGqC87vkKRRdDBMIWW
+JOGNRgVeUc5G6nu1D5mGnBXJqikkMB57cmelP42SWG5YBo2YFPobge5qAj7R5szg
+7q4Jy/UF2C/7UxHgL69mizh+oOazVBg5Oyq8o+FvI68dprphoDWu1tC6y4qVITNx
++EW6X/6ZGg3BMIe012zD4z49Z3N9Ozl6MczSnBTAPmCAtU3aMEs4bM/W/uY75iZi
+b0Sph1smOPXXDk2r8TY3CdsbcUdJVBsnKOkzU0PmJuhziYvKE/oC3lKIT2r1eo20
+IbIeCvRlruSciJ66LULMYI+xlq4tWHu4prB+jgOu5TM38d4G0pPxfPaCQwElfm7A
+pFaTDLqaDC7fEh8UVtl7B7NKewqrxuvi+ygMSC8i2g7IWtFFMQOtv/4TcLkRqVLG
+HTiRcoKYN9+S3yjf56Tqo4NsBdLCIlk28VPT1DVlANxE/QKgiSJlsxseF8x9ZKfT
+yyM7MnzkkEIakQDBZr0DvKTnWbgip7KWI+sO8Y0l/bjwKn7DBdGpdSJ7mASIsf22
+qFVd6JKCCoTKHWoyjgJUU6qaS563eRVWw0oNklOfb+TzGyzJOptuJ7IKBOlEGYIJ
++q76kWGBmnAcRakR7p7wX/vWpaNCq4qoJTE3Kz9vsT4OWny9XaQxga0nrZmKES3z
+ljf0MEZiMkq6NlXTcmuiONXnA4yXdk1BRfJi45xoCiOD/pbNZkoDX0DXBmsUlcBm
+XbGio9dtvg87TzyiaBAFkAms290eSJfTOsO1VDI7WggdYxNKZ14qRihciCxtapUb
+k5JRcgFMR08rRkwHCP9P88W9frdy/5fHV2pgYUbnQPChmluPaFTVp7xBf+sn02jn
+3yehQSwStp2HiPIMSiB8Og2sd0TtuNV8tLYL+M/vWhbcT/cR140hj0wqjlcL+7y7
+R1E+1KGvQDK/Zj9oBbv0fjuizzHgomaiiU13AZT5R0SJgmrhdNM0t1jdI+b7w5xp
+qHx2YXvB5Gj1pLcBhrMxkdouAZdOb8XyBmgNBppnzd40jISocuQaOdrldHgKgAtC
+/i9hNgt+Q57fuzFDJwCOyUR4cwXt+YW/dct5QtPqHlsHKwokoA1hPsRdw/Jco+p2
+SOq3oLTpvTIWuh2reMpMPdQO+2E4eKnQLVRpffe4T0VdaU0/NbPicEB+kG55WdNX
+MFDG8SaFkSA6v6KBBh+B/1UootFtOif/uM1OYzZHk/9nzgH7zIvaJ3xZ4JejhtcC
+6dYoK11S91l16GkiKcl2GvPTPl7MV5+FMyzJoZp+mpQ0GlTOCMRi732ciemLXO7t
+NcLScCno7PP07ZH1Yr5qNrJCX6P0mvbMHCDmw04oWVbvAzSgSuOznI8J2mCuJ0ti
+J7AAYZBSfQp12PlsxsEgHQahDXaFsupiVGv8oZ8SVwRAo8gy969jYcCbEicL1MeG
+3bbvQ2C6XAKrbZT6JlKLzzPXI9lcNshdDY94GTKHPw+3+1J2YBKjclqBiLV1J/gE
+EU0GxXiare7ImSCSTQtjHkFlssAUKVv64Jpv8g1ABV83jIH2rpXH38ntSHwxzDm5
+sIYiOVLLLHOPqr4/VM8vpfkLbuVYDBMSUJV8PnvViK02x7hWuOALWB6fhmMCZctl
+BaeUybAI8GZR6nLT3Dn5LTqfg14tA1l+SOZCgvLa3FoNS9PXyo3T9MQl3ADgf41C
+oV3Wv+SdoCWRfdwMxUhydVU22yZsZFcUau74tRF14ueWH/dynA2DC7/onah+jwpO
+W89/bMYGW6+czxob4iv25zoM2j22qwKdM2uQvAqH9BhA8ePFO8aCk9iHqsX1oysE
+eiyRhH+NfclYPheCWKr00l4/PqMxjaeIEC8MadVQwCYW4/4/kQbVYeJFnLh44en3
+GIKIRvmdGpNA/rIWtR7cjF4YI1/1UjOy6BYFLYOjKngNLsMhBOJFgX1vkkp/DriS
+Ks2Ln6g2/8z9bTZu+JlciuQqRPs0gn1UQPbaO+Us0B7KwuWAafbUEGNtHG6Z2VT6
+KUiT2fD4YOECaRvw5r6tpZRAF9fzDOWyvv14aCIqaXg1XT9JsAUAdJKi2BQoF/Xp
+eJQAOOIVr6yzTowjoWARLdCyaN+UcpSLu8W1T8O+9kbJ6SwgNfNqO++SRhF1Nxfc
+9Nh2cuRrcD25iPEJqY4LcLAxprquHtwLlkS53zVBWywN19xyrqYHnzxwdhuc2QQQ
+/a4pIR6lV7icCO5XX4NuDv9acDwSWcg9JxIP6kW81tMgdzZMAm4+2eL+d74teTme
+8IWH+qT9Oe5nroWj6K6xSmPBmoCI5X8lSYJS6To4sCI9OIh3L3Kb2V+B1Kg09uMU
+/f+HYPbClHDC2K5yN4UzX7/YPe1h0fV/L7a5vObWTMK8YAdtjAtRspa5/CStATjT
+rRCjv6SuEXZVhplTNZ3SAgSWZyYutJgp28S54rGM+NWPYAjvdzvJdZ5a6BGBl7FY
+wWj4Gs9DDrv0YXS9v/K+IAjbJhf7JxM3AUYRjBWLolhrKcBi4lIrizZYr79u+iwM
+rUtQ468KXhT+vrjNSjpMd6sv9rRLclXo7VJvtWODYwzr0AdhplTQetxpRg5X7oIZ
+mh3RLHG59ScA3U9kjudO5vJJHhGdiNKMn1RZrim3YuB/vY1wNM17WoBcNH2Oj0Ui
+vy7dFfjD0Uqr5dR6XsD4uizC6abNQHE/0vO9LZcyvlBpJYziVhP+xzbYFJRde6Jh
+KDhXANMcax0xawc6wZTRNXgn3unRLV8ZTsrHpfOLZLAb08kmXqW4kDpJpcVplEUL
+nW9VCksMD5JpPO7JiP6oNZHbFIgHHtc8fvIzjQGFRUequRdiWPd+h7FzFCfzbLzc
+CaNA0P/4pRkr0yOHWh20xA4MwusrhXc3NCsBLKaINFmoTuq/eVFeNpBvxLz4zBUp
+o3a73Wf65ite7AXVkz6uv3qCz5i95uNQ7BI1fXavOVzNdp6Dzzz32vydjFhm8jBY
+n2HLNTRmV89X2q5ZLy8aWHxTl5sZDRf9dREXc7NEAB/QnxgEDyibKahqJeYwjqvu
+fkfwD8v9rLn5fZG9757Uepju2FEDpLxavoedgK+wiF0S7Z7Vf0CkL9mGYq0Z+QZS
+29RgcIRNQaqK/4f7ztT2aL73wTdATfwTG6bxUWYSwn85yQVEWkwmi8Fkf+pofvS3
+qFprYgQIcISwefVZQidAdCX6QnTIL65qpIto3624wMJfUN0QV4eKsZJrUebs4KE3
+JBORKLzlqmBy5qsPEVUQnDxyLOZ+l9HrsijNZeCPLEU6HD4ibEYhobzkn8y/y/jH
+xYm7xZRGTxFTGb5O6gPVdPpjkxMrY36J45Ol7isebMm78QHhhR8tyj3qJBuw05Q+
+21Gwoc4ZTgPtyWVlaw9gyrCSG1tKV09KwKo48msIADtn0mJS6Zl2P2UDaRv1ApYe
+/p9/RHBZWF9iv3boHBn6C8L+ktLZ1tGXa6pJg4oVFokUs7LbjWpSfY5V5PkkiJDr
+w+YE2etIFMBW9RjnaofjKUOvYl/37tj6UstiNvyEScYR2nrPSuI1yV4DmXP8pPfs
+mdrifEPrWzwcFXlh1hQBhSy3OvxV177LQHPWwE9YnSZRqvSkHOahu92S860PlN8Q
+x0XsuOBER7PRDjW3l02P7TVMfkScsaL5/wk6aMYN7G1Tg5/K75ot16cKIg0n3YNF
+ZnR1z1AW5CDnabdqhRb+zeaDdzPPWU6REhIlgIY0+OvF6YQQawA3HMwWu/8lcd6d
+0YNEOvJBmKjY093Oos+IHzUCj2Io7Fs2qtJ9ERxufnEXLc5n1FDaMaHUnfHTiCvD
+jFhj/YMPlp/wGAc2+g9qL2Lm2s+NtuEg7gdi2APU6tKP5B3HU/r916PaJWE23Rn9
+Y1cUSGGjImzz1ZshuNOBERnBBc5UMIzsPiF/Aj2O3/LTRBSQnvDQwFBl6zFAJ8UN
+IDIB6xGqVOdh3XsMdcNb1X9BD2pvOB5kaDZ4IDCOljqLoBxiv2WsZkr17tljqAM0
+Tv1x5u0HD22pPHSYkcdg4aSJWJ2C2u05MVaDWrTlewk/nOtl4tHcPKzZK0eKTR3W
+NaVjCQ73QJGb6ZytkUHETMAYT9qJCppJp43vuJLAlbO/0EBAMWobuW7W9TTPYIf9
+9V2JBAL89L0f3rKIFDVYNpNpruAA/suGCzBBVt6/NL0q7FUr8F29TYzXlBrTW9Ll
+fikYmyFSW78p6jBoKhGLGAOm0CQTEOQKfbN0qg8t0ZEJ1ABn+Ysik1osBjKDGRmj
+6KMfw2danYkq0Ix+lG1nTnb9OEYqg5QOAQX/GUHYpeFt+abLw6M8wINXsz9BRWmo
+6HrQM/xMixiDsspQDJu8z9oALo8Ae24k4qgkfCX23uKyV0e3XeIK1qsLGlp1rQvw
+CKUzPyq11bhJIMuOSdDgXMfMaJ6gTTMesz8ci+KX3Awn3/EBMZLBaPoAWdvyy1ab
+TFryCMrQ0VYOSHSDSuTHDx29otu/QeUYYwoRI3nIcM2Kr6l7xapjfd+6fc5YiFtX
+3Q1OW0MVAepavpFOLvamNhdVwsRCNopDJ2h7t4ZnYePwrDj1Jc85uA7tNfrcaCzg
+BEtpxoIfl9dXzTHZsKGMsP7Be9BQp+oetcwaaLCK3BtsWCh67eMgDoZbSC6GzZ+i
+rZBIBbhJfZQuQGgOGLFsRdShRPlFnhy3CjTpKPKIV3PQk0gUZxLIp0LUkUjLqQ4W
+w9+bEOOEUDVLirQNk2T+I8X157j96X5fPADDC0hfVt5QtEQ9D/+2+i2iuNHhxJZB
+oLBgW6r5oehUrWTknmk4dGuqHHwSfjN3C8FUwS/v+bw0ZfgdG8xr1gUlHppbzxkG
+iN4OFonnWrXKNnw4CAT+vbcmbh+h1fSAnN8pl7lI0YQEHnqksf3ahQNS1PtVNf5k
+wR90HIXy6yqQ6RWDsth+adFh+5CmIwwbYMPUmWbQCAjmZMmpPzM/bIMWMw+Pa7/L
+jQtRHOJp6NGmuZBB13yM5MZiNHCmU8kuX5/64WPuBmTgsV5c3ayy4pczSqXVnky8
+QmWu9I//WmD5VqLJ9G32s5pdWQEfrK1BOrZjk7x1nPkO35vG1S6rDw1yTVt6xpHL
+1MQp1H0xZ8IsfhRjvEZUK17ADFYsqjRhYGlDiQwefYNaj0gXuh7z6+gejhv+iA6c
+REori+33/RObztHVz1krXMHFSbbX2ZG9I9b58tVuULyoE6avkr0/Pw0Mg2+vbTG9
+HHjyHWP9vB/5meP7RMO4B5qn/Kjn1ncotoeF+wisxGyxBJtCtdSeO2pmBvzfXgOd
+P44V0yOxMZn/8bE0KHqGbkM/nxujmox+4jaqeCFp5LIa17i09QcQECKUztdcD5Mm
+KJCD4rLKYoZPYFQsDyLOpdUhz8qJ2nrXCV9HnPExyVWVQ39BFK5vnvgV6sfwe7ZW
+jF1m3Pa+gAOySfW/SkCWnvlv6bAr5eO5UVa+RjjGEyvntchhGfk8Aaq1M/Tx4zqE
+78wnS5k/2SYcWs/ZdlWGucL88BozvP5gWYXqmq0p2HDg7x8Hw3XWEXZ0kGSkt0QD
+uVbYLtvi15z5eYFljbk25UBK3piHKbmPiJt6T+kNhhLtxnED9VxjjHcbUNAI9Xqi
+RO7yWh7tWz3SuIulzYQoVq2D3tUbMA7RRMxwuNc3xGL+r3Tm8uQh45Bc6PE7oP3/
+T05hZDiob5Nq6Ab7ndPlVGV5MqwaWG8iL2mmaahWUMcwvQ3uxccm68/ZuM+PYqxm
+cbYSokZM1vXavPyiIFXTqKIa9vlaLw5QlsLvbEhfzdU5ZygQGKQ3oge77LOURte7
+AltlM/oXE0SGL5AIg7DOU2r4Ul9IAFTU7fG6t3emEE1Dbd4Ule619ptJ5aOOY3Xc
+2rr58my+NUBERbv4YK7H9jhhZbwRdjy7DbsjyBHJHkUr6CgJIMDjMS8xvOQq01en
+o/ZuQUMNChfv7BR0IWZ5XTgnJou7dgBtQ/UULeHBwnEK1cBNF9uHpkHOePJBFOH7
+PSab45VXhOC8s57TO2A4RZaaBNffxi6K+NggWoITMh/ZuMzSEu4emjR6RJDw0Cc1
+mXzDctJWfFMHnYcbuj8wNdGtff8v5fy43YLnIOlEX/S4v5vApuFebo/gxWVWHJmz
+/hYSBYSmC6SUmbeIBXdghVx/287Xm8k/n4dtkOEzwOa+rbiHMHp9P5cZNp3DLiW6
+hKX9wMS67MmcN28MPPwTJXvqRYTPn6BcCTbaHAppUxG6fRMFNPDIo6JXCEvOVMpq
+cpNXn634CBlj20JlbtCRDWlJvhq3Lzy1b7Ca0WR6I/Gj7omvhtWSrTzgw3NN/yRw
+yGBFsVzWmU+9aCkatGcGjNIMQ//eMbd8F7oy6AHWlyWxO0ab7P52VpkE37uq686M
+8u02Hwg4vIRir5pH+1Of5yaBQCNG139cFENiIdLiM6BUerxSs4pgkeyPb84QMB97
+8sKv5nbp5rprhV2Aa3GuaYKWjUTJMba6w62eZ3XNdFRdRS6NFQ14AJUvYy7rWYjk
+WF37koLAxuLs08g0eFroEvkQ+H9q8evDsLRswVGwUHYQ32lK73Hq8utQZ58culKq
+xz2D13FGWSgMkFOL9xeSz2zRSQZ7343oqI/QX0Jqj3u0sXXNiAM5DACFqXug+OH0
+dGTlEVMP7RDMDm6vxCEZF5aIoZ8tT86Wxc37JwuIN0UmSILerCRWQi3XMgawGYV7
+QJkAarg6UxMz2nAkzgQqD6JFsm+2RNY6HSUDLy3KhUt1YVe/iyrxFi0IzlN+pbwt
+DjRZ6oUochpi0npMYkV9H3i2Lvoc33kXpMESVFnvrhJ8khACha+fzPtrKSnTfzWl
+B/E2c60Uym0GKDbaS5SK0HsZfe0sco18yYmAgcps8LNPBISrJk4XenppB+zAKa6m
+552ToKTSNNwO23FwOW2sBQlw+7IQrfTuVU416xbiBp6wCysG0IYIOeVy0rS+HCZh
+FHDsDfAkpLX13zSuMMDfQUvxw4v7Ll3Sk3BJhlXV6v9q9Oi1fu8sF+jHQ4ar5bg0
+zUgpL4d9eQ6c0hkj44pTcyvo0f2k3c+vEAC5BsAQ9GScdpx1PRGeV1uZ6Vf+tK48
+IdwUeO+5I1Kjq8Iq9sgLSWefSdWl+SXl9NS57zyTh0Jnf0IgIxktSvvr/OdzyN7b
+T6bb6UpchHDTf6uQph9iKjq61vyhWAoyr5n2MTrtoHLyTwAEj0S2lmXfioNycMto
+vIdnV+kqroiAraBWebtHdcC1hA5m7Ltaqr+EhiB4PcxZxh2lKBF3dkFioCJGrlAB
+qQu8Zp3equFO0qSXLdmw0cantNl9lDadLue3Xo5nCizu819mciwQdB3h5/axuMYR
++1611sLbScem4HBaOzS5IXRjOvzTEjmBpx76F/YHc/j9a2pb9rfrMseG9OliCL33
+7JNmAxScQUcGycEQ3l8RHtIoXQdNbqKtsYBdugCX22ERevHe2a1CSZdiNL15R5SV
+S0+LJEjIx9faJ8wJI//8ixZ4NdkVHvK3483Z+PcpBURSoA4W2PM3AoCegLBRisSu
+d8e92pE9gcuWwSlIYso6yx1BqWDkmQFcDx8UjuCM5qVKoQdTLFbd0pDwnB9O0Obd
+H0LLlVrhAC7v3HOjvfHkctqsPBchJn2Trafv9Wiagr6b/Q9g2YoVWQBNTiy+pxYA
+Syg7pMkZC7UiJLlRQxtAQKUW5WxQ0UTgzHCs4LJ7HxoWLEUtIMH10UQLfRRX7RNc
+t22fO52DzaGqGMX15ft8y039AI5z/7vI/duQWQUkcCQWqEy9CE9CXyaOcJjSqIXo
+DvuZqo84x2vZ1v6sCFMjKGIuZRxWDTIHHy9zHgc8Xs03ksJ9VQiyuCvgCgHyusyq
+1orD/fNYm25E04lnw8X9hAeWzdl0yDtBumCwYLcL7h/IVUuscN3J3hgiNTIW4OMW
+BLZ8VCDqw4fvv0J3QZ4jViF6TcYEx4+/Y2lata4EV3x3iOJ9qE3YK8X5wHVnEBjz
+yv9IerBRYVIeyHeJ6U0QS2OdWKzH6lzdVCGUbNXvLjKV2tSXfujRj0gsALmueQx3
+5k3Jzr6gS9OeK0e5jb2HR9eWLhXL84dU4OsjnvINlvUhFCEJnKXsUI94autmhI6N
+gfVMGVCVqtky6uJIQcZxJjR1OzC3YZNKQW6AiGCV3uzicKvkd9TkLklS9I/1xPwC
+vFknb2MLp6jnCpu+OWv0LbaW1xLKLkcS43hDMd0GNo8+8hZL5YCMvXigykgainZg
+oQpI74TOPUSlSTZ1iqf+20ew0/YwjYTpqqEAcKrTrPmEKA3GJwNBKeOXH2vLmhv0
+JGB6Mr1a5Yn3l/S5VqILRVDpMrdJboxcK25RDReu8OdOskfjVs3PWBusM8LfLMdv
+LmLChEAAKH0TOhyssiOipO5rYaW02MpE3UtP3/wuKEe8vk5XdVzMPMQy3/4+qylY
+ugWjRfEDWuPzJreyyHO45NHZbeVf9ro3BSwCcQ9eaUUKep08POhCwTcCXShyPway
+LOdgWgARXTrMJaYnuaQRDuNoxtYaClgplkQuRWv4nqon8kz7vfGAold1iA1FAz5M
+Ifu7TPy8bRsfqobU7C9WRXGNtqGUUOjvqYudg/VlNaDvEAu+99NOSlnmB9mB2rz+
+W2QxAlPAWkXA8DKEJ1hjC7mCavmdpjCcQlGGoErfaz9n80qiili5RpxWVrQ59iPB
+8wW04++kUe10/axhr6c35WNMx2H8QhhO0gDSDUC0jG/KDne0DJ4T6Op/qqHV4Qxx
+5PdWWwFE0YT6nAw32eP1ykRwbfLqxFRV2jV0vF0VdNln59AxgtYRl/OtXnpLGsnp
+kS3ugccqIjIfEpo0E232x4RMqBx9McKuHqWcmcMbFM28/JmrcYm1BmukPTMzZIC/
+gKScEoA4PnIf2KmvrdI4wfCkWN4URE7w+FVZU6cAwkigYZLRDy5hllULJiEGjfWm
+FP503KDP3q0+dJ1c9CdS603G4TrmQ/XtkGKR1g4hmb/9tcSNFnPgqoU/UlzJrjqt
+ICoYREpt+7c4MbYLRQ3r5rGr+usJQAKv+3zLJbgrT2XoxeUS/SEvWGdiw/WLv9jx
+MFgb2bjxZVxoBwfaHdwTR4DuqjcWst2gHfhUR9pZb6I6qj/TMCzzD/l4RUR53dAz
+uWSgNQU5Y7IzzDqnRKwknd+SjcC8iG3H8JAh1Z9urIQS9OuDaTh59lZz09iup3xp
+7GLDBQhfd28Pte2pznbHrbFtozA/Enf701NNl9/jgwjoePmVv+ZXzpGWmQLu6fHk
+Jdlw9qXJzZ1pT2bZn5A0oNIXP3VNFxuuFpBzSXLGXbyT3mxGQnEXGTVMuNLugbyn
+sCrTMIx4zzGVJZyq6X4pGUGZtMzV7s+c7gy7yUdhtoSNq3whl5I3mo3bwnj7Ku3i
+Smc6NerjRPyumvz1JdFihFGfwrS22lkXBpZ/DsTfPhEh0hxzyqY7z0mc/EEo3DMi
+Jz94/uFrWg57xkBxBdXlJ4yjoYW+mpEW/komichkq2M4TY5mduDJMzm+kMeW30TF
+jPH4yRmQjNc3aHA04nLuES2wqPJEMbQcqCb8jkaN+S1vhL5eFDwTLJWodLI3KVMq
+UyskA0xnz3AoepxdSbEUNULpskb4yTHWeLN6HIDnJupHEDddrnuIQ+JmwNu/gORf
+ERWE6N5umAYqT8/pUiU1spKdeHJzCSZz7LI9eMFGL4j0TMx7hxVj+Ig7t37Dr1NC
+SmMqHqSTHmjklSuuRALjiArphaXXTrXifJ0u3kkigUHeqYhL+XXP/+VQwdEF3Q60
+LAcl96pm2rSy/72iTXDbTNL9qPvEg8/mRCp2T9UccwyxY7sKk2sqDZcEEceuxrJS
+OT6n604hS7nvpQcQa+tAOC180wx8Fk0hjI5blWElq7kC3sUuQOYLxoazfcYr/Ana
+9IEgUMqBrNsN5sDoTCKTLswPagyjPGxei+xfg7/eflvrhxzuXqHKkUdWNVKQu6ov
+SAT3Bnmkad6YRwlxCRWDdXlA58hcKYvVc9jdERPDYIK2VVr79gdJmrYL9VT7N2EF
+eUutCx8NMIlBbAllD2T1vu5S//MjllxDz+Aj+fGL2cj44L+NK0/VXYw20/ddP6rZ
+DK7W8JEjMZb8vvdT4WatAMHpMoS2cyU1kWlqOX2u8JPBS6TAYN1VzR8NTp4XCk51
+ueXvAgDPQPtzhRHbB2KZ7gT0DShAm26uWUyCHnqn3I7nVutUyhHylTYUr6p9kRlW
+HEPj8NqIECMCZlS8VKBQXhjiXgRU65ojF4uTK47/TkZ6SyClo6yG0CzSkzCVooFq
+IQn6M80YK1/Alyn6vr4OKUzcrg9VoXjNHA/HQzcEnqvyMp9PFlkPvd4Yw88EgYpe
+Pz8ra9ZvLlczZ13QhGhts3Ka6i+UU5MvkNKN4U3S1XC7SsfjiIUIkui/wa+svPP8
+UlGbpaLnlPiOl5VMeKHyd0zWiQ2YvQ2OaZczRbjoHMiQ8k6lBM5xtPL0N1L2iQtm
+6DwGbi46l9pz6HTjb4ST+zjj1EYVPNOTBUwwYgegpMCYfQBhHcc6MsacJvv/k0hA
+pN6qB7ywE0hHifZoCgX2k6Rmkog5daw96ok9puECJngqI29OURy8BuPzmkaGUq4j
+/RRmE8xRzOX7U7XpwiTgulbh405w3Mnv9Nt9ftq8iMj1jd/FR6VSWV2Cp58VlgtL
+1NDt1OaMD4KpegtpPRherOqO6YXNVO+hdg1bumyz7XU5e2/V0Mp/ZNed5J+i+w+J
+ukqxft9Ucf1XVuaRLXhN/bD0pgQqumppS1JycI0fQUVO/mOjlhLk6xq64HteplBh
+RgTiyUzeq4YJaLQ1EtWCF0Oar5ig37uG9ODIM+dnhuMDbwb8iMi91bDwb4xU7I7P
+yS6Uc3QP4SW2SjQN+sebPUTtAJj1F8INjWnkl2O6cK+7UWDTDZpL8iSmqrLATvqs
+VP0o4jK1jcsTac475zTlRxNp12YI+0CG2gPvAasTxnb+bHHPCPTAz2Oq/wq7tNon
+HT5Hfwf2Rss6fwPqLga74nQpEpdDD7PiIebuHp6HgHqGBZ5lIOT1oUo1kejaOuwx
+IpRc+EHHo+fS1bFkyivPMu7i00Yr4I3xcd0MJ79gPBAAePQh4YSwd+qGIyS74Cur
+9Z3NHEAs3bvp+1r1S5PXgvXqMRm3m+5VRokszhIJye9TSM88CzwVTTslXGdTZpzb
+NYQrbDY8c1E2ZM0vbO4KN3ZoB/sN6CCpjQDyWg1IpirMZR21UaH2PHsk6vicr7wC
+r+51n+Lm/JNIon9gm0rC227AzMSFvsVHikUaJkUS7Lx55yfWgzKQldg7Y8JYj9SG
+FgDJBDC+fg2oCvACHo+OHyCpRoLCijoh+cdc2RNkFrCI/b9urA4GRFonI2FIgpa+
+GHnFA3DedrYgVwD/5qe7XBukMGmKTNGmxS3MaMvNZ4I09+WQWF1V4oQgMU3dVfK7
++ImmbH1b2qJVeUsq2wOYeyoDdCj/aBMCxnRiLOA9Hh/fQP5jOj3Ffef6Kp+7lgh8
+DZnBTkQSzVdg3/DUTax/gCPg1/ZGJtToPcJt0Jc6/wMLILavkhfJeciMYynpg1zP
+6JtWDi3olEr9y6U5khYna1cBvCjW+plqSwOd+st966dRP2fgWvoKlZ7thYOQSFnG
+CaR+PRewv7lYG1iR5gHqNf6Wcc3BYdf69KPZJ+Fvcztj+sMIaPVO7XuUuQYkkj1r
+2DX1pGMWTS8B05HAmef3X+82hD2NLxM2xJH9nJ864IRc1Msn6hBG0o1lSr62ChQ5
+3l2wRRBdUYX54zU6cxSaX0r3uIjzh+iWQpU3ksrzrtfN/z9GNYIwR4GbCMHqmWPY
+UZ0hHJ4NIPpm5SdDDxQX1yPFWKij2pUogToRYMznlOxXvoSK0pwdh0c+r5TJ3bJz
+zsyhYIw7nYWMfR7mf4OFA2e5vSAHNzrk/YXZ1mP9i/jXVciF1s4DjvhDywo7lrLM
+jz7WVOXz5li5VAEb8goXghiY1yiZF99cC9e6Dm5AktCTA3NXf/Um2iL3W0Egt0kr
+jMq0fcNRk/a2BdEXHlBuDTx2j1s+Ulv5BpY/fUvFvC+02peJr3AmqQeluPmbYG6/
+X+SQecVcuriZLv11T+DPCpOhtocGMzKt20Ibz0XHk4SOTdXfvfKW1jw2+1WruEDj
+rVa+EsM/OrgQ+bfp6jP6KuGyA28c4YDaIog07//Sr4qiRwf2j5ULNlwlyV6elAdx
+U2KI0rhFp1lRa6ioTELn+sSAf0ls82MaQrpCWe4JL/A3zclCkuwKPoL25SwXMdxg
+4GOPR06YYPuvlMIMBuJ5fBtOyM0xN7Fs89kkTYlk+9EtPbu+j3XTdY40ygcgqNqj
+q9miLP29FKV2R7zhRLvWQYB8TOu1/Y487XrmD4janpSnhfdkEB/h4eFkQA72e6Cx
+xHwKn4bW6gGOg7+xsiV3fEqCd4Dj3kkfBNhI2ROZQAGDRd+wUSyh6aw/KwgYyNv5
+tsXU5MBpEn8+X3E+oAAwCgYIKoZIzj0EAwIDSQAwRgIhAIhYZd/M9Acs5B+X3qcL
+I4I4wcuqjtVohMBKRTP/NZ8NAiEAk4XKOlwUhnPbQXimIgbVKWgt/E3ATBz8WOm4
+Y9B6B3E=
+-----END CERTIFICATE REQUEST-----
diff --git a/certs/frodokem/frodokem1344_pub-spki.der b/certs/frodokem/frodokem1344_pub-spki.der
new file mode 100644
index 0000000000000000000000000000000000000000..a075dd9d51922dba007fe529fb55d0b92535b6c4
GIT binary patch
literal 21541
zcmV(zK<2+Nf>a?e3I+%$fsAni0tW&Ef>aRzT~M#-Zc4WAzbvn$TBB_Kc=k-%ymaPF
zI|=SUiJW?1fACbDTPx2DKZB5rtweWm7jT{GMf{4S&U!Yy*@S@do2FdVd*H055+kzl
zoCOp*j{6$`Z{-pE(jLYw2+PqRAlB55r1?TFjbv~lTZ830k3kDKUM3wP?1}z5m0-_d
zLwgBBZ$RUgl<FYeBam+~vRZXwPX*wyRI8vMYyuqVf(b7lN@Puge6;-V_`z2Jx5CL~
z`uY1tP`66qy^cMlH%AO`#G-~seCuR|!2eC^c@h9pCoYBhH6S=DocU9B&BZ!b>!xd!
z2^$$#bF(5dmwk<v&}adl7Q}9`sr$Pcml!~Fk}vshq7~>RiA~4ErK=61+ulJdpn#jr
zFoEEGccW4yg<%$q;2K6*nm7h{18mv&hgrcS*F=HTBjt6?<CuFPj1VbO9(*25d7iDI
zYc7wuSUxM82x6&Z9+q@$G!h?T-R7wTk|c*B8Cubmw3hDEl$b)TZifl`05YsFpcTV0
z6%Ml6oaE)C_9FRK+ivE~LDo-@pr`Y88SxE#d|(kG!O?DQR9_xfL8%ae0u@nafDx#t
z{LCe*WM>sX@e*)Po|CdXn=cmg5UP|OpDt1zyP&nzHUW7amZwJ}1;n)&mW#thGt_!C
zTBn9Ne8AXX8{L%u4bP~LN}+Vr*~*KrGI3>d>VvoL<)(~T3p=IK5d-Fx+M6K|O~uSa
z=+!~lOoXcU<s5P5nJopjQq8zY)={w+p?T{{sO+Z)X<&!yi~X?2IR!Hv3#)g~UwpJ)
zmq^znd3YzIT7Y7@yO2RBnXu8<nKbS)zjCzcyN-0aq3&)*v0(^O+ZHHR!ZT4uk&^p>
zsWN!KwFt<+r0Q}W0Tf$+k$x`?UC+JRaE9j>`symio|A?eI^$s^ni0#my_p*ob$Uz<
zdl4U9Th7y8!Y<E$(DQ##$tI&Rg}D>|?-^E+2d6_aw5h9DE=}s1;g4l>Y6Ba&d~yOU
zPH^X*Tw@Ji06i2Q9EybgD&4e&iai$gR8kogk)0>&j^WfGS-1T69zveyYqZGEmA7YP
zKm_oV5^~NBuXb(;m)YZAG^Wv50ux?w%3Mo6hz)eb0{g+?1&*rpAo~*a-*+>tO<H0m
zU|A_t;FCZrdXmh$suwGAT`f`(OKtk&bA-Ej7ykl^DK=0c0gyUX)Sy(QCY$AHG#`*@
zi-CaI5gO!^g;yORQ%$XC(w3jjmJ}X{*@?5@Y+Oh{TewrYIw+B~#5&<XABtt8xYh&h
zx~w?!V;33yzAetZgH*{%iXd914uZr6+-TK=s6=@v2t)S`ko7F^qMi@llq=}QZ1biX
zg1Hh+gy0pn#H+e2E3Dzb7j`;Gj-6_g5!)!OiD|(E<IX7g5t|G`E)ZDVGE!zZGnEF-
zxPW&|s?^JoZ>o<D93t=_O=v_}uT%=S*mo|<A&%;I0H%}a7{F|8h2!1x*T}_Do5*9>
zJQi{Ww29htch&qk9ie?3WUmk=&SHDNJJGr7@2?Wxkl>L}&fsdn?+m4GV(96^RmiY{
zRn8_wOzS+Q*lpn9PUIpeuMMm;sp;;;{ze*Hf8*j_9t++^^UZ0vsAaA}2wCBs2E|%e
zj<k(sURe6+?#tmUyx2I|=jgMDpSl!!ojlRFCBnU<O@M<-t+u14DA_mo9|th$_dvn7
z%LvmJY0JxTqUxkdHF4;v3PRQKR4ELK6-*=)3c;$F7^AOW6|&C+eK}kdOVM~n(IPb%
zcK7BlRcnrNUXD6cqi_|SD$0uQJMJ>~?suBs#CpOr4_)N$qRqghL>&DKqtc2I?Yt>B
z>U6Rx{#_EUN8YS|F(UXjEC%}&b4iMo2<i`F7PCuuOowiCOp^6spBS5-B=hkIIPYNE
z08FgYuNIeugujvEQkVF&6qbiO(Te+CO*f{>;7ZCB&#t9v!!p22@5sjVDJiHPhsabF
zuK7cE)>swuC*ckkjQ=_Lg;57x_tXviFosHOhN|h`)nvCXA~>mlA|arsG*_L%CpA%o
zbsfYKgpcjz&1;Y(7wSngG`N=VUsGcqC8cJV5%XILOY&N<5n#9UpvLF*|9VR7gcJM|
z4B1`$OdI1~FH~8iZU7KI*SN|xk?x|ZWjj|suJjNbk3j&Kf8rExR?_c%aA53&!Q?_9
zlBgtMY|H+jnRM(%0@CIEuKJXPf1Ci8b?QeG%z{OU;y)=)H=BIJP<EE&T9+>f=cjUm
zN<fC3QyQL-9AysRA}Js{myMXoSzWSDq#7iXck!lj4$sGpnA<Ft*}XpEOsG0)(x~zd
z(&@0zUBxz!QuI0{e{6sR-@9jX6stEx>nTqEzyzY;hXgI3060^GshePyPhqn_R|y;n
z0aB$+V9p2*ZO`AHa0cB+q%di+xIpX6yIjZHUm9G22O@%VRqoPe@(($|^vc)#VKScY
znpF53qB)I8D_?DLcaI!EL*1wDjxml)j(DX3ffQq41h~`H<K$%PCb}#IDXF0S^mT6F
zKpvlsJ)xxV$Mrv7JL|6cgSYu(fmQ+0d}7KEAKCUe7*wg3aP5MA@y1Q_(F~s&+<A-C
zofN9I^FTTtf9*xdu*C!b^49x^LA2jHT<;y6!=W&v_%D05UduT3z>9^Pm_^U9o8{pD
zW}X4Rb=}O&cUYq@p<QX2#aE;IQYON;MqA1yD&Is&V=4{^Z5O|I9l%I;;-9K!`yG^!
zk_@JtY3@<WD74MwJlM-yo<7Egs%mT3{}gD8MFUM&Dvli!fZTeA=Q6JA%icP0Uro@A
ztLlx#P-;INdd;z|*sHU}!9Yg7;2%Sv?_Q4R{G42>INN7QN+s2g`hZDMTqbIIAOG;q
zLZ@B@Y$mqsC+Teqn!OoBiKH<M^o)_XJP5kj8p8IkH*i_qEEl5a%0hsO9tzjD<W&))
z=wFCGe~YSzb_}N(CJ<#{eg28?4;COoM)LQ4%Xd}~E&p+g9|c?=aurp6rz=BZp8(71
zSC|p}^5A4JpB)7@=7V8INxzb$6=%>(n78sVr^##0e2)o}vDSA6e^cxAeRJ2`%djUG
z<R^Q0N~v}yb~VSY!b4SXJh}_YsE;(_2K30m<Pd&Ep$eGSO&KZ1B%@%4jn_A~^(+SQ
z1cnsimor|n)WX**&mihVU@%m9lXgDzSCSwjPQcJO`&7<hPy#ZtMaM614(;ds3*AHg
zob4=4eVpPto^icgG)iN)$XR1*gad<0TXn>jcrjKc#X=qOzzCo)hH)(b`j{H%Cg$=>
zrTg;5MF&TeMu~&WQ86tG4k6nmYggJ+OhYZ2kZH;nJ&MYNX8778*o9lWoAA0CudU{$
zcwEsaA+x-Jp}?@wuxD~{2Bt;1k7lQQ{{E`sSFm*`#o7>wWu510xZ@@n56`phKWpz?
zF4>WwA)6J1Aa}i5Q1?15W58|rNy3GHthu!59m4ZFDl_ZY)I*uQN<d#NVX0JXW3pN&
zJt>e=>9_MGXWFWdP4)ClYrdx7qP0P-nllMlqQC6Lw^crkxyLek9Gc8{S*4rAoNK#I
zw2@}Bo0*c(!q%@%E3;aMsTGDMbFoSUM@Cjvn!p-3zaA%doj?vV#0UH#D4hQrhkVhr
z$5B1F(C8Te8vo{mk)jyH=%T4LV0m4<K9@Wh$)0Gl5j6rk19(ZO21m+W@-nvU6!MF~
zz~9LYa$w90alwX^3Kw@gQ=RC7caOE5{ayYR*P>6j*Sb4I6?xq!F8sAHFXgQ}0$x__
zfEifB{$~jkVXhezp&-5{{p+XTI@1TkN6<06tU!Ex>kht!U|d=EtWjM`D|VenKm%S=
zFtg$4A5RLuQlg?wvM-Yw_r5Wr806#GC37JS#yrJ$wDUK0jarwFEfST&bC=O}%jHB7
zd!vM-G-HLN!Whi;*BO8FG*rD}bcF3k^10=xz0>0N^u)&gyMA3tfEo>H<gl_Wc?FtD
zd>*s@-0-|!@4hwAtqI{NuIvj~p)`e5=s-$d`CMTO>RT2vEF2E+=*;)daRv8VJHv3<
zk>rsx?ifF%VoWSME)uVJ(xHgA6*Qg5q!As$8tNrP;o6QLEQ?eQAOxZIoi-p4!dg(?
z2_VQ03zRkM$#jYYMsi8Mj1Xgsq{w^q%?u_^cCJ3$?8i2Jk${Z9F}6?R9Eh6n+DqTE
z*G@tDJ1Z{%5!II(W=9HJAOv(qs(;NqL>L0rG_|OgvDWY!c4yf$;R*LGi*Ryg&AiW{
zs}Qm*z)bYC#rWO$7i2cD<oXuomCkyGZvl02P^j)(dl+6m{)_Vo>dRwz+yJ>J4i_z~
ztBZ4-7T$?db5dMxMf!q-*rcyb{2r|qj8yL$kr;Cjk%asNA7=oVox>&<j#Az63Csq0
z7^*2hU>*m8k<9bCbJPiAxHrfWKgYh?z$I%1a_V?9%vwSMus|48a%?_CL$9i?%9wnt
z?bbvk@2Vpcaxm$ur5kf48cwy@^cFiN==iWi$EDV@Ts4*@wHYaqH;z)?{oZtUEQa#C
zLG@aH6s`v$0YmZNb)~_mk~=6^f#L%~{(teGK*FwSsUEdKpNJbR`w@2NC(scj_azZt
zZ=ITEy*(e+RFP4!NK+c3SPwpb@4)}gEP%Ax)4VxIH%u*%ccBNe7GrWY&lRgvivsKC
zOT>e_gK{c5j~@(QTqy2Ksy}1sfapM%^)V5|Ybq*~qjrwaB%PfqM80RsJonP)0Q;4C
z?NmKi=F6X?{vGvb7#1v>*A?-k3c!lyM*&FpxR(55yl9X)lC~r;^pEBuZz`imYNAWq
z|56g=uJ06V0(rC|esUg<LFk}FemXh+y;tZDx5^7mZJ^}_#Z-aVkPF>z&Y-#dZx;YN
z*~cyq$UiQV$kn3oHkw__lIJ?e<0IHRWwo*TG?x6<TaMke%`Av`<%2bbo|{;4zL2s#
z1UJe<#Nsc`G+a(MdXjZn06Tw%2*n}Pi}8&gZdq4i*%rwD%Waka7Bt_v6&^7*3R2^<
zR03|gf>jX+I5lV4V6+q^LvInZ2HU^JPS<0l!mz8y>7p1cL_k-uq(=Q(Nom?1%2<%i
zzN{?r)OJ-G(l28qd{KN%z533B8M9lKN;&a<2Oo;wQTZ~Ds?}6^kS_D+g=0r+67%p%
zXqo}PmGVlC6I42Oo@E0{{A3le0OY@#B^y6zc5x4CEt(FXrUK5Ccq0~(^721F8&7yS
ziJt^OX(f?a+IO>_YHN3m_omj=z`(wL!Kh)&Ntf|foAmf&LVY^#b`&78zd&0yT%%2N
z0p~o+9->m0=q6^#a3&-nhV~2Ygutu$5}!*#!-7XnMWx=7`AmV<$bZq|%_Tl{9kQ;T
z@qnK1A>dNmbjx56LV2dCywbUKZFAF(RdtEAzezd!9_B@dV~=E7d?z2_pAlvLZh2w7
z0<dA8^g*M+HL1Cjd&U)-q@Eloa{xg!iC^Mq8AFU-b`=rC<CXgGd?j_9mhq1>3i&+R
zbz%HCx;ilMad#9fRL2T!jiJ!%((qd4^tF|SHhvl{_at}gYR8JENIuDbVfP(ujq-AO
zh1|c!9#gb&4bTN&&qq5S)!G*ix@2AjQ|%HVptci`9>>c1taEY6+ct{-0j4#w%Napb
zJT<+IY@qF#7hkpx!|_@XK)x`eq>VoKP%$&l@-<`lkYAqW)-8p20-J#As3@K_i;T(7
z-ZNC6$MT|#vOa&q#k#kdN)h^q3(K+>^4=$-ZTUaGw|^~bLMOi9d_(B8s|ppx1fz-2
z=^Asy0NX+8IDf6-g(Kpa8e1$Ns8?wt54L6=c=oNO|BfQaowH&Qq0hh})5eQyUx5Nl
z(lBIfQi-=cR?vs<i)kaZ7`5F^LurwzNEmEoqAmQ`X+t-_t4Mmf8A>!EAwYNR<U2(+
zYdE<?b%3kVjDCasjL;t<FDhE52e#O9piu})U<)^eGBr6hLzwXQP*{%FTY`R$+YSLe
zi*(JN`>cI1SIt#Iy`CU+yc4;LP||0~;uQuDEixausyaeM;B!n9zGc#4Tva2LJexil
zM)t(J!~TYL3)HCI1LOsuhp+A8+M!RK3AfCEDyC&ZKLM5gnq5MBd6h?b*nr}%XWF6|
z^V0%O8u=0c2J<HJsjMFdZ6Wm{Vm&^B0uM(w<gUqcQ%>U4UP;Rl4F<J02#<T8Fx@=2
zeu$W)u^ojIq`p{H7*pL5B7P47F6*d83kR^pBxJ`Emi0N@YvY>NMo~kt0g@hY-A&mq
zVHw1~7cP|Msxzi_X`?G|E0)i$SQBb%wQEUtP3zCL?oM7W*HjA!Zo<VmCa?FA?=-Ri
zz=u~+^kJ$AJa+?->8M1VR@Gt)JR{k8`_X@4+%#|(z~3^=$=!%;FDo0J%Q2m|xkI@m
zFhgJHFP?4x2Y1=>*syE^^;UUppbJD(@2-~Ee?oN4<4|I$Sd@g&e!{u=B?sOXeGIo-
z7m`6``^_E!rvivoUO^y^BIww<DeaDa1d}r?r%4whg%zNzXL~{U+ZUHh1q{F>*>x28
ztzxEZM0zqpioAH^tAA4v$Ij0jvcZ|_ATytQ1Eo9dg2FRF`VcE^zCM0ax63tfHo@M4
z`Imv=CeLbFXnNVT0g4TyI?zHkVH8<$$Ew;KS9>4iSY-Sq-^EOZZ~e676YfyNs+!^`
zqnlV$@vfhCW#V%{iVJ-1Z6t6vGF0`Q=Gl~TG-8}PGey3BG0%jP1bf`!VrS8bG}PUD
zwvGH-Bh>N9W}?@L35eH0->27mCUW>EPL@XikJ&Oo)UBz3E4of+L=p<u`cj*iz6#DF
zTQdcsoan4T7WA;NxWx}<^TE&T1Yw|6H+B9;8{^!DQMpiI5bm>z*hj)Jz7d-!&rb*j
zwADH6P*pi=cFG@}QmFjKBWy7Wk&!4>NRgwQHuHppZG)zNUqp>Moshb3t3^l>DGa6T
zO9h;Mj`8ZPh;KV6GEWl;O8P7V9poO*Gu|D1H8fiMz}9%T?{ZBi#h7<72uLOc875gm
zO4F@?bOpw@hiio60I82`zsNSeUI|PIz-A@;a-4WxRr9OK+unCmM4kWUQi!U*6bDIr
zVw_bu7?RRU?yiZmr4a*n!rKt{YDq{1i+meo(!K}TTyanatc4?{3`+r3;k`bus=OCj
z!sB^^cd;Lo{S%k|ia-7BSGg_0q!^@q)ZjWq>axi~N36Kdv{Li`=tMYURq{jj`BDux
z@nQ2*YfD9#5wKjZFWWI65pkWkLzALxi!!yMXB00YRwny{3p4awAAJw+^B}?aAd)8o
z-@NKBnTrJ>08dDBU`(Hl!n0{<Er2s_GOs?gdU)qaXDF%rS0fNYF1~wBrc@2qO*!#4
zTZ9l}P*D#+Pzc|}!TYkxd3_nT-ZPu=b6BfJM<lho*NtmG$v;7mli(~>uEt(es}`x=
zvS@=^C$h2Eak?id$wD@9@S(PW`GXRR_C8}U)+obe1z!ry(OV==3zU7SLuJ*n&BJWE
z55G2hQ}0N!4<V`?wqc)Sf^e%5n?EzK%V^8@nLTLrfTbZ6b!hw*i0FI=L+39h53w9)
z)TB#G`T>U4@V<S#`e_0kwd{<A7Xaz;B_u(XdA~F~q$e<maHX?cnPm}K0F>3bwxc!b
z9sEb_3s2<o4LJB^4z(n#fLWmp$DIBOAO-<N)yS}8z3fWzxxA}zE3_Q!%!)1q2=&>1
zz+=H0itELwKABXir-sRy*t#F3wU2D`+4Xtlm4|DV=_RZD+KR!78?vP)ik&a)19I=N
zIT?RHOwjDNc)7;fSF@#9CYHF?nQt%7prZat@crq$T<Mih_ut@|0qGEQtL{r&0^u;q
zn527Fn`#BnA&R)#UjG!M0Bm`?TO%dP{4?-}eCem&*Wf8U$QE70B*Ac_q$|Wi(TYWy
zlaBiqPz3Efyag$rHB!W!!%k_Nc}eabV|3&w%#j$9N4SBPwh&Hqk0<jTUJ75S+x)RD
z)TqY&TW=+eUcsdgE9hv$B~&~B=>4Agg8m`g?`9yQa>I(RE5`+7(RjzhbvOSR8GMLC
z>km}9qt#st767g;Sa}=Mm5oH13hrNPz@NU8jp5sfT;R-_sQyG61^}7xXjMS`e;7?-
zA9BN^3o1BR6U*O(i|5EI#d}Y5YQ=Z^M>{Q5`PO|{JTB=LQ?6ev6`uPZD;3J*F0wGM
z`ueyc`t-gml2@@7Ax=>@{kX#?wm;W6FX1%9@Kh6>t&IAgQcMO9A#VsLmk83yI&K}t
zuf&9MxJ}nad8BkvY;!~uj}iq(JWHDRDOuArF`N>acJ|W=$K^#~h>}Fa`_#$VBgGSu
zj-B6lUjN@9Ab~HWgU5@)rG$a_8IIQpmOt&m=%G1D{F3Idl_fSa@WL@UP?C(+!n}WI
zOIDDN2o6{?p{`?F5C|~L2s8rkre}y-h?Z5G1-*I($_6kA?Vr*1)m)T+4K|sw394lT
zTHs9N?tJK?@iRPrK8mxx)XIGC1V$ajyrY$J=vSN4A&|TP!0iVmjqJhyTGqWk-}W!8
zUDfOgKLxURpbdC``Z4Z6H^GgbPPNG#wUGEnQasa`a(*7I0p^LbiEt+%6~-W_%i^>!
zZNM9JvrP2G)_=7Xz9}adjB=yrJj@(1pz=b_@62A?%X~&;0dAt!i7nFC?md}Ww&#Un
z6nM&bKf=nQhGDTfRK>bcHXDGS#sl4T$B@E!h(%kF*=>m>6oMvJYbae%NWuRn?}fw6
zIqyY=v(9v{ZE5k*&|=4v;VNP_``xjy7+lQ>$<r~Wcm0-pi<R6UR8!<!%~eo9h+%2Y
z0apz8SwxqY-h|@U$&3&h?sgG%gy@aNP_^9R$3et}Tqy=9zm!hH7aODQRjeeLUxCXj
zqD}F{{Q7OBy|Y=XlA^-*md)o7M9U=+uhhbnRfu<iR$D=Ts`S-$<u<{#^K>G<B8Lc9
zJI)zI5wWbj9U?^U&z(sgxmub~SHmucY60xMLM6=bN8w1&Y?P|?mpcH$x^nh1p%0KE
zmpDd=q#nC|>hjgYo1Z%T{J__cOBa}x3s5g3FkqarOyH*)F<`?_jo;}l?R@zg@})FE
zcg7>7I0{^VABF@&kBCx2`-bzoWwo)tYjc~)cec|-28jyKwL~@EU7@80Sgm-%gNo;M
zv0C|`*5A*y1f%5?8Qxf+*|<}Y*ZqsB-9q^fPRSf@krv>A>V7-fa&sj3xuG&FQb2u9
zSu0v1m}-xRXsFn4N{AIxpx>Xa+L>N-=W}si|3lUsspBQ@=d37cAXgS{3Ev~ug-fsr
zP_);Blia2^EI3|Cz>aju#G=&fRs#SmyAa(%OBSD(h)kwq|CBrXpJkZtl;dxsYa0?Q
z!A;N^^Bh9zfi1c)#yfOd+P*X1_~arQBtg}62l!q9zW6>^1mz7tCS5`=omnOlBUgWJ
zO&~#em)=<s&iVgu+Ud)n!F1dqd?<Ifd7poW_+efk6M0PZ3wT?`1yi#*b$s>qGcskw
z^~6=9Po^R<2XDf3_ET(Deso6kexB6M3*+Z<9_{9b`K_v@U3{(p3B(YcPC+pR1nG4m
zaaoz7%;Ot`Q|-~y4j8y>()^Q)s(~=sOn69#C+#Y2OZ^rqL3jm8A~z)O(!OI2143=w
zdUUtMYPX)VM=%C|2{cw}*gxwl*<re*tDSt@2(%zMfY2}c-b)Mxme|j{r)j)k^C(<}
zN0L(m&Ve2vQ;Kf0l>*<(WGtU<uQ{Y3aGQk1PfvK22cfhw)|dG_>u;05tRu$SfD}~k
zyti*u&vQ$Rq#Qt)B5^}K*LwOA#kEhQ47Cd$MY%ST5Q_gTI<47#$|;s|BiyJdr6~$T
z(unV%i|=-?1uV__QI}r@<v73&DSJ*j@mlAJfP#A#3jW})h=@*q<g7wZq-GOG{KI;S
z&l8fAdegphdwJQFF@~M9$*?aBaHNjpRwB`q-)Ww(yHFuPR525TC=DNuA4Zy}F1SRI
zq>&j~KO1W`C$5jx-=s0&r^zCRORq$oMTi~gPmtH?tyd-EFNi9bMP$tKw52MdQ&I?l
z8@s<owA@%5N6dFXP1Y>$E^27h`SHj68<xll*M-PK>wJWCOlMC344sLddt@a$OYBXn
zoL@sXX0-Z|qSqS&^uLWA*5`mf_p0eRot_!=0fUQFRR(`k589p~BBrh&YucKQ=%l|@
zR*a^$4)(ISgao$p;H1@T{y#X}k0h5BPC!%-q_+^daK7ceqY~|NX-NVmT5^%aIhVV;
zk#>zEwhvEV9VH+KuH_gY-9S>+m41iH>oY*QgZ8t|QpKnsZ`o1zT_Y*F9W5}M5p4?4
zKPo=~iE0}Ti`aXH>JNjlen??e0DDI0?Gwez5b?Wl?JBj0C{ByH3*|{#udt$70XvjI
z+lPn{G&XpGF%S^mpie|R5lp+q)XwSo_T8D)sPX&<O-6(uaDLic@0eE)xy3bWYi_Uy
zyIhQ7OliGgJsXF7K_lAwM`q}5nHj#9>OPI)g?ZMea@*S{h`)Ukgh|`E?ZbIsQGblZ
z(+uqnxbXTllc;dVFwO~&xCb$3pyeZhUSvMc<|{2hN|0LYz{IvQSyhD!v2|!LZ^{iw
zPdaGIOmUzPd8u%g(=uQV>KYwgh39}c^#d;M@IV7?@p>O-#pYAd{kXQq7+0?cV`Bh6
zJ=v!%Ix}-ZjdDV3*p5(FFad<Z6F0p1ND?W?N$)t%G@AcLkMvugf{?W10<;>-cjW!X
zlL!dUH-hRF*4G!h?Q;3fM_;Jxq21lRz^oFYf0kX+cco$}LR~FS-3Fo~c*E~;!H~^T
zRF<Me;Aagj2sNMYEWX@AYT3RbE<GU2-LfsWqoqiHz%Ura&8OWzYulj3WLq0*b+KwB
z#^THLDiZ7f8&E%%CrXc!f4z>Yer!fFm>xdZD1~`{YNx?HYG#X&=5U^Go2t3nk~`HO
zN_puYO+M7!=%~t%InuneU_his(rS{5&yjD;XlQc^68f0G5)0!rN87$7yzt3|rP&L0
zb)gAj!95^Lmq4MzIaEntlGC|sVD8^+<WHW3xtduVRFvo>p_EYx;?zphm#<&S<h{ZO
zbvIK)Ytb9q<}?HR%jKld3tvuBfKj3BzYp4&{a~S_8`vmF)hIK)g9D^I`mB|~w9Zst
z^}@2Wz@$#j5}zh#T+Rr{=}+JP3D)y|!e;!xdx^l77y;&}knu${>CV8e%&T7o1hZ$Z
z{~uO}HS&w^KCO6NhiI?n!S@&1N=>AJUfHQ91VW{hbfAl+5jvlfNZy&x3w)q7&H`l1
z!)I!{eWnb&Bq4NX&B6$AWBIy&mA22X=uJG)h!oK2qiv4LSFb!Xb=bkax+~%NLd+;p
zVR2_`90~|dq}$I|{z{auFb`V`u19@v`1+gxBXp266A{<DO7EI?xMyL*0lp9~nnfch
zf-A$G3o{20IgYz#xDc+_A4ZSFX8wpr5Z-HPxbs893%Mnl6XlCLLEW4Nuux9^MzqPo
z94w6d^%uTEw#5fu*1R@moJ`NeVt-(8)*&OVw@hsywVXzTd(O)VtWhnp9E`ti^KH1o
zh4l=2;sR7>CNyXpgEVUZMoRCmswS`IkOkkb;D{ThgY6r{I3@$uxCL8ugLmK^VNAh<
z8#G!?h2*b9FJ|<e__;n}U*|rP%l!<D6ZCyz71;#$x#f$@w&{EdzWp@k)mLpSg9kE*
zYq+)WfGpsPyWaxv65$LEGWJc=1*E`D@MW|G`DH?FP?$5}TsO%+yp!;~o7%y^7Pum#
z>7nYxdew`Ns8o6@D%^^+?Gl_#Vryy<Y*STHz^SZ*;SyS5RpC$(SpdWSNjX$jQ_STU
z0#?_i<`u-t1aCtsXzC+3D0(Lej3<4rvISJWa{zVWGZE2R=$tWbH!Xvl2KHE|64|Mh
zQwv@$;aq2O<UZBhMxZq;dRvZHUnw<y_mvA7CH{8*$umQpqZ!dD6;!Elwuze*NMlN>
zJD=isjTZM2h1lnvmOzLD@v`@9Ai^n$RplvM9IBYJ$KneN!9hztGWc?@hARR#)hYZ#
z>x$E`&O7s(k{Vf#Yq`7V@G%+Pbid=P<F&Y)7%YqYfq?)};gGH-q>=L^$}VpQIYtq3
z%UE-N3e$%#?CIek4{q}B*pM^H`wfo|4Rjt~1tNx=nAh4EE7V?89YF(Q2}>u79iHQg
zA;^uj%iaG&JVl9-5ZSg4*`RR1@th`*@;%=D0`&_`J1ixR{g0Lq&`EO)r?Mb#$%0T7
zi)WPapJ;nE%rStE(5h(DZV0;ziQO@xd3FiLH!@w6$&p$OBBLijqt0Sg%O&7KMiZte
z$d0{$8#JC+z&M|(FG-aKA3!HYoKqH>>|KhZe&}J`h3RjlihyEDy4}82Am3%DQO0hG
zKK?r-rXah?Dmt7D{Ev(Qo9O3q)TF>BA4@0M+wk2e=S2~`hGjDh=w^pMtjljiK9I(u
zh|^wWqKhO$2cy`O=|V89XKt8#!jXFALwlS)VYwAC(69a{IZl&knJkkow+-9^NTHuF
z0hg~4>gP;uDUw4JsqG-trKcR;#FKADtM1bM*O7zbPG_d{3W^gvYzpWrfhC>W=$2VD
zNAvUlycG_=Yv`pRK5ZQy2joyObKxJ|yPg(Ae9M{T=a`+E&hNc6)lG5DbQ`(D@bwGR
zl>A*bwQ(*EJ8BuuY!m39`Q509?RhL&FPdN9W6$I`5R!g(7WQJ<beVjh;n|59Hbkhy
z+A0m8X`}RTwd~Skn=AW;bi?0wf~-Q3k5oO8nLx|XyR2xw{`<`q$H;Pdk<vEH?<Q!_
zlaG&O{%r`I(Wx}UfS8?TB;bo-^iaE(<R$|N>3>&Z(6mbPaBUgAy#|%8fuV_vL|R6o
z3O;ga$YdO&0q2H7%oGDLsrBL?acVGg!1UDN>FIJb3TGfafkM%O+(A^H^m0RgaHbpV
zWF%b>BPGZ%Zd>$B`ljqTJMbhJhb%*ws}Fj@4Q8PtLQ?y?-+hi?{@Q52Bx`$e%s%-V
zmfW&XAiwH54msgqX(Ey^*CWR2k+E!MlvUux<F3%&r;Mo3`8L^6>obbtf=&iCqD7+J
zBfB}NNz!eh`nZJFr7_w;4jgL5Xpq&d0C{O}=3oWtCDqzK38(@)C9Pg_<G9?JbP^Zd
zYj;HMeZOtk1s``bEyQ`sK5*GhBhF*6A*`MFq`qJbzE1IJFf|_3x)!!y*`DC=tK-3h
znMdS*20mg|G1n%5dsGAf*6^T)lfs~)>E=(4b>RHMp=LZ^=W$m^Vo~-k=BjbT8?56z
zvp5H}6Q`2dc|LHxOhq&M`}}JNy3pfg8hCz~gY)uiK>In)F;qvIi*f@(O&#{0>Slyv
z0b(A7g~5IMY5*$1naD!wK=8x17}4DZ<#f0gP_Ao_%g<zfz_+>1&}0jr&GDx9=TI`c
zt!mfE1Fn|YX4vy?O*gzYuKMZ3zmENa0S)g>9B!xGIA@#!<jL0jT?!R{`p~X86<|{U
zS`|7Rs7$I$M3@nl{f<(Il7`q;LzJBS*j%9#qac(`{mF}vl%%cv*({M;K_x^^e4Zn0
zR~9L~cvZE<u?lEOf?xOTum6b{oWUhQGRSD@)-Rw9V<c?PV~=Bh_q)m@x~;X9XF+C!
zWtOo#pO3@27lqb4kW@2-6;|GDAj#!Hy}mU~ADJV7K>L}iroz01V0jO)LwlO0JzBmt
zXKE|h>XJuJkAmq%CZqqJ5{-PaZr=NpSmD*Un}YKt#*K~#n1|rb1SCmqjPs;K9q=ec
zqBdXD(f~AnkC0U}!n)T7SHlj$FAC72q|Fn@5y6WI??TQ0=<7TqLuA=n$kwkSJae8p
zqkUq_F691M(*)^xAqf0aFrI+wxqhLeb^xHfw1jk4|1~nWNcZ?cZjY{9d>0ks-}__Q
z-0)~osJ;7Yc+I|tZs!r`6pL9sUH;rPz%!@&&b&dc#x1T@zGW0W04>lmXGc=2+1Dq8
z;jL>7Q}dh{LklA<>y_lJ;CL(n2Sx#^zT;PAutC!n@IiVWRf{Bpbh5}w1?eqLIMp7<
zR=mrx%JG{1aTSs$YtOwd0Z&d1#2`15$mT*ALSm^DfLb|>qBpVKhEV*bh%|1IGB{H<
zRzx-AVXrQ)vBC_Xl>wG$Vv#M+_njiBR)c}mKUct&Lt#_~akZ(8XzG}yyEipMp9dFZ
z@K@3%Xpk@xYbuGXt{ktKyf0h;;J!^Z4J%xyRZVF3GlsFM#`7zBkDxz4r4Z~f3G48(
zS|~QZ`KMgLhpmmhg-%o_*nRk5B-tF7ufT-G#0O{g*zH@HIKebu<+wLdZ&QBUw7S6y
zuS@pccwhi;+{_bU?j(+(J`w$|=^XNggAe$yb+_Go%w*~6t15xFAq5D*5w@2Y%l&5E
zdb}Z&W`?q(Vt_e+>V_*w&n2mJlQywQ#h=15F|<ss=0h9n+&aDR8q`EB&;Wr<zr#X&
zB*9xkFhgh1)263AORruoxp!;coUJmSCkB(iorvFJ5pn)%py%5tv{qW$03o>|k&1}C
zMK@Bx0=nGFCjLgX;ilD_NX~^uDb$jF(B#!sS#;&3H_jTcs?$_O!gA8>Kyv^rREZ!E
z!XZ%?DNPr74aZc2lqt71&uwM7;E+$R3NPJRI<a74tY|=PgGRA!otTMx0mR|3iax{!
zB<>8)p7Hvw`)SgL#9RCTq8mfyiA5;yXT?*SJp|WNV`irWEqYZs4Nt)dj+gCBLP;WD
ziLq97WEO4>I<S#fIqugfEMHwk`iqUB@2C+ej%@r(w$UkOh_+2nC-3Ii*;X*I<J2is
zG>>Uep^CGiP>~ZOWI%g-sgJ&MwZ4b3Ua7hk{x=UlGpYMSvE-Q!kQEhK<pD?nDt;C6
z%;XyOkZ9x=O-f5+w6?aik)&HfaqT?To1WsmAU|jkJ3l?oEE5enKlTpHVrV1(B6$K0
zv|w+I?~qT=VMVt>cBka7{+mI9%2w3-AaCVW>2|3LWM{S{*IckC9j3zylKOdrcWfNU
zHH*MgK5~>`WeVy=%Fk%@ja#@6FE#GhY79iz!#_0o#8f@sfFo}#PCMJGtodc~TRu>M
zEsYjkRXy7LnG|zqfIzAVFp_b@N(?DQ{QPZ}^)~xl{Y=Pa%J8PcB;V<W)j|oT1b7-5
zfD7tb8#h7xyalrL%`Hs?>xqoatqBFdy-7G+UPU-vc?kaMHs}6H;`K?CzN9|yB53QJ
zUjsz;W$H7*oL?p5WoOVr!7d((Cnsse{Tg^^#-IPp>#9<Sm15AM5cOYnPx9cFkdT;#
z?-@o3c4fL=<(oOUcu@6svCse67!haag&nlml5Yi%|0o=_>E#a9)&DAFn(*H_tzB3f
zX)t1vBPf;k{NMB7_AD*;ARBT?z<Jw_>Dui@rbjF??13O)rfqA)ijk7mal)5vvNdM7
zeb+$SSse^h;AuXEV@F9kQCc+hp{5N=Z14}B0)K6NuK)H>%P4b=K5>dKv`vv?yvP#f
z(!Qg@&Y{=+>{Zx&xlH|P+(R#BE|~YUG$=bS7FqkfN0CeAKu%m&23tZ7P3&{5b4UoI
zOc{hKAP@qWp3Euc5wU13o65|YKN*DabUyoJi?h>PRlHSL&mraAGWocXj}j_USY&wG
z1qKf3zbl(2IrEcV7a8`NgfEp%S(JLNqLTEOrN+R-0*chglYW0$w0QByaV!8XKwudB
z$ogyng2k9`YWvNPJ0~`5a)mAQ3?fH^xjeXUSj!GqMEKZHRH{W3R-@(W>Q^oiHOKJ5
zQ^Fo&yR@8JOAPmneAMKW_Vf1GO#Lm)B!J<^{kEg4tgDeITPQ{fxB8vq?}A|$SK~5P
zQ3T2Y5fa^H8#VFu<c`U`m}SGmgjJZET<TO0{~R4Beaxh^=MR!kG-p&&RnLp^$BzuM
z+pe!ntBdFdF~@^RBGi{BgXsYXxswo!ckAF}(>;l5_d5Sb6Ax?Wi_NqDEGRKr0sP}P
z1PN<VnUmsnVwL|f12rqNqV72O0I3cXmbXM!2u(RG3tVMFmi1Uo&mAetb$%H{R!CL`
zIj=bN*TbtN)KPR4)Cvf}_woSMYhpVWZwuf4!8xf3=1#oHVSl+TB7BXuEpvu-{Ya*Q
zo?n%fLUp&}y?LvhU+|3K-Yxl8*>D55HNl-hxjn*QI;KZ5L?_;7r)`x+s4qLdLXkz#
z!7zoEB;k!l1zu6kM(TUD51EFX70Ie8BrqO(a%ZJKjgnYySO$%l6#5&1?rH))(dNwH
z?yd>T^##~3`%@9%FRx~cIDVk!vs4&4J1V@R;cp|a9j3Zrpf#@6(7MZtl_4{6_(i&3
z{+SvL!7zuk*KEV%K0Rl1eLFdNG0f7O6u>@UfVEB9FiSXW&({9tJLV>0Z$znwTP8U5
z*A7jq@isRJ+Z%C5NmLsrDCsj(L*^#vbBT+}6Z!()QixA#^?Hr8A+jC{^kuH(oQR&f
zEkev-kFl1nEm(WFrm%jF1Fq#WH}T#E(v$Ig_JTtJC4O$eq*jv*x|$3w-x41bR@r+8
zvr2mktH$f%`zQ=ZFCy9w$Xd}wF$1l?{u6My5vfwf9XOG4f|xholHVxb=cMYRgKP!T
z!XjBV@l(^(HDv(YMEwGwi6UjQ8y*+TePpN8%Og87eB_Wq8j%3OX1xQvq~}?<BB!#J
zBkK<FjV1lK@G5@81<|Q>B72wwh_U^)s8wC)l7b3^${lJljsjFus+volw|Ny-!%7X3
zQ=f0-^BXM5I-71MvI+$0L>Yn!`mXwsVS$=(97U-S?w;^p`_`qSLaU0XB{4TEKX0)<
z4qAM@U8FIAttYLSiV-dImN)b;Mq)Bbx;9nQa%-YE)#n3@mv&7-Me<_foM;LogZ`Gy
zW=aEJK-UIq6qUecU9qC0*KNKJJ5M~KXb=UE39Q@Q9!QtdI>WV8GCNub9b*$pXI?5s
zC|rmvZEBSplaf(#0Zd0vD@IHQ2>(y>#l3#Fa{rgdS88BkM(05Ap_*HdXjIjwyg`5K
zC(~%>-zT9#EE2YzhluhFN+5hX4Xk%W?YPx^w6+WQ&+l3m+)wur*Nq{MOe&673;Vpg
zM^Qf1p|3zPzh*yZ1-tZqJEG4q;G$-tiA{F_l=(+QiGph3bkj7qSluJ$`@@`RsC;%|
zd%@&r^`y4}hO;q|+AaZ?PH)BX251cinrF@4G>n9(a^xC0+U0b33V;hj{x4xR3w}eM
z-@7qGCjgGgM0j%r?fHejb<24|)9M~u2P+CBpbcR@#9hPkT%+oCNb0wswCTMv7P=j)
zc*;yY)DHV$IC!bhEmUcJ_qb0*U1?1}HM8PyKz@*Jd0Ep}Fi^(vCWVn8I=`ZU1|Na{
zRVbp-Z8|6axXn&uHb;~HXU+lp%!}G5d|BX^qlVW4>DDMKT~ha1b?9j#Dam#k^V2?F
z%vYa<Gc3uWntqy;G#XUS2*hIVeVmEui(KyQHNw(xDd_C;^zD)LV!moNvO-^@^qTg}
z93bYyPAFMc?*lZTO5?Mfj|tjft|v=kC$IovkWzgLb=diA#=#&R2B8ghg|g~mRBQa9
zpAuIDK%>Yq_pf7Nz?%{$3)IJk-L~&TV7goat8J9}CQ^&fGuI>8TsFvE4Uc#kGKW78
zxBF6dU=pKpT7ihQbtm`)5lsfgc$%&5$eAFLO$%clL1nVQ6e(N!;F@pp4L}87H;jSy
zu9e5%$?ZsdG0Zu+u!bTzQp+rJkE*^uRL?J^`3r94SPT;qP?dZ>d)0`oHpjSDxZn#|
z9-oF|0%gl(1*eqBun6#GQR;Hj+&TFzI-i4HEdyD8NajL<^4i>54NKG4%8k?X#3kGS
z;D3!mp<UL$<ei`;k$v0@#Yl2>RW{ouY-CpyYVP>85q09{mLK<WoDG8uzv!K)evb-H
zThD)N#s*ujoX;8?;w$#&It<!9wyOf2Gi#8%3WxL<K=I?nJH~>O*oUgc^`k2UdMuHI
ze~o>~SUwkmSgQ2WUOzsgF^#8)5HAdA)lk4D7UTXukp|Ua;zgXec;V^y7=nmK`JEb*
zK>o58wI1AzUKk@^^-?pk=oSSngQF^V4KBkW1mZ=3eQ%OVe-5~kD$R?Zs5bx1{cSdG
z_?cXa<SIn_G=hCpK=#@@<t)%1%EIM<Y4+3*V{II6nb}nODM*vq@c3Zi0%;rY=Dw|^
zlt35P^9<#(zWsP;A}VQkHC;bRumu2glA_oYC>QnVc$5G*;uWu~vrdd7p<od$(6VUX
zlya1dyT!Fn!@l-L$>}U0HS=ma?~+ClbvGB>^w@TC<ZEy}xrp%zsg4V9ura2(t{&VA
zmPEPVH9=b}4cFXquBHc{JaBd!oY@2r{jMn?9;H{foCxk$UxRKA|5|W75?RPSClU|p
zMZDJ2Aa^!Q0&YIp;{JEOEqOVf@P&u^r2RSWXRd{#=&rF!W5Jq$h~<AJNrF=8IykT*
zJvfMWFLImNUxC!9H1^{Z{r`tx_QI5K!q~2IH-$4_zt}zPVbS$}FSfb7=GIKYykG}y
zj0;h+mbv^StpPaGtq`NXq^=QmRfd^UHJ#D|1eRweF0_~_+r+uzv5ffDk6;MzcRR^-
zo?7S;ftRsZ!D#pz&qEHo^kH<pzw*8y2-_wX`zI4O0Y(vw6^o)+Ybn5D;!-P%HdwE}
zZu%??txHhjuL@oi{=T@)N;*t;t1tGnOLA4{?NV>GV}oN1>(B>brc}^++-XJ*SMGut
znjO(Bak=#;0Nqbyj^|G1@<|>MoruzmpHx|{DYs(af4z-xG|hWjfLt_vj*mqmzb@Ss
z_`}gktL4;sUcmUeEW+ug%|LNK((}D7momOkX(f!}RulfmHrN!DU3;QoC^%OD(;RCZ
zF>41p!IaT8cqiWJ(JfyYPRhrn^NVD#8`H@qUZuE@I!UF)X_Q3^oo`hNOAHT^X*}-9
zi2kTGk=qoA2Oifve)2Po0fj|Js<{_pSoeO1v2zqB^K87_38O&J|M;aDE7K!~S{<~+
z4h+KUD}{GAG%Eotrie6Is7~s?c~M?AkZ;7i_{<e4qjtO9XZq$VUhD<clRmD$dV<fG
zz2@Uk>=HG7cCR^H&32xH&ph|q{GE(gX7VstpJB^2G-g-NSK6*wFE1Kcd{dX384VZx
zbrBbHvqS(N(4QCt4=9@{sA?tVFpjJ4en;>R%l)jm`F)YS@1E3pnC{q71EjoKzK5NF
zuds++678PVe?X)!*@j}R8TkfM+tgrigiS%JivNfE&eZm3zW2d5Ku!D;8>aD5W)i}G
zImrb?T1+O3!DN5xXnyp!s9I}c1PE}1uzB@aLMK3UCHg{i$S<yHq>E_Zt+>F#Ur^l;
zSBHwRl50`s?BJm{BomP+yydE3a^|ZK5mgYJJaR1NewWefvM9}E;EyatIvhSCY(^oW
zyyTzEzsvZ?#fiJcltxbxQyIQa>I2nu`eTz5D`S3%<CCTCD;{jgyYT_xg&!@-J?bPI
zu+x-2+flHg&KXVv?a5_jYY$+`u#y{FN>@)xz^XX%YX|^4XVPL)>6vyvWdms&^#Yb2
z{-1wDa9LPiV!w9i92xox!v2!d+1AmQYpO|uiWL@#6tlA1jcQVTj#cFOB#4mf!{!9p
z>qr#9R`nR?YKP+~L$6|A_wLyGQp;jC{Deuy5!!msO5!!iUIUqP{G|8nncCufL+e{S
z92I$C))WDSEVnxRRoA}DKy%i>PgtEMQL6N$9Oj|B-IDXI50u{!$3^V8;6z8W(GE4Y
zmralDHB5d)oUx+${|P#1#trOkQ-hz%@0u;wrwSqsC*6ZZW^{GWP!{AM=V`ZUg%<wJ
z=7V=L&sk295)vhVhBWx=#p#3)YXCPK%oe-<C2`)J(St-f@<EuW*wfw4qR)sQH3E-f
zDC}D{s?vQC9BzJb7cI_b)KJ<nq12u6(}*j>j96p+gAbOU@E8X+`VVR^V&>Y<jke(+
z?gwJn1Jvr$kK`T4Q~LeaquM25Hr*NhV^<VNVWT2!^VORnxYL0V8Nmh4R4|O}J|TYs
zJ&xb<(?k@Ip77AXP-W{eKqtiwATj~#5vo+@VcmNSb;DcLe?bpwZ#W)gXf}8tFpicw
zi=Z50zh$guO7-s9W2gf(PW^G_?FSESsXTO;k;h=+q={Iag4*plF;;_GwB>sVKb-4j
z;?dkZtl29^icKBXHKk(-4);Kjo9UdbkwL^vz!*>3i3*xYr;YEplE9U-ztBKHF=`vR
zZr1fQ&tQlB^<9Ys0{ry7AKtQv6g5~jlWDHt0RGE{3ot=e-oG@xD(qD&@Lj!4jMtPJ
z(_7NzekmB6AyQkvDe5q2DiMnq1E$a<6A<JIeY13`4=vG=3Df{*`HLcxS}X=KgBcm4
z=%XLQXIh<!D$tC6lx=5DcKtX;Dua{`0R{gVLD;3?ZTY6l!=pUFgIBXZK}Bh(=z7pI
z{7j1&gR;s{44b^q+5j$(0DEpE;;1BiCHCIpvR6m9UE&JXs|y-hb*&5V2&FSWDz(+P
zNg&IPNzmY2$INJ+piMI#vp*b*;+NbEC*Sb_F_OV(`T$wm^2=76Oj_~?%FxkP4oGx^
zO61269lfI4zd_{~V+s)?dB||him$1A#j0a{-@1LyScqF!-3?A#Llpt)TE3A^F7~E2
z7gfT<LN<y+Cun=OhG${p@T@rXCC@py4(&Di+-NM|1WRegf*+UHSIsfmu%V2w{=s|D
zP^ao1wagl5u!`IpY*;9I?c*R0hFeH3hRvU%t&m6sxJiAKE<k7w7_n?c)S*QAMV=hD
z3N+~`@`zV+(340MXA;P#Le!B+%c%|)!{3__<AhK(ONz7&lVtuQ#r5a7{po&RJOINB
zNMBaoP_#rn5C69MEuy&5;l!3fps-+Ds`;VlRIOy>o@qFAYpNW45`Hsx3&B*uFYo!h
zG-dc58_a9g1tlJuThAE=h~5qsiRW6i$~JsB2n7DUw<c~Mq1E(&oZl&zxk%B31Ri>%
zvHjYG15(ucRW<%(!5?%Sh4Skvkm(hJve<rU(P8_LrXvg+V8hgzX3z)-=48pKKQljU
zgBCLnk88injSEp6;%Vs7rn!(o*L;lR#$q&Zrc=o-U!VHnW9|lI;IUp@-K?_WmorMG
z)t*eeLS?S>kN;X=`BtLI^lkRDnq64|AFQoGI<{kzymg%U4&R%`)h??K4RTFedd88<
z)Wj*&eKBXkEPfPYyhc<jUcd}iEUGkNU}-~%3?6-hT8~H<x*qfE=pK$6{)i5oL`o}*
z?f3l?o6gbI&si&6!Np0o*V&Q1Bi8xy)oxI{s1v5IlD$7a4Ge>CuWd2C9C-2_WBt4z
z`I+PUM8miTny37z=hk;9wugoL2&}|xu>_k!wbY(FYGwxf-(CZqKaLgCBe5}=|M9Uj
zD0+r&LqDGzqneC<;x?*yA!+2Y8rQhA^#>3TB9zY8To02bD3F8VvdUtHPheCm4<gQ`
z)gjNyiQ0PC313H?@iEC&l|z3)6s~Wc_!a8M@O!paj9q5j_P&4vvPt#7N<fyL`ETj4
zE9K+4QC7Z2IK~qz=e5XT8TmW`s<kup@#8v#@60DlnLpVk99qxWc2$PC!u;?WGray_
zS%vDFttr@W;O`#?!*$jXc65+rq_;!^xmMUN+v3-p`FVk5jkz}EKuX@2hbg&_h?{y(
z=?#Vw?Z$Bf^;~0&cN<X92=#iRMDFrh9_?E_(zuJI&4egc0SpxL>#c*{)f+Gl(L~H}
zxYswtV*amm=JMnr<B(kF@jIaX|4&X~WH_jAlWOP&`<>I}RAqTGtQuHvA}?vCX{c6E
z$1uGO?#0I@>(AM^&yQlPW^uL>qDD;C_1e7rq99e%sG=J7`C2ayP?o~)Y)D_t)j4M<
z5E!I4q6fR|vy?{Hy8>HfGx`@3M20Vr2!pWBQ)>89Uq}E{)a~)Qw|AxxO+#(o6qW9^
z_M1uNqmE;B+}gVN@@&2}Ktx5m_+YNb_Bdf>yb*RhyA8V|$PvjNMJwni2_V4ZF)uN^
z<SNrwr=#|6K|>7+7w_y8bRlMWT{tHui@SCJZA0}GE#bk!aSGMIO&8mTra{hl@<9~g
z`#mO`<CRy0;JmY*(>q`|MV6Wb*Wbo2iul+dT7nZYAKAFf(h}|-nlySuknqqaHJN<F
za?)0OQwN=g8@fL*HPNko|1ahIxZQ&1An8P3^tiv9z^36|Zja!_WmX)Sv;Gzm1%##x
zq?DPrhy{0Gg<OBz&exmCKc9zfkl{1H=Dw}ChcJ45KbILcox?6Ax`d_uz{I-j$(%QD
z3_Sc3C41^cgwLO#TnRSX913Yu5xRX71vK!;qoP*`OU_ivYI2iTpRM=^8DrZ*Wp2=s
z4QWZf8n-VzwQsPR(PVlf@uTjEuZGo<tvukvb4~vwaL8aqv0T=fPrYa<8nkByjM5B4
z|K2gTd>6Vh=mFN3C9yk3o9zB}R+$9fyQ=HXjPmU^9|$<SgkrCnNBdKs=O%$bBSzPM
zToglMA=2VApj3LiQnQL+k?fCe&JZvkd-B4s=631kx@(19fNOECX@ZuGM9DF>y2GuW
zXLZeVR9!_bjTH@e0F^IeF6&u{<XBz%l7hg-;_TDNG<aI*68RALe`@jT!?3h$!BMbK
zb`albO7C&%^6OA%pB%bUs>eNp*KtN!C=8HOi}x3j&ur0227BL)=%|m-UqWh+d$h52
z&4>dz3;>0xd!YE?^mJt95mOKC5X=s4uf!o47nX>jpDj<$mc`BcCku!-MJ7ms-mD~6
zLM_)a2Cx~0dq9~0YPdR66EoUyB+djX528h~Z?;6%IvphgFD=T2OLbvazl$pI7A*+Q
zQ+}nqEe<qU>V+tB8e-CVOkzcSA9%Jd`W)YR7o@=wR9Ww?5`2;n0)?-i%=>F8Dbs&7
zr3djgbFCE0Z3ZYd+Dnv*(0dtu?JRPQe94J`fy!*~vrhzst0qntdU|OG?7%6mrstiL
zprq0?+z#7ua5-(P1qpEbvJkEG?p01T>lWe$p0Eom2GE8GIpuQFw7wiBVH9xe4e%tS
zwe{aLt}wvgK}+$&i~BBJ(vxsWhE>(-|7!H;wSMm`7wE@BhO6bcG|fmUFNb}34xG{%
zBjbuwb1Uf4{iNN`uMhya2EY*XWSn-Kbv+TDS6i9sSN^oFJR#f^c<;F*QlqQFD)z_=
zNoSu))us6*<@D6K?>v)-LT7(MAR`$qO8e{l=X1#3+fSz3=}KILaMORQkftAEDmuE>
z{GnJ1GOwBTF*@y_a`I0A1dl|vmSx|HgK}`oXuOAKSLrIQh=8r2R(ZQeb-=ZR4rc7T
zTB^T<h9G!7%vr`Ar6>`1c0ppGB1W!I0jUeTW}V)u;ZD+|mo3?_(Z;8=*?p8Yoi69M
zUXEu9EbjAPW^ybLbRFU6_OZCe5&K@X*23FK$EM(LT01nkA#`Ip{L>OSfu|n&7xo8p
z`2A~YTlTl>GRKDW>0$`I_w18q0~DM=M+V8k5Z+%A9?~dX2Tg9Gt+9Yzx&W8kVG(-q
z-r21}Nta?Yy?IBJl}k^HBuL1|*V-q{2_ygfixzk_*%co0x8u#(`1dIVL{gv*7TEJQ
z0)U=?uu+P{u6M`1+L1kh%a*|@NMg!5%N;?fVC0zrTn`@<j^K>urAna(Q!G~9(va|+
zA5PHb-5)~Bm0IBdF7MoPqrLIua@wps7a=BnldY%k^=O)czMK6IVA+ZlSpZE=EWW1}
z081!4q{$fzwIU?BQ9~O*K&2MtY*5ie;LLEW;Iexk8Wt=?Eg-@5(L@V<6j$vNT(@nX
zJDr2gp{f|g_2v6~%T4_Nj&uLJ$o<=pSp_6;Bo?Sly$DZ2UnY)ln9`_)=nngts*gCw
zYuVQRtO!#hC}J*U999i72OlqU9tS*L%{P+5eN_muxGUfa0rI-cs@96b{qtCxZbZ|G
zXT!z)ga?+**>uP|LAqeDV7CkIAIMcptZ?1Q-WVb^G8W+D76i6@R3PfZhwr~acR`*b
zRv~&##stTYzhh}ywXOtLe0PZAeW*>?E5-T1b!QM5^UD87dazMpQXa^6iRn!cOJki_
ztjFqH-BclzY}M~BGL_oYmwxEck4P*4xvqH(cjisW&c2{a)1E6wxsAPtN7t4v70dI7
zRN(6)p7ITr^&u1?37n<uP>*<O>t=+Gje+${8Bmp~*)r<lNI}MNCNy<BFt=foN<nUb
zh+vi8?BZ~%<agBME=f}KkM+d-0=!u#Z(|FmsOJiszBz03Ew+}|63Q+|661J7G2I3>
zk3RAiOXYx!y?CI?NE(WEV4(^~?}W}hM5ReKb&99{+efg|_Arfv>8hasaH`X+`GhD9
z#wP<oDdU$PYs;D&^dw+<GQC>miT9WExmKbJMNsK7w@Ge{Tq|x-4HvHP=T5Rm<5tbj
zSR1S}!rv^%Z!TiOgg^i&eG@tytg<7br0#2BrL@?}MBPhI-~28pN4&mHS9M&>Jj62J
z{ywWISh@wHMeze#<MSrBvdD9|<k8t}<zM!?Hw7#LaSvW;MGAVIJUr+^!8Zb3C~`jr
zvMlFdS^yDUI?N@eC%L2%4&!LX)*1>}DV9VoMQiw;sweVH`@QjiqE~f@4MhV!Od<Qb
zO#HlU8y~8M)a)--MRAR`p_EYQ@2QKOgY{)Kpzjb1zW38kN?GOy*@4=;{##@*0#m?R
zMZoYfgeO>I3%P=7`JJXPoI+8Cpi19sKWFnwqKa6#Mx0hwv^n-8!Se;Q<L{(V?R5RD
zVXvn*<zr08Vf;cEPSOC<4M4PvZ^{mLv<#jT=<0u}q1E9Gapd<_TLDDTg!-HeH`(L$
z%0zH&^6JD?RoXRlyj>M^*=Og_F@n|+m-DS&dP^F~>5(n&fyXK$G9MC}G!t$1$AnC%
z9DOmut{$bFnZp|t&Aj}Xt8t0725Y1}Gc#m>zksBi5`Z{9av#{KudUKJ!SJM5-V{Vm
z@c30(Q>OsJNT6Yo(GM<RmQ@QTAqI{0rWF2k+@R0itv+;}T=XYW>rKYtI_5+5?T})T
z)(#<=zx}nujTUp@s)avNT*<CFtsp8GL`rS@w>UAj3q=j<=CP~#>j^*tulsz<CAce3
zW$4A_68#}BSZ89x^^3pQ@i15$*|_m#TxbUe+8x{zM}Y3CHx{zppdI*BN7`9$qB^QS
z(=aUa5BYdSM0wrNGr44-H3d0ivNOy&r$nqIo!^p;z`TfU$MBFL)t_#xgc9`YgK0Q<
z_EvM#*siC1Y3yRd1qfevZx6NYsm^xCt+8#RFh3G^`_ofRm*3-q2<UkEmA~d!&XJax
z0`BSY<R#f~_NB?qooP>I*`JU!pwbsVbxju=t`?AUNpi+ryp!H+MnZ8H88u9}((Zx0
zr?4v1FpPN5F_k5ps_A|y89|w}%+>DCobC*}$wy(fgpI3wA(xUjnvL7Sc>5~t;!0;a
zHR|I;{H~h(^(E0_gi)Wuw6@w=7Y3Gp4#eL+5h2nXbIPVW&q<v8K`7iaA}2q1{^4s{
z4tvHxaRt@oCyb+^g}$1R7XC^miO6KDV>nHYW_IAoGdaGH$Clqj#f<Uz$r+H0*EeWz
zG~#mZ5iPK&@<cJT9H=Jzjz*37EpLRrUKBhNES0EqvNtJHDpM;Y159Vna4345T}iPN
zHA3mKM)=7w)_Aje9DwI0>PHYaU9NkGL*iz@+rNP1UlA3A=-zIa1}aa_=~5*%vXY&6
za&rkLbL_G`c)><5i1bX%dxsTc_=r2Ve#5U*LP}#Q9;A~VXylbEu0#UkhzjY2rPofi
z;(VPh-bo^XLEfo|OZj!r|K(7@(FNTOv@8cD_o`;vw6g!bqD^qyOw#?R`^1CK=0qxX
zPt_cA46$Ro3X^Lp4VMHF$F9b*QaL`S>rNp{x$mV15Nqo|I4ykB415+%A&ib&m0=~T
zxdPtBE<olB#)h+f#w+{@+Vp`SP|AU<+YRQx=u9G$F3b;V45K`3UW@EsgTLN>TkD4$
z?p~qFkw;cFQjoi<FGvLU26?1u-k3)TaS0WJb$LMN$XqFl)pOY05fj5;g0@v!`}PM(
znzjq|RQoq!1$j%Y3m*+Ii9u`$We;TazV1^0^COmAL(kwN`SFX{$oSyDjVn*pU5qx<
z_gz1#*$l4M@R1`imi)f=Q{iT<0Kw@pgtl`fHIZp*Ieo71lfg@*z+l}~%^wX;o)-#E
zb-Cs50szlI`*Vd6+XrHq?gaD=C_tNTu31ci9(t$Tj^|eERLT+Zl{OTws(q0eRvbg)
z@Y;wFBLZeryi}l2UKrwD1XSyqBNvO4D~|t8MtVyirK7Bd&@9rEFqNW#Y9R^wGtC$)
zU%;0s`o6vnDNNk14^^Rf%^VNMLpKDTtMW3RPZn7Zz1|qZ&jf*rUOzu8Yu0ZrS2Jf_
z(1d7hvvQj1FO*Z0FObrW;Z4%jaJx#!<A{X_lIXv|udKZD{8CYyrK0DQ_>PyAOn9O4
zcTCoa4Vb+Rj%k-OMY!l3$dK|*r3B7#wDR;fQuc`pX6QTyZZ0~P+H>f1<8OqM`#9s&
zMio5MlLbsLVh5n4z?gjiVI9XhGRB-H`~Q<jK&0NP2fVNoNJokGXbJ`PlcZ*nh&gqv
zJ?e=)rr`o6cq$`rPEj1Z2IKRZMut+ZBmER+6U<S}<@-~$>B1!7x>n)iPH^1G@ATV!
ze%ic<$n}li#Yd%5SzUsspB0u1OVrTq)aHy2f~k57X+0QTtm=;Gh0Rp&p>_>hx@@!U
zbvb)))zHd+WY?YKpQ8H@iMmR$e&1Aa{a04zku7*l{jl_=1S+~}X-iUaaE%{9MNa->
zqm~ln>l(V?dtRncVMYYv$xPm>h6!l2H4@c=7ekt_n4sUghV<abGv{Z9;{$I7{D{cC
z)v)kyj8yE7&&e*7b94{kCALa54f@BMJw)vQnDrOJ4UK8!mt(qcue(uT(+!$S@+79J
zvcOLItW^Cd;xe_3%M)qNJLfdzM-yq+W(fO0hS~$~0jm?ncK&Q}&j|Fu&tt0p3cIx0
zCmlXVe+TwP%Q}Ap>MjPm;&dqzmqQP;;vwel9-fDQdWHp_Wgz7Bp-MH8=-N8$F(Q;)
z_(8{`=hD@&WXdbgGVbEjMl0Zr@p0V@C%<4k5CC}eA>o9ucj|^CB)i}%tM#4D96&7H
zyXpH{^-Gi2g7xY#8MmA6RYr*{&Jqd9?^8(6JPSM(O*<uAXH#aJ+cktMY&JY|Q8r}F
zFKq4#H+E<T`wi$Isf_^gS`A31D$HdawNat=JbNVS_?)l20<Z3MpW^2HlSra}V4F(9
z+it+j#D%`aM~X!nCPfnLym{v*)`K#TmDoFD!dQ>gh86(H1TemS4X6t60v?Z!A0Vkl
zg2IYAA^FE#*%M?Iu!#M?ZmbRlL|P{!VMv0Oz8HDM190AUwjfsk|K_K=TpOe?X^KqI
zro}DHXv@uKf;9K#kXT(+;)EbEP2E-UyZDKwY<*kWqE&fID%%5?dnyBTDF0{^0>*S=
zEZ{vJAKyU!V>&&>edqcrpSzX_d<~hwPDB#TS76`p)J?2^fFt17_C_Yu=sm)1(3d*@
z0}CLwuaXzZdB}`oDd~e;&*+<04lU@EO8v{FIg%D9YgYlhDAxL!YD)v1`pbRmr%^v=
z;9B|$m7eW|gOEsB#tEc;Jr}UQxmX)mk>&yFHU5@y&B0;U`t+mOC*f~%J7fC82x#?A
z?R%8D1|*U_YuGjQq+=FMF9Fk$z?tXwU+*@AJ&i9DHpG$roS!=2gk03iC+ZMJ(v4+G
zzP1V!Io@5cMG#$4h56$(I&&17UrP75i1UZ&mO_;`lFIY0*UkSwMm2&kM}eCN!Rnb~
z*ioG!9G(pz`ex-PLk|=e*CWMPsH57ID1kZ=V9e)~>{q^oiqf1NhetlIl*!$)bI#16
zV2nGRg^Yb3=6{2Q182FtAO|-(<o$)&)?@vP_}5j)h1Sjkj`%~%3Okmv%#S|SROR#L
zSh-XI8}bSlf*6?BD47@ETnpE_4sJk_(31mmSAX>;+9LN`K_ItDD~!steZx_c_O=Dl
z7amY<4Lo*_TRu`-`39CheM`l>FSOd1iLY=bsRyOF`I}&FzhC5#dBt41xS1~fbx+{W
z3X`F>hXyk;t=mEy&qc?RgpN(s-@Wpd);u=*Rjar_<E>V{62m__xDffb>FP83D&evN
zZye!(+9HTF@Bh-TilRpc_K%edHe4miUY?W(aZ_T5(zr#ZSy5}Ks7ylV`ow^LNo@0D
z8bZ24S?&oh@HfrLLXzwXK7#h;EEh4{VBlkqM^2bv`>&M33<lzPd>c;4%`rEzZ1dS9
zO^Iat(Jei@zK?a&b&fR32Oy~0qpR7XEd9L{rFKWW;Y7REL4bTr>$UxkJnees4~W{H
zl&6LFWDp<W;o)RJ4)%MXvBZ1|pN7`z0gi*ev9cw1d`g0MfaBgt9|YJ)*%O&S0fR-~
cuu&|b>8w912pGuQ`L@N><iKeXe?DJvK3l=-JOBUy

