Fastest recovery of hashes passwords

SAMInside
Download (v2.6.2.0), 931 Kb
Screenshot
Purchase
Windows 2000/XP/2003/Vista
users' logon password recovery
• Over 10 types of data import:
from SAM, *.LC, *.LCP, *.LCS,
*.HDT, PWDUMP and other files.
• 4 types of attack, including Rainbow-tables attack.
Updated: 11/26/2007

PasswordsPro
Download (v2.4.1.0), 882 Kb
Screenshot
Purchase
Recovery of hashes passwords
• Over 30 types of hashes: DES, MD4, MD5, MD5 (Unix), MySQL, MySQL5, SHA-1, etc.
• Support of external modules.
• 7 types of attack, including Rainbow-tables attack.
Updated: 01/01/2008

Dictionaries
Files: 68

Hash generator
Algorithms: 98

News subscription
Subscribers: 667

News on web
RSS news feeds: 21

Technical support (ICQ)
Technical support (E-mail)

Total hits: | 6142016
Total visitors: | 1876451
Unique visitors today: | 1161
Forum
Messages: 5633
Updated: 01/24/2008, 16:24
 Hash database
Hashes: 10037849
Passwords found: 18824
Bookmark this page
Set this site as your homepage
Russian version of page

Site news

11/23/2007
The PasswordsPro program is updated to the 2.4.1.0 version.
In the new version:
• Support of all [PHP]-suffixed types of hashes is implemented as external DLL-modules.
• External modules added for new types of hashes for popular message boards and other programs:
md5($salt.$pass)
md5($pass.$salt)
md5(md5($salt).$pass)
md5($salt.$pass.$salt)
md5($salt.md5($salt.$pass))
• New hashing modules by third-party developers are added to the program archive for following types of hashes: MS SQL, Oracle DES, RipeMD-128, SHA-512, etc.
• API for external modules work is updated (new flags added to improve work with external modules).
• Number of modules to simultaneously work with is increased to 64.
• Speed of work with md5(md5($pass).$salt) type of hashes is increased by 25...30%.
• FAQ section in the program description is extended.
Discuss on the forum (17).

11/17/2007
The SAMInside program is updated to the 2.6.2.0 version.
In the new version:
• Support of Windows registry SYSTEM files containing several different Syskey keys is added.
• "GetSyskey" utility is updated in the program archive so that now it creates *.KEY-files containing all available keys from SYSTEM file.
• New utility "PassToSyskey" is added to the program archive to generate Syskey key using input password.
• Bug fixed which could appear while copying non-English passwords to clipboard.
• Dictionary of frequently used passwords is added to the program archive.
• Inactive menu icons images are improved.
Discuss on the forum (2).

Copyright ©2003-2008, InsidePro. All rights reserved.
Thursday, 24th of January 2008, 16:55:23.


//*************************************************
// Код, выполняемый в среднем за 1 такт процессора
//*************************************************

eax * 2:
    add eax,eax

eax * 4:
    shl eax,02h

eax * 8:
    shl eax,03h

eax * 16:
    shl eax,04h

eax * 32:
    shl eax,05h

eax * 64:
    shl eax,06h

eax * 128:
    shl eax,07h

eax * 256:
    shl eax,08h

eax * 512:
    shl eax,09h

eax * 1024:
    shl eax,0ah

eax * 2048:
    shl eax,0bh

eax * 4096:
    shl eax,0ch

eax * 8192:
    shl eax,0dh

eax * 16384:
    shl eax,0eh

//**************************************************
// Код, выполняемый в среднем за 2 такта процессора
//**************************************************

eax * 3:
    lea eax,[eax+eax*2]

eax * 5:
    lea eax,[eax+eax*4]

eax * 7:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 9:
    lea eax,[eax+eax*8]

eax * 15:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 17:
    mov ebx,eax
    shl eax,04h
    add eax,ebx

eax * 31:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 33:
    mov ebx,eax
    shl eax,05h
    add eax,ebx

eax * 63:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 65:
    mov ebx,eax
    shl eax,06h
    add eax,ebx

eax * 127:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 129:
    mov ebx,eax
    shl eax,07h
    add eax,ebx

eax * 255:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 257:
    mov ebx,eax
    shl eax,08h
    add eax,ebx

eax * 511:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 513:
    mov ebx,eax
    shl eax,09h
    add eax,ebx

eax * 1023:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 1025:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 2047:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 2049:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 4095:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 4097:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx

eax * 8191:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 8193:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 16383:
    mov ebx,eax
    shl eax,0eh
    sub eax,ebx

//**************************************************
// Код, выполняемый в среднем за 3 такта процессора
//**************************************************

eax * 6:
    lea ebx,[eax+eax*4]
    add eax,ebx

eax * 10:
    lea ebx,[eax+eax*8]
    add eax,ebx

eax * 11:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx

eax * 12:
    shl eax,02h
    lea eax,[eax+eax*2]

eax * 13:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx

eax * 14:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 18:
    add eax,eax
    lea eax,[eax+eax*8]

eax * 19:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx

eax * 20:
    shl eax,02h
    lea eax,[eax+eax*4]

eax * 21:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx

eax * 23:
    lea ebx,[eax+eax*8]
    shl eax,05h
    sub eax,ebx

eax * 24:
    shl eax,03h
    lea eax,[eax+eax*2]

eax * 25:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add eax,ebx

eax * 27:
    lea ebx,[eax+eax*4]
    shl eax,05h
    sub eax,ebx

eax * 28:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl eax,02h

eax * 29:
    lea ebx,[eax+eax*2]
    shl eax,05h
    sub eax,ebx

eax * 30:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add eax,eax

eax * 34:
    mov ebx,eax
    shl eax,05h
    lea eax,[eax+ebx*2]

eax * 35:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx

eax * 36:
    shl eax,02h
    lea eax,[eax+eax*8]

eax * 37:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add eax,ebx

eax * 39:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 40:
    shl eax,03h
    lea eax,[eax+eax*4]

eax * 41:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add eax,ebx

eax * 47:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 48:
    shl eax,04h
    lea eax,[eax+eax*2]

eax * 49:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 55:
    lea ebx,[eax+eax*8]
    shl eax,06h
    sub eax,ebx

eax * 56:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl eax,03h

eax * 57:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 59:
    lea ebx,[eax+eax*4]
    shl eax,06h
    sub eax,ebx

eax * 60:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,02h

eax * 61:
    lea ebx,[eax+eax*2]
    shl eax,06h
    sub eax,ebx

eax * 62:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add eax,eax

eax * 66:
    mov ebx,eax
    shl eax,06h
    lea eax,[eax+ebx*2]

eax * 67:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add eax,ebx

eax * 68:
    mov ebx,eax
    shl eax,06h
    lea eax,[eax+ebx*4]

eax * 69:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add eax,ebx

eax * 71:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 72:
    shl eax,03h
    lea eax,[eax+eax*8]

eax * 73:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add eax,ebx

eax * 79:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 80:
    shl eax,04h
    lea eax,[eax+eax*4]

eax * 81:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 95:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 96:
    shl eax,05h
    lea eax,[eax+eax*2]

eax * 97:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 111:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 112:
    mov ebx,eax
    shl eax,07h
    shl ebx,04h
    sub eax,ebx

eax * 113:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 119:
    lea ebx,[eax+eax*8]
    shl eax,07h
    sub eax,ebx

eax * 120:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,03h

eax * 121:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 123:
    lea ebx,[eax+eax*4]
    shl eax,07h
    sub eax,ebx

eax * 124:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,02h

eax * 125:
    lea ebx,[eax+eax*2]
    shl eax,07h
    sub eax,ebx

eax * 126:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    add eax,eax

eax * 130:
    mov ebx,eax
    shl eax,07h
    lea eax,[eax+ebx*2]

eax * 131:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add eax,ebx

eax * 132:
    mov ebx,eax
    shl eax,07h
    lea eax,[eax+ebx*4]

eax * 133:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add eax,ebx

eax * 135:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 136:
    mov ebx,eax
    shl eax,07h
    lea eax,[eax+ebx*8]

eax * 137:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add eax,ebx

eax * 143:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 144:
    shl eax,04h
    lea eax,[eax+eax*8]

eax * 145:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 159:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 160:
    shl eax,05h
    lea eax,[eax+eax*4]

eax * 161:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 191:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 192:
    shl eax,06h
    lea eax,[eax+eax*2]

eax * 193:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 223:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 224:
    mov ebx,eax
    shl eax,08h
    shl ebx,05h
    sub eax,ebx

eax * 225:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 239:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 240:
    mov ebx,eax
    shl eax,08h
    shl ebx,04h
    sub eax,ebx

eax * 241:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 247:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx

eax * 248:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,03h

eax * 249:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 251:
    lea ebx,[eax+eax*4]
    shl eax,08h
    sub eax,ebx

eax * 252:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,02h

eax * 253:
    lea ebx,[eax+eax*2]
    shl eax,08h
    sub eax,ebx

eax * 254:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    add eax,eax

eax * 258:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+ebx*2]

eax * 259:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add eax,ebx

eax * 260:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+ebx*4]

eax * 261:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add eax,ebx

eax * 263:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 264:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+ebx*8]

eax * 265:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add eax,ebx

eax * 271:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 272:
    mov ebx,eax
    shl eax,04h
    shl ebx,08h
    add eax,ebx

eax * 273:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 287:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 288:
    shl eax,05h
    lea eax,[eax+eax*8]

eax * 289:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 319:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 320:
    shl eax,06h
    lea eax,[eax+eax*4]

eax * 321:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 383:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 384:
    shl eax,07h
    lea eax,[eax+eax*2]

eax * 385:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 447:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 448:
    mov ebx,eax
    shl eax,09h
    shl ebx,06h
    sub eax,ebx

eax * 449:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 479:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 480:
    mov ebx,eax
    shl eax,09h
    shl ebx,05h
    sub eax,ebx

eax * 481:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 495:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 496:
    mov ebx,eax
    shl eax,09h
    shl ebx,04h
    sub eax,ebx

eax * 497:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 503:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx

eax * 504:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,03h

eax * 505:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 507:
    lea ebx,[eax+eax*4]
    shl eax,09h
    sub eax,ebx

eax * 508:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,02h

eax * 509:
    lea ebx,[eax+eax*2]
    shl eax,09h
    sub eax,ebx

eax * 510:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    add eax,eax

eax * 514:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*2]

eax * 515:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx

eax * 516:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*4]

eax * 517:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add eax,ebx

eax * 519:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 520:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*8]

eax * 521:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx

eax * 527:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 528:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    add eax,ebx

eax * 529:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 543:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 544:
    mov ebx,eax
    shl eax,05h
    shl ebx,09h
    add eax,ebx

eax * 545:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 575:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 576:
    shl eax,06h
    lea eax,[eax+eax*8]

eax * 577:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 639:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 640:
    shl eax,07h
    lea eax,[eax+eax*4]

eax * 641:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 767:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 768:
    shl eax,08h
    lea eax,[eax+eax*2]

eax * 769:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 895:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 896:
    mov ebx,eax
    shl eax,0ah
    shl ebx,07h
    sub eax,ebx

eax * 897:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 959:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 960:
    mov ebx,eax
    shl eax,0ah
    shl ebx,06h
    sub eax,ebx

eax * 961:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 991:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 992:
    mov ebx,eax
    shl eax,0ah
    shl ebx,05h
    sub eax,ebx

eax * 993:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1007:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1008:
    mov ebx,eax
    shl eax,0ah
    shl ebx,04h
    sub eax,ebx

eax * 1009:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1015:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx

eax * 1016:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,03h

eax * 1017:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 1019:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    sub eax,ebx

eax * 1020:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl eax,02h

eax * 1021:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx

eax * 1022:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    add eax,eax

eax * 1026:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*2]

eax * 1027:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx

eax * 1028:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*4]

eax * 1029:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx

eax * 1031:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1032:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*8]

eax * 1033:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx

eax * 1039:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1040:
    mov ebx,eax
    shl eax,04h
    shl ebx,0ah
    add eax,ebx

eax * 1041:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1055:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1056:
    mov ebx,eax
    shl eax,05h
    shl ebx,0ah
    add eax,ebx

eax * 1057:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1087:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1088:
    mov ebx,eax
    shl eax,06h
    shl ebx,0ah
    add eax,ebx

eax * 1089:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1151:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1152:
    shl eax,07h
    lea eax,[eax+eax*8]

eax * 1153:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1279:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1280:
    shl eax,08h
    lea eax,[eax+eax*4]

eax * 1281:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 1535:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 1536:
    shl eax,09h
    lea eax,[eax+eax*2]

eax * 1537:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 1791:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 1792:
    mov ebx,eax
    shl eax,0bh
    shl ebx,08h
    sub eax,ebx

eax * 1793:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 1919:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 1920:
    mov ebx,eax
    shl eax,0bh
    shl ebx,07h
    sub eax,ebx

eax * 1921:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 1983:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 1984:
    mov ebx,eax
    shl eax,0bh
    shl ebx,06h
    sub eax,ebx

eax * 1985:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 2015:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 2016:
    mov ebx,eax
    shl eax,0bh
    shl ebx,05h
    sub eax,ebx

eax * 2017:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 2031:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2032:
    mov ebx,eax
    shl eax,0bh
    shl ebx,04h
    sub eax,ebx

eax * 2033:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 2039:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx

eax * 2040:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl eax,03h

eax * 2041:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 2043:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx

eax * 2044:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl eax,02h

eax * 2045:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx

eax * 2046:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    add eax,eax

eax * 2050:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*2]

eax * 2051:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx

eax * 2052:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*4]

eax * 2053:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx

eax * 2055:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2056:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*8]

eax * 2057:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx

eax * 2063:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2064:
    mov ebx,eax
    shl eax,04h
    shl ebx,0bh
    add eax,ebx

eax * 2065:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2079:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2080:
    mov ebx,eax
    shl eax,05h
    shl ebx,0bh
    add eax,ebx

eax * 2081:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2111:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2112:
    mov ebx,eax
    shl eax,06h
    shl ebx,0bh
    add eax,ebx

eax * 2113:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2175:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2176:
    mov ebx,eax
    shl eax,07h
    shl ebx,0bh
    add eax,ebx

eax * 2177:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2303:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2304:
    shl eax,08h
    lea eax,[eax+eax*8]

eax * 2305:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2559:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 2560:
    shl eax,09h
    lea eax,[eax+eax*4]

eax * 2561:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 3071:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 3072:
    shl eax,0ah
    lea eax,[eax+eax*2]

eax * 3073:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 3583:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 3584:
    mov ebx,eax
    shl eax,0ch
    shl ebx,09h
    sub eax,ebx

eax * 3585:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,09h
    sub eax,ebx

eax * 3839:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 3840:
    mov ebx,eax
    shl eax,0ch
    shl ebx,08h
    sub eax,ebx

eax * 3841:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 3967:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 3968:
    mov ebx,eax
    shl eax,0ch
    shl ebx,07h
    sub eax,ebx

eax * 3969:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 4031:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 4032:
    mov ebx,eax
    shl eax,0ch
    shl ebx,06h
    sub eax,ebx

eax * 4033:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 4063:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4064:
    mov ebx,eax
    shl eax,0ch
    shl ebx,05h
    sub eax,ebx

eax * 4065:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 4079:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4080:
    mov ebx,eax
    shl eax,0ch
    shl ebx,04h
    sub eax,ebx

eax * 4081:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 4087:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx

eax * 4088:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl eax,03h

eax * 4089:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 4091:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx

eax * 4092:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl eax,02h

eax * 4093:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx

eax * 4094:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    add eax,eax

eax * 4098:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*2]

eax * 4099:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx

eax * 4100:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*4]

eax * 4101:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx

eax * 4103:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4104:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*8]

eax * 4105:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx

eax * 4111:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4112:
    mov ebx,eax
    shl eax,04h
    shl ebx,0ch
    add eax,ebx

eax * 4113:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4127:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4128:
    mov ebx,eax
    shl eax,05h
    shl ebx,0ch
    add eax,ebx

eax * 4129:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4159:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4160:
    mov ebx,eax
    shl eax,06h
    shl ebx,0ch
    add eax,ebx

eax * 4161:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4223:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4224:
    mov ebx,eax
    shl eax,07h
    shl ebx,0ch
    add eax,ebx

eax * 4225:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4351:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4352:
    mov ebx,eax
    shl eax,08h
    shl ebx,0ch
    add eax,ebx

eax * 4353:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4607:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 4608:
    shl eax,09h
    lea eax,[eax+eax*8]

eax * 4609:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 5119:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 5120:
    shl eax,0ah
    lea eax,[eax+eax*4]

eax * 5121:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 6143:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 6144:
    shl eax,0bh
    lea eax,[eax+eax*2]

eax * 6145:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 7167:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 7168:
    mov ebx,eax
    shl eax,0dh
    shl ebx,0ah
    sub eax,ebx

eax * 7169:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,0ah
    sub eax,ebx

eax * 7679:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 7680:
    mov ebx,eax
    shl eax,0dh
    shl ebx,09h
    sub eax,ebx

eax * 7681:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,09h
    sub eax,ebx

eax * 7935:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7936:
    mov ebx,eax
    shl eax,0dh
    shl ebx,08h
    sub eax,ebx

eax * 7937:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 8063:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 8064:
    mov ebx,eax
    shl eax,0dh
    shl ebx,07h
    sub eax,ebx

eax * 8065:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 8127:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 8128:
    mov ebx,eax
    shl eax,0dh
    shl ebx,06h
    sub eax,ebx

eax * 8129:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 8159:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8160:
    mov ebx,eax
    shl eax,0dh
    shl ebx,05h
    sub eax,ebx

eax * 8161:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 8175:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8176:
    mov ebx,eax
    shl eax,0dh
    shl ebx,04h
    sub eax,ebx

eax * 8177:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8183:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx

eax * 8184:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl eax,03h

eax * 8185:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 8187:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx

eax * 8188:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl eax,02h

eax * 8189:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx

eax * 8190:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    add eax,eax

eax * 8194:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]

eax * 8195:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx

eax * 8196:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*4]

eax * 8197:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx

eax * 8199:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8200:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*8]

eax * 8201:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx

eax * 8207:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8208:
    mov ebx,eax
    shl eax,04h
    shl ebx,0dh
    add eax,ebx

eax * 8209:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8223:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8224:
    mov ebx,eax
    shl eax,05h
    shl ebx,0dh
    add eax,ebx

eax * 8225:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8255:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8256:
    mov ebx,eax
    shl eax,06h
    shl ebx,0dh
    add eax,ebx

eax * 8257:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8319:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8320:
    mov ebx,eax
    shl eax,07h
    shl ebx,0dh
    add eax,ebx

eax * 8321:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8447:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8448:
    mov ebx,eax
    shl eax,08h
    shl ebx,0dh
    add eax,ebx

eax * 8449:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8703:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8704:
    mov ebx,eax
    shl eax,09h
    shl ebx,0dh
    add eax,ebx

eax * 8705:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 9215:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 9216:
    shl eax,0ah
    lea eax,[eax+eax*8]

eax * 9217:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 10239:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 10240:
    shl eax,0bh
    lea eax,[eax+eax*4]

eax * 10241:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 12287:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 12288:
    shl eax,0ch
    lea eax,[eax+eax*2]

eax * 12289:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    add eax,eax
    add eax,ebx

eax * 14335:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 14336:
    mov ebx,eax
    shl eax,0eh
    shl ebx,0bh
    sub eax,ebx

eax * 15359:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 15360:
    mov ebx,eax
    shl eax,0eh
    shl ebx,0ah
    sub eax,ebx

eax * 15871:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 15872:
    mov ebx,eax
    shl eax,0eh
    shl ebx,09h
    sub eax,ebx

eax * 16127:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 16128:
    mov ebx,eax
    shl eax,0eh
    shl ebx,08h
    sub eax,ebx

eax * 16255:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 16256:
    mov ebx,eax
    shl eax,0eh
    shl ebx,07h
    sub eax,ebx

eax * 16319:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16320:
    mov ebx,eax
    shl eax,0eh
    shl ebx,06h
    sub eax,ebx

eax * 16351:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 16352:
    mov ebx,eax
    shl eax,0eh
    shl ebx,05h
    sub eax,ebx

eax * 16367:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 16368:
    mov ebx,eax
    shl eax,0eh
    shl ebx,04h
    sub eax,ebx

eax * 16375:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx

eax * 16376:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl eax,03h

eax * 16379:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx

eax * 16380:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl eax,02h

eax * 16381:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    sub eax,ebx

eax * 16382:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    add eax,eax

//**************************************************
// Код, выполняемый в среднем за 4 такта процессора
//**************************************************

eax * 22:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+ebx*4]

eax * 26:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+ebx*8]

eax * 38:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+ebx*4]

eax * 42:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+ebx*8]

eax * 43:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    lea eax,[ebx+eax*8]

eax * 44:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+ebx*4]

eax * 45:
    lea ebx,[eax+eax*4]
    lea eax,[ebx+ebx*8]

eax * 46:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,06h
    sub eax,ebx

eax * 50:
    lea ebx,[eax+eax*8]
    shl eax,05h
    lea eax,[eax+ebx*2]

eax * 51:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 52:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+ebx*4]

eax * 53:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 54:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,06h
    sub eax,ebx

eax * 58:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,06h
    sub eax,ebx

eax * 70:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+ebx*2]

eax * 74:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+ebx*8]

eax * 75:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    lea eax,[ebx+eax*8]

eax * 76:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+ebx*4]

eax * 77:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    lea eax,[ebx+eax*8]

eax * 78:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    lea eax,[ebx+eax*2]

eax * 82:
    lea ebx,[eax+eax*8]
    shl eax,06h
    lea eax,[eax+ebx*2]

eax * 83:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,04h
    add eax,ebx

eax * 84:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+ebx*4]

eax * 85:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 86:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 87:
    lea ebx,[eax+eax*8]
    shl eax,05h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 88:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+ebx*8]

eax * 89:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 90:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,05h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 91:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 92:
    lea ebx,[eax+eax*8]
    shl eax,07h
    shl ebx,02h
    sub eax,ebx

eax * 93:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 94:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    lea eax,[ebx+eax*2]

eax * 98:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 99:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 100:
    lea ebx,[eax+eax*8]
    shl eax,06h
    lea eax,[eax+ebx*4]

eax * 101:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 102:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    add eax,ebx

eax * 103:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 104:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+ebx*8]

eax * 105:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 106:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 107:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 108:
    lea ebx,[eax+eax*4]
    shl eax,07h
    shl ebx,02h
    sub eax,ebx

eax * 109:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 110:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,07h
    sub eax,ebx

eax * 114:
    mov ebx,eax
    shl eax,07h
    lea eax,[eax+ebx*2]
    shl ebx,04h
    sub eax,ebx

eax * 115:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 116:
    lea ebx,[eax+eax*2]
    shl eax,07h
    shl ebx,02h
    sub eax,ebx

eax * 117:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 118:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,07h
    sub eax,ebx

eax * 122:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,07h
    sub eax,ebx

eax * 134:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+ebx*2]

eax * 138:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+ebx*2]

eax * 139:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 140:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+ebx*4]

eax * 141:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 142:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    lea eax,[ebx+eax*2]

eax * 146:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+ebx*2]

eax * 147:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*2]
    shl ebx,04h
    add eax,ebx

eax * 148:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+ebx*4]

eax * 149:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 150:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,04h
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 151:
    lea ebx,[eax+eax*8]
    shl eax,05h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 152:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+ebx*8]

eax * 153:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[ebx+ebx*8]

eax * 154:
    lea ebx,[eax+eax*8]
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 155:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    lea eax,[eax+eax*4]

eax * 156:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    lea eax,[ebx+eax*4]

eax * 157:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 158:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    lea eax,[ebx+eax*2]

eax * 162:
    lea ebx,[eax+eax*4]
    add eax,eax
    shl ebx,05h
    add eax,ebx

eax * 163:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,05h
    add eax,ebx

eax * 164:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+ebx*4]

eax * 165:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 166:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 167:
    lea ebx,[eax+eax*4]
    add eax,eax
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 168:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+ebx*8]

eax * 169:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 170:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 171:
    lea ebx,[eax+eax*4]
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 172:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,02h
    add eax,ebx

eax * 173:
    lea ebx,[eax+eax*2]
    shl eax,07h
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 174:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 175:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 176:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl eax,04h

eax * 177:
    mov ebx,eax
    shl eax,04h
    lea ebx,[ebx+eax*2]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 178:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 179:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 180:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 181:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 182:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,06h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 183:
    lea ebx,[eax+eax*8]
    shl eax,06h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 184:
    lea ebx,[eax+eax*8]
    shl eax,08h
    shl ebx,03h
    sub eax,ebx

eax * 185:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 186:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,06h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 187:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 188:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    lea eax,[ebx+eax*4]

eax * 189:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 190:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    lea eax,[ebx+eax*2]

eax * 194:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 195:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 196:
    lea ebx,[eax+eax*2]
    shl eax,02h
    shl ebx,06h
    add eax,ebx

eax * 197:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 198:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    add eax,ebx

eax * 199:
    lea ebx,[eax+eax*2]
    shl eax,02h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 200:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+ebx*8]

eax * 201:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 202:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 203:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 204:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*2]
    shl ebx,06h
    add eax,ebx

eax * 205:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 207:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 208:
    lea ebx,[eax+eax*2]
    shl eax,04h
    shl ebx,06h
    add eax,ebx

eax * 209:
    mov ebx,eax
    shl eax,04h
    lea ebx,[ebx+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 210:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 211:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 212:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 213:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 215:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 216:
    lea ebx,[eax+eax*4]
    shl eax,08h
    shl ebx,03h
    sub eax,ebx

eax * 217:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 219:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 220:
    lea ebx,[eax+eax*8]
    shl eax,08h
    shl ebx,02h
    sub eax,ebx

eax * 221:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 222:
    mov ebx,eax
    shl eax,05h
    lea ebx,[eax+ebx*2]
    shl eax,03h
    sub eax,ebx

eax * 226:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+ebx*2]
    shl ebx,05h
    sub eax,ebx

eax * 227:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 228:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+ebx*4]
    shl ebx,05h
    sub eax,ebx

eax * 229:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 230:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 231:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 232:
    lea ebx,[eax+eax*2]
    shl eax,08h
    shl ebx,03h
    sub eax,ebx

eax * 233:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 235:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 236:
    lea ebx,[eax+eax*4]
    shl eax,08h
    shl ebx,02h
    sub eax,ebx

eax * 237:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 238:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,08h
    sub eax,ebx

eax * 242:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+ebx*2]
    shl ebx,04h
    sub eax,ebx

eax * 243:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 244:
    lea ebx,[eax+eax*2]
    shl eax,08h
    shl ebx,02h
    sub eax,ebx

eax * 245:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 246:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,08h
    sub eax,ebx

eax * 250:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,08h
    sub eax,ebx

eax * 262:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+ebx*2]

eax * 266:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+ebx*2]

eax * 267:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 268:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+ebx*4]

eax * 269:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 270:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*2]

eax * 274:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+ebx*2]

eax * 275:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 276:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+ebx*4]

eax * 277:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 278:
    mov ebx,eax
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 279:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    lea eax,[eax+eax*8]

eax * 280:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+ebx*8]

eax * 281:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 282:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,05h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 283:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 284:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*4]

eax * 285:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 286:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*2]

eax * 290:
    lea ebx,[eax+eax*8]
    add eax,eax
    shl ebx,05h
    add eax,ebx

eax * 291:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*2]
    shl ebx,05h
    add eax,ebx

eax * 292:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+ebx*4]

eax * 293:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 294:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,05h
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 295:
    lea ebx,[eax+eax*8]
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 296:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+ebx*8]

eax * 297:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    lea eax,[ebx+ebx*8]

eax * 298:
    lea ebx,[eax+eax*8]
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 299:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 300:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 301:
    lea ebx,[eax+eax*2]
    shl eax,08h
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 302:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 303:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,04h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 304:
    lea ebx,[eax+eax*2]
    shl eax,08h
    shl ebx,04h
    add eax,ebx

eax * 305:
    lea ebx,[eax+eax*8]
    shl eax,03h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 306:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 307:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 308:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 309:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 310:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,06h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 311:
    lea ebx,[eax+eax*8]
    shl eax,06h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 312:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*8]

eax * 313:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 314:
    mov ebx,eax
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 315:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    lea eax,[eax+eax*4]

eax * 316:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*4]

eax * 317:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 318:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*2]

eax * 322:
    lea ebx,[eax+eax*4]
    add eax,eax
    shl ebx,06h
    add eax,ebx

eax * 323:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,06h
    add eax,ebx

eax * 324:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    lea eax,[eax+ebx*4]

eax * 325:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 326:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 327:
    lea ebx,[eax+eax*4]
    add eax,eax
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 328:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+ebx*8]

eax * 329:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 330:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 331:
    lea ebx,[eax+eax*4]
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 332:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,02h
    add eax,ebx

eax * 333:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 334:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 335:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 336:
    lea ebx,[eax+eax*4]
    shl eax,04h
    shl ebx,06h
    add eax,ebx

eax * 337:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 338:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 340:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 341:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 343:
    lea ebx,[eax+eax*8]
    shl eax,06h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 344:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 345:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 347:
    lea ebx,[eax+eax*4]
    shl eax,05h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 348:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 349:
    lea ebx,[eax+eax*2]
    shl eax,08h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 351:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 352:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl eax,05h

eax * 353:
    mov ebx,eax
    shl eax,05h
    lea ebx,[ebx+eax*2]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 354:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add ebx,ebx
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 355:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 356:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 357:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 359:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 360:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 361:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 364:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 365:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 366:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 367:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,03h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 368:
    lea ebx,[eax+eax*8]
    shl eax,09h
    shl ebx,04h
    sub eax,ebx

eax * 369:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 371:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 372:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 373:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 374:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 375:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 376:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*8]

eax * 377:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 378:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 379:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 380:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*4]

eax * 381:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 382:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    lea eax,[ebx+eax*2]

eax * 386:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 387:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 388:
    lea ebx,[eax+eax*2]
    shl eax,02h
    shl ebx,07h
    add eax,ebx

eax * 389:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 390:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,07h
    add eax,ebx

eax * 391:
    lea ebx,[eax+eax*2]
    shl eax,02h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 392:
    lea ebx,[eax+eax*2]
    shl eax,03h
    shl ebx,07h
    add eax,ebx

eax * 393:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 394:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 395:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 396:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*2]
    shl ebx,07h
    add eax,ebx

eax * 397:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 399:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 400:
    lea ebx,[eax+eax*2]
    shl eax,04h
    shl ebx,07h
    add eax,ebx

eax * 401:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 402:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 403:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 404:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 407:
    lea ebx,[eax+eax*8]
    shl eax,07h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 408:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*2]
    shl ebx,07h
    add eax,ebx

eax * 409:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 411:
    lea ebx,[eax+eax*4]
    shl eax,08h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 413:
    lea ebx,[eax+eax*2]
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 415:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 416:
    lea ebx,[eax+eax*2]
    shl eax,05h
    shl ebx,07h
    add eax,ebx

eax * 417:
    mov ebx,eax
    shl eax,05h
    lea ebx,[ebx+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 419:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 420:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 421:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 423:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 424:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 425:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 427:
    lea ebx,[eax+eax*4]
    shl eax,09h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 431:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 432:
    lea ebx,[eax+eax*4]
    shl eax,09h
    shl ebx,04h
    sub eax,ebx

eax * 433:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 437:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 439:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 440:
    lea ebx,[eax+eax*8]
    shl eax,09h
    shl ebx,03h
    sub eax,ebx

eax * 441:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 443:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 444:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*4]
    shl eax,03h
    sub eax,ebx

eax * 445:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 446:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*2]
    shl eax,03h
    sub eax,ebx

eax * 450:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*2]
    shl ebx,06h
    sub eax,ebx

eax * 451:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 452:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*4]
    shl ebx,06h
    sub eax,ebx

eax * 453:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 454:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 455:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,06h
    add eax,ebx

eax * 456:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*8]
    shl ebx,06h
    sub eax,ebx

eax * 457:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 459:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 461:
    lea ebx,[eax+eax*2]
    shl eax,09h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 463:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 464:
    lea ebx,[eax+eax*2]
    shl eax,09h
    shl ebx,04h
    sub eax,ebx

eax * 465:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 467:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 471:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 472:
    lea ebx,[eax+eax*4]
    shl eax,09h
    shl ebx,03h
    sub eax,ebx

eax * 473:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 475:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 476:
    lea ebx,[eax+eax*8]
    shl eax,09h
    shl ebx,02h
    sub eax,ebx

eax * 477:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 478:
    mov ebx,eax
    shl eax,05h
    lea ebx,[eax+ebx*2]
    shl eax,04h
    sub eax,ebx

eax * 482:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*2]
    shl ebx,05h
    sub eax,ebx

eax * 483:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 484:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*4]
    shl ebx,05h
    sub eax,ebx

eax * 485:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 487:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 488:
    lea ebx,[eax+eax*2]
    shl eax,09h
    shl ebx,03h
    sub eax,ebx

eax * 489:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 491:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 492:
    lea ebx,[eax+eax*4]
    shl eax,09h
    shl ebx,02h
    sub eax,ebx

eax * 493:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 494:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,09h
    sub eax,ebx

eax * 498:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+ebx*2]
    shl ebx,04h
    sub eax,ebx

eax * 499:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 500:
    lea ebx,[eax+eax*2]
    shl eax,09h
    shl ebx,02h
    sub eax,ebx

eax * 501:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 502:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,09h
    sub eax,ebx

eax * 506:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,09h
    sub eax,ebx

eax * 518:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+ebx*2]

eax * 522:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+ebx*2]

eax * 523:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 524:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+ebx*4]

eax * 525:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 526:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*2]

eax * 530:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+ebx*2]

eax * 531:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 532:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+ebx*4]

eax * 533:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 535:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 536:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+ebx*8]

eax * 537:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 539:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 540:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*4]

eax * 541:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 542:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*2]

eax * 546:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*2]

eax * 547:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 548:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+ebx*4]

eax * 549:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 551:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,04h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 552:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+ebx*8]

eax * 553:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 556:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 557:
    lea ebx,[eax+eax*2]
    shl eax,09h
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 558:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,06h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 559:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 560:
    lea ebx,[eax+eax*2]
    shl eax,09h
    shl ebx,04h
    add eax,ebx

eax * 561:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,05h
    add eax,ebx

eax * 562:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 563:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 564:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 565:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 566:
    mov ebx,eax
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 567:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    lea eax,[eax+eax*8]

eax * 568:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*8]

eax * 569:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,03h
    add eax,ebx

eax * 570:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,06h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 571:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 572:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*4]

eax * 573:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 574:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*2]

eax * 578:
    lea ebx,[eax+eax*8]
    add eax,eax
    shl ebx,06h
    add eax,ebx

eax * 579:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*2]
    shl ebx,06h
    add eax,ebx

eax * 580:
    lea ebx,[eax+eax*8]
    shl eax,02h
    shl ebx,06h
    add eax,ebx

eax * 581:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 582:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,06h
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 583:
    lea ebx,[eax+eax*8]
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 584:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+ebx*8]

eax * 585:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    lea eax,[ebx+ebx*8]

eax * 586:
    lea ebx,[eax+eax*8]
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 587:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 588:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 589:
    lea ebx,[eax+eax*8]
    shl eax,02h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 590:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 591:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 592:
    lea ebx,[eax+eax*4]
    shl eax,09h
    shl ebx,04h
    add eax,ebx

eax * 593:
    lea ebx,[eax+eax*8]
    shl eax,03h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 594:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 596:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 597:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 599:
    lea ebx,[eax+eax*8]
    shl eax,05h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 600:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 601:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 603:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 604:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 605:
    lea ebx,[eax+eax*2]
    shl eax,09h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 607:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 608:
    lea ebx,[eax+eax*2]
    shl eax,09h
    shl ebx,05h
    add eax,ebx

eax * 609:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,03h
    add eax,ebx

eax * 611:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 612:
    lea ebx,[eax+eax*8]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 613:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 616:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 617:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 619:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 620:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 622:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 623:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 624:
    mov ebx,eax
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 625:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 626:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 627:
    lea ebx,[eax*8+0h]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 628:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 629:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 630:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 631:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 632:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*8]

eax * 633:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 634:
    mov ebx,eax
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 635:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    lea eax,[eax+eax*4]

eax * 636:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*4]

eax * 637:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 638:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*2]

eax * 642:
    lea ebx,[eax+eax*4]
    add eax,eax
    shl ebx,07h
    add eax,ebx

eax * 643:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,07h
    add eax,ebx

eax * 644:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[eax+ebx*4]

eax * 645:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 646:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 647:
    lea ebx,[eax+eax*4]
    add eax,eax
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 648:
    lea ebx,[eax+eax*4]
    shl eax,03h
    shl ebx,07h
    add eax,ebx

eax * 649:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 650:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 651:
    lea ebx,[eax+eax*4]
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 652:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,02h
    add eax,ebx

eax * 653:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 654:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 655:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 656:
    lea ebx,[eax+eax*4]
    shl eax,04h
    shl ebx,07h
    add eax,ebx

eax * 657:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 658:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 660:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 661:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 664:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 665:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 667:
    lea ebx,[eax+eax*4]
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 671:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 672:
    lea ebx,[eax+eax*4]
    shl eax,05h
    shl ebx,07h
    add eax,ebx

eax * 673:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 676:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 677:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 680:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 688:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 689:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 695:
    lea ebx,[eax+eax*8]
    shl eax,07h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 696:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 697:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 699:
    lea ebx,[eax+eax*4]
    shl eax,06h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 701:
    lea ebx,[eax+eax*2]
    shl eax,09h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 703:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 704:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl eax,06h

eax * 705:
    mov ebx,eax
    shl eax,06h
    lea ebx,[ebx+eax*2]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 706:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    add ebx,ebx
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 707:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 709:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 711:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 712:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 713:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 719:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 720:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 721:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 727:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 728:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 729:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 732:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 733:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 735:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 736:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    shl ebx,05h
    sub eax,ebx

eax * 737:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,04h
    add eax,ebx

eax * 739:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 743:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 744:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 745:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 748:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 749:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 750:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 751:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 752:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 753:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 755:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 756:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 757:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 758:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 759:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 760:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*8]

eax * 761:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 762:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 763:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 764:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*4]

eax * 765:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 766:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    lea eax,[ebx+eax*2]

eax * 770:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 771:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 772:
    lea ebx,[eax+eax*2]
    shl eax,02h
    shl ebx,08h
    add eax,ebx

eax * 773:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 774:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 775:
    lea ebx,[eax+eax*2]
    shl eax,02h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 776:
    lea ebx,[eax+eax*2]
    shl eax,03h
    shl ebx,08h
    add eax,ebx

eax * 777:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 778:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 779:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 780:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 781:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 783:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 784:
    lea ebx,[eax+eax*2]
    shl eax,04h
    shl ebx,08h
    add eax,ebx

eax * 785:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 786:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 787:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 788:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 791:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 792:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 793:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 797:
    lea ebx,[eax+eax*2]
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 799:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 800:
    lea ebx,[eax+eax*2]
    shl eax,05h
    shl ebx,08h
    add eax,ebx

eax * 801:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 803:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 804:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 808:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 809:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 815:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 816:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 817:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 823:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 825:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 827:
    lea ebx,[eax+eax*4]
    shl eax,09h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 829:
    lea ebx,[eax+eax*2]
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 831:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 832:
    lea ebx,[eax+eax*2]
    shl eax,06h
    shl ebx,08h
    add eax,ebx

eax * 833:
    mov ebx,eax
    shl eax,06h
    lea ebx,[ebx+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 835:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 836:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 837:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 839:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 840:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 841:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 847:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 848:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 849:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 857:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 859:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 863:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,02h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 864:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    shl ebx,05h
    sub eax,ebx

eax * 865:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 869:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 871:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 873:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 879:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,03h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 880:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    shl ebx,04h
    sub eax,ebx

eax * 881:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 885:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 887:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 888:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*8]
    shl eax,03h
    sub eax,ebx

eax * 889:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 891:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 892:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*4]
    shl eax,03h
    sub eax,ebx

eax * 893:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 894:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*2]
    shl eax,03h
    sub eax,ebx

eax * 898:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*2]
    shl ebx,07h
    sub eax,ebx

eax * 899:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 900:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*4]
    shl ebx,07h
    sub eax,ebx

eax * 901:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 902:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 903:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,07h
    add eax,ebx

eax * 904:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*8]
    shl ebx,07h
    sub eax,ebx

eax * 905:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 907:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 911:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 912:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 913:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 919:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 921:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 925:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 927:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 928:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,05h
    sub eax,ebx

eax * 929:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 931:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 935:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 937:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 939:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 941:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 943:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 944:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    shl ebx,04h
    sub eax,ebx

eax * 945:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 949:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 951:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 952:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    shl ebx,03h
    sub eax,ebx

eax * 953:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 955:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 956:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*4]
    shl eax,04h
    sub eax,ebx

eax * 957:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 958:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*2]
    shl eax,04h
    sub eax,ebx

eax * 962:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*2]
    shl ebx,06h
    sub eax,ebx

eax * 963:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 964:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*4]
    shl ebx,06h
    sub eax,ebx

eax * 965:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 967:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 968:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*8]
    shl ebx,06h
    sub eax,ebx

eax * 969:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 971:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 973:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 974:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 975:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,06h
    add eax,ebx

eax * 976:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,04h
    sub eax,ebx

eax * 977:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 979:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 983:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 984:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    shl ebx,03h
    sub eax,ebx

eax * 985:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 987:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 988:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    shl ebx,02h
    sub eax,ebx

eax * 989:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 990:
    mov ebx,eax
    shl eax,05h
    lea ebx,[eax+ebx*2]
    shl eax,05h
    sub eax,ebx

eax * 994:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*2]
    shl ebx,05h
    sub eax,ebx

eax * 995:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 996:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*4]
    shl ebx,05h
    sub eax,ebx

eax * 997:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 999:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1000:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,03h
    sub eax,ebx

eax * 1001:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 1003:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1004:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    shl ebx,02h
    sub eax,ebx

eax * 1005:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1006:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0ah
    sub eax,ebx

eax * 1010:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+ebx*2]
    shl ebx,04h
    sub eax,ebx

eax * 1011:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1012:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,02h
    sub eax,ebx

eax * 1013:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1014:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0ah
    sub eax,ebx

eax * 1018:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0ah
    sub eax,ebx

eax * 1030:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+ebx*2]

eax * 1034:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+ebx*2]

eax * 1035:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1036:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+ebx*4]

eax * 1037:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1038:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1042:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+ebx*2]

eax * 1043:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1044:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+ebx*4]

eax * 1045:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1047:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    sub eax,ebx

eax * 1048:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+ebx*8]

eax * 1049:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1051:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1052:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*4]

eax * 1053:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 1054:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1058:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1059:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1060:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+ebx*4]

eax * 1061:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1063:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1064:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+ebx*8]

eax * 1065:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1067:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1069:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 1070:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1071:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1072:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,04h
    add eax,ebx

eax * 1073:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1075:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 1079:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1080:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*8]

eax * 1081:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1083:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 1084:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*4]

eax * 1085:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 1086:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1090:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1091:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 1092:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*4]

eax * 1093:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 1095:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 1096:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+ebx*8]

eax * 1097:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 1099:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 1103:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1104:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    shl ebx,04h
    add eax,ebx

eax * 1105:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 1106:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1107:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1109:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 1111:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1112:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 1113:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1116:
    lea ebx,[eax+eax*8]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 1117:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1119:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1120:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,05h
    add eax,ebx

eax * 1121:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1123:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1127:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1128:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 1129:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1132:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 1134:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 1135:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1136:
    mov ebx,eax
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 1137:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1138:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1139:
    lea ebx,[eax*4+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1140:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 1141:
    lea ebx,[eax*2+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1142:
    mov ebx,eax
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1143:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    lea eax,[eax+eax*8]

eax * 1144:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*8]

eax * 1145:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,03h
    add eax,ebx

eax * 1146:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 1147:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 1148:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*4]

eax * 1149:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 1150:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1154:
    lea ebx,[eax+eax*8]
    add eax,eax
    shl ebx,07h
    add eax,ebx

eax * 1155:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*2]
    shl ebx,07h
    add eax,ebx

eax * 1156:
    lea ebx,[eax+eax*8]
    shl eax,02h
    shl ebx,07h
    add eax,ebx

eax * 1157:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 1158:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,07h
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 1159:
    lea ebx,[eax+eax*8]
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1160:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[eax+ebx*8]

eax * 1161:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[ebx+ebx*8]

eax * 1162:
    lea ebx,[eax+eax*8]
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1163:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1164:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 1165:
    lea ebx,[eax+eax*8]
    shl eax,02h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1166:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1167:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 1168:
    lea ebx,[eax+eax*8]
    shl eax,04h
    shl ebx,07h
    add eax,ebx

eax * 1169:
    lea ebx,[eax+eax*8]
    shl eax,03h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1170:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 1172:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 1175:
    lea ebx,[eax+eax*8]
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1176:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 1177:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1179:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1183:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 1184:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    shl ebx,05h
    add eax,ebx

eax * 1185:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 1188:
    lea ebx,[eax+eax*8]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 1189:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1192:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 1193:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1199:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1200:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 1201:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1207:
    lea ebx,[eax+eax*8]
    shl eax,06h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1208:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 1211:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1213:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1215:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1216:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,06h
    add eax,ebx

eax * 1217:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,06h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1219:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1221:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1224:
    lea ebx,[eax+eax*8]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 1225:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1231:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1232:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 1233:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 1240:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 1241:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1243:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1244:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 1247:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1248:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 1249:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,04h
    add eax,ebx

eax * 1253:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1255:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1256:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 1259:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1260:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 1262:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 1263:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1264:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 1265:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1266:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1267:
    lea ebx,[eax*8+0h]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1268:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 1269:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1270:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 1271:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 1272:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*8]

eax * 1273:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1274:
    mov ebx,eax
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1275:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    lea eax,[eax+eax*4]

eax * 1276:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*4]

eax * 1277:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 1278:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1282:
    lea ebx,[eax+eax*4]
    add eax,eax
    shl ebx,08h
    add eax,ebx

eax * 1283:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 1284:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+ebx*4]

eax * 1285:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 1286:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1287:
    lea ebx,[eax+eax*4]
    add eax,eax
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1288:
    lea ebx,[eax+eax*4]
    shl eax,03h
    shl ebx,08h
    add eax,ebx

eax * 1289:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 1290:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 1291:
    lea ebx,[eax+eax*4]
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1292:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,02h
    add eax,ebx

eax * 1293:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1294:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1295:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 1296:
    lea ebx,[eax+eax*4]
    shl eax,04h
    shl ebx,08h
    add eax,ebx

eax * 1297:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 1298:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 1300:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 1301:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1303:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1304:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 1307:
    lea ebx,[eax+eax*4]
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1311:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 1312:
    lea ebx,[eax+eax*4]
    shl eax,05h
    shl ebx,08h
    add eax,ebx

eax * 1313:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 1316:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 1317:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1320:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 1321:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1327:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1328:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 1339:
    lea ebx,[eax+eax*4]
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1343:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 1344:
    lea ebx,[eax+eax*4]
    shl eax,06h
    shl ebx,08h
    add eax,ebx

eax * 1345:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1349:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1352:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 1360:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 1361:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1376:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 1392:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 1393:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1399:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1401:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1403:
    lea ebx,[eax+eax*4]
    shl eax,07h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1405:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1407:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1408:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl eax,07h

eax * 1409:
    mov ebx,eax
    shl eax,07h
    lea ebx,[ebx+eax*2]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 1410:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    add ebx,ebx
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 1411:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1413:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1415:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1416:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,03h
    add eax,ebx

eax * 1417:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1423:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1424:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 1440:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 1441:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1456:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 1457:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1463:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 1464:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 1465:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1469:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 1471:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 1472:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    shl ebx,06h
    sub eax,ebx

eax * 1473:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1475:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 1479:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1481:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 1487:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1488:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 1489:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1496:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 1500:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 1501:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 1503:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 1504:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 1505:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 1507:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 1512:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 1516:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 1517:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 1518:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 1519:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 1520:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 1521:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1523:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 1524:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 1525:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 1526:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 1527:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 1528:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*8]

eax * 1529:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1530:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 1531:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 1532:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*4]

eax * 1533:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 1534:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    lea eax,[ebx+eax*2]

eax * 1538:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 1539:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 1540:
    lea ebx,[eax+eax*2]
    shl eax,02h
    shl ebx,09h
    add eax,ebx

eax * 1541:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 1542:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 1543:
    lea ebx,[eax+eax*2]
    shl eax,02h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1544:
    lea ebx,[eax+eax*2]
    shl eax,03h
    shl ebx,09h
    add eax,ebx

eax * 1545:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 1546:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 1547:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1548:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 1549:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1551:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1552:
    lea ebx,[eax+eax*2]
    shl eax,04h
    shl ebx,09h
    add eax,ebx

eax * 1553:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1554:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 1555:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1556:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 1560:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 1565:
    lea ebx,[eax+eax*2]
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1567:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1568:
    lea ebx,[eax+eax*2]
    shl eax,05h
    shl ebx,09h
    add eax,ebx

eax * 1569:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1571:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1572:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 1576:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 1583:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1584:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 1585:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 1591:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1593:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 1597:
    lea ebx,[eax+eax*2]
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1599:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1600:
    lea ebx,[eax+eax*2]
    shl eax,06h
    shl ebx,09h
    add eax,ebx

eax * 1601:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1603:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1608:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 1609:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 1616:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 1617:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 1632:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 1633:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1647:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1649:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1655:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1657:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1659:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1661:
    lea ebx,[eax+eax*2]
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1663:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 1664:
    lea ebx,[eax+eax*2]
    shl eax,07h
    shl ebx,09h
    add eax,ebx

eax * 1665:
    mov ebx,eax
    shl eax,07h
    lea ebx,[ebx+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 1667:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1668:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 1669:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1671:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1672:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 1673:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 1679:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1680:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 1681:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1696:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 1697:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1721:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1723:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 1727:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 1728:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,06h
    sub eax,ebx

eax * 1729:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 1733:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 1735:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1751:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1753:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1759:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1760:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    shl ebx,05h
    sub eax,ebx

eax * 1761:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 1767:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1769:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1775:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 1776:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,07h
    shl ebx,04h
    sub eax,ebx

eax * 1777:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1781:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1783:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 1784:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*8]
    shl eax,03h
    sub eax,ebx

eax * 1785:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 1787:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 1788:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*4]
    shl eax,03h
    sub eax,ebx

eax * 1789:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 1790:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*2]
    shl eax,03h
    sub eax,ebx

eax * 1794:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*2]
    shl ebx,08h
    sub eax,ebx

eax * 1795:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 1796:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*4]
    shl ebx,08h
    sub eax,ebx

eax * 1797:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 1798:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 1799:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1800:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*8]
    shl ebx,08h
    sub eax,ebx

eax * 1801:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 1803:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1807:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1808:
    mov ebx,eax
    shl eax,04h
    shl ebx,08h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1809:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1815:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1817:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1823:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1824:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 1825:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 1831:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1841:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1849:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1853:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 1855:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 1856:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,06h
    sub eax,ebx

eax * 1857:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 1859:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 1863:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1871:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1873:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1883:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1887:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 1888:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,05h
    sub eax,ebx

eax * 1889:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1893:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1895:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1897:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1901:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1903:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1904:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    shl ebx,04h
    sub eax,ebx

eax * 1905:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1911:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 1912:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*8]
    shl eax,04h
    sub eax,ebx

eax * 1913:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1915:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 1916:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*4]
    shl eax,04h
    sub eax,ebx

eax * 1917:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 1918:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*2]
    shl eax,04h
    sub eax,ebx

eax * 1922:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*2]
    shl ebx,07h
    sub eax,ebx

eax * 1923:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 1924:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*4]
    shl ebx,07h
    sub eax,ebx

eax * 1925:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 1927:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 1928:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*8]
    shl ebx,07h
    sub eax,ebx

eax * 1929:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 1931:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 1933:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 1934:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 1935:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1936:
    mov ebx,eax
    shl eax,04h
    shl ebx,07h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 1937:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1939:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1943:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1945:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1949:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1951:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1952:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,05h
    sub eax,ebx

eax * 1953:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    mov ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 1955:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 1963:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1967:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 1968:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,04h
    sub eax,ebx

eax * 1969:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 1973:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1975:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 1976:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    shl ebx,03h
    sub eax,ebx

eax * 1977:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 1979:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 1980:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*4]
    shl eax,05h
    sub eax,ebx

eax * 1981:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 1982:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*2]
    shl eax,05h
    sub eax,ebx

eax * 1986:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*2]
    shl ebx,06h
    sub eax,ebx

eax * 1987:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 1988:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*4]
    shl ebx,06h
    sub eax,ebx

eax * 1989:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 1991:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,03h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 1992:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*8]
    shl ebx,06h
    sub eax,ebx

eax * 1993:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 1997:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 1999:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 2000:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,04h
    sub eax,ebx

eax * 2001:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 2003:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 2007:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 2008:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,03h
    sub eax,ebx

eax * 2009:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 2011:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 2012:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    shl ebx,02h
    sub eax,ebx

eax * 2013:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 2014:
    mov ebx,eax
    shl eax,05h
    lea ebx,[eax+ebx*2]
    shl eax,06h
    sub eax,ebx

eax * 2018:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*2]
    shl ebx,05h
    sub eax,ebx

eax * 2019:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 2020:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*4]
    shl ebx,05h
    sub eax,ebx

eax * 2021:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 2023:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2024:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,03h
    sub eax,ebx

eax * 2025:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 2027:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2028:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,02h
    sub eax,ebx

eax * 2029:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2030:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0bh
    sub eax,ebx

eax * 2034:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+ebx*2]
    shl ebx,04h
    sub eax,ebx

eax * 2035:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2036:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,02h
    sub eax,ebx

eax * 2037:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2038:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0bh
    sub eax,ebx

eax * 2042:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0bh
    sub eax,ebx

eax * 2054:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+ebx*2]

eax * 2058:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+ebx*2]

eax * 2059:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 2060:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+ebx*4]

eax * 2061:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 2062:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2066:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+ebx*2]

eax * 2067:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2068:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+ebx*4]

eax * 2069:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2071:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    sub eax,ebx

eax * 2072:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+ebx*8]

eax * 2073:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2075:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 2076:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 2077:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 2078:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2082:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2083:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2084:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+ebx*4]

eax * 2085:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2087:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2088:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+ebx*8]

eax * 2089:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2093:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 2095:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 2096:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,04h
    add eax,ebx

eax * 2097:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2099:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 2103:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*8]
    sub eax,ebx

eax * 2104:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*8]

eax * 2105:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2107:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 2108:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 2109:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 2110:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2114:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2115:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2116:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 2117:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2119:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 2120:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+ebx*8]

eax * 2121:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2123:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 2127:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2128:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,04h
    add eax,ebx

eax * 2129:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 2133:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 2141:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 2143:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2144:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,05h
    add eax,ebx

eax * 2145:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    mov ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2146:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2147:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 2149:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2151:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2153:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,04h
    add eax,ebx

eax * 2155:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2157:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2158:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2159:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2160:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 2161:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 2163:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 2167:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2168:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*8]

eax * 2169:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2171:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 2172:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 2173:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 2174:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2178:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2179:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 2180:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 2181:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 2183:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 2184:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*8]

eax * 2185:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 2191:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2192:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    shl ebx,04h
    add eax,ebx

eax * 2193:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2194:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2195:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2197:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2201:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 2203:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 2207:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2208:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,05h
    add eax,ebx

eax * 2209:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2213:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 2223:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2224:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 2225:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2231:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2232:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 2237:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2239:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 2240:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,06h
    add eax,ebx

eax * 2241:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 2243:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2249:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2256:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 2257:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2263:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2264:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 2265:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2268:
    lea ebx,[eax+eax*8]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 2271:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 2272:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 2273:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 2279:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2280:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 2281:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2284:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 2286:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 2287:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2288:
    mov ebx,eax
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 2289:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2290:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2291:
    lea ebx,[eax*4+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2292:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 2293:
    lea ebx,[eax*2+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2294:
    mov ebx,eax
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2295:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    lea eax,[eax+eax*8]

eax * 2296:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*8]

eax * 2297:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,03h
    add eax,ebx

eax * 2298:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 2299:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 2300:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 2301:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 2302:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2306:
    lea ebx,[eax+eax*8]
    add eax,eax
    shl ebx,08h
    add eax,ebx

eax * 2307:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 2308:
    lea ebx,[eax+eax*8]
    shl eax,02h
    shl ebx,08h
    add eax,ebx

eax * 2309:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 2310:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,08h
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 2311:
    lea ebx,[eax+eax*8]
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2312:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+ebx*8]

eax * 2313:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[ebx+ebx*8]

eax * 2314:
    lea ebx,[eax+eax*8]
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2315:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2316:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 2317:
    lea ebx,[eax+eax*8]
    shl eax,02h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2318:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 2319:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 2320:
    lea ebx,[eax+eax*8]
    shl eax,04h
    shl ebx,08h
    add eax,ebx

eax * 2321:
    lea ebx,[eax+eax*8]
    shl eax,03h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2322:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 2324:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 2327:
    lea ebx,[eax+eax*8]
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2328:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 2329:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2335:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2336:
    lea ebx,[eax+eax*8]
    shl eax,05h
    shl ebx,08h
    add eax,ebx

eax * 2337:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 2340:
    lea ebx,[eax+eax*8]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 2344:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 2345:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2352:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 2359:
    lea ebx,[eax+eax*8]
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2363:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2367:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 2368:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    shl ebx,06h
    add eax,ebx

eax * 2369:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 2373:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2376:
    lea ebx,[eax+eax*8]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 2377:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2384:
    lea ebx,[eax+eax*4]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 2400:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 2401:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2415:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2416:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 2417:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2423:
    lea ebx,[eax+eax*8]
    shl eax,07h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2427:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2429:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2431:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 2432:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    shl ebx,07h
    add eax,ebx

eax * 2433:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 2435:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2437:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2441:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2447:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2448:
    lea ebx,[eax+eax*8]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 2449:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 2464:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 2465:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2480:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 2488:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 2489:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2491:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2495:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 2496:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub eax,ebx

eax * 2497:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 2501:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2503:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2512:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 2513:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2520:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 2523:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2524:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 2527:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 2528:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 2529:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2533:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2536:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 2539:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2540:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 2542:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 2543:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2544:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 2545:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 2546:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2547:
    lea ebx,[eax*8+0h]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2548:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 2549:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2550:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 2551:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 2552:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*8]

eax * 2553:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2554:
    mov ebx,eax
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 2555:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    lea eax,[eax+eax*4]

eax * 2556:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 2557:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 2558:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 2562:
    lea ebx,[eax+eax*4]
    add eax,eax
    shl ebx,09h
    add eax,ebx

eax * 2563:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 2564:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+ebx*4]

eax * 2565:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 2566:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2567:
    lea ebx,[eax+eax*4]
    add eax,eax
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2568:
    lea ebx,[eax+eax*4]
    shl eax,03h
    shl ebx,09h
    add eax,ebx

eax * 2569:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 2570:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 2571:
    lea ebx,[eax+eax*4]
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2572:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,02h
    add eax,ebx

eax * 2573:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2574:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2575:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2576:
    lea ebx,[eax+eax*4]
    shl eax,04h
    shl ebx,09h
    add eax,ebx

eax * 2577:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 2578:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 2580:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 2581:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2584:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 2587:
    lea ebx,[eax+eax*4]
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2591:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2592:
    lea ebx,[eax+eax*4]
    shl eax,05h
    shl ebx,09h
    add eax,ebx

eax * 2593:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 2596:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 2597:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2600:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 2608:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 2609:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 2615:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2619:
    lea ebx,[eax+eax*4]
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2623:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 2624:
    lea ebx,[eax+eax*4]
    shl eax,06h
    shl ebx,09h
    add eax,ebx

eax * 2625:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 2629:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2632:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 2633:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 2640:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 2656:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 2657:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2671:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2683:
    lea ebx,[eax+eax*4]
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2687:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 2688:
    lea ebx,[eax+eax*4]
    shl eax,07h
    shl ebx,09h
    add eax,ebx

eax * 2689:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 2693:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2704:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 2705:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2720:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 2752:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 2784:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 2801:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2807:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2809:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 2811:
    lea ebx,[eax+eax*4]
    shl eax,08h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2813:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2815:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 2816:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl eax,08h

eax * 2817:
    mov ebx,eax
    shl eax,08h
    lea ebx,[ebx+eax*2]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 2818:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    add ebx,ebx
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 2819:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2821:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 2823:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 2824:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,03h
    add eax,ebx

eax * 2825:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 2831:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 2848:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 2880:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 2912:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 2913:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2928:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 2929:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2935:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 2937:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2941:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,07h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 2943:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 2944:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,07h
    sub eax,ebx

eax * 2945:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 2947:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 2951:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2953:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 2959:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 2975:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 2976:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 2977:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 2991:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 2992:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 2993:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 3000:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 3005:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 3007:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 3008:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 3009:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3011:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 3023:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 3024:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 3025:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3032:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 3036:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 3037:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 3039:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3040:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 3041:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 3043:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 3048:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 3052:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 3053:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 3054:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 3055:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3056:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 3057:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 3059:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 3060:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 3061:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 3062:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 3063:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 3064:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*8]

eax * 3065:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3066:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 3067:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 3068:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*4]

eax * 3069:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 3070:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0bh
    lea eax,[ebx+eax*2]

eax * 3074:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 3075:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 3076:
    lea ebx,[eax+eax*2]
    shl eax,02h
    shl ebx,0ah
    add eax,ebx

eax * 3077:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 3078:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 3079:
    lea ebx,[eax+eax*2]
    shl eax,02h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3080:
    lea ebx,[eax+eax*2]
    shl eax,03h
    shl ebx,0ah
    add eax,ebx

eax * 3081:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 3082:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 3083:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3084:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 3085:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3087:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3088:
    lea ebx,[eax+eax*2]
    shl eax,04h
    shl ebx,0ah
    add eax,ebx

eax * 3089:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3090:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 3091:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3092:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 3096:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 3101:
    lea ebx,[eax+eax*2]
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3103:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3104:
    lea ebx,[eax+eax*2]
    shl eax,05h
    shl ebx,0ah
    add eax,ebx

eax * 3105:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3107:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3108:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 3112:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 3119:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 3120:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 3121:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 3133:
    lea ebx,[eax+eax*2]
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3135:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3136:
    lea ebx,[eax+eax*2]
    shl eax,06h
    shl ebx,0ah
    add eax,ebx

eax * 3137:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3139:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3144:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 3152:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 3153:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 3167:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3168:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 3169:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 3183:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 3191:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 3193:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 3197:
    lea ebx,[eax+eax*2]
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3199:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3200:
    lea ebx,[eax+eax*2]
    shl eax,07h
    shl ebx,0ah
    add eax,ebx

eax * 3201:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3203:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3209:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 3216:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 3217:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 3232:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 3233:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3264:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 3311:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3313:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3319:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 3321:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3323:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 3325:
    lea ebx,[eax+eax*2]
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3327:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 3328:
    lea ebx,[eax+eax*2]
    shl eax,08h
    shl ebx,0ah
    add eax,ebx

eax * 3329:
    mov ebx,eax
    shl eax,08h
    lea ebx,[ebx+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 3331:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3332:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 3333:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 3335:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3336:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 3337:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 3343:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3345:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3360:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 3392:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 3425:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3449:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3451:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 3455:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3456:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,07h
    sub eax,ebx

eax * 3457:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 3461:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 3463:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3487:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3511:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3513:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3519:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3520:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,06h
    sub eax,ebx

eax * 3521:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 3527:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3529:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3535:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 3545:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3551:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3552:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,08h
    shl ebx,05h
    sub eax,ebx

eax * 3553:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 3559:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3561:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3567:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3568:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3569:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3573:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3575:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 3576:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*8]
    shl eax,03h
    sub eax,ebx

eax * 3577:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 3579:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 3580:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*4]
    shl eax,03h
    sub eax,ebx

eax * 3581:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 3582:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*2]
    shl eax,03h
    sub eax,ebx

eax * 3586:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*2]
    shl ebx,09h
    sub eax,ebx

eax * 3587:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 3588:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*4]
    shl ebx,09h
    sub eax,ebx

eax * 3589:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 3590:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 3591:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3592:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*8]
    shl ebx,09h
    sub eax,ebx

eax * 3593:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,09h
    sub eax,ebx

eax * 3595:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3599:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3600:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3601:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3607:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3609:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3615:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 3616:
    mov ebx,eax
    shl eax,05h
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3617:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3623:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3641:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3647:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 3648:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 3649:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3655:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3679:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3681:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3697:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3705:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3709:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 3711:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 3712:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,07h
    sub eax,ebx

eax * 3713:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 3715:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 3719:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3727:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3743:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3745:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3761:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3771:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3775:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3776:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,06h
    sub eax,ebx

eax * 3777:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 3781:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3791:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3793:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3799:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 3807:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 3808:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,05h
    sub eax,ebx

eax * 3809:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3817:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 3821:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3823:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3824:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,08h
    shl ebx,04h
    sub eax,ebx

eax * 3825:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3831:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 3832:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*8]
    shl eax,04h
    sub eax,ebx

eax * 3833:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3835:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 3836:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*4]
    shl eax,04h
    sub eax,ebx

eax * 3837:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 3838:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*2]
    shl eax,04h
    sub eax,ebx

eax * 3842:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*2]
    shl ebx,08h
    sub eax,ebx

eax * 3843:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 3844:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*4]
    shl ebx,08h
    sub eax,ebx

eax * 3845:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 3847:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 3848:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*8]
    shl ebx,08h
    sub eax,ebx

eax * 3849:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 3851:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 3853:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 3854:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 3855:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3856:
    mov ebx,eax
    shl eax,04h
    shl ebx,08h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3857:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3859:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3863:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3865:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 3871:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3872:
    mov ebx,eax
    shl eax,05h
    shl ebx,08h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3873:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3887:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3889:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3901:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3903:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 3904:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,06h
    sub eax,ebx

eax * 3905:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 3907:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 3919:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3921:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3929:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3931:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 3933:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3935:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3936:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,05h
    sub eax,ebx

eax * 3937:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    mov ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 3941:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 3943:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 3951:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3952:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,04h
    sub eax,ebx

eax * 3953:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3959:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 3960:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*8]
    shl eax,05h
    sub eax,ebx

eax * 3961:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 3963:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 3964:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*4]
    shl eax,05h
    sub eax,ebx

eax * 3965:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 3966:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*2]
    shl eax,05h
    sub eax,ebx

eax * 3970:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*2]
    shl ebx,07h
    sub eax,ebx

eax * 3971:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 3972:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*4]
    shl ebx,07h
    sub eax,ebx

eax * 3973:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 3975:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,03h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 3976:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*8]
    shl ebx,07h
    sub eax,ebx

eax * 3977:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 3983:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 3984:
    mov ebx,eax
    shl eax,04h
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 3985:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 3991:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 3995:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 3997:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 3998:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 3999:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    mov ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4000:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,05h
    sub eax,ebx

eax * 4001:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4003:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 4007:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4011:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 4015:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 4016:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,04h
    sub eax,ebx

eax * 4017:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 4021:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 4023:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 4024:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,03h
    sub eax,ebx

eax * 4025:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 4027:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 4028:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*4]
    shl eax,06h
    sub eax,ebx

eax * 4029:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 4030:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*2]
    shl eax,06h
    sub eax,ebx

eax * 4034:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*2]
    shl ebx,06h
    sub eax,ebx

eax * 4035:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 4036:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*4]
    shl ebx,06h
    sub eax,ebx

eax * 4037:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 4039:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,03h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 4040:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*8]
    shl ebx,06h
    sub eax,ebx

eax * 4041:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 4045:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 4047:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 4048:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,04h
    sub eax,ebx

eax * 4049:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 4051:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 4055:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4056:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,03h
    sub eax,ebx

eax * 4057:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 4059:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4060:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,02h
    sub eax,ebx

eax * 4061:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4062:
    mov ebx,eax
    shl eax,05h
    lea ebx,[eax+ebx*2]
    shl eax,07h
    sub eax,ebx

eax * 4066:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*2]
    shl ebx,05h
    sub eax,ebx

eax * 4067:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 4068:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*4]
    shl ebx,05h
    sub eax,ebx

eax * 4069:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 4071:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4072:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,03h
    sub eax,ebx

eax * 4073:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 4075:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4076:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,02h
    sub eax,ebx

eax * 4077:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4078:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0ch
    sub eax,ebx

eax * 4082:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+ebx*2]
    shl ebx,04h
    sub eax,ebx

eax * 4083:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4084:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,02h
    sub eax,ebx

eax * 4085:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4086:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0ch
    sub eax,ebx

eax * 4090:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0ch
    sub eax,ebx

eax * 4102:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+ebx*2]

eax * 4106:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+ebx*2]

eax * 4107:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 4108:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+ebx*4]

eax * 4109:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 4110:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4114:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+ebx*2]

eax * 4115:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4116:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+ebx*4]

eax * 4117:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4119:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    sub eax,ebx

eax * 4120:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+ebx*8]

eax * 4121:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4123:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 4124:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4125:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 4126:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4130:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4131:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4132:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+ebx*4]

eax * 4133:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4135:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4136:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+ebx*8]

eax * 4137:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4141:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4143:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 4144:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,04h
    add eax,ebx

eax * 4145:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 4147:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4151:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*8]
    sub eax,ebx

eax * 4152:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 4153:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4155:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 4156:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4157:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 4158:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4162:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4163:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 4164:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4165:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 4167:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 4168:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+ebx*8]

eax * 4169:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 4171:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4175:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 4176:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,04h
    add eax,ebx

eax * 4177:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 4181:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4183:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4187:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4189:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4190:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4191:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    mov ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 4192:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,05h
    add eax,ebx

eax * 4193:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4195:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4199:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4201:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,04h
    add eax,ebx

eax * 4207:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4208:
    mov ebx,eax
    shl eax,04h
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4209:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4215:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*8]
    sub eax,ebx

eax * 4216:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 4217:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4219:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 4220:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4221:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 4222:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4226:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4227:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4228:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4229:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4231:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4232:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 4233:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4239:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4240:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,04h
    add eax,ebx

eax * 4241:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4249:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4251:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4255:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4256:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,05h
    add eax,ebx

eax * 4257:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    mov ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4258:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4259:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4261:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4265:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4271:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4273:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4285:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 4287:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 4288:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,06h
    add eax,ebx

eax * 4289:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4291:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 4303:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4305:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4313:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4319:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4320:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 4321:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4327:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4331:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4333:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4334:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4335:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 4336:
    mov ebx,eax
    shl eax,04h
    shl ebx,08h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4337:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 4339:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 4343:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4344:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 4345:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4347:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 4348:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4349:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 4350:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4354:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4355:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 4356:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4357:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 4359:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4360:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 4361:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 4367:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4368:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl ebx,08h
    add eax,ebx

eax * 4369:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4370:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4371:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4373:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4375:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4377:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4383:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4384:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    shl ebx,05h
    add eax,ebx

eax * 4385:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4393:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4399:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4400:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 4401:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4411:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 4415:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4416:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,06h
    add eax,ebx

eax * 4417:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4421:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 4432:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 4433:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4447:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4448:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 4449:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4463:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4464:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 4471:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4477:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4479:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 4480:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,07h
    add eax,ebx

eax * 4481:
    mov ebx,eax
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 4483:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4489:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4496:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,08h
    add eax,ebx

eax * 4497:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4511:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4512:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 4513:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 4528:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 4535:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4536:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 4537:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 4543:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ch
    add eax,ebx

eax * 4544:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub eax,ebx

eax * 4545:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 4551:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 4553:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4560:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 4561:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4567:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4568:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 4572:
    lea ebx,[eax+eax*8]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 4575:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ch
    add eax,ebx

eax * 4576:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 4577:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4583:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4584:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 4585:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4588:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 4590:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 4591:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4592:
    mov ebx,eax
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 4593:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4594:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4595:
    lea ebx,[eax*4+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4596:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 4597:
    lea ebx,[eax*2+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4598:
    mov ebx,eax
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 4599:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    lea eax,[eax+eax*8]

eax * 4600:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 4601:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,03h
    add eax,ebx

eax * 4602:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 4603:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 4604:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 4605:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 4606:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 4610:
    lea ebx,[eax+eax*8]
    add eax,eax
    shl ebx,09h
    add eax,ebx

eax * 4611:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 4612:
    lea ebx,[eax+eax*8]
    shl eax,02h
    shl ebx,09h
    add eax,ebx

eax * 4613:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 4614:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,09h
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 4615:
    lea ebx,[eax+eax*8]
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4616:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+ebx*8]

eax * 4617:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[ebx+ebx*8]

eax * 4618:
    lea ebx,[eax+eax*8]
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4619:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4620:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 4621:
    lea ebx,[eax+eax*8]
    shl eax,02h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4622:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 4623:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4624:
    lea ebx,[eax+eax*8]
    shl eax,04h
    shl ebx,09h
    add eax,ebx

eax * 4625:
    lea ebx,[eax+eax*8]
    shl eax,03h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4626:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 4628:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 4631:
    lea ebx,[eax+eax*8]
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4632:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 4633:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4639:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 4640:
    lea ebx,[eax+eax*8]
    shl eax,05h
    shl ebx,09h
    add eax,ebx

eax * 4641:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 4644:
    lea ebx,[eax+eax*8]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 4648:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 4649:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4656:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 4657:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 4663:
    lea ebx,[eax+eax*8]
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4671:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 4672:
    lea ebx,[eax+eax*8]
    shl eax,06h
    shl ebx,09h
    add eax,ebx

eax * 4673:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 4680:
    lea ebx,[eax+eax*8]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 4681:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4688:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 4703:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4704:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 4727:
    lea ebx,[eax+eax*8]
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4731:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4735:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 4736:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    shl ebx,07h
    add eax,ebx

eax * 4737:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 4741:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 4745:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4752:
    lea ebx,[eax+eax*8]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 4768:
    lea ebx,[eax+eax*4]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 4769:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4800:
    lea ebx,[eax+eax*2]
    shl eax,09h
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 4832:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 4847:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4849:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4855:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4859:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 4861:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4863:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 4864:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    shl ebx,08h
    add eax,ebx

eax * 4865:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 4867:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 4869:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 4873:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 4879:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 4880:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add eax,ebx

eax * 4881:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 4896:
    lea ebx,[eax+eax*8]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 4928:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub eax,ebx

eax * 4960:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 4961:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4976:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 4985:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 4987:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 4991:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0ch
    add eax,ebx

eax * 4992:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,07h
    sub eax,ebx

eax * 4993:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 4997:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 4999:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 5023:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 5024:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 5040:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 5041:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 5048:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 5051:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5055:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0ch
    add eax,ebx

eax * 5056:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub eax,ebx

eax * 5057:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 5061:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5071:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 5072:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 5080:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 5083:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5084:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 5087:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0ch
    add eax,ebx

eax * 5088:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 5089:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 5093:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5096:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 5099:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5100:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 5102:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 5103:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0ch
    add eax,ebx

eax * 5104:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 5105:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 5106:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5107:
    lea ebx,[eax*8+0h]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5108:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 5109:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5110:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 5111:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 5112:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 5113:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5114:
    mov ebx,eax
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 5115:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    lea eax,[eax+eax*4]

eax * 5116:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 5117:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 5118:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 5122:
    lea ebx,[eax+eax*4]
    add eax,eax
    shl ebx,0ah
    add eax,ebx

eax * 5123:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 5124:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[eax+ebx*4]

eax * 5125:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 5126:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5127:
    lea ebx,[eax+eax*4]
    add eax,eax
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5128:
    lea ebx,[eax+eax*4]
    shl eax,03h
    shl ebx,0ah
    add eax,ebx

eax * 5129:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 5130:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 5131:
    lea ebx,[eax+eax*4]
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5132:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,02h
    add eax,ebx

eax * 5133:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5134:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5135:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5136:
    lea ebx,[eax+eax*4]
    shl eax,04h
    shl ebx,0ah
    add eax,ebx

eax * 5137:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5138:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 5140:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 5141:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5144:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 5147:
    lea ebx,[eax+eax*4]
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5151:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5152:
    lea ebx,[eax+eax*4]
    shl eax,05h
    shl ebx,0ah
    add eax,ebx

eax * 5153:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5156:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 5157:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5160:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 5167:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 5168:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 5179:
    lea ebx,[eax+eax*4]
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5183:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5184:
    lea ebx,[eax+eax*4]
    shl eax,06h
    shl ebx,0ah
    add eax,ebx

eax * 5185:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 5189:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5192:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 5200:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 5201:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 5215:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 5216:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 5239:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 5243:
    lea ebx,[eax+eax*4]
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5247:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5248:
    lea ebx,[eax+eax*4]
    shl eax,07h
    shl ebx,0ah
    add eax,ebx

eax * 5249:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 5253:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5257:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 5264:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 5280:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 5281:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 5312:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 5359:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 5371:
    lea ebx,[eax+eax*4]
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5375:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5376:
    lea ebx,[eax+eax*4]
    shl eax,08h
    shl ebx,0ah
    add eax,ebx

eax * 5377:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 5381:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5392:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 5393:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 5408:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 5440:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 5504:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 5568:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 5617:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 5623:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 5625:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 5627:
    lea ebx,[eax+eax*4]
    shl eax,09h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5629:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 5631:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 5632:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl eax,09h

eax * 5633:
    mov ebx,eax
    shl eax,09h
    lea ebx,[ebx+eax*2]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 5634:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    add ebx,ebx
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 5635:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 5637:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 5639:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 5640:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,03h
    add eax,ebx

eax * 5641:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 5647:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 5696:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 5760:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub eax,ebx

eax * 5824:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 5856:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 5857:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 5873:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 5879:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 5881:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 5885:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,08h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 5887:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 5888:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,08h
    sub eax,ebx

eax * 5889:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 5891:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,08h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 5895:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 5897:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 5903:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 5919:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 5952:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 5953:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 5984:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 5985:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 5999:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 6000:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 6001:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 6013:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,07h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6015:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 6016:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub eax,ebx

eax * 6017:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 6019:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6031:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 6033:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 6047:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 6048:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 6049:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 6064:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 6072:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 6077:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6079:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 6080:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 6081:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 6083:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6096:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 6104:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 6108:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 6109:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6111:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 6112:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 6113:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 6115:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6120:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 6124:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 6125:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6126:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0bh
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 6127:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 6128:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 6129:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 6131:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 6132:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 6133:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 6134:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0bh
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 6135:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 6136:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*8]

eax * 6137:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 6138:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0bh
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 6139:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 6140:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*4]

eax * 6141:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 6142:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,0ch
    lea eax,[ebx+eax*2]

eax * 6146:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 6147:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 6148:
    lea ebx,[eax+eax*2]
    shl eax,02h
    shl ebx,0bh
    add eax,ebx

eax * 6149:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6150:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 6151:
    lea ebx,[eax+eax*2]
    shl eax,02h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6152:
    lea ebx,[eax+eax*2]
    shl eax,03h
    shl ebx,0bh
    add eax,ebx

eax * 6153:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 6154:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6155:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6156:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 6157:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6159:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6160:
    lea ebx,[eax+eax*2]
    shl eax,04h
    shl ebx,0bh
    add eax,ebx

eax * 6161:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6162:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 6163:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6164:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6168:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 6173:
    lea ebx,[eax+eax*2]
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6175:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6176:
    lea ebx,[eax+eax*2]
    shl eax,05h
    shl ebx,0bh
    add eax,ebx

eax * 6177:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6179:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6180:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 6184:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6192:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 6205:
    lea ebx,[eax+eax*2]
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6207:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6208:
    lea ebx,[eax+eax*2]
    shl eax,06h
    shl ebx,0bh
    add eax,ebx

eax * 6209:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6211:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6216:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 6224:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6239:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 6240:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 6241:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 6255:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 6257:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 6269:
    lea ebx,[eax+eax*2]
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6271:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6272:
    lea ebx,[eax+eax*2]
    shl eax,07h
    shl ebx,0bh
    add eax,ebx

eax * 6273:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6275:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6288:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 6289:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 6304:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6305:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 6336:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 6337:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 6367:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 6383:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 6391:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 6393:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 6397:
    lea ebx,[eax+eax*2]
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6399:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6400:
    lea ebx,[eax+eax*2]
    shl eax,08h
    shl ebx,0bh
    add eax,ebx

eax * 6401:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6403:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6409:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 6416:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 6417:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 6432:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 6433:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 6464:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6528:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 6639:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 6641:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 6647:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 6649:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 6651:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 6653:
    lea ebx,[eax+eax*2]
    shl eax,09h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6655:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 6656:
    lea ebx,[eax+eax*2]
    shl eax,09h
    shl ebx,0bh
    add eax,ebx

eax * 6657:
    mov ebx,eax
    shl eax,09h
    lea ebx,[ebx+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 6659:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 6660:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 6661:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 6663:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 6664:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 6665:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 6671:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 6673:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 6720:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 6784:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 6881:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 6905:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 6907:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 6911:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 6912:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,08h
    sub eax,ebx

eax * 6913:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 6917:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 6919:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 6943:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 6977:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7031:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 7033:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7039:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7040:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,07h
    sub eax,ebx

eax * 7041:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 7047:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7049:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 7087:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 7097:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7103:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7104:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    shl ebx,06h
    sub eax,ebx

eax * 7105:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 7111:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7121:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 7129:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7135:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7136:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,08h
    shl ebx,05h
    sub eax,ebx

eax * 7137:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7143:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7145:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7151:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7152:
    mov ebx,eax
    shl eax,04h
    shl ebx,0ah
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7153:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7157:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7159:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 7160:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[eax+ebx*8]
    shl eax,03h
    sub eax,ebx

eax * 7161:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 7163:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 7164:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[eax+ebx*4]
    shl eax,03h
    sub eax,ebx

eax * 7165:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 7166:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[eax+ebx*2]
    shl eax,03h
    sub eax,ebx

eax * 7170:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]
    shl ebx,0ah
    sub eax,ebx

eax * 7171:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 7172:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*4]
    shl ebx,0ah
    sub eax,ebx

eax * 7173:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 7174:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 7175:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7176:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*8]
    shl ebx,0ah
    sub eax,ebx

eax * 7177:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl eax,0ah
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 7179:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7183:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7184:
    mov ebx,eax
    shl eax,04h
    shl ebx,0ah
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7185:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7191:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7193:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7199:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7200:
    mov ebx,eax
    shl eax,05h
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7201:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7207:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7217:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 7225:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7231:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7232:
    mov ebx,eax
    shl eax,06h
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7233:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7239:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7289:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7295:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 7296:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 7297:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7303:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7361:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7391:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7393:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7409:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7417:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7421:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 7423:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7424:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,08h
    sub eax,ebx

eax * 7425:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 7427:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 7431:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7439:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7455:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7457:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7489:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7537:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7547:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 7551:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7552:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,07h
    sub eax,ebx

eax * 7553:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 7557:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 7567:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7601:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7607:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 7615:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7616:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,06h
    sub eax,ebx

eax * 7617:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 7625:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 7631:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7633:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7647:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7648:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    shl ebx,05h
    sub eax,ebx

eax * 7649:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7657:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7661:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7663:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7664:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7665:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7671:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 7672:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*8]
    shl eax,04h
    sub eax,ebx

eax * 7673:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7675:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 7676:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*4]
    shl eax,04h
    sub eax,ebx

eax * 7677:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 7678:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*2]
    shl eax,04h
    sub eax,ebx

eax * 7682:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]
    shl ebx,09h
    sub eax,ebx

eax * 7683:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 7684:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*4]
    shl ebx,09h
    sub eax,ebx

eax * 7685:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 7687:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 7688:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*8]
    shl ebx,09h
    sub eax,ebx

eax * 7689:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 7691:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 7693:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 7694:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 7695:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7696:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7697:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7699:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7703:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7711:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7712:
    mov ebx,eax
    shl eax,05h
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7713:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7727:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7729:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7737:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 7743:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7744:
    mov ebx,eax
    shl eax,06h
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7745:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7759:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7777:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7793:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7805:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 7807:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 7808:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,07h
    sub eax,ebx

eax * 7809:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 7811:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 7823:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7839:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7841:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7867:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 7871:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7872:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,06h
    sub eax,ebx

eax * 7873:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7877:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 7889:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7895:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7897:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7901:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7903:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7904:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,05h
    sub eax,ebx

eax * 7905:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7913:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7919:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7920:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    shl ebx,04h
    sub eax,ebx

eax * 7921:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7927:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7928:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*8]
    shl eax,05h
    sub eax,ebx

eax * 7929:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7931:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7932:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*4]
    shl eax,05h
    sub eax,ebx

eax * 7933:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7934:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*2]
    shl eax,05h
    sub eax,ebx

eax * 7938:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]
    shl ebx,08h
    sub eax,ebx

eax * 7939:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 7940:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*4]
    shl ebx,08h
    sub eax,ebx

eax * 7941:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 7943:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,03h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 7944:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*8]
    shl ebx,08h
    sub eax,ebx

eax * 7945:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 7951:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 7952:
    mov ebx,eax
    shl eax,04h
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 7953:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 7959:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7961:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 7963:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7965:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7966:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 7967:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    add eax,ebx

eax * 7968:
    mov ebx,eax
    shl eax,05h
    shl ebx,08h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 7969:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 7971:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 7975:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 7983:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 7985:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7993:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 7997:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 7999:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 8000:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,06h
    sub eax,ebx

eax * 8001:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    mov ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 8003:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 8027:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 8031:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 8032:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,05h
    sub eax,ebx

eax * 8033:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8037:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 8039:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8047:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 8048:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,04h
    sub eax,ebx

eax * 8049:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 8055:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 8056:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*8]
    shl eax,06h
    sub eax,ebx

eax * 8057:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8059:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 8060:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*4]
    shl eax,06h
    sub eax,ebx

eax * 8061:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 8062:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*2]
    shl eax,06h
    sub eax,ebx

eax * 8066:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]
    shl ebx,07h
    sub eax,ebx

eax * 8067:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 8068:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*4]
    shl ebx,07h
    sub eax,ebx

eax * 8069:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 8071:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,03h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8072:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*8]
    shl ebx,07h
    sub eax,ebx

eax * 8073:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 8079:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 8080:
    mov ebx,eax
    shl eax,04h
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8081:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 8093:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 8095:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 8096:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,05h
    sub eax,ebx

eax * 8097:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 8099:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 8107:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8111:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 8112:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,04h
    sub eax,ebx

eax * 8113:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 8117:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8119:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 8120:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,03h
    sub eax,ebx

eax * 8121:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 8123:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 8124:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*4]
    shl eax,07h
    sub eax,ebx

eax * 8125:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 8126:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*2]
    shl eax,07h
    sub eax,ebx

eax * 8130:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]
    shl ebx,06h
    sub eax,ebx

eax * 8131:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 8132:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*4]
    shl ebx,06h
    sub eax,ebx

eax * 8133:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 8135:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8136:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*8]
    shl ebx,06h
    sub eax,ebx

eax * 8137:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 8141:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8143:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 8144:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,04h
    sub eax,ebx

eax * 8145:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 8147:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 8151:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8152:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,03h
    sub eax,ebx

eax * 8153:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,02h
    sub eax,ebx

eax * 8155:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8156:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,02h
    sub eax,ebx

eax * 8157:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8158:
    mov ebx,eax
    shl eax,05h
    lea ebx,[eax+ebx*2]
    shl eax,08h
    sub eax,ebx

eax * 8162:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]
    shl ebx,05h
    sub eax,ebx

eax * 8163:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 8164:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*4]
    shl ebx,05h
    sub eax,ebx

eax * 8165:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 8167:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8168:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,03h
    sub eax,ebx

eax * 8169:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 8171:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8172:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,02h
    sub eax,ebx

eax * 8173:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8174:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0dh
    sub eax,ebx

eax * 8178:
    mov ebx,eax
    shl eax,0dh
    lea eax,[eax+ebx*2]
    shl ebx,04h
    sub eax,ebx

eax * 8179:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 8180:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,02h
    sub eax,ebx

eax * 8181:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 8182:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0dh
    sub eax,ebx

eax * 8186:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0dh
    sub eax,ebx

eax * 8198:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    lea eax,[eax+ebx*2]

eax * 8202:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    lea eax,[eax+ebx*2]

eax * 8203:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8204:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    lea eax,[eax+ebx*4]

eax * 8205:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 8206:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8210:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    lea eax,[eax+ebx*2]

eax * 8211:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8212:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    lea eax,[eax+ebx*4]

eax * 8213:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8215:
    lea ebx,[eax+eax*8]
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8216:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    lea eax,[eax+ebx*8]

eax * 8217:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8219:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8220:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8221:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 8222:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8226:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8227:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8228:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    lea eax,[eax+ebx*4]

eax * 8229:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8231:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 8232:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    lea eax,[eax+ebx*8]

eax * 8233:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8237:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8239:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8240:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,04h
    add eax,ebx

eax * 8241:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8243:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8247:
    lea ebx,[eax+eax*8]
    shl eax,06h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8248:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 8249:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 8251:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 8252:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8253:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 8254:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8258:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8259:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8260:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8261:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8263:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 8264:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    lea eax,[eax+ebx*8]

eax * 8265:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8267:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8271:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 8272:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,04h
    add eax,ebx

eax * 8273:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 8277:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8285:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8287:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8288:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,05h
    add eax,ebx

eax * 8289:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8291:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8297:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,04h
    add eax,ebx

eax * 8303:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 8304:
    mov ebx,eax
    shl eax,04h
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8305:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 8311:
    lea ebx,[eax+eax*8]
    shl eax,07h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8312:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 8313:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 8315:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 8316:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8317:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 8318:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8322:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8323:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 8324:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8325:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 8327:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8328:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 8329:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 8335:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8336:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,04h
    add eax,ebx

eax * 8337:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8345:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8347:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8351:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8352:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,05h
    add eax,ebx

eax * 8353:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8357:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8381:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8383:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 8384:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,06h
    add eax,ebx

eax * 8385:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    mov ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8386:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8387:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8389:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8393:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8399:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8401:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8407:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8409:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 8411:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8413:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8414:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8415:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    mov ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 8416:
    mov ebx,eax
    shl eax,05h
    shl ebx,08h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8417:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 8419:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 8423:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 8431:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8432:
    mov ebx,eax
    shl eax,04h
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8433:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 8439:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8440:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 8441:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 8443:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 8444:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8445:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 8446:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8450:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8451:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 8452:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8453:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 8455:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8456:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 8457:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 8463:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8464:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,09h
    shl ebx,04h
    add eax,ebx

eax * 8465:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8471:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8479:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 8480:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,05h
    add eax,ebx

eax * 8481:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    mov ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8482:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8483:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8485:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8489:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 8497:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8507:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8511:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8512:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,06h
    add eax,ebx

eax * 8513:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 8517:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8543:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8544:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,08h
    add eax,ebx

eax * 8545:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 8559:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8573:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 8575:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8576:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,07h
    add eax,ebx

eax * 8577:
    mov ebx,eax
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8579:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 8593:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8608:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 8609:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8623:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8633:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 8639:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 8640:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub eax,ebx

eax * 8641:
    mov ebx,eax
    shl eax,07h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8647:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 8655:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8657:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8671:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8672:
    mov ebx,eax
    shl eax,05h
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8673:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 8679:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8683:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8685:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8686:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8687:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 8688:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8689:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 8691:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 8695:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,0dh
    add eax,ebx

eax * 8696:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 8697:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,03h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 8699:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*4]
    sub eax,ebx

eax * 8700:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8701:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*2]
    sub eax,ebx

eax * 8702:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8706:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 8707:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 8708:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 8709:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 8711:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8712:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 8713:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add ebx,eax
    shl eax,04h
    add eax,ebx

eax * 8719:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 8720:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl ebx,09h
    add eax,ebx

eax * 8721:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    mov ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8722:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8723:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8725:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8729:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8735:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8736:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    shl ebx,09h
    add eax,ebx

eax * 8737:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 8751:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8752:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,09h
    add eax,ebx

eax * 8753:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 8759:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8767:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8768:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    shl ebx,06h
    add eax,ebx

eax * 8769:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8777:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 8784:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,09h
    add eax,ebx

eax * 8785:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8815:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8827:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 8831:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8832:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,07h
    add eax,ebx

eax * 8833:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8837:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 8848:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,09h
    add eax,ebx

eax * 8849:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8896:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub eax,ebx

eax * 8897:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 8927:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8928:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 8929:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8943:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8951:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,08h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 8957:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 8959:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 8960:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,08h
    add eax,ebx

eax * 8961:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,09h
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 8963:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 8969:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,08h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 8977:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 8991:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 8992:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    add eax,ebx

eax * 8993:
    mov ebx,eax
    shl eax,08h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 9024:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub eax,ebx

eax * 9025:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 9056:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 9072:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 9079:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,07h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9081:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 9087:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 9088:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,07h
    sub eax,ebx

eax * 9089:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,07h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 9095:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 9097:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9120:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 9136:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 9137:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 9143:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9144:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 9151:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 9152:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub eax,ebx

eax * 9153:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 9161:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,06h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9167:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 9168:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 9175:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9176:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 9180:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 9183:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 9184:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub eax,ebx

eax * 9185:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 9191:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9192:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,03h
    sub eax,ebx

eax * 9193:
    mov ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,05h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9196:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 9198:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 9199:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 9200:
    mov ebx,eax
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,04h
    sub eax,ebx

eax * 9201:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 9202:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9203:
    lea ebx,[eax*4+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9204:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,02h
    sub eax,ebx

eax * 9205:
    lea ebx,[eax*2+0h]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9206:
    mov ebx,eax
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 9207:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    lea eax,[eax+eax*8]

eax * 9208:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 9209:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,03h
    add eax,ebx

eax * 9210:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 9211:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 9212:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 9213:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    sub eax,ebx

eax * 9214:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 9218:
    lea ebx,[eax+eax*8]
    add eax,eax
    shl ebx,0ah
    add eax,ebx

eax * 9219:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*2]
    shl ebx,0ah
    add eax,ebx

eax * 9220:
    lea ebx,[eax+eax*8]
    shl eax,02h
    shl ebx,0ah
    add eax,ebx

eax * 9221:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    shl ebx,0ah
    add eax,ebx

eax * 9222:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0ah
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 9223:
    lea ebx,[eax+eax*8]
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9224:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[eax+ebx*8]

eax * 9225:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[ebx+ebx*8]

eax * 9226:
    lea ebx,[eax+eax*8]
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9227:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9228:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 9229:
    lea ebx,[eax+eax*8]
    shl eax,02h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9230:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 9231:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9232:
    lea ebx,[eax+eax*8]
    shl eax,04h
    shl ebx,0ah
    add eax,ebx

eax * 9233:
    lea ebx,[eax+eax*8]
    shl eax,03h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9234:
    lea ebx,[eax+eax*8]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 9236:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 9239:
    lea ebx,[eax+eax*8]
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9240:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 9241:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9247:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9248:
    lea ebx,[eax+eax*8]
    shl eax,05h
    shl ebx,0ah
    add eax,ebx

eax * 9249:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9252:
    lea ebx,[eax+eax*8]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 9256:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,03h
    add eax,ebx

eax * 9257:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9263:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 9264:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 9271:
    lea ebx,[eax+eax*8]
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9279:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 9280:
    lea ebx,[eax+eax*8]
    shl eax,06h
    shl ebx,0ah
    add eax,ebx

eax * 9281:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,05h
    add eax,ebx

eax * 9288:
    lea ebx,[eax+eax*8]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 9289:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9296:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 9297:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 9312:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 9335:
    lea ebx,[eax+eax*8]
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9343:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9344:
    lea ebx,[eax+eax*8]
    shl eax,07h
    shl ebx,0ah
    add eax,ebx

eax * 9345:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9353:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9360:
    lea ebx,[eax+eax*8]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 9376:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,05h
    add eax,ebx

eax * 9408:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 9409:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 9439:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 9463:
    lea ebx,[eax+eax*8]
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9467:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 9471:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9472:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    shl ebx,08h
    add eax,ebx

eax * 9473:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9477:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 9481:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9504:
    lea ebx,[eax+eax*8]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 9505:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 9536:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,06h
    add eax,ebx

eax * 9600:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    lea eax,[eax+eax*8]
    shl ebx,07h
    add eax,ebx

eax * 9664:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub eax,ebx

eax * 9711:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 9713:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 9719:
    lea ebx,[eax+eax*8]
    shl eax,09h
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9723:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,09h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 9725:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 9727:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,09h
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 9728:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    shl ebx,09h
    add eax,ebx

eax * 9729:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx
    shl ebx,03h
    add eax,ebx

eax * 9731:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 9733:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,09h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 9737:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 9743:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 9744:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add eax,ebx

eax * 9745:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,04h
    add eax,ebx

eax * 9792:
    lea ebx,[eax+eax*8]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,0ah
    add eax,ebx

eax * 9856:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,07h
    sub eax,ebx

eax * 9920:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub eax,ebx

eax * 9952:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 9953:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 9977:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 9979:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 9983:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 9984:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,08h
    sub eax,ebx

eax * 9985:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,08h
    sub eax,ebx
    shl ebx,05h
    add eax,ebx

eax * 9989:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,08h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 9991:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 10015:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 10048:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub eax,ebx

eax * 10049:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 10080:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 10096:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 10097:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 10107:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10111:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 10112:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,07h
    sub eax,ebx

eax * 10113:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,07h
    sub eax,ebx
    shl ebx,06h
    add eax,ebx

eax * 10117:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,07h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10127:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 10144:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 10145:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 10160:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 10168:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 10171:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10175:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 10176:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub eax,ebx

eax * 10177:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,06h
    sub eax,ebx
    shl ebx,07h
    add eax,ebx

eax * 10181:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,06h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10192:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 10200:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 10203:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10204:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 10207:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 10208:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub eax,ebx

eax * 10209:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,05h
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 10213:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,05h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10216:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,03h
    sub eax,ebx

eax * 10219:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10220:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 10222:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0bh
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 10223:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0dh
    add eax,ebx

eax * 10224:
    mov ebx,eax
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub eax,ebx

eax * 10225:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,04h
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 10226:
    lea ebx,[eax+eax*8]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10227:
    lea ebx,[eax*8+0h]
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10228:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,02h
    sub eax,ebx

eax * 10229:
    mov ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10230:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0bh
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 10231:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 10232:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 10233:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10234:
    mov ebx,eax
    lea eax,[eax+eax*4]
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 10235:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    lea eax,[eax+eax*4]

eax * 10236:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 10237:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    sub eax,ebx

eax * 10238:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 10242:
    lea ebx,[eax+eax*4]
    add eax,eax
    shl ebx,0bh
    add eax,ebx

eax * 10243:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*2]
    shl ebx,0bh
    add eax,ebx

eax * 10244:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    lea eax,[eax+ebx*4]

eax * 10245:
    mov ebx,eax
    shl eax,0bh
    add ebx,eax
    lea eax,[ebx+ebx*4]

eax * 10246:
    lea ebx,[eax+eax*4]
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10247:
    lea ebx,[eax+eax*4]
    add eax,eax
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10248:
    lea ebx,[eax+eax*4]
    shl eax,03h
    shl ebx,0bh
    add eax,ebx

