From c0634a65575ea902d10096f9dcdb196437328ca2 Mon Sep 17 00:00:00 2001
From: RonniSkansing <rskansing@gmail.com>
Date: Fri, 10 Jul 2026 21:01:58 +0200
Subject: [PATCH] updated xcrypto

Signed-off-by: RonniSkansing <rskansing@gmail.com>
---
 backend/go.mod                                |    2 +-
 backend/go.sum                                |    4 +-
 .../golang.org/x/crypto/blake2b/go125.go      |   11 -
 .../chacha20poly1305_amd64.go                 |    6 +-
 .../chacha20poly1305/chacha20poly1305_amd64.s | 5182 ++---------------
 backend/vendor/modules.txt                    |    2 +-
 6 files changed, 332 insertions(+), 4875 deletions(-)
 delete mode 100644 backend/vendor/golang.org/x/crypto/blake2b/go125.go

diff --git a/backend/go.mod b/backend/go.mod
index 4f1307b..8f79784 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -30,7 +30,7 @@ require (
 	github.com/wneessen/go-mail v0.7.2
 	github.com/yeqown/go-qrcode/v2 v2.2.4
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.51.0
+	golang.org/x/crypto v0.52.0
 	golang.org/x/mod v0.35.0
 	golang.org/x/net v0.55.0
 	golang.org/x/oauth2 v0.27.0
diff --git a/backend/go.sum b/backend/go.sum
index c9e9515..fc3a3b4 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -277,8 +277,8 @@ golang.org/x/arch v0.9.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
diff --git a/backend/vendor/golang.org/x/crypto/blake2b/go125.go b/backend/vendor/golang.org/x/crypto/blake2b/go125.go
deleted file mode 100644
index 67e990b..0000000
--- a/backend/vendor/golang.org/x/crypto/blake2b/go125.go
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright 2025 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build go1.25
-
-package blake2b
-
-import "hash"
-
-var _ hash.XOF = (*xof)(nil)
diff --git a/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go b/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
index b850e77..bfe546b 100644
--- a/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
+++ b/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
@@ -20,7 +20,7 @@ func chacha20Poly1305Open(dst []byte, key []uint32, src, ad []byte) bool
 func chacha20Poly1305Seal(dst []byte, key []uint32, src, ad []byte)
 
 var (
-	useAVX2 = cpu.X86.HasAVX2 && cpu.X86.HasBMI2
+	useAVX2 = cpu.X86.HasSSSE3 && cpu.X86.HasAVX2 && cpu.X86.HasBMI2
 )
 
 // setupState writes a ChaCha20 input matrix to state. See
@@ -47,7 +47,7 @@ func setupState(state *[16]uint32, key *[32]byte, nonce []byte) {
 }
 
 func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []byte {
-	if !cpu.X86.HasSSSE3 {
+	if !useAVX2 {
 		return c.sealGeneric(dst, nonce, plaintext, additionalData)
 	}
 
@@ -66,7 +66,7 @@ func (c *chacha20poly1305) seal(dst, nonce, plaintext, additionalData []byte) []
 }
 
 func (c *chacha20poly1305) open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) {
-	if !cpu.X86.HasSSSE3 {
+	if !useAVX2 {
 		return c.openGeneric(dst, nonce, ciphertext, additionalData)
 	}
 
diff --git a/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s b/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
index fd5ee84..c703c13 100644
--- a/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
+++ b/backend/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
@@ -6,27 +6,6 @@
 