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem976-cert.der b/certs/frodokem/frodokem976-cert.der
new file mode 100644
index 0000000000000000000000000000000000000000..3bca3b3b6dddc65065e457b0dba973c7d24daab0
GIT binary patch
literal 16107
zcmcJ$Q*$m16RsKC#)`3G+cs8g+qP}nww*k&ZQHh;?DwmgT{VAT4*Tlrs=NB6tHlt=
zcghgR7n=_X0t^Czq=173iQOwld;WKl_#f^{6$1<e6ji9i3@;cc2!jJ7ECVzIs0tVa
zDu{{_BN79`{|qQNNLf2uX9HV<|4Sg@AcgEaO>7Ko|1W`ogLJdAHdRuRVT5OZ{a+L;
z9GJ3+lQSb81MdG!P&hO(M>}IXX;E3i|8YW5VPQgHK?Y(hL?#9%HU@S^CI%Kpc4iLE
z{{Z8EfQ^y!{{;*d|3An=XF&abWWoJkS+tz&Yz%?CME}bOML@Iz2nZxFXdo{#P^#zx
z_rE;prCXp&>Yx47nS@PAk}aD)R)g9^)%5Zda%CkYQgD9yqx{|Kt*ZB`vuYz5?9_&@
zxpl=$G*R8giVmXDiAL~5hD>Sr!^6^Ol-J)=Y0$g88IZvpMH2N$U%IBbL3P(eI0xk<
z^VGz^^kjv$rB=TtL=R282&}UBU-akB^OwLhF=(2k*x(~`=bERdn?%Y74z2BQsm2ef
z=y1Scm3R;NTJ?ZLUc=8#iQ0lc1v8W}MS7LvMHK-4ke4WD+xXjim(xnuSs4>*Z+M1r
z+xiYY+F$47s_sl2xdn@>)she|e`KD^7HiGZr2yYy?i?@SY>FT(;4xO~{)Zl{Sx4Rs
zL_2#Ll3ICY^O1;B09Nq9(0h6LMmdKEq_FG(p<a$+3>VX<5Fig44R3m#kl^g)nS2?l
z6B}*^@*^1;1GWe;E~wwuXXmN&YxsVN_cebl%<9ZUW3Shxc;tM95%ZkKgBeWZj1aZ|
z3k*Yo;o~5ETY4;a-obw)OyUa4>^|-|A%RvTdhxDnxU=OShqW9NIHqIKXBTO{|C1;I
zO{SZ~f?otL8~BDM5E%9ElcBcR(<uOR<WLgv>@S7%u+=XhD@2%FA>WRLDyYSnkHvN7
zRsPdBpWpD;JD4Z8FP?j!I5$9RURpeMf6qm?cNmyUUe#Bc&UxcSe_XBW$G?6Gdd?c&
zWvDFths<JAYQ}ChJ>?Try09tKgAO%xE1+tS1l?+TJb>dOFi@T}2x_kQPE&csOJSWx
z&yfC-4Xw>3cCvQZbxYv>y4DBbC$MJgaIm(fy?=g0{JR|0TR6E62FFkMD5xrotqpQw
zEILbOivoZ{+3+j5h#=OgO<wJLoo5N4dPskyo0{j7k)z#^HnXfD;~*cPNOAef7t?1f
z7BAe}4uJ8L-!5wus;)SvaFIfoqE_EHFtBjmI{<DGMMFAUMq@R`*pgh=60_Y9OcKFy
zi<<dn5nDx{>nfZ{^Vm6qHpXeB7cj^lMyIu-NWGplKEVY1PM~|#VA8Gc8KjoQbF(|G
zvszZMt=Ng|qWQDnk}&?BwC2`iY{+!rh-4T|KSFRD&F*z%e?AgLh6mbcP>?I!7iC6|
zsCs!wBo2<Hb4WG4>E7>Z<g{krmPa`Go}!HF<Dd(g&>N+VDJZ8Od^rvOB%Cd0k4S>*
z;X{NR$M;kNZ?$=0%8<#wug%%cut{?;lB>DfMHeS{?IUe{z8R4DJdHI&a9tN~MBqr%
zJ%2~pM!wgcQ%+>JjY4K$24$rgGjif|t@a&MPSS-V?tp=T&Eis#1ehb($QpBr{S%e-
zV5O|Z{wuhWua4+aggC<G?PQ*Kt-lF*l|d}b<T)=+UmG`?#KBLwUXkVD5yUS=w8YR8
z*LOIoM96@;nPmSg*SOkwvo2q0j72*>5#jJd88x8@rIOfa#}z~<=N`P3vnDx{mQM&{
zlTv&yhKesE%#IUi;;W`Q-aUUd(eZHYC*2{hmT0uNWHLX4_~`%&8i&EYl?977{t$gm
zA6EH&k#uobvE^4Rd%dvsuOsaW6tncQ80G0oZCrEwLtuG?h(TiNIojJ*_{abPIqb*Q
z1bRvs+}6a5lMhMlt$g0CRA^~wk^q7%oZr@@foKn044D~bVaIWlYZ<XU35;M@CiJsz
zX6&Bu(``gBb*khsVe-+?D2Lt!<P!FC_u@ezhaW590btHmq-yrkq&n!m`CdgbhFIg{
zNkxC<_=ZI)W<mXuwP7(7gCQmUu28bK4Eq&Bxc1;f-JVvp$zi<v2)S#)(+9o4jM~0G
zzZ=vSF|Lu?$#F(yrkq|#-@nR<#K&5f93fh4Su039@_BO@ASSDb!A82~^JcSrq%fe#
zFdBJ17NNi}+wOHipLK*+YjiU9`%k*fg=(@u_d0sw@uU<1`$O_spC9~cSmLV1PRNCE
zz!9QZ$7=Tzx<8mp<w}Alku1pr4g(8a8t)JG0E=tF0;LvJh=bjE^5akT3=YZpht~M8
zDkEmGtIMj}I@F?pOYaDq-ZKQ&Tx9kV9%?TQQS5`ea1T7TY1PUYs*vN2hek+fcmogo
z+BR266$*=xQW^HLYpoS8L`Ir`NiOVTatxwB;^OzUJs4%O$xt|{sZ^!qVBW3uW{b(*
zwjVp1{X9KUz8<vqzn&gXEsGAxgGs_dG+JaVGLlMcnNy@dfqF3f#Q7=={i2_p5L7pn
z#3uW%ZR$B(D(ML8d?Xq%(}hmTKRk;NHOo~Nw^(lSp`+FC6@l73olY~|9FB?XD%#2R
z*_b5Sos0hzF9F;1VdDK*+c3N$dxgJ@iw$`l^i1Po=9t%m=2?A2iHauItbbXQxjC0z
zbI=RwOPkC!D4aTlLW7;br=n!j28@Ky2}+^{6hjZ2$v_EiAeO|}ae}NA1*SsqmbD_F
zd1L_gVw$gn3{VJH$X1_aNN%oD5-QSH^pCCtC8itcg16Z=Um%5xf#ZZVlE_oK8kuOR
zZtWAN-H+b1h;<ylmoDwZ4drv(2XI_kMc9<ITU+A*W>VX&vD|VvB*&nS7Yit1LwqW0
z9<i));HSMKpSR^M^Vy&hhMc?R$CkivG>Z8!Xvh=3Do<r!sAI!~7gPW!?|BCMl_IQo
z1U|5tX?j&UPE*P)tpT?5F29N8PySL>7HK6KpS6wiAa{7#5k_+8E7C7^k|-YrC)BIc
z21$oH|6M>}oq&`0=T1s=a=h0dSa>!j%w0bGfPm<+k;HDyB1TE=mrB*n@l+!>3Y*U3
zz8bB9i~wcU?!Do$YoG(Kh;B<v-B=LZW5@19lQ1*iwzgAq1pRF-qQQFUY&)f9_fLv5
z)|MmNP49%n?M3ds9n(N33{4(s8rfLkIt2rAS%dnBq&#N)zHPA9VF2N7QgD)VO?|I|
z#sx9BIPa>QI#$++x^ta#pa!wFZ~qQUPjJ|mr_dZxdI&~;)%|4GI0|ktln=4#h?3QX
zrRVVK((+d^4fo;^#vg8*A>K8n+h0c$?Zc{9fJ&A?&y*8=vfQ0Dd|m!)yiu#Eg!r9?
zeGmU~qYCrlxohazD@0Q(zg!(h>5;Gja!REE!G@a11rOOtZPH-(wqQ)LTJhiNmYmSS
zP8&HY9C?rz$gt@8EmnNeMbAac0mW_;#5`AoewiU5?ajhk0RVuq|HqMBWKo7L41m@L
zZOLgmi8_c=<D}vru|_A5{y+p(&N3*_^LhLcN-0C79<+?N%o5?37Tmgz#LF<PIm-`t
z?h;x-OpD{@UONRqarDBc^^D3=5WTcl&$9|-qf24tPSm5B`)d=7iH)^IEtewVaKxa_
zaV2IU7Ynkyc4Ot%Lip&z@ktbbJu`T3)MbzCc8(M1`)LMGrS~JuZkekR?B4}d>{~PB
zH#EI67(i~1d#J@4<Z((m<U@=G6+f0jD=aFM3K4fk97rC9K~3_P*>$JeCO)a}*oQ}E
zxxI$`KI5r<4;`t=1dO~C4lYi^vu7S@&i11nI`<0M)z&dLA=!iqG5vD8Ec{-=8{$ap
zp^ZE@6>`RFsDeYK)kzY?-}bxPj4&wrb{n0$O!=Binr-O0;0mBdd4fp^uedO7LQaiQ
z8z~+FoqQVA22^n{u)I0(h%C<^;=lp_DF!M%s9G&cq}vdAeCEYPvUS8zFFe~jLLWuW
zuRQwoeN@#RlsNsG1fMrpN0^4FD2gpJAP3a9O#c-`^c*;e82Z6(CP_D0*g`Kso_9>p
zampy|yGm8Ipwgm-m<A%V8qR`nb?08m;1eY&D86_DYp8Fv!pdho9}AVDZh_M@d$jD@
zRYaeg%45pjuJ$x25?z0dwpPn1i=tnJ49#9}`feBJVD%ZaK3+2o?)o6olbJzAo;D!F
zj^j)<)YCh)dg|n%n%lYcB;qZwJJS-k1kcneHa1>*X1krfW95EM&~<~LYze$xY8G{Z
z5IEyy{CkB&0}Bqb^)Ru|5uk!WxT7V)k&d04P*4N?aIXp-!k@K4Tg*W~YM-CV?Pw{h
zS};q^lH3=`W1RI(q!VI%a3f4D{*Y}Wq4eBcP^iXZyHnaBwjZJa85WkZeUn2o691s;
zIVt%_Hi|iU@>Q2!6LYh(#^P04GX<h@!AoxSMLWP97nWOlqtI9`T`!|mZZb>mI*Lq$
zYA(F_a6CJ8lZ0V#KEJ4(RD2?74-`E}+I}BcIgF+Ot7lmiR$cf~c3rLHvqj$h(E<Vm
z4W^x!jCFW?Fg#ln6+luJ^o*`Kda7pz<n$h_I)t%yJDes=4r8zbeaBbOIiaS+rK_)l
zwjw%}Sg>rH0y**(YY11j0u-i9>UFcp+EbOJQ*4mx)tmSsWVsWw_@`_A?$*RmU*;er
zy?#Z*D-l_C8R<u+j|q1)8-Br1J|K$;xHe<9y7drITRz6sR@hrwFg@3dK8Bi-Ng62S
zMfo-@Ny&!bulaI|@uXb?8U;9?h=N(2_{VqB8LG33L(aAwxLb#r02M<evVjqDL-@jo
zykelom&Soesd6Pa$8j+{^j<>93KG$h(k@WPyW_*W7nUZCV)lnD!G6o_C=Gze1b&zl
zrlhG+>~!LD8D#hk<^A7s0P}LEPRS*RkKt~Ff@K2ANNY>oZOQBfk(Z$L2#$1BBuQ3$
zmEXqWy6d#K#x)YCiB)79Y6_Xk_a3pPtc_JC-B?dNN(3nE>wp*%ix+~Hq}X8dt4aHW
zx0+?yY%r0840U2*IqM@qW#V1dg*kB}&I*<U(a>nVK?F?L1qVL<2$NU_OKDEPE)#@w
z7kNV)C>D`+YL}%8kul*gUi39@Sh^~WymgKU6ZPU#T*Xi8SebYDbQ1G9cpEvg{2S>{
z-66tuA-FqLauqwpmf{_#TKo>ek62#5-GH1j6{fxtmAK01^q(eshvJ$=mAWepEh0@-
zHXk09o2J>MutoY4T45f$)TWo%pQZ3zLac10cer4j(^@jEwD8XFwVOi(a)%GN)j|o;
zX?8ZaJycb-&wu#BCU|$!6j|g_&@zQ51*P=w`GYtnt=%bZs1bY>rEEJ}e$SpM9*NJF
zui$@To~#~Fw%U55n2KO5eFH2Zb14Bmwc}{}HO+|hfwoi6YYTzo@qr5~(%_-;Q3(&L
zk{1OmM?RUxE~UlfYt~4$UB$)#k>dOMWMm;1LwwK%qG6CN`_N<E?Y-N)*Ke$jxihip
zmKV-t^25FzXzdB>HhGr0fKC{5z5A@plblQz<cAa#sbg^Qvb?WHddFNFl}qva<sMXB
z9h?{OksKF-n-}7?R5e4^r!=VCHKl)uc_H}$$kJt-<RGg?KNSo<rl;|gr(3x`{A(Jq
zXQsNuoGbzZ-JW7|8$@R~cZ|rFnI?%nFrNX+#KCGIpk%U{Drez4;BsqQ3}k1mpIM}G
ze@^}lUN&-m6*dL@0Km~J-<P8$fj5FSd=o~vM=l+@RfZzZ<1s(KE*pulWD7K*<ZbU1
z5$;WPAnuVxx!PYaPDWY(tkwWj_dp~_4nN+!z28q>&QZqyi5n*r!A0+V!V6RcuVv6e
zBaZC!ilceA$o#|VV5T2yyv04#-P2<hq-`KKiC_uUw&PMYCva4_rxV9lKHag_^jdp4
zAXE>Rd^=&L>ap1zfRo)ZRJhC$iITYgj2Qk7gk^jkP^#!~Jrz?s`dnPf#Jd=aonk9f
zb`&dNt4q8jL!$gif1P$IVyWV>;Mu)*!D|CCWc5BOwy|ENtquNyht%S3ciM~J!;G40
zhb&;b?x~}U^t-PKGMS`I7L+G9-?;!4B_)d~HCMCnWYa(MK+=!DucTjY(19RoC1qM~
ztyG=7h|_?IsBAXp0LLv3Mm9Q6#BmM}<-6v`P|AMg@mzwdC^SElnlUW|-iIZq*+*Xl
ze+v&q8E3um2u=N6k2sB)bh<J}=Rfw5>mB0imPz1<zisMPHg!-Q8(h<L?&-L;mnula
z4)0>Z{%GOiG59X>{>mj)b72Nh^)i_+*ZrxRMd8aww&$xW*@#6-=)DO7D}^Hng(=vx
zdW{0Hi79&e=kcZR*I(G86L(B*UH6s4WSd;L_D-iH{nm>t7+hdFTEfDJ__~^>i!1K-
znmCa!S>RnCy;$v|)3K9Y(zv@iY$}=Y!pB?#kEFr(1f4j4JK8!=PSxCctCiEJS_c}v
zQfmmiF^27aqd?7D>jgm+j62kqwEmtBJH*@KRoxqH?Pkc9a7ZAgA$H^mpTQq9?k9`K
zX#R&l4e#P*9Ocq3$Trg9L{5@n0H{=KlrCC3!6RC=pV?|7TvnGph*ia}>d=W<*^qx%
z+NyfgpFiX^RiGK(5Lo=aOWfvau?>rFC+zs?MC2OkMmXRCR3Jq)ViGg&zo`@*xVFB^
zg8)VgL{0X){NVAF9nD*~>J2pDR36GSL-|tF3DE)_)7VQZM3RzQ1PQd@dVV``Zs23`
z>vE}NYcF(87f<yc*-YKonWmZM>aIntfI68$M4<ZMh|vO2!~{5>{D>_3BSDV~8IOX(
zD+AfgMIZ^@MoO7_Qh=+TCV<BZb6~GpN|h}XrT!<jT;!#7N0aXi4a}jNC5qF;@glrw
z#SQ!YoCyKa?E9V+*V6?8jSE7|#x~^jXdK^)z1wB<2GI5kb=(|V76r0^7!+)c^hkh%
zuE-!g8GyyURQ%_q74B3Mn+>ZP)+?6QvO#oJ!{|&IeBXLwFM}y+iqxPabo@^?eZ`QV
zBVNkhffuC;d+Z5m@h8?HLq4ubx74bbkYQ20i`Z?{;ZI6Sf4PD9_0uCP!#V~64tASF
z*seo^LtUNy-O6!)qB>Z_lVw1qM0V6HQr1(`Kn5aI+OMb?*4o3g?Nt2_6B#d53&-sN
z+pC~JK%6vXzq-*o#6fg{V_A=AoXyekyG)(S^ZPFM>*Pk}`d2G6U@knv;v#l_b8K;|
zwl9xX`8pvn{mna)k_kA6lsVQd$cGU3q#EhdQ!W})YuO9qWR<_t_i-`GWigG!)8KEX
z!D}=;zWrumIzo)q$+mVIz;UN@aofpZsYyxGv)7L;j>b|ogO$vo0uYZjU$Q)Jl@kxq
zI%~Ov_|~d&m1A9n2r_rgV1;GrhMnFU8oXf%kAF3XUU8oPN;2olXXq5G&Nxi25$^(A
z_8i>WXPQl#%Cgh-cGPlWM^i7h(dr*24bABdgfw-ANIaw_2JM&{d_jRcO(sfJEDPEh
z=*7bGk~()nWzs7$LnqR<0nBJV&%FuaeVVFMSroxCQ7=C~z*%-n&W&)$JD1x_Tedt-
zJF2=PL-j2vgOaW}J_6@_4?Vb(O4RZYDfrTBKvPJ*um0fboSWdfubK2#51WhxdP){m
zbezz2(85uYZB25ZXA!pQn#nJj>I>A(e}F@N8qRXVzTzN4KwAsi{ODY(bV}m|@;D2A
zb!&l|dVU&JXO~U$`NULfuZZoQFNxC*S{_`B`K-b<RUn)v@{{z6b^IE$5R*lC_cAKn
z#nmduGXvBGJOr;%p;H?bSkm4)tFlIdw08ej$C9ReTqPdwB@AA%(COv$FU~wZZSChp
zZ94cZrN?x$PC-;fb|1Q);U=Hdmbm3KmJV*iXrC%J&_yC%_u`OBpZ$2>%|1PfK#L*+
zbRz;DzljYmJ5%a6oArZK?vfu0C2?gDF=HzvC-YL@pVjyggF*@TitteSJxWMjQU=D>
zfaclR>VGW`)ML@=uX{vR1ioO&S}Y`8--_qhCum{VZw5^9E7OAd{rCB-8Ipw()Emjo
z!?<*UATeLR`PV|06v+d@q908%5j(ZVSQf@P*`F*H+6^MF$?yhM;Byy7i6+rS*p5cv
zN&%}dF}Hbyv#0UCQ=FJ<^LsI9oqdhTEO*uzW=D?^lmF)1{*DeIlN7;j7y>O%PD<JO
zM}5c*YquTj5Y62;0?B2NGMjk*O1rJ?xDdNA3+u6^2%3;dmQbNPvkPL!9;u}PO2zP}
zG**BRJ`G|q=365|l@k&AX3%@jYVZQ!R_Z+a-*b;%i7im+u+K4Cq$Y`lWTdZPbr4cf
z8e!rcX(c@#eMCJjy@;!iB$A+`RLS%udD=3<K1lfvZ!|my)^Uxf2Mh0z7^K8H9qZkr
z@fnKL3p_n0X20~a{|58Y%}b4daGXhwK3zkFLFT&cg?3?RMB{Kpe%B6p^|YaZ6cd@U
z&WK01WQhEXv0~{<S4Hd%6;wxtc-NRQOUV{2V<A@Fmi7MmqtCM?@_L+W_b*1<UP-N_
zde}sclq~LBAuvBLv<bxCSe1-eR~ejll&xXW&lXTu+V{>(?6+GoD3{;3x)P}N=C^G*
z0~#7EN&Q!~IWk5eLR3^a4JQ%G5WMQH6E@o?Bin%d$BS4-+M<|C*3(-)=0p$f7VVx{
zii^J#5}qpJtGB5s>AL_5=t!sw|5AlFqJkB;u;jyc@uSu8eq>Z4x-4a+^BgF9)3n4R
z&Woy?`C1F6s2g_*ODO5wHFfWJz0jc^RfJNbk<Z*+Z!xIE`6RB>T-L${_5R70oQQ49
zWoA7y4#lN>U^MwA(&s*u5f|9Dx9VbMRP(CRT6krFv8Kg1hJ+x5w6m~9>XR!L5jBxS
zhYf}YE^m8bfxGAl-P@d!;T<$>sytlAfZMY%-S3xPn+f+EU(k=VWorI=#q%G0fUYp7
zKb{*{+nE;$A%YYyTPy2i%!Alg#}{5!g%n;Q>U&AfhoV!xw8X(7B3avzo7yU4ae;7%
zP&$W^F2-W)oVsVor)zq3;cQ%bBk+Rrq-J~@d;BwtxJr9XxwM%N%4LiWA4lE-W)(xm
zh_&`6^x(?GC>7J44PjoOo?}i&QNvUSr5mI-z7+#7v%A5I<ZFmK`RAMjO`6?KGM7?H
zoj3?h{wcFBSI8~+ELNaq1U>Qau1&+AI52BXp4O8Kd_INu=DUd=8WOKPtgBT#b#$}w
zMlC8T6w#@R-{KtU3Y#Xl>6jbd=X*vXCit`l1P}ulWjRx^yOdaFN>AF9S^&@jvOytU
zLTHjOxfyw{+1JNul%MjMTc<0B>}b=9W+*NAd!l^mA%541CO&<wUY<V{iK-d_m8?$y
zsKN@4?)-Yd0=`6%`PkiuIPZN<?HiW>U$#Z@x@g^K0U(^qT?}zUk%gTR<ozl15!wT$
z`roe?6z(N?0V+)I+N7tADRPI6vrcz_2FUvBKfr$-mL9gJ#)d%T!RXVheUbnjG)NiC
zTs<duH0o@+=StKw4=}{S^uOk|0YK2(sJnBuR<eo2Pz(2QHrtPCQavFod>xUsWH+n9
z$B-YE5p&?!1)OE2Io-o59&@L{%K>Mo6%(%L@>hWf|M{pIvmL=Eb$swT=C^coJ^9TE
zgxlvxfk2M5V$mxRkqc3zt7;TZ_bEzKdKQu(9MXJl>?6S(d6p%iX|!sXdXnjSgP^I2
zi0h-Fm?wO2%{lVeu??(EhM`?&`^nsiI4zZ5Cqdn$*Xa8E0W<24Q-1BMj<pcSG;h_0
zw7c|sfkgD0khTY=Z|%hDiR^G20o97|1Aco$OL$Cn&8?v&$r%MwAz0rcTr-n8i^&=9
z%5~YI!$!qw+kntN`9&?OMoAZT>%Km=8nzv-F&^Qw>>YqQR{Kb(2;*Fjb9*0CqN6JM
zIzTBC4BNfV8|la@1BCvyW`Y@!#(S5ZWC;i;K~`}DIqWGzp5YGitYe9(U5j~~=$ra=
zh%Bt+es1GTX7o(Ri7Nb_laW8tx^yc|`(jSAh3||WFB)$IHO8f)AeqkT82{i-Lmi`0
zFS#=u$+FI(?b3(H^SA2>1pXaCgI$DKJY0YIh)@<ts9SB-F@>5Q=+12yI2JC}c?SfF
zrAT}lx27E?kZxkqHTsXE4td;Y$s2o^tE>CFQVaRm<|Fbv#EP8L)XOHMBVQD;#n%4u
z^L=Dy8NUP{!xDOg?RUeaLrS<Omxh^^+)W<11R|+`t&q&m`JbD_`S~qEI;Wu6Qc8F>
z_sckW%stV}c$93Ap>W5ff0ooe{Gn0R%4EGtVXIkK3n({-)47jXkD!*Ai3h}WN<#`F
zTDRdRgMbOzseumv5IT9w{An@@Z4nXQ#21!6QxOCiWAB%jbmG!Diz%O@Hj9p72baQT
zu%(cBgx^Q{a$GE@K!TwmYH1j7p#|tAgBr?lyk+khHK9jOq9pl^C3EzGghUd&*fTm5
z8tr}#skuk<keaWI^V!WrvVq6%cQ8MK1`c8H@U)~Ln@gXkh6q*$E1`$rU|`4x27vUl
zWJgTgQ}+ASS<j-5L?(^<nQ}x-JuLdoR8l-4^Wm3^<{>tWcd9eG4CY-^Tx7A_^~=(g
z<yx%MsW)EV+I*sS&kr*<T@}%!J)+~dfTpBG0y7xhK_=T=buyJCrN{uoUnwmc!TySu
zjA}9}ow!KG>Qqc_2{evCFRsOGA4r78jCShKp$&SKPtn9dXyT112P)VHG_q`hi2Kk6
zZLulOm(aLFh}+0jAnv7;)}A$j?)H(5eTww&hcCPoYnT)kYVd*xvlc+O^LfXdUK_B2
z8t`nbRwa`n496CWoG&CdEM|Mxzvl#;gvufP6VMtQZ#*RZ`g(=0{1{GDTp3Rc1%hvv
z$kckQRyA)}fLJ*MJLy9|R*E0iq9>rqB^=k`rU3D{(VJ>ul8od;$zM}esZt6}POA<2
z0Xsy@Nb$i;`>v}quHg)MCJrdX`VUS+h&g6R4Kc$Q*MC*Cho$0Ca}CV$>H@WfE#>kv
z_v`3kAor2D!tOTRKvY|GQxyT(ggr9nhw98c@yf8K0FJbR5OXa<tC18g*Hy)2t3J_e
zf#ZxRg_@*Pti&KzZ`-{<(0&|klSGWNvS2jhkcC1Jiu2fd)qTrh+%D>|2*rm0iwh9H
z9Vdno;Hj`lP8+(v{l3O-a0B0{UvIasiLtLg88o3Ec7-}mT1k)Ti>}BEIoI*_1UzOZ
zmW+kW{qykVRmy`gJ~Fj>_1Xb_)!bUokF768!tdD8H?fzI1mF5_-Y_lG-g>!9K6=M5
zG|V=6-Ndfdju{l#&>cSd7piO#^ddlBtf~8#%7{zK2&(O`dI2h^fK7~O{lFuTWAw$+
zl=^um5hL3l3=aw-+++=n+PrN!PD<D);v0I2vIO4;Mbr4OHpwn`ngcux-^eCHbe@Sg
zbQ_x$0JdVarZMK{BKvZ(E#g;I&*8Q@$pSNT;;gk>e-gG)*ol0S=2yLrChQ%4B^uk%
zjj#%wGttFuu5&PYE@`t1yB6O@jMlcCvBkSoC&%krJ^L32+f6})uPBdXq0Z?br2rxA
z?f8gUQ#|^-bHq0o0Q^h|b<vsQTNq&^OE0dfg9ezr>`XqO%?Tad-n4LM?4sE>45iw|
zBMi3tAK5l<#qQT%>*7Saao>yE4G9<#)A38ZOcT>(DkmicR8_8+(%IV3cZI5EGgi06
zb}ZB`@X(o&?sGT*ihMT+b979pwCf?KuKKy?@Sy&m&rjb&41YNk&L6}V#h~4fBep`Q
z2ejj4Y;^EycZ=cRe#mLesvj|Pq4AS)4M9O^)Yc-x3eLB<f}e6;)UMQhh&5Bko?=|Z
z4Vy7Ar~S4LdoM>QmRV85cTLdJTeK##zbrL0OKy1wf*#|Z?1@`^WF;NhLjrBq{oT18
zI!tN}U-`HW5niL;i^^K^BI8vpav$nq@}P2wAwMFjmPq_w56AcG<Qjqf9@EBKSi0Wm
zm!PVW8JqdTA3{^L@TnnAGn-gHG^AwQaF~8W2N4U8G3?b#59U`)B2#<*Olf9SwBZP<
zOq><0Nd^b$g|0Q8`Lvy+dx=wst!b>5K@!k;=881v)4Q^(=FjoHG-v{zlre)84A&Kf
zI$<0ezR)c5FtK02--^_oqjqTxV60o#<@1lpTMzbTgewDHrFVeR<3Pfcbti0=J*uDB
zc<-YnP3DkwSH;G8F9KjU(540S%8SWA&of6tEK_0ttS9&ewck*yVNLywWquq4(3*4b
zPrF~lYC|=f+QXCT#o!&uUpqmZqZ@(D=LIl0(N^kgCv9gx_LCH~@BhYZUT#030_`EX
zJWMid^V7GPAk%huNp=*(ew&(+$Ih$MvXe(n-i}t@424*`L?kNWu`e!1GdQX>giUwo
zi;F|F_4oC4x*&Fft>rjKum5ef6h9K73sF@2EI_g271!SQqUTwsRsEjAXCZdK@#s4t
zKc|Z+>w4K?L4j2J@c+yQF^Fnx9NJ#LT`b50o7pRt#+8qCKKvXSR&>)4%Kn>+T=4Wr
zkdj4_ZCT`Pd>s&4$!~tZ^J*>_GEBiymJT5}cqep;N0c{tp?~(kW={gHUvKS*>JA}d
z+lgI6+7&xraWWjlytdu*p6G=+uzKx!;{bcv<p+^0qKKka&hcKSAFpEn<n?>(@FTIg
z;Tc1W=_wlCzDqWEEi3#Hm7^S-4i=yXxD;?_4?9&6k1t}rI;8sv>oQ{`naKrq>b0;n
zB&XWnPxp~lcMvvlF1Q%}820r`cPSuSKD!Gqk{p-N+A4I7g&%(8n&|jMOv~zWgNajn
z3<n1yfocI`ZHN?4WD*Z>Z8FJYwfGB*oybU__y`F**I3Ss7(m%Ca?7Z!mA*sRB>S#{
zJ_jJHRmY0_ZST4!olxUUH<Q&Ao>!bx)|yW0B8MUy3EYgK=!+HCf*QCr&!O{eV&KB<
z`b?kOK#t2I;DO$3E}p)0j2R@s84o%umu6&aj4N1bDXQ&Pv>`JIPb6_Ia6gZQ<{P+K
z<53)Ri=hs)eP^6@L;hk)eVNSq#k=@W*X?foKJ~+3(v7r(m<!8HDZovm?_YK!8PBbh
zUUZh5+kfL07)Hzcw>TN)so8k{WS4&`m;`h$6=DZYd(DxL2JH%oBb_8$2+kJejMFP#
z4E>%ztSbEvfeWTM07X$0nU79rQuP+p{}s#uvL%(cXulUU-<&90Qx3mmF(mPvw|KWE
z?-Cy^x|BRcOVt_<0bmnddCeO8(SVa4uJE#1JsZaF?qeN1M0)RXd4oC?r51V2G)Z4~
zgE9O{XuJ$AW@WaCFd0Jm;R1l@O?+bH8MuWkOmwLU9nE#95voo6*%%~#(h9EOQ+O?e
z)UW&dN!hykTp!7Z_~MJ{^oe9#pKlo$m!%!x3;NX*;)<wT>y+8o++X#pA|d4DjR3|d
zkzx5rnImX9e)b1^0oMG883o8YI{PPEum*yFQ=HUBKblx5iypWIg|^AH@vA-dWfzzl
z6${m|HXjG8OHQ8I9Q~!EJtH%7crVHh9qy!jD-v-@vi}sb6X%t1b{=Fh;X3}VBvmGs
zu;Y0cf1<zJXAYObxjW%yg39zTvGgf^pa4t&_qzg4N3bi8W(iGpSAT^#-MebD5&pUh
z?~S^oMBQFN=b4-`7Q?4@d4!;gKI3HacAFkD_bT^IDv+!B;qR5SQ=*>)8ii&NaMV&)
zPIZskIxj`kCgR5NL;aYvDUf1nJmOh!Z6%6Vng`(1{E5m4oAaUFJTIx2&(wF9T|0F9
zpk=au!A9vitNm=$OICEH6s#-wk;m9?wxA)K7o(x(e%CXC`RXhOZbu$llOK2u?uKg-
zF3<;r3Fn|aU?qPdAp@xcn*>BB*bM&qOt$$p8lFzD$T``I1OBW43*r(EkahoSE`lKu
zq2?VVxgGYv5TuLS^rsCi8LM{*Fxa;dM2_=%Y`$Tp#4OLhKMBDgLe_LwOJZqv0oGk8
zdd1&3gdUTIe&?Ms!V)rl=Lu!hD8IU<!fa}ET3TBb4y}}k)sD6eHkCd_dEu#RAbf`z
z)quTu!X}4=RO$4T-q?JgHiqV*FM7XXL>AWc4o|tHvasX6q>A;}?vkwjXvP*m7#|{_
z+WTb0MjtR?=}*OYz8GpCa1+IxMg==;Zfr6h1;mbh?uEyLsq)-2EWg%aF|<Ct>Am_2
zV;5T>VpjZ^5c5o=kGNX>>~0Qw-nF|dc=%_tcsJ4*jkCqUjy;{p6OwItYJZ&-2>K0$
zm3A;nyU>d|1+K9W=Yo$eA{Fj;FZ`7$4ZXHZ(ROXKXS9@}8r}z?r}WrJ#^fdI^KOXN
zN`5i@Uc}NS6uX_T<zXaR%d9&aJz*vOT4eT{wZ}lvjrqsgcX(LwPjP@k5d{pPo2sX)
z693CrA`8A;N?in%HviLAvnj~kV%m>mGE<RY4H{N!01!8;d#Iq=gAk1>THYiycWt;3
z0)(IK1CkY6934(NFQ3h7pxq+hNN_ze(FD0N_wva{q(}2E2}L}=`iLSuPEh`~RaSXm
zH2*nEi%32qrDhf{=^Pn-W!RU&maigtu9|C2-%Tg?X}8;1Mi!>bwhk5CEX2qt)?Dc!
zgDAIFg*@js;#u)8KBww&*oH1?3AY##2l{ogeSviVwOYcC(l%j(9Vsj_Rg8UVG6nKO
z(w`>40bQb6ez}OShru5&?kFSS#;qaS!o&sd_Gwo02cQE60%eO<6+>-2@mL}GyGp5H
zm$63$Tis%snfdoFS%zB6J+9ak1slDFu(X%8o^|f2cWb*7WH-zd(V5%Ey0R3OTtNV1
zxwsqD($HL0M^9kQ9KY%j%}McEk|6W8q<in-@?zs14KseyNN5Q}-L38o8rSBN=FBOK
zm8Pr4p~ix($0zg$T+jk4pKi)Gqj2qH!=LT*>=3)0Z8%DvmOA?Zu+ttA*3yr3TY@fq
zqI2s5%<p*yCzbl^$h+P^It#i%8zi^jJ*EjYO<<zBUDm272?;NNxEyYHPwY1;X2EHd
z@sPKuta9z^uCxN~(b5ZzI%L41NbCgGRm(vp4ck(Ay|aRkl9PCR0?+5Zj4KMyfmHnO
z9=!F#CJ1=}cL;er=niq?q&FmbR%}CX?Z<=W)`=dCOPn&!{;E86aRk?<+UnzEXCMm$
z=1YI_{tou`-g#Dm9!e`GHDB(Y#2IyJbDVA<<OI#-3nv;KFxi%PM?B2d1+%OaWdr=B
zF*?}S{)vP28t+l`3-J_p`EQuWy*|%M>Q#G4D;e6Tgh4rJs;ofTo5&%H_LLR`fo-yg
zv_0>LK_X6RzNuh#zid?VUkLg_olEH#wG}t&<&Ah`%SZpFOHk>8iwr*Qghpt<<aG!K
zjFjAf{B55HxxXq%p6HW2k~M?&F+Mg*dLe1<iFvOLT-*%Sy0c@`Fpc`PG0n!OVfR=1
z3&<Ui(YUr~gr2|!$iKF$V}FhyDyKIkf*Lpv0>l(ixDvViU_K}%OkdE4eJu?kA?iBr
zq{ScC|E?8=vqY2t=0e^UfmGax(IM}V&!QfXv!L}-4~Lvf9yr_Y=lZU$zw@Um0V5~>
zZQcX|#&duUz119DvlyLo%xz`0YggVeWG$P0(6t7he(9wBU&;|#z5_^vRanLT1p0X3
zFqup{G;muuLsc`^79gl;IUTViy?8}K2?e8+1%J3UqJ}Dy5A1#ddxn@=3gcuZSK%@e
zaKj~w2xsnyl=3u@(iL0$a52*kGr4EawX@cr^QcxXvwM`mYR33t&Psn9GBd`+C-D29
zT9m|mUV@89vF8le*V3L-k4`Yq;RbP2cvm~JE3ghZoK3OpIto^VP*XuNn#fHMHsvb2
zyRy@Ax>{<R*FA~YK?!9K8{m1|%-t5S>IgMfJ<|O%f6jU4l8!XAInoNhMSj>eOQ3fg
z3ByBAC*$x^iq5k`@~I3<@Ek|9Qv1>~x=>Bj@O--zxenu<&Guek)pbivJ$1WPCdx9A
z57@`s=~>6DP=|PO12~xTh`0^qrbp}qPp@;FHIkor7lt)zWBHbeOh6Yxicw!S|7CrZ
z&tLvcm0F(x%qTjyb~g>EpI!R5M;ve7l=yb_b1&#8(Km2bn<q!qP)uB$u3ncI#&9>2
z?a}1<HP`WZ$>BJ%fDBIiANJvFGVgWy!58kVgH5EW)=GYmjJQ&dF1kMLs2NvJd!Fgv
z|D`w3fm1HaSo{o`3RuE|qf^n%YOFJpjKo+N`{LrC{tWboafK<1IVTiI-;HJSRH2E^
z=>4ING0%+$>P@U60R9m*z({Rew%Zcppx)8A&VrLDLJMVqWh>8qwb|h>w)GOc7{3@-
z-k6=?OUuCZc9ST^Ud@h>?DJT~wei4|Rj3cPs(l0cS*jMzN8zRO35QKdkRUP0u!8?L
zDXuyi2$(YOy|Ob~?u$nMbqndYv47(A#mQo>8;+E-gCh~YINs;`MaTlGzjoR`Q!fbo
zu9|Ag-K`kU54RKjRV7~~jWg$Xjt5bJGDc1%7a(z#Xwfn|kxrFP&5u5RgEW#(E^W%}
zz%&rKwEwegw#*hKqK;Qx7j%<&t7?|*$Hu!YO@cOrVE(qFe3keLn3&GNNe4|D2>~6Y
zQY0Zv3$em{+ZOjal47f>(+X`&(uZbb0-cjNP4{Gjld@2!!wIhSq05dq8$3CukFx2c
zXCW=O;C4ik1z6W4Rvq43l=;+gv-nM<g_O^|;9-4ZCliQVE~l)=HhQZj-1WF~Nrpat
zel};wrQ2HKVIrxsM)UCETTjP5d|AlvIk!!Z%%}`QPYN1+L$gJK*v3fII25xrjb3Q_
zVTPz&(~boGJ>LEO*7FHDe2QT4wO&Wq*AIsdfE=um!a`Dhv8)+T2?hbN|4YB3nj;RC
z(lkwERrkKw2v*|h+h2ijA@jgBYd$*}gnHXE_>nWnr3}G`$VMa>nIpj4?7q2OgOJkY
zpOC!>;hx=TEQX77l%8dacZ;zptsubh0gQ6WSw;R6;+$44n##t1>b#y)QWgOn&b=pa
zQZA|bmCK&u+|rw;)j?1na&l??rsv4P<cy}c$FFdH)J>7B_o~hFZCX);A&^9L5$e2e
zpx}B3LDLv%!f+EBmsENDhPR<?&l7liMC~?Dg_Z#|J=0cB1-ie(wD#t+(qST$Pu!b0
z{5J_26B_>A<VxR9r$$sQ)O^Jjs)(M%zUJC<`IcZjVT%A7I^je8pCq3kzj{pY#pIAe
z4OhJcBwkVDFEr7lMyyAxYGh=#u<|>j#!V?or`83Cel6&mTy_11SVq@X7T0m~a?|4c
z9pK?N7hU?7(z|XxGV{C7G~yTgu_BPj7^1Ups73_^Js4%2&$R!xV)M3om_Y^fJ4p<>
z!acKf6yXuHgi<&pZEL0e>?R4ETdTLZvOBz0$~BqTK~=(|)#?X8mjK*Tw!sy4MlLfD
zT~vZ}ikjr*Ef*UFA&jF6Xn3mSeyi5dJcHEcZUzXBF#=fwnE}SLT3-IaS2$*n`>(&C
z&!>#0I4u>SB|hUaeM9)mtJav82f4l<b}!kL<&l<!bLRSvOkWbbow^y=_91dN8!52I
zGsd&#M0a?!RgUP>V+>nnJ6h5&5bI1_nMtdP%x4u(alKS#>`w8Y=vHPf0r+9>n8kn4
zdfppYApgF3wT_J!MP3m5b0TBKBjHNapP+S7vbR^(4gyP$^GN`#n7--oNFwiIkQlW^
z)0=**fxuS%vT@Eb`ukjIfg!EV%u-oD8oL4fvd2-l_bVS=@NYpw%MMeQ%2|J(-0iYf
zZ$WG8zDd8fgT|Oi=&2EYk(QRt=3Su0Z-i%#nfk`&DQqzz+>XC@9O%3tZ3Z*ZRrH9#
z=25jbLxXqn767Wq^J3~@VoDGC04~CqJE<gk!9vI5mO`>^!cO)|!JPu<`3$K_1>;7@
zGs{pUa=yRu?0WgpcRXw;9I@#3ZCjDRa~l~ccd%4mBn5Y5fBvX2wK0_Jwk~DB$>Dl1
z_JY8B$^5zc{N6`kt(Hh)s}=@$yn>U#2AkWq;vC4Gj=v`HVAilOUQu!(R|t1#OpO&L
zi(<j-4h=x>f)pBeFZTfYSll?@vrknhI7fi+{9PcENd)DHCS(w<cQYm3_TI}$?5%=L
z%R<{7h!TN&^X+V5Wl$k2eDA@N(Cw>UMO<TzVbABU*RM|>g^y<SR-7EWpZ^J9liFS~
z0ooA6SX<As{+Q`#0I1e27|gI#1O?Wk_qWr3`kb!)UhjB8j(`0|MY0>!c(N3pK|B)n
z^p~&Qo*2LXG}_gileYy<6^h2GPz=aWaW$ViXHQCQaRnvxj|LQjhK{fwk$BgSEkHr-
zHRtk;U!mY+Xvwco4@;F~W{&GPi?&m7-IDYZ`x-I=y>BN?cHjyM>mXkGtZdb$Ag*Y6
zR3Tz|vu2R^)pxL#(q`g2=ojPC;u2H_x^@ppcsVGwlkGEL(?!N#)e!kVIoVqM(`gZ2
z_hOJTg8V?z$HVr#LN_W{ODOIlPzmv}Y%NM1E*Cx~kwi=<Yi)<zQ;3uR51(5l%pQm>
z4ZMm#E-LHV`S!TVg+^?7UjVHLb%_kVx8CZ2o#eXS&W9II_o%*e3cFU4<0h1@u_Qn%
zpVuZch(dU#8$*RirdCsG<K|%C5itV(-72fRMw#Mi-AqTz4z27V?l%;_CR|4RhRmy)
z!HI{lFPhFWfq+GTaj3$`Z3haBc3E1SwJ+q0FddR0$%z;>!#PBW-ZW<dPd~u&(Q@Mu
z^3!iGz3jW86ZK%K1BS!={^H9}-TqPg8e4z>b}3$j6y|Xi4`wYpf)rF&5c5+9PD?9)
zo|K!Ayh!=}>ntRZWBowi6Mm?Qz^TY20?)34b7LLWZR5*)!2SeL@^T0iXTU#}#d4r`
z=pV~bxodubZ`$oIyk%JJ9#__|W#Vk_zZ27lXBM3MZ+ECh>y3AQW(*h>V9U|}l((L<
z?Dl&DyaKAkasYOT@{_(P16JERWLYzXDl(?R(u6Q^?yLIii$1!WdwDMae5KEx6U`M6
zx`f;uv!YOVk(AP1x?@`-c53fPwH{QtTVdez#B0wFF;-Au)Yd28>res<A?|*Ee8j~o
zWDM~;Cu7im`N{Bib1|j@^EvI~JJ=7PJyjFJaOW%@?0A&65{ChPY8b9}wDj3&hdSaP
zL0Cxvqk0jl^e^K$>lbh=x}9qsX7?kHL~Y&e;eU@sj+&L@DBjUY3MaPEp~#*Yb<R6G
z<TXLY(W1<wAbb#bt1Yhn4EbX=mF2nBK;Q(o>XD&<L(qu8jSGNX6bymlTCZiskrnkH
z5dnvp{4Q&YSFtf5;5#w-3pCsXo)<_#U&nvaA}=eYeanX&XTQ%`HD-&dYn^#|MuS6M
z{#|rRJPq{wnD4E4ISXZ?s5`0nQ%u%Q>I`%Zi-3{OSR#boM>5QP>8OsV-eOt<v!%D<
zX_?d-6^n<gYEV6%%$s=rKy$itVPKY`Et-QUcB<me#@>@d-wPSZz1M8np$d7`JzWF@
zh<S@mjIpBkJhF$ION3{V{Q+NJ>kiL*M%jT-t9}Qz${Dv4AeT*A8!Soa*r`ln*5@2=
zM^|wnCf@H7g+uUcy)85+OKH;So1M<yze`Y|?^I&6OrM?;9*Y?~IMP(EZ8x#PQpe*w
zYF;ZYLr`%kBJ=mjePxarDnZ-b1kb*Lq)6*@8bjdh<2MPHpu65ird><Q;Tw>c-%@XE
z@n3N$;Lf30h2Gguto(i;9>PzQxhs_55HiN7X|7PB5KC5Qmjn6PM`o?!m@Sc6rc{Oy
zZ7e`g3Yc4hzU?uymk(vz-b5AR-$zq9#pE=enN`wJqM9(gLKF?k2C=;F%zAYOj<2p{
z2AZTh5x0F;$ff~nwkG}75^P4?kp}k6e!IxY?POcwkurP4^bp!p7?|QNK{sy4X3@7v
z5%ExV)lQZB5)@|azV+*t#q#xqU$8;#(`=HR8u6k=&G;tAN!9=Bh+6g_K2A8a{46X}
zwcRFG0Fr`$JLIkfdKVDdtU~4J@FKbA<8;lrZV<@sWSLDTVYlaRtWGy9MWz#vjT6(;
z0j3O*Ab5b7cSU3rt;?e?i&zX%>rr!DnZ05!M6Q;|M!6mf{b9O!tBlooZHrO8`3TQ6
zjfRbtDFG5+<g+Gx3R&Kjo15H$Z9~+jajPF;bdAGh4`N-=NEO3A+U9B~e71^(Ht2HH
zK(X6Y9gB3*5iD--1ObH4DqpL~ohAPAUGmi*z>FYQ!Mj5AZZ#SBB=xC{1s8V9O7TKx
z{#v?Iub_99NnA-c%hV`BkH#e-@Rl8n;hX-!a7A<xZ<tWji&Cq_UbF6B^U(9F=onkf
z0y~MF12h^Mho_o6*2x->q5AvTw)6+WUh!NogG2JynGw5^{u#b$?l$lA4jC;_b2z&J
z3W!V#H&U0B*CQT<474w$x2HD_S+132r>Hmbzni!Nn5){~73G|jhX<4l^$EIxJdQ>f
zND^6GyG~(ee4bmC7y)kEs`F(!Z>P(wh#WQ|>8OYS%_Em7_L<+_;`hSz!^U}fJX(qT
zg3@Rey?^Z2eoO(~`1!D=)gF(arox>;`TGq_jF|4P@u>LNxBlLsvnp(Kt!gV8?HV7~
z*Y3!~SlEPzWYbXrF180l2*{CF^bXs8Kr=XF1oqYf5^{MB)J>Xa(3OjOm!_&`oZi<s
z;*P7Q@edPEH8lo5XU$1^RWdR)_?3g$4|cBgr<!f=V=%G*+WXr(_(Wh9BWe+K&-Kz5
zw>eL(c3_hh&X^Tnc;aTk3uO^2dtk716rTyYYB>AtWXY~v(}U#Lx_8eT4*J~38lx&|
zO`j!_&N)L$!hh(O6cYw3)p*9}8K1TJ_j5zRPJ)QP$=`2gEd;iTM4QI&_8T?8=h|6>
z$3C8pT49HEMmv4c(2&-VkH7Jl1bWvei7g*W>9bC@Rr~+``z(0$ZtvD<bqCC$z=K+9
zKdj;QJTZsA!F?P_EOUAH-@LatY&IVb>b{R#U-7Q?UUvsixGol=988rDEOV0vZFx~%
zp`TmNBHZ8)GpIeIt|N3qRuY{T?&%0foauD>Ea&dqqZbJ=2r%IN_dSh=0EPjECZMvM
zWcN&`1o6+nq%{MI0LQVCk%8cUZW1so1`L0+L)Bskr?*o%YZk_X08tYTttaZW|L@y5
zs5lUV2nZq3-6-J2UBH4x7BWL$l_862l<upIUOyd>>}>IffBpbMXb@`1SyGOi$)6Es
Zh{?nv?sk5i5qWg@0bqaiIg{Ya{Xa9uHCX@v