eax * 10249:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 10250:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 10251:
    lea ebx,[eax+eax*4]
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10252:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,02h
    add eax,ebx

eax * 10253:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10254:
    lea ebx,[eax+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10255:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10256:
    lea ebx,[eax+eax*4]
    shl eax,04h
    shl ebx,0bh
    add eax,ebx

eax * 10257:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10258:
    lea ebx,[eax+eax*4]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 10260:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 10261:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10264:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 10267:
    lea ebx,[eax+eax*4]
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10271:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 10272:
    lea ebx,[eax+eax*4]
    shl eax,05h
    shl ebx,0bh
    add eax,ebx

eax * 10273:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10276:
    lea ebx,[eax+eax*4]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 10277:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10280:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 10288:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 10299:
    lea ebx,[eax+eax*4]
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10303:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 10304:
    lea ebx,[eax+eax*4]
    shl eax,06h
    shl ebx,0bh
    add eax,ebx

eax * 10305:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10309:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10312:
    lea ebx,[eax+eax*4]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 10320:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 10336:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,05h
    add eax,ebx

eax * 10337:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,06h
    add eax,ebx

eax * 10351:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 10363:
    lea ebx,[eax+eax*4]
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10367:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10368:
    lea ebx,[eax+eax*4]
    shl eax,07h
    shl ebx,0bh
    add eax,ebx

eax * 10369:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10373:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10384:
    lea ebx,[eax+eax*4]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 10385:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 10400:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 10432:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,06h
    add eax,ebx

eax * 10433:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 10463:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 10487:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 10491:
    lea ebx,[eax+eax*4]
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10495:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10496:
    lea ebx,[eax+eax*4]
    shl eax,08h
    shl ebx,0bh
    add eax,ebx

eax * 10497:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10501:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10505:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,08h
    add eax,ebx

eax * 10528:
    lea ebx,[eax+eax*4]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 10529:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 10560:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 10624:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,07h
    add eax,ebx

eax * 10735:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 10747:
    lea ebx,[eax+eax*4]
    shl eax,09h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10751:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10752:
    lea ebx,[eax+eax*4]
    shl eax,09h
    shl ebx,0bh
    add eax,ebx

eax * 10753:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx
    shl ebx,02h
    add eax,ebx

eax * 10757:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 10768:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,04h
    add eax,ebx

eax * 10769:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 10816:
    lea ebx,[eax+eax*4]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 10880:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,0bh
    add eax,ebx

eax * 11008:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    lea eax,[eax+eax*4]
    shl ebx,08h
    add eax,ebx

eax * 11136:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub eax,ebx

eax * 11249:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 11255:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 11257:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 11259:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    sub eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 11261:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 11263:
    mov ebx,eax
    shl eax,0dh
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 11264:
    lea ebx,[eax+eax*8]
    add eax,eax
    add eax,ebx
    shl eax,0ah

eax * 11265:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[ebx+eax*2]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 11266:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    add ebx,ebx
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 11267:
    lea ebx,[eax+eax*2]
    shl eax,0dh
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 11269:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 11271:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 11272:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,03h
    add eax,ebx

eax * 11273:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 11279:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 11392:
    lea ebx,[eax+eax*4]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,0bh
    add eax,ebx

eax * 11520:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,08h
    sub eax,ebx

eax * 11648:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub eax,ebx

eax * 11712:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 11745:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 11761:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 11767:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    shl ebx,09h
    sub eax,ebx

eax * 11769:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 11773:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,09h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 11775:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 11776:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,09h
    sub eax,ebx

eax * 11777:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,09h
    sub eax,ebx

eax * 11779:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,09h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 11783:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 11791:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 11807:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 11904:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub eax,ebx

eax * 11968:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 11969:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 12000:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 12001:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12015:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 12017:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12029:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,08h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12031:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 12032:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,08h
    sub eax,ebx

eax * 12033:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 12035:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,08h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12047:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12063:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12095:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 12096:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 12097:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 12127:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 12128:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 12129:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 12144:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 12157:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,07h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12159:
    mov ebx,eax
    shl eax,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 12160:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub eax,ebx

eax * 12161:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 12163:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,07h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12191:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 12192:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 12208:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 12216:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 12221:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12223:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 12224:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub eax,ebx

eax * 12225:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 12227:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,06h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12240:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 12248:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 12252:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 12253:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12255:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 12256:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub eax,ebx

eax * 12257:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 12259:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,05h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12264:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,03h
    sub eax,ebx

eax * 12268:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 12269:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    add ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12270:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0ch
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 12271:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 12272:
    mov ebx,eax
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub eax,ebx

eax * 12273:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    add eax,eax
    add eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 12275:
    mov ebx,eax
    lea eax,[eax+eax*2]
    shl ebx,04h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 12276:
    lea ebx,[eax+eax*2]
    shl eax,0ch
    lea eax,[eax+eax*2]
    shl ebx,02h
    sub eax,ebx

eax * 12277:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,02h
    sub eax,ebx

eax * 12278:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0ch
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 12279:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 12280:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*8]

eax * 12281:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 12282:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0ch
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 12283:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    lea eax,[eax+eax*2]
    sub eax,ebx

eax * 12284:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*4]

eax * 12285:
    mov ebx,eax
    shl eax,0ch
    sub eax,ebx
    lea eax,[eax+eax*2]

eax * 12286:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    shl ebx,0dh
    lea eax,[ebx+eax*2]

eax * 12290:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    lea eax,[eax+ebx*2]

eax * 12291:
    mov ebx,eax
    shl eax,0ch
    add ebx,eax
    lea eax,[ebx+ebx*2]

eax * 12292:
    lea ebx,[eax+eax*2]
    shl eax,02h
    shl ebx,0ch
    add eax,ebx

eax * 12293:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 12294:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 12295:
    lea ebx,[eax+eax*2]
    shl eax,02h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12296:
    lea ebx,[eax+eax*2]
    shl eax,03h
    shl ebx,0ch
    add eax,ebx

eax * 12297:
    lea ebx,[eax+eax*2]
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 12298:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 12299:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12300:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 12301:
    lea ebx,[eax+eax*2]
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12303:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12304:
    lea ebx,[eax+eax*2]
    shl eax,04h
    shl ebx,0ch
    add eax,ebx

eax * 12305:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12306:
    lea ebx,[eax+eax*2]
    add eax,eax
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 12307:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12308:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 12312:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 12317:
    lea ebx,[eax+eax*2]
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12319:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12320:
    lea ebx,[eax+eax*2]
    shl eax,05h
    shl ebx,0ch
    add eax,ebx

eax * 12321:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12323:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12324:
    lea ebx,[eax+eax*2]
    shl eax,02h
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 12328:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 12336:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 12349:
    lea ebx,[eax+eax*2]
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12351:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12352:
    lea ebx,[eax+eax*2]
    shl eax,06h
    shl ebx,0ch
    add eax,ebx

eax * 12353:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12355:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12360:
    lea ebx,[eax+eax*2]
    shl eax,03h
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 12368:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 12383:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 12384:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 12413:
    lea ebx,[eax+eax*2]
    shl eax,07h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12415:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12416:
    lea ebx,[eax+eax*2]
    shl eax,07h
    shl ebx,0ch
    add eax,ebx

eax * 12417:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12419:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12432:
    lea ebx,[eax+eax*2]
    shl eax,04h
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 12448:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 12449:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 12479:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 12480:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 12481:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,07h
    add eax,ebx

eax * 12511:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12527:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12541:
    lea ebx,[eax+eax*2]
    shl eax,08h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12543:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12544:
    lea ebx,[eax+eax*2]
    shl eax,08h
    shl ebx,0ch
    add eax,ebx

eax * 12545:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12547:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12561:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0dh
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12576:
    lea ebx,[eax+eax*2]
    shl eax,05h
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 12577:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 12608:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 12672:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 12767:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 12783:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 12791:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    sub eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 12797:
    lea ebx,[eax+eax*2]
    shl eax,09h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12799:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12800:
    lea ebx,[eax+eax*2]
    shl eax,09h
    shl ebx,0ch
    add eax,ebx

eax * 12801:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 12803:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 12809:
    lea ebx,[eax+eax*8]
    shl eax,0dh
    add eax,ebx
    shl ebx,09h
    add eax,ebx

eax * 12816:
    mov ebx,eax
    shl eax,09h
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,04h
    add eax,ebx

eax * 12817:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0ch
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 12864:
    lea ebx,[eax+eax*2]
    shl eax,06h
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 12928:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 13056:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*2]
    shl ebx,0ch
    add eax,ebx

eax * 13295:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,0ch
    sub ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 13297:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 13303:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 13305:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 13307:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    sub eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 13309:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 13311:
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,0ch
    add eax,ebx
    add ebx,ebx
    add eax,ebx

eax * 13312:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    shl ebx,0ch
    add eax,ebx

eax * 13313:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[ebx+eax*4]
    lea eax,[eax+eax*8]
    add eax,ebx

eax * 13315:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 13316:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[eax+eax*8]
    shl ebx,02h
    add eax,ebx

eax * 13317:
    lea ebx,[eax+eax*4]
    shl eax,0dh
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 13319:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 13320:
    mov ebx,eax
    shl eax,0ah
    add ebx,eax
    lea eax,[eax+eax*4]
    shl ebx,03h
    add eax,ebx

eax * 13321:
    lea ebx,[eax+eax*8]
    shl eax,0ch
    add eax,ebx
    shl ebx,0ah
    add eax,ebx

eax * 13327:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 13440:
    lea ebx,[eax+eax*2]
    shl eax,07h
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 13568:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*4]
    shl ebx,0ch
    add eax,ebx

eax * 13793:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 13817:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 13819:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx
    shl ebx,09h
    sub eax,ebx

eax * 13823:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 13824:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,09h
    sub eax,ebx

eax * 13831:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 13855:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 14017:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 14071:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 14073:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14079:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14080:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,08h
    sub eax,ebx

eax * 14081:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 14087:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14143:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 14191:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 14201:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14207:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14208:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    shl ebx,07h
    sub eax,ebx

eax * 14215:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14239:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 14265:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14271:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14272:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,09h
    shl ebx,06h
    sub eax,ebx

eax * 14279:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14297:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14303:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14304:
    mov ebx,eax
    shl eax,05h
    shl ebx,0bh
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 14311:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14313:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14319:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14320:
    mov ebx,eax
    shl eax,04h
    shl ebx,0bh
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 14321:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14325:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14327:
    lea ebx,[eax+eax*8]
    shl eax,0bh
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 14328:
    mov ebx,eax
    shl eax,0bh
    lea ebx,[eax+ebx*8]
    shl eax,03h
    sub eax,ebx

eax * 14329:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14331:
    lea ebx,[eax+eax*4]
    shl eax,0bh
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 14332:
    mov ebx,eax
    shl eax,0bh
    lea ebx,[eax+ebx*4]
    shl eax,03h
    sub eax,ebx

eax * 14333:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add ebx,eax
    shl eax,03h
    sub eax,ebx

eax * 14334:
    mov ebx,eax
    shl eax,0bh
    lea ebx,[eax+ebx*2]
    shl eax,03h
    sub eax,ebx

eax * 14337:
    mov ebx,eax
    shl ebx,0bh
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14338:
    mov ebx,eax
    add eax,eax
    shl ebx,0bh
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 14339:
    lea ebx,[eax+eax*2]
    shl eax,0bh
    add eax,ebx
    shl ebx,0ch
    add eax,ebx

eax * 14340:
    mov ebx,eax
    shl eax,02h
    shl ebx,0bh
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 14341:
    lea ebx,[eax+eax*4]
    shl eax,0ch
    add eax,ebx
    shl ebx,0bh
    add eax,ebx

eax * 14343:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    mov ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14344:
    mov ebx,eax
    shl eax,03h
    shl ebx,0bh
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 14345:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl eax,0bh
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 14347:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14351:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14352:
    mov ebx,eax
    shl eax,04h
    shl ebx,0bh
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 14353:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14359:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14361:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14367:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,0eh
    sub ebx,eax
    shl eax,05h
    add eax,ebx

eax * 14368:
    mov ebx,eax
    shl eax,05h
    shl ebx,0bh
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 14369:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14375:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14393:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14399:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,0eh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 14400:
    mov ebx,eax
    shl eax,06h
    shl ebx,0bh
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 14401:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14407:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14457:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14463:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,0eh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 14464:
    mov ebx,eax
    shl eax,07h
    shl ebx,0bh
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 14465:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14471:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14527:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 14585:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14591:
    mov ebx,eax
    shl eax,0bh
    add eax,ebx
    shl ebx,0eh
    sub ebx,eax
    shl eax,08h
    add eax,ebx

eax * 14592:
    lea ebx,[eax+eax*2]
    shl eax,08h
    lea eax,[eax+eax*8]
    shl ebx,0ch
    add eax,ebx

eax * 14593:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14599:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14815:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 14817:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 14833:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 14841:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14845:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    sub eax,ebx
    shl ebx,09h
    sub eax,ebx

eax * 14847:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14848:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,09h
    sub eax,ebx

eax * 14849:
    mov ebx,eax
    shl eax,09h
    add eax,ebx
    shl ebx,0bh
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 14855:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 14863:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 14879:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15041:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 15089:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15099:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 15103:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15104:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,08h
    sub eax,ebx

eax * 15105:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 15119:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15167:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 15217:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15223:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 15231:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15232:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,07h
    sub eax,ebx

eax * 15247:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15279:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 15281:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15295:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 15296:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    shl ebx,06h
    sub eax,ebx

eax * 15311:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15313:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15327:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15328:
    mov ebx,eax
    shl eax,05h
    add ebx,eax
    shl eax,09h
    shl ebx,05h
    sub eax,ebx

eax * 15329:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15337:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15341:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15343:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15344:
    mov ebx,eax
    shl eax,04h
    shl ebx,0ah
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15345:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15351:
    lea ebx,[eax+eax*8]
    shl eax,0ah
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 15352:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[eax+ebx*8]
    shl eax,04h
    sub eax,ebx

eax * 15353:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 15355:
    lea ebx,[eax+eax*4]
    shl eax,0ah
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 15356:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[eax+ebx*4]
    shl eax,04h
    sub eax,ebx

eax * 15357:
    lea ebx,[eax+eax*2]
    shl eax,0ah
    add ebx,eax
    shl eax,04h
    sub eax,ebx

eax * 15358:
    mov ebx,eax
    shl eax,0ah
    lea ebx,[eax+ebx*2]
    shl eax,04h
    sub eax,ebx

eax * 15361:
    mov ebx,eax
    shl ebx,0ah
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15362:
    mov ebx,eax
    add eax,eax
    shl ebx,0ah
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 15363:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,0ah
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 15364:
    mov ebx,eax
    shl eax,02h
    shl ebx,0ah
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 15365:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,0ah
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 15367:
    mov ebx,eax
    shl eax,03h
    sub eax,ebx
    shl ebx,0ah
    add ebx,eax
    shl eax,0bh
    add eax,ebx

eax * 15368:
    mov ebx,eax
    shl eax,03h
    shl ebx,0ah
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 15369:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl eax,0ah
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 15375:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    mov ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15376:
    mov ebx,eax
    shl eax,04h
    shl ebx,0ah
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15377:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15379:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15383:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15391:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15392:
    mov ebx,eax
    shl eax,05h
    shl ebx,0ah
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15393:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15407:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15409:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15423:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,0eh
    sub ebx,eax
    shl eax,06h
    add eax,ebx

eax * 15424:
    mov ebx,eax
    shl eax,06h
    shl ebx,0ah
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 15425:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15439:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15473:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15487:
    mov ebx,eax
    shl eax,0ah
    add eax,ebx
    shl ebx,0eh
    sub ebx,eax
    shl eax,07h
    add eax,ebx

eax * 15488:
    mov ebx,eax
    shl eax,07h
    shl ebx,0ah
    sub ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 15489:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15503:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15551:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl ebx,0ah
    sub ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 15553:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 15585:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15601:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15613:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    sub eax,ebx
    shl ebx,08h
    sub eax,ebx

eax * 15615:
    mov ebx,eax
    shl eax,08h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15616:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,08h
    sub eax,ebx

eax * 15617:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 15631:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15647:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15679:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 15713:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15739:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 15743:
    mov ebx,eax
    shl eax,07h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15744:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,07h
    sub eax,ebx

eax * 15775:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15777:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15799:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 15807:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15808:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,06h
    sub eax,ebx

eax * 15809:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15823:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 15825:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15833:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15837:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15839:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15840:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    shl ebx,05h
    sub eax,ebx

eax * 15841:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    mov ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15855:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15856:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15857:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15863:
    lea ebx,[eax+eax*8]
    shl eax,09h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 15864:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*8]
    shl eax,05h
    sub eax,ebx

eax * 15867:
    lea ebx,[eax+eax*4]
    shl eax,09h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 15868:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*4]
    shl eax,05h
    sub eax,ebx

eax * 15869:
    lea ebx,[eax+eax*2]
    shl eax,09h
    add ebx,eax
    shl eax,05h
    sub eax,ebx

eax * 15870:
    mov ebx,eax
    shl eax,09h
    lea ebx,[eax+ebx*2]
    shl eax,05h
    sub eax,ebx

eax * 15873:
    mov ebx,eax
    shl ebx,09h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15874:
    mov ebx,eax
    add eax,eax
    shl ebx,09h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 15875:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 15876:
    mov ebx,eax
    shl eax,02h
    shl ebx,09h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 15877:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 15880:
    mov ebx,eax
    shl eax,03h
    shl ebx,09h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 15881:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl eax,09h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 15887:
    mov ebx,eax
    shl eax,04h
    sub eax,ebx
    shl ebx,09h
    add ebx,eax
    shl eax,0ah
    add eax,ebx

eax * 15888:
    mov ebx,eax
    shl eax,04h
    shl ebx,09h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 15889:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15903:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    mov ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15904:
    mov ebx,eax
    shl eax,05h
    shl ebx,09h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 15905:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15907:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15911:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15919:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15935:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15936:
    mov ebx,eax
    shl eax,06h
    shl ebx,09h
    sub ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 15937:
    mov ebx,eax
    shl eax,06h
    add eax,ebx
    shl ebx,09h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 15967:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15969:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 15997:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx

eax * 15999:
    mov ebx,eax
    shl eax,0eh
    sub eax,ebx
    shl ebx,07h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 16000:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,07h
    sub eax,ebx

eax * 16001:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16031:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 16033:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,05h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16049:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16057:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16059:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 16061:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16063:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16064:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,06h
    sub eax,ebx

eax * 16065:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16087:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 16095:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 16096:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,05h
    sub eax,ebx

eax * 16097:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    add eax,ebx

eax * 16111:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16112:
    mov ebx,eax
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    shl ebx,04h
    sub eax,ebx

eax * 16113:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 16119:
    lea ebx,[eax+eax*8]
    shl eax,08h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 16120:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*8]
    shl eax,06h
    sub eax,ebx

eax * 16121:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 16123:
    lea ebx,[eax+eax*4]
    shl eax,08h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 16124:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*4]
    shl eax,06h
    sub eax,ebx

eax * 16125:
    lea ebx,[eax+eax*2]
    shl eax,08h
    add ebx,eax
    shl eax,06h
    sub eax,ebx

eax * 16126:
    mov ebx,eax
    shl eax,08h
    lea ebx,[eax+ebx*2]
    shl eax,06h
    sub eax,ebx

eax * 16129:
    mov ebx,eax
    shl ebx,08h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16130:
    mov ebx,eax
    add eax,eax
    shl ebx,08h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 16131:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 16132:
    mov ebx,eax
    shl eax,02h
    shl ebx,08h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 16133:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 16136:
    mov ebx,eax
    shl eax,03h
    shl ebx,08h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 16137:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl eax,08h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 16144:
    mov ebx,eax
    shl eax,04h
    shl ebx,08h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 16145:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16159:
    mov ebx,eax
    shl eax,05h
    sub eax,ebx
    shl ebx,08h
    add ebx,eax
    shl eax,09h
    add eax,ebx

eax * 16160:
    mov ebx,eax
    shl eax,05h
    shl ebx,08h
    sub ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 16161:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,08h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16189:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    sub eax,ebx
    shl ebx,06h
    sub eax,ebx

eax * 16191:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    mov ebx,eax
    shl eax,08h
    add eax,ebx

eax * 16192:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,06h
    sub eax,ebx

eax * 16193:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    add ebx,ebx
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 16195:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,02h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 16199:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,03h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 16207:
    mov ebx,eax
    shl eax,06h
    sub eax,ebx
    shl ebx,04h
    add ebx,eax
    shl eax,08h
    add eax,ebx

eax * 16219:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 16223:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16224:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,05h
    sub eax,ebx

eax * 16231:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 16239:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    add ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16240:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,04h
    sub eax,ebx

eax * 16247:
    lea ebx,[eax+eax*8]
    shl eax,07h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 16248:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*8]
    shl eax,07h
    sub eax,ebx

eax * 16251:
    lea ebx,[eax+eax*4]
    shl eax,07h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 16252:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*4]
    shl eax,07h
    sub eax,ebx

eax * 16253:
    lea ebx,[eax+eax*2]
    shl eax,07h
    add ebx,eax
    shl eax,07h
    sub eax,ebx

eax * 16254:
    mov ebx,eax
    shl eax,07h
    lea ebx,[eax+ebx*2]
    shl eax,07h
    sub eax,ebx

eax * 16257:
    mov ebx,eax
    shl ebx,07h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16258:
    mov ebx,eax
    add eax,eax
    shl ebx,07h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 16259:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 16260:
    mov ebx,eax
    shl eax,02h
    shl ebx,07h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 16261:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 16264:
    mov ebx,eax
    shl eax,03h
    shl ebx,07h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 16265:
    mov ebx,eax
    shl eax,07h
    sub eax,ebx
    shl eax,07h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 16272:
    mov ebx,eax
    shl eax,04h
    shl ebx,07h
    sub ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 16273:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16285:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx

eax * 16287:
    mov ebx,eax
    shl eax,0eh
    sub eax,ebx
    shl ebx,05h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 16288:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,05h
    sub eax,ebx

eax * 16289:
    mov ebx,eax
    shl eax,05h
    add eax,ebx
    shl ebx,07h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16299:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 16303:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 16304:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,04h
    sub eax,ebx

eax * 16311:
    lea ebx,[eax+eax*8]
    shl eax,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16312:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,03h
    sub eax,ebx

eax * 16315:
    lea ebx,[eax+eax*4]
    shl eax,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16316:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*4]
    shl eax,08h
    sub eax,ebx

eax * 16317:
    lea ebx,[eax+eax*2]
    shl eax,06h
    add ebx,eax
    shl eax,08h
    sub eax,ebx

eax * 16318:
    mov ebx,eax
    shl eax,06h
    lea ebx,[eax+ebx*2]
    shl eax,08h
    sub eax,ebx

eax * 16321:
    mov ebx,eax
    shl ebx,06h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16322:
    mov ebx,eax
    add eax,eax
    shl ebx,06h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 16323:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 16324:
    mov ebx,eax
    shl eax,02h
    shl ebx,06h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 16325:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*4]
    add eax,ebx

eax * 16328:
    mov ebx,eax
    shl eax,03h
    shl ebx,06h
    sub ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 16329:
    mov ebx,eax
    shl eax,08h
    sub eax,ebx
    shl eax,06h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 16333:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx

eax * 16335:
    mov ebx,eax
    shl eax,0eh
    sub eax,ebx
    shl ebx,04h
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 16336:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,04h
    sub eax,ebx

eax * 16337:
    mov ebx,eax
    shl eax,04h
    add eax,ebx
    shl ebx,06h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16339:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    sub eax,ebx
    shl ebx,03h
    sub eax,ebx

eax * 16343:
    lea ebx,[eax+eax*8]
    shl eax,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 16344:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,03h
    sub eax,ebx

eax * 16347:
    lea ebx,[eax+eax*4]
    shl eax,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 16348:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    shl ebx,02h
    sub eax,ebx

eax * 16349:
    lea ebx,[eax+eax*2]
    shl eax,05h
    add ebx,eax
    shl eax,09h
    sub eax,ebx

eax * 16350:
    mov ebx,eax
    shl eax,05h
    lea ebx,[eax+ebx*2]
    shl eax,09h
    sub eax,ebx

eax * 16353:
    mov ebx,eax
    shl ebx,05h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16354:
    mov ebx,eax
    add eax,eax
    shl ebx,05h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 16355:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*2]
    add eax,ebx

eax * 16356:
    mov ebx,eax
    shl eax,02h
    shl ebx,05h
    sub ebx,eax
    shl eax,0ch
    sub eax,ebx

eax * 16357:
    lea ebx,[eax+eax*8]
    shl eax,0eh
    sub eax,ebx
    add ebx,ebx
    sub eax,ebx

eax * 16359:
    lea ebx,[eax+eax*8]
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 16360:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,03h
    sub eax,ebx

eax * 16361:
    mov ebx,eax
    shl eax,09h
    sub eax,ebx
    shl eax,05h
    lea ebx,[ebx+ebx*8]
    add eax,ebx

eax * 16363:
    lea ebx,[eax+eax*4]
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 16364:
    lea ebx,[eax+eax*4]
    shl eax,0eh
    shl ebx,02h
    sub eax,ebx

eax * 16365:
    lea ebx,[eax+eax*2]
    shl eax,04h
    add ebx,eax
    shl eax,0ah
    sub eax,ebx

eax * 16366:
    lea ebx,[eax+eax*8]
    add ebx,ebx
    shl eax,0eh
    sub eax,ebx

eax * 16369:
    mov ebx,eax
    shl ebx,04h
    sub ebx,eax
    shl eax,0eh
    sub eax,ebx

eax * 16370:
    mov ebx,eax
    add eax,eax
    shl ebx,04h
    sub ebx,eax
    shl eax,0dh
    sub eax,ebx

eax * 16371:
    lea ebx,[eax+eax*4]
    shl eax,03h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 16372:
    lea ebx,[eax+eax*2]
    shl eax,0eh
    shl ebx,02h
    sub eax,ebx

eax * 16373:
    lea ebx,[eax+eax*2]
    shl eax,03h
    add ebx,eax
    shl eax,0bh
    sub eax,ebx

eax * 16374:
    lea ebx,[eax+eax*4]
    add ebx,ebx
    shl eax,0eh
    sub eax,ebx

eax * 16377:
    mov ebx,eax
    shl eax,0bh
    sub eax,ebx
    lea eax,[ebx+eax*8]

eax * 16378:
    lea ebx,[eax+eax*2]
    add ebx,ebx
    shl eax,0eh
    sub eax,ebx


Network Working Group                                         B. Kaliski
Request for Comments: 1319                              RSA Laboratories
Updates: RFC 1115                                             April 1992

                     The MD2 Message-Digest Algorithm

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard.  Distribution of this memo is
   unlimited.

Acknowlegements

   The description of MD2 is based on material prepared by John Linn and
   Ron Rivest.  Their permission to incorporate that material is greatly
   appreciated.

Table of Contents

   1. Executive Summary                                                1
   2. Terminology and Notation                                         2
   3. MD2 Algorithm Description                                        2
   4. Summary                                                          4
   References                                                          5
   APPENDIX A - Reference Implementation                               5
   Security Considerations                                            17
   Author's Address                                                   17

1. Executive Summary

   This document describes the MD2 message-digest algorithm. The
   algorithm takes as input a message of arbitrary length and produces
   as output a 128-bit "fingerprint" or "message digest" of the input.
   It is conjectured that it is computationally infeasible to produce
   two messages having the same message digest, or to produce any
   message having a given prespecified target message digest. The MD2
   algorithm is intended for digital signature applications, where a
   large file must be "compressed" in a secure manner before being
   signed with a private (secret) key under a public-key cryptosystem
   such as RSA.

   License to use MD2 is granted for non-commerical Internet Privacy-
   Enhanced Mail [1-3].

   This document is an update to the August 1989 RFC 1115 [3], which
   also gives a reference implementation of MD2. The main differences

Kaliski                                                         [Page 1]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

   are that a textual description of MD2 is included, and that the
   reference implementation of MD2 is more portable.

   For OSI-based applications, MD2's object identifier is

   md2 OBJECT IDENTIFIER ::=
   iso(1) member-body(2) US(840) rsadsi(113549) digestAlgorithm(2) 2}

   In the X.509 type AlgorithmIdentifier [4], the parameters for MD2
   should have type NULL.

2. Terminology and Notation

   In this document, a "byte" is an eight-bit quantity.

   Let x_i denote "x sub i". If the subscript is an expression, we
   surround it in braces, as in x_{i+1}. Similarly, we use ^ for
   superscripts (exponentiation), so that x^i denotes x to the i-th
   power.

   Let X xor Y denote the bit-wise XOR of X and Y.

3. MD2 Algorithm Description

   We begin by supposing that we have a b-byte message as input, and
   that we wish to find its message digest. Here b is an arbitrary
   nonnegative integer; b may be zero, and it may be arbitrarily large.
   We imagine the bytes of the message written down as follows:

                   m_0 m_1 ... m_{b-1}

   The following five steps are performed to compute the message digest
   of the message.

3.1 Step 1. Append Padding Bytes

   The message is "padded" (extended) so that its length (in bytes) is
   congruent to 0, modulo 16. That is, the message is extended so that
   it is a multiple of 16 bytes long. Padding is always performed, even
   if the length of the message is already congruent to 0, modulo 16.

   Padding is performed as follows: "i" bytes of value "i" are appended
   to the message so that the length in bytes of the padded message
   becomes congruent to 0, modulo 16. At least one byte and at most 16
   16 bytes are appended.

   At this point the resulting message (after padding with bytes) has a
   length that is an exact multiple of 16 bytes. Let M[0 ... N-1] denote

Kaliski                                                         [Page 2]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

   the bytes of the resulting message, where N is a multiple of 16.

3.2 Step 2. Append Checksum

   A 16-byte checksum of the message is appended to the result of the
   previous step.

   This step uses a 256-byte "random" permutation constructed from the
   digits of pi. Let S[i] denote the i-th element of this table. The
   table is given in the appendix.

   Do the following:

      /* Clear checksum. */
      For i = 0 to 15 do:
         Set C[i] to 0.
      end /* of loop on i */

      Set L to 0.

      /* Process each 16-word block. */
      For i = 0 to N/16-1 do

         /* Checksum block i. */
         For j = 0 to 15 do
            Set c to M[i*16+j].
            Set C[j] to S[c xor L].
            Set L to C[j].
          end /* of loop on j */
       end /* of loop on i */

   The 16-byte checksum C[0 ... 15] is appended to the message. Let M[0
   with checksum), where N' = N + 16.

3.3 Step 3. Initialize MD Buffer

   A 48-byte buffer X is used to compute the message digest. The buffer
   is initialized to zero.

Kaliski                                                         [Page 3]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

3.4 Step 4. Process Message in 16-Byte Blocks

   This step uses the same 256-byte permutation S as step 2 does.

   Do the following:

      /* Process each 16-word block. */
      For i = 0 to N'/16-1 do

         /* Copy block i into X. */
         For j = 0 to 15 do
            Set X[16+j] to M[i*16+j].
            Set X[32+j] to (X[16+j] xor X[j]).
          end /* of loop on j */

         Set t to 0.

         /* Do 18 rounds. */
         For j = 0 to 17 do

            /* Round j. */
            For k = 0 to 47 do
               Set t and X[k] to (X[k] xor S[t]).
            end /* of loop on k */

            Set t to (t+j) modulo 256.
         end /* of loop on j */

      end /* of loop on i */

3.5 Step 5. Output

   The message digest produced as output is X[0 ... 15]. That is, we
   begin with X[0], and end with X[15].

   This completes the description of MD2. A reference implementation in
   C is given in the appendix.

4. Summary

   The MD2 message-digest algorithm is simple to implement, and provides
   a "fingerprint" or message digest of a message of arbitrary length.
   It is conjectured that the difficulty of coming up with two messages
   having the same message digest is on the order of 2^64 operations,
   and that the difficulty of coming up with any message having a given
   message digest is on the order of 2^128 operations. The MD2 algorithm
   has been carefully scrutinized for weaknesses. It is, however, a
   relatively new algorithm and further security analysis is of course

Kaliski                                                         [Page 4]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

   justified, as is the case with any new proposal of this sort.

References

   [1] Linn, J., "Privacy Enhancement for Internet Electronic Mail: Part
       I -- Message Encipherment and Authentication Procedures", RFC
       1113, DEC,  IAB Privacy Task Force, August 1989.

   [2] Kent, S., and J. Linn, "Privacy Enhancement for Internet
       Electronic Mail: Part II -- Certificate-Based Key Management",
       RFC 1114, BBNCC, DEC, IAB Privacy Task Force, August 1989.

   [3] Linn, J., "Privacy Enhancement for Internet Electronic Mail: Part
       III -- Algorithms, Modes, and Identifiers", RFC 1115 DEC, IAB
       Privacy Task Force, August 1989.

   [4] CCITT Recommendation X.509 (1988), "The Directory -
       Authentication Framework".

APPENDIX A - Reference Implementation

   This appendix contains the following files taken from RSAREF: A
   Cryptographic Toolkit for Privacy-Enhanced Mail:

     global.h -- global header file

     md2.h -- header file for MD2

     md2c.c -- source code for MD2

For more information on RSAREF, send email to <rsaref@rsa.com>.

The appendix also includes the following file:

     mddriver.c -- test driver for MD2, MD4 and MD5

The driver compiles for MD5 by default but can compile for MD2 or MD4 if
the symbol MD is defined on the C compiler command line as 2 or 4.

A.1 global.h

/* GLOBAL.H - RSAREF types and constants
 */

/* PROTOTYPES should be set to one if and only if the compiler supports
     function argument prototyping.
   The following makes PROTOTYPES default to 0 if it has not already
     been defined with C compiler flags.

Kaliski                                                         [Page 5]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

 */
#ifndef PROTOTYPES
#define PROTOTYPES 0
#endif

/* POINTER defines a generic pointer type */
typedef unsigned char *POINTER;

/* UINT2 defines a two byte word */
typedef unsigned short int UINT2;

/* UINT4 defines a four byte word */
typedef unsigned long int UINT4;

/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
   If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
     returns an empty list.
 */
#if PROTOTYPES
#define PROTO_LIST(list) list
#else
#define PROTO_LIST(list) ()
#endif

A.2 md2.h

/* MD2.H - header file for MD2C.C
 */

/* Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
   rights reserved.

   License to copy and use this software is granted for
   non-commercial Internet Privacy-Enhanced Mail provided that it is
   identified as the "RSA Data Security, Inc. MD2 Message Digest
   Algorithm" in all material mentioning or referencing this software
   or this function.

   RSA Data Security, Inc. makes no representations concerning either
   the merchantability of this software or the suitability of this
   software for any particular purpose. It is provided "as is"
   without express or implied warranty of any kind.

   These notices must be retained in any copies of any part of this
   documentation and/or software.
 */

Kaliski                                                         [Page 6]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

typedef struct {
  unsigned char state[16];                                 /* state */
  unsigned char checksum[16];                           /* checksum */
  unsigned int count;                 /* number of bytes, modulo 16 */
  unsigned char buffer[16];                         /* input buffer */
} MD2_CTX;

void MD2Init PROTO_LIST ((MD2_CTX *));
void MD2Update PROTO_LIST
  ((MD2_CTX *, unsigned char *, unsigned int));
void MD2Final PROTO_LIST ((unsigned char [16], MD2_CTX *));

A.3 md2c.c

/* MD2C.C - RSA Data Security, Inc., MD2 message-digest algorithm
 */

/* Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
   rights reserved.

   License to copy and use this software is granted for
   non-commercial Internet Privacy-Enhanced Mail provided that it is
   identified as the "RSA Data Security, Inc. MD2 Message Digest
   Algorithm" in all material mentioning or referencing this software
   or this function.

   RSA Data Security, Inc. makes no representations concerning either
   the merchantability of this software or the suitability of this
   software for any particular purpose. It is provided "as is"
   without express or implied warranty of any kind.

   These notices must be retained in any copies of any part of this
   documentation and/or software.
 */

#include "global.h"
#include "md2.h"

static void MD2Transform PROTO_LIST
  ((unsigned char [16], unsigned char [16], unsigned char [16]));
static void MD2_memcpy PROTO_LIST ((POINTER, POINTER, unsigned int));
static void MD2_memset PROTO_LIST ((POINTER, int, unsigned int));

/* Permutation of 0..255 constructed from the digits of pi. It gives a
   "random" nonlinear byte substitution operation.
 */
static unsigned char PI_SUBST[256] = {
  41, 46, 67, 201, 162, 216, 124, 1, 61, 54, 84, 161, 236, 240, 6,

Kaliski                                                         [Page 7]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

  19, 98, 167, 5, 243, 192, 199, 115, 140, 152, 147, 43, 217, 188,
  76, 130, 202, 30, 155, 87, 60, 253, 212, 224, 22, 103, 66, 111, 24,
  138, 23, 229, 18, 190, 78, 196, 214, 218, 158, 222, 73, 160, 251,
  245, 142, 187, 47, 238, 122, 169, 104, 121, 145, 21, 178, 7, 63,
  148, 194, 16, 137, 11, 34, 95, 33, 128, 127, 93, 154, 90, 144, 50,
  39, 53, 62, 204, 231, 191, 247, 151, 3, 255, 25, 48, 179, 72, 165,
  181, 209, 215, 94, 146, 42, 172, 86, 170, 198, 79, 184, 56, 210,
  150, 164, 125, 182, 118, 252, 107, 226, 156, 116, 4, 241, 69, 157,
  112, 89, 100, 113, 135, 32, 134, 91, 207, 101, 230, 45, 168, 2, 27,
  96, 37, 173, 174, 176, 185, 246, 28, 70, 97, 105, 52, 64, 126, 15,
  85, 71, 163, 35, 221, 81, 175, 58, 195, 92, 249, 206, 186, 197,
  234, 38, 44, 83, 13, 110, 133, 40, 132, 9, 211, 223, 205, 244, 65,
  129, 77, 82, 106, 220, 55, 200, 108, 193, 171, 250, 36, 225, 123,
  8, 12, 189, 177, 74, 120, 136, 149, 139, 227, 99, 232, 109, 233,
  203, 213, 254, 59, 0, 29, 57, 242, 239, 183, 14, 102, 88, 208, 228,
  166, 119, 114, 248, 235, 117, 75, 10, 49, 68, 80, 180, 143, 237,
  31, 26, 219, 153, 141, 51, 159, 17, 131, 20
};

static unsigned char *PADDING[] = {
  (unsigned char *)"",
  (unsigned char *)"\001",
  (unsigned char *)"\002\002",
  (unsigned char *)"\003\003\003",
  (unsigned char *)"\004\004\004\004",
  (unsigned char *)"\005\005\005\005\005",
  (unsigned char *)"\006\006\006\006\006\006",
  (unsigned char *)"\007\007\007\007\007\007\007",
  (unsigned char *)"\010\010\010\010\010\010\010\010",
  (unsigned char *)"\011\011\011\011\011\011\011\011\011",
  (unsigned char *)"\012\012\012\012\012\012\012\012\012\012",
  (unsigned char *)"\013\013\013\013\013\013\013\013\013\013\013",
  (unsigned char *)"\014\014\014\014\014\014\014\014\014\014\014\014",
  (unsigned char *)
    "\015\015\015\015\015\015\015\015\015\015\015\015\015",
  (unsigned char *)
    "\016\016\016\016\016\016\016\016\016\016\016\016\016\016",
  (unsigned char *)
    "\017\017\017\017\017\017\017\017\017\017\017\017\017\017\017",
  (unsigned char *)
    "\020\020\020\020\020\020\020\020\020\020\020\020\020\020\020\020"
};

/* MD2 initialization. Begins an MD2 operation, writing a new context.
 */
void MD2Init (context)
MD2_CTX *context;                                        /* context */
{

Kaliski                                                         [Page 8]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

  context->count = 0;
  MD2_memset ((POINTER)context->state, 0, sizeof (context->state));
  MD2_memset
    ((POINTER)context->checksum, 0, sizeof (context->checksum));
}

/* MD2 block update operation. Continues an MD2 message-digest
     operation, processing another message block, and updating the
     context.
 */
void MD2Update (context, input, inputLen)
MD2_CTX *context;                                        /* context */
unsigned char *input;                                /* input block */
unsigned int inputLen;                     /* length of input block */
{
  unsigned int i, index, partLen;

  /* Update number of bytes mod 16 */
  index = context->count;
  context->count = (index + inputLen) & 0xf;

  partLen = 16 - index;

  /* Transform as many times as possible.
    */
  if (inputLen >= partLen) {
    MD2_memcpy
      ((POINTER)&context->buffer[index], (POINTER)input, partLen);
    MD2Transform (context->state, context->checksum, context->buffer);

    for (i = partLen; i + 15 < inputLen; i += 16)
      MD2Transform (context->state, context->checksum, &input[i]);

    index = 0;
  }
  else
    i = 0;

  /* Buffer remaining input */
  MD2_memcpy
    ((POINTER)&context->buffer[index], (POINTER)&input[i],
     inputLen-i);
}

/* MD2 finalization. Ends an MD2 message-digest operation, writing the
     message digest and zeroizing the context.
 */
void MD2Final (digest, context)

Kaliski                                                         [Page 9]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

unsigned char digest[16];                         /* message digest */
MD2_CTX *context;                                        /* context */
{
  unsigned int index, padLen;

  /* Pad out to multiple of 16.
   */
  index = context->count;
  padLen = 16 - index;
  MD2Update (context, PADDING[padLen], padLen);

  /* Extend with checksum */
  MD2Update (context, context->checksum, 16);

  /* Store state in digest */
  MD2_memcpy ((POINTER)digest, (POINTER)context->state, 16);

  /* Zeroize sensitive information.
   */
  MD2_memset ((POINTER)context, 0, sizeof (*context));
}

/* MD2 basic transformation. Transforms state and updates checksum
     based on block.
 */
static void MD2Transform (state, checksum, block)
unsigned char state[16];
unsigned char checksum[16];
unsigned char block[16];
{
  unsigned int i, j, t;
  unsigned char x[48];

  /* Form encryption block from state, block, state ^ block.
   */
  MD2_memcpy ((POINTER)x, (POINTER)state, 16);
  MD2_memcpy ((POINTER)x+16, (POINTER)block, 16);
  for (i = 0; i < 16; i++)
    x[i+32] = state[i] ^ block[i];

  /* Encrypt block (18 rounds).
   */
  t = 0;
  for (i = 0; i < 18; i++) {
    for (j = 0; j < 48; j++)
      t = x[j] ^= PI_SUBST[t];
    t = (t + i) & 0xff;
  }

Kaliski                                                        [Page 10]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

  /* Save new state */
  MD2_memcpy ((POINTER)state, (POINTER)x, 16);

  /* Update checksum.
   */
  t = checksum[15];
  for (i = 0; i < 16; i++)
    t = checksum[i] ^= PI_SUBST[block[i] ^ t];

  /* Zeroize sensitive information.
   */
  MD2_memset ((POINTER)x, 0, sizeof (x));
}

/* Note: Replace "for loop" with standard memcpy if possible.
 */
static void MD2_memcpy (output, input, len)
POINTER output;
POINTER input;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
    output[i] = input[i];
}

/* Note: Replace "for loop" with standard memset if possible.
 */
static void MD2_memset (output, value, len)
POINTER output;
int value;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
    ((char *)output)[i] = (char)value;
}

A.4 mddriver.c

/* MDDRIVER.C - test driver for MD2, MD4 and MD5
 */

/* Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
   rights reserved.

Kaliski                                                        [Page 11]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

   RSA Data Security, Inc. makes no representations concerning either
   the merchantability of this software or the suitability of this
   software for any particular purpose. It is provided "as is"
   without express or implied warranty of any kind.

   These notices must be retained in any copies of any part of this
   documentation and/or software.
 */

/* The following makes MD default to MD5 if it has not already been
     defined with C compiler flags.
 */
#ifndef MD
#define MD MD5
#endif

#include <stdio.h>
#include <time.h>
#include <string.h>
#include "global.h"
#if MD == 2
#include "md2.h"
#endif
#if MD == 4
#include "md4.h"
#endif
#if MD == 5
#include "md5.h"
#endif

/* Length of test block, number of test blocks.
 */
#define TEST_BLOCK_LEN 1000
#define TEST_BLOCK_COUNT 1000

static void MDString PROTO_LIST ((char *));
static void MDTimeTrial PROTO_LIST ((void));
static void MDTestSuite PROTO_LIST ((void));
static void MDFile PROTO_LIST ((char *));
static void MDFilter PROTO_LIST ((void));
static void MDPrint PROTO_LIST ((unsigned char [16]));

#if MD == 2
#define MD_CTX MD2_CTX
#define MDInit MD2Init
#define MDUpdate MD2Update
#define MDFinal MD2Final
#endif

Kaliski                                                        [Page 12]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

#if MD == 4
#define MD_CTX MD4_CTX
#define MDInit MD4Init
#define MDUpdate MD4Update
#define MDFinal MD4Final
#endif
#if MD == 5
#define MD_CTX MD5_CTX
#define MDInit MD5Init
#define MDUpdate MD5Update
#define MDFinal MD5Final
#endif

/* Main driver.

   Arguments (may be any combination):
     -sstring - digests string
     -t       - runs time trial
     -x       - runs test script
     filename - digests file
     (none)   - digests standard input
 */
int main (argc, argv)
int argc;
char *argv[];
{
  int i;

  if (argc > 1)
    for (i = 1; i < argc; i++)
      if (argv[i][0] == '-' && argv[i][1] == 's')
        MDString (argv[i] + 2);
      else if (strcmp (argv[i], "-t") == 0)
        MDTimeTrial ();
      else if (strcmp (argv[i], "-x") == 0)
        MDTestSuite ();
      else
        MDFile (argv[i]);
  else
    MDFilter ();

  return (0);
}

/* Digests a string and prints the result.
 */
static void MDString (string)
char *string;

Kaliski                                                        [Page 13]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

{
  MD_CTX context;
  unsigned char digest[16];
  unsigned int len = strlen (string);

  MDInit (&context);
  MDUpdate (&context, string, len);
  MDFinal (digest, &context);

  printf ("MD%d (\"%s\") = ", MD, string);
  MDPrint (digest);
  printf ("\n");
}

/* Measures the time to digest TEST_BLOCK_COUNT TEST_BLOCK_LEN-byte
     blocks.
 */
static void MDTimeTrial ()
{
  MD_CTX context;
  time_t endTime, startTime;
  unsigned char block[TEST_BLOCK_LEN], digest[16];
  unsigned int i;

  printf
    ("MD%d time trial. Digesting %d %d-byte blocks ...", MD,
     TEST_BLOCK_LEN, TEST_BLOCK_COUNT);

  /* Initialize block */
  for (i = 0; i < TEST_BLOCK_LEN; i++)
    block[i] = (unsigned char)(i & 0xff);

  /* Start timer */
  time (&startTime);

  /* Digest blocks */
  MDInit (&context);
  for (i = 0; i < TEST_BLOCK_COUNT; i++)
    MDUpdate (&context, block, TEST_BLOCK_LEN);
  MDFinal (digest, &context);

  /* Stop timer */
  time (&endTime);

  printf (" done\n");
  printf ("Digest = ");
  MDPrint (digest);
  printf ("\nTime = %ld seconds\n", (long)(endTime-startTime));

Kaliski                                                        [Page 14]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

  printf
    ("Speed = %ld bytes/second\n",
     (long)TEST_BLOCK_LEN * (long)TEST_BLOCK_COUNT/(endTime-startTime));
}
/* Digests a reference suite of strings and prints the results.
 */
static void MDTestSuite ()
{
  printf ("MD%d test suite:\n", MD);

  MDString ("");
  MDString ("a");
  MDString ("abc");
  MDString ("message digest");
  MDString ("abcdefghijklmnopqrstuvwxyz");
  MDString
    ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
  MDString
    ("1234567890123456789012345678901234567890\
1234567890123456789012345678901234567890");
}

/* Digests a file and prints the result.
 */
static void MDFile (filename)
char *filename;
{
  FILE *file;
  MD_CTX context;
  int len;
  unsigned char buffer[1024], digest[16];

  if ((file = fopen (filename, "rb")) == NULL)
    printf ("%s can't be opened\n", filename);

  else {
    MDInit (&context);
    while (len = fread (buffer, 1, 1024, file))
      MDUpdate (&context, buffer, len);
    MDFinal (digest, &context);

    fclose (file);

    printf ("MD%d (%s) = ", MD, filename);
    MDPrint (digest);
    printf ("\n");
  }
}

Kaliski                                                        [Page 15]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

/* Digests the standard input and prints the result.
 */
static void MDFilter ()
{
  MD_CTX context;
  int len;
  unsigned char buffer[16], digest[16];

  MDInit (&context);
  while (len = fread (buffer, 1, 16, stdin))
    MDUpdate (&context, buffer, len);
  MDFinal (digest, &context);

  MDPrint (digest);
  printf ("\n");
}

/* Prints a message digest in hexadecimal.
 */
static void MDPrint (digest)
unsigned char digest[16];
{
  unsigned int i;

  for (i = 0; i < 16; i++)
    printf ("%02x", digest[i]);
}

A.5 Test suite

   The MD2 test suite (driver option "-x") should print the following
   results:

MD2 test suite:
MD2 ("") = 8350e5a3e24c153df2275c9f80692773
MD2 ("a") = 32ec01ec4a6dac72c0ab96fb34c0b5d1
MD2 ("abc") = da853b0d3f88d99b30283a69e6ded6bb
MD2 ("message digest") = ab4f496bfb2a530b219ff33031fe06b0
MD2 ("abcdefghijklmnopqrstuvwxyz") = 4e8ddff3650292ab5a4108c3aa47940b
MD2 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") =
da33def2a42df13975352846c30338cd
MD2 ("123456789012345678901234567890123456789012345678901234567890123456
78901234567890") = d5976f79d83d3a0dc9806c3c66f3efd8

Kaliski                                                        [Page 16]

RFC 1319              MD2 Message-Digest Algorithm            April 1992

Security Considerations

   The level of security discussed in this memo is considered to be
   sufficient for implementing very high security hybrid digital
   signature schemes based on MD2 and a public-key cryptosystem.

Author's Address

   Burton S. Kaliski Jr.
   RSA Laboratories (a division of RSA Data Security, Inc.)
   10 Twin Dolphin Drive
   Redwood City, CA  94065

   Phone: (415) 595-8782
   FAX: (415) 595-4126
   EMail: burt@rsa.com

Kaliski                                                        [Page 17]


Network Working Group                                          R. Rivest
Request for Comments: 1320           MIT Laboratory for Computer Science
Obsoletes: RFC 1186                          and RSA Data Security, Inc.
                                                              April 1992

                    The MD4 Message-Digest Algorithm

Status of thie Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard.  Distribution of this memo is
   unlimited.

Acknowlegements

   We would like to thank Don Coppersmith, Burt Kaliski, Ralph Merkle,
   and Noam Nisan for numerous helpful comments and suggestions.

Table of Contents

   1. Executive Summary                                                1
   2. Terminology and Notation                                         2
   3. MD4 Algorithm Description                                        2
   4. Summary                                                          6
   References                                                          6
   APPENDIX A - Reference Implementation                               6
   Security Considerations                                            20
   Author's Address                                                   20

1. Executive Summary

   This document describes the MD4 message-digest algorithm [1]. The
   algorithm takes as input a message of arbitrary length and produces
   as output a 128-bit "fingerprint" or "message digest" of the input.
   It is conjectured that it is computationally infeasible to produce
   two messages having the same message digest, or to produce any
   message having a given prespecified target message digest. The MD4
   algorithm is intended for digital signature applications, where a
   large file must be "compressed" in a secure manner before being
   encrypted with a private (secret) key under a public-key cryptosystem
   such as RSA.

   The MD4 algorithm is designed to be quite fast on 32-bit machines. In
   addition, the MD4 algorithm does not require any large substitution
   tables; the algorithm can be coded quite compactly.

Rivest                                                          [Page 1]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

   The MD4 algorithm is being placed in the public domain for review and
   possible adoption as a standard.

   This document replaces the October 1990 RFC 1186 [2].  The main
   difference is that the reference implementation of MD4 in the
   appendix is more portable.

   For OSI-based applications, MD4's object identifier is

   md4 OBJECT IDENTIFIER ::=
     {iso(1) member-body(2) US(840) rsadsi(113549) digestAlgorithm(2) 4}

   In the X.509 type AlgorithmIdentifier [3], the parameters for MD4
   should have type NULL.

2. Terminology and Notation

   In this document a "word" is a 32-bit quantity and a "byte" is an
   eight-bit quantity. A sequence of bits can be interpreted in a
   natural manner as a sequence of bytes, where each consecutive group
   of eight bits is interpreted as a byte with the high-order (most
   significant) bit of each byte listed first. Similarly, a sequence of
   bytes can be interpreted as a sequence of 32-bit words, where each
   consecutive group of four bytes is interpreted as a word with the
   low-order (least significant) byte given first.

   Let x_i denote "x sub i". If the subscript is an expression, we
   surround it in braces, as in x_{i+1}. Similarly, we use ^ for
   superscripts (exponentiation), so that x^i denotes x to the i-th
   power.

   Let the symbol "+" denote addition of words (i.e., modulo-2^32
   addition). Let X <<< s denote the 32-bit value obtained by circularly
   shifting (rotating) X left by s bit positions. Let not(X) denote the
   bit-wise complement of X, and let X v Y denote the bit-wise OR of X
   and Y. Let X xor Y denote the bit-wise XOR of X and Y, and let XY
   denote the bit-wise AND of X and Y.

3. MD4 Algorithm Description

   We begin by supposing that we have a b-bit message as input, and that
   we wish to find its message digest. Here b is an arbitrary
   nonnegative integer; b may be zero, it need not be a multiple of
   eight, and it may be arbitrarily large. We imagine the bits of the
   message written down as follows:

                 m_0 m_1 ... m_{b-1}

Rivest                                                          [Page 2]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

   The following five steps are performed to compute the message digest
   of the message.

3.1 Step 1. Append Padding Bits

   The message is "padded" (extended) so that its length (in bits) is
   congruent to 448, modulo 512. That is, the message is extended so
   that it is just 64 bits shy of being a multiple of 512 bits long.
   Padding is always performed, even if the length of the message is
   already congruent to 448, modulo 512.

   Padding is performed as follows: a single "1" bit is appended to the
   message, and then "0" bits are appended so that the length in bits of
   the padded message becomes congruent to 448, modulo 512. In all, at
   least one bit and at most 512 bits are appended.

3.2 Step 2. Append Length

   A 64-bit representation of b (the length of the message before the
   padding bits were added) is appended to the result of the previous
   step. In the unlikely event that b is greater than 2^64, then only
   the low-order 64 bits of b are used. (These bits are appended as two
   32-bit words and appended low-order word first in accordance with the
   previous conventions.)

   At this point the resulting message (after padding with bits and with
   b) has a length that is an exact multiple of 512 bits. Equivalently,
   this message has a length that is an exact multiple of 16 (32-bit)
   words. Let M[0 ... N-1] denote the words of the resulting message,
   where N is a multiple of 16.

3.3 Step 3. Initialize MD Buffer

   A four-word buffer (A,B,C,D) is used to compute the message digest.
   Here each of A, B, C, D is a 32-bit register. These registers are
   initialized to the following values in hexadecimal, low-order bytes
   first):

        word A: 01 23 45 67
        word B: 89 ab cd ef
        word C: fe dc ba 98
        word D: 76 54 32 10

Rivest                                                          [Page 3]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

3.4 Step 4. Process Message in 16-Word Blocks

   We first define three auxiliary functions that each take as input
   three 32-bit words and produce as output one 32-bit word.

        F(X,Y,Z) = XY v not(X) Z
        G(X,Y,Z) = XY v XZ v YZ
        H(X,Y,Z) = X xor Y xor Z

   In each bit position F acts as a conditional: if X then Y else Z.
   The function F could have been defined using + instead of v since XY
   and not(X)Z will never have "1" bits in the same bit position.)  In
   each bit position G acts as a majority function: if at least two of
   X, Y, Z are on, then G has a "1" bit in that bit position, else G has
   a "0" bit. It is interesting to note that if the bits of X, Y, and Z
   are independent and unbiased, the each bit of f(X,Y,Z) will be
   independent and unbiased, and similarly each bit of g(X,Y,Z) will be
   independent and unbiased. The function H is the bit-wise XOR or
   parity" function; it has properties similar to those of F and G.

   Do the following:

      Process each 16-word block. */
      For i = 0 to N/16-1 do

        /* Copy block i into X. */
        For j = 0 to 15 do
          Set X[j] to M[i*16+j].
        end /* of loop on j */

        /* Save A as AA, B as BB, C as CC, and D as DD. */
        AA = A
        BB = B
        CC = C
        DD = D

        /* Round 1. */
        /* Let [abcd k s] denote the operation
             a = (a + F(b,c,d) + X[k]) <<< s. */
        /* Do the following 16 operations. */
        [ABCD  0  3]  [DABC  1  7]  [CDAB  2 11]  [BCDA  3 19]
        [ABCD  4  3]  [DABC  5  7]  [CDAB  6 11]  [BCDA  7 19]
        [ABCD  8  3]  [DABC  9  7]  [CDAB 10 11]  [BCDA 11 19]
        [ABCD 12  3]  [DABC 13  7]  [CDAB 14 11]  [BCDA 15 19]

        /* Round 2. */
        /* Let [abcd k s] denote the operation
             a = (a + G(b,c,d) + X[k] + 5A827999) <<< s. */

Rivest                                                          [Page 4]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

        /* Do the following 16 operations. */
        [ABCD  0  3]  [DABC  4  5]  [CDAB  8  9]  [BCDA 12 13]
        [ABCD  1  3]  [DABC  5  5]  [CDAB  9  9]  [BCDA 13 13]
        [ABCD  2  3]  [DABC  6  5]  [CDAB 10  9]  [BCDA 14 13]
        [ABCD  3  3]  [DABC  7  5]  [CDAB 11  9]  [BCDA 15 13]

        /* Round 3. */
        /* Let [abcd k s] denote the operation
             a = (a + H(b,c,d) + X[k] + 6ED9EBA1) <<< s. */
        /* Do the following 16 operations. */
        [ABCD  0  3]  [DABC  8  9]  [CDAB  4 11]  [BCDA 12 15]
        [ABCD  2  3]  [DABC 10  9]  [CDAB  6 11]  [BCDA 14 15]
        [ABCD  1  3]  [DABC  9  9]  [CDAB  5 11]  [BCDA 13 15]
        [ABCD  3  3]  [DABC 11  9]  [CDAB  7 11]  [BCDA 15 15]

        /* Then perform the following additions. (That is, increment each
           of the four registers by the value it had before this block
           was started.) */
        A = A + AA
        B = B + BB
        C = C + CC
        D = D + DD

      end /* of loop on i */

   Note. The value 5A..99 is a hexadecimal 32-bit constant, written with
   the high-order digit first. This constant represents the square root
   of 2. The octal value of this constant is 013240474631.

   The value 6E..A1 is a hexadecimal 32-bit constant, written with the
   high-order digit first.  This constant represents the square root of
   3. The octal value of this constant is 015666365641.

   See Knuth, The Art of Programming, Volume 2 (Seminumerical
   Algorithms), Second Edition (1981), Addison-Wesley. Table 2, page
    660.

3.5 Step 5. Output

   The message digest produced as output is A, B, C, D. That is, we
   begin with the low-order byte of A, and end with the high-order byte
   of D.

   This completes the description of MD4. A reference implementation in
   C is given in the appendix.

Rivest                                                          [Page 5]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

4. Summary

   The MD4 message-digest algorithm is simple to implement, and provides
   a "fingerprint" or message digest of a message of arbitrary length.
   It is conjectured that the difficulty of coming up with two messages
   having the same message digest is on the order of 2^64 operations,
   and that the difficulty of coming up with any message having a given
   message digest is on the order of 2^128 operations. The MD4 algorithm
   has been carefully scrutinized for weaknesses. It is, however, a
   relatively new algorithm and further security analysis is of course
   justified, as is the case with any new proposal of this sort.

References

   [1] Rivest, R., "The MD4 message digest algorithm", in A.J.  Menezes
       and S.A. Vanstone, editors, Advances in Cryptology - CRYPTO '90
       Proceedings, pages 303-311, Springer-Verlag, 1991.

   [2] Rivest, R., "The MD4 Message Digest Algorithm", RFC 1186, MIT,
       October 1990.

   [3] CCITT Recommendation X.509 (1988), "The Directory -
       Authentication Framework".

   [4] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, MIT and
       RSA Data Security, Inc, April 1992.

APPENDIX A - Reference Implementation

   This appendix contains the following files:

        global.h -- global header file

        md4.h -- header file for MD4

        md4c.c -- source code for MD4

        mddriver.c -- test driver for MD2, MD4 and MD5

   The driver compiles for MD5 by default but can compile for MD2 or MD4
   if the symbol MD is defined on the C compiler command line as 2 or 4.

   The implementation is portable and should work on many different
   plaforms. However, it is not difficult to optimize the implementation
   on particular platforms, an exercise left to the reader. For example,
   on "little-endian" platforms where the lowest-addressed byte in a 32-
   bit word is the least significant and there are no alignment
   restrictions, the call to Decode in MD4Transform can be replaced with

Rivest                                                          [Page 6]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

   a typecast.

A.1 global.h

/* GLOBAL.H - RSAREF types and constants
 */

/* PROTOTYPES should be set to one if and only if the compiler supports
     function argument prototyping.
   The following makes PROTOTYPES default to 0 if it has not already
     been defined with C compiler flags.
 */
#ifndef PROTOTYPES
#define PROTOTYPES 0
#endif

/* POINTER defines a generic pointer type */
typedef unsigned char *POINTER;

/* UINT2 defines a two byte word */
typedef unsigned short int UINT2;

/* UINT4 defines a four byte word */
typedef unsigned long int UINT4;

/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
   If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
     returns an empty list.
 */

#if PROTOTYPES
#define PROTO_LIST(list) list
#else
#define PROTO_LIST(list) ()
#endif

A.2 md4.h

/* MD4.H - header file for MD4C.C
 */

/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
   rights reserved.

   License to copy and use this software is granted provided that it
   is identified as the "RSA Data Security, Inc. MD4 Message-Digest
   Algorithm" in all material mentioning or referencing this software
   or this function.

Rivest                                                          [Page 7]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

   License is also granted to make and use derivative works provided
   that such works are identified as "derived from the RSA Data
   Security, Inc. MD4 Message-Digest Algorithm" in all material
   mentioning or referencing the derived work.

   RSA Data Security, Inc. makes no representations concerning either
   the merchantability of this software or the suitability of this
   software for any particular purpose. It is provided "as is"
   without express or implied warranty of any kind.

   These notices must be retained in any copies of any part of this
   documentation and/or software.
 */

/* MD4 context. */
typedef struct {
  UINT4 state[4];                                   /* state (ABCD) */
  UINT4 count[2];        /* number of bits, modulo 2^64 (lsb first) */
  unsigned char buffer[64];                         /* input buffer */
} MD4_CTX;

void MD4Init PROTO_LIST ((MD4_CTX *));
void MD4Update PROTO_LIST
  ((MD4_CTX *, unsigned char *, unsigned int));
void MD4Final PROTO_LIST ((unsigned char [16], MD4_CTX *));

A.3 md4c.c

/* MD4C.C - RSA Data Security, Inc., MD4 message-digest algorithm
 */

/* Copyright (C) 1990-2, RSA Data Security, Inc. All rights reserved.

   License to copy and use this software is granted provided that it
   is identified as the "RSA Data Security, Inc. MD4 Message-Digest
   Algorithm" in all material mentioning or referencing this software
   or this function.

   License is also granted to make and use derivative works provided
   that such works are identified as "derived from the RSA Data
   Security, Inc. MD4 Message-Digest Algorithm" in all material
   mentioning or referencing the derived work.

   RSA Data Security, Inc. makes no representations concerning either
   the merchantability of this software or the suitability of this
   software for any particular purpose. It is provided "as is"
   without express or implied warranty of any kind.

Rivest                                                          [Page 8]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

   These notices must be retained in any copies of any part of this
   documentation and/or software.
 */

#include "global.h"
#include "md4.h"

/* Constants for MD4Transform routine.
 */
#define S11 3
#define S12 7
#define S13 11
#define S14 19
#define S21 3
#define S22 5
#define S23 9
#define S24 13
#define S31 3
#define S32 9
#define S33 11
#define S34 15

static void MD4Transform PROTO_LIST ((UINT4 [4], unsigned char [64]));
static void Encode PROTO_LIST
  ((unsigned char *, UINT4 *, unsigned int));
static void Decode PROTO_LIST
  ((UINT4 *, unsigned char *, unsigned int));
static void MD4_memcpy PROTO_LIST ((POINTER, POINTER, unsigned int));
static void MD4_memset PROTO_LIST ((POINTER, int, unsigned int));

static unsigned char PADDING[64] = {
  0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* F, G and H are basic MD4 functions.
 */
#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
#define G(x, y, z) (((x) & (y)) | ((x) & (z)) | ((y) & (z)))
#define H(x, y, z) ((x) ^ (y) ^ (z))

/* ROTATE_LEFT rotates x left n bits.
 */
#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n))))

/* FF, GG and HH are transformations for rounds 1, 2 and 3 */
/* Rotation is separate from addition to prevent recomputation */

Rivest                                                          [Page 9]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

#define FF(a, b, c, d, x, s) { \
    (a) += F ((b), (c), (d)) + (x); \
    (a) = ROTATE_LEFT ((a), (s)); \
  }
#define GG(a, b, c, d, x, s) { \
    (a) += G ((b), (c), (d)) + (x) + (UINT4)0x5a827999; \
    (a) = ROTATE_LEFT ((a), (s)); \
  }
#define HH(a, b, c, d, x, s) { \
    (a) += H ((b), (c), (d)) + (x) + (UINT4)0x6ed9eba1; \
    (a) = ROTATE_LEFT ((a), (s)); \
  }

/* MD4 initialization. Begins an MD4 operation, writing a new context.
 */
void MD4Init (context)
MD4_CTX *context;                                        /* context */
{
  context->count[0] = context->count[1] = 0;

  /* Load magic initialization constants.
   */
  context->state[0] = 0x67452301;
  context->state[1] = 0xefcdab89;
  context->state[2] = 0x98badcfe;
  context->state[3] = 0x10325476;
}

/* MD4 block update operation. Continues an MD4 message-digest
     operation, processing another message block, and updating the
     context.
 */
void MD4Update (context, input, inputLen)
MD4_CTX *context;                                        /* context */
unsigned char *input;                                /* input block */
unsigned int inputLen;                     /* length of input block */
{
  unsigned int i, index, partLen;

  /* Compute number of bytes mod 64 */
  index = (unsigned int)((context->count[0] >> 3) & 0x3F);
  /* Update number of bits */
  if ((context->count[0] += ((UINT4)inputLen << 3))
      < ((UINT4)inputLen << 3))
    context->count[1]++;
  context->count[1] += ((UINT4)inputLen >> 29);

  partLen = 64 - index;

Rivest                                                         [Page 10]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

  /* Transform as many times as possible.
   */
  if (inputLen >= partLen) {
    MD4_memcpy
      ((POINTER)&context->buffer[index], (POINTER)input, partLen);
    MD4Transform (context->state, context->buffer);

    for (i = partLen; i + 63 < inputLen; i += 64)
      MD4Transform (context->state, &input[i]);

    index = 0;
  }
  else
    i = 0;

  /* Buffer remaining input */
  MD4_memcpy
    ((POINTER)&context->buffer[index], (POINTER)&input[i],
     inputLen-i);
}

/* MD4 finalization. Ends an MD4 message-digest operation, writing the
     the message digest and zeroizing the context.
 */
void MD4Final (digest, context)
unsigned char digest[16];                         /* message digest */
MD4_CTX *context;                                        /* context */
{
  unsigned char bits[8];
  unsigned int index, padLen;

  /* Save number of bits */
  Encode (bits, context->count, 8);

  /* Pad out to 56 mod 64.
   */
  index = (unsigned int)((context->count[0] >> 3) & 0x3f);
  padLen = (index < 56) ? (56 - index) : (120 - index);
  MD4Update (context, PADDING, padLen);

  /* Append length (before padding) */
  MD4Update (context, bits, 8);
  /* Store state in digest */
  Encode (digest, context->state, 16);

  /* Zeroize sensitive information.
   */
  MD4_memset ((POINTER)context, 0, sizeof (*context));

Rivest                                                         [Page 11]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

}

/* MD4 basic transformation. Transforms state based on block.
 */
static void MD4Transform (state, block)
UINT4 state[4];
unsigned char block[64];
{
  UINT4 a = state[0], b = state[1], c = state[2], d = state[3], x[16];

  Decode (x, block, 64);

  /* Round 1 */
  FF (a, b, c, d, x[ 0], S11); /* 1 */
  FF (d, a, b, c, x[ 1], S12); /* 2 */
  FF (c, d, a, b, x[ 2], S13); /* 3 */
  FF (b, c, d, a, x[ 3], S14); /* 4 */
  FF (a, b, c, d, x[ 4], S11); /* 5 */
  FF (d, a, b, c, x[ 5], S12); /* 6 */
  FF (c, d, a, b, x[ 6], S13); /* 7 */
  FF (b, c, d, a, x[ 7], S14); /* 8 */
  FF (a, b, c, d, x[ 8], S11); /* 9 */
  FF (d, a, b, c, x[ 9], S12); /* 10 */
  FF (c, d, a, b, x[10], S13); /* 11 */
  FF (b, c, d, a, x[11], S14); /* 12 */
  FF (a, b, c, d, x[12], S11); /* 13 */
  FF (d, a, b, c, x[13], S12); /* 14 */
  FF (c, d, a, b, x[14], S13); /* 15 */
  FF (b, c, d, a, x[15], S14); /* 16 */

  /* Round 2 */
  GG (a, b, c, d, x[ 0], S21); /* 17 */
  GG (d, a, b, c, x[ 4], S22); /* 18 */
  GG (c, d, a, b, x[ 8], S23); /* 19 */
  GG (b, c, d, a, x[12], S24); /* 20 */
  GG (a, b, c, d, x[ 1], S21); /* 21 */
  GG (d, a, b, c, x[ 5], S22); /* 22 */
  GG (c, d, a, b, x[ 9], S23); /* 23 */
  GG (b, c, d, a, x[13], S24); /* 24 */
  GG (a, b, c, d, x[ 2], S21); /* 25 */
  GG (d, a, b, c, x[ 6], S22); /* 26 */
  GG (c, d, a, b, x[10], S23); /* 27 */
  GG (b, c, d, a, x[14], S24); /* 28 */
  GG (a, b, c, d, x[ 3], S21); /* 29 */
  GG (d, a, b, c, x[ 7], S22); /* 30 */
  GG (c, d, a, b, x[11], S23); /* 31 */
  GG (b, c, d, a, x[15], S24); /* 32 */

Rivest                                                         [Page 12]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

  /* Round 3 */
  HH (a, b, c, d, x[ 0], S31); /* 33 */
  HH (d, a, b, c, x[ 8], S32); /* 34 */
  HH (c, d, a, b, x[ 4], S33); /* 35 */
  HH (b, c, d, a, x[12], S34); /* 36 */
  HH (a, b, c, d, x[ 2], S31); /* 37 */
  HH (d, a, b, c, x[10], S32); /* 38 */
  HH (c, d, a, b, x[ 6], S33); /* 39 */
  HH (b, c, d, a, x[14], S34); /* 40 */
  HH (a, b, c, d, x[ 1], S31); /* 41 */
  HH (d, a, b, c, x[ 9], S32); /* 42 */
  HH (c, d, a, b, x[ 5], S33); /* 43 */
  HH (b, c, d, a, x[13], S34); /* 44 */
  HH (a, b, c, d, x[ 3], S31); /* 45 */
  HH (d, a, b, c, x[11], S32); /* 46 */
  HH (c, d, a, b, x[ 7], S33); /* 47 */
  HH (b, c, d, a, x[15], S34); /* 48 */

  state[0] += a;
  state[1] += b;
  state[2] += c;
  state[3] += d;

  /* Zeroize sensitive information.
   */
  MD4_memset ((POINTER)x, 0, sizeof (x));
}

/* Encodes input (UINT4) into output (unsigned char). Assumes len is
     a multiple of 4.
 */
static void Encode (output, input, len)
unsigned char *output;
UINT4 *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4) {
    output[j] = (unsigned char)(input[i] & 0xff);
    output[j+1] = (unsigned char)((input[i] >> 8) & 0xff);
    output[j+2] = (unsigned char)((input[i] >> 16) & 0xff);
    output[j+3] = (unsigned char)((input[i] >> 24) & 0xff);
  }
}

/* Decodes input (unsigned char) into output (UINT4). Assumes len is
     a multiple of 4.

Rivest                                                         [Page 13]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

 */
static void Decode (output, input, len)

UINT4 *output;
unsigned char *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4)
    output[i] = ((UINT4)input[j]) | (((UINT4)input[j+1]) << 8) |
      (((UINT4)input[j+2]) << 16) | (((UINT4)input[j+3]) << 24);
}

/* Note: Replace "for loop" with standard memcpy if possible.
 */
static void MD4_memcpy (output, input, len)
POINTER output;
POINTER input;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
    output[i] = input[i];
}

/* Note: Replace "for loop" with standard memset if possible.
 */
static void MD4_memset (output, value, len)
POINTER output;
int value;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
    ((char *)output)[i] = (char)value;
}

A.4 mddriver.c

/* MDDRIVER.C - test driver for MD2, MD4 and MD5
 */

/* Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
   rights reserved.

Rivest                                                         [Page 14]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

   RSA Data Security, Inc. makes no representations concerning either
   the merchantability of this software or the suitability of this
   software for any particular purpose. It is provided "as is"
   without express or implied warranty of any kind.

   These notices must be retained in any copies of any part of this
   documentation and/or software.

 */

/* The following makes MD default to MD5 if it has not already been
     defined with C compiler flags.
 */
#ifndef MD
#define MD MD5
#endif

#include <stdio.h>
#include <time.h>
#include <string.h>
#include "global.h"
#if MD == 2
#include "md2.h"
#endif
#if MD == 4
#include "md4.h"
#endif
#if MD == 5
#include "md5.h"
#endif

/* Length of test block, number of test blocks.
 */
#define TEST_BLOCK_LEN 1000
#define TEST_BLOCK_COUNT 1000

static void MDString PROTO_LIST ((char *));
static void MDTimeTrial PROTO_LIST ((void));
static void MDTestSuite PROTO_LIST ((void));
static void MDFile PROTO_LIST ((char *));
static void MDFilter PROTO_LIST ((void));
static void MDPrint PROTO_LIST ((unsigned char [16]));

#if MD == 2
#define MD_CTX MD2_CTX
#define MDInit MD2Init
#define MDUpdate MD2Update
#define MDFinal MD2Final

Rivest                                                         [Page 15]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

#endif
#if MD == 4
#define MD_CTX MD4_CTX
#define MDInit MD4Init
#define MDUpdate MD4Update
#define MDFinal MD4Final
#endif
#if MD == 5
#define MD_CTX MD5_CTX
#define MDInit MD5Init
#define MDUpdate MD5Update
#define MDFinal MD5Final
#endif

/* Main driver.

   Arguments (may be any combination):
     -sstring - digests string
     -t       - runs time trial
     -x       - runs test script
     filename - digests file
     (none)   - digests standard input
 */
int main (argc, argv)
int argc;
char *argv[];
{
  int i;

  if (argc > 1)
    for (i = 1; i < argc; i++)
      if (argv[i][0] == '-' && argv[i][1] == 's')
        MDString (argv[i] + 2);
      else if (strcmp (argv[i], "-t") == 0)
        MDTimeTrial ();
      else if (strcmp (argv[i], "-x") == 0)
        MDTestSuite ();
      else
        MDFile (argv[i]);
  else
    MDFilter ();

  return (0);
}

/* Digests a string and prints the result.
 */
static void MDString (string)

Rivest                                                         [Page 16]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

char *string;
{
  MD_CTX context;
  unsigned char digest[16];
  unsigned int len = strlen (string);

  MDInit (&context);
  MDUpdate (&context, string, len);
  MDFinal (digest, &context);

  printf ("MD%d (\"%s\") = ", MD, string);
  MDPrint (digest);
  printf ("\n");
}

/* Measures the time to digest TEST_BLOCK_COUNT TEST_BLOCK_LEN-byte
     blocks.
 */
static void MDTimeTrial ()
{
  MD_CTX context;
  time_t endTime, startTime;
  unsigned char block[TEST_BLOCK_LEN], digest[16];
  unsigned int i;

  printf
    ("MD%d time trial. Digesting %d %d-byte blocks ...", MD,
     TEST_BLOCK_LEN, TEST_BLOCK_COUNT);

  /* Initialize block */
  for (i = 0; i < TEST_BLOCK_LEN; i++)
    block[i] = (unsigned char)(i & 0xff);

  /* Start timer */
  time (&startTime);

  /* Digest blocks */
  MDInit (&context);
  for (i = 0; i < TEST_BLOCK_COUNT; i++)
    MDUpdate (&context, block, TEST_BLOCK_LEN);
  MDFinal (digest, &context);

  /* Stop timer */
  time (&endTime);

  printf (" done\n");
  printf ("Digest = ");
  MDPrint (digest);

Rivest                                                         [Page 17]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

  printf ("\nTime = %ld seconds\n", (long)(endTime-startTime));
  printf
    ("Speed = %ld bytes/second\n",
     (long)TEST_BLOCK_LEN * (long)TEST_BLOCK_COUNT/(endTime-startTime));
}

/* Digests a reference suite of strings and prints the results.
 */
static void MDTestSuite ()
{
  printf ("MD%d test suite:\n", MD);

  MDString ("");
  MDString ("a");
  MDString ("abc");
  MDString ("message digest");
  MDString ("abcdefghijklmnopqrstuvwxyz");
  MDString
    ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
  MDString

    ("1234567890123456789012345678901234567890\
1234567890123456789012345678901234567890");
}

/* Digests a file and prints the result.
 */
static void MDFile (filename)
char *filename;
{
  FILE *file;
  MD_CTX context;
  int len;
  unsigned char buffer[1024], digest[16];

  if ((file = fopen (filename, "rb")) == NULL)
    printf ("%s can't be opened\n", filename);

  else {
    MDInit (&context);
    while (len = fread (buffer, 1, 1024, file))
      MDUpdate (&context, buffer, len);
    MDFinal (digest, &context);

    fclose (file);

    printf ("MD%d (%s) = ", MD, filename);
    MDPrint (digest);

Rivest                                                         [Page 18]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

    printf ("\n");
  }
}

/* Digests the standard input and prints the result.
 */
static void MDFilter ()
{
  MD_CTX context;
  int len;
  unsigned char buffer[16], digest[16];

  MDInit (&context);
  while (len = fread (buffer, 1, 16, stdin))
    MDUpdate (&context, buffer, len);
  MDFinal (digest, &context);

  MDPrint (digest);
  printf ("\n");
}

/* Prints a message digest in hexadecimal.
 */
static void MDPrint (digest)
unsigned char digest[16];

{
  unsigned int i;

  for (i = 0; i < 16; i++)
    printf ("%02x", digest[i]);
}

A.5 Test suite

   The MD4 test suite (driver option "-x") should print the following
   results:

MD4 test suite:
MD4 ("") = 31d6cfe0d16ae931b73c59d7e0c089c0
MD4 ("a") = bde52cb31de33e46245e05fbdbd6fb24
MD4 ("abc") = a448017aaf21d8525fc10ae87aa6729d
MD4 ("message digest") = d9130a8164549fe818874806e1c7014b
MD4 ("abcdefghijklmnopqrstuvwxyz") = d79e1c308aa5bbcdeea8ed63df412da9
MD4 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") =
043f8582f241db351ce627e153e7f0e4
MD4 ("123456789012345678901234567890123456789012345678901234567890123456
78901234567890") = e33b4ddc9c38f2199c3e7b164fcc0536

Rivest                                                         [Page 19]

RFC 1320              MD4 Message-Digest Algorithm            April 1992

Security Considerations

   The level of security discussed in this memo is considered to be
   sufficient for implementing moderate security hybrid digital-
   signature schemes based on MD4 and a public-key cryptosystem. We do
   not know of any reason that MD4 would not be sufficient for
   implementing very high security digital-signature schemes, but
   because MD4 was designed to be exceptionally fast, it is "at the
   edge" in terms of risking successful cryptanalytic attack. After
   further critical review, it may be appropriate to consider MD4 for
   very high security applications. For very high security applications
   before the completion of that review, the MD5 algorithm [4] is
   recommended.

Author's Address

   Ronald L. Rivest
   Massachusetts Institute of Technology
   Laboratory for Computer Science
   NE43-324
   545 Technology Square
   Cambridge, MA  02139-1986

   Phone: (617) 253-5880
   EMail: rivest@theory.lcs.mit.edu

Rivest                                                         [Page 20]


Network Working Group                                          R. Rivest
Request for Comments: 1321           MIT Laboratory for Computer Science
                                             and RSA Data Security, Inc.
                                                              April 1992

                     The MD5 Message-Digest Algorithm

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard.  Distribution of this memo is
   unlimited.

Acknowlegements

   We would like to thank Don Coppersmith, Burt Kaliski, Ralph Merkle,
   David Chaum, and Noam Nisan for numerous helpful comments and
   suggestions.

Table of Contents

   1. Executive Summary                                                1
   2. Terminology and Notation                                         2
   3. MD5 Algorithm Description                                        3
   4. Summary                                                          6
   5. Differences Between MD4 and MD5                                  6
   References                                                          7
   APPENDIX A - Reference Implementation                               7
   Security Considerations                                            21
   Author's Address                                                   21

1. Executive Summary

   This document describes the MD5 message-digest algorithm. The
   algorithm takes as input a message of arbitrary length and produces
   as output a 128-bit "fingerprint" or "message digest" of the input.
   It is conjectured that it is computationally infeasible to produce
   two messages having the same message digest, or to produce any
   message having a given prespecified target message digest. The MD5
   algorithm is intended for digital signature applications, where a
   large file must be "compressed" in a secure manner before being
   encrypted with a private (secret) key under a public-key cryptosystem
   such as RSA.

Rivest                                                          [Page 1]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

   The MD5 algorithm is designed to be quite fast on 32-bit machines. In
   addition, the MD5 algorithm does not require any large substitution
   tables; the algorithm can be coded quite compactly.

   The MD5 algorithm is an extension of the MD4 message-digest algorithm
   1,2]. MD5 is slightly slower than MD4, but is more "conservative" in
   design. MD5 was designed because it was felt that MD4 was perhaps
   being adopted for use more quickly than justified by the existing
   critical review; because MD4 was designed to be exceptionally fast,
   it is "at the edge" in terms of risking successful cryptanalytic
   attack. MD5 backs off a bit, giving up a little in speed for a much
   greater likelihood of ultimate security. It incorporates some
   suggestions made by various reviewers, and contains additional
   optimizations. The MD5 algorithm is being placed in the public domain
   for review and possible adoption as a standard.

   For OSI-based applications, MD5's object identifier is

   md5 OBJECT IDENTIFIER ::=
     iso(1) member-body(2) US(840) rsadsi(113549) digestAlgorithm(2) 5}

   In the X.509 type AlgorithmIdentifier [3], the parameters for MD5
   should have type NULL.

2. Terminology and Notation

   In this document a "word" is a 32-bit quantity and a "byte" is an
   eight-bit quantity. A sequence of bits can be interpreted in a
   natural manner as a sequence of bytes, where each consecutive group
   of eight bits is interpreted as a byte with the high-order (most
   significant) bit of each byte listed first. Similarly, a sequence of
   bytes can be interpreted as a sequence of 32-bit words, where each
   consecutive group of four bytes is interpreted as a word with the
   low-order (least significant) byte given first.

   Let x_i denote "x sub i". If the subscript is an expression, we
   surround it in braces, as in x_{i+1}. Similarly, we use ^ for
   superscripts (exponentiation), so that x^i denotes x to the i-th
   power.

   Let the symbol "+" denote addition of words (i.e., modulo-2^32
   addition). Let X <<< s denote the 32-bit value obtained by circularly
   shifting (rotating) X left by s bit positions. Let not(X) denote the
   bit-wise complement of X, and let X v Y denote the bit-wise OR of X
   and Y. Let X xor Y denote the bit-wise XOR of X and Y, and let XY
   denote the bit-wise AND of X and Y.

Rivest                                                          [Page 2]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

3. MD5 Algorithm Description

   We begin by supposing that we have a b-bit message as input, and that
   we wish to find its message digest. Here b is an arbitrary
   nonnegative integer; b may be zero, it need not be a multiple of
   eight, and it may be arbitrarily large. We imagine the bits of the
   message written down as follows:

          m_0 m_1 ... m_{b-1}

   The following five steps are performed to compute the message digest
   of the message.

3.1 Step 1. Append Padding Bits

   The message is "padded" (extended) so that its length (in bits) is
   congruent to 448, modulo 512. That is, the message is extended so
   that it is just 64 bits shy of being a multiple of 512 bits long.
   Padding is always performed, even if the length of the message is
   already congruent to 448, modulo 512.

   Padding is performed as follows: a single "1" bit is appended to the
   message, and then "0" bits are appended so that the length in bits of
   the padded message becomes congruent to 448, modulo 512. In all, at
   least one bit and at most 512 bits are appended.

3.2 Step 2. Append Length

   A 64-bit representation of b (the length of the message before the
   padding bits were added) is appended to the result of the previous
   step. In the unlikely event that b is greater than 2^64, then only
   the low-order 64 bits of b are used. (These bits are appended as two
   32-bit words and appended low-order word first in accordance with the
   previous conventions.)

   At this point the resulting message (after padding with bits and with
   b) has a length that is an exact multiple of 512 bits. Equivalently,
   this message has a length that is an exact multiple of 16 (32-bit)
   words. Let M[0 ... N-1] denote the words of the resulting message,
   where N is a multiple of 16.

3.3 Step 3. Initialize MD Buffer

   A four-word buffer (A,B,C,D) is used to compute the message digest.
   Here each of A, B, C, D is a 32-bit register. These registers are
   initialized to the following values in hexadecimal, low-order bytes
   first):

Rivest                                                          [Page 3]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

          word A: 01 23 45 67
          word B: 89 ab cd ef
          word C: fe dc ba 98
          word D: 76 54 32 10

3.4 Step 4. Process Message in 16-Word Blocks

   We first define four auxiliary functions that each take as input
   three 32-bit words and produce as output one 32-bit word.

          F(X,Y,Z) = XY v not(X) Z
          G(X,Y,Z) = XZ v Y not(Z)
          H(X,Y,Z) = X xor Y xor Z
          I(X,Y,Z) = Y xor (X v not(Z))

   In each bit position F acts as a conditional: if X then Y else Z.
   The function F could have been defined using + instead of v since XY
   and not(X)Z will never have 1's in the same bit position.) It is
   interesting to note that if the bits of X, Y, and Z are independent
   and unbiased, the each bit of F(X,Y,Z) will be independent and
   unbiased.

   The functions G, H, and I are similar to the function F, in that they
   act in "bitwise parallel" to produce their output from the bits of X,
   Y, and Z, in such a manner that if the corresponding bits of X, Y,
   and Z are independent and unbiased, then each bit of G(X,Y,Z),
   H(X,Y,Z), and I(X,Y,Z) will be independent and unbiased. Note that
   the function H is the bit-wise "xor" or "parity" function of its
   inputs.

   This step uses a 64-element table T[1 ... 64] constructed from the
   sine function. Let T[i] denote the i-th element of the table, which
   is equal to the integer part of 4294967296 times abs(sin(i)), where i
   is in radians. The elements of the table are given in the appendix.

   Do the following:

   /* Process each 16-word block. */
   For i = 0 to N/16-1 do

     /* Copy block i into X. */
     For j = 0 to 15 do
       Set X[j] to M[i*16+j].
     end /* of loop on j */

     /* Save A as AA, B as BB, C as CC, and D as DD. */
     AA = A
     BB = B

Rivest                                                          [Page 4]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

     CC = C
     DD = D

     /* Round 1. */
     /* Let [abcd k s i] denote the operation
          a = b + ((a + F(b,c,d) + X[k] + T[i]) <<< s). */
     /* Do the following 16 operations. */
     [ABCD  0  7  1]  [DABC  1 12  2]  [CDAB  2 17  3]  [BCDA  3 22  4]
     [ABCD  4  7  5]  [DABC  5 12  6]  [CDAB  6 17  7]  [BCDA  7 22  8]
     [ABCD  8  7  9]  [DABC  9 12 10]  [CDAB 10 17 11]  [BCDA 11 22 12]
     [ABCD 12  7 13]  [DABC 13 12 14]  [CDAB 14 17 15]  [BCDA 15 22 16]

     /* Round 2. */
     /* Let [abcd k s i] denote the operation
          a = b + ((a + G(b,c,d) + X[k] + T[i]) <<< s). */
     /* Do the following 16 operations. */
     [ABCD  1  5 17]  [DABC  6  9 18]  [CDAB 11 14 19]  [BCDA  0 20 20]
     [ABCD  5  5 21]  [DABC 10  9 22]  [CDAB 15 14 23]  [BCDA  4 20 24]
     [ABCD  9  5 25]  [DABC 14  9 26]  [CDAB  3 14 27]  [BCDA  8 20 28]
     [ABCD 13  5 29]  [DABC  2  9 30]  [CDAB  7 14 31]  [BCDA 12 20 32]

     /* Round 3. */
     /* Let [abcd k s t] denote the operation
          a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s). */
     /* Do the following 16 operations. */
     [ABCD  5  4 33]  [DABC  8 11 34]  [CDAB 11 16 35]  [BCDA 14 23 36]
     [ABCD  1  4 37]  [DABC  4 11 38]  [CDAB  7 16 39]  [BCDA 10 23 40]
     [ABCD 13  4 41]  [DABC  0 11 42]  [CDAB  3 16 43]  [BCDA  6 23 44]
     [ABCD  9  4 45]  [DABC 12 11 46]  [CDAB 15 16 47]  [BCDA  2 23 48]

     /* Round 4. */
     /* Let [abcd k s t] denote the operation
          a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s). */
     /* Do the following 16 operations. */
     [ABCD  0  6 49]  [DABC  7 10 50]  [CDAB 14 15 51]  [BCDA  5 21 52]
     [ABCD 12  6 53]  [DABC  3 10 54]  [CDAB 10 15 55]  [BCDA  1 21 56]
     [ABCD  8  6 57]  [DABC 15 10 58]  [CDAB  6 15 59]  [BCDA 13 21 60]
     [ABCD  4  6 61]  [DABC 11 10 62]  [CDAB  2 15 63]  [BCDA  9 21 64]

     /* Then perform the following additions. (That is increment each
        of the four registers by the value it had before this block
        was started.) */
     A = A + AA
     B = B + BB
     C = C + CC
     D = D + DD

   end /* of loop on i */

Rivest                                                          [Page 5]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

3.5 Step 5. Output

   The message digest produced as output is A, B, C, D. That is, we
   begin with the low-order byte of A, and end with the high-order byte
   of D.

   This completes the description of MD5. A reference implementation in
   C is given in the appendix.

4. Summary

   The MD5 message-digest algorithm is simple to implement, and provides
   a "fingerprint" or message digest of a message of arbitrary length.
   It is conjectured that the difficulty of coming up with two messages
   having the same message digest is on the order of 2^64 operations,
   and that the difficulty of coming up with any message having a given
   message digest is on the order of 2^128 operations. The MD5 algorithm
   has been carefully scrutinized for weaknesses. It is, however, a
   relatively new algorithm and further security analysis is of course
   justified, as is the case with any new proposal of this sort.

5. Differences Between MD4 and MD5

     The following are the differences between MD4 and MD5:

       1.   A fourth round has been added.

       2.   Each step now has a unique additive constant.

       3.   The function g in round 2 was changed from (XY v XZ v YZ) to
       (XZ v Y not(Z)) to make g less symmetric.

       4.   Each step now adds in the result of the previous step.  This
       promotes a faster "avalanche effect".

       5.   The order in which input words are accessed in rounds 2 and
       3 is changed, to make these patterns less like each other.

       6.   The shift amounts in each round have been approximately
       optimized, to yield a faster "avalanche effect." The shifts in
       different rounds are distinct.

Rivest                                                          [Page 6]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

References

   [1] Rivest, R., "The MD4 Message Digest Algorithm", RFC 1320, MIT and
       RSA Data Security, Inc., April 1992.

   [2] Rivest, R., "The MD4 message digest algorithm", in A.J.  Menezes
       and S.A. Vanstone, editors, Advances in Cryptology - CRYPTO '90
       Proceedings, pages 303-311, Springer-Verlag, 1991.

   [3] CCITT Recommendation X.509 (1988), "The Directory -
       Authentication Framework."

APPENDIX A - Reference Implementation

   This appendix contains the following files taken from RSAREF: A
   Cryptographic Toolkit for Privacy-Enhanced Mail:

     global.h -- global header file

     md5.h -- header file for MD5

     md5c.c -- source code for MD5

   For more information on RSAREF, send email to <rsaref@rsa.com>.

   The appendix also includes the following file:

     mddriver.c -- test driver for MD2, MD4 and MD5

   The driver compiles for MD5 by default but can compile for MD2 or MD4
   if the symbol MD is defined on the C compiler command line as 2 or 4.

   The implementation is portable and should work on many different
   plaforms. However, it is not difficult to optimize the implementation
   on particular platforms, an exercise left to the reader. For example,
   on "little-endian" platforms where the lowest-addressed byte in a 32-
   bit word is the least significant and there are no alignment
   restrictions, the call to Decode in MD5Transform can be replaced with
   a typecast.

A.1 global.h

/* GLOBAL.H - RSAREF types and constants
 */

/* PROTOTYPES should be set to one if and only if the compiler supports
  function argument prototyping.
The following makes PROTOTYPES default to 0 if it has not already

Rivest                                                          [Page 7]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

  been defined with C compiler flags.
 */
#ifndef PROTOTYPES
#define PROTOTYPES 0
#endif

/* POINTER defines a generic pointer type */
typedef unsigned char *POINTER;

/* UINT2 defines a two byte word */
typedef unsigned short int UINT2;

/* UINT4 defines a four byte word */
typedef unsigned long int UINT4;

/* PROTO_LIST is defined depending on how PROTOTYPES is defined above.
If using PROTOTYPES, then PROTO_LIST returns the list, otherwise it
  returns an empty list.
 */
#if PROTOTYPES
#define PROTO_LIST(list) list
#else
#define PROTO_LIST(list) ()
#endif

A.2 md5.h

/* MD5.H - header file for MD5C.C
 */

/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
rights reserved.

License to copy and use this software is granted provided that it
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
Algorithm" in all material mentioning or referencing this software
or this function.

License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material
mentioning or referencing the derived work.

RSA Data Security, Inc. makes no representations concerning either
the merchantability of this software or the suitability of this
software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.

Rivest                                                          [Page 8]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

These notices must be retained in any copies of any part of this
documentation and/or software.
 */

/* MD5 context. */
typedef struct {
  UINT4 state[4];                                   /* state (ABCD) */
  UINT4 count[2];        /* number of bits, modulo 2^64 (lsb first) */
  unsigned char buffer[64];                         /* input buffer */
} MD5_CTX;

void MD5Init PROTO_LIST ((MD5_CTX *));
void MD5Update PROTO_LIST
  ((MD5_CTX *, unsigned char *, unsigned int));
void MD5Final PROTO_LIST ((unsigned char [16], MD5_CTX *));

A.3 md5c.c

/* MD5C.C - RSA Data Security, Inc., MD5 message-digest algorithm
 */

/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
rights reserved.

License to copy and use this software is granted provided that it
is identified as the "RSA Data Security, Inc. MD5 Message-Digest
Algorithm" in all material mentioning or referencing this software
or this function.

License is also granted to make and use derivative works provided
that such works are identified as "derived from the RSA Data
Security, Inc. MD5 Message-Digest Algorithm" in all material
mentioning or referencing the derived work.

RSA Data Security, Inc. makes no representations concerning either
the merchantability of this software or the suitability of this
software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.