 // func polyHashADInternal<>()
 TEXT polyHashADInternal<>(SB), NOSPLIT, $0
-	// Hack: Must declare #define macros inside of a function due to Avo constraints
-	// ROL rotates the uint32s in register R left by N bits, using temporary T.
-	#define ROL(N, R, T) \
-		MOVO R, T; \
-		PSLLL $(N), T; \
-		PSRLL $(32-(N)), R; \
-		PXOR T, R
-
-	// ROL8 rotates the uint32s in register R left by 8, using temporary T if needed.
-	#ifdef GOAMD64_v2
-		#define ROL8(R, T) PSHUFB ·rol8<>(SB), R
-	#else
-		#define ROL8(R, T) ROL(8, R, T)
-	#endif
-
-	// ROL16 rotates the uint32s in register R left by 16, using temporary T if needed.
-	#ifdef GOAMD64_v2
-		#define ROL16(R, T) PSHUFB ·rol16<>(SB), R
-	#else
-		#define ROL16(R, T) ROL(16, R, T)
-	#endif
 	XORQ  R10, R10
 	XORQ  R11, R11
 	XORQ  R12, R12
@@ -192,2468 +171,20 @@ hashADDone:
 // Requires: AVX, AVX2, BMI2, CMOV, SSE2
 TEXT ·chacha20Poly1305Open(SB), $288-97
 	// For aligned stack access
-	MOVQ SP, BP
-	ADDQ $0x20, BP
-	ANDQ $-32, BP
-	MOVQ dst_base+0(FP), DI
-	MOVQ key_base+24(FP), R8
-	MOVQ src_base+48(FP), SI
-	MOVQ src_len+56(FP), BX
-	MOVQ ad_base+72(FP), CX
-
-	// Check for AVX2 support
-	CMPB ·useAVX2+0(SB), $0x01
-	JE   chacha20Poly1305Open_AVX2
-
-	// Special optimization, for very short buffers
-	CMPQ BX, $0x80
-	JBE  openSSE128
-
-	// For long buffers, prepare the poly key first
-	MOVOU ·chacha20Constants<>+0(SB), X0
-	MOVOU 16(R8), X3
-	MOVOU 32(R8), X6
-	MOVOU 48(R8), X9
-	MOVO  X9, X13
-
-	// Store state on stack for future use
-	MOVO X3, 32(BP)
-	MOVO X6, 48(BP)
-	MOVO X9, 128(BP)
-	MOVQ $0x0000000a, R9
-
-openSSEPreparePolyKey:
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	DECQ  R9
-	JNE   openSSEPreparePolyKey
-
-	// A0|B0 hold the Poly1305 32-byte key, C0,D0 can be discarded
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL 32(BP), X3
-
-	// Clamp and store the key
-	PAND ·polyClampMask<>+0(SB), X0
-	MOVO X0, (BP)
-	MOVO X3, 16(BP)
-
-	// Hash AAD
-	MOVQ ad_len+80(FP), R9
-	CALL polyHashADInternal<>(SB)
-
-openSSEMainLoop:
-	CMPQ BX, $0x00000100
-	JB   openSSEMainLoopDone
-
-	// Load state, increment counter blocks
-	MOVO  ·chacha20Constants<>+0(SB), X0
-	MOVO  32(BP), X3
-	MOVO  48(BP), X6
-	MOVO  128(BP), X9
-	PADDL ·sseIncMask<>+0(SB), X9
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X1, X2
-	MOVO  X4, X5
-	MOVO  X7, X8
-	MOVO  X10, X11
-	PADDL ·sseIncMask<>+0(SB), X11
-	MOVO  X2, X12
-	MOVO  X5, X13
-	MOVO  X8, X14
-	MOVO  X11, X15
-	PADDL ·sseIncMask<>+0(SB), X15
-
-	// Store counters
-	MOVO X9, 80(BP)
-	MOVO X10, 96(BP)
-	MOVO X11, 112(BP)
-	MOVO X15, 128(BP)
-
-	// There are 10 ChaCha20 iterations of 2QR each, so for 6 iterations we hash
-	// 2 blocks, and for the remaining 4 only 1 block - for a total of 16
-	MOVQ $0x00000004, CX
-	MOVQ SI, R9
-
-openSSEInternalLoop:
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	ADDQ  (R9), R10
-	ADCQ  8(R9), R11
-	ADCQ  $0x01, R12
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x0c
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	LEAQ  16(R9), R9
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x04
-	DECQ  CX
-	JGE   openSSEInternalLoop
-	ADDQ  (R9), R10
-	ADCQ  8(R9), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(R9), R9
-	CMPQ  CX, $-6
-	JG    openSSEInternalLoop
-
-	// Add in the state
-	PADDD ·chacha20Constants<>+0(SB), X0
-	PADDD ·chacha20Constants<>+0(SB), X1
-	PADDD ·chacha20Constants<>+0(SB), X2
-	PADDD ·chacha20Constants<>+0(SB), X12
-	PADDD 32(BP), X3
-	PADDD 32(BP), X4
-	PADDD 32(BP), X5
-	PADDD 32(BP), X13