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem976-cert.pem b/certs/frodokem/frodokem976-cert.pem
new file mode 100644
index 00000000000..1cf46cd6085
--- /dev/null
+++ b/certs/frodokem/frodokem976-cert.pem
@@ -0,0 +1,338 @@
+-----BEGIN CERTIFICATE-----
+MII+5zCCPo6gAwIBAgIQURoYBxm/Ti3pJ8siUBvWqzAKBggqhkjOPQQDAjBxMQsw
+CQYDVQQGEwJVUzEQMA4GA1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQ
+MA4GA1UECgwHd29sZlNTTDENMAsGA1UECwwEVGVzdDEdMBsGA1UEAwwURnJvZG9L
+RU0gVGVzdCBFQ0MgQ0EwIhgPMjAyNjA3MTIwNDE3MzhaGA8yMTI2MDYxOTA0MTcz
+OFowaTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
+emVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxDTALBgNVBAsMBFRlc3QxFTATBgNVBAMM
+DEZyb2RvS0VNLTk3NjCCPSEwCgYIKIGMcQICBwEDgj0RAJZF0jtQn0vU7wDrK/7h
+586R20kj3G3ANWGuklaYqJUmVFNTJAU/L+Sg36zcq/mr6KxjTBmWsfzQ2VLrFEVe
+sqm5IcfKsgWSMJpLDePjpowS9//nSwPwn84Cw95SI1iKfi6z0MNYdpIMcVSTaJaS
+gpiUUbfUtn+zD3laHYkYp5D/FfW76faCl0YJLJOOhORodK309O6SKfI4W92ISrL6
+SoyIuuOrR74m2KzCSJ+x/u6lV9KAKDMIZCiYq3Lqq7oN4z0hnd1k/XzfOWtedFQX
+CODFzjHdbPAVjIBd5uyv6EcRtRg6tmogHaDG0TpuGNh6daEecdDpHZHozB+HgfOO
+W/H+LwS0XU9nAlyczQcrVM7b8yEpQAtB8mJ81dXuVJ08AqKn8g6wTijIGxd9orpP
+A4wNZu2RkXR7epTrhl2OiG8C/kmKjQTTBslBYLfAb3pd/2L56x380e1DNXQyLHBf
+vFLkdOQWjfWfPBeEIXQOi+H/AQojFn1xS++m5U7puT/kQyN2AzN4yXLKSBSjRer5
+XmLe3ICPGNWNgshdacBvimjh/pJICSVekzQeow1NgvgUQIKLUPswrrR6c4EXxuNJ
+D+gnKEvFa/+6m4VDJlGgbzQqg7VkPjR2zvdP+2SgP2L/fIQ8nsCQO+EinoFb0UtH
+juHgdV6/xQE6T1Z+Sy502vZgyVe8/oCwzAnQbA11xKeI/iVp20rOb8+YlfsDS6Kz
+hnkuE4bcgavDIxVr3cmBOOqCgk8kgwjQpPBaVNZ7UdksX2Iv6zYUt3WOy67FdtxA
+8e2ufQ7+gq3c48OurbjB0cZH/agTfEOUrwoaf0Pkg6uHNrcHysiMm0zcKLoaKbH/
+SdMORrZcJqx+7Z9quirymPMuzNE+TE4t2ktnaq0lOCbCKJV1/KBGYDGkR6Lg3YEK
+ek/dp7JCrKnpKHVKDswrWNriYWl04OIBtUUUEOjVFDVkFtxJ2VtGbtpBk0Qad4vO
+/TRG1xXQvKLOl3ne6AlkGrIvQGGgxRUtbyiW7c9k5he6/8oVea0XLtngYZankDs3
+c9k1aqs21m9E3xSANBsjMf/mtp6tmdpMuRpEmWPN8wY7Y8/guZz78yGKiIJtWSgm
+UfGjmozGVnt5SJLDyJg4SrP4XvHfWZ22nO+oiXN+5xLJYBoVQWUvY5fIUVSY4vxz
+xf6R6NWcxkkDXx4GheWQvqwB3Ld7F0wlT/nY0G7ONks4MSZXeG+MpJF74RDc+/hh
+JX30yLQGOu2k2okaSy71/Ytuivmu6SnKnLfHB5zrg5uXZDE5GrzXwOKqyy6ID94E
+BATPGyojgWgObU1kOkZQRU15NSmuGSdB1qBYD3WjD8Y6fHNoku1g2wfsmSJDMnrR
+Ry+uj8eTOD8p2ambeXmDP0oh1DC+j8Djx1MgMBPbk3D1TrLXu+7ZT6pkGC3Jyolx
+/imLylIIVZKybzqDIE54hNyd2EnOl6AgCm2VpPFGEx5MQzcagmV+V1bJvdHoyrny
+7X9LuU9XkmPT1GXRzg/7cQMDjxY33JsLFMnyjOkvh6r96pPq46ncf6RN7dLYULmX
+7AMXpuukEvTsV8layfpA1cYhMEjM9Yx8dkPkYQYRh/5uZQnMQwVuZWc5PhBX+KjR
+d6ZC1NTLHwYliD9uZbEh4AVGETMK0t5yxzrVD7iTBB/fTIb7r87I8SD7d8ZBlsyl
+85HL82JjnS91AusL+9/q8lGdPxiR8rpoOqNWZ/azVsN82/mrI8gPrX16Ki/scvgY
+JEZpK/ab2mnEjRZKR/lRpeDVC/yNINjyfSu4l6vbOGTf8wffaTzACdIzE7jh0d+D
+wInJWZa7OOgqZ1SYoi/B1zkQPjWvlIlFpGquQSLG++7jgUZNUhY2JNh9+G3V5FHC
+WjDHiu3IiVEwz7h76i+b5B2uY+bI/1BLt3Uqy6Fe7YzK8+amDhn6SfVgPwXsxUjs
+tW9CdTHCcga0XWvf+wnBhDpV7Eg8kiWTeQwWGBVLHRwZwjR2kdIpWyqFcW/plPP+
+nM4aI+n6W8nFVjEXpHZ113fZCNNhdb/GNl/1BhjQipzUHRO/LCGO8nhDvg0ZZqvW
+yBNCcu55WYWGiLE8DdjdOoWrEjRCU6cZ1Xauaz0GmZdAZZ4L85SND4AP0/3tcAQp
+lGXEiCRmSqpqw5/vbNu1ZeDdfzcUcNEvIaBfCXxQvr56W2m5SeLLIKIULREYJSOq
+GUznEIJAsAQektGrFmCj/t6FE3dVkrNw/N0r0BsqS4lsoBAsRmbSuykcPNMGrdWr
+ae8Yd0+Gx6wNqYJcPLtzzr04cpI3VVyUcJwXI1y701BS67rdL4dHwRjdCj1E4KL/
+MdOxn7kvMslGaBftw2ibwCGSUmXtNSc0VDs51XadFaGwprNoWShzu0KGhHQFzItN
+l8JjQ+kfpYvCUobjtCUDH+4G1EfZGoNrUkDMhR3VW4kJPEy6cEZa9yAwCA7sEWv7
+pxB3dkpIVUvsL/N2H6Vm2phB75xt/AKi04LJIK1JEcxeWZoUlne4yue983wtD684
+/+t1uCKxqNA74gw6W6MZKS3c3Mm6MyRu3MieqAwQcoP69mkIQ2IeKmw8RpuoAfTg
+5H341bxoz4OlMJ3wtPO1gv0UKNGHCQfmPqt6VH4I5WKR9hO6Az3pmTfsUgtHiR4B
+Z2aYq5gas5XvLWEZS98/ZWr+oNSrmySqFD5sbXTDO4in5BaUhvcQ/xmTRT4WOQj3
+c9ojuVg/8IGCr0BzR/velYyUkHvDBIicFwrwoA3CQEXlY0jfjdMWpa78Vave5cyy
+OxI2XfPhVy1RTEApm9/xYuV2gnE9RF61ja/Igwzzud/Ks0MzPt1cc7SJL++uD2HZ
+ps+4KVq9/pV0GNxyNu6/ykjv6p7hbzLCuwosnySXJcii2SgwEaexWMZJTxeQ4W6E
+W+OBIN+ThJNLrbC/UVnqIgVHPddOWBib5lh0r3SCWSJcfsHeNL6Eh/x6QtAhmIUW
+wavxy7zJEhukCH0iZsZTa+pqesXX1NX8pCw70+QWHDttxD3YMu//cmVc46v3ulWb
+QL7Mcy+UTvBsDa+g95BjtmZIR/BZcL4/1bJVM9Ppdobo9waztj9Orzim5ENhEZWq
+YR/aV0TqPCXmrpPDvd1BjaRXpCestZ2GorttTioaTwL2B4eMsNw1HiTTetNqwlK9
+ZQ+fdg7BTMRCXNuirkC6uinB/nImRNNMLoe6FMAJajlmyxPDGq1zVYCJ2C5AmPIh
+CKg0w0C+++X6hilMKliD1R3VNIl/l4S24RA9MM1azz+69bxC1g+Xjzs72Oe6CDi/
+DZe+x00oIfa4rNE1QJwVSheeyrAUaIBcH8hGyLeL1aYPGjiNE9A6kpsRpEE0970Y
+nq4GfWAMPkihBPUwfNqvnMbfu8kfYH9ahMyYwQ7P3GhWH+Hwg6nhbDCgsbP3MGEH
+3cl5V45hnzlJcaAGx4Ok86YJUdNRpkIiu4niSeOHCMs/p2+9mG6S9FjecIiKm3f3
+hf/1HVf9xORXTIHG9qLD080NN5rkWs/BFON0v0Jvrq8zsxBthkIy/zt10v/rDWIa
+SOAUxvWzojmQWVYFCJevSSGQ78F4bcYwUn69Y+l1zH5oSWfaX3UbQBOLegRKQ9Z1
+MdsHzMgrY1LjAOb7Y66BqzgwNPhzPETV0eMaDAEcpACm4qvXp5Iu2kTz9T0bEG5y
+Flii6ODkFccRoKrk/37zVlzDSOf8ywXRYdkOzQapo46nYSa6sLXNJ0EPesLmicT+
+GbQjmGXS3BWlEdFykV1zmabA7JZUaSpbKwbNACVrxZsGdng71pk+RSOhpOr4BLGw
+tmsYoDXpyIZKK7UMWmfzarzfUhXQzJ8ynN2semGjRdn3jGxXmaeLL9cHhpzSc/24
+Rzg1fcNs5dhmhLz6IV9MzhERzWEgGY85lmJfX+dr9Ls8KtDe73ohPaFv6FtHagWa
+W6RkZNT1Nu/N8DU79ZFedwYptYLt1LRFcwZA6D0xJ+wQLAsFCtzyyuE4gVUWIN5b
+RDiYGZ6Roa0J8vFWCYU/m9otpDgfJHCgljtyak1Woc8rNJTAijxkm/0hXYVk4u5D
+K0fynG1IU/W9oaJXPG7eprlG4YVZB4eHld3unSzGkPJWestJ8yXHF8vm/K+YrY3u
+3tg0e6atzAJV6j0ma/wtwjuPh56u7lGyqEuwTFuoZc8mdscRIRNoQ9vy5c/M7pMW
+YenR01STpOZJcACMwyS48YKqxRRZC19qq4esovan7axTfdwmvfq1AggJBFyflBjj
+5eLFz6OLgSOng/UVWsfnX2cAc/mEVsQW2O/Fl0MmCmHeCfA+obvKV1M6XmBdFNZF
+zJKh1W6VB8b8jmIMr9YAh1Qke+7bNb6rk12kYZZ7v5L6QmrejdMcvNnw72ViYEzi
+hZiw1ll7khFN1RD+TMAyG8ecDdJiT4GbMgGumc+stuMPXE+Ndm5DfEtBmJ5nL40r
+KTJLAJX2VO+Xk1NtHydo1bVky2+xFCgFPkRRZ69H+v2T6BN0dXGd3U4Fd7lnQCow
+qhFhYxGxiNLGT1KCefxZ4kSmVKoFOOWkDQngkYXWECHUU98Aufly8tF7GFosUpz6
+TR/hte/HLLo8ZQ3FJAqls7JG58r71QLF+BL5UNWBM9W7XaXrAn1i34lRapESxra1
+r++lz+ohe0FsxhpLq4ojm5Crf9rz2XbNR1ntEANla4q3E5UlVf3gIlpNbWu7Lsi+
+kBKJAwv3wkYQNHsOW0lGw7T3ZbjKfFdqp8+EIUhMK5KiqDXzH6qS8JvqaCKyGtYY
+SCHEx6BhiQqH6jgeHsYyRpk0pp2B3zIGS7wmsbcDGCFclrxqdSFkIMUdjO09h5hW
+LE9snUQyK9P0j6n+tsinfIjNkzPpBbcmEU/4JP6v4w7dogV4KpSrNyjcUvADV5De
+Dv5Gn6Bvwk5UKhdgUypHVfvNHLNwcaSt01Wv7FlbIVpWNn08Ve6zz5OH0y/mLUM8
+b5az9o7+1IieIBicEPkMhBrnriVbl4i7/dju4w4mcfoM16JIRc03NgzgE1ZX+1Ae
+Q2Ud8EsomyZKCUyi5qGmL/mgwxpltr2VdxOJPqmmNt7cf/V6lXmS9ev3BRyN9Gvy
+Ety3v4syowpqfoFqB54pur6uyRThrbQPL4JuzPXY0oImkILS1ksFhk+LkfLXSeqh
+NOR9mmR1pqQm2GwQrrykZLpEpPGwlBFCdWIeA7EhxQLccIblXt3g75/3/Ri50OhG
+zbX2OdUm48DeCVzKbLdPNNCBuwpoX/GbmuadmjQR8pUSSuUFR6ef/PMvcp5tVetH
+8dW+E15dGvZHxp11H+72IreWV2I19JcInthTUA+fhaCBEUun2yYC12P+qTB9ZueQ
+Kefcnn0/2FmO6GZeIjk0QMK9ekbQ2iHoGvAxEeuaZZK+CvuBVCKEV4UDJU2aVeiI
+3gVO2NwwJei2+5skThzmUMPrsjn8orOB/roFFar51YxJAdqD2n6RxjvG63G9VcSK
+6ZAX+/zrsiIYTaFaCE9u8FIO8WXeBvERRTq49hbmxzUc1626VuACSCPj+vh8fPnm
+9ukSyVBHZJGjDIzg+w1AqYTYmS0JD8bev0cUfLVMUBi5My/Isu8b417gXzNBLbEm
+ZYk0hlxvOlZoH3JR8S5HHlTn3mxae9j24iBYiEn45jMqvm3bwgxN3mJR651Ei0jx
++4nF/YILMffCU6m5dudGV+T709SaHerIjsw2p1RyRqU2r5LrJRAp/pj3zXWjNKs8
+aTzf8XUdtwJiNXzkpG1s1y2uhPwNB1s7uHPgkOAXi8y4B6E27b6vKYp/8a2DZcsp
+lEFPJmje6gNFJCWNpmhXaXo2YOh5EGCQ8aov1bFdBiG2JDLZtqpWy+qPWQiJqrRo
+OAUbpIQRY+mSGnSIhj7tPxZTnPc8etQMqaJo6ErOZqIB4QsfreEV0wX4iIYSyTXu
+eYaW/9mJ543Lc+xoFT/lfU6/xDq9TJE4kO+zvVRmcVTIw9hadL657XBKoZIZiLwy
+Gfq1Ojxh/aN8/J4kV3Uzuiq/MmjVrxyvzxI+oBFwPq+l2o4Qkb/ugwSmDB+GCqHg
+a/eLAm2No/RQefxRJ4BDabsbyE7ZXvc4Zd0mQ67wXaWY73slhAVAzYxIaWMi7aw8
+vDqP7+0ikj6UQPlgFaRX+rtyuy9JZL2sh8yUMep9aFkdI7F+5hUioN2MbJ9OVmhs
+3LY5Y6xdCRWqW8QZso028dqhV3xb9g5FBDuGfiSw8S4ZhXxp91h8FNjuxG4gxECN
+sY7G9B4wgBeP/ps8Y9H+H1cd6vbJEutvg26KceZOSTDCAKZGxy6MXJF5jFbBM2va
+iE1eL4M1VX+r43MzVGI/30trrMeAP4X3lkC0DWIBR/G8R23s07cYPt6H5fTmRO0I
+7kOB6gNAlVaJyxef3G3ALgVcYFXyQBa1Bq2c+U/D5cxvLPiIVu4JuudPCGaZVOtF
+cw9pFRdke1uFSSk7RBADoe3R3ZLQwvrL/OvUpdzghtBeHVZQJc6vyOhaZ1rX32mu
+QFglYYmCWMPGY9IAicoFPk/GTTfzH751JTxRUfcwJc7qgiMd2pWnWJOBdl9aujxr
+F8LgrEpWNoYSsP6OqET2tt5aPugUBHG9NIs5ZXLqiLPWdxn56TIOB2f98SQbenUG
+FDoGRm1uhffkyR5rN711x+66t/8I5bSOp4sC0g+DhGwQ8x8aFVIwS8uBGDfUpBz2
+tgznWhk2GKwLe44tarFF11lj6FQF4Wza4Jkyi8wkYaWGyRycL6nEQXIdleDieylV
+N47mJKT7GOMwoBtVvUrXRkJio5B1Ru+L4/6VtcGoYUft9PMLMNkWDhoZt0iH33Gx
+ca+vcPDW5cGSWASJ9GqBqkici88Qm/SzwpkPCJf/RWcY2PLNbsyw/jIlPQi1OO/i
+NvdBQIGPSynBWGP5BuKMoXKnvkWPbeTl+UyvdfX53zv3y9qa2fy2M7rQiJlp6o7R
+28jT3K7Any1U7ZGSmPh8iikyAZ0kM453g30gG+asEPt6TowXW9V7FubXP6p+89OL
+ddOXI3phJ7th94wNHnDbkpgOjWvm3Vy3unLeu9Pdc3HUs1Naer9/No8salaZNSVx
+qbqQFNGl1dFrnZAGts9q1A/4tlXsnWyrDwLQ7TBrGGp3GZi/hoTaag0e7NAVqemg
+9yPQdj5ic45YMcUmWZB1Aaf1hLbAZpwkljTevPjkteZvLLBG2raAh0sJOXwAEMzo
+DyLEV0YJcpaE6igRzSVFKqRNA7uCezQ89pbQ5iplv0TOLkS32gExaNE72wJ855Zd
+qqOJNMqwT9HCOafvJjsO4z3Qnr8tp9XJLcdW3kwq/UFMEphaycYMdPEJw96WIbXy
+ikH2v2EsoibhWPJ2dJ6RduFak/iwC5QQA+cli6PlkbzitTilnGwj4l9ph9d2mj9J
+ln4AvT/iGibniDTuN9ZxRB8trgO083SuU+csewLzzwXs72kTlunni69vnCz79DKu
+cFIZeKBJGrgDqISuF/VVOsyhQ59E/pP3GOX3jdKNmyDw9sdDvDq2TjzOALwBxA1Z
+qV2ui4KluLbPVdgjENjxJ11qLKjJVZAd9ocNUqJz9ucnGtEeLa776q6YBe8pec20
+XaGLqZzAFV9i2z5K3EdqzRhdG7HHwFYZAOqSHb3TxFXAcMnA7uEvEkC1UjAJsg4d
+P2VtPTcylv02bPJKntR/EikiqqMiMbYHOTPUwBzXkMZhokgNqYiGL+ApB14kMDG2
+gbTPz6xQtXEryIxY9+Ahax9+BJRbNCO8/VLpGeYUhxn4YTKQ1s1BYMHxoDWZSaJI
+K9qUtMUbLkECjfz/oO1CaiiUwoRF+rNMid6u5RhpZJ2c+zRpXLFE95QNYasF0Opj
+kmWMoxlyYwVTgdcKje+fIM/nkH7MORfY0eCNFLvAspQ08GwWZ+TzictQ0bcnx8QR
+I6ML2mIA1cvLSm6Ai/pOxVy34t4h0PGyAE6ZJDNlev9Ld9jedSJ1M0NfNpVBZSVJ
+pSoVdDdBGY7kV5e6pkYezFnWAA77YY4W0baJhlSSDsDOFb/orR2BDNavesH5nuT3
+ImkTLhnpFrVKyyJCTEvsC10OlhKyCpByLUl5831Feet7IqzkSJMJi1YlYEk8t5mH
++iQ+4+5ZesLZG2Mrw6LwEDBKRrtysHiMHjCjWKF6ecrP/GCcJ4Q9LtFKxgI46EnH
+9O0Ihweed+CGvBZZjBo6iv2uxHu+txQCpCFmNc5HjLWZRP7INRhgS6uJ4MShrIqF
+fK1nM0pNodUYD6rvp78cHGA83ET35Z5vUI1ccFNXpazFZU4kJY/9UYKgn4azAnBk
+ViUiXlQFPcc2sdN/brqvpsD5MyJ/36XDTqCy19aCV/h/3WrOA4aESSsnVrSKjVGJ
+RUVUlxqSCGIFq/C7C5x9mZxhJv57IkxLaaQ6TXp8T43mXwzvFPEzSjo/pgcNKon8
+v7Ozk/2hCADkQrwe61U9iak1AaKl+n7T+rZy8cbHSIynlca76QCc22aleY97Kqgz
+7VsKo70bzBhCk+l2luDl2aJxsBNEKVmyPmh4X9ODpXTmj7toTWltE/H0biYhNtx1
+ztmajxJ1qMLHlO6KffGGMRsBbr+r6s7HWuyqbEPW0jGttWSNIx+FJLuitUr7Oo4P
+E5IjXTYKPAyf3dLSO6P0FXxoKTD5A5fMqIhMYTt6sph//y9cMhvpHkF/JLXM0f3W
+elANgV5DOYAddwS36HsjIA5KPTa2NcuN8kbcufwdm6lKHZIT+aWd+lJzsEtI4uMP
+JbfEd1fXMaShQ4VCmDhjXhbTjtBYeoX7dpisos+PmLIB0nTLWpC3N5D1NEdVuK2o
+S2d9EuuNXT44n9IXqzCZxmxc2wnD1srHKjLwbSCfgl9ynbmjscyFKXcHfB5rMAEz
+eGH2SfeFeCb70Egsl2/elDpTla9HAiyg5zN+OoXvBc8YglqJLyLF322xHI8EbFo8
+tubqHj5R+bTwyr4sI3vgGOzXHVgVZ8myWyoqEkXM6v+knUupbbMMzY3uPfXxMSEy
+DZexDgJhClROZkbwlY4zKXotla66ANIRYaIdkYaTQyZnJr9n/Prni39U6He7djhN
+x7PWWoYtBfmST5bjHrzmWh4vrl+fgCojVlcfKk19gQNR1hpe0dmB0h5Io2jI8PpH
+PfGdrvg6QD6caaTZRa/HobqIOnhGD9pSNDcxAvn0hvMJeQqsUP97CBvrJqETCr/Y
+y3ptZhG5bXRdvYFZAtn3ULq1r+9fGXpZ2kCK4sf0z3CTQC4JAqc00LA5O4wTz5h6
+1ov1PAEG0s1QtLfCuoP4x3h0rFuUZUjEtTvlnDb+VpOwIAsNryFsSb01YfrEfxhj
+M4LI6gxqqmgu8tcdM7tR9uI5hmsyG0XV/KFEP+nHVzNvH9srkITZF/1LjLAm7uYG
+d/vGoUCdS1Kj9yEhdSGKdlaLGr3nErOYmxBBDBDRno7zH9Amm2ogZoxWh1iTZtmx
+QWZlRHbzYkZ6DYSt6RHI5W0LbZlib7u45tDmRy0qf7sfr8t7x9nR4jMT/nOgrvdd
+bEI4zT2r2kt4S/mhSIzYQlx5F36uytfmTcW3HyrWQ/IeuLG1iI2cre9iaiPoKBCi
+BMDTDLQyWDRl6D3W7afTcdqp17fCQlBP01trskl1N2zAwDatNt46yDxD6JzeulgY
+uMaGRDHQvnS4wDKSclYV2bpTmgQZeK98EORrmQIv963KMw8sfN8vI9QAAJFNUsYR
+h/SZTzDwB+i51DK4WzPJIf0r98Qlh6Xx0NroTMfoQnMqiPE5MT+KbKbcl1zq0Em1
+PugvHYwdxhONdamhlC5z5R7i8FlYFrJflLuIEGqvabfrfSF6/7z0Ag35Dlk3RDNH
+iGDV5CBNAEK9V9dylSsvAPB33wGODI503gIINKNHzRutuAqCLsrLdowccl0mj8el
++DeHdnZ4+VO1Jsjb8xHRBtZOc8z22wdyPosiadzh5fXxipqnP0g+MNQViW79setx
+lYh6OllnW07unwVIDyRAbkJM/ukc7pLR0dwgLnODjqYpDTZ4649PF+BFmpASnALE
+iHKTUGorvj+Gi6xUJb9Th9ebGNIS7uPNnvOb8wNqF5LiIq9TxFFEW++I5sO6yi3M
+wrmAhS5PaqDNJShcRER+kvY0wGZEDkxkfPb2mCKmj2nMfeS3abnFcXWitATUhdEO
+//MvqBsYc4IfxMQrSwoFQtIJ1GGtKckd1XzOV0LzeiGTT9rUaBWhkZIjHY7oLhIs
+XME4StDzaIWt/Jnpz9uSJcLz/fkEfx+xOEMFiJeTg23rffSxiTUwa0LyhIQBB/Iw
+ukv1SbmNj/Sc+ezovtNdSJoseOhUiY2wCxXuzJOQIDPj/HVa4xkKfJZ0FUwX8LOP
+iqRO7fbU7GrYjnPnfB3A2NGSfL7+MzsuqyHLcA9yyUBaSUiRMwQu4po20KyUKkkp
+RMIwJ0pbbUHBqfaZrCUqXY+KMayWFztIFDiCezrTnH0HDrKZuCuGxNovVftFksMJ
+ItqLcSoL8hQlnB+J8YaxXEbMevaGj+MG74rXADvU5ra+2B+9uMba4SiY/fL8HZVs
+CpU0KwWhiWe1uoh06bnQX7cBUVcBz65bqjJSCjjcNE5+BzsLF7i8UPWRGpGqxGDm
+A60afB0QYLCwUfygjTkTG0x6FlEf/XWKlrAYtld8C7pGqAY3JPLBGJV/GNN6urN1
+iBtx7qEP5bJ8KsLLJSPmU4BaTVOqShROW7cJ8hmFRmNS8mdc8Ly7j7HoEc6PAIVs
+HBqxhWgXha0iMMg6nm9QvjSp81rYBGrs6hOtNpXr+5785PLCnvMiqW/vmGFFXFbb
+Vg4RZTeKnf4q6GiS7GKtoQwkqSAX2JlbsiQMnnZVZdywkmfSOOgylSsjpkalYY5f
+3XihQXDJFNsjRimqoceZ4zQoQQg55WzXeNxxyW+L86MSfR8YOrqQ3Y9GEoF6Udsm
+LYbh3fnYN2HuDbJgsG/hWhbhYMuDymCH7BPRJKovF34VUj0H0Ln49AHIb0aUGBE7
+/vL4e6Y8FsnGzNfs97kJ7LS2sD8ZYEYjP3K5wMrgmZMNtvLpsc1MuLbr3ybH8D9C
+xTbL7bM3W7gXg4KxvYjHJwin0wPqgU9Gs73/KmM6SmMItydYoRMDQG2NRbDC8wBy
+jOrUzFjpuyExNhwWeSghG5RZWa6f3U45KQuLIu4vSKeRfvJSZpCHt0m8eCziHRZ+
+irMgFTzKjxVtbda6GVKsWmQX+9M31ZRuD/yrvuPdWCPSMzOSz2x3wZMZY4fmT5Na
+/LBdWgvwHqoUNsTuQ1UMdCHq7550hBWeJLR1N1s+2o1b3U5kaflKuzj32LA3/Dg2
+7qGJfkU8SaJd58MpQCAt78nGZ7OQFdF0if0EugXoUxPTdDj9Qw7Gm1+Pq7ksATen
+6E+Bt3MVFXBmot7I6rR+hxKsdXmHC71QJd09qd/8J2ykkm/Jfurv2kgKRGbJ6x2a
+ZWbVKnNTURNWOo2mz66G+VGrtGc1d5K4GBO8BYbOxr3pDLoST70CM4yNpkt24zle
+WOlFxcNgHPv7fuMWgE4SOf4P9lKD3/rkNqII8hTllBkVBax4acWEwQfNF6v+RmhC
+yeaoWUFBSxO2oyCpOfiPof6oPRO8luEG2GZyvqQbUtptyARz4be5cHtyCDTPRWL5
+WgOm7xSzZyc0rSzUd5/iQXnJejeS3D4lpbmcxEC3bMG9nrldMlex/KAbcYl7x/3T
+VFtPRMmrtU76WEZPA06Shf5EVmoQP3vy5fHZJlmCwXnNZNwYXnwV6wNWSZnboMX6
+QsyuDZaFc87bGP4sJCU7DBd/xOKJ0vONN6zU8mjsMkTM4IAyl2erLYgOVjI5qTWT
+YeKYonateqAtuyTgkswPtpc1aoNICZ9oUiwVzd9N12j1kL8sFEB6KY3DKDDtqaJd
+hzjafgk00QqO/AH9Uiu7x2+XsQQ13Gyo0fOU3PJwZyDWwnum8Lqm5YIgldlzGTTg
+Kv6OkHzk1Fozhdl2UrLRex8BdwOz0hWq6ssc9c7kQjTMRroY9A2xV/+Ga8VaYNrV
+PxoOA63pBftv/w+sYldtruPmrNOE3kn/b0Ea5O5AmvXSBAxFtiucc1x0fzfmlVf9
+ugUVe3f+hkC4hV48Mkw20c3vmgLNbx2Tbygif9taiuV0181Ny+RzfHJrfDCiGN8h
+I1VHjvZ15M4aVq0gs/AV09PELbDxsK9eAm9BtqgaEPfV/KRS+pIJohJWwGkDGZBS
+2Pg+jNE1zVZ/9IjPBt/9HS+7B/vNpCmvvzcLAwBWwB4c0YMwRVna427t+OrSTwFn
+cFKmj6jIu/L+42KpvSwgTVDQitJ6eZFKTRJNtdM9svfCQtagtPIde7ShxGKVGlRL
+hR/i+SB1kA9PZfYv9XkZN5MBsNm2uYu9hSE23o7YEN9G6dZzYsMX7W7gfMq/CuJr
+97z4OAT23z8CSaMoiytUnXzZL8mrN/s9f/O5fyNt7jzID42+o8Xd8JRh96ei/kVO
+KcPNhEAvunWhO5zFc6siydMX93GYf0NeMxaTZ06Cu1+1NrGUlnDxzcAkrLkgsznS
+dWL+YsDBS7xREWr1eEPTI+WlLW5RvMiI4/qeZV19ic1NXjsERyt5xYSCEANbARja
+RKTKmiLCOtsyTxi1gENG5kxIEn1CQ3Stas7GYQhw0ztMVdim+QZtlH7XA/WBEVes
+jkQnuLztJMpXOZhnTVpD0VLQVFvNk7wmCCXGgtuNKMCOR1sIwu9onS5+szA6G7z7
+mNDaEY+bHzwJ27SkzetyjcMjGsmD6KhLMTGyj6HUtaOuwVJtJWWIkiN2oXjpjgk+
+wu7YPFLDd40rh275Mc13EfwylvbLm/8d6vpYXr22/ed/FjJeim8G0IealaEbly/B
+1XcjyZ6qS9N0TtDh+DtAxRSfUNPLi3pasvH0b6DnQZMA8UqFbwUt7TigFAl2BxpL
+k02iBTaLdBq/R6QJ+aDFVktQDjoKpIESUkURPi5Cy1bvA4D3BHEHtZYio+G/A6Bo
+IZxaTh6l04WS6T2k362f6x4UjKYmlVtWbAwOum2Mqu01jvqxGpiIUfbbrM+HP3h9
+bITEJPF16+4TzItXiuUyyy+v7hbF9yBk1QVGa2fbDsuFKfp1uga/kvQxPMLvB6KS
+da2Gx55xrUKukv7awyL0W4StPlH3ogdgryf7KbbX9bCKMQ/2fhdz+xBksKBqgo+b
+XIF+A/yzhXYPVK5zmsC0wav/VUhCc3wOBDFImWrzKZ1BasnoHAXSC2jkMxIAfIyc
+/pxBrQYfOUckbWCMIkKbLwG1Ei2zdrL8uI723wErExgTcq6gGhi8Tk8zaBX2ubiZ
+mprF4ItvFQzmqNyKD9RJwecXuxr3IM/RAsuR7ZDwpZZMjiC59cUeysG9fdAbKHS9
+kfbKKmbjkqb0kMKhBEAb/akMXUG8nyzUFE3fYNYimHyr27IN7bwd+CulpVhwUV31
+JimOFn2u1cYfvC+Z5svv3S8Hnuye+EqCOrTyJ+xLc5J/SBQoWqMBi9S8nay+V9k9
+KIvbD9rl8rDIS2YAUpaQD+iErqoSe5d5uvto9CpjGTnyuGifk78+Zn7fN1yG3eK1
+y8HSbVPtm7jox3tNRdamBLyE8zxkf8+hsZw9FrGt8d96iTPs6J0M3k8ZWj8B2Azu
+OtMMgn0CMhriuIHWoMqRmRC5GSMCXYRnDe3oTbTvjA0uQaN0lHs4DeihGAbrDLqb
+8f9oRBZIiVd8g0ndh/Iwg14bsxy3FJQYv9S6w8DagyYa9+Vo2mdTM08/4csGMEQl
+s/CuI2pv6gS9okXsP7LEFY2XFfB8lcY0hc3weghjsk/X2FUzZmPnpq6riAlTkhi4
+FN0EzJjMKep6XmFD8BeLsRnb5jZOEBCqc/SYsrTiV8gUeWBF8dZjJYez+Q0p1FXS
+3njUVhjzuHWUWPNnNoEgkIVAVr/0YzYvgcpqgCox6dOGYUDuizOXKgvFaGRlyYsA
+Nxnpex08F1X1vsVP2LlpxNnN23zX9wpvjqFEZ6TzkY31IWAP16z1eGgL6bzf1UHj
+HNuk34pkFDm1cW83mDJ6BzbVzOHZNQAJ+BI1LcOLXKJ7K5UMsqIa6j4uiZYM/+CI
+9zKXFa6nUm7Y277HpiisDX0OvqblY0xl9pv78MQta0/TmPFEam2GGbg+tfLGjFtn
+vZwVkdaQ7UTP/TW+YUF3M/5sfsXFUhykgVGjKAogd1Z6dlM/9vySNB5Ola+JKlw/
+9Oy0ZgLw05f+cpQyo0GtFBi2gQA7NXiGQVfyQixWFJ/LCTuuiEIOBn9u8hBrNo8u
+Gpg9Pm3Xgm/TPsaEsBEhyiZUO9Xm+op5tN8jKJA/WMZSLxqDoN1rm6iCjD/pNLVE
+oA8pWps9JNAlL6qH/GHcflImnld2rcDuuzvnvXfomZsXTN1dKgzPBsbHGNCm4zBF
+O1upTzn9D+ik/x45VuWH2l4kpTtGITgV7ZRwoWyBK1eR3lPdILFvJAsRKo1wlpQo
+EfKTHLO64i6SV6CoREN5YRx7O4tjQ7LcxG6iktJ8uM01aPIA4jAfVGm2VWJcHUeO
+Qk/wqkrFdcjzUW5epCzO0fm8TTCuauA6jpVRbV+xh5f22L7ZO8z5bG/mEXcXlUXO
+77Kvp5U0nkG6MahHdwjUxNCrub6CrdA/VuQs5qTYk0Ez3Ul4v+PV07LwLDMek8aG
+pQav717uFDrb9FrO5wprWnZZ41nSbnn7CfoMg9ITPl6V/TFDrsuxHN3pnIVvnd0M
+KTy1r3DCBOe+IzWm+phuH7xgIels4hf90TBzVbDtivC/gi5pLsNtEHeE4DLKV1oB
+Ia/fNauLSEh7ukdOG4i+jv0TF6Hnq2TEfEVNVK7330tRG+TU9ixYB4HjRI7KGOy1
+4posNtSosHRRfVNzR5CRPPvhTHYSPOJKkP/gDWzy2wImoTuFJpAD3iKyy3wHFZuO
+sYSu+vJa3OZfLHWPVBrh108rpIk621fX88u7gjQwF/bBlOHeGd3g6ZuhXxK2OSs+
+nuBI6CuWtI9eggfKLOv2ORQuASXcR7mQCtzqM01KKbEN62QVBPzh5nFs2D3kjPYi
+zDuo/4dE8WA81pbsuIW2JRTHSGGoJJZNQJf4ROM0XMxbBh9ulERLcD3GYZIapqBm
+QZzBTYu0JwYvol3rS/ZX1ncr1dqQEWrzgLPrA0uh6pk+O5GyCbrL7YU4CkpOwk/v
+wHkmgFYCn0X0TxBsMFzlHhkSmKIknuZov20Mj84Y2XRys8UsWO1kLNr7Yr38mPYC
+8ABjyVxFiV9A6gJQt+zlgDiDKnP4Ux+tDHkfD5VFDKVOoIQ+CFMXfgPy4VtZQkIr
+rzuT0/52y+b8xZtEU7poQnxpgio7D4yF+Yr1RXkHzwOwSvLjOdR5Gt356WB2dv/R
+51WBxua9VGZAgcmdAON8V3J2mzF0nWhuTVyu1vkWTWq0fRVbwvT/LkuA9qgPNP2B
+I0NVNUYcgn15GjJlzXGxO2l0CKwzrqEOV1tz5DST9nuMCEKEEqeE+nayE4ZUJsLf
++wF6hWZqQxqalKsbMR87DJREQ5reRKY8syQupGn+OjMtxTJ4nNC4NbDpPFaq1Td5
+pwtajX4Xz0v9YjMxjZCRP4DnaaWN++sFR4s3ncWwri3pK8fKMC4bgzsofKxyN1E1
+xHHozDTfckGphSsqBzFlTsogs55UeHY3LTl2alxor/REbwhCnMVhHXnu0O+hNV1C
+sqvzLlBo9Z31OkuKYm3kW4jvEfLdZ5EvcsaHHRWYJTh7U4yfbxB9qoeReskPa1f8
+X2PqVpJZevjrRO2HPc+cfNI1XneWlud371Qhm2VPgeEd3r7ZF6lYBvR3unFoPER3
+xJ6Yid6Ezdk46LIm5nyih7JcGH6nRMoJogdGK+u0JzX3T6DV/5ZK2c66zlJ0tr2z
+wljo64C4ieXb7qV+vME70mCTL7E5rGiUia0oyurn1+2lYo07tCXgLJ9/tK8+e04a
+cjQCw82A48Aa2zPgvH8Not7ZBMqWVq5J+iPGdivH03b03ldkrM166GDxJy9hXQxU
+p5nT+4XMgdQYDC5VXpuyr2dJihbSyPw6P837goAKdgqnjekgQJjfjjZ6VSyMmb/+
+K41onpAAv5KtHwH+RWEWlrLVb9xGOCveWe2bDEijFIY0CzaonPdt3j+kbntB6snq
+yVTaz84+l5kbfHdIpBnXnIlJwHnXG215F01RsIRrrvgA/tSsRaASPS59iAuVkUgj
+YZlrDVDLR1bHgrrMaL/sb2fVwIwV/3eFwW1w9D1+Gpszr8WKTm8MI0fq5eE+/w6b
+ALDtc+HoWKGC/avMt57fqcmgiG9F/1Ym1ySPaDj1kAJVCGQRliZAI3RItVtn5kuW
+S5agjOn4B2NLlKazmrkXYUTrcBzVZ9U2i0RYHayvg+6S71ZnnH82Pd1LIxTEDmj4
+3lTskve6ys2dGpgDk8aFA8cqUiMgl4VrF/jdR3vkSjarr1uGspNgCTEyA9BM55h6
+NgxKaVguGoSufS6ciejD5ukvi227LzQkqGk7chBNumytkqvj8Wmnfa87NH/Kl4Wo
+0PYdGP0ZlB9E69WV2Y6yfFaR8L54OkmG8/v7tJlOmG5qHRcQWDWMPD0ebM2P8vxp
+T+B0t83GzlXFCctBY/0JNooCbo1IrXGkNrPH6lp/F4VV7S3Ggifl3//9X32F4/SJ
+NH5s2Q7hYIgJgQfDrUoYEFT2aq3CVYQCAnAnL9ZWnUcIlbPNIWuv+dOyBKV6fsGp
+DupM8jrPaM/LgxPvvsP6ncM6VAY+DzYhQYqdQD20eNvdrQ6VvICRnNMGeJy7ZEYb
+GuSYm24d7xbbS1FAOPoBEuc5qyb+hXSXqEWWNj/ndNmdpaeJCYg74EDmqElW/J43
+lXS1v59buR+whebrbPhfcjgydBRS4D9R6eS9KJRf91w8/WapoxZAkyHqhnThYVF2
+8AYssoplMO6Gj5Oq5fgd2lRwPILv5Ct30SoUmQjNzreoKgPh3jLY+H3WuWVCoCK/
+ksUnkwkXCQ35Zexgf12tRVeGaNZuCKMvI3Ct7XrV7x/JkdwfCQmR+lhQST5BP1iN
+hOrLxFGtOrBIBx2jsv8JIctZjnm2VoqKnENU+TFZ7qYSu1vqAmCuA/hOrLDaRpm8
+7Js65YzVs9PR8Lry/54VS/8pfK/Ripr9wGaJ/xnzqYIhZAa7wMStVRIVhBLJPmbB
+76nb76zFMFUD/ZNGCal4mrbHDvMDpSlDhZfc1rDo7pMFO1u/tKq9iLZKdpQicVZI
+ebZr/roukQG+p9o6h+gmTMKMo6UQ5xOTe3xOjosGQxpWurH0rjv4rFla6AdcO7S6
+QcgxAGwAZ7rJm7X2UA2pcpkmgNn2FdGVx5Vz1KMUkvUbMv0GgE9WrWiog3b5473U
+b6efJKeIOZ5+xs3rH/jnd2FuwA87tGNRN5AxkDWdjLl5t6rGYC8WxWqccmov0iJd
+yuxnS1ZE0ZukzDr2qpnfzD/mXqqa1Lo/C/AzR/4UvvmxNAcn+Hu2yMmjiuoigDkR
+GJAQG0iw5hS8KTe4qq7DAUvJPki6azL9Lh0jivCNEDFcRZiz/mwABNd/nBromcHA
+di0BB2voZ5Y1+rK9uj9N5Ysb8db6vA34g8TVcczrVJsn9Hhvm9fvA66v/ST83YPI
+MyMvKw7/ENTVZ9F1CUfuQ87lMsDI0ShuFwZ35f3ecS57B23DmhVVXyIE0RNc24aE
+3p/SulYR0UZYh0ZT8mC6OiCN8EqTL0GicuW1oiXdILs3qkHeoXTRmUqqUWSyB+hq
+hhAmPieQN1+gjPA8NhI4jhVwt9yKAdDamZXwCyp7I6HwJRwcVTK3MKXfttSZDE4b
+eTG/Ag17TBzs+/3hDjWsSJM2rEO6efcFJQuEaG62GuJO58n3kzwXrTQx7Ck6EalD
+uVnMyKKURRgK38TCCd8ComS91b66wDR3Ofmc51UoOcYAHYB1B5QjQU4hykwO7d+a
+SXfg+agjcGuEZqeGuHEhkgG/oG9uC0wTB6l+8QWTFXCr90R2jmQL6dHt2e3n80Pk
+z1/Wc3K99VBAGSRu6zK6tw5GNbbomxxnXVm6KtlpMGcYVUFA2Yzh3Zj+wHPtf/fw
+PQLl/3/HRJyyVzybUfUCeZHgYNXtd/Qx/Ryyb63pJreCzKJFj1UowkwqOrTpdJzL
+Sdw6g5HBx4GkA4bGN+QjfLDI0ggI4LSePsnsEhqZW0/WK8VKpZqayV10RbgqOu8j
+wSJ+YjEA+d2Ty7kbQUNdD+t91tyulQ/WW3mrDxd8NZkjf7C5NaYtmh5xYKQbLRsf
+qoJ2vcJIe3FTuCXhMBkuipDsrSGA9HNua1BdtUPZezBKYwf6EGAdGXrsFWOh2JGk
+vB9VhXtqtqOWxahD5SNJD5gltrgH4FGKSAWI0NcgnMKOpoLsiRGjp7ze/XnsngkP
+tfnSA6mGdYqE8WzcuQvLOu3doA1HmHms8HOH7VNOOyBLrWofFKjRXCVhiw71LsgT
+BpQrV1O3OzgwPERjAf/cp6rtEsw8ttuYFJyGqr4iwWJH7SDVD/0Hn6vOGpAKcKPN
+m2UGCw4KcasWnrgAgox11NPPcKI+iWbESCOdicdnGuMSjNtoMgWY4hh9W3c4Qn9g
+uKbrwO4uRXkyrwEMF/38PplW3f5X/MjSBgF1pNMHQzx2R4Q1p+QHQVhRRn9YAZeX
+qPXLTspJ6pX9J3RCSJ1s8i++iONWDjlSMkQNN10a7myHvW1+M+I39Aal9uMAj2E/
+yJs04l/jgI44qt9o6h5mvYBD3GKseI+nsdxldHCA3o2yHWeEnlDfxK1b+D3RzsgB
+C7puOMH0n9md1Xf/7gHWA1M04gTrEv6Y20wErr/Eaq3ME0TIVTSzDsrpflb/fhXH
+357r8UAB7GA3nYw6gYbUEbSN1lGi6pOVvabebq1G53ByKtmDqt+pYXP0PXA/Bsih
+oWO3wE+/caULBkd48eXkOj1CZAb/0Exhwev7MCfb042pF/WX+v2Ef7pczK2FMPB0
+R4Ry5JfWjxYF52KIX+TU+7tvE8aAiSCqKApW6oZTUJnlm/+65UXdnmyHb/5PECts
+vXmA8RgmE5udcke5uyQMRtK5Ujeai+k9z8R7yiU4tVQ8UUPigu9cR1j1B/5nzJt6
+3LEfcwzXeZlRGh+yDjsbugvTQYUIOtmuMxpNRYDGRAUKy/2nt5BVbWEfPuZlJwDF
+vAWfgigvrz/mtU9NSlzvPhGPcOE5q8huE15smufoLBomqP2j5yLNAP/zoHxS688I
+ZVJey1L+pCW4JHQA7QsOFqAxpUIZwCPFO+tyWA9YtWatCtxf1npqk7aLjh0RVmGs
+yZQ9kunyLOfe6mFnlVxFnQ9G51V4Nje+nS+/B4o74LRquVYH7L3NowC6jfiOko1r
+L3rkcAzQkg0yTf4F2di9iJ/1Et4GV6z5AWudyW9AJk2T2MOlkbneqpMzYDnJuBVV
+dSIi4bxFDA56tu+iaCWVs13Az82c4fCRVS+7UzFqmM3QQ8iNw+LkWlSuuGVrGFgd
+OeS02KSnDlV1oyWAfZ73M43EpRTf2wWc7Acol7tzyA45wD9liEgu7d0RLdiTnT7C
+SNHcWLK1gNZxoTudLNcJ3uGSqv3yIsQekkzwokg4QmQWrbSpUyhGlFG4TgL+4RE1
+qzjPpUzVKVQGRbKhDlOB0NQJ775ncE+GNt3bE0I/4RRV5xc5ZM7PU11TKspi7A9F
+g5wCavG7m/d0AZCsqjMAyy7mR275UZwsBLRsJP1bQbQP3ksBepz46p2euzbWPEpn
+8xd5QuBRwsw7pRVkuBk0YG2VRHlUdlyWTvxBQzG973+9TRh+fg3SbRPAWrNNzMZ7
+KxOZ/SYalmAnchOn8kfJIMTV9UNMq923RqEClQ4bxHhbA/CBhrRVKnJx9kngfXPt
+OdlhgjdzapwuSG/ggGRYLsVKJV2QGRqNvrkEVAaRQeIPn+whY4xePGBND6QGrnmt
+5aqc1nBCJleSNinZjgn6ZtvvVBi77W4WrNvzDTLNFBkYmkgCkKN92EPnB6i8np6U
+uRltIcBZ72CJY+0aOnACbKGyKo03x7d2YkPo1xgUw3XksSjfs6yOEOa5hEdh9AYA
+HjVPrlo7m0f2/aX8wYEzDk6pPdYh+WvLgvRK+1wYDIfvNSj2Lmj3pt6wUV/omiKq
+Ls8yskQvFDpIQPichBZ+mPow7CHqkGKRo78Srls3rdmArfK+/1JyjqQ0C8sZnQDH
+ho8dVpTIuzWBmVb/+7fUHAZwUulBmThJ/3QxGaov9Q2z0O+f5/ARFIJaxZyxCAAl
+WxuKXiQ9eZASJQPAlb++v48RTrYj3qO/io9LKeIK7K7/1lSd1vLyEplYyi7Cnziy
+CgcjTRtvu0N0HjzvVY1AO26r6dUufHPrm4mdNiFLi4nCWuR1zDfO/7+k+aKY47LR
+Lx0tSKChpoxVX1A37X8ygb0eoAtmrHnzA2ZDu4Og4bEyMRd495ATHhnvgHwDz1U2
+LrZX1lm4Wfrt7XgRIhgZIOMlzYuBdW7ixA4Riuwvcd1/AM4ayB9wbEBITp+xK7Na
+6Amq0+DrZlboOXztGkdy1+eQ8sr0ra1h/ui0k1+rTEytHqrDGfJvdrDnWrf5yAqO
+ULjBuLk+RArTia4PXulfmNPdOedr3guT0ugzUvY8j88Fok0Pqr4KGF1S9R+8rTnB
+b00l7HaYg042vd/pseLAeMiyi6muZvVIk+k5haWI/i/UUpHDqlc8yC8x9Vw/4Z6G
+BOaDIv0m+e7PaUDco0WzyB3hslkF0Lg0Q8j69OS2C8Vdx7t+FBQQ2RHl/R0yQL/Z
+yyJq8qYvm+bdVsEnUPuh83y4vV22eLrQEg0Dalzy2Bu+9DOI+Az65EjVOnzB7vm1
+cdu048Ne+cls7D3Xv+29hMp206IS4syowtU7JIPceynsFelszw7uHsUwV/UT2Q69
+B6oh6aLgXUBI6F27fdWe4XAVo0IwQDAdBgNVHQ4EFgQUQFXVk2/1LlMGUGFltpkI
+HxpyqjEwHwYDVR0jBBgwFoAU41akBnP4505sNDHigUVlOFv0K9gwCgYIKoZIzj0E
+AwIDRwAwRAIgIfDHuvZ4QGk0TQeZYFYwmyrHLvy3L2CYupR0afMe6fICIGGGYjml
+qBGaP5mHYhcyNEd36e2ZiuTj+ro3933oSD6e
+-----END CERTIFICATE-----
diff --git a/certs/frodokem/frodokem976-key.der b/certs/frodokem/frodokem976-key.der
new file mode 100644
index 0000000000000000000000000000000000000000..1a55b3c812c0dfb1f51d8f24e0e781c1b5630f6a
GIT binary patch
literal 31323
zcmYg$19)A{_jPO=P2;pdW7|fP#%RMPjh)7gZ8x@Ur!gDbw(T$Hz5hPHZ}Oab&zad+
zd+jxIBSvo*H3)DpMg$nRk6xiR5D>87P~I-0Z<inn{DH&%HCzqRCRX#H_udp-mk`G1
zuHU-xViP={(`BYk!47F()_4C#ElQCuS#+@Jl|`#27Q|60fB8ZIEx@pqv0AcJd|$j*
zVjznjU->jPuXKnd_O+_8k+g5H3Obtcw+!;;W?m@9?dz@#<XQS(h^`eSa`j*j`s%SR
zb;oEV8|4_2_-OCMSjGCOI?rlUXHB9Yy!^;l?Ca+J8}9^hc)FNy-z^jS(yObJXzB}2
zt>r-Jst4)Nz^2V&i8iXal1|C=%9oQ|wTWLJS>OymCKlTs6gMGn@{y)48$P?Oa+!U#
zSH^`~>-o#HY<`9v`b%f$sC-WXy%vwV&Xj~Gqj#L!5^v7MA@jY>*gjFz-Y{{1*JZfY
z`3nP7jgEpbgm%gZEUoh2#Y<9ZK}4YoeYff96XjH1h^+hzlnVKe{e-ygSxpL%p~&Bl
zqoV9xU1AUYb;1L!AYP<`!=NT%2849$JFHxEUiI$}iJr!fMcC|_>8!uCC~etq;e=hM
z^WyrF+M|T5zk(x><G9<%oaSxI?>7o;iI6)&viuyd9hAh%7CX5As=u=ID*|si%)4Lb
zM~79g$@)vQBs}HU7}odM$a3CySc2XmpC1{^YFzBRaC<kUQ1?E3l<6^hZA$hNp;FAS
zVx{q^HRNY?{ClhLXqX|O|LW$;o7NG@vrd-gr8O=i5x&0W@U^`MoLfQFLx$dd;YN2r
zt>xuc#W4JsIkH1{e&7q`k45RfR-=h=kB~B1)&9=(nEp#%#a-msX3GO!oCn_C3KTwY
zV>xG<$}_Ht^K{?z84lU8>K(#|%6c4^1kaDl+)-Y<OP4mg%1RsljQ2`B7ht-H#Firv
zc#3TK6bG=^!w&X`Cd)2;Y$Bkpe3hC+5wFvxD)Bf@H*KQ1NW7#U9_N>p|Fj@uY+6dm
zN!9r=&fzITT$d?FB5Q5g3&BNUIloG{q;UVEgEY!8t@^@--Vgh=4e(kqEVR98EH*=&
zC8>EWamxjv7*PVJkiXBY;<MOeEm?mPoLBbX4GF3k1obj{us>OSj6WVV+`(;n9mIAn
z#igHL(~HlK<l(TJXEQBkpRp2M#rnlcNY3=SQ<qknv>@9^Aev+_atXs@FuK;5@_0!a
z9O!MK@sUdLJo|TOud1uFWOP@5BBylq-PiL~jnul7(}Ey7k6nxbT>@+&BL;(nensWP
zjVHUFm#DqzlwK*wZ|`CJwj<k0z?bS>ab+nL?&roV|FX+)GEu4hv<l6Ma$QGTdc4!4
zbieAaf#E*RSqLJKp}&3(u?)U1+ov8(sqceLIrK?RFl6E)XqoNUC>o*<L|uV`f*K{H
zA@?#tv5+(57XK_J=gdZ3hW|lmCPN+7Ase-q+s)1-`dD`n_9%%=gxO_Wf}t#;FNRZq
zdcH8(+1W=xnskb>Euv$y?+Xbd=3<QXwS3iV^U1tIks;ovfx#e~7wV8fB{-GnDl2Xu
z68WFLOQ~~Ge-koD5G>+y&c!j`%ZhLicpG`BsSdP`?+rFy9DB+%DyT&pOime%|3!VY
zfrN~};aEyW#2UB=-De0WdOnCb*eqP~%#k~unETwAa0H2)cbJ25b)+_+Iq)Dj-Al?S
zIeZ=J<|wkI2ZJ8)Vrc|FECOw5WX#2nrgm2_?vy7yH8n&GLm4PwX;ewN1}%=xf-tdS
z+s8eP+7JUpyejMeSpK*FoaE7|S15is_cCheQr{qz!2#kB@p1LwLNQeUFY2PnggaZ+
z_@-L5%Wd(#n7kjg)ZK-K;mGz5k3#$h?M?E+kM1xWX^DHq+_h=Mr!bPa3wPRvgyKa`
z!_`aJ)gQba@DnVU4eR5pJ{>^=8u87Xdo;$%iCGMPX1UP#*~(*s#Bxl_gvfdyPd2^8
z<&<#PDdyboET*><J2e^mf{*)y6d6YwTn`wMw}{FNcKTmG%hWs23}t>j4jsJQ$wR?^
zkh<0tfIjMxJgT)4c3|qXg{jdoTYZH8<IAmbB*`018RLwEgNH3c^bWt1)iG*<T8qZd
z#%e$I@+IXj0r~!e)<BOc6K;;9!>rRh+@zjEdoTO9YZ$z-;FKvM%yv4`@Qa@!ZOHiF
zi)Z>Vg>6rqHT?VoD|wOUmbv|kF<6Da<l|2}mYMOvBqazMr6FF%hN1pKoqRsFhN6x&
z>JFs%E?s2Wm40fzSZlPl?8$*;J<dRy@eSVXb6cB>){jQ1jUkdOtWW58l;lPDvb$*B
zf)!BjqsNPJbhBSp{4kwVqN}Z+mTAWbX=H-TGtlV7zfUw%zvG>RDV;9<af;`p;NMq*
zT<ERM+idr@mD4twLq$8*It7<pyLs}n(qYpwLx98|yk!JF(Y35srpe0mMh4~qaTDC*
zE|cUA(r6{4W3~^h$~;`tj;Yw06?xSr8XxVNh5dc)p@&1{5;_e;_K9;tI+gr4YbYU!
zPhh4b<_Ubvlmv(Uh^DoI;CW@6ti?5NNf_Z!j?m2>^U<6fr6pBlju<W-iF3a%Bnq9T
zSUf>wO?nTIluDrwf7SSn74OtAxZ8T^_6fC|^Yzf7fvmD%jAsLhTPqu%`qR?VKobjv
z<x+oI0TP<6&%@0RI1&B#H0HeG$pzq7Yg_Jj(=8^WKDmskXEm3#-p^Pc#{=MDcle84
zls(|K^`mYun;`l2lQ@o)5G8`%gByQOEKVe-jywINhcB}#U}XA|F;$#QQG~^BZeicW
z6PUk+6YGDA_KF`P#*f1VcWbvm-l#5c=H*>3XeaTw5*Hd9>DmPqn1YLNmVw+UD7I}N
zxf(W!lUw$rQoOP~T*ZUIu5-Dr_DNAzkUDwwTz}iq+lEi{Yi(G0zYo%7<LY3w2n+wR
zwp~pS!)Y0+-hAF@1GQ%BOPoF4k}dm5`=I3MLE5?%b7wOGT{=YqWq;QEM@IDgO7&hT
z1>DGWOJA)`FOt<5-x!(Figrbf12Sj{zFB#7yyP8q`*M444Ki(yKP#+lz5!1z!egX~
zemH-M&xcwDFbH$t+{wQ8ela^Rb?KR%ntsZm<C)yTdB<bX%{Rw<`f6*Wy;*$Qq>?Py
zHf+ZbD}QE=T%K_oX;AlFQsPX*x=moZN`+-|-_d{X7N)vRK)#$aZ%afEJ+4TPctK6{
zfR}QoET*e<Stu+=E$2f?ZK{7(vxPhjfda%0Y(Qwm65D%<Nta2}PNh~O)O1IbKeFAz
z+KX9bf=x}-e_m{<L?>nG1Ddcp;7z%{4`Fr@l-jBM3Yw!AOuQh4D`4#sY<t{(@TZog
zQTLf9nr031Oz^E+N8@80(Hs?Mx^5AkK~0F@;hEcQg5zvQPH5|s`$&4zP%_RYn1U^h
zn>JX1W%5g#xL>@#K4dx%m4Gu0bBsGW89hgc^|lo+tqjIp7l~go6Y84LZJ|7+ceQzd
zSl3h2cR2A6%IK1bD)IW6PvN>bV@755Eu$Xn@_@5ixL!J!luZUqpHI$Z9=zhDVxBNr
zbI^v=W&qrfK)zLLqGj}z`iga6aI({_-|IDz+H?1onygpvO;*?B2r|d-EzQwCSey3k
z!d7MFEY)Zh{=&?!JPs4DhsgQ_l51GK*VS2Eks7Mda0%s7q>-n8ep>W0DtWXT>^ls5
zm`E8fd~+Za#0+tPk`|e9U|NJ7?x!_S+63EqG$`{b=452Ov*Q(=9^WKD0)LkSmbXzn
zn;%WTAbNStM~G%=i=&>kx3-1dhn`Wi_3Ck{s@)~I`!obSt~ZY|0#leBp07vMR8c$f
zK?v2Qb0?_#1;2(o(P&}`I~RT2HcH1XDX-%wUik-&7A?#O7^PWHGK}L-o|z<mG4jlu
zgFC3oiaImA47UA#e`(rUBu(Q>)0R~w?6Ki==9J|U7rkt;`P)!)wWRzIhFMtulnJ}%
z1_@3!_b&78x$nL$52W8@|DvOh=#k(@aK-C?`?hO#)yzvXwsPu1%9m-irzK$u{aY)?
z&~WOS{dDAvjpsV*s}l@$t@rU%jhG#b;2s~-ha)sPL}-Mii@|kHFBKe;6)jQDMEta<
z%u@J^b5(dhf#iixIh@24)*10Uwx)8bnWMC<u^qv@hRM&QI(~*5CnB^G7bzB!U#?p-
zv($JkSMnOg*ZnkL0|MffPg3c6BQI24hNLbj`*4SLp2`zT!%kM_SY7i<haprB_^8aD
zK6Ua$1f-RnC{`87RLE)-7>!an_Mwwvnusi3Y>y6~#Ng=dk54Mc<m^aUgN1fcG@N@E
z^<Zfrelsl&D9O6XKQ8&=zC_jfPzwPE52c+Ri?_MG(KDJI;zgeCbB(RpxBJZ)%<kS-
zwHs&dv?oD?3PEoL{)|7fc~I>O_g7sVtQoQ4=*(%$IN08&aDAlm8L$9l3fGfGwzlFJ
zogBS**Y@ZKVbhhc$#*UDXQxK`y0RO7i4`*%uF>dn(`YZU9n6G%DaaH03SP;~;AKgp
zC3Tyq+6rNgmLhI4LWya{3}Lj?%rancH_E38F<&f*KbTC{8V*@iVts_>7gaPamw0%N
z*~7GVut{B(hjwZ-7NlV;Lf11uuMC{%RZ#MFe$v<w%~LLd=G@LfhF^>Fn?WO;`mzev
zcyD_#?uw^Lr<C#_N4#Ep+DF&KYlPfGfsk8WCB8fOI1SNrhjIUT+KXknSts`p!d-tg
zNYOM3qqnZM{4{s;fYepUyq7?xIG8*+ve<Lsa^7)7LgN?>(#R~h9y5+o<#~-vQ_jMy
znZCa*5+eu_@wQVOjnx%JOG><}=GLfT&`r%Wf7F*$QkFJ4tAOp2xG4H8`M`v%ieLs$
zlC--oLoWy+;DGb}`(9@8B-XrCuT^FknHH+bdPqD{?f4c`2U0_l9-`1=zJNqkItBAo
zQD)l7tBAsvy8e8(z>yf1edu~BbcH*Lm-0=N<t*r*G_l1TAD5KQAk`vQP+r8-Gpsu0
zm1%HwztBjiJdV7pwzkPBom445($FH+RAqPPRXM31jR}}!*!d*FYZYI86aF$4m_~w^
zf_9JOOR!r;sg)4e{5*HEi9%)bfHa#WDK^5vj<klUs`mK#y@(OfnasyzDrtDxtewm}
zhWm^z0;9UtI48^?{=z)=l_k$>mpJF>>%&{<cVSm%7Z^+R?IFzB2&Nuhrm$($O>JcZ
zSnH)Vs0`kg!`E{Y-c*s^6EiZ<{t6*c7qe0anXFsxzYQJoa;WCa(aKtK44XuA&MRWk
zg&p+YLspXZKrC7NZ+~50J59fR#%mng6CbI);hLt}>{x-<9yG64U>);nMlktyp8R_!
z^*1Z}MI46oHnc>3`qL$YZJLG3p~U%g8|GIXf*Xn6R0rad8?yR%HGQ_L1h}-hFP~A<
z{W84JW%3uPAZ86-3K`wM??zJZE~U8(%xQ%0eg8_v#VXj@>LNb2K)Oe8#)N+O+bFsX
z;n7Q(%va41l2Y!s%3k0KwEWx>BjsM*V={&OyPeNnhgDopS=C-IP0-jy_tT+L;0rzr
z9#OqKy@xifD&4{Rk+_dfhgD>Fa+#WN3YKR|DCb5iFz4uE+zmH4JAG{LW=oq?*B~Ux
zHy`fY-0pX7_Av%NOBhCFBZaO#A`2G!&Lw?<N9|o{m%wtXmHmv@$imQHbxOGTb?qCA
z(5Ff&qaap)Z7Xh76JlG%b9#yQ%DXG(nyzy<8zkz1Qg=HnG;J1(ok(&k`ih6Cq9Ky!
zk3l`p-iS=MonHzY9e2gmwjL*^eiI$^hYz#oE8B|avX@66Qle46B;JlVWV06Y{@`6b
zcOa^V&}Vbo%CRt?{Z!`rgbb_2(_pt2xrQ4u+yI-&e%w}09qf5t>SHuS9V?_jWwLSr
zDMmpVmS>{&!-ZXU&lycO^1O&)x>5&*w2p##zOG1h=paG^E~u!+gcF)D#~0mTKbpWk
z(4YTU0Ow1}Ew9TIQel?Kp7h`ES>Wr4#HH)llhAj8{ul#nC(i!yuk%5>VMBIDCfEYo
z?(*&3+^w=voRO#1t;*kRl>58pH0|3OkFBLMqwxb<nDHNKxq0=Tv)!K3DAXKSnrPaY
zO{UA=m5*ZZXP{g2m**~oqeZo!_(0_$5&I)#u9@A2Kv;xjUww9dQvC2s<VQ1Mzx@2y
zTTY{8Dv`1?o!rDzS4v-K!I4nO9|mN{CA=-%5vRvw(fqN3_qy0QY7fn}%?wh8ttA1&
zu}lZ<CK^QKl^#3TWEsn$=IQdPCgw|ZTm~gN@YqFK-S|~u?B@%aYHnILC}L1N{vH$+
z=k)k~Za;3--LU3Px-Ch%1;Z-Cd#~Oz{=$uTN#->ee<4;QI=C6YIJEMy47S;kmtyP$
z%M<UT57mxx4psfbVzv+{_m#niO~tc#(~d=1Utm?ntfcRkfZuJrU=6Z9xWsvjgvHTh
zJs$r`!1mRS=rP=hh}Qw6V4P~u5N`V0Z>8v=wRKf41aWF%N>lC?y0(X{=<WhlPvDz&
z72v)nDIbd2q5i<eHFVYTlcMGkMT5*d9$$_g>wFk`I-JT~TJs<KN~HRk@^5+no~E(p
z?COs)L3K*KAaC`qUV{m+ph0MUg<d(1OX4;MN?t|9TSm&i2j1jF3vv1CF<y?}G@E$M
za68vZq*dAdF)Cid3q)_~Ry6tdu%K*OSwpytY!3pfXPofw_nA>(ji1jc2wfatu()Bw
zEiC<Rw+7yuakM)0oix?I!fn@t=Z8Q{p!)clqg@gcU@I}o40+*kOy#`0sYBY;#AnAV
zL39oOWLhaUt6{LG483l?u$IIeGEAYD>p$==g`u!p$d)K>ZNrsXg(G~2BIglrlQDx(
zrB!-XTv$Il(n0(*Wb-Ai_D_MH#PQW7BI7&`3ITq-WWcITrA>Lc_1Vn!pJ;Wcpes|a
zBFU7HQMBZ%>dquoxP(_RW4yVG5zFC<7iLO6xLVHB4fb0hL9YlI>OblR_b?lwnYQ_D
zVi6Ww+xN2N4%hdqJhwv&zvrLoSenKHlYSh8k1zI5E|qnpe^Ne<icY+93#MiUPo-c9
zck*#3A>1iJdvuWx#nqa2#o3t^DDt?R3~`uDAa~LG(5!bGiu~SsF**??%xq^_yS~YG
zrFnAM&St9mi>6DvCwl~)scI4%rA=W|B-VKD^tf4SBuw3?=@jZ+oyt+Fc`+))*fFCS
zo~aXlV!OZZf+_O*qcQBl{ft}kF-LxVyKr@;9x9DU2k`uB-@1<PDHQRnD=l|hwL4aH
z72*qZzXD|7x!l0ehWAj(y4A$tZR33pKBA9MiqYiAK{k84vhv=<kL}PHwTu3x7p-3a
zXEGV*S%h%gjn^s44q_dwP#Evz%0H#zLD}RROKbm>KRxiNPjy9>=2=J<BT;jp7s>t{
zzH23(wDuxc=%!tdE{kei{ld{cEy{6SGv=-WF%}JSmog-KJE~=)mNPfSoP6WkkAPXn
z-vUzc9$>8k8w6ClfvhJSGd7~cpUNO>F73;{?9#bHT#iB?o&La#-`@=>w@RUVykai1
zR>J?8Aw|#tS>RiSd#%DfoGFqn`Vw=Cw|yHn5tdAHcGD-)!d)lN`xmSQyc=1gP^T=!
zJGY^3RAr7FZSMSojwxNifJ!9MO#re|mfg+n2ZHhUpUNH&$`YYZshvk^bTUH<Q#!D}
z=`Zq2FG-k=;OP)n_I0S@gB?T@wN7@cbXX5`oUAio2-Yew!dIaX2^d-MaWKa}vzuQ?
zr%iccP?Hs9lQGr7a<NQxyqk^e)ytAZE)4W%SfhshO2Nof=T$R0TJpKphPFRc{dSGi
zjMxJzR*RLq<ymPTe+Mf7|4xrNa%MzG_s@9-Tar|kB<(_MO%EZx5JcG1YsRs#>Brbk
zU$KX3*`SrOZM+|bsVR@FKeQ`FZ)1`5ilN6245E!fv+->Wpuc#{B7~i$lZ@_0dJJ>n
z&W*2yVKsMD#j>86;}~yU1`T~4um8~3jZU78xS$U<Jv1b3`77i>zDK)$V}*3=yb4S{
ziGsz*<yFRMZpDGjfkosSdz_FFrBp5rwmpXse)yJJLQ|gj`(ce4FqB8VaGdeFAb;g(
zl#ajH?R%v}UPv?LE`RRRwr<IOVAA97<J3wIkqOJn93kqU#A8$;MB09ma=vsIb3Sw>
zE7_8afe%ro)Rp3`PYQUT;NLvaaOs>UG@$LuIzwZW7H_t#_!;`1F<U*;#d&b_NjK$#
zFCYE5bT0(wo>bq}F<by_n$wzp3ywx80eA3oS+{FjJr+a`>36oj5}~z8qA&eyc)Bvh
zL2KQaCBc4frN%7Ma+%Y3s70sw?eE^{@-B(qZl_s&4%4>&qLy3IV<b;O8S$*>ossTe
z4PkAlN=f!r8Je$;y>imivZ*|;<DP}gb2Yb1KBH=O##`;qbJ_GSq`$8e?FZGG;4sA?
zF)`%?f@nB>=;E_x#1!|W6g{dJS29_dA35A|E^Z28JKvB_vCdhfxdrlIk!gaS+N-N$
zo-^UVwuD>WAFA*L6|#Y6<vw^!KGfNs_x4GK=EwCm?}Mc*e$RD|aHT0=Io3kRZY3PX
z6OP$;j9=TH&$6k&6s6Xv;y3yEZPF*#ekY>YMDB+L=J}N+6)F3Y!{7Pe5f}~yoqe$<
z!S3h&OoZT;?ZpRw`!tV=%tdA<m`ZC6!^nyKD4Mfsr60M&Q8A;*b=VPjk<ynZCU~;1
zu-#0k8Sfzzh6@5^^>|#W5<OoTw3!L_-wSzC)DDk7&$xU>_WCNq^^3>}s(#OvoCHOh
zkG+m<DC|Ofsqu*@xlo!Y8uLCk^+Cz5LPm096P2>Q+evMfDJN6JPdJg&;498#_?Wtj
z-=kw<N!DmYViov={g7s4JxAm<tAt8JX@QKfJH}y{4nJr51a2{7Qm?u8B7E1(U>^<h
znFUF@_cz<r#_Y;rKWZmfxA$g@;4DA&ZlrGgeo{S-Nzx@)t;BMFi7S_Ypv%~0@!<A5
zg&xK8)(m1G>shs^d=~*_uE|@sbMT&D@xJD4u#Jw~bq()mmPj4jc%Vv)h6Y1y_~11s
zRi@CQ8fhf#gzx&CiIf>Rp%Mi`4?$V}yZBjLI19DQr?|2vunBa%ETSm?7!fLCs&?b2
zhusiQ<vpinM^3rE>KRS{Ptf<#3h|roTXr<xGn9Qx|3yQtszyvB=k5imI79GteBNu~
zy=1mY|Jj2C-+5};9k(EV%8#6RvGTsmra<nW;;0KstQ<@b_gDUx@XiP&pI=?!2oI?;
zF%jD5hFmPZqc>XE>$G}lK+NBMZhHF(>l?m{#)4q*M&H$_b&McAJVZY0SOphPDCTIQ
z%S^~MFF4G^$mg2+&L*F`zMu9bTCqlw-L*X1DeNz*F%=|;$mOKwQmt%y58a-41}xtF
z2S}zxCiEAxL@dpUHyd33X3T_Q(@&YA0{eYxELOyew2{8^xX&`76;vlXFiwxXnS!Y@
zO4+xhqz<IPj;bL9t-Bc2iOFa}NND3};g`f?RLQ0!-$PXc)MLKSR|<VM5_P=P7k5GS
zE!{`&-?l)sNYb}zZrB;yk@!U8*-TtM<k~kszQKa|VwX{Nt79(AIl@=GAoEk^K2tJu
zPFUL+*Q0E3c1NzKo|tAv<l=opWo=+sO6jS-Df!+<v@EEONu(NPbylN2zM13vNt=bj
z+4@f5&kB=TW>r!S9OfMz?4|50-2J>FdnqeT>Ua&k{-R7{ZT1Zv%+a>0*z-+aena8^
zEO$fOGE0JBxGf!IL8WtBWgwpd1B;SV>O~K@N>X4vgWYSKVs6l486bV8z3rw9$UPrh
z*puzs6SkuXJm+E(2sY1KO3*$Sld9$4V;~A8>ctFmD9ntdx7&Wdai*b;Q}r#jIS|dX
z{73zvJE_ZS%M}FjJ&Fd0D2qg(?(`Ok9GGyc+N^CHEd$t@(<*p4Qn>vJ1RQI&#0X(&
z1A;gG;E-eJJ6j#9h`!uAjsQo;pZ8yCsrnZ$(Z^wC<n4xU7GZ7qL&$zCt#4nS2mj6&
zkmP5a!Va>0t~|7f3v}VuFxHYkNr#q1r4Y0fmVMcOcM?55zC=QA=M$bsjm-Y@FhT)$
zP3(6hMhZlCpl!@&Q`$BG|Bw=8%Jwe-v&nc97$=(}X_v{DkfylN8)W5Qx)nvWP6Kzk
zng%}&cQ*d=qgOD^7@_>AEh_2}eZ$)ET@*#u(Cy|Xkt{Fb$FTcW{g1{T8;7hKs42g3
zl-Em!0zy1HZ{qH5S{Vdr;R*ODy;AA{qG`9kYQmQ;q%jH$QzqD%QPJc?;d}HLblQJ7
zrN=H!{7Rpa_D2_^DLXHp@1Z=2D>+4=0~2C=EDqhTDudV<&4e#}eZgTb7@K6Sr5eK`
zu2Sxg_Sz<OB!AQW+*1w;t3bp)8IFl0VcC3g(A>mFaErIcmc>1*jtI_?KfakdGMx*z
z+jS%Am>Z9FYkOhgp)V#KvPQKX5Y&{CjADVJ-}ucwRuW4iMJ?LN_(59BLg-K7O;QOZ
zjZQ=`Q%O87k0chSw=4H#iaRVyRZ;`3fA<1|%A;6x7d+WQhz$+m1r}uranQMcrMCF6
z%Z-1;Cd_H@EEvz!PF>p^ace{G!urR==ZhzzICF$JR$A!HAmiGmK>Pj1v2XR@ifZ7a
zWm-kdN(h`wtnwbPJczgrEuXKW2%?I*b$1|33EYU#bSo+ppEAO@FbQQ{a1@E39fIR4
z@aoju5SzpcU^pl){@}%V;!V0VRXYR{+MHyfZdbX{bPiFH?|k{CDfgvF8cSZQ9{vK~
zPuxK1!dUyPr8%N<5B+Zhn4kGOf=WLVT)$E>#(wU%Pti8k!b{CLDAS_@%u@Ea!^gCz
zt&7gIOR_?%(?mTnZPi6p6m%nw;M5nIJ(K7o{nAV%ib4|Hxg@PB3Zyhg6{Dq!XyXaa
zJ?1!C@;vcez3^|#KQo1_2e1~&#i@%j`;s<UKMKKdZJW>jT(TLk3c1Y2a3{v&Zi-xv
z5XbOxQCy_@<iEarKgXeWf?TCrVYRM_v#vYjGpHMIggH)8#DMF8t;7dA)_8XX-ftxy
zi-*qha&hOH$BQ%2J3M=I+X#PDQ&%B?uPaV2VB6R+xRw-yTz9cwIU?IoceqN`cP1d*
z!#;Fe&7swR>*HP78rb&%E`Jj8z)L~Ay7iUDfLq!CuKt61CMKkyMVMGc=OvhJ=)u&m
z`hGJh6Z<<H=Z~a>u^Jj>>C5t5)QBNuCk&GLQ63jc-y;L+rCNT{Z4lvj1Xq(_^A1K}
zTUg9A;VYGB8sa`qa!kisqCOS3Z7!>mPq45=kD5FEiNQAr*inele5%mVL_B+6gvH){
zBBFw1PkL~gX77ugMp5Iyp~b%trnM|@_~Tx>ne%q8g5!yk{UkHULyT7{OJ}!>T9D+^
z=|Hb>btLw<eb6&h6ZGB}%t?FBXAzX%<Zlthjdb7~`Fjdp^>*0U*59*M`VVS60x(J(
zoC6SBKT|IA6|O#gFwcp$8t^zcU64c&{XTF=^xNqBG>zRCMNC!hu)NVS|9i#a8e=x6
z=mtE@7HI#!y{-F5O&AKT5G<i#c`}ZhTwm4q#d^AQ-#tEhY~uWq$KZNFy;1U6eb{2p
zg1f-lj>X4@F8TSR$M+BH2yXF<xQXz<PJxDykPK#BHc27ZT}0+f0Uu^d{5s6sciXlc
zLZt<Zeki;3`bKM4TR7HHG5vc@$h=dmYU2;ArF2tH=^H}M11=oVOZ=3%jVaxN_2z$C
z(;9V{)heGd2yKE~`<^G2wG>1LifiQ`)WsDb<)i&xL{&}E1Y9q+&*!N$y#F|l7%t&`
zb;CY{RFz6v%;<R#9xg+U_p|%Ei1$KALCJ%J>)E{#G;tZmQ8IO5a>Oh;y!MMZ!MONS
zAc`t8S0P)B-bP}UW2sBVr)G+^=wZ~l1U6G2N%(XVB|7YpRk>M{>&SLGEI}9Qu&$4c
z$Awus0h|jS@T}tq;ZNYtO0>;=Rtc3*Y)j?^<Cn2Z7uLokGo7w^XH9wA-XwAJcKEDo
zG%w+iZd+5DEPnHjN>$^o#NbYl)f3o72Se|!|85Dh4vRP8T_IPhz51K=XzDIZ3lN|{
zmhMA8TD_u{=&M<jZSIsz`mRX5S_u(soe2KEo`6CUtD{Y^)3*2I*ojkne)~0>tJ90W
zV1wURUS?VL@sZQt5F=JZF;*YRJQp>Cx9w*~<c7BF+-%L<7_;zJNy$|t!fzb5{t~E`
zl2o5zPfm7!syMGG{|aFxR98TNcKi01Ev1KO_$&<7jvtWtkxFxS{GsD)BdVTPfuk_1
z&qNH(u#Y1-)aC6Qh>&2a9q-?b`!I@WENogH-yKXSfE!yY<wX?qH($JL>KC@sk;r`>
z3!ZRsj*^zckgJ{KtGewJp2?`WAabqA?ADJXP?qr{-nb`mh(uK|x?#9>#^;Cuub8iE
z3~BWvWnT%OLt7Q!pRv>L!acTJa~o_&*f6_ox#NVoSrveg%KjKatDNdK&oEHT@yO?S
z+2~1bal+e=8rGKGvwRk-cblK}A|_AWHR3DC(BzQGlhR{XOg1oydux;EDe{#CC&pOb
zyZKu!du43A_4!B#MM)z`HP?iL{)>LcADI?KbkpmfB9r9Xxt}Z*TlxbxAJU9;+=E8s
zzVbjx&^q_{dZR&Vf#WTR<_!KO>*QW!R=}(MB_h5fD~aJQEMi}3`nOjP&U%tZR%I^l
z9>yZpV;1t-3tg=wT=YXj%Q3~E8dsvRoTkXQ(wMT=NK6YA9A&TfV%W!ya0xBA&Qp_A
zdXH*GZo-zw#IXhRh-6}3_{Ex>kwe?CE^>kapS=PZCZ?*0%&FS!vOh`|ltzKk<c^s?
z_ru}&J5T0#mAah5Xag+onMRz@pP1ushLT^24j$CMw$?rGdg3sD4Yq<A3-}$ENtnR!
zXWEH;AgxGd(q4XS{f<Yl2P^&a<WPu<X4UzXRmQGR4A{A}pB40{W6lgLct=<QnHae&
zX!a0$f_8}<`1_0=RhiEy+z2^d7)oO3{Pe;@s;7{@ZlP>oYvakX*V`d8Oh{8S<=^K{
z`bF>a<*b&bAHK&5&7+FbQZ+|HX|f0{I%W%hs3b@XRJ>U%84VEl>2B`ZO>ypUc!D_`
zq87Z(Jj76bg41(LVmJ*gZf3lQGUP}7;Lrrq9(~2c+j$C`741;!-<M`nDqI%*vd~3#
zrR7`7uXvjUt6Tozk-Bd7x+0hf^~M9&?h(zfBE!@>B3awZ1M;cb&k<F*%<gwb&7a~|
z6-i+`Hxwu)$t2TD>Qo`qfxUOo6Nn~TEEr&Jp(!sZLZvXoToM!(x}jvk$qeAN7@w*g
ztDYLdZ&tx+G4U{M%Q6V?TI3a2Ot5bn8<Kwi?pX`5!baLDSPDj+lKQiY+e~mvGCB@1
z6m=YVmK!e{PSSYY^M3G8tNR$?NBh>On?aiIo6&h!k)4@Pf`re7NIF6->2y<Aa;v&C
zWQlIYi&e<SEkt*;xw-1riaOU+)ZsYpWz)UHEeuIJL#N9OuxUqWchcV6H5VU_WbC3n
zC9ytgW`l=JwWOA`sm=3!3|T~7*uJRfm-!B+6d#GY=UY~U;hNyw^k{NLV}Q?f(O{Au
z)6W0hW0gbOe|e*J=+A`3m*eDyy*^htv6(!m7T-%=L(kF7$`n4F%F^>ymmrp-y;P(X
z1$<2b@HwOt?nxwXcL-*JjRvoojKQcRv_^b#2pwNz<l{ZLn$u8ZdZBFlSXWNuy-Ylq
zL!_qU^H&p59LXRxHy^3xfD1;SuY}d_>ak+++NYYjIu?AW2yVAc7L32JC<v?%!7z$a
zR-cuTn_3+}wPuMO2~>4shb3U2xyALe`i-2qz!_92%+9H>d^gz5D=Q9!{}PSYfVB)Y
zoH$H<;PO>Z<P0~Y5`S@rT^<ds$nGk!s%As2AIn)+?0m+6GNAe%nR-fPV&&(QD&A#-
zL#+CxF}oK@q@SQ_`;`GZgV&(xFB+!(Nq;@TlMt2!8pIwGL!*HZFb@2ES0Y|qmFu=1
zg}KHb-SZ=hZnL)tR^geV#yOW!Vb`R(sIw*4KTQz#TUMuqHs3AgtOgrman;&baU?Rk
zz_L#dug|lA!QWx9ed-F)&T^%VL#oOmIN+xbibr}~3%q4cz%I*IvYcCN>&yFCg6xjc
zmbYynYjl(Rc-H;NOkpzdT-4OUAHRXW_M$gb%eXZKJ8CBKSakH6txZqJiRH!Iqo+sd
zU5=Mx_D2K~Csh~6F9J7D(X8*~<I00*v<0q?YQ969O(wk9#xiFMm15!5d4ch;{qz@7
zyAY;R#Y!K7=P3&mMuG9Pyg)N!kDw<=<m0!P^|qSi@Aa)fCmp0x=9%7k2zIVnCI1*H
zpx&#*K;V<HY?fT$9V)QTS}U4?O0Aj9M=?gpP!#Z_x8$Kjm8Rxc+Hum%v)k&lmz0bv
zyR1WlGz!z(hc}kD$tcF7Rj9!AjJlWe`kqU5J7D1}MJ|sxDJS-EtaYZj7p+><%9mx5
zN-GLPbeb^h_}Gu=7cuXun>Og9)iMf1MV$5Cx$=Y<h*T|gTV_R1xHXKhnOuNvFcK^O
zs8i9`CXxsjRyZq??s4e9RJ8n>L-%+5zD16)%yf-AJWkQ#TV+7P&0O0&&+xsu)egE7
zZk*WP)2j0PIMy_wCZ+-jC%CEZvEs%y@6s^=)h)W6oVgewmSw4*?VHn+RcCZ8?_+xX
zb79I)zn)-mFJ5W>-9<3dbkx|?n6PwygnvNtnZV@#8u!d3QZ`iiZh1e&&nk5piJG^z
z+`1ELw~d@F?;+8WxJ8$A-+Tl2d7RNsrQ$gFtlgXb2Yr_Xnv?Gu^Prk0IBEGRTXBe_
zq-&FeJYis4_%kMM=5DcJx0{%pa@p;wj3VLI)D4|Ftk<S!_#oa<?Z$69_Njsjdqwvz
zb`p_MypQX$ju^Zf(vh!g$mSP|5LB5wepHc=D`ZteZm`(N;g!B+4;PwCJKyLWB9sZ%
zXBB93g18seW-o`Dy;&J?Z~nxtui!7Q?I&k`!>Hq;<xg9a+@p=JiTLUbJ4knU!-Yi;
zPPrt}7>TfSz#=D2U5R{Xhz<3$zGGuP$F~)FLpID)@ERa`uFE?Uf7IYtM~T%ZsaHS|
zFDICAC%Vb1J*)*oY#A#mW6jsA7fq0t@m(n8k6cL22N;GdokN)$wHYVc>4ivi)5~Ag
zhmbOv2TA-qQC09wL&tuc2-5PM3a1^;RKHXq(#5V6(99XNx8LJqBxX^h?U=M%AVvJe
zo42>E?x9mZHl$m4)Ng%Cyn#3aGZ@eo3;HH_0P(s0X!{qZ4~^a37vfSRXJXViF{E7i
z3}1e@FSs6%7wcLY!osxWJTa3mj&J|1(333srO8Ct?T0rF4{E62eekuIGwdj2h4jTH
z*OW8C^8LQ9qvPxNu8LRh&f8z!1ic1Q!8YC0Y#o!C>{CrF<+RIY?s4QyYuvH5I<H>o
zWq#chpt3%Dk&CFXiNEu9cP3yq8nLP5`C$)N!cvxrqNZiH#Ts+t8VV=ui;?g9;8=y}
zuT0gs`Uvjg_uW*4;CE~>ArmnVQmm-R?-kKJ-f9Z^oF6aTET4Lqf2NEzuvP5ysuoRi
zIOij3hI!zQ$~^0{Foi`%3H;jqksJ1S2rUu9k=j#H_GzECZ;+9m(1+)vTZt`)B3rl3
z-Z1N`tx%yKEe$M_k^CS@b(-=|M~+Wij;7is<yWFsaKb4)dPL4AW2c#HI>J@Om-L@a
zu2ZkMWrFoBwzL9I(Jz*bqZn*^1BkE_DLGxggr-}exfcaQxeTD1sXcu&I8cq&aJf4a
zJr3X-O>vuG`|1=Qzw30WOqy(@;I&S)(l(D<s19@G)MR7AE9%spmKe0+J2KC?S4Fks
zmK9K?jpvasItZTyD^7b@^MUPFA!GVAUV8p-(_ba~y4LDW^}WMi4ME$BC%GOie|RQz
zV;CyAN=#ydN<R)B?9LwN>WA^vP_EIXd)AcmyUG*TvO;u?{MzgwSY%mi@kGvAnTHyT
zS1przAn$dg?VEJGT2V7B8FAUuJ^#R<r-P)NpEUXCH|#ZqheWUPHMy$XSSlE2qW_6o
zVC2#J7lI=~e%L;VVB%^xyNe24Xj1zNZJ0?~Bv^ZNDKYqqm>y1i)wI=;I4A9j#&I%|
zWHy#RD<XSA%B{tUK#rxW(80jLfbzoVU;cz7LN_PL9Q@goAgK=LSwahETsg%GU$e41
zu$QS4u?!48diOxYxF|_-y(BZ_&qETbecnyOChbR7#?u|4*so50e=Mx8_&f-bS;~8Y
z<*ks&B@VXN`Cn0z!77gJ*7wviy`PJR>(f>X2QmV!#9mdYW+@^}IIkliRNxHJ<EaG6
z?ImlqjCW+>W#ThJ_wQg0WMcEGe>dXli5^<Nn>L<i4-r)-Dk=9li9S^|PVr>tTb3cm
z>P9iSTTwoWzHJ&DNhL^xjOq1*?4wa4CrR)#!@XOUaNUw-FD}>euZq!yXJUpNlif{p
zVMmhwp-xZWTjoxm613N~v(FG>(agX~QSgJu7EP|nyfnIa^ZZA?dpQrQ=U{?g!PpHE
z-ZOqIvFPD++<bVIn`+cq+fQyO|I5e6nk4x|OH(3TG<CL6UcUF{BM}!*KNQyN>qmP3
zs`S7Q2^l=Yvj;<1hDny%<gi!w9cX&u`l%d$>h=Dxz54q6&E0SFDu~s?d>&<8HxS+n
zwyRVc4^8>Tw6s&j7Xrfi1H+7JssvnI^$4k1`Tb-SRIZE1pF)%a*$eJblhGj`%+t26
zhtw`^Wf*=`c2c3>R6)L)pNq?-C~+;nqEaSdex@`ViW3rSB_>-Eo#HIYC<<~ufMe`(
z6;r+V*(Vf;#j^|S+Rvxv<_EzC@~jE&6iBH)rE$dB*S4o?H4<0&?HroleY53cw#QOh
z6HwgWYW*1d?N*!j`FmkDj$jPwfxrE_o}%L!3|&>Q5#xz}L`>249npfaHLv&S7Om4b
z4OSA|$lv+`8p!n(=D9ofnMNbw46^p<o)0nbxbVpLMn}4yI;CQ2{w6b)aM=vx)}_ZT
z)2GA(QA@<|@KF!ypQZSP1k}TP4~DuGOSvl~VTrP<Ug1fHG{T+hRD*+4M3nEDG*0p`
znzarfbju*`<Vz|R#FJW%lDW4-r>iH&&zde?)39Y;sol!QgMUAFd=GlXzby17HH2yI
z=q^>k!1l!$;Q#*Tv~cmXq=!)j@;OEvzVPSox;~Uk$Xsd>zl5ckioKH<XdbQhnxfXg
zI%&sPG8<J%=Q^{OCi*Dww)_R|fITYN&d}^!v|Y>?S2y|a5Eu~x)uzg;GM>8<4b44R
zZJwGYp?)SXb1>tkf#lko&&Y+gNmRe)Z?MPX`r_=SvazDC37MZ^ekrJyniTjr-fy-}
zS>>lw<Og!4dGwAP65s7Q=~;H5^3)h8azrvkvZaPLI@cHV>N4Q;n5Nj8GE9)^3?3QF
zsEUp!=L~b-6eX<=3+#L?`aRVofOy6t@q*QMU&#vl;m)<Le;_;ffb16+I$k6ip=8Al
zRtq&pLs3~5xXb{*WRn^5Gd&S`@L3odleSo5^@}+e)U0O;!Cumz4#!X6ux5M4@oW!O
ztxW=Q+aZMKGY>7ucRt<IHp7R?$sewMS|!h(LY9?3Q#>vE^s|sN(4xGeO-&n*JHShv
zi2U7V?&u%?Xo(BswEetdL+=V}(e)c!<r^8)IHvZZzwb)=M3XA|xVU<N_?HXaCT^0j
zGwB!xp)A|&+APXtl4gz~p_NSg@g(UYMZ+rCJyU-)D*g|V9N#iR&v@A}IK#26>z9JT
z#}<;}&Jbx_$urL=-@Q{|u4l|$t(!_hk|%U#YKK5}m3?>g_`Ht7Rw5b0ULw-ud<#v9
z=xbtGN3bEkJ8&Dri(AUdbVSXKUMSM2G2EXOD~5-#+T97i3Xx^lI^EXP!Ro|ypR%j+
zk*gPs=$8X*EV+<8>7Xpi@#=3Wr?vY6a%(f+@A>`>Hl)$u?HN{<h_aZlg&yb7G1%6{
zx1x^WhKT#)$MeU#mm*uE-)8J=TdzM0;!{{2GB?$uh_lu0CBHM)(P*NX|G{XCry?Xc
zAG*Gr_|jo_?0I{}2eJL?*(aJ(rN*1Acn#qkwWd3L>~zKS{I1HXbf2o;dpJuhLgizp
zEDd+fzJ1D&)DpK()So`D97z9OjxBPxiv9^WxV4%z{(&P5f+Q`48QLD{+~2<kbnL|%
zXt+<w|B!j;GlAVN#|$+R3W?~T9=gvgmBpdXXgL?7;<~XVk$YA&vgLjH{oY15hwu|2
zagn!UYp0~E&6ftsbw+&p;K-v=(qC70mS&%IYDMN<8Kn(iAJBA(@Li6u4KnAVa$1O0
z{9H}zvg3OSM7GJLP!lQZ8erEHgC(H@$7V@VI>Yn4kAl#%^IKM)osZJsQETrfAPfB+
zf_=};ml_d=xQ~}JkR=kGOU~>9j=#wBkjRvp5@QvNYg6ilpj^}UW5UGJs(q>F;bi0$
zH2{BI$}c*`80M{8OvFm@FKQ$Eqc3qxGL8BSn_m2vAQHhkdnDNi1`!3prWhx!0n9tp
zVQO;JI*UK(d$%NcYEYjs!6ruNq6sr};s&0(mJ_G2r*1>uVaEx*m@{)ZI1=vj6MvHG
z@{8J2{{#%UL(U|u2(P1rFI)Z=tdP2*xTiXJLPEjyko=(3LEQ5Pdtu2`^9zQyz)e*Y
zE+uABWDXsI6Z3#p3lEkJjw_hln@z9?J%RpY){SqQzrs0-R!t7xe{cOIvZP<~Ga|oo
z$;jUN*GgCwk+E;u=hf~~tvkN)zy08dO_rR0uF~gIr=4C;z-J)8ux>ydV!R|S%0iX3
zcbk?DV~X~xuvViC?t7@ddSLghrX8LOf*<K}q=s^P`A?zOgv}^s9mK@7=B-$kitk$6
z(#-o5trqIpUGZ59!1QNk8q{|vwA<t&!bto)-`?Wp6E=i-9h24jbNI;kVR1675cfLa
z;n~--Nqe}|kMYc2!q;{yVI~3xdRIU2+t$=$vlV9VuOO15j|i#<{$D;PZ707rZHq0Z
znFm<CD4@}rw>tki$D_hbPPLV2Y^FdGpJ-I#_#Lv(H`?twNXc2N%&RD};eDztp?(ef
zVmzGevQ$ZIhcxS)q)0$qg~CJFgg7bW2gf~M#zG(`_N!ME8e!-;zdlmMLXVh#$LIrC
zPYZOq_eX|uft^|fIce=ve)I_Ib*|!mOU$q4zjycO2&f94vv<ixz+Nvi+>{PS;f$2N
z4k^9lP&QE5gB>HH;AAl63gdT>_wXFrs-vpcelJB>`ZnWY8dDb%PK2(iS27UG7rlQ$
zx4UwnXB?+3mWnFAtMZebqb-%89X6O}t;V!b751ogBpa+L>@GYy%#6Wh%Nl7c8kt${
z1$ut2H8A}eV+BU7<R08Cb-+rHN-k!uD>tffr6`6)musK_Tg8ElY`sMc3B{%EG|PlC
zu3D#KbR=c{EJ}r;`3sY2;>egte^}SXmZox9gOM4YIuX}a&0J1Cii$%v<uCWNTb8iy
zT&&ea=#(Saj|t6o{U}@=0!D$7^vBESpXOpx`8y@Ym(;6jf6drr@}$zu!mq4H7d>B)
zb-$06J<F2h6gI>utttHSQ9M?$K_22|9i6S1b2L|Wnpzn~tSS@bi`Uo`{Aru9wSqtU
z@*<|Nz&e)7E-shh-_b8RUuXvPk5I*YQXovvo0D(t!6QqGSipwpcO)$D6;tS-YRoB~
zwS;O=S7g9lQtl2?)0)|5c%_Xmah-+N6g!7`a<L5?@L6>&;zXU59kt`-pM*r1T2DP&
z<?uW_kS8oKJ2b21hI?IUF_WID2;y}=*ka~iNDPp4PhX437BAO}XF|lG5O)96f;{u`
zuTi0~wYia6bGJL@n%DE@urp1em$X{@WvEWyBTcCjiBAyL)(E8x6D72PntnuT5c-u@
zR}M7?rp&o?yC`MGT9`^Lnw@$+9RA_^;;AxT^RXpP$>Jq4^9U9`-fu~W$ZYpHkzLq=
zmbA3kMtlp>4vkaYAcJE9Zfgkh%qp5Nj=p+FeUZIcJghE<t;&z9)g|F*JB_{)dRH)D
z@7WZ}G<lLGZk}_W{&=yV$QSa>klvdOd0$CCYU3dVoU(nqp*OkBTd7d|w)dN?h<=p0
zN|XVMTT<{Y#TUmT@qzJ(^dM3{D!Uz{OpBv*{#WTm+pCgocn&M#5Pm9HpMM0AYHWWq
zn^%(R>tp@YI~Z%FeW4^ysaJa@{33>H<m$20^xZRbEN{)8lu9@-N-e_RuM~XFkr<Sa
z9dYe#?Gfnmb>u7A?ZI#V6SskIRQ5WfoH}!Hfsv#>NZ*;xS%m;gE=Oq9EMotj_f#cJ
zkjJukf12LS?l3thm7P>3B&bt!%VC(~?`wO`eOBUT)i?vuC&`S=yik>IpE-^_nY~)y
zXCQtralVB7F4F9iv0ll{g!}V067xO&=`T0PQ5AOjI<*;%291Z~<Dckcc=#lnlp`Tt
z4wf6;DCogQ3^vQ2V1EhviLK2ACFRpAX{$B&;EN{L4!^7Jak(86NZ8KqMqUhFm6qzg
z?A644E0&cleP7gte_`cVv8!2s-;WUfx#3SkBfluZWKbFE*ZpsalgnJYW-Ev>6MHO5
zH@p#}&{=Y*MQsRpI!f2XEu~z4tmG(<920%y*;`llD>piR_E&`zmVLjLjM?Y%%ME;C
zm{N-BDpKR^XJES47FbX7huZNWd#1WS8T}!+lr2`>Pqbd80X^2hD$@UOwN;1Mqtn;y
zfrW)OkG}m(#4Ol8KSXAFk;jm{v#k2(!{^7$OSgtrow}b*V;IPgrrH;Cgl$(Wfp<s`
zTawe<ZhubhYi$;5HoLyw511eE&9)!6`VKlyW?^g$7j#bZQ1~plQXgUOn~$QLyzgOD
zyT+VHX@xB!-OpOn5tQ81X?CAZTerr3d4&W6fBS+00|SG2yCC1L*S7)j-xI`tYv6A)
zU|`R$Pj9xMRmis)=>P0qUSD3J{<D2~^Llyndw#Qpdh-J;!QbLRygdPPPyej~5rK6e
z!|N+B4_JT(FaxXtcz~S1D}V$1&Hwq${_ek5AOi?97#NW6_4V-$84v*i3>pmP?HLpe
zKn&yo;R0d-e!%R*f4E-%uO6tkDF1Q-NC0F2TIl~c0dl<lmk&S!{U0763aCy{?w2>)
z$N#DWPy_zJJHQO!3ygp7KpvoakUzi@<l7ezA3zOa7sw6sX7T*y_y2PV%)Go|27f~Y
z{a@uUZ?7PRfqbB7KqrA%pqhYc02=@az$J(=pd+B}07wBpfEiFM011E*`fUza0kH|{
z2-sVd5dYbMDg-zJ;sbM_T7gI)gdjx!@&YkITmg501;7Bn41fwi126;3fRF<n0;vJ$
zG>{FXG7vg&u!pyNfbYLJ|4@Od1TcX50riF$hzu|ZVi^<{;Pv^<AJ86<0aOKG0q6{{
zetLTcFuwe!Iba=#11K3(DbOq64tRZdiw&#-*@0M~4g)m-*3kbKA7J=jB>)!y1|Y}(
z)C{l(Tp$es$bbRj0n}9xLqJZDYCwGfxB;*OoB-+pyZ{vfyXNt24ph%S3m^k99^X8G
z0ptUC1Zn}00~kPh1?mIsG@vq2Y`_=L1)u~_M8FSpG5}FPcmW=P{R3D4`wO%u0KP$7
z1Mxt!z}-JC{&g9M0ptNr44?*(0)UQy_y(~6+ATn5fT)0`07X2!p#h->6b!Hg44?;q
z7jOrx0$m378^8{b4X^`P1b72#0KJ3M_VTtHLAikZfZ~BJ0{;JM0QC*<1nLC`yZJwE
z08~I$5JHgFK|BIX0UQAg19$)opk4yq0Ac{$1Z9AEvjd$yfGR=g0b2mc{aZeeKPU!>
z86YkY4^#`NI$#Ch67T}N|5XI)8NeEdA%Hz#9ki=KnBM@t#RK{X_yPR@Y62kv>_NGJ
zIp6~AAec9MV1W7u>J6|CSU|k-0<1#6T|h1n@BjQkw!jle<v>1=Qeocu1;hYV33&a(
z3eqE>b|4-wfJ%WLJ-y)po&itLUicqk&?<l!wCe!I0p$TPKv@C2KsG?hz$yqSfEv&z
z&~Ffa5Z8b@{%Hn?1X2_TJ75Re?SLn!w?H>RH2`%0eFrQ+)d4kwzkQm4A_FTRTR_Rc
z-utIDzz>KAunxTb^9P-fpxpOw>i|;VWB_b|GZA<PYWt@jfFS@6sINdrf!u%%U<+aq
z$N<U=^bFW>Kz9LM0T#e_0RUP+s~}$f)d@rZd|%&o5-<l?0k8k712_SI`he<yx&elv
z-tIuNKztx3FaS+}&SubA48#WP0eu410-XY#sGu4_Ckc=ZU<lw56bqOEIs&K!xIjF=
z1$es$VFgZgkaj?kKsysSH$fGEs{F?dz!QK27=XS(u|fQSm<Muz*aLbFXa$%7I0kY9
zy#f4z{R!w4U>~UG->C%HfX)HH2UID50AK-N510k17If}`a)D+6U*H*t4`c&4`S<jX
z2cRlY?*SX20^lqI_3h2=zX5!&0_+)(B~S~19?&f?Kppz`c><~phydd7Uk5=v|2y4)
zXdt#hRscc}BS0qs48W%=fELteK)XQ205(7yKvVz^&@%u9phuu0fJfjg_@`G;2SJem
zodR(I&Op_J^aN-Rm<1{V?tr|2?f*_=;2F>skRMbvPz}tR4ZtbTIS^7{w}6xeV(Q;#
zAaLFRodC`zP<D_9U<FbW5F1be=zCHi8c-ED*!|lakQ1=`e@)xbktEd-g<)U?<A|Pc
zKz3jQJ}3woA!lTO4AGk&2zWyg0>Q2#mi+qP6Gd%IcURqeGf$p8nYXHE*6PlD4lTTQ
z@m^`on(hgz4ScZsb|_(=R^0(uSx3+@Xvwu|z(_u2mu(!SA|u5@gLqQS-EpT+qh{47
zU=mfC7kw<_E<}9t>?|+YmwWedV`H(i-i!xtI-v@-u+@%j-WRWD106`FFb@Sj+|LwY
zy4N39cQjb+I80Bp%6jY#g9zi!d;Hv`o2e%`(moq?xis&bVw_>TeM{y)TsBz1tDo+u
z>Z8^`-90)q&R~5z>wJp1{m_`qz+|S^vgbV((^;JH9a`f>iCKKPQha4f=Xw}4)-F_S
z8nuSvFkq}*uh>~q(HrF@HCh$Y)cQx|%7Za^VNEx{q8Q-TKgTBYi?^Kfz%~nISzNmx
zW|O^gPDf_3zx!%)U4bH{RkQWWsX&I!tHNQZe#2m0T(b_Jb>3sD`8@O~Oy;I+SMiUP
z@MS@VmUYpw4*}hqQyo%L%u<Lx#dFVKI1e`@WxSpmDh#lxUs^>`>BK85UKgqL;#ntj
z&RU0&dcW)a6dhmKl|>%tD<;b&&(6cB7y4Wc%fyginzG7hnZ{m>xxOri5-S)t-jz5!
z6SoE*+g<pm(tE`t>?y)3nPH{;wRZUz4Hn#C!ENWT0&bZTwe>|fj_VKNe)p*hTf=^S
z)3dXbE0Yc?kvCq=Ud-@1QVJD#nzz;-XQUXsJGUOL&eN7Y`iw(fetqhhOPmm^g(56J
ze83HD{Q%lLwHu4Xz5?Of{j}>siEa2?n?71w>~$mdFjStcdDLFr80$_LL-^1&9mc~W
z5?-Lu1H=%&xGIYn{PKm%Jg6ua7XRvFkYIwc@h(!iaD@hR9}%s#-k+86jXg}s-mhoF
z+P7Pkw&J|XWo=q=B|R1izs~tdm)Z9nk{WA&U@a|L#a?$K@6UhddHw93vqj*}gdO+Z
z^&<>H7%SD1_;A$DHVYW{+1zZ48P6)bT&$zG7gs4zsqy%`lh>6yy~AjlF7CL7(P5lg
ze1Z|OG7ATMY<iEmx`V2N(n!3STThYQKE=dMxfshWm9i9jRzeZ8W>f`vW{1kG$dVXS
z+by~Sw|vE{d8yj97;^=0RTJ#-VRZ*ix-V^?qWE}%Ela#QQhQ35#}B8sWmu-F%5b<|
zCaWb{tzW`W@1}GNVppuGBCRjOVk@rt0{pJ@oQb{e&*h2b<p93bQe9asicGxximDz1
zsk@Eoh(8RLa|lEi%UJN!{aD$+4s<l3ceH{&;y!IG(v;v8!;~;(dA4AEy<NW8a=>H-
zUp$4P4EYS70}u5V{(XOApRWeOh->q_iy6A?i0P|CWL%wjx3cGP?BX~aSrI=j;H!`L
z>{&rIZhtW<dS2L*g(+$bHYYB4=toTJ!F3W=RTC>+iAC|ydU=xRj~{=z8Aj{g*qr_H
zQl4Uxe|Xb?D2mm3$m10*s!2O(x)s$`3c#G1?VFHUFK01jt{xLVti&e$TSo!eu=0<6
zCj4s4UShUamZ7zKHeY=hlS{Q`U7UyoH?qmAS?%m<pfgylY=5)19_ZaFe&f>FG>SW8
ze(1EZ?qXoG3fD9Mr)W1D_juANUH7SO;9E|7gxcC!_nn%kaOoMyddSORcM`@#?^R4J
zP2FiL7N1T8WtkFfYQ-V1l$0Ly95EGr?8oM+m**-geVHTw&>4Y9Y;h`XxWZn9kjNt6
zqAFi3#N@|Uw`k<o*Hx><3N>$bVZ3z}H)hj*ILwo?G}1cr#VOM~hPrj|izY=6lSuSd
zGx;jYa2k`H`fl}~HnWk%6cmfF@=h=8-P;|k#ykb+)!ikRe@M%PHGOAI<04~EmZ)1l
ztfFMSK4+dvgxvg;TBg&NQC9R(h}zlkKvBHu`BOARkn);EYgiQ@KWe+XRlh+fLzr2f
zTg^Arcr>3D#rVa=2R#jl7B-{411Q!srBBv{csH9hm1k|09;f`IN4!IshUA`Ck*luy
zj4?+liIM!sv-MWUD_`ZG-L%;l4EbT7Wtyy`WQ*_g$djC5)Lfl{mFAmmw0=}wu)}66
zuwz|u%QZE|oq6?MSRK~UT58S;-dAzr<IO6c9YxH7{D@p<DtGRXXpn99LFRmRI&x+%
z&Z>bY0{CHIpK2WDc%3f{u*OfEmKC#McNE*Wsl$x_G!jM{PW`c*UZ9HwvGRt;J%?g5
zg~3YK<`<n$eWro<VgcuD!&r<si+Lkej3}WuqN<#)qEtdv5kq3HD&q$xQB!lw=&|hL
zt-KdixtcxmL*2bjv0xtq;)`jxV0SGhJ?WOAH1%k!h#{x`@|6z?@TnNzT|KiPU)f#f
zbG5b5v%{tefFK5R1D34a@3`tWn9DEJ{9&H@tt~S$sy=ick!By`b|ZJm|G(cP9*oyL
zws-uiCa<Zzp240RvcU=-z59Lp6J1@TT7m`=+9?L->cMK6Z6(B2F#mm`o^y4zByTbx
zKjRpJ(9oWLDzeUD->&0e)GXtkRoRJGwGq!UkBd-Z+;u1xQ?c?#b@=AZ)wrND>S95z
zyr+Uk!N1)cT8NLgS1dg<rACU)PxezQZ)FmL;Sr79H6`@7C#k7ejr(b(k!riE^*M^}
zy8t}--CvBQa|mLE52(jV-1N=Q8NMSXc%iMGyNWIO@|gwkKQW|=M%O7Y$RF>Y-#6K=
zmnSHVrkr;A)R(TqC_*|C3oB`zEr;D1C(hX7t4>q4x;w~sY6$asb{tTWoznA3opt$Q
zRn)M`q<$-6nCfnjK)^S)JaIuu;nZ!k&XwMwtZLhdT($N=Vt)7DU8PT>=F3TVvh8}Y
z^J``Kvb$F;7%Bc@-t{^(oa<=viX-n;6p!UDOeuh}aEuXJdiUBDSIzQhO?P8r^;cfi
zcpV1=_=Onuey}S#{-OBO>y_2wGD|nO3zq}c$&1&rHy&~2o94!2iJ$dec35PsCl_<X
z*Wa137R#b%)flzQrE6B>)@w6ai}%%nGYA~b?%tX84$SJ)^!4e|z3JP1hlvHBjq@u8
z$d(&3ox^AjZbi;p$jyWn`krXZ9Cp-ME8@Q{D{Jj4*6|x!KH61q(BG+eZb{d=n(OJm
zd-ynJZ@h~H-uUbZkOw@%V?}upYrY$&SWFcsuc>^WmIbp#@4SlPtD2A}zRGo3btSHN
z#Aa+knu_qqV&`?dSjA`+hjX8c!0h(xJn`H2w?4&z88Sn|?W?J&dPx0Ni#SH8o?3fW
z(9>Yo6;)SyrDyCyMmHhBMGC=0ee}5xkL461#`MGnj&Tx#x*CgmpCiS&LxY;uQz*Zf
zFh@qyMDbNeV-e2sY-a10|Hk+)myosdm@AGD$Qi$NEfI*7e_5ddOm(GxRE@_}qeUua
zKe%!K(=NyFy1ZC+k5iqAv2`NBx!I{o_cyB7r7dIYAkC6{+UOf2RVD78j{81wb<8*B
z@#FAKi{95?=!lOuvv1;!#bf;xW8<WZu$F4EgEL;;dx%?Ks1DfKN{VGk6!O^pmRGS*
zzuBui9`V`lt<A0qe5%e`AC8o#zha#|^JN?os_PpwS9=QgN%SJ|{-CU~(h9caM~qg~
zK`?3WTh+?3*qrM!B4XL^HrOp!bW{Gi<1jlWtnG8Esm4SZOJ2);v6OSnsvc<CFMZ+*
zbNH8ur(f_T4)5(&MaEj|(}??VeAY{gD(@=PNFGDnlUB2L--<83F#zS;dGxNvVibmQ
zQKx|_+^n_(jmNO42E7TtX7j;<19~{Js?+i2Xm8l>&C)(ajC*U$HByZAD`@(LPGzNe
z>P++e$PUkX1XbM0y|#{j7R~3Ys`A=6PmWNuTJ4M5{i9K9v1cx8?JVVA1&BS>$Vqdb
z`x#o(hi>4tnkVc#s|RFL)ZxTBi@r&s-ra}BVCttR7|ru8hplF<dN8V@Xg|zU!?r^#
z)?rUf?1(fid1X;V<p{&&+kA22qg=Vt{gGz^9$>167-Ls{U2nu{43;gv9ImMVQBeYa
zas{6=vvm(T!Hm~<!x25F1=orR2V#gTzo%{lnrc(8OnV<bF>VB!v=UA}Q;d#aM3iN<
zXt99<v5LHG!~yTAD9#|AMzNfw*kFZ))Rs>>gZriIp0PVG2keTrxU-qg&Em6;guB$@
zbxJet|1z*J+uh;0;vXh-w*J12t?u2hT@>{Qyqa65(0%gFPMPrz5r(R4G1;Zcw@eqi
zyu_&rfG{L+L4}UGis(}ae?CFdJ#C+j8;fVJRzgoR?6V86mCo6&2Xr6g3hYpchbn#E
zN__KRb>Gqyr3#MgsZkc<1xD7)V9Spzra9}aaaCm*E6;Fe9YzsC<ki(?%dpN%q3J}_
zb@|~bFSp<hx{@8}Z~|d9CsJq5r=C=}`Ruj_R<C(xvpxht8H_u-|Ngd8v@o;fGv7KQ
zw0Mx`vi4L4jzWYF^YWCsXwe;)I*ggPG7BRV!lt7PY}dgDWwRiXqBWBS^6x&AZ$I^u
zyc*r}cS@<d<fq(@{aCPWk@%c)yYoHcpX`evydstDuwj-~VZ)m_W`wz%r;_>(PSmY+
z=_<~ubib#8rXFOsF`G@SbvJ1LFoW%s5SF|YA$~jD8;FYEDns-sw7QYw?nhK}|9?Zx
zrf6$$Y(?wk4Er#MvQbFXDZJ{V3gNSUWo~ucUYb=nX#^77vEs9<{hl5Q*EU})Jof!a
zEc3PMv$m%bD50xzVP~aCLnv~L!|Zop!(0s(i)Zd~_Wo)GDtJ=B!Fc&7|B%X2yunzv
zcsf!{#hxrcV+VzekJaY1%?}S^kaOqt{B?%b!H==_eNj6vdar&|zV$vs#)k;0vTp{h
zcZ}1j9X3(((YMd;{Hi8bJ=0*Q=WTc>HJ0*R4+#T3Qv^@!=Svnu_b613+YeHzjG7%L
zuh{YwQFV*UQ57!dP+A`veyy=04QEpntEj2VOc}vF#;YGp)a6u4T>2e5KSf|>I-=z|
z23r`h)@M;b0P(5?FLYCm(n3!uF%-V+6;WM*oz{5u<35?j^ATRSVf1%t@advez;=se
z%GLGUIQFU!rR@~W$`Ij$XFk%mcO2lvVbsog)9z|xegjx7VTrBr*nBop5!F>m;qE%0
z?u6LxzE3}b)V{xZpi};M=b2JPS|05ZPj9gkW;<=le;RFP>`uouS$d-573(Qv_b_2{
zR#y7{AuaRS{`Z1&FEHjW9qUHw$T!VKz49ZcDh>Pc<SHc7&2O(r+bN)G41z4IkKB@5
zw|xZ9M*8a+ez9Bj>oX}`o__qtPhbD_=kNafpYQ+s^S3|z>o0%%=I{Uh-^YJ``#btQ
ByQ%;H