These notices must be retained in any copies of any part of this
documentation and/or software.
 */

#include "global.h"
#include "md5.h"

/* Constants for MD5Transform routine.
 */

Rivest                                                          [Page 9]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

#define S11 7
#define S12 12
#define S13 17
#define S14 22
#define S21 5
#define S22 9
#define S23 14
#define S24 20
#define S31 4
#define S32 11
#define S33 16
#define S34 23
#define S41 6
#define S42 10
#define S43 15
#define S44 21

static void MD5Transform PROTO_LIST ((UINT4 [4], unsigned char [64]));
static void Encode PROTO_LIST
  ((unsigned char *, UINT4 *, unsigned int));
static void Decode PROTO_LIST
  ((UINT4 *, unsigned char *, unsigned int));
static void MD5_memcpy PROTO_LIST ((POINTER, POINTER, unsigned int));
static void MD5_memset PROTO_LIST ((POINTER, int, unsigned int));

static unsigned char PADDING[64] = {
  0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
};

/* F, G, H and I are basic MD5 functions.
 */
#define F(x, y, z) (((x) & (y)) | ((~x) & (z)))
#define G(x, y, z) (((x) & (z)) | ((y) & (~z)))
#define H(x, y, z) ((x) ^ (y) ^ (z))
#define I(x, y, z) ((y) ^ ((x) | (~z)))

/* ROTATE_LEFT rotates x left n bits.
 */
#define ROTATE_LEFT(x, n) (((x) << (n)) | ((x) >> (32-(n))))

/* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4.
Rotation is separate from addition to prevent recomputation.
 */
#define FF(a, b, c, d, x, s, ac) { \
 (a) += F ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \

Rivest                                                         [Page 10]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

 (a) += (b); \
  }
#define GG(a, b, c, d, x, s, ac) { \
 (a) += G ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \
 (a) += (b); \
  }
#define HH(a, b, c, d, x, s, ac) { \
 (a) += H ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \
 (a) += (b); \
  }
#define II(a, b, c, d, x, s, ac) { \
 (a) += I ((b), (c), (d)) + (x) + (UINT4)(ac); \
 (a) = ROTATE_LEFT ((a), (s)); \
 (a) += (b); \
  }

/* MD5 initialization. Begins an MD5 operation, writing a new context.
 */
void MD5Init (context)
MD5_CTX *context;                                        /* context */
{
  context->count[0] = context->count[1] = 0;
  /* Load magic initialization constants.
*/
  context->state[0] = 0x67452301;
  context->state[1] = 0xefcdab89;
  context->state[2] = 0x98badcfe;
  context->state[3] = 0x10325476;
}

/* MD5 block update operation. Continues an MD5 message-digest
  operation, processing another message block, and updating the
  context.
 */
void MD5Update (context, input, inputLen)
MD5_CTX *context;                                        /* context */
unsigned char *input;                                /* input block */
unsigned int inputLen;                     /* length of input block */
{
  unsigned int i, index, partLen;

  /* Compute number of bytes mod 64 */
  index = (unsigned int)((context->count[0] >> 3) & 0x3F);

  /* Update number of bits */
  if ((context->count[0] += ((UINT4)inputLen << 3))

Rivest                                                         [Page 11]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

   < ((UINT4)inputLen << 3))
 context->count[1]++;
  context->count[1] += ((UINT4)inputLen >> 29);

  partLen = 64 - index;

  /* Transform as many times as possible.
*/
  if (inputLen >= partLen) {
 MD5_memcpy
   ((POINTER)&context->buffer[index], (POINTER)input, partLen);
 MD5Transform (context->state, context->buffer);

 for (i = partLen; i + 63 < inputLen; i += 64)
   MD5Transform (context->state, &input[i]);

 index = 0;
  }
  else
 i = 0;

  /* Buffer remaining input */
  MD5_memcpy
 ((POINTER)&context->buffer[index], (POINTER)&input[i],
  inputLen-i);
}

/* MD5 finalization. Ends an MD5 message-digest operation, writing the
  the message digest and zeroizing the context.
 */
void MD5Final (digest, context)
unsigned char digest[16];                         /* message digest */
MD5_CTX *context;                                       /* context */
{
  unsigned char bits[8];
  unsigned int index, padLen;

  /* Save number of bits */
  Encode (bits, context->count, 8);

  /* Pad out to 56 mod 64.
*/
  index = (unsigned int)((context->count[0] >> 3) & 0x3f);
  padLen = (index < 56) ? (56 - index) : (120 - index);
  MD5Update (context, PADDING, padLen);

  /* Append length (before padding) */
  MD5Update (context, bits, 8);

Rivest                                                         [Page 12]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

  /* Store state in digest */
  Encode (digest, context->state, 16);

  /* Zeroize sensitive information.
*/
  MD5_memset ((POINTER)context, 0, sizeof (*context));
}

/* MD5 basic transformation. Transforms state based on block.
 */
static void MD5Transform (state, block)
UINT4 state[4];
unsigned char block[64];
{
  UINT4 a = state[0], b = state[1], c = state[2], d = state[3], x[16];

  Decode (x, block, 64);

  /* Round 1 */
  FF (a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */
  FF (d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */
  FF (c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */
  FF (b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */
  FF (a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */
  FF (d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */
  FF (c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */
  FF (b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */
  FF (a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */
  FF (d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */
  FF (c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */
  FF (b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */
  FF (a, b, c, d, x[12], S11, 0x6b901122); /* 13 */
  FF (d, a, b, c, x[13], S12, 0xfd987193); /* 14 */
  FF (c, d, a, b, x[14], S13, 0xa679438e); /* 15 */
  FF (b, c, d, a, x[15], S14, 0x49b40821); /* 16 */

 /* Round 2 */
  GG (a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */
  GG (d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */
  GG (c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */
  GG (b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */
  GG (a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */
  GG (d, a, b, c, x[10], S22,  0x2441453); /* 22 */
  GG (c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */
  GG (b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */
  GG (a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */
  GG (d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */
  GG (c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */

Rivest                                                         [Page 13]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

  GG (b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */
  GG (a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */
  GG (d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */
  GG (c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */
  GG (b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */

  /* Round 3 */
  HH (a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */
  HH (d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */
  HH (c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */
  HH (b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */
  HH (a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */
  HH (d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */
  HH (c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */
  HH (b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */
  HH (a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */
  HH (d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */
  HH (c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */
  HH (b, c, d, a, x[ 6], S34,  0x4881d05); /* 44 */
  HH (a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */
  HH (d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */
  HH (c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */
  HH (b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */

  /* Round 4 */
  II (a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */
  II (d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */
  II (c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */
  II (b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */
  II (a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */
  II (d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */
  II (c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */
  II (b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */
  II (a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */
  II (d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */
  II (c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */
  II (b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */
  II (a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */
  II (d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */
  II (c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */
  II (b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */

  state[0] += a;
  state[1] += b;
  state[2] += c;
  state[3] += d;

  /* Zeroize sensitive information.

Rivest                                                         [Page 14]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

*/
  MD5_memset ((POINTER)x, 0, sizeof (x));
}

/* Encodes input (UINT4) into output (unsigned char). Assumes len is
  a multiple of 4.
 */
static void Encode (output, input, len)
unsigned char *output;
UINT4 *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4) {
 output[j] = (unsigned char)(input[i] & 0xff);
 output[j+1] = (unsigned char)((input[i] >> 8) & 0xff);
 output[j+2] = (unsigned char)((input[i] >> 16) & 0xff);
 output[j+3] = (unsigned char)((input[i] >> 24) & 0xff);
  }
}

/* Decodes input (unsigned char) into output (UINT4). Assumes len is
  a multiple of 4.
 */
static void Decode (output, input, len)
UINT4 *output;
unsigned char *input;
unsigned int len;
{
  unsigned int i, j;

  for (i = 0, j = 0; j < len; i++, j += 4)
 output[i] = ((UINT4)input[j]) | (((UINT4)input[j+1]) << 8) |
   (((UINT4)input[j+2]) << 16) | (((UINT4)input[j+3]) << 24);
}

/* Note: Replace "for loop" with standard memcpy if possible.
 */

static void MD5_memcpy (output, input, len)
POINTER output;
POINTER input;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)

Rivest                                                         [Page 15]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

 output[i] = input[i];
}

/* Note: Replace "for loop" with standard memset if possible.
 */
static void MD5_memset (output, value, len)
POINTER output;
int value;
unsigned int len;
{
  unsigned int i;

  for (i = 0; i < len; i++)
 ((char *)output)[i] = (char)value;
}

A.4 mddriver.c

/* MDDRIVER.C - test driver for MD2, MD4 and MD5
 */

/* Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
rights reserved.

RSA Data Security, Inc. makes no representations concerning either
the merchantability of this software or the suitability of this
software for any particular purpose. It is provided "as is"
without express or implied warranty of any kind.

These notices must be retained in any copies of any part of this
documentation and/or software.
 */

/* The following makes MD default to MD5 if it has not already been
  defined with C compiler flags.
 */
#ifndef MD
#define MD MD5
#endif

#include <stdio.h>
#include <time.h>
#include <string.h>
#include "global.h"
#if MD == 2
#include "md2.h"
#endif
#if MD == 4

Rivest                                                         [Page 16]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

#include "md4.h"
#endif
#if MD == 5
#include "md5.h"
#endif

/* Length of test block, number of test blocks.
 */
#define TEST_BLOCK_LEN 1000
#define TEST_BLOCK_COUNT 1000

static void MDString PROTO_LIST ((char *));
static void MDTimeTrial PROTO_LIST ((void));
static void MDTestSuite PROTO_LIST ((void));
static void MDFile PROTO_LIST ((char *));
static void MDFilter PROTO_LIST ((void));
static void MDPrint PROTO_LIST ((unsigned char [16]));

#if MD == 2
#define MD_CTX MD2_CTX
#define MDInit MD2Init
#define MDUpdate MD2Update
#define MDFinal MD2Final
#endif
#if MD == 4
#define MD_CTX MD4_CTX
#define MDInit MD4Init
#define MDUpdate MD4Update
#define MDFinal MD4Final
#endif
#if MD == 5
#define MD_CTX MD5_CTX
#define MDInit MD5Init
#define MDUpdate MD5Update
#define MDFinal MD5Final
#endif

/* Main driver.

Arguments (may be any combination):
  -sstring - digests string
  -t       - runs time trial
  -x       - runs test script
  filename - digests file
  (none)   - digests standard input
 */
int main (argc, argv)
int argc;

Rivest                                                         [Page 17]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

char *argv[];
{
  int i;

  if (argc > 1)
 for (i = 1; i < argc; i++)
   if (argv[i][0] == '-' && argv[i][1] == 's')
     MDString (argv[i] + 2);
   else if (strcmp (argv[i], "-t") == 0)
     MDTimeTrial ();
   else if (strcmp (argv[i], "-x") == 0)
     MDTestSuite ();
   else
     MDFile (argv[i]);
  else
 MDFilter ();

  return (0);
}

/* Digests a string and prints the result.
 */
static void MDString (string)
char *string;
{
  MD_CTX context;
  unsigned char digest[16];
  unsigned int len = strlen (string);

  MDInit (&context);
  MDUpdate (&context, string, len);
  MDFinal (digest, &context);

  printf ("MD%d (\"%s\") = ", MD, string);
  MDPrint (digest);
  printf ("\n");
}

/* Measures the time to digest TEST_BLOCK_COUNT TEST_BLOCK_LEN-byte
  blocks.
 */
static void MDTimeTrial ()
{
  MD_CTX context;
  time_t endTime, startTime;
  unsigned char block[TEST_BLOCK_LEN], digest[16];
  unsigned int i;

Rivest                                                         [Page 18]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

  printf
 ("MD%d time trial. Digesting %d %d-byte blocks ...", MD,
  TEST_BLOCK_LEN, TEST_BLOCK_COUNT);

  /* Initialize block */
  for (i = 0; i < TEST_BLOCK_LEN; i++)
 block[i] = (unsigned char)(i & 0xff);

  /* Start timer */
  time (&startTime);

  /* Digest blocks */
  MDInit (&context);
  for (i = 0; i < TEST_BLOCK_COUNT; i++)
 MDUpdate (&context, block, TEST_BLOCK_LEN);
  MDFinal (digest, &context);

  /* Stop timer */
  time (&endTime);

  printf (" done\n");
  printf ("Digest = ");
  MDPrint (digest);
  printf ("\nTime = %ld seconds\n", (long)(endTime-startTime));
  printf
 ("Speed = %ld bytes/second\n",
  (long)TEST_BLOCK_LEN * (long)TEST_BLOCK_COUNT/(endTime-startTime));
}

/* Digests a reference suite of strings and prints the results.
 */
static void MDTestSuite ()
{
  printf ("MD%d test suite:\n", MD);

  MDString ("");
  MDString ("a");
  MDString ("abc");
  MDString ("message digest");
  MDString ("abcdefghijklmnopqrstuvwxyz");
  MDString
 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789");
  MDString
 ("1234567890123456789012345678901234567890\
1234567890123456789012345678901234567890");
}

/* Digests a file and prints the result.

Rivest                                                         [Page 19]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

 */
static void MDFile (filename)
char *filename;
{
  FILE *file;
  MD_CTX context;
  int len;
  unsigned char buffer[1024], digest[16];

  if ((file = fopen (filename, "rb")) == NULL)
 printf ("%s can't be opened\n", filename);

  else {
 MDInit (&context);
 while (len = fread (buffer, 1, 1024, file))
   MDUpdate (&context, buffer, len);
 MDFinal (digest, &context);

 fclose (file);

 printf ("MD%d (%s) = ", MD, filename);
 MDPrint (digest);
 printf ("\n");
  }
}

/* Digests the standard input and prints the result.
 */
static void MDFilter ()
{
  MD_CTX context;
  int len;
  unsigned char buffer[16], digest[16];

  MDInit (&context);
  while (len = fread (buffer, 1, 16, stdin))
 MDUpdate (&context, buffer, len);
  MDFinal (digest, &context);

  MDPrint (digest);
  printf ("\n");
}

/* Prints a message digest in hexadecimal.
 */
static void MDPrint (digest)
unsigned char digest[16];
{

Rivest                                                         [Page 20]

RFC 1321              MD5 Message-Digest Algorithm            April 1992

  unsigned int i;

  for (i = 0; i < 16; i++)
 printf ("%02x", digest[i]);
}

A.5 Test suite

   The MD5 test suite (driver option "-x") should print the following
   results:

MD5 test suite:
MD5 ("") = d41d8cd98f00b204e9800998ecf8427e
MD5 ("a") = 0cc175b9c0f1b6a831c399e269772661
MD5 ("abc") = 900150983cd24fb0d6963f7d28e17f72
MD5 ("message digest") = f96b697d7cb7938d525a2f31aaf161d0
MD5 ("abcdefghijklmnopqrstuvwxyz") = c3fcd3d76192e4007dfb496cca67e13b
MD5 ("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789") =
d174ab98d277d9f5a5611c2c9f419d9f
MD5 ("123456789012345678901234567890123456789012345678901234567890123456
78901234567890") = 57edf4a22be3c955ac49da2e2107b67a

Security Considerations

   The level of security discussed in this memo is considered to be
   sufficient for implementing very high security hybrid digital-
   signature schemes based on MD5 and a public-key cryptosystem.

Author's Address

   Ronald L. Rivest
   Massachusetts Institute of Technology
   Laboratory for Computer Science
   NE43-324
   545 Technology Square
   Cambridge, MA  02139-1986

   Phone: (617) 253-5880
   EMail: rivest@theory.lcs.mit.edu

Rivest                                                         [Page 21]


Network Working Group                                           J. Touch
Request for Comments: 1810                                           ISI
Category: Informational                                        June 1995

                       Report on MD5 Performance

Status of this Memo

   This memo provides information for the Internet community.  This memo
   does not specify an Internet standard of any kind.  Distribution of
   this memo is unlimited.

Abstract

   MD5 is an authentication algorithm, which has been proposed as the
   default authentication option in IPv6.  When enabled, the MD5
   algorithm operates over the entire data packet, including header.
   This RFC addresses how fast MD5 can be implemented in software and
   hardware, and whether it supports currently available IP bandwidth.
   MD5 can be implemented in existing hardware technology at 256 Mbps,
   and in software at 87 Mbps.  These rates cannot support current IP
   rates, e.g., 100 Mbps TCP and 130 Mbps UDP over ATM.  If MD5 cannot
   support existing network bandwidth using existing technology, it will
   not scale as network speeds increase in the future.  This RFC is
   intended to alert the IP community about the performance limitations
   of MD5, and to suggest that alternatives be considered for use in
   high speed IP implementations.

Introduction

   MD5 is an authentication algorithm, which has been proposed as one
   authentication option in IPv6 [1].  RFC 1321 describes the MD5
   algorithm and gives a reference implementation [3].  When enabled,
   the MD5 algorithm operates over the entire data packet, including
   header (with dummy values for volatile fields).  This RFC addresses
   how fast MD5 can be implemented in software and hardware, and whether
   it supports currently available IP bandwidth.

   This RFC considers the general issue of checksumming and security at
   high speed in IPv6.  IPv6 has no header checksum (which IPv4 has
   [5]), but proposes an authentication digest over the entire body of
   the packet (including header where volatile fields are zeroed) [1].
   This RFC specifically addresses the performance of that
   authentication mechanism.

Touch                        Informational                      [Page 1]

RFC 1810               Report on MD5 Performance               June 1995

Measurements

   The performance of MD5 was measured.  The code was an optimized
   version of the MD5 reference implementation from the RFC [3], and is
   available for anonymous FTP [7].  The following are the results of
   the performance test "md5 -t", modified to prohibit on-chip caching
   of the data block:

        87 Mbps    DEC Alpha (190 Mhz)
        33 Mbps    HP 9000/720
        48 Mbps    IBM RS/6000 7006 (PPC 601 @80 Mhz)
        31 Mbps    Intel i486/66 NetBSD
        44 Mbps    Intel Pentium/90 NeXTStep
        52 Mbps    SGI/IP-20 IRIX 5.2
        37 Mbps    Sun SPARC-10/51, SPARC-20/50 SunOS 4.1.3
        57 Mbps    Sun SPARC-20/71 SunOS 4.1.3

   These rates do not keep up with currently available IP bandwidth,
   e.g., 100 Mbps TCP and 130 Mbps UDP over a Fore SBA-200 ATM host
   interface in a Sun SPARC-20/71.

   Values as high as 100 Mbps have been reported for the DEC Alpha (190
   Mhz).  These values reflect on-chip caching of the data.  It is not
   clear at this time whether in-memory, off-chip cache, or on-chip
   cache performance measures are more relevant to IP performance.

Analysis of the MD5 Algorithm

   The MD5 algorithm is a block-chained hashing algorithm.  The first
   block is hashed with an initial seed, resulting in a hash.  The hash
   is summed with the seed, and that result becomes the seed for the
   next block.  When the last block is computed, it's "next-seed' value
   becomes the hash for the entire stream. Thus, the seed for block
   depends on both the hash and the seed of its preceding block.  As a
   result, blocks cannot be hashed in parallel.

   Each 16-word (64-byte) block is hashed via 64 basic steps, using a
   4-word intermediate hash, and collapsing the intermediate hash at the
   end.  The 64 steps are 16 groups of 4 steps, one step per
   intermediate hash word.  This RFC uses the following notation (as
   from RFC-1321 [3]):

        A,B,C,D         intermediate hash words
        X[i]            input data block
        T[i]            sine table lookup
        << i            rotate i bits
        F               logical functions of 3 args

Touch                        Informational                      [Page 2]

RFC 1810               Report on MD5 Performance               June 1995

   The subscripts to X, I, and << are fixed for each step, and are
   omitted here.  There are four different logical functions, also
   omitted.  Each 4-step group looks like:

        A = B + ((A + F(B,C,D) + X[i] + T[i]) << i)
        D = A + ((D + F(A,B,C) + X[i] + T[i]) << i)
        C = D + ((C + F(D,A,B) + X[i] + T[i]) << i)
        B = C + ((B + F(C,D,A) + X[i] + T[i]) << i)

   Note that this has the general form shown below. Due to the
   complexity of the function 'f', these equations cannot be transformed
   into a less serial set.

        A = f(D); B = f(A); C = f(B); D = f(C)

   Each steps is composed of two table lookups, one rotation, a 3-
   component logical operation, and 4 additions.  The best
   parallelization possible leaves F(x,y,z) to the last step, waiting as
   long as possible for the result from the previous step.  The
   resulting tree is shown below.

     (t0) B* C  C  D      X   T
          |  |  |  |      |   |
          |  |  |  |      |   |
           \/    \/        \ /
      t1   op    op   A     +                               X   T
            \    /    \    /                                |   |
             \  /      \  /                                 |   |
              \/        \/                                   \ /
      t2      op        +             (t0) B* C  C  D   A     +
               \       /                   |  |  |  |    \    /
                 \   /                      \ |  | /      \  /
                  \ /                         \\//         \/
      t3           +                   t1      op          +
                   |                            \         /
                   |                              \     /
                   |                                \ /
      t4           <<      B*          t2            +       B*
                    \     /                           \     /
                     \   /                             <<  /
                      \ /                               \ /
      t5               +               t3                +
                       |                                 |
                       |                                 |
                       |                                 |
                       A**                               A**

            Binary operation tree             Optimized hardware tree

Touch                        Informational                      [Page 3]

RFC 1810               Report on MD5 Performance               June 1995

   This diagram assumes that each operation takes one unit time.  The
   tree shows the items that depend on the previous step as B*, and the
   item that the next step depends on as A**.  Sequences of the binary
   operation tree cannot be overlapped, but the optimized hardware tree
   can (by one time step).

   There are 4 steps processed per word of input, ignoring inter-block
   processing.  The speed of the overall algorithm depends on how fast
   we can process these 4 steps, vs.  the bandwidth of one word of input
   being processed.

   The binary tree takes 5 time units per step of the algorithm, and
   permits at best 3-way parallelism (at time t1).  In software, this
   means it takes 5 * 4 = 20 instructions per word input.  A computer
   capable of M MIPS can support a data bandwidth of M/20 * 32 Mbps,
   i.e., bits per second equal to 1.6x its MIPS rate.  Therefore, a 100
   MIPS machine can support a 160 Mbps stream.

        Parallel software rate in Mbps = 1.6 * MIPS rate

   This assumes that register reads and writes are overlapped with
   computation entirely.  Without any parallelism, there are 8
   operations per step, and 4 steps per word, so 32 operations per word,
   i.e., the data rate in Mbps would be identical to the MIPS rate:

        Serial software rate in Mbps = MIPS rate

   Predictions using SpecInt92 numbers as MIPS estimators can be
   compared with measured rates [2]:

     Spec-    Predicted      MD5
     Int92   Upper-Bound   Measured      Machine
   ------------------------------------------------------------
     122       122-195     87 Mbps    DEC Alpha (190 Mhz)
      48        48- 77     33 Mbps    HP 9000/720
      88        88-141     48 Mbps    IBM RS/6000 7006 (PPC 601 @80 Mhz)
      32        32- 51     31 Mbps    Intel i486/33 NetBSD
      90        90-144     44 Mbps    Intel Pentium/90 NeXTStep
      90        90-144     52 Mbps    SGI/IP-20 IRIX 5.2
      65        65-104     37 Mbps    Sun SPARC-10/51 SunOS 4.1.3
     126       126-202     57 Mbps    Sun SPARC-20/71 SunOS 4.1.3

   The hardware rate takes 3 time units per step, i.e.  3 * 4 = 12 time
   units per word of input.  Hardware capable of doing an operation
   (e.g., 32-bit addition) in N nanoseconds can support a data bandwidth
   of 32/12/N bps, i.e., 2/3N bps.

        Hardware rate in Mbps = 8/3N * 1,000

Touch                        Informational                      [Page 4]

RFC 1810               Report on MD5 Performance               June 1995

   For CMOS, an operation (32-bit addition, including register retrieval
   and storage) costs about 5.2 ns (2.6 ns per add, 2 ns for latching)
   [6].  There are 6 clocks through the most highly-parallelized
   implementation, resulting in 31.2 ns per 32-bit word, or 256 Mbps
   [6].  This will not keep pace with existing hardware, which is
   capable of link speeds in excess of 622 Mbps (ATM).

   By comparison, IPv4 uses the Internet Checksum [5].  This checksum
   can be performed in 32-bit-wide units in excess of 1 Gbps in an
   existing, low-cost PLD.  The checksum can also be parallelized by
   computing partial sums and reducing the result.

One Proposed Solution

   There are several ways to increase the performance of the IPv6
   authentication mechanism.  One is to increase the hardware
   performance of MD5 by slightly modifying the algorithm, the other is
   to propose a replacement algorithm.  This RFC discusses briefly the
   modification of MD5 for high-speed hardware implementation.
   Alternate algorithms, capable of 3.5x the speed of MD5, have been
   discussed elsewhere [6].

   MD5 uses block chaining to ensure sensitivity to block order.  Block
   chaining also prevents arbitrary parallelism, which can be as much a
   benefit to the spoofer as to the user.  MD5 can be slightly altered
   to accommodate a higher bandwidth data rate.  There should be a
   predetermined finite number of blocks processed from independent
   seeds, such that the I-th block is part of the "I mod K"-th chain.
   The resulting K digests themselves form a message, which can be MD5-
   encoded using a single-block algorithm. This idea was proposed
   independently by the author and by Burt Kaliski of RSA.

   The goal is to support finite parallelism to provide adequate
   bandwidth at current processing rates, without providing arbitrary
   power for spoofing.  It would require further analysis to ensure that
   it provides an adequate level of security.

   For current technology and network bandwidth, a minimum of 4-way
   parallel chaining would suffice, and 16-way chaining would be
   preferable.  This would support network bandwidth of 1 Gbps with 4-
   way chaining, in CMOS hardware.  The chaining parallelism should be a
   multiple of 4-way, to generate a complete block of digests (4 words
   per digest, 16 words per block).  This modification is believed to
   achieve the goals of MD5, without the penalties of implementation of
   the current MD5 algorithm.

Touch                        Informational                      [Page 5]

RFC 1810               Report on MD5 Performance               June 1995

Security Considerations

   This entire document addresses a mechanism for providing security in
   IPv6.  MD5 is the proposed default optional authentication mechanism
   for IPv6 traffic.  This RFC specifically addresses the concern that
   security mechanisms such as MD5 that cannot support high bandwidth
   with available hardware will compromise their deployment, and
   ultimately, the security of the systems they are intended to
   maintain.

   The IPv6 requirements document emphasizes that IPv6 implementations
   should not compromise performance, compared to IPv4.  This is
   presumably despite IPv6's increased functionality.  "Required
   optional" components of IPv6 should be held to this same standard.
   MD5 compromises performance, and so its use as a required default
   option in IPv6 should be reconsidered.

   The use of MD5 as the default to the required authentication option
   may compromise security in high-bandwidth systems, because enabling
   the option causes performance degradation, defeating its inclusion as
   an IPv6 option.  As a result, the authentication option may be
   disabled entirely.

   It is important to the use of authentication in high-performance
   systems that an alternative mechanism be available in IPv6 from the
   outset.  This may require the specification of multiple "required"
   authentication algorithms - one that's slower but believed strong,
   and one that's faster but may inspire somewhat less confidence.

Conclusions

   MD5 cannot be implemented in existing technology at rates in excess
   of 256 Mbps in hardware, or 86 Mbps in software.  MD5 is a proposed
   authentication option in IPv6, a protocol that should support
   existing networking technology, which is capable of 130 Mbps UDP.

   As a result, MD5 cannot be used to support IP authentication in
   existing networks at existing rates.  Although MD5 will support
   higher bandwidth in the future due to technological advances, these
   will be offset by similar advances in networking.  If MD5 cannot
   support existing network bandwidth using existing technology, it will
   not be able to scale as network speeds increase in the future.  This
   RFC proposes that MD5 be modified to support a 16-way block chaining,
   in order to allow existing technology (CMOS hardware) to support
   existing networking rates (1 Gbps).  It further proposes that
   alternatives to MD5 be considered for use in high-speed networks.

Touch                        Informational                      [Page 6]

RFC 1810               Report on MD5 Performance               June 1995

Acknowledgements

   The author would like to thank Steve Kent at BBN, Burt Kaliski,
   Victor Chang, and Steve Burnett at RSA, Ran Atkinson at the NRL, and
   the HPCC Division at ISI for reviewing the contents of this document.
   Burt independently suggested the block-parallel modification proposed
   here.

References

   [1] Atkinson, R., "IPv6 Authentication Header", Work in Progress,
       Naval Research Lab, February 1995.

   [2] DiMarco, J., "Spec Benchmark table, V.  4.12",
       <ftp://ftp.cfd.toronto.edu/pub/spectable>.

   [3] Rivest, R., "The MD5 Message-Digest Algorithm", RFC1321, MIT LCS
       & RSA Data Security, Inc., April 1992.

   [4] Partridge, C., and F. Kastenholz, "Technical Criteria for
       Choosing IP The Next Generation (IPng)", RFC 1726, BBN Systems
       and Technologies, FTP Software, December 1994.

   [5] Postel, J., "Internet Protocol - DARPA Internet Program Protocol
       Specification," STD 5, RFC 791, USC/Information Sciences
       Institute, September 1981.

   [6] Touch, J., "Performance Analysis fo MD5," to appear in ACM
       Sigcomm '95, Boston.

   [7] Touch, J., Optimized MD5 software, <ftp://ftp.isi.edu/pub/hpcc-
       papers/touch/md5-opt.tar>.

Author's Address

   Joe Touch
   Information Sciences Institute
   University of Southern California
   4676 Admiralty Way
   Marina del Rey, CA 90292-6695
   USA

   Phone: +1 310-822-1511 x151
   Fax:   +1 310-823-6714
   URL:   ftp://ftp.isi.edu/pub/hpcc-papers/touch
   EMail: touch@isi.edu

Touch                        Informational                      [Page 7]


Network Working Group                                         M. Oehler
Request for Comments: 2085                                          NSA
Category: Standards Track                                      R. Glenn
                                                                   NIST
                                                          February 1997

           HMAC-MD5 IP Authentication with Replay Prevention

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   This document describes a keyed-MD5 transform to be used in
   conjunction with the IP Authentication Header [RFC-1826]. The
   particular transform is based on [HMAC-MD5].  An option is also
   specified to guard against replay attacks.

Table of Contents

   1.  Introduction...................................................1
   1.1    Terminology.................................................2
   1.2    Keys........................................................2
   1.3    Data Size...................................................3
   2.  Packet Format..................................................3
   2.1    Replay Prevention...........................................4
   2.2    Authentication Data Calculation.............................4
   3.  Security Considerations........................................5
   Acknowledgments....................................................5
   References.........................................................6
   Authors' Addresses.................................................6

1. Introduction

   The Authentication Header (AH) [RFC-1826] provides integrity and
   authentication for IP datagrams. The transform specified in this
   document uses a keyed-MD5 mechanism [HMAC-MD5].  The mechanism uses
   the (key-less) MD5 hash function [RFC-1321] which produces a message
   digest. When combined with an AH Key, authentication data is
   produced. This value is placed in the Authentication Data field of
   the AH [RFC-1826]. This value is also the basis for the data
   integrity service offered by the AH protocol.

Oehler & Glenn              Standards Track                     [Page 1]

RFC 2085                        HMAC-MD5                  February 1997

   To provide protection against replay attacks, a Replay Prevention
   field is included as a transform option.  This field is used to help
   prevent attacks in which a message is stored and re-used later,
   replacing or repeating the original.  The Security Parameters Index
   (SPI) [RFC-1825] is used to determine whether this option is included
   in the AH.

   Familiarity with the following documents is assumed: "Security
   Architecture for the Internet Protocol" [RFC-1825], "IP
   Authentication Header" [RFC-1826], and "HMAC-MD5: Keyed-MD5 for
   Message Authentication" [HMAC-MD5].

   All implementations that claim conformance or compliance with the IP
   Authentication Header specification [RFC-1826] MUST implement this
   HMAC-MD5 transform.

1.1 Terminology

   In  this  document,  the  words  that  are  used  to   define   the
   significance  of each particular requirement are usually capitalized.
   These words are:

   - MUST

   This word or the adjective "REQUIRED" means that  the  item  is  an
   absolute requirement of the specification.

   - SHOULD

   This word or the adjective "RECOMMENDED"  means  that  there  might
   exist  valid reasons in particular circumstances to ignore this item,
   but the full implications should be understood and the case carefully
   weighed before taking a different course.

1.2 Keys

   The "AH Key" is used as a shared secret between two communicating
   parties.  The Key is not a "cryptographic key" as used in a
   traditional sense. Instead, the AH key (shared secret) is hashed with
   the transmitted data and thus, assures that an intervening party
   cannot duplicate the authentication data.

   Even though an AH key is not a cryptographic key, the rudimentary
   concerns of cryptographic keys still apply. Consider that the
   algorithm and most of the data used to produce the output is known.
   The strength of the transform lies in the singular mapping of the key
   (which needs to be strong) and the IP datagram (which is known) to
   the authentication data.  Thus, implementations should, and as

Oehler & Glenn              Standards Track                     [Page 2]

RFC 2085                        HMAC-MD5                  February 1997

   frequently as possible, change the AH key. Keys need to be chosen at
   random, or generated using a cryptographically strong pseudo-random
   generator seeded with a random seed. [HMAC-MD5]

   All conforming and compliant implementations MUST support a key
   length of 128 bits or less.  Implementations SHOULD support longer
   key lengths as well.  It is advised that the key length be chosen to
   be the length of the hash output, which is 128 bits for MD5.  For
   other key lengths the following concerns MUST be considered.

   A key length of zero is prohibited and implementations MUST prevent
   key lengths of zero from being used with this transform, since no
   effective authentication could be provided by a zero-length key.
   Keys having a length less than 128 bits are strongly discouraged as
   it would decrease the security strength of the function.  Keys longer
   than 128 bits are acceptable, but the extra length may not
   significantly increase the function strength.  A longer key may be
   advisable if the randomness of the key is suspect.  MD5 operates on
   64-byte blocks.  Keys longer than 64-bytes are first hashed using
   MD5.  The resulting hash is then used to calculate the authentication
   data.

1.3 Data Size

   MD5 produces a 128-bit value which is used as the authentication
   data.  It is naturally 64 bit aligned and thus, does not need any
   padding for machines with native double words.

2. Packet Format

     +---------------+---------------+---------------+---------------+
     | Next Header   | Length        |           RESERVED            |
     +---------------+---------------+---------------+---------------+
     |                              SPI                              |
     +---------------+---------------+---------------+---------------+
     |                     Replay Prevention                         |
     |                                                               |
     +---------------+---------------+---------------+---------------+
     |                                                               |
     +                     Authentication Data                       |
     |                                                               |
     +---------------+---------------+---------------+---------------+
      1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8

   The Next Header, RESERVED, and SPI fields are specified in [RFC-
   1826].  The Length field is the length of the Replay Prevention field
   and the Authentication Data in 32-bit words.

Oehler & Glenn              Standards Track                     [Page 3]

RFC 2085                        HMAC-MD5                  February 1997

2.1 Replay Prevention

   The Replay Prevention field is a 64-bit value used to guarantee that
   each packet exchanged between two parties is different.  Each IPsec
   Security Association specifies whether Replay Prevention is used for
   that Security Association.  If Replay Prevention is NOT in use, then
   the Authentication Data field will directly follow the SPI field.

   The 64-bit field is an up counter starting at a value of 1.

   The secret shared key must not be used for a period of time that
   allows the counter to wrap, that is, to transmit more than 2^64
   packets using a single key.

   Upon receipt, the replay value is assured to be increasing.  The
   implementation may accept out of order packets. The number of packets
   to accept out of order is an implementation detail. If an "out of
   order window" is supported, the implementation shall ensure that any
   and all packets accepted out of order are guaranteed not to have
   arrived before. That is, the implementation will accept any packet at
   most once.

   When the destination address is a multicast address, replay
   protection is in use, and more than one sender is sharing the same
   IPsec Security Association to that multicast destination address,
   then Replay Protection SHOULD NOT be enabled.  When replay protection
   is desired for a multicast session having multiple senders to the
   same multicast destination address, each sender SHOULD have its own
   IPsec Security Association.

   [ESP-DES-MD5] provides example code that implements a 32 packet
   replay window and a test routine to show how it works.

2.2 Authentication Data Calculation

   The authentication data is the output of the authentication algorithm
   (MD5).  This value is calculated over the entire IP datagram. Fields
   within the datagram that are variant during transit and the
   authentication data field itself, must contain all zeros prior to the
   computation [RFC-1826].  The Replay Prevention field if present, is
   included in the calculation.

   The definition and reference implementation of MD5 appears in [RFC-
   1321].  Let 'text' denote the data to which HMAC-MD5 is to be applied
   and K be the message authentication secret key shared by the parties.
   If K is longer than 64-bytes it MUST first be hashed using MD5.  In
   this case, K is the resulting hash.

Oehler & Glenn              Standards Track                     [Page 4]

RFC 2085                        HMAC-MD5                  February 1997

   We define two fixed and different strings ipad and opad as follows
   (the 'i' and 'o' are mnemonics for inner and outer):

             ipad = the byte 0x36 repeated 64 times
             opad = the byte 0x5C repeated 64 times.
   To compute HMAC-MD5 over the data `text' we perform
             MD5(K XOR opad, MD5(K XOR ipad, text))
   Namely,
    (1) append zeros to the end of K to create a 64 byte string
        (e.g., if K is of length 16 bytes it will be appended with 48
        zero bytes 0x00)
    (2) XOR (bitwise exclusive-OR) the 64 byte string computed in step
        (1) with ipad
    (3) append the data stream 'text' to the 64 byte string resulting
        from step (2)
    (4) apply MD5 to the stream generated in step (3)
    (5) XOR (bitwise exclusive-OR) the 64 byte string computed in
        step (1) with opad
    (6) append the MD5 result from step (4) to the 64 byte string
        resulting from step (5)
    (7) apply MD5 to the stream generated in step (6) and output
        the result

      This computation is described in more detail, along with example
      code and performance improvements, in [HMAC-MD5]. Implementers
      should consult [HMAC-MD5] for more information on this technique
      for keying a cryptographic hash function.

3. Security Considerations

   The security provided by this transform is based on the strength of
   MD5, the correctness of the algorithm's implementation, the security
   of the key management mechanism and its implementation, the strength
   of the associated secret key, and upon the correctness of the
   implementations in all of the participating systems.  [HMAC-MD5]
   contains a detailed discussion on the strengths and weaknesses of
   MD5.

Acknowledgments

   This document is largely based on text written by Hugo Krawczyk.  The
   format used was derived from work by William Simpson and Perry
   Metzger.  The text on replay prevention is derived directly from work
   by Jim Hughes.

Oehler & Glenn              Standards Track                     [Page 5]

RFC 2085                        HMAC-MD5                  February 1997

References

   [RFC-1825]    Atkinson, R., "Security Architecture for the Internet
                 Protocol", RFC 1852, Naval Research Laboratory,
                 July 1995.
   [RFC-1826]    Atkinson, R., "IP Authentication Header",
                 RFC 1826, August 1995.
   [RFC-1828]    Metzger, P., and W. Simpson, "IP Authentication using
                 Keyed MD5", RFC 1828, August 1995.
   [RFC-1321]    Rivest, R., "The MD5 Message-Digest Algorithm",
                 RFC 1321, April 1992.
   [HMAC-MD5]    Krawczyk, H., Bellare, M., and R. Canetti,
                 "HMAC: Keyed-Hashing for Message Authentication",
                 RFC 2104, February 1997.
   [ESP-DES-MD5] Hughes, J., "Combined DES-CBC, MD5, and Replay
                 Prevention Security Transform", Work in Progress.

Authors' Addresses

   Michael J. Oehler
   National Security Agency
   Atn: R23, INFOSEC Research and Development
   9800 Savage Road
   Fort Meade, MD 20755

   EMail: mjo@tycho.ncsc.mil

   Robert Glenn
   NIST
   Building 820, Room 455
   Gaithersburg, MD 20899

   EMail: rob.glenn@nist.gov

Oehler & Glenn              Standards Track                     [Page 6]


Network Working Group                                       H. Krawczyk
Request for Comments: 2104                                          IBM
Category: Informational                                      M. Bellare
                                                                   UCSD
                                                             R. Canetti
                                                                    IBM
                                                          February 1997

             HMAC: Keyed-Hashing for Message Authentication

Status of This Memo

   This memo provides information for the Internet community.  This memo
   does not specify an Internet standard of any kind.  Distribution of
   this memo is unlimited.

Abstract

   This document describes HMAC, a mechanism for message authentication
   using cryptographic hash functions. HMAC can be used with any
   iterative cryptographic hash function, e.g., MD5, SHA-1, in
   combination with a secret shared key.  The cryptographic strength of
   HMAC depends on the properties of the underlying hash function.

1. Introduction

   Providing a way to check the integrity of information transmitted
   over or stored in an unreliable medium is a prime necessity in the
   world of open computing and communications. Mechanisms that provide
   such integrity check based on a secret key are usually called
   "message authentication codes" (MAC). Typically, message
   authentication codes are used between two parties that share a secret
   key in order to validate information transmitted between these
   parties. In this document we present such a MAC mechanism based on
   cryptographic hash functions. This mechanism, called HMAC, is based
   on work by the authors [BCK1] where the construction is presented and
   cryptographically analyzed. We refer to that work for the details on
   the rationale and security analysis of HMAC, and its comparison to
   other keyed-hash methods.

Krawczyk, et. al.            Informational                      [Page 1]

RFC 2104                          HMAC                     February 1997

   HMAC can be used in combination with any iterated cryptographic hash
   function. MD5 and SHA-1 are examples of such hash functions. HMAC
   also uses a secret key for calculation and verification of the
   message authentication values. The main goals behind this
   construction are

   * To use, without modifications, available hash functions.
     In particular, hash functions that perform well in software,
     and for which code is freely and widely available.

   * To preserve the original performance of the hash function without
     incurring a significant degradation.

   * To use and handle keys in a simple way.

   * To have a well understood cryptographic analysis of the strength of
     the authentication mechanism based on reasonable assumptions on the
     underlying hash function.

   * To allow for easy replaceability of the underlying hash function in
     case that faster or more secure hash functions are found or
     required.

   This document specifies HMAC using a generic cryptographic hash
   function (denoted by H). Specific instantiations of HMAC need to
   define a particular hash function. Current candidates for such hash
   functions include SHA-1 [SHA], MD5 [MD5], RIPEMD-128/160 [RIPEMD].
   These different realizations of HMAC will be denoted by HMAC-SHA1,
   HMAC-MD5, HMAC-RIPEMD, etc.

   Note: To the date of writing of this document MD5 and SHA-1 are the
   most widely used cryptographic hash functions. MD5 has been recently
   shown to be vulnerable to collision search attacks [Dobb].  This
   attack and other currently known weaknesses of MD5 do not compromise
   the use of MD5 within HMAC as specified in this document (see
   [Dobb]); however, SHA-1 appears to be a cryptographically stronger
   function. To this date, MD5 can be considered for use in HMAC for
   applications where the superior performance of MD5 is critical.   In
   any case, implementers and users need to be aware of possible
   cryptanalytic developments regarding any of these cryptographic hash
   functions, and the eventual need to replace the underlying hash
   function. (See section 6 for more information on the security of
   HMAC.)

Krawczyk, et. al.            Informational                      [Page 2]

RFC 2104                          HMAC                     February 1997

2. Definition of HMAC

   The definition of HMAC requires a cryptographic hash function, which
   we denote by H, and a secret key K. We assume H to be a cryptographic
   hash function where data is hashed by iterating a basic compression
   function on blocks of data.   We denote by B the byte-length of such
   blocks (B=64 for all the above mentioned examples of hash functions),
   and by L the byte-length of hash outputs (L=16 for MD5, L=20 for
   SHA-1).  The authentication key K can be of any length up to B, the
   block length of the hash function.  Applications that use keys longer
   than B bytes will first hash the key using H and then use the
   resultant L byte string as the actual key to HMAC. In any case the
   minimal recommended length for K is L bytes (as the hash output
   length). See section 3 for more information on keys.

   We define two fixed and different strings ipad and opad as follows
   (the 'i' and 'o' are mnemonics for inner and outer):

                   ipad = the byte 0x36 repeated B times
                  opad = the byte 0x5C repeated B times.

   To compute HMAC over the data `text' we perform

                    H(K XOR opad, H(K XOR ipad, text))

   Namely,

    (1) append zeros to the end of K to create a B byte string
        (e.g., if K is of length 20 bytes and B=64, then K will be
         appended with 44 zero bytes 0x00)
    (2) XOR (bitwise exclusive-OR) the B byte string computed in step
        (1) with ipad
    (3) append the stream of data 'text' to the B byte string resulting
        from step (2)
    (4) apply H to the stream generated in step (3)
    (5) XOR (bitwise exclusive-OR) the B byte string computed in
        step (1) with opad
    (6) append the H result from step (4) to the B byte string
        resulting from step (5)
    (7) apply H to the stream generated in step (6) and output
        the result

   For illustration purposes, sample code based on MD5 is provided as an
   appendix.

Krawczyk, et. al.            Informational                      [Page 3]

RFC 2104                          HMAC                     February 1997

3. Keys

   The key for HMAC can be of any length (keys longer than B bytes are
   first hashed using H).  However, less than L bytes is strongly
   discouraged as it would decrease the security strength of the
   function.  Keys longer than L bytes are acceptable but the extra
   length would not significantly increase the function strength. (A
   longer key may be advisable if the randomness of the key is
   considered weak.)

   Keys need to be chosen at random (or using a cryptographically strong
   pseudo-random generator seeded with a random seed), and periodically
   refreshed.  (Current attacks do not indicate a specific recommended
   frequency for key changes as these attacks are practically
   infeasible.  However, periodic key refreshment is a fundamental
   security practice that helps against potential weaknesses of the
   function and keys, and limits the damage of an exposed key.)

4. Implementation Note

   HMAC is defined in such a way that the underlying hash function H can
   be used with no modification to its code. In particular, it uses the
   function H with the pre-defined initial value IV (a fixed value
   specified by each iterative hash function to initialize its
   compression function).  However, if desired, a performance
   improvement can be achieved at the cost of (possibly) modifying the
   code of H to support variable IVs.

   The idea is that the intermediate results of the compression function
   on the B-byte blocks (K XOR ipad) and (K XOR opad) can be precomputed
   only once at the time of generation of the key K, or before its first
   use. These intermediate results are stored and then used to
   initialize the IV of H each time that a message needs to be
   authenticated.  This method saves, for each authenticated message,
   the application of the compression function of H on two B-byte blocks
   (i.e., on (K XOR ipad) and (K XOR opad)). Such a savings may be
   significant when authenticating short streams of data.  We stress
   that the stored intermediate values need to be treated and protected
   the same as secret keys.

   Choosing to implement HMAC in the above way is a decision of the
   local implementation and has no effect on inter-operability.

Krawczyk, et. al.            Informational                      [Page 4]

RFC 2104                          HMAC                     February 1997

5. Truncated output

   A well-known practice with message authentication codes is to
   truncate the output of the MAC and output only part of the bits
   (e.g., [MM, ANSI]).  Preneel and van Oorschot [PV] show some
   analytical advantages of truncating the output of hash-based MAC
   functions. The results in this area are not absolute as for the
   overall security advantages of truncation. It has advantages (less
   information on the hash result available to an attacker) and
   disadvantages (less bits to predict for the attacker).  Applications
   of HMAC can choose to truncate the output of HMAC by outputting the t
   leftmost bits of the HMAC computation for some parameter t (namely,
   the computation is carried in the normal way as defined in section 2
   above but the end result is truncated to t bits). We recommend that
   the output length t be not less than half the length of the hash
   output (to match the birthday attack bound) and not less than 80 bits
   (a suitable lower bound on the number of bits that need to be
   predicted by an attacker).  We propose denoting a realization of HMAC
   that uses a hash function H with t bits of output as HMAC-H-t. For
   example, HMAC-SHA1-80 denotes HMAC computed using the SHA-1 function
   and with the output truncated to 80 bits.  (If the parameter t is not
   specified, e.g. HMAC-MD5, then it is assumed that all the bits of the
   hash are output.)

6. Security

   The security of the message authentication mechanism presented here
   depends on cryptographic properties of the hash function H: the
   resistance to collision finding (limited to the case where the
   initial value is secret and random, and where the output of the
   function is not explicitly available to the attacker), and the
   message authentication property of the compression function of H when
   applied to single blocks (in HMAC these blocks are partially unknown
   to an attacker as they contain the result of the inner H computation
   and, in particular, cannot be fully chosen by the attacker).

   These properties, and actually stronger ones, are commonly assumed
   for hash functions of the kind used with HMAC. In particular, a hash
   function for which the above properties do not hold would become
   unsuitable for most (probably, all) cryptographic applications,
   including alternative message authentication schemes based on such
   functions.  (For a complete analysis and rationale of the HMAC
   function the reader is referred to [BCK1].)

Krawczyk, et. al.            Informational                      [Page 5]

RFC 2104                          HMAC                     February 1997

   Given the limited confidence gained so far as for the cryptographic
   strength of candidate hash functions, it is important to observe the
   following two properties of the HMAC construction and its secure use
   for message authentication:

   1. The construction is independent of the details of the particular
   hash function H in use and then the latter can be replaced by any
   other secure (iterative) cryptographic hash function.

   2. Message authentication, as opposed to encryption, has a
   "transient" effect. A published breaking of a message authentication
   scheme would lead to the replacement of that scheme, but would have
   no adversarial effect on information authenticated in the past.  This
   is in sharp contrast with encryption, where information encrypted
   today may suffer from exposure in the future if, and when, the
   encryption algorithm is broken.

   The strongest attack known against HMAC is based on the frequency of
   collisions for the hash function H ("birthday attack") [PV,BCK2], and
   is totally impractical for minimally reasonable hash functions.

   As an example, if we consider a hash function like MD5 where the
   output length equals L=16 bytes (128 bits) the attacker needs to
   acquire the correct message authentication tags computed (with the
   _same_ secret key K!) on about 2**64 known plaintexts.  This would
   require the processing of at least 2**64 blocks under H, an
   impossible task in any realistic scenario (for a block length of 64
   bytes this would take 250,000 years in a continuous 1Gbps link, and
   without changing the secret key K during all this time).  This attack
   could become realistic only if serious flaws in the collision
   behavior of the function H are discovered (e.g.  collisions found
   after 2**30 messages). Such a discovery would determine the immediate
   replacement of the function H (the effects of such failure would be
   far more severe for the traditional uses of H in the context of
   digital signatures, public key certificates, etc.).

   Note: this attack needs to be strongly contrasted with regular
   collision attacks on cryptographic hash functions where no secret key
   is involved and where 2**64 off-line parallelizable (!) operations
   suffice to find collisions.  The latter attack is approaching
   feasibility [VW] while the birthday attack on HMAC is totally
   impractical.  (In the above examples, if one uses a hash function
   with, say, 160 bit of output then 2**64 should be replaced by 2**80.)

Krawczyk, et. al.            Informational                      [Page 6]

RFC 2104                          HMAC                     February 1997

   A correct implementation of the above construction, the choice of
   random (or cryptographically pseudorandom) keys, a secure key
   exchange mechanism, frequent key refreshments, and good secrecy
   protection of keys are all essential ingredients for the security of
   the integrity verification mechanism provided by HMAC.

Krawczyk, et. al.            Informational                      [Page 7]

RFC 2104                          HMAC                     February 1997

Appendix -- Sample Code

   For the sake of illustration we provide the following sample code for
   the implementation of HMAC-MD5 as well as some corresponding test
   vectors (the code is based on MD5 code as described in [MD5]).

/*
** Function: hmac_md5
*/

void
hmac_md5(text, text_len, key, key_len, digest)
unsigned char*  text;                /* pointer to data stream */
int             text_len;            /* length of data stream */
unsigned char*  key;                 /* pointer to authentication key */
int             key_len;             /* length of authentication key */
caddr_t         digest;              /* caller digest to be filled in */

{
        MD5_CTX context;
        unsigned char k_ipad[65];    /* inner padding -
                                      * key XORd with ipad
                                      */
        unsigned char k_opad[65];    /* outer padding -
                                      * key XORd with opad
                                      */
        unsigned char tk[16];
        int i;
        /* if key is longer than 64 bytes reset it to key=MD5(key) */
        if (key_len > 64) {

                MD5_CTX      tctx;

                MD5Init(&tctx);
                MD5Update(&tctx, key, key_len);
                MD5Final(tk, &tctx);

                key = tk;
                key_len = 16;
        }

        /*
         * the HMAC_MD5 transform looks like:
         *
         * MD5(K XOR opad, MD5(K XOR ipad, text))
         *
         * where K is an n byte key
         * ipad is the byte 0x36 repeated 64 times

Krawczyk, et. al.            Informational                      [Page 8]

RFC 2104                          HMAC                     February 1997

         * opad is the byte 0x5c repeated 64 times
         * and text is the data being protected
         */

        /* start out by storing key in pads */
        bzero( k_ipad, sizeof k_ipad);
        bzero( k_opad, sizeof k_opad);
        bcopy( key, k_ipad, key_len);
        bcopy( key, k_opad, key_len);

        /* XOR key with ipad and opad values */
        for (i=0; i<64; i++) {
                k_ipad[i] ^= 0x36;
                k_opad[i] ^= 0x5c;
        }
        /*
         * perform inner MD5
         */
        MD5Init(&context);                   /* init context for 1st
                                              * pass */
        MD5Update(&context, k_ipad, 64)      /* start with inner pad */
        MD5Update(&context, text, text_len); /* then text of datagram */
        MD5Final(digest, &context);          /* finish up 1st pass */
        /*
         * perform outer MD5
         */
        MD5Init(&context);                   /* init context for 2nd
                                              * pass */
        MD5Update(&context, k_opad, 64);     /* start with outer pad */
        MD5Update(&context, digest, 16);     /* then results of 1st
                                              * hash */
        MD5Final(digest, &context);          /* finish up 2nd pass */
}

Test Vectors (Trailing '\0' of a character string not included in test):

  key =         0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
  key_len =     16 bytes
  data =        "Hi There"
  data_len =    8  bytes
  digest =      0x9294727a3638bb1c13f48ef8158bfc9d

  key =         "Jefe"
  data =        "what do ya want for nothing?"
  data_len =    28 bytes
  digest =      0x750c783e6ab0b503eaa86e310a5db738

  key =         0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Krawczyk, et. al.            Informational                      [Page 9]

RFC 2104                          HMAC                     February 1997

  key_len       16 bytes
  data =        0xDDDDDDDDDDDDDDDDDDDD...
                ..DDDDDDDDDDDDDDDDDDDD...
                ..DDDDDDDDDDDDDDDDDDDD...
                ..DDDDDDDDDDDDDDDDDDDD...
                ..DDDDDDDDDDDDDDDDDDDD
  data_len =    50 bytes
  digest =      0x56be34521d144c88dbb8c733f0e8b3f6

Acknowledgments

   Pau-Chen Cheng, Jeff Kraemer, and Michael Oehler, have provided
   useful comments on early drafts, and ran the first interoperability
   tests of this specification. Jeff and Pau-Chen kindly provided the
   sample code and test vectors that appear in the appendix.  Burt
   Kaliski, Bart Preneel, Matt Robshaw, Adi Shamir, and Paul van
   Oorschot have provided useful comments and suggestions during the
   investigation of the HMAC construction.

References

   [ANSI]  ANSI X9.9, "American National Standard for Financial
           Institution Message Authentication (Wholesale)," American
           Bankers Association, 1981.   Revised 1986.

   [Atk]   Atkinson, R., "IP Authentication Header", RFC 1826, August
           1995.

   [BCK1]  M. Bellare, R. Canetti, and H. Krawczyk,
           "Keyed Hash Functions and Message Authentication",
           Proceedings of Crypto'96, LNCS 1109, pp. 1-15.
           (http://www.research.ibm.com/security/keyed-md5.html)

   [BCK2]  M. Bellare, R. Canetti, and H. Krawczyk,
           "Pseudorandom Functions Revisited: The Cascade Construction",
           Proceedings of FOCS'96.

   [Dobb]  H. Dobbertin, "The Status of MD5  After a Recent Attack",
           RSA Labs' CryptoBytes, Vol. 2 No. 2, Summer 1996.
           http://www.rsa.com/rsalabs/pubs/cryptobytes.html

   [PV]    B. Preneel and P. van Oorschot, "Building fast MACs from hash
           functions", Advances in Cryptology -- CRYPTO'95 Proceedings,
           Lecture Notes in Computer Science, Springer-Verlag Vol.963,
           1995, pp. 1-14.

   [MD5]   Rivest, R., "The MD5 Message-Digest Algorithm",
           RFC 1321, April 1992.

Krawczyk, et. al.            Informational                     [Page 10]

RFC 2104                          HMAC                     February 1997

   [MM]    Meyer, S. and Matyas, S.M., Cryptography, New York Wiley,
           1982.

   [RIPEMD] H. Dobbertin, A. Bosselaers, and B. Preneel, "RIPEMD-160: A
            strengthened version of RIPEMD", Fast Software Encryption,
            LNCS Vol 1039, pp. 71-82.
            ftp://ftp.esat.kuleuven.ac.be/pub/COSIC/bosselae/ripemd/.

   [SHA]   NIST, FIPS PUB 180-1: Secure Hash Standard, April 1995.

   [Tsu]   G. Tsudik, "Message authentication with one-way hash
           functions", In Proceedings of Infocom'92, May 1992.
           (Also in "Access Control and Policy Enforcement in
            Internetworks", Ph.D. Dissertation, Computer Science
            Department, University of Southern California, April 1991.)

   [VW]    P. van Oorschot and M. Wiener, "Parallel Collision
           Search with Applications to Hash Functions and Discrete
           Logarithms", Proceedings of the 2nd ACM Conf. Computer and
           Communications Security, Fairfax, VA, November 1994.

Authors' Addresses

   Hugo Krawczyk
   IBM T.J. Watson Research Center
   P.O.Box 704
   Yorktown Heights, NY 10598

   EMail: hugo@watson.ibm.com

   Mihir Bellare
   Dept of Computer Science and Engineering
   Mail Code 0114
   University of California at San Diego
   9500 Gilman Drive
   La Jolla, CA 92093

   EMail: mihir@cs.ucsd.edu

   Ran Canetti
   IBM T.J. Watson Research Center
   P.O.Box 704
   Yorktown Heights, NY 10598

   EMail: canetti@watson.ibm.com

Krawczyk, et. al.            Informational                     [Page 11]


Network Working Group                                          P. Cheng
Request for Comments: 2202                                          IBM
Category: Informational                                        R. Glenn
                                                                   NIST
                                                         September 1997

                 Test Cases for HMAC-MD5 and HMAC-SHA-1

Status of This Memo

   This memo provides information for the Internet community.  This memo
   does not specify an Internet standard of any kind.  Distribution of
   this memo is unlimited.

Abstract

   This document provides two sets of test cases for HMAC-MD5 and HMAC-
   SHA-1, respectively. HMAC-MD5 and HMAC-SHA-1 are two constructs of
   the HMAC [HMAC] message authentication function using the MD5 [MD5]
   hash function and the SHA-1 [SHA] hash function. Both constructs are
   used by IPSEC [OG,CG] and other protocols to authenticate messages.
   The test cases and results provided in this document are meant to be
   used as a conformance test for HMAC-MD5 and HMAC-SHA-1
   implementations.

1. Introduction

   The general method for constructing a HMAC message authentication
   function using a particular hash function is described in section 2
   of [HMAC]. We will not repeat the description here. Section 5 of
   [HMAC] also discusses truncating the output of HMAC; the rule is that
   we should keep the more significant bits (the bits in the left,
   assuming a network byte order (big-endian)).

   In sections 2 and 3 we provide test cases for HMAC-MD5 and HMAC-SHA-
   1, respectively. Each case includes the key, the data, and the
   result.  The values of keys and data are either hexadecimal numbers
   (prefixed by "0x") or ASCII character strings in double quotes. If a
   value is an ASCII character string, then the HMAC computation for the
   corresponding test case DOES NOT include the trailing null character
   ('\0') in the string.

Cheng & Glenn                Informational                      [Page 1]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

   The C source code of the functions used to generate HMAC-SHA-1
   results is listed in the Appendix. Note that these functions are
   meant to be simple and easy to understand; they are not optimized in
   any way. The C source code for computing HMAC-MD5 can be found in
   [MD5]; or you can do a simple modification to HMAC-SHA-1 code to get
   HMAC-MD5 code, as explained in the Appendix.

   The test cases in this document are cross-verified by three
   independent implementations, one from NIST and two from IBM Research.
   One IBM implementation uses optimized code that is very different
   from the code in the Appendix. An implemenation that concurs with the
   results provided in this document should be interoperable with other
   similar implemenations.  We do not claim that such an implementation
   is absolutely correct with respect to the HMAC definition in [HMAC].

2. Test Cases for HMAC-MD5

test_case =     1
key =           0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
key_len =       16
data =          "Hi There"
data_len =      8
digest =        0x9294727a3638bb1c13f48ef8158bfc9d

test_case =     2
key =           "Jefe"
key_len =       4
data =          "what do ya want for nothing?"
data_len =      28
digest =        0x750c783e6ab0b503eaa86e310a5db738

test_case =     3
key =           0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
key_len         16
data =          0xdd repeated 50 times
data_len =      50
digest =        0x56be34521d144c88dbb8c733f0e8b3f6

test_case =     4
key =           0x0102030405060708090a0b0c0d0e0f10111213141516171819
key_len         25
data =          0xcd repeated 50 times
data_len =      50
digest =        0x697eaf0aca3a3aea3a75164746ffaa79

Cheng & Glenn                Informational                      [Page 2]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

test_case =     5
key =           0x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c
key_len =       16
data =          "Test With Truncation"
data_len =      20
digest =        0x56461ef2342edc00f9bab995690efd4c
digest-96       0x56461ef2342edc00f9bab995

test_case =     6
key =           0xaa repeated 80 times
key_len =       80
data =          "Test Using Larger Than Block-Size Key - Hash Key First"
data_len =      54
digest =        0x6b1ab7fe4bd7bf8f0b62e6ce61b9d0cd

test_case =     7
key =           0xaa repeated 80 times
key_len =       80
data =          "Test Using Larger Than Block-Size Key and Larger
                Than One Block-Size Data"
data_len =      73
digest =        0x6f630fad67cda0ee1fb1f562db3aa53e

3. Test Cases for HMAC-SHA-1

test_case =     1
key =           0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
key_len =       20
data =          "Hi There"
data_len =      8
digest =        0xb617318655057264e28bc0b6fb378c8ef146be00

test_case =     2
key =           "Jefe"
key_len =       4
data =          "what do ya want for nothing?"
data_len =      28
digest =        0xeffcdf6ae5eb2fa2d27416d5f184df9c259a7c79

test_case =     3
key =           0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
key_len =       20
data =          0xdd repeated 50 times
data_len =      50
digest =        0x125d7342b9ac11cd91a39af48aa17b4f63f175d3

Cheng & Glenn                Informational                      [Page 3]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

test_case =     4
key =           0x0102030405060708090a0b0c0d0e0f10111213141516171819
key_len =       25
data =          0xcd repeated 50 times
data_len =      50
digest =        0x4c9007f4026250c6bc8414f9bf50c86c2d7235da

test_case =     5
key =           0x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c
key_len =       20
data =          "Test With Truncation"
data_len =      20
digest =        0x4c1a03424b55e07fe7f27be1d58bb9324a9a5a04
digest-96 =     0x4c1a03424b55e07fe7f27be1

test_case =     6
key =           0xaa repeated 80 times
key_len =       80
data =          "Test Using Larger Than Block-Size Key - Hash Key First"
data_len =      54
digest =        0xaa4ae5e15272d00e95705637ce8a3b55ed402112

test_case =     7
key =           0xaa repeated 80 times
key_len =       80
data =          "Test Using Larger Than Block-Size Key and Larger
                Than One Block-Size Data"
data_len =      73
digest =        0xe8e99d0f45237d786d6bbaa7965c7808bbff1a91
data_len =      20
digest =        0x4c1a03424b55e07fe7f27be1d58bb9324a9a5a04
digest-96 =     0x4c1a03424b55e07fe7f27be1

test_case =     6
key =           0xaa repeated 80 times
key_len =       80
data =          "Test Using Larger Than Block-Size Key - Hash Key
First"
data_len =      54
digest =        0xaa4ae5e15272d00e95705637ce8a3b55ed402112

test_case =     7
key =           0xaa repeated 80 times
key_len =       80
data =          "Test Using Larger Than Block-Size Key and Larger
                Than One Block-Size Data"
data_len =      73
digest =        0xe8e99d0f45237d786d6bbaa7965c7808bbff1a91

Cheng & Glenn                Informational                      [Page 4]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

4. Security Considerations

   This docuemnt raises no security issues. Discussion on the strength
   of the HMAC construction can be found in [HMAC].

References

   [HMAC]    Krawczyk, H., Bellare, M., and R. Canetti,
             "HMAC: Keyed-Hashing for Message Authentication",
             RFC 2104, February 1997.

   [MD5]     Rivest, R., "The MD5 Message-Digest Algorithm",
             RFC 1321, April 1992.

   [SHA]     NIST, FIPS PUB 180-1: Secure Hash Standard, April 1995.

   [OG]      Oehler, M., and R. Glenn,
             "HMAC-MD5 IP Authentication with Replay Prevention",
             RFC 2085, February 1997.

   [CG]      Chang, S., and R. Glenn,
             "HMAC-SHA IP Authentication with Replay Prevention",
             Work in Progress.

Cheng & Glenn                Informational                      [Page 5]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

Authors' Addresses

   Pau-Chen Cheng
   IBM T.J. Watson Research Center
   P.O.Box 704
   Yorktown Heights, NY 10598

   EMail: pau@watson.ibm.com

   Robert Glenn
   NIST
   Building 820, Room 455
   Gaithersburg, MD 20899

   EMail: rob.glenn@nist.gov

Cheng & Glenn                Informational                      [Page 6]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

Appendix

   This appendix contains the C reference code which implements HMAC-
   SHA-1 using an existing SHA-1 library.  It assumes that the SHA-1
   library has similar API's as those of the MD5 code described in RFC
   1321.  The code for HMAC-MD5 is similar, just replace the strings
   "SHA" and "sha" with "MD5" and "md5". HMAC-MD5 code is also listed in
   RFC 2104.

   #ifndef SHA_DIGESTSIZE
   #define SHA_DIGESTSIZE  20
   #endif

   #ifndef SHA_BLOCKSIZE
   #define SHA_BLOCKSIZE   64
   #endif

   #ifndef MD5_DIGESTSIZE
   #define MD5_DIGESTSIZE  16
   #endif

   #ifndef MD5_BLOCKSIZE
   #define MD5_BLOCKSIZE   64
   #endif

   /* Function to print the digest */
   void
   pr_sha(FILE* fp, char* s, int t)
   {
           int     i ;

           fprintf(fp, "0x") ;
           for (i = 0 ; i < t ; i++)
                   fprintf(fp, "%02x", s[i]) ;
           fprintf(fp, "0) ;
   }

   void truncate
   (
    char*   d1,   /* data to be truncated */
    char*   d2,   /* truncated data */
    int     len   /* length in bytes to keep */
   )
   {
           int     i ;
           for (i = 0 ; i < len ; i++) d2[i] = d1[i];
   }

Cheng & Glenn                Informational                      [Page 7]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

   /* Function to compute the digest */
   void
   hmac_sha
   (
    char*    k,     /* secret key */
    int      lk,    /* length of the key in bytes */
    char*    d,     /* data */
    int      ld,    /* length of data in bytes */
    char*    out,   /* output buffer, at least "t" bytes */
    int      t
   )
   {
           SHA_CTX ictx, octx ;
           char    isha[SHA_DIGESTSIZE], osha[SHA_DIGESTSIZE] ;
           char    key[SHA_DIGESTSIZE] ;
           char    buf[SHA_BLOCKSIZE] ;
           int     i ;

           if (lk > SHA_BLOCKSIZE) {

                   SHA_CTX         tctx ;

                   SHAInit(&tctx) ;
                   SHAUpdate(&tctx, k, lk) ;
                   SHAFinal(key, &tctx) ;

                   k = key ;
                   lk = SHA_DIGESTSIZE ;
           }

           /**** Inner Digest ****/

           SHAInit(&ictx) ;

           /* Pad the key for inner digest */
           for (i = 0 ; i < lk ; ++i) buf[i] = k[i] ^ 0x36 ;
           for (i = lk ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x36 ;

           SHAUpdate(&ictx, buf, SHA_BLOCKSIZE) ;
           SHAUpdate(&ictx, d, ld) ;

           SHAFinal(isha, &ictx) ;

           /**** Outter Digest ****/

           SHAInit(&octx) ;

           /* Pad the key for outter digest */

Cheng & Glenn                Informational                      [Page 8]

RFC 2202         Test Cases for HMAC-MD5 and HMAC-SHA-1   September 1997

           for (i = 0 ; i < lk ; ++i) buf[i] = k[i] ^ 0x5C ;
           for (i = lk ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x5C ;

           SHAUpdate(&octx, buf, SHA_BLOCKSIZE) ;
           SHAUpdate(&octx, isha, SHA_DIGESTSIZE) ;

           SHAFinal(osha, &octx) ;

           /* truncate and print the results */
           t = t > SHA_DIGESTSIZE ? SHA_DIGESTSIZE : t ;
           truncate(osha, out, t) ;
           pr_sha(stdout, out, t) ;

   }

Cheng & Glenn                Informational                      [Page 9]


Network Working Group                                            J. Kapp
Request for Comments: 2286                           Reaper Technologies
Category: Informational                                    February 1998

            Test Cases for HMAC-RIPEMD160 and HMAC-RIPEMD128

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   This document provides two sets of test cases for HMAC-RIPEMD160 and
   HMAC-RIPEMD128, respectively. HMAC-RIPEMD160 and HMAC-RIPEMD128 are
   two constructs of the HMAC [HMAC] message authentication function
   using the RIPEMD-160 and RIPEMD-128 [RIPE] hash functions. The test
   cases and results provided in this document are meant to be used as a
   conformance test for HMAC-RIPEMD160 and HMAC-RIPEMD128
   implementations.

1. Introduction

   The general method for constructing a HMAC message authentication
   function using a particular hash function is described in section 2
   of [HMAC].

   In sections 2 and 3 test cases for HMAC-RIPEMD160 and HMAC-RIPEMD128,
   respectively are provided. Each case includes the key, the data, and
   the result.  The values of keys and data are either hexadecimal
   numbers (prefixed by "0x") or ASCII character strings in double
   quotes. If a value is an ASCII character string, then the HMAC
   computation for the corresponding test case DOES NOT include the
   trailing null character ('\0') in the string.

   The C source code of the functions used to generate HMAC-RIPEMD160
   and HMAC-RIPEMD128 results is listed in the Appendix. Please Note
   that the functions provided are implemented in such a way as to be
   simple and easy to understand as a result they are not optimized in
   any way. The C source code for computing HMAC-MD5 can be found in
   [MD5].

Kapp                         Informational                      [Page 1]

RFC 2286       Test Cases: HMAC-RIPEMD160, HMAC-RIPEMD128  February 1998

2. Test Cases for HMAC-RIPEMD160

test_case =         1
key =               0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
key_len =           20
data =              "Hi There"
data_len =          8
digest =            0x24cb4bd67d20fc1a5d2ed7732dcc39377f0a5668

test_case =         2
key =               "Jefe"
key_len =           4
data =              "what do ya want for nothing?"
data_len =          28
digest =            0xdda6c0213a485a9e24f4742064a7f033b43c4069

test_case =         3
key =               0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
key_len =           20
data =              0xdd repeated 50 times
data_len =          50
digest =            0xb0b105360de759960ab4f35298e116e295d8e7c1

test_case =         4
key =               0x0102030405060708090a0b0c0d0e0f10111213141516171819
key_len =           25
data =              0xcd repeated 50 times
data_len =          50
digest =            0xd5ca862f4d21d5e610e18b4cf1beb97a4365ecf4

test_case =         5
key =               0x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c
key_len =           20
data =              "Test With Truncation"
data_len =          20
digest =            0x7619693978f91d90539ae786500ff3d8e0518e39
digest-96 =         0x7619693978f91d90539ae786

test_case =         6
key =               0xaa repeated 80 times
key_len =           80
data =              "Test Using Larger Than Block-Size Key - Hash Key
                    First"
data_len =          54
digest =            0x6466ca07ac5eac29e1bd523e5ada7605b791fd8b

test_case =         7
key =               0xaa repeated 80 times

Kapp                         Informational                      [Page 2]

RFC 2286       Test Cases: HMAC-RIPEMD160, HMAC-RIPEMD128  February 1998

key_len =           80
data =              "Test Using Larger Than Block-Size Key and Larger
                    Than One Block-Size Data"
data_len =          73
digest =            0x69ea60798d71616cce5fd0871e23754cd75d5a0a

3. Test Cases for HMAC-RIPEMD128

test_case =         1
key =               0x0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b
key_len =           16
data =              "Hi There"
data_len =          8
digest =            0xfbf61f9492aa4bbf81c172e84e0734db

test_case =         2
key =               "Jefe"
key_len =           4
data =              "what do ya want for nothing?"
data_len =          28
digest =            0x875f828862b6b334b427c55f9f7ff09b

test_case =         3
key =               0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
key_len =           16
data =              0xdd repeated 50 times
data_len =          50
digest =            0x09f0b2846d2f543da363cbec8d62a38d

test_case =         4
key =               0x0102030405060708090a0b0c0d0e0f10111213141516171819
key_len =           25
data =              0xcd repeated 50 times
data_len =          50
digest =            0xbdbbd7cf03e44b5aa60af815be4d2294

test_case =         5
key =               0x0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c
key_len =           16
data =              "Test With Truncation"
data_len =          20
digest =            0xe79808f24b25fd031c155f0d551d9a3a
digest-96 =         0xe79808f24b25fd031c155f0d

test_case =         6
key =               0xaa repeated 80 times
key_len =           80
data =              "Test Using Larger Than Block-Size Key - Hash Key

Kapp                         Informational                      [Page 3]

RFC 2286       Test Cases: HMAC-RIPEMD160, HMAC-RIPEMD128  February 1998

                    First"
data_len =          54
digest =            0xdc732928de98104a1f59d373c150acbb

test_case =         7
key =               0xaa repeated 80 times
key_len =           80
data =              "Test Using Larger Than Block-Size Key and Larger
                    Than One Block-Size Data"
data_len =          73
digest =            0x5c6bec96793e16d40690c237635f30c5

4. Security Considerations

   This document raises no security issues.  Discussion on the strength
   of the HMAC construction can be found in [HMAC].

References

   [HMAC]    Krawczyk, H., Bellare, M., and R. Canetti,
             "HMAC: Keyed-Hashing for Message Authentication", RFC 2104,
             February 1997.

   [MD5]     Rivest, R., "The MD5 Message-Digest Algorithm",
             RFC 1321, April 1992.

   [OG]      Oehler, M., and R. Glenn,
             "HMAC-MD5 IP Authentication with Replay Prevention", RFC
             2085, February 1997

   [CG]      Chang, S., and R. Glenn,
             "Test Cases for HMAC-MD5 and HMAC-SHA-1", RFC 2202,
             September 1997.

   [RIPE]    Dobbertin, H., Bosselaers A., and Preneel, B.
             "RIPEMD-160: A Strengthened Version of RIPEMD" April 1996

Author's Address

   Justin S. Kapp
   Reaper Technologies
   The Post Office, Dunsop Bridge
   Clitheroe, Lancashire.
   BB7 3BB.  United Kingdom

   EMail: skapp@reapertech.com

Kapp                         Informational                      [Page 4]

RFC 2286       Test Cases: HMAC-RIPEMD160, HMAC-RIPEMD128  February 1998

Appendix

   This code which implements HMAC-RIPEMD160 using an existing RIPEMD-
   160 library.  It assumes that the RIPEMD-160 library has similar
   API's as those of the MD5 code described in RFC 1321.  The code for
   HMAC-MD5, is similar, this HMAC-MD5 code is also listed in RFC 2104.
   To adapt this example to produce the HMAC-RIPEMD128 then replace each
   occurance of 'RMD160' with 'RMD128'.

#ifndef RMD160_DIGESTSIZE
#define RMD160_DIGESTSIZE  20
#endif

#ifndef RMD128_DIGESTSIZE
#define RMD128_DIGESTSIZE  16
#endif

/*  HMAC_RMD160 implements HMAC-RIPEMD160 */

void HMAC_RMD160(input, len, key, keylen, digest)
unsigned char *input;                       /* pointer to data stream */
int len;                                     /* length of data stream */
unsigned char *key;                  /* pointer to authentication key */
int keylen;                           /* length of authentication key */
unsigned char *digest;                        /* resulting MAC digest */
{
    RMD160_CTX context;
    unsigned char k_ipad[65];  /* inner padding - key XORd with ipad */
    unsigned char k_opad[65];  /* outer padding - key XORd with opad */
    unsigned char tk[RMD160_DIGESTSIZE];
    int i;

    /* if key is longer than 64 bytes reset it to key=SHA1(key) */
    if (keylen > 64) {
        RMD160_CTX      tctx;

        RMD160Init(&tctx);
        RMD160Update(&tctx, key, keylen);
        RMD160Final(tk, &tctx);

        key = tk;
        keylen = RMD160_DIGESTSIZE;
    }

        /* The HMAC_SHA1 transform looks like:

           RMD160(K XOR opad, RMD160(K XOR ipad, text))

Kapp                         Informational                      [Page 5]

RFC 2286       Test Cases: HMAC-RIPEMD160, HMAC-RIPEMD128  February 1998

           where K is an n byte key
           ipad is the byte 0x36 repeated 64 times
           opad is the byte 0x5c repeated 64 times
           and text is the data being protected */

        /* start out by storing key in pads */
    memset(k_ipad, 0x36, sizeof(k_ipad));
    memset(k_opad, 0x5c, sizeof(k_opad));

        /* XOR key with ipad and opad values */
    for (i=0; i<keylen; i++) {
        k_ipad[i] ^= key[i];
        k_opad[i] ^= key[i];
    }

        /* perform inner RIPEMD-160 */

    RMD160Init(&context);           /* init context for 1st pass */
    RMD160Update(&context, k_ipad, 64);  /* start with inner pad */
    RMD160Update(&context, input, len); /* then text of datagram */
    RMD160Final(digest, &context);         /* finish up 1st pass */

        /* perform outer RIPEMD-160 */
    RMD160Init(&context);           /* init context for 2nd pass */
    RMD160Update(&context, k_opad, 64);  /* start with outer pad */
    /* then results of 1st hash */
    RMD160Update(&context, digest, RMD160_DIGESTSIZE);
    RMD160Final(digest, &context);         /* finish up 2nd pass */

    memset(k_ipad, 0x00, sizeof(k_ipad));
    memset(k_opad, 0x00, sizeof(k_opad));
}

Kapp                         Informational                      [Page 6]

RFC 2286       Test Cases: HMAC-RIPEMD160, HMAC-RIPEMD128  February 1998

Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Kapp                         Informational                      [Page 7]


Network Working Group                                      B. Kaliski
Request for Comments: 2313                      RSA Laboratories East
Category: Informational                                    March 1998

                        PKCS #1: RSA Encryption
                              Version 1.5

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Overview

   This document describes a method for encrypting data using the RSA
   public-key cryptosystem.

1. Scope

   This document describes a method for encrypting data using the RSA
   public-key cryptosystem. Its intended use is in the construction of
   digital signatures and digital envelopes, as described in PKCS #7:

        o    For digital signatures, the content to be signed
             is first reduced to a message digest with a
             message-digest algorithm (such as MD5), and then
             an octet string containing the message digest is
             encrypted with the RSA private key of the signer
             of the content. The content and the encrypted
             message digest are represented together according
             to the syntax in PKCS #7 to yield a digital
             signature. This application is compatible with
             Privacy-Enhanced Mail (PEM) methods.

        o    For digital envelopes, the content to be enveloped
             is first encrypted under a content-encryption key
             with a content-encryption algorithm (such as DES),
             and then the content-encryption key is encrypted
             with the RSA public keys of the recipients of the
             content. The encrypted content and the encrypted

Kaliski                      Informational                      [Page 1]

RFC 2313                PKCS #1: RSA Encryption               March 1998

             content-encryption key are represented together
             according to the syntax in PKCS #7 to yield a
             digital envelope. This application is also
             compatible with PEM methods.

   The document also describes a syntax for RSA public keys and private
   keys. The public-key syntax would be used in certificates; the
   private-key syntax would be used typically in PKCS #8 private-key
   information. The public-key syntax is identical to that in both X.509
   and Privacy-Enhanced Mail.  Thus X.509/PEM RSA keys can be used in
   this document.

   The document also defines three signature algorithms for use in
   signing X.509/PEM certificates and certificate-revocation lists, PKCS
   #6 extended certificates, and other objects employing digital
   signatures such as X.401 message tokens.

   Details on message-digest and content-encryption algorithms are
   outside the scope of this document, as are details on sources of the
   pseudorandom bits required by certain methods in this document.

2. References

   FIPS PUB 46-1  National Bureau of Standards. FIPS PUB 46-1:
             Data Encryption Standard. January 1988.

   PKCS #6   RSA Laboratories. PKCS #6: Extended-Certificate
             Syntax. Version 1.5, November 1993.

   PKCS #7   RSA Laboratories. PKCS #7: Cryptographic Message
             Syntax. Version 1.5, November 1993.

   PKCS #8   RSA Laboratories. PKCS #8: Private-Key Information
             Syntax. Version 1.2, November 1993.

   RFC 1319  Kaliski, B., "The MD2 Message-Digest
             Algorithm," RFC 1319, April 1992.

   RFC 1320  Rivest, R., "The MD4 Message-Digest
             Algorithm," RFC 1320, April 1992.

   RFC 1321  Rivest, R., "The MD5 Message-Digest
             Algorithm," RFC 1321, April 1992.

   RFC 1423  Balenson, D., "Privacy Enhancement for
             Internet Electronic Mail: Part III: Algorithms,
             Modes, and Identifiers," RFC 1423, February 1993.

Kaliski                      Informational                      [Page 2]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   X.208     CCITT. Recommendation X.208: Specification of
             Abstract Syntax Notation One (ASN.1). 1988.

   X.209     CCITT. Recommendation X.209: Specification of
             Basic Encoding Rules for Abstract Syntax Notation
             One (ASN.1). 1988.

   X.411     CCITT. Recommendation X.411: Message Handling
             Systems: Message Transfer System: Abstract Service
             Definition and Procedures.1988.

   X.509     CCITT. Recommendation X.509: The Directory--
             Authentication Framework. 1988.

   [dBB92]   B. den Boer and A. Bosselaers. An attack on the
             last two rounds of MD4. In J. Feigenbaum, editor,
             Advances in Cryptology---CRYPTO '91 Proceedings,
             volume 576 of Lecture Notes in Computer Science,
             pages 194-203. Springer-Verlag, New York, 1992.

   [dBB93]   B. den Boer  and A. Bosselaers. Collisions for the
             compression function of MD5. Presented at
             EUROCRYPT '93 (Lofthus, Norway, May 24-27, 1993).

   [DO86]    Y. Desmedt and A.M. Odlyzko. A chosen text attack
             on the RSA cryptosystem and some discrete
             logarithm schemes. In H.C. Williams, editor,
             Advances in Cryptology---CRYPTO '85 Proceedings,
             volume 218 of Lecture Notes in Computer Science,
             pages 516-521. Springer-Verlag, New York, 1986.

   [Has88]   Johan Hastad. Solving simultaneous modular
             equations. SIAM Journal on Computing,
             17(2):336-341, April 1988.

   [IM90]    Colin I'Anson and Chris Mitchell. Security defects
             in CCITT Recommendation X.509--The directory
             authentication framework. Computer Communications
             Review, :30-34, April 1990.

   [Mer90]   R.C. Merkle. Note on MD4. Unpublished manuscript,
             1990.

   [Mil76]   G.L. Miller. Riemann's hypothesis and tests for
             primality. Journal of Computer and Systems
             Sciences, 13(3):300-307, 1976.

Kaliski                      Informational                      [Page 3]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   [QC82]    J.-J. Quisquater and C. Couvreur. Fast
             decipherment algorithm for RSA public-key
             cryptosystem. Electronics Letters, 18(21):905-907,
             October 1982.

   [RSA78]   R.L. Rivest, A. Shamir, and L. Adleman. A method
             for obtaining digital signatures and public-key
             cryptosystems. Communications of the ACM,
             21(2):120-126, February 1978.

3. Definitions

   For the purposes of this document, the following definitions apply.

   AlgorithmIdentifier: A type that identifies an algorithm (by object
   identifier) and associated parameters. This type is defined in X.509.

   ASN.1: Abstract Syntax Notation One, as defined in X.208.

   BER: Basic Encoding Rules, as defined in X.209.

   DES: Data Encryption Standard, as defined in FIPS PUB 46-1.

   MD2: RSA Data Security, Inc.'s MD2 message-digest algorithm, as
   defined in RFC 1319.

   MD4: RSA Data Security, Inc.'s MD4 message-digest algorithm, as
   defined in RFC 1320.

   MD5: RSA Data Security, Inc.'s MD5 message-digest algorithm, as
   defined in RFC 1321.

   modulus: Integer constructed as the product of two primes.

   PEM: Internet Privacy-Enhanced Mail, as defined in RFC 1423 and
   related documents.

   RSA: The RSA public-key cryptosystem, as defined in [RSA78].

   private key: Modulus and private exponent.

   public key: Modulus and public exponent.

4. Symbols and abbreviations

   Upper-case symbols (e.g., BT) denote octet strings and bit strings
   (in the case of the signature S); lower-case symbols (e.g., c) denote
   integers.

Kaliski                      Informational                      [Page 4]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   ab   hexadecimal octet value  c    exponent
   BT   block type               d    private exponent
   D    data                     e    public exponent
   EB   encryption block         k    length of modulus in
                                        octets
   ED   encrypted data           n    modulus
   M    message                  p, q  prime factors of modulus
   MD   message digest           x    integer encryption block
   MD'  comparative message      y    integer encrypted data
          digest
   PS   padding string           mod n  modulo n
   S    signature                X || Y  concatenation of X, Y
                                 ||X||  length in octets of X
5. General overview

   The next six sections specify key generation, key syntax, the
   encryption process, the decryption process, signature algorithms, and
   object identifiers.

   Each entity shall generate a pair of keys: a public key and a private
   key. The encryption process shall be performed with one of the keys
   and the decryption process shall be performed with the other key.
   Thus the encryption process can be either a public-key operation or a
   private-key operation, and so can the decryption process. Both
   processes transform an octet string to another octet string. The
   processes are inverses of each other if one process uses an entity's
   public key and the other process uses the same entity's private key.

   The encryption and decryption processes can implement either the
   classic RSA transformations, or variations with padding.

6. Key generation

   This section describes RSA key generation.

   Each entity shall select a positive integer e as its public exponent.

   Each entity shall privately and randomly select two distinct odd
   primes p and q such that (p-1) and e have no common divisors, and
   (q-1) and e have no common divisors.

   The public modulus n shall be the product of the private prime
   factors p and q:

                                 n = pq .

   The private exponent shall be a positive integer d such that de-1 is
   divisible by both p-1 and q-1.

Kaliski                      Informational                      [Page 5]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   The length of the modulus n in octets is the integer k satisfying

                        2^(8(k-1)) <= n < 2^(8k) .

   The length k of the modulus must be at least 12 octets to accommodate
   the block formats in this document (see Section 8).

   Notes.

        1.   The public exponent may be standardized in
             specific applications. The values 3 and F4 (65537) may have
             some practical advantages, as noted in X.509 Annex C.

        2.   Some additional conditions on the choice of primes
             may well be taken into account in order to deter
             factorization of the modulus. These security conditions
             fall outside the scope of this document. The lower bound on
             the length k is to accommodate the block formats, not for
             security.

7. Key syntax

   This section gives the syntax for RSA public and private keys.

7.1 Public-key syntax

   An RSA public key shall have ASN.1 type RSAPublicKey:

   RSAPublicKey ::= SEQUENCE {
     modulus INTEGER, -- n
     publicExponent INTEGER -- e }

   (This type is specified in X.509 and is retained here for
   compatibility.)

   The fields of type RSAPublicKey have the following meanings:

        o    modulus is the modulus n.

        o    publicExponent is the public exponent e.

Kaliski                      Informational                      [Page 6]

RFC 2313                PKCS #1: RSA Encryption               March 1998

7.2 Private-key syntax

   An RSA private key shall have ASN.1 type RSAPrivateKey:

   RSAPrivateKey ::= SEQUENCE {
     version Version,
     modulus INTEGER, -- n
     publicExponent INTEGER, -- e
     privateExponent INTEGER, -- d
     prime1 INTEGER, -- p
     prime2 INTEGER, -- q
     exponent1 INTEGER, -- d mod (p-1)
     exponent2 INTEGER, -- d mod (q-1)
     coefficient INTEGER -- (inverse of q) mod p }

   Version ::= INTEGER

   The fields of type RSAPrivateKey have the following meanings:

        o    version is the version number, for compatibility
             with future revisions of this document. It shall
             be 0 for this version of the document.

        o    modulus is the modulus n.

        o    publicExponent is the public exponent e.

        o    privateExponent is the private exponent d.

        o    prime1 is the prime factor p of n.

        o    prime2 is the prime factor q of n.

        o    exponent1 is d mod (p-1).

        o    exponent2 is d mod (q-1).

        o    coefficient is the Chinese Remainder Theorem
             coefficient q-1 mod p.

   Notes.

        1.   An RSA private key logically consists of only the
             modulus n and the private exponent d. The presence of the
             values p, q, d mod (p-1), d mod (p-1), and q-1 mod p is
             intended for efficiency, as Quisquater and Couvreur have
             shown [QC82]. A private-key syntax that does not include

Kaliski                      Informational                      [Page 7]

RFC 2313                PKCS #1: RSA Encryption               March 1998

             all the extra values can be converted readily to the syntax
             defined here, provided the public key is known, according
             to a result by Miller [Mil76].

        2.   The presence of the public exponent e is intended
             to make it straightforward to derive a public key from the
             private key.

8. Encryption process

   This section describes the RSA encryption process.

   The encryption process consists of four steps: encryption- block
   formatting, octet-string-to-integer conversion, RSA computation, and
   integer-to-octet-string conversion. The input to the encryption
   process shall be an octet string D, the data; an integer n, the
   modulus; and an integer c, the exponent. For a public-key operation,
   the integer c shall be an entity's public exponent e; for a private-
   key operation, it shall be an entity's private exponent d. The output
   from the encryption process shall be an octet string ED, the
   encrypted data.

   The length of the data D shall not be more than k-11 octets, which is
   positive since the length k of the modulus is at least 12 octets.
   This limitation guarantees that the length of the padding string PS
   is at least eight octets, which is a security condition.

   Notes.

        1.   In typical applications of this document to
             encrypt content-encryption keys and message digests, one
             would have ||D|| <= 30. Thus the length of the RSA modulus
             will need to be at least 328 bits (41 octets), which is
             reasonable and consistent with security recommendations.

        2.   The encryption process does not provide an
             explicit integrity check to facilitate error detection
             should the encrypted data be corrupted in transmission.
             However, the structure of the encryption block guarantees
             that the probability that corruption is undetected is less
             than 2-16, which is an upper bound on the probability that
             a random encryption block looks like block type 02.

        3.   Application of private-key operations as defined
             here to data other than an octet string containing a
             message digest is not recommended and is subject to further
             study.

Kaliski                      Informational                      [Page 8]

RFC 2313                PKCS #1: RSA Encryption               March 1998

        4.   This document may be extended to handle data of
             length more than k-11 octets.

8.1 Encryption-block formatting

   A block type BT, a padding string PS, and the data D shall be
   formatted into an octet string EB, the encryption block.

              EB = 00 || BT || PS || 00 || D .           (1)

   The block type BT shall be a single octet indicating the structure of
   the encryption block. For this version of the document it shall have
   value 00, 01, or 02. For a private- key operation, the block type
   shall be 00 or 01. For a public-key operation, it shall be 02.

   The padding string PS shall consist of k-3-||D|| octets. For block
   type 00, the octets shall have value 00; for block type 01, they
   shall have value FF; and for block type 02, they shall be
   pseudorandomly generated and nonzero. This makes the length of the
   encryption block EB equal to k.

   Notes.

        1.   The leading 00 octet ensures that the encryption
             block, converted to an integer, is less than the modulus.

        2.   For block type 00, the data D must begin with a
             nonzero octet or have known length so that the encryption
             block can be parsed unambiguously. For block types 01 and
             02, the encryption block can be parsed unambiguously since
             the padding string PS contains no octets with value 00 and
             the padding string is separated from the data D by an octet
             with value 00.

        3.   Block type 01 is recommended for private-key
             operations. Block type 01 has the property that the
             encryption block, converted to an integer, is guaranteed to
             be large, which prevents certain attacks of the kind
             proposed by Desmedt and Odlyzko [DO86].

        4.   Block types 01 and 02 are compatible with PEM RSA
             encryption of content-encryption keys and message digests
             as described in RFC 1423.

Kaliski                      Informational                      [Page 9]

RFC 2313                PKCS #1: RSA Encryption               March 1998

        5.   For block type 02, it is recommended that the
             pseudorandom octets be generated independently for each
             encryption process, especially if the same data is input to
             more than one encryption process.  Hastad's results [Has88]
             motivate this recommendation.

        6.   For block type 02, the padding string is at least
             eight octets long, which is a security condition for
             public-key operations that prevents an attacker from
             recoving data by trying all possible encryption blocks. For
             simplicity, the minimum length is the same for block type
             01.

        7.   This document may be extended in the future to
             include other block types.

8.2 Octet-string-to-integer conversion

   The encryption block EB shall be converted to an integer x, the
   integer encryption block. Let EB1, ..., EBk be the octets of EB from
   first to last. Then the integer x shall satisfy

                                     k
                x =  SUM  2^(8(k-i)) EBi .              (2)
                                   i = 1

   In other words, the first octet of EB has the most significance in
   the integer and the last octet of EB has the least significance.

   Note. The integer encryption block x satisfies 0 <= x <  n since EB1
   = 00 and 2^(8(k-1)) <= n.

8.3 RSA computation

   The integer encryption block x shall be raised to the power c modulo
   n to give an integer y, the integer encrypted data.

                       y = x^c mod n,  0 <= y < n .

   This is the classic RSA computation.

8.4 Integer-to-octet-string conversion

   The integer encrypted data y shall be converted to an octet string ED
   of length k, the encrypted data. The encrypted data ED shall satisfy

Kaliski                      Informational                     [Page 10]

RFC 2313                PKCS #1: RSA Encryption               March 1998

                                     k
                y =  SUM  2^(8(k-i)) EDi .              (3)
                                   i = 1

   where ED1, ..., EDk are the octets of ED from first to last.

   In other words, the first octet of ED has the most significance in
   the integer and the last octet of ED has the least significance.

9. Decryption process

   This section describes the RSA decryption process.

   The decryption process consists of four steps: octet-string-to-
   integer conversion, RSA computation, integer-to-octet-string
   conversion, and encryption-block parsing. The input to the decryption
   process shall be an octet string ED, the encrypted data; an integer
   n, the modulus; and an integer c, the exponent. For a public-key
   operation, the integer c shall be an entity's public exponent e; for
   a private-key operation, it shall be an entity's private exponent d.
   The output from the decryption process shall be an octet string D,
   the data.

   It is an error if the length of the encrypted data ED is not k.

   For brevity, the decryption process is described in terms of the
   encryption process.

9.1 Octet-string-to-integer conversion

   The encrypted data ED shall be converted to an integer y, the integer
   encrypted data, according to Equation (3).

   It is an error if the integer encrypted data y does not satisfy 0 <=
   y < n.

9.2 RSA computation

   The integer encrypted data y shall be raised to the power c modulo n
   to give an integer x, the integer encryption block.

                       x = y^c mod n,  0 <= x < n .

   This is the classic RSA computation.

Kaliski                      Informational                     [Page 11]

RFC 2313                PKCS #1: RSA Encryption               March 1998

9.3 Integer-to-octet-string conversion

   The integer encryption block x shall be converted to an octet string
   EB of length k, the encryption block, according to Equation (2).

9.4 Encryption-block parsing

   The encryption block EB shall be parsed into a block type BT, a
   padding string PS, and the data D according to Equation (1).

   It is an error if any of the following conditions occurs:

        o    The encryption block EB cannot be parsed
             unambiguously (see notes to Section 8.1).

        o    The padding string PS consists of fewer than eight
             octets, or is inconsistent with the block type BT.

        o    The decryption process is a public-key operation
             and the block type BT is not 00 or 01, or the decryption
             process is a private-key operation and the block type is
             not 02.

10. Signature algorithms

   This section defines three signature algorithms based on the RSA
   encryption process described in Sections 8 and 9. The intended use of
   the signature algorithms is in signing X.509/PEM certificates and
   certificate-revocation lists, PKCS #6 extended certificates, and
   other objects employing digital signatures such as X.401 message
   tokens. The algorithms are not intended for use in constructing
   digital signatures in PKCS #7. The first signature algorithm
   (informally, "MD2 with RSA") combines the MD2 message-digest
   algorithm with RSA, the second (informally, "MD4 with RSA") combines
   the MD4 message-digest algorithm with RSA, and the third (informally,
   "MD5 with RSA") combines the MD5 message-digest algorithm with RSA.

   This section describes the signature process and the verification
   process for the two algorithms. The "selected" message-digest
   algorithm shall be either MD2 or MD5, depending on the signature
   algorithm. The signature process shall be performed with an entity's
   private key and the verification process shall be performed with an
   entity's public key. The signature process transforms an octet string
   (the message) to a bit string (the signature); the verification
   process determines whether a bit string (the signature) is the
   signature of an octet string (the message).

Kaliski                      Informational                     [Page 12]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   Note. The only difference between the signature algorithms defined
   here and one of the the methods by which signatures (encrypted
   message digests) are constructed in PKCS #7 is that signatures here
   are represented here as bit strings, for consistency with the X.509
   SIGNED macro. In PKCS #7 encrypted message digests are octet strings.

10.1 Signature process

   The signature process consists of four steps: message digesting, data
   encoding, RSA encryption, and octet-string-to-bit-string conversion.
   The input to the signature process shall be an octet string M, the
   message; and a signer's private key. The output from the signature
   process shall be a bit string S, the signature.

10.1.1 Message digesting

   The message M shall be digested with the selected message- digest
   algorithm to give an octet string MD, the message digest.

10.1.2 Data encoding

   The message digest MD and a message-digest algorithm identifier shall
   be combined into an ASN.1 value of type DigestInfo, described below,
   which shall be BER-encoded to give an octet string D, the data.

   DigestInfo ::= SEQUENCE {
     digestAlgorithm DigestAlgorithmIdentifier,
     digest Digest }

   DigestAlgorithmIdentifier ::= AlgorithmIdentifier

   Digest ::= OCTET STRING

   The fields of type DigestInfo have the following meanings:

        o    digestAlgorithm identifies the message-digest
             algorithm (and any associated parameters). For
             this application, it should identify the selected
             message-digest algorithm, MD2, MD4 or MD5. For
             reference, the relevant object identifiers are the
             following:

Kaliski                      Informational                     [Page 13]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   md2 OBJECT IDENTIFIER ::=

     { iso(1) member-body(2) US(840) rsadsi(113549)
         digestAlgorithm(2) 2 } md4 OBJECT IDENTIFIER ::=
     { iso(1) member-body(2) US(840) rsadsi(113549)
         digestAlgorithm(2) 4 } md5 OBJECT IDENTIFIER ::=
     { iso(1) member-body(2) US(840) rsadsi(113549)
         digestAlgorithm(2) 5 }

             For these object identifiers, the parameters field of the
             digestAlgorithm value should be NULL.

        o    digest is the result of the message-digesting
             process, i.e., the message digest MD.

   Notes.

        1.   A message-digest algorithm identifier is included
             in the DigestInfo value to limit the damage resulting from
             the compromise of one message-digest algorithm. For
             instance, suppose an adversary were able to find messages
             with a given MD2 message digest.  That adversary might try
             to forge a signature on a message by finding an innocuous-
             looking message with the same MD2 message digest, and
             coercing a signer to sign the innocuous-looking message.
             This attack would succeed only if the signer used MD2. If
             the DigestInfo value contained only the message digest,
             however, an adversary could attack signers that use any
             message digest.

        2.   Although it may be claimed that the use of a
             SEQUENCE type violates the literal statement in the X.509
             SIGNED and SIGNATURE macros that a signature is an
             ENCRYPTED OCTET STRING (as opposed to ENCRYPTED SEQUENCE),
             such a literal interpretation need not be required, as
             I'Anson and Mitchell point out [IM90].

        3.  No reason is known that MD4 would not be
             for very high security digital signature schemes, but
             because MD4 was designed to be exceptionally fast, it is
             "at the edge" in terms of risking successful cryptanalytic
             attack.  A message-digest algorithm can be considered
             "broken" if someone can find a collision: two messages with
             the same digest. While collisions have been found in
             variants of MD4 with only two digesting "rounds"

Kaliski                      Informational                     [Page 14]

RFC 2313                PKCS #1: RSA Encryption               March 1998

             [Mer90][dBB92], none have been found in MD4 itself, which
             has three rounds. After further critical review, it may be
             appropriate to consider MD4 for very high security
             applications.

             MD5, which has four rounds and is proportionally slower
             than MD4, is recommended until the completion of MD4's
             review. The reported "pseudocollisions" in MD5's internal
             compression function [dBB93] do not appear to have any
             practical impact on  MD5's security.

             MD2, the slowest of the three, has the most conservative
             design. No attacks on MD2 have been published.

10.1.3 RSA encryption

   The data D shall be encrypted with the signer's RSA private key as
   described in Section 7 to give an octet string ED, the encrypted
   data. The block type shall be 01. (See Section 8.1.)

10.1.4 Octet-string-to-bit-string conversion

   The encrypted data ED shall be converted into a bit string S, the
   signature. Specifically, the most significant bit of the first octet
   of the encrypted data shall become the first bit of the signature,
   and so on through the least significant bit of the last octet of the
   encrypted data, which shall become the last bit of the signature.

   Note. The length in bits of the signature S is a multiple of eight.

10.2 Verification process

   The verification process for both signature algorithms consists of
   four steps: bit-string-to-octet-string conversion, RSA decryption,
   data decoding, and message digesting and comparison. The input to the
   verification process shall be an octet string M, the message; a
   signer's public key; and a bit string S, the signature. The output
   from the verification process shall be an indication of success or
   failure.

10.2.1 Bit-string-to-octet-string conversion

   The signature S shall be converted into an octet string ED, the
   encrypted data. Specifically, assuming that the length in bits of the
   signature S is a multiple of eight, the first bit of the signature
   shall become the most significant bit of the first octet of the

Kaliski                      Informational                     [Page 15]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   encrypted data, and so on through the last bit of the signature,
   which shall become the least significant bit of the last octet of the
   encrypted data.

   It is an error if the length in bits of the signature S is not a
   multiple of eight.

10.2.2 RSA decryption

   The encrypted data ED shall be decrypted with the signer's RSA public
   key as described in Section 8 to give an octet string D, the data.

   It is an error if the block type recovered in the decryption process
   is not 01. (See Section 9.4.)

10.2.3 Data decoding

   The data D shall be BER-decoded to give an ASN.1 value of type
   DigestInfo, which shall be separated into a message digest MD and a
   message-digest algorithm identifier. The message-digest algorithm
   identifier shall determine the "selected" message-digest algorithm
   for the next step.

   It is an error if the message-digest algorithm identifier does not
   identify the MD2, MD4 or MD5 message-digest algorithm.

10.2.4 Message digesting and comparison

   The message M shall be digested with the selected message-digest
   algorithm to give an octet string MD', the comparative message
   digest. The verification process shall succeed if the comparative
   message digest MD' is the same as the message digest MD, and the
   verification process shall fail otherwise.

11. Object identifiers

   This document defines five object identifiers: pkcs-1, rsaEncryption,
   md2WithRSAEncryption, md4WithRSAEncryption, and md5WithRSAEncryption.

   The object identifier pkcs-1 identifies this document.

   pkcs-1 OBJECT IDENTIFIER ::=

     { iso(1) member-body(2) US(840) rsadsi(113549)
         pkcs(1) 1 }

Kaliski                      Informational                     [Page 16]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   The object identifier rsaEncryption identifies RSA public and private
   keys as defined in Section 7 and the RSA encryption and decryption
   processes defined in Sections 8 and 9.

   rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 }

   The rsaEncryption object identifier is intended to be used in the
   algorithm field of a value of type AlgorithmIdentifier. The
   parameters field of that type, which has the algorithm-specific
   syntax ANY DEFINED BY algorithm, would have ASN.1 type NULL for this
   algorithm.

   The object identifiers md2WithRSAEncryption, md4WithRSAEncryption,
   md5WithRSAEncryption, identify, respectively, the "MD2 with RSA,"
   "MD4 with RSA," and "MD5 with RSA" signature and verification
   processes defined in Section 10.

   md2WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 2 }
   md4WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 3 }
   md5WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 4 }

   These object identifiers are intended to be used in the algorithm
   field of a value of type AlgorithmIdentifier. The parameters field of
   that type, which has the algorithm-specific syntax ANY DEFINED BY
   algorithm, would have ASN.1 type NULL for these algorithms.

   Note. X.509's object identifier rsa also identifies RSA public keys
   as defined in Section 7, but does not identify private keys, and
   identifies different encryption and decryption processes. It is
   expected that some applications will identify public keys by rsa.
   Such public keys are compatible with this document; an rsaEncryption
   process under an rsa public key is the same as the rsaEncryption
   process under an rsaEncryption public key.

Security Considerations

   Security issues are discussed throughout this memo.

Revision history

   Versions 1.0-1.3

   Versions 1.0-1.3 were distributed to participants in RSA Data
   Security, Inc.'s Public-Key Cryptography Standards meetings in
   February and March 1991.

Kaliski                      Informational                     [Page 17]

RFC 2313                PKCS #1: RSA Encryption               March 1998

   Version 1.4

   Version 1.4 is part of the June 3, 1991 initial public release of
   PKCS. Version 1.4 was published as NIST/OSI Implementors' Workshop
   document SEC-SIG-91-18.

   Version 1.5

   Version 1.5 incorporates several editorial changes, including updates
   to the references and the addition of a revision history. The
   following substantive changes were made:

        o    Section 10: "MD4 with RSA" signature and
             verification processes are added.

        o    Section 11: md4WithRSAEncryption object identifier
             is added.

   Supersedes June 3, 1991 version, which was also published as NIST/OSI
   Implementors' Workshop document SEC-SIG-91-18.

Acknowledgements

   This document is based on a contribution of RSA Laboratories, a
   division of RSA Data Security, Inc.  Any substantial use of the text
   from this document must acknowledge RSA Data Security, Inc. RSA Data
   Security, Inc.  requests that all material mentioning or referencing
   this document identify this as "RSA Data Security, Inc. PKCS #1".

Author's Address

   Burt Kaliski
   RSA Laboratories East
   20 Crosby Drive
   Bedford, MA  01730

   Phone: (617) 687-7000
   EMail: burt@rsa.com

Kaliski                      Informational                     [Page 18]

RFC 2313                PKCS #1: RSA Encryption               March 1998

Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Kaliski                      Informational                     [Page 19]


Network Working Group                                          C. Madson
Request for Comments: 2403                            Cisco Systems Inc.
Category: Standards Track                                       R. Glenn
                                                                    NIST
                                                           November 1998

                The Use of HMAC-MD5-96 within ESP and AH

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   This memo describes the use of the HMAC algorithm [RFC-2104] in
   conjunction with the MD5 algorithm [RFC-1321] as an authentication
   mechanism within the revised IPSEC Encapsulating Security Payload
   [ESP] and the revised IPSEC Authentication Header [AH]. HMAC with MD5
   provides data origin authentication and integrity protection.

   Further information on the other components necessary for ESP and AH
   implementations is provided by [Thayer97a].

1.  Introduction

   This memo specifies the use of MD5 [RFC-1321] combined with HMAC
   [RFC-2104] as a keyed authentication mechanism within the context of
   the Encapsulating Security Payload and the Authentication Header.
   The goal of HMAC-MD5-96 is to ensure that the packet is authentic and
   cannot be modified in transit.

   HMAC is a secret key authentication algorithm. Data integrity and
   data origin authentication as provided by HMAC are dependent upon the
   scope of the distribution of the secret key. If only the source and
   destination know the HMAC key, this provides both data origin
   authentication and data integrity for packets sent between the two
   parties; if the HMAC is correct, this proves that it must have been
   added by the source.

Madson & Glenn              Standards Track                     [Page 1]

RFC 2403        The Use of HMAC-MD5-96 within ESP and AH   November 1998

   In this memo, HMAC-MD5-96 is used within the context of ESP and AH.
   For further information on how the various pieces of ESP - including
   the confidentiality mechanism -- fit together to provide security
   services, refer to [ESP] and [Thayer97a]. For further information on
   AH, refer to [AH] and [Thayer97a].

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC-2119].

2. Algorithm and Mode

   [RFC-1321] describes the underlying MD5 algorithm, while [RFC-2104]
   describes the HMAC algorithm. The HMAC algorithm provides a framework
   for inserting various hashing algorithms such as MD5.

   HMAC-MD5-96 operates on 64-byte blocks of data.  Padding requirements
   are specified in [RFC-1321] and are part of the MD5 algorithm.  If
   MD5 is built according to [RFC-1321], there is no need to add any
   additional padding as far as HMAC-MD5-96 is concerned.  With regard
   to "implicit packet padding" as defined in [AH], no implicit packet
   padding is required.

   HMAC-MD5-96 produces a 128-bit authenticator value.  This 128-bit
   value can be truncated as described in RFC 2104.  For use with either
   ESP or AH, a truncated value using the first 96 bits MUST be
   supported.  Upon sending, the truncated value is stored within the
   authenticator field.  Upon receipt, the entire 128-bit value is
   computed and the first 96 bits are compared to the value stored in
   the authenticator field.  No other authenticator value lengths are
   supported by HMAC-MD5-96.

   The length of 96 bits was selected because it is the default
   authenticator length as specified in [AH] and meets the security
   requirements described in [RFC-2104].

2.1  Performance

   [Bellare96a] states that "(HMAC) performance is essentially that of
   the underlying hash function".  [RFC-1810] provides some performance
   analysis and recommendations of the use of MD5 with Internet
   protocols.  As of this writing no performance analysis has been done
   of HMAC or HMAC combined with MD5.

   [RFC-2104] outlines an implementation modification which can improve
   per-packet performance without affecting interoperability.

Madson & Glenn              Standards Track                     [Page 2]

RFC 2403        The Use of HMAC-MD5-96 within ESP and AH   November 1998

3. Keying Material

   HMAC-MD5-96 is a secret key algorithm. While no fixed key length is
   specified in [RFC-2104], for use with either ESP or AH a fixed key
   length of 128-bits MUST be supported.  Key lengths other than 128-
   bits MUST NOT be supported (i.e. only 128-bit keys are to be used by
   HMAC-MD5-96).  A key length of 128-bits was chosen based on the
   recommendations in [RFC-2104] (i.e. key lengths less than the
   authenticator length decrease security strength and keys longer than
   the authenticator length do not significantly increase security
   strength).

   [RFC-2104] discusses requirements for key material, which includes a
   discussion on requirements for strong randomness.  A strong pseudo-
   random function MUST be used to generate the required 128-bit key.

   At the time of this writing there are no specified weak keys for use
   with HMAC.  This does not mean to imply that weak keys do not exist.
   If, at some point, a set of weak keys for HMAC are identified, the
   use of these weak keys must be rejected followed by a request for
   replacement keys or a newly negotiated Security Association.

   [ARCH] describes the general mechanism for obtaining keying material
   when multiple keys are required for a single SA (e.g. when an ESP SA
   requires a key for confidentiality and a key for authentication).

   In order to provide data origin authentication, the key distribution
   mechanism must ensure that unique keys are allocated and that they
   are distributed only to the parties participating in the
   communication.

   [RFC-2104] makes the following recommendation with regard to
   rekeying.  Current attacks do not indicate a specific recommended
   frequency for key changes as these attacks are practically
   infeasible.  However, periodic key refreshment is a fundamental
   security practice that helps against potential weaknesses of the
   function and keys, reduces the information avaliable to a
   cryptanalyst, and limits the damage of an exposed key.

4.  Interaction with the ESP Cipher Mechanism

   As of this writing, there are no known issues which preclude the use
   of the HMAC-MD5-96 algorithm with any specific cipher algorithm.

Madson & Glenn              Standards Track                     [Page 3]

RFC 2403        The Use of HMAC-MD5-96 within ESP and AH   November 1998

5.  Security Considerations

   The security provided by HMAC-MD5-96 is based upon the strength of
   HMAC, and to a lesser degree, the strength of MD5. [RFC-2104] claims
   that HMAC does not depend upon the property of strong collision
   resistance, which is important to consider when evaluating the use of
   MD5, an algorithm which has, under recent scrutiny, been shown to be
   much less collision-resistant than was first thought. At the time of
   this writing there are no practical cryptographic attacks against
   HMAC-MD5-96.

   [RFC-2104] states that for "minimally reasonable hash functions" the
   "birthday attack", the strongest attack know against HMAC, is
   impractical. For a 64-byte block hash such as HMAC-MD5-96, an attack
   involving the successful processing of 2**64 blocks would be
   infeasible unless it were discovered that the underlying hash had
   collisions after processing 2**30 blocks. A hash with such weak
   collision-resistance characteristics would generally be considered to
   be unusable.

   It is also important to consider that while MD5 was never developed
   to be used as a keyed hash algorithm, HMAC had that criteria from the
   onset. While the use of MD5 in the context of data security is
   undergoing reevaluation, the combined HMAC with MD5 algorithm has
   held up to cryptographic scrutiny.

   [RFC-2104] also discusses the potential additional security which is
   provided by the truncation of the resulting hash. Specifications
   which include HMAC are strongly encouraged to perform this hash
   truncation.

   As [RFC-2104] provides a framework for incorporating various hash
   algorithms with HMAC, it is possible to replace MD5 with other
   algorithms such as SHA-1. [RFC-2104] contains a detailed discussion
   on the strengths and weaknesses of HMAC algorithms.

   As is true with any cryptographic algorithm, part of its strength
   lies in the correctness of the algorithm implementation, the security
   of the key management mechanism and its implementation, the strength
   of the associated secret key, and upon the correctness of the
   implementation in all of the participating systems.  [RFC-2202]
   contains test vectors and example code to assist in verifying the
   correctness of HMAC-MD5-96 code.

Madson & Glenn              Standards Track                     [Page 4]

RFC 2403        The Use of HMAC-MD5-96 within ESP and AH   November 1998

6.  Acknowledgments

   This document is derived in part from previous works by Jim Hughes,
   those people that worked with Jim on the combined DES/CBC+HMAC-MD5
   ESP transforms, the ANX bakeoff participants, and the members of the
   IPsec working group.

   We would also like to thank Hugo Krawczyk for his comments and
   recommendations regarding some of the cryptographic specific text in
   this document.

7.  References

   [RFC-1321]   Rivest, R., "MD5 Digest Algorithm", RFC 1321, April
                1992.

   [RFC-2104]   Krawczyk, H., Bellare, M., and R. Canetti, "HMAC:
                Keyed-Hashing for Message Authentication", RFC 2104,
                February 1997.

   [RFC-1810]   Touch, J., "Report on MD5 Performance", RFC 1810, June
                1995.

   [Bellare96a] Bellare, M., Canetti, R., and H. Krawczyk, "Keying Hash
                Functions for Message Authentication", Advances in
                Cryptography, Crypto96 Proceeding, June 1996.

   [ARCH]       Kent, S., and R. Atkinson, "Security Architecture for
                the Internet Protocol", RFC 2401, November 1998.

   [ESP]        Kent, S., and R. Atkinson, "IP Encapsulating Security
                Payload", RFC 2406, November 1998.

   [AH]         Kent, S., and R. Atkinson, "IP Authentication Header",
                RFC 2402, November 1998.

   [Thayer97a]  Thayer, R., Doraswamy, N., and R. Glenn, "IP Security
                Document Roadmap", RFC 2411, November 1998.

   [RFC-2202]   Cheng, P., and R. Glenn, "Test Cases for HMAC-MD5 and
                HMAC-SHA-1", RFC 2202, March 1997.

   [RFC-2119]   Bradner, S., "Key words for use in RFCs to Indicate
                Requirement Levels", BCP 14, RFC 2119, March 1997.

Madson & Glenn              Standards Track                     [Page 5]

RFC 2403        The Use of HMAC-MD5-96 within ESP and AH   November 1998

8.  Editors' Address

   Cheryl Madson
   Cisco Systems, Inc.

   EMail: cmadson@cisco.com

   Rob Glenn
   NIST

   EMail: <rob.glenn@nist.gov>

 The IPsec working group can be contacted through the chairs:

   Robert Moskowitz
   ICSA

   EMail: rgm@icsa.net

   Ted T'so
   Massachusetts Institute of Technology

   EMail: tytso@mit.edu

Madson & Glenn              Standards Track                     [Page 6]

RFC 2403        The Use of HMAC-MD5-96 within ESP and AH   November 1998

9.  Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Madson & Glenn              Standards Track                     [Page 7]


Network Working Group                                          C. Madson
Request for Comments: 2404                            Cisco Systems Inc.
Category: Standards Track                                       R. Glenn
                                                                    NIST
                                                           November 1998

               The Use of HMAC-SHA-1-96 within ESP and AH

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   This memo describes the use of the HMAC algorithm [RFC-2104] in
   conjunction with the SHA-1 algorithm [FIPS-180-1] as an
   authentication mechanism within the revised IPSEC Encapsulating
   Security Payload [ESP] and the revised IPSEC Authentication Header
   [AH]. HMAC with SHA-1 provides data origin authentication and
   integrity protection.

   Further information on the other components necessary for ESP and AH
   implementations is provided by [Thayer97a].

1.  Introduction

   This memo specifies the use of SHA-1 [FIPS-180-1] combined with HMAC
   [RFC-2104] as a keyed authentication mechanism within the context of
   the Encapsulating Security Payload and the Authentication Header.
   The goal of HMAC-SHA-1-96 is to ensure that the packet is authentic
   and cannot be modified in transit.

   HMAC is a secret key authentication algorithm. Data integrity and
   data origin authentication as provided by HMAC are dependent upon the
   scope of the distribution of the secret key. If only the source and
   destination know the HMAC key, this provides both data origin

Madson & Glenn              Standards Track                     [Page 1]

RFC 2404       The Use of HMAC-SHA-1-96 within ESP and AH  November 1998

   authentication and data integrity for packets sent between the two
   parties; if the HMAC is correct, this proves that it must have been
   added by the source.

   In this memo, HMAC-SHA-1-96 is used within the context of ESP and AH.
   For further information on how the various pieces of ESP - including
   the confidentiality mechanism -- fit together to provide security
   services, refer to [ESP] and [Thayer97a]. For further information on
   AH, refer to [AH] and [Thayer97a].

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC 2119].

2. Algorithm and Mode

   [FIPS-180-1] describes the underlying SHA-1 algorithm, while [RFC-
   2104] describes the HMAC algorithm. The HMAC algorithm provides a
   framework for inserting various hashing algorithms such as SHA-1.

   HMAC-SHA-1-96 operates on 64-byte blocks of data.  Padding
   requirements are specified in [FIPS-180-1] and are part of the SHA-1
   algorithm.  If you build SHA-1 according to [FIPS-180-1] you do not
   need to add any additional padding as far as HMAC-SHA-1-96 is
   concerned.  With regard to "implicit packet padding" as defined in
   [AH] no implicit packet padding is required.

   HMAC-SHA-1-96 produces a 160-bit authenticator value.  This 160-bit
   value can be truncated as described in RFC2104.  For use with either
   ESP or AH, a truncated value using the first 96 bits MUST be
   supported.  Upon sending, the truncated value is stored within the
   authenticator field.  Upon receipt, the entire 160-bit value is
   computed and the first 96 bits are compared to the value stored in
   the authenticator field.  No other authenticator value lengths are
   supported by HMAC-SHA-1-96.

   The length of 96 bits was selected because it is the default
   authenticator length as specified in [AH] and meets the security
   requirements described in [RFC-2104].

2.1  Performance

   [Bellare96a] states that "(HMAC) performance is essentially that of
   the underlying hash function".  As of this writing no detailed
   performance analysis has been done of SHA-1, HMAC or HMAC combined
   with SHA-1.

Madson & Glenn              Standards Track                     [Page 2]

RFC 2404       The Use of HMAC-SHA-1-96 within ESP and AH  November 1998

   [RFC-2104] outlines an implementation modification which can improve
   per-packet performance without affecting interoperability.

3. Keying Material

   HMAC-SHA-1-96 is a secret key algorithm. While no fixed key length is
   specified in [RFC-2104], for use with either ESP or AH a fixed key
   length of 160-bits MUST be supported.  Key lengths other than 160-
   bits MUST NOT be supported (i.e. only 160-bit keys are to be used by
   HMAC-SHA-1-96).  A key length of 160-bits was chosen based on the
   recommendations in [RFC-2104] (i.e. key lengths less than the
   authenticator length decrease security strength and keys longer than
   the authenticator length do not significantly increase security
   strength).

   [RFC-2104] discusses requirements for key material, which includes a
   discussion on requirements for strong randomness.  A strong pseudo-
   random function MUST be used to generate the required 160-bit key.

   At the time of this writing there are no specified weak keys for use
   with HMAC.  This does not mean to imply that weak keys do not exist.
   If, at some point, a set of weak keys for HMAC are identified, the
   use of these weak keys must be rejected followed by a request for
   replacement keys or a newly negotiated Security Association.

   [ARCH] describes the general mechanism for obtaining keying material
   when multiple keys are required for a single SA (e.g. when an ESP SA
   requires a key for confidentiality and a key for authentication).

   In order to provide data origin authentication, the key distribution
   mechanism must ensure that unique keys are allocated and that they
   are distributed only to the parties participating in the
   communication.

   [RFC-2104] makes the following recommendation with regard to
   rekeying.  Current attacks do not indicate a specific recommended
   frequency for key changes as these attacks are practically
   infeasible.  However, periodic key refreshment is a fundamental
   security practice that helps against potential weaknesses of the
   function and keys, reduces the information avaliable to a
   cryptanalyst, and limits the damage of an exposed key.

4.  Interaction with the ESP Cipher Mechanism

   As of this writing, there are no known issues which preclude the use
   of the HMAC-SHA-1-96 algorithm with any specific cipher algorithm.

Madson & Glenn              Standards Track                     [Page 3]

RFC 2404       The Use of HMAC-SHA-1-96 within ESP and AH  November 1998

5.  Security Considerations

   The security provided by HMAC-SHA-1-96 is based upon the strength of
   HMAC, and to a lesser degree, the strength of SHA-1.  At the time of
   this writing there are no practical cryptographic attacks against
   HMAC-SHA-1-96.

   [RFC-2104] states that for "minimally reasonable hash functions" the
   "birthday attack" is impractical.  For a 64-byte block hash such as
   HMAC-SHA-1-96, an attack involving the successful processing of 2**80
   blocks would be infeasible unless it were discovered that the
   underlying hash had collisions after processing 2**30 blocks.  A hash
   with such weak collision-resistance characteristics would generally
   be considered to be unusable.

   It is also important to consider that while SHA-1 was never developed
   to be used as a keyed hash algorithm, HMAC had that criteria from the
   onset.

   [RFC-2104] also discusses the potential additional security which is
   provided by the truncation of the resulting hash. Specifications
   which include HMAC are strongly encouraged to perform this hash
   truncation.

   As [RFC-2104] provides a framework for incorporating various hash
   algorithms with HMAC, it is possible to replace SHA-1 with other
   algorithms such as MD5. [RFC-2104] contains a detailed discussion on
   the strengths and weaknesses of HMAC algorithms.

   As is true with any cryptographic algorithm, part of its strength
   lies in the correctness of the algorithm implementation, the security
   of the key management mechanism and its implementation, the strength
   of the associated secret key, and upon the correctness of the
   implementation in all of the participating systems.  [RFC-2202]
   contains test vectors and example code to assist in verifying the
   correctness of HMAC-SHA-1-96 code.

6.  Acknowledgments

   This document is derived in part from previous works by Jim Hughes,
   those people that worked with Jim on the combined DES/CBC+HMAC-MD5
   ESP transforms, the ANX bakeoff participants, and the members of the
   IPsec working group.

   We would also like to thank Hugo Krawczyk for his comments and
   recommendations regarding some of the cryptographic specific text in
   this document.

Madson & Glenn              Standards Track                     [Page 4]

RFC 2404       The Use of HMAC-SHA-1-96 within ESP and AH  November 1998

7.  References

   [FIPS-180-1] NIST, FIPS PUB 180-1: Secure Hash Standard,
                April 1995.
                http://csrc.nist.gov/fips/fip180-1.txt (ascii)
                http://csrc.nist.gov/fips/fip180-1.ps  (postscript)

   [RFC-2104]   Krawczyk, H., Bellare, M. and R. Canetti, "HMAC: Keyed-
                Hashing for Message Authentication", RFC 2104, February
                1997.

   [Bellare96a] Bellare, M., Canetti, R., and H. Krawczyk, "Keying Hash
                Functions for Message Authentication", Advances in
                Cryptography, Crypto96 Proceeding, June 1996.

   [ARCH]       Kent, S., and R. Atkinson, "Security Architecture for
                the Internet Protocol", RFC 2401, November 1998.

   [ESP]        Kent, S., and R. Atkinson, "IP Encapsulating Security
                Payload", RFC 2406, November 1998.

   [AH]         Kent, S., and R. Atkinson, "IP Authentication Header",
                RFC 2402, November 1998.

   [Thayer97a]  Thayer, R., Doraswamy, N., and R. Glenn, "IP Security
                Document Roadmap", RFC 2411, November 1998.

   [RFC-2202]   Cheng, P., and R. Glenn, "Test Cases for HMAC-MD5 and
                HMAC-SHA-1", RFC 2202, March 1997.

   [RFC-2119]   Bradner, S., "Key words for use in RFCs to Indicate
                Requirement Levels", BCP 14, RFC 2119, March 1997.

8.  Editors' Address

   Cheryl Madson
   Cisco Systems, Inc.

   EMail: cmadson@cisco.com

   Rob Glenn
   NIST

   EMail: rob.glenn@nist.gov

Madson & Glenn              Standards Track                     [Page 5]

RFC 2404       The Use of HMAC-SHA-1-96 within ESP and AH  November 1998

 The IPsec working group can be contacted through the chairs:

   Robert Moskowitz
   ICSA

   EMail: rgm@icsa.net

   Ted T'so
   Massachusetts Institute of Technology

   EMail: tytso@mit.edu

Madson & Glenn              Standards Track                     [Page 6]

RFC 2404       The Use of HMAC-SHA-1-96 within ESP and AH  November 1998

9.  Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Madson & Glenn              Standards Track                     [Page 7]


Network Working Group                                          C. Madson
Request for Comments: 2405                           Cisco Systems, Inc.
Category: Standards Track                                   N. Doraswamy
                                                      Bay Networks, Inc.
                                                           November 1998

                    The ESP DES-CBC Cipher Algorithm
                            With Explicit IV

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   This document describes the use of the DES Cipher algorithm in Cipher
   Block Chaining Mode, with an explicit IV, as a confidentiality
   mechanism within the context of the IPSec Encapsulating Security
   Payload (ESP).

1. Introduction

   This document describes the use of the DES Cipher algorithm in Cipher
   Block Chaining Mode as a confidentiality mechanism within the context
   of the Encapsulating Security Payload.

   DES is a symmetric block cipher algorithm. The algorithm is described
   in [FIPS-46-2][FIPS-74][FIPS-81]. [Schneier96] provides a general
   description of Cipher Block Chaining Mode, a mode which is applicable
   to several encryption algorithms.

   As specified in this memo, DES-CBC is not an authentication
   mechanism. [Although DES-MAC, described in [Schneier96] amongst other
   places, does provide authentication, DES-MAC is not discussed here.]

   For further information on how the various pieces of ESP fit together
   to provide security services, refer to [ESP] and [road].

Madson & Doraswamy          Standards Track                     [Page 1]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC-2119].

2. Algorithm and Mode

   DES-CBC is a symmetric secret-key block algorithm. It has a block
   size of 64 bits.

   [FIPS-46-2][FIPS-74] and [FIPS-81] describe the DES algorithm, while
   [Schneier96] provides a good description of CBC mode.

2.1 Performance

   Phil Karn has tuned DES-CBC software to achieve 10.45 Mbps with a 90
   MHz Pentium, scaling to 15.9 Mbps with a 133 MHz Pentium.  Other DES
   speed estimates may be found in [Schneier96].

3. ESP Payload

   DES-CBC requires an explicit Initialization Vector (IV) of 8 octets
   (64 bits).  This IV immediately precedes the protected (encrypted)
   payload. The IV MUST be a random value.

   Including the IV in each datagram ensures that decryption of each
   received datagram can be performed, even when some datagrams are
   dropped, or datagrams are re-ordered in transit.

   Implementation note:

      Common practice is to use random data for the first IV and the
      last 8 octets of encrypted data from an encryption process as the
      IV for the next encryption process; this logically extends the CBC
      across the packets. It also has the advantage of limiting the
      leakage of information from the random number genrator. No matter
      which mechnism is used, the receiver MUST NOT assume any meaning
      for this value, other than that it is an IV.

      To avoid ECB encryption of very similar plaintext blocks in
      different packets, implementations MUST NOT use a counter or other
      low-Hamming distance source for IVs.

   The payload field, as defined in [ESP], is broken down according to
   the following diagram:

Madson & Doraswamy          Standards Track                     [Page 2]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

      +---------------+---------------+---------------+---------------+
      |                                                               |
      +                   Initialization Vector (IV)                  +
      |                                                               |
      +---------------+---------------+---------------+---------------+
      |                                                               |
      ~              Encrypted Payload (variable length)              ~
      |                                                               |
      +---------------------------------------------------------------+
       1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8

3.1 Block Size and Padding

   The DES-CBC algorithm described in this document MUST use a block
   size of 8 octets (64 bits).

   When padding is required, it MUST be done according to the
   conventions specified in [ESP].

4. Key Material

   DES-CBC is a symmetric secret key algorithm. The key size is 64-bits.
   [It is commonly known as a 56-bit key as the key has 56 significant
   bits; the least significant bit in every byte is the parity bit.]

   [arch] describes the general mechanism to derive keying material for
   the ESP transform. The derivation of the key from some amount of
   keying material does not differ between the manually- and
   automatically-keyed security associations.

   This mechanism MUST derive a 64-bit key value for use by this cipher.
   The mechanism will derive raw key values, the derivation process
   itself is not responsible for handling parity or weak key checks.

   Weak key checks SHOULD be performed. If such a key is found, the key
   SHOULD be rejected and a new SA requested.

   Implementation note:

      If an implementation chooses to do weak key checking, it should
      recognize that the known weak keys [FIPS74] have been adjusted for
      parity. Otherwise the handling of parity is a local issue.

   A strong pseudo-random function MUST be used to generate the required
   key. For a discussion on this topic, reference [RFC1750].

Madson & Doraswamy          Standards Track                     [Page 3]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

4.1 Weak Keys

   DES has 16 known weak keys, including so-called semi-weak keys.  The
   list of weak keys can be found in [FIPS74].

4.2 Key Lifetime

   [Blaze96] discusses the costs and key recovery time for brute force
   attacks. It presents various combinations of total cost/time to
   recover a key/cost per key recovered for 40-bit and 56-bit DES keys,
   based on late 1995 estimates.

   While a brute force search of a 56-bit DES keyspace can be considered
   infeasable for the so-called casual hacker, who is simply using spare
   CPU cycles or other low-cost resources, it is within reach of someone
   willing to spend a bit more money.

   For example, for a cost of $300,000, a 56-bit DES key can be
   recovered in an average of 19 days using off-the-shelf technology and
   in only 3 hours using a custom developed chip.

   It should be noted that there are other attacks which can recover the
   key faster, that brute force attacks are considered the "worst case",
   although the easiest to implement.

   [Wiener94] also discusses a $1M machine which can break a DES key in
   3.5 hours (1993 estimates), using a known-plaintext attack. As
   discussed in the Security Considerations section, a known plaintext
   attack is reasonably likely.

   It should also be noted that over time, the total and average search
   costs as well as the average key recovery time will continue to drop.

   While the above does not provide specific recommendations for key
   lifetime, it does reinforce the point that for a given application
   the desired key lifetime is dependent upon the perceived threat (an
   educated guess as to the amount of resources available to the
   attacker) relative to the worth of the data to be protected.

   While there are no recommendations for volume-based lifetimes made
   here, it shoud be noted that given sufficient volume there is an
   increased probabilty that known plaintext can be accumulated.

5. Interaction with Authentication Algorithms

   As of this writing, there are no known issues which preclude the use
   of the DES-CBC algorithm with any specific authentication algorithm.

Madson & Doraswamy          Standards Track                     [Page 4]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

6. Security Considerations

   [Much of this section was originally written by William Allen Simpson
   and Perry Metzger.]

   Users need to understand that the quality of the security provided by
   this specification depends completely on the strength of the DES
   algorithm, the correctness of that algorithm's implementation, the
   security of the Security Association management mechanism and its
   implementation, the strength of the key [CN94], and upon the
   correctness of the implementations in all of the participating nodes.

   [Bell95] and [Bell96] describe a cut and paste splicing attack which
   applies to all Cipher Block Chaining algorithms. This attack can be
   addressed with the use of an authentication mechanism.

   The use of the cipher mechanism without any corresponding
   authentication mechanism is strongly discouraged. This cipher can be
   used in an ESP transform that also includes authentication; it can
   also be used in an ESP transform that doesn't include authentication
   provided there is an companion AH header. Refer to [ESP], [AH],
   [arch], and [road] for more details.

   When the default ESP padding is used, the padding bytes have a
   predictable value.  They provide a small measure of tamper detection
   on their own block and the previous block in CBC mode.  This makes it
   somewhat harder to perform splicing attacks, and avoids a possible
   covert channel.  This small amount of known plaintext does not create
   any problems for modern ciphers.

   At the time of writing of this document, [BS93] demonstrated a
   differential cryptanalysis based chosen-plaintext attack requiring
   2^47 plaintext-ciphertext pairs, where the size of a pair is the size
   of a DES block (64 bits). [Matsui94] demonstrated a linear
   cryptanalysis based known-plaintext attack requiring only 2^43
   plaintext-ciphertext pairs.  Although these attacks are not
   considered practical, they must be taken into account.

   More disturbingly, [Wiener94] has shown the design of a DES cracking
   machine costing $1 Million that can crack one key every 3.5 hours.
   This is an extremely practical attack.

   One or two blocks of known plaintext suffice to recover a DES key.
   Because IP datagrams typically begin with a block of known and/or
   guessable header text, frequent key changes will not protect against
   this attack.

Madson & Doraswamy          Standards Track                     [Page 5]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

   It is suggested that DES is not a good encryption algorithm for the
   protection of even moderate value information in the face of such
   equipment.  Triple DES is probably a better choice for such purposes.

   However, despite these potential risks, the level of privacy provided
   by use of ESP DES-CBC in the Internet environment is far greater than
   sending the datagram as cleartext.

   The case for using random values for IVs has been refined with the
   following summary provided by Steve Bellovin. Refer to [Bell97] for
   further information.

      "The problem arises if you use a counter as an IV, or some other
      source with a low Hamming distance between successive IVs, for
      encryption in CBC mode.  In CBC mode, the "effective plaintext"
      for an encryption is the XOR of the actual plaintext and the
      ciphertext of the preceeding block.  Normally, that's a random
      value, which means that the effective plaintext is quite random.
      That's good, because many blocks of actual plaintext don't change
      very much from packet to packet, either.

      For the first block of plaintext, though, the IV takes the place
      of the previous block of ciphertext.  If the IV doesn't differ
      much from the previous IV, and the actual plaintext block doesn't
      differ much from the previous packet's, then the effective
      plaintext won't differ much, either.  This means that you have
      pairs of ciphertext blocks combined with plaintext blocks that
      differ in just a few bit positions.  This can be a wedge for
      assorted cryptanalytic attacks."

   The discussion on IVs has been updated to require that an
   implementation not use a low-Hamming distance source for IVs.

7. References

   [Bell95]     Bellovin, S., "An Issue With DES-CBC When Used Without
                Strong Integrity", Presentation at the 32nd Internet
                Engineering Task Force, Danvers Massachusetts, April
                1995.

   [Bell96]     Bellovin, S., "Problem Areas for the IP Security
                Protocols", Proceedings of the Sixth Usenix Security
                Symposium, July 1996.

Madson & Doraswamy          Standards Track                     [Page 6]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

   [Bell97]     Bellovin, S., "Probable Plaintext Cryptanalysis of the
                IP Security Protocols", Proceedings of the Symposium on
                Network and Distributed System Security, San Diego, CA,
                pp. 155-160, February 1997 (also
                http://www.research.att.com/~smb/papers/probtxt.{ps,
                pdf}).

   [BS93]       Biham, E., and A. Shamir, "Differential Cryptanalysis of
                the Data Encryption Standard", Berlin: Springer-Verlag,
                1993.

   [Blaze96]    Blaze, M., Diffie, W., Rivest, R., Schneier, B.,
                Shimomura, T., Thompson, E., and M. Wiener, "Minimal Key
                Lengths for Symmetric Ciphers to Provide Adequate
                Commercial Security", currently available at
                http://www.bsa.org/policy/encryption/cryptographers.html.

   [CN94]       Carroll, J.M., and S. Nudiati, "On Weak Keys and Weak
                Data:  Foiling the Two Nemeses", Cryptologia, Vol. 18
                No. 23 pp.  253-280, July 1994.

   [FIPS-46-2]  US National Bureau of Standards, "Data Encryption
                Standard", Federal Information Processing Standard
                (FIPS) Publication 46-2, December 1993,
                http://www.itl.nist.gov/div897/pubs/fip46-2.htm
                (supercedes FIPS-46-1).

   [FIPS-74]    US National Bureau of Standards, "Guidelines for
                Implementing and Using the Data Encryption Standard",
                Federal Information Processing Standard (FIPS)
                Publication 74, April 1981,
                http://www.itl.nist.gov/div897/pubs/fip74.htm.

   [FIPS-81]    US National Bureau of Standards, "DES Modes of
                Operation", Federal Information Processing Standard
                (FIPS) Publication 81, December 1980,
                http://www.itl.nist.gov/div897/pubs/fip81.htm.

   [Matsui94]   Matsui, M., "Linear Cryptanalysis method for DES
                Cipher", Advances in Cryptology -- Eurocrypt '93
                Proceedings, Berlin:  Springer-Verlag, 1994.

   [RFC-1750]   Eastlake, D., Crocker, S., and J. Schiller, "Randomness
                Recommendations for Security", RFC 1750, December 1994.

   [RFC-2119]   Bradner, S., "Key words for use in RFCs to Indicate
                Requirement Levels", BCP 14, RFC 2119, March 1997.

Madson & Doraswamy          Standards Track                     [Page 7]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

   [Schneier96] Schneier, B., "Applied Cryptography Second Edition",
                John Wiley & Sons, New York, NY, 1996.  ISBN 0-471-
                12845-7.

   [Wiener94]   Wiener, M.J., "Efficient DES Key Search", School of
                Computer Science, Carleton University, Ottawa, Canada,
                TR-244, May 1994.  Presented at the Rump Session of
                Crypto '93. [Reprinted in "Practical Cryptography for
                Data Internetworks", W.Stallings, editor, IEEE Computer
                Society Press, pp.31-79 (1996).  Currently available at
                ftp://ripem.msu.edu/pub/crypt/docs/des-key-search.ps.]

   [ESP]        Kent, S., and R. Atkinson, "IP Encapsulating Security
                Payload (ESP)", RFC 2406, November 1998.

   [AH]         Kent, S., and R. Atkinson, "IP Authentication Header
                (AH)", RFC 2402, November 1998.

   [arch]       Kent, S., and R. Atkinson, "Security Architecture for
                the Internet Protocol", RFC 2401, November 1998.

   [road]       Thayer, R., Doraswamy, N., and R. Glenn, "IP Security
                Document Roadmap", RFC 2411, November 1998.

8. Acknowledgments

   Much of the information provided here originated with various ESP-DES
   documents authored by Perry Metzger and William Allen Simpson,
   especially the Security Considerations section.

   This document is also derived in part from previous works by Jim
   Hughes, those people that worked with Jim on the combined DES-
   CBC+HMAC-MD5 ESP transforms, the ANX bakeoff participants, and the
   members of the IPsec working group.

   Thanks to Rob Glenn for assisting with the nroff formatting.

Madson & Doraswamy          Standards Track                     [Page 8]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

   The IPSec working group can be contacted via the IPSec working
   group's mailing list (ipsec@tis.com) or through its chairs:

     Robert Moskowitz
     International Computer Security Association

     EMail: rgm@icsa.net

     Theodore Y. Ts'o
     Massachusetts Institute of Technology

     EMail: tytso@MIT.EDU

9. Editors' Addresses

   Cheryl Madson
   Cisco Systems, Inc.

   EMail: cmadson@cisco.com

   Naganand Doraswamy
   Bay Networks, Inc.

   EMail: naganand@baynetworks.com

Madson & Doraswamy          Standards Track                     [Page 9]

RFC 2405            The ESP DES-CBC Cipher Algorithm       November 1998

10.  Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Madson & Doraswamy          Standards Track                    [Page 10]


Network Working Group                                         K. Sklower
Request for Comments: 2419            University of California, Berkeley
Obsoletes: 1969                                                 G. Meyer
Category: Standards Track                                          Shiva
                                                          September 1998

         The PPP DES Encryption Protocol, Version 2 (DESE-bis)

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Abstract

   The Point-to-Point Protocol (PPP) [1] provides a standard method for
   transporting multi-protocol datagrams over point-to-point links.

   The PPP Encryption Control Protocol (ECP) [2] provides a method to
   negotiate and utilize encryption protocols over PPP encapsulated
   links.

   This document provides specific details for the use of the DES
   standard [5, 6] for encrypting PPP encapsulated packets.

Acknowledgements

   The authors extend hearty thanks to Fred Baker of Cisco, Philip
   Rakity of Flowpoint, and William Simpson of Daydreamer for helpful
   improvements to the clarity and correctness of the document.

Table of Contents

   1. Introduction ................................................  2
   1.1. Motivation ................................................  2
   1.2. Conventions ...............................................  2
   2. General Overview ............................................  2
   3. Structure of This Specification .............................  4
   4. DESE Configuration Option for ECP ...........................  4
   5. Packet Format for DESE ......................................  5

Sklower & Meyer             Standards Track                     [Page 1]

RFC 2419                 PPP DES Encryption v2            September 1998

   6. Encryption ..................................................  6
   6.1. Padding Considerations ....................................  7
   6.2. Generation of the Ciphertext ..............................  8
   6.3. Retrieval of the Plaintext ................................  8
   6.4. Recovery after Packet Loss ................................  8
   7. MRU Considerations ..........................................  9
   8. Differences from RFC 1969 ...................................  9
   8.1. When to Pad ...............................................  9
   8.2. Assigned Numbers ..........................................  9
   8.3. Minor Editorial Changes ...................................  9
   9. Security Considerations .....................................  9
   10. References ................................................. 10
   11. Authors' Addresses ......................................... 11
   12. Full Copyright Statement ................................... 12

1.  Introduction

1.1.  Motivation

   The purpose of this memo is two-fold: to show how one specifies the
   necessary details of a "data" or "bearer" protocol given the context
   of the generic PPP Encryption Control Protocol, and also to provide
   at least one commonly-understood means of secure data transmission
   between PPP implementations.

   The DES encryption algorithm is a well studied, understood and widely
   implemented encryption algorithm.  The DES cipher was designed for
   efficient implementation in hardware, and consequently may be
   relatively expensive to implement in software.  However, its
   pervasiveness makes it seem like a reasonable choice for a "model"
   encryption protocol.

   Source code implementing DES in the "Electronic Code Book Mode" can be
   found in [7].  US export laws forbid the inclusion of
   compilation-ready source code in this document.

1.2.  Conventions

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [8].

2.  General Overview

   The purpose of encrypting packets exchanged between two PPP
   implementations is to attempt to insure the privacy of communication
   conducted via the two implementations.  The encryption process
   depends on the specification of an encryption algorithm and a shared

Sklower & Meyer             Standards Track                     [Page 2]

RFC 2419                 PPP DES Encryption v2            September 1998

   secret (usually involving at least a key) between the sender and
   receiver.

   Generally, the encryptor will take a PPP packet including the
   protocol field, apply the chosen encryption algorithm, place the
   resulting cipher text (and in this specification, an explicit
   sequence number) in the information field of another PPP packet.  The
   decryptor will apply the inverse algorithm and interpret the
   resulting plain text as if it were a PPP packet which had arrived
   directly on the interface.

   The means by which the secret becomes known to both communicating
   elements is beyond the scope of this document; usually some form of
   manual configuration is involved.  Implementations might make use of
   PPP authentication, or the EndPoint Identifier Option described in
   PPP Multilink [3], as factors in selecting the shared secret.  If the
   secret can be deduced by analysis of the communication between the
   two parties, then no privacy is guaranteed.

   While the US Data Encryption Standard (DES) algorithm [5, 6] provides
   multiple modes of use, this specification selects the use of only one
   mode in conjunction with the PPP Encryption Control Protocol (ECP):
   the Cipher Block Chaining (CBC) mode.  In addition to the US
   Government publications cited above, the CBC mode is also discussed
   in [7], although no C source code is provided for it per se.

   The initialization vector for this mode is deduced from an explicit
   64-bit nonce, which is exchanged in the clear during the negotiation
   phase.  The 56-bit key required by all DES modes is established as a
   shared secret between the implementations.

   One reason for choosing the chaining mode is that it is generally
   thought to require more computation resources to deduce a 64 bit key
   used for DES encryption by analysis of the encrypted communication
   stream when chaining mode is used, compared with the situation where
   each block is encrypted separately with no chaining.  Certainly,
   identical sequences of plaintext will produce different ciphers when
   chaining mode is in effect, thus complicating analysis.

   However, if chaining is to extend beyond packet boundaries, both the
   sender and receiver must agree on the order the packets were
   encrypted.  Thus, this specification provides for an explicit 16 bit
   sequence number to sequence decryption of the packets.  This mode of
   operation even allows recovery from occasional packet loss; details
   are also given below.

Sklower & Meyer             Standards Track                     [Page 3]

RFC 2419                 PPP DES Encryption v2            September 1998

3.  Structure of This Specification

   The PPP Encryption Control Protocol (ECP), provides a framework for
   negotiating parameters associated with encryption, such as choosing
   the algorithm.  It specifies the assigned numbers to be used as PPP
   protocol numbers for the "data packets" to be carried as the
   associated "data protocol", and describes the state machine.

   Thus, a specification for use in that matrix need only describe any
   additional configuration options required to specify a particular
   algorithm, and the process by which one encrypts/decrypts the
   information once the Opened state has been achieved.

4.  DESE Configuration Option for ECP

   Description

        The ECP DESE Configuration Option indicates that the issuing
        implementation is offering to employ this specification for
        decrypting communications on the link, and may be thought of as
        a request for its peer to encrypt packets in this manner.

        The ECP DESE Configuration Option has the following fields,
        which are transmitted from left to right:

                    Figure 1:  ECP DESE Configuration Option

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
        |   Type = 3    |    Length     |         Initial Nonce ...
        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

        Type

             Type = 3, to indicate the DESE-bis protocol.  The former
             value 1 indicating the previous DESE specification is
             deprecated, i.e.  systems implementing this specification
             MUST NOT offer the former value 1 in a configure-request
             and MUST configure-reject the former value on receipt of a
             configure-request containing it.

        Length

             10

Sklower & Meyer             Standards Track                     [Page 4]

RFC 2419                 PPP DES Encryption v2            September 1998

        Initial Nonce

             This field is an 8 byte quantity which is used by the peer
             implementation to encrypt the first packet transmitted
             after the sender reaches the opened state.

             To guard against replay attacks, the implementation SHOULD
             offer a different value during each ECP negotiation.  An
             example might be to use the number of seconds since Jan
             1st, 1970 (GMT/UT) in the upper 32 bits, and the current
             number of nanoseconds relative to the last second mark in
             the lower 32 bits.

             Its formulaic role is described in the Encryption section
             below.

5.  Packet Format for DESE

   Description

        The DESE packets themselves have the following fields:

                  Figure 2:  DES Encryption Protocol Packet Format

      0                   1                   2                   3
      0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |    Address    |    Control    |     0000      |  Protocol ID  |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      | Seq. No. High | Seq. No. Low  |        Ciphertext ...
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

        Address and Control

             These fields MUST be present unless the PPP Address and
             Control Field Compression option (ACFC) has been
             negotiated.

        Protocol ID

             The value of this field is 0x53 or 0x55; the latter
             indicates that ciphertext includes headers for the
             Multilink Protocol, and REQUIRES that the Individual Link
             Encryption Control Protocol has reached the opened state.
             The leading zero MAY be absent if the PPP Protocol Field
             Compression option (PFC) has been negotiated.

Sklower & Meyer             Standards Track                     [Page 5]

RFC 2419                 PPP DES Encryption v2            September 1998

        Sequence Number

             These 16-bit numbers are assigned by the encryptor
             sequentially starting with 0 (for the first packet
             transmitted once ECP has reached the opened state.

        Ciphertext

             The generation of this data is described in the next
             section.

6.  Encryption

   Once the ECP has reached the Opened state, the sender MUST NOT apply
   the encryption procedure to LCP packets nor ECP packets.

   If the async control character map option has been negotiated on the
   link, the sender applies mapping after the encryption algorithm has
   been run.

   The encryption algorithm is generally to pad the Protocol and
   Information fields of a PPP packet to some multiple of 8 bytes, and
   apply DES in Chaining Block Cipher mode with a 56-bit key K.

   There are a lot of details concerning what constitutes the Protocol
   and Information fields, in the presence or non-presence of Multilink,
   and whether the ACFC and PFC options have been negotiated, and the
   sort of padding chosen.

   Regardless of whether ACFC has been negotiated on the link, the
   sender applies the encryption procedure to only that portion of the
   packet excluding the address and control field.

   If the Multilink Protocol has been negotiated and encryption is to be
   construed as being applied to each link separately, then the
   encryption procedure is to be applied to the (possibly extended)
   protocol and information fields of the packet in the Multilink
   Protocol.

   If the Multilink Protocol has been negotiated and encryption is to be
   construed as being applied to the bundle, then the multilink
   procedure is to be applied to the resulting DESE packets.

Sklower & Meyer             Standards Track                     [Page 6]

RFC 2419                 PPP DES Encryption v2            September 1998

6.1.  Padding Considerations

   Since the DES algorithm operates on blocks of 8 octets, plain text
   packets which are of length not a multiple of 8 octets must be
   padded.  This can be injurious to the interpretation of some
   protocols which do not contain an explicit length field in their
   protocol headers.

   Since there is no standard directory of protocols which are
   susceptible to corruption through padding, this can lead to confusion
   over which protocols should be protected against padding-induced
   corruption.  Consequently, this specification requires that the
   unambiguous technique described below MUST be applied to ALL plain
   text packets.

   The method of padding is based on that described for the LCP Self-
   Describing-Padding (SDP) option (as defined in RFC 1570 [4]), but
   differs in two respects: first, maximum-pad value is fixed to be 8,
   and second, the method is to be applied to ALL packets, not just
   "specifically identified protocols".

   Plain text which is not a multiple of 8 octets long MUST be padded
   prior to encrypting the plain text with sufficient octets in the
   sequence of octets 1, 2, 3 ... 7 to make the plain text a multiple of
   8 octets.

   Plain text which is already a multiple of 8 octets may require
   padding with a further 8 octets (1, 2, 3 ... 8).  These additional
   octets MUST be appended prior to encrypting the plain text if the
   last octet of the plain text has a value of 1 through 8, inclusive.

   After the peer has decrypted the cipher text, it strips off the
   Self-Describing-Padding octets, to recreate the original plain text.

   Note that after decrypting, only the content of the last octet need
   be examined to determine how many pad bytes should be removed.
   However, the peer SHOULD discard the frame if all the octets forming
   the padding do not match the scheme just described.

   The padding operation described above is performed independently of
   whether or not the LCP Self-Describing-Padding (SDP) option has been
   negotiated.  If it has, SDP would be applied to the packet as a whole
   after it had been ciphered and after the Encryption Protocol
   Identifiers had been prepended.

Sklower & Meyer             Standards Track                     [Page 7]

RFC 2419                 PPP DES Encryption v2            September 1998

6.2.  Generation of the Ciphertext

   In this discussion, E[k] will denote the basic DES cipher determined
   by a 56-bit key k acting on 64 bit blocks. and D[k] will denote the
   corresponding decryption mechanism.  The padded plaintext described
   in the previous section then becomes a sequence of 64 bit blocks P[i]
   (where i ranges from 1 to n).  The circumflex character (^)
   represents the bit-wise exclusive-or operation applied to 64-bit
   blocks.

   When encrypting the first packet to be transmitted in the opened
   state let C[0] be the result of applying E[k] to the Initial Nonce
   received in the peer's ECP DESE option; otherwise let C[0] be the
   final block of the previously transmitted packet.

   The ciphertext for the packet is generated by the iterative process

                        C[i] = E[k](P[i] ^ C[i-1])

   for i running between 1 and n.

6.3.  Retrieval of the Plaintext

   When decrypting the first packet received in the opened state, let
   C[0] be the result of applying E[k] to the Initial Nonce transmitted
   in the ECP DESE option.  The first packet will have sequence number
   zero.  For subsequent packets, let C[0] be the final block of the
   previous packet in sequence space.  Decryption is then accomplished
   by

                        P[i] = C[i-1] ^ D[k](C[i]),

   for i running between 1 and n.

6.4.  Recovery after Packet Loss

   Packet loss is detected when there is a discontinuity in the sequence
   numbers of consecutive packets.  Suppose packet number N - 1 has an
   unrecoverable error or is otherwise lost, but packets N and N + 1 are
   received correctly.

   Since the algorithm in the previous section requires C[0] for packet
   N to be C[last] for packet N - 1, it will be impossible to decode
   packet N.  However, all packets N + 1 and following can be decoded in
   the usual way, since all that is required is the last block of
   ciphertext of the previous packet (in this case packet N, which WAS
   received).

Sklower & Meyer             Standards Track                     [Page 8]

RFC 2419                 PPP DES Encryption v2            September 1998

7.  MRU Considerations

   Because padding can occur, and because there is an additional
   protocol field in effect, implementations should take into account
   the growth of the packets.  As an example, if PFC had been
   negotiated, and if the MRU before had been exactly a multiple of 8,
   then the plaintext resulting combining a full sized data packets with
   a one byte protocol field would require an additional 7 bytes of
   padding, and the sequence number would be an additional 2 bytes so
   that the information field in the DESE protocol is now 10 bytes
   larger than that in the original packet.  Because the convention is
   that PPP options are independent of each other, negotiation of DESE
   does not, by itself, automatically increase the MRU value.

8.  Differences from RFC 1969

8.1.  When to Pad

   In RFC 1969, the method of Self-Describing Padding was not applied to
   all packets transmitted using DESE.  Following the method of the SDP
   option itself, only "specifically identified protocols", were to be
   padded.  Protocols with an explicit length identifier were exempt.
   (Examples included non-VJ-compressed IP, XNS, CLNP).

   In this speficiation, the method is applied to ALL packets.

   Secondly, this specification is clarified as being completely
   independent of the Self-Describing-Padding option for PPP, and fixes
   the maximum number of padding octets as 8.

8.2.  Assigned Numbers

   Since this specification could theoretically cause misinterpretation
   of a packet transmitted according to the previous specification, a
   new type field number has been assigned for the DESE-bis protocol

8.3.  Minor Editorial Changes

   This specification has been designated a standards track document.
   Some other language has been changed for greater clarity.

9.  Security Considerations

   This proposal is concerned with providing confidentiality solely.  It
   does not describe any mechanisms for integrity, authentication or
   nonrepudiation.  It does not guarantee that any message received has
   not been modified in transit through replay, cut-and-paste or active

Sklower & Meyer             Standards Track                     [Page 9]

RFC 2419                 PPP DES Encryption v2            September 1998

   tampering.  It does not provide authentication of the source of any
   packet received, or protect against the sender of any packet denying
   its authorship.

   This proposal relies on exterior and unspecified methods for
   authentication and retrieval of shared secrets.  It proposes no new
   technology for privacy, but merely describes a convention for the
   application of the DES cipher to data transmission between PPP
   implementation.

   Any methodology for the protection and retrieval of shared secrets,
   and any limitations of the DES cipher are relevant to the use
   described here.

10.  References

   [1] Simpson, W., Editor, "The Point-to-Point Protocol (PPP)", STD 51,
       RFC 1661, July 1994.

   [2] Meyer, G., "The PPP Encryption Protocol (ECP)", RFC 1968, June
       1996.

   [3] Sklower, K., Lloyd, B., McGregor, G., Carr, D., and T. Coradetti,
       "The PPP Multilink Protocol (MP)", RFC 1990, August 1996.

   [4] Simpson, W., Editor, "PPP LCP Extensions", RFC 1570, January
       1994.

   [5] National Bureau of Standards, "Data Encryption Standard", FIPS
       PUB 46 (January 1977).

   [6] National Bureau of Standards, "DES Modes of Operation", FIPS PUB
       81 (December 1980).

   [7] Schneier, B., "Applied Cryptography - Protocols Algorithms, and
       source code in C", John Wiley & Sons, Inc. 1994.  There is an
       errata associated with the book, and people can get a copy by
       sending e-mail to schneier@counterpane.com.

   [8] Bradner, S., "Key words for use in RFCs to Indicate Requirement
       Levels", BCP 14, RFC 2119, March 1997.

Sklower & Meyer             Standards Track                    [Page 10]

RFC 2419                 PPP DES Encryption v2            September 1998

11.  Authors' Addresses

   Keith Sklower
   Computer Science Department
   339 Soda Hall, Mail Stop 1776
   University of California
   Berkeley, CA 94720-1776

   Phone:  (510) 642-9587
   EMail:  sklower@CS.Berkeley.EDU

   Gerry M. Meyer
   Cisco Systems Ltd.
   Bothwell House, Pochard Way,
   Strathclyde Business Park,
   Bellshill, ML4 3HB
   Scotland, UK

   Phone: (UK) (pending)
   Fax:   (UK) (pending)
   Email: gemeyer@cisco.com

Sklower & Meyer             Standards Track                    [Page 11]

RFC 2419                 PPP DES Encryption v2            September 1998

12.  Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Sklower & Meyer             Standards Track                    [Page 12]


Network Working Group                                         B. Kaliski
Request for Comments: 2437                                    J. Staddon
Obsoletes: 2313                                         RSA Laboratories
Category: Informational                                     October 1998

                PKCS #1: RSA Cryptography Specifications
                              Version 2.0

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

Table of Contents

   1.       Introduction.....................................2
   1.1      Overview.........................................3
   2.       Notation.........................................3
   3.       Key types........................................5
   3.1      RSA public key...................................5
   3.2      RSA private key..................................5
   4.       Data conversion primitives.......................6
   4.1      I2OSP............................................6
   4.2      OS2IP............................................7
   5.       Cryptographic primitives.........................8
   5.1      Encryption and decryption primitives.............8
   5.1.1    RSAEP............................................8
   5.1.2    RSADP............................................9
   5.2      Signature and verification primitives...........10
   5.2.1    RSASP1..........................................10
   5.2.2    RSAVP1..........................................11
   6.       Overview of schemes.............................11
   7.       Encryption schemes..............................12
   7.1      RSAES-OAEP......................................13
   7.1.1    Encryption operation............................13
   7.1.2    Decryption operation............................14
   7.2      RSAES-PKCS1-v1_5................................15
   7.2.1    Encryption operation............................17
   7.2.2    Decryption operation............................17
   8.       Signature schemes with appendix.................18
   8.1      RSASSA-PKCS1-v1_5...............................19
   8.1.1    Signature generation operation..................20

Kaliski & Staddon            Informational                      [Page 1]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   8.1.2    Signature verification operation................21
   9.       Encoding methods................................22
   9.1      Encoding methods for encryption.................22
   9.1.1    EME-OAEP........................................22
   9.1.2    EME-PKCS1-v1_5..................................24
   9.2      Encoding methods for signatures with appendix...26
   9.2.1    EMSA-PKCS1-v1_5.................................26
   10.      Auxiliary Functions.............................27
   10.1     Hash Functions..................................27
   10.2     Mask Generation Functions.......................28
   10.2.1   MGF1............................................28
   11.      ASN.1 syntax....................................29
   11.1     Key representation..............................29
   11.1.1   Public-key syntax...............................30
   11.1.2   Private-key syntax..............................30
   11.2     Scheme identification...........................31
   11.2.1   Syntax for RSAES-OAEP...........................31
   11.2.2   Syntax for RSAES-PKCS1-v1_5.....................32
   11.2.3   Syntax for RSASSA-PKCS1-v1_5....................33
   12       Patent Statement................................33
   12.1     Patent statement for the RSA algorithm..........34
   13.      Revision history................................35
   14.      References......................................35
            Security Considerations.........................37
            Acknowledgements................................37
            Authors' Addresses..............................38
            Full Copyright Statement........................39

1. Introduction

   This memo is the successor to RFC 2313. This document provides
   recommendations for the implementation of public-key cryptography
   based on the RSA algorithm [18], covering the following aspects:

      -cryptographic primitives
      -encryption schemes
      -signature schemes with appendix
      -ASN.1 syntax for representing keys and for identifying the
       schemes

   The recommendations are intended for general application within
   computer and communications systems, and as such include a fair
   amount of flexibility. It is expected that application standards
   based on these specifications may include additional constraints. The
   recommendations are intended to be compatible with draft standards
   currently being developed by the ANSI X9F1 [1] and IEEE P1363 working
   groups [14].  This document supersedes PKCS #1 version 1.5 [20].

Kaliski & Staddon            Informational                      [Page 2]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Editor's note. It is expected that subsequent versions of PKCS #1 may
   cover other aspects of the RSA algorithm such as key size, key
   generation, key validation, and signature schemes with message
   recovery.

1.1 Overview

   The organization of this document is as follows:

      -Section 1 is an introduction.
      -Section 2 defines some notation used in this document.
      -Section 3 defines the RSA public and private key types.
      -Sections 4 and 5 define several primitives, or basic mathematical
       operations. Data conversion primitives are in Section 4, and
       cryptographic primitives (encryption-decryption,
       signature-verification) are in Section 5.
      -Section 6, 7 and 8 deal with the encryption and signature schemes
       in this document. Section 6 gives an overview. Section 7 defines
       an OAEP-based [2] encryption scheme along with the method found
       in PKCS #1 v1.5.  Section 8 defines a signature scheme with
       appendix; the method is identical to that of PKCS #1 v1.5.
      -Section 9 defines the encoding methods for the encryption and
       signature schemes in Sections 7 and 8.
      -Section 10 defines the hash functions and the mask generation
       function used in this document.
      -Section 11 defines the ASN.1 syntax for the keys defined in
       Section 3 and the schemes gives in Sections 7 and 8.
      -Section 12 outlines the revision history of PKCS #1.
      -Section 13 contains references to other publications and
       standards.

2. Notation

   (n, e)        RSA public key

   c             ciphertext representative, an integer between 0 and n-1

   C             ciphertext, an octet string

   d             private exponent

   dP            p's exponent, a positive integer such that:
                  e(dP)\equiv 1 (mod(p-1))

   dQ            q's exponent, a positive integer such that:
                  e(dQ)\equiv 1 (mod(q-1))

   e             public exponent

Kaliski & Staddon            Informational                      [Page 3]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   EM            encoded message, an octet string

   emLen         intended length in octets of an encoded message

   H             hash value, an output of Hash

   Hash          hash function

   hLen          output length in octets of hash function Hash

   K             RSA private key

   k             length in octets of the modulus

   l             intended length of octet string

   lcm(.,.)      least common multiple of two
                 nonnegative integers

   m             message representative, an integer between
                 0 and n-1

   M             message, an octet string

   MGF           mask generation function

   n             modulus

   P             encoding parameters, an octet string

   p,q           prime factors of the modulus

   qInv          CRT coefficient, a positive integer less
                 than p such: q(qInv)\equiv 1 (mod p)

   s             signature representative, an integer
                 between 0 and n-1

   S             signature, an octet string

   x             a nonnegative integer

   X             an octet string corresponding to x

   \xor          bitwise exclusive-or of two octet strings

   \lambda(n)    lcm(p-1, q-1), where n = pq

Kaliski & Staddon            Informational                      [Page 4]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   ||            concatenation operator

   ||.||         octet length operator

3. Key types

   Two key types are employed in the primitives and schemes defined in
   this document: RSA public key and RSA private key. Together, an RSA
   public key and an RSA private key form an RSA key pair.

3.1 RSA public key

   For the purposes of this document, an RSA public key consists of two
   components:

   n, the modulus, a nonnegative integer
   e, the public exponent, a nonnegative integer

   In a valid RSA public key, the modulus n is a product of two odd
   primes p and q, and the public exponent e is an integer between 3 and
   n-1 satisfying gcd (e, \lambda(n)) = 1, where \lambda(n) = lcm (p-
   1,q-1).  A recommended syntax for interchanging RSA public keys
   between implementations is given in Section 11.1.1; an
   implementation's internal representation may differ.

3.2 RSA private key

   For the purposes of this document, an RSA private key may have either
   of two representations.

   1. The first representation consists of the pair (n, d), where the
   components have the following meanings:

   n, the modulus, a nonnegative integer
   d, the private exponent, a nonnegative integer

   2. The second representation consists of a quintuple (p, q, dP, dQ,
   qInv), where the components have the following meanings:

   p, the first factor, a nonnegative integer
   q, the second factor, a nonnegative integer
   dP, the first factor's exponent, a nonnegative integer
   dQ, the second factor's exponent, a nonnegative integer
   qInv, the CRT coefficient, a nonnegative integer

   In a valid RSA private key with the first representation, the modulus
   n is the same as in the corresponding public key and is the product
   of two odd primes p and q, and the private exponent d is a positive

Kaliski & Staddon            Informational                      [Page 5]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   integer less than n satisfying:

   ed \equiv 1 (mod \lambda(n))

   where e is the corresponding public exponent and \lambda(n) is as
   defined above.

   In a valid RSA private key with the second representation, the two
   factors p and q are the prime factors of the modulus n, the exponents
   dP and dQ are positive integers less than p and q respectively
   satisfying

   e(dP)\equiv 1(mod(p-1))
   e(dQ)\equiv 1(mod(q-1)),

   and the CRT coefficient qInv is a positive integer less than p
   satisfying:

   q(qInv)\equiv 1 (mod p).

   A recommended syntax for interchanging RSA private keys between
   implementations, which includes components from both representations,
   is given in Section 11.1.2; an implementation's internal
   representation may differ.

4. Data conversion primitives

   Two data conversion primitives are employed in the schemes defined in
   this document:

   I2OSP: Integer-to-Octet-String primitive
   OS2IP: Octet-String-to-Integer primitive

   For the purposes of this document, and consistent with ASN.1 syntax, an
   octet string is an ordered sequence of octets (eight-bit bytes). The
   sequence is indexed from first (conventionally, leftmost) to last
   (rightmost). For purposes of conversion to and from integers, the first
   octet is considered the most significant in the following conversion
   primitives

4.1 I2OSP

   I2OSP converts a nonnegative integer to an octet string of a specified
   length.

   I2OSP (x, l)

Kaliski & Staddon            Informational                      [Page 6]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Input:
   x         nonnegative integer to be converted
   l         intended length of the resulting octet string

   Output:
   X         corresponding octet string of length l; or
             "integer too large"

   Steps:

   1. If x>=256^l, output "integer too large" and stop.

   2. Write the integer x in its unique l-digit representation base 256:

   x = x_{l-1}256^{l-1} + x_{l-2}256^{l-2} +... + x_1 256 + x_0

   where 0 <= x_i < 256 (note that one or more leading digits will be
   zero if x < 256^{l-1}).

   3. Let the octet X_i have the value x_{l-i} for 1 <= i <= l.  Output
   the octet string:

   X = X_1 X_2 ... X_l.

4.2 OS2IP

   OS2IP converts an octet string to a nonnegative integer.

   OS2IP (X)

   Input:
   X         octet string to be converted

   Output:
   x         corresponding nonnegative integer

   Steps:

   1. Let X_1 X_2 ... X_l  be the octets of X from first to last, and
   let x{l-i} have value X_i for 1<= i <= l.

   2. Let x = x{l-1} 256^{l-1} + x_{l-2} 256^{l-2} +...+ x_1 256 + x_0.

   3. Output x.

Kaliski & Staddon            Informational                      [Page 7]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

5. Cryptographic primitives

   Cryptographic primitives are basic mathematical operations on which
   cryptographic schemes can be built. They are intended for
   implementation in hardware or as software modules, and are not
   intended to provide security apart from a scheme.

   Four types of primitive are specified in this document, organized in
   pairs: encryption and decryption; and signature and verification.

   The specifications of the primitives assume that certain conditions
   are met by the inputs, in particular that public and private keys are
   valid.

5.1 Encryption and decryption primitives

   An encryption primitive produces a ciphertext representative from a
   message representative under the control of a public key, and a
   decryption primitive recovers the message representative from the
   ciphertext representative under the control of the corresponding
   private key.

   One pair of encryption and decryption primitives is employed in the
   encryption schemes defined in this document and is specified here:
   RSAEP/RSADP. RSAEP and RSADP involve the same mathematical operation,
   with different keys as input.

   The primitives defined here are the same as in the draft IEEE P1363
   and are compatible with PKCS #1 v1.5.

   The main mathematical operation in each primitive is exponentiation.

5.1.1 RSAEP

   RSAEP((n, e), m)

   Input:
   (n, e)    RSA public key
   m         message representative, an integer between 0 and n-1

   Output:
   c         ciphertext representative, an integer between 0 and n-1;
             or "message representative out of range"

   Assumptions: public key (n, e) is valid

   Steps:

Kaliski & Staddon            Informational                      [Page 8]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   1. If the message representative m is not between 0 and n-1, output
   message representative out of range and stop.

   2. Let c = m^e mod n.

   3. Output c.

5.1.2 RSADP

   RSADP (K, c)

   Input:

   K         RSA private key, where K has one of the following forms
                 -a pair (n, d)
                 -a quintuple (p, q, dP, dQ, qInv)
   c         ciphertext representative, an integer between 0 and n-1

   Output:
   m         message representative, an integer between 0 and n-1; or
             "ciphertext representative out of range"

   Assumptions: private key K is valid

   Steps:

   1. If the ciphertext representative c is not between 0 and n-1,
   output "ciphertext representative out of range" and stop.

   2. If the first form (n, d) of K is used:

   2.1 Let m = c^d mod n.          Else, if the second form (p, q, dP,
   dQ, qInv) of K is used:

   2.2 Let m_1 = c^dP mod p.

   2.3 Let m_2 = c^dQ mod q.

   2.4 Let h = qInv ( m_1 - m_2 ) mod p.

   2.5 Let m = m_2 + hq.

   3. Output m.

Kaliski & Staddon            Informational                      [Page 9]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

5.2 Signature and verification primitives

   A signature primitive produces a signature representative from a
   message representative under the control of a private key, and a
   verification primitive recovers the message representative from the
   signature representative under the control of the corresponding
   public key. One pair of signature and verification primitives is
   employed in the signature schemes defined in this document and is
   specified here: RSASP1/RSAVP1.

   The primitives defined here are the same as in the draft IEEE P1363
   and are compatible with PKCS #1 v1.5.

   The main mathematical operation in each primitive is exponentiation,
   as in the encryption and decryption primitives of Section 5.1. RSASP1
   and RSAVP1 are the same as RSADP and RSAEP except for the names of
   their input and output arguments; they are distinguished as they are
   intended for different purposes.

5.2.1 RSASP1

   RSASP1 (K, m)

   Input:
   K             RSA private key, where K has one of the following
                 forms:
                    -a pair (n, d)
                    -a quintuple (p, q, dP, dQ, qInv)

   m             message representative, an integer between 0 and n-1

   Output:
   s             signature representative, an integer between  0 and
                 n-1, or "message representative out of range"

   Assumptions:
   private key K is valid

   Steps:

   1. If the message representative m is not between 0 and n-1, output
   "message representative out of range" and stop.

   2. If the first form (n, d) of K is used:

   2.1 Let s = m^d mod n.          Else, if the second form (p, q, dP,
   dQ, qInv) of K is used:

Kaliski & Staddon            Informational                     [Page 10]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   2.2 Let s_1 = m^dP mod p.

   2.3 Let s_2 = m^dQ mod q.

   2.4 Let h = qInv ( s_1 - s_2 ) mod p.

   2.5 Let s = s_2 + hq.

   3. Output S.

5.2.2 RSAVP1

   RSAVP1 ((n, e), s)

   Input:
   (n, e)  RSA public key
   s       signature representative, an integer between 0 and n-1

   Output:
   m       message representative, an integer between 0 and n-1;
           or "invalid"

   Assumptions:
   public key (n, e) is valid

   Steps:

   1. If the signature representative s is not between 0 and n-1, output
   "invalid" and stop.

   2. Let m = s^e mod n.

   3. Output m.

6. Overview of schemes

   A scheme combines cryptographic primitives and other techniques to
   achieve a particular security goal. Two types of scheme are specified
   in this document: encryption schemes and signature schemes with
   appendix.

   The schemes specified in this document are limited in scope in that
   their operations consist only of steps to process data with a key,
   and do not include steps for obtaining or validating the key. Thus,
   in addition to the scheme operations, an application will typically
   include key management operations by which parties may select public
   and private keys for a scheme operation. The specific additional
   operations and other details are outside the scope of this document.

Kaliski & Staddon            Informational                     [Page 11]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   As was the case for the cryptographic primitives (Section 5), the
   specifications of scheme operations assume that certain conditions
   are met by the inputs, in particular that public and private keys are
   valid. The behavior of an implementation is thus unspecified when a
   key is invalid. The impact of such unspecified behavior depends on
   the application. Possible means of addressing key validation include
   explicit key validation by the application; key validation within the
   public-key infrastructure; and assignment of liability for operations
   performed with an invalid key to the party who generated the key.

7. Encryption schemes

   An encryption scheme consists of an encryption operation and a
   decryption operation, where the encryption operation produces a
   ciphertext from a message with a recipient's public key, and the
   decryption operation recovers the message from the ciphertext with
   the recipient's corresponding private key.

   An encryption scheme can be employed in a variety of applications. A
   typical application is a key establishment protocol, where the
   message contains key material to be delivered confidentially from one
   party to another. For instance, PKCS #7 [21] employs such a protocol
   to deliver a content-encryption key from a sender to a recipient; the
   encryption schemes defined here would be suitable key-encryption
   algorithms in that context.

   Two encryption schemes are specified in this document: RSAES-OAEP and
   RSAES-PKCS1-v1_5. RSAES-OAEP is recommended for new applications;
   RSAES-PKCS1-v1_5 is included only for compatibility with existing
   applications, and is not recommended for new applications.

   The encryption schemes given here follow a general model similar to
   that employed in IEEE P1363, by combining encryption and decryption
   primitives with an encoding method for encryption. The encryption
   operations apply a message encoding operation to a message to produce
   an encoded message, which is then converted to an integer message
   representative. An encryption primitive is applied to the message
   representative to produce the ciphertext. Reversing this, the
   decryption operations apply a decryption primitive to the ciphertext
   to recover a message representative, which is then converted to an
   octet string encoded message. A message decoding operation is applied
   to the encoded message to recover the message and verify the
   correctness of the decryption.

Kaliski & Staddon            Informational                     [Page 12]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

7.1 RSAES-OAEP

   RSAES-OAEP combines the RSAEP and RSADP primitives (Sections 5.1.1
   and 5.1.2) with the EME-OAEP encoding method (Section 9.1.1) EME-OAEP
   is based on the method found in [2]. It is compatible with the IFES
   scheme defined in the draft P1363 where the encryption and decryption
   primitives are IFEP-RSA and IFDP-RSA and the message encoding method
   is EME-OAEP. RSAES-OAEP can operate on messages of length up to k-2-
   2hLen octets, where hLen is the length of the hash function output
   for EME-OAEP and k is the length in octets of the recipient's RSA
   modulus.  Assuming that the hash function in EME-OAEP has appropriate
   properties, and the key size is sufficiently large, RSAEP-OAEP
   provides "plaintext-aware encryption," meaning that it is
   computationally infeasible to obtain full or partial information
   about a message from a ciphertext, and computationally infeasible to
   generate a valid ciphertext without knowing the corresponding
   message.  Therefore, a chosen-ciphertext attack is ineffective
   against a plaintext-aware encryption scheme such as RSAES-OAEP.

   Both the encryption and the decryption operations of RSAES-OAEP take
   the value of the parameter string P as input. In this version of PKCS
   #1, P is an octet string that is specified explicitly. See Section
   11.2.1 for the relevant ASN.1 syntax. We briefly note that to receive
   the full security benefit of RSAES-OAEP, it should not be used in a
   protocol involving RSAES-PKCS1-v1_5. It is possible that in a
   protocol on which both encryption schemes are present, an adaptive
   chosen ciphertext attack such as [4] would be useful.

   Both the encryption and the decryption operations of RSAES-OAEP take
   the value of the parameter string P as input. In this version of PKCS
   #1, P is an octet string that is specified explicitly. See Section
   11.2.1 for the relevant ASN.1 syntax.

7.1.1 Encryption operation

   RSAES-OAEP-ENCRYPT ((n, e), M, P)

   Input:
   (n, e)    recipient's RSA public key

   M         message to be encrypted, an octet string of length at
             most k-2-2hLen, where k is the length in octets of the
             modulus n and hLen is the length in octets of the hash
             function output for EME-OAEP

   P         encoding parameters, an octet string that may be empty

Kaliski & Staddon            Informational                     [Page 13]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Output:
   C         ciphertext, an octet string of length k; or "message too
             long"

   Assumptions: public key (n, e) is valid

   Steps:

   1. Apply the EME-OAEP encoding operation (Section 9.1.1.2) to the
   message M and the encoding parameters P to produce an encoded message
   EM of length k-1 octets:

   EM = EME-OAEP-ENCODE (M, P, k-1)

   If the encoding operation outputs "message too long," then output
   "message too long" and stop.

   2. Convert the encoded message EM to an integer message
   representative m: m = OS2IP (EM)

   3. Apply the RSAEP encryption primitive (Section 5.1.1) to the public
   key (n, e) and the message representative m to produce an integer
   ciphertext representative c:

   c = RSAEP ((n, e), m)

   4. Convert the ciphertext representative c to a ciphertext C of
   length k octets: C = I2OSP (c, k)

   5. Output the ciphertext C.

7.1.2 Decryption operation

   RSAES-OAEP-DECRYPT (K, C, P)

   Input:
   K          recipient's RSA private key
   C          ciphertext to be decrypted, an octet string of length
              k, where k is the length in octets of the modulus n
   P          encoding parameters, an octet string that may be empty

   Output:
   M          message, an octet string of length at most k-2-2hLen,
              where hLen is the length in octets of the hash
              function output for EME-OAEP; or "decryption error"

Kaliski & Staddon            Informational                     [Page 14]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Steps:

   1. If the length of the ciphertext C is not k octets, output
   "decryption error" and stop.

   2. Convert the ciphertext C to an integer ciphertext representative
   c: c = OS2IP (C).

   3. Apply the RSADP decryption primitive (Section 5.1.2) to the
   private key K and the ciphertext representative c to produce an
   integer message representative m:

   m = RSADP (K, c)

   If RSADP outputs "ciphertext out of range," then output "decryption
   error" and stop.

   4. Convert the message representative m to an encoded message EM of
   length k-1 octets: EM = I2OSP (m, k-1)

   If I2OSP outputs "integer too large," then output "decryption error"
   and stop.

   5. Apply the EME-OAEP decoding operation to the encoded message EM
   and the encoding parameters P to recover a message M:

   M = EME-OAEP-DECODE (EM, P)

   If the decoding operation outputs "decoding error," then output
   "decryption error" and stop.

   6. Output the message M.

   Note. It is important that the error messages output in steps 4 and 5
   be the same, otherwise an adversary may be able to extract useful
   information from the type of error message received. Error message
   information is used to mount a chosen-ciphertext attack on PKCS #1
   v1.5 encrypted messages in [4].

7.2 RSAES-PKCS1-v1_5

   RSAES-PKCS1-v1_5 combines the RSAEP and RSADP primitives with the
   EME-PKCS1-v1_5 encoding method. It is the same as the encryption
   scheme in PKCS #1 v1.5. RSAES-PKCS1-v1_5 can operate on messages of
   length up to k-11 octets, although care should be taken to avoid
   certain attacks on low-exponent RSA due to Coppersmith, et al. when
   long messages are encrypted (see the third bullet in the notes below
   and [7]).

Kaliski & Staddon            Informational                     [Page 15]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   RSAES-PKCS1-v1_5 does not provide "plaintext aware" encryption. In
   particular, it is possible to generate valid ciphertexts without
   knowing the corresponding plaintexts, with a reasonable probability
   of success. This ability can be exploited in a chosen ciphertext
   attack as shown in [4]. Therefore, if RSAES-PKCS1-v1_5 is to be used,
   certain easily implemented countermeasures should be taken to thwart
   the attack found in [4]. The addition of structure to the data to be
   encoded, rigorous checking of PKCS #1 v1.5 conformance and other
   redundancy in decrypted messages, and the consolidation of error
   messages in a client-server protocol based on PKCS #1 v1.5 can all be
   effective countermeasures and don't involve changes to a PKCS #1
   v1.5-based protocol. These and other countermeasures are discussed in
   [5].

   Notes. The following passages describe some security recommendations
   pertaining to the use of RSAES-PKCS1-v1_5. Recommendations from
   version 1.5 of this document are included as well as new
   recommendations motivated by cryptanalytic advances made in the
   intervening years.

   -It is recommended that the pseudorandom octets in EME-PKCS1-v1_5 be
   generated independently for each encryption process, especially if
   the same data is input to more than one encryption process. Hastad's
   results [13] are one motivation for this recommendation.

   -The padding string PS in EME-PKCS1-v1_5 is at least eight octets
   long, which is a security condition for public-key operations that
   prevents an attacker from recovering data by trying all possible
   encryption blocks.

   -The pseudorandom octets can also help thwart an attack due to
   Coppersmith et al. [7] when the size of the message to be encrypted
   is kept small. The attack works on low-exponent RSA when similar
   messages are encrypted with the same public key. More specifically,
   in one flavor of the attack, when two inputs to RSAEP agree on a
   large fraction of bits (8/9) and low-exponent RSA (e = 3) is used to
   encrypt both of them, it may be possible to recover both inputs with
   the attack. Another flavor of the attack is successful in decrypting
   a single ciphertext when a large fraction (2/3) of the input to RSAEP
   is already known. For typical applications, the message to be
   encrypted is short (e.g., a 128-bit symmetric key) so not enough
   information will be known or common between two messages to enable
   the attack.  However, if a long message is encrypted, or if part of a
   message is known, then the attack may be a concern. In any case, the
   RSAEP-OAEP scheme overcomes the attack.

Kaliski & Staddon            Informational                     [Page 16]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

7.2.1 Encryption operation

   RSAES-PKCS1-V1_5-ENCRYPT ((n, e), M)

   Input:
   (n, e)  recipient's RSA public key
   M       message to be encrypted, an octet string of length at
           most k-11 octets, where k is the length in octets of the
           modulus n

   Output:
   C       ciphertext, an octet string of length k; or "message too
           long"

   Steps:

   1. Apply the EME-PKCS1-v1_5 encoding operation (Section 9.1.2.1) to
   the message M to produce an encoded message EM of length k-1 octets:

   EM = EME-PKCS1-V1_5-ENCODE (M, k-1)

   If the encoding operation outputs "message too long," then output
   "message too long" and stop.

   2. Convert the encoded message EM to an integer message
   representative m: m = OS2IP (EM)

   3. Apply the RSAEP encryption primitive (Section 5.1.1) to the public
   key (n, e) and the message representative m to produce an integer
   ciphertext representative c: c = RSAEP ((n, e), m)

   4. Convert the ciphertext representative c to a ciphertext C of
   length k octets: C = I2OSP (c, k)

   5. Output the ciphertext C.

7.2.2 Decryption operation

   RSAES-PKCS1-V1_5-DECRYPT (K, C)

   Input:
   K       recipient's RSA private key
   C       ciphertext to be decrypted, an octet string of length k,
           where k is the length in octets of the modulus n

   Output:
   M       message, an octet string of length at most k-11; or
           "decryption error"

Kaliski & Staddon            Informational                     [Page 17]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Steps:

   1. If the length of the ciphertext C is not k octets, output
   "decryption error" and stop.

   2. Convert the ciphertext C to an integer ciphertext representative
   c: c = OS2IP (C).

   3. Apply the RSADP decryption primitive to the private key (n, d) and
   the ciphertext representative c to produce an integer message
   representative m: m = RSADP ((n, d), c).

   If RSADP outputs "ciphertext out of range," then output "decryption
   error" and stop.

   4. Convert the message representative m to an encoded message EM of
   length k-1 octets: EM = I2OSP (m, k-1)

   If I2OSP outputs "integer too large," then output "decryption error"
   and stop.

   5. Apply the EME-PKCS1-v1_5 decoding operation to the encoded message
   EM to recover a message M: M = EME-PKCS1-V1_5-DECODE (EM).

   If the decoding operation outputs "decoding error," then output
   "decryption error" and stop.

   6. Output the message M.

   Note. It is important that only one type of error message is output
   by EME-PKCS1-v1_5, as ensured by steps 4 and 5. If this is not done,
   then an adversary may be able to use information extracted form the
   type of error message received to mount a chosen-ciphertext attack
   such as the one found in [4].

8. Signature schemes with appendix

   A signature scheme with appendix consists of a signature generation
   operation and a signature verification operation, where the signature
   generation operation produces a signature from a message with a
   signer's private key, and the signature verification operation
   verifies the signature on the message with the signer's corresponding
   public key.  To verify a signature constructed with this type of
   scheme it is necessary to have the message itself. In this way,
   signature schemes with appendix are distinguished from signature
   schemes with message recovery, which are not supported in this
   document.

Kaliski & Staddon            Informational                     [Page 18]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   A signature scheme with appendix can be employed in a variety of
   applications. For instance, X.509 [6] employs such a scheme to
   authenticate the content of a certificate; the signature scheme with
   appendix defined here would be a suitable signature algorithm in that
   context. A related signature scheme could be employed in PKCS #7
   [21], although for technical reasons, the current version of PKCS #7
   separates a hash function from a signature scheme, which is different
   than what is done here.

   One signature scheme with appendix is specified in this document:
   RSASSA-PKCS1-v1_5.

   The signature scheme with appendix given here follows a general model
   similar to that employed in IEEE P1363, by combining signature and
   verification primitives with an encoding method for signatures. The
   signature generation operations apply a message encoding operation to
   a message to produce an encoded message, which is then converted to
   an integer message representative. A signature primitive is then
   applied to the message representative to produce the signature. The
   signature verification operations apply a signature verification
   primitive to the signature to recover a message representative, which
   is then converted to an octet string. The message encoding operation
   is again applied to the message, and the result is compared to the
   recovered octet string. If there is a match, the signature is
   considered valid. (Note that this approach assumes that the signature
   and verification primitives have the message-recovery form and the
   encoding method is deterministic, as is the case for RSASP1/RSAVP1
   and EMSA-PKCS1-v1_5. The signature generation and verification
   operations have a different form in P1363 for other primitives and
   encoding methods.)

   Editor's note. RSA Laboratories is investigating the possibility of
   including a scheme based on the PSS encoding methods specified in
   [3], which would be recommended for new applications.

8.1 RSASSA-PKCS1-v1_5

   RSASSA-PKCS1-v1_5 combines the RSASP1 and RSAVP1 primitives with the
   EME-PKCS1-v1_5 encoding method. It is compatible with the IFSSA
   scheme defined in the draft P1363 where the signature and
   verification primitives are IFSP-RSA1 and IFVP-RSA1 and the message
   encoding method is EMSA-PKCS1-v1_5 (which is not defined in P1363).
   The length of messages on which RSASSA-PKCS1-v1_5 can operate is
   either unrestricted or constrained by a very large number, depending
   on the hash function underlying the message encoding method.

Kaliski & Staddon            Informational                     [Page 19]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Assuming that the hash function in EMSA-PKCS1-v1_5 has appropriate
   properties and the key size is sufficiently large, RSASSA-PKCS1-v1_5
   provides secure signatures, meaning that it is computationally
   infeasible to generate a signature without knowing the private key,
   and computationally infeasible to find a message with a given
   signature or two messages with the same signature. Also, in the
   encoding method EMSA-PKCS1-v1_5, a hash function identifier is
   embedded in the encoding.  Because of this feature, an adversary must
   invert or find collisions of the particular hash function being used;
   attacking a different hash function than the one selected by the
   signer is not useful to the adversary.

8.1.1 Signature generation operation

   RSASSA-PKCS1-V1_5-SIGN (K, M)
   Input:
   K         signer's RSA private ke
   M         message to be signed, an octet string

   Output:
   S         signature, an octet string of length k, where k is the
             length in octets of the modulus n; "message too long" or
             "modulus too short"
   Steps:

   1. Apply the EMSA-PKCS1-v1_5 encoding operation (Section 9.2.1) to
   the message M to produce an encoded message EM of length k-1 octets:

   EM = EMSA-PKCS1-V1_5-ENCODE (M, k-1)

   If the encoding operation outputs "message too long," then output
   "message too long" and stop. If the encoding operation outputs
   "intended encoded message length too short" then output "modulus too
   short".

   2. Convert the encoded message EM to an integer message
   representative m: m = OS2IP (EM)

   3. Apply the RSASP1 signature primitive (Section 5.2.1) to the
   private key K and the message representative m to produce an integer
   signature representative s: s = RSASP1 (K, m)

   4. Convert the signature representative s to a signature S of length
   k octets: S = I2OSP (s, k)

   5. Output the signature S.

Kaliski & Staddon            Informational                     [Page 20]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

8.1.2 Signature verification operation

   RSASSA-PKCS1-V1_5-VERIFY ((n, e), M, S)

   Input:
   (n, e)    signer's RSA public key
   M         message whose signature is to be verified, an octet string
   S         signature to be verified, an octet string of length k,
             where k is the length in octets of the modulus n

   Output: "valid signature," "invalid signature," or "message too
   long", or "modulus too short"

   Steps:

   1. If the length of the signature S is not k octets, output "invalid
   signature" and stop.

   2. Convert the signature S to an integer signature representative s:

   s = OS2IP (S)

   3. Apply the RSAVP1 verification primitive (Section 5.2.2) to the
   public key (n, e) and the signature representative s to produce an
   integer message representative m:

   m = RSAVP1 ((n, e), s)                  If RSAVP1 outputs "invalid"
   then output "invalid signature" and stop.

   4. Convert the message representative m to an encoded message EM of
   length k-1 octets: EM = I2OSP (m, k-1)

   If I2OSP outputs "integer too large," then output "invalid signature"
   and stop.

   5. Apply the EMSA-PKCS1-v1_5 encoding operation (Section 9.2.1) to
   the message M to produce a second encoded message EM' of length k-1
   octets:

   EM' = EMSA-PKCS1-V1_5-ENCODE (M, k-1)

   If the encoding operation outputs "message too long," then output
   "message too long" and stop. If the encoding operation outputs
   "intended encoded message length too short" then output "modulus too
   short".

Kaliski & Staddon            Informational                     [Page 21]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   6. Compare the encoded message EM and the second encoded message EM'.
   If they are the same, output "valid signature"; otherwise, output
   "invalid signature."

9. Encoding methods

   Encoding methods consist of operations that map between octet string
   messages and integer message representatives.

   Two types of encoding method are considered in this document:
   encoding methods for encryption, encoding methods for signatures with
   appendix.

9.1 Encoding methods for encryption

   An encoding method for encryption consists of an encoding operation
   and a decoding operation. An encoding operation maps a message M to a
   message representative EM of a specified length; the decoding
   operation maps a message representative EM back to a message. The
   encoding and decoding operations are inverses.

   The message representative EM will typically have some structure that
   can be verified by the decoding operation; the decoding operation
   will output "decoding error" if the structure is not present. The
   encoding operation may also introduce some randomness, so that
   different applications of the encoding operation to the same message
   will produce different representatives.

   Two encoding methods for encryption are employed in the encryption
   schemes and are specified here: EME-OAEP and EME-PKCS1-v1_5.

9.1.1 EME-OAEP

   This encoding method is parameterized by the choice of hash function
   and mask generation function. Suggested hash and mask generation
   functions are given in Section 10. This encoding method is based on
   the method found in [2].

9.1.1.1 Encoding operation

   EME-OAEP-ENCODE (M, P, emLen)

   Options:
   Hash      hash function (hLen denotes the length in octet of the
             hash function output)
   MGF       mask generation function

Kaliski & Staddon            Informational                     [Page 22]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Input:
   M         message to be encoded, an octet string of length at most
             emLen-1-2hLen
   P         encoding parameters, an octet string
   emLen     intended length in octets of the encoded message, at least
             2hLen+1

   Output:
   EM        encoded message, an octet string of length emLen;
             "message too long" or "parameter string too long"

   Steps:

   1. If the length of P is greater than the input limitation for the
   hash function (2^61-1 octets for SHA-1) then output "parameter string
   too long" and stop.

   2. If ||M|| > emLen-2hLen-1 then output "message too long" and stop.

   3. Generate an octet string PS consisting of emLen-||M||-2hLen-1 zero
   octets. The length of PS may be 0.

   4. Let pHash = Hash(P), an octet string of length hLen.

   5. Concatenate pHash, PS, the message M, and other padding to form a
   data block DB as: DB = pHash || PS || 01 || M

   6. Generate a random octet string seed of length hLen.

   7. Let dbMask = MGF(seed, emLen-hLen).

   8. Let maskedDB = DB \xor dbMask.

   9. Let seedMask = MGF(maskedDB, hLen).

   10. Let maskedSeed = seed \xor seedMask.

   11. Let EM = maskedSeed || maskedDB.

   12. Output EM.

9.1.1.2 Decoding operation EME-OAEP-DECODE (EM, P)

   Options:
   Hash      hash function (hLen denotes the length in octet of the hash
             function output)

   MGF       mask generation function

Kaliski & Staddon            Informational                     [Page 23]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Input:

   EM        encoded message, an octet string of length at least 2hLen+1
   P         encoding parameters, an octet string

   Output:
   M         recovered message, an octet string of length at most
             ||EM||-1-2hLen; or "decoding error"

   Steps:

   1. If the length of P is greater than the input limitation for the
   hash function (2^61-1 octets for SHA-1) then output "parameter string
   too long" and stop.

   2. If ||EM|| < 2hLen+1, then output "decoding error" and stop.

   3. Let maskedSeed be the first hLen octets of EM and let maskedDB be
   the remaining ||EM|| - hLen octets.

   4. Let seedMask = MGF(maskedDB, hLen).

   5. Let seed = maskedSeed \xor seedMask.

   6. Let dbMask = MGF(seed, ||EM|| - hLen).

   7. Let DB = maskedDB \xor dbMask.

   8. Let pHash = Hash(P), an octet string of length hLen.

   9. Separate DB into an octet string pHash' consisting of the first
   hLen octets of DB, a (possibly empty) octet string PS consisting of
   consecutive zero octets following pHash', and a message M as:

   DB = pHash' || PS || 01 || M

   If there is no 01 octet to separate PS from M, output "decoding
   error" and stop.

   10. If pHash' does not equal pHash, output "decoding error" and stop.

   11. Output M.

9.1.2 EME-PKCS1-v1_5

   This encoding method is the same as in PKCS #1 v1.5, Section 8:
   Encryption Process.

Kaliski & Staddon            Informational                     [Page 24]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

9.1.2.1 Encoding operation

   EME-PKCS1-V1_5-ENCODE (M, emLen)

   Input:
   M         message to be encoded, an octet string of length at most
             emLen-10
   emLen     intended length in octets of the encoded message

   Output:
   EM        encoded message, an octet string of length emLen; or
             "message too long"

   Steps:

   1. If the length of the message M is greater than emLen - 10 octets,
   output "message too long" and stop.

   2. Generate an octet string PS of length emLen-||M||-2 consisting of
   pseudorandomly generated nonzero octets. The length of PS will be at
   least 8 octets.

   3. Concatenate PS, the message M, and other padding to form the
   encoded message EM as:

   EM = 02 || PS || 00 || M

   4. Output EM.

9.1.2.2 Decoding operation

   EME-PKCS1-V1_5-DECODE (EM)

   Input:
   EM      encoded message, an octet string of length at least 10

   Output:
   M       recovered message, an octet string of length at most
           ||EM||-10; or "decoding error"

   Steps:

   1. If the length of the encoded message EM is less than 10, output
   "decoding error" and stop.

   2. Separate the encoded message EM into an octet string PS consisting
   of nonzero octets and a message M as: EM = 02 || PS || 00 || M.

Kaliski & Staddon            Informational                     [Page 25]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   If the first octet of EM is not 02, or if there is no 00 octet to
   separate PS from M, output "decoding error" and stop.

   3. If the length of PS is less than 8 octets, output "decoding error"
   and stop.

   4. Output M.

9.2 Encoding methods for signatures with appendix

   An encoding method for signatures with appendix, for the purposes of
   this document, consists of an encoding operation. An encoding
   operation maps a message M to a message representative EM of a
   specified length. (In future versions of this document, encoding
   methods may be added that also include a decoding operation.)

   One encoding method for signatures with appendix is employed in the
   encryption schemes and is specified here: EMSA-PKCS1-v1_5.

9.2.1 EMSA-PKCS1-v1_5

   This encoding method only has an encoding operation.

   EMSA-PKCS1-v1_5-ENCODE (M, emLen)

   Option:
   Hash      hash function (hLen denotes the length in octet of the hash
             function output)

   Input:
   M         message to be encoded
   emLen     intended length in octets of the encoded message, at least
             ||T|| + 10, where T is the DER encoding of a certain value
             computed during the encoding operation

   Output:
   EM        encoded message, an octet string of length emLen; or "message
             too long" or "intended encoded message length too short"

   Steps:

   1. Apply the hash function to the message M to produce a hash value
   H:

   H = Hash(M).

   If the hash function outputs "message too long," then output "message
   too long".

Kaliski & Staddon            Informational                     [Page 26]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   2. Encode the algorithm ID for the hash function and the hash value
   into an ASN.1 value of type DigestInfo (see Section 11) with the
   Distinguished Encoding Rules (DER), where the type DigestInfo has the
   syntax

   DigestInfo::=SEQUENCE{
     digestAlgorithm  AlgorithmIdentifier,
     digest OCTET STRING }

   The first field identifies the hash function and the second contains
   the hash value. Let T be the DER encoding.

   3. If emLen is less than ||T|| + 10 then output "intended encoded
   message length too short".

   4. Generate an octet string PS consisting of emLen-||T||-2 octets
   with value FF (hexadecimal). The length of PS will be at least 8
   octets.

   5. Concatenate PS, the DER encoding T, and other padding to form the
   encoded message EM as: EM = 01 || PS || 00 || T

   6. Output EM.

10. Auxiliary Functions

   This section specifies the hash functions and the mask generation
   functions that are mentioned in the encoding methods (Section 9).

10.1 Hash Functions

   Hash functions are used in the operations contained in Sections 7, 8
   and 9. Hash functions are deterministic, meaning that the output is
   completely determined by the input. Hash functions take octet strings
   of variable length, and generate fixed length octet strings. The hash
   functions used in the operations contained in Sections 7, 8 and 9
   should be collision resistant. This means that it is infeasible to
   find two distinct inputs to the hash function that produce the same
   output. A collision resistant hash function also has the desirable
   property of being one-way; this means that given an output, it is
   infeasible to find an input whose hash is the specified output. The
   property of collision resistance is especially desirable for RSASSA-
   PKCS1-v1_5, as it makes it infeasible to forge signatures. In
   addition to the requirements, the hash function should yield a mask
   generation function  (Section 10.2) with pseudorandom output.

Kaliski & Staddon            Informational                     [Page 27]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Three hash functions are recommended for the encoding methods in this
   document: MD2 [15], MD5 [17], and SHA-1 [16]. For the EME-OAEP
   encoding method, only SHA-1 is recommended. For the EMSA-PKCS1-v1_5
   encoding method, SHA-1 is recommended for new applications. MD2 and
   MD5 are recommended only for compatibility with existing applications
   based on PKCS #1 v1.5.