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem976-key.pem b/certs/frodokem/frodokem976-key.pem
new file mode 100644
index 00000000000..9bc2ad369dc
--- /dev/null
+++ b/certs/frodokem/frodokem976-key.pem
@@ -0,0 +1,655 @@
+-----BEGIN PRIVATE KEY-----
+MIJ6VwIBADAKBggogYxxAgIHAQSCekQEgnpADgnqden1CLQd4xS7yoLo1AjDQRJQ
+w5pglkXSO1CfS9TvAOsr/uHnzpHbSSPcbcA1Ya6SVpiolSZUU1MkBT8v5KDfrNyr
++avorGNMGZax/NDZUusURV6yqbkhx8qyBZIwmksN4+OmjBL3/+dLA/CfzgLD3lIj
+WIp+LrPQw1h2kgxxVJNolpKCmJRRt9S2f7MPeVodiRinkP8V9bvp9oKXRgksk46E
+5Gh0rfT07pIp8jhb3YhKsvpKjIi646tHvibYrMJIn7H+7qVX0oAoMwhkKJircuqr
+ug3jPSGd3WT9fN85a150VBcI4MXOMd1s8BWMgF3m7K/oRxG1GDq2aiAdoMbROm4Y
+2Hp1oR5x0OkdkejMH4eB845b8f4vBLRdT2cCXJzNBytUztvzISlAC0HyYnzV1e5U
+nTwCoqfyDrBOKMgbF32iuk8DjA1m7ZGRdHt6lOuGXY6IbwL+SYqNBNMGyUFgt8Bv
+el3/YvnrHfzR7UM1dDIscF+8UuR05BaN9Z88F4QhdA6L4f8BCiMWfXFL76blTum5
+P+RDI3YDM3jJcspIFKNF6vleYt7cgI8Y1Y2CyF1pwG+KaOH+kkgJJV6TNB6jDU2C
++BRAgotQ+zCutHpzgRfG40kP6CcoS8Vr/7qbhUMmUaBvNCqDtWQ+NHbO90/7ZKA/
+Yv98hDyewJA74SKegVvRS0eO4eB1Xr/FATpPVn5LLnTa9mDJV7z+gLDMCdBsDXXE
+p4j+JWnbSs5vz5iV+wNLorOGeS4ThtyBq8MjFWvdyYE46oKCTySDCNCk8FpU1ntR
+2SxfYi/rNhS3dY7LrsV23EDx7a59Dv6Crdzjw66tuMHRxkf9qBN8Q5SvChp/Q+SD
+q4c2twfKyIybTNwouhopsf9J0w5GtlwmrH7tn2q6KvKY8y7M0T5MTi3aS2dqrSU4
+JsIolXX8oEZgMaRHouDdgQp6T92nskKsqekodUoOzCtY2uJhaXTg4gG1RRQQ6NUU
+NWQW3EnZW0Zu2kGTRBp3i879NEbXFdC8os6Xed7oCWQasi9AYaDFFS1vKJbtz2Tm
+F7r/yhV5rRcu2eBhlqeQOzdz2TVqqzbWb0TfFIA0GyMx/+a2nq2Z2ky5GkSZY83z
+Bjtjz+C5nPvzIYqIgm1ZKCZR8aOajMZWe3lIksPImDhKs/he8d9Znbac76iJc37n
+EslgGhVBZS9jl8hRVJji/HPF/pHo1ZzGSQNfHgaF5ZC+rAHct3sXTCVP+djQbs42
+SzgxJld4b4ykkXvhENz7+GElffTItAY67aTaiRpLLvX9i26K+a7pKcqct8cHnOuD
+m5dkMTkavNfA4qrLLogP3gQEBM8bKiOBaA5tTWQ6RlBFTXk1Ka4ZJ0HWoFgPdaMP
+xjp8c2iS7WDbB+yZIkMyetFHL66Px5M4PynZqZt5eYM/SiHUML6PwOPHUyAwE9uT
+cPVOste77tlPqmQYLcnKiXH+KYvKUghVkrJvOoMgTniE3J3YSc6XoCAKbZWk8UYT
+HkxDNxqCZX5XVsm90ejKufLtf0u5T1eSY9PUZdHOD/txAwOPFjfcmwsUyfKM6S+H
+qv3qk+rjqdx/pE3t0thQuZfsAxem66QS9OxXyVrJ+kDVxiEwSMz1jHx2Q+RhBhGH
+/m5lCcxDBW5lZzk+EFf4qNF3pkLU1MsfBiWIP25lsSHgBUYRMwrS3nLHOtUPuJME
+H99MhvuvzsjxIPt3xkGWzKXzkcvzYmOdL3UC6wv73+ryUZ0/GJHyumg6o1Zn9rNW
+w3zb+asjyA+tfXoqL+xy+BgkRmkr9pvaacSNFkpH+VGl4NUL/I0g2PJ9K7iXq9s4
+ZN/zB99pPMAJ0jMTuOHR34PAiclZlrs46CpnVJiiL8HXORA+Na+UiUWkaq5BIsb7
+7uOBRk1SFjYk2H34bdXkUcJaMMeK7ciJUTDPuHvqL5vkHa5j5sj/UEu3dSrLoV7t
+jMrz5qYOGfpJ9WA/BezFSOy1b0J1McJyBrRda9/7CcGEOlXsSDySJZN5DBYYFUsd
+HBnCNHaR0ilbKoVxb+mU8/6czhoj6fpbycVWMRekdnXXd9kI02F1v8Y2X/UGGNCK
+nNQdE78sIY7yeEO+DRlmq9bIE0Jy7nlZhYaIsTwN2N06hasSNEJTpxnVdq5rPQaZ
+l0BlngvzlI0PgA/T/e1wBCmUZcSIJGZKqmrDn+9s27Vl4N1/NxRw0S8hoF8JfFC+
+vnpbablJ4ssgohQtERglI6oZTOcQgkCwBB6S0asWYKP+3oUTd1WSs3D83SvQGypL
+iWygECxGZtK7KRw80wat1atp7xh3T4bHrA2pglw8u3POvThykjdVXJRwnBcjXLvT
+UFLrut0vh0fBGN0KPUTgov8x07GfuS8yyUZoF+3DaJvAIZJSZe01JzRUOznVdp0V
+obCms2hZKHO7QoaEdAXMi02XwmND6R+li8JShuO0JQMf7gbUR9kag2tSQMyFHdVb
+iQk8TLpwRlr3IDAIDuwRa/unEHd2SkhVS+wv83YfpWbamEHvnG38AqLTgskgrUkR
+zF5ZmhSWd7jK573zfC0Przj/63W4IrGo0DviDDpboxkpLdzcybozJG7cyJ6oDBBy
+g/r2aQhDYh4qbDxGm6gB9ODkffjVvGjPg6UwnfC087WC/RQo0YcJB+Y+q3pUfgjl
+YpH2E7oDPemZN+xSC0eJHgFnZpirmBqzle8tYRlL3z9lav6g1KubJKoUPmxtdMM7
+iKfkFpSG9xD/GZNFPhY5CPdz2iO5WD/wgYKvQHNH+96VjJSQe8MEiJwXCvCgDcJA
+ReVjSN+N0xalrvxVq97lzLI7EjZd8+FXLVFMQCmb3/Fi5XaCcT1EXrWNr8iDDPO5
+38qzQzM+3VxztIkv764PYdmmz7gpWr3+lXQY3HI27r/KSO/qnuFvMsK7CiyfJJcl
+yKLZKDARp7FYxklPF5DhboRb44Eg35OEk0utsL9RWeoiBUc9105YGJvmWHSvdIJZ
+Ilx+wd40voSH/HpC0CGYhRbBq/HLvMkSG6QIfSJmxlNr6mp6xdfU1fykLDvT5BYc
+O23EPdgy7/9yZVzjq/e6VZtAvsxzL5RO8GwNr6D3kGO2ZkhH8Flwvj/VslUz0+l2
+huj3BrO2P06vOKbkQ2ERlaphH9pXROo8Jeauk8O93UGNpFekJ6y1nYaiu21OKhpP
+AvYHh4yw3DUeJNN602rCUr1lD592DsFMxEJc26KuQLq6KcH+ciZE00wuh7oUwAlq
+OWbLE8MarXNVgInYLkCY8iEIqDTDQL775fqGKUwqWIPVHdU0iX+XhLbhED0wzVrP
+P7r1vELWD5ePOzvY57oIOL8Nl77HTSgh9ris0TVAnBVKF57KsBRogFwfyEbIt4vV
+pg8aOI0T0DqSmxGkQTT3vRiergZ9YAw+SKEE9TB82q+cxt+7yR9gf1qEzJjBDs/c
+aFYf4fCDqeFsMKCxs/cwYQfdyXlXjmGfOUlxoAbHg6TzpglR01GmQiK7ieJJ44cI
+yz+nb72YbpL0WN5wiIqbd/eF//UdV/3E5FdMgcb2osPTzQ03muRaz8EU43S/Qm+u
+rzOzEG2GQjL/O3XS/+sNYhpI4BTG9bOiOZBZVgUIl69JIZDvwXhtxjBSfr1j6XXM
+fmhJZ9pfdRtAE4t6BEpD1nUx2wfMyCtjUuMA5vtjroGrODA0+HM8RNXR4xoMARyk
+AKbiq9enki7aRPP1PRsQbnIWWKLo4OQVxxGgquT/fvNWXMNI5/zLBdFh2Q7NBqmj
+jqdhJrqwtc0nQQ96wuaJxP4ZtCOYZdLcFaUR0XKRXXOZpsDsllRpKlsrBs0AJWvF
+mwZ2eDvWmT5FI6Gk6vgEsbC2axigNenIhkortQxaZ/NqvN9SFdDMnzKc3ax6YaNF
+2feMbFeZp4sv1weGnNJz/bhHODV9w2zl2GaEvPohX0zOERHNYSAZjzmWYl9f52v0
+uzwq0N7veiE9oW/oW0dqBZpbpGRk1PU2783wNTv1kV53Bim1gu3UtEVzBkDoPTEn
+7BAsCwUK3PLK4TiBVRYg3ltEOJgZnpGhrQny8VYJhT+b2i2kOB8kcKCWO3JqTVah
+zys0lMCKPGSb/SFdhWTi7kMrR/KcbUhT9b2holc8bt6muUbhhVkHh4eV3e6dLMaQ
+8lZ6y0nzJccXy+b8r5itje7e2DR7pq3MAlXqPSZr/C3CO4+Hnq7uUbKoS7BMW6hl
+zyZ2xxEhE2hD2/Llz8zukxZh6dHTVJOk5klwAIzDJLjxgqrFFFkLX2qrh6yi9qft
+rFN93Ca9+rUCCAkEXJ+UGOPl4sXPo4uBI6eD9RVax+dfZwBz+YRWxBbY78WXQyYK
+Yd4J8D6hu8pXUzpeYF0U1kXMkqHVbpUHxvyOYgyv1gCHVCR77ts1vquTXaRhlnu/
+kvpCat6N0xy82fDvZWJgTOKFmLDWWXuSEU3VEP5MwDIbx5wN0mJPgZsyAa6Zz6y2
+4w9cT412bkN8S0GYnmcvjSspMksAlfZU75eTU20fJ2jVtWTLb7EUKAU+RFFnr0f6
+/ZPoE3R1cZ3dTgV3uWdAKjCqEWFjEbGI0sZPUoJ5/FniRKZUqgU45aQNCeCRhdYQ
+IdRT3wC5+XLy0XsYWixSnPpNH+G178csujxlDcUkCqWzskbnyvvVAsX4EvlQ1YEz
+1btdpesCfWLfiVFqkRLGtrWv76XP6iF7QWzGGkuriiObkKt/2vPZds1HWe0QA2Vr
+ircTlSVV/eAiWk1ta7suyL6QEokDC/fCRhA0ew5bSUbDtPdluMp8V2qnz4QhSEwr
+kqKoNfMfqpLwm+poIrIa1hhIIcTHoGGJCofqOB4exjJGmTSmnYHfMgZLvCaxtwMY
+IVyWvGp1IWQgxR2M7T2HmFYsT2ydRDIr0/SPqf62yKd8iM2TM+kFtyYRT/gk/q/j
+Dt2iBXgqlKs3KNxS8ANXkN4O/kafoG/CTlQqF2BTKkdV+80cs3BxpK3TVa/sWVsh
+WlY2fTxV7rPPk4fTL+YtQzxvlrP2jv7UiJ4gGJwQ+QyEGueuJVuXiLv92O7jDiZx
++gzXokhFzTc2DOATVlf7UB5DZR3wSyibJkoJTKLmoaYv+aDDGmW2vZV3E4k+qaY2
+3tx/9XqVeZL16/cFHI30a/IS3Le/izKjCmp+gWoHnim6vq7JFOGttA8vgm7M9djS
+giaQgtLWSwWGT4uR8tdJ6qE05H2aZHWmpCbYbBCuvKRkukSk8bCUEUJ1Yh4DsSHF
+AtxwhuVe3eDvn/f9GLnQ6EbNtfY51SbjwN4JXMpst0800IG7Cmhf8Zua5p2aNBHy
+lRJK5QVHp5/88y9ynm1V60fx1b4TXl0a9kfGnXUf7vYit5ZXYjX0lwie2FNQD5+F
+oIERS6fbJgLXY/6pMH1m55Ap59yefT/YWY7oZl4iOTRAwr16RtDaIega8DER65pl
+kr4K+4FUIoRXhQMlTZpV6IjeBU7Y3DAl6Lb7myROHOZQw+uyOfyis4H+ugUVqvnV
+jEkB2oPafpHGO8brcb1VxIrpkBf7/OuyIhhNoVoIT27wUg7xZd4G8RFFOrj2FubH
+NRzXrbpW4AJII+P6+Hx8+eb26RLJUEdkkaMMjOD7DUCphNiZLQkPxt6/RxR8tUxQ
+GLkzL8iy7xvjXuBfM0EtsSZliTSGXG86VmgfclHxLkceVOfebFp72PbiIFiISfjm
+Myq+bdvCDE3eYlHrnUSLSPH7icX9ggsx98JTqbl250ZX5PvT1Jod6siOzDanVHJG
+pTavkuslECn+mPfNdaM0qzxpPN/xdR23AmI1fOSkbWzXLa6E/A0HWzu4c+CQ4BeL
+zLgHoTbtvq8pin/xrYNlyymUQU8maN7qA0UkJY2maFdpejZg6HkQYJDxqi/VsV0G
+IbYkMtm2qlbL6o9ZCImqtGg4BRukhBFj6ZIadIiGPu0/FlOc9zx61AypomjoSs5m
+ogHhCx+t4RXTBfiIhhLJNe55hpb/2Ynnjctz7GgVP+V9Tr/EOr1MkTiQ77O9VGZx
+VMjD2Fp0vrntcEqhkhmIvDIZ+rU6PGH9o3z8niRXdTO6Kr8yaNWvHK/PEj6gEXA+
+r6XajhCRv+6DBKYMH4YKoeBr94sCbY2j9FB5/FEngENpuxvITtle9zhl3SZDrvBd
+pZjveyWEBUDNjEhpYyLtrDy8Oo/v7SKSPpRA+WAVpFf6u3K7L0lkvayHzJQx6n1o
+WR0jsX7mFSKg3Yxsn05WaGzctjljrF0JFapbxBmyjTbx2qFXfFv2DkUEO4Z+JLDx
+LhmFfGn3WHwU2O7EbiDEQI2xjsb0HjCAF4/+mzxj0f4fVx3q9skS62+Dbopx5k5J
+MMIApkbHLoxckXmMVsEza9qITV4vgzVVf6vjczNUYj/fS2usx4A/hfeWQLQNYgFH
+8bxHbezTtxg+3ofl9OZE7QjuQ4HqA0CVVonLF5/cbcAuBVxgVfJAFrUGrZz5T8Pl
+zG8s+IhW7gm6508IZplU60VzD2kVF2R7W4VJKTtEEAOh7dHdktDC+sv869Sl3OCG
+0F4dVlAlzq/I6FpnWtffaa5AWCVhiYJYw8Zj0gCJygU+T8ZNN/MfvnUlPFFR9zAl
+zuqCIx3aladYk4F2X1q6PGsXwuCsSlY2hhKw/o6oRPa23lo+6BQEcb00izllcuqI
+s9Z3GfnpMg4HZ/3xJBt6dQYUOgZGbW6F9+TJHms3vXXH7rq3/wjltI6niwLSD4OE
+bBDzHxoVUjBLy4EYN9SkHPa2DOdaGTYYrAt7ji1qsUXXWWPoVAXhbNrgmTKLzCRh
+pYbJHJwvqcRBch2V4OJ7KVU3juYkpPsY4zCgG1W9StdGQmKjkHVG74vj/pW1wahh
+R+308wsw2RYOGhm3SIffcbFxr69w8NblwZJYBIn0aoGqSJyLzxCb9LPCmQ8Il/9F
+ZxjY8s1uzLD+MiU9CLU47+I290FAgY9LKcFYY/kG4oyhcqe+RY9t5OX5TK919fnf
+O/fL2prZ/LYzutCImWnqjtHbyNPcrsCfLVTtkZKY+HyKKTIBnSQzjneDfSAb5qwQ
++3pOjBdb1XsW5tc/qn7z04t105cjemEnu2H3jA0ecNuSmA6Na+bdXLe6ct67091z
+cdSzU1p6v382jyxqVpk1JXGpupAU0aXV0WudkAa2z2rUD/i2VeydbKsPAtDtMGsY
+ancZmL+GhNpqDR7s0BWp6aD3I9B2PmJzjlgxxSZZkHUBp/WEtsBmnCSWNN68+OS1
+5m8ssEbatoCHSwk5fAAQzOgPIsRXRglyloTqKBHNJUUqpE0Du4J7NDz2ltDmKmW/
+RM4uRLfaATFo0TvbAnznll2qo4k0yrBP0cI5p+8mOw7jPdCevy2n1cktx1beTCr9
+QUwSmFrJxgx08QnD3pYhtfKKQfa/YSyiJuFY8nZ0npF24VqT+LALlBAD5yWLo+WR
+vOK1OKWcbCPiX2mH13aaP0mWfgC9P+IaJueINO431nFEHy2uA7TzdK5T5yx7AvPP
+BezvaROW6eeLr2+cLPv0Mq5wUhl4oEkauAOohK4X9VU6zKFDn0T+k/cY5feN0o2b
+IPD2x0O8OrZOPM4AvAHEDVmpXa6LgqW4ts9V2CMQ2PEnXWosqMlVkB32hw1SonP2
+5yca0R4trvvqrpgF7yl5zbRdoYupnMAVX2LbPkrcR2rNGF0bscfAVhkA6pIdvdPE
+VcBwycDu4S8SQLVSMAmyDh0/ZW09NzKW/TZs8kqe1H8SKSKqoyIxtgc5M9TAHNeQ
+xmGiSA2piIYv4CkHXiQwMbaBtM/PrFC1cSvIjFj34CFrH34ElFs0I7z9UukZ5hSH
+GfhhMpDWzUFgwfGgNZlJokgr2pS0xRsuQQKN/P+g7UJqKJTChEX6s0yJ3q7lGGlk
+nZz7NGlcsUT3lA1hqwXQ6mOSZYyjGXJjBVOB1wqN758gz+eQfsw5F9jR4I0Uu8Cy
+lDTwbBZn5POJy1DRtyfHxBEjowvaYgDVy8tKboCL+k7FXLfi3iHQ8bIATpkkM2V6
+/0t32N51InUzQ182lUFlJUmlKhV0N0EZjuRXl7qmRh7MWdYADvthjhbRtomGVJIO
+wM4Vv+itHYEM1q96wfme5PciaRMuGekWtUrLIkJMS+wLXQ6WErIKkHItSXnzfUV5
+63sirORIkwmLViVgSTy3mYf6JD7j7ll6wtkbYyvDovAQMEpGu3KweIweMKNYoXp5
+ys/8YJwnhD0u0UrGAjjoScf07QiHB5534Ia8FlmMGjqK/a7Ee763FAKkIWY1zkeM
+tZlE/sg1GGBLq4ngxKGsioV8rWczSk2h1RgPqu+nvxwcYDzcRPflnm9QjVxwU1el
+rMVlTiQlj/1RgqCfhrMCcGRWJSJeVAU9xzax039uuq+mwPkzIn/fpcNOoLLX1oJX
++H/das4DhoRJKydWtIqNUYlFRVSXGpIIYgWr8LsLnH2ZnGEm/nsiTEtppDpNenxP
+jeZfDO8U8TNKOj+mBw0qify/s7OT/aEIAORCvB7rVT2JqTUBoqX6ftP6tnLxxsdI
+jKeVxrvpAJzbZqV5j3sqqDPtWwqjvRvMGEKT6XaW4OXZonGwE0QpWbI+aHhf04Ol
+dOaPu2hNaW0T8fRuJiE23HXO2ZqPEnWowseU7op98YYxGwFuv6vqzsda7KpsQ9bS
+Ma21ZI0jH4Uku6K1Svs6jg8TkiNdNgo8DJ/d0tI7o/QVfGgpMPkDl8yoiExhO3qy
+mH//L1wyG+keQX8ktczR/dZ6UA2BXkM5gB13BLfoeyMgDko9NrY1y43yRty5/B2b
+qUodkhP5pZ36UnOwS0ji4w8lt8R3V9cxpKFDhUKYOGNeFtOO0Fh6hft2mKyiz4+Y
+sgHSdMtakLc3kPU0R1W4rahLZ30S641dPjif0herMJnGbFzbCcPWyscqMvBtIJ+C
+X3KduaOxzIUpdwd8HmswATN4YfZJ94V4JvvQSCyXb96UOlOVr0cCLKDnM346he8F
+zxiCWokvIsXfbbEcjwRsWjy25uoePlH5tPDKviwje+AY7NcdWBVnybJbKioSRczq
+/6SdS6ltswzNje499fExITINl7EOAmEKVE5mRvCVjjMpei2VrroA0hFhoh2RhpND
+Jmcmv2f8+ueLf1Tod7t2OE3Hs9Zahi0F+ZJPluMevOZaHi+uX5+AKiNWVx8qTX2B
+A1HWGl7R2YHSHkijaMjw+kc98Z2u+DpAPpxppNlFr8ehuog6eEYP2lI0NzEC+fSG
+8wl5CqxQ/3sIG+smoRMKv9jLem1mEbltdF29gVkC2fdQurWv718ZelnaQIrix/TP
+cJNALgkCpzTQsDk7jBPPmHrWi/U8AQbSzVC0t8K6g/jHeHSsW5RlSMS1O+WcNv5W
+k7AgCw2vIWxJvTVh+sR/GGMzgsjqDGqqaC7y1x0zu1H24jmGazIbRdX8oUQ/6cdX
+M28f2yuQhNkX/UuMsCbu5gZ3+8ahQJ1LUqP3ISF1IYp2VosavecSs5ibEEEMENGe
+jvMf0CabaiBmjFaHWJNm2bFBZmVEdvNiRnoNhK3pEcjlbQttmWJvu7jm0OZHLSp/
+ux+vy3vH2dHiMxP+c6Cu911sQjjNPavaS3hL+aFIjNhCXHkXfq7K1+ZNxbcfKtZD
+8h64sbWIjZyt72JqI+goEKIEwNMMtDJYNGXoPdbtp9Nx2qnXt8JCUE/TW2uySXU3
+bMDANq023jrIPEPonN66WBi4xoZEMdC+dLjAMpJyVhXZulOaBBl4r3wQ5GuZAi/3
+rcozDyx83y8j1AAAkU1SxhGH9JlPMPAH6LnUMrhbM8kh/Sv3xCWHpfHQ2uhMx+hC
+cyqI8TkxP4psptyXXOrQSbU+6C8djB3GE411qaGULnPlHuLwWVgWsl+Uu4gQaq9p
+t+t9IXr/vPQCDfkOWTdEM0eIYNXkIE0AQr1X13KVKy8A8HffAY4MjnTeAgg0o0fN
+G624CoIuyst2jBxyXSaPx6X4N4d2dnj5U7UmyNvzEdEG1k5zzPbbB3I+iyJp3OHl
+9fGKmqc/SD4w1BWJbv2x63GViHo6WWdbTu6fBUgPJEBuQkz+6RzuktHR3CAuc4OO
+pikNNnjrj08X4EWakBKcAsSIcpNQaiu+P4aLrFQlv1OH15sY0hLu482e85vzA2oX
+kuIir1PEUURb74jmw7rKLczCuYCFLk9qoM0lKFxERH6S9jTAZkQOTGR89vaYIqaP
+acx95LdpucVxdaK0BNSF0Q7/8y+oGxhzgh/ExCtLCgVC0gnUYa0pyR3VfM5XQvN6
+IZNP2tRoFaGRkiMdjuguEixcwThK0PNoha38menP25IlwvP9+QR/H7E4QwWIl5OD
+bet99LGJNTBrQvKEhAEH8jC6S/VJuY2P9Jz57Oi+011Imix46FSJjbALFe7Mk5Ag
+M+P8dVrjGQp8lnQVTBfws4+KpE7t9tTsatiOc+d8HcDY0ZJ8vv4zOy6rIctwD3LJ
+QFpJSJEzBC7imjbQrJQqSSlEwjAnSlttQcGp9pmsJSpdj4oxrJYXO0gUOIJ7OtOc
+fQcOspm4K4bE2i9V+0WSwwki2otxKgvyFCWcH4nxhrFcRsx69oaP4wbvitcAO9Tm
+tr7YH724xtrhKJj98vwdlWwKlTQrBaGJZ7W6iHTpudBftwFRVwHPrluqMlIKONw0
+Tn4HOwsXuLxQ9ZEakarEYOYDrRp8HRBgsLBR/KCNORMbTHoWUR/9dYqWsBi2V3wL
+ukaoBjck8sEYlX8Y03q6s3WIG3HuoQ/lsnwqwsslI+ZTgFpNU6pKFE5btwnyGYVG
+Y1LyZ1zwvLuPsegRzo8AhWwcGrGFaBeFrSIwyDqeb1C+NKnzWtgEauzqE602lev7
+nvzk8sKe8yKpb++YYUVcVttWDhFlN4qd/iroaJLsYq2hDCSpIBfYmVuyJAyedlVl
+3LCSZ9I46DKVKyOmRqVhjl/deKFBcMkU2yNGKaqhx5njNChBCDnlbNd43HHJb4vz
+oxJ9Hxg6upDdj0YSgXpR2yYthuHd+dg3Ye4NsmCwb+FaFuFgy4PKYIfsE9Ekqi8X
+fhVSPQfQufj0AchvRpQYETv+8vh7pjwWycbM1+z3uQnstLawPxlgRiM/crnAyuCZ
+kw228umxzUy4tuvfJsfwP0LFNsvtszdbuBeDgrG9iMcnCKfTA+qBT0azvf8qYzpK
+Ywi3J1ihEwNAbY1FsMLzAHKM6tTMWOm7ITE2HBZ5KCEblFlZrp/dTjkpC4si7i9I
+p5F+8lJmkIe3Sbx4LOIdFn6KsyAVPMqPFW1t1roZUqxaZBf70zfVlG4P/Ku+491Y
+I9IzM5LPbHfBkxljh+ZPk1r8sF1aC/AeqhQ2xO5DVQx0IervnnSEFZ4ktHU3Wz7a
+jVvdTmRp+Uq7OPfYsDf8ODbuoYl+RTxJol3nwylAIC3vycZns5AV0XSJ/QS6BehT
+E9N0OP1DDsabX4+ruSwBN6foT4G3cxUVcGai3sjqtH6HEqx1eYcLvVAl3T2p3/wn
+bKSSb8l+6u/aSApEZsnrHZplZtUqc1NRE1Y6jabProb5Uau0ZzV3krgYE7wFhs7G
+vekMuhJPvQIzjI2mS3bjOV5Y6UXFw2Ac+/t+4xaAThI5/g/2UoPf+uQ2ogjyFOWU
+GRUFrHhpxYTBB80Xq/5GaELJ5qhZQUFLE7ajIKk5+I+h/qg9E7yW4QbYZnK+pBtS
+2m3IBHPht7lwe3IINM9FYvlaA6bvFLNnJzStLNR3n+JBecl6N5LcPiWluZzEQLds
+wb2euV0yV7H8oBtxiXvH/dNUW09Eyau1TvpYRk8DTpKF/kRWahA/e/Ll8dkmWYLB
+ec1k3BhefBXrA1ZJmdugxfpCzK4NloVzztsY/iwkJTsMF3/E4onS8403rNTyaOwy
+RMzggDKXZ6stiA5WMjmpNZNh4piidq16oC27JOCSzA+2lzVqg0gJn2hSLBXN303X
+aPWQvywUQHopjcMoMO2pol2HONp+CTTRCo78Af1SK7vHb5exBDXcbKjR85Tc8nBn
+INbCe6bwuqblgiCV2XMZNOAq/o6QfOTUWjOF2XZSstF7HwF3A7PSFarqyxz1zuRC
+NMxGuhj0DbFX/4ZrxVpg2tU/Gg4DrekF+2//D6xiV22u4+as04TeSf9vQRrk7kCa
+9dIEDEW2K5xzXHR/N+aVV/26BRV7d/6GQLiFXjwyTDbRze+aAs1vHZNvKCJ/21qK
+5XTXzU3L5HN8cmt8MKIY3yEjVUeO9nXkzhpWrSCz8BXT08QtsPGwr14Cb0G2qBoQ
+99X8pFL6kgmiElbAaQMZkFLY+D6M0TXNVn/0iM8G3/0dL7sH+82kKa+/NwsDAFbA
+HhzRgzBFWdrjbu346tJPAWdwUqaPqMi78v7jYqm9LCBNUNCK0np5kUpNEk210z2y
+98JC1qC08h17tKHEYpUaVEuFH+L5IHWQD09l9i/1eRk3kwGw2ba5i72FITbejtgQ
+30bp1nNiwxftbuB8yr8K4mv3vPg4BPbfPwJJoyiLK1SdfNkvyas3+z1/87l/I23u
+PMgPjb6jxd3wlGH3p6L+RU4pw82EQC+6daE7nMVzqyLJ0xf3cZh/Q14zFpNnToK7
+X7U2sZSWcPHNwCSsuSCzOdJ1Yv5iwMFLvFERavV4Q9Mj5aUtblG8yIjj+p5lXX2J
+zU1eOwRHK3nFhIIQA1sBGNpEpMqaIsI62zJPGLWAQ0bmTEgSfUJDdK1qzsZhCHDT
+O0xV2Kb5Bm2UftcD9YERV6yORCe4vO0kylc5mGdNWkPRUtBUW82TvCYIJcaC240o
+wI5HWwjC72idLn6zMDobvPuY0NoRj5sfPAnbtKTN63KNwyMayYPoqEsxMbKPodS1
+o67BUm0lZYiSI3aheOmOCT7C7tg8UsN3jSuHbvkxzXcR/DKW9sub/x3q+lhevbb9
+538WMl6KbwbQh5qVoRuXL8HVdyPJnqpL03RO0OH4O0DFFJ9Q08uLelqy8fRvoOdB
+kwDxSoVvBS3tOKAUCXYHGkuTTaIFNot0Gr9HpAn5oMVWS1AOOgqkgRJSRRE+LkLL
+Vu8DgPcEcQe1liKj4b8DoGghnFpOHqXThZLpPaTfrZ/rHhSMpiaVW1ZsDA66bYyq
+7TWO+rEamIhR9tusz4c/eH1shMQk8XXr7hPMi1eK5TLLL6/uFsX3IGTVBUZrZ9sO
+y4Up+nW6Br+S9DE8wu8HopJ1rYbHnnGtQq6S/trDIvRbhK0+UfeiB2CvJ/spttf1
+sIoxD/Z+F3P7EGSwoGqCj5tcgX4D/LOFdg9UrnOawLTBq/9VSEJzfA4EMUiZavMp
+nUFqyegcBdILaOQzEgB8jJz+nEGtBh85RyRtYIwiQpsvAbUSLbN2svy4jvbfASsT
+GBNyrqAaGLxOTzNoFfa5uJmamsXgi28VDOao3IoP1EnB5xe7Gvcgz9ECy5HtkPCl
+lkyOILn1xR7Kwb190BsodL2R9soqZuOSpvSQwqEEQBv9qQxdQbyfLNQUTd9g1iKY
+fKvbsg3tvB34K6WlWHBRXfUmKY4Wfa7Vxh+8L5nmy+/dLwee7J74SoI6tPIn7Etz
+kn9IFChaowGL1LydrL5X2T0oi9sP2uXysMhLZgBSlpAP6ISuqhJ7l3m6+2j0KmMZ
+OfK4aJ+Tvz5mft83XIbd4rXLwdJtU+2buOjHe01F1qYEvITzPGR/z6GxnD0Wsa3x
+33qJM+zonQzeTxlaPwHYDO460wyCfQIyGuK4gdagypGZELkZIwJdhGcN7ehNtO+M
+DS5Bo3SUezgN6KEYBusMupvx/2hEFkiJV3yDSd2H8jCDXhuzHLcUlBi/1LrDwNqD
+Jhr35WjaZ1MzTz/hywYwRCWz8K4jam/qBL2iRew/ssQVjZcV8HyVxjSFzfB6CGOy
+T9fYVTNmY+emrquICVOSGLgU3QTMmMwp6npeYUPwF4uxGdvmNk4QEKpz9JiytOJX
+yBR5YEXx1mMlh7P5DSnUVdLeeNRWGPO4dZRY82c2gSCQhUBWv/RjNi+BymqAKjHp
+04ZhQO6LM5cqC8VoZGXJiwA3Gel7HTwXVfW+xU/YuWnE2c3bfNf3Cm+OoURnpPOR
+jfUhYA/XrPV4aAvpvN/VQeMc26TfimQUObVxbzeYMnoHNtXM4dk1AAn4EjUtw4tc
+onsrlQyyohrqPi6Jlgz/4Ij3MpcVrqdSbtjbvsemKKwNfQ6+puVjTGX2m/vwxC1r
+T9OY8URqbYYZuD618saMW2e9nBWR1pDtRM/9Nb5hQXcz/mx+xcVSHKSBUaMoCiB3
+Vnp2Uz/2/JI0Hk6Vr4kqXD/07LRmAvDTl/5ylDKjQa0UGLaBADs1eIZBV/JCLFYU
+n8sJO66IQg4Gf27yEGs2jy4amD0+bdeCb9M+xoSwESHKJlQ71eb6inm03yMokD9Y
+xlIvGoOg3WubqIKMP+k0tUSgDylamz0k0CUvqof8Ydx+UiaeV3atwO67O+e9d+iZ
+mxdM3V0qDM8GxscY0KbjMEU7W6lPOf0P6KT/HjlW5YfaXiSlO0YhOBXtlHChbIEr
+V5HeU90gsW8kCxEqjXCWlCgR8pMcs7riLpJXoKhEQ3lhHHs7i2NDstzEbqKS0ny4
+zTVo8gDiMB9UabZVYlwdR45CT/CqSsV1yPNRbl6kLM7R+bxNMK5q4DqOlVFtX7GH
+l/bYvtk7zPlsb+YRdxeVRc7vsq+nlTSeQboxqEd3CNTE0Ku5voKt0D9W5CzmpNiT
+QTPdSXi/49XTsvAsMx6TxoalBq/vXu4UOtv0Ws7nCmtadlnjWdJuefsJ+gyD0hM+
+XpX9MUOuy7Ec3emchW+d3QwpPLWvcMIE574jNab6mG4fvGAh6WziF/3RMHNVsO2K
+8L+CLmkuw20Qd4TgMspXWgEhr981q4tISHu6R04biL6O/RMXoeerZMR8RU1Urvff
+S1Eb5NT2LFgHgeNEjsoY7LXimiw21KiwdFF9U3NHkJE8++FMdhI84kqQ/+ANbPLb
+AiahO4UmkAPeIrLLfAcVm46xhK768lrc5l8sdY9UGuHXTyukiTrbV9fzy7uCNDAX
+9sGU4d4Z3eDpm6FfErY5Kz6e4EjoK5a0j16CB8os6/Y5FC4BJdxHuZAK3OozTUop
+sQ3rZBUE/OHmcWzYPeSM9iLMO6j/h0TxYDzWluy4hbYlFMdIYagklk1Al/hE4zRc
+zFsGH26UREtwPcZhkhqmoGZBnMFNi7QnBi+iXetL9lfWdyvV2pARavOAs+sDS6Hq
+mT47kbIJusvthTgKSk7CT+/AeSaAVgKfRfRPEGwwXOUeGRKYoiSe5mi/bQyPzhjZ
+dHKzxSxY7WQs2vtivfyY9gLwAGPJXEWJX0DqAlC37OWAOIMqc/hTH60MeR8PlUUM
+pU6ghD4IUxd+A/LhW1lCQiuvO5PT/nbL5vzFm0RTumhCfGmCKjsPjIX5ivVFeQfP
+A7BK8uM51Hka3fnpYHZ2/9HnVYHG5r1UZkCByZ0A43xXcnabMXSdaG5NXK7W+RZN
+arR9FVvC9P8uS4D2qA80/YEjQ1U1RhyCfXkaMmXNcbE7aXQIrDOuoQ5XW3PkNJP2
+e4wIQoQSp4T6drIThlQmwt/7AXqFZmpDGpqUqxsxHzsMlERDmt5EpjyzJC6kaf46
+My3FMnic0Lg1sOk8VqrVN3mnC1qNfhfPS/1iMzGNkJE/gOdppY376wVHizedxbCu
+Lekrx8owLhuDOyh8rHI3UTXEcejMNN9yQamFKyoHMWVOyiCznlR4djctOXZqXGiv
+9ERvCEKcxWEdee7Q76E1XUKyq/MuUGj1nfU6S4pibeRbiO8R8t1nkS9yxocdFZgl
+OHtTjJ9vEH2qh5F6yQ9rV/xfY+pWkll6+OtE7Yc9z5x80jVed5aW53fvVCGbZU+B
+4R3evtkXqVgG9He6cWg8RHfEnpiJ3oTN2TjosibmfKKHslwYfqdEygmiB0Yr67Qn
+NfdPoNX/lkrZzrrOUnS2vbPCWOjrgLiJ5dvupX68wTvSYJMvsTmsaJSJrSjK6ufX
+7aVijTu0JeAsn3+0rz57ThpyNALDzYDjwBrbM+C8fw2i3tkEypZWrkn6I8Z2K8fT
+dvTeV2SszXroYPEnL2FdDFSnmdP7hcyB1BgMLlVem7KvZ0mKFtLI/Do/zfuCgAp2
+CqeN6SBAmN+ONnpVLIyZv/4rjWiekAC/kq0fAf5FYRaWstVv3EY4K95Z7ZsMSKMU
+hjQLNqic923eP6Rue0HqyerJVNrPzj6XmRt8d0ikGdeciUnAedcbbXkXTVGwhGuu
++AD+1KxFoBI9Ln2IC5WRSCNhmWsNUMtHVseCusxov+xvZ9XAjBX/d4XBbXD0PX4a
+mzOvxYpObwwjR+rl4T7/DpsAsO1z4ehYoYL9q8y3nt+pyaCIb0X/VibXJI9oOPWQ
+AlUIZBGWJkAjdEi1W2fmS5ZLlqCM6fgHY0uUprOauRdhROtwHNVn1TaLRFgdrK+D
+7pLvVmecfzY93UsjFMQOaPjeVOyS97rKzZ0amAOTxoUDxypSIyCXhWsX+N1He+RK
+NquvW4ayk2AJMTID0EznmHo2DEppWC4ahK59LpyJ6MPm6S+LbbsvNCSoaTtyEE26
+bK2Sq+Pxaad9rzs0f8qXhajQ9h0Y/RmUH0Tr1ZXZjrJ8VpHwvng6SYbz+/u0mU6Y
+bmodFxBYNYw8PR5szY/y/GlP4HS3zcbOVcUJy0Fj/Qk2igJujUitcaQ2s8fqWn8X
+hVXtLcaCJ+Xf//1ffYXj9Ik0fmzZDuFgiAmBB8OtShgQVPZqrcJVhAICcCcv1lad
+RwiVs80ha6/507IEpXp+wakO6kzyOs9oz8uDE+++w/qdwzpUBj4PNiFBip1APbR4
+292tDpW8gJGc0wZ4nLtkRhsa5Jibbh3vFttLUUA4+gES5zmrJv6FdJeoRZY2P+d0
+2Z2lp4kJiDvgQOaoSVb8njeVdLW/n1u5H7CF5uts+F9yODJ0FFLgP1Hp5L0olF/3
+XDz9ZqmjFkCTIeqGdOFhUXbwBiyyimUw7oaPk6rl+B3aVHA8gu/kK3fRKhSZCM3O
+t6gqA+HeMtj4fda5ZUKgIr+SxSeTCRcJDfll7GB/Xa1FV4Zo1m4Ioy8jcK3tetXv
+H8mR3B8JCZH6WFBJPkE/WI2E6svEUa06sEgHHaOy/wkhy1mOebZWioqcQ1T5MVnu
+phK7W+oCYK4D+E6ssNpGmbzsmzrljNWz09HwuvL/nhVL/yl8r9GKmv3AZon/GfOp
+giFkBrvAxK1VEhWEEsk+ZsHvqdvvrMUwVQP9k0YJqXiatscO8wOlKUOFl9zWsOju
+kwU7W7+0qr2Itkp2lCJxVkh5tmv+ui6RAb6n2jqH6CZMwoyjpRDnE5N7fE6OiwZD
+Gla6sfSuO/isWVroB1w7tLpByDEAbABnusmbtfZQDalymSaA2fYV0ZXHlXPUoxSS
+9Rsy/QaAT1ataKiDdvnjvdRvp58kp4g5nn7Gzesf+Od3YW7ADzu0Y1E3kDGQNZ2M
+uXm3qsZgLxbFapxyai/SIl3K7GdLVkTRm6TMOvaqmd/MP+ZeqprUuj8L8DNH/hS+
++bE0Byf4e7bIyaOK6iKAOREYkBAbSLDmFLwpN7iqrsMBS8k+SLprMv0uHSOK8I0Q
+MVxFmLP+bAAE13+cGuiZwcB2LQEHa+hnljX6sr26P03lixvx1vq8DfiDxNVxzOtU
+myf0eG+b1+8Drq/9JPzdg8gzIy8rDv8Q1NVn0XUJR+5DzuUywMjRKG4XBnfl/d5x
+LnsHbcOaFVVfIgTRE1zbhoTen9K6VhHRRliHRlPyYLo6II3wSpMvQaJy5bWiJd0g
+uzeqQd6hdNGZSqpRZLIH6GqGECY+J5A3X6CM8Dw2EjiOFXC33IoB0NqZlfALKnsj
+ofAlHBxVMrcwpd+21JkMTht5Mb8CDXtMHOz7/eEONaxIkzasQ7p59wUlC4RobrYa
+4k7nyfeTPBetNDHsKToRqUO5WczIopRFGArfxMIJ3wKiZL3VvrrANHc5+ZznVSg5
+xgAdgHUHlCNBTiHKTA7t35pJd+D5qCNwa4Rmp4a4cSGSAb+gb24LTBMHqX7xBZMV
+cKv3RHaOZAvp0e3Z7efzQ+TPX9Zzcr31UEAZJG7rMrq3DkY1tuibHGddWboq2Wkw
+ZxhVQUDZjOHdmP7Ac+1/9/A9AuX/f8dEnLJXPJtR9QJ5keBg1e139DH9HLJvrekm
+t4LMokWPVSjCTCo6tOl0nMtJ3DqDkcHHgaQDhsY35CN8sMjSCAjgtJ4+yewSGplb
+T9YrxUqlmprJXXRFuCo67yPBIn5iMQD53ZPLuRtBQ10P633W3K6VD9ZbeasPF3w1
+mSN/sLk1pi2aHnFgpBstGx+qgna9wkh7cVO4JeEwGS6KkOytIYD0c25rUF21Q9l7
+MEpjB/oQYB0ZeuwVY6HYkaS8H1WFe2q2o5bFqEPlI0kPmCW2uAfgUYpIBYjQ1yCc
+wo6mguyJEaOnvN79eeyeCQ+1+dIDqYZ1ioTxbNy5C8s67d2gDUeYeazwc4ftU047
+IEutah8UqNFcJWGLDvUuyBMGlCtXU7c7ODA8RGMB/9ynqu0SzDy225gUnIaqviLB
+YkftINUP/Qefq84akApwo82bZQYLDgpxqxaeuACCjHXU089woj6JZsRII52Jx2ca
+4xKM22gyBZjiGH1bdzhCf2C4puvA7i5FeTKvAQwX/fw+mVbd/lf8yNIGAXWk0wdD
+PHZHhDWn5AdBWFFGf1gBl5eo9ctOyknqlf0ndEJInWzyL76I41YOOVIyRA03XRru
+bIe9bX4z4jf0BqX24wCPYT/ImzTiX+OAjjiq32jqHma9gEPcYqx4j6ex3GV0cIDe
+jbIdZ4SeUN/ErVv4PdHOyAELum44wfSf2Z3Vd//uAdYDUzTiBOsS/pjbTASuv8Rq
+rcwTRMhVNLMOyul+Vv9+FcffnuvxQAHsYDedjDqBhtQRtI3WUaLqk5W9pt5urUbn
+cHIq2YOq36lhc/Q9cD8GyKGhY7fAT79xpQsGR3jx5eQ6PUJkBv/QTGHB6/swJ9vT
+jakX9Zf6/YR/ulzMrYUw8HRHhHLkl9aPFgXnYohf5NT7u28TxoCJIKooClbqhlNQ
+meWb/7rlRd2ebIdv/k8QK2y9eYDxGCYTm51yR7m7JAxG0rlSN5qL6T3PxHvKJTi1
+VDxRQ+KC71xHWPUH/mfMm3rcsR9zDNd5mVEaH7IOOxu6C9NBhQg62a4zGk1FgMZE
+BQrL/ae3kFVtYR8+5mUnAMW8BZ+CKC+vP+a1T01KXO8+EY9w4TmryG4TXmya5+gs
+Giao/aPnIs0A//OgfFLrzwhlUl7LUv6kJbgkdADtCw4WoDGlQhnAI8U763JYD1i1
+Zq0K3F/WemqTtouOHRFWYazJlD2S6fIs597qYWeVXEWdD0bnVXg2N76dL78Hijvg
+tGq5Vgfsvc2jALqN+I6SjWsveuRwDNCSDTJN/gXZ2L2In/US3gZXrPkBa53Jb0Am
+TZPYw6WRud6qkzNgOcm4FVV1IiLhvEUMDnq276JoJZWzXcDPzZzh8JFVL7tTMWqY
+zdBDyI3D4uRaVK64ZWsYWB055LTYpKcOVXWjJYB9nvczjcSlFN/bBZzsByiXu3PI
+DjnAP2WISC7t3REt2JOdPsJI0dxYsrWA1nGhO50s1wne4ZKq/fIixB6STPCiSDhC
+ZBattKlTKEaUUbhOAv7hETWrOM+lTNUpVAZFsqEOU4HQ1AnvvmdwT4Y23dsTQj/h
+FFXnFzlkzs9TXVMqymLsD0WDnAJq8bub93QBkKyqMwDLLuZHbvlRnCwEtGwk/VtB
+tA/eSwF6nPjqnZ67NtY8SmfzF3lC4FHCzDulFWS4GTRgbZVEeVR2XJZO/EFDMb3v
+f71NGH5+DdJtE8Bas03MxnsrE5n9JhqWYCdyE6fyR8kgxNX1Q0yr3bdGoQKVDhvE
+eFsD8IGGtFUqcnH2SeB9c+052WGCN3NqnC5Ib+CAZFguxUolXZAZGo2+uQRUBpFB
+4g+f7CFjjF48YE0PpAauea3lqpzWcEImV5I2KdmOCfpm2+9UGLvtbhas2/MNMs0U
+GRiaSAKQo33YQ+cHqLyenpS5GW0hwFnvYIlj7Ro6cAJsobIqjTfHt3ZiQ+jXGBTD
+deSxKN+zrI4Q5rmER2H0BgAeNU+uWjubR/b9pfzBgTMOTqk91iH5a8uC9Er7XBgM
+h+81KPYuaPem3rBRX+iaIqouzzKyRC8UOkhA+JyEFn6Y+jDsIeqQYpGjvxKuWzet
+2YCt8r7/UnKOpDQLyxmdAMeGjx1WlMi7NYGZVv/7t9QcBnBS6UGZOEn/dDEZqi/1
+DbPQ75/n8BEUglrFnLEIACVbG4peJD15kBIlA8CVv76/jxFOtiPeo7+Kj0sp4grs
+rv/WVJ3W8vISmVjKLsKfOLIKByNNG2+7Q3QePO9VjUA7bqvp1S58c+ubiZ02IUuL
+icJa5HXMN87/v6T5opjjstEvHS1IoKGmjFVfUDftfzKBvR6gC2asefMDZkO7g6Dh
+sTIxF3j3kBMeGe+AfAPPVTYutlfWWbhZ+u3teBEiGBkg4yXNi4F1buLEDhGK7C9x
+3X8AzhrIH3BsQEhOn7Ers1roCarT4OtmVug5fO0aR3LX55DyyvStrWH+6LSTX6tM
+TK0eqsMZ8m92sOdat/nICo5QuMG4uT5ECtOJrg9e6V+Y090552veC5PS6DNS9jyP
+zwWiTQ+qvgoYXVL1H7ytOcFvTSXsdpiDTja93+mx4sB4yLKLqa5m9UiT6TmFpYj+
+L9RSkcOqVzzILzH1XD/hnoYE5oMi/Sb57s9pQNyjRbPIHeGyWQXQuDRDyPr05LYL
+xV3Hu34UFBDZEeX9HTJAv9nLImrypi+b5t1WwSdQ+6HzfLi9XbZ4utASDQNqXPLY
+G770M4j4DPrkSNU6fMHu+bVx27Tjw175yWzsPde/7b2EynbTohLizKjC1Tskg9x7
+KewV6WzPDu4exTBX9RPZDr0HqiHpouBdQEjoXbt91Z7hcBX+/wMAAQABAAQAAAAC
+AAAAAwAAAP////8CAAIAAAACAAEAAQABAP//AAD9//z/AwAAAP////8DAP//BQD/
+/////v/+/wQAAgAAAP7////+/wIA/f8AAAQAAQAAAP//AQADAAIABAD9/wAA/P/+
+/wIAAgABAAAABAD//wIA///9/wAAAwACAAAAAAAAAAIA//8BAAAAAQABAAEA//8B
+AAEAAgACAAEA/f/9/wIA+P/9/wIAAgD9/wMAAQABAAAA/v8CAP//+//8/wAAAAAC
+AAUABgD//wAAAAAAAAAA/f8EAP///v////7/AQABAP3/AwAAAP3/+v8BAAMA///8
+/wMAAAAEAP7/AAABAAEAAQACAAAA//8CAAAA/P8FAAQAAAAAAP7///8DAAEAAgAC
+AAUAAgACAAMAAAACAP3/AAD///v//P/+/wUA+//+/wIAAQD/////AgABAP///v/+
+//7//////////v////////8AAAEAAAAEAAAAAgD9/wQAAQADAAMA//8DAP//AAAD
+AAAA//8AAPz/BgAAAP3////9/wAABAABAAAA//8AAP3//v/8/wEA/v8FAP7/AgAG
+AP7/AQADAAIAAQD//wQAAQADAAEABAD//wAA/v8AAAEAAAD///7/AQD+//7/AQAC
+AAAA/v8CAAIABAAAAP//AQACAAEABAABAP3/AwD+/wEAAwADAP//AQAAAAUA/f8E
+AAEA//8AAAAAAQABAAEAAAD7/wIA/v8BAAIAAQD///z/BQD///7/AgD+//7//v//
+/wEA/f/8/wEA/v8BAP//BAD+//7/AQACAP//AQD///v//P///wEA/P8BAAAAAgD/
+////AQACAAQAAAAAAAEAAgD//wAA/v8AAPr/AQACAP//AQADAAEAAgABAP7/BAAC
+AAMA//8BAAEA+v/+////AQABAAAAAgD//wIA/v8BAAIA/v8BAAIA/f/8//v//v8C
+AAQA+/8AAAEA///9////AwD//wEAAgD///3/AAD9/wEAAwACAAMAAQD///7/AgD/
+/wMA/f8CAP///f/8/wIAAAACAP7//f8CAP///v8AAAEABAD9//7//v///wMAAAD+
+//7/AAD+//r///8AAAEA/v8BAAEA//8AAAQAAAAAAAAA/f/+/wUAAQD///7/AwD+
+/wIAAQD+/wQA///7//3/AAACAAAA/f8DAAEAAQAAAAEA/f8BAP3/AAD//wIAAgAD
+AAAAAAACAP//AQAEAP//AAACAP//AAAAAP7/AwD//wMAAQABAAEA/v8EAP//AwD+
+////AAD8/wAAAAD//wIA/f/9//v///////3//P///wMA/v///wEA/f//////+/8D
+AAAAAAD9/wAAAQAAAP7/AAAAAAQA/f8BAP7///////7//v8DAAEAAQD+/wEA//8A
+APz//f///wQAAQD7/wIA//8DAP7//v8AAPz/AwAAAAEAAAAAAAIA//8DAP3/BQAE
+AP//AwAEAP7///8CAAEAAQADAAEA///+//7/AQD+////AgD+/wEA+//9/wAAAgAB
+AP7/BAACAAAAAgD9/////P/+//3//f8BAAIAAQD8/wIA/v8AAP7/AgD//wAAAwAA
+AP/////+/wMAAQD8/wEA//8BAPr/AAD+//////8FAP3/AwD///////8FAAEAAgD/
+////BQD+/////f8CAAAAAwD7////AAACAAMA///+/wQAAAD//wAAAAAAAP//AAAD
+AP//AQD+/wYAAwAAAP//AgD+/wUA//8CAAEAAgAAAAEA/v///wIAAQD9/wEA//8A
+AP//AwABAPb/AgD//wMAAQD8/wIA///+/wMAAQD//wEAAgABAP//AAABAAAAAwD9
+//7//v/+////AAACAAEAAQABAP3/AAADAAEAAwD+/wAAAQD+/wYA/f8CAAIABQD9
+//z//v////3/AQABAAUA///5/wMA/v///wAA//8AAAIAAgD//wAA/f/+/wIAAQD/
+/wAAAAACAAMA//8CAP///f/9/wUA//8BAAEAAwAAAP//AgABAAAAAAD6/wAAAQAC
+AP//AAD+/wEAAQD+/wIA/v///wEAAgD/////AgAEAP7/AQADAP3/AQD///7//v//
+//3/AAD+/wIAAQD//////v////7//f8CAP//BgAEAAAAAAD9//3/AQABAP//AQD+
+///////+/wIA/P8EAAAABQAAAAEAAQAEAAAA//////7////+/wEA//8BAP///v/+
+/wMA///9/wEAAwAAAAAABgD7//7///8CAP//AAAEAAAA/v8BAAEA/v8BAPv/AgD9
+//v/AQABAAAAAAD9/wUAAgAAAPz//f8AAAAA+//+//v//////wAA/v8CAAEA//8A
+APz//f/+//3/AQD9/wAA/v8AAAIA/f8BAAEA/f8BAAMA/////wIA//8EAP///v8A
+AAQAAAD//wAAAQD9////AAD//wEAAQAEAAEA//8AAP7/BQADAP//AQD+/wAAAgD+
+/wQAAAADAAAAAAABAAEAAgAAAP3//f////7/AAABAPz//v8AAP7/AQD+/wEAAAAD
+AAIAAAACAP//AAABAAMAAQAGAAEA//8AAAMAAgD+/wAA/v8FAAEA+/8CAAAA//8D
+AAEAAQAAAP///v/9/wIA/v/9/wAAAgD//wAA+v/+////AwAAAAAA+f/+////AQD8
+/wAA///+//v/AAD///7///8CAAMA/v///wAAAAD7//z//v/+//7///8CAAEABgAB
+AP7///8AAP///P/9/wAAAgD+/wIAAAD//wEABAD8/wEA/f/9/////f////z/BAAC
+AAEA//8CAAIA//8BAAEA///+/wAAAQAAAP//AgD+////BgD///7/AQD///7/AQD7
+/wIAAAD//wMA+//9//7/AAAFAAEAAwABAAAAAQAEAAMA/f/+/wAA/f///wIA////
+/////v8DAPz/AgAAAAQA/f/+/wAA//8BAAAAAgAEAAMAAAAEAP///f8DAAEAAAD/
+//7/AgD9/////v8BAP3/AgADAAIA//8CAP///v8BAAEAAgAFAAIABQACAAEA//8A
+AAAAAAACAAIA/v////r////9/wAAAAAAAP///v/9/wAAAwD///v//v8BAP//AgD/
+/wEA///8//3/AAD//wAAAQAAAAAAAAACAPz/AQACAAUA/v///wAAAQD8/wAAAgAB
+AAIAAAD//wAA/v/+/wUAAgABAAEA/v8BAP///P8AAAEAAAAFAP//+////wYAAQAD
+AAAA/v8EAAAA//8BAP///f8CAAIAAQABAAMAAAAEAAIA//8EAP3/+//9/wEAAQAB
+AP3/AQAFAP3/AwABAAIAAAABAAEAAQABAP//AQACAAEAAAD+/wEAAgD9/wIAAQAA
+AP7//v8BAAEAAgD7//7//v/+////AAD+/wIA/P///wMA//8CAP7/AAAAAAAAAAAD
+AAMAAAD8//7//v/+/wIAAAABAP7/AAADAAAAAAACAP////8AAP3/AAABAAIAAQAB
+AAMA///9/wAAAAD//wIA/////wEA//8AAAMA/v8AAAEAAAD8/wIA/v////3/AAAA
+AAEAAAABAP7/AQAAAAQA/P////7/+v/9/wIAAAD//wEA/v/7/wQA/f///wMA/f/+
+////AgD8//7/AgACAAMAAAD9//3//v8BAAAABQD7/wEA/v8CAAAA//8AAP///v8B
+AP7/AQAEAAIA///+//3/AQD+/wEAAQD8/wIAAAAFAAEA/v/9//7/AAABAP7/+v/9
+/wQAAgADAAEAAwD+/wAA/f8EAP3/AwD9////AAADAAAAAQD//wYAAgABAAIABQD/
+//3/AgAAAPz//f8DAAIA///+//7//v8DAAQA/v///wUAAAD//wEA/f8FAP3/AQD+
+/////f8CAP7//v8CAP//AQADAP3//P8AAAQA/v8AAP3/AgADAAAAAQD5/wAA//8A
+AP7/AgD9/wUAAAD//wAAAgD9//7/AAABAAEA/v8AAAAA/v8BAPz/AwAAAP7/BAD/
+////AQAAAAEAAAD9//z/BwACAP3//////wAAAQAAAPv/AwABAP7//v/7/wAA+v/+
+//3/+/8DAAEAAgACAP7//v/+/wAA/v8CAAAAAgD+/wEABQABAAEAAAD+//7/AAD/
+/wEA/f///wQABAACAPv/AgD9/wQA//8BAAMAAAD//wEA/v8AAPz/AQD9/wMAAAAE
+AP7/AwD+/wAA/f8BAAAAAQD+/wIAAQD/////AAACAAIAAQACAP////8BAAEAAAD/
+/wEA/f8CAAAABAD7//3/AgADAAAAAAD//wAAAgABAP7///8BAP3/AQACAAIA/v/+
+/wIAAAD/////AgACAAEA/v8CAP7/BQD/////AQACAAYA//8GAP//BQD//////f/9
+/wEA/f///wQAAQAAAAIA/v8CAPz////7/wAA/v8EAAAA///8////AgD+/wEAAAD9
+//7/AgAAAP3/AAABAP7/AwABAP7///8BAP3/AQADAAAAAwABAAIAAAADAP7/AAD/
+/wAAAAABAAQA////////AQD//wAA/v8CAAEAAwABAP3/AAAAAP7/AgD8//3//f8A
+AP7//v8FAAIAAAACAAMA+//7/wAAAAACAP3/AgD9/wUABAD///7///8GAAIA/P8B
+AAAABAABAP//AQD+/wEAAAD//wIABwABAAEABAABAAIA+/8BAAEA/v8BAP3/BAD+
+/wAAAQD+/wAAAQAAAP//AQABAAAA/v///wEAAwAAAAEAAQD+/wIAAgADAP//AQD/
+/wEAAAADAAEA/v8CAAAA/f8BAAEAAAAAAAMA/v8CAP////////z///8EAAEAAAAC
+AAAAAAD+//3/AAD+////AgD///z/AQABAP//AAD//////v/9//z//v8AAP3/AAAA
+AAAAAwD7/wQAAAD//////v8CAAAA/v/7/wAAAQABAP7/AAABAP//AAABAAIA/f//
+////AAABAP3//v/+/wAAAgD+//z//v///wMA/v8CAAMAAAD//wEA+/////3/AAD+
+//7/AwABAAAAAQAAAP/////9//3/AAD+/wEA/v/+/wAA/v8EAAAA/f8BAP//+/8D
+AAAAAgD+////AwACAP7/AQACAAIAAAD+/wMA/v/8/wAAAAD//wEA///+/wMA/f/+
+////AgACAP3//P8AAP//AwD//wMAAAADAAEAAQADAP///v////3/AgABAAAA//8A
+AP7////9//3///8CAAEA/v8CAAAA/v8AAAEAAwAAAAAAAQD//wAA//8BAAAA///9
+//7/AQAAAP///v///wMAAAD+/wIAAgABAAEAAAACAP//AgD9/wAA/v8DAAEAAwAA
+AAMAAwACAPv//v/+/wEA/v////7/AgAGAAAA/v/8/wEA/f/9/wIAAQD+/wAABAAB
+AP3/AwADAAAAAgAEAAAAAQABAAEAAwD//wAAAQACAAAA/f8AAP3//f///wAA///8
+/wAA/v////z/AgADAAAABAD+////AQD/////AQAAAAIAAQAAAAAA//8AAP7/AgAA
+AAEA//8DAAIA///+/wIAAAAAAP3/////////AQD///z/AgD+/wIAAAACAAAAAgD+
+/wIAAgD//wAAAwD9//v///8EAP7//P///////v///wMAAQAAAAMAAAD///7/AAAB
+AAIABQAAAP7/AAAEAAEAAAD9//z/AQAAAAIAAQD///3/BAAAAAIA/v////7/BAAA
+AAIAAgD9/wAA/v8AAAIAAwACAP7/AQABAP//AwABAP7//f/+//3/AAABAP//AwD+
+/wEA/v8AAAAA/f8BAAIA/f/9//7/AQD8/wEAAwABAAIAAwABAAIAAQD9//7/AgD9
+//7////+/wEA//8CAAAAAQD+/wEAAAABAAIA/f///wAA/v/////////9////AQAG
+AAAABAACAAUAAQD//wEAAAD7//7///8EAP//AgD+/wAAAQAEAP7///8BAP3//f8A
+AP///v8DAAUAAQABAAEA///+/wEAAgD9//7//v/+/wAAAQACAAIA/v8BAAEAAQAA
+AAAAAgD///z/AAD//////v8BAAMAAgD+/wEA/v8CAAAAAAD+//7/AQADAAMA/P8F
+AAIA/v8EAP3/AAAAAP//AgAAAAAA///9/wAA/////wQA//8AAP///f8BAP7///8F
+AP//AAD///3/AAD///7///8AAP3////+//////8FAAEA/f////7/AwADAP////8B
+AAAA/P8BAAAABAD9/wIA/f8CAAIA/P/+/wAAAQAAAP///f8AAPz/AgAAAAEAAgAE
+AAQAAAD+/wcA/v8DAP3///8DAPz/AQD9/wAAAAD+/wMABAD+//z///8AAP///f8C
+AAIA/v///wQAAQABAAAAAQD//wAAAgADAAEA/f8BAP3/AwADAAAA//8CAP3///8A
+APv/AAD//////P/+/wIAAQAEAAAAAAD//wIAAQAAAP///v///wMABAABAAIAAwD+
+////AQACAP7/AQAFAAIA/f///wEA/v/+/wUA/P8BAAQAAQD+/wMA+////wIAAgAC
+AAIAAQABAP7/AQD//////v8AAAMAAgAAAP///f8BAAMA/v8AAAAABAD///v/AAD+
+/////P8CAAMA+v8DAP//BAD//wAAAwADAP3/AgD+/wEA+P/+/////f8HAAAA/v8B
+AAAA//8AAP3/AQABAAEA/v8AAAUAAQD//wEAAQABAP3//v///wEAAAD//wMAAgD9
+//7/+/8AAAEA/v8BAP//BAD//wYA/v/+//z//f8EAP7///8AAAEA//8BAAEAAAD+
+/wAA/P8AAAQA+v8CAAAA/v8AAP7/AQAAAAAA+v/9/wEAAQD5////BAAEAAMAAgD/
+/wIA//8BAP///f/+//7/BQD9/wAAAQAEAP///v8FAAUAAgAAAP7/AQAAAAAA/v8C
+AP7/AQD9//7/AAD+/wAAAwD//wIAAwADAAAAAQAEAAAAAgABAAAAAAD6////BAAC
+AAEAAAD9//z////9/wEAAAAAAAEAAAD///////8CAAEAAgAAAAAA/f/+////AAAD
+AAIAAQABAAAAAAD//wIABAD+/wAA/////wEA/f8AAAMABAABAP7/AgD///7////9
+/////v8BAAEA/f8CAAMAAgD9//3/AgD+//3///8AAAEA/v8CAP//AAACAP7/AgAC
+AAAAAgD+//3/AQABAP////8FAAAA///9//z/AQD+/wEA/P8AAAQAAAABAAEAAAAB
+AP//AQAAAP///P8BAAAA/v8CAP//AgACAP//AwABAP7//f8BAAEAAAD9/wMA/v//
+/wAAAAAAAAMAAgACAAAAAQD///3/AQD+/wAAAgADAAIAAAD//wIAAwD+/wAAAwAD
+AAIA/P/+/wIAAwD//wIAAQAAAAAAAAAAAAAA/f/+//z//f8DAP//AwD///z//v/9
+//7///8BAAEAAgAAAP///f8DAAAAAAABAAIAAwABAAIA/v/+//7/+/8HAAQAAwAC
+AP//AAD+/wQAAAD+/wEA/v8AAAQAAwD+/wIA/v/7/wAA//8DAP3/AAD9/wEAAwD/
+//z//////wEAAwD9///////+/wIA///9/wAAAQD///z/AgACAAEAAAAAAAEA///+
+/wAAAgACAP3/AgD//wIA///+/wQA/P8BAAEAAAAFAAEA/v/+////AwD//wAAAgD+
+/wIA/v/+//3/AQADAP7/AQADAAEABQD8//3//v/+//z/AwD9//3/AwD8//7/AAAD
+AP7/+/8EAAIAAQAAAP3//v8AAAAA///+/wEAAQABAP//AAD+/wEA///9/wAAAQAA
+AAEA/v8FAAIAAwD+////AwAAAAIA/f/9/wIAAAD7/wEA//8AAAIA/v8DAAMAAgAC
+AP//AAD9///////+/wAA///9/wAA//8BAAEA/P8AAAEAAQD9/wIA/v/6/wEAAAAE
+AP7///8BAAIAAwABAP////////7/AAD//wEAAwAAAP3//f8BAAAAAQABAAIAAAAB
+AAAA/v8BAAAAAAD+////AgACAAEAAgD+//r/AAACAAYAAgABAAIAAgD9//3//v8C
+AAAA/v/+/wIABAACAAIA//8BAAIAAAD+/wUABgD8/wIAAAABAAQAAgAAAAIAAQD7
+/wIAAAADAP////8DAAAA//8BAP7/AgAAAAMA/v8BAP7////+/wIA/f/+//7////7
+/wMA/f/8//z/AAD////////+//3///8BAAIAAgABAP3//v8DAAAAAAABAAMA/v//
+/wMA///+//3/AAABAAEAAAD//wAA//8AAAEAAAD8//7/AgABAAMAAgD///z//P8F
+AAAAAQD9/wMAAgD//wEAAQD8//7//v8AAAMA/v8BAP///P/9////9v8DAAEAAQAE
+AAAAAAACAAMAAAABAAEAAAADAAMAAgABAP//AAABAAAAAQD///7//P8AAAIAAQAA
+AP7//////wMAAAABAAEA//8BAP7///8CAP//AAADAPz//f8DAPz/AwD9/wAAAgAB
+AAAA//8CAAEA/f8CAAAABAACAP//AAAFAAIA/v/+//7/AQD+//3/AQD+/////v//
+/wIAAwAEAPz/AAD//wMA/f/+/wIAAAD9/wAA//8AAAAABAAEAAIA///+/wEAAgD+
+//3///8AAAEAAAABAAEABAADAPv///8AAP////8AAP3/AQD//wMABAD9/wEAAgD+
+//7/BAD//////P8CAPz///8AAAEA/P/9//////8BAP3///8DAP///v8CAP////8E
+AP3/AAD+//v//////wQA/v/9//z/AgAEAAEAAgAAAAEA///9////AQD//////v8A
+AP//AwAAAAEA///+/wMAAQD/////AAACAP7/AAD+/wAAAQADAP///v8DAAIABQAB
+AAMABAAAAP//AQAAAAIAAgD9/wEA/f8AAAAA/v8AAAEA/v/8//7//v///wUA/f8A
+AP7////9/wAAAQAGAP3/AAAEAAEA/f///wIAAgAAAAEAAwD//wUAAwABAPz/AgAD
+AP3/BQD+//7//v/9/wAAAgABAAQA/f8CAAIAAwD//wAAAwD///3//P8AAAQAAgAA
+AAEABAABAAAA/P///wAA//8BAAMA/f//////AAD///3/AQD+/wEA//8CAAEA/f8C
+APz/AAABAAEABAABAAEA//8FAAEAAwAEAP7/AwABAAEA//8DAP7/AgD//wAABAD+
+////AgADAAIA//8BAAEAAAABAAEA//8BAP7/AAACAAMAAgADAP//BgD9/wEA////
+////BQACAAAAAAACAAEAAAABAAMAAAD//wQA///8/wAA/f8AAP///v8CAP7/AAAA
+AP//AQD///r/AQD9/wAA///4/wAAAAAAAAIAAAADAAIAAQD//wEAAQD5/wEA/f8C
+AAAAAwD+//3//f8AAAMAAwD+/wAAAgACAAEAAgD+/wIA/P///wMAAgABAAEA/f8B
+AAQA/////////v///wEA/v/9/wAAAwABAP7/AQAAAP7//v8BAP3/AAD///7/AwD/
+/wUA/P///wEA/f8CAAEA/v8AAP7/AAAAAAMA//8DAP3//f/+//7/AQACAAIA/v8E
+AP///v/+/wEAAQD+/wEAAwABAP//AQD//wMAAgAAAAQA//8EAAAAAQD9/wAAAAAA
+AAIAAQABAAEA//8CAAIA+/8EAAEABgAAAAEA/P8CAP////8EAP7/AwAAAAEA+v8A
+AAEA/f////7/AgACAAAA/v8DAP7/+//+//r//v8BAAIA//8AAPz/AgAAAP3///8E