   The hash functions themselves are not defined here; readers are
   referred to the appropriate references ([15], [17] and [16]).

   Note. Version 1.5 of this document also allowed for the use of MD4 in
   signature schemes. The cryptanalysis of MD4 has progressed
   significantly in the intervening years. For example, Dobbertin [10]
   demonstrated how to find collisions for MD4 and that the first two
   rounds of MD4 are not one-way [11]. Because of these results and
   others (e.g. [9]), MD4 is no longer recommended. There have also been
   advances in the cryptanalysis of MD2 and MD5, although not enough to
   warrant removal from existing applications. Rogier and Chauvaud [19]
   demonstrated how to find collisions in a modified version of MD2. No
   one has demonstrated how to find collisions for the full MD5
   algorithm, although partial results have been found (e.g. [8]). For
   new applications, to address these concerns, SHA-1 is preferred.

10.2 Mask Generation Functions

   A mask generation function takes an octet string of variable length
   and a desired output length as input, and outputs an octet string of
   the desired length. There may be restrictions on the length of the
   input and output octet strings, but such bounds are generally very
   large. Mask generation functions are deterministic; the octet string
   output is completely determined by the input octet string. The output
   of a mask generation function should be pseudorandom, that is, if the
   seed to the function is unknown, it should be infeasible to
   distinguish the output from a truly random string. The plaintext-
   awareness of RSAES-OAEP relies on the random nature of the output of
   the mask generation function, which in turn relies on the random
   nature of the underlying hash.

   One mask generation function is recommended for the encoding methods
   in this document, and is defined here: MGF1, which is based on a hash
   function. Future versions of this document may define other mask
   generation functions.

10.2.1 MGF1

   MGF1 is a Mask Generation Function based on a hash function.

   MGF1 (Z, l)

Kaliski & Staddon            Informational                     [Page 28]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   Options:
   Hash    hash function (hLen denotes the length in octets of the hash
           function output)

   Input:
   Z       seed from which mask is generated, an octet string
   l       intended length in octets of the mask, at most 2^32(hLen)

   Output:
   mask    mask, an octet string of length l; or "mask too long"

   Steps:

   1.If l > 2^32(hLen), output "mask too long" and stop.

   2.Let T  be the empty octet string.

   3.For counter from 0 to \lceil{l / hLen}\rceil-1, do the following:

   a.Convert counter to an octet string C of length 4 with the primitive
   I2OSP: C = I2OSP (counter, 4)

   b.Concatenate the hash of the seed Z and C to the octet string T: T =
   T || Hash (Z || C)

   4.Output the leading l octets of T as the octet string mask.

11. ASN.1 syntax

11.1 Key representation

   This section defines ASN.1 object identifiers for RSA public and
   private keys, and defines the types RSAPublicKey and RSAPrivateKey.
   The intended application of these definitions includes X.509
   certificates, PKCS #8 [22], and PKCS #12 [23].

   The object identifier rsaEncryption identifies RSA public and private
   keys as defined in Sections 11.1.1 and 11.1.2. The parameters field
   associated with this OID in an AlgorithmIdentifier shall have type
   NULL.

   rsaEncryption OBJECT IDENTIFIER ::= {pkcs-1 1}

   All of the definitions in this section are the same as in PKCS #1
   v1.5.

Kaliski & Staddon            Informational                     [Page 29]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

11.1.1 Public-key syntax

   An RSA public key should be represented with the ASN.1 type
   RSAPublicKey:

   RSAPublicKey::=SEQUENCE{
     modulus INTEGER, -- n
     publicExponent INTEGER -- e }

   (This type is specified in X.509 and is retained here for
   compatibility.)

   The fields of type RSAPublicKey have the following meanings:
   -modulus is the modulus n.
   -publicExponent is the public exponent e.

11.1.2 Private-key syntax

   An RSA private key should be represented with ASN.1 type
   RSAPrivateKey:

   RSAPrivateKey ::= SEQUENCE {
     version Version,
     modulus INTEGER, -- n
     publicExponent INTEGER, -- e
     privateExponent INTEGER, -- d
     prime1 INTEGER, -- p
     prime2 INTEGER, -- q
     exponent1 INTEGER, -- d mod (p-1)
     exponent2 INTEGER, -- d mod (q-1)
     coefficient INTEGER -- (inverse of q) mod p }

   Version ::= INTEGER

   The fields of type RSAPrivateKey have the following meanings:

   -version is the version number, for compatibility with future
   revisions of this document. It shall be 0 for this version of the
   document.
   -modulus is the modulus n.
   -publicExponent is the public exponent e.
   -privateExponent is the private exponent d.
   -prime1 is the prime factor p of n.
   -prime2 is the prime factor q of n.
   -exponent1 is d mod (p-1).
   -exponent2 is d mod (q-1).
   -coefficient is the Chinese Remainder Theorem coefficient q-1 mod p.

Kaliski & Staddon            Informational                     [Page 30]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

11.2 Scheme identification

   This section defines object identifiers for the encryption and
   signature schemes. The schemes compatible with PKCS #1 v1.5 have the
   same definitions as in PKCS #1 v1.5. The intended application of
   these definitions includes X.509 certificates and PKCS #7.

11.2.1 Syntax for RSAES-OAEP

   The object identifier id-RSAES-OAEP identifies the RSAES-OAEP
   encryption scheme.

   id-RSAES-OAEP OBJECT IDENTIFIER ::= {pkcs-1 7}

   The parameters field associated with this OID in an
   AlgorithmIdentifier shall have type RSAEP-OAEP-params:

   RSAES-OAEP-params ::=  SEQUENCE {
     hashFunc [0] AlgorithmIdentifier {{oaepDigestAlgorithms}}
       DEFAULT sha1Identifier,
     maskGenFunc [1] AlgorithmIdentifier {{pkcs1MGFAlgorithms}}
       DEFAULT mgf1SHA1Identifier,
     pSourceFunc [2] AlgorithmIdentifier
       {{pkcs1pSourceAlgorithms}}
       DEFAULT pSpecifiedEmptyIdentifier }

   The fields of type RSAES-OAEP-params have the following meanings:

   -hashFunc identifies the hash function. It shall be an algorithm ID
   with an OID in the set oaepDigestAlgorithms, which for this version
   shall consist of id-sha1, identifying the SHA-1 hash function. The
   parameters field for id-sha1 shall have type NULL.

   oaepDigestAlgorithms ALGORITHM-IDENTIFIER ::= {
     {NULL IDENTIFIED BY id-sha1} }

   id-sha1 OBJECT IDENTIFIER ::=
     {iso(1) identified-organization(3) oiw(14) secsig(3)
       algorithms(2) 26}

   The default hash function is SHA-1:
   sha1Identifier ::= AlgorithmIdentifier {id-sha1, NULL}

   -maskGenFunc identifies the mask generation function. It shall be an
   algorithm ID with an OID in the set pkcs1MGFAlgorithms, which for
   this version shall consist of id-mgf1, identifying the MGF1 mask
   generation function (see Section 10.2.1). The parameters field for

Kaliski & Staddon            Informational                     [Page 31]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   id-mgf1 shall have type AlgorithmIdentifier, identifying the hash
   function on which MGF1 is based, where the OID for the hash function
   shall be in the set oaepDigestAlgorithms.

   pkcs1MGFAlgorithms ALGORITHM-IDENTIFIER ::= {
     {AlgorithmIdentifier {{oaepDigestAlgorithms}} IDENTIFIED
       BY id-mgf1} }

   id-mgf1 OBJECT IDENTIFIER ::= {pkcs-1 8}

   The default mask generation function is MGF1 with SHA-1:

   mgf1SHA1Identifier ::= AlgorithmIdentifier {
     id-mgf1, sha1Identifier }

   -pSourceFunc identifies the source (and possibly the value) of the
   encoding parameters P. It shall be an algorithm ID with an OID in the
   set pkcs1pSourceAlgorithms, which for this version shall consist of
   id-pSpecified, indicating that the encoding parameters are specified
   explicitly. The parameters field for id-pSpecified shall have type
   OCTET STRING, containing the encoding parameters.

   pkcs1pSourceAlgorithms ALGORITHM-IDENTIFIER ::= {
     {OCTET STRING IDENTIFIED BY id-pSpecified} }

   id-pSpecified OBJECT IDENTIFIER ::= {pkcs-1 9}

   The default encoding parameters is an empty string (so that pHash in
   EME-OAEP will contain the hash of the empty string):

   pSpecifiedEmptyIdentifier ::= AlgorithmIdentifier {
     id-pSpecified, OCTET STRING SIZE (0) }

   If all of the default values of the fields in RSAES-OAEP-params are
   used, then the algorithm identifier will have the following value:

   RSAES-OAEP-Default-Identifier ::= AlgorithmIdentifier {
     id-RSAES-OAEP,
     {sha1Identifier,
      mgf1SHA1Identifier,
      pSpecifiedEmptyIdentifier } }

11.2.2 Syntax for RSAES-PKCS1-v1_5

   The object identifier rsaEncryption (Section 11.1) identifies the
   RSAES-PKCS1-v1_5 encryption scheme. The parameters field associated
   with this OID in an AlgorithmIdentifier shall have type NULL. This is
   the same as in PKCS #1 v1.5.

Kaliski & Staddon            Informational                     [Page 32]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   RsaEncryption   OBJECT IDENTIFIER ::= {PKCS-1 1}

11.2.3 Syntax for RSASSA-PKCS1-v1_5

   The object identifier for RSASSA-PKCS1-v1_5 shall be one of the
   following. The choice of OID depends on the choice of hash algorithm:
   MD2, MD5 or SHA-1. Note that if either MD2 or MD5 is used then the
   OID is just as in PKCS #1 v1.5. For each OID, the parameters field
   associated with this OID in an AlgorithmIdentifier shall have type
   NULL.

   If the hash function to be used is MD2, then the OID should be:

   md2WithRSAEncryption ::= {PKCS-1 2}

   If the hash function to be used is MD5, then the OID should be:

   md5WithRSAEncryption ::= {PKCS-1 4}

   If the hash function to be used is SHA-1, then the OID should be:

   sha1WithRSAEncryption ::= {pkcs-1 5}

   In the digestInfo type mentioned in Section 9.2.1 the OIDS for the
   digest algorithm are the following:

   id-SHA1 OBJECT IDENTIFIER ::=
           {iso(1) identified-organization(3) oiw(14) secsig(3)
            algorithms(2) 26 }

   md2 OBJECT IDENTIFIER ::=
           {iso(1) member-body(2) US(840) rsadsi(113549)
            digestAlgorithm(2) 2}

   md5 OBJECT IDENTIFIER ::=
           {iso(1) member-body(2) US(840) rsadsi(113549)
            digestAlgorithm(2) 5}

   The parameters field of the digest algorithm has ASN.1 type NULL for
   these OIDs.

12. Patent statement

   The Internet Standards Process as defined in RFC 1310 requires a
   written statement from the Patent holder that a license will be made
   available to applicants under reasonable terms and conditions prior
   to approving a specification as a Proposed, Draft or Internet
   Standard.

Kaliski & Staddon            Informational                     [Page 33]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   The Internet Society, Internet Architecture Board, Internet
   Engineering Steering Group and the Corporation for National Research
   Initiatives take no position on the validity or scope of the
   following patents and patent applications, nor on the appropriateness
   of the terms of the assurance. The Internet Society and other groups
   mentioned above have not made any determination as to any other
   intellectual property rights which may apply to the practice of this
   standard.  Any further consideration of these matters is the user's
   responsibility.

12.1 Patent statement for the RSA algorithm

   The Massachusetts Institute of Technology has granted RSA Data
   Security, Inc., exclusive sub-licensing rights to the following
   patent issued in the United States:

   Cryptographic Communications System and Method ("RSA"), No. 4,405,829

   RSA Data Security, Inc. has provided the following statement with
   regard to this patent:

   It is RSA's business practice to make licenses to its patents
   available on reasonable and nondiscriminatory terms. Accordingly, RSA
   is willing, upon request, to grant non-exclusive licenses to such
   patent on reasonable and non-discriminatory terms and conditions to
   those who respect RSA's intellectual property rights and subject to
   RSA's then current royalty rate for the patent licensed. The royalty
   rate for the RSA patent is presently set at 2% of the licensee's
   selling price for each product covered by the patent.  Any requests
   for license information may be directed to:

            Director of Licensing
            RSA Data Security, Inc.
            2955 Campus Drive
            Suite 400
            San Mateo, CA 94403

   A license under RSA's patent(s) does not include any rights to know-
   how or other technical information or license under other
   intellectual property rights.  Such license does not extend to any
   activities which constitute infringement or inducement thereto. A
   licensee must make his own determination as to whether a license is
   necessary under patents of others.

Kaliski & Staddon            Informational                     [Page 34]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

13. Revision history

   Versions 1.0-1.3

   Versions 1.0-1.3 were distributed to participants in RSA Data
   Security, Inc.'s Public-Key Cryptography Standards meetings in
   February and March 1991.

   Version 1.4

   Version 1.4 was part of the June 3, 1991 initial public release of
   PKCS. Version 1.4 was published as NIST/OSI Implementors' Workshop
   document SEC-SIG-91-18.

   Version 1.5

   Version 1.5 incorporates several editorial changes, including updates
   to the references and the addition of a revision history. The
   following substantive changes were made: -Section 10: "MD4 with RSA"
   signature and verification processes were added.

   -Section 11: md4WithRSAEncryption object identifier was added.

   Version 2.0 [DRAFT]

   Version 2.0 incorporates major editorial changes in terms of the
   document structure, and introduces the RSAEP-OAEP encryption scheme.
   This version continues to support the encryption and signature
   processes in version 1.5, although the hash algorithm MD4 is no
   longer allowed due to cryptanalytic advances in the intervening
   years.

14. References

   [1] ANSI, ANSI X9.44: Key Management Using Reversible Public Key
       Cryptography for the Financial Services Industry. Work in
       Progress.

   [2] M. Bellare and P. Rogaway. Optimal Asymmetric Encryption - How to
       Encrypt with RSA. In Advances in Cryptology-Eurocrypt '94, pp.
       92-111, Springer-Verlag, 1994.

   [3] M. Bellare and P. Rogaway. The Exact Security of Digital
       Signatures - How to Sign with RSA and Rabin. In Advances in
       Cryptology-Eurocrypt '96, pp. 399-416, Springer-Verlag, 1996.

Kaliski & Staddon            Informational                     [Page 35]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   [4] D. Bleichenbacher. Chosen Ciphertext Attacks against Protocols
       Based on the RSA Encryption Standard PKCS #1. To appear in
       Advances in Cryptology-Crypto '98.

   [5] D. Bleichenbacher, B. Kaliski and J. Staddon. Recent Results on
       PKCS #1: RSA Encryption Standard. RSA Laboratories' Bulletin,
       Number 7, June 24, 1998.

   [6] CCITT. Recommendation X.509: The Directory-Authentication
       Framework. 1988.

   [7] D. Coppersmith, M. Franklin, J. Patarin and M. Reiter. Low-
       Exponent RSA with Related Messages. In Advances in Cryptology-
       Eurocrypt '96, pp. 1-9, Springer-Verlag, 1996

   [8] B. Den Boer and Bosselaers. Collisions for the Compression
       Function of MD5. In Advances in Cryptology-Eurocrypt '93, pp
       293-304, Springer-Verlag, 1994.

   [9] B. den Boer, and A. Bosselaers. An Attack on the Last Two Rounds
       of MD4. In Advances in Cryptology-Crypto '91, pp.194-203,
       Springer-Verlag, 1992.

   [10] H. Dobbertin. Cryptanalysis of MD4. Fast Software Encryption.
        Lecture Notes in Computer Science, Springer-Verlag 1996, pp.
        55-72.

   [11] H. Dobbertin. Cryptanalysis of MD5 Compress. Presented at the
        rump session of Eurocrypt `96, May 14, 1996

   [12] H. Dobbertin.The First Two Rounds of MD4 are Not One-Way. Fast
        Software Encryption. Lecture Notes in Computer Science,
        Springer-Verlag 1998, pp. 284-292.

   [13] J. Hastad. Solving Simultaneous Modular Equations of Low Degree.
        SIAM Journal of Computing, 17, 1988, pp. 336-341.

   [14] IEEE. IEEE P1363: Standard Specifications for Public Key
        Cryptography. Draft Version 4.

   [15] Kaliski, B., "The MD2 Message-Digest Algorithm", RFC 1319, April
        1992.

   [16] National Institute of Standards and Technology (NIST). FIPS
        Publication 180-1: Secure Hash Standard. April 1994.

   [17] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April
        1992.

Kaliski & Staddon            Informational                     [Page 36]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

   [18] R. Rivest, A. Shamir and L. Adleman. A Method for Obtaining
        Digital Signatures and Public-Key Cryptosystems. Communications
        of the ACM, 21(2), pp. 120-126, February 1978.

   [19] N. Rogier and P. Chauvaud. The Compression Function of MD2 is
        not Collision Free. Presented at Selected Areas of Cryptography
        `95. Carleton University, Ottawa, Canada. May 18-19, 1995.

   [20] RSA Laboratories. PKCS #1: RSA Encryption Standard. Version 1.5,
        November 1993.

   [21] RSA Laboratories. PKCS #7: Cryptographic Message Syntax
        Standard. Version 1.5, November 1993.

   [22] RSA  Laboratories. PKCS #8: Private-Key Information Syntax
        Standard. Version 1.2, November 1993.

   [23] RSA Laboratories. PKCS #12: Personal Information Exchange Syntax
        Standard. Version 1.0, Work in Progress, April 1997.

Security Considerations

   Security issues are discussed throughout this memo.

Acknowledgements

   This document is based on a contribution of RSA Laboratories, a
   division of RSA Data Security, Inc.  Any substantial use of the text
   from this document must acknowledge RSA Data Security, Inc. RSA Data
   Security, Inc. requests that all material mentioning or referencing
   this document identify this as "RSA Data Security, Inc. PKCS #1
   v2.0".

Kaliski & Staddon            Informational                     [Page 37]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

Authors' Addresses

   Burt Kaliski
   RSA Laboratories East
   20 Crosby Drive
   Bedford, MA  01730

   Phone: (617) 687-7000
   EMail: burt@rsa.com

   Jessica Staddon
   RSA Laboratories West
   2955 Campus Drive
   Suite 400
   San Mateo, CA 94403

   Phone: (650) 295-7600
   EMail: jstaddon@rsa.com

Kaliski & Staddon            Informational                     [Page 38]

RFC 2437        PKCS #1: RSA Cryptography Specifications    October 1998

Full Copyright Statement

   Copyright (C) The Internet Society (1998).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Kaliski & Staddon            Informational                     [Page 39]


Network Working Group                                        A. Keromytis
Request for Comments: 2857                     University of Pennsylvania
Category: Standards Track                                       N. Provos
                            Center for Information Technology Integration
                                                                June 2000

            The Use of HMAC-RIPEMD-160-96 within ESP and AH

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2000).  All Rights Reserved.

Abstract

   This memo describes the use of the HMAC algorithm [RFC 2104] in
   conjunction with the RIPEMD-160 algorithm [RIPEMD-160] as an
   authentication mechanism within the revised IPSEC Encapsulating
   Security Payload [ESP] and the revised IPSEC Authentication Header
   [AH].  HMAC with RIPEMD-160 provides data origin authentication and
   integrity protection.

   Further information on the other components necessary for ESP and AH
   implementations is provided by [Thayer97a].

1.  Introduction

   This memo specifies the use of RIPEMD-160 [RIPEMD-160] combined with
   HMAC [RFC 2104] as a keyed authentication mechanism within the
   context of the Encapsulating Security Payload and the Authentication
   Header.  The goal of HMAC-RIPEMD-160-96 is to ensure that the packet
   is authentic and cannot be modified in transit.

   HMAC is a secret key authentication algorithm.  Data integrity and
   data origin authentication as provided by HMAC are dependent upon the
   scope of the distribution of the secret key.  If only the source and
   destination know the HMAC key, this provides both data origin
   authentication and data integrity for packets sent between the two
   parties; if the HMAC is correct, this proves that it must have been
   added by the source.

Keromytis & Provos          Standards Track                     [Page 1]

RFC 2857          HMAC-RIPEMD-160-96 within ESP and AH         June 2000

   In this memo, HMAC-RIPEMD-160-96 is used within the context of ESP
   and AH.  For further information on how the various pieces of ESP -
   including the confidentiality mechanism -- fit together to provide
   security services, refer to [ESP] and [Thayer97a].  For further
   information on AH, refer to [AH] and [Thayer97a].

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED",  "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC 2119].

2. Algorithm and Mode

   [RIPEMD-160] describes the underlying RIPEMD-160 algorithm, while
   [RFC 2104] describes the HMAC algorithm.  The HMAC algorithm provides
   a framework for inserting various hashing algorithms such as RIPEMD-
   160.

   HMAC-RIPEMD-160-96 operates on 64-byte blocks of data.  Padding
   requirements are specified in [RIPEMD-160] and are part of the
   RIPEMD-160 algorithm.  Padding bits are only necessary in computing
   the HMAC-RIPEMD-160 authenticator value and MUST NOT be included in
   the packet.

   HMAC-RIPEMD-160-96 produces a 160-bit authenticator value.  This
   160-bit value can be truncated as described in RFC2104.  For use with
   either ESP or AH, a truncated value using the first 96 bits MUST be
   supported.  Upon sending, the truncated value is stored within the
   authenticator field.  Upon receipt, the entire 160-bit value is
   computed and the first 96 bits are compared to the value stored in
   the authenticator field.  No other authenticator value lengths are
   supported by HMAC-RIPEMD-160-96.

   The length of 96 bits was selected because it is the default
   authenticator length as specified in [AH] and meets the security
   requirements described in [RFC 2104].

2.1  Performance

   [Bellare96a] states that "(HMAC) performance is essentially that of
   the underlying hash function".  [RIPEMD-160] provides some
   performance analysis.  As of this writing no detailed performance
   analysis has been done of HMAC or HMAC combined with RIPEMD-160.

   [RFC 2104] outlines an implementation modification which can improve
   per-packet performance without affecting interoperability.

Keromytis & Provos          Standards Track                     [Page 2]

RFC 2857          HMAC-RIPEMD-160-96 within ESP and AH         June 2000

3. Keying Material

   HMAC-RIPEMD-160-96 is a secret key algorithm.  While no fixed key
   length is specified in [RFC 2104], for use with either ESP or AH a
   fixed key length of 160-bits MUST be supported.  Key lengths other
   than 160-bits SHALL NOT be supported.  A key length of 160-bits was
   chosen based on the recommendations in [RFC 2104] (i.e. key lengths
   less than the authenticator length decrease security strength and
   keys longer than the authenticator length do not significantly
   increase security strength).

   [RFC 2104] discusses requirements for key material, which includes a
   discussion on requirements for strong randomness.  A strong pseudo-
   random function MUST be used to generate the required 160-bit key.
   Implementors should refer to RFC 1750 for guidance on the
   requirements for such functions.

   At the time of this writing there are no specified weak keys for use
   with HMAC.  This does not mean to imply that weak keys do not exist.
   If, at some point, a set of weak keys for HMAC are identified, the
   use of these weak keys must be rejected followed by a request for
   replacement keys or a newly negotiated Security Association.

   [ESP] describes the general mechanism to obtain keying material for
   the ESP transform.  The derivation of the key from some amount of
   keying material does not differ between the manual and automatic key
   management mechanisms.

   In order to provide data origin authentication, the key distribution
   mechanism must ensure that unique keys are allocated and that they
   are distributed only to the parties participating in the
   communication.

   [RFC 2104] states that for "minimally reasonable hash functions" the
   "birthday attack" is impractical.  For a 64-byte block hash such as
   HMAC-RIPEMD-160-96, an attack involving the successful processing of
   2**64 blocks would be infeasible unless it were discovered that the
   underlying hash had collisions after processing 2**30 blocks.  (A
   hash with such weak collision-resistance characteristics would
   generally be considered to be unusable.) No time-based attacks are
   discussed in the document.

   While it it still cryptographically prudent to perform frequent
   rekeying, current literature does not include any recommended key
   lifetimes for HMAC-RIPEMD.  When recommendations for HMAC-RIPEMD key
   lifetimes become available they will be included in a revised version
   of this document.

Keromytis & Provos          Standards Track                     [Page 3]

RFC 2857          HMAC-RIPEMD-160-96 within ESP and AH         June 2000

4.  Interaction with the ESP Cipher Mechanism

   As of this writing, there are no known issues which preclude the use
   of the HMAC-RIPEMD-160-96 algorithm with any specific cipher
   algorithm.

5.  Security Considerations

   The security provided by HMAC-RIPEMD-160-96 is based upon the
   strength of HMAC, and to a lesser degree, the strength of RIPEMD-160.
   At the time of this writing there are no known practical
   cryptographic attacks against RIPEMD-160.

   It is also important to consider that while RIPEMD-160 was never
   developed to be used as a keyed hash algorithm, HMAC had that
   criteria from the onset.

   [RFC 2104] also discusses the potential additional security which is
   provided by the truncation of the resulting hash.  Specifications
   which include HMAC are strongly encouraged to perform this hash
   truncation.

   As [RFC 2104] provides a framework for incorporating various hash
   algorithms with HMAC, it is possible to replace RIPEMD-160 with other
   algorithms such as SHA-1.  [RFC 2104] contains a detailed discussion
   on the strengths and weaknesses of HMAC algorithms.

   As is true with any cryptographic algorithm, part of its strength
   lies in the correctness of the algorithm implementation, the security
   of the key management mechanism and its implementation, the strength
   of the associated secret key, and upon the correctness of the
   implementation in all of the participating systems.  [Kapp97]
   contains test vectors and example code to assist in verifying the
   correctness of HMAC-RIPEMD-160-96 code.

6.  Acknowledgements

   This document is derived from work by C. Madson and R. Glenn and from
   previous works by Jim Hughes, those people that worked with Jim on
   the combined DES/CBC+HMAC-MD5 ESP transforms, the ANX bakeoff
   participants, and the members of the IPsec working group.

7.  References

   [RIPEMD-160]  3.ISO/IEC 10118-3:1998, "Information technology -
                 Security techniques - Hash-functions - Part 3:
                 Dedicated hash-functions," International Organization
                 for Standardization, Geneva, Switzerland, 1998.

Keromytis & Provos          Standards Track                     [Page 4]

RFC 2857          HMAC-RIPEMD-160-96 within ESP and AH         June 2000

   [RFC 2104]    Krawczyk, H., Bellare, M. and R. Canetti, "HMAC:
                 Keyed-Hashing for Message Authentication", RFC 2104,
                 September, 1997.

   [Bellare96a]  Bellare, M., Canetti, R., Krawczyk, H., "Keying Hash
                 Functions for Message Authentication", Advances in
                 Cryptography, Crypto96 Proceeding, June 1996.

   [ESP]         Kent, S. and R. Atkinson, "IP Encapsulating Security
                 Payload (ESP)", RFC 2406, November 1998.

   [AH]          Kent, S. and R. Atkinson, "IP Authentication Header",
                 RFC 2402, November 1998.

   [Thayer97a]   Thayer, R., Doraswamy, N. and R. Glenn, "IP Security
                 Document Roadmap", RFC 2411, November 1998.

   [Kapp97]      Kapp, J., "Test Cases for HMAC-RIPEMD160 and HMAC-
                 RIPEMD128", RFC 2286, March 1998.

   [RFC 1750]    Eastlake 3rd, D., Crocker, S. and J. Schiller,
                 "Randomness Recommendations for Security", RFC 1750,
                 December 1994.

   [RFC 2119]    Bradner, S., "Key words for use in RFCs to Indicate
                 Requirement Levels", BCP 14, RFC 2119, March 1997.

8.  Authors' Addresses

      Angelos D. Keromytis
      Distributed Systems Lab
      Computer and Information Science Department
      University of Pennsylvania
      200 S. 33rd Street
      Philadelphia, PA 19104 - 6389

      EMail: angelos@dsl.cis.upenn.edu

      Niels Provos
      Center for Information Technology Integration
      University of Michigan
      519 W. William
      Ann Arbor, Michigan 48103 USA

      EMail: provos@citi.umich.edu

Keromytis & Provos          Standards Track                     [Page 5]

RFC 2857          HMAC-RIPEMD-160-96 within ESP and AH         June 2000

   The IPsec working group can be contacted through the chairs:

      Robert Moskowitz
      International Computer Security Association

      EMail: rgm@icsa.net

      Ted T'so
      VA Linux Systems

      EMail: tytso@valinux.com

Keromytis & Provos          Standards Track                     [Page 6]

RFC 2857          HMAC-RIPEMD-160-96 within ESP and AH         June 2000

9.  Full Copyright Statement

   Copyright (C) The Internet Society (2000).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Keromytis & Provos          Standards Track                     [Page 7]


Network Working Group                                   D. Eastlake, 3rd
Request for Comments: 3174                                      Motorola
Category: Informational                                         P. Jones
                                                           Cisco Systems
                                                          September 2001

                   US Secure Hash Algorithm 1 (SHA1)

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2001).  All Rights Reserved.

Abstract

   The purpose of this document is to make the SHA-1 (Secure Hash
   Algorithm 1) hash algorithm conveniently available to the Internet
   community.  The United States of America has adopted the SHA-1 hash
   algorithm described herein as a Federal Information Processing
   Standard.  Most of the text herein was taken by the authors from FIPS
   180-1.  Only the C code implementation is "original".

Acknowledgements

   Most of the text herein was taken from [FIPS 180-1].  Only the C code
   implementation is "original" but its style is similar to the
   previously published MD4 and MD5 RFCs [RFCs 1320, 1321].

   The SHA-1 is based on principles similar to those used by Professor
   Ronald L. Rivest of MIT when designing the MD4 message digest
   algorithm [MD4] and is modeled after that algorithm [RFC 1320].

   Useful comments from the following, which have been incorporated
   herein, are gratefully acknowledged:

      Tony Hansen
      Garrett Wollman

Eastlake & Jones             Informational                      [Page 1]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

Table of Contents

   1. Overview of Contents...........................................  2
   2. Definitions of Bit Strings and Integers........................  3
   3. Operations on Words............................................  3
   4. Message Padding................................................  4
   5. Functions and Constants Used...................................  6
   6. Computing the Message Digest...................................  6
   6.1 Method 1......................................................  6
   6.2 Method 2......................................................  7
   7. C Code.........................................................  8
   7.1 .h file.......................................................  8
   7.2 .c file....................................................... 10
   7.3 Test Driver................................................... 18
   8. Security Considerations........................................ 20
   References........................................................ 21
   Authors' Addresses................................................ 21
   Full Copyright Statement.......................................... 22

1. Overview of Contents

   NOTE: The text below is mostly taken from [FIPS 180-1] and assertions
   therein of the security of SHA-1 are made by the US Government, the
   author of [FIPS 180-1], and not by the authors of this document.

   This document specifies a Secure Hash Algorithm, SHA-1, for computing
   a condensed representation of a message or a data file.  When a
   message of any length < 2^64 bits is input, the SHA-1 produces a
   160-bit output called a message digest.  The message digest can then,
   for example, be input to a signature algorithm which generates or
   verifies the signature for the message.  Signing the message digest
   rather than the message often improves the efficiency of the process
   because the message digest is usually much smaller in size than the
   message.  The same hash algorithm must be used by the verifier of a
   digital signature as was used by the creator of the digital
   signature.  Any change to the message in transit will, with very high
   probability, result in a different message digest, and the signature
   will fail to verify.

   The SHA-1 is called secure because it is computationally infeasible
   to find a message which corresponds to a given message digest, or to
   find two different messages which produce the same message digest.
   Any change to a message in transit will, with very high probability,
   result in a different message digest, and the signature will fail to
   verify.

Eastlake & Jones             Informational                      [Page 2]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

   Section 2 below defines the terminology and functions used as
   building blocks to form SHA-1.

2. Definitions of Bit Strings and Integers

   The following terminology related to bit strings and integers will be
   used:

   a. A hex digit is an element of the set {0, 1, ... , 9, A, ... , F}.
      A hex digit is the representation of a 4-bit string.  Examples:  7
      = 0111, A = 1010.

   b. A word equals a 32-bit string which may be represented as a
      sequence of 8 hex digits.  To convert a word to 8 hex digits each
      4-bit string is converted to its hex equivalent as described in
      (a) above.  Example:

      1010 0001 0000 0011 1111 1110 0010 0011 = A103FE23.

   c. An integer between 0 and 2^32 - 1 inclusive may be represented as
      a word.  The least significant four bits of the integer are
      represented by the right-most hex digit of the word
      representation.  Example: the integer 291 = 2^8+2^5+2^1+2^0 =
      256+32+2+1 is represented by the hex word, 00000123.

      If z is an integer, 0 <= z < 2^64, then z = (2^32)x + y where 0 <=
      x < 2^32 and 0 <= y < 2^32.  Since x and y can be represented as
      words X and Y, respectively, z can be represented as the pair of
      words (X,Y).

   d. block = 512-bit string.  A block (e.g., B) may be represented as a
      sequence of 16 words.

3. Operations on Words

   The following logical operators will be applied to words:

   a. Bitwise logical word operations

      X AND Y  =  bitwise logical "and" of  X and Y.

      X OR Y   =  bitwise logical "inclusive-or" of X and Y.

      X XOR Y  =  bitwise logical "exclusive-or" of X and Y.

      NOT X    =  bitwise logical "complement" of X.

Eastlake & Jones             Informational                      [Page 3]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

      Example:

               01101100101110011101001001111011
         XOR   01100101110000010110100110110111
               --------------------------------
           =   00001001011110001011101111001100

   b. The operation X + Y is defined as follows:  words X and Y
      represent integers x and y, where 0 <= x < 2^32 and 0 <= y < 2^32.
      For positive integers n and m, let n mod m be the remainder upon
      dividing n by m.  Compute

         z  =  (x + y) mod 2^32.

      Then 0 <= z < 2^32.  Convert z to a word,  Z, and define Z = X +
      Y.

   c. The circular left shift operation S^n(X), where X is a word and n
      is an integer with 0 <= n < 32, is defined by

         S^n(X)  =  (X << n) OR (X >> 32-n).

      In the above, X << n is obtained as follows: discard the left-most
      n bits of X and then pad the result with n zeroes on the right
      (the result will still be 32 bits).  X >> n is obtained by
      discarding the right-most n bits of X and then padding the result
      with n zeroes on the left.  Thus S^n(X) is equivalent to a
      circular shift of X by n positions to the left.

4. Message Padding

   SHA-1 is used to compute a message digest for a message or data file
   that is provided as input.  The message or data file should be
   considered to be a bit string.  The length of the message is the
   number of bits in the message (the empty message has length 0).  If
   the number of bits in a message is a multiple of 8, for compactness
   we can represent the message in hex.  The purpose of message padding
   is to make the total length of a padded message a multiple of 512.
   SHA-1 sequentially processes blocks of 512 bits when computing the
   message digest.  The following specifies how this padding shall be
   performed.  As a summary, a "1" followed by m "0"s followed by a 64-
   bit integer are appended to the end of the message to produce a
   padded message of length 512 * n.  The 64-bit integer is the length
   of the original message.  The padded message is then processed by the
   SHA-1 as n 512-bit blocks.

Eastlake & Jones             Informational                      [Page 4]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

   Suppose a message has length l < 2^64.  Before it is input to the
   SHA-1, the message is padded on the right as follows:

   a. "1" is appended.  Example: if the original message is "01010000",
      this is padded to "010100001".

   b. "0"s are appended.  The number of "0"s will depend on the original
      length of the message.  The last 64 bits of the last 512-bit block
      are reserved

      for the length l of the original message.

      Example:  Suppose the original message is the bit string

         01100001 01100010 01100011 01100100 01100101.

      After step (a) this gives

         01100001 01100010 01100011 01100100 01100101 1.

      Since l = 40, the number of bits in the above is 41 and 407 "0"s
      are appended, making the total now 448.  This gives (in hex)

         61626364 65800000 00000000 00000000
         00000000 00000000 00000000 00000000
         00000000 00000000 00000000 00000000
         00000000 00000000.

   c. Obtain the 2-word representation of l, the number of bits in the
      original message.  If l < 2^32 then the first word is all zeroes.
      Append these two words to the padded message.

      Example: Suppose the original message is as in (b).  Then l = 40
      (note that l is computed before any padding).  The two-word
      representation of 40 is hex 00000000 00000028.  Hence the final
      padded message is hex

         61626364 65800000 00000000 00000000
         00000000 00000000 00000000 00000000
         00000000 00000000 00000000 00000000
         00000000 00000000 00000000 00000028.

      The padded message will contain 16 * n words for some n > 0.
      The padded message is regarded as a sequence of n blocks M(1) ,
      M(2), first characters (or bits) of the message.

Eastlake & Jones             Informational                      [Page 5]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

5. Functions and Constants Used

   A sequence of logical functions f(0), f(1),..., f(79) is used in
   SHA-1.  Each f(t), 0 <= t <= 79, operates on three 32-bit words B, C,
   D and produces a 32-bit word as output.  f(t;B,C,D) is defined as
   follows: for words B, C, D,

      f(t;B,C,D) = (B AND C) OR ((NOT B) AND D)         ( 0 <= t <= 19)

      f(t;B,C,D) = B XOR C XOR D                        (20 <= t <= 39)

      f(t;B,C,D) = (B AND C) OR (B AND D) OR (C AND D)  (40 <= t <= 59)

      f(t;B,C,D) = B XOR C XOR D                        (60 <= t <= 79).

   A sequence of constant words K(0), K(1), ... , K(79) is used in the
   SHA-1.  In hex these are given by

      K(t) = 5A827999         ( 0 <= t <= 19)

      K(t) = 6ED9EBA1         (20 <= t <= 39)

      K(t) = 8F1BBCDC         (40 <= t <= 59)

      K(t) = CA62C1D6         (60 <= t <= 79).

6. Computing the Message Digest

   The methods given in 6.1 and 6.2 below yield the same message digest.
   Although using method 2 saves sixty-four 32-bit words of storage, it
   is likely to lengthen execution time due to the increased complexity
   of the address computations for the { W[t] } in step (c).  There are
   other computation methods which give identical results.

6.1 Method 1

   The message digest is computed using the message padded as described
   in section 4.  The computation is described using two buffers, each
   consisting of five 32-bit words, and a sequence of eighty 32-bit
   words.  The words of the first 5-word buffer are labeled A,B,C,D,E.
   The words of the second 5-word buffer are labeled H0, H1, H2, H3, H4.
   The words of the 80-word sequence are labeled W(0), W(1),..., W(79).
   A single word buffer TEMP is also employed.

   To generate the message digest, the 16-word blocks M(1), M(2),...,
   M(n) defined in section 4 are processed in order.  The processing of
   each M(i) involves 80 steps.

Eastlake & Jones             Informational                      [Page 6]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

   Before processing any blocks, the H's are initialized as follows: in
   hex,

      H0 = 67452301

      H1 = EFCDAB89

      H2 = 98BADCFE

      H3 = 10325476

      H4 = C3D2E1F0.

   Now M(1), M(2), ... , M(n) are processed.  To process M(i), we
   proceed as follows:

      a. Divide M(i) into 16 words W(0), W(1), ... , W(15), where W(0)
         is the left-most word.

      b. For t = 16 to 79 let

         W(t) = S^1(W(t-3) XOR W(t-8) XOR W(t-14) XOR W(t-16)).

      c. Let A = H0, B = H1, C = H2, D = H3, E = H4.

      d. For t = 0 to 79 do

         TEMP = S^5(A) + f(t;B,C,D) + E + W(t) + K(t);

         E = D;  D = C;  C = S^30(B);  B = A; A = TEMP;

      e. Let H0 = H0 + A, H1 = H1 + B, H2 = H2 + C, H3 = H3 + D, H4 = H4
         + E.

   After processing M(n), the message digest is the 160-bit string
   represented by the 5 words

         H0 H1 H2 H3 H4.

6.2 Method 2

   The method above assumes that the sequence W(0), ... , W(79) is
   implemented as an array of eighty 32-bit words.  This is efficient
   from the standpoint of minimization of execution time, since the
   addresses of W(t-3), ...  ,W(t-16) in step (b) are easily computed.
   If space is at a premium, an alternative is to regard { W(t) } as a

Eastlake & Jones             Informational                      [Page 7]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

   circular queue, which may be implemented using an array of sixteen
   32-bit words W[0], ... W[15].  In this case, in hex let

   MASK = 0000000F.  Then processing of M(i) is as follows:

      a. Divide M(i) into 16 words W[0], ... , W[15], where W[0] is the
         left-most word.

      b. Let A = H0, B = H1, C = H2, D = H3, E = H4.

      c. For t = 0 to 79 do

         s = t AND MASK;

         if (t >= 16) W[s] = S^1(W[(s + 13) AND MASK] XOR W[(s + 8) AND
         MASK] XOR W[(s + 2) AND MASK] XOR W[s]);

         TEMP = S^5(A) + f(t;B,C,D) + E + W[s] + K(t);

         E = D; D = C; C = S^30(B); B = A; A = TEMP;

      d. Let H0 = H0 + A, H1 = H1 + B, H2 = H2 + C, H3 = H3 + D, H4 = H4
         + E.

7. C Code

   Below is a demonstration implementation of SHA-1 in C.  Section 7.1
   contains the header file, 7.2 the C code, and 7.3 a test driver.

7.1 .h file

/*
 *  sha1.h
 *
 *  Description:
 *      This is the header file for code which implements the Secure
 *      Hashing Algorithm 1 as defined in FIPS PUB 180-1 published
 *      April 17, 1995.
 *
 *      Many of the variable names in this code, especially the
 *      single character names, were used because those were the names
 *      used in the publication.
 *
 *      Please read the file sha1.c for more information.
 *
 */

Eastlake & Jones             Informational                      [Page 8]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

#ifndef _SHA1_H_
#define _SHA1_H_

#include <stdint.h>
/*
 * If you do not have the ISO standard stdint.h header file, then you
 * must typdef the following:
 *    name              meaning
 *  uint32_t         unsigned 32 bit integer
 *  uint8_t          unsigned 8 bit integer (i.e., unsigned char)
 *  int_least16_t    integer of >= 16 bits
 *
 */

#ifndef _SHA_enum_
#define _SHA_enum_
enum
{
    shaSuccess = 0,
    shaNull,            /* Null pointer parameter */
    shaInputTooLong,    /* input data too long */
    shaStateError       /* called Input after Result */
};
#endif
#define SHA1HashSize 20

/*
 *  This structure will hold context information for the SHA-1
 *  hashing operation
 */
typedef struct SHA1Context
{
    uint32_t Intermediate_Hash[SHA1HashSize/4]; /* Message Digest  */

    uint32_t Length_Low;            /* Message length in bits      */
    uint32_t Length_High;           /* Message length in bits      */

                               /* Index into message block array   */
    int_least16_t Message_Block_Index;
    uint8_t Message_Block[64];      /* 512-bit message blocks      */

    int Computed;               /* Is the digest computed?         */
    int Corrupted;             /* Is the message digest corrupted? */
} SHA1Context;

/*
 *  Function Prototypes
 */

Eastlake & Jones             Informational                      [Page 9]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

int SHA1Reset(  SHA1Context *);
int SHA1Input(  SHA1Context *,
                const uint8_t *,
                unsigned int);
int SHA1Result( SHA1Context *,
                uint8_t Message_Digest[SHA1HashSize]);

#endif

7.2 .c file

/*
 *  sha1.c
 *
 *  Description:
 *      This file implements the Secure Hashing Algorithm 1 as
 *      defined in FIPS PUB 180-1 published April 17, 1995.
 *
 *      The SHA-1, produces a 160-bit message digest for a given
 *      data stream.  It should take about 2**n steps to find a
 *      message with the same digest as a given message and
 *      2**(n/2) to find any two messages with the same digest,
 *      when n is the digest size in bits.  Therefore, this
 *      algorithm can serve as a means of providing a
 *      "fingerprint" for a message.
 *
 *  Portability Issues:
 *      SHA-1 is defined in terms of 32-bit "words".  This code
 *      uses <stdint.h> (included via "sha1.h" to define 32 and 8
 *      bit unsigned integer types.  If your C compiler does not
 *      support 32 bit unsigned integers, this code is not
 *      appropriate.
 *
 *  Caveats:
 *      SHA-1 is designed to work with messages less than 2^64 bits
 *      long.  Although SHA-1 allows a message digest to be generated
 *      for messages of any number of bits less than 2^64, this
 *      implementation only works with messages with a length that is
 *      a multiple of the size of an 8-bit character.
 *
 */

Eastlake & Jones             Informational                     [Page 10]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

#include "sha1.h"

/*
 *  Define the SHA1 circular left shift macro
 */
#define SHA1CircularShift(bits,word) \
                (((word) << (bits)) | ((word) >> (32-(bits))))

/* Local Function Prototyptes */
void SHA1PadMessage(SHA1Context *);
void SHA1ProcessMessageBlock(SHA1Context *);

/*
 *  SHA1Reset
 *
 *  Description:
 *      This function will initialize the SHA1Context in preparation
 *      for computing a new SHA1 message digest.
 *
 *  Parameters:
 *      context: [in/out]
 *          The context to reset.
 *
 *  Returns:
 *      sha Error Code.
 *
 */
int SHA1Reset(SHA1Context *context)
{
    if (!context)
    {
        return shaNull;
    }

    context->Length_Low             = 0;
    context->Length_High            = 0;
    context->Message_Block_Index    = 0;

    context->Intermediate_Hash[0]   = 0x67452301;
    context->Intermediate_Hash[1]   = 0xEFCDAB89;
    context->Intermediate_Hash[2]   = 0x98BADCFE;
    context->Intermediate_Hash[3]   = 0x10325476;
    context->Intermediate_Hash[4]   = 0xC3D2E1F0;

    context->Computed   = 0;
    context->Corrupted  = 0;

Eastlake & Jones             Informational                     [Page 11]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

    return shaSuccess;
}

/*
 *  SHA1Result
 *
 *  Description:
 *      This function will return the 160-bit message digest into the
 *      Message_Digest array  provided by the caller.
 *      NOTE: The first octet of hash is stored in the 0th element,
 *            the last octet of hash in the 19th element.
 *
 *  Parameters:
 *      context: [in/out]
 *          The context to use to calculate the SHA-1 hash.
 *      Message_Digest: [out]
 *          Where the digest is returned.
 *
 *  Returns:
 *      sha Error Code.
 *
 */
int SHA1Result( SHA1Context *context,
                uint8_t Message_Digest[SHA1HashSize])
{
    int i;

    if (!context || !Message_Digest)
    {
        return shaNull;
    }

    if (context->Corrupted)
    {
        return context->Corrupted;
    }

    if (!context->Computed)
    {
        SHA1PadMessage(context);
        for(i=0; i<64; ++i)
        {
            /* message may be sensitive, clear it out */
            context->Message_Block[i] = 0;
        }
        context->Length_Low = 0;    /* and clear length */
        context->Length_High = 0;
        context->Computed = 1;

Eastlake & Jones             Informational                     [Page 12]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

    }

    for(i = 0; i < SHA1HashSize; ++i)
    {
        Message_Digest[i] = context->Intermediate_Hash[i>>2]
                            >> 8 * ( 3 - ( i & 0x03 ) );
    }

    return shaSuccess;
}

/*
 *  SHA1Input
 *
 *  Description:
 *      This function accepts an array of octets as the next portion
 *      of the message.
 *
 *  Parameters:
 *      context: [in/out]
 *          The SHA context to update
 *      message_array: [in]
 *          An array of characters representing the next portion of
 *          the message.
 *      length: [in]
 *          The length of the message in message_array
 *
 *  Returns:
 *      sha Error Code.
 *
 */
int SHA1Input(    SHA1Context    *context,
                  const uint8_t  *message_array,
                  unsigned       length)
{
    if (!length)
    {
        return shaSuccess;
    }

    if (!context || !message_array)
    {
        return shaNull;
    }

    if (context->Computed)
    {
        context->Corrupted = shaStateError;

Eastlake & Jones             Informational                     [Page 13]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

        return shaStateError;
    }

    if (context->Corrupted)
    {
         return context->Corrupted;
    }
    while(length-- && !context->Corrupted)
    {
    context->Message_Block[context->Message_Block_Index++] =
                    (*message_array & 0xFF);

    context->Length_Low += 8;
    if (context->Length_Low == 0)
    {
        context->Length_High++;
        if (context->Length_High == 0)
        {
            /* Message is too long */
            context->Corrupted = 1;
        }
    }

    if (context->Message_Block_Index == 64)
    {
        SHA1ProcessMessageBlock(context);
    }

    message_array++;
    }

    return shaSuccess;
}

/*
 *  SHA1ProcessMessageBlock
 *
 *  Description:
 *      This function will process the next 512 bits of the message
 *      stored in the Message_Block array.
 *
 *  Parameters:
 *      None.
 *
 *  Returns:
 *      Nothing.
 *
 *  Comments:

Eastlake & Jones             Informational                     [Page 14]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

 *      Many of the variable names in this code, especially the
 *      single character names, were used because those were the
 *      names used in the publication.
 *
 *
 */
void SHA1ProcessMessageBlock(SHA1Context *context)
{
    const uint32_t K[] =    {       /* Constants defined in SHA-1   */
                            0x5A827999,
                            0x6ED9EBA1,
                            0x8F1BBCDC,
                            0xCA62C1D6
                            };
    int           t;                 /* Loop counter                */
    uint32_t      temp;              /* Temporary word value        */
    uint32_t      W[80];             /* Word sequence               */
    uint32_t      A, B, C, D, E;     /* Word buffers                */

    /*
     *  Initialize the first 16 words in the array W
     */
    for(t = 0; t < 16; t++)
    {
        W[t] = context->Message_Block[t * 4] << 24;
        W[t] |= context->Message_Block[t * 4 + 1] << 16;
        W[t] |= context->Message_Block[t * 4 + 2] << 8;
        W[t] |= context->Message_Block[t * 4 + 3];
    }

    for(t = 16; t < 80; t++)
    {
       W[t] = SHA1CircularShift(1,W[t-3] ^ W[t-8] ^ W[t-14] ^ W[t-16]);
    }

    A = context->Intermediate_Hash[0];
    B = context->Intermediate_Hash[1];
    C = context->Intermediate_Hash[2];
    D = context->Intermediate_Hash[3];
    E = context->Intermediate_Hash[4];

    for(t = 0; t < 20; t++)
    {
        temp =  SHA1CircularShift(5,A) +
                ((B & C) | ((~B) & D)) + E + W[t] + K[0];
        E = D;
        D = C;
        C = SHA1CircularShift(30,B);

Eastlake & Jones             Informational                     [Page 15]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

        B = A;
        A = temp;
    }

    for(t = 20; t < 40; t++)
    {
        temp = SHA1CircularShift(5,A) + (B ^ C ^ D) + E + W[t] + K[1];
        E = D;
        D = C;
        C = SHA1CircularShift(30,B);
        B = A;
        A = temp;
    }

    for(t = 40; t < 60; t++)
    {
        temp = SHA1CircularShift(5,A) +
               ((B & C) | (B & D) | (C & D)) + E + W[t] + K[2];
        E = D;
        D = C;
        C = SHA1CircularShift(30,B);
        B = A;
        A = temp;
    }

    for(t = 60; t < 80; t++)
    {
        temp = SHA1CircularShift(5,A) + (B ^ C ^ D) + E + W[t] + K[3];
        E = D;
        D = C;
        C = SHA1CircularShift(30,B);
        B = A;
        A = temp;
    }

    context->Intermediate_Hash[0] += A;
    context->Intermediate_Hash[1] += B;
    context->Intermediate_Hash[2] += C;
    context->Intermediate_Hash[3] += D;
    context->Intermediate_Hash[4] += E;

    context->Message_Block_Index = 0;
}

/*
 *  SHA1PadMessage
 *

Eastlake & Jones             Informational                     [Page 16]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

 *  Description:
 *      According to the standard, the message must be padded to an even
 *      512 bits.  The first padding bit must be a '1'.  The last 64
 *      bits represent the length of the original message.  All bits in
 *      between should be 0.  This function will pad the message
 *      according to those rules by filling the Message_Block array
 *      accordingly.  It will also call the ProcessMessageBlock function
 *      provided appropriately.  When it returns, it can be assumed that
 *      the message digest has been computed.
 *
 *  Parameters:
 *      context: [in/out]
 *          The context to pad
 *      ProcessMessageBlock: [in]
 *          The appropriate SHA*ProcessMessageBlock function
 *  Returns:
 *      Nothing.
 *
 */

void SHA1PadMessage(SHA1Context *context)
{
    /*
     *  Check to see if the current message block is too small to hold
     *  the initial padding bits and length.  If so, we will pad the
     *  block, process it, and then continue padding into a second
     *  block.
     */
    if (context->Message_Block_Index > 55)
    {
        context->Message_Block[context->Message_Block_Index++] = 0x80;
        while(context->Message_Block_Index < 64)
        {
            context->Message_Block[context->Message_Block_Index++] = 0;
        }

        SHA1ProcessMessageBlock(context);

        while(context->Message_Block_Index < 56)
        {
            context->Message_Block[context->Message_Block_Index++] = 0;
        }
    }
    else
    {
        context->Message_Block[context->Message_Block_Index++] = 0x80;
        while(context->Message_Block_Index < 56)
        {

Eastlake & Jones             Informational                     [Page 17]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

            context->Message_Block[context->Message_Block_Index++] = 0;
        }
    }

    /*
     *  Store the message length as the last 8 octets
     */
    context->Message_Block[56] = context->Length_High >> 24;
    context->Message_Block[57] = context->Length_High >> 16;
    context->Message_Block[58] = context->Length_High >> 8;
    context->Message_Block[59] = context->Length_High;
    context->Message_Block[60] = context->Length_Low >> 24;
    context->Message_Block[61] = context->Length_Low >> 16;
    context->Message_Block[62] = context->Length_Low >> 8;
    context->Message_Block[63] = context->Length_Low;

    SHA1ProcessMessageBlock(context);
}

7.3 Test Driver

   The following code is a main program test driver to exercise the code
   in sha1.c.

/*
 *  sha1test.c
 *
 *  Description:
 *      This file will exercise the SHA-1 code performing the three
 *      tests documented in FIPS PUB 180-1 plus one which calls
 *      SHA1Input with an exact multiple of 512 bits, plus a few
 *      error test checks.
 *
 *  Portability Issues:
 *      None.
 *
 */

#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include "sha1.h"

/*
 *  Define patterns for testing
 */
#define TEST1   "abc"
#define TEST2a  "abcdbcdecdefdefgefghfghighijhi"

Eastlake & Jones             Informational                     [Page 18]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

#define TEST2b  "jkijkljklmklmnlmnomnopnopq"
#define TEST2   TEST2a TEST2b
#define TEST3   "a"
#define TEST4a  "01234567012345670123456701234567"
#define TEST4b  "01234567012345670123456701234567"
    /* an exact multiple of 512 bits */
#define TEST4   TEST4a TEST4b
char *testarray[4] =
{
    TEST1,
    TEST2,
    TEST3,
    TEST4
};
long int repeatcount[4] = { 1, 1, 1000000, 10 };
char *resultarray[4] =
{
    "A9 99 3E 36 47 06 81 6A BA 3E 25 71 78 50 C2 6C 9C D0 D8 9D",
    "84 98 3E 44 1C 3B D2 6E BA AE 4A A1 F9 51 29 E5 E5 46 70 F1",
    "34 AA 97 3C D4 C4 DA A4 F6 1E EB 2B DB AD 27 31 65 34 01 6F",
    "DE A3 56 A2 CD DD 90 C7 A7 EC ED C5 EB B5 63 93 4F 46 04 52"
};

int main()
{
    SHA1Context sha;
    int i, j, err;
    uint8_t Message_Digest[20];

    /*
     *  Perform SHA-1 tests
     */
    for(j = 0; j < 4; ++j)
    {
        printf( "\nTest %d: %d, '%s'\n",
                j+1,
                repeatcount[j],
                testarray[j]);

        err = SHA1Reset(&sha);
        if (err)
        {
            fprintf(stderr, "SHA1Reset Error %d.\n", err );
            break;    /* out of for j loop */
        }

        for(i = 0; i < repeatcount[j]; ++i)
        {

Eastlake & Jones             Informational                     [Page 19]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

            err = SHA1Input(&sha,
                  (const unsigned char *) testarray[j],
                  strlen(testarray[j]));
            if (err)
            {
                fprintf(stderr, "SHA1Input Error %d.\n", err );
                break;    /* out of for i loop */
            }
        }

        err = SHA1Result(&sha, Message_Digest);
        if (err)
        {
            fprintf(stderr,
            "SHA1Result Error %d, could not compute message digest.\n",
            err );
        }
        else
        {
            printf("\t");
            for(i = 0; i < 20 ; ++i)
            {
                printf("%02X ", Message_Digest[i]);
            }
            printf("\n");
        }
        printf("Should match:\n");
        printf("\t%s\n", resultarray[j]);
    }

    /* Test some error returns */
    err = SHA1Input(&sha,(const unsigned char *) testarray[1], 1);
    printf ("\nError %d. Should be %d.\n", err, shaStateError );
    err = SHA1Reset(0);
    printf ("\nError %d. Should be %d.\n", err, shaNull );
    return 0;
}

8. Security Considerations

   This document is intended to provide convenient open source access by
   the Internet community to the United States of America Federal
   Information Processing Standard Secure Hash Function SHA-1 [FIPS
   180-1].  No independent assertion of the security of this hash
   function by the authors for any particular use is intended.

Eastlake & Jones             Informational                     [Page 20]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

References

   [FIPS 180-1] "Secure Hash Standard", United States of American,
                National Institute of Science and Technology, Federal
                Information Processing Standard (FIPS) 180-1, April
                1993.

   [MD4]        "The MD4 Message Digest Algorithm," Advances in
                Cryptology - CRYPTO '90 Proceedings, Springer-Verlag,
                1991, pp. 303-311.

   [RFC 1320]   Rivest, R., "The MD4 Message-Digest Algorithm", RFC
                1320, April 1992.

   [RFC 1321]   Rivest, R., "The MD5 Message-Digest Algorithm", RFC
                1321, April 1992.

   [RFC 1750]   Eastlake, D., Crocker, S. and J. Schiller, "Randomness
                Requirements for Security", RFC 1750, December 1994.

Authors' Addresses

   Donald E. Eastlake, 3rd
   Motorola
   155 Beaver Street
   Milford, MA 01757 USA

   Phone:   +1 508-634-2066 (h)
            +1 508-261-5434 (w)
   Fax:     +1 508-261-4777
   EMail:   Donald.Eastlake@motorola.com

   Paul E. Jones
   Cisco Systems, Inc.
   7025 Kit Creek Road
   Research Triangle Park, NC 27709 USA

   Phone:   +1 919 392 6948
   EMail:   paulej@packetizer.com

Eastlake & Jones             Informational                     [Page 21]

RFC 3174           US Secure Hash Algorithm 1 (SHA1)      September 2001

Full Copyright Statement

   Copyright (C) The Internet Society (2001).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Eastlake & Jones             Informational                     [Page 22]


Network Working Group                                         R. Housley
Request for Comments: 3217                              RSA Laboratories
Category: Informational                                    December 2001

                    Triple-DES and RC2 Key Wrapping

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2001).  All Rights Reserved.

Abstract

   This document specifies the algorithm for wrapping one Triple-DES key
   with another Triple-DES key and the algorithm for wrapping one RC2
   key with another RC2 key.  These key wrap algorithms were originally
   published in section 12.6 of RFC 2630.  They are republished since
   these key wrap algorithms have been found to be useful in contexts
   beyond those supported by RFC 2630.

1  Introduction

   Management of symmetric cryptographic keys often leads to situations
   where one symmetric key is used to encrypt (or wrap) another.  Key
   wrap algorithms are commonly used in two situations.  First, key
   agreement algorithms (such as Diffie-Hellman [DH-X9.42]) generate a
   pairwise key-encryption key, and a key wrap algorithm is used to
   encrypt the content-encryption key or a multicast key with the
   pairwise key-encryption key.  Second, a key wrap algorithm is used to
   encrypt the content-encryption key, multicast key, or session key in
   a locally generated storage key-encryption key or a key-encryption
   key that was distributed out-of-band.

   This document specifies the algorithm for wrapping one Triple-DES key
   with another Triple-DES key [3DES], and it specifies the algorithm
   for wrapping one RC2 key with another RC2 key [RC2].  Encryption of a
   Triple-DES key with another Triple-DES key uses the algorithm
   specified in section 3.  Encryption of a RC2 key with another RC2 key
   uses the algorithm specified in section 4.  Both of these algorithms
   rely on the key checksum algorithm specified in section 2.  Triple-
   DES and RC2 content-encryption keys are encrypted in Cipher Block
   Chaining (CBC) mode [MODES].

Housley                      Informational                      [Page 1]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

   In this document, the key words MUST, MUST NOT, REQUIRED, SHOULD,
   SHOULD NOT, RECOMMENDED, and MAY are to be interpreted as described
   by Scott Bradner in [STDWORDS].

2  Key Checksum

   The key checksum algorithm is used to provide a key integrity check
   value.  The algorithm is:

   1. Compute a 20 octet SHA-1 [SHA1] message digest on the key that is
      to be wrapped.
   2. Use the most significant (first) eight octets of the message
      digest value as the checksum value.

3  Triple-DES Key Wrapping and Unwrapping

   This section specifies the algorithms for wrapping and unwrapping one
   Triple-DES key with another Triple-DES key [3DES].

   The same key wrap algorithm is used for both Two-key Triple-DES and
   Three-key Triple-DES keys.  When a Two-key Triple-DES key is to be
   wrapped, a third DES key with the same value as the first DES key is
   created.  Thus, all wrapped Triple-DES keys include three DES keys.
   However, a Two-key Triple-DES key MUST NOT be used to wrap a Three-
   key Triple-DES key that is comprised of three unique DES keys.

3.1  Triple-DES Key Wrap

   The Triple-DES key wrap algorithm encrypts a Triple-DES key with a
   Triple-DES key-encryption key.  The Triple-DES key wrap algorithm is:

   1. Set odd parity for each of the DES key octets comprising the
      Three-Key Triple-DES key that is to be wrapped, call the result
      CEK.
   2. Compute an 8 octet key checksum value on CEK as described above in
      Section 2, call the result ICV.
   3. Let CEKICV = CEK || ICV.
   4. Generate 8 octets at random, call the result IV.
   5. Encrypt CEKICV in CBC mode using the key-encryption key.  Use the
      random value generated in the previous step as the initialization
      vector (IV).  Call the ciphertext TEMP1.
   6. Let TEMP2 = IV || TEMP1.
   7. Reverse the order of the octets in TEMP2.  That is, the most
      significant (first) octet is swapped with the least significant
      (last) octet, and so on.  Call the result TEMP3.
   8. Encrypt TEMP3 in CBC mode using the key-encryption key.  Use an
      initialization vector (IV) of 0x4adda22c79e82105.  The ciphertext
      is 40 octets long.

Housley                      Informational                      [Page 2]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

   Note:  When the same Three-Key Triple-DES key is wrapped in different
   key-encryption keys, a fresh initialization vector (IV) must be
   generated for each invocation of the key wrap algorithm.

3.2  Triple-DES Key Unwrap

   The Triple-DES key unwrap algorithm decrypts a Triple-DES key using a
   Triple-DES key-encryption key.  The Triple-DES key unwrap algorithm
   is:

   1. If the wrapped key is not 40 octets, then error.
   2. Decrypt the wrapped key in CBC mode using the key-encryption key.
      Use an initialization vector (IV) of 0x4adda22c79e82105.  Call the
      output TEMP3.
   3. Reverse the order of the octets in TEMP3.  That is, the most
      significant (first) octet is swapped with the least significant
      (last) octet, and so on.  Call the result TEMP2.
   4. Decompose TEMP2 into IV and TEMP1.  IV is the most significant
      (first) 8 octets, and TEMP1 is the least significant (last) 32
      octets.
   5. Decrypt TEMP1 in CBC mode using the key-encryption key.  Use the
      IV value from the previous step as the initialization vector.
      Call the ciphertext CEKICV.
   6. Decompose CEKICV into CEK and ICV.  CEK is the most significant
      (first) 24 octets, and ICV is the least significant (last) 8
      octets.
   7. Compute an 8 octet key checksum value on CEK as described above in
      Section 2.  If the computed key checksum value does not match the
      decrypted key checksum value, ICV, then error.
   8. Check for odd parity each of the DES key octets comprising CEK.
      If parity is incorrect, then error.
   9. Use CEK as a Triple-DES key.

3.3  Triple-DES Key Wrap Algorithm Identifier

   Some security protocols employ ASN.1 [X.208-88, X.209-88], and these
   protocols employ algorithm identifiers to name cryptographic
   algorithms.  To support these protocols, the Triple-DES key wrap
   algorithm has been assigned the following algorithm identifier:

      id-alg-CMS3DESwrap OBJECT IDENTIFIER ::= { iso(1) member-body(2)
         us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 6 }

   The AlgorithmIdentifier parameter field MUST be NULL.

Housley                      Informational                      [Page 3]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

3.4  Triple-DES Key Wrap Example

   This section contains a Triple-DES Key Wrap example.  Intermediate
   values corresponding to the named items in section 3.1 are given in
   hexadecimal.

   CEK:     2923 bf85 e06d d6ae 5291 49f1 f1ba e9ea b3a7 da3d 860d 3e98
   KEK:     255e 0d1c 07b6 46df b313 4cc8 43ba 8aa7 1f02 5b7c 0838 251f
   ICV:     181b 7e96 86e0 4a4e
   CEKICV:  2923 bf85 e06d d6ae 5291 49f1 f1ba e9ea b3a7 da3d 860d 3e98
            181b 7e96 86e0 4a4e
   IV:      5dd4 cbfc 96f5 453b
   TEMP1:   cfc1 a789 c675 dd2a b49a 3204 ef92 cc03 5c1f 973b 7a79 60f6
            a44d cc5f 729d 8449
   TEMP2:   5dd4 cbfc 96f5 453b cfc1 a789 c675 dd2a b49a 3204 ef92 cc03
            5c1f 973b 7a79 60f6 a44d cc5f 729d 8449
   TEMP3:   4984 9d72 5fcc 4da4 f660 797a 3b97 1f5c 03cc 92ef 0432 9ab4
            2add 75c6 89a7 c1cf 3b45 f596 fccb d45d
   RESULT:  6901 0761 8ef0 92b3 b48c a179 6b23 4ae9 fa33 ebb4 1596 0403
            7db5 d6a8 4eb3 aac2 768c 6327 75a4 67d4

4  RC2 Key Wrapping and Unwrapping

   This section specifies the algorithms for wrapping and unwrapping one
   RC2 key with another RC2 key [RC2].

   RC2 supports variable length keys.  RC2 128-bit keys MUST be used as
   key-encryption keys; however, the wrapped RC2 key MAY be of any size.

4.1  RC2 Key Wrap

   The RC2 key wrap algorithm encrypts a RC2 key with a RC2 key-
   encryption key.  The RC2 key wrap algorithm is:

   1.  Let the RC2 key be called CEK, and let the length of CEK in
       octets be called LENGTH.  LENGTH is a single octet.
   2.  Let LCEK = LENGTH || CEK.
   3.  Let LCEKPAD = LCEK || PAD.  If the length of LCEK is a multiple
       of 8, the PAD has a length of zero.  If the length of LCEK is not
       a multiple of 8, then PAD contains the fewest number of random
       octets to make the length of LCEKPAD a multiple of 8.
   4.  Compute an 8 octet key checksum value on LCEKPAD as described
       above in Section 2, call the result ICV.
   5.  Let LCEKPADICV = LCEKPAD || ICV.
   6.  Generate 8 octets at random, call the result IV.
   7.  Encrypt LCEKPADICV in CBC mode using the key-encryption key.  Use
       the random value generated in the previous step as the
       initialization vector (IV).  Call the ciphertext TEMP1.

Housley                      Informational                      [Page 4]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

   8.  Let TEMP2 = IV || TEMP1.
   9.  Reverse the order of the octets in TEMP2.  That is, the most
       significant (first) octet is swapped with the least significant
       (last) octet, and so on.  Call the result TEMP3.
   10. Encrypt TEMP3 in CBC mode using the key-encryption key.  Use an
       initialization vector (IV) of 0x4adda22c79e82105.

   Note:  When the same RC2 key is wrapped in different key-encryption
   keys, a fresh initialization vector (IV) must be generated for each
   invocation of the key wrap algorithm.

4.2  RC2 Key Unwrap

   The RC2 key unwrap algorithm decrypts a RC2 key using a RC2 key-
   encryption key.  The RC2 key unwrap algorithm is:

   1.  If the wrapped key is not a multiple of 8 octets, then error.
   2.  Decrypt the wrapped key in CBC mode using the key-encryption key.
       Use an initialization vector (IV) of 0x4adda22c79e82105.  Call
       the output TEMP3.
   3.  Reverse the order of the octets in TEMP3.  That is, the most
       significant (first) octet is swapped with the least significant
       (last) octet, and so on.  Call the result TEMP2.
   4.  Decompose the TEMP2 into IV and TEMP1.  IV is the most
       significant (first) 8 octets, and TEMP1 is the remaining octets.
   5.  Decrypt TEMP1 in CBC mode using the key-encryption key.  Use the
       IV value from the previous step as the initialization vector.
       Call the plaintext LCEKPADICV.
   6.  Decompose the LCEKPADICV into LCEKPAD, and ICV.  ICV is the least
       significant (last) octet 8 octets.  LCEKPAD is the remaining
       octets.
   7.  Compute an 8 octet key checksum value on LCEKPAD as described
       above in Section 2.  If the computed key checksum value does not
       match the decrypted key checksum value, ICV, then error.
   8.  Decompose the LCEKPAD into LENGTH, CEK, and PAD.  LENGTH is the
       most significant (first) octet.  CEK is the following LENGTH
       octets.  PAD is the remaining octets, if any.
   9.  If the length of PAD is more than 7 octets, then error.
   10. Use CEK as an RC2 key.

4.3  RC2 Key Wrap Algorithm Identifier

   Some security protocols employ ASN.1 [X.208-88, X.209-88], and these
   protocols employ algorithm identifiers to name cryptographic
   algorithms.  To support these protocols, the RC2 key wrap algorithm
   has been assigned the following algorithm identifier:

Housley                      Informational                      [Page 5]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

      id-alg-CMSRC2wrap OBJECT IDENTIFIER ::= { iso(1) member-body(2)
         us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 7 }

   The AlgorithmIdentifier parameter field MUST be RC2wrapParameter:

      RC2wrapParameter ::= RC2ParameterVersion

      RC2ParameterVersion ::= INTEGER

   The RC2 effective-key-bits (key size) greater than 32 and less than
   256 is encoded in the RC2ParameterVersion.  For the effective-key-
   bits of 40, 64, and 128, the rc2ParameterVersion values are 160, 120,
   and 58 respectively.  These values are not simply the RC2 key length.
   Note that the value 160 must be encoded as two octets (00 A0),
   because the one octet (A0) encoding represents a negative number.

4.4  RC2 Key Wrap Example

   This section contains a RC2 Key Wrap example.  Intermediate values
   corresponding to the named items in section 4.1 are given in
   hexadecimal.

   CEK:        b70a 25fb c9d8 6a86 050c e0d7 11ea d4d9
   KEK:        fd04 fd08 0607 07fb 0003 feff fd02 fe05
   LENGTH:     10
   LCEK:       10b7 0a25 fbc9 d86a 8605 0ce0 d711 ead4 d9
   PAD:        4845 cce7 fd12 50
   LCEKPAD:    10b7 0a25 fbc9 d86a 8605 0ce0 d711 ead4
               d948 45cc e7fd 1250
   ICV:        0a6f f19f db40 4988
   LCEKPADICV: 10b7 0a25 fbc9 d86a 8605 0ce0 d711 ead4
               d948 45cc e7fd 1250 0a6f f19f db40 4988
   IV:         c7d9 0059 b29e 97f7
   TEMP1:      a01d a259 3793 1260 e48c 55f5 04ce 70b8
               ac8c d79e ffe8 9932 9fa9 8a07 a31f f7a7
   TEMP2:      c7d9 0059 b29e 97f7 a01d a259 3793 1260
               e48c 55f5 04ce 70b8 ac8c d79e ffe8 9932
               9fa9 8a07 a31f f7a7
   TEMP3:      a7f7 1fa3 078a a99f 3299 8eff 9ed7 8cac
               b870 ce04 f555 8ce4 6012 9337 59a2 1da0
               f797 9eb2 5900 d9c7
   RESULT:     70e6 99fb 5701 f783 3330 fb71 e87c 85a4
               20bd c99a f05d 22af 5a0e 48d3 5f31 3898
               6cba afb4 b28d 4f35

Housley                      Informational                      [Page 6]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

5  References

   [3DES]     American National Standards Institute.  ANSI X9.52-1998,
              Triple Data Encryption Algorithm Modes of Operation.
              1998.

   [CMS]      Housley, R., "Cryptographic Message Syntax", RFC 2630,
              June 1999.

   [DES]      American National Standards Institute.  ANSI X3.106,
              "American National Standard for Information Systems - Data
              Link Encryption".  1983.

   [DH-X9.42] Rescorla, E., "Diffie-Hellman Key Agreement Method", RFC
              2631, June 1999.

   [DSS]      National Institute of Standards and Technology.  FIPS Pub
              186: Digital Signature Standard.  19 May 1994.

   [MODES]    National Institute of Standards and Technology.  FIPS Pub
              81: DES Modes of Operation.  2 December 1980.

   [RANDOM]   Eastlake, D., Crocker, S. and J. Schiller, "Randomness
              Recommendations for Security", RFC 1750, December 1994.

   [RC2]      Rivest, R., "A Description of the RC2 (r) Encryption
              Algorithm", RFC 2268, March 1998.

   [SHA1]     National Institute of Standards and Technology.  FIPS Pub
              180-1: Secure Hash Standard.  17 April 1995.

   [STDWORDS] Bradner, S., "Key Words for Use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [X.208-88] CCITT.  Recommendation X.208: Specification of Abstract
              Syntax Notation One (ASN.1).  1988.

   [X.209-88] CCITT.  Recommendation X.209: Specification of Basic
              Encoding Rules for Abstract Syntax Notation One (ASN.1).
              1988.

Housley                      Informational                      [Page 7]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

6  Security Considerations

   Implementations must protect the key-encryption key.  Compromise of
   the key-encryption key may result in the disclosure of all keys that
   have been wrapped with the key-encryption key, which may lead to the
   disclosure of all traffic protected with those wrapped key.

   Implementations must randomly generate initialization vectors (IVs)
   and padding.  The generation of quality random numbers is difficult.
   RFC 1750 [RANDOM] offers important guidance in this area, and
   Appendix 3 of FIPS Pub 186 [DSS] provides one quality PRNG technique.

   If the key-encryption key and wrapped key are associated with
   different symmetric encryption algorithms, the effective security
   provided to data encrypted with the wrapped key is determined by the
   weaker of the two algorithms.  If, for example, data is encrypted
   with 168-bit Triple-DES and that Triple-DES key is wrapped with a
   40-bit RC2 key, then at most 40 bits of protection is provided.  A
   trivial search to determine the value of the 40-bit RC2 key can
   recover Triple-DES key, and then the Triple-DES key can be used to
   decrypt the content.  Therefore, implementers must ensure that key-
   encryption algorithms are as strong or stronger than content-
   encryption algorithms.

   These key wrap algorithms specified in this document have been
   reviewed for use with Triple-DES and RC2, and they have not been
   reviewed for use with other encryption algorithms.  Similarly, the
   key wrap algorithms make use of CBC mode [MODES], and they have not
   been reviewed for use with other cryptographic modes.

7  Acknowledgments

   This document is the result of contributions from many professionals.
   I appreciate the hard work of all members of the IETF S/MIME Working
   Group.  I extend a special thanks to Carl Ellison, Peter Gutmann, Bob
   Jueneman, Don Johnson, Burt Kaliski, John Pawling, and Jim Schaad for
   their support in defining these algorithms and generating this
   specification.

8  Author Address

   Russell Housley
   RSA Laboratories
   918 Spring Knoll Drive
   Herndon, VA 20170
   USA

   EMail: rhousley@rsasecurity.com

Housley                      Informational                      [Page 8]

RFC 3217            Triple-DES and RC2 Key Wrapping        December 2001

9  Full Copyright Statement

   Copyright (C) The Internet Society (2001).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Housley                      Informational                      [Page 9]


Network Working Group                                       D. Sheinwald
Request for Comments: 3385                                     J. Satran
Category: Informational                                              IBM
                                                               P. Thaler
                                                              V. Cavanna
                                                                 Agilent
                                                          September 2002

       Internet Protocol Small Computer System Interface (iSCSI)
         Cyclic Redundancy Check (CRC)/Checksum Considerations

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2002).  All Rights Reserved.

Abstract

   In this memo, we attempt to give some estimates for the probability
   of undetected errors to facilitate the selection of an error
   detection code for the Internet Protocol Small Computer System
   Interface (iSCSI).

   We will also attempt to compare Cyclic Redundancy Checks (CRCs) with
   other checksum forms (e.g., Fletcher, Adler, weighted checksums), as
   permitted by available data.

1. Introduction

   Cyclic Redundancy Check (CRC) codes [Peterson] are shortened cyclic
   codes used for error detection.  A number of CRC codes have been
   adopted in standards: ATM, IEC, IEEE, CCITT, IBM-SDLC, and more
   [Baicheva].  The most important expectation from this kind of code is
   a very low probability for undetected errors.  The probability of
   undetected errors in such codes has been, and still is, subject to
   extensive studies that have included both analytical models and
   simulations.  Those codes have been used extensively in
   communications and magnetic recording as they demonstrate good "burst
   error" detection capabilities, but are also good at detecting several
   independent bit errors.  Hardware implementations are very simple and
   well known; their simplicity has made them popular with hardware

Sheinwald, et. al.           Informational                      [Page 1]

RFC 3385                iSCSI CRC Considerations          September 2002

   developers for many years.  However, algorithms and software for
   effective implementations of CRC are now also widely available
   [Williams].

   The probability of undetected errors depends on the polynomial
   selected to generate the code, the error distribution (error model),
   and the data length.

2. Error Models and Goals

   We will analyze the code behavior under two conditions:

      - noisy channel - burst errors with an average length of n bits
      - low noise channel - independent single bit errors

   Burst errors are the prevalent natural phenomenon on communication
   lines and recording media.  The numbers quoted for them revolve
   around the BER (bit error rate).  However, those numbers are
   frequently nothing more than a reflection of the Burst Error Rate
   multiplied by the average burst length.  In field engineering tests,
   three numbers are usually quoted together -- BER, error-free-seconds
   and severely-error-seconds; this illustrates our point.

   Even beyond communication and recording media, the effects of errors
   will be bursty.  An example of this is a memory error that will
   affect more than a single bit and the total effect will not be very
   different from the communication error, or software errors that occur
   while manipulating packets will have a burst effect.  Software errors
   also result in burst errors.  In addition, serial internal
   interconnects will make this type of error the most common within
   machines as well.

   We also analyze the effects of single independent bit errors, since
   these may be caused by certain defects.

   On burst, we assume an average burst error duration of bd, which at a
   given transmission rate s, will result in an average burst of a =
   bd*s bits.  (E.g., an average burst duration of 3 ns at 1Gbs gives an
   average burst of 3 bits.)

   For the burst error rate, we will take 10^-10.  The numbers quoted
   for BER on wired communication channels are between 10^-10 to 10^-12
   and we consider the BER as burst-error-rate*average-burst-length.
   Nevertheless, please keep in mind that if the channel includes
   wireless links, the error rates may be substantially higher.

   For independent single bit errors, we assume a 10^-11 error rate.

Sheinwald, et. al.           Informational                      [Page 2]

RFC 3385                iSCSI CRC Considerations          September 2002

   Because the error detection mechanisms will have to transport large
   amounts of data (petabytes=10^16 bits) without errors, we will target
   very low probabilities for undetected errors for all block lengths
   (at 10Gb/s that much data can be sent in less than 2 weeks on a
   single link).

   Alternatively, as iSCSI has to perform efficiently, we will require
   that the error detection capability of a selected protection
   mechanism be very good, at least up to block lengths of 8k bytes
   (64kbits).

   The error detection capability should keep the probability of
   undetected errors at values that would be "next-to-impossible".  We
   recognize, however, that such attributes are hard to quantify and we
   resorted to physics.  The value 10^23 is the Avogadro number while
   10^45 is the number of atoms in the known Universe (or it was many
   years ago when we read about it) and those are the bounds of
   incertitude we could live with.  (10^-23 at worst and 10^-45 if we
   can afford it.)  For 8k blocks, the per/bit equivalent would be
   (10^-28 to 10^-50).

3. Background and Literature Survey

   Each codeword of a binary (n,k) CRC code C consists of n = k+r bits.
   The block of r parity bits is computed from the block of k
   information bits.  The code has a degree r generator polynomial g(x).

   The code is linear in the sense that the bitwise addition of any two
   codewords yields a codeword.

   For the minimal m such that g(x) divides (x^m)-1, either n=m, and the
   code C comprises the set D of all the multiplications of g(x) modulo
   (x^m)-1, or n<m, and C is obtained from D by shortening each word in
   the latter in m-n specific positions.  (This also reduces the number
   of words since all zero words are then discarded and duplicates are
   not maintained.)

   Error detection at the receiving end is made by computing the parity
   bits from the received information block, and comparing them with the
   received parity bits.

   An undetected error occurs when the received word c' is a codeword,
   but is different from the c that is transmitted.

   This is only possible when the error pattern e=c'-c is a codeword by
   itself (because of the linearity of the code).  The performance of a
   CRC code is measured by the probability Pud of undetected channel
   errors.

Sheinwald, et. al.           Informational                      [Page 3]

RFC 3385                iSCSI CRC Considerations          September 2002

   Let Ai denote the number of codewords of weight i, (i.e., with i 1-
   bits).  For a binary symmetric channel (BSC), with sporadic,
   independent bit error ratio of probability 0<=epsilon<=0.5, the
   probability of undetected errors for the code C is thus given by:

Pud(C,epsilon) = Sigma[for i=d to n] (Ai*(epsilon^i)*(1-epsilon)^(n-i))

   where d is the distance of the code:  the minimal weight difference
   between two codewords in C which, by the linearity of the code, is
   also the minimal weight of any codeword in the code.  Pud can also be
   expressed by the weight distribution of the dual code:  the set of
   words each of which is orthogonal (bitwise AND yields an even number
   of 1-bits) to every word of C.  The fact that Pud can be computed
   using the dual code is extremely important; while the number of
   codewords in the code is 2^k, the number of codewords in the dual
   code is 2^r.  k is in the orders of thousands, and r in the order of
   16 or 24 or 32.  If we use Bi to denote the number of codewords in
   the dual code which are of weight i, then ([LinCostello]):

Pud (C,epsilon) = 2^-r Sigma [for i=0 to n] Bi*(1-2*epsilon)^i -
(1-epsilon)^n

   Wolf [Wolf94o] introduced an efficient algorithm for enumerating all
   the codewords of a code and finding their weight distribution.

   Wolf [Wolf82] found that, counter to what was assumed, (1) there
   exist codes for which Pud(C,epsilon)>Pud(C,0.5) for some epsilon
   not=0.5 and (2) Pud is not always increasing for 0<=epsilon<=0.5.
   The value of what was assumed to be the worst Pud is Pud(C,0.5)=(2^-
   r) - (2^-n).  This stems from the fact that with epsilon=0.5, all 2^n
   received words are equally likely and out of them 2^(n-r)-1 will be
   accepted as codewords of no errors, although they are different from
   the codeword transmitted.  Previously Pud had been assumed to equal
   [2^(n-r)-1]/(2^n-1) or the ratio of the number of non-zero multiples
   of the polynomial of degree less than n (each such multiple is
   undetected) and the number of possible error polynomials.  With
   either formula Pud approaches 1/2^r as n approaches infinity, but
   Wolf's formula is more accurate.

   Wolf [Wolf94j] investigated the CCITT code of r=16 parity bits.  This
   code is a member of the family of (shortened codes of) BCH codes of
   length 2^(r-1) -1 (r=16 in the CCITT 16-bit case) generated by a
   polynomial of the form g(x) =(x+1)p(x) with p(x) being a primitive
   polynomial of degree r-1 (=15 in this case).  These codes have a BCH
   design distance of 4.  That is, the minimal distance between any two
   codewords in the code is at least 4 bits (which is earned by the fact

Sheinwald, et. al.           Informational                      [Page 4]

RFC 3385                iSCSI CRC Considerations          September 2002

   that the sequence of powers of alpha, the root of p(x), which are
   roots of g(x), includes three consecutive powers -- alpha^0, alpha^1,
   alpha^2).  Hence, every 3 single bit errors are detectable.

   Wolf found that different shortened versions of a given code, of the
   same codeword length, perform the same (independent of which specific
   indexes are omitted from the original code).  He also found that for
   the unshortened codes, all primitive polynomials yield codes of the
   same performance.  But for the shortened versions, the choice of the
   primitive polynomial does make a difference.  Wolf [Wolf94j] found a
   primitive polynomial which (when multiplied by x+1) yields a
   generating polynomial that outperforms the CCITT one by an order of
   magnitude.  For 32-bit redundancy bits, he found an example of two
   polynomials that differ in their probability of undetected burst of
   length 33 by 4 orders of magnitude.

   It so happens, that for some shortened codes, the minimum distance,
   or the distribution of the weights, is better than for others derived
   from different unshortened codes.

   Baicheva, et. al. [Baicheva] made a comprehensive comparison of
   different generating polynomials of degree 16 of the form g(x) =
   (x+1)p(x), and of other forms.  They computed their Pud for code
   lengths up to 1024 bits.  They measured their "goodness"  -- if
   Pud(C,epsilon)  <= Pud(C,0.5) and being "well-behaved" -- if
   Pud(C,epsilon) increases with epsilon in the range (0,0.5).  The
   paper gives a comprehensive table that lists which of the polynomials
   is good and which is well-behaved for different length ranges.

   For a single burst error, Wolf [Wolf94J] suggested the model of (b:p)
   burst -- the errors only occur within a span of b bits, and within
   that span, the errors occur randomly, with a bit error probability 0
   <= p <= 1.

   For p=0.5, which used to be considered the worst case, it is well
   known [Wolf94J] that the probability of undetected one burst error of
   length b <= r is 0, of length b=r+1 is 2^-(r-1), and of b > r+1, is
   2^-r, independently of the choice of the primitive polynomial.

   With Wolf's definition, where p can be different from 0.5, indeed it
   was found that for a given b there are values of p, different from
   0.5 which maximize the probability of undetected (b:p) burst error.

Sheinwald, et. al.           Informational                      [Page 5]

RFC 3385                iSCSI CRC Considerations          September 2002

   Wolf proved that for a given code, for all b in the range r < b < n,
   the conditional probability of undetected error for the (n, n-r)
   code, given that a (b:p) burst occurred, is equal to the probability
   of undetected errors for the same code (the same generating
   polynomial), shortened to block length b, when this shortened code is
   used with a binary symmetric channel with channel (sporadic,
   independent) bit error probability p.

   For the IEEE-802.3 used CRC32, Fujiwara et al. [Fujiwara89] measured
   the weights of all words of all shortened versions of the IEEE 802.3
   code of 32 check bits.  This code is generated by a primitive
   polynomial of degree 32:

   g(x) = x^32 + x^26 + x^23 + x^22 + x^16 + x^12 + x^11 + x^10 + x^8 +
   x^7 + x^5 + x^4 + x^2 + x + 1 and hence the designed distance of it
   is only 3.  This distance holds for codes as long as 2^32-1.
   However, the frame format of the MAC (Media Access Control) of the
   data link layer in IEEE 802.3, as well as that of the data link layer
   for the Ethernet (1980) forbid lengths exceeding 12,144 bits.  Thus,
   only such bounded lengths are investigated in [Fujiwara89].  For
   shortened versions, the minimum distance was found to be 4 for
   lengths 4096 to 12,144; 5 for lengths 512 to 2048; and even 15 for
   lengths 33 through 42.  A chart of results of calculations of Pud is
   presented in [Fujiwara89] from which we can see that for codes of
   length 12,144 and BSC of epsilon = 10^-5 - 10^-4,
   Pud(12,144,epsilon)= 10^-14 - 10^-13 and for epsilon = 10^-4 - 10^-3,
   Pud(512,epsilon) = 10^-15, Pud(1024,epsilon) = 10^-14,
   Pud(2048,epsilon) = 10^-13, Pud(4096,epsilon) = 10^-12 - 10^-11, and
   Pud(8192,epsilon) = 10^-10 which is rather close to 2^-32.

   Castagnoli, et. al. [Castagnoli93] extended Fujiwara's technique for
   efficiently calculating the minimum distance through the weight
   distribution of the dual code and explored a large number of CRC
   codes with 24 and 32 redundancy bit.  They explored several codes
   built as a multiplication of several lower degree irreducible
   polynomials.

   In the popular class of (x+1)*deg31-irreducible-polynomial they
   explored 47000 polynomials (not all the possible ones).  The best
   they found has d=6 up to block lengths of 5275 and d=4 up to 2^31-1
   (bits).

   The investigation was done in 1993 with a special purpose processor.

   By comparison, the IEEE-802 code has d=4 up to at least 64,000 bits
   (Fujikura stopped looking at 12,144) and d=3 up to 2^32-1 bits.

Sheinwald, et. al.           Informational                      [Page 6]

RFC 3385                iSCSI CRC Considerations          September 2002

   CRC32/4 (we will refer to it as CRC32C for the remainder of this
   memo) is 11EDC6F41;  IEEE-802 CRC is 104C11DB7, denoting the
   coefficients as a bit vector.

   [Stone98] evaluated the performance of CRC (the AAL5 CRC that is the
   same as IEEE802) and the TCP and Fletcher checksums on large amounts
   of data.  The results of this experiment indicate a serious weakness
   of the checksums on real-data that stems from the fact that checksums
   do not spread the "hot spots" in input data.  However, the results
   show that Fletcher behaves by a factor of 2 better than the regular
   TCP checksum.

4. Probability of Undetected Errors - Burst Error

4.1 CRC32C (Derivations from [Wolf94j])

   Wolf [Wolf94j] found a 32-bit polynomial of the form g(x) = (1+x)p(x)
   for which the conditional probability of undetected error, given that
   a burst of length 33 occurred, is at most (i.e., maximized over all
   possible channel bit error probabilities within the burst) 4 * 10^-
   10.

   We will now figure the probability of undetected error, given that a
   burst of length 34 occurred, using the result derived in this paper,
   namely that for a given code, for all b in the range 32 < b < n, the
   conditional probability of undetected error for the (n, n-32) code,
   given that a (b:p) burst occurred, is equal to the probability of
   undetected errors for the same code (the same generating polynomial),
   shortened to block length b, when this shortened code is used with a
   binary symmetric channel with channel (sporadic, independent) bit
   error probability p.

   The approximation formula for Pud of sporadic errors, if the weights
   Ai are distributed binomially, is:

   Pud(C, epsilon) =~= Sigma[for i=d to n] ((n choose i) / 2^r )*(1-
   epsilon)^(n-i) * epsilon^i .

   Assuming a very small epsilon, this expression is dominated by i=d.
   From [Fujiwara89] we know that for 32-bit CRC, for such small n,
   d=15.  Thus, when n grows from 33 to 34, we find that the
   approximation of Pud grows by (34 choose 15) / (33 choose 15) =
   34/19; when n grows further to 35, Pud grows by another 35/20.

   Taking, from Wolf [Wolf94j], the most generous conditional
   probability, computed with the bit error probability p* that
   maximizes Pub(p|b), we derive: Pud(p*|33) = 4 x 10^{-10}, yielding
   Pud(p*|34) = 7.15 x 10^{-10} and Pud(p*|35) = 1.25 x 10^{-9}.

Sheinwald, et. al.           Informational                      [Page 7]

RFC 3385                iSCSI CRC Considerations          September 2002

   For the density function of the burst length, we assume the Rayleigh
   density function (the discretization thereof to integers), which is
   the density of the absolute values of complex numbers of Gauss
   distribution:

      f(x) = x / a^2  exp {-x^2 / 2a^2 }     , x>0 .

   This density function has a peak at the parameter a and it decreases
   smoothly as x increases.

   We take three consecutive bits as the most common burst event once an
   error does occur, and thus a=3.

   Now, the probability that a burst of length b occurs in a specific
   position is the burst error rate, which we estimate as 10^{-10},
   times f(b).  Calculating for b=33 we find f(33) = 1.94 x 10^{-26}.
   Together, we found that the probability that a burst of length 33
   occurred, starting at a specific position, is 1.94 x 10^{-36}.

   Multiplying this by the generous upper bound on the probability that
   this burst error is not detected, Pud(p*|33), we get that the
   probability that a burst occurred at a specific position, and is not
   detected, is 7.79 x 10 ^{-46}.

   Going again along this path of calculations, this time for b=34 we
   find that f(34) = 4.85*10^{-28}.  Multiplying by 10^{-10} and by
   Pud(p*|34) = 7.15*10^{-10} we find that the probability that a burst
   of length 34 occurred at a specific position, and is not detected, is
   3.46*10^{-47}.

   Last, computing for b=35, we get 1*10^{-29} * 10^{-10} * 1.25*10^{-9}
   = 1.25*10^{-48}.

   It looks like the total can be approximated at 10^-45 which is within
   the bounds of what we are looking for.

   When we multiply this by the length of the code (because thus far we
   calculated for a specific position) we have 10^-45 * 6.5*10^4 =
   6.5*10^-41 as an upper bound on the probability of undetected burst
   error for a code of length 8K Bytes.

   We can also apply this overestimation for IEEE 802.3.

   Comment: 2^{-32} = 2.33*10^{-10}.

Sheinwald, et. al.           Informational                      [Page 8]

RFC 3385                iSCSI CRC Considerations          September 2002

5. Probability of Undetected Errors - Independent Errors

5.1 CRC (Derivations from [Castagnoli93])

   It is reported in [Castagnoli93] that for BER = epsilon=10^-6, Pud
   for a single bit error, for a code of length 8KB, for both cases,
   IEEE-802.3 and CRC32C is 10^{-20}.  They also report that CRC32C has
   distance 4, and IEEE either 3 or 4 for this code length.  From this,
   and the minimum distance of the code of this length, we conclude that
   with our estimation of epsilon, namely 10^{-11}, we should multiply
   the reported result by {10^{-5}}^4 = 10^{-20} for CRC32C, and either
   10^{-15} or 10^{-20} for IEEE802.3.

5.2 Checksums

   For independent bit errors, Pud of CRC is approximately 12,000 better
   than Fletcher, and 22,000 better than Adler.  For burst errors, by
   the simple examples that exist for three consecutive values that can
   produce an undetected burst, we take the factor to be at least the
   same.

   If in three consecutive bytes, the error values are x, -2x, x then
   the error is undetected.  Even for this error pattern alone, the
   conditional probability of undetected error, assuming a uniform
   distribution of data, is 2^-16 = 1.5 * 10^-5.  The probability that a
   burst of length 3 bytes occurs, is f(24) = 3*10^-14.  Together:
   4.5*10^-19.  Multiplying this by the length of the code, we get close
   to 4.5*10^-16, way worse than the vicinity of 10^-40.

   The numbers in the table in Section 7 below reflect a more "tolerant"
   difference (10*4).

6. Incremental CRC Updates

   In some protocols the packet header changes frequently.  If the CRC
   includes the changing part, the CRC will have to be recomputed.  This
   raises two issues:

      - the complete computation is expensive
      - the packet is not protected against unwanted changes
        between the last check and the recomputation

   Fortunately, changes in the header do not imply a need for completed
   CRC computation.  The reason is the linearity of the CRC function.
   Namely, with I1 and I2 denoting two equal-length blocks of
   information bits, CRC(I) denoting the CRC check bits calculated for
   I, and + denoting bitwise modulo-2 addition, we have CRC(I1+I2) =
   CRC(I1)+CRC(I2).

Sheinwald, et. al.           Informational                      [Page 9]

RFC 3385                iSCSI CRC Considerations          September 2002

   Hence, for an IP packet, made of a header h followed by data d
   followed by CRC bits c = CRC(h d), arriving at a node, which updates
   header h to become h', the implied update of c is an addition of
   CRC(h'-h 0), where 0 is an all 0 block of the length of the data
   block d, and addition and subtraction are bitwise modulo 2.

   We know that a predetermined permutation of bits does not change
   distance and weight statistics of the codewords.  It follows that
   such a transformation does not change the probability of undetected
   errors.

   We can then conceive the packet as if it was built from data d
   followed by header h, compute the CRC accordingly, c=CRC(d h), and
   update at the node with an addition of CRC(0 h'-h)=CRC(h'-h), but on
   transmission, send the header part before the data and the CRC bits.
   This will allow a faster computation of the CRC, while still letting
   the header part lead (no change to the protocol).

   Error detection, i.e., computing the CRC bits by the data and header
   parts that arrive, and comparing them with the CRC part that arrives
   together with them, can be done at the final, end-target node only,
   and the detected errors will include unwanted changes introduced by
   the intermediate nodes.

   The analysis of the undetected error probability remains valid
   according to the following rationale:

   The packet started its way as a codeword.  On its way, several
   codewords were added to it (any information followed by the
   corresponding CRC is a codeword).  Let e denote the totality of
   errors added to the packet, on its long, multi-hop journey.  Because
   the code is linear (i.e., the sum of two codewords is also a
   codeword) the packet arriving to the end-target node is some codeword
   + e, and hence, as in our preceding analysis, e is undetected if and
   only if it is a codeword by itself.  This fact is the basis of our
   above analysis, and hence that analysis applies here too.  (See a
   detailed discussion at [braun01].)

7. Complexity of Hardware Implementation

   Comparing the cost of various CRC polynomials, we used a tool
   available at http://www.easics.com/webtools/crctool to implement CRC
   generators/checkers for various CRC polynomials.  The program gives
   either Verilog or VHDL code after specifying a polynomial, as well as
   the number of data bits, k, to be handled in one clock cycle.  For a
   serial implementation, k would be one.

Sheinwald, et. al.           Informational                     [Page 10]

RFC 3385                iSCSI CRC Considerations          September 2002

   The cost for either one generator or checker is shown in the
   following table.

   The number of 2-input XOR gates, for an un-optimized implementation,
   required for various values of k:

   +----------------------------------------------+
   | Polynomial  | k=32     | k=64     | k=128    |
   +----------------------------------------------+
   | CCITT-CRC32 | 488      | 740      | 1430     |
   +----------------------------------------------+
   | IEEE-802    | 872      | 1390     | 2518     |
   +----------------------------------------------+
   | CRC32Q(Wolf)| 944      | 1444     | 2534     |
   +----------------------------------------------+
   | CRC32C      | 1036     | 1470     | 2490     |
   +----------------------------------------------+

   After optimizing (sharing terms) and in terms of Cells (4 cells per 2
   input AND, 7 cells per 2 input XOR, 3 cells per inverter) the cost
   for two candidate polynomials is shown in the following table.

   +-----------------------------------+
   | Polynomial  | k=32     | k=64     |
   +-----------------------------------+
   | CCITT-CRC32 | 1855     | 3572     |
   +-----------------------------------+
   | CRC32C      | 4784     | 7111     |
   +-----------------------------------+

   For 32-bit datapath, CCITT-CRC32 requires 40% of the number of cells
   required by the CRC32C.  For a 64-bit datapath, CCITT-CRC32 requires
   50% of the number of cells.

   The total size of one of our smaller chips is roughly 1 million
   cells.  The fraction represented by the CRC circuit is less than 1%.

8. Implementation of CRC32C

8.1 A Serial Implementation in Hardware

   A serial implementation that processes one data bit at a time and
   performs simultaneous multiplication of the data polynomial by x^32
   and division by the CRC32C polynomial is described in the following
   Verilog [ieee1364] code.

Sheinwald, et. al.           Informational                     [Page 11]

RFC 3385                iSCSI CRC Considerations          September 2002

   /////////////////////////////////////////////////////////////////////
   //File: CRC32_D1.v
   //Date: Tue Feb 26 02:47:05 2002
   //
   //Copyright (C) 1999 Easics NV.
   //This source file may be used and distributed without restriction
   //provided that this copyright statement is not removed from the file
   //and that any derivative work contains the original copyright notice
   //and the associated disclaimer.
   //
   //THIS SOURCE FILE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS
   //OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
   //WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
   //
   //Purpose: Verilog module containing a synthesizable CRC function
   //* polynomial: (0 1 2 4 5 7 8 10 11 12 16 22 23 26 32)
   //* data width: 1
   //
   //Info: jand@easics.be (Jan Decaluwe)
   //http://www.easics.com
   /////////////////////////////////////////////////////////////////////
   module CRC32_D1;
   // polynomial: (0 1 2 4 5 7 8 10 11 12 16 22 23 26 32)
   // data width: 1
   function [31:0] nextCRC32_D1;
   input Data;
   input [31:0] CRC;
   reg [0:0] D;
   reg [31:0] C;
   reg [31:0] NewCRC;
   begin
   D[0] = Data;
   C = CRC;
   NewCRC[0] = D[0] ^ C[31];
   NewCRC[1] = D[0] ^ C[0] ^ C[31];
   NewCRC[2] = D[0] ^ C[1] ^ C[31];
   NewCRC[3] = C[2];
   NewCRC[4] = D[0] ^ C[3] ^ C[31];
   NewCRC[5] = D[0] ^ C[4] ^ C[31];
   NewCRC[6] = C[5];
   NewCRC[7] = D[0] ^ C[6] ^ C[31];
   NewCRC[8] = D[0] ^ C[7] ^ C[31];
   NewCRC[9] = C[8];
   NewCRC[10] = D[0] ^ C[9] ^ C[31];
   NewCRC[11] = D[0] ^ C[10] ^ C[31];
   NewCRC[12] = D[0] ^ C[11] ^ C[31];
   NewCRC[13] = C[12];
   NewCRC[14] = C[13];

Sheinwald, et. al.           Informational                     [Page 12]

RFC 3385                iSCSI CRC Considerations          September 2002

   NewCRC[15] = C[14];
   NewCRC[16] = D[0] ^ C[15] ^ C[31];
   NewCRC[17] = C[16];
   NewCRC[18] = C[17];
   NewCRC[19] = C[18];
   NewCRC[20] = C[19];
   NewCRC[21] = C[20];
   NewCRC[22] = D[0] ^ C[21] ^ C[31];
   NewCRC[23] = D[0] ^ C[22] ^ C[31];
   NewCRC[24] = C[23];
   NewCRC[25] = C[24];
   NewCRC[26] = D[0] ^ C[25] ^ C[31];
   NewCRC[27] = C[26];
   NewCRC[28] = C[27];
   NewCRC[29] = C[28];
   NewCRC[30] = C[29];
   NewCRC[31] = C[30];
   nextCRC32_D1 = NewCRC;
   end
   endfunction
   endmodule

8.2 A Parallel Implementation in Hardware

   A parallel implementation that processes 32 data bits at a time is
   described in the following Verilog [ieee1364] code.  In software
   implementations, the next state logic is typically implemented by
   means of tables indexed by the input and the current state.

   /////////////////////////////////////////////////////////////////////
   //File: CRC32_D32.v
   //Date: Tue Feb 26 02:50:08 2002
   //
   //Copyright (C) 1999 Easics NV.
   //This source file may be used and distributed without restriction
   //provided that this copyright statement is not removed from the file
   //and that any derivative work contains the original copyright notice
   //and the associated disclaimer.
   //
   //THIS SOURCE FILE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS
   //OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
   //WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
   //
   //Purpose: Verilog module containing a synthesizable CRC function
   //* polynomial: p(0 to 32) := "100000101111011000111011011110001"
   //* data width: 32
   //
   //Info: jand@easics.be (Jan Decaluwe)

Sheinwald, et. al.           Informational                     [Page 13]

RFC 3385                iSCSI CRC Considerations          September 2002

   //http://www.easics.com
   /////////////////////////////////////////////////////////////////////
   module CRC32_D32;
   // polynomial: p(0 to 32) := "100000101111011000111011011110001"
   // data width: 32
   // convention: the first serial data bit is D[31]
   function [31:0] nextCRC32_D32;
   input [31:0] Data;
   input [31:0] CRC;
   reg [31:0] D;
   reg [31:0] C;
   reg [31:0] NewCRC;
   begin
   D = Data;
   C = CRC;
   NewCRC[0] = D[31] ^ D[30] ^ D[28] ^ D[27] ^ D[26] ^ D[25] ^ D[23]
   ^
   D[21] ^ D[18] ^ D[17] ^ D[16] ^ D[12] ^ D[9] ^ D[8] ^
   D[7] ^ D[6] ^ D[5] ^ D[4] ^ D[0] ^ C[0] ^ C[4] ^ C[5] ^
   C[6] ^ C[7] ^ C[8] ^ C[9] ^ C[12] ^ C[16] ^ C[17] ^
   C[18] ^ C[21] ^ C[23] ^ C[25] ^ C[26] ^ C[27] ^ C[28] ^
   C[30] ^ C[31];
   NewCRC[1] = D[31] ^ D[29] ^ D[28] ^ D[27] ^ D[26] ^ D[24] ^ D[22]
   ^
   D[19] ^ D[18] ^ D[17] ^ D[13] ^ D[10] ^ D[9] ^ D[8] ^
   D[7] ^ D[6] ^ D[5] ^ D[1] ^ C[1] ^ C[5] ^ C[6] ^ C[7] ^
   C[8] ^ C[9] ^ C[10] ^ C[13] ^ C[17] ^ C[18] ^ C[19] ^
   C[22] ^ C[24] ^ C[26] ^ C[27] ^ C[28] ^ C[29] ^ C[31];
   NewCRC[2] = D[30] ^ D[29] ^ D[28] ^ D[27] ^ D[25] ^ D[23] ^ D[20]
   ^
   D[19] ^ D[18] ^ D[14] ^ D[11] ^ D[10] ^ D[9] ^ D[8] ^
   D[7] ^ D[6] ^ D[2] ^ C[2] ^ C[6] ^ C[7] ^ C[8] ^ C[9] ^
   C[10] ^ C[11] ^ C[14] ^ C[18] ^ C[19] ^ C[20] ^ C[23] ^
   C[25] ^ C[27] ^ C[28] ^ C[29] ^ C[30];
   NewCRC[3] = D[31] ^ D[30] ^ D[29] ^ D[28] ^ D[26] ^ D[24] ^ D[21]
   ^
   D[20] ^ D[19] ^ D[15] ^ D[12] ^ D[11] ^ D[10] ^ D[9] ^
   D[8] ^ D[7] ^ D[3] ^ C[3] ^ C[7] ^ C[8] ^ C[9] ^ C[10] ^
   C[11] ^ C[12] ^ C[15] ^ C[19] ^ C[20] ^ C[21] ^ C[24] ^
   C[26] ^ C[28] ^ C[29] ^ C[30] ^ C[31];
   NewCRC[4] = D[31] ^ D[30] ^ D[29] ^ D[27] ^ D[25] ^ D[22] ^ D[21]
   ^
   D[20] ^ D[16] ^ D[13] ^ D[12] ^ D[11] ^ D[10] ^ D[9] ^
   D[8] ^ D[4] ^ C[4] ^ C[8] ^ C[9] ^ C[10] ^ C[11] ^
   C[12] ^ C[13] ^ C[16] ^ C[20] ^ C[21] ^ C[22] ^ C[25] ^
   C[27] ^ C[29] ^ C[30] ^ C[31];
   NewCRC[5] = D[31] ^ D[30] ^ D[28] ^ D[26] ^ D[23] ^ D[22] ^ D[21]
   ^

Sheinwald, et. al.           Informational                     [Page 14]

RFC 3385                iSCSI CRC Considerations          September 2002

   D[17] ^ D[14] ^ D[13] ^ D[12] ^ D[11] ^ D[10] ^ D[9] ^
   D[5] ^ C[5] ^ C[9] ^ C[10] ^ C[11] ^ C[12] ^ C[13] ^
   C[14] ^ C[17] ^ C[21] ^ C[22] ^ C[23] ^ C[26] ^ C[28] ^
   C[30] ^ C[31];
   NewCRC[6] = D[30] ^ D[29] ^ D[28] ^ D[26] ^ D[25] ^ D[24] ^ D[22]
   ^
   D[21] ^ D[17] ^ D[16] ^ D[15] ^ D[14] ^ D[13] ^ D[11] ^
   D[10] ^ D[9] ^ D[8] ^ D[7] ^ D[5] ^ D[4] ^ D[0] ^ C[0] ^
   C[4] ^ C[5] ^ C[7] ^ C[8] ^ C[9] ^ C[10] ^ C[11] ^
   C[13] ^ C[14] ^ C[15] ^ C[16] ^ C[17] ^ C[21] ^ C[22] ^
   C[24] ^ C[25] ^ C[26] ^ C[28] ^ C[29] ^ C[30];
   NewCRC[7] = D[31] ^ D[30] ^ D[29] ^ D[27] ^ D[26] ^ D[25] ^ D[23]
   ^
   D[22] ^ D[18] ^ D[17] ^ D[16] ^ D[15] ^ D[14] ^ D[12] ^
   D[11] ^ D[10] ^ D[9] ^ D[8] ^ D[6] ^ D[5] ^ D[1] ^
   C[1] ^ C[5] ^ C[6] ^ C[8] ^ C[9] ^ C[10] ^ C[11] ^
   C[12] ^ C[14] ^ C[15] ^ C[16] ^ C[17] ^ C[18] ^ C[22] ^
   C[23] ^ C[25] ^ C[26] ^ C[27] ^ C[29] ^ C[30] ^ C[31];
   NewCRC[8] = D[25] ^ D[24] ^ D[21] ^ D[19] ^ D[15] ^ D[13] ^ D[11]
   ^
   D[10] ^ D[8] ^ D[5] ^ D[4] ^ D[2] ^ D[0] ^ C[0] ^ C[2] ^
   C[4] ^ C[5] ^ C[8] ^ C[10] ^ C[11] ^ C[13] ^ C[15] ^
   C[19] ^ C[21] ^ C[24] ^ C[25];
   NewCRC[9] = D[31] ^ D[30] ^ D[28] ^ D[27] ^ D[23] ^ D[22] ^ D[21]
   ^
   D[20] ^ D[18] ^ D[17] ^ D[14] ^ D[11] ^ D[8] ^ D[7] ^
   D[4] ^ D[3] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[3] ^ C[4] ^
   C[7] ^ C[8] ^ C[11] ^ C[14] ^ C[17] ^ C[18] ^ C[20] ^
   C[21] ^ C[22] ^ C[23] ^ C[27] ^ C[28] ^ C[30] ^ C[31];
   NewCRC[10] = D[30] ^ D[29] ^ D[27] ^ D[26] ^ D[25] ^ D[24] ^
   D[22] ^
   D[19] ^ D[17] ^ D[16] ^ D[15] ^ D[7] ^ D[6] ^ D[2] ^
   D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[2] ^ C[6] ^ C[7] ^ C[15] ^
   C[16] ^ C[17] ^ C[19] ^ C[22] ^ C[24] ^ C[25] ^ C[26] ^
   C[27] ^ C[29] ^ C[30];
   NewCRC[11] = D[21] ^ D[20] ^ D[12] ^ D[9] ^ D[6] ^ D[5] ^ D[4] ^
   D[3] ^ D[2] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[2] ^ C[3] ^
   C[4] ^ C[5] ^ C[6] ^ C[9] ^ C[12] ^ C[20] ^ C[21];
   NewCRC[12] = D[22] ^ D[21] ^ D[13] ^ D[10] ^ D[7] ^ D[6] ^ D[5] ^
   D[4] ^ D[3] ^ D[2] ^ D[1] ^ C[1] ^ C[2] ^ C[3] ^ C[4] ^
   C[5] ^ C[6] ^ C[7] ^ C[10] ^ C[13] ^ C[21] ^ C[22];
   NewCRC[13] = D[31] ^ D[30] ^ D[28] ^ D[27] ^ D[26] ^ D[25] ^
   D[22] ^
   D[21] ^ D[18] ^ D[17] ^ D[16] ^ D[14] ^ D[12] ^ D[11] ^
   D[9] ^ D[3] ^ D[2] ^ D[0] ^ C[0] ^ C[2] ^ C[3] ^ C[9] ^
   C[11] ^ C[12] ^ C[14] ^ C[16] ^ C[17] ^ C[18] ^ C[21] ^
   C[22] ^ C[25] ^ C[26] ^ C[27] ^ C[28] ^ C[30] ^ C[31];
   NewCRC[14] = D[30] ^ D[29] ^ D[25] ^ D[22] ^ D[21] ^ D[19] ^

Sheinwald, et. al.           Informational                     [Page 15]

RFC 3385                iSCSI CRC Considerations          September 2002

   D[16] ^
   D[15] ^ D[13] ^ D[10] ^ D[9] ^ D[8] ^ D[7] ^ D[6] ^
   D[5] ^ D[3] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[3] ^ C[5] ^
   C[6] ^ C[7] ^ C[8] ^ C[9] ^ C[10] ^ C[13] ^ C[15] ^
   C[16] ^ C[19] ^ C[21] ^ C[22] ^ C[25] ^ C[29] ^ C[30];
   NewCRC[15] = D[31] ^ D[30] ^ D[26] ^ D[23] ^ D[22] ^ D[20] ^
   D[17] ^
   D[16] ^ D[14] ^ D[11] ^ D[10] ^ D[9] ^ D[8] ^ D[7] ^
   D[6] ^ D[4] ^ D[2] ^ D[1] ^ C[1] ^ C[2] ^ C[4] ^ C[6] ^
   C[7] ^ C[8] ^ C[9] ^ C[10] ^ C[11] ^ C[14] ^ C[16] ^
   C[17] ^ C[20] ^ C[22] ^ C[23] ^ C[26] ^ C[30] ^ C[31];
   NewCRC[16] = D[31] ^ D[27] ^ D[24] ^ D[23] ^ D[21] ^ D[18] ^
   D[17] ^
   D[15] ^ D[12] ^ D[11] ^ D[10] ^ D[9] ^ D[8] ^ D[7] ^
   D[5] ^ D[3] ^ D[2] ^ C[2] ^ C[3] ^ C[5] ^ C[7] ^ C[8] ^
   C[9] ^ C[10] ^ C[11] ^ C[12] ^ C[15] ^ C[17] ^ C[18] ^
   C[21] ^ C[23] ^ C[24] ^ C[27] ^ C[31];
   NewCRC[17] = D[28] ^ D[25] ^ D[24] ^ D[22] ^ D[19] ^ D[18] ^
   D[16] ^
   D[13] ^ D[12] ^ D[11] ^ D[10] ^ D[9] ^ D[8] ^ D[6] ^
   D[4] ^ D[3] ^ C[3] ^ C[4] ^ C[6] ^ C[8] ^ C[9] ^ C[10] ^
   C[11] ^ C[12] ^ C[13] ^ C[16] ^ C[18] ^ C[19] ^ C[22] ^
   C[24] ^ C[25] ^ C[28];
   NewCRC[18] = D[31] ^ D[30] ^ D[29] ^ D[28] ^ D[27] ^ D[21] ^
   D[20] ^
   D[19] ^ D[18] ^ D[16] ^ D[14] ^ D[13] ^ D[11] ^ D[10] ^
   D[8] ^ D[6] ^ D[0] ^ C[0] ^ C[6] ^ C[8] ^ C[10] ^ C[11] ^
   C[13] ^ C[14] ^ C[16] ^ C[18] ^ C[19] ^ C[20] ^ C[21] ^
   C[27] ^ C[28] ^ C[29] ^ C[30] ^ C[31];
   NewCRC[19] = D[29] ^ D[27] ^ D[26] ^ D[25] ^ D[23] ^ D[22] ^
   D[20] ^
   D[19] ^ D[18] ^ D[16] ^ D[15] ^ D[14] ^ D[11] ^ D[8] ^
   D[6] ^ D[5] ^ D[4] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[4] ^
   C[5] ^ C[6] ^ C[8] ^ C[11] ^ C[14] ^ C[15] ^ C[16] ^
   C[18] ^ C[19] ^ C[20] ^ C[22] ^ C[23] ^ C[25] ^ C[26] ^
   C[27] ^ C[29];
   NewCRC[20] = D[31] ^ D[25] ^ D[24] ^ D[20] ^ D[19] ^ D[18] ^
   D[15] ^
   D[8] ^ D[4] ^ D[2] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[2] ^
   C[4] ^ C[8] ^ C[15] ^ C[18] ^ C[19] ^ C[20] ^ C[24] ^
   C[25] ^ C[31];
   NewCRC[21] = D[26] ^ D[25] ^ D[21] ^ D[20] ^ D[19] ^ D[16] ^ D[9]
   ^
   D[5] ^ D[3] ^ D[2] ^ D[1] ^ C[1] ^ C[2] ^ C[3] ^ C[5] ^
   C[9] ^ C[16] ^ C[19] ^ C[20] ^ C[21] ^ C[25] ^ C[26];
   NewCRC[22] = D[31] ^ D[30] ^ D[28] ^ D[25] ^ D[23] ^ D[22] ^
   D[20] ^
   D[18] ^ D[16] ^ D[12] ^ D[10] ^ D[9] ^ D[8] ^ D[7] ^

Sheinwald, et. al.           Informational                     [Page 16]

RFC 3385                iSCSI CRC Considerations          September 2002

   D[5] ^ D[3] ^ D[2] ^ D[0] ^ C[0] ^ C[2] ^ C[3] ^ C[5] ^
   C[7] ^ C[8] ^ C[9] ^ C[10] ^ C[12] ^ C[16] ^ C[18] ^
   C[20] ^ C[22] ^ C[23] ^ C[25] ^ C[28] ^ C[30] ^ C[31];
   NewCRC[23] = D[30] ^ D[29] ^ D[28] ^ D[27] ^ D[25] ^ D[24] ^
   D[19] ^
   D[18] ^ D[16] ^ D[13] ^ D[12] ^ D[11] ^ D[10] ^ D[7] ^
   D[5] ^ D[3] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[3] ^ C[5] ^
   C[7] ^ C[10] ^ C[11] ^ C[12] ^ C[13] ^ C[16] ^ C[18] ^
   C[19] ^ C[24] ^ C[25] ^ C[27] ^ C[28] ^ C[29] ^ C[30];
   NewCRC[24] = D[31] ^ D[30] ^ D[29] ^ D[28] ^ D[26] ^ D[25] ^
   D[20] ^
   D[19] ^ D[17] ^ D[14] ^ D[13] ^ D[12] ^ D[11] ^ D[8] ^
   D[6] ^ D[4] ^ D[2] ^ D[1] ^ C[1] ^ C[2] ^ C[4] ^ C[6] ^
   C[8] ^ C[11] ^ C[12] ^ C[13] ^ C[14] ^ C[17] ^ C[19] ^
   C[20] ^ C[25] ^ C[26] ^ C[28] ^ C[29] ^ C[30] ^ C[31];
   NewCRC[25] = D[29] ^ D[28] ^ D[25] ^ D[23] ^ D[20] ^ D[17] ^
   D[16] ^
   D[15] ^ D[14] ^ D[13] ^ D[8] ^ D[6] ^ D[4] ^ D[3] ^
   D[2] ^ D[0] ^ C[0] ^ C[2] ^ C[3] ^ C[4] ^ C[6] ^ C[8] ^
   C[13] ^ C[14] ^ C[15] ^ C[16] ^ C[17] ^ C[20] ^ C[23] ^
   C[25] ^ C[28] ^ C[29];
   NewCRC[26] = D[31] ^ D[29] ^ D[28] ^ D[27] ^ D[25] ^ D[24] ^
   D[23] ^
   D[15] ^ D[14] ^ D[12] ^ D[8] ^ D[6] ^ D[3] ^ D[1] ^
   D[0] ^ C[0] ^ C[1] ^ C[3] ^ C[6] ^ C[8] ^ C[12] ^ C[14] ^
   C[15] ^ C[23] ^ C[24] ^ C[25] ^ C[27] ^ C[28] ^ C[29] ^
   C[31];
   NewCRC[27] = D[31] ^ D[29] ^ D[27] ^ D[24] ^ D[23] ^ D[21] ^
   D[18] ^
   D[17] ^ D[15] ^ D[13] ^ D[12] ^ D[8] ^ D[6] ^ D[5] ^
   D[2] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[2] ^ C[5] ^ C[6] ^
   C[8] ^ C[12] ^ C[13] ^ C[15] ^ C[17] ^ C[18] ^ C[21] ^
   C[23] ^ C[24] ^ C[27] ^ C[29] ^ C[31];
   NewCRC[28] = D[31] ^ D[27] ^ D[26] ^ D[24] ^ D[23] ^ D[22] ^
   D[21] ^
   D[19] ^ D[17] ^ D[14] ^ D[13] ^ D[12] ^ D[8] ^ D[5] ^
   D[4] ^ D[3] ^ D[2] ^ D[1] ^ D[0] ^ C[0] ^ C[1] ^ C[2] ^
   C[3] ^ C[4] ^ C[5] ^ C[8] ^ C[12] ^ C[13] ^ C[14] ^
   C[17] ^ C[19] ^ C[21] ^ C[22] ^ C[23] ^ C[24] ^ C[26] ^
   C[27] ^ C[31];
   NewCRC[29] = D[28] ^ D[27] ^ D[25] ^ D[24] ^ D[23] ^ D[22] ^
   D[20] ^
   D[18] ^ D[15] ^ D[14] ^ D[13] ^ D[9] ^ D[6] ^ D[5] ^
   D[4] ^ D[3] ^ D[2] ^ D[1] ^ C[1] ^ C[2] ^ C[3] ^ C[4] ^
   C[5] ^ C[6] ^ C[9] ^ C[13] ^ C[14] ^ C[15] ^ C[18] ^
   C[20] ^ C[22] ^ C[23] ^ C[24] ^ C[25] ^ C[27] ^ C[28];
   NewCRC[30] = D[29] ^ D[28] ^ D[26] ^ D[25] ^ D[24] ^ D[23] ^
   D[21] ^

Sheinwald, et. al.           Informational                     [Page 17]

RFC 3385                iSCSI CRC Considerations          September 2002

   D[19] ^ D[16] ^ D[15] ^ D[14] ^ D[10] ^ D[7] ^ D[6] ^
   D[5] ^ D[4] ^ D[3] ^ D[2] ^ C[2] ^ C[3] ^ C[4] ^ C[5] ^
   C[6] ^ C[7] ^ C[10] ^ C[14] ^ C[15] ^ C[16] ^ C[19] ^
   C[21] ^ C[23] ^ C[24] ^ C[25] ^ C[26] ^ C[28] ^ C[29];
   NewCRC[31] = D[30] ^ D[29] ^ D[27] ^ D[26] ^ D[25] ^ D[24] ^
   D[22] ^
   D[20] ^ D[17] ^ D[16] ^ D[15] ^ D[11] ^ D[8] ^ D[7] ^
   D[6] ^ D[5] ^ D[4] ^ D[3] ^ C[3] ^ C[4] ^ C[5] ^ C[6] ^
   C[7] ^ C[8] ^ C[11] ^ C[15] ^ C[16] ^ C[17] ^ C[20] ^
   C[22] ^ C[24] ^ C[25] ^ C[26] ^ C[27] ^ C[29] ^ C[30];
   nextCRC32_D32 = NewCRC;
   end
   endfunction

8.3 Some Hardware Implementation Comments

   The iSCSI spec specifies that the most significant 32 bits of the
   data be complemented prior to performing the CRC computation.  For
   most implementations of the CRC algorithm, such as the ones described
   here, which perform simultaneous multiplication by x^32 and division
   by the CRC polynomial, this is equivalent to initializing the CRC
   register to ones regardless of the CRC polynomial.  For other
   implementations, in particular one that only performs division by the
   CRC polynomial (and for which the prescribed multiplication by x^32
   is performed externally) initializing the CRC register to ones does
   not have the same effect as complementing the most significant 32
   bits of the message.  With such implementations, for the CRC32c
   polynomial, initializing the CRC register to 0x2a26f826 has the same
   effect as complementing the most significant 32 bits of the data.
   See reference [Tuikov&Cavanna] for more details.

8.4 Fast Hardware Implementation References

   Fast hardware implementations start from a canonic scheme (as the one
   presented in 7.2) and optimize it based on different criteria.  Two
   classic papers on this subject are [Albertengo1990] and [Glaise1997].
   A more modern (and systematic) approach can be found in [Shie2001]
   and [Sprachman2001].

9. Summary and Conclusions

   The following table is a summary of the error detection capabilities
   of the different codes analyzed.  In the table, d is the minimal
   distance at block length block (in bits), i/byte - software
   instructions/byte, Table size (if table lookup needed), T-look number
   of lookups/byte, Pudb - Pud burst and Puds - Pud sporadic:

Sheinwald, et. al.           Informational                     [Page 18]

RFC 3385                iSCSI CRC Considerations          September 2002

   +-----------------------------------------------------------+
   | Code      |d| Block |i/Byte|Tsize|T-look| Pudb   | Puds   |
   +-----------------------------------------------------------+
   | Fletcher32|3| 2^19  | 2    |  -  | -    | 10^-37 | 10^-36 |
   +-----------------------------------------------------------+
   | Adler32   |3| 2^19  | 3    |  -  | -    | 10^-36 | 10^-35 |
   +-----------------------------------------------------------+
   | IEEE-802  |3| 2^16  | 2.75 | 2^18| 0.5/b| 10^-41 | 10^-40 |
   +-----------------------------------------------------------+
   | CRC32C    |3| 2^31-1| 2.75 | 2^18| 0.5/b| 10^-41 | 10^-40 |
   +-----------------------------------------------------------+

   The probabilities for undetected errors in the above table are
   computed assuming uniformly distributed data.  For real data - that
   can be biased - [Stone98], checksums behave substantially worse than
   CRCs.

   Considering the protection level it offers, the lack of sensitivity
   for biased data and the large block it can protect, we think that
   CRC32C is a good choice as a basic error detection mechanism for
   iSCSI.

   Please observe also that burst errors characterized by a fixed
   average time will have a higher impact on error detection capability
   as the speed of the channels (machines and networks) increases.  The
   only way to keep the Pud within bounds for the long-term is to reduce
   the BER by using better coding of lower levels of the channel.

10. Security Considerations

   These codes detect unintentional changes to data such as those caused
   by noise. In an environment where an attacker can change the data, it
   can also change the error-detection code to match the new data.
   Therefore, the error-detection codes overviewed here do not provide
   protection against attacks.  Indeed, these codes are not intended for
   security purposes; they are meant to be used within some application,
   and the application's threat model and security design control the
   security considerations for the use of the CRC.

11. References and Bibliography

   [Albertengo1990] G. Albertengo, R. Sisto, "Parallel CRC Generation
                    IEEE Micro", Vol. 10, No. 5, October 1990, pp. 63-
                    71.

   [Arazi]          B Arazi, "A commonsense Approach to the Theory of
                    Error Correcting codes".

Sheinwald, et. al.           Informational                     [Page 19]

RFC 3385                iSCSI CRC Considerations          September 2002

   [Baicheva]       T Baicheva, S Dodunekov and P Kazakov, "Undetected
                    error probability performance of cyclic redundancy-
                    check codes of 16-bit redundancy", IEEE Proceedings
                    on Communications, 147:253-256, October 2000.

   [Black]          "Fast CRC32 in Software"  by Richard Black, 1994, at
                    www.cl.cam.ac.uk/Research/SRG/bluebook/21/crc/crc.
                    html.

   [Castagnoli93]   Guy Castagnoli, Stefan Braeuer and Martin Herrman
                    "Optimization of Cyclic Redundancy-Check Codes with
                    24 and 32 Parity Bits", IEEE Transact. on
                    Communications, Vol. 41, No. 6, June 1993.

   [braun01]        Florian Braun and Marcel Waldvogel, "Fast
                    Incremental CRC Updates for IP over ATM Networks",
                    IEEE, High Performance Switching and Routing, 2001,
                    pp. 48-52.

   [FITS]           "NASA FITS documents" at http://heasarc.gsfc.nasa.
                    gov/docs/heasarc/ofwg/docs/general/checksum/node26.
                    html.

   [Fujiwara89]     Toru Fujiwara, Tadao Kasami, and Shu Lin, "Error
                    detecting capabilities of the shortened hamming
                    codes adopted forerror detection in IEEE standard
                    802.3", IEEE Transactions on Communications, COM-
                    37:986989, September 1989.

   [Glaise1997]     Glaise, R. J., "A two-step computation of cyclic
                    redundancy code CRC-32 for ATM networks", IBM
                    Journal of Research and Development, Volume 41,
                    Number 6, 1997.

   [ieee1364]       IEEE Standard Hardware Description Language Based on
                    the Verilog Hardware Description Language, IEEE
                    Standard 1364-1995, December 1995.

   [LinCostello]    S. Lin and D.J. Costello, Jr., "Error Control
                    Coding: Fundamentals and Applications", Englewood
                    Cliffs, NJ: Prentice Hall, 1983.

   [Peterson]       W Wesley Peterson & E J Weldon - Error Correcting
                    Codes - First Edition 1961/Second Edition 1972.

Sheinwald, et. al.           Informational                     [Page 20]

RFC 3385                iSCSI CRC Considerations          September 2002

   [RFC2026]        Bradner, S., "The Internet Standards Process --
                    Revision 3", BCP 9, RFC 2026, October 1996.

   [Ritter]         Ritter, T. 1986. The Great CRC Mystery. Dr. Dobb's
                    Journal of Software Tools. February. 11(2): 26-34,
                    76-83.

   [Polynomials]    "Information on Primitive and Irreducible
                    Polynomials" at http://www.theory.csc.uvic.ca/~cos/
                    inf/neck/PolyInfo.html.

   [RFC1146]        Zweig, J. and C. Partridge, "TCP Alternate Checksum
                    Options", RFC 1146, March 1990.

   [RFC1950]        Deutsch, P. and J. Gailly, "ZLIB Compressed Data
                    Format Specification version 3.3", RFC 1950, May
                    1996.

   [Shie2001]       Ming-Der Shieh, et. al, "A Systematic Approach for
                    Parallel CRC Computations", Journal of Information
                    Science and Engineering, Vol.17 No.3, pp.445-461.

   [Sprachman2001]  Michael Sprachman, "Automatic Generation of Parallel
                    CRC Circuits", IEEE Design & Test May-June 2001.

   [Stone98]        J. Stone et. al., "Performance of Checksums and
                    CRC's over Real Data", IEEE/ACM Transactions on
                    Networking, Vol. 6, No. 5, October 1998.

   [Williams]       Ross Williams - A PAINLESS GUIDE TO CRC ERROR
                    DETECTION ALGORITHMS widely available on the net -
                    (e.g., ftp.adelaide.edu.au/pub/rocksoft/crc_v3.txt)

   [Wolf82]         J.K. Wolf, Arnold Michelson and Allen Levesque, "On
                    the probability of undetected error for linear block
                    codes", IEEE Transactions on Communications, COM-30:
                    317-324, 1982.

   [Wolf88]         J.K. Wolf, R.D. Blackeney, "An Exact Evaluation of
                    the Probability of Undetected Error for Certain
                    Shortened Binary CRC Codes", Proc. MILCOM - IEEE
                    1988.

   [Wolf94J]        J.K. Wolf and Dexter Chun, "The single burst error
                    detection performance of binary cyclic codes", IEEE
                    Transactions on Communications COM-42:11-13, January
                    1994.

Sheinwald, et. al.           Informational                     [Page 21]

RFC 3385                iSCSI CRC Considerations          September 2002

   [Wolf94O]        Dexter Chun and J.K. Wolf, "Special Hardware for
                    computing the probability of undetected error for
                    certain binary crc codes and test results", IEEE
                    Transactions on Communications, COM-42:2769-2772.

   [Tuikov&Cavanna] Luben Tuikov and Vicente Cavanna, "The iSCSI CRC32C
                    Digest and the Simultaneous Multiply and Divide
                    Algorithm", January 30, 2002. White paper
                    distributed to the IETF ips iSCSI reflector.

12. Acknowledgements

   We would like to thank Matt Wakeley for providing us with the
   motivation to co-author this paper and for helpful discussions on the
   subject matter, during his employment with Agilent.

13. Authors' Addresses

   Julian Satran
   IBM, Haifa Research Lab
   MATAM - Advanced Technology Center
   Haifa 31905, Israel
   EMail: julian_satran@il.ibm.com

   Dafna Sheinwald
   IBM, Haifa Research Lab
   MATAM - Advanced Technology Center
   Haifa 31905, Israel
   EMail: Dafna_Sheinwald@il.ibm.com

   Pat Thaler
   Agilent Technologies
   1101 Creekside Ridge Drive
   Suite 100, M/S RH21
   Roseville, CA 95661
   EMail: pat_thaler@agilent.com

   Vicente Cavanna
   Agilent Technologies
   1101 Creekside Ridge Drive
   Suite 100, M/S RH21
   Roseville, CA 95661
   EMail: vince_cavanna@agilent.com

Sheinwald, et. al.           Informational                     [Page 22]

RFC 3385                iSCSI CRC Considerations          September 2002

14.  Full Copyright Statement

   Copyright (C) The Internet Society (2002).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Sheinwald, et. al.           Informational                     [Page 23]


Network Working Group                                          J. Schaad
Request for Comments: 3394                       Soaring Hawk Consulting
Category: Informational                                       R. Housley
                                                        RSA Laboratories
                                                          September 2002

         Advanced Encryption Standard (AES) Key Wrap Algorithm

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2002).  All Rights Reserved.

Abstract

   The purpose of this document is to make the Advanced Encryption
   Standard (AES) Key Wrap algorithm conveniently available to the
   Internet community.  The United States of America has adopted AES as
   the new encryption standard.  The AES Key Wrap algorithm will
   probably be adopted by the USA for encryption of AES keys. The
   authors took most of the text in this document from the draft AES Key
   Wrap posted by NIST.

Table of Contents

   1. Introduction................................................  2
   2. Overview....................................................  2
   2.1 Notation and Definitions...................................  3
   2.2 Algorithms.................................................  4
   2.2.1 Key Wrap.................................................  4
   2.2.2 Key Unwrap...............................................  5
   2.2.3 Key Data Integrity -- the Initial Value..................  6
   2.2.3.1 Default Initial Value..................................  7
   2.2.3.2 Alternative Initial Values.............................  7
   3. Object Identifiers..........................................  8
   4. Test Vectors................................................  8
   4.1 Wrap 128 bits of Key Data with a 128-bit KEK...............  8
   4.2 Wrap 128 bits of Key Data with a 192-bit KEK............... 11
   4.3 Wrap 128 bits of Key Data with a 256-bit KEK............... 14
   4.4 Wrap 192 bits of Key Data with a 192-bit KEK............... 17
   4.5 Wrap 192 bits of Key Data with a 256-bit KEK............... 24
   4.6 Wrap 256 bits of Key Data with a 256-bit KEK............... 30

Schaad & Housley             Informational                      [Page 1]

RFC 3394                AES Key Wrap Algorithm            September 2002

   5. Security Considerations..................................... 39
   6. References.................................................. 39
   7. Acknowledgments............................................. 39
   8. Authors' Addresses.......................................... 39
   9. Full Copyright Statement.................................... 40

1. Introduction

   NOTE: Most of the following text is taken from [AES-WRAP], and the
   assertions regarding the security of the AES Key Wrap algorithm are
   made by the US Government, not by the authors of this document.

   This specification is intended to satisfy the National Institute of
   Standards and Technology (NIST) Key Wrap requirement to:  Design a
   cryptographic algorithm called a Key Wrap that uses the Advanced
   Encryption Standard (AES) as a primitive to securely encrypt
   plaintext key(s) with any associated integrity information and data,
   such that the combination could be longer than the width of the AES
   block size (128-bits).  Each ciphertext bit should be a highly non-
   linear function of each plaintext bit, and (when unwrapping) each
   plaintext bit should be a highly non-linear function of each
   ciphertext bit.  It is sufficient to approximate an ideal
   pseudorandom permutation to the degree that exploitation of
   undesirable phenomena is as unlikely as guessing the AES engine key.

   This key wrap algorithm needs to provide ample security to protect
   keys in the context of prudently designed key management
   architecture.

   Throughout this document, any data being wrapped will be referred to
   as the key data.  It makes no difference to the algorithm whether the
   data being wrapped is a key; in fact there is often good reason to
   include other data with the key, to wrap multiple keys together, or
   to wrap data that isn't strictly a key.  So, the term "key data" is
   used broadly to mean any data being wrapped, but particularly keys,
   since this is primarily a key wrap algorithm.  The key used to do the
   wrapping will be referred to as the key-encryption key (KEK).

   In this document a KEK can be any valid key supported by the AES
   codebook.  That is, a KEK can be a 128-bit key, a 192-bit key, or a
   256-bit key.

2. Overview

   The AES key wrap algorithm is designed to wrap or encrypt key data.
   The key wrap operates on blocks of 64 bits.  Before being wrapped,
   the key data is parsed into n blocks of 64 bits.

Schaad & Housley             Informational                      [Page 2]

RFC 3394                AES Key Wrap Algorithm            September 2002

   The only restriction the key wrap algorithm places on n is that n be
   at least two.  (For key data with length less than or equal to 64
   bits, the constant field used in this specification and the key data
   form a single 128-bit codebook input making this key wrap
   unnecessary.)  The key wrap algorithm accommodates all supported AES
   key sizes.  However, other cryptographic values often need to be
   wrapped.  One such value is the seed of the random number generator
   for DSS.  This seed value requires n to be greater than four.
   Undoubtedly other values require this type of protection. Therefore,
   no upper bound is imposed on n.

   The AES key wrap can be configured to use any of the three key sizes
   supported by the AES codebook.  The choice of a key size affects the
   overall security provided by the key wrap, but it does not alter the
   description of the key wrap algorithm.  Therefore, in the description
   that follows, the key wrap is described generically; no key size is
   specified for the KEK.

2.1 Notation and Definitions

   The following notation is used in the description of the key wrapping
   algorithms:

      AES(K, W)     Encrypt W using the AES codebook with key K
      AES-1(K, W)   Decrypt W using the AES codebook with key K
      MSB(j, W)     Return the most significant j bits of W
      LSB(j, W)     Return the least significant j bits of W
      B1 ^ B2       The bitwise exclusive or (XOR) of B1 and B2
      B1 | B2       Concatenate B1 and B2
      K             The key-encryption key K
      n             The number of 64-bit key data blocks
      s             The number of steps in the wrapping process, s = 6n
      P[i]          The ith plaintext key data block
      C[i]          The ith ciphertext data block
      A             The 64-bit integrity check register
      R[i]          An array of 64-bit registers where
                       i = 0, 1, 2, ..., n
      A[t], R[i][t] The contents of registers A and R[i] after encryption
                       step t.
      IV            The 64-bit initial value used during the wrapping
                       process.

   In the key wrap algorithm, the concatenation function will be used to
   concatenate 64-bit quantities to form the 128-bit input to the AES
   codebook.  The extraction functions will be used to split the 128-bit
   output from the AES codebook into two 64-bit quantities.

Schaad & Housley             Informational                      [Page 3]

RFC 3394                AES Key Wrap Algorithm            September 2002

2.2 Algorithms

   The specification of the key wrap algorithm requires the use of the
   AES codebook [AES].  The next three sections will describe the key
   wrap algorithm, the key unwrap algorithm, and the inherent data
   integrity check.

2.2.1 Key Wrap

   The inputs to the key wrapping process are the KEK and the plaintext
   to be wrapped.  The plaintext consists of n 64-bit blocks, containing
   the key data being wrapped.  The key wrapping process is described
   below.

   Inputs:      Plaintext, n 64-bit values {P1, P2, ..., Pn}, and
                Key, K (the KEK).
   Outputs:     Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}.

   1) Initialize variables.

       Set A0 to an initial value (see 2.2.3)
       For i = 1 to n
            R[0][i] = P[i]

   2) Calculate intermediate values.

       For t = 1 to s, where s = 6n
           A[t] = MSB(64, AES(K, A[t-1] | R[t-1][1])) ^ t
           For i = 1 to n-1
               R[t][i] = R[t-1][i+1]
           R[t][n] = LSB(64, AES(K, A[t-1] | R[t-1][1]))

   3) Output the results.

       Set C[0] = A[t]
       For i = 1 to n
           C[i] = R[t][i]

   An alternative description of the key wrap algorithm involves
   indexing rather than shifting.  This approach allows one to calculate
   the wrapped key in place, avoiding the rotation in the previous
   description.  This produces identical results and is more easily
   implemented in software.

Schaad & Housley             Informational                      [Page 4]

RFC 3394                AES Key Wrap Algorithm            September 2002

   Inputs:  Plaintext, n 64-bit values {P1, P2, ..., Pn}, and
            Key, K (the KEK).
   Outputs: Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}.

   1) Initialize variables.

       Set A = IV, an initial value (see 2.2.3)
       For i = 1 to n
           R[i] = P[i]

   2) Calculate intermediate values.

       For j = 0 to 5
           For i=1 to n
               B = AES(K, A | R[i])
               A = MSB(64, B) ^ t where t = (n*j)+i
               R[i] = LSB(64, B)

   3) Output the results.

       Set C[0] = A
       For i = 1 to n
           C[i] = R[i]

2.2.2 Key Unwrap

   The inputs to the unwrap process are the KEK and (n+1) 64-bit blocks
   of ciphertext consisting of previously wrapped key.  It returns n
   blocks of plaintext consisting of the n 64-bit blocks of the
   decrypted key data.

   Inputs:  Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}, and
           Key, K (the KEK).
   Outputs: Plaintext, n 64-bit values {P1, P2, ..., Pn}.

   1) Initialize variables.

       Set A[s] = C[0] where s = 6n
       For i = 1 to n
           R[s][i] = C[i]

   2) Calculate the intermediate values.

       For t = s to 1
           A[t-1] = MSB(64, AES-1(K, ((A[t] ^ t) | R[t][n]))
           R[t-1][1] = LSB(64, AES-1(K, ((A[t]^t) | R[t][n]))
           For i = 2 to n
               R[t-1][i] = R[t][i-1]

Schaad & Housley             Informational                      [Page 5]

RFC 3394                AES Key Wrap Algorithm            September 2002

   3) Output the results.

       If A[0] is an appropriate initial value (see 2.2.3),
       Then
           For i = 1 to n
               P[i] = R[0][i]
       Else
           Return an error

   The unwrap algorithm can also be specified as an index based
   operation, allowing the calculations to be carried out in place.
   Again, this produces the same results as the register shifting
   approach.

   Inputs:  Ciphertext, (n+1) 64-bit values {C0, C1, ..., Cn}, and
            Key, K (the KEK).
   Outputs: Plaintext, n 64-bit values {P0, P1, K, Pn}.

   1) Initialize variables.

       Set A = C[0]
       For i = 1 to n
           R[i] = C[i]

   2) Compute intermediate values.

       For j = 5 to 0
           For i = n to 1
               B = AES-1(K, (A ^ t) | R[i]) where t = n*j+i
               A = MSB(64, B)
               R[i] = LSB(64, B)

   3) Output results.

   If A is an appropriate initial value (see 2.2.3),
   Then
       For i = 1 to n
           P[i] = R[i]
   Else
       Return an error

2.2.3 Key Data Integrity -- the Initial Value

   The initial value (IV) refers to the value assigned to A[0] in the
   first step of the wrapping process.  This value is used to obtain an
   integrity check on the key data.  In the final step of the unwrapping
   process, the recovered value of A[0] is compared to the expected

Schaad & Housley             Informational                      [Page 6]

RFC 3394                AES Key Wrap Algorithm            September 2002

   value of A[0].  If there is a match, the key is accepted as valid,
   and the unwrapping algorithm returns it.  If there is not a match,
   then the key is rejected, and the unwrapping algorithm returns an
   error.

   The exact properties achieved by this integrity check depend on the
   definition of the initial value.  Different applications may call for
   somewhat different properties; for example, whether there is need to
   determine the integrity of key data throughout its lifecycle or just
   when it is unwrapped.  This specification defines a default initial
   value that supports integrity of the key data during the period it is
   wrapped (2.2.3.1).  Provision is also made to support alternative
   initial values (in 2.2.3.2).

2.2.3.1 Default Initial Value

   The default initial value (IV) is defined to be the hexadecimal
   constant:

       A[0] = IV = A6A6A6A6A6A6A6A6

   The use of a constant as the IV supports a strong integrity check on
   the key data during the period that it is wrapped.  If unwrapping
   produces A[0] = A6A6A6A6A6A6A6A6, then the chance that the key data
   is corrupt is 2^-64.  If unwrapping produces A[0] any other value,
   then the unwrap must return an error and not return any key data.

2.2.3.2 Alternative Initial Values

   When the key wrap is used as part of a larger key management protocol
   or system, the desired scope for data integrity may be more than just
   the key data or the desired duration for more than just the period
   that it is wrapped.  Also, if the key data is not just an AES key, it
   may not always be a multiple of 64 bits.  Alternative definitions of
   the initial value can be used to address such problems.  NIST will
   define alternative initial values in future key management
   publications as needed.  In order to accommodate a set of
   alternatives that may evolve over time, key wrap implementations that
   are not application-specific will require some flexibility in the way
   that the initial value is set and tested.

Schaad & Housley             Informational                      [Page 7]

RFC 3394                AES Key Wrap Algorithm            September 2002

3. Object Identifiers

   NIST has assigned the following object identifiers to identify the
   key wrap algorithm with the default initial value specified in
   2.2.3.1.  One object identifier is assigned for use with each of the
   KEK AES key sizes.

       aes  OBJECT IDENTIFIER  ::=  { joint-iso-itu-t(2) country(16)

          us(840) organization(1) gov(101) csor(3) nistAlgorithm(4) 1 }

       id-aes128-wrap  OBJECT IDENTIFIER  ::=  { aes 5 }
       id-aes192-wrap  OBJECT IDENTIFIER  ::=  { aes 25 }
       id-aes256-wrap  OBJECT IDENTIFIER  ::=  { aes 45 }

4. Test Vectors

   The examples in this section were generated using the index-based
   implementation of the key wrap algorithm.  The use of this approach
   allows a straightforward software implementation of the key wrap
   algorithm.

4.1 Wrap 128 bits of Key Data with a 128-bit KEK

   Input:
   KEK:            000102030405060708090A0B0C0D0E0F
   Key Data:       00112233445566778899AABBCCDDEEFF

   Wrap:

   Step t       A               R1               R2

   1
   In   A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
   Enc  F4740052E82A2251 74CE86FBD7B805E7 8899AABBCCDDEEFF
   XorT F4740052E82A2250 74CE86FBD7B805E7 8899AABBCCDDEEFF

   2
   In   F4740052E82A2250 74CE86FBD7B805E7 8899AABBCCDDEEFF
   Enc  06BA4EBDE7768D0B 74CE86FBD7B805E7 D132EE38147E76F8
   XorT 06BA4EBDE7768D09 74CE86FBD7B805E7 D132EE38147E76F8

   3
   In   06BA4EBDE7768D09 74CE86FBD7B805E7 D132EE38147E76F8
   Enc  FC967627BE937208 FE6E8D679C5D3460 D132EE38147E76F8
   XorT FC967627BE93720B FE6E8D679C5D3460 D132EE38147E76F8

Schaad & Housley             Informational                      [Page 8]

RFC 3394                AES Key Wrap Algorithm            September 2002

   4
   In   FC967627BE93720B FE6E8D679C5D3460 D132EE38147E76F8
   Enc  5896EA9028EE203B FE6E8D679C5D3460 07B2BD973E36A6FC
   XorT 5896EA9028EE203F FE6E8D679C5D3460 07B2BD973E36A6FC

   5
   In   5896EA9028EE203F FE6E8D679C5D3460 07B2BD973E36A6FC
   Enc  93AEA71B258D90C3 25F5A3ADC2195401 07B2BD973E36A6FC
   XorT 93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC

   6
   In   93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC
   Enc  E3EE986344D878F7 25F5A3ADC2195401 F14863BB1E9CA90A
   XorT E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A

   7
   In   E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A
   Enc  2BFC21B2C20E4006 B556D35ED8CEF052 F14863BB1E9CA90A
   XorT 2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A

   8
   In   2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A
   Enc  4BE8CE99C0A43A7D B556D35ED8CEF052 64BAE5818D0570BB
   XorT 4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB

   9
   In   4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB
   Enc  EBE1CE91067024F3 BE114B343EB00981 64BAE5818D0570BB
   XorT EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB

   10
   In   EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB
   Enc  5A9C7B1F5B1C3B46 BE114B343EB00981 4FD3D2B7D74FBB42
   XorT 5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42

   11
   In   5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42
   Enc  93B71967EED41FFC AEF34BD8FB5A7B82 4FD3D2B7D74FBB42
   XorT 93B71967EED41FF7 AEF34BD8FB5A7B82 4FD3D2B7D74FBB42

   12
   In   93B71967EED41FF7 AEF34BD8FB5A7B82 4FD3D2B7D74FBB42
   Enc  1FA68B0A8112B44B AEF34BD8FB5A7B82 9D3E862371D2CFE5
   XorT 1FA68B0A8112B447 AEF34BD8FB5A7B82 9D3E862371D2CFE5

   Output:
   Ciphertext:  1FA68B0A8112B447 AEF34BD8FB5A7B82 9D3E862371D2CFE5

Schaad & Housley             Informational                      [Page 9]

RFC 3394                AES Key Wrap Algorithm            September 2002

   Unwrap:

   Step t       A               R1               R2
   12
   In   1FA68B0A8112B447 AEF34BD8FB5A7B82 9D3E862371D2CFE5
   XorT 1FA68B0A8112B44B AEF34BD8FB5A7B82 9D3E862371D2CFE5
   Dec  93B71967EED41FF7 AEF34BD8FB5A7B82 4FD3D2B7D74FBB42

   11
   In   93B71967EED41FF7 AEF34BD8FB5A7B82 4FD3D2B7D74FBB42
   XorT 93B71967EED41FFC AEF34BD8FB5A7B82 4FD3D2B7D74FBB42
   Dec  5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42

   10
   In   5A9C7B1F5B1C3B4C BE114B343EB00981 4FD3D2B7D74FBB42
   XorT 5A9C7B1F5B1C3B46 BE114B343EB00981 4FD3D2B7D74FBB42
   Dec  EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB

   9
   In   EBE1CE91067024FA BE114B343EB00981 64BAE5818D0570BB
   XorT EBE1CE91067024F3 BE114B343EB00981 64BAE5818D0570BB
   Dec  4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB

   8
   In   4BE8CE99C0A43A75 B556D35ED8CEF052 64BAE5818D0570BB
   XorT 4BE8CE99C0A43A7D B556D35ED8CEF052 64BAE5818D0570BB
   Dec  2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A

   7
   In   2BFC21B2C20E4001 B556D35ED8CEF052 F14863BB1E9CA90A
   XorT 2BFC21B2C20E4006 B556D35ED8CEF052 F14863BB1E9CA90A
   Dec  E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A

   6
   In   E3EE986344D878F1 25F5A3ADC2195401 F14863BB1E9CA90A
   XorT E3EE986344D878F7 25F5A3ADC2195401 F14863BB1E9CA90A
   Dec  93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC

   5
   In   93AEA71B258D90C6 25F5A3ADC2195401 07B2BD973E36A6FC
   XorT 93AEA71B258D90C3 25F5A3ADC2195401 07B2BD973E36A6FC
   Dec  5896EA9028EE203F FE6E8D679C5D3460 07B2BD973E36A6FC

   4
   In   5896EA9028EE203F FE6E8D679C5D3460 07B2BD973E36A6FC
   XorT 5896EA9028EE203B FE6E8D679C5D3460 07B2BD973E36A6FC
   Dec  FC967627BE93720B FE6E8D679C5D3460 D132EE38147E76F8

Schaad & Housley             Informational                     [Page 10]

RFC 3394                AES Key Wrap Algorithm            September 2002

   3
   In   FC967627BE93720B FE6E8D679C5D3460 D132EE38147E76F8
   XorT FC967627BE937208 FE6E8D679C5D3460 D132EE38147E76F8
   Dec  06BA4EBDE7768D09 74CE86FBD7B805E7 D132EE38147E76F8

   2
   In   06BA4EBDE7768D09 74CE86FBD7B805E7 D132EE38147E76F8
   XorT 06BA4EBDE7768D0B 74CE86FBD7B805E7 D132EE38147E76F8
   Dec  F4740052E82A2250 74CE86FBD7B805E7 8899AABBCCDDEEFF

   1
   In   F4740052E82A2250 74CE86FBD7B805E7 8899AABBCCDDEEFF
   XorT F4740052E82A2251 74CE86FBD7B805E7 8899AABBCCDDEEFF
   Dec  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF

   Plaintext  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF

   Output:
   Key Data:  00112233445566778899AABBCCDDEEFF

4.2 Wrap 128 bits of Key Data with a 192-bit KEK

   Input:
   KEK:        000102030405060708090A0B0C0D0E0F1011121314151617
   Key Data:   00112233445566778899AABBCCDDEEFF

   Wrap:

   Step t       A               R1               R21
   In   A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
   Enc  DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF
   XorT DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF

   2
   In   DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
   Enc  9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D
   XorT 9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D

   3
   In   9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
   Enc  7B8E343CA51CF8AB BC164F51E20CC983 51F22F3286758A2D
   XorT 7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D

   4
   In   7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D
   Enc  02A97C5897140595 BC164F51E20CC983 05FC2D8F8FF4B919
   XorT 02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919

Schaad & Housley             Informational                     [Page 11]

RFC 3394                AES Key Wrap Algorithm            September 2002

   5
   In   02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919
   Enc  15D4B63F66583817 429487269D3A0016 05FC2D8F8FF4B919
   XorT 15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919

   6
   In   15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919
   Enc  AE2D0B76A6951EEA 429487269D3A0016 05A2D8FB4DD5BD7A
   XorT AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A

   7
   In   AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A
   Enc  79F849444F4B8AA8 D40B091CDBAC0340 05A2D8FB4DD5BD7A
   XorT 79F849444F4B8AAF D40B091CDBAC0340 05A2D8FB4DD5BD7A

   8
   In   79F849444F4B8AAF D40B091CDBAC0340 05A2D8FB4DD5BD7A
   Enc  5933A9195B5F5E21 D40B091CDBAC0340 89F0D6C06F8CA9B4
   XorT 5933A9195B5F5E29 D40B091CDBAC0340 89F0D6C06F8CA9B4

   9
   In   5933A9195B5F5E29 D40B091CDBAC0340 89F0D6C06F8CA9B4
   Enc  57ADA800299C2E85 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4
   XorT 57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4

   10
   In   57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4
   Enc  BF17BD6A9BC80163 4D5B3DFE7C04ABBA EB24CCFA52EA9078
   XorT BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078

   11
   In   BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078
   Enc  B68BF270AE81544F F92B5B97C050AED2 EB24CCFA52EA9078
   XorT B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078

   12
   In   B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078
   Enc  96778B25AE6CA439 F92B5B97C050AED2 468AB8A17AD84E5D
   XorT 96778B25AE6CA435 F92B5B97C050AED2 468AB8A17AD84E5D

   Output:
   Ciphertext:  96778B25AE6CA435 F92B5B97C050AED2 468AB8A17AD84E5D

Schaad & Housley             Informational                     [Page 12]

RFC 3394                AES Key Wrap Algorithm            September 2002

   Unwrap:

   Step t       A               R1               R2

   12
   In   96778B25AE6CA435 F92B5B97C050AED2 468AB8A17AD84E5D
   XorT 96778B25AE6CA439 F92B5B97C050AED2 468AB8A17AD84E5D
   Dec  B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078

   11
   In   B68BF270AE815444 F92B5B97C050AED2 EB24CCFA52EA9078
   XorT B68BF270AE81544F F92B5B97C050AED2 EB24CCFA52EA9078
   Dec  BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078

   10
   In   BF17BD6A9BC80169 4D5B3DFE7C04ABBA EB24CCFA52EA9078
   XorT BF17BD6A9BC80163 4D5B3DFE7C04ABBA EB24CCFA52EA9078
   Dec  57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4

   9
   In   57ADA800299C2E8C 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4
   XorT 57ADA800299C2E85 4D5B3DFE7C04ABBA 89F0D6C06F8CA9B4
   Dec  5933A9195B5F5E29 D40B091CDBAC0340 89F0D6C06F8CA9B4

   8
   In   5933A9195B5F5E29 D40B091CDBAC0340 89F0D6C06F8CA9B4
   XorT 5933A9195B5F5E21 D40B091CDBAC0340 89F0D6C06F8CA9B4
   Dec  79F849444F4B8AAF D40B091CDBAC0340 05A2D8FB4DD5BD7A

   7
   In   79F849444F4B8AAF D40B091CDBAC0340 05A2D8FB4DD5BD7A
   XorT 79F849444F4B8AA8 D40B091CDBAC0340 05A2D8FB4DD5BD7A
   Dec  AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A

   6
   In   AE2D0B76A6951EEC 429487269D3A0016 05A2D8FB4DD5BD7A
   XorT AE2D0B76A6951EEA 429487269D3A0016 05A2D8FB4DD5BD7A
   Dec  15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919

   5
   In   15D4B63F66583812 429487269D3A0016 05FC2D8F8FF4B919
   XorT 15D4B63F66583817 429487269D3A0016 05FC2D8F8FF4B919
   Dec  02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919

   4
   In   02A97C5897140591 BC164F51E20CC983 05FC2D8F8FF4B919
   XorT 02A97C5897140595 BC164F51E20CC983 05FC2D8F8FF4B919
   Dec  7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D

Schaad & Housley             Informational                     [Page 13]

RFC 3394                AES Key Wrap Algorithm            September 2002

   3
   In   7B8E343CA51CF8A8 BC164F51E20CC983 51F22F3286758A2D
   XorT 7B8E343CA51CF8AB BC164F51E20CC983 51F22F3286758A2D
   Dec  9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D

   2
   In   9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
   XorT 9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D
   Dec  DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF

   1
   In   DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
   XorT DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF
   Dec  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF

   Plaintext A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF

   Output:
   Key Data:  00112233445566778899AABBCCDDEEFF

4.3 Wrap 128 bits of Key Data with a 256-bit KEK

   Input:
   KEK:000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
   Key Data:    00112233445566778899AABBCCDDEEFF

   Wrap:

   Step t       A               R1               R2
   1
   In   A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
   Enc  794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
   XorT 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF

   2
   In   794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
   Enc  D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
   XorT D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8

   3
   In   D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
   Enc  85DBDF1879D5C0A5 5602001BFA07AD8B F60E0CDB7F429FE8
   XorT 85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8

Schaad & Housley             Informational                     [Page 14]

RFC 3394                AES Key Wrap Algorithm            September 2002

   4
   In   85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8
   Enc  738C291128B7226D 5602001BFA07AD8B 58924F777C3F678C
   XorT 738C291128B72269 5602001BFA07AD8B 58924F777C3F678C

   5
   In   738C291128B72269 5602001BFA07AD8B 58924F777C3F678C
   Enc  2656A02DFFF054DC F4DF378183E3D5B2 58924F777C3F678C
   XorT 2656A02DFFF054D9 F4DF378183E3D5B2 58924F777C3F678C

   6
   In   2656A02DFFF054D9 F4DF378183E3D5B2 58924F777C3F678C
   Enc  DDFD0C0E8B52A63A F4DF378183E3D5B2 91AC1D36A964F41B
   XorT DDFD0C0E8B52A63C F4DF378183E3D5B2 91AC1D36A964F41B

   7
   In   DDFD0C0E8B52A63C F4DF378183E3D5B2 91AC1D36A964F41B
   Enc  39AB00D4AE4399EA 5271D5CED80F34ED 91AC1D36A964F41B
   XorT 39AB00D4AE4399ED 5271D5CED80F34ED 91AC1D36A964F41B

   8
   In   39AB00D4AE4399ED 5271D5CED80F34ED 91AC1D36A964F41B
   Enc  4CE414878463EAAC 5271D5CED80F34ED 67D8ED899E7929B8
   XorT 4CE414878463EAA4 5271D5CED80F34ED 67D8ED899E7929B8

   9
   In   4CE414878463EAA4 5271D5CED80F34ED 67D8ED899E7929B8
   Enc  FBB44DB106AA0789 0DF7E50829123648 67D8ED899E7929B8
   XorT FBB44DB106AA0780 0DF7E50829123648 67D8ED899E7929B8

   10
   In   FBB44DB106AA0780 0DF7E50829123648 67D8ED899E7929B8
   Enc  877112A7308ADCC5 0DF7E50829123648 3472D5993D318FD2
   XorT 877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2

   11
   In   877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2
   Enc  78E40190807CC151 63E9777905818A2A 3472D5993D318FD2
   XorT 78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2

   12
   In   78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2
   Enc  64E8C3F9CE0F5BAE 63E9777905818A2A 93C8191E7D6E8AE7
   XorT 64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7

   Output:
   Ciphertext:  64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7

Schaad & Housley             Informational                     [Page 15]

RFC 3394                AES Key Wrap Algorithm            September 2002

   Unwrap:

   Step t       A               R1               R2
   12
   In   64E8C3F9CE0F5BA2 63E9777905818A2A 93C8191E7D6E8AE7
   XorT 64E8C3F9CE0F5BAE 63E9777905818A2A 93C8191E7D6E8AE7
   Dec  78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2

   11
   In   78E40190807CC15A 63E9777905818A2A 3472D5993D318FD2
   XorT 78E40190807CC151 63E9777905818A2A 3472D5993D318FD2
   Dec  877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2

   10
   In   877112A7308ADCCF 0DF7E50829123648 3472D5993D318FD2
   XorT 877112A7308ADCC5 0DF7E50829123648 3472D5993D318FD2
   Dec  FBB44DB106AA0780 0DF7E50829123648 67D8ED899E7929B8

   9
   In   FBB44DB106AA0780 0DF7E50829123648 67D8ED899E7929B8
   XorT FBB44DB106AA0789 0DF7E50829123648 67D8ED899E7929B8
   Dec  4CE414878463EAA4 5271D5CED80F34ED 67D8ED899E7929B8

   8
   In   4CE414878463EAA4 5271D5CED80F34ED 67D8ED899E7929B8
   XorT 4CE414878463EAAC 5271D5CED80F34ED 67D8ED899E7929B8
   Dec  39AB00D4AE4399ED 5271D5CED80F34ED 91AC1D36A964F41B

   7
   In   39AB00D4AE4399ED 5271D5CED80F34ED 91AC1D36A964F41B
   XorT 39AB00D4AE4399EA 5271D5CED80F34ED 91AC1D36A964F41B
   Dec  DDFD0C0E8B52A63C F4DF378183E3D5B2 91AC1D36A964F41B

   6
   In   DDFD0C0E8B52A63C F4DF378183E3D5B2 91AC1D36A964F41B
   XorT DDFD0C0E8B52A63A F4DF378183E3D5B2 91AC1D36A964F41B
   Dec  2656A02DFFF054D9 F4DF378183E3D5B2 58924F777C3F678C

   5
   In   2656A02DFFF054D9 F4DF378183E3D5B2 58924F777C3F678C
   XorT 2656A02DFFF054DC F4DF378183E3D5B2 58924F777C3F678C
   Dec  738C291128B72269 5602001BFA07AD8B 58924F777C3F678C

   4
   In   738C291128B72269 5602001BFA07AD8B 58924F777C3F678C
   XorT 738C291128B7226D 5602001BFA07AD8B 58924F777C3F678C
   Dec  85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8

Schaad & Housley             Informational                     [Page 16]

RFC 3394                AES Key Wrap Algorithm            September 2002

   3
   In   85DBDF1879D5C0A6 5602001BFA07AD8B F60E0CDB7F429FE8
   XorT 85DBDF1879D5C0A5 5602001BFA07AD8B F60E0CDB7F429FE8
   Dec  D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8

   2
   In   D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
   XorT D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
   Dec  794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF

   1
   In   794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
   XorT 794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
   Dec  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF

   Plaintext A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF

   Output:
   Key Data:  00112233445566778899AABBCCDDEEFF

4.4 Wrap 192 bits of Key Data with a 192-bit KEK

   Input:
   KEK:       000102030405060708090A0B0C0D0E0F1011121314151617
   Key Data:  00112233445566778899AABBCCDDEEFF0001020304050607

   Wrap:

   Step t     A/R3             R1               R2

   1
   In   A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
        0001020304050607
   Enc  DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF
        0001020304050607
   XorT DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
        0001020304050607

   2
   In   DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
        0001020304050607
   Enc  9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D
        0001020304050607
   XorT 9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
        0001020304050607

Schaad & Housley             Informational                     [Page 17]

RFC 3394                AES Key Wrap Algorithm            September 2002

   3
   In   9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
        0001020304050607
   Enc  2C8E19A519025B7C 351D385096CCFB29 51F22F3286758A2D
        FF540E514DE120A3
   XorT 2C8E19A519025B7F 351D385096CCFB29 51F22F3286758A2D
        FF540E514DE120A3

   4
   In   2C8E19A519025B7F 351D385096CCFB29 51F22F3286758A2D
        FF540E514DE120A3
   Enc  E727C7BDF822602E A08DAA041D17BBBA 51F22F3286758A2D
        FF540E514DE120A3
   XorT E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D
        FF540E514DE120A3

   5
   In   E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D
        FF540E514DE120A3
   Enc  15B61F7B25D51700 A08DAA041D17BBBA AE82BC1118A5DEA4
        FF540E514DE120A3
   XorT 15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4
        FF540E514DE120A3

   6
   In   15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4
        FF540E514DE120A3
   Enc  A187755AEA64719C A08DAA041D17BBBA AE82BC1118A5DEA4
        D1E708FD13778787
   XorT A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4
        D1E708FD13778787

   7
   In   A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4
        D1E708FD13778787
   Enc  5A994895D81644B7 926ED65A9E853FD9 AE82BC1118A5DEA4
        D1E708FD13778787
   XorT 5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4
        D1E708FD13778787

   8
   In   5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4
        D1E708FD13778787
   Enc  864F408C8AB8CDCF 926ED65A9E853FD9 552A09E141D08AE3
        D1E708FD13778787
   XorT 864F408C8AB8CDC7 926ED65A9E853FD9 552A09E141D08AE3
        D1E708FD13778787

Schaad & Housley             Informational                     [Page 18]

RFC 3394                AES Key Wrap Algorithm            September 2002

   9
   In   864F408C8AB8CDC7 926ED65A9E853FD9 552A09E141D08AE3
        D1E708FD13778787
   Enc  53F4373F575EB7A4 926ED65A9E853FD9 552A09E141D08AE3
        ED5E8456E61BD295
   XorT 53F4373F575EB7AD 926ED65A9E853FD9 552A09E141D08AE3
        ED5E8456E61BD295

   10
   In   53F4373F575EB7AD 926ED65A9E853FD9 552A09E141D08AE3
        ED5E8456E61BD295
   Enc  9EAA4CDA0B1BA5FF 98883EDC6B080FB5 552A09E141D08AE3
        ED5E8456E61BD295
   XorT 9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3
        ED5E8456E61BD295

   11
   In   9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3
        ED5E8456E61BD295
   Enc  B1B9902C68E0EB52 98883EDC6B080FB5 63F6D88A0663FEF9
        ED5E8456E61BD295
   XorT B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9
        ED5E8456E61BD295

   12
   In   B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9
        ED5E8456E61BD295
   Enc  FCE591D77709A6E0 98883EDC6B080FB5 63F6D88A0663FEF9
        463437433A93EFE5
   XorT FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9
        463437433A93EFE5

   13
   In   FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9
        463437433A93EFE5
   Enc  428428D2BD88CF58 C46965F34EFB2261 63F6D88A0663FEF9
        463437433A93EFE5
   XorT 428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9
        463437433A93EFE5

   14
   In   428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9
        463437433A93EFE5
   Enc  6AC861AB961DA578 C46965F34EFB2261 56E3CEE892BBEFC4
        463437433A93EFE5
   XorT 6AC861AB961DA576 C46965F34EFB2261 56E3CEE892BBEFC4
        463437433A93EFE5

Schaad & Housley             Informational                     [Page 19]

RFC 3394                AES Key Wrap Algorithm            September 2002

   15
   In   6AC861AB961DA576 C46965F34EFB2261 56E3CEE892BBEFC4
        463437433A93EFE5
   Enc  E80DB49CC9A1EA61 C46965F34EFB2261 56E3CEE892BBEFC4
        84943C8C67FCFD53
   XorT E80DB49CC9A1EA6E C46965F34EFB2261 56E3CEE892BBEFC4
        84943C8C67FCFD53

   16
   In   E80DB49CC9A1EA6E C46965F34EFB2261 56E3CEE892BBEFC4
        84943C8C67FCFD53
   Enc  ABEE3534AC465C2C 68F24EC260743EDC 56E3CEE892BBEFC4
        84943C8C67FCFD53
   XorT ABEE3534AC465C3C 68F24EC260743EDC 56E3CEE892BBEFC4
        84943C8C67FCFD53

   17
   In   ABEE3534AC465C3C 68F24EC260743EDC 56E3CEE892BBEFC4
        84943C8C67FCFD53
   Enc  E7CC8D8CEDE62BF7 68F24EC260743EDC E1C6C7DDEE725A93
        84943C8C67FCFD53
   XorT E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93
        84943C8C67FCFD53

   18
   In   E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93
        84943C8C67FCFD53
   Enc  031D33264E15D320 68F24EC260743EDC E1C6C7DDEE725A93
        6BA814915C6762D2
   XorT 031D33264E15D332 68F24EC260743EDC E1C6C7DDEE725A93
        6BA814915C6762D2

   Output:
   Ciphertext  031D33264E15D332 68F24EC260743EDC E1C6C7DDEE725A93
               6BA814915C6762D2

   Unwrap:

   Step t     A/R3             R1               R2

   18
   In   031D33264E15D332 68F24EC260743EDC E1C6C7DDEE725A93
        6BA814915C6762D2
   XorT 031D33264E15D320 68F24EC260743EDC E1C6C7DDEE725A93
        6BA814915C6762D2
   Dec  E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93
        84943C8C67FCFD53

Schaad & Housley             Informational                     [Page 20]

RFC 3394                AES Key Wrap Algorithm            September 2002

   17
   In   E7CC8D8CEDE62BE6 68F24EC260743EDC E1C6C7DDEE725A93
        84943C8C67FCFD53
   XorT E7CC8D8CEDE62BF7 68F24EC260743EDC E1C6C7DDEE725A93
        84943C8C67FCFD53
   Dec  ABEE3534AC465C3C 68F24EC260743EDC 56E3CEE892BBEFC4
        84943C8C67FCFD53

   16
   In   ABEE3534AC465C3C 68F24EC260743EDC 56E3CEE892BBEFC4
        84943C8C67FCFD53
   XorT ABEE3534AC465C2C 68F24EC260743EDC 56E3CEE892BBEFC4
        84943C8C67FCFD53
   Dec  E80DB49CC9A1EA6E C46965F34EFB2261 56E3CEE892BBEFC4
        84943C8C67FCFD53

   15
   In   E80DB49CC9A1EA6E C46965F34EFB2261 56E3CEE892BBEFC4
        84943C8C67FCFD53
   XorT E80DB49CC9A1EA61 C46965F34EFB2261 56E3CEE892BBEFC4
        84943C8C67FCFD53
   Dec  6AC861AB961DA576 C46965F34EFB2261 56E3CEE892BBEFC4
        463437433A93EFE5

   14
   In   6AC861AB961DA576 C46965F34EFB2261 56E3CEE892BBEFC4
        463437433A93EFE5
   XorT 6AC861AB961DA578 C46965F34EFB2261 56E3CEE892BBEFC4
        463437433A93EFE5
   Dec  428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9
        463437433A93EFE5

   13
   In   428428D2BD88CF55 C46965F34EFB2261 63F6D88A0663FEF9
        463437433A93EFE5
   XorT 428428D2BD88CF58 C46965F34EFB2261 63F6D88A0663FEF9
        463437433A93EFE5
   Dec  FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9
        463437433A93EFE5

   12
   In   FCE591D77709A6EC 98883EDC6B080FB5 63F6D88A0663FEF9
        463437433A93EFE5
   XorT FCE591D77709A6E0 98883EDC6B080FB5 63F6D88A0663FEF9
        463437433A93EFE5
   Dec  B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9
        ED5E8456E61BD295

Schaad & Housley             Informational                     [Page 21]

RFC 3394                AES Key Wrap Algorithm            September 2002

   11
   In   B1B9902C68E0EB59 98883EDC6B080FB5 63F6D88A0663FEF9
        ED5E8456E61BD295
   XorT B1B9902C68E0EB52 98883EDC6B080FB5 63F6D88A0663FEF9
        ED5E8456E61BD295
   Dec  9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3
        ED5E8456E61BD295

   10
   In   9EAA4CDA0B1BA5F5 98883EDC6B080FB5 552A09E141D08AE3
        ED5E8456E61BD295
   XorT 9EAA4CDA0B1BA5FF 98883EDC6B080FB5 552A09E141D08AE3
        ED5E8456E61BD295
   Dec  53F4373F575EB7AD 926ED65A9E853FD9 552A09E141D08AE3
        ED5E8456E61BD295

   9
   In   53F4373F575EB7AD 926ED65A9E853FD9 552A09E141D08AE3
        ED5E8456E61BD295
   XorT 53F4373F575EB7A4 926ED65A9E853FD9 552A09E141D08AE3
        ED5E8456E61BD295
   Dec  864F408C8AB8CDC7 926ED65A9E853FD9 552A09E141D08AE3
        D1E708FD13778787

   8
   In   864F408C8AB8CDC7 926ED65A9E853FD9 552A09E141D08AE3
        D1E708FD13778787
   XorT 864F408C8AB8CDCF 926ED65A9E853FD9 552A09E141D08AE3
        D1E708FD13778787
   Dec  5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4
        D1E708FD13778787

   7
   In   5A994895D81644B0 926ED65A9E853FD9 AE82BC1118A5DEA4
        D1E708FD13778787
   XorT 5A994895D81644B7 926ED65A9E853FD9 AE82BC1118A5DEA4
        D1E708FD13778787
   Dec  A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4
        D1E708FD13778787

   6
   In   A187755AEA64719A A08DAA041D17BBBA AE82BC1118A5DEA4
        D1E708FD13778787
   XorT A187755AEA64719C A08DAA041D17BBBA AE82BC1118A5DEA4
        D1E708FD13778787
   Dec  15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4
        FF540E514DE120A3

Schaad & Housley             Informational                     [Page 22]

RFC 3394                AES Key Wrap Algorithm            September 2002

   5
   In   15B61F7B25D51705 A08DAA041D17BBBA AE82BC1118A5DEA4
        FF540E514DE120A3
   XorT 15B61F7B25D51700 A08DAA041D17BBBA AE82BC1118A5DEA4
        FF540E514DE120A3
   Dec  E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D
        FF540E514DE120A3

   4
   In   E727C7BDF822602A A08DAA041D17BBBA 51F22F3286758A2D
        FF540E514DE120A3
   XorT E727C7BDF822602E A08DAA041D17BBBA 51F22F3286758A2D
        FF540E514DE120A3
   Dec  2C8E19A519025B7F 351D385096CCFB29 51F22F3286758A2D
        FF540E514DE120A3

   3
   In   2C8E19A519025B7F 351D385096CCFB29 51F22F3286758A2D
        FF540E514DE120A3
   XorT 2C8E19A519025B7C 351D385096CCFB29 51F22F3286758A2D
        FF540E514DE120A3
   Dec  9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
        0001020304050607

   2
   In   9D9B32B9ED742E00 351D385096CCFB29 51F22F3286758A2D
        0001020304050607
   XorT 9D9B32B9ED742E02 351D385096CCFB29 51F22F3286758A2D
        0001020304050607
   Dec  DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
        0001020304050607

   1
   In   DFE8FD5D1A3786A6 351D385096CCFB29 8899AABBCCDDEEFF
        0001020304050607
   XorT DFE8FD5D1A3786A7 351D385096CCFB29 8899AABBCCDDEEFF
        0001020304050607
   Dec  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
        0001020304050607

   Plaintext  A6A6A6A6A6A6A6A6 0011223344556677
              8899AABBCCDDEEFF 0001020304050607
   Output:
   Key Data:  00112233445566778899AABBCCDDEEFF0001020304050607

Schaad & Housley             Informational                     [Page 23]

RFC 3394                AES Key Wrap Algorithm            September 2002

4.5 Wrap 192 bits of Key Data with a 256-bit KEK

   Input:
   KEK:
     000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
   Key Data:    00112233445566778899AABBCCDDEEFF0001020304050607

   Wrap:

   Step t     A/R3             R1               R2

   1
   In   A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
        0001020304050607
   Enc  794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607
   XorT 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607

   2
   In   794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607
   Enc  D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607
   XorT D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607

   3
   In   D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607
   Enc  9DF8F5405FBC00C1 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154
   XorT 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154

   4
   In   9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154
   Enc  F1D28EA6295891EC 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
        6CA405593A3B5154
   XorT F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
        6CA405593A3B5154

Schaad & Housley             Informational                     [Page 24]

RFC 3394                AES Key Wrap Algorithm            September 2002

   5
   In   F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
        6CA405593A3B5154
   Enc  BF213BFD04E8A24F 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        6CA405593A3B5154
   XorT BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        6CA405593A3B5154

   6
   In   BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        6CA405593A3B5154
   Enc  6F85BFBDB7E880E3 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   XorT 6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B

   7
   In   6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   Enc  D532789E4E79D819 444F92BF78E77BB1 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   XorT D532789E4E79D81E 444F92BF78E77BB1 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B

   8
   In   D532789E4E79D81E 444F92BF78E77BB1 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   Enc  2A5FFCEF1F1916D8 444F92BF78E77BB1 C6874607903270CD
        39EBC1A1A53FF55B
   XorT 2A5FFCEF1F1916D0 444F92BF78E77BB1 C6874607903270CD
        39EBC1A1A53FF55B

   9
   In   2A5FFCEF1F1916D0 444F92BF78E77BB1 C6874607903270CD
        39EBC1A1A53FF55B
   Enc  01271BA91D9804F6 444F92BF78E77BB1 C6874607903270CD
        740A273461ED82C6
   XorT 01271BA91D9804FF 444F92BF78E77BB1 C6874607903270CD
        740A273461ED82C6

   10
   In   01271BA91D9804FF 444F92BF78E77BB1 C6874607903270CD
        740A273461ED82C6
   Enc  A3223BD7237F7033 FB1611A83BEB567F C6874607903270CD
        740A273461ED82C6
   XorT A3223BD7237F7039 FB1611A83BEB567F C6874607903270CD
        740A273461ED82C6

Schaad & Housley             Informational                     [Page 25]

RFC 3394                AES Key Wrap Algorithm            September 2002

   11
   In   A3223BD7237F7039 FB1611A83BEB567F C6874607903270CD
        740A273461ED82C6
   Enc  B50C330616E7B1C7 FB1611A83BEB567F 73EDC8CB9322C34E
        740A273461ED82C6
   XorT B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E
        740A273461ED82C6

   12
   In   B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E
        740A273461ED82C6
   Enc  FB8AFF3F083E12CE FB1611A83BEB567F 73EDC8CB9322C34E
        0B08CFDF48020F0D
   XorT FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
        0B08CFDF48020F0D

   13
   In   FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
        0B08CFDF48020F0D
   Enc  82F597607784A33C FB1F2965FCE1E783 73EDC8CB9322C34E
        0B08CFDF48020F0D
   XorT 82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E
        0B08CFDF48020F0D

   14
   In   82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E
        0B08CFDF48020F0D
   Enc  D48E5E83B7C906DB FB1F2965FCE1E783 D36F4FFBA2C82ED9
        0B08CFDF48020F0D
   XorT D48E5E83B7C906D5 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        0B08CFDF48020F0D

   15
   In   D48E5E83B7C906D5 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        0B08CFDF48020F0D
   Enc  1BF2B1CD947311B6 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        C490C33642717146
   XorT 1BF2B1CD947311B9 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        C490C33642717146

   16
   In   1BF2B1CD947311B9 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        C490C33642717146
   Enc  C9F5F26A378011DE F6E6F4FBE30E71E4 D36F4FFBA2C82ED9
        C490C33642717146
   XorT C9F5F26A378011CE F6E6F4FBE30E71E4 D36F4FFBA2C82ED9
        C490C33642717146

Schaad & Housley             Informational                     [Page 26]

RFC 3394                AES Key Wrap Algorithm            September 2002

   17
   In   C9F5F26A378011CE F6E6F4FBE30E71E4 D36F4FFBA2C82ED9
        C490C33642717146
   Enc  39128CE5E435F3A0 F6E6F4FBE30E71E4 769C8B80A32CB895
        C490C33642717146
   XorT 39128CE5E4325F3B1 F6E6F4FBE30E71E4 769C8B80A32CB895
        C490C33642717146

   18
   In   39128CE5E435F3B1 F6E6F4FBE30E71E4 769C8B80A32CB895
        C490C33642717146
   Enc  A8F9BC1612C68B2D F6E6F4FBE30E71E4 769C8B80A32CB895
        8CD5D17D6B254DA1
   XorT A8F9BC1612C68B3F F6E6F4FBE30E71E4 769C8B80A32CB895
        8CD5D17D6B254DA1

   Ciphertext   A8F9BC1612C68B3F F6E6F4FBE30E71E4
                769C8B80A32CB895 8CD5D17D6B254DA1

   Unwrap:

   Step t     A/R3             R1               R2

   18
   In   A8F9BC1612C68B3F F6E6F4FBE30E71E4 769C8B80A32CB895
        8CD5D17D6B254DA1
   XorT A8F9BC1612C68B2D F6E6F4FBE30E71E4 769C8B80A32CB895
        8CD5D17D6B254DA1
   Dec  39128CE5E435F3B1 F6E6F4FBE30E71E4 769C8B80A32CB895
        C490C33642717146

   17
   In   39128CE5E435F3B1 F6E6F4FBE30E71E4 769C8B80A32CB895
        C490C33642717146
   XorT 39128CE5E435F3A0 F6E6F4FBE30E71E4 769C8B80A32CB895
        C490C33642717146
   Dec  C9F5F26A378011CE F6E6F4FBE30E71E4 D36F4FFBA2C82ED9
        C490C33642717146

   16
   In   C9F5F26A378011CE F6E6F4FBE30E71E4 D36F4FFBA2C82ED9
        C490C33642717146
   XorT C9F5F26A378011DE F6E6F4FBE30E71E4 D36F4FFBA2C82ED9
        C490C33642717146
   Dec  1BF2B1CD947311B9 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        C490C33642717146

Schaad & Housley             Informational                     [Page 27]

RFC 3394                AES Key Wrap Algorithm            September 2002

   15
   In   1BF2B1CD947311B9 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        C490C33642717146
   XorT 1BF2B1CD947311B6 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        C490C33642717146
   Dec  D48E5E83B7C906D5 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        0B08CFDF48020F0D

   14
   In   D48E5E83B7C906D5 FB1F2965FCE1E783 D36F4FFBA2C82ED9
        0B08CFDF48020F0D
   XorT D48E5E83B7C906DB FB1F2965FCE1E783 D36F4FFBA2C82ED9
        0B08CFDF48020F0D
   Dec  82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E
        0B08CFDF48020F0D

   13
   In   82F597607784A331 FB1F2965FCE1E783 73EDC8CB9322C34E
        0B08CFDF48020F0D
   XorT 82F597607784A33C FB1F2965FCE1E783 73EDC8CB9322C34E
        0B08CFDF48020F0D
   Dec  FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
        0B08CFDF48020F0D

   12
   In   FB8AFF3F083E12C2 FB1611A83BEB567F 73EDC8CB9322C34E
        0B08CFDF48020F0D
   XorT FB8AFF3F083E12CE FB1611A83BEB567F 73EDC8CB9322C34E
        0B08CFDF48020F0D
   Dec  B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E
        740A273461ED82C6

   11
   In   B50C330616E7B1CC FB1611A83BEB567F 73EDC8CB9322C34E
        740A273461ED82C6
   XorT B50C330616E7B1C7 FB1611A83BEB567F 73EDC8CB9322C34E
        740A273461ED82C6
   Dec  A3223BD7237F7039 FB1611A83BEB567F C6874607903270CD
        740A273461ED82C6

   10
   In   A3223BD7237F7039 FB1611A83BEB567F C6874607903270CD
        740A273461ED82C6
   XorT A3223BD7237F7033 FB1611A83BEB567F C6874607903270CD
        740A273461ED82C6
   Dec  01271BA91D9804FF 444F92BF78E77BB1 C6874607903270CD
        740A273461ED82C6

Schaad & Housley             Informational                     [Page 28]

RFC 3394                AES Key Wrap Algorithm            September 2002

   9
   In   01271BA91D9804FF 444F92BF78E77BB1 C6874607903270CD
        740A273461ED82C6
   XorT 01271BA91D9804F6 444F92BF78E77BB1 C6874607903270CD
        740A273461ED82C6
   Dec  2A5FFCEF1F1916D0 444F92BF78E77BB1 C6874607903270CD
        39EBC1A1A53FF55B

   8
   In   2A5FFCEF1F1916D0 444F92BF78E77BB1 C6874607903270CD
        39EBC1A1A53FF55B
   XorT 2A5FFCEF1F1916D8 444F92BF78E77BB1 C6874607903270CD
        39EBC1A1A53FF55B
   Dec  D532789E4E79D81E 444F92BF78E77BB1 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B

   7
   In   D532789E4E79D81E 444F92BF78E77BB1 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   XorT D532789E4E79D819 444F92BF78E77BB1 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   Dec  6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B

   6
   In   6F85BFBDB7E880E5 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   XorT 6F85BFBDB7E880E3 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        39EBC1A1A53FF55B
   Dec  BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        6CA405593A3B5154

   5
   In   BF213BFD04E8A24A 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        6CA405593A3B5154
   XorT BF213BFD04E8A24F 0CC86A4D9B9C6A31 AEBE2D5C8BF747A9
        6CA405593A3B5154
   Dec  F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
        6CA405593A3B5154

   4
   In   F1D28EA6295891E8 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
        6CA405593A3B5154
   XorT F1D28EA6295891EC 0CC86A4D9B9C6A31 F60E0CDB7F429FE8
        6CA405593A3B5154
   Dec  9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154

Schaad & Housley             Informational                     [Page 29]

RFC 3394                AES Key Wrap Algorithm            September 2002

   3
   In   9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154
   XorT 9DF8F5405FBC00C1 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154
   Dec  D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607

   2
   In   D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607
   XorT D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607
   Dec  794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607

   1
   In   794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607
   XorT 794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607
   Dec  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
        0001020304050607

   Plaintext  A6A6A6A6A6A6A6A6 0011223344556677
              8899AABBCCDDEEFF 0001020304050607

   Output:
   Key Data:  00112233445566778899AABBCCDDEEFF0001020304050607

4.6 Wrap 256 bits of Key Data with a 256-bit KEK

   Input:
   KEK:
     000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F
   Key Data:
     00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F

Schaad & Housley             Informational                     [Page 30]

RFC 3394                AES Key Wrap Algorithm            September 2002

   Wrap:

   Step t     A/R3             R1/R4            R2

   1
   In   A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F
   Enc  794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F
   XorT 794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F

   2
   In   794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F
   Enc  D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607 08090A0B0C0D0E0F
   XorT D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607 08090A0B0C0D0E0F

   3
   In   D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607 08090A0B0C0D0E0F
   Enc  9DF8F5405FBC00C1 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 08090A0B0C0D0E0F
   XorT 9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 08090A0B0C0D0E0F

   4
   In   9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 08090A0B0C0D0E0F
   Enc  564408FDD0DD2EA4 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   XorT 564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC

   5
   In   564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   Enc  4EF02EDD3146AFBB E7D1194D853E53F8 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   XorT 4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC

Schaad & Housley             Informational                     [Page 31]

RFC 3394                AES Key Wrap Algorithm            September 2002

   6
   In   4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   Enc  963AAFFD96B223EC E7D1194D853E53F8 EFD48BA304945576
        6CA405593A3B5154 E5923CB9FDB56FBC
   XorT 963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576
        6CA405593A3B5154 E5923CB9FDB56FBC

   7
   In   963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576
        6CA405593A3B5154 E5923CB9FDB56FBC
   Enc  66D7A8ADD086B9DD E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 E5923CB9FDB56FBC
   XorT 66D7A8ADD086B9DA E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 E5923CB9FDB56FBC

   8
   In   66D7A8ADD086B9DA E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 E5923CB9FDB56FBC
   Enc  C58B9D3AC6D5B94E E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   XorT C58B9D3AC6D5B946 E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74

   9
   In   C58B9D3AC6D5B946 E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   Enc  1A681354E84C41F8 D6AE29ECE7192D43 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   XorT 1A681354E84C41F1 D6AE29ECE7192D43 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74

   10
   In   1A681354E84C41F1 D6AE29ECE7192D43 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   Enc  DBA417FB51F9E3CB D6AE29ECE7192D43 FBEC169FA5C0F6BA
        C365B66943E2D760 73E3B6CBE5D05D74
   XorT DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        C365B66943E2D760 73E3B6CBE5D05D74

   11
   In   DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        C365B66943E2D760 73E3B6CBE5D05D74
   Enc  0629EB29A42E4FD9 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 73E3B6CBE5D05D74
   XorT 0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 73E3B6CBE5D05D74

Schaad & Housley             Informational                     [Page 32]

RFC 3394                AES Key Wrap Algorithm            September 2002

   12
   In   0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 73E3B6CBE5D05D74
   Enc  F9ED8A1429515665 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   XorT F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9

   13
   In   F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   Enc  2E8E2B6BB2016696 4745856AF333F01F FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   XorT 2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9

   14
   In   2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   Enc  15342443CB95ADB1 4745856AF333F01F BCA418BBF7DCE60B
        F56701DAF0388216 3CF149E90E8C04D9
   XorT 15342443CB95ADBF 4745856AF333F01F BCA418BBF7DCE60B
        F56701DAF0388216 3CF149E90E8C04D9

   15
   In   15342443CB95ADBF 4745856AF333F01F BCA418BBF7DCE60B
        F56701DAF0388216 3CF149E90E8C04D9
   Enc  33FE29365885C4B7 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 3CF149E90E8C04D9
   XorT 33FE29365885C4B8 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 3CF149E90E8C04D9

   16
   In   33FE29365885C4B8 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 3CF149E90E8C04D9
   Enc  5075496800978B4A 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   XorT 5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C

   17
   In   5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   Enc  A5382A26B47551F1 1BB8C765A84195E7 BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   XorT A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C

Schaad & Housley             Informational                     [Page 33]

RFC 3394                AES Key Wrap Algorithm            September 2002

   18
   In   A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   Enc  F19D80D437EFE8F9 1BB8C765A84195E7 F7EDAD518C960D36
        C272E9466AAE98F9 40F68C91DB49702C
   XorT F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36
        C272E9466AAE98F9 40F68C91DB49702C

   19
   In   F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36
        C272E9466AAE98F9 40F68C91DB49702C
   Enc  B422B444B87A190B 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 40F68C91DB49702C
   XorT B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 40F68C91DB49702C

   20
   In   B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 40F68C91DB49702C
   Enc  D058823360F88A37 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   XorT D058823360F88A23 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73

   21
   In   D058823360F88A23 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   Enc  C89A96CA7B163ECC CBCCB35CFB87F826 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   XorT C89A96CA7B163ED9 CBCCB35CFB87F826 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73

   22
   In   C89A96CA7B163ED9 CBCCB35CFB87F826 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   Enc  39D02FE7435870ED CBCCB35CFB87F826 3F5786E2D80ED326
        1CFBF6B4C24CB982 07DFE775B9687E73
   XorT 39D02FE7435870FB CBCCB35CFB87F826 3F5786E2D80ED326
        1CFBF6B4C24CB982 07DFE775B9687E73

   23
   In   39D02FE7435870FB CBCCB35CFB87F826 3F5786E2D80ED326
        1CFBF6B4C24CB982 07DFE775B9687E73
   Enc  0AEB82AE3146A91B CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B 07DFE775B9687E73
   XorT 0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B 07DFE775B9687E73

Schaad & Housley             Informational                     [Page 34]

RFC 3394                AES Key Wrap Algorithm            September 2002

   24
   In   0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B 07DFE775B9687E73
   Enc  28C9F404C4B810EC CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B FB988B9B7A02DD21
   XorT 28C9F404C4B810F4 CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B FB988B9B7A02DD21

   Output:
   Ciphertext  28C9F404C4B810F4 CBCCB35CFB87F826 3F5786E2D80ED326
               CBC7F0E71A99F43B FB988B9B7A02DD21

   Unwrap:

   Step t     A/R3             R1/R4            R2

   24
   In   28C9F404C4B810F4 CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B FB988B9B7A02DD21
   XorT 28C9F404C4B810EC CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B FB988B9B7A02DD21
   Dec  0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B 07DFE775B9687E73

   23
   In   0AEB82AE3146A90C CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B 07DFE775B9687E73
   XorT 0AEB82AE3146A91B CBCCB35CFB87F826 3F5786E2D80ED326
        CBC7F0E71A99F43B 07DFE775B9687E73
   Dec  39D02FE7435870FB CBCCB35CFB87F826 3F5786E2D80ED326
        1CFBF6B4C24CB982 07DFE775B9687E73

   22
   In   39D02FE7435870FB CBCCB35CFB87F826 3F5786E2D80ED326
        1CFBF6B4C24CB982 07DFE775B9687E73
   XorT 39D02FE7435870ED CBCCB35CFB87F826 3F5786E2D80ED326
        1CFBF6B4C24CB982 07DFE775B9687E73
   Dec  C89A96CA7B163ED9 CBCCB35CFB87F826 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73

   21
   In   C89A96CA7B163ED9 CBCCB35CFB87F826 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   XorT C89A96CA7B163ECC CBCCB35CFB87F826 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   Dec  D058823360F88A23 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73

Schaad & Housley             Informational                     [Page 35]

RFC 3394                AES Key Wrap Algorithm            September 2002

   20
   In   D058823360F88A23 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   XorT D058823360F88A37 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 07DFE775B9687E73
   Dec  B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 40F68C91DB49702C

   19
   In   B422B444B87A1918 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 40F68C91DB49702C
   XorT B422B444B87A190B 1BB8C765A84195E7 F7EDAD518C960D36
        1CFBF6B4C24CB982 40F68C91DB49702C
   Dec  F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36
        C272E9466AAE98F9 40F68C91DB49702C

   18
   In   F19D80D437EFE8EB 1BB8C765A84195E7 F7EDAD518C960D36
        C272E9466AAE98F9 40F68C91DB49702C
   XorT F19D80D437EFE8F9 1BB8C765A84195E7 F7EDAD518C960D36
        C272E9466AAE98F9 40F68C91DB49702C
   Dec  A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C

   17
   In   A5382A26B47551E0 1BB8C765A84195E7 BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   XorT A5382A26B47551F1 1BB8C765A84195E7 BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   Dec  5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C

   16
   In   5075496800978B5A 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   XorT 5075496800978B4A 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 40F68C91DB49702C
   Dec  33FE29365885C4B8 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 3CF149E90E8C04D9

   15
   In   33FE29365885C4B8 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 3CF149E90E8C04D9
   XorT 33FE29365885C4B7 4745856AF333F01F BCA418BBF7DCE60B
        C272E9466AAE98F9 3CF149E90E8C04D9
   Dec  15342443CB95ADBF 4745856AF333F01F BCA418BBF7DCE60B
        F56701DAF0388216 3CF149E90E8C04D9

Schaad & Housley             Informational                     [Page 36]

RFC 3394                AES Key Wrap Algorithm            September 2002

   14
   In   15342443CB95ADBF 4745856AF333F01F BCA418BBF7DCE60B
        F56701DAF0388216 3CF149E90E8C04D9
   XorT 15342443CB95ADB1 4745856AF333F01F BCA418BBF7DCE60B
        F56701DAF0388216 3CF149E90E8C04D9
   Dec  2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9

   13
   In   2E8E2B6BB201669B 4745856AF333F01F FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   XorT 2E8E2B6BB2016696 4745856AF333F01F FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   Dec  F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9

   12
   In   F9ED8A1429515669 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   XorT F9ED8A1429515665 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 3CF149E90E8C04D9
   Dec  0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 73E3B6CBE5D05D74

   11
   In   0629EB29A42E4FD2 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        F56701DAF0388216 73E3B6CBE5D05D74
   XorT 0629EB29A42E4FD9 D6AE29ECE7192D43 FBEC169FA5C0F6BA

        F56701DAF0388216 73E3B6CBE5D05D74
   Dec  DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        C365B66943E2D760 73E3B6CBE5D05D74

   10
   In   DBA417FB51F9E3C1 D6AE29ECE7192D43 FBEC169FA5C0F6BA
        C365B66943E2D760 73E3B6CBE5D05D74
   XorT DBA417FB51F9E3CB D6AE29ECE7192D43 FBEC169FA5C0F6BA
        C365B66943E2D760 73E3B6CBE5D05D74
   Dec  1A681354E84C41F1 D6AE29ECE7192D43 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74

   9
   In   1A681354E84C41F1 D6AE29ECE7192D43 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   XorT 1A681354E84C41F8 D6AE29ECE7192D43 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   Dec  C58B9D3AC6D5B946 E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74

Schaad & Housley             Informational                     [Page 37]

RFC 3394                AES Key Wrap Algorithm            September 2002

   8
   In   C58B9D3AC6D5B946 E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   XorT C58B9D3AC6D5B94E E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 73E3B6CBE5D05D74
   Dec  66D7A8ADD086B9DA E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 E5923CB9FDB56FBC

   7
   In   66D7A8ADD086B9DA E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 E5923CB9FDB56FBC
   XorT 66D7A8ADD086B9DD E7D1194D853E53F8 EFD48BA304945576
        C365B66943E2D760 E5923CB9FDB56FBC
   Dec  963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576
        6CA405593A3B5154 E5923CB9FDB56FBC

   6
   In   963AAFFD96B223EA E7D1194D853E53F8 EFD48BA304945576
        6CA405593A3B5154 E5923CB9FDB56FBC
   XorT 963AAFFD96B223EC E7D1194D853E53F8 EFD48BA304945576
        6CA405593A3B5154 E5923CB9FDB56FBC
   Dec  4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC

   5
   In   4EF02EDD3146AFBE E7D1194D853E53F8 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   XorT 4EF02EDD3146AFBB E7D1194D853E53F8 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   Dec  564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC

   4
   In   564408FDD0DD2EA0 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   XorT 564408FDD0DD2EA4 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 E5923CB9FDB56FBC
   Dec  9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 08090A0B0C0D0E0F

   3
   In   9DF8F5405FBC00C2 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 08090A0B0C0D0E0F
   XorT 9DF8F5405FBC00C1 F661BD9F31FBFA31 F60E0CDB7F429FE8
        6CA405593A3B5154 08090A0B0C0D0E0F
   Dec  D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607 08090A0B0C0D0E0F

Schaad & Housley             Informational                     [Page 38]

RFC 3394                AES Key Wrap Algorithm            September 2002

   2
   In   D450EA5C5BBCB563 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607 08090A0B0C0D0E0F
   XorT D450EA5C5BBCB561 F661BD9F31FBFA31 F60E0CDB7F429FE8
        0001020304050607 08090A0B0C0D0E0F
   Dec  794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F

   1
   In   794314D454E3FDE0 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F
   XorT 794314D454E3FDE1 F661BD9F31FBFA31 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F
   Dec  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
        0001020304050607 08090A0B0C0D0E0F

   Plaintext  A6A6A6A6A6A6A6A6 0011223344556677 8899AABBCCDDEEFF
              0001020304050607 08090A0B0C0D0E0F

   Output:
   Key Data:
        00112233445566778899AABBCCDDEEFF000102030405060708090A0B0C0D0E0F

5. Security Considerations

   The key wrap algorithm includes a strong integrity check on the key
   data.  If unwrapping produces the expected check value in A[0], then
   the chance that the key data is corrupt is 2^-64.  If unwrapping
   produces an unexpected value, then the algorithm implementation MUST
   return an error, and it MUST NOT return any key data.