+APz//f8CAP7/AgADAAQAAAABAAQAAQADAAEA/P8EAPz/AgAAAAIABgABAP3/BAAD
+AP7/AQAAAP3//P/6/wAAAAD7//3/AQD9/wAAAQD8/wEAAQAAAP7/AgD+/wIAAQD9
+/wMABAABAP///P/9/wQABAD8/wEA/f/+/wYA+f8BAP3/AQACAPz/AAD9/wAAAQAB
+AAAAAwABAAMA/v/+/wAABAD8////AgAEAP7/AgD6////AAAAAP//AAABAPz/AgD8
+////BQAEAAIAAAD+//3/AQD///z//P8CAP//AAD9/wMAAAD//wMA/v8CAP3/AAAA
+APv//////wEAAQABAAEAAwACAAMA//8EAP//AQD//wAAAwACAP7//////wIAAAAC
+AAUA/v8AAP3/AQAAAAMAAAAAAP3/AQAEAAYAAQD9/wIA//8AAAMA/f///wEAAgAA
+AAEA/v8CAP3/AwD//wMABAD//wAAAgAAAAIAAAABAP3/AAABAP//AAD//wIA/v8A
+AAMAAwADAAAAAQACAP//AAD+////AwACAAEAAAD9//7/AQABAAAAAgD+//7//P8C
+AAAAAwADAAAAAgD///7/AQD//wMAAAAAAP//AQADAAAA/v8AAAEAAAACAAIA/P8C
+AP7//f8AAAAA//8EAP3//f///wAAAQAAAP7//f/+/wIAAgD9///////+/wAAAgAB
+APz///8BAP7/AAABAAIABAAAAP//AQD/////AQABAP///f/+////AQAAAAAAAQAC
+AAAAAgD9/wQA/v8BAP7/BQADAAMA/v/+//v/BwACAAIA//////v/AAD9/wQAAAAG
+AP//+//+/wEAAwD9/wEA/v8BAP//AwAAAAAA//8DAAAAAgABAP//AQAEAAEAAAAA
+AAEA/v8AAAEAAQACAAAAAgACAAAAAAD9/wMAAwACAAAAAQADAAAAAAABAAAA/P//
+///////+//3//v8BAP//AwAAAP//BQACAAIAAAABAP3//f8BAP//AwD+//7//P/6
+//3/AgD+/wEAAQAAAP3/AwAAAP7/AQD8////AQD9//7/AAAAAPz/AgD7//7///8E
+AP3/AAD8//z/AgAAAAIA///8//7/AQD9/wQAAAD+/wEAAQD9/wQA/v8CAAEAAQD/
+//7/AAD//wAA/f8DAAEAAAADAAAAAgACAP3/AgD9////AAD9/wAA/v8CAAAAAQD/
+/////f8CAPv//f8AAAEA/P8BAAEAAAAAAAQAAQADAP7/AAACAAEAAwACAAIABgAB
+AAEA/v8AAAAA/P/+//3/AgADAAMAAwACAP//BgAAAP7/AQACAP3//f///wEA/P//
+//3/BAD+/wAABAABAAMAAgADAP7/AQABAAEA+/8CAP7/AQD9/wEABAD8////AgD/
+//3/AwADAP////8AAAMA//8CAAIAAAABAAUA//8BAAAAAAD9////AAD9//3///8A
+AAEA/v8AAP///P8BAAQA//8CAAAAAAD+/wEAAQAEAAAA/v8BAP///f8CAAMA+v8B
+AAAA///+////AgACAAQAAAABAP3/AQAAAAQA//8CAAEAAgABAAQA/v8AAP7//v8D
+AP//AAACAAEAAgD6/wEA///+////+/8BAAEAAAABAP3/AwD9/wAA//8CAAAA////
+//7/AQADAAEABAD9////AAD+/wIAAQD8/wIAAgD8//z/AAD8/////v8AAP7/AAAB
+AAUAAgD8/wMA/P/5/wAAAAAFAAEAAAAAAAQAAQACAP7/AQACAAQA/v8BAAQA//8B
+AP7/AgAAAP3////+//7/AAABAPv//v8AAPz/+/8BAAAA///+////BQD+/wAAAAD/
+/wEAAwABAP//AAD///z/+v8BAP//AQD//wMA/f8AAAEAAwACAPv/AQAAAAQA/f/8
+/wIA/v8AAAAA/P8CAP7/AwAAAP////8EAAMA/v///wEA/f8DAAIAAAAAAP7//v/+
+/wIAAAD9/wEAAQABAAEA/v8FAP7//v/8/wUAAQACAP7/AAACAAEAAgAAAAEAAQD5
+/////v///wMA//8AAP3/AQAAAP7//v8CAP//AQAFAAAA///8/wAAAgAAAP7/AAD8
+/wEAAAD///7//v8AAAEA/v8CAP3/AgD//wIAAQD+//7/AAD9/////v/9/wQAAgAD
+AAAA//8CAPr/AAD///7/AQABAAAAAgABAAMAAgD5/wQA///9/wEA//8AAAcA/f8D
+APv/AAD//wEA+/8CAAEA/P/+/wAAAQD//wIAAQACAAMA/v8CAP////8AAP7////8
+/wEAAAD//wAAAQD+/wQA+/8BAAEABQD7//7/BAAAAAEAAQACAAAAAAABAAAAAQD/
+////AAAEAAAA/f/+/wAAAQAAAAEAAgAEAAAABQD///v/AAABAAIA/v/7//z/AQAC
+AP7///8BAAAA//8CAAIA//8BAPv/AQD///3/AAACAAAA/v8CAAAA/v8FAP//AAAA
+AAAAAAABAP7//v8EAAAA/P///wAAAQD+//7/AQD+/wIA/f8DAAIAAQD+//3/AAAE
+AP///P8BAAAA//8AAP//AAD//wIAAQD+/wAAAwAAAAIAAwAAAAEA//8CAAIAAQAH
+AAAAAwD9/wEAAAACAP7/AwAAAAMA/f8AAP7/AwD+/wEA+//+//z//P8AAP///f8A
+AAEAAAD9//z/AQACAP//AgD///7/AAACAAEAAAAAAAMABAD/////AQAAAAMAAAAA
+AAEABAABAAMA///+/wEA/P/9/wIAAgACAAEABQAAAP//AAAEAP////8DAAAAAAAA
+AAIAAAABAAEAAgAFAPz/BQADAP7//v///wIAAQACAAAAAwD+/wIAAgD+//7/AAD6
+//3////8/wAA/f8BAPz/AQACAAEA/////wAAAAD8////+/8CAAIA//8EAAMAAQD9
+/wEA//8BAPz////+////AQADAAAA/P8AAPz//f/+/////v///wAAAAAAAAIAAAAB
+AAEA//8BAAIABQABAAAAAAACAP3/AgAAAAIA/f/+/wQAAAD+/wIAAgABAP3/AQAA
+AAIAAQAAAAMA+/8CAP//AQD//wAAAQAGAAEAAgD+/wAAAAABAAIAAgABAP//AwAA
+AAEAAgD+/wAA+//9/wAA//8EAP7/AQD///3/AwACAAUAAAADAAIA//8DAP///f/+
+/wEA//8CAP//AQACAAEA/v8CAPv//P8EAAEA/v/+//v/AQADAAYA///+////AQD9
+//7/AwABAP//AwAEAAAAAAD8/wIA+P8DAAIAAAAEAP//AQADAAAA//8CAPv/AgAB
+AAAAAQAAAAEA/v8AAAQAAAAAAAMABQAAAAQABQAAAP7///8CAP//AQABAAAA/v8F
+AP/////9//3/BAABAP//BAABAAEAAQACAP7///8AAAAAAgAAAP3/+/8EAAEA//8B
+AP3/AQACAAEA/v8DAP//AAABAAAAAgD//wAA/v/8//7//v8BAP3///8BAAYA//8A
+AAEAAQAEAAAA/v/9//7//v//////AQD+//3//f8BAP3//v8CAP//AgD+////AgAE
+AAAA/v///wAA//8AAAEA/P8BAAAA/////wAABAABAAAAAAD//wIA/v/+/wQA//8B
+AAEAAAAAAAAA/v8BAPz/AwADAP7/AAAAAAAAAAAAAAMA/P8AAPv/AAADAAUA/P8A
+AAMA/v8BAP3/AgABAAEABAACAP//AwD//wMA/P8BAAQA/v/+/wMA/v8EAP//AAD9
+////AgD9//7//v8CAP///v8CAAEA/v8AAAUAAgD7//z/BAD9//v/AQD7/wQA//8A
+AAAAAQAAAAUA/v/+////AwACAPz//P/+/wIA/v8BAAEAAAAAAP7//v8CAPz/AwD9
+/wEAAQAFAP//+P8AAAEA/P///wIAAwD9/wEAAAD8////+v8AAAEAAAACAP////8D
+AP7/AwD//wAAAAADAAEABAD/////AQAFAAMAAQD+/wEA/v////v/AQAAAAIAAgD/
+/wAA/f8CAP7/AQABAP7/AQD+/wEAAgD8/wMA/v8DAP7/AAABAAEA//8AAAAAAQAB
+AP//AgAEAAAA/v/+/wEA//8CAAIABAACAAAAAgD///////8BAP//BAAAAAEA/v8B
+AP3////+//////8AAAEAAgD9//7//f8CAPz/AQD+/wIAAQAAAAMAAgAAAP3//f/+
+////AgADAAIAAAD+//3/AAACAP///v/+/wAA+/8CAP//AAD9/wAA+/8BAAAAAgD/
+/wIAAQADAAEAAQD9////BAAAAAUAAQD//wQAAAAAAAMAAQACAAEA///+//3/BAAF
+AP7/AAACAP7////7/wIAAQADAAUAAAABAP3/AwD+/wIA//8AAAUA///+//z///8F
+AAQA/P/9/wAAAQD9//z//P8CAAEABAAAAAAA/v8EAP///v8AAPz/AAD//wIAAQAC
+AAQA/v/+/wMA//////3//P8BAP7//P8CAAAAAwD+/wEAAQACAAEA/v8DAAIAAQAE
+AP7////+/wEAAQACAPz//v8CAP/////7/wIA//8CAP///P//////AwD+/wQABgAA
+APv/AgAAAAQA/f8CAAEAAAD//wEAAAD/////AAACAAAA/P///wIA/v//////AQD+
+//7//f8AAAIA/v8AAAIA/v8BAP//AAAAAP//AQACAP//AAD9//7/AAACAAIA/P8C
+AAQAAgACAAEAAgD9/wMA//8AAP///f///wMA/v/8/wEA/f8CAAUAAAADAAMAAgD+
+//7/AQAAAAAA/f8EAAIA/f8AAP7/AQAAAAMABAAAAAYA//8AAP7/BAD//wIA/f8A
+AAEAAQACAP///v////7//v/8//v//v/9/wMAAgACAAEAAQD8/wEAAgACAAAAAwD9
+/wAAAQAAAP3////////////+////AAACAPz/AAABAAEAAAABAAIABAADAP////8D
+AAAAAgD8/wEAAQABAP3/AQD9//7/AQAAAAEABQD+/wUAAQAEAAQAAgABAAUA/v8A
+AAEABgAAAP7/+v8BAP3//v/+/wIAAgAAAP///P8CAP///////wUA/f///wQA/P8E
+AAIA/v8BAAMA///9//7/AAAAAP3/AgD//wAAAAAEAAAA//8AAP7/AQAAAAAAAAAC
+AAAAAgAAAAAA/f8AAP3/AAACAP7/AAABAAQA+//+//3/+/8EAP7/AgABAP3/AgD+
+/wEAAAAAAAEA/////wAAAQABAP//AQADAP//AAADAP//AQAAAPv/AQD9/wIAAgAE
+AAIAAAAAAP7//v///wcAAQABAAEAAwAAAAUAAQABAAMA/P8BAP7/AwD//wAAAAAA
+AP3/AwACAAEA/f/9//3/AwABAAAAAwAAAAEAAgAEAP7///8CAPv///8AAAMAAAD8
+//3/BAADAAAABAD8/wIAAAAEAPz//v8BAAAAAAABAAEA///+/wIA/f8DAP3/AQD/
+//7/AAACAAMAAAADAP7/AwAAAP//+//9//3/AAD7/wEAAgABAP/////9/wAA/P8D
+AP//AQD8/wIABQAFAP7/AQABAAAAAQAGAP//AQD9/wEAAwAEAP///f8AAAEA//8B
+AP////8AAAEA///+//3/AwD9//z/AQD8/wEAAQADAP//AQADAAEAAQD9//7///8C
+AP7/BQABAAIA/v8GAAAAAAD//wMAAQD//wAA//8BAAAA/v/+//7/AgD9//v/AAAD
+AAEAAgABAAEA//8AAAIAAQD///3///8BAP///v8AAP7/BQADAAEA//8CAAAA///6
+/wEAAwACAAIAAgD//////f8AAAEAAQD9/wQA/f8DAAIAAAD//wMAAAABAP//AwAD
+AAIAAgACAAIA+/8AAP//AQD+/wAA/f/7/wIABQACAP7/BwD//wIA/v8FAAAA/f8B
+AP//AQD//wMAAAD8/wAA/P8AAAIAAQAAAP7//v8AAAEA/f///wIAAwD//wEA/P8D
+AAIAAgAEAAMABAD///z/AwACAAEA/v8AAAMAAAAAAAAAAwABAAMAAwABAP//AwAF
+AP//AgD+//////8BAP7////6/wMA//8EAAIA/////wQA/v/9/wAAAQD//wMAAQAC
+AP7/AgD//wEAAQD9//z//v8CAAEAAAD//wYA/f8EAAQAAAACAAAA/f8CAAAA/f8A
+AAEA///8/wEAAAADAP3/BAADAP7/AAAAAP7/AQAAAP////8CAAIA//8CAAAA/v/9
+//3//v8AAP3//v8BAAAA//8BAAEAAAAAAP3/AAABAAMA/v8AAPz/AAD9/////P8F
+AAEAAAACAAAABQACAAEAAQACAAIAAQD+/wIA/v///wIAAwD8/wMAAAD//wAAAQD9
+/wMAAAAFAAIABAABAP//BAABAAYA///+//z/AAAAAAIAAgD9/wAABQAAAAAAAgD8
+/wIA//8CAAIAAQD//wEA//8CAAAAAQD9/wAA//8FAAQAAQD8//z////7/wIAAQD+
+////AgADAAAAAgD9//3///8AAP///f//////AwD//wIAAAACAAIA/f/9/wAA//8A
+AAAABAAFAAUAAQD+/wIABAD9//3/AAAAAAAAAQACAP/////8/wEAAgABAP///f8C
+AAAAAAABAP//AAABAAMA///9/wMA/v/9/wAAAAADAAMAAgABAAEAAgADAAAAAQAB
+AP//AQABAAEAAgAEAAEAAAABAAcA/f8AAP3////9/wIAAgABAAIAAgAAAAMAAQAA
+AP3//f////3/AAABAP7////+/wAAAAABAAMAAAAAAAEA/v8FAAMAAAD///7/AgAD
+AAIA/f/+/wIAAQACAAMA/v8AAPv///8CAP7/AQD8//7/AQD//wEA///8/////f8B
+APz/AQAAAP//AQACAAEA/////wAA/f8DAP3///8AAAcA/v8BAAIAAQADAAEA/v/+
+//7/AQAEAAMAAQACAPv/BQAEAAEAAQD+/wAAAAD9//7/AAABAP7//////wIAAQAA
+AP///f/8//3//v/9/wAA/P8AAAAAAAD9////AQABAAQAAQACAAAA/f8CAP//AgAA
+AP3/AgACAP3///8CAAAABQABAAEA///9/wEAAAD+/wEAAAADAP//AAD8/wAA///+
+/wAAAQAEAAAA/f8BAAEAAgABAAAA///8/wQA/v8DAP3/AgD///////8EAAIAAwAA
+AP//AgD//wEA/P8BAAAAAAD+/wEA/v/9//3//////wIAAAD//wMAAQADAP7///8A
+AP////8AAAEA//8CAAAAAgAAAPz/BgD//wEA/f8CAP/////+/wMA/////wEAAQAB
+AP7/AAAGAAAA+f8AAP////8DAPz/AwD+/////f/9/wEAAAABAP3////+/wEA/v8A
+AAMA//8BAPv/AAACAAAA/////wEA///9/wEAAQD/////AgABAAIA/P/+/wIABAD+
+//v//v8DAAAA//8CAP3/AQAEAAAA/v/+/wAA/f///wUABAAAAPz/AQABAP7/AQAA
+AP//AwADAAAAAAD+//////8CAP///f/+/wIAAgAAAP3//v/+/wEAAQAFAP///v/+
+/wEA///9/wIAAAADAP//AAADAP///v////3//f/8////BAAAAAEAAAAAAAIA/v8B
+AAQAAAAAAP7//P8AAP3/BAD9/wIAAAAAAP/////+/wAA//8BAAMAAgD+/wAAAAAB
+AAAAAAD+//3/AgAAAAEABAD5/wAAAAACAAEAAgD//wUAAAABAP//AQACAAEA//8D
+AP7/AgAAAP//AQABAAAA//8FAAAA/v8AAP7/AAABAPz//f/+/wAAAgABAAEAAgD+
+/wAAAgAEAAAAAQACAP//AQD9//3/AgABAAIA/v/8//7//v///wEA/v///wIAAQAA
+AAIABAD//wAABQD///3/AAAEAAIAAwADAP////8DAAAAAAABAP//AQD//wEA//8A
+AAAAAAADAP3/AQD//wMA/v/8////AgAAAP7/AgABAAMAAgACAAAAAAD+////AAD/
+////AwD9/wIAAQD//wMA/v///////v8FAAEA/v8CAAMAAAAFAP//AAADAAIAAgD9
+/wAABAAAAPz/AQAAAP//AQACAPv/BQD9/wEA/v/8//3/AQAAAAEA///8//3//P//
+//z/AgADAP///f/+/wMAAAADAP//AAD///7/AAABAAQAAQD8/wIAAAAAAAIA////
+//3/AwACAAIAAQD/////AQD9/wEABgAEAAEA/v///wEAAgABAAIA/f8DAAUA//8A
+AP3/AAADAAAAAAABAAEAAAADAAEAAgD+////AQD8/wMAAQD9//7/AgD//wAA//8D
+AAAABAD9/////v8AAP7/BAACAAAAAgAAAP3///8AAAEA/////////v/7//3/AAD/
+/wAA/////wMAAQD+/wMAAAAAAAAA/v8AAP//AwAAAAAAAAD//wEAAQD//wEA/P8C
+AAAAAQD//wAA/f/+/wIABQAAAAAAAAAAAP3///8BAP7//f8AAAMA//////z//v/9
+//7/AgACAAIA/v8BAAAABAD8//3//f8AAP///////wAA//8AAAQAAgD9/wIAAQD9
+////AgD9/wEAAwD8/wIAAgABAAEAAgADAAIAAgD+/wMA//8BAPr///8BAAAA/P8A
+APz//P8BAAMA/f8AAP3/AwAAAPv/AQAFAAEAAQAAAAAABAD+////AAD+//3//v/9
+/wIAAQAAAP7/AAAFAP//////////BAD//wEA///9/wEA/f8CAAAA//8DAP//AgAB
+AP7/AAAAAAIAAwAFAAIA/v8DAAMA/v8GAAMAAQAFAPz//v/+//3/AgACAAAA//8C
+AP3/AgAAAAAAAwD+/wQAAQAAAP//AAACAAAA///+/////P8AAAEAAwABAAIAAgD/
+/wEAAQD9/wAA+f8AAAAA///8/wAA/f///wUABAACAAIAAAAFAP//AQAGAP7/AAD9
+//3//v////7/AAD//wEA/v/6/wAA/P/+/////v8CAAIAAAAFAAEA//8CAAAA/v/7
+/wEA//8AAP//AgD///7//v///wEAAAD//wQAAgD9/wMA/v8AAAIAAgD+/wAA/f8C
+AP7/AgAFAAIA/v8BAAIAAgACAAMAAQD6/wEAAwD6//7/AgD//wEAAQADAP3/AQAA
+AAEAAwD6/wAA/f8BAAMA+v8FAAEA/v/+///////8//7/AAAAAP7/AAD+/wEAAAD8
+//7/AwAAAPz//v/+/wIAAAACAAQAAAD+//3/AgAAAAEAAgAAAP//AwD+/wQA//8D
+AAIABQD7/////f8CAP3/AQAAAPz/AQAAAP7/BAACAAAA/////wAA/v8CAAIAAQAB
+AP////8DAPz/AwD8////AgAAAAIA/f8BAAEAAwD//wEAAgAEAAEA/v8AAAMA///+
+/wAAAgD+/wAA/v8AAAQAAAD//////v8AAAAAAgD+/wQAAAABAP3///8BAPv//v8B
+AAIAAAAAAP//AAD//wIAAwD//wAA/f8CAAEA/v8BAAMAAgD7/wEABAAEAAMAAAAA
+AP7/AQD7/wQAAAD9/wQABQD+/wIA/f/9/wMA/v/+////AAD+/wAAAgADAP///v8A
+AAQA/P8BAP3/AAACAAAAAwD/////AAD//wMAAQABAP//AQD9/wIAAAD/////AgD/
+/wQAAAD//wIAAQAEAAIA/////wMA//8AAAMA//8BAAAABQD+/wMAAQD+/////v//
+////AAAEAPz/AgACAP7/AAADAAAA//8CAP7//v////3/AAAAAAUAAwABAAAAAwD+
+/wIA//////7/AQABAAEAAAAAAAEA//8CAAAAAAAAAP3/AQD+/wIAAwD8/////f8B
+AAIAAQD///3/AwADAAMA///+/wAA/f8FAAMAAAABAAEA///8/////v8CAP///f/+
+//7//f8AAAAAAAADAP7/AQD//wAAAAD//wMAAQAAAP7///8BAAMAAQACAPz/AQD8
+//7/AAD//////f8BAAAA/f/7/wAA//8AAP//AQABAAAA/v/9/wAA//8CAP7/AwD9
+/wAAAQAAAAAA/////wAA//8AAP///P8FAAUAAgADAAEAAAABAP///f8CAAEAAwAA
+APr/AgD///7/BAD9/wEAAgACAP7/BQABAP7/AAD+/wAAAgABAAIA/f/+/wIA////
+/wEAAAD//wEA/P/8//7/AwAAAAIABAAAAAIA//8BAAEAAAD+/////f///wAAAgAB
+AAIAAAD//wEAAgD+/wIAAAABAAAAAAD//wAABQAAAP////8CAAIA/v8CAPv/BwAB
+AP7//v/+//7/AQABAP3/BQADAAAAAAD//wAAAQACAAMA/v/+/wMAAgAAAAIABAD+
+/wQA/f8CAAMA/v/9////BgAAAP//AAD8/wAAAAAEAAEAAQD8/wEABAABAAMA//8B
+AAQAAwACAP7/BQAAAAIAAgAEAAAAAAD+/wIAAQD///v//f/+/////v8CAAIA+/8F
+AAIAAwD+/wIAAAADAAAA/f8AAAMA///8//3/AQADAAMAAAD9/wAA/v8AAAIAAAAB
+AAAAAAABAAEA///8/////f8BAP//BAAAAAEA/P8AAAAA//8EAP//AAD//wUA/v8A
+AP//AgABAP7///8FAP//AAAAAAAAAAAAAAIA/v8AAP3/AAD///7///8DAPr//f/9
+/wYAAQAAAAIAAQAAAAEAAQADAAEA/f8EAP//AQACAP3/AAABAAIAAAD+/wAA////
+//n/BQAAAP3/AwAAAAEA//8CAAAA/v///wAAAQAAAAEAAgACAAEAAQAAAAAAAgAF
+AAEAAQAAAAMA/v8CAAIAAwD7/////f/9//3//////wEAAAD8////AgD///7/AAD+
+/wEA6bPwKnb1eCTx5vT1Y+jbN3pRjuL3/79j
+-----END PRIVATE KEY-----
diff --git a/certs/frodokem/frodokem976-req.der b/certs/frodokem/frodokem976-req.der
new file mode 100644
index 0000000000000000000000000000000000000000..6319eaba8a7685d4758bfbf255605ba0d6f9714a
GIT binary patch
literal 15859
zcmV<PJq*Gyf<5mrf<2W20RS**F$*vW1_M<D1``5RQ!x-Q4h92N1PBZVO>b^=VQyhD
z5HJn~162eE3<pAQdSz{4ZZQxr4h92N1PTlXcW-QFQ&UVa4KND^162eI3<OkVb96Bk
zFcSs?RRjYJ3`TNqWN%AFO)WV$HZX!cAutLC2q=M!aRLGd0Rw_P5dfA&(mPO}OVsZG
z>nr}@=gyJaNh92Cz%^m6l2(|gl_peEQzQjHFXW)#tlX>ltLUs_Oc|E3{LtA_>l8&^
zvZ=Wt$I7w=k}#S}4ddgcj1u?%=Su_dpUwiq-clo2iheG$(8E}Ek_>TFlW3Nbf|!(1
zx74<Ovk!S%9f=sHkpC6+yXp3VmqrOJla7SsXmqXg^zM==@;F=Fh)S~hN{ooQ<Eux$
zCfKaPNT0F(?xk1KfG9HvWGI-ca_XzP4dXo_o!w;peBU{1UUXC!2;jxeG2LwN6^wvg
z=IpQNM-jCcI<{&c9iYb1I&K))dUc^5anR`<k?71Hhk^5sTk-xc1hidGX98TD%?B$~
z&fD`LDL@NB@?w0|)$UZCJOZMp@(!?0D99TZeWJQg1B?x3?U9jmdwP`XhFy+`Zvy^F
zij4%*2FXESx4>_DUH@YF>mB^j?L#$mGAwXkyi(+J<Q9$fpF9_YA#@Il;r{^&BNlye
zOYf%TPU*Qn<U=EN12cHZa>_^)qebfZUSi(dfR7l}je^KsX~1uaXyN{nNC_oglQbTq
z4NZdh6hMNDQ2Q{hw0d)a7slgB59lW-OT}ydx|@YVCQ+boG%AC&WIi-@&i7CIWS~D{
z|9pfzp1_bh;Ub=aThU8Lj^W^SUcbcwI!{)9OD=TU_F&0Zy#9c&%n8tJ4Ryq)i2fyM
z+e*%F&zP0_152W_hIuX%hTMUx!y^@I-N}JC>Vkq#B!dXhr0`l))_YOeEMH<T>oyd(
zb&kuf#dh34@$IgC4*r6z+~dQpt+>I_#z+0A6MRFIuL>G}L*#?2hc>qd%E*kHOx!5C
z8Y!{=Nz)ESwp=Exe(j%Xx+?OR^DfNMK1@z6+Dm6@ttB`n!YGw>{Gdi)F{DSL;N5`=
zdQaV_vO=t>=_qwd4$Lc9+Tvkpbl~CvwM7&V=+zW8WER{>*;__#+Ch^<8h4A%{WM0`
z70|q*&X;-K=m}&RvM)ekpv4s}Zzz`S&t&Eoy8p@*d94>N+2CQ8r;s~0bJ;a&t2Wke
zMBfyEG#eu^|K_%yt(n?Pxf(>7W6kphJ7dq_xt#m+A&Q8CZCNNLQSqaijK)@bc}SAO
z$e1`vv-n=|-&viuobRZKbAIO%$zU24L1iyvm&j36nBx3%#r~1#)ttsj1798nh2@aG
ztO4A&dlyV4Px;u;Zq7DKI58$ycyElPk$d3~-23=pC4KbBv<5ouq}quZOD^^Oi*Abf
zuIVYtoVUjZoa=*|mt-+H8obxQ;;PFoh!5Tb1O(3;DkFht4sA_jIz~`MO?fpbt{Epm
z)}UAqb)yf)I(&0zlI>vI2ke<5Lo#~NM=!3A$CEfeDcPx;d3l3BN+HxRzK_7;$5S9M
z6Wfz;^-i+ayYAUfs$>`~$;ydw{wa&fQV3O&vTr(rAWnFM+@07-&X=Gd3T>67@kSFK
zOhY#sf@OYJR>{55=*qeB?SD(TPgjy-)6`|r&JX)>0|Sp1H{6>G6v^_8=`V+>{pyqI
z<Eh+#q)qM8*igBb>;o63>!cF&>{rQJ$@)Om#vw3B%=L_Xc0=T01`&t;Ze<C~Lj`VS
zXE{C)SNN#Wccwzr)XN_RC5S(6Ww9aP1x67w3ew(k$2!#yxRV4Q-%N)4ug=KvAp3X5
zL6*#=^O4K*Vq={zbpq=P``_yFQJp^+k@C7|I-^!+_On*QeB1e}BghY}eR?V{>~i=R
zBt~f~_M6&i#Elk8NBL2u;MEKKjUd?aeJi+^tJ^qa-}49GX*|FQ(lZmd;nClNz=_FO
zmb*CUDrZ!fqA$VMIS@WIuat>Jq-w4~BF6jf<AFv^QWiEO*nRkI)#OpaS}@0o?Z}By
zFweMq>Mxt*9j;^M$p27Fw{<GZp<eBb%Jb%?4jKAM^<X~*?8QjzwQoXoF~V{Nv|Vf8
z`w78>I#ujQJd!1oc?=d96-yl)8NxJnk<uw!Dur=x>6G*SoX#2}>H1sA#a1yFq;_@J
zci9NjVRgU8HedAy7|@EG)EyJQEFq5actgGo8D^{2$P+?x?s-{-hKR8|4cOf}g{u-Y
zLQ|(1)po9HJqDSVKxLi_^OTJbfDhCC?QjGslx4(-BxXvgYQvxJY}>VE;N5>W6mZcm
zA)sFgd{Dl=dRu9^N#e^Oq7*F=7$qaB8BFI8f<UkY9+J_k7GR_P-h~r)Rg$xC{M{?i
z8!AhQY@iS<MrP8xDI7f02CdbrY3~?!Plm^=4XJ`$JiBwwy*P4`H&tAeaGVz-T)Wdy
zQtP_iFNa6L7~KjzMBt+TG1IZ1xi2!wMrar9!)TkpA(B#M?KLMfR69A<cAXWWu%@$U
zStxV6LWYEN1<Z?0m%?L1=^v$w!cvCgv?T){?grFH*&2guQb5dw9o1Wj2|P@?a7J49
zATS6H>=A4Grx15`N=Q{p>@V|nAEjp6m_hHHZTteF(}Kw$tw|BgURjzHmUp<y=e_fM
zEf23a|Lb+QBC)8@JK_vFTca5%E!^D6x-%qh+{m7&3=ndI`u1rELt-8(Y&=Grr~&lg
z<bC+nylBsZr7)fFwDYxs{S+wChY1JfKC60EehB4ak@ge113l@PH|$aiM~NN*XJ(kI
zm>RQ{?=4{&OW!|bYW|?qtD7XM6h3Tibi+G{r{orthW8Nv8Iwgm7C8v_bJ`=hSU>QA
zg0DbxNBiEDjFgaj!vu(&7Ygv84Z=W0<zq<SjnfvTuKZQ2-sQ})I}$cs^Wj%5QA|K7
zo8R$b<#vK`Jw#r$jjzaq4D-3)%Ckc=KHXe%w23e8t`A|^rq8%3TD|_2bQs)nHtxU5
zNbl;N;cqg+y9z9yB$p+~qS+`g5vQ?O#z{{Xkl}8GTjPNs-;;!sORccKQCaFD1xG#C
zPFNV5=2&#Ebb?tTTz<jcG`@s~{CYyrA((|0!K?AhyvY(9qzHW?X2w%%>S}t$*VNVg
zq%1qr<Q5z|ZNxp;GVlL#WnAN{_qtV^K)%d#FO*L3Yz?oV_mE?@W=KcyS#Z8T)v{GH
z)9H4G==TP*wm(j<IHu%7VG)(8VISI8MCv>x=B|^&z1=~Lq*tUTthJqnqPuNQDjH7$
z_6LWIu-r8sB-47+YQj>zWe=Zr4#7;sLR{OTu0XoFDZ&17CPdRrE{D1lzzJ$OX3G=9
z8m)6xfQi^HK$!9&2&go}K)(Cs`i3b?Dp-Tn9o006f0u-|;SfDA&05bty7jz5)(@AD
zJ3H9tx(GPG4VS*hO(-GuxUA7NK%5my7oN(n6lj24AIL_?w~N)L4;na)6VN)6n-Qcz
zH21w2o~{OcU<^J;p#=3XeA=&^#^1ZiA7Fo4gv^-14$s_ZRv+Q;gQ?+cFrcxs_b_1x
z-N|`Zj$xlUNpYYC$AhHvrU_BgQKmv7yNTjS<A(^#Kc{cKm~N8vSl)1miko-$h5z*(
zSN+7~S4@G%_M*en%?&r2<XX?c6ytQiLT|3GGqVtFhC(v`J9X0k>kVQWNZ=I4^|PWm
zkXcp*2$!!(A&~FEcx}coQhvQ->2=J0Xh~<<Uv(Qm6N`ETN<-FlG1~{s$SY$~;{fLS
zW3GX#I50H$b38=V(c>Bn0UV?NrsAvDr;;w(MDz7M8xU@C7FeR_;N%s@5umE%|9<mU
zT*FA`{L2N=Vc8DN2C1Wtr(q_#u(i!6K@WPu=844q8MGsqWzyUgr4i9`kzI3{roil$
zRB0+(D+bK~C2Pf-26lKm)|oy<BcY_~_yn=Awrd!mHR;HPN-MPtT4(cWyx&q4(9EAQ
zoZYN?VWUOa_l#^;nWu{{*9V52(sTW|M>sWo!))c)W`w-@Azw_+5fRN{AQ_K2mSSID
z=WF!4JSx!M?|LCUp>OD0M`{I{Tcl)U)b%#+&G0ol^^sn81}U|I?bNhIa|S@@JuxTj
z5G)G?3f%I_;W&X+79ieRL^zlko{^!g3G(q)357qK+AX9wA0%*~mOFB4O;(}LD>RhA
ziacbS{UKe2Wa92aD@XF2ZAeq~y`iF4JZ|2mxkllISqF!QmEG>0EXI)XR(i`x^Cia@
z%jW#An5~WO-q<vIrmf5ZRq8z^Yy2(3JCBE+uI^E?s7tU+Tc~BvCU(aWArojr+w$el
z%<hvGVd>G+RFkCUNpJv+!z8%zf~v(7SqooktB0(j_NVQvQ+?bfz52BR2nhsSpOhHm
z<>JN9ql<wfr-StsTF2*KX8?2ggjU2B*zd)cLnaDg-U;wNp}WdgQ#xK?T@=<u%#xwi
zZj}ed{ElJ_uhsyER3v-u+cmzclU<}?mV3XF`a){njnf>w+3@dWVqi?-g_y9`S$mQZ
zP1O+oOu#Z5$D9q)Vo!maG6Alc&#boN4_r@;c5Xv_OF@{PXD^K_DKbj{mG)Hcmy=U%
zA17$lwPee0u@oo;K15MxuSfd*ljsw4b#a~DP6c<lXFw`2su5vh5wVEU#!pg$dHh-8
zM5a`#1vurT4GG|ph1L)u)KlL8x%qPP(R&zLEK;2MO&{U4@5d~<JY@~VBnqXovPS31
z`_%%)_!9Y0)qykByIrO00)1lNiBW2i62`W*ukWSL>LGhUY{nW(tBNC=kgI>%^VxRI
zM_KI<17&N9w-c2mRsG;1T1{<hyDrGSkP?Xl3-`iC5Hx!ZTS-R4wD)DW%6wO9r_Y2T
zNK7k|qNp|VAF7h@o9bvHvKrPHNFl_>pkav$hw3;U9>y|8nKY)If!{I)OS~qrw*wd<
zT$a3Qbs=OR#T|_8J%^Z9EKh8mL^3PW^pC0jw#cV^h|QBT=>@kY5l{Fe{;%T>-J%6}
zDwL}?DBM!;16PpV4*o`;pl`xXR4Nx>Qz}PQ`^_A)aB-xq(^aqRSz94mRyKV+RqnIT
zlZVqU<}E`!Z<e$6j{ek$o*)>U5cv#*8t1MhTbGEt{n+l~4kmH>4A-JaMa?%h4B!)1
zSNl*NLuDQCODLNrN(oG&=Aou9`JlrZWwyPQcN2*|sirpG+<*0Ym3fl&>-Pm5jr42s
z65O}Hi!!4MYJP!g2c9XqzOKm>;jOd}FM@8&_1MyaCXj;C)=LG3Pm7WA*GcN3G~|7n
zWOb&bCfIBcuDqmVx<sV$u#^!(bz&X^u_46*+;E2FUftmDpZEP3xzOlF&9(M9)h6S>
z-U(dFY`0G|(1E)OXkYQ0n&zFFG!gQZ5=!L-N2j0s^DlCqZB^?>@zuT)UR@gYN5-9X
zAMW-dx0Y98HT0JVp4d}R51)mgfe}lm+a?0nWB#cyeP-v7Dd*gteLvV)j_77yA~`fb
z!o7M%(ApvB8t^d@>zZYfz6$$+R3d~|g##r`npNnC-UUwB+%P5Rw)>kTP8{Y?!|Sp+
z{Gzjg{<;Mfs`=H7Ndek}+J2G7JI3pAy;a1D>5v!u{OhtJ7)_yC2v2VCQV#KD-Ujgz
zMLM|l7Ust_9M`S7R^S3iBjft`e0=%l_URJIP)B5uqYRAT`wc*;gxHxa2@l5Jzef~&
zwM<YLxic@wvhN$?Uf^FdK`pT+Wr;L~TyHv7XdiM>@h(RmROjAoT6@^`;viUvN%-b7
zD!y&o!VFE`Vo~dzM2krA`-#Q<f(tSC!c(cacIQS{<onaqnjPxMj?6ZvRB}e8Hm{QF
zB@ik8nD@<fqcp2LX*}QYbse_?Vl{l^q-|{1Ev|(84F_90xO3o;;1`R`xCfy&?Y^%m
zihuE~gJsJpltE7>Xx{1rMI<GSrf64bdNyF_c@SWb@v1M?v0Vlswj?sywyIXk>W^6n
ziK?_{I0YM|gb`!uk{Wb~hCb~-7E_$}JbKg&siJ7;O3r4Y0pSZDt>G2Z1^9@D63I30
zd4`t%*@@?k%X92#6+h*DPQS!Dy-blfkngj-RAzBh$ivuLbiTRma7v+)8Hl_x8Tz$4
zJYoH#eEgmyS9LSGD!(#l)vp|{&k{bM5pX`QrP_`Vk-zSP1f~ohh6<tJYxj!+ZH=S!
zP<i}OCxAm~yBo+(*<SZJW!)x2uJB!@nD2Wfgats&j7Vu?BJHd^ygHBX?IMysltB4l
z6{J`CyK=iPNo2jOhs=~Q>V0Tg9V4-R<`p8K-HdFXPF84a+_pJmtX&Bes$0YvvW+(J
z+M!o`TlNk`1UrU)B(U)=8HIdl_gH)s*zUw`AjCk8v5v;{9x#9xkN%rHW6}N}R~_p1
z$r9^tgKmm(=1xg4!T_d5$1aRqk$H?(!82>xh)rHEgEduutK)MsRAN8hOKYshfIo%z
zmO!)(VgX0-yhm;9)3+Et-iPJ%=0xoX?n8m<13;BliOUzC+-<-v1zccN@<0}~2Cba=
zPs8QRZ!GwTR_+P9=T8V`nN;gVa}Q}17i4=|g-IzpL=Xd^?a|$m(8Bu5{Oi=E+~9`L
zUL96YCC;zN=vrr5*WYQbKv*SViGo<e#$(a|iOK~&PsU9*^B=x-B|K44_b?^S>VhL3
z+LfnRlYw?$TDm-I7sBAIN>(<860rV`s6_U*-daBB6a;a-G>bW9a_We))^{2C=`s!n
zXZ`Uc8+vsH6gmb*ZEl74<jEduH@$Vo?z*@C2<5bnr;7s84}*kk5c3}z6;d!u%Yhg-
z)TA8twhZT588#TK3ww?&YOzJvS!3u_1>tPk;F&Uu%p_r@hRGb9FR8>qavhc6;(IAo
zH;(2cr281-FrXV%y-L?cLSmzkbw=-t<NlSk!Kh(J?ey~tFxeIk8X31phu?9raj&m%
z@YdzQl2`<Z^lE{sNSuq$5S#R~!kG^Um;Xg)7})a7Zp^U$G9^6-wK(tMHuph5fsacm
z!B}JY2I7pNa;LsUk8R}T`An~M_4(gB_siOv+5EOMy3mN3Y3h#A+sM=0uE3uyRPB+H
znD~5(DKY__Br}e8gMA<y=ByC=dQOZNTh)6O=GQ-}e)H3db<>w4dSNHKVfTy;9&p=|
zm=29==G|Pkx^mvT)7^7%)U#7sdcS`*k1T3dnKdPGsk)F9(WTYVYn_k=w$EzR5BRoK
z?44|@4+7BbFl!iUcNv(!hJ@N`4Ib>!6{+c<_ao4DK4No@STV&WS&(%Br}c!kz-F8z
zmNeeH_~f<bZ!EAz+O~j)O9?rA01(XR4<f`@MhSA3gz6{}%_T)Dq)h|6f_pSP_Lk7*
zDrLV!&Mri^+5s_W(L37$eCL*3s-uZC%CJw-!a1k!COZz}J<y)NEvMDVEyq^gOe+0B
zOcIz{$;J$H@d?A;mLawBib3|jVJxC1;aKu^be@rR;aZdUunUwB1Lq}+qvesj;<Y%X
zoNOcFUulQecA7s)mVN-eKjIoD=ZG}!H`Z}PA1$r}wDWYXQ|Byu0`t!W?C)t4mg(n<
zuWy_z`}8uda8em~ph+6I1E_?q7xh&-%%MY{ME;Za80Ghk(v6!S@b<?;ygIf{Jk9{T
z0mKbisa>v%f~B~&&sEqX5ZLi2U1}_-$yJaY_J<8pqI34=CmPWnEw20Ou9yYyDS6Gb
zU7?GqoWK=dV%t7S+(&B77+o8&$G}z@0P2z*z0<^1z;MaH?%^*IK($gZ39=3yKV@w_
zH!_y}Hf-`rp45L5DI%()A~CiHIWyG29M_P>VWLP4sfdOz;3)@QBrq|yfwa%htWdRa
zE69vk_uwIGAASUsTQnoQ{Zi=}<`jn+_+c`T*3Cg+!SSFqnMtBZE83K_#Tza`0*(Ct
zpzT6xD3rp4Mf$T$iQcZ|7-?jkoclCsT(Ly=lnr641<>kal4Xpe8FFI<Q-RkCjqjfz
z&*zYS%sCg>(cp~~yTG!PH1KQ|XXNvV%TUp`C&$DQBclu2VgS|4%Svv5i~3H*T({!h
zA<*%%08W`CGi7@JOLy4bbs}{$Lti$PL1iULr79J4H$fSW<X4xvrbZsjS=Im!`(ch2
z(YA?(RFV$B&K1AttsQ|3)~|ZO`JUwWB54yY8R-_aO3NZbOiSzwT@IEKvI>xLElGLv
zeMNcedm^mlNRtVRRwZCbJhz#L`XoN%?pb=m*&Aak!=msIFiJ+da<F)e9x$U=p?Z1B
z&-`GVCxksN(MrYwIOs{o^z8_T2cCD}hP)P8j2b$M{jS7&zPA(tq#<TC&PR;3nMD4`
zH5gz^tBK&mp{$C9e643QN=>2F7!RuNr@tH=U_9JJ_vM~%P>o!0Q&**|#br(;C6E14
zf}o#<vjT8rRwW`{R0Tc9HnG!xZo03g!1*&Gf8V9UPN1^a)`C~~f8A=%1BQf2D<@X8
zij7f;MMYGX8j=WN1*`D83!HtKoM9&Zdm>CrX{0($dVEif=3fl&6!9}kIzOfd4JwKJ
zzq7NG{h<f|<U+h2>s398sWkzjrTTu;`nGcM#>YsEr<KOL=>VMDW~F(Ldn%|i?OO_?
zy&KFJLX+usmf+>tqH(YjL@8OaK4^Gf(}SgS=8wB*O=)ct@$_ycAvWA~&e@ue5_PD;
z$CU1hees4d8v$;=tLo0jTI{N9L)OwUt+iy0BOiq%yP~y9`#O#f6OtocHVQlppWV{Z
zJEQa!d}t{!`2&~CsEABqJ9@I1fB!FBG8^e0L4PE*%+dYUdQc64UPC#69d`t`=zAj|
z4oW>Xwl&L*@<!ab{2iOAN*$6D`K6uuQgg6NNaEuUCAY+PSJyG5p+kj2m^foz7SoQ<
zSbBx~c9^W9&ySe00n&8KT9CIlko7c2Rk*FFOJ{u&>y2GLIG@rNt1y|yY+Tz3!`8~j
zDl+hGAfJL?a-F%OvCM@jcL#hPYcK&bcwzQQ_l0;S`_M=%mv7#bI#ZReM*=LM=QDmf
zh3^H=7=l`fFCxX?ZLu7W1Z-M7w&v;{K2iC!@XEd{BYWT&?AIMw6=%t^TPi9NMa=5|
zq@7EtZL<u`jqW}5@i8GX4VSSF0$~bNPG&~%m5wthdM%Z%x&YD<VWJ(8hLb}kXC}XA
z{QBpMe^lsqyLLED$FtU2hAjp8l24Z79=zsS9xtw6pMWYOR#zV?O?`m_QPvt>(b<90
z9!R5T$ng3{J@K8c_&Pv7oN1)lMX$%9x`;Y>Mi1IjG&eB<`SgbK33&>vQ2%=f8|x;a
z6AHiB%X)2Q5xH%2UA=)>0@?Ray0x$GUm1E?+CYlp$Mnx|lRz#B0;e?4usJ)76VI4>
z){FH#0S3~|P_(zgx`X(~cyz2=lx0Z7wL9gUHvU$VupkQ!uOVzny)|L_#D5rLGlIzK
z3~H)qF7nqMGrLjt;yH$EG8;wJ{GmiY>Bm<yZy(z$kc8P6{Y#9nChq12cl*YnK%Glc
zqxT^pbs>s&R*M?F=MuA+n-D<^5Ye8F^B>SAn`$6tj8=zOlV;hmL1tw{cJpFJdJTlF
z=@H1~Z3}IgVsE>+=FsLxEh>MzAFs=M$Jx>1GZX%Epsx2_Y(hBAJ*(PFcuV=ANQ~G*
zTzMCMuFBWuO~tn#D%L~t9=Nf!h>e`B?_z2r=qM1P1i;e_v@%#UW#~QD?Wfam+NsyK
z!a`6_(_3q@Np&}Dz`!=GHr_hOJVWT5-nv*AxW<M=G0?trxWF=!a#j`Dx>K428F;UJ
z5aer_0x$Qi$}<lveBUo4)BpgHO;W}YhxD0GFz^THxzsYaTQkWa{VVsxC5NT)(Awxs
z$LK<HDv0qpF+YlIrreiY>d;BGKIktUj2*@kjdiJ^lrD4S9^&v>SQfHhl)H!!YOiUx
z>wO`5|Ge}94fzgPH$*c>h+x&^AWZ;5y;s+Al`Ag*@OR$<jtq`;-U0|Tqesmft+)z;
zF3QVxj2v=ZCXdIZ_&0}kc6j+ywI;~h^AXVo)=qQG_S*+?K8qr0+~MW*@rs(KKS(|>
z)D?+t{juwDm56#eS!Y{L?w<un4<tZtLQMYY9PX0Q(cB;|bAyhiDGfGw>yJ+t;6<8{
z5}X3Wh;oxqYAe1!hKsCJCBIXL*P9s967J*8p7WdY18NtN;v%n8#8E_B?}+BZy2>rg
z!nuHjE>CKp%_S&YL_~g)_B6m|L=H@3eD?O3BBqaN%zfmyX}QI5b)vKc)P>Ow|MM@X
z8yItfAH>8fO9}--(h1aIttrVJ)qKuZLi2hdlTX^zXceK6k|Q0C=q?g0T){X>(DP`8
zt^Aqk&)bqE!t?$41b-i~I70=9my?5S>wWaGi8U~5Lh^)!0SEFhx=Zy*xs8wXocZkN
zzSCVunk;zeREdqS3l;9nlaL@Y<NS46;~5HkmUI<N7x1%>ilk2M_SEcZ*p74Od>z2p
z(UN?={xdr+t0Bv94|2&sT1iNeGXyT;nl{j^lqyLnM8Ys9N?UC~!KwC{tR*U4kBTv@
zmKQrn6gYx=I@6qe2M)5CxGRRl+Amf6MUuk_BHD{_Dhu)yC7d6L@rJQnM$CHlhL7V0
z?~2y|JJja3zStkVxW?MyD46~7{2i5S3Y9b~1)+&&wYrFO>ABEfw*gUC0ne^msxndv
zINUT&eg``X7r4Ao^^qEps>ERC1Faf-9S~r!uu=S=jX4t=OnMekAN_TTmarJMS9}Y)
zMyLiiB=W%+m46u1db+c9h#PV4p%3M<d@91rB_rljfLcvcs!9}2Tek`F8HGk;Qu1e9
z@VvW^vFH)bj{t>i92&8OXcvX8A~480o^MdTG^z7i*aT|q>JzOtmFxSS{N(b&p7SE9
zZ||64MO;?fRt^zmH;SG9D(GmE>|(8<3?!)_7ucCwvLp<ic2#BEu##ueIOsB!D<h^x
zrD2X=-FTrvaLE+gBStBzp~soyG$=s`Ipu8Ec-(QxZ;SJz5`7;SI=YbEk46%KdQsaZ
zEr#LU`PesM?hUeFuy5g77U5vagUVos>=V%>sxKFQ6;eG1(7E{Z0myGglo$~^{_^;H
zraTtO#?063_qhq|w6?H68DK^uKXSRi%HWxk4Yu;>vCT}lw(H*}$M8Qw#Wu_Bvo~9~
z7lVSay@<yr2&dBn>VZ#2v%UW+V>(J>2)8F#p%Vi@ZH+~+!t(%fjOx_PSn0bVF*Y0)
zc_<+plv!D>pWRM5DGQ4t?k`BEk$&=0W{`)sNxXP0;vE)#inAaUJj#z1ZEe=N8B(lT
zWEcC>H`SDG5B#gX<K0*z(laxX&un+WlNn=&=1-Ga{IFeG3-BJQ6gI@}LsblPA?oj*
zbc7Y2B(!xmTRz&2Tis4%Y57XKIQQ7FH~cs@?xBf(MLbEOUFX9oKp-ve$;M~1kQLE%
ziTwn+1?W=~({wofLk`B9UyrM~ECDyC=ud&Sa}^bEW}@E6>a>1`60CK3hYP(>CEY!#
z-~1<Rq>^vRe(LYqND4$|$?F}OWoFeXb5l_hRyvKQ&#s2~QLD6PHFuJ@7!$k&hR(*l
z=?uCOPrU*&jE$yCcH=o-Sm{N@!(bfy`+nmVfKC!Q{txz2gWvk(Hlhgf6y=l|6$Pw#
zX~l%W2hA6&{zhm*$>yk8K|xCswxb}aIrxvE{-`|@yq4hx*k*FRq#IJ&ZO8<3;kUVP
zdvXXg&qZSSS_7u<6tib1G_5Succ0=xdC7V=lH5KerMaBMK(}ncy`H&UGFP$upc`?C
zd&m9LR9jC($*Z+a`dCI!15T2K{zO)45I=kJ<?-1jS%SfN&1BpdUVIhn16E0y+n~kz
zLd>oWmW6Z9+Zg^VBqcix7k|X!iPH0pH>}k1XzVgX%;11BmuIUjhz?dVIjJ?1Vd9vg
zcCC7#ExRP(lFSdbmo;jGNC}^4QY;nC-%ZzO^^m_T6hL|@jl(D~?Wv+&hdA1P2{h3P
zj{E`rQY*X1Z<nzIHQa2d(esqt@^EJ$*1~(H@Vchuf*_UIa~U+?D*ld;eB{(xGlki9
zQnJx|9|3m*v(go+>dPGU&g4Qg%tpEx^bN6B|AuSDT437MKN=1Lt?32(Z~qUhVpnah
z<L0c>gx*R2Z$TR5?m(LL(gX}ewkw=-Ty%do=9O3dx&;+`cm9SzxP@LkGE6qn&F`85
z&2Jr(Zzv*v+ggg{bl1&I%j9!>a%+4rq8Q&HBUML^_I2dW8dj|!v+xzu)5I;X@vyI6
z0&hXKs2ULW)%>JV`jQEv5>~)z0~wG~*!Vt-(KXFhfAomY2H*W1FS`f(&7>)>zc&j5
z09L>r9MOX?MOoV8ZteK$(oX?ra8jm^sK~qW{^Me)y(}P2P|%9fdU=sbO%hGD(>=2H
z!a~-dwDKK$w4uael^Rq_g&*SiAa#%rPi6Km^?4aLlL4^Vwz-SFg&{WHj@S_2M(Ngb
zV#62hZs2^%zY5}O_q_Nx1oq!Q0!gDNiz`%}eAzF_t2g^SfAhJ2BW><H$PbOaqs86u
zlwtR$qW(orDZ|Z#Krgy=p*x(#bE_iB(--$~n14fFGZvF)PJ+8%wKlPomT>XSz$C1>
zAhS8rbz=Tvz`;wrQ4wnOctg`8<)tldQM|~A<NBUuU44noO<p?$M=N>7gn|$QTLBo_
zM5M}^BEmY`GEW$_fI~*+Oh^)aLPK<|YR<-C2yoLoOjX#X`37y2e%Ax_fe}}%jzlN8
zyzL~)S2>txO<F_IQqWXe&6B()2qngX+l?r|jz?Pv!tZFEE`GBxIvc$En9$l0kDDJn
z3EQ-!&FgZF!y_8WgXpMBF)^}_q13gbuEA1mC1r?`BX*&9>5d6L!tU5SQp0zRD~E3R
zG0k@o{4$pI%bWil>iSq-y|(@5e-<)cif;zchnkh48<#J^)psMwo~ldJbWYIW_&Y$w
z6rWJj%Zqwivhnn9pyxr80P#wNZv`#wIG_{>b_W_ulTD%pHj8u`zel7A`JlyCOHd9v
z3Z#J&QbiFyE<(#z?*oAM1aSwomLj9!zXPCXA)H!H9;MTTlIcC9->skP9u$nGCY4)O
zYzz*%ZH%hzHIDkR8kmSt_S>w_hd+3IY=p!l@pbF&6U>WOisdrPFR$(v#rGg&)dfat
zXWI_Tg(>=Vx(2_J^f5fb?+2oib*+ZSo^h>0u9E)R!y@!sgsnbN_o4@2uP6H{w%7Hr
ziZKuNeiw855M;2RYJ!iOT!DTA{Ii924^*ymn!vQdtN&F<LUVi$1TjdNYV#?bL2Ak9
z90k$~Xyh{z0DO#`{+vOr1|K;`ByC`fB0`%l0ksk>vv#ulxQ_PU0V@+26LPMg8W_Az
zPcvv0_PMy3nwrJni*FSS=BV6?57bG)=NG#g_aM*F0?U!@knp9JOpYMA^~D~_!M%OZ
z8z^+Wk@m_eX5*5k^pL`#1V9`8sSI5~yq_%86iwe?)*_gEtJ|^-?YtfME2X7aa8X_L
zCMk{<eXiBUAG|M_=F9KhF9)9Np7=_FI<)d9>`QZ!e@GN4TB8Ar)V!UnzE{~jD2v+<
z+U4@F$V+AbQkIYp=!CAS5_^|<y8CGKDq|Tr^0;W9lfOP@e&07-hTY<|%fZrZQ|+6$
z=*N3aMb@SSyoB>SWPi`0v79{?v90mndWkda=$#DSPZ?T20oV-gI@1h-eF8EX;<$m<
zpvsY%5V;v60$qe>4ejVnwC{`!E<vMolzTW0=%E+}>kPV^@&9N<7D$O#e1l2dhw?Ck
zUK_I<w-l5Zztp<Jz}kZ*8u#UB+GkTUPe0+y1~5b=v+%AXYH#WUy`n|zKeEIXjh7Yh
ze3iyDh0XAK2xGEO*Vt7vW@G23uB(U%Q<50C6x{^On9M2adR}2e@E41*8QbPIP7n~P
zbM%<9wBlFD6nS7p@z!G{hqL(&Db!Wc-gwkj81uMwlvwj;Hi00Jg+Nxn^kX(Jfy!!t
zDlzHPhG9VNi!+xh3&m(;Wyy;GHyP=B9XuCR^}fYV*tu!M+0EO0*Y^r<j-f<nr1O!D
z^&wyn*R1t;Xbb7Q-_=3m9NVPdiewZywQ+AZm@;|?Hr34G*);$O_!2cO!;4&^dn=U;
zvZ5O5J}!xt4FBMW_cE6iuBTFN*xSCxrYNipeGa~+<zq}`_M7|g#4T%2)0pu@YHfxY
zxIVS=#*ABMy_^-1){yN)&;2#NVL^8@{%n55#Znxkfl;F<3Ltk@dUjJk_WY7G9!{07
zi7H$_^z5`|0`Sw9{&JKuqd~0{7`A}`J2iNQL09rZELIes%LzNKh(Znqe{S*+Yc`KA
z8kjvkZP$Wt(>}(8un{53CR97s=K6|xwBI8rkUv<)QZE{VpxtYmsDg|?=`^)Opbsfp
zn>{4ZB`>On{9)XFQYM~PcCEnfyF2H-cj%d$7fjt<Dh$sC#>W`YrsFV0J6owwIsFgl
zr2if{R^^A<UL>VEMj<#A?UZn#Y=J9Rk=|3?AhB;G3lS=faF&!P5%QB9v%2Cgl2@Rp
zL_>LD9D6&9V?(ms#BQRJ(tNnhHE8kx;xHdnX|`2jTpdS_LQn9jO2u`^^HFYIq%6+S
z`Mgaqu4>>qj+IeuU$KXm_SnAJJIwiPZ{`tq7nMcM@3OC_l{B6~x-qCncL>zP(5tz=
zg00X$R^%+^q}Y=|Gu=sezvI=@vhXZ39+Sp~r3SC>UhWh++w@w_=L&0Dc3I<D(r$VC
z3Hl6!(i1*jmHjb8uFJ6;-RYc#Z=Kx?DLl2WaKZ%Vz9TiJ`j~DXykH^eY~mOF(J*sW
zu<eTQzk)7lF2ijQcZA?F%2!$eA+O&xtBXiTd%8zX8;HJ+{Sz0V=c{DId__%EuJ_+d
zQ5)pc_AFQjf#XDu${6gm;+iZr)Tpp@QGHW$N05;``{7J>5<KEckpJKfZ1URzCZRip
zCXfT(BC^YT2Nj!+v4pPr@><;HUo3TxR2t#ePb;K}I@?#*^UJ$}G%y$T!Ia_N8QtLN
zo1tG4wmB<4p5RF6E0(m6UV;b8EbI0;6fOZJ+()^P3f$^5O-d=T4eMkT1pMLVactN<
z<c#(r%sZ(6heYvUJl2-%xP`VQ6vs$ms3ew6K$rML<1}2%TLvF)ltfE#J;q^@8m6FT
zL7c%&i?k;OFQQ%ROZHdRcPrJ}kP&M0fV1lZOQGtSK0A@J3A)Seg*XaIPQp*`z<DNs
zRsx?z^iL3MFkIyx84{SHB%bDIzikYU&KTKra<j!OSnXsi+WTU?{FwFv@Bm}UTt$gr
zK<WZex9sJBID;y4_){OP40#_9l|>AtPN0N72vZk+1M=ZpSwcc9uRD{|{&vge{KcC@
zQ@UtEd})FzI}eP7`HJ;Lc?Zt}uuAgdIn;R?-TCQYc6R^K=T(8m=Dk#AK!M4f0ONdD
za(0_Bbe(8!O<b<l`4&xTw0#v@!u0<xOMv#M4>bLOBSTd+MjV2Dc^Wch&2h0iX><sz
zGp?ZyS6g%BG?Vswj0i%65~qavcCr(OR3^gT`vH1|W@<wknv|;>F&{e&lte?C-bAK6
zvm`F0Y5qDhEyXf;oY1&6u<1Njs?|4nrwdw*eizS6{bDmQjgXN)fahtYjr;2bM~gR|
z#jvg|=_|*|FfJQ|J1BgtayL;m#Bu1%G~aSTsf8;l2Qg(%${@3zRCsnbEje~-TxhTK
zL~jT}oW)@sdG65fp*3AXva9nhP-yj?^*T$6Vr}GGi0={d-Di<6a>j=p6__PBdsB>`
zZxDT|hmm^84{KNaUt{W4l39BA>qPB`J<ptc(luUpmX_yt?^Ge1Wlw?O9p1j#7pYhV
z^mn>(XgoxB#GaUm-h|EBIOwt_=6s@uvRoK`r$ovLq6bDR>$E2|_fMeJ|CUPG&brQ0
zbhf>-!dU3*fVhd}+wP@)yumxtV3RMgIjm@uiLEHg>gU((rDBacv?bsypMSKkK6_3Y
zax?<N&4A;;8rw7AynhX%-q{4omR7Dw`Xk16E63Az^xjuwtj&7pVDTp}VO<PVr<v3H
zh0KA}7z{2|UYoM7XGw|{(#ZTeKh67sfC_dBr;X_#K$zc-HhNVojG4dwD~)KLkO04u
ztsepYMPU|}vej?gMmQ_pS?!w)NTU>nGz&JUocC?sKcsGZLF&os$yD0U&OVo!8+><2
zq#4(oiAlhD*Bfnl7fn&Hgln$&0RGghMW7NrE`5j#m61pzVVP?UP|HVF$AY@dXus@l
zXVt)r75{gI!EJE#J$@RSGq1&pPHzk&N9yI_KK~Az0I=<I;pkYQg8i$^x1Qgr$)JdD
zMgLYN*CdZ<IQ5VMRS0AemL@<WbV#*ZXXZ<mOO~LF>G%g@OO&Rwnz<KYMC))I)o0Z<
zi$qu*tgnOalJ8b$oPRbw-Af}B#13fq-c;<8_qxi>of?<}lg5Pu$0|}IAeV(}7x>*r
zd*n(stFK#zvXfv5F){<tOy`(-HVjH>SS}ibu6-_?iRi=T=`V|IyDu~(sA)TL5KX#l
zt&*$b@oA@huRAn<%9n+x(Doe|{TY-WMC;X+*^aV&R*~?&csfaj^ZWa>nNFB)Y8@94
zST&41Jsxb$kMjI!PvCU7&Bo4E#R<znWBmy>iUMwpNUd?CHnYd-T7MUXRqZXtf+ywQ
z|NUQmh2!*zG=6N^4&h*k34sU0tx6aWRQ77E!c~L<0&piU)>fTI2$i$VA#1Ps)3OAm
zdVayF4(d$uI?rg&%Yzf|zQg*R!#Y$3J`Xk_L5iI~J+ye+-K`FlynvCM(*}5)yJSWi
z8swOpZXNFy+e=YEIQjt+=Q*n;{)Kdxs701GKj(DWou#LV35Yx3K<21PR{Wkfm2|bg
zpIf;fu!ZL9Z1`VtI5Kn;Qs6&P>EyjAlwbE;JpE>=qZUAuA?k*7;bBpB@CGchie)hF
zhL4k~<@g=iRB$|k@8m0Y(JB;~2+hv7s44^D-ZI$ueb%{ULZBkQlEo*J2^R?s`DN^2
ze_gFbSB7ZTZV00<BXF(lde!eA$&uV22?>$<SWrnmK|ffHgzC%0QLQ?#NCzFGvi}Jo
z%UO<jwpNOYoI_OkF<I`W61!XK0${EK_)e^_+D4hY?3+5}jMcN#(eS$R|DF{~|0#U0
z(TbY=z-Ed68S|-vA!G)-z{IUp5*36J$v$Sm@2T7Gti>=@1O1am38{FRw#N?h1EncL
zg_qpcu;}iS1v^{6w5q*`wn}!CB5_todA4i*x-O9czNgwchv+6u!i=M(5a$z<dwfog
ziv~j)R=TnDt~>awSz71^TsyS7LC7%xYyfAv$(yzIPz|YanI?eQ_7%~U$CY!`qZE?$
z8#4U{fKOJfXsCmB`QyFRZ>OImr-(V8e#Xt~ANc2YVQ#<=JG5g_H;^%qHJyyPdAF*@
zU@sQMYMgRvFVZ4i%Is%LRz%U8q|7?@s+r%+KjvPln$)^K3-B{X{uI9Xu`~xK_<Od<
z$)k$uB7iv&7?2PfNU-J<yeT)hs;<KUOUXV+x@$81E*&F^@Qn~LTt%3({%imQ*MFQE
z=$XO5b}a!1Yv^Z|HTtr>x<5_jiyQIQ`n(PJgT&Qw%<EK}C-iu4o7e9HuCM(h{N01d
zGb1l64*w9;)o0Ol2}kZj&gC+|$k8Zn7Y29b{oZjddk1a9niW-FA_UPBT-%0(-k;LC
zRuR!gScgVa@?g3;AdT=!lP^J{a^<z6CEXyqH>yG2p>)xiN~%$0vIppDh7cw`Cy+N^
zpp5W5HWE0F6>zuQiUH8tnU(MhDtjZL@Fg4^RWi3QrQf#HnG8-Fc`?5N4SP%+?EC%U
z4mGSulQyhFx_S2nB@2XTZnhfYPUp$@lROu#G%@TcIuWTuxmnD}qLf7#3g5)S3Eu*u
zWWCkCy1+DdIr*IDRVX>e03CpJ2b3d0P9e%n4(;EXNq6A+s3UM|gl4CPxN#wp0l%Pc
zZVOBk2dRGX1(OwUtM^29j${kz(e2so=kr74&tKMaa=rCXKp7-%>oU5x4n{S$=$jm8
zU0J#+*=aCm7*#<)*^J@cnEt?X?SJ?1Jp$$bf5$|evR6EtQS}0Ok>Fs}?RWGs{T#Ay
zt?4GWg3O{tk5wqbOe#9G>2#dSN!&Vvk-^7-qyvV=H{>IHu*lK~2;j7yKFRD78kt*9
z)+@zIrJ9<_U35jbDmw2Y!6JTQF#!49lgqgqK|@^+>wVVTu9XkgTY0Mw7ko9DBY&{D
zHKr|^9&uo#8!a0js)BaC!bp2@Q@ADJFc~h2knF7?fb?^2YfxRaL)m*UN@EB55MUh{
zdh8Wrq1ch6ydPDCduq0$mc^(;<s(TCm?gHj2jEePNCk+{*C3q2j;4a_i4mixyx#qJ
z?4Ah^wfWKmsfKlmgz;?LxeLoW?cJaaN0@o6@N<XlQ%*Y|ORZ`j6sXZ$C1HyW^)AR0
z29zsTQ@1-fFg!$K0sq{ms_hcYJht1I6r6^tz9PY5N9`ch5B&$9tIisb3UH&%n`H(I
z4hnIr7M{2Of{b<4)6a0CK8a?;NF$wz$7dSj5{%nuG6k687=2rJI6{A5xTfpC?k+`n
zGOqy)7ybM`nO5EYSNzD*1_5=X(+5L5c1MIYr{o7gSW!lQSOJ%psP)TE%1P>#{U>xn
zNS$o*FTRN5Rt`B*GDHnGT^jCehrMlnGvYV&2Br4n0FPlm$eT3cU*mv|II7=h>K<mj
zfJ5A3tay*7vD{^JaDd*8vK?oHo>1S!ty}m#(ay*L3%YJN!StWmoz-{$?g7>VQ#9fP
z>k|H$+e`$mzr<>-%o9Y&RW!2>%ISVq|9%z6-=6F7KmqJvH=T?+friu(w2jtLqUw{C
zy{6u7tw!f?aw^$_s^6($bM!rMKL*I5p<}nePrq@c3kFAc@#W+?Jwjv#|Ikcf!Rz}l
zC)?AFsTcK^`u&7|x?Ieyg)s1RM}%_Zm)4IK1?OUjU*y#LyKfW5fQcZgC<<2UhEq_P
z<(vPy<wf0|Y=>|DPY^3?y?KD~7$y^&opMLHyCe)o(z#MMnv3Z@&%}GmB{;QIJW)g9
zg6~{MSoH_~XUv;=+_4{X4A*&?Q5qkz4m%sV3)4Y`2s+uWGa5}rfW|}x3d{Ycw~$qB
zVIMx`WhVf|yak_vC@-%+=Cw~vN?h+g5sz@;IjhKS6JBhZ=jbdNCaC?R=OWDj|MQ@H
zQtQtMWl~<tQvReRxFmD{?F$YTpfROF8NegOJL_^-4_LKktqR;<)_Q7_wu_D(5msTW
z$&@{k>GCY+-s)jzm0U%g4@T!zcs4h_oiD!!iaX%6YPnVi?7hvS0J@F%j*^XQFM8x~
z4A7DdGEM#k+1R~^pY;;n23M^40c)MfZ$KtZli0(hk-6TglQUpB$+#6&bs{3+yhRKS
zdbaPPXeE`iUBJ)HoZ;}1RWG|!F>092&_l?L!{X#xRIa#XYZzD^Ipnn1q^Ay5b)zMK
zeV+F-jl`uC-`fS8><1{9yK~46Ilw<<h)6E&-4QL=lbt@oNYUI_vbBKLaiKe%EY}I%
z;gYKT@*>0@l1%WTNH{`d7Ok|YQz%B1QMgV5{^1cdt2oc4Ow}n=21T-=4pV{9)Cupt
zXK+u3Hr?A3LO<aYRp%EuWX{i1T~jK`V(bq^gPa0t@w=P%bODg8sxtt~F6KvW`B9uK
z1hi}<{aZn_58g`wdYt&`ou0ck);vmQ^A~wS;8DWNJEaw5xEVBHZIwiMRCZjJPW(Yb
zF}?49y-gT?eht!X6Tn)tP0Yr7D-)UhCK{GtCvp>~@<+)a#MSjfOsn0uMxg?g4jaUH
zTLbWchO|{Ga&h)a;C*xLIoV-?H*;#7E=X_SfMi%M#Y!bzkQo|{zPSWc29ZJH51;HI
zV~k!rU`-FC2CjLn<*J<4a6%?mk~S&XjtTl^+wW8uyX|fktlRSqGR+hj7@9}|kfVLr
zL+1ymyq=zvxfyLCz*+BLiDT^=I&cDPp|UECH^;YjVngWH7!<>G<gqB<v#gE~=DCDN
zVe|$79yL#{T05IZ_Wh;&!GSXlPN_ZCA^B^|g7ixJTo??8?=>j)E@=0r-mp<$=$ay`
zF3&QuL@yLNNI>|Ugcg37`Y`Mv>X2fQqrVcaTQ{xQfUWYr|59>}q%;f58Jz&fhL0Uq
zl*qd^ftgnS`?u5_25?g8L76y7|8y}KsxS2ov(WFK=kO5}f?CC#u?PSqTN{dABt3bM
z5+wt`mA}5fj}cC`Bi^IGijPYv;tK4p|JGEU*7EWanOMp$!k;*@3I`)i8*jTqbRInK
zRgFM9Zma3lE_`$An~9w^Axn#i!dm2Y%s0;ezohx1nB%h1FC8sNprNLWRbNmy?SC?X
zy&j+oW~_Ph17<_JgP`HDGBFo;_mC4F8Sj961J6}9F1A<JS-4sH?d^CGA{ZGU<0Z|D
zfpu=;#10XP>@RWMe*n%J$RBWQKuAuXu`9D$=n1OR;Ok~q=sA4t8b@;1=aBNs^sTL7
z{^+!mU#m<^tsbhw8S-y-u;*I0`N#^6P`JUkxjsY+(}}JRUg=+$)7?4eYu*c!(&#f%
z_B@Zz1)@z4s=f*sT~hTQysbIGZ%rlac9?@sHof2JvEsmZ$g+#6u4eT}lj%8yrHKA7
z)KZbds#iS7FERC8KjEH+1m=Sx{U-VD&uKv1qeZjG9pSQB1<<%OL&*B{<hBdNUB|nA
z6ciBI5#{|IGC;rC%OYy>rZ1c3-B!UTQ2U|te7L<`ws^YG5)A`tT=Li(zVtJQ_ze2w
zNYy%g!S4CBaoe=x!(RExZ0tSPzwNz*%68MD65`CL!qqz@gWP*5>=o&3&kpV$#V}X(
z6WI>E2dW|IqTpRXNa$U=ebt`fa222cFbW0;DuzhTJp=;+14sZcMFJrJmY-k6)B!k(
zljRWFZnSP2LjPt-I8NI=o=Y4)I6F>t0w5Yun_WbPN@ZF%p;=75bPyCFGrHccuUVlR
J)=!Gm=4<>S^d<lR