   Implementations must protect the KEK from disclosure.  Compromise of
   the KEK may result in the disclosure of all key data protected with
   that KEK.

6. References

   AES       National Institute of Standards and Technology. FIPS Pub
             197: Advanced Encryption Standard (AES). 26 November 2001.

   AES-WRAP  National Institute of Standards and Technology. AES Key
             Wrap Specification. 17 November 2001.
             [http://csrc.nist.gov/encryption/kms/key-wrap.pdf]

Schaad & Housley             Informational                     [Page 39]

RFC 3394                AES Key Wrap Algorithm            September 2002

7. Acknowledgments

   Most of the text in this document is taken from [AES-WRAP].  The
   authors of that document are responsible for the development of the
   AES key wrap algorithm.

8. Authors' Addresses

   Jim Schaad
   Soaring Hawk Consulting

   EMail: jimsch@exmsft.com

   Russell Housley
   RSA Laboratories
   918 Spring Knoll Drive
   Herndon, VA 20170
   USA

   EMail: rhousley@rsasecurity.com

Schaad & Housley             Informational                     [Page 40]

RFC 3394                AES Key Wrap Algorithm            September 2002

9. Full Copyright Statement

   Copyright (C) The Internet Society (2002).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others provided that the above copyright notice and this paragraph
   are included on all such copies.  However, this document itself may
   not be modified in any way, such as by removing the copyright notice
   or references to the Internet Society or other Internet
   organizations, except as required to translate it into languages
   other than English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Schaad & Housley             Informational                     [Page 41]


Network Working Group                                         J. Jonsson
Request for Comments: 3447                                    B. Kaliski
Obsoletes: 2437                                         RSA Laboratories
Category: Informational                                    February 2003

     Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography
                      Specifications Version 2.1

Status of this Memo

   This memo provides information for the Internet community.  It does
   not specify an Internet standard of any kind.  Distribution of this
   memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   This memo represents a republication of PKCS #1 v2.1 from RSA
   Laboratories' Public-Key Cryptography Standards (PKCS) series, and
   change control is retained within the PKCS process.  The body of this
   document is taken directly from the PKCS #1 v2.1 document, with
   certain corrections made during the publication process.

Table of Contents

   1.       Introduction...............................................2
   2.       Notation...................................................3
   3.       Key types..................................................6
      3.1      RSA public key..........................................6
      3.2      RSA private key.........................................7
   4.       Data conversion primitives.................................8
      4.1      I2OSP...................................................9
      4.2      OS2IP...................................................9
   5.       Cryptographic primitives..................................10
      5.1      Encryption and decryption primitives...................10
      5.2      Signature and verification primitives..................12
   6.       Overview of schemes.......................................14
   7.       Encryption schemes........................................15
      7.1      RSAES-OAEP.............................................16
      7.2      RSAES-PKCS1-v1_5.......................................23
   8.       Signature schemes with appendix...........................27
      8.1      RSASSA-PSS.............................................29
      8.2      RSASSA-PKCS1-v1_5......................................32
   9.       Encoding methods for signatures with appendix.............35

Jonsson & Kaliski            Informational                      [Page 1]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      9.1      EMSA-PSS...............................................36
      9.2      EMSA-PKCS1-v1_5........................................41
   Appendix A. ASN.1 syntax...........................................44
      A.1      RSA key representation.................................44
      A.2      Scheme identification..................................46
   Appendix B. Supporting techniques..................................52
      B.1      Hash functions.........................................52
      B.2      Mask generation functions..............................54
   Appendix C. ASN.1 module...........................................56
   Appendix D. Intellectual Property Considerations...................63
   Appendix E. Revision history.......................................64
   Appendix F. References.............................................65
   Appendix G. About PKCS.............................................70
   Appendix H. Corrections Made During RFC Publication Process........70
   Security Considerations............................................70
   Acknowledgements...................................................71
   Authors' Addresses.................................................71
   Full Copyright Statement...........................................72

1. Introduction

   This document provides recommendations for the implementation of
   public-key cryptography based on the RSA algorithm [42], covering the
   following aspects:

    * Cryptographic primitives

    * Encryption schemes

    * Signature schemes with appendix

    * ASN.1 syntax for representing keys and for identifying the schemes

   The recommendations are intended for general application within
   computer and communications systems, and as such include a fair
   amount of flexibility.  It is expected that application standards
   based on these specifications may include additional constraints.
   The recommendations are intended to be compatible with the standard
   IEEE-1363-2000 [26] and draft standards currently being developed by
   the ANSI X9F1 [1] and IEEE P1363 [27] working groups.

   This document supersedes PKCS #1 version 2.0 [35][44] but includes
   compatible techniques.

Jonsson & Kaliski            Informational                      [Page 2]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   The organization of this document is as follows:

    * Section 1 is an introduction.

    * Section 2 defines some notation used in this document.

    * Section 3 defines the RSA public and private key types.

    * Sections 4 and 5 define several primitives, or basic mathematical
      operations.  Data conversion primitives are in Section 4, and
      cryptographic primitives (encryption-decryption, signature-
      verification) are in Section 5.

    * Sections 6, 7, and 8 deal with the encryption and signature
      schemes in this document.  Section 6 gives an overview.  Along
      with the methods found in PKCS #1 v1.5, Section 7 defines an
      OAEP-based [3] encryption scheme and Section 8 defines a PSS-based
      [4][5] signature scheme with appendix.

    * Section 9 defines the encoding methods for the signature schemes
      in Section 8.

    * Appendix A defines the ASN.1 syntax for the keys defined in
      Section 3 and the schemes in Sections 7 and 8.

    * Appendix B defines the hash functions and the mask generation
      function used in this document, including ASN.1 syntax for the
      techniques.

    * Appendix C gives an ASN.1 module.

    * Appendices D, E, F and G cover intellectual property issues,
      outline the revision history of PKCS #1, give references to other
      publications and standards, and provide general information about
      the Public-Key Cryptography Standards.

2. Notation

   c              ciphertext representative, an integer between 0 and
                  n-1

   C              ciphertext, an octet string

   d              RSA private exponent

Jonsson & Kaliski            Informational                      [Page 3]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   d_i            additional factor r_i's CRT exponent, a positive
                  integer such that

                    e * d_i == 1 (mod (r_i-1)), i = 3, ..., u

   dP             p's CRT exponent, a positive integer such that

                    e * dP == 1 (mod (p-1))

   dQ             q's CRT exponent, a positive integer such that

                    e * dQ == 1 (mod (q-1))

   e              RSA public exponent

   EM             encoded message, an octet string

   emBits         (intended) length in bits of an encoded message EM

   emLen          (intended) length in octets of an encoded message EM

   GCD(. , .)     greatest common divisor of two nonnegative integers

   Hash           hash function

   hLen           output length in octets of hash function Hash

   k              length in octets of the RSA modulus n

   K              RSA private key

   L              optional RSAES-OAEP label, an octet string

   LCM(., ..., .) least common multiple of a list of nonnegative
                  integers

   m              message representative, an integer between 0 and n-1

   M              message, an octet string

   mask           MGF output, an octet string

   maskLen        (intended) length of the octet string mask

   MGF            mask generation function

   mgfSeed        seed from which mask is generated, an octet string

Jonsson & Kaliski            Informational                      [Page 4]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   mLen           length in octets of a message M

   n              RSA modulus, n = r_1 * r_2 * ... * r_u , u >= 2

   (n, e)         RSA public key

   p, q           first two prime factors of the RSA modulus n

   qInv           CRT coefficient, a positive integer less than p such
                  that

                    q * qInv == 1 (mod p)

   r_i            prime factors of the RSA modulus n, including r_1 = p,
                  r_2 = q, and additional factors if any

   s              signature representative, an integer between 0 and n-1

   S              signature, an octet string

   sLen           length in octets of the EMSA-PSS salt

   t_i            additional prime factor r_i's CRT coefficient, a
                  positive integer less than r_i such that

                    r_1 * r_2 * ... * r_(i-1) * t_i == 1 (mod r_i) ,

                  i = 3, ... , u

   u              number of prime factors of the RSA modulus, u >= 2

   x              a nonnegative integer

   X              an octet string corresponding to x

   xLen           (intended) length of the octet string X

   0x             indicator of hexadecimal representation of an octet or
                  an octet string; "0x48" denotes the octet with
                  hexadecimal value 48; "(0x)48 09 0e" denotes the
                  string of three consecutive octets with hexadecimal
                  value 48, 09, and 0e, respectively

   \lambda(n)     LCM(r_1-1, r_2-1, ... , r_u-1)

   \xor           bit-wise exclusive-or of two octet strings

Jonsson & Kaliski            Informational                      [Page 5]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   \ceil(.)       ceiling function; \ceil(x) is the smallest integer
                  larger than or equal to the real number x

   ||             concatenation operator

   ==             congruence symbol; a == b (mod n) means that the
                  integer n divides the integer a - b

   Note.  The CRT can be applied in a non-recursive as well as a
   recursive way.  In this document a recursive approach following
   Garner's algorithm [22] is used.  See also Note 1 in Section 3.2.

3. Key types

   Two key types are employed in the primitives and schemes defined in
   this document: RSA public key and RSA private key.  Together, an RSA
   public key and an RSA private key form an RSA key pair.

   This specification supports so-called "multi-prime" RSA where the
   modulus may have more than two prime factors.  The benefit of multi-
   prime RSA is lower computational cost for the decryption and
   signature primitives, provided that the CRT (Chinese Remainder
   Theorem) is used.  Better performance can be achieved on single
   processor platforms, but to a greater extent on multiprocessor
   platforms, where the modular exponentiations involved can be done in
   parallel.

   For a discussion on how multi-prime affects the security of the RSA
   cryptosystem, the reader is referred to [49].

3.1 RSA public key

   For the purposes of this document, an RSA public key consists of two
   components:

      n        the RSA modulus, a positive integer
      e        the RSA public exponent, a positive integer

   In a valid RSA public key, the RSA modulus n is a product of u
   distinct odd primes r_i, i = 1, 2, ..., u, where u >= 2, and the RSA
   public exponent e is an integer between 3 and n - 1 satisfying GCD(e,
   \lambda(n)) = 1, where \lambda(n) = LCM(r_1 - 1, ..., r_u - 1).  By
   convention, the first two primes r_1 and r_2 may also be denoted p
   and q respectively.

   A recommended syntax for interchanging RSA public keys between
   implementations is given in Appendix A.1.1; an implementation's
   internal representation may differ.

Jonsson & Kaliski            Informational                      [Page 6]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

3.2 RSA private key

   For the purposes of this document, an RSA private key may have either
   of two representations.

   1. The first representation consists of the pair (n, d), where the
      components have the following meanings:

         n        the RSA modulus, a positive integer
         d        the RSA private exponent, a positive integer

   2. The second representation consists of a quintuple (p, q, dP, dQ,
      qInv) and a (possibly empty) sequence of triplets (r_i, d_i, t_i),
      i = 3, ..., u, one for each prime not in the quintuple, where the
      components have the following meanings:

         p        the first factor, a positive integer
         q        the second factor, a positive integer
         dP       the first factor's CRT exponent, a positive integer
         dQ       the second factor's CRT exponent, a positive integer
         qInv     the (first) CRT coefficient, a positive integer
         r_i      the i-th factor, a positive integer
         d_i      the i-th factor's CRT exponent, a positive integer
         t_i      the i-th factor's CRT coefficient, a positive integer

   In a valid RSA private key with the first representation, the RSA
   modulus n is the same as in the corresponding RSA public key and is
   the product of u distinct odd primes r_i, i = 1, 2, ..., u, where u
   >= 2.  The RSA private exponent d is a positive integer less than n
   satisfying

      e * d == 1 (mod \lambda(n)),

   where e is the corresponding RSA public exponent and \lambda(n) is
   defined as in Section 3.1.

   In a valid RSA private key with the second representation, the two
   factors p and q are the first two prime factors of the RSA modulus n
   (i.e., r_1 and r_2), the CRT exponents dP and dQ are positive
   integers less than p and q respectively satisfying

      e * dP == 1 (mod (p-1))
      e * dQ == 1 (mod (q-1)) ,

   and the CRT coefficient qInv is a positive integer less than p
   satisfying

      q * qInv == 1 (mod p).

Jonsson & Kaliski            Informational                      [Page 7]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   If u > 2, the representation will include one or more triplets (r_i,
   d_i, t_i), i = 3, ..., u.  The factors r_i are the additional prime
   factors of the RSA modulus n.  Each CRT exponent d_i (i = 3, ..., u)
   satisfies

      e * d_i == 1 (mod (r_i - 1)).

   Each CRT coefficient t_i (i = 3, ..., u) is a positive integer less
   than r_i satisfying

      R_i * t_i == 1 (mod r_i) ,

   where R_i = r_1 * r_2 * ... * r_(i-1).

   A recommended syntax for interchanging RSA private keys between
   implementations, which includes components from both representations,
   is given in Appendix A.1.2; an implementation's internal
   representation may differ.

   Notes.

   1. The definition of the CRT coefficients here and the formulas that
      use them in the primitives in Section 5 generally follow Garner's
      algorithm [22] (see also Algorithm 14.71 in [37]). However, for
      compatibility with the representations of RSA private keys in PKCS
      #1 v2.0 and previous versions, the roles of p and q are reversed
      compared to the rest of the primes.  Thus, the first CRT
      coefficient, qInv, is defined as the inverse of q mod p, rather
      than as the inverse of R_1 mod r_2, i.e., of p mod q.

   2. Quisquater and Couvreur [40] observed the benefit of applying the
      Chinese Remainder Theorem to RSA operations.

4. Data conversion primitives

   Two data conversion primitives are employed in the schemes defined in
   this document:

      * I2OSP - Integer-to-Octet-String primitive

      * OS2IP - Octet-String-to-Integer primitive

   For the purposes of this document, and consistent with ASN.1 syntax,
   an octet string is an ordered sequence of octets (eight-bit bytes).
   The sequence is indexed from first (conventionally, leftmost) to last
   (rightmost).  For purposes of conversion to and from integers, the
   first octet is considered the most significant in the following
   conversion primitives.

Jonsson & Kaliski            Informational                      [Page 8]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

4.1 I2OSP

   I2OSP converts a nonnegative integer to an octet string of a
   specified length.

   I2OSP (x, xLen)

   Input:
   x        nonnegative integer to be converted
   xLen     intended length of the resulting octet string

   Output:
   X        corresponding octet string of length xLen

   Error: "integer too large"

   Steps:

   1. If x >= 256^xLen, output "integer too large" and stop.

   2. Write the integer x in its unique xLen-digit representation in
      base 256:

         x = x_(xLen-1) 256^(xLen-1) + x_(xLen-2) 256^(xLen-2) + ...
         + x_1 256 + x_0,

      where 0 <= x_i < 256 (note that one or more leading digits will be
      zero if x is less than 256^(xLen-1)).

   3. Let the octet X_i have the integer value x_(xLen-i) for 1 <= i <=
      xLen.  Output the octet string

         X = X_1 X_2 ... X_xLen.

4.2 OS2IP

   OS2IP converts an octet string to a nonnegative integer.

   OS2IP (X)

   Input:
   X        octet string to be converted

   Output:
   x        corresponding nonnegative integer

Jonsson & Kaliski            Informational                      [Page 9]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Steps:

   1. Let X_1 X_2 ... X_xLen be the octets of X from first to last,
      and let x_(xLen-i) be the integer value of the octet X_i for
      1 <= i <= xLen.

   2. Let x = x_(xLen-1) 256^(xLen-1) + x_(xLen-2) 256^(xLen-2) + ...
      + x_1 256 + x_0.

   3. Output x.

5. Cryptographic primitives

   Cryptographic primitives are basic mathematical operations on which
   cryptographic schemes can be built.  They are intended for
   implementation in hardware or as software modules, and are not
   intended to provide security apart from a scheme.

   Four types of primitive are specified in this document, organized in
   pairs: encryption and decryption; and signature and verification.

   The specifications of the primitives assume that certain conditions
   are met by the inputs, in particular that RSA public and private keys
   are valid.

5.1 Encryption and decryption primitives

   An encryption primitive produces a ciphertext representative from a
   message representative under the control of a public key, and a
   decryption primitive recovers the message representative from the
   ciphertext representative under the control of the corresponding
   private key.

   One pair of encryption and decryption primitives is employed in the
   encryption schemes defined in this document and is specified here:
   RSAEP/RSADP.  RSAEP and RSADP involve the same mathematical
   operation, with different keys as input.

   The primitives defined here are the same as IFEP-RSA/IFDP-RSA in IEEE
   Std 1363-2000 [26] (except that support for multi-prime RSA has been
   added) and are compatible with PKCS #1 v1.5.

   The main mathematical operation in each primitive is exponentiation.

Jonsson & Kaliski            Informational                     [Page 10]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

5.1.1 RSAEP

   RSAEP ((n, e), m)

   Input:
   (n, e)   RSA public key
   m        message representative, an integer between 0 and n - 1

   Output:
   c        ciphertext representative, an integer between 0 and n - 1

   Error: "message representative out of range"

   Assumption: RSA public key (n, e) is valid

   Steps:

   1. If the message representative m is not between 0 and n - 1, output
      "message representative out of range" and stop.

   2. Let c = m^e mod n.

   3. Output c.

5.1.2   RSADP

   RSADP (K, c)

   Input:
   K        RSA private key, where K has one of the following forms:
            - a pair (n, d)
            - a quintuple (p, q, dP, dQ, qInv) and a possibly empty
              sequence of triplets (r_i, d_i, t_i), i = 3, ..., u
   c        ciphertext representative, an integer between 0 and n - 1

   Output:
   m        message representative, an integer between 0 and n - 1

   Error: "ciphertext representative out of range"

   Assumption: RSA private key K is valid

Jonsson & Kaliski            Informational                     [Page 11]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Steps:

   1. If the ciphertext representative c is not between 0 and n - 1,
      output "ciphertext representative out of range" and stop.

   2. The message representative m is computed as follows.

      a. If the first form (n, d) of K is used, let m = c^d mod n.

      b. If the second form (p, q, dP, dQ, qInv) and (r_i, d_i, t_i)
         of K is used, proceed as follows:

         i.    Let m_1 = c^dP mod p and m_2 = c^dQ mod q.

         ii.   If u > 2, let m_i = c^(d_i) mod r_i, i = 3, ..., u.

         iii.  Let h = (m_1 - m_2) * qInv mod p.

         iv.   Let m = m_2 + q * h.

         v.    If u > 2, let R = r_1 and for i = 3 to u do

                  1. Let R = R * r_(i-1).

                  2. Let h = (m_i - m) * t_i mod r_i.

                  3. Let m = m + R * h.

   3.   Output m.

   Note.  Step 2.b can be rewritten as a single loop, provided that one
   reverses the order of p and q.  For consistency with PKCS #1 v2.0,
   however, the first two primes p and q are treated separately from
   the additional primes.

5.2 Signature and verification primitives

   A signature primitive produces a signature representative from a
   message representative under the control of a private key, and a
   verification primitive recovers the message representative from the
   signature representative under the control of the corresponding
   public key.  One pair of signature and verification primitives is
   employed in the signature schemes defined in this document and is
   specified here: RSASP1/RSAVP1.

   The primitives defined here are the same as IFSP-RSA1/IFVP-RSA1 in
   IEEE 1363-2000 [26] (except that support for multi-prime RSA has
   been added) and are compatible with PKCS #1 v1.5.

Jonsson & Kaliski            Informational                     [Page 12]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   The main mathematical operation in each primitive is
   exponentiation, as in the encryption and decryption primitives of
   Section 5.1.  RSASP1 and RSAVP1 are the same as RSADP and RSAEP
   except for the names of their input and output arguments; they are
   distinguished as they are intended for different purposes.

5.2.1 RSASP1

   RSASP1 (K, m)

   Input:
   K        RSA private key, where K has one of the following forms:
            - a pair (n, d)
            - a quintuple (p, q, dP, dQ, qInv) and a (possibly empty)
              sequence of triplets (r_i, d_i, t_i), i = 3, ..., u
   m        message representative, an integer between 0 and n - 1

   Output:
   s        signature representative, an integer between 0 and n - 1

   Error: "message representative out of range"

   Assumption: RSA private key K is valid

   Steps:

   1. If the message representative m is not between 0 and n - 1,
      output "message representative out of range" and stop.

   2. The signature representative s is computed as follows.

      a. If the first form (n, d) of K is used, let s = m^d mod n.

         b. If the second form (p, q, dP, dQ, qInv) and (r_i, d_i, t_i)
         of K is used, proceed as follows:

         i.    Let s_1 = m^dP mod p and s_2 = m^dQ mod q.

         ii.   If u > 2, let s_i = m^(d_i) mod r_i, i = 3, ..., u.

         iii.  Let h = (s_1 - s_2) * qInv mod p.

         iv.   Let s = s_2 + q * h.

         v.    If u > 2, let R = r_1 and for i = 3 to u do

                  1. Let R = R * r_(i-1).

Jonsson & Kaliski            Informational                     [Page 13]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

                  2. Let h = (s_i - s) * t_i mod r_i.

                  3. Let s = s + R * h.

   3. Output s.

   Note.  Step 2.b can be rewritten as a single loop, provided that one
   reverses the order of p and q.  For consistency with PKCS #1 v2.0,
   however, the first two primes p and q are treated separately from the
   additional primes.

5.2.2 RSAVP1

   RSAVP1 ((n, e), s)

   Input:
   (n, e)   RSA public key
   s        signature representative, an integer between 0 and n - 1

   Output:
   m        message representative, an integer between 0 and n - 1

   Error: "signature representative out of range"

   Assumption: RSA public key (n, e) is valid

   Steps:

   1. If the signature representative s is not between 0 and n - 1,
      output "signature representative out of range" and stop.

   2. Let m = s^e mod n.

   3. Output m.

6. Overview of schemes

   A scheme combines cryptographic primitives and other techniques to
   achieve a particular security goal.  Two types of scheme are
   specified in this document: encryption schemes and signature schemes
   with appendix.

   The schemes specified in this document are limited in scope in that
   their operations consist only of steps to process data with an RSA
   public or private key, and do not include steps for obtaining or
   validating the key.  Thus, in addition to the scheme operations, an
   application will typically include key management operations by which

Jonsson & Kaliski            Informational                     [Page 14]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   parties may select RSA public and private keys for a scheme
   operation.  The specific additional operations and other details are
   outside the scope of this document.

   As was the case for the cryptographic primitives (Section 5), the
   specifications of scheme operations assume that certain conditions
   are met by the inputs, in particular that RSA public and private keys
   are valid.  The behavior of an implementation is thus unspecified
   when a key is invalid.  The impact of such unspecified behavior
   depends on the application.  Possible means of addressing key
   validation include explicit key validation by the application; key
   validation within the public-key infrastructure; and assignment of
   liability for operations performed with an invalid key to the party
   who generated the key.

   A generally good cryptographic practice is to employ a given RSA key
   pair in only one scheme.  This avoids the risk that vulnerability in
   one scheme may compromise the security of the other, and may be
   essential to maintain provable security.  While RSAES-PKCS1-v1_5
   (Section 7.2) and RSASSA-PKCS1-v1_5 (Section 8.2) have traditionally
   been employed together without any known bad interactions (indeed,
   this is the model introduced by PKCS #1 v1.5), such a combined use of
   an RSA key pair is not recommended for new applications.

   To illustrate the risks related to the employment of an RSA key pair
   in more than one scheme, suppose an RSA key pair is employed in both
   RSAES-OAEP (Section 7.1) and RSAES-PKCS1-v1_5.  Although RSAES-OAEP
   by itself would resist attack, an opponent might be able to exploit a
   weakness in the implementation of RSAES-PKCS1-v1_5 to recover
   messages encrypted with either scheme.  As another example, suppose
   an RSA key pair is employed in both RSASSA-PSS (Section 8.1) and
   RSASSA-PKCS1-v1_5.  Then the security proof for RSASSA-PSS would no
   longer be sufficient since the proof does not account for the
   possibility that signatures might be generated with a second scheme.
   Similar considerations may apply if an RSA key pair is employed in
   one of the schemes defined here and in a variant defined elsewhere.

7. Encryption schemes

   For the purposes of this document, an encryption scheme consists of
   an encryption operation and a decryption operation, where the
   encryption operation produces a ciphertext from a message with a
   recipient's RSA public key, and the decryption operation recovers the
   message from the ciphertext with the recipient's corresponding RSA
   private key.

Jonsson & Kaliski            Informational                     [Page 15]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   An encryption scheme can be employed in a variety of applications.  A
   typical application is a key establishment protocol, where the
   message contains key material to be delivered confidentially from one
   party to another.  For instance, PKCS #7 [45] employs such a protocol
   to deliver a content-encryption key from a sender to a recipient; the
   encryption schemes defined here would be suitable key-encryption
   algorithms in that context.

   Two encryption schemes are specified in this document: RSAES-OAEP and
   RSAES-PKCS1-v1_5.  RSAES-OAEP is recommended for new applications;
   RSAES-PKCS1-v1_5 is included only for compatibility with existing
   applications, and is not recommended for new applications.

   The encryption schemes given here follow a general model similar to
   that employed in IEEE Std 1363-2000 [26], combining encryption and
   decryption primitives with an encoding method for encryption.  The
   encryption operations apply a message encoding operation to a message
   to produce an encoded message, which is then converted to an integer
   message representative.  An encryption primitive is applied to the
   message representative to produce the ciphertext.  Reversing this,
   the decryption operations apply a decryption primitive to the
   ciphertext to recover a message representative, which is then
   converted to an octet string encoded message.  A message decoding
   operation is applied to the encoded message to recover the message
   and verify the correctness of the decryption.

   To avoid implementation weaknesses related to the way errors are
   handled within the decoding operation (see [6] and [36]), the
   encoding and decoding operations for RSAES-OAEP and RSAES-PKCS1-v1_5
   are embedded in the specifications of the respective encryption
   schemes rather than defined in separate specifications.  Both
   encryption schemes are compatible with the corresponding schemes in
   PKCS #1 v2.0.

7.1 RSAES-OAEP

   RSAES-OAEP combines the RSAEP and RSADP primitives (Sections 5.1.1
   and 5.1.2) with the EME-OAEP encoding method (step 1.b in Section
   7.1.1 and step 3 in Section 7.1.2).  EME-OAEP is based on Bellare and
   Rogaway's Optimal Asymmetric Encryption scheme [3].  (OAEP stands for
   "Optimal Asymmetric Encryption Padding.").  It is compatible with the
   IFES scheme defined in IEEE Std 1363-2000 [26], where the encryption
   and decryption primitives are IFEP-RSA and IFDP-RSA and the message
   encoding method is EME-OAEP.  RSAES-OAEP can operate on messages of
   length up to k - 2hLen - 2 octets, where hLen is the length of the
   output from the underlying hash function and k is the length in
   octets of the recipient's RSA modulus.

Jonsson & Kaliski            Informational                     [Page 16]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Assuming that computing e-th roots modulo n is infeasible and the
   mask generation function in RSAES-OAEP has appropriate properties,
   RSAES-OAEP is semantically secure against adaptive chosen-ciphertext
   attacks.  This assurance is provable in the sense that the difficulty
   of breaking RSAES-OAEP can be directly related to the difficulty of
   inverting the RSA function, provided that the mask generation
   function is viewed as a black box or random oracle; see [21] and the
   note below for further discussion.

   Both the encryption and the decryption operations of RSAES-OAEP take
   the value of a label L as input.  In this version of PKCS #1, L is
   the empty string; other uses of the label are outside the scope of
   this document.  See Appendix A.2.1 for the relevant ASN.1 syntax.

   RSAES-OAEP is parameterized by the choice of hash function and mask
   generation function.  This choice should be fixed for a given RSA
   key.  Suggested hash and mask generation functions are given in
   Appendix B.

   Note.  Recent results have helpfully clarified the security
   properties of the OAEP encoding method [3] (roughly the procedure
   described in step 1.b in Section 7.1.1).  The background is as
   follows.  In 1994, Bellare and Rogaway [3] introduced a security
   concept that they denoted plaintext awareness (PA94).  They proved
   that if a deterministic public-key encryption primitive (e.g., RSAEP)
   is hard to invert without the private key, then the corresponding
   OAEP-based encryption scheme is plaintext-aware (in the random oracle
   model), meaning roughly that an adversary cannot produce a valid
   ciphertext without actually "knowing" the underlying plaintext.
   Plaintext awareness of an encryption scheme is closely related to the
   resistance of the scheme against chosen-ciphertext attacks.  In such
   attacks, an adversary is given the opportunity to send queries to an
   oracle simulating the decryption primitive.  Using the results of
   these queries, the adversary attempts to decrypt a challenge
   ciphertext.

   However, there are two flavors of chosen-ciphertext attacks, and PA94
   implies security against only one of them.  The difference relies on
   what the adversary is allowed to do after she is given the challenge
   ciphertext.  The indifferent attack scenario (denoted CCA1) does not
   admit any queries to the decryption oracle after the adversary is
   given the challenge ciphertext, whereas the adaptive scenario
   (denoted CCA2) does (except that the decryption oracle refuses to
   decrypt the challenge ciphertext once it is published).  In 1998,
   Bellare and Rogaway, together with Desai and Pointcheval [2], came up
   with a new, stronger notion of plaintext awareness (PA98) that does
   imply security against CCA2.

Jonsson & Kaliski            Informational                     [Page 17]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   To summarize, there have been two potential sources for
   misconception: that PA94 and PA98 are equivalent concepts; or that
   CCA1 and CCA2 are equivalent concepts.  Either assumption leads to
   the conclusion that the Bellare-Rogaway paper implies security of
   OAEP against CCA2, which it does not.

   (Footnote: It might be fair to mention that PKCS #1 v2.0 cites [3]
   and claims that "a chosen ciphertext attack is ineffective against a
   plaintext-aware encryption scheme such as RSAES-OAEP" without
   specifying the kind of plaintext awareness or chosen ciphertext
   attack considered.)

   OAEP has never been proven secure against CCA2; in fact, Victor Shoup
   [48] has demonstrated that such a proof does not exist in the general
   case.  Put briefly, Shoup showed that an adversary in the CCA2
   scenario who knows how to partially invert the encryption primitive
   but does not know how to invert it completely may well be able to
   break the scheme.  For example, one may imagine an attacker who is
   able to break RSAES-OAEP if she knows how to recover all but the
   first 20 bytes of a random integer encrypted with RSAEP.  Such an
   attacker does not need to be able to fully invert RSAEP, because she
   does not use the first 20 octets in her attack.

   Still, RSAES-OAEP is secure against CCA2, which was proved by
   Fujisaki, Okamoto, Pointcheval, and Stern [21] shortly after the
   announcement of Shoup's result.  Using clever lattice reduction
   techniques, they managed to show how to invert RSAEP completely given
   a sufficiently large part of the pre-image.  This observation,
   combined with a proof that OAEP is secure against CCA2 if the
   underlying encryption primitive is hard to partially invert, fills
   the gap between what Bellare and Rogaway proved about RSAES-OAEP and
   what some may have believed that they proved.  Somewhat
   paradoxically, we are hence saved by an ostensible weakness in RSAEP
   (i.e., the whole inverse can be deduced from parts of it).

   Unfortunately however, the security reduction is not efficient for
   concrete parameters.  While the proof successfully relates an
   adversary Adv against the CCA2 security of RSAES-OAEP to an algorithm
   Inv inverting RSA, the probability of success for Inv is only
   approximately \epsilon^2 / 2^18, where \epsilon is the probability of
   success for Adv.

   (Footnote: In [21] the probability of success for the inverter was
   \epsilon^2 / 4.  The additional factor 1 / 2^16 is due to the eight
   fixed zero bits at the beginning of the encoded message EM, which are
   not present in the variant of OAEP considered in [21] (Inv must apply
   Adv twice to invert RSA, and each application corresponds to a factor
   1 / 2^8).)

Jonsson & Kaliski            Informational                     [Page 18]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   In addition, the running time for Inv is approximately t^2, where t
   is the running time of the adversary.  The consequence is that we
   cannot exclude the possibility that attacking RSAES-OAEP is
   considerably easier than inverting RSA for concrete parameters.
   Still, the existence of a security proof provides some assurance that
   the RSAES-OAEP construction is sounder than ad hoc constructions such
   as RSAES-PKCS1-v1_5.

   Hybrid encryption schemes based on the RSA-KEM key encapsulation
   paradigm offer tight proofs of security directly applicable to
   concrete parameters; see [30] for discussion.  Future versions of
   PKCS #1 may specify schemes based on this paradigm.

7.1.1 Encryption operation

   RSAES-OAEP-ENCRYPT ((n, e), M, L)

   Options:
   Hash     hash function (hLen denotes the length in octets of the hash
            function output)
   MGF      mask generation function

   Input:
   (n, e)   recipient's RSA public key (k denotes the length in octets
            of the RSA modulus n)
   M        message to be encrypted, an octet string of length mLen,
            where mLen <= k - 2hLen - 2
   L        optional label to be associated with the message; the
            default value for L, if L is not provided, is the empty
            string

   Output:
   C        ciphertext, an octet string of length k

   Errors:  "message too long"; "label too long"

   Assumption: RSA public key (n, e) is valid

   Steps:

   1. Length checking:

      a. If the length of L is greater than the input limitation for the
         hash function (2^61 - 1 octets for SHA-1), output "label too
         long" and stop.

      b. If mLen > k - 2hLen - 2, output "message too long" and stop.

Jonsson & Kaliski            Informational                     [Page 19]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   2. EME-OAEP encoding (see Figure 1 below):

      a. If the label L is not provided, let L be the empty string. Let
         lHash = Hash(L), an octet string of length hLen (see the note
         below).

      b. Generate an octet string PS consisting of k - mLen - 2hLen - 2
         zero octets.  The length of PS may be zero.

      c. Concatenate lHash, PS, a single octet with hexadecimal value
         0x01, and the message M to form a data block DB of length k -
         hLen - 1 octets as

            DB = lHash || PS || 0x01 || M.

      d. Generate a random octet string seed of length hLen.

      e. Let dbMask = MGF(seed, k - hLen - 1).

      f. Let maskedDB = DB \xor dbMask.

      g. Let seedMask = MGF(maskedDB, hLen).

      h. Let maskedSeed = seed \xor seedMask.

      i. Concatenate a single octet with hexadecimal value 0x00,
         maskedSeed, and maskedDB to form an encoded message EM of
         length k octets as

            EM = 0x00 || maskedSeed || maskedDB.

   3. RSA encryption:

      a. Convert the encoded message EM to an integer message
         representative m (see Section 4.2):

            m = OS2IP (EM).

      b. Apply the RSAEP encryption primitive (Section 5.1.1) to the RSA
         public key (n, e) and the message representative m to produce
         an integer ciphertext representative c:

            c = RSAEP ((n, e), m).

      c. Convert the ciphertext representative c to a ciphertext C of
         length k octets (see Section 4.1):

            C = I2OSP (c, k).

Jonsson & Kaliski            Informational                     [Page 20]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   4. Output the ciphertext C.

   Note.  If L is the empty string, the corresponding hash value lHash
   has the following hexadecimal representation for different choices of
   Hash:

   SHA-1:   (0x)da39a3ee 5e6b4b0d 3255bfef 95601890 afd80709
   SHA-256: (0x)e3b0c442 98fc1c14 9afbf4c8 996fb924 27ae41e4 649b934c
                a495991b 7852b855
   SHA-384: (0x)38b060a7 51ac9638 4cd9327e b1b1e36a 21fdb711 14be0743
                4c0cc7bf 63f6e1da 274edebf e76f65fb d51ad2f1 4898b95b
   SHA-512: (0x)cf83e135 7eefb8bd f1542850 d66d8007 d620e405 0b5715dc
                83f4a921 d36ce9ce 47d0d13c 5d85f2b0 ff8318d2 877eec2f
                63b931bd 47417a81 a538327a f927da3e

   __________________________________________________________________

                             +----------+---------+-------+
                        DB = |  lHash   |    PS   |   M   |
                             +----------+---------+-------+
                                            |
                  +----------+              V
                  |   seed   |--> MGF ---> xor
                  +----------+              |
                        |                   |
               +--+     V                   |
               |00|    xor <----- MGF <-----|
               +--+     |                   |
                 |      |                   |
                 V      V                   V
               +--+----------+----------------------------+
         EM =  |00|maskedSeed|          maskedDB          |
               +--+----------+----------------------------+
   __________________________________________________________________

   Figure 1: EME-OAEP encoding operation.  lHash is the hash of the
   optional label L.  Decoding operation follows reverse steps to
   recover M and verify lHash and PS.

7.1.2 Decryption operation

   RSAES-OAEP-DECRYPT (K, C, L)

   Options:
   Hash     hash function (hLen denotes the length in octets of the hash
            function output)
   MGF      mask generation function

Jonsson & Kaliski            Informational                     [Page 21]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Input:
   K        recipient's RSA private key (k denotes the length in octets
            of the RSA modulus n)
   C        ciphertext to be decrypted, an octet string of length k,
            where k = 2hLen + 2
   L        optional label whose association with the message is to be
            verified; the default value for L, if L is not provided, is
            the empty string

   Output:
   M        message, an octet string of length mLen, where mLen <= k -
            2hLen - 2

   Error: "decryption error"

   Steps:

   1. Length checking:

      a. If the length of L is greater than the input limitation for the
         hash function (2^61 - 1 octets for SHA-1), output "decryption
         error" and stop.

      b. If the length of the ciphertext C is not k octets, output
         "decryption error" and stop.

      c. If k < 2hLen + 2, output "decryption error" and stop.

   2.    RSA decryption:

      a. Convert the ciphertext C to an integer ciphertext
         representative c (see Section 4.2):

            c = OS2IP (C).

         b. Apply the RSADP decryption primitive (Section 5.1.2) to the
         RSA private key K and the ciphertext representative c to
         produce an integer message representative m:

            m = RSADP (K, c).

         If RSADP outputs "ciphertext representative out of range"
         (meaning that c >= n), output "decryption error" and stop.

      c. Convert the message representative m to an encoded message EM
         of length k octets (see Section 4.1):

            EM = I2OSP (m, k).

Jonsson & Kaliski            Informational                     [Page 22]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   3. EME-OAEP decoding:

      a. If the label L is not provided, let L be the empty string. Let
         lHash = Hash(L), an octet string of length hLen (see the note
         in Section 7.1.1).

      b. Separate the encoded message EM into a single octet Y, an octet
         string maskedSeed of length hLen, and an octet string maskedDB
         of length k - hLen - 1 as

            EM = Y || maskedSeed || maskedDB.

      c. Let seedMask = MGF(maskedDB, hLen).

      d. Let seed = maskedSeed \xor seedMask.

      e. Let dbMask = MGF(seed, k - hLen - 1).

      f. Let DB = maskedDB \xor dbMask.

      g. Separate DB into an octet string lHash' of length hLen, a
         (possibly empty) padding string PS consisting of octets with
         hexadecimal value 0x00, and a message M as

            DB = lHash' || PS || 0x01 || M.

         If there is no octet with hexadecimal value 0x01 to separate PS
         from M, if lHash does not equal lHash', or if Y is nonzero,
         output "decryption error" and stop.  (See the note below.)

   4. Output the message M.

   Note.  Care must be taken to ensure that an opponent cannot
   distinguish the different error conditions in Step 3.g, whether by
   error message or timing, or, more generally, learn partial
   information about the encoded message EM.  Otherwise an opponent may
   be able to obtain useful information about the decryption of the
   ciphertext C, leading to a chosen-ciphertext attack such as the one
   observed by Manger [36].

7.2 RSAES-PKCS1-v1_5

   RSAES-PKCS1-v1_5 combines the RSAEP and RSADP primitives (Sections
   5.1.1 and 5.1.2) with the EME-PKCS1-v1_5 encoding method (step 1 in
   Section 7.2.1 and step 3 in Section 7.2.2).  It is mathematically
   equivalent to the encryption scheme in PKCS #1 v1.5.  RSAES-PKCS1-
   v1_5 can operate on messages of length up to k - 11 octets (k is the
   octet length of the RSA modulus), although care should be taken to

Jonsson & Kaliski            Informational                     [Page 23]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   avoid certain attacks on low-exponent RSA due to Coppersmith,
   Franklin, Patarin, and Reiter when long messages are encrypted (see
   the third bullet in the notes below and [10]; [14] contains an
   improved attack).  As a general rule, the use of this scheme for
   encrypting an arbitrary message, as opposed to a randomly generated
   key, is not recommended.

   It is possible to generate valid RSAES-PKCS1-v1_5 ciphertexts without
   knowing the corresponding plaintexts, with a reasonable probability
   of success.  This ability can be exploited in a chosen- ciphertext
   attack as shown in [6].  Therefore, if RSAES-PKCS1-v1_5 is to be
   used, certain easily implemented countermeasures should be taken to
   thwart the attack found in [6].  Typical examples include the
   addition of structure to the data to be encoded, rigorous checking of
   PKCS #1 v1.5 conformance (and other redundancy) in decrypted
   messages, and the consolidation of error messages in a client-server
   protocol based on PKCS #1 v1.5.  These can all be effective
   countermeasures and do not involve changes to a PKCS #1 v1.5-based
   protocol.  See [7] for a further discussion of these and other
   countermeasures.  It has recently been shown that the security of the
   SSL/TLS handshake protocol [17], which uses RSAES-PKCS1-v1_5 and
   certain countermeasures, can be related to a variant of the RSA
   problem; see [32] for discussion.

   Note.  The following passages describe some security recommendations
   pertaining to the use of RSAES-PKCS1-v1_5.  Recommendations from
   version 1.5 of this document are included as well as new
   recommendations motivated by cryptanalytic advances made in the
   intervening years.

    * It is recommended that the pseudorandom octets in step 2 in
      Section 7.2.1 be generated independently for each encryption
      process, especially if the same data is input to more than one
      encryption process.  Haastad's results [24] are one motivation for
      this recommendation.

    * The padding string PS in step 2 in Section 7.2.1 is at least eight
      octets long, which is a security condition for public-key
      operations that makes it difficult for an attacker to recover data
      by trying all possible encryption blocks.

    * The pseudorandom octets can also help thwart an attack due to
      Coppersmith et al. [10] (see [14] for an improvement of the
      attack) when the size of the message to be encrypted is kept
      small.  The attack works on low-exponent RSA when similar messages
      are encrypted with the same RSA public key.  More specifically, in
      one flavor of the attack, when two inputs to RSAEP agree on a
      large fraction of bits (8/9) and low-exponent RSA (e = 3) is used

Jonsson & Kaliski            Informational                     [Page 24]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      to encrypt both of them, it may be possible to recover both inputs
      with the attack.  Another flavor of the attack is successful in
      decrypting a single ciphertext when a large fraction (2/3) of the
      input to RSAEP is already known.  For typical applications, the
      message to be encrypted is short (e.g., a 128-bit symmetric key)
      so not enough information will be known or common between two
      messages to enable the attack.  However, if a long message is
      encrypted, or if part of a message is known, then the attack may
      be a concern.  In any case, the RSAES-OAEP scheme overcomes the
      attack.

7.2.1 Encryption operation

   RSAES-PKCS1-V1_5-ENCRYPT ((n, e), M)

   Input:
   (n, e)   recipient's RSA public key (k denotes the length in octets
            of the modulus n)
   M        message to be encrypted, an octet string of length mLen,
            where mLen <= k - 11

   Output:
   C        ciphertext, an octet string of length k

   Error: "message too long"

   Steps:

   1. Length checking: If mLen > k - 11, output "message too long" and
      stop.

   2. EME-PKCS1-v1_5 encoding:

      a. Generate an octet string PS of length k - mLen - 3 consisting
         of pseudo-randomly generated nonzero octets.  The length of PS
         will be at least eight octets.

      b. Concatenate PS, the message M, and other padding to form an
         encoded message EM of length k octets as

            EM = 0x00 || 0x02 || PS || 0x00 || M.

Jonsson & Kaliski            Informational                     [Page 25]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   3. RSA encryption:

      a. Convert the encoded message EM to an integer message
         representative m (see Section 4.2):

            m = OS2IP (EM).

      b. Apply the RSAEP encryption primitive (Section 5.1.1) to the RSA
         public key (n, e) and the message representative m to produce
         an integer ciphertext representative c:

            c = RSAEP ((n, e), m).

      c. Convert the ciphertext representative c to a ciphertext C of
         length k octets (see Section 4.1):

               C = I2OSP (c, k).

   4. Output the ciphertext C.

7.2.2 Decryption operation

   RSAES-PKCS1-V1_5-DECRYPT (K, C)

   Input:
   K        recipient's RSA private key
   C        ciphertext to be decrypted, an octet string of length k,
            where k is the length in octets of the RSA modulus n

   Output:
   M        message, an octet string of length at most k - 11

   Error: "decryption error"

   Steps:

   1. Length checking: If the length of the ciphertext C is not k octets
      (or if k < 11), output "decryption error" and stop.

   2. RSA decryption:

      a. Convert the ciphertext C to an integer ciphertext
         representative c (see Section 4.2):

            c = OS2IP (C).

Jonsson & Kaliski            Informational                     [Page 26]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      b. Apply the RSADP decryption primitive (Section 5.1.2) to the RSA
         private key (n, d) and the ciphertext representative c to
         produce an integer message representative m:

            m = RSADP ((n, d), c).

         If RSADP outputs "ciphertext representative out of range"
         (meaning that c >= n), output "decryption error" and stop.

      c. Convert the message representative m to an encoded message EM
         of length k octets (see Section 4.1):

            EM = I2OSP (m, k).

   3. EME-PKCS1-v1_5 decoding: Separate the encoded message EM into an
      octet string PS consisting of nonzero octets and a message M as

         EM = 0x00 || 0x02 || PS || 0x00 || M.

      If the first octet of EM does not have hexadecimal value 0x00, if
      the second octet of EM does not have hexadecimal value 0x02, if
      there is no octet with hexadecimal value 0x00 to separate PS from
      M, or if the length of PS is less than 8 octets, output
      "decryption error" and stop.  (See the note below.)

   4. Output M.

   Note.  Care shall be taken to ensure that an opponent cannot
   distinguish the different error conditions in Step 3, whether by
   error message or timing.  Otherwise an opponent may be able to obtain
   useful information about the decryption of the ciphertext C, leading
   to a strengthened version of Bleichenbacher's attack [6]; compare to
   Manger's attack [36].

8. Signature schemes with appendix

   For the purposes of this document, a signature scheme with appendix
   consists of a signature generation operation and a signature
   verification operation, where the signature generation operation
   produces a signature from a message with a signer's RSA private key,
   and the signature verification operation verifies the signature on
   the message with the signer's corresponding RSA public key.  To
   verify a signature constructed with this type of scheme it is
   necessary to have the message itself.  In this way, signature schemes
   with appendix are distinguished from signature schemes with message
   recovery, which are not supported in this document.

Jonsson & Kaliski            Informational                     [Page 27]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   A signature scheme with appendix can be employed in a variety of
   applications.  For instance, the signature schemes with appendix
   defined here would be suitable signature algorithms for X.509
   certificates [28].  Related signature schemes could be employed in
   PKCS #7 [45], although for technical reasons the current version of
   PKCS #7 separates a hash function from a signature scheme, which is
   different than what is done here; see the note in Appendix A.2.3 for
   more discussion.

   Two signature schemes with appendix are specified in this document:
   RSASSA-PSS and RSASSA-PKCS1-v1_5.  Although no attacks are known
   against RSASSA-PKCS1-v1_5, in the interest of increased robustness,
   RSASSA-PSS is recommended for eventual adoption in new applications.
   RSASSA-PKCS1-v1_5 is included for compatibility with existing
   applications, and while still appropriate for new applications, a
   gradual transition to RSASSA-PSS is encouraged.

   The signature schemes with appendix given here follow a general model
   similar to that employed in IEEE Std 1363-2000 [26], combining
   signature and verification primitives with an encoding method for
   signatures.  The signature generation operations apply a message
   encoding operation to a message to produce an encoded message, which
   is then converted to an integer message representative.  A signature
   primitive is applied to the message representative to produce the
   signature.  Reversing this, the signature verification operations
   apply a signature verification primitive to the signature to recover
   a message representative, which is then converted to an octet string
   encoded message.  A verification operation is applied to the message
   and the encoded message to determine whether they are consistent.

   If the encoding method is deterministic (e.g., EMSA-PKCS1-v1_5), the
   verification operation may apply the message encoding operation to
   the message and compare the resulting encoded message to the
   previously derived encoded message.  If there is a match, the
   signature is considered valid.  If the method is randomized (e.g.,
   EMSA-PSS), the verification operation is typically more complicated.
   For example, the verification operation in EMSA-PSS extracts the
   random salt and a hash output from the encoded message and checks
   whether the hash output, the salt, and the message are consistent;
   the hash output is a deterministic function in terms of the message
   and the salt.

   For both signature schemes with appendix defined in this document,
   the signature generation and signature verification operations are
   readily implemented as "single-pass" operations if the signature is
   placed after the message.  See PKCS #7 [45] for an example format in
   the case of RSASSA-PKCS1-v1_5.

Jonsson & Kaliski            Informational                     [Page 28]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

8.1 RSASSA-PSS

   RSASSA-PSS combines the RSASP1 and RSAVP1 primitives with the EMSA-
   PSS encoding method.  It is compatible with the IFSSA scheme as
   amended in the IEEE P1363a draft [27], where the signature and
   verification primitives are IFSP-RSA1 and IFVP-RSA1 as defined in
   IEEE Std 1363-2000 [26] and the message encoding method is EMSA4.
   EMSA4 is slightly more general than EMSA-PSS as it acts on bit
   strings rather than on octet strings.  EMSA-PSS is equivalent to
   EMSA4 restricted to the case that the operands as well as the hash
   and salt values are octet strings.

   The length of messages on which RSASSA-PSS can operate is either
   unrestricted or constrained by a very large number, depending on the
   hash function underlying the EMSA-PSS encoding method.

   Assuming that computing e-th roots modulo n is infeasible and the
   hash and mask generation functions in EMSA-PSS have appropriate
   properties, RSASSA-PSS provides secure signatures.  This assurance is
   provable in the sense that the difficulty of forging signatures can
   be directly related to the difficulty of inverting the RSA function,
   provided that the hash and mask generation functions are viewed as
   black boxes or random oracles.  The bounds in the security proof are
   essentially "tight", meaning that the success probability and running
   time for the best forger against RSASSA-PSS are very close to the
   corresponding parameters for the best RSA inversion algorithm; see
   [4][13][31] for further discussion.

   In contrast to the RSASSA-PKCS1-v1_5 signature scheme, a hash
   function identifier is not embedded in the EMSA-PSS encoded message,
   so in theory it is possible for an adversary to substitute a
   different (and potentially weaker) hash function than the one
   selected by the signer.  Therefore, it is recommended that the EMSA-
   PSS mask generation function be based on the same hash function.  In
   this manner the entire encoded message will be dependent on the hash
   function and it will be difficult for an opponent to substitute a
   different hash function than the one intended by the signer.  This
   matching of hash functions is only for the purpose of preventing hash
   function substitution, and is not necessary if hash function
   substitution is addressed by other means (e.g., the verifier accepts
   only a designated hash function).  See [34] for further discussion of
   these points.  The provable security of RSASSA-PSS does not rely on
   the hash function in the mask generation function being the same as
   the hash function applied to the message.

   RSASSA-PSS is different from other RSA-based signature schemes in
   that it is probabilistic rather than deterministic, incorporating a
   randomly generated salt value.  The salt value enhances the security

Jonsson & Kaliski            Informational                     [Page 29]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   of the scheme by affording a "tighter" security proof than
   deterministic alternatives such as Full Domain Hashing (FDH); see [4]
   for discussion.  However, the randomness is not critical to security.
   In situations where random generation is not possible, a fixed value
   or a sequence number could be employed instead, with the resulting
   provable security similar to that of FDH [12].

8.1.1 Signature generation operation

   RSASSA-PSS-SIGN (K, M)

   Input:
   K        signer's RSA private key
   M        message to be signed, an octet string

   Output:
   S        signature, an octet string of length k, where k is the
            length in octets of the RSA modulus n

   Errors: "message too long;" "encoding error"

   Steps:

   1. EMSA-PSS encoding: Apply the EMSA-PSS encoding operation (Section
      9.1.1) to the message M to produce an encoded message EM of length
      \ceil ((modBits - 1)/8) octets such that the bit length of the
      integer OS2IP (EM) (see Section 4.2) is at most modBits - 1, where
      modBits is the length in bits of the RSA modulus n:

         EM = EMSA-PSS-ENCODE (M, modBits - 1).

      Note that the octet length of EM will be one less than k if
      modBits - 1 is divisible by 8 and equal to k otherwise.  If the
      encoding operation outputs "message too long," output "message too
      long" and stop.  If the encoding operation outputs "encoding
      error," output "encoding error" and stop.

   2. RSA signature:

      a. Convert the encoded message EM to an integer message
         representative m (see Section 4.2):

            m = OS2IP (EM).

Jonsson & Kaliski            Informational                     [Page 30]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      b. Apply the RSASP1 signature primitive (Section 5.2.1) to the RSA
         private key K and the message representative m to produce an
         integer signature representative s:

            s = RSASP1 (K, m).

      c. Convert the signature representative s to a signature S of
         length k octets (see Section 4.1):

            S = I2OSP (s, k).

   3. Output the signature S.

8.1.2 Signature verification operation

   RSASSA-PSS-VERIFY ((n, e), M, S)

   Input:
   (n, e)   signer's RSA public key
   M        message whose signature is to be verified, an octet string
   S        signature to be verified, an octet string of length k, where
            k is the length in octets of the RSA modulus n

   Output:
   "valid signature" or "invalid signature"

   Steps:

   1. Length checking: If the length of the signature S is not k octets,
      output "invalid signature" and stop.

   2. RSA verification:

      a. Convert the signature S to an integer signature representative
         s (see Section 4.2):

            s = OS2IP (S).

      b. Apply the RSAVP1 verification primitive (Section 5.2.2) to the
         RSA public key (n, e) and the signature representative s to
         produce an integer message representative m:

            m = RSAVP1 ((n, e), s).

         If RSAVP1 output "signature representative out of range,"
         output "invalid signature" and stop.

Jonsson & Kaliski            Informational                     [Page 31]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      c. Convert the message representative m to an encoded message EM
         of length emLen = \ceil ((modBits - 1)/8) octets, where modBits
         is the length in bits of the RSA modulus n (see Section 4.1):

            EM = I2OSP (m, emLen).

         Note that emLen will be one less than k if modBits - 1 is
         divisible by 8 and equal to k otherwise.  If I2OSP outputs
         "integer too large," output "invalid signature" and stop.

   3. EMSA-PSS verification: Apply the EMSA-PSS verification operation
      (Section 9.1.2) to the message M and the encoded message EM to
      determine whether they are consistent:

         Result = EMSA-PSS-VERIFY (M, EM, modBits - 1).

   4. If Result = "consistent," output "valid signature." Otherwise,
      output "invalid signature."

8.2. RSASSA-PKCS1-v1_5

   RSASSA-PKCS1-v1_5 combines the RSASP1 and RSAVP1 primitives with the
   EMSA-PKCS1-v1_5 encoding method.  It is compatible with the IFSSA
   scheme defined in IEEE Std 1363-2000 [26], where the signature and
   verification primitives are IFSP-RSA1 and IFVP-RSA1 and the message
   encoding method is EMSA-PKCS1-v1_5 (which is not defined in IEEE Std
   1363-2000, but is in the IEEE P1363a draft [27]).

   The length of messages on which RSASSA-PKCS1-v1_5 can operate is
   either unrestricted or constrained by a very large number, depending
   on the hash function underlying the EMSA-PKCS1-v1_5 method.

   Assuming that computing e-th roots modulo n is infeasible and the
   hash function in EMSA-PKCS1-v1_5 has appropriate properties, RSASSA-
   PKCS1-v1_5 is conjectured to provide secure signatures.  More
   precisely, forging signatures without knowing the RSA private key is
   conjectured to be computationally infeasible.  Also, in the encoding
   method EMSA-PKCS1-v1_5, a hash function identifier is embedded in the
   encoding.  Because of this feature, an adversary trying to find a
   message with the same signature as a previously signed message must
   find collisions of the particular hash function being used; attacking
   a different hash function than the one selected by the signer is not
   useful to the adversary.  See [34] for further discussion.

   Note.  As noted in PKCS #1 v1.5, the EMSA-PKCS1-v1_5 encoding method
   has the property that the encoded message, converted to an integer
   message representative, is guaranteed to be large and at least
   somewhat "random".  This prevents attacks of the kind proposed by

Jonsson & Kaliski            Informational                     [Page 32]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Desmedt and Odlyzko [16] where multiplicative relationships between
   message representatives are developed by factoring the message
   representatives into a set of small values (e.g., a set of small
   primes).  Coron, Naccache, and Stern [15] showed that a stronger form
   of this type of attack could be quite effective against some
   instances of the ISO/IEC 9796-2 signature scheme.  They also analyzed
   the complexity of this type of attack against the EMSA-PKCS1-v1_5
   encoding method and concluded that an attack would be impractical,
   requiring more operations than a collision search on the underlying
   hash function (i.e., more than 2^80 operations).  Coppersmith,
   Halevi, and Jutla [11] subsequently extended Coron et al.'s attack to
   break the ISO/IEC 9796-1 signature scheme with message recovery.  The
   various attacks illustrate the importance of carefully constructing
   the input to the RSA signature primitive, particularly in a signature
   scheme with message recovery.  Accordingly, the EMSA-PKCS-v1_5
   encoding method explicitly includes a hash operation and is not
   intended for signature schemes with message recovery.  Moreover,
   while no attack is known against the EMSA-PKCS-v1_5 encoding method,
   a gradual transition to EMSA-PSS is recommended as a precaution
   against future developments.

8.2.1 Signature generation operation

   RSASSA-PKCS1-V1_5-SIGN (K, M)

   Input:
   K        signer's RSA private key
   M        message to be signed, an octet string

   Output:
   S        signature, an octet string of length k, where k is the
            length in octets of the RSA modulus n

   Errors: "message too long"; "RSA modulus too short"

   Steps:

   1. EMSA-PKCS1-v1_5 encoding: Apply the EMSA-PKCS1-v1_5 encoding
      operation (Section 9.2) to the message M to produce an encoded
      message EM of length k octets:

         EM = EMSA-PKCS1-V1_5-ENCODE (M, k).

      If the encoding operation outputs "message too long," output
      "message too long" and stop.  If the encoding operation outputs
      "intended encoded message length too short," output "RSA modulus
      too short" and stop.

Jonsson & Kaliski            Informational                     [Page 33]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   2. RSA signature:

      a. Convert the encoded message EM to an integer message
         representative m (see Section 4.2):

            m = OS2IP (EM).

      b. Apply the RSASP1 signature primitive (Section 5.2.1) to the RSA
         private key K and the message representative m to produce an
         integer signature representative s:

            s = RSASP1 (K, m).

      c. Convert the signature representative s to a signature S of
         length k octets (see Section 4.1):

            S = I2OSP (s, k).

   3. Output the signature S.

8.2.2 Signature verification operation

   RSASSA-PKCS1-V1_5-VERIFY ((n, e), M, S)

   Input:
   (n, e)   signer's RSA public key
   M        message whose signature is to be verified, an octet string
   S        signature to be verified, an octet string of length k, where
            k is the length in octets of the RSA modulus n

   Output:
   "valid signature" or "invalid signature"

   Errors: "message too long"; "RSA modulus too short"

   Steps:

   1. Length checking: If the length of the signature S is not k octets,
      output "invalid signature" and stop.

   2. RSA verification:

      a. Convert the signature S to an integer signature representative
         s (see Section 4.2):

            s = OS2IP (S).

Jonsson & Kaliski            Informational                     [Page 34]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      b. Apply the RSAVP1 verification primitive (Section 5.2.2) to the
         RSA public key (n, e) and the signature representative s to
         produce an integer message representative m:

            m = RSAVP1 ((n, e), s).

         If RSAVP1 outputs "signature representative out of range,"
         output "invalid signature" and stop.

      c. Convert the message representative m to an encoded message EM
         of length k octets (see Section 4.1):

            EM' = I2OSP (m, k).

         If I2OSP outputs "integer too large," output "invalid
         signature" and stop.

   3. EMSA-PKCS1-v1_5 encoding: Apply the EMSA-PKCS1-v1_5 encoding
      operation (Section 9.2) to the message M to produce a second
      encoded message EM' of length k octets:

            EM' = EMSA-PKCS1-V1_5-ENCODE (M, k).

      If the encoding operation outputs "message too long," output
      "message too long" and stop.  If the encoding operation outputs
      "intended encoded message length too short," output "RSA modulus
      too short" and stop.

   4. Compare the encoded message EM and the second encoded message EM'.
      If they are the same, output "valid signature"; otherwise, output
      "invalid signature."

   Note.  Another way to implement the signature verification operation
   is to apply a "decoding" operation (not specified in this document)
   to the encoded message to recover the underlying hash value, and then
   to compare it to a newly computed hash value.  This has the advantage
   that it requires less intermediate storage (two hash values rather
   than two encoded messages), but the disadvantage that it requires
   additional code.

9. Encoding methods for signatures with appendix

   Encoding methods consist of operations that map between octet string
   messages and octet string encoded messages, which are converted to
   and from integer message representatives in the schemes.  The integer
   message representatives are processed via the primitives.  The
   encoding methods thus provide the connection between the schemes,
   which process messages, and the primitives.

Jonsson & Kaliski            Informational                     [Page 35]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   An encoding method for signatures with appendix, for the purposes of
   this document, consists of an encoding operation and optionally a
   verification operation.  An encoding operation maps a message M to an
   encoded message EM of a specified length.  A verification operation
   determines whether a message M and an encoded message EM are
   consistent, i.e., whether the encoded message EM is a valid encoding
   of the message M.

   The encoding operation may introduce some randomness, so that
   different applications of the encoding operation to the same message
   will produce different encoded messages, which has benefits for
   provable security.  For such an encoding method, both an encoding and
   a verification operation are needed unless the verifier can reproduce
   the randomness (e.g., by obtaining the salt value from the signer).
   For a deterministic encoding method only an encoding operation is
   needed.

   Two encoding methods for signatures with appendix are employed in the
   signature schemes and are specified here: EMSA-PSS and EMSA-PKCS1-
   v1_5.

9.1 EMSA-PSS

   This encoding method is parameterized by the choice of hash function,
   mask generation function, and salt length.  These options should be
   fixed for a given RSA key, except that the salt length can be
   variable (see [31] for discussion).  Suggested hash and mask
   generation functions are given in Appendix B.  The encoding method is
   based on Bellare and Rogaway's Probabilistic Signature Scheme (PSS)
   [4][5].  It is randomized and has an encoding operation and a
   verification operation.

Jonsson & Kaliski            Informational                     [Page 36]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Figure 2 illustrates the encoding operation.

   __________________________________________________________________

                                  +-----------+
                                  |     M     |
                                  +-----------+
                                        |
                                        V
                                      Hash
                                        |
                                        V
                          +--------+----------+----------+
                     M' = |Padding1|  mHash   |   salt   |
                          +--------+----------+----------+
                                         |
               +--------+----------+     V
         DB =  |Padding2|maskedseed|   Hash
               +--------+----------+     |
                         |               |
                         V               |    +--+
                        xor <--- MGF <---|    |bc|
                         |               |    +--+
                         |               |      |
                         V               V      V
               +-------------------+----------+--+
         EM =  |    maskedDB       |maskedseed|bc|
               +-------------------+----------+--+
   __________________________________________________________________

   Figure 2: EMSA-PSS encoding operation.  Verification operation
   follows reverse steps to recover salt, then forward steps to
   recompute and compare H.

   Notes.

   1. The encoding method defined here differs from the one in Bellare
      and Rogaway's submission to IEEE P1363a [5] in three respects:

      *  It applies a hash function rather than a mask generation
         function to the message.  Even though the mask generation
         function is based on a hash function, it seems more natural to
         apply a hash function directly.

      *  The value that is hashed together with the salt value is the
         string (0x)00 00 00 00 00 00 00 00 || mHash rather than the
         message M itself.  Here, mHash is the hash of M.  Note that the

Jonsson & Kaliski            Informational                     [Page 37]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

         hash function is the same in both steps.  See Note 3 below for
         further discussion.  (Also, the name "salt" is used instead of
         "seed", as it is more reflective of the value's role.)

      *  The encoded message in EMSA-PSS has nine fixed bits; the first
         bit is 0 and the last eight bits form a "trailer field", the
         octet 0xbc.  In the original scheme, only the first bit is
         fixed.  The rationale for the trailer field is for
         compatibility with the Rabin-Williams IFSP-RW signature
         primitive in IEEE Std 1363-2000 [26] and the corresponding
         primitive in the draft ISO/IEC 9796-2 [29].

   2. Assuming that the mask generation function is based on a hash
      function, it is recommended that the hash function be the same as
      the one that is applied to the message; see Section 8.1 for
      further discussion.

   3. Without compromising the security proof for RSASSA-PSS, one may
      perform steps 1 and 2 of EMSA-PSS-ENCODE and EMSA-PSS-VERIFY (the
      application of the hash function to the message) outside the
      module that computes the rest of the signature operation, so that
      mHash rather than the message M itself is input to the module.  In
      other words, the security proof for RSASSA-PSS still holds even if
      an opponent can control the value of mHash.  This is convenient if
      the module has limited I/O bandwidth, e.g., a smart card.  Note
      that previous versions of PSS [4][5] did not have this property.
      Of course, it may be desirable for other security reasons to have
      the module process the full message.  For instance, the module may
      need to "see" what it is signing if it does not trust the
      component that computes the hash value.

   4. Typical salt lengths in octets are hLen (the length of the output
      of the hash function Hash) and 0.  In both cases the security of
      RSASSA-PSS can be closely related to the hardness of inverting
      RSAVP1.  Bellare and Rogaway [4] give a tight lower bound for the
      security of the original RSA-PSS scheme, which corresponds roughly
      to the former case, while Coron [12] gives a lower bound for the
      related Full Domain Hashing scheme, which corresponds roughly to
      the latter case.  In [13] Coron provides a general treatment with
      various salt lengths ranging from 0 to hLen; see [27] for
      discussion.  See also [31], which adapts the security proofs in
      [4][13] to address the differences between the original and the
      present version of RSA-PSS as listed in Note 1 above.

   5. As noted in IEEE P1363a [27], the use of randomization in
      signature schemes - such as the salt value in EMSA-PSS - may
      provide a "covert channel" for transmitting information other than
      the message being signed.  For more on covert channels, see [50].

Jonsson & Kaliski            Informational                     [Page 38]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

9.1.1 Encoding operation

   EMSA-PSS-ENCODE (M, emBits)

   Options:

   Hash     hash function (hLen denotes the length in octets of the hash
            function output)
   MGF      mask generation function
   sLen     intended length in octets of the salt

   Input:
   M        message to be encoded, an octet string
   emBits   maximal bit length of the integer OS2IP (EM) (see Section
            4.2), at least 8hLen + 8sLen + 9

   Output:
   EM       encoded message, an octet string of length emLen = \ceil
            (emBits/8)

   Errors:  "encoding error"; "message too long"

   Steps:

   1.  If the length of M is greater than the input limitation for the
       hash function (2^61 - 1 octets for SHA-1), output "message too
       long" and stop.

   2.  Let mHash = Hash(M), an octet string of length hLen.

   3.  If emLen < hLen + sLen + 2, output "encoding error" and stop.

   4.  Generate a random octet string salt of length sLen; if sLen = 0,
       then salt is the empty string.

   5.  Let
         M' = (0x)00 00 00 00 00 00 00 00 || mHash || salt;

       M' is an octet string of length 8 + hLen + sLen with eight
       initial zero octets.

   6.  Let H = Hash(M'), an octet string of length hLen.

   7.  Generate an octet string PS consisting of emLen - sLen - hLen - 2
       zero octets.  The length of PS may be 0.

   8.  Let DB = PS || 0x01 || salt; DB is an octet string of length
       emLen - hLen - 1.

Jonsson & Kaliski            Informational                     [Page 39]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   9.  Let dbMask = MGF(H, emLen - hLen - 1).

   10. Let maskedDB = DB \xor dbMask.

   11. Set the leftmost 8emLen - emBits bits of the leftmost octet in
       maskedDB to zero.

   12. Let EM = maskedDB || H || 0xbc.

   13. Output EM.

9.1.2 Verification operation

   EMSA-PSS-VERIFY (M, EM, emBits)

   Options:
   Hash     hash function (hLen denotes the length in octets of the hash
            function output)
   MGF      mask generation function
   sLen     intended length in octets of the salt

   Input:
   M        message to be verified, an octet string
   EM       encoded message, an octet string of length emLen = \ceil
            (emBits/8)
   emBits   maximal bit length of the integer OS2IP (EM) (see Section
            4.2), at least 8hLen + 8sLen + 9

   Output:
   "consistent" or "inconsistent"

   Steps:

   1.  If the length of M is greater than the input limitation for the
       hash function (2^61 - 1 octets for SHA-1), output "inconsistent"
       and stop.

   2.  Let mHash = Hash(M), an octet string of length hLen.

   3.  If emLen < hLen + sLen + 2, output "inconsistent" and stop.

   4.  If the rightmost octet of EM does not have hexadecimal value
       0xbc, output "inconsistent" and stop.

   5.  Let maskedDB be the leftmost emLen - hLen - 1 octets of EM, and
       let H be the next hLen octets.

Jonsson & Kaliski            Informational                     [Page 40]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   6.  If the leftmost 8emLen - emBits bits of the leftmost octet in
       maskedDB are not all equal to zero, output "inconsistent" and
       stop.

   7.  Let dbMask = MGF(H, emLen - hLen - 1).

   8.  Let DB = maskedDB \xor dbMask.

   9.  Set the leftmost 8emLen - emBits bits of the leftmost octet in DB
       to zero.

   10. If the emLen - hLen - sLen - 2 leftmost octets of DB are not zero
       or if the octet at position emLen - hLen - sLen - 1 (the leftmost
       position is "position 1") does not have hexadecimal value 0x01,
       output "inconsistent" and stop.

   11.  Let salt be the last sLen octets of DB.

   12.  Let
            M' = (0x)00 00 00 00 00 00 00 00 || mHash || salt ;

       M' is an octet string of length 8 + hLen + sLen with eight
       initial zero octets.

   13. Let H' = Hash(M'), an octet string of length hLen.

   14. If H = H', output "consistent." Otherwise, output "inconsistent."

9.2 EMSA-PKCS1-v1_5

   This encoding method is deterministic and only has an encoding
   operation.

   EMSA-PKCS1-v1_5-ENCODE (M, emLen)

   Option:
   Hash     hash function (hLen denotes the length in octets of the hash
            function output)

   Input:
   M        message to be encoded
   emLen    intended length in octets of the encoded message, at least
            tLen + 11, where tLen is the octet length of the DER
            encoding T of a certain value computed during the encoding
            operation

Jonsson & Kaliski            Informational                     [Page 41]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Output:
   EM       encoded message, an octet string of length emLen

   Errors:
   "message too long"; "intended encoded message length too short"

   Steps:

   1. Apply the hash function to the message M to produce a hash value
      H:

         H = Hash(M).

      If the hash function outputs "message too long," output "message
      too long" and stop.

   2. Encode the algorithm ID for the hash function and the hash value
      into an ASN.1 value of type DigestInfo (see Appendix A.2.4) with
      the Distinguished Encoding Rules (DER), where the type DigestInfo
      has the syntax

      DigestInfo ::= SEQUENCE {
          digestAlgorithm AlgorithmIdentifier,
          digest OCTET STRING
      }

      The first field identifies the hash function and the second
      contains the hash value.  Let T be the DER encoding of the
      DigestInfo value (see the notes below) and let tLen be the length
      in octets of T.

   3. If emLen < tLen + 11, output "intended encoded message length too
      short" and stop.

   4. Generate an octet string PS consisting of emLen - tLen - 3 octets
      with hexadecimal value 0xff.  The length of PS will be at least 8
      octets.

   5. Concatenate PS, the DER encoding T, and other padding to form the
      encoded message EM as

         EM = 0x00 || 0x01 || PS || 0x00 || T.

   6. Output EM.

Jonsson & Kaliski            Informational                     [Page 42]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Notes.

   1. For the six hash functions mentioned in Appendix B.1, the DER
      encoding T of the DigestInfo value is equal to the following:

      MD2:     (0x)30 20 30 0c 06 08 2a 86 48 86 f7 0d 02 02 05 00 04
                   10 || H.
      MD5:     (0x)30 20 30 0c 06 08 2a 86 48 86 f7 0d 02 05 05 00 04
                   10 || H.
      SHA-1:   (0x)30 21 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 || H.
      SHA-256: (0x)30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00
                   04 20 || H.
      SHA-384: (0x)30 41 30 0d 06 09 60 86 48 01 65 03 04 02 02 05 00
                   04 30 || H.
      SHA-512: (0x)30 51 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00
                      04 40 || H.

   2. In version 1.5 of this document, T was defined as the BER
      encoding, rather than the DER encoding, of the DigestInfo value.
      In particular, it is possible - at least in theory - that the
      verification operation defined in this document (as well as in
      version 2.0) rejects a signature that is valid with respect to the
      specification given in PKCS #1 v1.5.  This occurs if other rules
      than DER are applied to DigestInfo (e.g., an indefinite length
      encoding of the underlying SEQUENCE type).  While this is unlikely
      to be a concern in practice, a cautious implementer may choose to
      employ a verification operation based on a BER decoding operation
      as specified in PKCS #1 v1.5.  In this manner, compatibility with
      any valid implementation based on PKCS #1 v1.5 is obtained.  Such
      a verification operation should indicate whether the underlying
      BER encoding is a DER encoding and hence whether the signature is
      valid with respect to the specification given in this document.

Jonsson & Kaliski            Informational                     [Page 43]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

Appendix A. ASN.1 syntax

A.1 RSA key representation

   This section defines ASN.1 object identifiers for RSA public and
   private keys, and defines the types RSAPublicKey and RSAPrivateKey.
   The intended application of these definitions includes X.509
   certificates, PKCS #8 [46], and PKCS #12 [47].

   The object identifier rsaEncryption identifies RSA public and private
   keys as defined in Appendices A.1.1 and A.1.2.  The parameters field
   associated with this OID in a value of type AlgorithmIdentifier shall
   have a value of type NULL.

   rsaEncryption    OBJECT IDENTIFIER ::= { pkcs-1 1 }

   The definitions in this section have been extended to support multi-
   prime RSA, but are backward compatible with previous versions.

A.1.1 RSA public key syntax

   An RSA public key should be represented with the ASN.1 type
   RSAPublicKey:

      RSAPublicKey ::= SEQUENCE {
          modulus           INTEGER,  -- n
          publicExponent    INTEGER   -- e
      }

   The fields of type RSAPublicKey have the following meanings:

    * modulus is the RSA modulus n.

    * publicExponent is the RSA public exponent e.

Jonsson & Kaliski            Informational                     [Page 44]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

A.1.2 RSA private key syntax

   An RSA private key should be represented with the ASN.1 type
   RSAPrivateKey:

      RSAPrivateKey ::= SEQUENCE {
          version           Version,
          modulus           INTEGER,  -- n
          publicExponent    INTEGER,  -- e
          privateExponent   INTEGER,  -- d
          prime1            INTEGER,  -- p
          prime2            INTEGER,  -- q
          exponent1         INTEGER,  -- d mod (p-1)
          exponent2         INTEGER,  -- d mod (q-1)
          coefficient       INTEGER,  -- (inverse of q) mod p
          otherPrimeInfos   OtherPrimeInfos OPTIONAL
      }

   The fields of type RSAPrivateKey have the following meanings:

    * version is the version number, for compatibility with future
      revisions of this document.  It shall be 0 for this version of the
      document, unless multi-prime is used, in which case it shall be 1.

            Version ::= INTEGER { two-prime(0), multi(1) }
               (CONSTRAINED BY
               {-- version must be multi if otherPrimeInfos present --})

    * modulus is the RSA modulus n.

    * publicExponent is the RSA public exponent e.

    * privateExponent is the RSA private exponent d.

    * prime1 is the prime factor p of n.

    * prime2 is the prime factor q of n.

    * exponent1 is d mod (p - 1).

    * exponent2 is d mod (q - 1).

    * coefficient is the CRT coefficient q^(-1) mod p.

    * otherPrimeInfos contains the information for the additional primes
      r_3, ..., r_u, in order.  It shall be omitted if version is 0 and
      shall contain at least one instance of OtherPrimeInfo if version
      is 1.

Jonsson & Kaliski            Informational                     [Page 45]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

         OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo

         OtherPrimeInfo ::= SEQUENCE {
             prime             INTEGER,  -- ri
             exponent          INTEGER,  -- di
             coefficient       INTEGER   -- ti
         }

   The fields of type OtherPrimeInfo have the following meanings:

    * prime is a prime factor r_i of n, where i >= 3.

    * exponent is d_i = d mod (r_i - 1).

    * coefficient is the CRT coefficient t_i = (r_1 * r_2 * ... * r_(i-
      1))^(-1) mod r_i.

   Note.  It is important to protect the RSA private key against both
   disclosure and modification.  Techniques for such protection are
   outside the scope of this document.  Methods for storing and
   distributing private keys and other cryptographic data are described
   in PKCS #12 and #15.

A.2 Scheme identification

   This section defines object identifiers for the encryption and
   signature schemes.  The schemes compatible with PKCS #1 v1.5 have the
   same definitions as in PKCS #1 v1.5.  The intended application of
   these definitions includes X.509 certificates and PKCS #7.

   Here are type identifier definitions for the PKCS #1 OIDs:

      PKCS1Algorithms    ALGORITHM-IDENTIFIER ::= {
          { OID rsaEncryption              PARAMETERS NULL } |
          { OID md2WithRSAEncryption       PARAMETERS NULL } |
          { OID md5WithRSAEncryption       PARAMETERS NULL } |
          { OID sha1WithRSAEncryption      PARAMETERS NULL } |
          { OID sha256WithRSAEncryption    PARAMETERS NULL } |
          { OID sha384WithRSAEncryption    PARAMETERS NULL } |
          { OID sha512WithRSAEncryption    PARAMETERS NULL } |
          { OID id-RSAES-OAEP PARAMETERS RSAES-OAEP-params } |
          PKCS1PSourceAlgorithms                             |
          { OID id-RSASSA-PSS PARAMETERS RSASSA-PSS-params } ,
          ...  -- Allows for future expansion --
      }

Jonsson & Kaliski            Informational                     [Page 46]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

A.2.1 RSAES-OAEP

   The object identifier id-RSAES-OAEP identifies the RSAES-OAEP
   encryption scheme.

      id-RSAES-OAEP    OBJECT IDENTIFIER ::= { pkcs-1 7 }

   The parameters field associated with this OID in a value of type
   AlgorithmIdentifier shall have a value of type RSAES-OAEP-params:

      RSAES-OAEP-params ::= SEQUENCE {
          hashAlgorithm     [0] HashAlgorithm    DEFAULT sha1,
          maskGenAlgorithm  [1] MaskGenAlgorithm DEFAULT mgf1SHA1,
          pSourceAlgorithm  [2] PSourceAlgorithm DEFAULT pSpecifiedEmpty
      }

   The fields of type RSAES-OAEP-params have the following meanings:

    * hashAlgorithm identifies the hash function.  It shall be an
      algorithm ID with an OID in the set OAEP-PSSDigestAlgorithms.
      For a discussion of supported hash functions, see Appendix B.1.

         HashAlgorithm ::= AlgorithmIdentifier {
            {OAEP-PSSDigestAlgorithms}
         }

         OAEP-PSSDigestAlgorithms    ALGORITHM-IDENTIFIER ::= {
             { OID id-sha1 PARAMETERS NULL   }|
             { OID id-sha256 PARAMETERS NULL }|
             { OID id-sha384 PARAMETERS NULL }|
             { OID id-sha512 PARAMETERS NULL },
             ...  -- Allows for future expansion --
         }

      The default hash function is SHA-1:

         sha1    HashAlgorithm ::= {
             algorithm   id-sha1,
             parameters  SHA1Parameters : NULL
         }

         SHA1Parameters ::= NULL

    * maskGenAlgorithm identifies the mask generation function.  It
      shall be an algorithm ID with an OID in the set
      PKCS1MGFAlgorithms, which for this version shall consist of
      id-mgf1, identifying the MGF1 mask generation function (see
      Appendix B.2.1).  The parameters field associated with id-mgf1

Jonsson & Kaliski            Informational                     [Page 47]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      shall be an algorithm ID with an OID in the set
      OAEP-PSSDigestAlgorithms, identifying the hash function on which
      MGF1 is based.

         MaskGenAlgorithm ::= AlgorithmIdentifier {
            {PKCS1MGFAlgorithms}
         }
         PKCS1MGFAlgorithms    ALGORITHM-IDENTIFIER ::= {
             { OID id-mgf1 PARAMETERS HashAlgorithm },
             ...  -- Allows for future expansion --
         }

      The default mask generation function is MGF1 with SHA-1:

         mgf1SHA1    MaskGenAlgorithm ::= {
             algorithm   id-mgf1,
             parameters  HashAlgorithm : sha1
         }

    * pSourceAlgorithm identifies the source (and possibly the value)
      of the label L.  It shall be an algorithm ID with an OID in the
      set PKCS1PSourceAlgorithms, which for this version shall consist
      of id-pSpecified, indicating that the label is specified
      explicitly.  The parameters field associated with id-pSpecified
      shall have a value of type OCTET STRING, containing the
      label.  In previous versions of this specification, the term
      "encoding parameters" was used rather than "label", hence the
      name of the type below.

         PSourceAlgorithm ::= AlgorithmIdentifier {
            {PKCS1PSourceAlgorithms}
         }

         PKCS1PSourceAlgorithms    ALGORITHM-IDENTIFIER ::= {
             { OID id-pSpecified PARAMETERS EncodingParameters },
             ...  -- Allows for future expansion --
         }

         id-pSpecified    OBJECT IDENTIFIER ::= { pkcs-1 9 }

         EncodingParameters ::= OCTET STRING(SIZE(0..MAX))

Jonsson & Kaliski            Informational                     [Page 48]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      The default label is an empty string (so that lHash will contain
      the hash of the empty string):

         pSpecifiedEmpty    PSourceAlgorithm ::= {
             algorithm   id-pSpecified,
             parameters  EncodingParameters : emptyString
         }

         emptyString    EncodingParameters ::= ''H

      If all of the default values of the fields in RSAES-OAEP-params
      are used, then the algorithm identifier will have the following
      value:

         rSAES-OAEP-Default-Identifier  RSAES-AlgorithmIdentifier ::= {
             algorithm   id-RSAES-OAEP,
             parameters  RSAES-OAEP-params : {
                 hashAlgorithm       sha1,
                 maskGenAlgorithm    mgf1SHA1,
                 pSourceAlgorithm    pSpecifiedEmpty
             }
         }

         RSAES-AlgorithmIdentifier ::= AlgorithmIdentifier {
            {PKCS1Algorithms}
         }

A.2.2 RSAES-PKCS1-v1_5

   The object identifier rsaEncryption (see Appendix A.1) identifies the
   RSAES-PKCS1-v1_5 encryption scheme.  The parameters field associated
   with this OID in a value of type AlgorithmIdentifier shall have a
   value of type NULL.  This is the same as in PKCS #1 v1.5.

      rsaEncryption    OBJECT IDENTIFIER ::= { pkcs-1 1 }

A.2.3 RSASSA-PSS

   The object identifier id-RSASSA-PSS identifies the RSASSA-PSS
   encryption scheme.

      id-RSASSA-PSS    OBJECT IDENTIFIER ::= { pkcs-1 10 }

Jonsson & Kaliski            Informational                     [Page 49]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   The parameters field associated with this OID in a value of type
   AlgorithmIdentifier shall have a value of type RSASSA-PSS-params:

      RSASSA-PSS-params ::= SEQUENCE {
          hashAlgorithm      [0] HashAlgorithm    DEFAULT sha1,
          maskGenAlgorithm   [1] MaskGenAlgorithm DEFAULT mgf1SHA1,
          saltLength         [2] INTEGER          DEFAULT 20,
          trailerField       [3] TrailerField     DEFAULT trailerFieldBC
      }

   The fields of type RSASSA-PSS-params have the following meanings:

    * hashAlgorithm identifies the hash function.  It shall be an
      algorithm ID with an OID in the set OAEP-PSSDigestAlgorithms (see
      Appendix A.2.1).  The default hash function is SHA-1.

    * maskGenAlgorithm identifies the mask generation function.  It
      shall be an algorithm ID with an OID in the set

      PKCS1MGFAlgorithms (see Appendix A.2.1).  The default mask
      generation function is MGF1 with SHA-1.  For MGF1 (and more
      generally, for other mask generation functions based on a hash
      function), it is recommended that the underlying hash function be
      the same as the one identified by hashAlgorithm; see Note 2 in
      Section 9.1 for further comments.

    * saltLength is the octet length of the salt.  It shall be an
      integer.  For a given hashAlgorithm, the default value of
      saltLength is the octet length of the hash value.  Unlike the
      other fields of type RSASSA-PSS-params, saltLength does not need
      to be fixed for a given RSA key pair.

    * trailerField is the trailer field number, for compatibility with
      the draft IEEE P1363a [27].  It shall be 1 for this version of the
      document, which represents the trailer field with hexadecimal
      value 0xbc.  Other trailer fields (including the trailer field
      HashID || 0xcc in IEEE P1363a) are not supported in this document.

         TrailerField ::= INTEGER { trailerFieldBC(1) }

      If the default values of the hashAlgorithm, maskGenAlgorithm, and
      trailerField fields of RSASSA-PSS-params are used, then the
      algorithm identifier will have the following value:

Jonsson & Kaliski            Informational                     [Page 50]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

         rSASSA-PSS-Default-Identifier  RSASSA-AlgorithmIdentifier ::= {
             algorithm   id-RSASSA-PSS,
             parameters  RSASSA-PSS-params : {
                 hashAlgorithm       sha1,
                 maskGenAlgorithm    mgf1SHA1,
                 saltLength          20,
                 trailerField        trailerFieldBC
             }
         }

         RSASSA-AlgorithmIdentifier ::=
             AlgorithmIdentifier { {PKCS1Algorithms} }

   Note.  In some applications, the hash function underlying a signature
   scheme is identified separately from the rest of the operations in
   the signature scheme.  For instance, in PKCS #7 [45], a hash function
   identifier is placed before the message and a "digest encryption"
   algorithm identifier (indicating the rest of the operations) is
   carried with the signature.  In order for PKCS #7 to support the
   RSASSA-PSS signature scheme, an object identifier would need to be
   defined for the operations in RSASSA-PSS after the hash function
   (analogous to the RSAEncryption OID for the RSASSA-PKCS1-v1_5
   scheme).  S/MIME CMS [25] takes a different approach.  Although a
   hash function identifier is placed before the message, an algorithm
   identifier for the full signature scheme may be carried with a CMS
   signature (this is done for DSA signatures).  Following this
   convention, the id-RSASSA-PSS OID can be used to identify RSASSA-PSS
   signatures in CMS.  Since CMS is considered the successor to PKCS #7
   and new developments such as the addition of support for RSASSA-PSS
   will be pursued with respect to CMS rather than PKCS #7, an OID for
   the "rest of" RSASSA-PSS is not defined in this version of PKCS #1.

A.2.4 RSASSA-PKCS1-v1_5

   The object identifier for RSASSA-PKCS1-v1_5 shall be one of the
   following.  The choice of OID depends on the choice of hash
   algorithm: MD2, MD5, SHA-1, SHA-256, SHA-384, or SHA-512.  Note that
   if either MD2 or MD5 is used, then the OID is just as in PKCS #1
   v1.5.  For each OID, the parameters field associated with this OID in
   a value of type AlgorithmIdentifier shall have a value of type NULL.
   The OID should be chosen in accordance with the following table:

      Hash algorithm   OID
      --------------------------------------------------------
      MD2              md2WithRSAEncryption    ::= {pkcs-1 2}
      MD5              md5WithRSAEncryption    ::= {pkcs-1 4}
      SHA-1            sha1WithRSAEncryption   ::= {pkcs-1 5}
      SHA-256          sha256WithRSAEncryption ::= {pkcs-1 11}

Jonsson & Kaliski            Informational                     [Page 51]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      SHA-384          sha384WithRSAEncryption ::= {pkcs-1 12}
      SHA-512          sha512WithRSAEncryption ::= {pkcs-1 13}

   The EMSA-PKCS1-v1_5 encoding method includes an ASN.1 value of type
   DigestInfo, where the type DigestInfo has the syntax

      DigestInfo ::= SEQUENCE {
          digestAlgorithm DigestAlgorithm,
          digest OCTET STRING
      }

   digestAlgorithm identifies the hash function and shall be an
   algorithm ID with an OID in the set PKCS1-v1-5DigestAlgorithms.  For
   a discussion of supported hash functions, see Appendix B.1.

      DigestAlgorithm ::=
          AlgorithmIdentifier { {PKCS1-v1-5DigestAlgorithms} }

      PKCS1-v1-5DigestAlgorithms    ALGORITHM-IDENTIFIER ::= {
          { OID id-md2 PARAMETERS NULL    }|
          { OID id-md5 PARAMETERS NULL    }|
          { OID id-sha1 PARAMETERS NULL   }|
          { OID id-sha256 PARAMETERS NULL }|
          { OID id-sha384 PARAMETERS NULL }|
          { OID id-sha512 PARAMETERS NULL }
      }

Appendix B. Supporting techniques

   This section gives several examples of underlying functions
   supporting the encryption schemes in Section 7 and the encoding
   methods in Section 9.  A range of techniques is given here to allow
   compatibility with existing applications as well as migration to new
   techniques.  While these supporting techniques are appropriate for
   applications to implement, none of them is required to be
   implemented.  It is expected that profiles for PKCS #1 v2.1 will be
   developed that specify particular supporting techniques.

   This section also gives object identifiers for the supporting
   techniques.

B.1 Hash functions

   Hash functions are used in the operations contained in Sections 7 and
   9.  Hash functions are deterministic, meaning that the output is
   completely determined by the input.  Hash functions take octet
   strings of variable length, and generate fixed length octet strings.

Jonsson & Kaliski            Informational                     [Page 52]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   The hash functions used in the operations contained in Sections 7 and
   9 should generally be collision-resistant.  This means that it is
   infeasible to find two distinct inputs to the hash function that
   produce the same output.  A collision-resistant hash function also
   has the desirable property of being one-way; this means that given an
   output, it is infeasible to find an input whose hash is the specified
   output.  In addition to the requirements, the hash function should
   yield a mask generation function (Appendix B.2) with pseudorandom
   output.

   Six hash functions are given as examples for the encoding methods in
   this document: MD2 [33], MD5 [41], SHA-1 [38], and the proposed
   algorithms SHA-256, SHA-384, and SHA-512 [39].  For the RSAES-OAEP
   encryption scheme and EMSA-PSS encoding method, only SHA-1 and SHA-
   256/384/512 are recommended.  For the EMSA-PKCS1-v1_5 encoding
   method, SHA-1 or SHA-256/384/512 are recommended for new
   applications.  MD2 and MD5 are recommended only for compatibility
   with existing applications based on PKCS #1 v1.5.

   The object identifiers id-md2, id-md5, id-sha1, id-sha256, id-sha384,
   and id-sha512, identify the respective hash functions:

      id-md2      OBJECT IDENTIFIER ::= {
          iso(1) member-body(2) us(840) rsadsi(113549)
          digestAlgorithm(2) 2
      }

      id-md5      OBJECT IDENTIFIER ::= {
          iso(1) member-body(2) us(840) rsadsi(113549)
          digestAlgorithm(2) 5
      }

      id-sha1    OBJECT IDENTIFIER ::= {
          iso(1) identified-organization(3) oiw(14) secsig(3)
          algorithms(2) 26
      }

      id-sha256    OBJECT IDENTIFIER ::= {
          joint-iso-itu-t(2) country(16) us(840) organization(1)
          gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1
      }

      id-sha384    OBJECT IDENTIFIER ::= {
          joint-iso-itu-t(2) country(16) us(840) organization(1)
          gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2
      }

Jonsson & Kaliski            Informational                     [Page 53]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

      id-sha512    OBJECT IDENTIFIER ::= {
          joint-iso-itu-t(2) country(16) us(840) organization(1)
          gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3
      }

   The parameters field associated with id-md2 and id-md5 in a value of
   type AlgorithmIdentifier shall have a value of type NULL.

   The parameters field associated with id-sha1, id-sha256, id-sha384,
   and id-sha512 should be omitted, but if present, shall have a value
   of type NULL.

   Note.  Version 1.5 of PKCS #1 also allowed for the use of MD4 in
   signature schemes.  The cryptanalysis of MD4 has progressed
   significantly in the intervening years.  For example, Dobbertin [18]
   demonstrated how to find collisions for MD4 and that the first two
   rounds of MD4 are not one-way [20].  Because of these results and
   others (e.g., [8]), MD4 is no longer recommended.  There have also
   been advances in the cryptanalysis of MD2 and MD5, although not
   enough to warrant removal from existing applications.  Rogier and
   Chauvaud [43] demonstrated how to find collisions in a modified
   version of MD2.  No one has demonstrated how to find collisions for
   the full MD5 algorithm, although partial results have been found
   (e.g., [9][19]).

   To address these concerns, SHA-1, SHA-256, SHA-384, or SHA-512 are
   recommended for new applications.  As of today, the best (known)
   collision attacks against these hash functions are generic attacks
   with complexity 2^(L/2), where L is the bit length of the hash
   output.  For the signature schemes in this document, a collision
   attack is easily translated into a signature forgery.  Therefore, the
   value L / 2 should be at least equal to the desired security level in
   bits of the signature scheme (a security level of B bits means that
   the best attack has complexity 2^B).  The same rule of thumb can be
   applied to RSAES-OAEP; it is recommended that the bit length of the
   seed (which is equal to the bit length of the hash output) be twice
   the desired security level in bits.

B.2 Mask generation functions

   A mask generation function takes an octet string of variable length
   and a desired output length as input, and outputs an octet string of
   the desired length.  There may be restrictions on the length of the
   input and output octet strings, but such bounds are generally very
   large.  Mask generation functions are deterministic; the octet string
   output is completely determined by the input octet string.  The
   output of a mask generation function should be pseudorandom: Given
   one part of the output but not the input, it should be infeasible to

Jonsson & Kaliski            Informational                     [Page 54]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   predict another part of the output.  The provable security of RSAES-
   OAEP and RSASSA-PSS relies on the random nature of the output of the
   mask generation function, which in turn relies on the random nature
   of the underlying hash.

   One mask generation function is given here: MGF1, which is based on a
   hash function.  MGF1 coincides with the mask generation functions
   defined in IEEE Std 1363-2000 [26] and the draft ANSI X9.44 [1].
   Future versions of this document may define other mask generation
   functions.

B.2.1 MGF1

   MGF1 is a Mask Generation Function based on a hash function.

   MGF1 (mgfSeed, maskLen)

   Options:
   Hash     hash function (hLen denotes the length in octets of the hash
            function output)

   Input:
   mgfSeed  seed from which mask is generated, an octet string
   maskLen  intended length in octets of the mask, at most 2^32 hLen

   Output:
   mask     mask, an octet string of length maskLen

   Error:   "mask too long"

   Steps:

   1. If maskLen > 2^32 hLen, output "mask too long" and stop.

   2. Let T be the empty octet string.

   3. For counter from 0 to \ceil (maskLen / hLen) - 1, do the
      following:

      a. Convert counter to an octet string C of length 4 octets (see
         Section 4.1):

            C = I2OSP (counter, 4) .

      b. Concatenate the hash of the seed mgfSeed and C to the octet
         string T:

            T = T || Hash(mgfSeed || C) .

Jonsson & Kaliski            Informational                     [Page 55]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   4. Output the leading maskLen octets of T as the octet string mask.

   The object identifier id-mgf1 identifies the MGF1 mask generation
   function:

   id-mgf1    OBJECT IDENTIFIER ::= { pkcs-1 8 }

   The parameters field associated with this OID in a value of type
   AlgorithmIdentifier shall have a value of type hashAlgorithm,
   identifying the hash function on which MGF1 is based.

Appendix C. ASN.1 module

PKCS-1 {
    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-1(1)
    modules(0) pkcs-1(1)
}

-- $ Revision: 2.1r1 $

-- This module has been checked for conformance with the ASN.1
-- standard by the OSS ASN.1 Tools

DEFINITIONS EXPLICIT TAGS ::=

BEGIN

-- EXPORTS ALL
-- All types and values defined in this module are exported for use
-- in other ASN.1 modules.

IMPORTS

id-sha256, id-sha384, id-sha512
    FROM NIST-SHA2 {
        joint-iso-itu-t(2) country(16) us(840) organization(1)
        gov(101) csor(3) nistalgorithm(4) modules(0) sha2(1)
    };

-- ============================
--   Basic object identifiers
-- ============================

-- The DER encoding of this in hexadecimal is:
-- (0x)06 08
--        2A 86 48 86 F7 0D 01 01
--
pkcs-1    OBJECT IDENTIFIER ::= {

Jonsson & Kaliski            Informational                     [Page 56]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

    iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1
}

--
-- When rsaEncryption is used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be NULL.
--
rsaEncryption    OBJECT IDENTIFIER ::= { pkcs-1 1 }

--
-- When id-RSAES-OAEP is used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be RSAES-OAEP-params.
--
id-RSAES-OAEP    OBJECT IDENTIFIER ::= { pkcs-1 7 }

--
-- When id-pSpecified is used in an AlgorithmIdentifier the
-- parameters MUST be an OCTET STRING.
--
id-pSpecified    OBJECT IDENTIFIER ::= { pkcs-1 9 }

-- When id-RSASSA-PSS is used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be RSASSA-PSS-params.
--
id-RSASSA-PSS    OBJECT IDENTIFIER ::= { pkcs-1 10 }

--
-- When the following OIDs are used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be NULL.
--
md2WithRSAEncryption       OBJECT IDENTIFIER ::= { pkcs-1 2 }
md5WithRSAEncryption       OBJECT IDENTIFIER ::= { pkcs-1 4 }
sha1WithRSAEncryption      OBJECT IDENTIFIER ::= { pkcs-1 5 }
sha256WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 11 }
sha384WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 12 }
sha512WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 13 }

--
-- This OID really belongs in a module with the secsig OIDs.
--
id-sha1    OBJECT IDENTIFIER ::= {
    iso(1) identified-organization(3) oiw(14) secsig(3)
    algorithms(2) 26
}

--
-- OIDs for MD2 and MD5, allowed only in EMSA-PKCS1-v1_5.
--

Jonsson & Kaliski            Informational                     [Page 57]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

id-md2 OBJECT IDENTIFIER ::= {
    iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 2
}

id-md5 OBJECT IDENTIFIER ::= {
    iso(1) member-body(2) us(840) rsadsi(113549) digestAlgorithm(2) 5
}

--
-- When id-mgf1 is used in an AlgorithmIdentifier the parameters MUST
-- be present and MUST be a HashAlgorithm, for example sha1.
--
id-mgf1    OBJECT IDENTIFIER ::= { pkcs-1 8 }

-- ================
--   Useful types
-- ================

ALGORITHM-IDENTIFIER ::= CLASS {
    &id    OBJECT IDENTIFIER  UNIQUE,
    &Type  OPTIONAL
}
    WITH SYNTAX { OID &id [PARAMETERS &Type] }

--
-- Note: the parameter InfoObjectSet in the following definitions
-- allows a distinct information object set to be specified for sets
-- of algorithms such as:
-- DigestAlgorithms    ALGORITHM-IDENTIFIER ::= {
--     { OID id-md2  PARAMETERS NULL }|
--     { OID id-md5  PARAMETERS NULL }|
--     { OID id-sha1 PARAMETERS NULL }
-- }
--

AlgorithmIdentifier { ALGORITHM-IDENTIFIER:InfoObjectSet } ::=
SEQUENCE {
    algorithm  ALGORITHM-IDENTIFIER.&id({InfoObjectSet}),
    parameters
        ALGORITHM-IDENTIFIER.&Type({InfoObjectSet}{@.algorithm})
            OPTIONAL
}

-- ==============
--   Algorithms
-- ==============

--

Jonsson & Kaliski            Informational                     [Page 58]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

-- Allowed EME-OAEP and EMSA-PSS digest algorithms.
--
OAEP-PSSDigestAlgorithms    ALGORITHM-IDENTIFIER ::= {
    { OID id-sha1 PARAMETERS NULL   }|
    { OID id-sha256 PARAMETERS NULL }|
    { OID id-sha384 PARAMETERS NULL }|
    { OID id-sha512 PARAMETERS NULL },
    ...  -- Allows for future expansion --
}

--
-- Allowed EMSA-PKCS1-v1_5 digest algorithms.
--
PKCS1-v1-5DigestAlgorithms    ALGORITHM-IDENTIFIER ::= {
    { OID id-md2 PARAMETERS NULL    }|
    { OID id-md5 PARAMETERS NULL    }|
    { OID id-sha1 PARAMETERS NULL   }|
    { OID id-sha256 PARAMETERS NULL }|
    { OID id-sha384 PARAMETERS NULL }|
    { OID id-sha512 PARAMETERS NULL }
}

-- When id-md2 and id-md5 are used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be NULL.

-- When id-sha1, id-sha256, id-sha384 and id-sha512 are used in an
-- AlgorithmIdentifier the parameters (which are optional) SHOULD
-- be omitted. However, an implementation MUST also accept
-- AlgorithmIdentifier values where the parameters are NULL.

sha1    HashAlgorithm ::= {
    algorithm   id-sha1,
    parameters  SHA1Parameters : NULL  -- included for compatibility
                                       -- with existing implementations
}

HashAlgorithm ::= AlgorithmIdentifier { {OAEP-PSSDigestAlgorithms} }

SHA1Parameters ::= NULL

--
-- Allowed mask generation function algorithms.
-- If the identifier is id-mgf1, the parameters are a HashAlgorithm.
--
PKCS1MGFAlgorithms    ALGORITHM-IDENTIFIER ::= {
    { OID id-mgf1 PARAMETERS HashAlgorithm },
    ...  -- Allows for future expansion --
}

Jonsson & Kaliski            Informational                     [Page 59]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

--
-- Default AlgorithmIdentifier for id-RSAES-OAEP.maskGenAlgorithm and
-- id-RSASSA-PSS.maskGenAlgorithm.
--
mgf1SHA1    MaskGenAlgorithm ::= {
    algorithm   id-mgf1,
    parameters  HashAlgorithm : sha1
}

MaskGenAlgorithm ::= AlgorithmIdentifier { {PKCS1MGFAlgorithms} }

--
-- Allowed algorithms for pSourceAlgorithm.
--
PKCS1PSourceAlgorithms    ALGORITHM-IDENTIFIER ::= {
    { OID id-pSpecified PARAMETERS EncodingParameters },
    ...  -- Allows for future expansion --
}

EncodingParameters ::= OCTET STRING(SIZE(0..MAX))

--
-- This identifier means that the label L is an empty string, so the
-- digest of the empty string appears in the RSA block before
-- masking.
--
pSpecifiedEmpty    PSourceAlgorithm ::= {
    algorithm   id-pSpecified,
    parameters  EncodingParameters : emptyString
}

PSourceAlgorithm ::= AlgorithmIdentifier { {PKCS1PSourceAlgorithms} }

emptyString    EncodingParameters ::= ''H

--
-- Type identifier definitions for the PKCS #1 OIDs.
--
PKCS1Algorithms    ALGORITHM-IDENTIFIER ::= {
    { OID rsaEncryption              PARAMETERS NULL } |
    { OID md2WithRSAEncryption       PARAMETERS NULL } |
    { OID md5WithRSAEncryption       PARAMETERS NULL } |
    { OID sha1WithRSAEncryption      PARAMETERS NULL } |
    { OID sha256WithRSAEncryption    PARAMETERS NULL } |
    { OID sha384WithRSAEncryption    PARAMETERS NULL } |
    { OID sha512WithRSAEncryption    PARAMETERS NULL } |
    { OID id-RSAES-OAEP PARAMETERS RSAES-OAEP-params } |
    PKCS1PSourceAlgorithms                             |

Jonsson & Kaliski            Informational                     [Page 60]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

    { OID id-RSASSA-PSS PARAMETERS RSASSA-PSS-params } ,
    ...  -- Allows for future expansion --
}

-- ===================
--   Main structures
-- ===================

RSAPublicKey ::= SEQUENCE {
    modulus           INTEGER,  -- n
    publicExponent    INTEGER   -- e
}

--
-- Representation of RSA private key with information for the CRT
-- algorithm.
--
RSAPrivateKey ::= SEQUENCE {
    version           Version,
    modulus           INTEGER,  -- n
    publicExponent    INTEGER,  -- e
    privateExponent   INTEGER,  -- d
    prime1            INTEGER,  -- p
    prime2            INTEGER,  -- q
    exponent1         INTEGER,  -- d mod (p-1)
    exponent2         INTEGER,  -- d mod (q-1)
    coefficient       INTEGER,  -- (inverse of q) mod p
    otherPrimeInfos   OtherPrimeInfos OPTIONAL
}

Version ::= INTEGER { two-prime(0), multi(1) }
    (CONSTRAINED BY {
        -- version must be multi if otherPrimeInfos present --
    })

OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo

OtherPrimeInfo ::= SEQUENCE {
    prime             INTEGER,  -- ri
    exponent          INTEGER,  -- di
    coefficient       INTEGER   -- ti
}

--
-- AlgorithmIdentifier.parameters for id-RSAES-OAEP.
-- Note that the tags in this Sequence are explicit.
--
RSAES-OAEP-params ::= SEQUENCE {

Jonsson & Kaliski            Informational                     [Page 61]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

    hashAlgorithm      [0] HashAlgorithm     DEFAULT sha1,
    maskGenAlgorithm   [1] MaskGenAlgorithm  DEFAULT mgf1SHA1,
    pSourceAlgorithm   [2] PSourceAlgorithm  DEFAULT pSpecifiedEmpty
}

--
-- Identifier for default RSAES-OAEP algorithm identifier.
-- The DER Encoding of this is in hexadecimal:
-- (0x)30 0D
--        06 09
--           2A 86 48 86 F7 0D 01 01 07
--        30 00
-- Notice that the DER encoding of default values is "empty".
--

rSAES-OAEP-Default-Identifier    RSAES-AlgorithmIdentifier ::= {
    algorithm   id-RSAES-OAEP,
    parameters  RSAES-OAEP-params : {
        hashAlgorithm       sha1,
        maskGenAlgorithm    mgf1SHA1,
        pSourceAlgorithm    pSpecifiedEmpty
    }
}

RSAES-AlgorithmIdentifier ::=
    AlgorithmIdentifier { {PKCS1Algorithms} }

--
-- AlgorithmIdentifier.parameters for id-RSASSA-PSS.
-- Note that the tags in this Sequence are explicit.
--
RSASSA-PSS-params ::= SEQUENCE {
    hashAlgorithm      [0] HashAlgorithm      DEFAULT sha1,
    maskGenAlgorithm   [1] MaskGenAlgorithm   DEFAULT mgf1SHA1,
    saltLength         [2] INTEGER            DEFAULT 20,
    trailerField       [3] TrailerField       DEFAULT trailerFieldBC
}

TrailerField ::= INTEGER { trailerFieldBC(1) }

--
-- Identifier for default RSASSA-PSS algorithm identifier
-- The DER Encoding of this is in hexadecimal:
-- (0x)30 0D
--        06 09
--           2A 86 48 86 F7 0D 01 01 0A
--        30 00
-- Notice that the DER encoding of default values is "empty".

Jonsson & Kaliski            Informational                     [Page 62]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

--
rSASSA-PSS-Default-Identifier    RSASSA-AlgorithmIdentifier ::= {
    algorithm   id-RSASSA-PSS,
    parameters  RSASSA-PSS-params : {
        hashAlgorithm       sha1,
        maskGenAlgorithm    mgf1SHA1,
        saltLength          20,
        trailerField        trailerFieldBC
    }
}

RSASSA-AlgorithmIdentifier ::=
    AlgorithmIdentifier { {PKCS1Algorithms} }

--
-- Syntax for the EMSA-PKCS1-v1_5 hash identifier.
--
DigestInfo ::= SEQUENCE {
    digestAlgorithm DigestAlgorithm,
    digest OCTET STRING
}

DigestAlgorithm ::=
    AlgorithmIdentifier { {PKCS1-v1-5DigestAlgorithms} }

END  -- PKCS1Definitions

Appendix D. Intellectual Property Considerations

   The RSA public-key cryptosystem is described in U.S. Patent
   4,405,829, which expired on September 20, 2000.  RSA Security Inc.
   makes no other patent claims on the constructions described in this
   document, although specific underlying techniques may be covered.

   Multi-prime RSA is described in U.S. Patent 5,848,159.

   The University of California has indicated that it has a patent
   pending on the PSS signature scheme [5].  It has also provided a
   letter to the IEEE P1363 working group stating that if the PSS
   signature scheme is included in an IEEE standard, "the University of
   California will, when that standard is adopted, FREELY license any
   conforming implementation of PSS as a technique for achieving a
   digital signature with appendix" [23].  The PSS signature scheme is
   specified in the IEEE P1363a draft [27], which was in ballot
   resolution when this document was published.

Jonsson & Kaliski            Informational                     [Page 63]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   License to copy this document is granted provided that it is
   identified as "RSA Security Inc.  Public-Key Cryptography Standards
   (PKCS)" in all material mentioning or referencing this document.

   RSA Security Inc. makes no other representations regarding
   intellectual property claims by other parties.  Such determination is
   the responsibility of the user.

Appendix E. Revision history

   Versions 1.0 - 1.3

      Versions 1.0 - 1.3 were distributed to participants in RSA Data
      Security, Inc.'s Public-Key Cryptography Standards meetings in
      February and March 1991.

   Version 1.4

      Version 1.4 was part of the June 3, 1991 initial public release of
      PKCS.  Version 1.4 was published as NIST/OSI Implementors'
      Workshop document SEC-SIG-91-18.

   Version 1.5

      Version 1.5 incorporated several editorial changes, including
      updates to the references and the addition of a revision history.
      The following substantive changes were made:

      -  Section 10: "MD4 with RSA" signature and verification processes
         were added.
      -  Section 11: md4WithRSAEncryption object identifier was added.

      Version 1.5 was republished as IETF RFC 2313.

   Version 2.0

      Version 2.0 incorporated major editorial changes in terms of the
      document structure and introduced the RSAES-OAEP encryption
      scheme.  This version continued to support the encryption and
      signature processes in version 1.5, although the hash algorithm
      MD4 was no longer allowed due to cryptanalytic advances in the
      intervening years.  Version 2.0 was republished as IETF RFC 2437
      [35].

Jonsson & Kaliski            Informational                     [Page 64]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   Version 2.1

      Version 2.1 introduces multi-prime RSA and the RSASSA-PSS
      signature scheme with appendix along with several editorial
      improvements.  This version continues to support the schemes in
      version 2.0.

Appendix F: References

   [1]   ANSI X9F1 Working Group.  ANSI X9.44 Draft D2: Key
         Establishment Using Integer Factorization Cryptography.
         Working Draft, March 2002.

   [2]   M. Bellare, A. Desai, D. Pointcheval and P. Rogaway.  Relations
         Among Notions of Security for Public-Key Encryption Schemes.
         In H. Krawczyk, editor, Advances in Cryptology - Crypto '98,
         volume 1462 of Lecture Notes in Computer Science, pp. 26 - 45.
         Springer Verlag, 1998.

   [3]   M. Bellare and P. Rogaway.  Optimal Asymmetric Encryption - How
         to Encrypt with RSA.  In A. De Santis, editor, Advances in
         Cryptology - Eurocrypt '94, volume 950 of Lecture Notes in
         Computer Science, pp. 92 - 111.  Springer Verlag, 1995.

   [4]   M. Bellare and P. Rogaway.  The Exact Security of Digital
         Signatures - How to Sign with RSA and Rabin.  In U. Maurer,
         editor, Advances in Cryptology - Eurocrypt '96, volume 1070 of
         Lecture Notes in Computer Science, pp. 399 - 416.  Springer
         Verlag, 1996.

   [5]   M. Bellare and P. Rogaway.  PSS: Provably Secure Encoding
         Method for Digital Signatures.  Submission to IEEE P1363
         working group, August 1998.  Available from
         http://grouper.ieee.org/groups/1363/.

   [6]   D. Bleichenbacher.  Chosen Ciphertext Attacks Against Protocols
         Based on the RSA Encryption Standard PKCS #1.  In H. Krawczyk,
         editor, Advances in Cryptology - Crypto '98, volume 1462 of
         Lecture Notes in Computer Science, pp. 1 - 12.  Springer
         Verlag, 1998.

   [7]   D. Bleichenbacher, B. Kaliski and J. Staddon.  Recent Results
         on PKCS #1: RSA Encryption Standard.  RSA Laboratories'
         Bulletin No. 7, June 1998.

Jonsson & Kaliski            Informational                     [Page 65]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   [8]   B. den Boer and A. Bosselaers.  An Attack on the Last Two
         Rounds of MD4.  In J.  Feigenbaum, editor, Advances in
         Cryptology - Crypto '91, volume 576 of Lecture Notes in
         Computer Science, pp. 194 - 203.  Springer Verlag, 1992.

   [9]   B. den Boer and A. Bosselaers.  Collisions for the Compression
         Function of MD5.  In T. Helleseth, editor, Advances in
         Cryptology - Eurocrypt '93, volume 765 of Lecture Notes in
         Computer Science, pp. 293 - 304.  Springer Verlag, 1994.

   [10]  D. Coppersmith, M. Franklin, J. Patarin and M. Reiter.  Low-
         Exponent RSA with Related Messages.  In U. Maurer, editor,
         Advances in Cryptology - Eurocrypt '96, volume 1070 of Lecture
         Notes in Computer Science, pp. 1 - 9.  Springer Verlag, 1996.

   [11]  D. Coppersmith, S. Halevi and C. Jutla.  ISO 9796-1 and the New
         Forgery Strategy.  Presented at the rump session of Crypto '99,
         August 1999.

   [12]  J.-S. Coron.  On the Exact Security of Full Domain Hashing.  In
         M. Bellare, editor, Advances in Cryptology - Crypto 2000,
         volume 1880 of Lecture Notes in Computer Science, pp. 229 -
         235.  Springer Verlag, 2000.

   [13]  J.-S. Coron.  Optimal Security Proofs for PSS and Other
         Signature Schemes.   In L. Knudsen, editor, Advances in
         Cryptology - Eurocrypt 2002, volume 2332 of Lecture Notes in
         Computer Science, pp. 272 - 287.  Springer Verlag, 2002.

   [14]  J.-S. Coron, M. Joye, D. Naccache and P. Paillier.  New Attacks
         on PKCS #1 v1.5 Encryption.  In B. Preneel, editor, Advances in
         Cryptology - Eurocrypt 2000, volume 1807 of Lecture Notes in
         Computer Science, pp. 369 - 379.  Springer Verlag, 2000.

   [15]  J.-S. Coron, D. Naccache and J. P. Stern.  On the Security of
         RSA Padding.  In M. Wiener, editor, Advances in Cryptology -
         Crypto '99, volume 1666 of Lecture Notes in Computer Science,
         pp. 1 - 18.  Springer Verlag, 1999.

   [16]  Y. Desmedt and A.M. Odlyzko.  A Chosen Text Attack on the RSA
         Cryptosystem and Some Discrete Logarithm Schemes.  In H.C.
         Williams, editor, Advances in Cryptology - Crypto '85, volume
         218 of Lecture Notes in Computer Science, pp. 516 - 522.
         Springer Verlag, 1986.

   [17]  Dierks, T. and C. Allen, "The TLS Protocol, Version 1.0", RFC
         2246, January 1999.

Jonsson & Kaliski            Informational                     [Page 66]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   [18]  H. Dobbertin.  Cryptanalysis of MD4.  In D. Gollmann, editor,
         Fast Software Encryption '96, volume 1039 of Lecture Notes in
         Computer Science, pp. 55 - 72.  Springer Verlag, 1996.

   [19]  H. Dobbertin.  Cryptanalysis of MD5 Compress.  Presented at the
         rump session of Eurocrypt '96, May 1996.

   [20]  H. Dobbertin.  The First Two Rounds of MD4 are Not One-Way.  In
         S. Vaudenay, editor, Fast Software Encryption '98, volume 1372
         in Lecture Notes in Computer Science, pp. 284 - 292.  Springer
         Verlag, 1998.

   [21]  E. Fujisaki, T. Okamoto, D. Pointcheval and J. Stern.  RSA-OAEP
         is Secure under the RSA Assumption.  In J. Kilian, editor,
         Advances in Cryptology - Crypto 2001, volume 2139 of Lecture
         Notes in Computer Science, pp. 260 - 274.  Springer Verlag,
         2001.

   [22]  H. Garner.  The Residue Number System.  IRE Transactions on
         Electronic Computers, EC-8 (6), pp. 140 - 147, June 1959.

   [23]  M.L. Grell.  Re: Encoding Methods PSS/PSS-R.  Letter to IEEE
         P1363 working group, University of California, June 15, 1999.
         Available from
         http://grouper.ieee.org/groups/1363/P1363/patents.html.

   [24]  J. Haastad.  Solving Simultaneous Modular Equations of Low
         Degree.  SIAM Journal of Computing, volume 17, pp. 336 - 341,
         1988.

   [25]  Housley, R., "Cryptographic Message Syntax (CMS)", RFC 3369,
         August 2002.  Housley, R., "Cryptographic Message Syntax (CMS)
         Algorithms", RFC 3370, August 2002.

   [26]  IEEE Std 1363-2000: Standard Specifications for Public Key
         Cryptography.  IEEE, August 2000.

   [27]  IEEE P1363 working group.  IEEE P1363a D11: Draft Standard
         Specifications for Public Key Cryptography -- Amendment 1:
         Additional Techniques. December 16, 2002.  Available from
         http://grouper.ieee.org/groups/1363/.

   [28]  ISO/IEC 9594-8:1997: Information technology - Open Systems
         Interconnection - The Directory: Authentication Framework.
         1997.

Jonsson & Kaliski            Informational                     [Page 67]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   [29]  ISO/IEC FDIS 9796-2: Information Technology - Security
         Techniques - Digital Signature Schemes Giving Message Recovery
         - Part 2: Integer Factorization Based Mechanisms.  Final Draft
         International Standard, December 2001.

   [30]  ISO/IEC 18033-2: Information Technology - Security Techniques -
         Encryption Algorithms - Part 2: Asymmetric Ciphers.  V. Shoup,
         editor, Text for 2nd Working Draft, January 2002.

   [31]  J. Jonsson.  Security Proof for the RSA-PSS Signature Scheme
         (extended abstract).  Second Open NESSIE Workshop.  September
         2001.  Full version available from
         http://eprint.iacr.org/2001/053/.

   [32]  J. Jonsson and B. Kaliski.  On the Security of RSA Encryption
         in TLS.  In M. Yung, editor, Advances in Cryptology - CRYPTO
         2002, vol. 2442 of Lecture Notes in Computer Science, pp. 127 -
         142.  Springer Verlag, 2002.

   [33]  Kaliski, B., "The MD2 Message-Digest Algorithm", RFC 1319,
         April 1992.

   [34]  B. Kaliski.  On Hash Function Identification in Signature
         Schemes.  In B. Preneel, editor, RSA Conference 2002,
         Cryptographers' Track, volume 2271 of Lecture Notes in Computer
         Science, pp. 1 - 16.  Springer Verlag, 2002.

   [35]  Kaliski, B. and J. Staddon, "PKCS #1: RSA Cryptography
         Specifications Version 2.0", RFC 2437, October 1998.

   [36]  J. Manger.  A Chosen Ciphertext Attack on RSA Optimal
         Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1
         v2.0. In J. Kilian, editor, Advances in Cryptology - Crypto
         2001, volume 2139 of Lecture Notes in Computer Science, pp. 260
         - 274.  Springer Verlag, 2001.

   [37]  A. Menezes, P. van Oorschot and S. Vanstone.  Handbook of
         Applied Cryptography.  CRC Press, 1996.

   [38]  National Institute of Standards and Technology (NIST).  FIPS
         Publication 180-1: Secure Hash Standard.  April 1994.

   [39]  National Institute of Standards and Technology (NIST).  Draft
         FIPS 180-2: Secure Hash Standard.  Draft, May 2001.  Available
         from http://www.nist.gov/sha/.

Jonsson & Kaliski            Informational                     [Page 68]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

   [40]  J.-J. Quisquater and C. Couvreur.  Fast Decipherment Algorithm
         for RSA Public-Key Cryptosystem.  Electronics Letters, 18 (21),
         pp. 905 - 907, October 1982.

   [41]  Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April
         1992.

   [42]  R. Rivest, A. Shamir and L. Adleman.  A Method for Obtaining
         Digital Signatures and Public-Key Cryptosystems.
         Communications of the ACM, 21 (2), pp. 120-126, February 1978.

   [43]  N. Rogier and P. Chauvaud.  The Compression Function of MD2 is
         not Collision Free.  Presented at Selected Areas of
         Cryptography '95.  Carleton University, Ottawa, Canada.  May
         1995.

   [44]  RSA Laboratories.  PKCS #1 v2.0: RSA Encryption Standard.
         October 1998.

   [45]  RSA Laboratories.  PKCS #7 v1.5: Cryptographic Message Syntax
         Standard.  November 1993.  (Republished as IETF RFC 2315.)

   [46]  RSA Laboratories.  PKCS #8 v1.2: Private-Key Information Syntax
         Standard.  November 1993.

   [47]  RSA Laboratories.  PKCS #12 v1.0: Personal Information Exchange
         Syntax Standard.  June 1999.

   [48]  V. Shoup.  OAEP Reconsidered.  In J. Kilian, editor, Advances
         in Cryptology - Crypto 2001, volume 2139 of Lecture Notes in
         Computer Science, pp. 239 - 259.  Springer Verlag, 2001.

   [49]  R. D. Silverman.  A Cost-Based Security Analysis of Symmetric
         and Asymmetric Key Lengths.  RSA Laboratories Bulletin No. 13,
         April 2000.  Available from
         http://www.rsasecurity.com.rsalabs/bulletins/.

   [50]  G. J. Simmons.  Subliminal communication is easy using the DSA.
         In T. Helleseth, editor, Advances in Cryptology - Eurocrypt
         '93, volume 765 of Lecture Notes in Computer Science, pp. 218-
         232.  Springer-Verlag, 1993.

Jonsson & Kaliski            Informational                     [Page 69]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

Appendix G: About PKCS

   The Public-Key Cryptography Standards are specifications produced by
   RSA Laboratories in cooperation with secure systems developers
   worldwide for the purpose of accelerating the deployment of
   public-key cryptography.  First published in 1991 as a result of
   meetings with a small group of early adopters of public-key
   technology, the PKCS documents have become widely referenced and
   implemented.  Contributions from the PKCS series have become part of
   many formal and de facto standards, including ANSI X9 and IEEE P1363
   documents, PKIX, SET, S/MIME, SSL/TLS, and WAP/WTLS.

   Further development of PKCS occurs through mailing list discussions
   and occasional workshops, and suggestions for improvement are
   welcome.  For more information, contact:

      PKCS Editor
      RSA Laboratories
      174 Middlesex Turnpike
      Bedford, MA  01730 USA
      pkcs-editor@rsasecurity.com
      http://www.rsasecurity.com/rsalabs/pkcs

Appendix H: Corrections Made During RFC Publication Process

   The following corrections were made in converting the PKCS #1 v2.1
   document to this RFC:

   *  The requirement that the parameters in an AlgorithmIdentifier
      value for id-sha1, id-sha256, id-sha384, and id-sha512 be NULL was
      changed to a recommendation that the parameters be omitted (while
      still allowing the parameters to be NULL). This is to align with
      the definitions originally promulgated by NIST. Implementations
      MUST accept AlgorithmIdentifier values both without parameters and
      with NULL parameters.

   *  The notes after RSADP and RSASP1 (Secs. 5.1.2 and 5.2.1) were
      corrected to refer to step 2.b rather than 2.a.

   *  References [25], [27] and [32] were updated to reflect new
      publication data.

   These corrections will be reflected in future editions of PKCS #1
   v2.1.

Security Considerations

   Security issues are discussed throughout this memo.

Jonsson & Kaliski            Informational                     [Page 70]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

Acknowledgements

   This document is based on a contribution of RSA Laboratories, the
   research center of RSA Security Inc.  Any substantial use of the text
   from this document must acknowledge RSA Security Inc.  RSA Security
   Inc. requests that all material mentioning or referencing this
   document identify this as "RSA Security Inc. PKCS #1 v2.1".

Authors' Addresses

   Jakob Jonsson
   Philipps-Universitaet Marburg
   Fachbereich Mathematik und Informatik
   Hans Meerwein Strasse, Lahnberge
   DE-35032 Marburg
   Germany

   Phone: +49 6421 28 25672
   EMail: jonsson@mathematik.uni-marburg.de

   Burt Kaliski
   RSA Laboratories
   174 Middlesex Turnpike
   Bedford, MA 01730 USA

   Phone: +1 781 515 7073
   EMail: bkaliski@rsasecurity.com

Jonsson & Kaliski            Informational                     [Page 71]

RFC 3447        PKCS #1: RSA Cryptography Specifications   February 2003

Full Copyright Statement

   Copyright (C) The Internet Society 2003.  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others provided that the above copyright notice and this paragraph
   are included on all such copies.  However, this document itself may
   not be modified in any way, such as by removing the copyright notice
   or references to the Internet Society or other Internet
   organizations, except as required to translate it into languages
   other than English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Jonsson & Kaliski            Informational                     [Page 72]


Network Working Group                                          J. Schaad
Request for Comments: 3537                       Soaring Hawk Consulting
Category: Standards Track                                     R. Housley
                                                          Vigil Security
                                                                May 2003

       Wrapping a Hashed Message Authentication Code (HMAC) key
           with a Triple-Data Encryption Standard (DES) Key
             or an Advanced Encryption Standard (AES) Key

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   This document defines two methods for wrapping an HMAC (Hashed
   Message Authentication Code) key.  The first method defined uses a
   Triple DES (Data Encryption Standard) key to encrypt the HMAC key.
   The second method defined uses an AES (Advanced Encryption Standard)
   key to encrypt the HMAC key.  One place that such an algorithm is
   used is for the Authenticated Data type in CMS (Cryptographic Message
   Syntax).

1. Introduction

   Standard methods exist for encrypting a Triple-DES (3DES) content-
   encryption key (CEK) with a 3DES key-encryption key (KEK) [3DES-
   WRAP], and for encrypting an AES CEK with an AES KEK [AES-WRAP].
   Triple-DES key wrap imposes parity restrictions, and in both
   instances there are restrictions on the size of the key being wrapped
   that make the encryption of HMAC [HMAC] keying material difficult.

   This document specifies a mechanism for the encryption of an HMAC key
   of arbitrary length by a 3DES KEK or an AES KEK.

Schaad & Housley            Standards Track                     [Page 1]

RFC 3537                     HMAC Key Wrap                      May 2003

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in BCP 14, RFC 2119
   [STDWORDS].

2. HMAC Key Guidelines

   [HMAC] suggests that the key be at least as long as the output (L) of
   the hash function being used.  When keys longer than the block size
   of the hash algorithm are used, they are hashed and the resulting
   hash value is used.  Using keys much longer than L provides no
   security benefit, unless the random function used to create the key
   has low entropy output.

3. HMAC Key Wrapping and Unwrapping with Triple-DES

   This section specifies the algorithms for wrapping and unwrapping an
   HMAC key with a 3DES KEK [3DES].

   The 3DES wrapping of HMAC keys is based on the algorithm defined in
   Section 3 of [3DES-WRAP].  The major differences are due to the fact
   that an HMAC key is of variable length and the HMAC key has no
   particular parity.

   In the algorithm description, "a || b" is used to represent 'a'
   concatenated with 'b'.

3.1 Wrapping an HMAC Key with a Triple-DES Key-Encryption Key

   This algorithm encrypts an HMAC key with a 3DES KEK.  The algorithm
   is:

   1.  Let the HMAC key be called KEY, and let the length of KEY in
       octets be called LENGTH.  LENGTH is a single octet.

   2.  Let LKEY = LENGTH || KEY.

   3.  Let LKEYPAD = LKEY || PAD.  If the length of LKEY is a multiple
       of 8, the PAD has a length of zero.  If the length of LKEY is not
       a multiple of 8, then PAD contains the fewest number of random
       octets to make the length of LKEYPAD a multiple of 8.

   4.  Compute an 8 octet key checksum value on LKEYPAD as described in
       Section 2 of [3DES-WRAP], call the result ICV.

   5.  Let LKEYPADICV = LKEYPAD || ICV.

   6.  Generate 8 octets at random, call the result IV.

Schaad & Housley            Standards Track                     [Page 2]

RFC 3537                     HMAC Key Wrap                      May 2003

   7.  Encrypt LKEYPADICV in CBC mode using the 3DES KEK.  Use the
       random value generated in the previous step as the initialization
       vector (IV).  Call the ciphertext TEMP1.

   8.  Let TEMP2 = IV || TEMP1.

   9.  Reverse the order of the octets in TEMP2.  That is, the most
       significant (first) octet is swapped with the least significant
       (last) octet, and so on.  Call the result TEMP3.

   10. Encrypt TEMP3 in CBC mode using the 3DES KEK.  Use an
       initialization vector (IV) of 0x4adda22c79e82105.

   Note:  When the same HMAC key is wrapped in different 3DES KEKs, a
   fresh initialization vector (IV) must be generated for each
   invocation of the HMAC key wrap algorithm (step 6).

3.2  Unwrapping an HMAC Key with a Triple-DES Key-Encryption Key

   This algorithm decrypts an HMAC key using a 3DES KEK.  The algorithm
   is:

   1.  If the wrapped key is not a multiple of 8 octets, then error.

   2.  Decrypt the wrapped key in CBC mode using the 3DES KEK.  Use an
       initialization vector (IV) of 0x4adda22c79e82105.  Call the
       output TEMP3.

   3.  Reverse the order of the octets in TEMP3.  That is, the most
       significant (first) octet is swapped with the least significant
       (last) octet, and so on.  Call the result TEMP2.

   4.  Decompose the TEMP2 into IV and TEMP1.  IV is the most
       significant (first) 8 octets, and TEMP1 is composed of the
       remaining octets.

   5.  Decrypt TEMP1 in CBC mode using the 3DES KEK.  Use the IV value
       from the previous step as the initialization vector.  Call the
       plaintext LKEYPADICV.

   6.  Decompose the LKEYPADICV into LKEYPAD, and ICV.  ICV is the least
       significant (last) 8 octets.  LKEYPAD is composed of the
       remaining octets.

   7.  Compute an 8 octet key checksum value on LKEYPAD as described in
       Section 2 of [3DES-WRAP].  If the computed key checksum value
       does not match the decrypted key checksum value, ICV, then error.

Schaad & Housley            Standards Track                     [Page 3]

RFC 3537                     HMAC Key Wrap                      May 2003

   8.  Decompose the LKEYPAD into LENGTH, KEY, and PAD.  LENGTH is the
       most significant (first) octet.  KEY is the following LENGTH of
       octets.  PAD is the remaining octets, if any.

   9.  If the length of PAD is more than 7 octets, then error.

   10. Use KEY as an HMAC key.

3.3 HMAC Key Wrap with Triple-DES Algorithm Identifier

   Some security protocols employ ASN.1 [X.208-88, X.209-88], and these
   protocols employ algorithm identifiers to name cryptographic
   algorithms.  To support these protocols, the HMAC Key Wrap with
   Triple-DES algorithm has been assigned the following algorithm
   identifier:

      id-alg-HMACwith3DESwrap OBJECT IDENTIFIER ::= { iso(1)
          member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
          smime(16) alg(3) 11 }

   The AlgorithmIdentifier parameter field MUST be NULL.

3.4 HMAC Key Wrap with Triple-DES Test Vector

   KEK          :  5840df6e 29b02af1
                :  ab493b70 5bf16ea1
                :  ae8338f4 dcc176a8

   HMAC_KEY     :  c37b7e64 92584340
                :  bed12207 80894115
                :  5068f738

   IV           :  050d8c79 e0d56b75

   PAD          :  38be62

   ICV          :  1f363a31 cdaa9037

   LKEYPADICV   :  14c37b7e 64925843
                :  40bed122 07808941
                :  155068f7 38be62fe
                :  1f363a31 cdaa9037

   TEMP1        :  157a8210 f432836b
                :  a618b096 475c864b
                :  6612969c dfa445b1
                :  5646bd00 500b2cc1

Schaad & Housley            Standards Track                     [Page 4]

RFC 3537                     HMAC Key Wrap                      May 2003

   TEMP3        :  c12c0b50 00bd4656
                :  b145a4df 9c961266
                :  4b865c47 96b018a6
                :  6b8332f4 10827a15
                :  756bd5e0 798c0d05

   Wrapped Key  :  0f1d715d 75a0aaf6
                :  6f02e371 c08b79e2
                :  a1253dc4 3040136b
                :  dc161118 601f2863
                :  e2929b3b dd17697c

4. HMAC Key Wrapping and Unwrapping with AES

   This section specifies the algorithms for wrapping and unwrapping an
   HMAC key with an AES KEK [AES-WRAP].

   The AES wrapping of HMAC keys is based on the algorithm defined in
   [AES-WRAP].  The major difference is inclusion of padding due to the
   fact that the length of an HMAC key may not be a multiple of 64 bits.

   In the algorithm description, "a || b" is used to represent 'a'
   concatenated with 'b'.

4.1 Wrapping an HMAC Key with an AES Key-Encryption Key

   This algorithm encrypts an HMAC key with an AES KEK.  The algorithm
   is:

   1.  Let the HMAC key be called KEY, and let the length of KEY in
       octets be called LENGTH.  LENGTH is a single octet.

   2.  Let LKEY = LENGTH || KEY.

   3.  Let LKEYPAD = LKEY || PAD.  If the length of LKEY is a multiple
       of 8, the PAD has a length of zero.  If the length of LKEY is not
       a multiple of 8, then PAD contains the fewest number of random
       octets to make the length of LKEYPAD a multiple of 8.

   4.  Encrypt LKEYPAD using the AES key wrap algorithm specified in
       section 2.2.1 of [AES-WRAP], using the AES KEK as the encryption
       key.  The result is 8 octets longer than LKEYPAD.

Schaad & Housley            Standards Track                     [Page 5]

RFC 3537                     HMAC Key Wrap                      May 2003

4.2  Unwrapping an HMAC Key with an AES Key

   The AES key unwrap algorithm decrypts an HMAC key using an AES KEK.
   The AES key unwrap algorithm is:

   1.  If the wrapped key is not a multiple of 8 octets, then error.

   2.  Decrypt the wrapped key using the AES key unwrap algorithm
       specified in section 2.2.2 of [AES-WRAP], using the AES KEK as
       the decryption key.  If the unwrap algorithm internal integrity
       check fails, then error, otherwise call the result LKEYPAD.

   3.  Decompose the LKEYPAD into LENGTH, KEY, and PAD.  LENGTH is the
       most significant (first) octet.  KEY is the following LENGTH of
       octets.  PAD is the remaining octets, if any.

   4.  If the length of PAD is more than 7 octets, then error.

   5.  Use KEY as an HMAC key.

4.3 HMAC Key Wrap with AES Algorithm Identifier

   Some security protocols employ ASN.1 [X.208-88, X.209-88], and these
   protocols employ algorithm identifiers to name cryptographic
   algorithms.  To support these protocols, the HMAC Key Wrap with AES
   algorithm has been assigned the following algorithm identifier:

      id-alg-HMACwithAESwrap OBJECT IDENTIFIER ::= { iso(1)
          member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
          smime(16) alg(3) 12 }

   The AlgorithmIdentifier parameter field MUST be NULL.

4.4 HMAC Key Wrap with AES Test Vector

   KEK          :  5840df6e 29b02af1
                :  ab493b70 5bf16ea1
                :  ae8338f4 dcc176a8

   HMAC_KEY     :  c37b7e64 92584340
                :  bed12207 80894115
                :  5068f738

   PAD          :  050d8c

   LKEYPAD      :  14c37b7e 64925843
                :  40bed122 07808941
                :  155068f7 38050d8c

Schaad & Housley            Standards Track                     [Page 6]

RFC 3537                     HMAC Key Wrap                      May 2003

   Wrapped Key  :  9fa0c146 5291ea6d
                :  b55360c6 cb95123c
                :  d47b38cc e84dd804
                :  fbcec5e3 75c3cb13

5. Security Considerations

   Implementations must protect the key-encryption key (KEK).
   Compromise of the KEK may result in the disclosure of all HMAC keys
   that have been wrapped with the KEK, which may lead to loss of data
   integrity protection.

   The use of these key wrap functions provide confidentiality and data
   integrity, but they do not necessarily provide data origination
   authentication.  Anyone possessing the KEK can create a message that
   passes the integrity check.  If data origination authentication is
   also desired, then the KEK distribution mechanism must provide data
   origin authentication of the KEK.  Alternatively, a digital signature
   may be used.

   Implementations must randomly generate initialization vectors (IVs)
   and padding.  The generation of quality random numbers is difficult.

   RFC 1750 [RANDOM] offers important guidance in this area, and
   Appendix 3 of FIPS Pub 186 [DSS] provides one quality PRNG technique.

   The key wrap algorithms specified in this document have been reviewed
   for use with Triple-DES and AES, and have not been reviewed for use
   with other encryption algorithms.

6. References

6.1  Normative References

   [3DES]      American National Standards Institute.  ANSI X9.52-1998,
               Triple Data Encryption Algorithm Modes of Operation.
               1998.

   [3DES-WRAP] Housley, R., "Triple-DES and RC2 Key Wrapping", RFC 3217,
               December 2001.

   [AES]       National Institute of Standards and Technology. FIPS Pub
               197: Advanced Encryption Standard (AES). 26 November
               2001.

   [AES-WRAP]  Schaad, J. and R. Housley, "Advanced Encryption Standard
               (AES) Key Wrap Algorithm", RFC 3394, September 2002.

Schaad & Housley            Standards Track                     [Page 7]

RFC 3537                     HMAC Key Wrap                      May 2003

   [HMAC]      Krawczyk, H., Bellare, M. and R. Canetti, "HMAC:  Keyed-
               Hashing for Message Authentication", RFC 2104, February
               1997.

   [STDWORDS]  Bradner, S., "Key words for use in RFCs to Indicate
               Requirement Levels", BCP 14, RFC 2119, March 1997.

6.2 Informative References

   [DSS]       National Institute of Standards and Technology. FIPS Pub
               186: Digital Signature Standard.  19 May 1994.

   [RANDOM]    Eastlake 3rd, D., Crocker, S. and J. Schiller,
               "Randomness Recommendations for Security", RFC 1750,
               December 1994.

   [RFC2026]   Bradner, S., "The Internet Standards Process - Revision
               3", BCP 9, RFC 2026, October 1996.

   [X.208-88]  CCITT.  Recommendation X.208: Specification of Abstract
               Syntax Notation One (ASN.1).  1988.

   [X.209-88]  CCITT.  Recommendation X.209: Specification of Basic
               Encoding Rules for Abstract Syntax Notation One (ASN.1).
               1988.

7. Authors' Addresses

   Jim Schaad
   Soaring Hawk Consulting

   EMail: jimsch@exmsft.com

   Russell Housley
   Vigil Security
   918 Spring Knoll Drive
   Herndon, VA 20170
   USA

   EMail: housley@vigilsec.com

Schaad & Housley            Standards Track                     [Page 8]

RFC 3537                     HMAC Key Wrap                      May 2003

8. Full Copyright Statement

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assignees.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Schaad & Housley            Standards Track                     [Page 9]


Network Working Group                                         S. Frankel
Request for Comments: 3602                                      R. Glenn
Category: Standards Track                                           NIST
                                                                S. Kelly
                                                               Airespace
                                                          September 2003

          The AES-CBC Cipher Algorithm and Its Use with IPsec

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

Abstract

   This document describes the use of the Advanced Encryption Standard
   (AES) Cipher Algorithm in Cipher Block Chaining (CBC) Mode, with an
   explicit Initialization Vector (IV), as a confidentiality mechanism
   within the context of the IPsec Encapsulating Security Payload (ESP).

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
       1.1.  Specification of Requirements. . . . . . . . . . . . . .  3
   2.  The AES Cipher Algorithm . . . . . . . . . . . . . . . . . . .  3
       2.1.  Mode . . . . . . . . . . . . . . . . . . . . . . . . . .  3
       2.2.  Key Size and Number of Rounds. . . . . . . . . . . . . .  4
       2.3.  Weak Keys. . . . . . . . . . . . . . . . . . . . . . . .  4
       2.4.  Block Size and Padding . . . . . . . . . . . . . . . . .  4
       2.5.  Additional Information . . . . . . . . . . . . . . . . .  4
       2.6.  Performance. . . . . . . . . . . . . . . . . . . . . . .  5
   3.  ESP Payload  . . . . . . . . . . . . . . . . . . . . . . . . .  5
       3.1.  ESP Algorithmic Interactions . . . . . . . . . . . . . .  6
       3.2.  Keying Material. . . . . . . . . . . . . . . . . . . . .  6
   4.  Test Vectors . . . . . . . . . . . . . . . . . . . . . . . . .  6
   5.  IKE Interactions . . . . . . . . . . . . . . . . . . . . . . . 10
       5.1.  Phase 1 Identifier . . . . . . . . . . . . . . . . . . . 10
       5.2.  Phase 2 Identifier . . . . . . . . . . . . . . . . . . . 10
       5.3.  Key Length Attribute . . . . . . . . . . . . . . . . . . 10

Frankel, et al.             Standards Track                     [Page 1]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

       5.4.  Hash Algorithm Considerations. . . . . . . . . . . . . . 10
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 11
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 11
   8.  Intellectual Property Rights Statement . . . . . . . . . . . . 11
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 12
       9.1.  Normative References . . . . . . . . . . . . . . . . . . 12
       9.2.  Informative References . . . . . . . . . . . . . . . . . 12
   10. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 13
   11. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 14
   12. Full Copyright Statement . . . . . . . . . . . . . . . . . . . 15

1.  Introduction

   As the culmination of a four-year competitive process, NIST (the
   National Institute of Standards and Technology) has selected the AES
   (Advanced Encryption Standard), the successor to the venerable DES
   (Data Encryption Standard).  The competition was an open one, with
   public participation and comment solicited at each step of the
   process.  The AES [AES], formerly known as Rijndael, was chosen from
   a field of five finalists.

   The AES selection was made on the basis of several characteristics:

      +  security

      +  unclassified

      +  publicly disclosed

      +  available royalty-free, worldwide

      +  capable of handling a block size of at least 128 bits

      +  at a minimum, capable of handling key sizes of 128, 192, and
         256 bits

      +  computational efficiency and memory requirements on a variety
         of software and hardware, including smart cards

      +  flexibility, simplicity and ease of implementation

   The AES will be the government's designated encryption cipher.  The
   expectation is that the AES will suffice to protect sensitive
   (unclassified) government information until at least the next
   century.  It is also expected to be widely adopted by businesses and
   financial institutions.

Frankel, et al.             Standards Track                     [Page 2]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

   It is the intention of the IETF IPsec Working Group that AES will
   eventually be adopted as the default IPsec ESP cipher and will obtain
   the status of MUST be included in compliant IPsec implementations.

   The remainder of this document specifies the use of the AES within
   the context of IPsec ESP.  For further information on how the various
   pieces of ESP fit together to provide security services, refer to
   [ARCH], [ESP], and [ROAD].

1.1.  Specification of Requirements

   The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" that
   appear in this document are to be interpreted as described in
   [RFC-2119].

2.  The AES Cipher Algorithm

   All symmetric block cipher algorithms share common characteristics
   and variables, including mode, key size, weak keys, block size, and
   rounds.  The following sections contain descriptions of the relevant
   characteristics of the AES cipher.

2.1.  Mode

   NIST has defined 5 modes of operation for AES and other FIPS-approved
   ciphers [MODES]: CBC (Cipher Block Chaining), ECB (Electronic
   CodeBook), CFB (Cipher FeedBack), OFB (Output FeedBack) and CTR
   (Counter).  The CBC mode is well-defined and well-understood for
   symmetric ciphers, and is currently required for all other ESP
   ciphers.  This document specifies the use of the AES cipher in CBC
   mode within ESP.  This mode requires an Initialization Vector (IV)
   that is the same size as the block size.  Use of a randomly generated
   IV prevents generation of identical ciphertext from packets which
   have identical data that spans the first block of the cipher
   algorithm's block size.

   The IV is XOR'd with the first plaintext block before it is
   encrypted.  Then for successive blocks, the previous ciphertext block
   is XOR'd with the current plaintext, before it is encrypted.

   More information on CBC mode can be obtained in [MODES, CRYPTO-S].
   For the use of CBC mode in ESP with 64-bit ciphers, see [CBC].

Frankel, et al.             Standards Track                     [Page 3]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

2.2.  Key Size and Number of Rounds

   AES supports three key sizes: 128 bits, 192 bits, and 256 bits.  The
   default key size is 128 bits, and all implementations MUST support
   this key size.  Implementations MAY also support key sizes of 192
   bits and 256 bits.

   AES uses a different number of rounds for each of the defined key
   sizes.  When a 128-bit key is used, implementations MUST use 10
   rounds.  When a 192-bit key is used, implementations MUST use 12
   rounds.  When a 256-bit key is used, implementations MUST use 14
   rounds.

2.3.  Weak Keys

   At the time of writing this document there are no known weak keys for
   the AES.

   Some cipher algorithms have weak keys or keys that MUST not be used
   due to their interaction with some aspect of the cipher's definition.
   If weak keys are discovered for the AES, then weak keys SHOULD be
   checked for and discarded when using manual key management.  When
   using dynamic key management, such as [IKE], weak key checks SHOULD
   NOT be performed as they are seen as an unnecessary added code
   complexity that could weaken the intended security [EVALUATION].

2.4.  Block Size and Padding

   The AES uses a block size of sixteen octets (128 bits).

   Padding is required by the AES to maintain a 16-octet (128-bit)
   blocksize.  Padding MUST be added, as specified in [ESP], such that
   the data to be encrypted (which includes the ESP Pad Length and Next
   Header fields) has a length that is a multiple of 16 octets.

   Because of the algorithm specific padding requirement, no additional
   padding is required to ensure that the ciphertext terminates on a 4-
   octet boundary (i.e., maintaining a 16-octet blocksize guarantees
   that the ESP Pad Length and Next Header fields will be right aligned
   within a 4-octet word).  Additional padding MAY be included, as
   specified in [ESP], as long as the 16-octet blocksize is maintained.

2.5.  Additional Information

   AES was invented by Joan Daemen from Banksys/PWI and Vincent Rijmen
   from ESAT-COSIC, both in Belgium, and is available world-wide on a
   royalty-free basis.  It is not covered by any patents, and the
   Rijndael homepage contains the following statement: "Rijndael is

Frankel, et al.             Standards Track                     [Page 4]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

   available for free.  You can use it for whatever purposes you want,
   irrespective of whether it is accepted as AES or not."  AES's
   description can be found in [AES].  The Rijndael homepage is:
   http://www.esat.kuleuven.ac.be/~rijmen/rijndael/.

   The AES homepage, http://www.nist.gov/aes, contains a wealth of
   information about the AES, including a definitive description of the
   AES algorithm, performance statistics, test vectors and intellectual
   property information.  This site also contains information on how to
   obtain an AES reference implementation from NIST.

2.6.  Performance

   For a comparison table of the estimated speeds of AES and other
   cipher algorithms, please see [PERF-1], [PERF-2], [PERF-3], or
   [PERF-4].  The AES homepage has pointers to other analyses.

3.  ESP Payload

   The ESP payload is made up of the IV followed by raw cipher-text.
   Thus the payload field, as defined in [ESP], is broken down according
   to the following diagram:

   +---------------+---------------+---------------+---------------+
   |                                                               |
   +               Initialization Vector (16 octets)               +
   |                                                               |
   +---------------+---------------+---------------+---------------+
   |                                                               |
   ~ Encrypted Payload (variable length, a multiple of 16 octets)  ~
   |                                                               |
   +---------------------------------------------------------------+

   The IV field MUST be the same size as the block size of the cipher
   algorithm being used.  The IV MUST be chosen at random, and MUST be
   unpredictable.

   Including the IV in each datagram ensures that decryption of each
   received datagram can be performed, even when some datagrams are
   dropped, or datagrams are re-ordered in transit.

   To avoid CBC encryption of very similar plaintext blocks in different
   packets, implementations MUST NOT use a counter or other low-Hamming
   distance source for IVs.

Frankel, et al.             Standards Track                     [Page 5]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

3.1.  ESP Algorithmic Interactions

   Currently, there are no known issues regarding interactions between
   the AES and other aspects of ESP, such as use of certain
   authentication schemes.

3.2.  Keying Material

   The minimum number of bits sent from the key exchange protocol to the
   ESP algorithm must be greater than or equal to the key size.

   The cipher's encryption and decryption key is taken from the first
   <x> bits of the keying material, where <x> represents the required
   key size.

4.  Test Vectors

   The first 4 test cases test AES-CBC encryption.  Each test case
   includes the key, the plaintext, and the resulting ciphertext.  The
   values of keys and data are either hexadecimal numbers (prefixed by
   "0x") or ASCII character strings (surrounded by double quotes).  If a
   value is an ASCII character string, then the AES-CBC computation for
   the corresponding test case DOES NOT include the trailing null
   character ('\0') of the string.  The computed cyphertext values are
   all hexadecimal numbers.

   The last 4 test cases illustrate sample ESP packets using AES-CBC for
   encryption.  All data are hexadecimal numbers (not prefixed by "0x").

   These test cases were verified using 2 independent implementations:
   the NIST AES-CBC reference implementation and an implementation
   provided by the authors of the Rijndael algorithm
   (http://csrc.nist.gov/encryption/aes/rijndael/
                          rijndael-unix-refc.tar).

Case #1: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key
Key       : 0x06a9214036b8a15b512e03d534120006
IV        : 0x3dafba429d9eb430b422da802c9fac41
Plaintext : "Single block msg"
Ciphertext: 0xe353779c1079aeb82708942dbe77181a

Case #2: Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key
Key       : 0xc286696d887c9aa0611bbb3e2025a45a
IV        : 0x562e17996d093d28ddb3ba695a2e6f58
Plaintext : 0x000102030405060708090a0b0c0d0e0f
              101112131415161718191a1b1c1d1e1f
Ciphertext: 0xd296cd94c2cccf8a3a863028b5e1dc0a
              7586602d253cfff91b8266bea6d61ab1

Frankel, et al.             Standards Track                     [Page 6]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

Case #3: Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key
Key       : 0x6c3ea0477630ce21a2ce334aa746c2cd
IV        : 0xc782dc4c098c66cbd9cd27d825682c81
Plaintext : "This is a 48-byte message (exactly 3 AES blocks)"
Ciphertext: 0xd0a02b3836451753d493665d33f0e886
              2dea54cdb293abc7506939276772f8d5
              021c19216bad525c8579695d83ba2684

Case #4: Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key
Key       : 0x56e47a38c5598974bc46903dba290349
IV        : 0x8ce82eefbea0da3c44699ed7db51b7d9
Plaintext : 0xa0a1a2a3a4a5a6a7a8a9aaabacadaeaf
              b0b1b2b3b4b5b6b7b8b9babbbcbdbebf
              c0c1c2c3c4c5c6c7c8c9cacbcccdcecf
              d0d1d2d3d4d5d6d7d8d9dadbdcdddedf
Ciphertext: 0xc30e32ffedc0774e6aff6af0869f71aa
              0f3af07a9a31a9c684db207eb0ef8e4e
              35907aa632c3ffdf868bb7b29d3d46ad
              83ce9f9a102ee99d49a53e87f4c3da55

Case #5: Sample transport-mode ESP packet (ping 192.168.123.100)
Key: 90d382b4 10eeba7a d938c46c ec1a82bf
SPI: 4321
Source address: 192.168.123.3
Destination address: 192.168.123.100
Sequence number: 1
IV: e96e8c08 ab465763 fd098d45 dd3ff893

Original packet:
IP header (20 bytes): 45000054 08f20000 4001f9fe c0a87b03 c0a87b64
Data (64 bytes):
08000ebd a70a0000 8e9c083d b95b0700 08090a0b 0c0d0e0f 10111213 14151617
18191a1b 1c1d1e1f 20212223 24252627 28292a2b 2c2d2e2f 30313233 34353637

Augment data with:
Padding: 01020304 05060708 090a0b0c 0d0e
Pad length: 0e
Next header: 01 (ICMP)

Pre-encryption Data with padding, pad length and next header (80 bytes):
08000ebd a70a0000 8e9c083d b95b0700 08090a0b 0c0d0e0f 10111213 14151617
18191a1b 1c1d1e1f 20212223 24252627 28292a2b 2c2d2e2f 30313233 34353637
01020304 05060708 090a0b0c 0d0e0e01

Frankel, et al.             Standards Track                     [Page 7]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

Post-encryption packet with SPI, Sequence number, IV:
IP header: 4500007c 08f20000 4032f9a5 c0a87b03 c0a87b64
SPI/Seq #: 00004321 00000001
IV: e96e8c08 ab465763 fd098d45 dd3ff893
Encrypted Data (80 bytes):
f663c25d 325c18c6 a9453e19 4e120849 a4870b66 cc6b9965 330013b4 898dc856
a4699e52 3a55db08 0b59ec3a 8e4b7e52 775b07d1 db34ed9c 538ab50c 551b874a
a269add0 47ad2d59 13ac19b7 cfbad4a6

Case #6: Sample transport-mode ESP packet
         (ping -p 77 -s 20 192.168.123.100)
Key: 90d382b4 10eeba7a d938c46c ec1a82bf
SPI: 4321
Source address: 192.168.123.3
Destination address: 192.168.123.100
Sequence number: 8
IV: 69d08df7 d203329d b093fc49 24e5bd80

Original packet:
IP header (20 bytes): 45000030 08fe0000 4001fa16 c0a87b03 c0a87b64
Data (28 bytes):
0800b5e8 a80a0500 a69c083d 0b660e00 77777777 77777777 77777777

Augment data with:
Padding: 0102
Pad length: 02
Next header: 01 (ICMP)

Pre-encryption Data with padding, pad length and next header (32 bytes):
0800b5e8 a80a0500 a69c083d 0b660e00 77777777 77777777 77777777 01020201

Post-encryption packet with SPI, Sequence number, IV:
IP header: 4500004c 08fe0000 4032f9c9 c0a87b03 c0a87b64
SPI/Seq #: 00004321 00000008
IV: 69d08df7 d203329d b093fc49 24e5bd80
Encrypted Data (32 bytes):
f5199588 1ec4e0c4 488987ce 742e8109 689bb379 d2d750c0 d915dca3 46a89f75

Case #7: Sample tunnel-mode ESP packet (ping 192.168.123.200)
Key: 01234567 89abcdef 01234567 89abcdef
SPI: 8765
Source address: 192.168.123.3
Destination address: 192.168.123.200
Sequence number: 2
IV: f4e76524 4f6407ad f13dc138 0f673f37

Frankel, et al.             Standards Track                     [Page 8]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

Original packet:
IP header (20 bytes): 45000054 09040000 4001f988 c0a87b03 c0a87bc8
Data (64 bytes):
08009f76 a90a0100 b49c083d 02a20400 08090a0b 0c0d0e0f 10111213 14151617
18191a1b 1c1d1e1f 20212223 24252627 28292a2b 2c2d2e2f 30313233 34353637

Augment data with:
Padding: 01020304 05060708 090a
Pad length: 0a
Next header: 04 (IP-in-IP)

Pre-encryption Data with original IP header, padding, pad length and
                         next header (96 bytes):
45000054 09040000 4001f988 c0a87b03 c0a87bc8 08009f76 a90a0100 b49c083d
02a20400 08090a0b 0c0d0e0f 10111213 14151617 18191a1b 1c1d1e1f 20212223
24252627 28292a2b 2c2d2e2f 30313233 34353637 01020304 05060708 090a0a04

Post-encryption packet with SPI, Sequence number, IV:
IP header: 4500008c 09050000 4032f91e c0a87b03 c0a87bc8
SPI/Seq #: 00008765 00000002
IV: f4e76524 4f6407ad f13dc138 0f673f37
Encrypted Data (96 bytes):
773b5241 a4c44922 5e4f3ce5 ed611b0c 237ca96c f74a9301 3c1b0ea1 a0cf70f8
e4ecaec7 8ac53aad 7a0f022b 859243c6 47752e94 a859352b 8a4d4d2d ecd136e5
c177f132 ad3fbfb2 201ac990 4c74ee0a 109e0ca1 e4dfe9d5 a100b842 f1c22f0d

Case #8: Sample tunnel-mode ESP packet
         (ping -p ff -s 40 192.168.123.200)
Key: 01234567 89abcdef 01234567 89abcdef
SPI: 8765
Source address: 192.168.123.3
Destination address: 192.168.123.200
Sequence number: 5
IV: 85d47224 b5f3dd5d 2101d4ea 8dffab22

Original packet:
IP header (20 bytes): 45000044 090c0000 4001f990 c0a87b03 c0a87bc8
Data (48 bytes):
0800d63c aa0a0200 c69c083d a3de0300 ffffffff ffffffff ffffffff ffffffff
ffffffff ffffffff ffffffff ffffffff

Augment data with:
Padding: 01020304 05060708 090a
Pad length: 0a
Next header: 04 (IP-in-IP)

Frankel, et al.             Standards Track                     [Page 9]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

Pre-encryption Data with original IP header, padding, pad length and
                         next header (80 bytes):
45000044 090c0000 4001f990 c0a87b03 c0a87bc8 0800d63c aa0a0200 c69c083d
a3de0300 ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff
ffffffff 01020304 05060708 090a0a04

Post-encryption packet with SPI, Sequence number, IV:
IP header: 4500007c 090d0000 4032f926 c0a87b03 c0a87bc8
SPI/Seq #: 00008765 00000005
IV: 85d47224 b5f3dd5d 2101d4ea 8dffab22
Encrypted Data (80 bytes):
15b92683 819596a8 047232cc 00f7048f e45318e1 1f8a0f62 ede3c3fc 61203bb5
0f980a08 c9843fd3 a1b06d5c 07ff9639 b7eb7dfb 3512e5de 435e7207 ed971ef3
d2726d9b 5ef6affc 6d17a0de cbb13892

5.  IKE Interactions

5.1.  Phase 1 Identifier

   For Phase 1 negotiations, IANA has assigned an Encryption Algorithm
   ID of 7 for AES-CBC.

5.2.  Phase 2 Identifier

   For Phase 2 negotiations, IANA has assigned an ESP Transform
   Identifier of 12 for ESP_AES.

5.3.  Key Length Attribute

   Since the AES allows variable key lengths, the Key Length attribute
   MUST be specified in both a Phase 1 exchange [IKE] and a Phase 2
   exchange [DOI].

5.4.  Hash Algorithm Considerations

   A companion competition, to select the successor to SHA-1, the
   widely-used hash algorithm, recently concluded.  The resulting
   hashes, called SHA-256, SHA-384 and SHA-512 [SHA2-1, SHA2-2] are
   capable of producing output of three different lengths (256, 384 and
   512 bits), sufficient for the generation (within IKE) and
   authentication (within ESP) of the three AES key sizes (128, 192 and
   256 bits).

   However, HMAC-SHA-1 [HMAC-SHA] and HMAC-MD5 [HMAC-MD5] are currently
   considered of sufficient strength to serve both as IKE generators of
   128-bit AES keys and as ESP authenticators for AES encryption using
   128-bit keys.

Frankel, et al.             Standards Track                    [Page 10]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

6.  Security Considerations

   Implementations are encouraged to use the largest key sizes they can
   when taking into account performance considerations for their
   particular hardware and software configuration.  Note that encryption
   necessarily impacts both sides of a secure channel, so such
   consideration must take into account not only the client side, but
   the server as well.  However, a key size of 128 bits is considered
   secure for the foreseeable future.

   For more information regarding the necessary use of random IV values,
   see [CRYPTO-B].

   For further security considerations, the reader is encouraged to read
   [AES].

7.  IANA Considerations

   IANA has assigned Encryption Algorithm ID 7 to AES-CBC.
   IANA has assigned ESP Transform Identifier 12 to ESP_AES.

8.  Intellectual Property Rights Statement

   The IETF takes no position regarding the validity or scope of any
   intellectual property or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; neither does it represent that it
   has made any effort to identify any such rights.  Information on the
   IETF's procedures with respect to rights in standards-track and
   standards-related documentation can be found in BCP-11.  Copies of
   claims of rights made available for publication and any assurances of
   licenses to be made available, or the result of an attempt made to
   obtain a general license or permission for the use of such
   proprietary rights by implementers or users of this specification can
   be obtained from the IETF Secretariat.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights which may cover technology that may be required to practice
   this standard.  Please address the information to the IETF Executive
   Director.

Frankel, et al.             Standards Track                    [Page 11]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

9.  References

9.1.  Normative References

   [AES]        NIST, FIPS PUB 197, "Advanced Encryption Standard
                (AES)," November 2001.
                http://csrc.nist.gov/publications/fips/fips197/
                fips-197.{ps,pdf}

   [CBC]        Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
                Algorithms", RFC 2451, November 1998.

   [ESP]        Kent, S. and R. Atkinson, "IP Encapsulating Security
                Payload (ESP)", RFC 2406, November 1998.

9.2.  Informative References

   [ARCH]       Kent, S. and R. Atkinson, "Security Architecture for the
                Internet Protocol", RFC 2401, November 1998.

   [CRYPTO-B]   Bellovin, S., "Probable Plaintext Cryptanalysis of the
                IP Security Protocols", Proceedings of the Symposium on
                Network and Distributed System Security, San Diego, CA,
                pp. 155-160, February 1997.
                http://www.research.att.com/~smb/papers/probtxt.pdf

   [CRYPTO-S]   B. Schneier, "Applied Cryptography Second Edition", John
                Wiley & Sons, New York, NY, 1995, ISBN 0-471-12845-7.

   [DOI]        Piper, D., "The Internet IP Security Domain of
                Interpretation for ISAKMP", RFC 2407, November 1998.

   [EVALUATION] Ferguson, N. and B. Schneier, "A Cryptographic
                Evaluation of IPsec," Counterpane Internet Security,
                Inc., January 2000.
                http://www.counterpane.com/ipsec.pdf

   [HMAC-MD5]   Madson, C. and R. Glenn, "The Use of HMAC-MD5-96 within
                ESP and AH", RFC 2403, November 1998.

   [HMAC-SHA]   Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96
                within ESP and AH", RFC 2404, November 1998.

   [IKE]        Harkins, D. and D. Carrel, "The Internet Key Exchange
                (IKE)", RFC 2409, November 1998.

Frankel, et al.             Standards Track                    [Page 12]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

   [MODES]      Dworkin, M., "Recommendation for Block Cipher Modes of
                Operation: Methods and Techniques," NIST Special
                Publication 800-38A, December 2001.
                http://csrc.nist.gov/publications/nistpubs/
                800-38a/sp800-38a.pdf

   [PERF-1]     Bassham, L. III, "Efficiency Testing of ANSI C
                Implementations of Round1 Candidate Algorithms for the
                Advanced Encryption Standard."
                http://csrc.nist.gov/encryption/aes/round1/r1-ansic.pdf

   [PERF-2]     Lipmaa, Helger, "AES/Rijndael: speed."
                http://www.tcs.hut.fi/~helger/aes/rijndael.html

   [PERF-3]     Nechvetal, J., E. Barker, D. Dodson, M. Dworkin, J.
                Foti and E. Roback, "Status Report on the First Round of
                the Development of the Advanced Encryption Standard."
                http://csrc.nist.gov/encryption/aes/round1/r1report.pdf

   [PERF-4]     Schneier, B., J. Kelsey, D. Whiting, D. Wagner, C.
                Hall, and N. Ferguson, "Performance Comparison of the
                AES Submissions."
                http://www.counterpane.com/aes-performance.pdf

   [RFC-2119]   Bradner, S., "Key words for use in RFCs to Indicate
                Requirement Levels", BCP 14, RFC 2119, March 1997.

   [ROAD]       Thayer, R., Doraswamy, N. and R. Glenn, "IP Security
                Document Roadmap", RFC 2411, November 1998.

   [SHA2-1]     NIST, FIPS PUB 180-2 "Specifications for the Secure Hash
                Standard," August 2002.
                http://csrc.nist.gov/publications/fips/fips180-2/
                fips180-2.pdf

   [SHA2-2]     "Descriptions of SHA-256, SHA-384, and SHA-512."
                http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf

10.  Acknowledgments

   Portions of this text, as well as its general structure, were
   unabashedly lifted from [CBC].

   The authors want to thank Hilarie Orman for providing expert advice
   (and a sanity check) on key sizes, requirements for Diffie-Hellman
   groups, and IKE interactions.  We also thank Scott Fluhrer for his
   helpful comments and recommendations.

Frankel, et al.             Standards Track                    [Page 13]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

11.  Authors' Addresses

   Sheila Frankel
   NIST
   820 West Diamond Ave.
   Room 677
   Gaithersburg, MD 20899

   Phone: +1 (301) 975-3297
   EMail: sheila.frankel@nist.gov

   Scott Kelly
   Airespace
   110 Nortech Pkwy
   San Jose CA 95134

   Phone: +1 408 635 2000
   EMail: scott@hyperthought.com

   Rob Glenn
   NIST
   820 West Diamond Ave.
   Room 605
   Gaithersburg, MD 20899

   Phone: +1 (301) 975-3667
   EMail: rob.glenn@nist.gov

Frankel, et al.             Standards Track                    [Page 14]

RFC 3602        AES-CBC Cipher Algorithm Use with IPsec   September 2003

12.  Full Copyright Statement

   Copyright (C) The Internet Society (2003).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assignees.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Frankel, et al.             Standards Track                    [Page 15]


Network Working Group                                         K. Raeburn
Request for Comments: 3962                                           MIT
Category: Standards Track                                  February 2005

      Advanced Encryption Standard (AES) Encryption for Kerberos 5

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2005).

Abstract

   The United States National Institute of Standards and Technology
   (NIST) has chosen a new Advanced Encryption Standard (AES), which is
   significantly faster and (it is believed) more secure than the old
   Data Encryption Standard (DES) algorithm.  This document is a
   specification for the addition of this algorithm to the Kerberos
   cryptosystem suite.

1.  Introduction

   This document defines encryption key and checksum types for Kerberos
   5 using the AES algorithm recently chosen by NIST.  These new types
   support 128-bit block encryption and key sizes of 128 or 256 bits.

   Using the "simplified profile" of [KCRYPTO], we can define a pair of
   encryption and checksum schemes.  AES is used with ciphertext
   stealing to avoid message expansion, and SHA-1 [SHA1] is the
   associated checksum function.

2.  Conventions used in this Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in BCP 14, RFC 2119
   [KEYWORDS].

Raeburn                     Standards Track                     [Page 1]

RFC 3962             AES Encryption for Kerberos 5         February 2005

3.  Protocol Key Representation

   The profile in [KCRYPTO] treats keys and random octet strings as
   conceptually different.  But since the AES key space is dense, we can
   use any bit string of appropriate length as a key.  We use the byte
   representation for the key described in [AES], where the first bit of
   the bit string is the high bit of the first byte of the byte string
   (octet string) representation.

4.  Key Generation from Pass Phrases or Random Data

   Given the above format for keys, we can generate keys from the
   appropriate amounts of random data (128 or 256 bits) by simply
   copying the input string.

   To generate an encryption key from a pass phrase and salt string, we
   use the PBKDF2 function from PKCS #5 v2.0 ([PKCS5]), with parameters
   indicated below, to generate an intermediate key (of the same length
   as the desired final key), which is then passed into the DK function
   with the 8-octet ASCII string "kerberos" as is done for des3-cbc-
   hmac-sha1-kd in [KCRYPTO].  (In [KCRYPTO] terms, the PBKDF2 function
   produces a "random octet string", hence the application of the
   random-to-key function even though it's effectively a simple identity
   operation.)  The resulting key is the user's long-term key for use
   with the encryption algorithm in question.

   tkey = random2key(PBKDF2(passphrase, salt, iter_count, keylength))
   key = DK(tkey, "kerberos")

   The pseudorandom function used by PBKDF2 will be a SHA-1 HMAC of the
   passphrase and salt, as described in Appendix B.1 to PKCS#5.

   The number of iterations is specified by the string-to-key parameters
   supplied.  The parameter string is four octets indicating an unsigned
   number in big-endian order.  This is the number of iterations to be
   performed.  If the value is 00 00 00 00, the number of iterations to
   be performed is 4,294,967,296 (2**32).  (Thus the minimum expressible
   iteration count is 1.)

   For environments where slower hardware is the norm, implementations
   of protocols such as Kerberos may wish to limit the number of
   iterations to prevent a spoofed response supplied by an attacker from
   consuming lots of client-side CPU time; if such a limit is
   implemented, it SHOULD be no less than 50,000.  Even for environments
   with fast hardware, 4 billion iterations is likely to take a fairly
   long time; much larger bounds might still be enforced, and it might
   be wise for implementations to permit interruption of this operation
   by the user if the environment allows for it.

Raeburn                     Standards Track                     [Page 2]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   If the string-to-key parameters are not supplied, the value used is
   00 00 10 00 (decimal 4,096, indicating 4,096 iterations).

   Note that this is not a requirement, nor even a recommendation, for
   this value to be used in "optimistic preauthentication" (e.g.,
   attempting timestamp-based preauthentication using the user's long-
   term key without having first communicated with the KDC) in the
   absence of additional information, or as a default value for sites to
   use for their principals' long-term keys in their Kerberos database.
   It is simply the interpretation of the absence of the string-to-key
   parameter field when the KDC has had an opportunity to provide it.

   Sample test vectors are given in Appendix B.

5.  Ciphertext Stealing

   Cipher block chaining is used to encrypt messages, with the initial
   vector stored in the cipher state.  Unlike previous Kerberos
   cryptosystems, we use ciphertext stealing to handle the possibly
   partial final block of the message.

   Ciphertext stealing is described on pages 195-196 of [AC], and
   section 8 of [RC5]; it has the advantage that no message expansion is
   done during encryption of messages of arbitrary sizes as is typically
   done in CBC mode with padding.  Some errata for [RC5] are listed in
   Appendix A and are considered part of the ciphertext stealing
   technique as used here.

   Ciphertext stealing, as defined in [RC5], assumes that more than one
   block of plain text is available.  If exactly one block is to be
   encrypted, that block is simply encrypted with AES (also known as ECB
   mode).  Input smaller than one block is padded at the end to one
   block; the values of the padding bits are unspecified.
   (Implementations MAY use all-zero padding, but protocols MUST NOT
   rely on the result being deterministic.  Implementations MAY use
   random padding, but protocols MUST NOT rely on the result not being
   deterministic.  Note that in most cases, the Kerberos encryption
   profile will add a random confounder independent of this padding.)

   For consistency, ciphertext stealing is always used for the last two
   blocks of the data to be encrypted, as in [RC5].  If the data length
   is a multiple of the block size, this is equivalent to plain CBC mode
   with the last two ciphertext blocks swapped.

   A test vector is given in Appendix B.

Raeburn                     Standards Track                     [Page 3]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   The initial vector carried out from one encryption for use in a
   subsequent encryption is the next-to-last block of the encryption
   output; this is the encrypted form of the last plaintext block.  When
   decrypting, the next-to-last block of the supplied ciphertext is
   carried forward as the next initial vector.  If only one ciphertext
   block is available (decrypting one block, or encrypting one block or
   less), then that one block is carried out instead.

6.  Kerberos Algorithm Profile Parameters

   This is a summary of the parameters to be used with the simplified
   algorithm profile described in [KCRYPTO]:

  +--------------------------------------------------------------------+
  |               protocol key format        128- or 256-bit string    |
  |                                                                    |
  |            string-to-key function        PBKDF2+DK with variable   |
  |                                          iteration count (see      |
  |                                          above)                    |
  |                                                                    |
  |  default string-to-key parameters        00 00 10 00               |
  |                                                                    |
  |        key-generation seed length        key size                  |
  |                                                                    |
  |            random-to-key function        identity function         |
  |                                                                    |
  |                  hash function, H        SHA-1                     |
  |                                                                    |
  |               HMAC output size, h        12 octets (96 bits)       |
  |                                                                    |
  |             message block size, m        1 octet                   |
  |                                                                    |
  |  encryption/decryption functions,        AES in CBC-CTS mode       |
  |  E and D                                 (cipher block size 16     |
  |                                          octets), with next-to-    |
  |                                          last block (last block    |
  |                                          if only one) as CBC-style |
  |                                          ivec                      |
  +--------------------------------------------------------------------+

   Using this profile with each key size gives us two each of encryption
   and checksum algorithm definitions.

Raeburn                     Standards Track                     [Page 4]

RFC 3962             AES Encryption for Kerberos 5         February 2005

7.  Assigned Numbers

   The following encryption type numbers are assigned:

  +--------------------------------------------------------------------+
  |                         encryption types                           |
  +--------------------------------------------------------------------+
  |         type name                  etype value          key size   |
  +--------------------------------------------------------------------+
  |   aes128-cts-hmac-sha1-96              17                 128      |
  |   aes256-cts-hmac-sha1-96              18                 256      |
  +--------------------------------------------------------------------+

   The following checksum type numbers are assigned:

  +--------------------------------------------------------------------+
  |                          checksum types                            |
  +--------------------------------------------------------------------+
  |        type name                 sumtype value           length    |
  +--------------------------------------------------------------------+
  |    hmac-sha1-96-aes128                15                   96      |
  |    hmac-sha1-96-aes256                16                   96      |
  +--------------------------------------------------------------------+

   These checksum types will be used with the corresponding encryption
   types defined above.

8.  Security Considerations

   This new algorithm has not been around long enough to receive the
   decades of intense analysis that DES has received.  It is possible
   that some weakness exists that has not been found by the
   cryptographers analyzing these algorithms before and during the AES
   selection process.

   The use of the HMAC function has drawbacks for certain pass phrase
   lengths.  For example, a pass phrase longer than the hash function
   block size (64 bytes, for SHA-1) is hashed to a smaller size (20
   bytes) before applying the main HMAC algorithm.  However, entropy is
   generally sparse in pass phrases, especially in long ones, so this
   may not be a problem in the rare cases of users with long pass
   phrases.

   Also, generating a 256-bit key from a pass phrase of any length may
   be deceptive, as the effective entropy in pass-phrase-derived key
   cannot be nearly that large given the properties of the string-to-key
   function described here.

Raeburn                     Standards Track                     [Page 5]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   The iteration count in PBKDF2 appears to be useful primarily as a
   constant multiplier for the amount of work required for an attacker
   using brute-force methods.  Unfortunately, it also multiplies, by the
   same amount, the work needed by a legitimate user with a valid
   password.  Thus the work factor imposed on an attacker (who may have
   many powerful workstations at his disposal) must be balanced against
   the work factor imposed on the legitimate user (who may have a PDA or
   cell phone); the available computing power on either side increases
   as time goes on, as well.  A better way to deal with the brute-force
   attack is through preauthentication mechanisms that provide better
   protection of the user's long-term key.  Use of such mechanisms is
   out of the scope of this document.

   If a site does wish to use this means of protection against a brute-
   force attack, the iteration count should be chosen based on the
   facilities available to both attacker and legitimate user, and the
   amount of work the attacker should be required to perform to acquire
   the key or password.

   As an example:

      The author's tests on a 2GHz Pentium 4 system indicated that in
      one second, nearly 90,000 iterations could be done, producing a
      256-bit key.  This was using the SHA-1 assembly implementation
      from OpenSSL, and a pre-release version of the PBKDF2 code for
      MIT's Kerberos package, on a single system.  No attempt was made
      to do multiple hashes in parallel, so we assume an attacker doing
      so can probably do at least 100,000 iterations per second --
      rounded up to 2**17, for ease of calculation.  For simplicity, we
      also assume the final AES encryption step costs nothing.

      Paul Leach estimates [LEACH] that a password-cracking dictionary
      may have on the order of 2**21 entries, with capitalization,
      punctuation, and other variations contributing perhaps a factor of
      2**11, giving a ballpark estimate of 2**32.

      Thus, for a known iteration count N and a known salt string, an
      attacker with some number of computers comparable to the author's
      would need roughly N*2**15 CPU seconds to convert the entire
      dictionary plus variations into keys.

      An attacker using a dozen such computers for a month would have
      roughly 2**25 CPU seconds available.  So using 2**12 (4,096)
      iterations would mean an attacker with a dozen such computers
      dedicated to a brute-force attack against a single key (actually,
      any password-derived keys sharing the same salt and iteration

Raeburn                     Standards Track                     [Page 6]

RFC 3962             AES Encryption for Kerberos 5         February 2005

      count) would process all the variations of the dictionary entries
      in four months and, on average, would likely find the user's
      password in two months.

      Thus, if this form of attack is of concern, users should be
      required to change their passwords every few months, and an
      iteration count a few orders of magnitude higher should be chosen.
      Perhaps several orders of magnitude, as many users will tend to
      use the shorter and simpler passwords (to the extent they can,
      given a site's password quality checks) that the attacker would
      likely try first.

      Since this estimate is based on currently available CPU power, the
      iteration counts used for this mode of defense should be increased
      over time, at perhaps 40%-60% each year or so.

      Note that if the attacker has a large amount of storage available,
      intermediate results could be cached, saving a lot of work for the
      next attack with the same salt and a greater number of iterations
      than had been run at the point where the intermediate results were
      saved.  Thus, it would be wise to generate a new random salt
      string when passwords are changed.  The default salt string,
      derived from the principal name, only protects against the use of
      one dictionary of keys against multiple users.

   If the PBKDF2 iteration count can be spoofed by an intruder on the
   network, and the limit on the accepted iteration count is very high,
   the intruder may be able to introduce a form of denial of service
   attack against the client by sending a very high iteration count,
   causing the client to spend a great deal of CPU time computing an
   incorrect key.

   An intruder spoofing the KDC reply, providing a low iteration count
   and reading the client's reply from the network, may be able to
   reduce the work needed in the brute-force attack outlined above.
   Thus, implementations may seek to enforce lower bounds on the number
   of iterations that will be used.

   Since threat models and typical end-user equipment will vary widely
   from site to site, allowing site-specific configuration of such
   bounds is recommended.

   Any benefit against other attacks specific to the HMAC or SHA-1
   algorithms is probably achieved with a fairly small number of
   iterations.

Raeburn                     Standards Track                     [Page 7]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   In the "optimistic preauthentication" case mentioned in section 3,
   the client may attempt to produce a key without first communicating
   with the KDC.  If the client has no additional information, it can
   only guess as to the iteration count to be used.  Even such
   heuristics as "iteration count X was used to acquire tickets for the
   same principal only N hours ago" can be wrong.  Given the
   recommendation above for increasing the iteration counts used over
   time, it is impossible to recommend any specific default value for
   this case; allowing site-local configuration is recommended.  (If the
   lower and upper bound checks described above are implemented, the
   default count for optimistic preauthentication should be between
   those bounds.)

   Ciphertext stealing mode, as it requires no additional padding in
   most cases, will reveal the exact length of each message being
   encrypted rather than merely bounding it to a small range of possible
   lengths as in CBC mode.  Such obfuscation should not be relied upon
   at higher levels in any case; if the length must be obscured from an
   outside observer, this should be done by intentionally varying the
   length of the message to be encrypted.

9.  IANA Considerations

   Kerberos encryption and checksum type values used in section 7 were
   previously reserved in [KCRYPTO] for the mechanisms defined in this
   document.  The registries have been updated to list this document as
   the reference.

10.  Acknowledgements

   Thanks to John Brezak, Gerardo Diaz Cuellar, Ken Hornstein, Paul
   Leach, Marcus Watts, Larry Zhu, and others for feedback on earlier
   versions of this document.

Raeburn                     Standards Track                     [Page 8]

RFC 3962             AES Encryption for Kerberos 5         February 2005

A.  Errata for RFC 2040 Section 8

   (Copied from the RFC Editor's errata web site on July 8, 2004.)

   Reported By: Bob Baldwin; baldwin@plusfive.com
   Date: Fri, 26 Mar 2004 06:49:02 -0800

   In Section 8, Description of RC5-CTS, of the encryption method,
   it says:

       1. Exclusive-or Pn-1 with the previous ciphertext
          block, Cn-2, to create Xn-1.

   It should say:

       1. Exclusive-or Pn-1 with the previous ciphertext
          block, Cn-2, to create Xn-1.  For short messages where
          Cn-2 does not exist, use IV.

   Reported By: Bob Baldwin; baldwin@plusfive.com
   Date: Mon, 22 Mar 2004 20:26:40 -0800

   In Section 8, first paragraph, second sentence says:

       This mode handles any length of plaintext and produces ciphertext
       whose length matches the plaintext length.

   In Section 8, first paragraph, second sentence should read:

       This mode handles any length of plaintext longer than one
       block and produces ciphertext whose length matches the
       plaintext length.

   In Section 8, step 6 of the decryption method says:

       6. Decrypt En to create Pn-1.

   In Section 8, step 6 of the decryption method should read:

       6. Decrypt En and exclusive-or with Cn-2 to create Pn-1.
          For short messages where Cn-2 does not exist, use the IV.

Raeburn                     Standards Track                     [Page 9]

RFC 3962             AES Encryption for Kerberos 5         February 2005

B.  Sample Test Vectors

   Sample values for the PBKDF2 HMAC-SHA1 string-to-key function are
   included below.

   Iteration count = 1
   Pass phrase = "password"
   Salt = "ATHENA.MIT.EDUraeburn"
   128-bit PBKDF2 output:
       cd ed b5 28 1b b2 f8 01 56 5a 11 22 b2 56 35 15
   128-bit AES key:
       42 26 3c 6e 89 f4 fc 28 b8 df 68 ee 09 79 9f 15
   256-bit PBKDF2 output:
       cd ed b5 28 1b b2 f8 01 56 5a 11 22 b2 56 35 15
       0a d1 f7 a0 4b b9 f3 a3 33 ec c0 e2 e1 f7 08 37
   256-bit AES key:
       fe 69 7b 52 bc 0d 3c e1 44 32 ba 03 6a 92 e6 5b
       bb 52 28 09 90 a2 fa 27 88 39 98 d7 2a f3 01 61

   Iteration count = 2
   Pass phrase = "password"
   Salt="ATHENA.MIT.EDUraeburn"
   128-bit PBKDF2 output:
       01 db ee 7f 4a 9e 24 3e 98 8b 62 c7 3c da 93 5d
   128-bit AES key:
       c6 51 bf 29 e2 30 0a c2 7f a4 69 d6 93 bd da 13
   256-bit PBKDF2 output:
       01 db ee 7f 4a 9e 24 3e 98 8b 62 c7 3c da 93 5d
       a0 53 78 b9 32 44 ec 8f 48 a9 9e 61 ad 79 9d 86
   256-bit AES key:
       a2 e1 6d 16 b3 60 69 c1 35 d5 e9 d2 e2 5f 89 61
       02 68 56 18 b9 59 14 b4 67 c6 76 22 22 58 24 ff

   Iteration count = 1200
   Pass phrase = "password"
   Salt = "ATHENA.MIT.EDUraeburn"
   128-bit PBKDF2 output:
       5c 08 eb 61 fd f7 1e 4e 4e c3 cf 6b a1 f5 51 2b
   128-bit AES key:
       4c 01 cd 46 d6 32 d0 1e 6d be 23 0a 01 ed 64 2a
   256-bit PBKDF2 output:
       5c 08 eb 61 fd f7 1e 4e 4e c3 cf 6b a1 f5 51 2b
       a7 e5 2d db c5 e5 14 2f 70 8a 31 e2 e6 2b 1e 13
   256-bit AES key:
       55 a6 ac 74 0a d1 7b 48 46 94 10 51 e1 e8 b0 a7
       54 8d 93 b0 ab 30 a8 bc 3f f1 62 80 38 2b 8c 2a

Raeburn                     Standards Track                    [Page 10]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   Iteration count = 5
   Pass phrase = "password"
   Salt=0x1234567878563412
   128-bit PBKDF2 output:
       d1 da a7 86 15 f2 87 e6 a1 c8 b1 20 d7 06 2a 49
   128-bit AES key:
       e9 b2 3d 52 27 37 47 dd 5c 35 cb 55 be 61 9d 8e
   256-bit PBKDF2 output:
       d1 da a7 86 15 f2 87 e6 a1 c8 b1 20 d7 06 2a 49
       3f 98 d2 03 e6 be 49 a6 ad f4 fa 57 4b 6e 64 ee
   256-bit AES key:
       97 a4 e7 86 be 20 d8 1a 38 2d 5e bc 96 d5 90 9c
       ab cd ad c8 7c a4 8f 57 45 04 15 9f 16 c3 6e 31
   (This test is based on values given in [PECMS].)

   Iteration count = 1200
   Pass phrase = (64 characters)
     "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
   Salt="pass phrase equals block size"
   128-bit PBKDF2 output:
       13 9c 30 c0 96 6b c3 2b a5 5f db f2 12 53 0a c9
   128-bit AES key:
       59 d1 bb 78 9a 82 8b 1a a5 4e f9 c2 88 3f 69 ed
   256-bit PBKDF2 output:
       13 9c 30 c0 96 6b c3 2b a5 5f db f2 12 53 0a c9
       c5 ec 59 f1 a4 52 f5 cc 9a d9 40 fe a0 59 8e d1
   256-bit AES key:
       89 ad ee 36 08 db 8b c7 1f 1b fb fe 45 94 86 b0
       56 18 b7 0c ba e2 20 92 53 4e 56 c5 53 ba 4b 34

   Iteration count = 1200
   Pass phrase = (65 characters)
     "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
   Salt = "pass phrase exceeds block size"
   128-bit PBKDF2 output:
       9c ca d6 d4 68 77 0c d5 1b 10 e6 a6 87 21 be 61
   128-bit AES key:
       cb 80 05 dc 5f 90 17 9a 7f 02 10 4c 00 18 75 1d
   256-bit PBKDF2 output:
       9c ca d6 d4 68 77 0c d5 1b 10 e6 a6 87 21 be 61
       1a 8b 4d 28 26 01 db 3b 36 be 92 46 91 5e c8 2a
   256-bit AES key:
       d7 8c 5c 9c b8 72 a8 c9 da d4 69 7f 0b b5 b2 d2
       14 96 c8 2b eb 2c ae da 21 12 fc ee a0 57 40 1b

Raeburn                     Standards Track                    [Page 11]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   Iteration count = 50
   Pass phrase = g-clef (0xf09d849e)
   Salt = "EXAMPLE.COMpianist"
   128-bit PBKDF2 output:
       6b 9c f2 6d 45 45 5a 43 a5 b8 bb 27 6a 40 3b 39
   128-bit AES key:
       f1 49 c1 f2 e1 54 a7 34 52 d4 3e 7f e6 2a 56 e5
   256-bit PBKDF2 output:
       6b 9c f2 6d 45 45 5a 43 a5 b8 bb 27 6a 40 3b 39
       e7 fe 37 a0 c4 1e 02 c2 81 ff 30 69 e1 e9 4f 52
   256-bit AES key:
       4b 6d 98 39 f8 44 06 df 1f 09 cc 16 6d b4 b8 3c
       57 18 48 b7 84 a3 d6 bd c3 46 58 9a 3e 39 3f 9e

   Some test vectors for CBC with ciphertext stealing, using an initial
   vector of all-zero.

   AES 128-bit key:
     0000:  63 68 69 63 6b 65 6e 20 74 65 72 69 79 61 6b 69

   IV:
     0000:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Input:
     0000:  49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65
     0010:  20
   Output:
     0000:  c6 35 35 68 f2 bf 8c b4 d8 a5 80 36 2d a7 ff 7f
     0010:  97
   Next IV:
     0000:  c6 35 35 68 f2 bf 8c b4 d8 a5 80 36 2d a7 ff 7f

   IV:
     0000:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Input:
     0000:  49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65
     0010:  20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20
   Output:
     0000:  fc 00 78 3e 0e fd b2 c1 d4 45 d4 c8 ef f7 ed 22
     0010:  97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5
   Next IV:
     0000:  fc 00 78 3e 0e fd b2 c1 d4 45 d4 c8 ef f7 ed 22

Raeburn                     Standards Track                    [Page 12]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   IV:
     0000:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Input:
     0000:  49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65
     0010:  20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43
   Output:
     0000:  39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8
     0010:  97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84
   Next IV:
     0000:  39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8

   IV:
     0000:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Input:
     0000:  49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65
     0010:  20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43
     0020:  68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c
   Output:
     0000:  97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84
     0010:  b3 ff fd 94 0c 16 a1 8c 1b 55 49 d2 f8 38 02 9e
     0020:  39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5
   Next IV:
     0000:  b3 ff fd 94 0c 16 a1 8c 1b 55 49 d2 f8 38 02 9e

   IV:
     0000:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Input:
     0000:  49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65
     0010:  20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43
     0020:  68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c 20
   Output:
     0000:  97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84
     0010:  9d ad 8b bb 96 c4 cd c0 3b c1 03 e1 a1 94 bb d8
     0020:  39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8
   Next IV:
     0000:  9d ad 8b bb 96 c4 cd c0 3b c1 03 e1 a1 94 bb d8

Raeburn                     Standards Track                    [Page 13]

RFC 3962             AES Encryption for Kerberos 5         February 2005

   IV:
     0000:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Input:
     0000:  49 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 68 65
     0010:  20 47 65 6e 65 72 61 6c 20 47 61 75 27 73 20 43
     0020:  68 69 63 6b 65 6e 2c 20 70 6c 65 61 73 65 2c 20
     0030:  61 6e 64 20 77 6f 6e 74 6f 6e 20 73 6f 75 70 2e
   Output:
     0000:  97 68 72 68 d6 ec cc c0 c0 7b 25 e2 5e cf e5 84
     0010:  39 31 25 23 a7 86 62 d5 be 7f cb cc 98 eb f5 a8
     0020:  48 07 ef e8 36 ee 89 a5 26 73 0d bc 2f 7b c8 40
     0030:  9d ad 8b bb 96 c4 cd c0 3b c1 03 e1 a1 94 bb d8
   Next IV:
     0000:  48 07 ef e8 36 ee 89 a5 26 73 0d bc 2f 7b c8 40

Normative References

   [AC]       Schneier, B., "Applied Cryptography", second edition, John
              Wiley and Sons, New York, 1996.

   [AES]      National Institute of Standards and Technology, U.S.
              Department of Commerce, "Advanced Encryption Standard",
              Federal Information Processing Standards Publication 197,
              Washington, DC, November 2001.

   [KCRYPTO]  Raeburn, K., "Encryption and Checksum Specifications for
              Kerberos 5", RFC 3961, February 2005.

   [KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [PKCS5]    Kaliski, B., "PKCS #5: Password-Based Cryptography
              Specification Version 2.0", RFC 2898, September 2000.

   [RC5]      Baldwin, R. and R. Rivest, "The RC5, RC5-CBC, RC5-CBC-Pad,
              and RC5-CTS Algorithms", RFC 2040, October 1996.

   [SHA1]     National Institute of Standards and Technology, U.S.
              Department of Commerce, "Secure Hash Standard", Federal
              Information Processing Standards Publication 180-1,
              Washington, DC, April 1995.

Raeburn                     Standards Track                    [Page 14]

RFC 3962             AES Encryption for Kerberos 5         February 2005

Informative References

   [LEACH]    Leach, P., email to IETF Kerberos working group mailing
              list, 5 May 2003, ftp://ftp.ietf.org/ietf-mail-
              archive/krb-wg/2003-05.mail.

   [PECMS]    Gutmann, P., "Password-based Encryption for CMS", RFC
              3211, December 2001.

Author's Address

   Kenneth Raeburn
   Massachusetts Institute of Technology
   77 Massachusetts Avenue
   Cambridge, MA 02139

   EMail: raeburn@mit.edu

Raeburn                     Standards Track                    [Page 15]

RFC 3962             AES Encryption for Kerberos 5         February 2005

Full Copyright Statement

   Copyright (C) The Internet Society (2005).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the IETF's procedures with respect to rights in IETF Documents can
   be found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at ietf-
   ipr@ietf.org.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.

Raeburn                     Standards Track                    [Page 16]


Восстановление паролей к хэшам

SAMInside
Скачать (v2.6.2.0), 931 Кб
Скриншот
Купить
Восстановление паролей на вход в Windows 2000/XP/Vista
• Свыше 10 видов импорта: из SAM, *.LC, *.LCP, *.LCS, *.HDT,
PWDUMP и других файлов.
• 4 вида атаки, включая атаку по Rainbow-таблицам.
Обновлено: 26.11.2007

PasswordsPro
Скачать (v2.4.1.0), 882 Кб
Скриншот
Купить
Восстановление паролей к хэшам пользователей
• Свыше 30 типов хэшей - DES, MD4, MD5, MySQL, SHA-1 и др.
• Поддержка внешних модулей.
• 7 видов атак, включая атаку по Rainbow-таблицам.
Обновлено: 01.01.2008

Словари
Файлов: 68

Библиотека
Документов: 298

Генератор хэшей
Алгоритмов: 98

Подписка на новости
Подписчиков: 667

Новости интернета
Новостных RSS-лент: 21

Расчет Rainbow-таблиц

Служба поддержки (ICQ)
Служба поддержки (E-mail)

Кнопки InsidePro
Хостинг от SpaceWeb

Яндекс.тИЦ
Google PageRank

Просмотров страниц: | 6142017
Всего посещений: | 1876451
Посетителей сегодня: | 1161
Форум
Сообщений: 5633
Последнее: 24.01.2008, 16:24
 База хэшей
Хэшей: 10037849
Найдено паролей: 18824
Добавить в "Избранное"
Сделать стартовой страницей
Английская версия сайта

Новости сайта

23.11.2007
Программа PasswordsPro обновилась до версии 2.4.1.0.
В новой версии:
• Все типы хэшей с суффиксом [PHP] реализованы в виде внешних DLL-модулей.
• Добавлены внешние модули для новых типов хэшей из популярных форумов и др. программ:
md5($salt.$pass)
md5($pass.$salt)
md5(md5($salt).$pass)
md5($salt.$pass.$salt)
md5($salt.md5($salt.$pass))
• Архив с программой дополнен модулями хэширования от сторонних разработчиков для следующих типов хэшей - MS SQL, Oracle DES, RipeMD-128, SHA-512 и др.
• Обновлен API для работы с внешними модулями (добавлены новые флаги для более оптимальной работы с внешними модулями).
• Количество модулей, одновременно с которыми может работать программа, увеличено до 64.
• Скорость работы с хэшами типа md5(md5($pass).$salt) увеличена на 25...30%.
• Расширен раздел FAQ в описании программы.
Обсудить на форуме (20).

17.11.2007
Программа SAMInside обновилась до версии 2.6.2.0.
В новой версии:
• Добавлена поддержка файлов SYSTEM реестра Windows, которые содержат несколько различных ключей Syskey.
• Обновлена программа "GetSyskey" из архива с программой и теперь она создает *.KEY-файлы со всеми доступными ключами из файла SYSTEM.
• В архив с программой добавлена новая утилита "PassToSyskey", которая генерирует ключ Syskey на основе вводимого пароля.
• Исправлена ошибка, возникающая при копировании в буфер обмена неанглийских паролей.
• В архив с программой добавлен словарь, содержащий часто используемые пароли.
• Улучшен вид иконок у неактивных пунктов меню.
Обсудить на форуме (4).

Copyright ©2003-2008, InsidePro. All rights reserved.
Thursday, 24th of January 2008, 16:55:24.