literal 0
HcmV?d00001

diff --git a/certs/frodokem/frodokem976-req.pem b/certs/frodokem/frodokem976-req.pem
new file mode 100644
index 00000000000..2bf0644468e
--- /dev/null
+++ b/certs/frodokem/frodokem976-req.pem
@@ -0,0 +1,333 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MII97zCCPZUCAQAwaTELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAO
+BgNVBAcMB0JvemVtYW4xEDAOBgNVBAoMB3dvbGZTU0wxDTALBgNVBAsMBFRlc3Qx
+FTATBgNVBAMMDEZyb2RvS0VNLTk3NjCCPSEwCgYIKIGMcQICBwEDgj0RAJZF0jtQ
+n0vU7wDrK/7h586R20kj3G3ANWGuklaYqJUmVFNTJAU/L+Sg36zcq/mr6KxjTBmW
+sfzQ2VLrFEVesqm5IcfKsgWSMJpLDePjpowS9//nSwPwn84Cw95SI1iKfi6z0MNY
+dpIMcVSTaJaSgpiUUbfUtn+zD3laHYkYp5D/FfW76faCl0YJLJOOhORodK309O6S
+KfI4W92ISrL6SoyIuuOrR74m2KzCSJ+x/u6lV9KAKDMIZCiYq3Lqq7oN4z0hnd1k
+/XzfOWtedFQXCODFzjHdbPAVjIBd5uyv6EcRtRg6tmogHaDG0TpuGNh6daEecdDp
+HZHozB+HgfOOW/H+LwS0XU9nAlyczQcrVM7b8yEpQAtB8mJ81dXuVJ08AqKn8g6w
+TijIGxd9orpPA4wNZu2RkXR7epTrhl2OiG8C/kmKjQTTBslBYLfAb3pd/2L56x38
+0e1DNXQyLHBfvFLkdOQWjfWfPBeEIXQOi+H/AQojFn1xS++m5U7puT/kQyN2AzN4
+yXLKSBSjRer5XmLe3ICPGNWNgshdacBvimjh/pJICSVekzQeow1NgvgUQIKLUPsw
+rrR6c4EXxuNJD+gnKEvFa/+6m4VDJlGgbzQqg7VkPjR2zvdP+2SgP2L/fIQ8nsCQ
+O+EinoFb0UtHjuHgdV6/xQE6T1Z+Sy502vZgyVe8/oCwzAnQbA11xKeI/iVp20rO
+b8+YlfsDS6KzhnkuE4bcgavDIxVr3cmBOOqCgk8kgwjQpPBaVNZ7UdksX2Iv6zYU
+t3WOy67FdtxA8e2ufQ7+gq3c48OurbjB0cZH/agTfEOUrwoaf0Pkg6uHNrcHysiM
+m0zcKLoaKbH/SdMORrZcJqx+7Z9quirymPMuzNE+TE4t2ktnaq0lOCbCKJV1/KBG
+YDGkR6Lg3YEKek/dp7JCrKnpKHVKDswrWNriYWl04OIBtUUUEOjVFDVkFtxJ2VtG
+btpBk0Qad4vO/TRG1xXQvKLOl3ne6AlkGrIvQGGgxRUtbyiW7c9k5he6/8oVea0X
+LtngYZankDs3c9k1aqs21m9E3xSANBsjMf/mtp6tmdpMuRpEmWPN8wY7Y8/guZz7
+8yGKiIJtWSgmUfGjmozGVnt5SJLDyJg4SrP4XvHfWZ22nO+oiXN+5xLJYBoVQWUv
+Y5fIUVSY4vxzxf6R6NWcxkkDXx4GheWQvqwB3Ld7F0wlT/nY0G7ONks4MSZXeG+M
+pJF74RDc+/hhJX30yLQGOu2k2okaSy71/Ytuivmu6SnKnLfHB5zrg5uXZDE5GrzX
+wOKqyy6ID94EBATPGyojgWgObU1kOkZQRU15NSmuGSdB1qBYD3WjD8Y6fHNoku1g
+2wfsmSJDMnrRRy+uj8eTOD8p2ambeXmDP0oh1DC+j8Djx1MgMBPbk3D1TrLXu+7Z
+T6pkGC3Jyolx/imLylIIVZKybzqDIE54hNyd2EnOl6AgCm2VpPFGEx5MQzcagmV+
+V1bJvdHoyrny7X9LuU9XkmPT1GXRzg/7cQMDjxY33JsLFMnyjOkvh6r96pPq46nc
+f6RN7dLYULmX7AMXpuukEvTsV8layfpA1cYhMEjM9Yx8dkPkYQYRh/5uZQnMQwVu
+ZWc5PhBX+KjRd6ZC1NTLHwYliD9uZbEh4AVGETMK0t5yxzrVD7iTBB/fTIb7r87I
+8SD7d8ZBlsyl85HL82JjnS91AusL+9/q8lGdPxiR8rpoOqNWZ/azVsN82/mrI8gP
+rX16Ki/scvgYJEZpK/ab2mnEjRZKR/lRpeDVC/yNINjyfSu4l6vbOGTf8wffaTzA
+CdIzE7jh0d+DwInJWZa7OOgqZ1SYoi/B1zkQPjWvlIlFpGquQSLG++7jgUZNUhY2
+JNh9+G3V5FHCWjDHiu3IiVEwz7h76i+b5B2uY+bI/1BLt3Uqy6Fe7YzK8+amDhn6
+SfVgPwXsxUjstW9CdTHCcga0XWvf+wnBhDpV7Eg8kiWTeQwWGBVLHRwZwjR2kdIp
+WyqFcW/plPP+nM4aI+n6W8nFVjEXpHZ113fZCNNhdb/GNl/1BhjQipzUHRO/LCGO
+8nhDvg0ZZqvWyBNCcu55WYWGiLE8DdjdOoWrEjRCU6cZ1Xauaz0GmZdAZZ4L85SN
+D4AP0/3tcAQplGXEiCRmSqpqw5/vbNu1ZeDdfzcUcNEvIaBfCXxQvr56W2m5SeLL
+IKIULREYJSOqGUznEIJAsAQektGrFmCj/t6FE3dVkrNw/N0r0BsqS4lsoBAsRmbS
+uykcPNMGrdWrae8Yd0+Gx6wNqYJcPLtzzr04cpI3VVyUcJwXI1y701BS67rdL4dH
+wRjdCj1E4KL/MdOxn7kvMslGaBftw2ibwCGSUmXtNSc0VDs51XadFaGwprNoWShz
+u0KGhHQFzItNl8JjQ+kfpYvCUobjtCUDH+4G1EfZGoNrUkDMhR3VW4kJPEy6cEZa
+9yAwCA7sEWv7pxB3dkpIVUvsL/N2H6Vm2phB75xt/AKi04LJIK1JEcxeWZoUlne4
+yue983wtD684/+t1uCKxqNA74gw6W6MZKS3c3Mm6MyRu3MieqAwQcoP69mkIQ2Ie
+Kmw8RpuoAfTg5H341bxoz4OlMJ3wtPO1gv0UKNGHCQfmPqt6VH4I5WKR9hO6Az3p
+mTfsUgtHiR4BZ2aYq5gas5XvLWEZS98/ZWr+oNSrmySqFD5sbXTDO4in5BaUhvcQ
+/xmTRT4WOQj3c9ojuVg/8IGCr0BzR/velYyUkHvDBIicFwrwoA3CQEXlY0jfjdMW
+pa78Vave5cyyOxI2XfPhVy1RTEApm9/xYuV2gnE9RF61ja/Igwzzud/Ks0MzPt1c
+c7SJL++uD2HZps+4KVq9/pV0GNxyNu6/ykjv6p7hbzLCuwosnySXJcii2SgwEaex
+WMZJTxeQ4W6EW+OBIN+ThJNLrbC/UVnqIgVHPddOWBib5lh0r3SCWSJcfsHeNL6E
+h/x6QtAhmIUWwavxy7zJEhukCH0iZsZTa+pqesXX1NX8pCw70+QWHDttxD3YMu//
+cmVc46v3ulWbQL7Mcy+UTvBsDa+g95BjtmZIR/BZcL4/1bJVM9Ppdobo9waztj9O
+rzim5ENhEZWqYR/aV0TqPCXmrpPDvd1BjaRXpCestZ2GorttTioaTwL2B4eMsNw1
+HiTTetNqwlK9ZQ+fdg7BTMRCXNuirkC6uinB/nImRNNMLoe6FMAJajlmyxPDGq1z
+VYCJ2C5AmPIhCKg0w0C+++X6hilMKliD1R3VNIl/l4S24RA9MM1azz+69bxC1g+X
+jzs72Oe6CDi/DZe+x00oIfa4rNE1QJwVSheeyrAUaIBcH8hGyLeL1aYPGjiNE9A6
+kpsRpEE0970Ynq4GfWAMPkihBPUwfNqvnMbfu8kfYH9ahMyYwQ7P3GhWH+Hwg6nh
+bDCgsbP3MGEH3cl5V45hnzlJcaAGx4Ok86YJUdNRpkIiu4niSeOHCMs/p2+9mG6S
+9FjecIiKm3f3hf/1HVf9xORXTIHG9qLD080NN5rkWs/BFON0v0Jvrq8zsxBthkIy
+/zt10v/rDWIaSOAUxvWzojmQWVYFCJevSSGQ78F4bcYwUn69Y+l1zH5oSWfaX3Ub
+QBOLegRKQ9Z1MdsHzMgrY1LjAOb7Y66BqzgwNPhzPETV0eMaDAEcpACm4qvXp5Iu
+2kTz9T0bEG5yFlii6ODkFccRoKrk/37zVlzDSOf8ywXRYdkOzQapo46nYSa6sLXN
+J0EPesLmicT+GbQjmGXS3BWlEdFykV1zmabA7JZUaSpbKwbNACVrxZsGdng71pk+
+RSOhpOr4BLGwtmsYoDXpyIZKK7UMWmfzarzfUhXQzJ8ynN2semGjRdn3jGxXmaeL
+L9cHhpzSc/24Rzg1fcNs5dhmhLz6IV9MzhERzWEgGY85lmJfX+dr9Ls8KtDe73oh
+PaFv6FtHagWaW6RkZNT1Nu/N8DU79ZFedwYptYLt1LRFcwZA6D0xJ+wQLAsFCtzy
+yuE4gVUWIN5bRDiYGZ6Roa0J8vFWCYU/m9otpDgfJHCgljtyak1Woc8rNJTAijxk
+m/0hXYVk4u5DK0fynG1IU/W9oaJXPG7eprlG4YVZB4eHld3unSzGkPJWestJ8yXH
+F8vm/K+YrY3u3tg0e6atzAJV6j0ma/wtwjuPh56u7lGyqEuwTFuoZc8mdscRIRNo
+Q9vy5c/M7pMWYenR01STpOZJcACMwyS48YKqxRRZC19qq4esovan7axTfdwmvfq1
+AggJBFyflBjj5eLFz6OLgSOng/UVWsfnX2cAc/mEVsQW2O/Fl0MmCmHeCfA+obvK
+V1M6XmBdFNZFzJKh1W6VB8b8jmIMr9YAh1Qke+7bNb6rk12kYZZ7v5L6QmrejdMc
+vNnw72ViYEzihZiw1ll7khFN1RD+TMAyG8ecDdJiT4GbMgGumc+stuMPXE+Ndm5D
+fEtBmJ5nL40rKTJLAJX2VO+Xk1NtHydo1bVky2+xFCgFPkRRZ69H+v2T6BN0dXGd
+3U4Fd7lnQCowqhFhYxGxiNLGT1KCefxZ4kSmVKoFOOWkDQngkYXWECHUU98Aufly
+8tF7GFosUpz6TR/hte/HLLo8ZQ3FJAqls7JG58r71QLF+BL5UNWBM9W7XaXrAn1i
+34lRapESxra1r++lz+ohe0FsxhpLq4ojm5Crf9rz2XbNR1ntEANla4q3E5UlVf3g
+IlpNbWu7Lsi+kBKJAwv3wkYQNHsOW0lGw7T3ZbjKfFdqp8+EIUhMK5KiqDXzH6qS
+8JvqaCKyGtYYSCHEx6BhiQqH6jgeHsYyRpk0pp2B3zIGS7wmsbcDGCFclrxqdSFk
+IMUdjO09h5hWLE9snUQyK9P0j6n+tsinfIjNkzPpBbcmEU/4JP6v4w7dogV4KpSr
+NyjcUvADV5DeDv5Gn6Bvwk5UKhdgUypHVfvNHLNwcaSt01Wv7FlbIVpWNn08Ve6z
+z5OH0y/mLUM8b5az9o7+1IieIBicEPkMhBrnriVbl4i7/dju4w4mcfoM16JIRc03
+NgzgE1ZX+1AeQ2Ud8EsomyZKCUyi5qGmL/mgwxpltr2VdxOJPqmmNt7cf/V6lXmS
+9ev3BRyN9GvyEty3v4syowpqfoFqB54pur6uyRThrbQPL4JuzPXY0oImkILS1ksF
+hk+LkfLXSeqhNOR9mmR1pqQm2GwQrrykZLpEpPGwlBFCdWIeA7EhxQLccIblXt3g
+75/3/Ri50OhGzbX2OdUm48DeCVzKbLdPNNCBuwpoX/GbmuadmjQR8pUSSuUFR6ef
+/PMvcp5tVetH8dW+E15dGvZHxp11H+72IreWV2I19JcInthTUA+fhaCBEUun2yYC
+12P+qTB9ZueQKefcnn0/2FmO6GZeIjk0QMK9ekbQ2iHoGvAxEeuaZZK+CvuBVCKE
+V4UDJU2aVeiI3gVO2NwwJei2+5skThzmUMPrsjn8orOB/roFFar51YxJAdqD2n6R
+xjvG63G9VcSK6ZAX+/zrsiIYTaFaCE9u8FIO8WXeBvERRTq49hbmxzUc1626VuAC
+SCPj+vh8fPnm9ukSyVBHZJGjDIzg+w1AqYTYmS0JD8bev0cUfLVMUBi5My/Isu8b
+417gXzNBLbEmZYk0hlxvOlZoH3JR8S5HHlTn3mxae9j24iBYiEn45jMqvm3bwgxN
+3mJR651Ei0jx+4nF/YILMffCU6m5dudGV+T709SaHerIjsw2p1RyRqU2r5LrJRAp
+/pj3zXWjNKs8aTzf8XUdtwJiNXzkpG1s1y2uhPwNB1s7uHPgkOAXi8y4B6E27b6v
+KYp/8a2DZcsplEFPJmje6gNFJCWNpmhXaXo2YOh5EGCQ8aov1bFdBiG2JDLZtqpW
+y+qPWQiJqrRoOAUbpIQRY+mSGnSIhj7tPxZTnPc8etQMqaJo6ErOZqIB4QsfreEV
+0wX4iIYSyTXueYaW/9mJ543Lc+xoFT/lfU6/xDq9TJE4kO+zvVRmcVTIw9hadL65
+7XBKoZIZiLwyGfq1Ojxh/aN8/J4kV3Uzuiq/MmjVrxyvzxI+oBFwPq+l2o4Qkb/u
+gwSmDB+GCqHga/eLAm2No/RQefxRJ4BDabsbyE7ZXvc4Zd0mQ67wXaWY73slhAVA
+zYxIaWMi7aw8vDqP7+0ikj6UQPlgFaRX+rtyuy9JZL2sh8yUMep9aFkdI7F+5hUi
+oN2MbJ9OVmhs3LY5Y6xdCRWqW8QZso028dqhV3xb9g5FBDuGfiSw8S4ZhXxp91h8
+FNjuxG4gxECNsY7G9B4wgBeP/ps8Y9H+H1cd6vbJEutvg26KceZOSTDCAKZGxy6M
+XJF5jFbBM2vaiE1eL4M1VX+r43MzVGI/30trrMeAP4X3lkC0DWIBR/G8R23s07cY
+Pt6H5fTmRO0I7kOB6gNAlVaJyxef3G3ALgVcYFXyQBa1Bq2c+U/D5cxvLPiIVu4J
+uudPCGaZVOtFcw9pFRdke1uFSSk7RBADoe3R3ZLQwvrL/OvUpdzghtBeHVZQJc6v
+yOhaZ1rX32muQFglYYmCWMPGY9IAicoFPk/GTTfzH751JTxRUfcwJc7qgiMd2pWn
+WJOBdl9aujxrF8LgrEpWNoYSsP6OqET2tt5aPugUBHG9NIs5ZXLqiLPWdxn56TIO
+B2f98SQbenUGFDoGRm1uhffkyR5rN711x+66t/8I5bSOp4sC0g+DhGwQ8x8aFVIw
+S8uBGDfUpBz2tgznWhk2GKwLe44tarFF11lj6FQF4Wza4Jkyi8wkYaWGyRycL6nE
+QXIdleDieylVN47mJKT7GOMwoBtVvUrXRkJio5B1Ru+L4/6VtcGoYUft9PMLMNkW
+DhoZt0iH33Gxca+vcPDW5cGSWASJ9GqBqkici88Qm/SzwpkPCJf/RWcY2PLNbsyw
+/jIlPQi1OO/iNvdBQIGPSynBWGP5BuKMoXKnvkWPbeTl+UyvdfX53zv3y9qa2fy2
+M7rQiJlp6o7R28jT3K7Any1U7ZGSmPh8iikyAZ0kM453g30gG+asEPt6TowXW9V7
+FubXP6p+89OLddOXI3phJ7th94wNHnDbkpgOjWvm3Vy3unLeu9Pdc3HUs1Naer9/
+No8salaZNSVxqbqQFNGl1dFrnZAGts9q1A/4tlXsnWyrDwLQ7TBrGGp3GZi/hoTa
+ag0e7NAVqemg9yPQdj5ic45YMcUmWZB1Aaf1hLbAZpwkljTevPjkteZvLLBG2raA
+h0sJOXwAEMzoDyLEV0YJcpaE6igRzSVFKqRNA7uCezQ89pbQ5iplv0TOLkS32gEx
+aNE72wJ855ZdqqOJNMqwT9HCOafvJjsO4z3Qnr8tp9XJLcdW3kwq/UFMEphaycYM
+dPEJw96WIbXyikH2v2EsoibhWPJ2dJ6RduFak/iwC5QQA+cli6PlkbzitTilnGwj
+4l9ph9d2mj9Jln4AvT/iGibniDTuN9ZxRB8trgO083SuU+csewLzzwXs72kTlunn
+i69vnCz79DKucFIZeKBJGrgDqISuF/VVOsyhQ59E/pP3GOX3jdKNmyDw9sdDvDq2
+TjzOALwBxA1ZqV2ui4KluLbPVdgjENjxJ11qLKjJVZAd9ocNUqJz9ucnGtEeLa77
+6q6YBe8pec20XaGLqZzAFV9i2z5K3EdqzRhdG7HHwFYZAOqSHb3TxFXAcMnA7uEv
+EkC1UjAJsg4dP2VtPTcylv02bPJKntR/EikiqqMiMbYHOTPUwBzXkMZhokgNqYiG
+L+ApB14kMDG2gbTPz6xQtXEryIxY9+Ahax9+BJRbNCO8/VLpGeYUhxn4YTKQ1s1B
+YMHxoDWZSaJIK9qUtMUbLkECjfz/oO1CaiiUwoRF+rNMid6u5RhpZJ2c+zRpXLFE
+95QNYasF0OpjkmWMoxlyYwVTgdcKje+fIM/nkH7MORfY0eCNFLvAspQ08GwWZ+Tz
+ictQ0bcnx8QRI6ML2mIA1cvLSm6Ai/pOxVy34t4h0PGyAE6ZJDNlev9Ld9jedSJ1
+M0NfNpVBZSVJpSoVdDdBGY7kV5e6pkYezFnWAA77YY4W0baJhlSSDsDOFb/orR2B
+DNavesH5nuT3ImkTLhnpFrVKyyJCTEvsC10OlhKyCpByLUl5831Feet7IqzkSJMJ
+i1YlYEk8t5mH+iQ+4+5ZesLZG2Mrw6LwEDBKRrtysHiMHjCjWKF6ecrP/GCcJ4Q9
+LtFKxgI46EnH9O0Ihweed+CGvBZZjBo6iv2uxHu+txQCpCFmNc5HjLWZRP7INRhg
+S6uJ4MShrIqFfK1nM0pNodUYD6rvp78cHGA83ET35Z5vUI1ccFNXpazFZU4kJY/9
+UYKgn4azAnBkViUiXlQFPcc2sdN/brqvpsD5MyJ/36XDTqCy19aCV/h/3WrOA4aE
+SSsnVrSKjVGJRUVUlxqSCGIFq/C7C5x9mZxhJv57IkxLaaQ6TXp8T43mXwzvFPEz
+Sjo/pgcNKon8v7Ozk/2hCADkQrwe61U9iak1AaKl+n7T+rZy8cbHSIynlca76QCc
+22aleY97Kqgz7VsKo70bzBhCk+l2luDl2aJxsBNEKVmyPmh4X9ODpXTmj7toTWlt
+E/H0biYhNtx1ztmajxJ1qMLHlO6KffGGMRsBbr+r6s7HWuyqbEPW0jGttWSNIx+F
+JLuitUr7Oo4PE5IjXTYKPAyf3dLSO6P0FXxoKTD5A5fMqIhMYTt6sph//y9cMhvp
+HkF/JLXM0f3WelANgV5DOYAddwS36HsjIA5KPTa2NcuN8kbcufwdm6lKHZIT+aWd
++lJzsEtI4uMPJbfEd1fXMaShQ4VCmDhjXhbTjtBYeoX7dpisos+PmLIB0nTLWpC3
+N5D1NEdVuK2oS2d9EuuNXT44n9IXqzCZxmxc2wnD1srHKjLwbSCfgl9ynbmjscyF
+KXcHfB5rMAEzeGH2SfeFeCb70Egsl2/elDpTla9HAiyg5zN+OoXvBc8YglqJLyLF
+322xHI8EbFo8tubqHj5R+bTwyr4sI3vgGOzXHVgVZ8myWyoqEkXM6v+knUupbbMM
+zY3uPfXxMSEyDZexDgJhClROZkbwlY4zKXotla66ANIRYaIdkYaTQyZnJr9n/Prn
+i39U6He7djhNx7PWWoYtBfmST5bjHrzmWh4vrl+fgCojVlcfKk19gQNR1hpe0dmB
+0h5Io2jI8PpHPfGdrvg6QD6caaTZRa/HobqIOnhGD9pSNDcxAvn0hvMJeQqsUP97
+CBvrJqETCr/Yy3ptZhG5bXRdvYFZAtn3ULq1r+9fGXpZ2kCK4sf0z3CTQC4JAqc0
+0LA5O4wTz5h61ov1PAEG0s1QtLfCuoP4x3h0rFuUZUjEtTvlnDb+VpOwIAsNryFs
+Sb01YfrEfxhjM4LI6gxqqmgu8tcdM7tR9uI5hmsyG0XV/KFEP+nHVzNvH9srkITZ
+F/1LjLAm7uYGd/vGoUCdS1Kj9yEhdSGKdlaLGr3nErOYmxBBDBDRno7zH9Amm2og
+ZoxWh1iTZtmxQWZlRHbzYkZ6DYSt6RHI5W0LbZlib7u45tDmRy0qf7sfr8t7x9nR
+4jMT/nOgrvddbEI4zT2r2kt4S/mhSIzYQlx5F36uytfmTcW3HyrWQ/IeuLG1iI2c
+re9iaiPoKBCiBMDTDLQyWDRl6D3W7afTcdqp17fCQlBP01trskl1N2zAwDatNt46
+yDxD6JzeulgYuMaGRDHQvnS4wDKSclYV2bpTmgQZeK98EORrmQIv963KMw8sfN8v
+I9QAAJFNUsYRh/SZTzDwB+i51DK4WzPJIf0r98Qlh6Xx0NroTMfoQnMqiPE5MT+K
+bKbcl1zq0Em1PugvHYwdxhONdamhlC5z5R7i8FlYFrJflLuIEGqvabfrfSF6/7z0
+Ag35Dlk3RDNHiGDV5CBNAEK9V9dylSsvAPB33wGODI503gIINKNHzRutuAqCLsrL
+dowccl0mj8el+DeHdnZ4+VO1Jsjb8xHRBtZOc8z22wdyPosiadzh5fXxipqnP0g+
+MNQViW79setxlYh6OllnW07unwVIDyRAbkJM/ukc7pLR0dwgLnODjqYpDTZ4649P
+F+BFmpASnALEiHKTUGorvj+Gi6xUJb9Th9ebGNIS7uPNnvOb8wNqF5LiIq9TxFFE
+W++I5sO6yi3MwrmAhS5PaqDNJShcRER+kvY0wGZEDkxkfPb2mCKmj2nMfeS3abnF
+cXWitATUhdEO//MvqBsYc4IfxMQrSwoFQtIJ1GGtKckd1XzOV0LzeiGTT9rUaBWh
+kZIjHY7oLhIsXME4StDzaIWt/Jnpz9uSJcLz/fkEfx+xOEMFiJeTg23rffSxiTUw
+a0LyhIQBB/Iwukv1SbmNj/Sc+ezovtNdSJoseOhUiY2wCxXuzJOQIDPj/HVa4xkK
+fJZ0FUwX8LOPiqRO7fbU7GrYjnPnfB3A2NGSfL7+MzsuqyHLcA9yyUBaSUiRMwQu
+4po20KyUKkkpRMIwJ0pbbUHBqfaZrCUqXY+KMayWFztIFDiCezrTnH0HDrKZuCuG
+xNovVftFksMJItqLcSoL8hQlnB+J8YaxXEbMevaGj+MG74rXADvU5ra+2B+9uMba
+4SiY/fL8HZVsCpU0KwWhiWe1uoh06bnQX7cBUVcBz65bqjJSCjjcNE5+BzsLF7i8
+UPWRGpGqxGDmA60afB0QYLCwUfygjTkTG0x6FlEf/XWKlrAYtld8C7pGqAY3JPLB
+GJV/GNN6urN1iBtx7qEP5bJ8KsLLJSPmU4BaTVOqShROW7cJ8hmFRmNS8mdc8Ly7
+j7HoEc6PAIVsHBqxhWgXha0iMMg6nm9QvjSp81rYBGrs6hOtNpXr+5785PLCnvMi
+qW/vmGFFXFbbVg4RZTeKnf4q6GiS7GKtoQwkqSAX2JlbsiQMnnZVZdywkmfSOOgy
+lSsjpkalYY5f3XihQXDJFNsjRimqoceZ4zQoQQg55WzXeNxxyW+L86MSfR8YOrqQ
+3Y9GEoF6UdsmLYbh3fnYN2HuDbJgsG/hWhbhYMuDymCH7BPRJKovF34VUj0H0Ln4
+9AHIb0aUGBE7/vL4e6Y8FsnGzNfs97kJ7LS2sD8ZYEYjP3K5wMrgmZMNtvLpsc1M
+uLbr3ybH8D9CxTbL7bM3W7gXg4KxvYjHJwin0wPqgU9Gs73/KmM6SmMItydYoRMD
+QG2NRbDC8wByjOrUzFjpuyExNhwWeSghG5RZWa6f3U45KQuLIu4vSKeRfvJSZpCH
+t0m8eCziHRZ+irMgFTzKjxVtbda6GVKsWmQX+9M31ZRuD/yrvuPdWCPSMzOSz2x3
+wZMZY4fmT5Na/LBdWgvwHqoUNsTuQ1UMdCHq7550hBWeJLR1N1s+2o1b3U5kaflK
+uzj32LA3/Dg27qGJfkU8SaJd58MpQCAt78nGZ7OQFdF0if0EugXoUxPTdDj9Qw7G
+m1+Pq7ksATen6E+Bt3MVFXBmot7I6rR+hxKsdXmHC71QJd09qd/8J2ykkm/Jfurv
+2kgKRGbJ6x2aZWbVKnNTURNWOo2mz66G+VGrtGc1d5K4GBO8BYbOxr3pDLoST70C
+M4yNpkt24zleWOlFxcNgHPv7fuMWgE4SOf4P9lKD3/rkNqII8hTllBkVBax4acWE
+wQfNF6v+RmhCyeaoWUFBSxO2oyCpOfiPof6oPRO8luEG2GZyvqQbUtptyARz4be5
+cHtyCDTPRWL5WgOm7xSzZyc0rSzUd5/iQXnJejeS3D4lpbmcxEC3bMG9nrldMlex
+/KAbcYl7x/3TVFtPRMmrtU76WEZPA06Shf5EVmoQP3vy5fHZJlmCwXnNZNwYXnwV
+6wNWSZnboMX6QsyuDZaFc87bGP4sJCU7DBd/xOKJ0vONN6zU8mjsMkTM4IAyl2er
+LYgOVjI5qTWTYeKYonateqAtuyTgkswPtpc1aoNICZ9oUiwVzd9N12j1kL8sFEB6
+KY3DKDDtqaJdhzjafgk00QqO/AH9Uiu7x2+XsQQ13Gyo0fOU3PJwZyDWwnum8Lqm
+5YIgldlzGTTgKv6OkHzk1Fozhdl2UrLRex8BdwOz0hWq6ssc9c7kQjTMRroY9A2x
+V/+Ga8VaYNrVPxoOA63pBftv/w+sYldtruPmrNOE3kn/b0Ea5O5AmvXSBAxFtiuc
+c1x0fzfmlVf9ugUVe3f+hkC4hV48Mkw20c3vmgLNbx2Tbygif9taiuV0181Ny+Rz
+fHJrfDCiGN8hI1VHjvZ15M4aVq0gs/AV09PELbDxsK9eAm9BtqgaEPfV/KRS+pIJ
+ohJWwGkDGZBS2Pg+jNE1zVZ/9IjPBt/9HS+7B/vNpCmvvzcLAwBWwB4c0YMwRVna
+427t+OrSTwFncFKmj6jIu/L+42KpvSwgTVDQitJ6eZFKTRJNtdM9svfCQtagtPId
+e7ShxGKVGlRLhR/i+SB1kA9PZfYv9XkZN5MBsNm2uYu9hSE23o7YEN9G6dZzYsMX
+7W7gfMq/CuJr97z4OAT23z8CSaMoiytUnXzZL8mrN/s9f/O5fyNt7jzID42+o8Xd
+8JRh96ei/kVOKcPNhEAvunWhO5zFc6siydMX93GYf0NeMxaTZ06Cu1+1NrGUlnDx
+zcAkrLkgsznSdWL+YsDBS7xREWr1eEPTI+WlLW5RvMiI4/qeZV19ic1NXjsERyt5
+xYSCEANbARjaRKTKmiLCOtsyTxi1gENG5kxIEn1CQ3Stas7GYQhw0ztMVdim+QZt
+lH7XA/WBEVesjkQnuLztJMpXOZhnTVpD0VLQVFvNk7wmCCXGgtuNKMCOR1sIwu9o
+nS5+szA6G7z7mNDaEY+bHzwJ27SkzetyjcMjGsmD6KhLMTGyj6HUtaOuwVJtJWWI
+kiN2oXjpjgk+wu7YPFLDd40rh275Mc13EfwylvbLm/8d6vpYXr22/ed/FjJeim8G
+0IealaEbly/B1XcjyZ6qS9N0TtDh+DtAxRSfUNPLi3pasvH0b6DnQZMA8UqFbwUt
+7TigFAl2BxpLk02iBTaLdBq/R6QJ+aDFVktQDjoKpIESUkURPi5Cy1bvA4D3BHEH
+tZYio+G/A6BoIZxaTh6l04WS6T2k362f6x4UjKYmlVtWbAwOum2Mqu01jvqxGpiI
+UfbbrM+HP3h9bITEJPF16+4TzItXiuUyyy+v7hbF9yBk1QVGa2fbDsuFKfp1uga/
+kvQxPMLvB6KSda2Gx55xrUKukv7awyL0W4StPlH3ogdgryf7KbbX9bCKMQ/2fhdz
++xBksKBqgo+bXIF+A/yzhXYPVK5zmsC0wav/VUhCc3wOBDFImWrzKZ1BasnoHAXS
+C2jkMxIAfIyc/pxBrQYfOUckbWCMIkKbLwG1Ei2zdrL8uI723wErExgTcq6gGhi8
+Tk8zaBX2ubiZmprF4ItvFQzmqNyKD9RJwecXuxr3IM/RAsuR7ZDwpZZMjiC59cUe
+ysG9fdAbKHS9kfbKKmbjkqb0kMKhBEAb/akMXUG8nyzUFE3fYNYimHyr27IN7bwd
++CulpVhwUV31JimOFn2u1cYfvC+Z5svv3S8Hnuye+EqCOrTyJ+xLc5J/SBQoWqMB
+i9S8nay+V9k9KIvbD9rl8rDIS2YAUpaQD+iErqoSe5d5uvto9CpjGTnyuGifk78+
+Zn7fN1yG3eK1y8HSbVPtm7jox3tNRdamBLyE8zxkf8+hsZw9FrGt8d96iTPs6J0M
+3k8ZWj8B2AzuOtMMgn0CMhriuIHWoMqRmRC5GSMCXYRnDe3oTbTvjA0uQaN0lHs4
+DeihGAbrDLqb8f9oRBZIiVd8g0ndh/Iwg14bsxy3FJQYv9S6w8DagyYa9+Vo2mdT
+M08/4csGMEQls/CuI2pv6gS9okXsP7LEFY2XFfB8lcY0hc3weghjsk/X2FUzZmPn
+pq6riAlTkhi4FN0EzJjMKep6XmFD8BeLsRnb5jZOEBCqc/SYsrTiV8gUeWBF8dZj
+JYez+Q0p1FXS3njUVhjzuHWUWPNnNoEgkIVAVr/0YzYvgcpqgCox6dOGYUDuizOX
+KgvFaGRlyYsANxnpex08F1X1vsVP2LlpxNnN23zX9wpvjqFEZ6TzkY31IWAP16z1
+eGgL6bzf1UHjHNuk34pkFDm1cW83mDJ6BzbVzOHZNQAJ+BI1LcOLXKJ7K5UMsqIa
+6j4uiZYM/+CI9zKXFa6nUm7Y277HpiisDX0OvqblY0xl9pv78MQta0/TmPFEam2G
+Gbg+tfLGjFtnvZwVkdaQ7UTP/TW+YUF3M/5sfsXFUhykgVGjKAogd1Z6dlM/9vyS
+NB5Ola+JKlw/9Oy0ZgLw05f+cpQyo0GtFBi2gQA7NXiGQVfyQixWFJ/LCTuuiEIO
+Bn9u8hBrNo8uGpg9Pm3Xgm/TPsaEsBEhyiZUO9Xm+op5tN8jKJA/WMZSLxqDoN1r
+m6iCjD/pNLVEoA8pWps9JNAlL6qH/GHcflImnld2rcDuuzvnvXfomZsXTN1dKgzP
+BsbHGNCm4zBFO1upTzn9D+ik/x45VuWH2l4kpTtGITgV7ZRwoWyBK1eR3lPdILFv
+JAsRKo1wlpQoEfKTHLO64i6SV6CoREN5YRx7O4tjQ7LcxG6iktJ8uM01aPIA4jAf
+VGm2VWJcHUeOQk/wqkrFdcjzUW5epCzO0fm8TTCuauA6jpVRbV+xh5f22L7ZO8z5
+bG/mEXcXlUXO77Kvp5U0nkG6MahHdwjUxNCrub6CrdA/VuQs5qTYk0Ez3Ul4v+PV
+07LwLDMek8aGpQav717uFDrb9FrO5wprWnZZ41nSbnn7CfoMg9ITPl6V/TFDrsux
+HN3pnIVvnd0MKTy1r3DCBOe+IzWm+phuH7xgIels4hf90TBzVbDtivC/gi5pLsNt
+EHeE4DLKV1oBIa/fNauLSEh7ukdOG4i+jv0TF6Hnq2TEfEVNVK7330tRG+TU9ixY
+B4HjRI7KGOy14posNtSosHRRfVNzR5CRPPvhTHYSPOJKkP/gDWzy2wImoTuFJpAD
+3iKyy3wHFZuOsYSu+vJa3OZfLHWPVBrh108rpIk621fX88u7gjQwF/bBlOHeGd3g
+6ZuhXxK2OSs+nuBI6CuWtI9eggfKLOv2ORQuASXcR7mQCtzqM01KKbEN62QVBPzh
+5nFs2D3kjPYizDuo/4dE8WA81pbsuIW2JRTHSGGoJJZNQJf4ROM0XMxbBh9ulERL
+cD3GYZIapqBmQZzBTYu0JwYvol3rS/ZX1ncr1dqQEWrzgLPrA0uh6pk+O5GyCbrL
+7YU4CkpOwk/vwHkmgFYCn0X0TxBsMFzlHhkSmKIknuZov20Mj84Y2XRys8UsWO1k
+LNr7Yr38mPYC8ABjyVxFiV9A6gJQt+zlgDiDKnP4Ux+tDHkfD5VFDKVOoIQ+CFMX
+fgPy4VtZQkIrrzuT0/52y+b8xZtEU7poQnxpgio7D4yF+Yr1RXkHzwOwSvLjOdR5
+Gt356WB2dv/R51WBxua9VGZAgcmdAON8V3J2mzF0nWhuTVyu1vkWTWq0fRVbwvT/
+LkuA9qgPNP2BI0NVNUYcgn15GjJlzXGxO2l0CKwzrqEOV1tz5DST9nuMCEKEEqeE
++nayE4ZUJsLf+wF6hWZqQxqalKsbMR87DJREQ5reRKY8syQupGn+OjMtxTJ4nNC4
+NbDpPFaq1Td5pwtajX4Xz0v9YjMxjZCRP4DnaaWN++sFR4s3ncWwri3pK8fKMC4b
+gzsofKxyN1E1xHHozDTfckGphSsqBzFlTsogs55UeHY3LTl2alxor/REbwhCnMVh
+HXnu0O+hNV1CsqvzLlBo9Z31OkuKYm3kW4jvEfLdZ5EvcsaHHRWYJTh7U4yfbxB9
+qoeReskPa1f8X2PqVpJZevjrRO2HPc+cfNI1XneWlud371Qhm2VPgeEd3r7ZF6lY
+BvR3unFoPER3xJ6Yid6Ezdk46LIm5nyih7JcGH6nRMoJogdGK+u0JzX3T6DV/5ZK
+2c66zlJ0tr2zwljo64C4ieXb7qV+vME70mCTL7E5rGiUia0oyurn1+2lYo07tCXg
+LJ9/tK8+e04acjQCw82A48Aa2zPgvH8Not7ZBMqWVq5J+iPGdivH03b03ldkrM16
+6GDxJy9hXQxUp5nT+4XMgdQYDC5VXpuyr2dJihbSyPw6P837goAKdgqnjekgQJjf
+jjZ6VSyMmb/+K41onpAAv5KtHwH+RWEWlrLVb9xGOCveWe2bDEijFIY0CzaonPdt
+3j+kbntB6snqyVTaz84+l5kbfHdIpBnXnIlJwHnXG215F01RsIRrrvgA/tSsRaAS
+PS59iAuVkUgjYZlrDVDLR1bHgrrMaL/sb2fVwIwV/3eFwW1w9D1+Gpszr8WKTm8M
+I0fq5eE+/w6bALDtc+HoWKGC/avMt57fqcmgiG9F/1Ym1ySPaDj1kAJVCGQRliZA
+I3RItVtn5kuWS5agjOn4B2NLlKazmrkXYUTrcBzVZ9U2i0RYHayvg+6S71ZnnH82
+Pd1LIxTEDmj43lTskve6ys2dGpgDk8aFA8cqUiMgl4VrF/jdR3vkSjarr1uGspNg
+CTEyA9BM55h6NgxKaVguGoSufS6ciejD5ukvi227LzQkqGk7chBNumytkqvj8Wmn
+fa87NH/Kl4Wo0PYdGP0ZlB9E69WV2Y6yfFaR8L54OkmG8/v7tJlOmG5qHRcQWDWM
+PD0ebM2P8vxpT+B0t83GzlXFCctBY/0JNooCbo1IrXGkNrPH6lp/F4VV7S3Ggifl
+3//9X32F4/SJNH5s2Q7hYIgJgQfDrUoYEFT2aq3CVYQCAnAnL9ZWnUcIlbPNIWuv
++dOyBKV6fsGpDupM8jrPaM/LgxPvvsP6ncM6VAY+DzYhQYqdQD20eNvdrQ6VvICR
+nNMGeJy7ZEYbGuSYm24d7xbbS1FAOPoBEuc5qyb+hXSXqEWWNj/ndNmdpaeJCYg7
+4EDmqElW/J43lXS1v59buR+whebrbPhfcjgydBRS4D9R6eS9KJRf91w8/WapoxZA
+kyHqhnThYVF28AYssoplMO6Gj5Oq5fgd2lRwPILv5Ct30SoUmQjNzreoKgPh3jLY
++H3WuWVCoCK/ksUnkwkXCQ35Zexgf12tRVeGaNZuCKMvI3Ct7XrV7x/JkdwfCQmR
++lhQST5BP1iNhOrLxFGtOrBIBx2jsv8JIctZjnm2VoqKnENU+TFZ7qYSu1vqAmCu
+A/hOrLDaRpm87Js65YzVs9PR8Lry/54VS/8pfK/Ripr9wGaJ/xnzqYIhZAa7wMSt
+VRIVhBLJPmbB76nb76zFMFUD/ZNGCal4mrbHDvMDpSlDhZfc1rDo7pMFO1u/tKq9
+iLZKdpQicVZIebZr/roukQG+p9o6h+gmTMKMo6UQ5xOTe3xOjosGQxpWurH0rjv4
+rFla6AdcO7S6QcgxAGwAZ7rJm7X2UA2pcpkmgNn2FdGVx5Vz1KMUkvUbMv0GgE9W
+rWiog3b5473Ub6efJKeIOZ5+xs3rH/jnd2FuwA87tGNRN5AxkDWdjLl5t6rGYC8W
+xWqccmov0iJdyuxnS1ZE0ZukzDr2qpnfzD/mXqqa1Lo/C/AzR/4UvvmxNAcn+Hu2
+yMmjiuoigDkRGJAQG0iw5hS8KTe4qq7DAUvJPki6azL9Lh0jivCNEDFcRZiz/mwA
+BNd/nBromcHAdi0BB2voZ5Y1+rK9uj9N5Ysb8db6vA34g8TVcczrVJsn9Hhvm9fv
+A66v/ST83YPIMyMvKw7/ENTVZ9F1CUfuQ87lMsDI0ShuFwZ35f3ecS57B23DmhVV
+XyIE0RNc24aE3p/SulYR0UZYh0ZT8mC6OiCN8EqTL0GicuW1oiXdILs3qkHeoXTR
+mUqqUWSyB+hqhhAmPieQN1+gjPA8NhI4jhVwt9yKAdDamZXwCyp7I6HwJRwcVTK3
+MKXfttSZDE4beTG/Ag17TBzs+/3hDjWsSJM2rEO6efcFJQuEaG62GuJO58n3kzwX
+rTQx7Ck6EalDuVnMyKKURRgK38TCCd8ComS91b66wDR3Ofmc51UoOcYAHYB1B5Qj
+QU4hykwO7d+aSXfg+agjcGuEZqeGuHEhkgG/oG9uC0wTB6l+8QWTFXCr90R2jmQL
+6dHt2e3n80Pkz1/Wc3K99VBAGSRu6zK6tw5GNbbomxxnXVm6KtlpMGcYVUFA2Yzh
+3Zj+wHPtf/fwPQLl/3/HRJyyVzybUfUCeZHgYNXtd/Qx/Ryyb63pJreCzKJFj1Uo
+wkwqOrTpdJzLSdw6g5HBx4GkA4bGN+QjfLDI0ggI4LSePsnsEhqZW0/WK8VKpZqa
+yV10RbgqOu8jwSJ+YjEA+d2Ty7kbQUNdD+t91tyulQ/WW3mrDxd8NZkjf7C5NaYt
+mh5xYKQbLRsfqoJ2vcJIe3FTuCXhMBkuipDsrSGA9HNua1BdtUPZezBKYwf6EGAd
+GXrsFWOh2JGkvB9VhXtqtqOWxahD5SNJD5gltrgH4FGKSAWI0NcgnMKOpoLsiRGj
+p7ze/XnsngkPtfnSA6mGdYqE8WzcuQvLOu3doA1HmHms8HOH7VNOOyBLrWofFKjR
+XCVhiw71LsgTBpQrV1O3OzgwPERjAf/cp6rtEsw8ttuYFJyGqr4iwWJH7SDVD/0H
+n6vOGpAKcKPNm2UGCw4KcasWnrgAgox11NPPcKI+iWbESCOdicdnGuMSjNtoMgWY
+4hh9W3c4Qn9guKbrwO4uRXkyrwEMF/38PplW3f5X/MjSBgF1pNMHQzx2R4Q1p+QH
+QVhRRn9YAZeXqPXLTspJ6pX9J3RCSJ1s8i++iONWDjlSMkQNN10a7myHvW1+M+I3
+9Aal9uMAj2E/yJs04l/jgI44qt9o6h5mvYBD3GKseI+nsdxldHCA3o2yHWeEnlDf
+xK1b+D3RzsgBC7puOMH0n9md1Xf/7gHWA1M04gTrEv6Y20wErr/Eaq3ME0TIVTSz
+Dsrpflb/fhXH357r8UAB7GA3nYw6gYbUEbSN1lGi6pOVvabebq1G53ByKtmDqt+p
+YXP0PXA/BsihoWO3wE+/caULBkd48eXkOj1CZAb/0Exhwev7MCfb042pF/WX+v2E
+f7pczK2FMPB0R4Ry5JfWjxYF52KIX+TU+7tvE8aAiSCqKApW6oZTUJnlm/+65UXd
+nmyHb/5PECtsvXmA8RgmE5udcke5uyQMRtK5Ujeai+k9z8R7yiU4tVQ8UUPigu9c
+R1j1B/5nzJt63LEfcwzXeZlRGh+yDjsbugvTQYUIOtmuMxpNRYDGRAUKy/2nt5BV
+bWEfPuZlJwDFvAWfgigvrz/mtU9NSlzvPhGPcOE5q8huE15smufoLBomqP2j5yLN
+AP/zoHxS688IZVJey1L+pCW4JHQA7QsOFqAxpUIZwCPFO+tyWA9YtWatCtxf1npq
+k7aLjh0RVmGsyZQ9kunyLOfe6mFnlVxFnQ9G51V4Nje+nS+/B4o74LRquVYH7L3N
+owC6jfiOko1rL3rkcAzQkg0yTf4F2di9iJ/1Et4GV6z5AWudyW9AJk2T2MOlkbne
+qpMzYDnJuBVVdSIi4bxFDA56tu+iaCWVs13Az82c4fCRVS+7UzFqmM3QQ8iNw+Lk
+WlSuuGVrGFgdOeS02KSnDlV1oyWAfZ73M43EpRTf2wWc7Acol7tzyA45wD9liEgu
+7d0RLdiTnT7CSNHcWLK1gNZxoTudLNcJ3uGSqv3yIsQekkzwokg4QmQWrbSpUyhG
+lFG4TgL+4RE1qzjPpUzVKVQGRbKhDlOB0NQJ775ncE+GNt3bE0I/4RRV5xc5ZM7P
+U11TKspi7A9Fg5wCavG7m/d0AZCsqjMAyy7mR275UZwsBLRsJP1bQbQP3ksBepz4
+6p2euzbWPEpn8xd5QuBRwsw7pRVkuBk0YG2VRHlUdlyWTvxBQzG973+9TRh+fg3S
+bRPAWrNNzMZ7KxOZ/SYalmAnchOn8kfJIMTV9UNMq923RqEClQ4bxHhbA/CBhrRV
+KnJx9kngfXPtOdlhgjdzapwuSG/ggGRYLsVKJV2QGRqNvrkEVAaRQeIPn+whY4xe
+PGBND6QGrnmt5aqc1nBCJleSNinZjgn6ZtvvVBi77W4WrNvzDTLNFBkYmkgCkKN9
+2EPnB6i8np6UuRltIcBZ72CJY+0aOnACbKGyKo03x7d2YkPo1xgUw3XksSjfs6yO
+EOa5hEdh9AYAHjVPrlo7m0f2/aX8wYEzDk6pPdYh+WvLgvRK+1wYDIfvNSj2Lmj3
+pt6wUV/omiKqLs8yskQvFDpIQPichBZ+mPow7CHqkGKRo78Srls3rdmArfK+/1Jy
+jqQ0C8sZnQDHho8dVpTIuzWBmVb/+7fUHAZwUulBmThJ/3QxGaov9Q2z0O+f5/AR
+FIJaxZyxCAAlWxuKXiQ9eZASJQPAlb++v48RTrYj3qO/io9LKeIK7K7/1lSd1vLy
+EplYyi7CnziyCgcjTRtvu0N0HjzvVY1AO26r6dUufHPrm4mdNiFLi4nCWuR1zDfO
+/7+k+aKY47LRLx0tSKChpoxVX1A37X8ygb0eoAtmrHnzA2ZDu4Og4bEyMRd495AT
+HhnvgHwDz1U2LrZX1lm4Wfrt7XgRIhgZIOMlzYuBdW7ixA4Riuwvcd1/AM4ayB9w
+bEBITp+xK7Na6Amq0+DrZlboOXztGkdy1+eQ8sr0ra1h/ui0k1+rTEytHqrDGfJv
+drDnWrf5yAqOULjBuLk+RArTia4PXulfmNPdOedr3guT0ugzUvY8j88Fok0Pqr4K
+GF1S9R+8rTnBb00l7HaYg042vd/pseLAeMiyi6muZvVIk+k5haWI/i/UUpHDqlc8
+yC8x9Vw/4Z6GBOaDIv0m+e7PaUDco0WzyB3hslkF0Lg0Q8j69OS2C8Vdx7t+FBQQ
+2RHl/R0yQL/ZyyJq8qYvm+bdVsEnUPuh83y4vV22eLrQEg0Dalzy2Bu+9DOI+Az6
+5EjVOnzB7vm1cdu048Ne+cls7D3Xv+29hMp206IS4syowtU7JIPceynsFelszw7u
+HsUwV/UT2Q69B6oh6aLgXUBI6F27fdWe4XAVoAAwCgYIKoZIzj0EAwIDSAAwRQIh
+AJafX8XUATiKk+UQ2m60bhtC/2ZJOE7bPZ5LHD44O051AiAaUZtdRIZKZVo3oVlM
+vXQQFCEzut6ur1mhG9ZPitTmaw==
+-----END CERTIFICATE REQUEST-----
diff --git a/certs/frodokem/frodokem976_pub-spki.der b/certs/frodokem/frodokem976_pub-spki.der
new file mode 100644
index 0000000000000000000000000000000000000000..3b714f5bfc3310f75d6f5cfaf92723ca7f1d4db7
GIT binary patch
literal 15653
zcmV+=J=(%Bf;}NH3I+%$fsAni0tW#Df;|xcmPOJ#P@hZG?*Qv7{^94&k=scl+-<-$
zVXl%^n5dN|R8vzV1wSw3px><AtNE+wtYb_Wma+WM*;4BiMP9P0xgp2OvIUYbnoAAi
z<ED%f_y6Zh1Mr{D0>j=?BUp-lF0;_XSay;Oaa5CNmXd;)lu@_Twtuq^d0HKb7^jf`
z74^I6_JWs22`rP2gyd*+t@QNnk}2{yTiu9CvieGlh`QseN4_T5tinj2vHtF*SJHqe
zGYDiTn5%N?tGW&2Jt3XlWc_^KIcr{YR2K-~#m+I^Z15F~fL-S7ujoe+wHP|KY9Jk;
z#?d-%7}$Dsp&oJ2=^c^i%pZq=^Nw5b{x1ZyT~B8MT%64ZD^$+g^C2lf3qkT?eAU(N
zRGmBmqNnl>uudq*8y9_|x=#a)4QB0;k#u`{l<S6Fj)-pp{z;0B1k(n|L14GQZ+cz-
zV)^SG{L$@0HFPp8a9_Mq<aFc~jrE^A7la{n4vXRc0SY4)eQ`_grsYoQxj*DXBX$Eb
zc*%0gNED+*>iJ$`-rRtX7}bq}$X#i`Z;EK){*p)uC0>&>9-|FSg7_3bf{Rf5Fs`(E
zbAcDe<4F(bCn!tBYyY~Ng+nG$pl>uPgSBKnG<MGSPy1w`KVtuUggl<WkUQZbo`GA@
zOGl33;B{WV#Q{1`R(?w^blUb{$ydDofUwL7&}<EL#HWb<C28AA&Tr3{mHPurqO*p1
zE)#~_fvdwK6>HtefjH`df=?ua2+*YPT2$71QQ0hCVlV496t{Jb%dW+C+(7Z|u6+*v
zg00-+!>+Bk!O_M?{iqXsLzJ%y8h=CNgR6%&w+G6|jGIi{D7qRcvHwZa4o0?ICaiw#
zpK7`)@|g23%+WqfPA%F?XKJk_I3~g<m391}Mqn|dN21`}feLz0-KVlbtf}cJbxID*
zD_Gj%VQF;W;sLcq6cFgu6g6ZP+)3G6MsC_clSCSKi_ZNtM%NY4yrRyRdEV#=WE!$B
zKw+T86)kTlmhI1E<`=sE$`yI77cSZ0VV0+mJ2!LLHEOFi)^9}L6o51vBQgKxww|q-
z+Dy3`M44mF^9DO(&)~V7`|}}+h=OfdC?-+yqneDyR(p9!lEcWDI7+klUh&^qowl6s
zsEKoa=Mu?a8WllhFJqU;QB;`X{By<rk?7T&#z_NT9tMTwkiM(|+_!rdOeIhG*wAjy
zHcL1$CRccGjHHo!;Sk*W_+ce|^vJXZI_;#|i5g2T_5F)(iutbTDaxF;#|ND2gPWIR
zF*zE%*TCYc%Pxoy-UI{$&l@TufoKkGO=LPoP(@97H7TwcCqdSrSPylh55_utb7+$7
zVA}`mnIc0ndeKKOu8+r)I6o=bshfFugFi|k)G)q}z~jeLATSf#lW_G;ve&!r*-xru
z7%j=liE;iZi^@_6Rg$uAI)flic!b=Y*h$Wppdboum89`T6CO-MHyVOvepgn>z0v5(
zx$^CQOSw;1l4H}<Wzo(L`*8yUj}|xFn+p`l@{H*(hpPSRlj`HC+<&A^?b6s#xtHt%
z7pCi^67=j>$y&+!K-I<}Fi6bxjC^)O<Y5L8hyHG53Cu$UZe?dVJ`h*<sL^+(Le$jD
z9|k3eKW=5QA>ai@5i<(X-g3t})epFn1Rvi_hWoG1$nhZicg8`M%%$^@%kyGmoiB9)
z>kIqe>he*YKNyknx@bD1R%iCJR>OST`Ku$y53PNADlhDE_!uNcX)E@d+G)g%7D`9?
zQKjJ33;c~B*z$cVxR<NjIAq`R2j6KtzzNbb6S(2g--E!3$yt`WIOr;8RG6YK!Phwu
zJ~gkDiAAJpu0bNk`|jg`Mom%{HYC`6_-)nXQNmg<$BOO9iBT}mxO?g^o8%p?W9G>J
zP)oOUD$Ai>?TpIv=B5rA`bqU*KLzZ?NbI$5LUl31at5?rYv20`!Gt<h>_|M4C6jp!
z78n&v9UK|LG<K2FDO)Oqac}9A^ZuO98YAiYTgk;%F&CtEb=P;<2-9J8zs5FS^#&Nw
zik#FP6Td7Wj`Dazz6}{>tJcU9LUQhTS%rp(u{;gf-8zM<5;Q_nry13Du4_F8nU_Fi
zo(uDojSqki)BWvm1Synd#E2wjN~&tZpYLqjwPoPle>W6x(JvvOUkQ9rzP@@}X}L+_
z%OIi@EfE+cBdQrp=MaKGumm2G(W@3<qyFB76L(dTvvB;~E6^J%ONnft5G+P!(z_`f
zJktiP)vIam7<W&G$E*#hf?PbibI!dua*{VyT$FH}7b9G|(@;|Dy4^2_N5L4~3Oz*N
zqW>||v7fmwGRa107wyAno4_HGQf2KmCp1($In{QZ6``=EvuIf;bGt%@gmeYWi%plp
zV?*g5rHjH+hU2s)10U`N)JNGGgKJVi%!M7*TZsugOuBGJTK6C@2oCHKYx}1VcXmoh
zRZHwI^L8JlX4;rR@0@M?0;1D`$snys5zJm$niQ6IxXS0f^L#B2uQ>nfb+{t2sL(s&
z3_4q*87VE?+{wB#ByQZuo~R5Ea)bKzX$V7N9x7}+Mw_Ss^x))u_|?2<&x55fo$$2t
zwSxT=DA9)r2j)JjdQ^T0<zkWc6S@OE>6tg|QVU0k9sy@&n5&o?vz6~HVHr!`KV@qE
zpwz3IB&rlXY;APIJBX*`7L<nf5dRsIMLrfe2={Z^Be_^V@PUG_Kyyd?-j$4$kbA=f
zh@2M+@SqLCKt<(aNZ*aq7NxHIRjc0R%(6QYHeK`KS1nOYKq;Hw@nYq6f^j`WUbT&{
z$b$^?x!=mOLo+_zTywOEFYm4oVcDk7xG7q_{*`nX+;TSVzsgAO>Ym|mGQztGET1Ho
zCCH-LC@>MHu~^1QPZyBkZiHLofgs<Lgp*6Hu)k4R>LLY4J=acH7@Ou;bgy)RSt4A1
z!QM2!gopfkLeL?Yg%-i9@yoo)5*wrleIjPYQ)}vKdd1h&)%>I^JJaMA96N2qJ=iku
z|8iwq<E!_&RhvM*%yTc4PVj6Eub}skW42~UNAOv2zCYEnRWsA+c82Kp2D7$5POmto
z<U?T*m8xMM+E+yCJSFC?lf%8;L5-wWq$jMkora>jZB8m0PXhJ_hm5e?H6A3>dedsc
zQoUslpLPzxOvFN5+oG;Oy1FUB{&FTn(@ZXhx)i_(YB^@h6T=#<b5($e*e*br@*xPQ
zG{Zo?`{nwEDNHI@gVi0?G>Lzggtp-jJuuB$&p*2Lyh7FwmybI;*yp+kIKK^-zQ;`{
zA@;be(KSGv6-pPL%CHn@fLtHQM##5|)us;`IE@p~I+B|aq(L<Iy%?UZ27O=*K1iVi
z^)P(eubjr;yU8D5e_Djhn86Ou+-O!G;qZg0;cPIVv9tFuVF%sGc~_2MpE*f!pa#c-
zr1Pc;QPWYTLL$3~;z{F&2+KdGZ@rjqlJr>KaEOYVclU+=^&MCJ#N<~@fyVZt!_&<T
zH=5*H&%qSqbiYDxuCFt*5N(D+GXFbu(*NrXVj4)`6vp+lqB)RRRs{%`uSp@0@4<L&
z#xPQTy<_Qh%zkJ|XWCzN8$c6_dIU;C)^#!42h7MTV^ZS)=KEu=fvY$$H28BoMAgyb
z8Vms(qyVPktJkNJF4{!%^*tL9ZgLh_qUhk{6~_^vs^tHE^HyBLNay^^1<_&I4$TIs
zqmHLxCc3b-%_l(*dcx+3#QqtyBba5<+!dt}(Q=VpbD5^V?3Pq%DqAZC%>X59#hV6p
zcstgaK1Cy;r0Vztv9Pvl7@#%j$c9QQwG3Kk^J=``QWen5pE8`?ta@RiMcMa^Y*(45
zi!av)hMdxK{kTUsHGRWu<=AF~y!s(uOwJJz&0!!Jk2#iNUti~I^t(JN(BAKQAw8jQ
z=vzl>1)5u=WMtI!Ht)^wH9Pf@UUvp5wSw)`v_*3UK<GU&C+rX`3k3??^2*^jfmIeD
z-djXCm>Hgtp{)t>@m2|iKbzVuq&OcWaG;hua%xRhq0cKcl)#ESWSjjVU4>-g?n5g_
z@|<l*Q}w-}qE|d_-ln-m;e}ZThliEj?wu^gkn&b~%SrPk#}~`y{I8g;jqcvqG<&A4
z%mP*FJtk}XEy6pGhn}wPQL?B@uuNO1WzQyd#}OeDXhYlb<<HFSlNMp=(bH6uq~=L*
z0F1*VxbcFj#S~c!Uuvs|tfKa(?W|LM+$O#HwE_qU1YDn#7~|#Q#m}RQfg`7b^%Yvj
z=U-<4bNPf;#1`1^#g{`S3Sr&}@IIlt%2!i5USM4m)<w*cq1A4c2gdx4Vhpd=0Ebj0
zd+ysczN?d6q+ynOzmobwYTk|09K6}^?`2|OOyY%@u+~|7k`YbS5dKWSG8@O74boyy
zftxY`u9?rQw&M?6PmOkNLwrj?n4V`ZjVmcKO8}MjRPUFQQ*9q7Xw|i3%Wtt1C<Q)5
zQD?75`u&sW6LfWPo!w3ace!UkDln=MVPg@oh|<PSQi6H>S>i;dRH_9y<)jS>;E{#a
z5Fyl4-vGJ!a`Mr87+Ne+occ{4;kEC_EV?{p4aFo1rL(d|=gRxl0>$_e`B2q?Gu69Y
zrRxHHV&92TYLODgwzaSCrO)aidqHf*8cVB+Bb$(`f7<iecFjjw?GOWHYl^oMl_gdE
z;38U0ZEL$O$i9#gi31Dw!bT7@dk$MkM#HrCWw^?GS8Auvgds>wE0Ut9HS-^;lJJ}A
zXd<#2))+`3#K)jvi3*46I36CxGDev+rk#P`G6qY$Cb72z7$IDiylQnJWFW;IjO{&#
zm{u%LY@I|hE7SCkss6Uer+kRblQZcBw<Zx!_$2<X;||@T1$Ziyt2ZdzQt$&;klqgd
zMxUT>!cJ5w7hqE=M^*dH9J6q7q^;9cuk2Y{AzD^8eLPj}v(J-<(=X;NLp*Pmv-Xbu
z)QFxS7@QFK41^lzt|eQSh`asR?&A(7arz9`qDV!}H#Q956INIIP#!~N9q>yin<h#L
zOrqwYrZ4%R!y09_y_I(pi9V^OHs0KS^?H?glJ)EN1ssj^Yw{A@x4(-rqY7$%focby
zDZ0L{$rRzOv=1+WZp`)A(t;+Cg3{JY1%^+Hk@D9`>Y+5`eVSx-rlcm=Y!I%zq-458
zr17wn5khrh9s{u<#RA-LhUH$};P0RJ{TR8>=tj-8_Bqui<G|htT*_>>Pc+bhy9#Ju
z@td0FotiWe@|6-w<poElpZxPLa-MBf>qqg`z7t+u8umxVopm4X_9C~IS7J5vmk6HN
zQ&10|g`j~EOQ+i=0@q{ysW5$J=a4Dq+@5_u*jbL~W?mvWG(f_=dPdONA?O<LF%j#U
zWs<%M`+-y<gja<FB~6-D=!o70PT1TqCFr*Mn<P#g=1{}yvN`;svw{A)1r@6K)r?62
z+JoADk;Xg5>v6qR#ER*V7yJC{vLYBwp;`z}ZtzkL@nzly@exHjxb_z2$2A<+t-4m=
z0!Sm{`uKc&`R4ZN63I|UWRar`jNtnXK&gb-nJozq#@@e26nwQzP#C#0FUYd*8{=N!
zUo$~1u_k4SG=^MnI#y^Oa#8UvM;=t?-fUWX*!JQeScpmZ<})h3ZQH^OP2OTr>zzc4
zNb&oL#r=W{G55k#skwINMpxwf)6|+B>d21FHm6i_Mx{2dlItZ9DgK!E&2^(Rt2}8u
z-|=-Fw*q1{eB`8UY}YNWg!~N$TRXUO;E>=Ki_EwOp*HQluPKUu@vVbp%PEvWPbO&I
z>H|e2C5@(NS7~}SVCZ=eV36^uFV(SK1|ha2GTFAOR?F&-SqO=$v}ia58>EC0W9gC_
zbclvN?LQV%ocBC>)C{SjXy{7LW}*S%3m>iF71IUyh=vl$HST$amjBs_=Z(vA>}VA~
z<$X@S#5%o9kvNd=v%OSiaa72|*jjYHx$SUDp^_PhyfPX3wK_au{iA&Ro+MXwGrB6j
zGHBJW9Iww3KA;hBKCh+Pju4T*?t=uT3?GIHq2O!xivn$pqx4XD{81->LutDk$WGZ_
z_c&$UCPS|9U8R`sdnJSgK+TLuX=5VotUSCrkMHdwl0K9``Ct{KSNgkhyDv#(y{w1K
zlridkXjvU2v3}+iBB0%jY@be6Xl&fJIb*C{2^Fea#2K=UHu2h_SA1Lc4n+hzhJGZl
z@h%yKd};Ssd=%L3#BLzOK#j4E#`GRAfESPcn>=ID{vTHz>h{SJ>u-Z@igD&nNif0y
zrbfpuj9ig<j8?%jYuboSUN3_+Re!7Fb2C(8Ki^AhtjB;qh4+>~v<+ebNAbKzZS2#x
z7(U*I<@Dx6?FjBef$9T5l~#$%7oXg1z%B(`U{&%!7PSVgocT|~<;-s^_=r~S3A*P`
z2xgg7>qT=9X%!b_ds~G`DLX_E1EKBF-ICD4`pf+5)TP|uhR|LeR!}9*ugK_HXIj_a
zX|6z6C1HtzSi{C+(g2Cd1wK#4O*iu&zI7!$QBn6WCC=)CBOTh6r&yDLc3)b$JZl%i
z;H*kkHii<g{*I_b_O{+yKIjw#alJH)Ic0L{h_lvr8Tsil4hLub@gy61bp{kV21ade
zh4<vi9&0zfb;s_yxBm#`w2r5X0@4qIglrJ=9~u=>FiXpU7&p|U9QL*h=UN#y7_19>
zjxB1jMb}wl=u`#aY}(+NGK<V4VWo!29Gowy#6fZ$mEhugDOER)<|L&17~?RY8&$nZ
z*G58OqmXq*?~CL9m9@dBVMp!s^9wN977iL2w@8QIaj|i)uW<0z<-w9z1c~%&fvQNH
zi_Z|7^s~a54+xk4MQ0e;^386{u>LY7JqWcp@8UN1K|q0zODVxvWBCT+jG=O;zD191
z<mLHHuXXkL-#hoq+M3z?wlliWh?!~Xj?vr5)7-AWpDk4Fk&>ABe2OVD0i7f>j(3B7
zARFea5c_&gj2Bzgdlu%`KdOH7(~EV}mm_*%C%a+yj13-e+me_LjcexJT(`P%-n-M?
zb8*zOQ(Ahze>RUSYF3#wC2^^`kQC9S)zNF6kOsETYSa(-wpHw%Y^x6f(Csj57;1MJ
zn7@XE+G-6R?9dgd>7e%`&~`pzbB<Us#U@#hbpfaKgtowDoFtYs-n{tawdQXuutwUp
zfQL&7IeY*R%;*my#8*ZMa+ZYZC=tyiMJl9C1G|EIG(7f}(B>*-zeLV1M7P=jF=){{
z+X8&&mR+i&i8RWvPtn3Tr|%{^4&y!0p1&=p)yXZ#R^Ci1{Xt9;m|Drk40Q1c!`_x5
zwepHV_P=2)q9);3@^*Bdk#^x)llZU;ln?{wC5xlwk-XxyIHjCyBjR6ahu3zRKS`E;
z0KGrr8Ybt6H10RnaYP?2t^>65bgon9EPDd;&jsx7X%m*|=ZmjzoGknFGOln^8F-*c
z8n^?fgsvC$RXWU}L!U(cllK_q_l?qxn;`J^$3wh2woW|G0K5Uj4OyvOu8V@DxVFz#
z*dq|w@h4qsEU3v<kRA4i4N{_W_U9)W(H<?X`|7Tk1@9?&&9q&ii>aKz6<=c8K1$q2
zYRwp38?nd0Rv7^5k{!L%#8tp>$-wU6FA_ktQZNa!4jn&bZ9O+Kmi;zt@=Bi6e-bGo
zs-q$?wg)*g)W96qkj7!6NDZlohA-eL2VNvFF}8uU&(Ew-wQ(!Rj9B;JA!{Fg1e9Ae
zBfR}m=^5q}hZ*=`GLY8IL14l0pf#CEqDU*+l(fYgE<pl~{QscsLTV_K!h}WovrLKJ
zuH_hMWSyM*G-+J1ME8^pVXFnu>SK~+jH4NHV+B)z*9wjApCHfYkbcZL7ueC@jTF1U
zvXnINY!+wa^NGt)(YGhZ#1SK-3)*4;)yvCDZh(vWPQ_fe;@%<9@v;C;nIto1djCsz
z*xq#_bu&X>HkCnTB}t_!6?8X28II&vm%64#9?V(R01o?Mjuz3jiH1~?4#3V8zv!(U
zfehBKdcpag<o6<J6D}F)7PU&tB0@|{><e8EmJ+fGka8_adGmcmdFy*3tmH_O35!-G
zU`af;nTPr$KI86LdcxToV=Kd=@DMOcM!Rybc#Iw}qgbJOdCJfHV4Np}JucBo#sWC#
zNyqf<2!{urci@J+7FmoMI*R?S#CyKC6au6nW;M=7jJ26W{>U{LU`wls;KZS<iiLcw
zXERDoq16}<s_&=292{Ug+(h@~o^Mc%TyRrYrL4teP9!Cd{ZWFTpN6vnaAZ~`B3@Jl
zJ;ye&(|>NducpBHGa`TArNd63ve(vvSNMP3YR&_Ogh?wWR<w$ZQHe!GRF@i(2x0}R
z@Vg6~eVLqLCjNUOOiO8`I!$_fPmShZ4DS^2GfFx?rUwlwiTuB_vy=Uy2ms_lydLXS
zJ&CC`0ivb)e$)E4a`DE;NQ|eI#=GeNoZDuld5?Q4s59+b3ZuOn%oswG>2{Xj<=LWf
zuoFZnS+YK8cwf_lrF7<xyJ$^mZ4>eIZYCi%+;z^`nvW87sKUpT?uvc!hA|rfZojMQ
z&c|Bps%%5n(lM>IWQ`*qg(SP8wMzRsjt>)(BV9HMJPe=R($YJl^c8$)DKPm1m&~Y$
zOkq2EvY3DWFI+Mk=^jCUB(==Z{nmO=4S`-mIe;B^1h?pWBOne+JvO#A%Z>6z+`0T6
zo2g12k`wu*o%&L9uuDkd;}0db#CKQMF{GhGg+iD(V_p{1j?h?oh5L4xtfJ44n6d%V
zbjw<hw>OaWG)Gmqt*A?9eG==9T|PLU(if{RnZ|5f+X=(g%Eu})@NFQUf?sl-xudbn
zg(-Ijd>(5s0W)}E_DT1JcqaSMNGz9c-jq61m9IwvETHEzemaHk1<x3QT8S?r#oukQ
z9FGKST0FMq>K;B(`LyuLzAPhq;27-J9at4-$+BB2DiTG^>i?vjOQ~(M49$)1J@xT1
zAu<h@u?_-Z3RF&JM(~x6Gbws4m9Dw~(h*^z9g&8ULndb?zi0gV=Zk+-=y$tzI8Dd1
z)>?)w1^JRsmg640=2{*vu3w*kDkD}`A1Y0Kfdf(28eY-afzlpGqiD$R`bRzSov!#g
zKt7ylq}fHU$Dz82I(SA8+EO$(F#`GYhVuz|3an87dk7orCZQ7wzu3!qZDtX<ZFF6|
zfms6C_fWdEukT+OdRf{)isHxg&v27KE(rpsG|;d)JB$<0n0nTW^*jLv(#=q`x5B!E
z_{Vs3tXq_2NW`@}<(xMDR+F$G3k|O!Y)QQ}Vfw^>7-KVn$m$Ggs%S3q*BvvvQTF0F
zhHEk#Mb-SFL_g`rS2J%P+bfWS*%$pwjIbu|<_35B#-Tu+OH!lvAt7}kigs3u8olQd
zvzVI@K@1Slo{sY$&?cK|AZCnKhgg$l*|9-pWkh!KVn%umgstfj$mMMdZJA<kySV1i
z=0`0mf4d*A%X`P!(c&``{&S$N_g!p4IL$q)+Dmv#`JqUR*g{-+7k;kF*XB*dw;w9j
zL-HQDv9*YeoUQL-Y9r_<5TXRY(+spSSTtqmJ=X1~({b9V*SEq#P*2laYqCjoH*CPb
zHmx?^I><aj=$ziVSQxm*hD0&YzI3?2GLmvu71_E|ngkhmuY3^XYncKs_pQn^4=jA&
zFC)|d0Fg~n#u10~nNKkA2k5!fGPqka$szqK_rxWKrSZ_(=uF4xLUSsJ@i{R+ifpFb
zmt5-5Nwq%cFCB~>#uJTosiBlEbLAf5@L5<EvR{<Dh!AS8X}9ZrA$tG3^a2g}4p}!u
zGe?ME)#M;e07AW2*K(CBF97g&-vN#cj&$Av2sEQd%^R(_3W6@m%XW+$a$P2m$EEl;
zhjw;&`BSwf$lLP~(FWE|bIkVJ2Xa1(B5B;=<@NE3nx{WVJ}}f3iEjO|>v5HcdOBHW
zTTbqu1xODhKyE@z{^=a<lF`xJATD!*j;1LMHhAlgPZ!`tnvfEl0>p@NlTd0azCVVG
ztW+hxQ-{}^7}65%<ISG)oAU!|7n0&4uT#WPL|gBO=EJ(mEzH8XfQ2qkYM{*}C|pED
zev<Yyz-B}aOk{la_Lw53k7>+(<hN<L#c_3_v;@?J(GLIfFQ^+BbAlhl#4Ae*1wzsZ
z)M2eD$sN^v&R0V7dLfff+SF(jp^=g!9ggTO5-eQ7I7-m-Xoao(nd#5lk|o0P{rLoc
zAF((?1&EiEgKg`5^s$LGFl$2cgoFVH@-Vtf^+~ynkMx}R?C8GJT}YZNc<5A#jj#(9
z?#z>rAT#6qbz0*Y3VfDy6-*cKvyY0TPVM&8>}uGKbLV^=z}V4}e7^oOJ1(ms%Ww~J
z$v|33NRcxHF5;Rt(5#dyNhw6aFege|Z9&1Q_L;0DDqW9?F|3vsJ4h5bf_pmCoP7rl
zvYEImhQ!)0Rr^Jf!wDkVi*YIo@)RYUABpjXv0O&XdiI8o;|A}F*8n@z=C;1rAHBH7
z+Tkde{qp=Bm23)?G%E$6iD$LCh;-?>&|kL!QC9)au3M@yQVKZSG){g8I|~=MyioO#
z8j-5RVCDm@8hjlPV6d=J{Gg3F6B|r=7EvGlb&8g-7`9h@3%W+A1~(+~!5Ec)7}I*X
zvvr6YaqgiH<+6M#!pkKi=2L)LO;f5$6i!>W3Gx|*Mq^U)XI${SyN|Kx5zdbQg=`!e
zv4v<Cg{>km$U2^HP`)&&^IF&hYV7J0tu~eG`=0#d^1`0;BB^ihm|;a+R@+t%5oI@u
zo&GB5Xp-z=t)UDgsUR2FnOm|X44!sXW!$imXVN(6GL<VMrbeY<j$hq)p+RuT6x$<4
zDXO8znd3AlK?phJY}a_)amjCs^P>`d9~e5ikll|)5`lVA+a@iB;obSzH(~A#vS6@p
z;aV2qV9SHbV2A7z(Il!b7k(8|JqOUa`1AqDZ$^|D5j+0!_<N>27RkoU*X;MX3GB4C
zus<1KMk7CRxxmWcnUf8+^69b7Ot`k|-zLZKKSISe%k8r_Teug4g0a1b$0rD<(*x>(
zPe!x7|0-iTN@EDOCs?5q13+z!MX<v20CJ4#)XZ4vyCE?)92R*fAsdugS+1YmPB|$H
ziz4nXNT-p0@=|7yhqp<*cr4-_7JiDeAQe2yj}>ig*18!|tXgCj`_nholx`3FtG?si
zSR>LiGm_72cfpexV~6HXlUn?+U0Mt99;y^J#O^~?40Ivt@1Aso6`mxtbvIi++KpS?
zPGo8MO1n7s*swSJI5zH~iGD>qNupin!zn-@E$_+3XS0wM(R7LZ1iA(2Qxns4IQ>Ho
z#+zS{tGO%zH>c=NfwyxN6>w&v-pJ~-euomQb$N#iy-+3HJ*nUPCv2pWZ^?e@@7hQT
zL}tnB9hzlk)hcsSQ4>}=ji%48hWSyev}ZMUlDHTXyak5N#=Yqbx)M*l0yB(_rb~9?
zIbK-lMa9El9Q*rz;}(EU5;^`4_ELl2`s6mE2=Wx=lo=HTtaxd~guw^R7pwk8XhO;6
zs98ZlOB1%EAgMX{kD>mkJrlf^;Re`da=xS+Qrd0E1aslHxo~@O2sF<{V)<GFrtcK9
zXD2kREYx?O;z4=IdN-2XJ|(5OoWwx4Y{9*rxm_|>vHYMLafy4!{nJ!iPejS9wNCn2
zMo$Ayl7;?6R%#GGd-CP+*(O<n!FkPO+!$Vb73%|5NtxTA#ri_bt__xjbI#is{wyRV
zI}8_p#Nvt4^NlyG)beQTGDOVafHIe7t1XBQRx&xMHIrfDn4)&AdY~=4B;b<F54M*z
zYJ*4#pJ-An70usG*J$;Szbq6$dMS;=C@}4*qFskL+I|T%(F%_I0sT@dyT@;ru>>{T
zY^c%ml-%-gXCT(Xd#3QZrsaYlmDzI{G~g=!j*xuh)LJuz*>+O0(R&{OcLTH16{_mX
z9QDrRLNv@qx)}5gu~+|wYsFe%+SNZA4g;;}1^aLR53FKWZLZ_ytkZ<vN&jy_8szRk
zn)T8I3`MppoO4`se>dipSN*yL6?=F7hCsN5UOX~PHqp)RngY#l9g}Y;B7fUjisf|I
z%}vYXb9{1Zd@!OI-ytJaM~?P&<jxvatst}T71PtiEwJ&huU-OgLAIzG5ck#mq*D5l
z38E5Kz-a>+kW$$AK8(>d%~pT(h|dP!{T(m62m8&WDX+gb3j+XFz#bgYgD^!|+T(8R
z`0CP60cUVhrjMw|yYl|yVyV3>AWcxviqd*{kxESxO|{cKviHJ5)}XZV9ecE)#A1~i
zR7-^);`tzTkPlB~_Am8$88?#wu-Ue`i@k**Hr|fd5Z^}W)^lRR7wvA~e9FHH;%oQ3
z_&5ai-#-FLqbQ3jRGoa;FUhMn`#pd2xql;V?mWm3jlQGB-SCuQ_ot%%MNTQh&4fTN
zx^<yDoW*miBFWPi_i>niLtZl$lV?tXyI-|7v6Pl@@y);_thpewIns4v{$jwvOT1AL
zYV~+S(<9}jEpAb~$cW?mo@HHqiOo%3I|N57dBuc+5CdBQ7}`Xn%9<j=I@>Z&7`1>y
zM&?XN5`98LbggR6#$gC>(>qL6*rxdgZIpi31NDIsSFDaiC%C-rB+6Ggm}gB|L(x*u
zR9nrHye0@G#)8|8D8P<KTL{AMXq_&8voJavy!)8Y+7XYNA3O=$w4}}Ja*e|y8p(s`
zs7o<1vX7zEwWF@VQf(z=h>|0Ap?K+z2|mK^*gR6hca1BDZuv3IcM<$DmiEh={~hZ3
zSYExh{pWucGG2;r2GEC^m7yD#FTvG!BgvksOVe~t(Bb$yK*bcFP}9qcdRnsa^lzZ&
zL6ZRSN`-F)E$uj<6bW_*8cUN+q6IdKbQ-@$qzU<;#a2sD4mt{?ff7<h5k4+L%U16L
zfcFG(2ep<Wqv5{;plBhST23CN(}j}hJ*3~QpX(kJjHV`)TUKlg4!UiOs_iw7`mq|A
zh*9?2tj~u(cztYy#3b=`>+TcGi&u)}GRrTo?iR)OAY|1AMr&u=4$Flp`gOVnzmoJZ
zJi_k>qLOv3hR2?9twOGn{@TML^jn0jK2i6g2Vk!!`zf~9^{|RD5B7c+bNdivu%K#!
zkDFY9egpiog?0~Au5+5ew85+YRY*c}d=3OLNSSK$DV;%T$><yf(hF$hGZFxNjGX?Q
zL9GTKIY%UIV2mO{n=b*i5-qcKvi!J?_TK?36BrY6uAmwiyiQLuXchLkxS5)o#o&u?
z6%6L6+=>s>Nx|nAyBhZ(&(Q+Qk?oN1rIt*NAi4F$9?HSJeb5^ybiI-G$|`2#lBV>K
z!l48}8~v#aT|vB`EYuWD-(c1vn0%|-vJLIL9r!DyrC4xLUG*j@juw5c)y5yZFPY}c
z@7*s4p6s6ZN`gAH@+a&|bCQ2Z6ewDw0gKeUovglB**z$W+Yj31^03HDW&l!_kPqmD
zuBsAymwCGTX!I&$89DN}XrGh6K4yO3H(Z9@;<d}c(rr`io4Dx5drd{wrUbl%^E_mK
z&!MrLJr=R8@!xuhGwkS{4Bk%}T0a5U4DLG941#?EG8*Ezf!3hPk(m&=86yH+gl7%y
z=uNcmj14Y9qjZ#eI1T8b7zXPMx|{L;XharBiC27sN!^F?FoRwjvmCb+lo-F%y2HTQ
zgC-jH<!IVxQ!`IL;mZavL?yHEt|Mx1>IA)_MeIMa#1)N~74UqO#x#Y^@OlVivQO98
zRWoK|=ccZ!hzV1Y7`PPO1k9MsDe8J&VMFj2i?JEo<~B|c5UO+Zn6k9uSI883U`6rP
zV<m^P`3))5Rnp#g)K(btxOJ3R^Jg}JAdrPXR=@OPHZOt7YJe&+>C=W`K<<k(mnsXz
zXk=x{ivTwn>3bbK7ghDX#ZTC|X~fyh+kDse3U7{~L}#S)k&X2sU=P=<^>}Ct>Ac_7
zLE{|Tq~D5U6gjnVZ#S4SdIvVu%;DKJ015aKH7&!7T%vm`l?<|?8tOhSiIxoi;E4A!
zmldw3Qf}DWzQ?90tPOn*zNY14Ol9_)`|!jqYfsad@kDBEh8eg%werS{TW7tT6_M7E
z?L^Q0HNIg%cQgKMe#OO79HfC!qbLd>cUF3KQ$P0nk~AJpm9L2^TtD>ev}OYE)0h5o
zlrp11trQrxfdD%-c!oh&@<J?D6ralpJFbXA4hDa2@(^n_k1iURJw9#Mf^XA4#)PmD
zA<8CHJJsg;ig~o(BPftRSjJK>8iSzSYn!Noj6dl#wM3u~DO#I7B+w-<s)zhx+<sCf
zo>z9Q!0x*{=e>96nVT0(-CZgS&j!ZF7|^EUFhx6CsZTlm59p--9ywO!huU5wr8`C;
zI2G-baG`90D_4=;Q{5o3ZzKy5DvfZKlqeDMlN__U;x3X`pr}Mcd0`xTJBwpOvfRXO
zqLR{lxXm?a@&Mv6A5>|!RbpHnM~*^I@TyA1b;$EkZeFA;&e8e2O)#!%;5v?#QEgwb
zhnM!)zS%p>`D}0I5qB4rMb7WCucwtXo<X`Xs7H4Q)Wp!MxxRv}&_7n>Eas%xlR-1x
zNqE2G)zh-@EHfUH#)hQ^ukT*&6gu1VTF&PRYg%?$<5|*fdHV_a41>}WK3<jmF+;A)
zu^ip$oP}?l-3%!_wXbl(1n0gZHKzKQZXdj0A?a-57yZ#Nb5*eIitxXJE@>{qZ4h^a
z;4;crS^*)i-!-d?NJx9SM@}1vzK;D97oq2?WW;<$O;oP;-%C*&<ka>oSO<aQM2^ZB
z?6u;WEH>1ruyj#<Q*%d<kv#k1Om-4H;!2SJ;0<i@+X5z`JB22Y1KuLC%X|kFn~t%B
zuKMy?+~!{_b&pgU;nz<qq=`D)SJ(5)yMi<@7xuxF;oceD;OU#8UlO)CD?Xm!Na!n;
zw2xkb2g)q#_Bj+T0VUi=xsVFn>N8DBDX|UfWEBMb;pTB{*gfQo_9DzXsQ-sV@nAgG
zmh8BNwj~tDNMWcXmQ6sH_(bD0T+CYrA8wRHOK?5LVUilApk_gw!A*;_Ck8K~UF%Es
zSJrnc)!L8|YV&}z>jO)n>X|+}k+KQ8%k70Y3QA7GPw&8aCV*A~pGEXf5Nt49<sKOl
zn4%<}=4iid43Ewj*>rNV#VlCuWGveIV!iyB_5$z#W64}aiC;kK0#LW?<$ySYDs%W#
zAFT{|9}ks945dz>ggyvU7k&fs;agckLMyL3lhgio%jW#Wn?zH(XhM8xf+{-?jD`7%
z^+kCH&jYYZ^5Z$wc^cjM>0owt|Iz1FfyU;&RAxYd$(;b>d{=UIn=y2qXl_khuGaY$
zO=`4#6<fme|1L{__NWgu{edGxRW(K&f_-@!GG)ziu{&vW2&^-%p$=DDbL2FW_Ir#7
zLWB~hg!*=}6NXeK!r%J=dWB|cLmHZts~a&NI}DUWLz>=1raZGGE~IJxIx{WBGI*TO
zxHYipJXWgJH+iQET8(}e&rAJcGck>jkw1XvX{C+(>jg)PH=V_>t}W>+$I37+8-qJ2
ze5`UeQ8mPI=*%?VazUwuD=G&uWlqW<vz}CVb~i0Kc4}N`uk=K32tu62VI6ty(C?u&
zT|%;}^Da<m^_}%PONwG`<XedE5%S$<kuP$_haDA|B{+LijGu21eX56%ddUxKSNvaN
z>Q<6jdid)^?T0<joP5$XUU!z3=XdW^A)94Sf#DtAzS$S4SO)ZWx^ZYcM0doVn2Fwm
z&Dl8UvL@zyqKC3v7=EWj$_b(eMl0*ICpGs^pw<7DO4-i3&Qf%?y|cnt=<9&EiRIhw
zrGC7@JJMj2FR?kSXq1VqD9Y;R*X^ZZjXSg@;4Ghiw68vUP8xDF0>jOK<G>o*GvK^`
z4Wi!J1j?3Hu1WeM#&#>m({}XUS7fZsdgx&BCof@L3{<C?)BA<Yfz%ibE>&Kevae@J
ziWbty{5n6)`+|T9b_%DB=^#Lu-;OqVRV<8|zy2$YXr7P&zmlyV0sci{7M8NrZ`?*W
zE8bb{n+!;!6oxblHmIEUZQehmZhJxM$?C~e+Rx5Dmzf)UcSxie*PMw-z<JjjZFv_>
zQLuz-uJ{1{)T~9I5<M<`hzpgGNF!mHYYkA#M^?vzy3A<5>~Ck)z>F3DcZI=iaP&QX
z8k;k(#fnaE3?oPC<>5a64x0e5?Q`MiSfPUbtIW5a->J!<h;K#zRwmaZk7zjckOEZ*
zWD%AoKqGWWwOeQAOO{KPpp5DG2V+Z=rn8#47hy!}a2(ZV)i#SnSRJgdgYJ^=R%e`l
zHa*=-BNW6AX!zb#?2`Ao%FUe`m;;l>g#*VbQX?Rjg=-i1-A8-mN;a#nTZXceU<olY
z1JF$8n0hu0N@-Xw8icNWE}V(z!{+HPi*36vG$g2LJ8}?Bx@@hItK;!$r+u$GG=IvM
zg{aW>9T@!?lpjRv)s@+fvV2yN@V<CDNrv<L`?Q%(m~Ltv7Z6xAj66LaY|W4I{Ao|%
zbhpjM&Q-+;%RyuP2{wuXZjDH-aili0$Ld;t7ll>rEyjW;<=_APUwwt+^ocZnY}pRs
zV2BBU2g9vO7!XwUYOTUmgaQI^Cok4koks|jv&|uEuldum1f_a@!Kn`FO!7L<XwS=o
z6Ysvm`kli%R0ci|HX%WZoj^Ubc-!5r4wbxsk(|>8c$~XrMjIOBn44}L?-tujQ9wBQ
z0TSmqt0w-1beE__mNq}<blIJyr-=!OJK#X(s7Y4*o;Q_rwZETRxgW5F=Id<uUvfAy
zbQDtHKT+xAy(pAl_gp;vW~rkVK$9WrhIHX!QFibKEV7DaFz$wrld9$T9okfIJc94!
zD|gW<6qyLk&bO#41L58>*!X?cxn)A2BEOQwCzA;m2@UyW>|lRgtwmRcXx45Bqc0<H
zt?hc%?;pvL+#d-Ek@{FrNj^b8SdE10%fwNwI<QCw9iy`U2_ef_j(N6Lii(^=RQWMk
z?xqsETj~N}t^@c^tgzZfnY`?qI^~Sjv(wS=y7K>?6-)mqe6P`pn*G3LiT@e%se&P7
z2D`w-tyK~ggc8X<X2I{N+wZK!FjWKnlST=tc$&7y4)X)0DMN*q+}5z@?vn*OTfelb
zy@<9-c9bG<R!DiaYyP?}kpaG^+B%2mCQQPNqook%6O(&<PL7KPLmF1PvGlGx_^er4
z=m%Uow7NmaF#v1;XS&Iowf0aAsdAYnfZ6sH(Ur%QbJU|0lJy%h{RV(fR;_5LgLe7j
zz0_}~pCqS<Ii7yT&Fdfd=XYUlzz;jLV^KGdF_1N#jJbKYs>Wb17R73ua%wNqB3;Vt
zXG>N@(VL{qI`*oW-^@SeUaFeZx<3o>Ge`auzWK2<2PgP@w#dn&is~YOIT09;5F1Fa
z<`ldsH@K><!vRalK1jN2GW{+cBZ}~i5HVaun6v(D00h^6oEqqv!N7Jc0S9a7XO=bk
zvc0-LP34Ol@z(mh4fun^)p5-0RGTOCcyF86?*p!{{UrR|gUB-@FDnlJ5Y*LY(RB$&
z?nBPyGQh~uC~g-9cjf)waV~oYZNr)sRbL_m(Gy(ThJ@aq(z;d=(MDK@MpN=&x;h|@
z@Jf>}L85ZywW1~6AiFoJLEfQs(V0rBQDm|Q=xT-#CO#*SH(#KP@H{pWIF1!?x7>;W
z(At@m@Czz?Bcbpm92`|Lw=kvOw$zynP8)eKzXA<=OdRa{{oxKZtVokKtV6na_XQ;j
zglKNI8sbjp$@h~y7p*ig>?t}CsYAJ0%*djYMHmX-#KH;R0-|KS)xNsGG<P}qoaa?2
zImQ4TfOQ9yBSB6f%1jRJ-<nBx;Q6Q{aBGBSr-rz3A(8>Vpl@yqOcMvGe(?p96>zKf
zM0Sp33+d7A+3n}^L*&n2)^l>b^-w?=ByQ_6y0;ESHMZ!R9A{lwx+>XeFlQK5K|tAz
z;oX@2z;o??_wYRe<^O-jM4Yl$JeyJV0(p_(VAbt+^fCP$vTv>FCbxpjqD7BYD8fuC
zI<)C@oXbhvI)jnH$AP2+hQ>GKBYd#P(g+CPw4Of6>=GK8TTj+2#Y&}`n#o;sMYt+D
z?<2t?equ2I`Q4Mtxf?-4T@UMh*4(a@57t|Gs}C1^HJKxSu(>s+Et(#2V5A!@8y~8I
zcD=$#dvQ~^CE+j`E{c%sts#K)b8c%;UA05mdoW642l^0T9T|G;6=R{;k)*sIRfT(M
zwxgECs6*u=Ne`GMwzvo2QHn?fh|t#{oWhQ#g6xSAqo=&y{dw%32@kdT(gUf6b&7=X
zY}~mE%R24dpbbZud93hrhwW2NJ0MG~Y9AD+(Oe~Aiw^ZJ$P)&XD_2vuJ2)^rL}LN}
z+^4GT63jfd+n5xbhN`|I!D2`4Ak`232cN6X8juQbqs^OT1`7@fajO=dxB!BTb=1?(
zaH2kmX2eJ%or%Y18sid-+h{TcnBo|HTX#4@e_*(#>%i_VMR_u>0Sp)Y{63jh-Tqhn
z$kGM@b)?e=Lp*jzgf*w+2SHd-Mt@iVmzSvZ%TCHk>XrQ`bV5j-Z1OL@h~ricIZ`r2
z4L4mH?rev>ZGJQ2H}nRj_TvDLVL!;5G~!?5fQ~q--)QO{X1#zz++wVFkEgNRWpr?W
z-i@*yXM~<m-^8t3_&w3i$N>wwZaBg8pV^(&cmM7I)&o;C;somw{+QcL1g^itYOTx@
zM95V%vkuDXepdf}702J6>+wJV>|i&Yj5>ja)Dg6e)={GBla;-u-fpc%=Wuc=*@LRz
zsbO>UJ#aq;$f2QQx4=)oait3eM|kn&<T^b<WCs7xOku(6`!FZl(~YSY^_TkngnznR
z%&mnm@N`Fna^#oRj}`^zVu)Yl)cd<{6UKmvAgU+|R_caRP?_bM|GMQx-JWcRZ~jjZ
zD{Q@afbke66PulKN4dKs3`WwqQa755={?WHd&(s^wNyM&L*jz(Tt`^-2mWWwn|j=_
zA9D=Xd6`ifAF>WR8@dbAL4^o9*{(AhO+|plL<I`V{inB(Rc&D(KIUa70L8oopMoea
zuRrFsPfbc(?>-TaaN#+t$Ziu}Y?|ljEE*=L{iEk1%>e)NpnOv6&j@8wUdvMcq$Ri{
zbO7xO4i=y>r9v6NBgH%Ga##;owPvjf++WsuYLm8$jvWzJVXVoNJ(B72Ea%?pVP}<G
zMV${u=T&$%H@=-OzXyst;IwMFRtN08&7%Oijrfj|jcYG@<Zukok_|FV{sr0Cy@;Rn
z65a+^toZ?Joyl)NCQXyr!=;hA-l~%`U^&US6;*X2BH_G63=Vp>@1kfWm9t&I&&{0S
z@R3z7yHhc0n9a~b$c@9|<XTj&xMgb?SRFa!wAiGl4pnudC4haN_cM*er4--W1)S^$
zD3`l)$PPKcKV^tWF74eBE!dNtKEg=R+*q=;fYx!LJDn`o3Ett7s{QgJ#2%7N@S;dK
zLSz=Lw5d}lMwC&wP6Gbn5jCqg&!tS&DO3hUvY`%BfzZ?m@4jbnPlh(#+Y>@R;S^Qp
z7dd3k&r@AfD#~K)4@HBV0&4NQoA-19kgTdR0Lw1sM{fC1oGb*iY$W|#L9`FvO96VE
z`0AaWyEfK5N@w#Ic|zb(!pu9R6=b*>G+=F&M0r$pT$WD!K|?XU?|;2b7=C^Y(rpvK
zTC+{e#(OIhnf)djmS87x6Q}Y=$sokl^+Qan-M2=e0+kLM#CTf+@PUT3RVs3E_DSG<
zbL~0VVS+bvYMd@eZ{UDrST4m%C0&pi8jZfW1XKo*LE;ae>>*=}UOZq;52OaJd9CHD
zoYrtcCRdU+DcOz*`exhjR2aMMZWgTD^9?f16d4$rNCJ?feb__i2dKQBo|L&6Z6Ux}
z?_h~z?HW380&JnODvdYCw{~Jf=+_t&!*%4bDBrWJju7U#ghyfY1^^y4Pp(=!n@9Hj
zrToExGY(FvJ=P)lYs-T4O8Z<G42SPEDE2OB_om*kQD5kqBC0OWGO|Q36go&i_?(0m
zewg|&>>=uqVv(c260Tb}t=WLB^1lC4a*m`l3(Fau0LO-p9afacyETECR{#6A)EowI
zQt3gNI7$C>F&U~a^$oMo@1N)J5fp-2#hkGS03}-+ie4l=d5{t%1HhHPzQ2zVPPQZ7
zqrZxeODW<C?5_XTRGrrH@)DU?$}Ym6II;={BTXA`yF+vyJnvPFKs#=$>D4ZLbL*Rl
zoi-s$i;2Qo<aNw9&i}up`J$NPve7RcEl8lDri@izP&e&=GJ(AwpbKWKdGiBiL%V~Z
z;juC?7kKxO6CN4wfP4ebRW>fRSJqj$S^Dkmco8BP86e{&&5MC`ZsNoa5sK_Daov9a
z&Kk%caBM(GPM@(Wvs&m0s?*@>W>)AqeC--Xa@XgO^2+qBtzrJ?w3A<}OiZmFs>2!b
zZ+5WfTDSSg3XV{?!MM3TL<-Z1t`A=6UzpR~Ip=HM3zO35Gg9_EkIx07O%JNR3K(5d
z^&h;gIl*sDCG2*XgHATR-|4a9z<9{Ai>a<=^+=QHIfbQ&{x8&0k;AH2JjgFG^;|#U
zo`wYGgChMV`R>nYK-{B6v&bFcvRMVtxHLn^`t;<s3&mZ>yM7cD5ZMvs{T(tuzuC(o
zYVxKpo95kC!6#7rq4RvWy<N6=y3i6018Q9I*c-m|Gl=*M`s7H}I()(I`L%J|wBy5G
z`N?eTJ=eeOy@bkk)1ngM%&5ZEJ0yeLdnxP{>1@vq?jFT3SM?Lw4!sAeA?c#vT|h|a
LUAukNp5bs6RRFu#

literal 0
HcmV?d00001

diff --git a/certs/frodokem/gen_frodokem.c b/certs/frodokem/gen_frodokem.c
new file mode 100644
index 00000000000..0ef8bc94f01
--- /dev/null
+++ b/certs/frodokem/gen_frodokem.c
@@ -0,0 +1,241 @@
+/* gen_frodokem.c
+ *
+ * Copyright (C) 2006-2026 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* Generator for the FrodoKEM test key material in this directory.
+ *
+ * FrodoKEM is a KEM, and neither OpenSSL nor the liboqs oqs-provider expose it
+ * as a certificate/key-encoding algorithm with the ISO/IEC 18033-2 OIDs that
+ * wolfSSL uses (their FrodoKEM integration is KEM-only, for TLS key exchange).
+ * These fixtures therefore cannot be produced with OpenSSL the way the ML-DSA
+ * material is; they are generated by wolfSSL itself using wc_MakeCert_ex() and
+ * friends. A KEM public key cannot sign, so the certificate and request are
+ * signed by an ECC (P-256) issuer key.
+ *
+ * Material is produced for the 976 and 1344 (SHAKE) parameter sets; 640 has no
+ * standardised OID and cannot be encoded.
+ *
+ * Build against an installed wolfSSL configured with (at least):
+ *   --enable-experimental --enable-frodokem --enable-certgen --enable-certreq
+ *   --enable-certext --enable-keygen --enable-ecc  (and HAVE_PKCS8,
+ *   WOLFSSL_DER_TO_PEM)
+ *
+ *   cc gen_frodokem.c -lwolfssl -o gen_frodokem && (cd certs/frodokem &&
+ *       ./gen_frodokem)
+ */
+
+#include <wolfssl/options.h>
+#include <wolfssl/wolfcrypt/settings.h>
+#include <wolfssl/wolfcrypt/wc_frodokem.h>
+#include <wolfssl/wolfcrypt/asn_public.h>
+#include <wolfssl/wolfcrypt/ecc.h>
+#include <wolfssl/wolfcrypt/random.h>
+#include <stdio.h>
+#include <string.h>
+
+#if !defined(WOLFSSL_HAVE_FRODOKEM) || defined(WOLFSSL_FRODOKEM_NO_ASN1) || \
+    !defined(WOLFSSL_CERT_GEN) || !defined(WOLFSSL_CERT_REQ) || \
+    !defined(WOLFSSL_CERT_EXT) || !defined(HAVE_ECC) || \
+    !defined(WOLFSSL_DER_TO_PEM)
+int main(void)
+{
+    fprintf(stderr, "wolfSSL not built with the features needed to generate "
+                    "the FrodoKEM certificates (see the header comment).\n");
+    return 1;
+}
+#else
+
+static byte der[45000];
+static byte pem[64000];
+static byte caDer[4000];
+
+static int writeFile(const char* name, const byte* data, int len)
+{
+    FILE* f;
+    if (len <= 0) {
+        fprintf(stderr, "  %s: nothing to write (%d)\n", name, len);
+        return -1;
+    }
+    f = fopen(name, "wb");
+    if (f == NULL) {
+        fprintf(stderr, "  cannot open %s\n", name);
+        return -1;
+    }
+    (void)fwrite(data, 1, (size_t)len, f);
+    fclose(f);
+    printf("  wrote %s (%d bytes)\n", name, len);
+    return 0;
+}
+
+/* Convert DER to PEM and write it, guarding against a bad DER length. */
+static void writePem(const byte* d, int derLen, int pemType, const char* name)
+{
+    int plen;
+    if (derLen <= 0) {
+        fprintf(stderr, "  %s: bad DER length (%d)\n", name, derLen);
+        return;
+    }
+    plen = wc_DerToPem(d, (word32)derLen, pem, sizeof(pem), pemType);
+    writeFile(name, pem, plen);
+}
+
+/* Only set the string fields; wc_InitCert() already zeroed the struct and set
+ * the per-field ASN encoding types, which must be preserved. */
+static void setName(CertName* n, const char* cn)
+{
+    XSTRNCPY(n->country, "US", CTC_NAME_SIZE);
+    n->countryEnc = CTC_PRINTABLE;
+    XSTRNCPY(n->state, "Montana", CTC_NAME_SIZE);
+    n->stateEnc = CTC_UTF8;
+    XSTRNCPY(n->locality, "Bozeman", CTC_NAME_SIZE);
+    n->localityEnc = CTC_UTF8;
+    XSTRNCPY(n->org, "wolfSSL", CTC_NAME_SIZE);
+    n->orgEnc = CTC_UTF8;
+    XSTRNCPY(n->unit, "Test", CTC_NAME_SIZE);
+    n->unitEnc = CTC_UTF8;
+    XSTRNCPY(n->commonName, cn, CTC_NAME_SIZE);
+    n->commonNameEnc = CTC_UTF8;
+}
+
+/* Generate the key, public SPKI, ECC-signed leaf certificate and ECC-signed
+ * certificate request for one FrodoKEM parameter set. */
+static int genVariant(WC_RNG* rng, ecc_key* ca, int caLen, int type,
+                      const char* prefix, const char* cn)
+{
+    FrodoKemKey fk;
+    Cert cert;
+    char fn[128];
+    int len, body;
+
+    if (wc_FrodoKemKey_Init(&fk, type, NULL, INVALID_DEVID) != 0) {
+        fprintf(stderr, "FrodoKEM key init failed for %s\n", prefix);
+        return -1;
+    }
+    if (wc_FrodoKemKey_MakeKey(&fk, rng) != 0) {
+        fprintf(stderr, "FrodoKEM key generation failed for %s\n", prefix);
+        wc_FrodoKemKey_Free(&fk);
+        return -1;
+    }
+
+    /* Private key (PKCS#8) and public key (SubjectPublicKeyInfo). */
+    len = wc_FrodoKemKey_PrivateKeyToDer(&fk, der, sizeof(der));
+    XSNPRINTF(fn, sizeof(fn), "%s-key.der", prefix);
+    writeFile(fn, der, len);
+    XSNPRINTF(fn, sizeof(fn), "%s-key.pem", prefix);
+    writePem(der, len, PKCS8_PRIVATEKEY_TYPE, fn);
+    len = wc_FrodoKemKey_PublicKeyToDer(&fk, der, sizeof(der), 1);
+    XSNPRINTF(fn, sizeof(fn), "%s_pub-spki.der", prefix);
+    writeFile(fn, der, len);
+
+    /* Leaf certificate signed by the ECC CA. */
+    wc_InitCert(&cert);
+    setName(&cert.subject, cn);
+    setName(&cert.issuer, "FrodoKEM Test ECC CA");
+    cert.sigType = CTC_SHA256wECDSA;
+    cert.selfSigned = 0;   /* issuer is the ECC CA, not the subject */
+    cert.daysValid = 36500;   /* long-lived test fixture */
+    (void)wc_SetSubjectKeyIdFromPublicKey_ex(&cert, FRODOKEM_TYPE, &fk);
+    (void)wc_SetAuthKeyIdFromCert(&cert, caDer, caLen);
+    body = wc_MakeCert_ex(&cert, der, sizeof(der), FRODOKEM_TYPE, &fk, rng);
+    if (body > 0) {
+        len = wc_SignCert(body, CTC_SHA256wECDSA, der, sizeof(der), NULL, ca,
+                          rng);
+        XSNPRINTF(fn, sizeof(fn), "%s-cert.der", prefix);
+        writeFile(fn, der, len);
+        XSNPRINTF(fn, sizeof(fn), "%s-cert.pem", prefix);
+        writePem(der, len, CERT_TYPE, fn);
+    }
+
+    /* Certificate request signed by the ECC key (a KEM cannot self-sign). */
+    wc_InitCert(&cert);
+    setName(&cert.subject, cn);
+    cert.sigType = CTC_SHA256wECDSA;
+    cert.version = 0;   /* PKCS#10 (RFC 2986) requires version 0 */
+    body = wc_MakeCertReq_ex(&cert, der, sizeof(der), FRODOKEM_TYPE, &fk);
+    if (body > 0) {
+        len = wc_SignCert(body, CTC_SHA256wECDSA, der, sizeof(der), NULL, ca,
+                          rng);
+        XSNPRINTF(fn, sizeof(fn), "%s-req.der", prefix);
+        writeFile(fn, der, len);
+        XSNPRINTF(fn, sizeof(fn), "%s-req.pem", prefix);
+        writePem(der, len, CERTREQ_TYPE, fn);
+    }
+
+    wc_FrodoKemKey_Free(&fk);
+    return 0;
+}
+
+int main(void)
+{
+    WC_RNG rng;
+    ecc_key ca;
+    Cert cert;
+    int ret = 0;
+    int len;
+    int body;
+    int caLen = 0;
+
+    if (wc_InitRng(&rng) != 0) {
+        fprintf(stderr, "RNG init failed\n");
+        return 1;
+    }
+
+    /* ---- Issuer: self-signed ECC P-256 CA ---- */
+    if (wc_ecc_init(&ca) != 0) {
+        fprintf(stderr, "ECC CA init failed\n");
+        ret = 1; goto out_rng;
+    }
+    if (wc_ecc_make_key(&rng, 32, &ca) != 0) {
+        fprintf(stderr, "ECC CA key generation failed\n");
+        wc_ecc_free(&ca);
+        ret = 1; goto out_rng;
+    }
+    wc_InitCert(&cert);
+    setName(&cert.subject, "FrodoKEM Test ECC CA");
+    cert.sigType = CTC_SHA256wECDSA;
+    cert.isCA = 1;
+    cert.selfSigned = 1;
+    cert.daysValid = 36500;   /* long-lived test fixture */
+    (void)wc_SetSubjectKeyIdFromPublicKey_ex(&cert, ECC_TYPE, &ca);
+    body = wc_MakeCert_ex(&cert, caDer, sizeof(caDer), ECC_TYPE, &ca, &rng);
+    if (body > 0) {
+        len = wc_SignCert(body, CTC_SHA256wECDSA, caDer, sizeof(caDer), NULL,
+                          &ca, &rng);
+        caLen = len;
+        writeFile("frodokem-ca-ecc-cert.der", caDer, len);
+        writePem(caDer, len, CERT_TYPE, "frodokem-ca-ecc-cert.pem");
+    }
+    len = wc_EccKeyToDer(&ca, der, sizeof(der));
+    writeFile("frodokem-ca-ecc-key.der", der, len);
+    writePem(der, len, ECC_PRIVATEKEY_TYPE, "frodokem-ca-ecc-key.pem");
+
+    /* ---- FrodoKEM parameter sets with a standardised OID ---- */
+    (void)genVariant(&rng, &ca, caLen, WC_FRODOKEM_976_SHAKE, "frodokem976",
+                     "FrodoKEM-976");
+    (void)genVariant(&rng, &ca, caLen, WC_FRODOKEM_1344_SHAKE, "frodokem1344",
+                     "FrodoKEM-1344");
+
+    wc_ecc_free(&ca);
+out_rng:
+    wc_FreeRng(&rng);
+    return ret;
+}
+
+#endif
diff --git a/certs/frodokem/include.am b/certs/frodokem/include.am
new file mode 100644
index 00000000000..6c0e1794cd4
--- /dev/null
+++ b/certs/frodokem/include.am
@@ -0,0 +1,31 @@
+# vim:ft=automake
+# All paths should be given relative to the root
+#
+
+# These are experimental FrodoKEM test fixtures. Distribute them only when
+# FrodoKEM is enabled: keeping them out of the default (FrodoKEM-off) tarball
+# keeps the single-line $(DISTFILES) that "make dist" passes to the shell under
+# the kernel's per-argument limit (MAX_ARG_STRLEN) in out-of-tree builds.
+if BUILD_WC_FRODOKEM
+EXTRA_DIST += \
+		 certs/frodokem/README.txt \
+		 certs/frodokem/gen_frodokem.c \
+		 certs/frodokem/frodokem-ca-ecc-key.der \
+		 certs/frodokem/frodokem-ca-ecc-key.pem \
+		 certs/frodokem/frodokem-ca-ecc-cert.der \
+		 certs/frodokem/frodokem-ca-ecc-cert.pem \
+		 certs/frodokem/frodokem976-key.der \
+		 certs/frodokem/frodokem976-key.pem \
+		 certs/frodokem/frodokem976_pub-spki.der \
+		 certs/frodokem/frodokem976-cert.der \
+		 certs/frodokem/frodokem976-cert.pem \
+		 certs/frodokem/frodokem976-req.der \
+		 certs/frodokem/frodokem976-req.pem \
+		 certs/frodokem/frodokem1344-key.der \
+		 certs/frodokem/frodokem1344-key.pem \
+		 certs/frodokem/frodokem1344_pub-spki.der \
+		 certs/frodokem/frodokem1344-cert.der \
+		 certs/frodokem/frodokem1344-cert.pem \
+		 certs/frodokem/frodokem1344-req.der \
+		 certs/frodokem/frodokem1344-req.pem
+endif
diff --git a/certs/include.am b/certs/include.am
index 97d8bfe75a7..0b033848b44 100644
--- a/certs/include.am
+++ b/certs/include.am
@@ -181,3 +181,4 @@ include certs/lms/include.am
 include certs/rpk/include.am
 include certs/acert/include.am
 include certs/mldsa/include.am
+include certs/frodokem/include.am
diff --git a/certs/renewcerts.sh b/certs/renewcerts.sh
index e0dc5bd0102..1a96869565a 100755
--- a/certs/renewcerts.sh
+++ b/certs/renewcerts.sh
@@ -1293,6 +1293,21 @@ EOF
         echo "---------------------------------------------------------------------"
     fi
 
+    ############################################################
+    #### FrodoKEM certificates (generated by wolfSSL)        ###
+    ############################################################
+    # FrodoKEM is a KEM, not a signature algorithm, and neither OpenSSL nor the
+    # liboqs oqs-provider expose it with the ISO/IEC 18033-2 certificate/key
+    # OIDs that wolfSSL uses - their FrodoKEM support is KEM-only, for TLS key
+    # exchange, and the liboqs certificate integration is not going to be
+    # present. So the FrodoKEM test key material cannot be produced here with
+    # OpenSSL the way the ML-DSA material above is; it is generated by wolfSSL
+    # itself and shipped pre-built under certs/frodokem/. See
+    # certs/frodokem/README.txt and certs/frodokem/gen_frodokem.c to regenerate.
+    echo "Skipping FrodoKEM cert generation (OpenSSL cannot create FrodoKEM"
+    echo "certificates; they are generated by wolfSSL - see certs/frodokem/)"
+    echo "---------------------------------------------------------------------"
+
     #cleanup the file system now that we're done
     echo "Performing final steps, cleaning up the file system..."
     echo ""
diff --git a/doc/dox_comments/header_files/wc_frodokem.h b/doc/dox_comments/header_files/wc_frodokem.h
index 6fa6a9c980e..b33955f1ac7 100644
--- a/doc/dox_comments/header_files/wc_frodokem.h
+++ b/doc/dox_comments/header_files/wc_frodokem.h
@@ -167,8 +167,9 @@ int wc_FrodoKemKey_MakeKey(FrodoKemKey* key, WC_RNG* rng);
     WC_FRODOKEM_640_MAKEKEY_RAND_SZ for FrodoKEM-640).
 
     \return 0 on success.
-    \return BAD_FUNC_ARG if key or rand is NULL, or len is not the
-    length required for the key's parameter set.
+    \return BAD_FUNC_ARG if key or rand is NULL.
+    \return BUFFER_E if len is not the length required for the key's
+    parameter set.
 
     \param [in,out] key An initialized FrodoKemKey to hold the generated
     key pair.
@@ -272,8 +273,9 @@ int wc_FrodoKemKey_Encapsulate(FrodoKemKey* key, unsigned char* ct,
     WC_FRODOKEM_640_ENC_RAND_SZ for FrodoKEM-640).
 
     \return 0 on success.
-    \return BAD_FUNC_ARG if key, ct, ss or rand is NULL, or len is not
-    the length required for the key's parameter set.
+    \return BAD_FUNC_ARG if key, ct, ss or rand is NULL.
+    \return BUFFER_E if len is not the length required for the key's
+    parameter set.
     \return BAD_STATE_E if key does not hold a public key.
 
     \param [in] key A FrodoKemKey holding a public key.
@@ -302,8 +304,9 @@ int wc_FrodoKemKey_EncapsulateWithRandom(FrodoKemKey* key,
 
     \return 0 on success (a shared secret is always produced for a
     correctly sized ciphertext).
-    \return BAD_FUNC_ARG if key, ss or ct is NULL, or len is not the
-    ciphertext size for the key's parameter set.
+    \return BAD_FUNC_ARG if key, ss or ct is NULL.
+    \return BUFFER_E if len is not the ciphertext size for the key's
+    parameter set.
     \return BAD_STATE_E if key does not hold a private key.
     \return MEMORY_E on allocation failure.
 
diff --git a/scripts/asn1_oid_sum.pl b/scripts/asn1_oid_sum.pl
index 04f79235db5..6b4cdac4b2d 100755
--- a/scripts/asn1_oid_sum.pl
+++ b/scripts/asn1_oid_sum.pl
@@ -336,6 +336,18 @@ sub print_footer {
 my @hss_lms = ( 1, 2, 840, 113549, 1, 9, 16, 3, 17 );
 my @xmss = ( 1, 3, 6, 1, 5, 5, 7, 6, 34 );
 my @xmssmt = ( 1, 3, 6, 1, 5, 5, 7, 6, 35 );
+# FrodoKEM / eFrodoKEM key OIDs (ISO/IEC 18033-2, arc 1.0.18033.2.2.7.x).
+# The old-scheme byte sums (434..441) collide with the SLH-DSA key OIDs, so an
+# add_sum offset gives them distinct old-scheme values (100434..100441); the new
+# XOR-hash scheme has no collision. Only 976/1344 are standardised (no 640).
+my @frodokem_976_shake  = ( 1, 0, 18033, 2, 2, 7, 1 );
+my @frodokem_1344_shake = ( 1, 0, 18033, 2, 2, 7, 2 );
+my @efrodokem_976_shake  = ( 1, 0, 18033, 2, 2, 7, 3 );
+my @efrodokem_1344_shake = ( 1, 0, 18033, 2, 2, 7, 4 );
+my @frodokem_976_aes  = ( 1, 0, 18033, 2, 2, 7, 5 );
+my @frodokem_1344_aes = ( 1, 0, 18033, 2, 2, 7, 6 );
+my @efrodokem_976_aes  = ( 1, 0, 18033, 2, 2, 7, 7 );
+my @efrodokem_1344_aes = ( 1, 0, 18033, 2, 2, 7, 8 );
 
 my @keys = (
     { name => "ANON",                 oid => \@anon            },
@@ -373,6 +385,14 @@ sub print_footer {
     { name => "HSS_LMS",              oid => \@hss_lms         },
     { name => "XMSS",                 oid => \@xmss            },
     { name => "XMSSMT",               oid => \@xmssmt          },
+    { name => "FRODOKEM_976_SHAKE",   oid => \@frodokem_976_shake,   add_sum => 100000 },
+    { name => "FRODOKEM_1344_SHAKE",  oid => \@frodokem_1344_shake,  add_sum => 100000 },
+    { name => "EFRODOKEM_976_SHAKE",  oid => \@efrodokem_976_shake,  add_sum => 100000 },
+    { name => "EFRODOKEM_1344_SHAKE", oid => \@efrodokem_1344_shake, add_sum => 100000 },
+    { name => "FRODOKEM_976_AES",     oid => \@frodokem_976_aes,     add_sum => 100000 },
+    { name => "FRODOKEM_1344_AES",    oid => \@frodokem_1344_aes,    add_sum => 100000 },
+    { name => "EFRODOKEM_976_AES",    oid => \@efrodokem_976_aes,    add_sum => 100000 },
+    { name => "EFRODOKEM_1344_AES",   oid => \@efrodokem_1344_aes,   add_sum => 100000 },
 );
 
 print_sum_enum("Key", "k", \@keys);
diff --git a/tests/api/test_frodokem.c b/tests/api/test_frodokem.c
index 75df0058db7..62cab1429ac 100644
--- a/tests/api/test_frodokem.c
+++ b/tests/api/test_frodokem.c
@@ -32,6 +32,11 @@
     #include <wolfssl/wolfcrypt/wc_frodokem.h>
     #include <wolfssl/wolfcrypt/hash.h>
     #include <wolfssl/wolfcrypt/sha256.h>
+    #if defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC)
+        #include <wolfssl/wolfcrypt/asn_public.h>
+        #include <wolfssl/wolfcrypt/asn.h>
+        #include <wolfssl/wolfcrypt/ecc.h>
+    #endif
 #endif
 #include <wolfssl/wolfcrypt/types.h>
 #include <tests/api/api.h>
@@ -735,10 +740,11 @@ static const FrodoKemKat frodokem_kats[] = {
     FKAT_640_AES FKAT_976_AES FKAT_1344_AES
     FKAT_E640_SHAKE FKAT_E976_SHAKE FKAT_E1344_SHAKE
     FKAT_E640_AES FKAT_E976_AES FKAT_E1344_AES
+    { 0 } /* sentinel so the array is never empty */
 };
 
 #define FRODOKEM_KAT_CNT \
-    ((int)(sizeof(frodokem_kats) / sizeof(frodokem_kats[0])))
+    ((int)(sizeof(frodokem_kats) / sizeof(frodokem_kats[0])) - 1)
 
 #endif /* !NO_SHA256 && !WOLFSSL_FRODOKEM_NO_MAKE_KEY */
 #endif /* WOLFSSL_HAVE_FRODOKEM */
@@ -830,6 +836,9 @@ int test_wc_frodokem_encapsulate_kats(void)
     }
 
     XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* key is freed at the bottom of each loop iteration; on the 0-iteration
+     * allocation-failure path it was never initialised, so only the backing
+     * memory is released here. */
     XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     return EXPECT_RESULT();
@@ -876,6 +885,9 @@ int test_wc_frodokem_decapsulate_kats(void)
     }
 
     XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* key is freed at the bottom of each loop iteration; on the 0-iteration
+     * allocation-failure path it was never initialised, so only the backing
+     * memory is released here. */
     XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     return EXPECT_RESULT();
@@ -927,6 +939,9 @@ int test_wc_frodokem_roundtrip(void)
         DoExpectIntEQ(wc_FreeRng(&rng), 0);
     }
     XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* key is freed at the bottom of each loop iteration; on the 0-iteration
+     * allocation-failure path it was never initialised, so only the backing
+     * memory is released here. */
     XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     return EXPECT_RESULT();
@@ -1014,6 +1029,9 @@ int test_wc_frodokem_encode_decode(void)
     XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     XFREE(skBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     XFREE(pkBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* The three keys are freed at the bottom of each loop iteration; on the
+     * 0-iteration allocation-failure path they were never initialised, so only
+     * the backing memory is released here. */
     XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     XFREE(pubKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
@@ -1101,6 +1119,9 @@ int test_wc_frodokem_decap_implicit_reject(void)
         DoExpectIntEQ(wc_FreeRng(&rng), 0);
     }
     XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* key is freed at the bottom of each loop iteration; on the 0-iteration
+     * allocation-failure path it was never initialised, so only the backing
+     * memory is released here. */
     XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     return EXPECT_RESULT();
@@ -1302,11 +1323,13 @@ int test_wc_frodokem_bad_args(void)
 #endif
     ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(NULL, small, small,
         small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
-    /* NULL ct / ss are rejected independently of key state. */
+    /* NULL ct / ss / rand are rejected independently of key state. */
     ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, NULL, small,
         small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
     ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, small, NULL,
         small, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_EncapsulateWithRandom(key, small, small,
+        NULL, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
 #ifndef WC_NO_RNG
     /* Encapsulate rejects a NULL rng in isolation (ct and ss valid). */
     ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, small, small, NULL),
@@ -1420,6 +1443,9 @@ int test_wc_frodokem_op_len_checks(void)
         DoExpectIntEQ(wc_FreeRng(&rng), 0);
     }
     XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    /* key is freed at the bottom of each loop iteration; on the 0-iteration
+     * allocation-failure path it was never initialised, so only the backing
+     * memory is released here. */
     XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 #endif
     return EXPECT_RESULT();
@@ -1496,3 +1522,448 @@ int test_wc_frodokem_not_compiled_in(void)
 #endif
     return EXPECT_RESULT();
 }
+
+/* ASN.1 round trip: encode the public key as a SubjectPublicKeyInfo and the
+ * private key as a PKCS#8 OneAsymmetricKey, decode each back into a fresh key
+ * object (auto-detecting the type from the OID) and confirm the decoded keys
+ * still produce matching shared secrets. The 640 parameter sets have no
+ * standardised OID, so their encoding must be rejected. */
+int test_wc_frodokem_asn1(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
+    defined(WC_ENABLE_ASYM_KEY_EXPORT) && \
+    defined(WC_ENABLE_ASYM_KEY_IMPORT) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
+    !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
+    !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    int i;
+    FrodoKemKey* key = NULL;
+    FrodoKemKey* key2 = NULL;
+    WC_RNG rng;
+    byte* der = NULL;
+    byte* ct = NULL;
+    byte ss[FRODOKEM_MAX_LENSEC];
+    byte ssDec[FRODOKEM_MAX_LENSEC];
+    int derLen = 0;
+    word32 idx = 0;
+    word32 ctLen = 0;
+    word32 ssLen = 0;
+    int rngInit = 0;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    key2 = (FrodoKemKey*)XMALLOC(sizeof(*key2), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key2);
+    der = (byte*)XMALLOC(FRODOKEM_MAX_PRV_KEY_DER_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(der);
+    ct = (byte*)XMALLOC(FRODOKEM_MAX_CIPHER_TEXT_SIZE, NULL,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(ct);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        int type = frodokem_types[i];
+
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_CipherTextSize(key, &ctLen), 0);
+        ExpectIntEQ(wc_FrodoKemKey_SharedSecretSize(key, &ssLen), 0);
+
+        if ((type & FRODOKEM_BASE_MASK) == WC_FRODOKEM_640) {
+            /* 640 has no standardised OID: encoding must be rejected. */
+            ExpectIntEQ(wc_FrodoKemKey_PublicKeyToDer(key, der,
+                FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1),
+                WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+            ExpectIntEQ(wc_FrodoKemKey_PrivateKeyToDer(key, der,
+                FRODOKEM_MAX_PRV_KEY_DER_SIZE),
+                WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+            wc_FrodoKemKey_Free(key);
+            continue;
+        }
+
+        /* Public key: SubjectPublicKeyInfo round trip (auto-detect type). */
+        ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der,
+            FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1)), 0);
+        XMEMSET(key2, 0, sizeof(*key2));
+        key2->devId = INVALID_DEVID;
+        idx = 0;
+        ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(key2, der, (word32)derLen,
+            &idx), 0);
+        ExpectIntEQ(key2->type, type);
+        /* Encapsulate to the decoded public key; original decapsulates. */
+        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key2, ct, ss, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key, ssDec, ct, ctLen), 0);
+        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);
+        wc_FrodoKemKey_Free(key2);
+
+        /* Private key: PKCS#8 round trip; decoded key can decapsulate. */
+        ExpectIntGT((derLen = wc_FrodoKemKey_PrivateKeyToDer(key, der,
+            FRODOKEM_MAX_PRV_KEY_DER_SIZE)), 0);
+        XMEMSET(key2, 0, sizeof(*key2));
+        key2->devId = INVALID_DEVID;
+        idx = 0;
+        ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(key2, der, (word32)derLen,
+            &idx), 0);
+        ExpectIntEQ(key2->type, type);
+        ExpectIntEQ(wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng), 0);
+        ExpectIntEQ(wc_FrodoKemKey_Decapsulate(key2, ssDec, ct, ctLen), 0);
+        ExpectIntEQ(XMEMCMP(ss, ssDec, ssLen), 0);
+        wc_FrodoKemKey_Free(key2);
+
+        /* Strict validation: decoding this key's DER into a key that was
+         * initialized as a DIFFERENT variant must be rejected. */
+        {
+            int j;
+            int other = -1;
+
+            for (j = 0; j < FRODOKEM_TYPE_CNT; j++) {
+                if ((frodokem_types[j] != type) &&
+                        ((frodokem_types[j] & FRODOKEM_BASE_MASK) !=
+                            WC_FRODOKEM_640)) {
+                    other = frodokem_types[j];
+                    break;
+                }
+            }
+            if (other != -1) {
+                ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der,
+                    FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1)), 0);
+                ExpectIntEQ(wc_FrodoKemKey_Init(key2, other, NULL,
+                    INVALID_DEVID), 0);
+                idx = 0;
+                ExpectIntNE(wc_FrodoKemKey_PublicKeyDecode(key2, der,
+                    (word32)derLen, &idx), 0);
+                wc_FrodoKemKey_Free(key2);
+            }
+        }
+
+        /* A truncated/corrupted DER must be rejected, not over-read. */
+        ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der,
+            FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1)), 0);
+        XMEMSET(key2, 0, sizeof(*key2));
+        key2->devId = INVALID_DEVID;
+        idx = 0;
+        ExpectIntNE(wc_FrodoKemKey_PublicKeyDecode(key2, der,
+            (word32)derLen / 2, &idx), 0);
+        wc_FrodoKemKey_Free(key2);
+
+        wc_FrodoKemKey_Free(key);
+    }
+
+    /* NULL-argument checks. */
+    idx = 0;
+    ExpectIntEQ(wc_FrodoKemKey_PublicKeyToDer(NULL, der, 16, 1),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_PrivateKeyToDer(NULL, der, 16),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(NULL, der, 16, &idx),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+    ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(NULL, der, 16, &idx),
+        WC_NO_ERR_TRACE(BAD_FUNC_ARG));
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(ct, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Key-file I/O: a FrodoKEM key flows through the generic PUBLIC KEY / PKCS#8
+ * PRIVATE KEY PEM containers (DER->PEM->DER round trip), and wc_GetKeyOID
+ * recognizes a FrodoKEM private-key DER. */
+int test_wc_frodokem_key_pem(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
+    defined(WC_ENABLE_ASYM_KEY_EXPORT) && \
+    defined(WC_ENABLE_ASYM_KEY_IMPORT) && \
+    defined(WOLFSSL_DER_TO_PEM) && defined(WOLFSSL_PEM_TO_DER) && \
+    (defined(WOLFSSL_CERT_EXT) || defined(WOLFSSL_PUB_PEM_TO_DER)) && \
+    !defined(WC_NO_RNG) && !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
+    int i;
+    FrodoKemKey* key = NULL;
+    FrodoKemKey* key2 = NULL;
+    WC_RNG rng;
+    byte* der = NULL;
+    byte* der2 = NULL;
+    byte* pem = NULL;
+    int rngInit = 0;
+    int derLen;
+    int der2Len;
+    int pemLen;
+    word32 idx;
+    const word32 dersz = FRODOKEM_MAX_PRV_KEY_DER_SIZE;
+    const word32 pemsz = FRODOKEM_MAX_PRV_KEY_DER_SIZE * 2;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    key2 = (FrodoKemKey*)XMALLOC(sizeof(*key2), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key2);
+    der = (byte*)XMALLOC(dersz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(der);
+    der2 = (byte*)XMALLOC(dersz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(der2);
+    pem = (byte*)XMALLOC(pemsz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(pem);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    for (i = 0; (i < FRODOKEM_TYPE_CNT) && EXPECT_SUCCESS(); i++) {
+        int type = frodokem_types[i];
+
+        if ((type & FRODOKEM_BASE_MASK) == WC_FRODOKEM_640) {
+            continue;
+        }
+
+        ExpectIntEQ(wc_FrodoKemKey_Init(key, type, NULL, INVALID_DEVID), 0);
+        ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+
+        /* Public key: DER -> PEM (PUBLIC KEY) -> DER -> decode. */
+        ExpectIntGT((derLen = wc_FrodoKemKey_PublicKeyToDer(key, der, dersz,
+            1)), 0);
+        ExpectIntGT((pemLen = wc_DerToPem(der, (word32)derLen, pem, pemsz,
+            PUBLICKEY_TYPE)), 0);
+        ExpectIntGT((der2Len = wc_PubKeyPemToDer(pem, pemLen, der2, dersz)), 0);
+        ExpectIntEQ(der2Len, derLen);
+        ExpectIntEQ(XMEMCMP(der, der2, (size_t)derLen), 0);
+        XMEMSET(key2, 0, sizeof(*key2));
+        key2->devId = INVALID_DEVID;
+        idx = 0;
+        ExpectIntEQ(wc_FrodoKemKey_PublicKeyDecode(key2, der2,
+            (word32)der2Len, &idx), 0);
+        ExpectIntEQ(key2->type, type);
+        wc_FrodoKemKey_Free(key2);
+
+        /* Private key: PKCS#8 PEM round trip. */
+        ExpectIntGT((derLen = wc_FrodoKemKey_PrivateKeyToDer(key, der,
+            dersz)), 0);
+        ExpectIntGT((pemLen = wc_DerToPem(der, (word32)derLen, pem, pemsz,
+            PKCS8_PRIVATEKEY_TYPE)), 0);
+        ExpectIntGT((der2Len = wc_KeyPemToDer(pem, pemLen, der2, dersz,
+            "")), 0);
+        XMEMSET(key2, 0, sizeof(*key2));
+        key2->devId = INVALID_DEVID;
+        idx = 0;
+        ExpectIntEQ(wc_FrodoKemKey_PrivateKeyDecode(key2, der2,
+            (word32)der2Len, &idx), 0);
+        ExpectIntEQ(key2->type, type);
+        wc_FrodoKemKey_Free(key2);
+
+        wc_FrodoKemKey_Free(key);
+    }
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(der2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* X.509: build a certificate carrying a FrodoKEM subject public key (signed by
+ * an ECC issuer key, since a KEM cannot self-sign), then parse it back and
+ * confirm the FrodoKEM subject key is recognized. */
+int test_wc_frodokem_x509(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
+    defined(WOLFSSL_CERT_GEN) && defined(WOLFSSL_ASN_TEMPLATE) && \
+    defined(HAVE_ECC) && \
+    defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_FRODOKEM_SHAKE) && \
+    !defined(NO_SHA256) && !defined(WC_NO_RNG) && \
+    !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY)
+    FrodoKemKey* key = NULL;
+    ecc_key* caKey = NULL;
+    WC_RNG rng;
+    Cert* cert = NULL;
+    DecodedCert* dc = NULL;
+    byte* der = NULL;
+    int rngInit = 0;
+    int bodySz = 0;
+    int derSz = 0;
+    const word32 dersz = FRODOKEM_MAX_PUB_KEY_DER_SIZE + 4096;
+
+    XMEMSET(&rng, 0, sizeof(rng));
+    key = (FrodoKemKey*)XMALLOC(sizeof(*key), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(key);
+    caKey = (ecc_key*)XMALLOC(sizeof(*caKey), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(caKey);
+    cert = (Cert*)XMALLOC(sizeof(*cert), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(cert);
+    dc = (DecodedCert*)XMALLOC(sizeof(*dc), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(dc);
+    der = (byte*)XMALLOC(dersz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(der);
+    ExpectIntEQ(wc_InitRng(&rng), 0);
+    if (EXPECT_SUCCESS()) {
+        rngInit = 1;
+    }
+
+    /* Subject FrodoKEM key pair and issuer ECC signing key. */
+    ExpectIntEQ(wc_FrodoKemKey_Init(key, WC_FRODOKEM_976_SHAKE, NULL,
+        INVALID_DEVID), 0);
+    ExpectIntEQ(wc_FrodoKemKey_MakeKey(key, &rng), 0);
+    ExpectIntEQ(wc_ecc_init(caKey), 0);
+    ExpectIntEQ(wc_ecc_make_key(&rng, 32, caKey), 0);
+
+    /* Build the certificate body carrying the FrodoKEM public key. */
+    ExpectIntEQ(wc_InitCert(cert), 0);
+    if (EXPECT_SUCCESS()) {
+        XMEMCPY(cert->subject.country, "US", 3);
+        XMEMCPY(cert->subject.commonName, "FrodoKEM Test", 14);
+        cert->sigType = CTC_SHA256wECDSA;
+        cert->selfSigned = 1;
+    }
+    /* Subject Key Identifier derived from the FrodoKEM public key. */
+#ifdef WOLFSSL_CERT_EXT
+    ExpectIntEQ(wc_SetSubjectKeyIdFromPublicKey_ex(cert, FRODOKEM_TYPE, key),
+        0);
+#endif
+    ExpectIntGT((bodySz = wc_MakeCert_ex(cert, der, dersz, FRODOKEM_TYPE,
+        key, &rng)), 0);
+    /* Sign with the ECC issuer key (a KEM cannot produce signatures). */
+    ExpectIntGT((derSz = wc_SignCert(bodySz, CTC_SHA256wECDSA, der, dersz,
+        NULL, caKey, &rng)), 0);
+
+    /* Parse the certificate and confirm the FrodoKEM subject key. */
+    if (EXPECT_SUCCESS()) {
+        wc_InitDecodedCert(dc, der, (word32)derSz, NULL);
+        ExpectIntEQ(wc_ParseCert(dc, CERT_TYPE, NO_VERIFY, NULL), 0);
+        ExpectIntEQ((int)dc->keyOID, FRODOKEM_976_SHAKEk);
+        ExpectIntGT(dc->pubKeySize, 0);
+        wc_FreeDecodedCert(dc);
+    }
+
+    /* Certificate request (PKCS#10) carrying the FrodoKEM public key. A KEM
+     * cannot self-sign, so the request is signed with the ECC key. */
+#ifdef WOLFSSL_CERT_REQ
+    ExpectIntEQ(wc_InitCert(cert), 0);
+    if (EXPECT_SUCCESS()) {
+        XMEMCPY(cert->subject.country, "US", 3);
+        XMEMCPY(cert->subject.commonName, "FrodoKEM CSR", 13);
+        cert->sigType = CTC_SHA256wECDSA;
+        cert->version = 0;   /* PKCS#10 (RFC 2986) requires version 0 */
+    }
+    ExpectIntGT((bodySz = wc_MakeCertReq_ex(cert, der, dersz, FRODOKEM_TYPE,
+        key)), 0);
+    ExpectIntGT((derSz = wc_SignCert(bodySz, CTC_SHA256wECDSA, der, dersz,
+        NULL, caKey, &rng)), 0);
+    if (EXPECT_SUCCESS()) {
+        wc_InitDecodedCert(dc, der, (word32)derSz, NULL);
+        ExpectIntEQ(wc_ParseCert(dc, CERTREQ_TYPE, NO_VERIFY, NULL), 0);
+        ExpectIntEQ((int)dc->keyOID, FRODOKEM_976_SHAKEk);
+        wc_FreeDecodedCert(dc);
+    }
+#endif
+
+    if (rngInit) {
+        DoExpectIntEQ(wc_FreeRng(&rng), 0);
+    }
+    wc_ecc_free(caKey);
+    wc_FrodoKemKey_Free(key);
+    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(dc, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(caKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Parse the committed FrodoKEM certificate and CSR fixtures from
+ * certs/frodokem/ and confirm the FrodoKEM subject key is recognized. */
+int test_wc_frodokem_cert_file(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
+    defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC) && \
+    defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_WC_FRODOKEM_1344) && \
+    defined(WOLFSSL_FRODOKEM_SHAKE) && !defined(NO_FILESYSTEM)
+    static const struct {
+        const char* file;
+        int type;
+        int keySum;
+    } fixtures[] = {
+        { "./certs/frodokem/frodokem976-cert.der",  CERT_TYPE,
+          FRODOKEM_976_SHAKEk },
+        { "./certs/frodokem/frodokem976-req.der",   CERTREQ_TYPE,
+          FRODOKEM_976_SHAKEk },
+        { "./certs/frodokem/frodokem1344-cert.der", CERT_TYPE,
+          FRODOKEM_1344_SHAKEk },
+        { "./certs/frodokem/frodokem1344-req.der",  CERTREQ_TYPE,
+          FRODOKEM_1344_SHAKEk }
+    };
+    byte* buf = NULL;
+    DecodedCert* dc = NULL;
+    XFILE f;
+    size_t n;
+    int i;
+
+    buf = (byte*)XMALLOC(24000, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(buf);
+    dc = (DecodedCert*)XMALLOC(sizeof(*dc), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ExpectNotNull(dc);
+
+    for (i = 0; (i < (int)(sizeof(fixtures) / sizeof(fixtures[0]))) &&
+            EXPECT_SUCCESS(); i++) {
+        n = 0;
+        if ((f = XFOPEN(fixtures[i].file, "rb")) != XBADFILE) {
+            n = XFREAD(buf, 1, 24000, f);
+            XFCLOSE(f);
+        }
+        ExpectIntGT((int)n, 0);
+        if (EXPECT_SUCCESS()) {
+            wc_InitDecodedCert(dc, buf, (word32)n, NULL);
+            ExpectIntEQ(wc_ParseCert(dc, fixtures[i].type, NO_VERIFY, NULL), 0);
+            ExpectIntEQ((int)dc->keyOID, fixtures[i].keySum);
+            wc_FreeDecodedCert(dc);
+        }
+    }
+
+    XFREE(dc, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* Verify the committed FrodoKEM leaf certificates chain to the committed ECC
+ * issuer certificate (exercises the full parse + signature-verify path). */
+int test_wc_frodokem_cert_verify(void)
+{
+    EXPECT_DECLS;
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
+    defined(WOLFSSL_CERT_GEN) && defined(HAVE_ECC) && \
+    defined(WOLFSSL_WC_FRODOKEM_976) && defined(WOLFSSL_WC_FRODOKEM_1344) && \
+    defined(WOLFSSL_FRODOKEM_SHAKE) && !defined(NO_FILESYSTEM) && \
+    !defined(WOLFCRYPT_ONLY) && !defined(NO_CERTS)
+    WOLFSSL_CERT_MANAGER* cm = NULL;
+
+    ExpectNotNull(cm = wolfSSL_CertManagerNew());
+    ExpectIntEQ(wolfSSL_CertManagerLoadCA(cm,
+        "./certs/frodokem/frodokem-ca-ecc-cert.pem", NULL), WOLFSSL_SUCCESS);
+    ExpectIntEQ(wolfSSL_CertManagerVerify(cm,
+        "./certs/frodokem/frodokem976-cert.pem", WOLFSSL_FILETYPE_PEM),
+        WOLFSSL_SUCCESS);
+    ExpectIntEQ(wolfSSL_CertManagerVerify(cm,
+        "./certs/frodokem/frodokem1344-cert.pem", WOLFSSL_FILETYPE_PEM),
+        WOLFSSL_SUCCESS);
+    wolfSSL_CertManagerFree(cm);
+#endif
+    return EXPECT_RESULT();
+}
diff --git a/tests/api/test_frodokem.h b/tests/api/test_frodokem.h
index ffbdb66ccc3..48cbca3990c 100644
--- a/tests/api/test_frodokem.h
+++ b/tests/api/test_frodokem.h
@@ -36,6 +36,11 @@ int test_wc_frodokem_bad_args(void);
 int test_wc_frodokem_op_len_checks(void);
 int test_wc_frodokem_new_delete(void);
 int test_wc_frodokem_not_compiled_in(void);
+int test_wc_frodokem_asn1(void);
+int test_wc_frodokem_key_pem(void);
+int test_wc_frodokem_x509(void);
+int test_wc_frodokem_cert_file(void);
+int test_wc_frodokem_cert_verify(void);
 
 #define TEST_FRODOKEM_DECLS                                                 \
     TEST_DECL_GROUP("frodokem", test_wc_frodokem_make_key_kats),            \
@@ -49,6 +54,11 @@ int test_wc_frodokem_not_compiled_in(void);
     TEST_DECL_GROUP("frodokem", test_wc_frodokem_bad_args),                 \
     TEST_DECL_GROUP("frodokem", test_wc_frodokem_op_len_checks),            \
     TEST_DECL_GROUP("frodokem", test_wc_frodokem_new_delete),               \
-    TEST_DECL_GROUP("frodokem", test_wc_frodokem_not_compiled_in)
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_not_compiled_in),          \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_asn1),                     \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_key_pem),                  \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_x509),                     \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_cert_file),                \
+    TEST_DECL_GROUP("frodokem", test_wc_frodokem_cert_verify)
 
 #endif /* WOLFCRYPT_TEST_FRODOKEM_H */
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index 8b870e3ce0b..1c95ff5166d 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -295,6 +295,9 @@ ASN Options:
 #if defined(WOLFSSL_HAVE_SLHDSA)
     #include <wolfssl/wolfcrypt/wc_slhdsa.h>
 #endif
+#if defined(WOLFSSL_HAVE_FRODOKEM)
+    #include <wolfssl/wolfcrypt/wc_frodokem.h>
+#endif
 
 #ifdef WOLFSSL_QNX_CAAM
     #include <wolfssl/wolfcrypt/port/caam/wolfcaam.h>
@@ -4546,9 +4549,19 @@ static int EncodeName(EncodedName* name, const char* nameStr, byte nameTag, byte
 #endif
 #ifdef WOLFSSL_CERT_GEN
 static int SetValidity(byte* output, int daysValid);
-static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz, RsaKey* rsaKey, ecc_key* eccKey, WC_RNG* rng, DsaKey* dsaKey, ed25519_key* ed25519Key, ed448_key* ed448Key, falcon_key* falconKey, wc_MlDsaKey* mldsaKey, SlhDsaKey* slhDsaKey, LmsKey* lmsKey, XmssKey* xmssKey);
+static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
+                       RsaKey* rsaKey, ecc_key* eccKey, WC_RNG* rng,
+                       DsaKey* dsaKey, ed25519_key* ed25519Key,
+                       ed448_key* ed448Key, falcon_key* falconKey,
+                       wc_MlDsaKey* mldsaKey, SlhDsaKey* slhDsaKey,
+                       LmsKey* lmsKey, XmssKey* xmssKey, void* frodoKey);
 #ifdef WOLFSSL_CERT_REQ
-static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz, RsaKey* rsaKey, DsaKey* dsaKey, ecc_key* eccKey, ed25519_key* ed25519Key, ed448_key* ed448Key, falcon_key* falconKey, wc_MlDsaKey* mldsaKey, SlhDsaKey* slhDsaKey, LmsKey* lmsKey, XmssKey* xmssKey);
+static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
+                       RsaKey* rsaKey, DsaKey* dsaKey, ecc_key* eccKey,
+                       ed25519_key* ed25519Key, ed448_key* ed448Key,
+                       falcon_key* falconKey, wc_MlDsaKey* mldsaKey,
+                       SlhDsaKey* slhDsaKey, LmsKey* lmsKey, XmssKey* xmssKey,
+                       void* frodoKey);
 #endif
 #endif
 #endif
@@ -4853,6 +4866,34 @@ static int ParseCRL_Extensions(DecodedCRL* dcrl, const byte* buf, word32* inOutI
     static const byte keyMlDsa_87Oid[] =
         {96, 134, 72, 1, 101, 3, 4, 3, 19};
 #endif /* WOLFSSL_HAVE_MLDSA */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    /* FrodoKEM / eFrodoKEM key OIDs (ISO/IEC 18033-2, arc 1.0.18033.2.2.7.x).
+     * Only the 976 and 1344 parameter sets are standardised (no 640). */
+    /* frodokem976-shake:    1.0.18033.2.2.7.1 */
+    static const byte keyFrodoKem_976ShakeOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 1};
+    /* frodokem1344-shake:   1.0.18033.2.2.7.2 */
+    static const byte keyFrodoKem_1344ShakeOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 2};
+    /* efrodokem976-shake:   1.0.18033.2.2.7.3 */
+    static const byte keyeFrodoKem_976ShakeOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 3};
+    /* efrodokem1344-shake:  1.0.18033.2.2.7.4 */
+    static const byte keyeFrodoKem_1344ShakeOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 4};
+    /* frodokem976-aes:      1.0.18033.2.2.7.5 */
+    static const byte keyFrodoKem_976AesOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 5};
+    /* frodokem1344-aes:     1.0.18033.2.2.7.6 */
+    static const byte keyFrodoKem_1344AesOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 6};
+    /* efrodokem976-aes:     1.0.18033.2.2.7.7 */
+    static const byte keyeFrodoKem_976AesOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 7};
+    /* efrodokem1344-aes:    1.0.18033.2.2.7.8 */
+    static const byte keyeFrodoKem_1344AesOid[] =
+        {40, 129, 140, 113, 2, 2, 7, 8};
+#endif /* WOLFSSL_HAVE_FRODOKEM */
 #ifdef WOLFSSL_HAVE_SLHDSA
     /* SLH-DSA-SHA2-128s: 2.16.840.1.101.3.4.3.20 */
     static const byte keySlhDsa_Sha2_128sOid[] = {96, 134, 72, 1, 101, 3, 4, 3, 20};
@@ -6189,6 +6230,40 @@ const byte* OidFromId(word32 id, word32 type, word32* oidSz)
                     *oidSz = sizeof(keySlhDsa_Shake_256fOid);
                     break;
             #endif /* WOLFSSL_HAVE_SLHDSA */
+            #ifdef WOLFSSL_HAVE_FRODOKEM
+                case FRODOKEM_976_SHAKEk:
+                    oid = keyFrodoKem_976ShakeOid;
+                    *oidSz = sizeof(keyFrodoKem_976ShakeOid);
+                    break;
+                case FRODOKEM_1344_SHAKEk:
+                    oid = keyFrodoKem_1344ShakeOid;
+                    *oidSz = sizeof(keyFrodoKem_1344ShakeOid);
+                    break;
+                case EFRODOKEM_976_SHAKEk:
+                    oid = keyeFrodoKem_976ShakeOid;
+                    *oidSz = sizeof(keyeFrodoKem_976ShakeOid);
+                    break;
+                case EFRODOKEM_1344_SHAKEk:
+                    oid = keyeFrodoKem_1344ShakeOid;
+                    *oidSz = sizeof(keyeFrodoKem_1344ShakeOid);
+                    break;
+                case FRODOKEM_976_AESk:
+                    oid = keyFrodoKem_976AesOid;
+                    *oidSz = sizeof(keyFrodoKem_976AesOid);
+                    break;
+                case FRODOKEM_1344_AESk:
+                    oid = keyFrodoKem_1344AesOid;
+                    *oidSz = sizeof(keyFrodoKem_1344AesOid);
+                    break;
+                case EFRODOKEM_976_AESk:
+                    oid = keyeFrodoKem_976AesOid;
+                    *oidSz = sizeof(keyeFrodoKem_976AesOid);
+                    break;
+                case EFRODOKEM_1344_AESk:
+                    oid = keyeFrodoKem_1344AesOid;
+                    *oidSz = sizeof(keyeFrodoKem_1344AesOid);
+                    break;
+            #endif /* WOLFSSL_HAVE_FRODOKEM */
             #ifdef WOLFSSL_HAVE_LMS
                 case HSS_LMSk:
                     oid = keyHssLmsOid;
@@ -7693,6 +7768,37 @@ static word32 fpkiCertPolOid(const byte* oid, word32 oidSz, word32 oidSum) {
     return 0;
 }
 #endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+/* The FrodoKEM key OIDs (1.0.18033.2.2.7.x) old-scheme byte sums (434..441)
+ * collide with the SLH-DSA key OIDs. All FrodoKEM OIDs share the same length
+ * and 7-byte prefix and differ only in the final arc, so match the prefix and
+ * map the final arc to the distinct FrodoKEM sum (100434..100441). Returns 0
+ * when the OID is not FrodoKEM (leaving the byte sum unchanged).
+ * @param [in]  oid    Buffer holding OID content octets.
+ * @param [in]  oidSz  Length of OID data in buffer.
+ */
+static word32 frodoKemKeyOidSum(const byte* oid, word32 oidSz)
+{
+    word32 sum = 0;
+
+    if ((oidSz == (word32)sizeof(keyFrodoKem_976ShakeOid)) &&
+            (XMEMCMP(oid, keyFrodoKem_976ShakeOid, oidSz - 1) == 0)) {
+        switch (oid[oidSz - 1]) {
+            case 1: sum = FRODOKEM_976_SHAKEk; break;
+            case 2: sum = FRODOKEM_1344_SHAKEk; break;
+            case 3: sum = EFRODOKEM_976_SHAKEk; break;
+            case 4: sum = EFRODOKEM_1344_SHAKEk; break;
+            case 5: sum = FRODOKEM_976_AESk; break;
+            case 6: sum = FRODOKEM_1344_AESk; break;
+            case 7: sum = EFRODOKEM_976_AESk; break;
+            case 8: sum = EFRODOKEM_1344_AESk; break;
+            default: break;
+        }
+    }
+
+    return sum;
+}
+#endif /* WOLFSSL_HAVE_FRODOKEM */
 #endif /* WOLFSSL_OLD_OID_SUM */
 
 word32 wc_oid_sum(const byte* input, int length)
@@ -7780,6 +7886,16 @@ static int GetOID(const byte* input, word32* inOutIdx, word32* oid,
         *oid = found_collision;
     }
 #endif /* WOLFSSL_FPKI */
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    /* Remap a FrodoKEM key OID off the SLH-DSA byte-sum collision to its
+     * distinct sum so the two do not alias in the old-scheme lookup. */
+    if (oidType == oidKeyType) {
+        word32 fkSum = frodoKemKeyOidSum(actualOid, actualOidSz);
+        if (fkSum != 0) {
+            *oid = fkSum;
+        }
+    }
+#endif /* WOLFSSL_HAVE_FRODOKEM */
 #endif
 
     /* Return the index after the OID data. */
@@ -9159,6 +9275,22 @@ int ToTraditionalInline_ex2(const byte* input, word32* inOutIdx, word32 sz,
                     ret = ASN_PARSE_E;
                 }
                 break;
+        #endif
+        #if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+            case FRODOKEM_976_SHAKEk:
+            case FRODOKEM_1344_SHAKEk:
+            case EFRODOKEM_976_SHAKEk:
+            case EFRODOKEM_1344_SHAKEk:
+            case FRODOKEM_976_AESk:
+            case FRODOKEM_1344_AESk:
+            case EFRODOKEM_976_AESk:
+            case EFRODOKEM_1344_AESk:
+                /* Neither NULL item nor OBJECT_ID item allowed. */
+                if ((dataASN[PKCS8KEYASN_IDX_PKEY_ALGO_NULL].tag != 0) ||
+                    (dataASN[PKCS8KEYASN_IDX_PKEY_ALGO_OID_CURVE].tag != 0)) {
+                    ret = ASN_PARSE_E;
+                }
+                break;
         #endif
             /* Other OIDs (DSAk), no parameter validation. */
             default:
@@ -9730,6 +9862,52 @@ int wc_CheckPrivateKey(const byte* privKey, word32 privKeySz,
     }
     else
 #endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_VERIFY_ONLY */
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+    if ((ks == FRODOKEM_976_SHAKEk) || (ks == FRODOKEM_1344_SHAKEk) ||
+        (ks == EFRODOKEM_976_SHAKEk) || (ks == EFRODOKEM_1344_SHAKEk) ||
+        (ks == FRODOKEM_976_AESk) || (ks == FRODOKEM_1344_AESk) ||
+        (ks == EFRODOKEM_976_AESk) || (ks == EFRODOKEM_1344_AESk)) {
+        /* FrodoKemKey is large (tens of KB); always heap-allocate it to avoid
+         * a big stack frame, as wc_GetKeyOID() does. */
+        FrodoKemKey* key_pair = (FrodoKemKey*)XMALLOC(sizeof(FrodoKemKey),
+            heap, DYNAMIC_TYPE_TMP_BUFFER);
+        word32 keyIdx = 0;
+        word32 pubSz = 0;
+        byte*  pub = NULL;
+
+        if (key_pair == NULL) {
+            return MEMORY_E;
+        }
+        XMEMSET(key_pair, 0, sizeof(FrodoKemKey));
+        key_pair->devId = INVALID_DEVID;
+
+        /* Auto-detect the variant from the private key's OID, derive its
+         * public key and match it against the certificate's public key. */
+        ret = wc_FrodoKemKey_PrivateKeyDecode(key_pair, privKey, privKeySz,
+            &keyIdx);
+        if (ret == 0) {
+            ret = wc_FrodoKemKey_PublicKeySize(key_pair, &pubSz);
+        }
+        if (ret == 0) {
+            pub = (byte*)XMALLOC(pubSz, heap, DYNAMIC_TYPE_TMP_BUFFER);
+            if (pub == NULL) {
+                ret = MEMORY_E;
+            }
+        }
+        if (ret == 0) {
+            ret = wc_FrodoKemKey_EncodePublicKey(key_pair, pub, pubSz);
+        }
+        if (ret == 0) {
+            WOLFSSL_MSG("Checking FrodoKEM key pair");
+            ret = ((pubKeySz == pubSz) &&
+                   (XMEMCMP(pub, pubKey, pubSz) == 0)) ? 1 : 0;
+        }
+        XFREE(pub, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        wc_FrodoKemKey_Free(key_pair);
+        XFREE(key_pair, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+    else
+#endif /* WOLFSSL_HAVE_FRODOKEM && !WOLFSSL_FRODOKEM_NO_ASN1 */
     {
         ret = 0;
     }
@@ -9985,6 +10163,47 @@ static int CheckAlgoV2(int oid, int* id, int* blockSz)
 
 #if defined(HAVE_PKCS8) || defined(HAVE_PKCS12)
 
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+/* Map a decoded FrodoKEM key type to its key-OID sum (Key_Sum). Mirrors the
+ * mapping in wc_frodokem.c; 640 has no standardised OID and returns 0. */
+static int frodoKemKeyTypeToSum(int type)
+{
+    int sum = 0;
+
+    switch (type & (FRODOKEM_BASE_MASK | FRODOKEM_AES | FRODOKEM_EPHEMERAL)) {
+        case WC_FRODOKEM_976:
+            sum = FRODOKEM_976_SHAKEk;
+            break;
+        case WC_FRODOKEM_976 | FRODOKEM_EPHEMERAL:
+            sum = EFRODOKEM_976_SHAKEk;
+            break;
+        case WC_FRODOKEM_976 | FRODOKEM_AES:
+            sum = FRODOKEM_976_AESk;
+            break;
+        case WC_FRODOKEM_976 | FRODOKEM_AES | FRODOKEM_EPHEMERAL:
+            sum = EFRODOKEM_976_AESk;
+            break;
+        case WC_FRODOKEM_1344:
+            sum = FRODOKEM_1344_SHAKEk;
+            break;
+        case WC_FRODOKEM_1344 | FRODOKEM_EPHEMERAL:
+            sum = EFRODOKEM_1344_SHAKEk;
+            break;
+        case WC_FRODOKEM_1344 | FRODOKEM_AES:
+            sum = FRODOKEM_1344_AESk;
+            break;
+        case WC_FRODOKEM_1344 | FRODOKEM_AES | FRODOKEM_EPHEMERAL:
+            sum = EFRODOKEM_1344_AESk;
+            break;
+        default:
+            sum = 0;
+            break;
+    }
+
+    return sum;
+}
+#endif /* WOLFSSL_HAVE_FRODOKEM && !WOLFSSL_FRODOKEM_NO_ASN1 */
+
 int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID, word32* oidSz,
         int* algoID, void* heap)
 {
@@ -10280,6 +10499,28 @@ int wc_GetKeyOID(byte* key, word32 keySz, const byte** curveOID, word32* oidSz,
         XFREE(slhDsa, heap, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #endif /* WOLFSSL_HAVE_SLHDSA && !WOLFSSL_SLHDSA_VERIFY_ONLY */
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+    if (*algoID == 0) {
+        FrodoKemKey *frodo = (FrodoKemKey *)XMALLOC(sizeof(*frodo), heap,
+            DYNAMIC_TYPE_TMP_BUFFER);
+        if (frodo == NULL)
+            return MEMORY_E;
+
+        /* A zeroed object makes wc_FrodoKemKey_PrivateKeyDecode auto-detect the
+         * variant from the OID and initialize the key. */
+        XMEMSET(frodo, 0, sizeof(*frodo));
+        frodo->devId = INVALID_DEVID;
+        tmpIdx = 0;
+        if (wc_FrodoKemKey_PrivateKeyDecode(frodo, key, keySz, &tmpIdx) == 0) {
+            *algoID = frodoKemKeyTypeToSum(frodo->type);
+        }
+        else {
+            WOLFSSL_MSG("Not FrodoKEM DER key");
+        }
+        wc_FrodoKemKey_Free(frodo);
+        XFREE(frodo, heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+#endif /* WOLFSSL_HAVE_FRODOKEM && !WOLFSSL_FRODOKEM_NO_ASN1 */
 
     /* if flag is not set then this is not a key that we understand. */
     if (*algoID == 0) {
@@ -12759,7 +13000,8 @@ void wc_FreeDecodedCert(DecodedCert* cert)
 
 #if defined(HAVE_ED25519) || defined(HAVE_ED448) || defined(HAVE_FALCON) || \
     defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA) || \
-    defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS)
+    defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS) || \
+    (defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1))
 /* Store the key data under the BIT_STRING in dynamically allocated data.
  *
  * @param [in, out] cert    Certificate object.
@@ -13766,6 +14008,19 @@ static int GetCertKey(DecodedCert* cert, const byte* source, word32* inOutIdx,
             ret = StoreKey(cert, source, &srcIdx, maxIdx);
             break;
     #endif /* WOLFSSL_HAVE_MLDSA */
+    #if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+        case FRODOKEM_976_SHAKEk:
+        case FRODOKEM_1344_SHAKEk:
+        case EFRODOKEM_976_SHAKEk:
+        case EFRODOKEM_1344_SHAKEk:
+        case FRODOKEM_976_AESk:
+        case FRODOKEM_1344_AESk:
+        case EFRODOKEM_976_AESk:
+        case EFRODOKEM_1344_AESk:
+            cert->pkCurveOID = cert->keyOID;
+            ret = StoreKey(cert, source, &srcIdx, maxIdx);
+            break;
+    #endif /* WOLFSSL_HAVE_FRODOKEM && !WOLFSSL_FRODOKEM_NO_ASN1 */
     #ifdef WOLFSSL_HAVE_SLHDSA
         case SLH_DSA_SHAKE_128Fk:
         case SLH_DSA_SHAKE_192Fk:
@@ -28145,7 +28400,8 @@ static int EncodePublicKey(int keyType, byte* output, int outLen,
                            ed25519_key* ed25519Key, ed448_key* ed448Key,
                            DsaKey* dsaKey, falcon_key* falconKey,
                            wc_MlDsaKey* mldsaKey, SlhDsaKey* slhDsaKey,
-                           LmsKey* lmsKey, XmssKey* xmssKey)
+                           LmsKey* lmsKey, XmssKey* xmssKey,
+                           void* frodoKey)
 {
     int ret = 0;
 
@@ -28160,6 +28416,7 @@ static int EncodePublicKey(int keyType, byte* output, int outLen,
     (void)slhDsaKey;
     (void)lmsKey;
     (void)xmssKey;
+    (void)frodoKey;
 
     switch (keyType) {
     #ifndef NO_RSA
@@ -28221,6 +28478,15 @@ static int EncodePublicKey(int keyType, byte* output, int outLen,
             }
             break;
     #endif /* WOLFSSL_HAVE_MLDSA */
+    #if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+        case FRODOKEM_KEY:
+            ret = wc_FrodoKemKey_PublicKeyToDer((FrodoKemKey*)frodoKey, output,
+                                                (word32)outLen, 1);
+            if (ret <= 0) {
+                ret = PUBLIC_KEY_E;
+            }
+            break;
+    #endif /* WOLFSSL_HAVE_FRODOKEM && !WOLFSSL_FRODOKEM_NO_ASN1 */
     #if defined(WOLFSSL_HAVE_SLHDSA)
         case SLH_DSA_SHAKE_128F_KEY:
         case SLH_DSA_SHAKE_192F_KEY:
@@ -29603,7 +29869,7 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
                        DsaKey* dsaKey, ed25519_key* ed25519Key,
                        ed448_key* ed448Key, falcon_key* falconKey,
                        wc_MlDsaKey* mldsaKey, SlhDsaKey* slhDsaKey,
-                       LmsKey* lmsKey, XmssKey* xmssKey)
+                       LmsKey* lmsKey, XmssKey* xmssKey, void* frodoKey)
 {
     /* TODO: issRaw and sbjRaw should be NUL terminated. */
     DECL_ASNSETDATA(dataASN, x509CertASN_Length);
@@ -29699,6 +29965,11 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
             cert->keyType = xmssKey->is_xmssmt ? XMSSMT_KEY : XMSS_KEY;
         }
 #endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+        else if (frodoKey != NULL) {
+            cert->keyType = FRODOKEM_KEY;
+        }
+#endif /* WOLFSSL_HAVE_FRODOKEM && !WOLFSSL_FRODOKEM_NO_ASN1 */
         else {
             ret = BAD_FUNC_ARG;
         }
@@ -29747,7 +30018,7 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
         /* Calculate public key encoding size. */
         ret = EncodePublicKey(cert->keyType, NULL, 0, rsaKey,
                 eccKey, ed25519Key, ed448Key, dsaKey, falconKey,
-                mldsaKey, slhDsaKey, lmsKey, xmssKey);
+                mldsaKey, slhDsaKey, lmsKey, xmssKey, frodoKey);
         publicKeySz = (word32)ret;
     }
     if (ret >= 0) {
@@ -29934,7 +30205,8 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
             (int)dataASN[X509CERTASN_IDX_TBS_SPUBKEYINFO_SEQ]
                            .data.buffer.length,
             rsaKey, eccKey, ed25519Key, ed448Key, dsaKey,
-            falconKey, mldsaKey, slhDsaKey, lmsKey, xmssKey);
+            falconKey, mldsaKey, slhDsaKey, lmsKey, xmssKey,
+            frodoKey);
     }
     if ((ret >= 0) && (!dataASN[X509CERTASN_IDX_TBS_EXT_SEQ].noOut)) {
         /* Encode extensions into buffer. */
@@ -29981,6 +30253,7 @@ int wc_MakeCert_ex(Cert* cert, byte* derBuffer, word32 derSz, int keyType,
     SlhDsaKey*         slhDsaKey = NULL;
     LmsKey*            lmsKey = NULL;
     XmssKey*           xmssKey = NULL;
+    void*              frodoKey = NULL;
 
     if (keyType == RSA_TYPE)
         rsaKey = (RsaKey*)key;
@@ -30032,10 +30305,14 @@ int wc_MakeCert_ex(Cert* cert, byte* derBuffer, word32 derSz, int keyType,
             return BAD_FUNC_ARG;
     }
 #endif
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+    else if (keyType == FRODOKEM_TYPE)
+        frodoKey = key;
+#endif
 
     return MakeAnyCert(cert, derBuffer, derSz, rsaKey, eccKey, rng, dsaKey,
                        ed25519Key, ed448Key, falconKey, mldsaKey,
-                       slhDsaKey, lmsKey, xmssKey);
+                       slhDsaKey, lmsKey, xmssKey, frodoKey);
 }
 
 /* Make an x509 Certificate v3 RSA or ECC from cert input, write to buffer */
@@ -30044,7 +30321,7 @@ int wc_MakeCert(Cert* cert, byte* derBuffer, word32 derSz, RsaKey* rsaKey,
              ecc_key* eccKey, WC_RNG* rng)
 {
     return MakeAnyCert(cert, derBuffer, derSz, rsaKey, eccKey, rng, NULL, NULL,
-                       NULL, NULL, NULL, NULL, NULL, NULL);
+                       NULL, NULL, NULL, NULL, NULL, NULL, NULL);
 }
 
 
@@ -30112,7 +30389,8 @@ static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
                    RsaKey* rsaKey, DsaKey* dsaKey, ecc_key* eccKey,
                    ed25519_key* ed25519Key, ed448_key* ed448Key,
                    falcon_key* falconKey, wc_MlDsaKey* mldsaKey,
-                   SlhDsaKey* slhDsaKey, LmsKey* lmsKey, XmssKey* xmssKey)
+                   SlhDsaKey* slhDsaKey, LmsKey* lmsKey, XmssKey* xmssKey,
+                   void* frodoKey)
 {
     DECL_ASNSETDATA(dataASN, certReqBodyASN_Length);
     word32 publicKeySz = 0;
@@ -30207,6 +30485,11 @@ static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
             cert->keyType = xmssKey->is_xmssmt ? XMSSMT_KEY : XMSS_KEY;
         }
 #endif /* WOLFSSL_HAVE_XMSS && !WOLFSSL_XMSS_VERIFY_ONLY */
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+        else if (frodoKey != NULL) {
+            cert->keyType = FRODOKEM_KEY;
+        }
+#endif /* WOLFSSL_HAVE_FRODOKEM && !WOLFSSL_FRODOKEM_NO_ASN1 */
         else {
             ret = BAD_FUNC_ARG;
         }
@@ -30229,7 +30512,7 @@ static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
         /* Determine encode public key size. */
          ret = EncodePublicKey(cert->keyType, NULL, 0, rsaKey,
              eccKey, ed25519Key, ed448Key, dsaKey, falconKey,
-             mldsaKey, slhDsaKey, lmsKey, xmssKey);
+             mldsaKey, slhDsaKey, lmsKey, xmssKey, frodoKey);
          publicKeySz = (word32)ret;
     }
     if (ret >= 0) {
@@ -30349,7 +30632,7 @@ static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
                 dataASN[CERTREQBODYASN_IDX_SPUBKEYINFO_SEQ].data.buffer.data,
             (int)dataASN[CERTREQBODYASN_IDX_SPUBKEYINFO_SEQ].data.buffer.length,
             rsaKey, eccKey, ed25519Key, ed448Key, dsaKey, falconKey,
-            mldsaKey, slhDsaKey, lmsKey, xmssKey);
+            mldsaKey, slhDsaKey, lmsKey, xmssKey, frodoKey);
     }
     if ((ret >= 0 && derBuffer != NULL) &&
             (!dataASN[CERTREQBODYASN_IDX_EXT_BODY].noOut)) {
@@ -30385,6 +30668,7 @@ int wc_MakeCertReq_ex(Cert* cert, byte* derBuffer, word32 derSz, int keyType,
     SlhDsaKey*     slhDsaKey = NULL;
     LmsKey*        lmsKey = NULL;
     XmssKey*       xmssKey = NULL;
+    void*          frodoKey = NULL;
 
     if (keyType == RSA_TYPE)
         rsaKey = (RsaKey*)key;
@@ -30436,10 +30720,14 @@ int wc_MakeCertReq_ex(Cert* cert, byte* derBuffer, word32 derSz, int keyType,
             return BAD_FUNC_ARG;
     }
 #endif
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+    else if (keyType == FRODOKEM_TYPE)
+        frodoKey = key;
+#endif
 
     return MakeCertReq(cert, derBuffer, derSz, rsaKey, dsaKey, eccKey,
                        ed25519Key, ed448Key, falconKey, mldsaKey,
-                       slhDsaKey, lmsKey, xmssKey);
+                       slhDsaKey, lmsKey, xmssKey, frodoKey);
 }
 
 WOLFSSL_ABI
@@ -30447,7 +30735,7 @@ int wc_MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
                    RsaKey* rsaKey, ecc_key* eccKey)
 {
     return MakeCertReq(cert, derBuffer, derSz, rsaKey, NULL, eccKey, NULL,
-                       NULL, NULL, NULL, NULL, NULL, NULL);
+                       NULL, NULL, NULL, NULL, NULL, NULL, NULL);
 }
 #endif /* WOLFSSL_CERT_REQ */
 
@@ -31127,20 +31415,27 @@ static int SetKeyIdFromPublicKey(Cert *cert, RsaKey *rsakey, ecc_key *eckey,
                                  ed25519_key* ed25519Key, ed448_key* ed448Key,
                                  falcon_key* falconKey,
                                  wc_MlDsaKey* mldsaKey,
-                                 SlhDsaKey *slhDsaKey, int kid_type)
+                                 SlhDsaKey *slhDsaKey, void* frodoKey,
+                                 int kid_type)
 {
     byte *buf;
     int   bufferSz, ret;
+    word32 bufSz = MAX_PUBLIC_KEY_SZ;
 
     if (cert == NULL ||
         (rsakey == NULL && eckey == NULL && ed25519Key == NULL &&
          ed448Key == NULL && falconKey == NULL && mldsaKey == NULL &&
-         slhDsaKey == NULL) ||
+         slhDsaKey == NULL && frodoKey == NULL) ||
         (kid_type != SKID_TYPE && kid_type != AKID_TYPE))
         return BAD_FUNC_ARG;
 
-    buf = (byte *)XMALLOC(MAX_PUBLIC_KEY_SZ, cert->heap,
-                                                       DYNAMIC_TYPE_TMP_BUFFER);
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+    /* FrodoKEM public keys are far larger than MAX_PUBLIC_KEY_SZ. */
+    if (frodoKey != NULL) {
+        bufSz = FRODOKEM_MAX_PUB_KEY_DER_SIZE;
+    }
+#endif
+    buf = (byte *)XMALLOC(bufSz, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
     if (buf == NULL)
         return MEMORY_E;
 
@@ -31186,6 +31481,12 @@ static int SetKeyIdFromPublicKey(Cert *cert, RsaKey *rsakey, ecc_key *eckey,
                                                MAX_PUBLIC_KEY_SZ, 0);
     }
 #endif
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+    if (frodoKey != NULL) {
+        bufferSz = wc_FrodoKemKey_PublicKeyToDer((FrodoKemKey*)frodoKey, buf,
+                                                 bufSz, 0);
+    }
+#endif
 
     if (bufferSz <= 0) {
         XFREE(buf, cert->heap, DYNAMIC_TYPE_TMP_BUFFER);
@@ -31225,6 +31526,7 @@ int wc_SetSubjectKeyIdFromPublicKey_ex(Cert *cert, int keyType, void* key)
     falcon_key*        falconKey = NULL;
     wc_MlDsaKey*       mldsaKey = NULL;
     SlhDsaKey*         slhDsaKey = NULL;
+    void*              frodoKey = NULL;
 
     if (keyType == RSA_TYPE)
         rsaKey = (RsaKey*)key;
@@ -31256,9 +31558,13 @@ int wc_SetSubjectKeyIdFromPublicKey_ex(Cert *cert, int keyType, void* key)
     else if (IsSlhDsaKeyType(keyType))
         slhDsaKey = (SlhDsaKey*)key;
 #endif
+#if defined(WOLFSSL_HAVE_FRODOKEM) && !defined(WOLFSSL_FRODOKEM_NO_ASN1)
+    else if (keyType == FRODOKEM_TYPE)
+        frodoKey = key;
+#endif
 
     return SetKeyIdFromPublicKey(cert, rsaKey, eccKey, ed25519Key, ed448Key,
-                                 falconKey, mldsaKey, slhDsaKey,
+                                 falconKey, mldsaKey, slhDsaKey, frodoKey,
                                  SKID_TYPE);
 }
 
@@ -31266,7 +31572,7 @@ int wc_SetSubjectKeyIdFromPublicKey_ex(Cert *cert, int keyType, void* key)
 int wc_SetSubjectKeyIdFromPublicKey(Cert *cert, RsaKey *rsakey, ecc_key *eckey)
 {
     return SetKeyIdFromPublicKey(cert, rsakey, eckey, NULL, NULL, NULL, NULL,
-                                 NULL, SKID_TYPE);
+                                 NULL, NULL, SKID_TYPE);
 }
 
 int wc_SetAuthKeyIdFromPublicKey_ex(Cert *cert, int keyType, void* key)
@@ -31311,7 +31617,7 @@ int wc_SetAuthKeyIdFromPublicKey_ex(Cert *cert, int keyType, void* key)
 #endif
 
     return SetKeyIdFromPublicKey(cert, rsaKey, eccKey, ed25519Key, ed448Key,
-                                 falconKey, mldsaKey, slhDsaKey,
+                                 falconKey, mldsaKey, slhDsaKey, NULL,
                                  AKID_TYPE);
 }
 
@@ -31319,7 +31625,7 @@ int wc_SetAuthKeyIdFromPublicKey_ex(Cert *cert, int keyType, void* key)
 int wc_SetAuthKeyIdFromPublicKey(Cert *cert, RsaKey *rsakey, ecc_key *eckey)
 {
     return SetKeyIdFromPublicKey(cert, rsakey, eckey, NULL, NULL, NULL, NULL,
-                                 NULL, AKID_TYPE);
+                                 NULL, NULL, AKID_TYPE);
 }
 
 
@@ -33325,7 +33631,8 @@ enum {
     || (defined(HAVE_CURVE25519) && defined(HAVE_CURVE25519_KEY_IMPORT)) \
     || (defined(HAVE_ED448) && defined(HAVE_ED448_KEY_IMPORT)) \
     || (defined(HAVE_CURVE448) && defined(HAVE_CURVE448_KEY_IMPORT)) \
-    || defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA))
+    || defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) \
+    || defined(WOLFSSL_HAVE_SLHDSA) || defined(WOLFSSL_HAVE_FRODOKEM))
 
 
 int DecodeAsymKey_Assign(const byte* input, word32* inOutIdx, word32 inSz,
diff --git a/wolfcrypt/src/asn_orig.c b/wolfcrypt/src/asn_orig.c
index ccab6504257..6eab2b6041d 100644
--- a/wolfcrypt/src/asn_orig.c
+++ b/wolfcrypt/src/asn_orig.c
@@ -6594,7 +6594,7 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
                        DsaKey* dsaKey, ed25519_key* ed25519Key,
                        ed448_key* ed448Key, falcon_key* falconKey,
                        wc_MlDsaKey* mldsaKey, SlhDsaKey* slhDsaKey,
-                       LmsKey* lmsKey, XmssKey* xmssKey)
+                       LmsKey* lmsKey, XmssKey* xmssKey, void* frodoKey)
 {
     int ret;
     WC_DECLARE_VAR(der, DerCert, 1, 0);
@@ -6609,6 +6609,11 @@ static int MakeAnyCert(Cert* cert, byte* derBuffer, word32 derSz,
                     "WOLFSSL_ASN_TEMPLATE");
         return ALGO_ID_E;
     }
+    if (frodoKey != NULL) {
+        WOLFSSL_MSG("FrodoKEM certificate generation requires "
+                    "WOLFSSL_ASN_TEMPLATE");
+        return ALGO_ID_E;
+    }
 
     if (derBuffer == NULL)
         return BAD_FUNC_ARG;
@@ -7238,7 +7243,8 @@ static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
                    RsaKey* rsaKey, DsaKey* dsaKey, ecc_key* eccKey,
                    ed25519_key* ed25519Key, ed448_key* ed448Key,
                    falcon_key* falconKey, wc_MlDsaKey* mldsaKey,
-                   SlhDsaKey* slhDsaKey, LmsKey* lmsKey, XmssKey* xmssKey)
+                   SlhDsaKey* slhDsaKey, LmsKey* lmsKey, XmssKey* xmssKey,
+                   void* frodoKey)
 {
     int ret;
     WC_DECLARE_VAR(der, DerCert, 1, 0);
@@ -7250,6 +7256,11 @@ static int MakeCertReq(Cert* cert, byte* derBuffer, word32 derSz,
                     "WOLFSSL_ASN_TEMPLATE");
         return ALGO_ID_E;
     }
+    if (frodoKey != NULL) {
+        WOLFSSL_MSG("FrodoKEM certificate request generation requires "
+                    "WOLFSSL_ASN_TEMPLATE");
+        return ALGO_ID_E;
+    }
 
     if (eccKey)
         cert->keyType = ECC_KEY;
diff --git a/wolfcrypt/src/cryptocb.c b/wolfcrypt/src/cryptocb.c
index c3067b97b87..8eaef59c4fb 100644
--- a/wolfcrypt/src/cryptocb.c
+++ b/wolfcrypt/src/cryptocb.c
@@ -1317,7 +1317,7 @@ int wc_CryptoCb_PqcStatefulSigSigsLeft(int type, void* key, word32* sigsLeft)
 }
 #endif /* WOLFSSL_HAVE_LMS || WOLFSSL_HAVE_XMSS */
 
-#if defined(WOLFSSL_HAVE_MLKEM)
+#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM)
 int wc_CryptoCb_PqcKemGetDevId(int type, void* key)
 {
     int devId = INVALID_DEVID;
@@ -1326,9 +1326,16 @@ int wc_CryptoCb_PqcKemGetDevId(int type, void* key)
         return devId;
 
     /* get devId */
+#ifdef WOLFSSL_HAVE_MLKEM
     if (type == WC_PQC_KEM_TYPE_MLKEM) {
         devId = ((MlKemKey*) key)->devId;
     }
+#endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    if (type == WC_PQC_KEM_TYPE_FRODOKEM) {
+        devId = ((FrodoKemKey*) key)->devId;
+    }
+#endif
 
     return devId;
 }
@@ -1436,7 +1443,7 @@ int wc_CryptoCb_PqcDecapsulate(const byte* ciphertext, word32 ciphertextLen,
 
     return wc_CryptoCb_TranslateErrorCode(ret);
 }
-#endif /* WOLFSSL_HAVE_MLKEM */
+#endif /* WOLFSSL_HAVE_MLKEM || WOLFSSL_HAVE_FRODOKEM */
 
 #if defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) || \
     defined(WOLFSSL_HAVE_SLHDSA)
diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm.S b/wolfcrypt/src/port/arm/armv8-frodokem-asm.S
index 6f0fd9bb6ac..7c68e080a22 100644
--- a/wolfcrypt/src/port/arm/armv8-frodokem-asm.S
+++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm.S
@@ -294,7 +294,6 @@ L_frodokem_sha3_x2_neon_begin:
 	.size	frodokem_sha3_x2_neon,.-frodokem_sha3_x2_neon
 #endif /* __APPLE__ */
 #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
-	.arch_extension	sha3
 #ifndef __APPLE__
 .text
 .globl	frodokem_sha3_x2_crypto
@@ -319,6 +318,9 @@ _frodokem_sha3_x2_crypto:
 #else
 	adrp x1, L_sha3_aarch64_r@PAGE
 	add  x1, x1, L_sha3_aarch64_r@PAGEOFF
+#endif /* __APPLE__ */
+#ifdef __APPLE__
+.arch_extension sha3
 #endif /* __APPLE__ */
 	ld4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
 	ld4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm b/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm
index 8dbf29e94eb..0f32cbfd030 100644
--- a/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm
+++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm.asm
@@ -262,7 +262,6 @@ L_frodokem_sha3_x2_neon_begin
 	ret
 	ENDP
 	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
-; 	.arch_extension	sha3
 	AREA	|.text|, CODE, READONLY
 	ALIGN	4
 	EXPORT	frodokem_sha3_x2_crypto
@@ -275,6 +274,7 @@ frodokem_sha3_x2_crypto PROC
 	stp	D14, D15, [x29, #64]
 	adrp	x1, L_sha3_aarch64_r
 	add	x1, x1, L_sha3_aarch64_r
+; .arch_extension sha3
 	ld4	{V0.D, V1.D, V2.D, V3.D}[0], [x0], #32
 	ld4	{V4.D, V5.D, V6.D, V7.D}[0], [x0], #32
 	ld4	{V8.D, V9.D, V10.D, V11.D}[0], [x0], #32
diff --git a/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c b/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
index 7074cd9f8d2..e27e6900a5a 100644
--- a/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
+++ b/wolfcrypt/src/port/arm/armv8-frodokem-asm_c.c
@@ -265,11 +265,13 @@ void frodokem_sha3_x2_neon(word64* state)
 }
 
 #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
-    "	.arch_extension	sha3\n\t"
 void frodokem_sha3_x2_crypto(word64* state)
 {
     const word64* r = L_sha3_aarch64_r;
     __asm__ __volatile__ (
+#ifdef __APPLE__
+    ".arch_extension sha3\n\t"
+#endif /* __APPLE__ */
         "ld4	{v0.d, v1.d, v2.d, v3.d}[0], [%x[state]], #32\n\t"
         "ld4	{v4.d, v5.d, v6.d, v7.d}[0], [%x[state]], #32\n\t"
         "ld4	{v8.d, v9.d, v10.d, v11.d}[0], [%x[state]], #32\n\t"
diff --git a/wolfcrypt/src/wc_frodokem.c b/wolfcrypt/src/wc_frodokem.c
index 2725d70c1e9..e6e81528e6d 100644
--- a/wolfcrypt/src/wc_frodokem.c
+++ b/wolfcrypt/src/wc_frodokem.c
@@ -40,6 +40,12 @@
 #include <wolfssl/wolfcrypt/wc_frodokem_mat.h>
 #include <wolfssl/wolfcrypt/hash.h>
 #include <wolfssl/wolfcrypt/memory.h>
+#ifdef WOLF_CRYPTO_CB
+    #include <wolfssl/wolfcrypt/cryptocb.h>
+#endif
+#ifndef WOLFSSL_FRODOKEM_NO_ASN1
+    #include <wolfssl/wolfcrypt/asn.h>
+#endif
 
 #ifdef NO_INLINE
     #include <wolfssl/wolfcrypt/misc.h>
@@ -55,6 +61,11 @@
 /* Domain separator prepended to seedSE when generating encapsulation noise. */
 #define FRODOKEM_DOMAIN_ENCAPS  0x96
 
+/* The public key seedA || b is hashed as a single contiguous pkSize-byte block
+ * starting at key->seedA, so b must immediately follow seedA in the struct. */
+wc_static_assert(WC_OFFSETOF(FrodoKemKey, b) ==
+    WC_OFFSETOF(FrodoKemKey, seedA) + FRODOKEM_SEEDA_SZ);
+
 /******************************************************************************/
 /* Parameter sets.                                                            */
 /******************************************************************************/
@@ -560,7 +571,12 @@ int wc_FrodoKemKey_PublicKeySize(const FrodoKemKey* key, word32* len)
 static void frodokem_wipe_shake(FrodoKemKey* key)
 {
     if (key != NULL) {
-        (void)wc_InitShake128(&key->shake, NULL, INVALID_DEVID);
+        /* Re-initialising resets the Keccak state, erasing any residual secret
+         * (k') left in it. If that fails, clear the state directly so no secret
+         * material is left behind. */
+        if (wc_InitShake128(&key->shake, NULL, INVALID_DEVID) != 0) {
+            ForceZero(&key->shake, sizeof(key->shake));
+        }
     }
 }
 
@@ -698,6 +714,7 @@ int wc_FrodoKemKey_MakeKey(FrodoKemKey* key, WC_RNG* rng)
 #ifndef WC_NO_RNG
     const FrodoKemParams* p = NULL;
     int randLen = 0;
+    int cbHandled = 0;
 #ifdef WOLFSSL_SMALL_STACK
     byte* rand = NULL;
 #else
@@ -717,9 +734,21 @@ int wc_FrodoKemKey_MakeKey(FrodoKemKey* key, WC_RNG* rng)
     if (ret == 0) {
         randLen = p->lenSec + p->lenSE + FRODOKEM_SEEDA_SZ;
     }
+#ifdef WOLF_CRYPTO_CB
+    /* Offload to a registered crypto callback when a device is set; fall
+     * through to the software path when the callback is unavailable. */
+    if ((ret == 0) && (key->devId != INVALID_DEVID)) {
+        ret = wc_CryptoCb_MakePqcKemKey(rng, WC_PQC_KEM_TYPE_FRODOKEM,
+            key->type, key);
+        cbHandled = (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE));
+        if (!cbHandled) {
+            ret = 0;
+        }
+    }
+#endif
 #ifdef WOLFSSL_SMALL_STACK
     /* Keep the random data off the stack. */
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         rand = (byte*)XMALLOC((size_t)randLen, key->heap,
             DYNAMIC_TYPE_TMP_BUFFER);
         if (rand == NULL) {
@@ -727,10 +756,10 @@ int wc_FrodoKemKey_MakeKey(FrodoKemKey* key, WC_RNG* rng)
         }
     }
 #endif
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         ret = wc_RNG_GenerateBlock(rng, rand, (word32)randLen);
     }
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         ret = wc_FrodoKemKey_MakeKeyWithRandom(key, rand, randLen);
     }
 
@@ -937,6 +966,7 @@ int wc_FrodoKemKey_Encapsulate(FrodoKemKey* key, unsigned char* ct,
 #ifndef WC_NO_RNG
     const FrodoKemParams* p = NULL;
     int randLen = 0;
+    int cbHandled = 0;
 #ifdef WOLFSSL_SMALL_STACK
     byte* rand = NULL;
 #else
@@ -956,9 +986,21 @@ int wc_FrodoKemKey_Encapsulate(FrodoKemKey* key, unsigned char* ct,
     if (ret == 0) {
         randLen = p->lenSec + p->lenSalt;
     }
+#ifdef WOLF_CRYPTO_CB
+    /* Offload to a registered crypto callback when a device is set; fall
+     * through to the software path when the callback is unavailable. */
+    if ((ret == 0) && (key->devId != INVALID_DEVID)) {
+        ret = wc_CryptoCb_PqcEncapsulate(ct, (word32)p->ctSize, ss,
+            (word32)p->lenSec, rng, WC_PQC_KEM_TYPE_FRODOKEM, key);
+        cbHandled = (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE));
+        if (!cbHandled) {
+            ret = 0;
+        }
+    }
+#endif
 #ifdef WOLFSSL_SMALL_STACK
     /* Keep the random data off the stack. */
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         rand = (byte*)XMALLOC((size_t)randLen, key->heap,
             DYNAMIC_TYPE_TMP_BUFFER);
         if (rand == NULL) {
@@ -966,10 +1008,10 @@ int wc_FrodoKemKey_Encapsulate(FrodoKemKey* key, unsigned char* ct,
         }
     }
 #endif
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         ret = wc_RNG_GenerateBlock(rng, rand, (word32)randLen);
     }
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         ret = wc_FrodoKemKey_EncapsulateWithRandom(key, ct, ss, rand, randLen);
     }
 
@@ -1055,6 +1097,7 @@ int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
     word32 isEq;
     byte mask;
     size_t matSz = 0;
+    int cbHandled = 0;
 
     if ((key == NULL) || (ss == NULL) || (ct == NULL)) {
         ret = BAD_FUNC_ARG;
@@ -1072,7 +1115,19 @@ int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
         }
     }
 
-    if (ret == 0) {
+#ifdef WOLF_CRYPTO_CB
+    /* Offload to a registered crypto callback when a device is set; fall
+     * through to the software path when the callback is unavailable. */
+    if ((ret == 0) && (key->devId != INVALID_DEVID)) {
+        ret = wc_CryptoCb_PqcDecapsulate(ct, len, ss, (word32)p->lenSec,
+            WC_PQC_KEM_TYPE_FRODOKEM, key);
+        cbHandled = (ret != WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE));
+        if (!cbHandled) {
+            ret = 0;
+        }
+    }
+#endif
+    if ((ret == 0) && !cbHandled) {
         n = p->n;
         heap = key->heap;
         c1 = ct;
@@ -1107,7 +1162,7 @@ int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
         }
     }
 
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         /* B' = Unpack(c1, nbar, n) and C = Unpack(c2, nbar, nbar). */
         frodokem_unpack(bpIn, c1, FRODOKEM_NBAR * n, p->d);
         frodokem_unpack(cIn, c2, nn, p->d);
@@ -1127,18 +1182,18 @@ int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
         ret = frodokem_gen_seedse_k(p, &key->shake, key->pkh, uSalt,
             seedSEk + 1);
     }
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         /* Generate and sample S' | E' | E'' from SHAKE(domain || seedSE'). The
          * three are contiguous from sp, so they form a single noise region. The
          * row scratch is free here, so use it as the SHAKE block scratch. */
         ret = frodokem_gen_noise(p, &key->shake, seedSEk, (byte*)row,
             sp, 2 * FRODOKEM_NBAR * n + FRODOKEM_NBAR_SQ, NULL, 0);
     }
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         /* B'' = S' * A + E', accumulated in place over E' in work. */
         ret = frodokem_mul_add_sa_plus_e(key, work, sp, row);
     }
-    if (ret == 0) {
+    if ((ret == 0) && !cbHandled) {
         /* Compare B' (bpIn) against B'' (work) before reusing work. */
         for (i = 0; i < FRODOKEM_NBAR * n; i++) {
             diff |= (word16)(bpIn[i] ^ work[i]);
@@ -1162,7 +1217,7 @@ int wc_FrodoKemKey_Decapsulate(FrodoKemKey* key, unsigned char* ss,
         /* kHat = k' if ciphertext valid, else s (implicit rejection). Selected
          * in place over k' (kPrime) in seedSEk. */
         for (i = 0; i < p->lenSec; i++) {
-            kPrime[i] = (byte)((kPrime[i] & mask) | (key->s[i] & (byte)~mask));
+            kPrime[i] = ctMaskSel(mask, kPrime[i], key->s[i]);
         }
 
         /* ss = SHAKE(c1 || c2 || salt || kHat, lensec). c1 || c2 || salt is
@@ -1436,4 +1491,316 @@ int wc_FrodoKemKey_DecodePrivateKey(FrodoKemKey* key, const unsigned char* in,
     return ret;
 }
 
+/******************************************************************************/
+/* ASN.1 (SubjectPublicKeyInfo / PKCS#8) key encoding and decoding.           */
+/******************************************************************************/
+
+#ifndef WOLFSSL_FRODOKEM_NO_ASN1
+#if defined(WC_ENABLE_ASYM_KEY_EXPORT) || defined(WC_ENABLE_ASYM_KEY_IMPORT)
+
+/* Map a FrodoKEM key type to its ISO/IEC 18033-2 key-OID sum. Only the 976 and
+ * 1344 parameter sets have standardised OIDs, so a 640 (or unknown) type has no
+ * ASN.1 encoding.
+ *
+ * @param  [in]   type    FrodoKEM key type (base | modifier bits).
+ * @param  [out]  oidSum  OID sum (FRODOKEM_*k / EFRODOKEM_*k).
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when the type has no standardised OID.
+ */
+static int frodokem_type_to_oid_sum(int type, int* oidSum)
+{
+    int ret = 0;
+
+    switch (type & (FRODOKEM_BASE_MASK | FRODOKEM_AES | FRODOKEM_EPHEMERAL)) {
+        case WC_FRODOKEM_976:
+            *oidSum = FRODOKEM_976_SHAKEk;
+            break;
+        case WC_FRODOKEM_976 | FRODOKEM_EPHEMERAL:
+            *oidSum = EFRODOKEM_976_SHAKEk;
+            break;
+        case WC_FRODOKEM_976 | FRODOKEM_AES:
+            *oidSum = FRODOKEM_976_AESk;
+            break;
+        case WC_FRODOKEM_976 | FRODOKEM_AES | FRODOKEM_EPHEMERAL:
+            *oidSum = EFRODOKEM_976_AESk;
+            break;
+        case WC_FRODOKEM_1344:
+            *oidSum = FRODOKEM_1344_SHAKEk;
+            break;
+        case WC_FRODOKEM_1344 | FRODOKEM_EPHEMERAL:
+            *oidSum = EFRODOKEM_1344_SHAKEk;
+            break;
+        case WC_FRODOKEM_1344 | FRODOKEM_AES:
+            *oidSum = FRODOKEM_1344_AESk;
+            break;
+        case WC_FRODOKEM_1344 | FRODOKEM_AES | FRODOKEM_EPHEMERAL:
+            *oidSum = EFRODOKEM_1344_AESk;
+            break;
+        default:
+            /* 640 (and any unknown type) has no standardised OID. */
+            ret = BAD_FUNC_ARG;
+            break;
+    }
+
+    return ret;
+}
+
+#ifdef WC_ENABLE_ASYM_KEY_IMPORT
+/* Map a decoded key-OID sum to a FrodoKEM key type.
+ *
+ * @param  [in]   oidSum  OID sum from the decoded AlgorithmIdentifier.
+ * @param  [out]  type    FrodoKEM key type.
+ * @return  0 on success.
+ * @return  ASN_PARSE_E when the OID is not a FrodoKEM key OID.
+ */
+static int frodokem_oid_sum_to_type(int oidSum, int* type)
+{
+    int ret = 0;
+
+    switch (oidSum) {
+        case FRODOKEM_976_SHAKEk:
+            *type = WC_FRODOKEM_976;
+            break;
+        case EFRODOKEM_976_SHAKEk:
+            *type = WC_FRODOKEM_976 | FRODOKEM_EPHEMERAL;
+            break;
+        case FRODOKEM_976_AESk:
+            *type = WC_FRODOKEM_976 | FRODOKEM_AES;
+            break;
+        case EFRODOKEM_976_AESk:
+            *type = WC_FRODOKEM_976 | FRODOKEM_AES | FRODOKEM_EPHEMERAL;
+            break;
+        case FRODOKEM_1344_SHAKEk:
+            *type = WC_FRODOKEM_1344;
+            break;
+        case EFRODOKEM_1344_SHAKEk:
+            *type = WC_FRODOKEM_1344 | FRODOKEM_EPHEMERAL;
+            break;
+        case FRODOKEM_1344_AESk:
+            *type = WC_FRODOKEM_1344 | FRODOKEM_AES;
+            break;
+        case EFRODOKEM_1344_AESk:
+            *type = WC_FRODOKEM_1344 | FRODOKEM_AES | FRODOKEM_EPHEMERAL;
+            break;
+        default:
+            ret = ASN_PARSE_E;
+            break;
+    }
+
+    return ret;
+}
+#endif /* WC_ENABLE_ASYM_KEY_IMPORT */
+
+#endif /* WC_ENABLE_ASYM_KEY_EXPORT || WC_ENABLE_ASYM_KEY_IMPORT */
+
+#ifdef WC_ENABLE_ASYM_KEY_EXPORT
+/* Encode the FrodoKEM public key as a DER SubjectPublicKeyInfo.
+ *
+ * @param  [in]   key      FrodoKEM key object with public key set.
+ * @param  [out]  output   Buffer for the DER, or NULL to get the length.
+ * @param  [in]   len      Size of output buffer in bytes.
+ * @param  [in]   withAlg  Include the SubjectPublicKeyInfo wrapper (1) or emit
+ *                         only the raw public key bytes (0).
+ * @return  Length of the encoding in bytes on success.
+ * @return  BAD_FUNC_ARG when key is NULL or the type has no OID.
+ * @return  MEMORY_E when dynamic memory allocation fails.
+ */
+int wc_FrodoKemKey_PublicKeyToDer(FrodoKemKey* key, byte* output, word32 len,
+    int withAlg)
+{
+    int ret = 0;
+    int oidSum = 0;
+    word32 pkSize = 0;
+    byte* rawPk = NULL;
+
+    if (key == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    if (ret == 0) {
+        ret = frodokem_type_to_oid_sum(key->type, &oidSum);
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_PublicKeySize(key, &pkSize);
+    }
+    if (ret == 0) {
+        rawPk = (byte*)XMALLOC((size_t)pkSize, key->heap,
+            DYNAMIC_TYPE_TMP_BUFFER);
+        if (rawPk == NULL) {
+            ret = MEMORY_E;
+        }
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_EncodePublicKey(key, rawPk, pkSize);
+    }
+    if (ret == 0) {
+        ret = SetAsymKeyDerPublic(rawPk, pkSize, output, len, oidSum, withAlg);
+    }
+
+    if (rawPk != NULL) {
+        XFREE(rawPk, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+
+    return ret;
+}
+
+/* Encode the FrodoKEM private key as a DER PKCS#8 OneAsymmetricKey.
+ *
+ * FrodoKEM's private key already embeds the public key, so no separate public
+ * key is appended (PKCS#8 version 1).
+ *
+ * @param  [in]   key     FrodoKEM key object with private key set.
+ * @param  [out]  output  Buffer for the DER, or NULL to get the length.
+ * @param  [in]   len     Size of output buffer in bytes.
+ * @return  Length of the encoding in bytes on success.
+ * @return  BAD_FUNC_ARG when key is NULL or the type has no OID.
+ * @return  MEMORY_E when dynamic memory allocation fails.
+ */
+int wc_FrodoKemKey_PrivateKeyToDer(FrodoKemKey* key, byte* output, word32 len)
+{
+    int ret = 0;
+    int oidSum = 0;
+    word32 skSize = 0;
+    byte* rawSk = NULL;
+
+    if (key == NULL) {
+        ret = BAD_FUNC_ARG;
+    }
+    if (ret == 0) {
+        ret = frodokem_type_to_oid_sum(key->type, &oidSum);
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_PrivateKeySize(key, &skSize);
+    }
+    if (ret == 0) {
+        rawSk = (byte*)XMALLOC((size_t)skSize, key->heap,
+            DYNAMIC_TYPE_TMP_BUFFER);
+        if (rawSk == NULL) {
+            ret = MEMORY_E;
+        }
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_EncodePrivateKey(key, rawSk, skSize);
+    }
+    if (ret == 0) {
+        ret = SetAsymKeyDer(rawSk, skSize, NULL, 0, output, len, oidSum);
+    }
+
+    if (rawSk != NULL) {
+        /* rawSk held the private key (secret s and S^T). */
+        ForceZero(rawSk, skSize);
+        XFREE(rawSk, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+
+    return ret;
+}
+#endif /* WC_ENABLE_ASYM_KEY_EXPORT */
+
+#ifdef WC_ENABLE_ASYM_KEY_IMPORT
+/* Decode a DER SubjectPublicKeyInfo into a FrodoKEM public key.
+ *
+ * When the key object already has a type set, the DER OID must match it;
+ * otherwise the type is taken from the OID and the object is initialized. For
+ * that auto-detect case the caller must zero the object first, and the new key
+ * inherits its key->heap and key->devId (so a zeroed object yields devId 0 -
+ * set key->devId to INVALID_DEVID first if software is required).
+ *
+ * @param  [in, out]  key       FrodoKEM key object.
+ * @param  [in]       input     DER buffer.
+ * @param  [in]       inSz      Size of DER buffer in bytes.
+ * @param  [in, out]  inOutIdx  On in, index into buffer; on out, index after.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when a pointer is NULL.
+ * @return  ASN_PARSE_E when the DER or OID is invalid.
+ */
+int wc_FrodoKemKey_PublicKeyDecode(FrodoKemKey* key, const byte* input,
+    word32 inSz, word32* inOutIdx)
+{
+    int ret = 0;
+    int keyType = ANONk;
+    const byte* pubKey = NULL;
+    word32 pubKeyLen = 0;
+
+    if ((key == NULL) || (input == NULL) || (inOutIdx == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    /* If already initialized, require the DER OID to match the key type. */
+    if ((ret == 0) && (key->params != NULL)) {
+        ret = frodokem_type_to_oid_sum(key->type, &keyType);
+    }
+    if (ret == 0) {
+        ret = DecodeAsymKeyPublic_Assign(input, inOutIdx, inSz, &pubKey,
+            &pubKeyLen, &keyType);
+    }
+    /* Not initialized: set up the object from the decoded OID. */
+    if ((ret == 0) && (key->params == NULL)) {
+        void* heap = key->heap;
+        int devId = key->devId;
+        int type = 0;
+        ret = frodokem_oid_sum_to_type(keyType, &type);
+        if (ret == 0) {
+            ret = wc_FrodoKemKey_Init(key, type, heap, devId);
+        }
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_DecodePublicKey(key, pubKey, pubKeyLen);
+    }
+
+    return ret;
+}
+
+/* Decode a DER PKCS#8 OneAsymmetricKey into a FrodoKEM private key.
+ *
+ * Type auto-detection and the key->heap / key->devId inheritance behave as
+ * described for wc_FrodoKemKey_PublicKeyDecode.
+ *
+ * @param  [in, out]  key       FrodoKEM key object.
+ * @param  [in]       input     DER buffer.
+ * @param  [in]       inSz      Size of DER buffer in bytes.
+ * @param  [in, out]  inOutIdx  On in, index into buffer; on out, index after.
+ * @return  0 on success.
+ * @return  BAD_FUNC_ARG when a pointer is NULL.
+ * @return  ASN_PARSE_E when the DER or OID is invalid.
+ */
+int wc_FrodoKemKey_PrivateKeyDecode(FrodoKemKey* key, const byte* input,
+    word32 inSz, word32* inOutIdx)
+{
+    int ret = 0;
+    int keyType = ANONk;
+    const byte* privKey = NULL;
+    word32 privKeyLen = 0;
+    const byte* pubKey = NULL;
+    word32 pubKeyLen = 0;
+
+    if ((key == NULL) || (input == NULL) || (inOutIdx == NULL)) {
+        ret = BAD_FUNC_ARG;
+    }
+    if ((ret == 0) && (key->params != NULL)) {
+        ret = frodokem_type_to_oid_sum(key->type, &keyType);
+    }
+    if (ret == 0) {
+        /* A KEM has no seed in the blob and, as FrodoKEM's private key already
+         * embeds the public key, no trailing public key either (so pubKeyLen
+         * comes back 0). The pubKey out-params must still be non-NULL. */
+        ret = DecodeAsymKey_Assign(input, inOutIdx, inSz, NULL, NULL, &privKey,
+            &privKeyLen, &pubKey, &pubKeyLen, &keyType);
+    }
+    if ((ret == 0) && (key->params == NULL)) {
+        void* heap = key->heap;
+        int devId = key->devId;
+        int type = 0;
+        ret = frodokem_oid_sum_to_type(keyType, &type);
+        if (ret == 0) {
+            ret = wc_FrodoKemKey_Init(key, type, heap, devId);
+        }
+    }
+    if (ret == 0) {
+        ret = wc_FrodoKemKey_DecodePrivateKey(key, privKey, privKeyLen);
+    }
+
+    return ret;
+}
+#endif /* WC_ENABLE_ASYM_KEY_IMPORT */
+
+#endif /* !WOLFSSL_FRODOKEM_NO_ASN1 */
+
 #endif /* WOLFSSL_HAVE_FRODOKEM */
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index eb0c48bd390..b35f33c92a8 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -1480,6 +1480,9 @@ static WC_MAYBE_UNUSED Aes* test_AesGcmNew(void* heap, int declaredDevId,
 #ifdef WOLFSSL_STATIC_MEMORY
     #if defined(WOLFSSL_STATIC_MEMORY_TEST_SZ)
         static byte gTestMemory[WOLFSSL_STATIC_MEMORY_TEST_SZ];
+    #elif defined(WOLFSSL_HAVE_FRODOKEM)
+        /* FrodoKEM keys (~44 KB) and decaps matrices (~86 KB) are large. */
+        static byte gTestMemory[1024*1024];
     #elif defined(WOLFSSL_HAVE_MLDSA)
         #if defined(WOLFSSL_MLDSA_VERIFY_SMALL_MEM) && \
             defined(WOLFSSL_MLDSA_SIGN_SMALL_MEM) && \
@@ -53586,6 +53589,11 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t frodokem_test(void)
 #if !defined(WC_NO_RNG) && !defined(WOLFSSL_FRODOKEM_NO_MAKE_KEY) && \
     !defined(WOLFSSL_FRODOKEM_NO_ENCAPSULATE) && \
     !defined(WOLFSSL_FRODOKEM_NO_DECAPSULATE)
+    /* ASN.1 key encode/decode is exercised when it has not been disabled. */
+#if !defined(WOLFSSL_FRODOKEM_NO_ASN1) && \
+    defined(WC_ENABLE_ASYM_KEY_EXPORT) && defined(WC_ENABLE_ASYM_KEY_IMPORT)
+    #define FRODOKEM_TEST_ASN1
+#endif
     static const int types[] = {
     #ifdef WOLFSSL_FRODOKEM_SHAKE
         #ifdef WOLFSSL_WC_FRODOKEM_640
@@ -53649,6 +53657,10 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t frodokem_test(void)
     word32 skLen = 0;
     word32 ctLen = 0;
     word32 ssLen = 0;
+#ifdef FRODOKEM_TEST_ASN1
+    FrodoKemKey* key2 = NULL;
+    byte* der = NULL;
+#endif
 
     key = (FrodoKemKey*)XMALLOC(sizeof(*key), HEAP_HINT,
         DYNAMIC_TYPE_TMP_BUFFER);
@@ -53662,6 +53674,20 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t frodokem_test(void)
         ret = WC_TEST_RET_ENC_NC;
         goto out;
     }
+#ifdef FRODOKEM_TEST_ASN1
+    key2 = (FrodoKemKey*)XMALLOC(sizeof(*key2), HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    /* Zeroize now so key2 is Free-safe on every error path. */
+    if (key2 != NULL) {
+        XMEMSET(key2, 0, sizeof(*key2));
+    }
+    der = (byte*)XMALLOC(FRODOKEM_MAX_PRV_KEY_DER_SIZE, HEAP_HINT,
+        DYNAMIC_TYPE_TMP_BUFFER);
+    if ((key2 == NULL) || (der == NULL)) {
+        ret = WC_TEST_RET_ENC_NC;
+        goto out;
+    }
+#endif
 
     ret = wc_InitRng_ex(&rng, HEAP_HINT, devId);
     if (ret != 0) {
@@ -53705,9 +53731,71 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t frodokem_test(void)
             ret = WC_TEST_RET_ENC_NC; break;
         }
 
-        wc_FrodoKemKey_Free(key);
+#ifdef FRODOKEM_TEST_ASN1
+        /* ASN.1 round trip. The 640 parameter sets have no standardised OID,
+         * so their encoding is expected to be rejected. */
+        if ((types[i] & FRODOKEM_BASE_MASK) != WC_FRODOKEM_640) {
+            word32 idx = 0;
+            int derLen;
+
+            /* Public key: SubjectPublicKeyInfo. Encapsulate to the decoded
+             * public key; the original private key must decapsulate it. */
+            derLen = wc_FrodoKemKey_PublicKeyToDer(key, der,
+                FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1);
+            if (derLen < 0) { ret = WC_TEST_RET_ENC_EC(derLen); break; }
+            ret = wc_FrodoKemKey_Init(key2, types[i], HEAP_HINT, devId);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            ret = wc_FrodoKemKey_PublicKeyDecode(key2, der, (word32)derLen,
+                &idx);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            ret = wc_FrodoKemKey_Encapsulate(key2, ct, ss, &rng);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            ret = wc_FrodoKemKey_Decapsulate(key, ss2, ct, ctLen);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            if (XMEMCMP(ss, ss2, ssLen) != 0) {
+                ret = WC_TEST_RET_ENC_NC; break;
+            }
+            wc_FrodoKemKey_Free(key2);
+
+            /* Private key: PKCS#8. The decoded private key must decapsulate a
+             * ciphertext produced for the original public key. */
+            idx = 0;
+            derLen = wc_FrodoKemKey_PrivateKeyToDer(key, der,
+                FRODOKEM_MAX_PRV_KEY_DER_SIZE);
+            if (derLen < 0) { ret = WC_TEST_RET_ENC_EC(derLen); break; }
+            ret = wc_FrodoKemKey_Init(key2, types[i], HEAP_HINT, devId);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            ret = wc_FrodoKemKey_PrivateKeyDecode(key2, der, (word32)derLen,
+                &idx);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            ret = wc_FrodoKemKey_Encapsulate(key, ct, ss, &rng);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            ret = wc_FrodoKemKey_Decapsulate(key2, ss2, ct, ctLen);
+            if (ret != 0) { ret = WC_TEST_RET_ENC_EC(ret); break; }
+            if (XMEMCMP(ss, ss2, ssLen) != 0) {
+                ret = WC_TEST_RET_ENC_NC; break;
+            }
+            wc_FrodoKemKey_Free(key2);
+        }
+        else {
+            /* 640 has no standardised OID: encoding must be rejected. */
+            if (wc_FrodoKemKey_PublicKeyToDer(key, der,
+                    FRODOKEM_MAX_PUB_KEY_DER_SIZE, 1) !=
+                    WC_NO_ERR_TRACE(BAD_FUNC_ARG)) {
+                ret = WC_TEST_RET_ENC_NC; break;
+            }
+            if (wc_FrodoKemKey_PrivateKeyToDer(key, der,
+                    FRODOKEM_MAX_PRV_KEY_DER_SIZE) !=
+                    WC_NO_ERR_TRACE(BAD_FUNC_ARG)) {
+                ret = WC_TEST_RET_ENC_NC; break;
+            }
+        }
+#endif /* FRODOKEM_TEST_ASN1 */
     }
 
+    /* key is freed once at out:, which covers both the normal loop-exit and
+     * the error-break paths. wc_FrodoKemKey_Init zeroizes the object on
+     * re-entry, so no per-iteration free is needed. */
 out:
     if (key != NULL)
         wc_FrodoKemKey_Free(key);
@@ -53717,6 +53805,13 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t frodokem_test(void)
     XFREE(pk, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     XFREE(ct, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
     XFREE(key, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+#ifdef FRODOKEM_TEST_ASN1
+    if (key2 != NULL)
+        wc_FrodoKemKey_Free(key2);
+    XFREE(der, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(key2, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    #undef FRODOKEM_TEST_ASN1
+#endif
 #endif /* !WC_NO_RNG */
     return ret;
 }
@@ -76622,6 +76717,42 @@ static int myCryptoDevCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
             }
         }
     #endif /* WOLFSSL_HAVE_MLKEM */
+    #ifdef WOLFSSL_HAVE_FRODOKEM
+        if (info->pk.type == WC_PK_TYPE_PQC_KEM_KEYGEN) {
+            if ((info->pk.pqc_kem_kg.type == WC_PQC_KEM_TYPE_FRODOKEM) &&
+                (info->pk.pqc_kem_kg.key != NULL)) {
+                FrodoKemKey* key = (FrodoKemKey*)info->pk.pqc_kem_kg.key;
+                /* set devId to invalid, so software is used */
+                key->devId = INVALID_DEVID;
+                ret = wc_FrodoKemKey_MakeKey(key, info->pk.pqc_kem_kg.rng);
+                key->devId = devIdArg;
+            }
+        }
+        else if (info->pk.type == WC_PK_TYPE_PQC_KEM_ENCAPS) {
+            if ((info->pk.pqc_encaps.type == WC_PQC_KEM_TYPE_FRODOKEM) &&
+                (info->pk.pqc_encaps.key != NULL)) {
+                FrodoKemKey* key = (FrodoKemKey*)info->pk.pqc_encaps.key;
+                key->devId = INVALID_DEVID;
+                ret = wc_FrodoKemKey_Encapsulate(key,
+                    info->pk.pqc_encaps.ciphertext,
+                    info->pk.pqc_encaps.sharedSecret,
+                    info->pk.pqc_encaps.rng);
+                key->devId = devIdArg;
+            }
+        }
+        else if (info->pk.type == WC_PK_TYPE_PQC_KEM_DECAPS) {
+            if ((info->pk.pqc_decaps.type == WC_PQC_KEM_TYPE_FRODOKEM) &&
+                (info->pk.pqc_decaps.key != NULL)) {
+                FrodoKemKey* key = (FrodoKemKey*)info->pk.pqc_decaps.key;
+                key->devId = INVALID_DEVID;
+                ret = wc_FrodoKemKey_Decapsulate(key,
+                    info->pk.pqc_decaps.sharedSecret,
+                    info->pk.pqc_decaps.ciphertext,
+                    info->pk.pqc_decaps.ciphertextLen);
+                key->devId = devIdArg;
+            }
+        }
+    #endif /* WOLFSSL_HAVE_FRODOKEM */
     }
     else if (info->algo_type == WC_ALGO_TYPE_CIPHER) {
 #if !defined(NO_AES) || !defined(NO_DES3)
diff --git a/wolfssl/wolfcrypt/asn.h b/wolfssl/wolfcrypt/asn.h
index 009c258742e..bd380e69ba4 100644
--- a/wolfssl/wolfcrypt/asn.h
+++ b/wolfssl/wolfcrypt/asn.h
@@ -2883,7 +2883,8 @@ enum cert_enums {
     SLH_DSA_SHAKE_256F_KEY   = 35,
     LMS_KEY                  = 36,
     XMSS_KEY                 = 37,
-    XMSSMT_KEY               = 38
+    XMSSMT_KEY               = 38,
+    FRODOKEM_KEY             = 39
 };
 
 #ifndef WOLFSSL_NO_DILITHIUM_LEGACY_NAMES
@@ -3347,7 +3348,8 @@ WOLFSSL_LOCAL int  wolfssl_local_MatchDnsNameConstraint(const char* name,
     || (defined(HAVE_CURVE25519) && defined(HAVE_CURVE25519_KEY_IMPORT)) \
     || (defined(HAVE_ED448) && defined(HAVE_ED448_KEY_IMPORT)) \
     || (defined(HAVE_CURVE448) && defined(HAVE_CURVE448_KEY_IMPORT)) \
-    || defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_SLHDSA))
+    || defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) \
+    || defined(WOLFSSL_HAVE_SLHDSA) || defined(WOLFSSL_HAVE_FRODOKEM))
 WOLFSSL_LOCAL int DecodeAsymKey_Assign(const byte* input, word32* inOutIdx,
     word32 inSz, const byte** seed, word32* seedLen, const byte** privKey,
     word32* privKeyLen, const byte** pubKey, word32* pubKeyLen,
diff --git a/wolfssl/wolfcrypt/asn_public.h b/wolfssl/wolfcrypt/asn_public.h
index d557ac94cd0..51f073947f5 100644
--- a/wolfssl/wolfcrypt/asn_public.h
+++ b/wolfssl/wolfcrypt/asn_public.h
@@ -183,7 +183,8 @@ enum CertType {
     TRUSTED_CERT_TYPE,
     LMS_TYPE,
     XMSS_TYPE,
-    XMSSMT_TYPE
+    XMSSMT_TYPE,
+    FRODOKEM_TYPE
 };
 
 #ifndef WOLFSSL_NO_DILITHIUM_LEGACY_NAMES
diff --git a/wolfssl/wolfcrypt/cryptocb.h b/wolfssl/wolfcrypt/cryptocb.h
index 3de89680e61..b1dc22c8454 100644
--- a/wolfssl/wolfcrypt/cryptocb.h
+++ b/wolfssl/wolfcrypt/cryptocb.h
@@ -80,6 +80,9 @@
 #ifdef WOLFSSL_HAVE_MLKEM
     #include <wolfssl/wolfcrypt/wc_mlkem.h>
 #endif
+#ifdef WOLFSSL_HAVE_FRODOKEM
+    #include <wolfssl/wolfcrypt/wc_frodokem.h>
+#endif
 #if defined(WOLFSSL_HAVE_MLDSA)
     #include <wolfssl/wolfcrypt/wc_mldsa.h>
 #endif
@@ -309,7 +312,7 @@ typedef struct wc_CryptoInfo {
                 byte         contextLen;
             } ed25519verify;
         #endif
-        #if defined(WOLFSSL_HAVE_MLKEM)
+        #if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM)
             struct {
                 WC_RNG*     rng;
                 int         size;
@@ -830,7 +833,7 @@ WOLFSSL_LOCAL int wc_CryptoCb_PqcStatefulSigSigsLeft(int type, void* key,
     word32* sigsLeft);
 #endif /* WOLFSSL_HAVE_LMS || WOLFSSL_HAVE_XMSS */
 
-#if defined(WOLFSSL_HAVE_MLKEM)
+#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM)
 WOLFSSL_LOCAL int wc_CryptoCb_PqcKemGetDevId(int type, void* key);
 
 WOLFSSL_LOCAL int wc_CryptoCb_MakePqcKemKey(WC_RNG* rng, int type,
@@ -843,7 +846,7 @@ WOLFSSL_LOCAL int wc_CryptoCb_PqcEncapsulate(byte* ciphertext,
 WOLFSSL_LOCAL int wc_CryptoCb_PqcDecapsulate(const byte* ciphertext,
     word32 ciphertextLen, byte* sharedSecret, word32 sharedSecretLen,
     int type, void* key);
-#endif /* WOLFSSL_HAVE_MLKEM */
+#endif /* WOLFSSL_HAVE_MLKEM || WOLFSSL_HAVE_FRODOKEM */
 
 #if defined(HAVE_FALCON) || defined(WOLFSSL_HAVE_MLDSA) || \
     defined(WOLFSSL_HAVE_SLHDSA)
diff --git a/wolfssl/wolfcrypt/memory.h b/wolfssl/wolfcrypt/memory.h
index 155b8aa4ea9..257745385b3 100644
--- a/wolfssl/wolfcrypt/memory.h
+++ b/wolfssl/wolfcrypt/memory.h
@@ -133,7 +133,7 @@ WOLFSSL_API int wolfSSL_GetAllocators(wolfSSL_Malloc_cb* mf,
 
     #ifndef LARGEST_MEM_BUCKET
         #ifndef SESSION_CERTS
-            #ifdef WOLFSSL_HAVE_MLDSA
+            #if defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_FRODOKEM)
                 #define LARGEST_MEM_BUCKET 131072
             #else
                 #define LARGEST_MEM_BUCKET 16128
@@ -155,7 +155,7 @@ WOLFSSL_API int wolfSSL_GetAllocators(wolfSSL_Malloc_cb* mf,
 
     #ifndef WOLFMEM_BUCKETS
         #ifndef SESSION_CERTS
-            #ifdef WOLFSSL_HAVE_MLDSA
+            #if defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_FRODOKEM)
                 /* default size of chunks of memory to separate into */
                 #define WOLFMEM_BUCKETS 64,128,256,512,1024,8192,32768,\
                                         65536,LARGEST_MEM_BUCKET
@@ -188,7 +188,7 @@ WOLFSSL_API int wolfSSL_GetAllocators(wolfSSL_Malloc_cb* mf,
     #endif
 
     #ifndef WOLFMEM_DIST
-        #ifdef WOLFSSL_HAVE_MLDSA
+        #if defined(WOLFSSL_HAVE_MLDSA) || defined(WOLFSSL_HAVE_FRODOKEM)
             #define WOLFMEM_DIST    30,10,8,15,8,10,8,5,1
         #elif defined(WOLFSSL_HAVE_MLKEM)
             #define WOLFMEM_DIST    49,10,6,14,5,6,14,1,1
diff --git a/wolfssl/wolfcrypt/oid_sum.h b/wolfssl/wolfcrypt/oid_sum.h
index c24dd97d17b..1a650deed3c 100644
--- a/wolfssl/wolfcrypt/oid_sum.h
+++ b/wolfssl/wolfcrypt/oid_sum.h
@@ -225,7 +225,23 @@ enum Key_Sum {
     /* 0x2b,0x06,0x01,0x05,0x05,0x07,0x06,0x22  */
     XMSSk                       = 107,           /* 1.3.6.1.5.5.7.6.34 */
     /* 0x2b,0x06,0x01,0x05,0x05,0x07,0x06,0x23  */
-    XMSSMTk                     = 108            /* 1.3.6.1.5.5.7.6.35 */
+    XMSSMTk                     = 108,           /* 1.3.6.1.5.5.7.6.35 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x01  */
+    FRODOKEM_976_SHAKEk         = 100434,        /* 1.0.18033.2.2.7.1 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x02  */
+    FRODOKEM_1344_SHAKEk        = 100435,        /* 1.0.18033.2.2.7.2 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x03  */
+    EFRODOKEM_976_SHAKEk        = 100436,        /* 1.0.18033.2.2.7.3 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x04  */
+    EFRODOKEM_1344_SHAKEk       = 100437,        /* 1.0.18033.2.2.7.4 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x05  */
+    FRODOKEM_976_AESk           = 100438,        /* 1.0.18033.2.2.7.5 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x06  */
+    FRODOKEM_1344_AESk          = 100439,        /* 1.0.18033.2.2.7.6 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x07  */
+    EFRODOKEM_976_AESk          = 100440,        /* 1.0.18033.2.2.7.7 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x08  */
+    EFRODOKEM_1344_AESk         = 100441         /* 1.0.18033.2.2.7.8 */
 #else
     /* 0x00  */
     ANONk                       = 0x7fffffff,    /* 0.0 */
@@ -296,7 +312,23 @@ enum Key_Sum {
     /* 0x2b,0x06,0x01,0x05,0x05,0x07,0x06,0x22  */
     XMSSk                       = 0x2707012e,    /* 1.3.6.1.5.5.7.6.34 */
     /* 0x2b,0x06,0x01,0x05,0x05,0x07,0x06,0x23  */
-    XMSSMTk                     = 0x2607012e     /* 1.3.6.1.5.5.7.6.35 */
+    XMSSMTk                     = 0x2607012e,    /* 1.3.6.1.5.5.7.6.35 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x01  */
+    FRODOKEM_976_SHAKEk         = 0x708b832a,    /* 1.0.18033.2.2.7.1 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x02  */
+    FRODOKEM_1344_SHAKEk        = 0x738b832a,    /* 1.0.18033.2.2.7.2 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x03  */
+    EFRODOKEM_976_SHAKEk        = 0x728b832a,    /* 1.0.18033.2.2.7.3 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x04  */
+    EFRODOKEM_1344_SHAKEk       = 0x758b832a,    /* 1.0.18033.2.2.7.4 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x05  */
+    FRODOKEM_976_AESk           = 0x748b832a,    /* 1.0.18033.2.2.7.5 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x06  */
+    FRODOKEM_1344_AESk          = 0x778b832a,    /* 1.0.18033.2.2.7.6 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x07  */
+    EFRODOKEM_976_AESk          = 0x768b832a,    /* 1.0.18033.2.2.7.7 */
+    /* 0x28,0x81,0x8c,0x71,0x02,0x02,0x07,0x08  */
+    EFRODOKEM_1344_AESk         = 0x798b832a     /* 1.0.18033.2.2.7.8 */
 #endif
 };
 
diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index a24bdf00853..53f5869dcb6 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -3702,6 +3702,7 @@
      (defined(HAVE_ED448)      && defined(HAVE_ED448_KEY_EXPORT)) || \
      (defined(HAVE_CURVE448)   && defined(HAVE_CURVE448_KEY_EXPORT)) || \
       defined(HAVE_FALCON) || defined(HAVE_DILITHIUM) || \
+      defined(WOLFSSL_HAVE_FRODOKEM) || \
       defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_LIBOQS) || \
      (defined(WOLFSSL_HAVE_LMS)  && !defined(WOLFSSL_LMS_VERIFY_ONLY)) || \
      (defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)))
@@ -3714,6 +3715,7 @@
      (defined(HAVE_ED448)      && defined(HAVE_ED448_KEY_IMPORT)) || \
      (defined(HAVE_CURVE448)   && defined(HAVE_CURVE448_KEY_IMPORT)) || \
       defined(HAVE_FALCON) || defined(HAVE_DILITHIUM) || \
+      defined(WOLFSSL_HAVE_FRODOKEM) || \
       defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_LIBOQS) || \
      (defined(WOLFSSL_HAVE_LMS)  && !defined(WOLFSSL_LMS_VERIFY_ONLY)) || \
      (defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)))
diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index aad0ad68b4d..df6e5d8879f 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -1588,7 +1588,7 @@ enum wc_PkType {
     WC_PK_TYPE_CURVE25519_KEYGEN = 16,
     WC_PK_TYPE_RSA_GET_SIZE = 17,
     #define _WC_PK_TYPE_MAX WC_PK_TYPE_RSA_GET_SIZE
-#if defined(WOLFSSL_HAVE_MLKEM)
+#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM)
     WC_PK_TYPE_PQC_KEM_KEYGEN = 18,
     WC_PK_TYPE_PQC_KEM_ENCAPS = 19,
     WC_PK_TYPE_PQC_KEM_DECAPS = 20,
@@ -1626,7 +1626,7 @@ enum wc_PkType {
     WC_PK_TYPE_MAX = _WC_PK_TYPE_MAX
 };
 
-#if defined(WOLFSSL_HAVE_MLKEM)
+#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM)
     /* Post quantum KEM algorithms */
     enum wc_PqcKemType {
         WC_PQC_KEM_TYPE_NONE = 0,
@@ -1634,6 +1634,9 @@ enum wc_PkType {
         WC_PQC_KEM_TYPE_MLKEM = 1,
         #undef _WC_PQC_KEM_TYPE_MAX
         #define _WC_PQC_KEM_TYPE_MAX WC_PQC_KEM_TYPE_MLKEM
+        WC_PQC_KEM_TYPE_FRODOKEM = 2,
+        #undef _WC_PQC_KEM_TYPE_MAX
+        #define _WC_PQC_KEM_TYPE_MAX WC_PQC_KEM_TYPE_FRODOKEM
         WC_PQC_KEM_TYPE_MAX = _WC_PQC_KEM_TYPE_MAX
     };
 
diff --git a/wolfssl/wolfcrypt/wc_frodokem.h b/wolfssl/wolfcrypt/wc_frodokem.h
index 264eb5dd2be..f1ec2198777 100644
--- a/wolfssl/wolfcrypt/wc_frodokem.h
+++ b/wolfssl/wolfcrypt/wc_frodokem.h
@@ -190,6 +190,16 @@
 /* Number of coefficients in the secret matrix S^T (nbar * n). */
 #define FRODOKEM_MAX_S_CNT      (FRODOKEM_NBAR * FRODOKEM_MAX_N)
 
+/* DER (SubjectPublicKeyInfo / PKCS#8) encoding overhead over the raw key. */
+#define FRODOKEM_ASN1_PUB_OVERHEAD  32
+#define FRODOKEM_ASN1_PRV_OVERHEAD  40
+/* Maximum DER-encoded key sizes over the enabled parameter sets. Callers may
+ * also pass a NULL output to the *ToDer functions to get the exact length. */
+#define FRODOKEM_MAX_PUB_KEY_DER_SIZE \
+    (FRODOKEM_MAX_PUBLIC_KEY_SIZE + FRODOKEM_ASN1_PUB_OVERHEAD)
+#define FRODOKEM_MAX_PRV_KEY_DER_SIZE \
+    (FRODOKEM_MAX_PRIVATE_KEY_SIZE + FRODOKEM_ASN1_PRV_OVERHEAD)
+
 
 enum {
     /* Base parameter sets. On their own these select the standard (salted)
@@ -317,6 +327,20 @@ WOLFSSL_API int wc_FrodoKemKey_EncodePrivateKey(FrodoKemKey* key,
 WOLFSSL_API int wc_FrodoKemKey_EncodePublicKey(FrodoKemKey* key,
     unsigned char* out, word32 len);
 
+#ifndef WOLFSSL_FRODOKEM_NO_ASN1
+#ifdef WC_ENABLE_ASYM_KEY_EXPORT
+WOLFSSL_API int wc_FrodoKemKey_PublicKeyToDer(FrodoKemKey* key, byte* output,
+    word32 len, int withAlg);
+WOLFSSL_API int wc_FrodoKemKey_PrivateKeyToDer(FrodoKemKey* key, byte* output,
+    word32 len);
+#endif /* WC_ENABLE_ASYM_KEY_EXPORT */
+#ifdef WC_ENABLE_ASYM_KEY_IMPORT
+WOLFSSL_API int wc_FrodoKemKey_PublicKeyDecode(FrodoKemKey* key,
+    const byte* input, word32 inSz, word32* inOutIdx);
+WOLFSSL_API int wc_FrodoKemKey_PrivateKeyDecode(FrodoKemKey* key,
+    const byte* input, word32 inSz, word32* inOutIdx);
+#endif /* WC_ENABLE_ASYM_KEY_IMPORT */
+#endif /* !WOLFSSL_FRODOKEM_NO_ASN1 */
 
 
 #ifdef __cplusplus