-	PADDD 48(BP), X6
-	PADDD 48(BP), X7
-	PADDD 48(BP), X8
-	PADDD 48(BP), X14
-	PADDD 80(BP), X9
-	PADDD 96(BP), X10
-	PADDD 112(BP), X11
-	PADDD 128(BP), X15
-
-	// Load - xor - store
-	MOVO  X15, 64(BP)
-	MOVOU (SI), X15
-	PXOR  X15, X0
-	MOVOU X0, (DI)
-	MOVOU 16(SI), X15
-	PXOR  X15, X3
-	MOVOU X3, 16(DI)
-	MOVOU 32(SI), X15
-	PXOR  X15, X6
-	MOVOU X6, 32(DI)
-	MOVOU 48(SI), X15
-	PXOR  X15, X9
-	MOVOU X9, 48(DI)
-	MOVOU 64(SI), X9
-	PXOR  X9, X1
-	MOVOU X1, 64(DI)
-	MOVOU 80(SI), X9
-	PXOR  X9, X4
-	MOVOU X4, 80(DI)
-	MOVOU 96(SI), X9
-	PXOR  X9, X7
-	MOVOU X7, 96(DI)
-	MOVOU 112(SI), X9
-	PXOR  X9, X10
-	MOVOU X10, 112(DI)
-	MOVOU 128(SI), X9
-	PXOR  X9, X2
-	MOVOU X2, 128(DI)
-	MOVOU 144(SI), X9
-	PXOR  X9, X5
-	MOVOU X5, 144(DI)
-	MOVOU 160(SI), X9
-	PXOR  X9, X8
-	MOVOU X8, 160(DI)
-	MOVOU 176(SI), X9
-	PXOR  X9, X11
-	MOVOU X11, 176(DI)
-	MOVOU 192(SI), X9
-	PXOR  X9, X12
-	MOVOU X12, 192(DI)
-	MOVOU 208(SI), X9
-	PXOR  X9, X13
-	MOVOU X13, 208(DI)
-	MOVOU 224(SI), X9
-	PXOR  X9, X14
-	MOVOU X14, 224(DI)
-	MOVOU 240(SI), X9
-	PXOR  64(BP), X9
-	MOVOU X9, 240(DI)
-	LEAQ  256(SI), SI
-	LEAQ  256(DI), DI
-	SUBQ  $0x00000100, BX
-	JMP   openSSEMainLoop
-
-openSSEMainLoopDone:
-	// Handle the various tail sizes efficiently
-	TESTQ BX, BX
-	JE    openSSEFinalize
-	CMPQ  BX, $0x40
-	JBE   openSSETail64
-	CMPQ  BX, $0x80
-	JBE   openSSETail128
-	CMPQ  BX, $0xc0
-	JBE   openSSETail192
-	JMP   openSSETail256
-
-openSSEFinalize:
-	// Hash in the PT, AAD lengths
-	ADDQ  ad_len+80(FP), R10
-	ADCQ  src_len+56(FP), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-
-	// Final reduce
-	MOVQ    R10, R13
-	MOVQ    R11, R14
-	MOVQ    R12, R15
-	SUBQ    $-5, R10
-	SBBQ    $-1, R11
-	SBBQ    $0x03, R12
-	CMOVQCS R13, R10
-	CMOVQCS R14, R11
-	CMOVQCS R15, R12
-
-	// Add in the "s" part of the key
-	ADDQ 16(BP), R10
-	ADCQ 24(BP), R11
-
-	// Finally, constant time compare to the tag at the end of the message
-	XORQ    AX, AX
-	MOVQ    $0x00000001, DX
-	XORQ    (SI), R10
-	XORQ    8(SI), R11
-	ORQ     R11, R10
-	CMOVQEQ DX, AX
-
-	// Return true iff tags are equal
-	MOVB AX, ret+96(FP)
-	RET
-
-openSSE128:
-	MOVOU ·chacha20Constants<>+0(SB), X0
-	MOVOU 16(R8), X3
-	MOVOU 32(R8), X6
-	MOVOU 48(R8), X9
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X1, X2
-	MOVO  X4, X5
-	MOVO  X7, X8
-	MOVO  X10, X11
-	PADDL ·sseIncMask<>+0(SB), X11
-	MOVO  X3, X13
-	MOVO  X6, X14
-	MOVO  X10, X15
-	MOVQ  $0x0000000a, R9
-
-openSSE128InnerCipherLoop:
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	DECQ  R9
-	JNE   openSSE128InnerCipherLoop
-
-	// A0|B0 hold the Poly1305 32-byte key, C0,D0 can be discarded
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL ·chacha20Constants<>+0(SB), X1
-	PADDL ·chacha20Constants<>+0(SB), X2
-	PADDL X13, X3
-	PADDL X13, X4
-	PADDL X13, X5
-	PADDL X14, X7
-	PADDL X14, X8
-	PADDL X15, X10
-	PADDL ·sseIncMask<>+0(SB), X15
-	PADDL X15, X11
-
-	// Clamp and store the key
-	PAND  ·polyClampMask<>+0(SB), X0
-	MOVOU X0, (BP)
-	MOVOU X3, 16(BP)
-
-	// Hash
-	MOVQ ad_len+80(FP), R9
-	CALL polyHashADInternal<>(SB)
-
-openSSE128Open:
-	CMPQ BX, $0x10
-	JB   openSSETail16
-	SUBQ $0x10, BX
-
-	// Load for hashing
-	ADDQ (SI), R10
-	ADCQ 8(SI), R11
-	ADCQ $0x01, R12
-
-	// Load for decryption
-	MOVOU (SI), X12
-	PXOR  X12, X1
-	MOVOU X1, (DI)
-	LEAQ  16(SI), SI
-	LEAQ  16(DI), DI
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-
-	// Shift the stream "left"
-	MOVO X4, X1
-	MOVO X7, X4
-	MOVO X10, X7
-	MOVO X2, X10
-	MOVO X5, X2
-	MOVO X8, X5
-	MOVO X11, X8
-	JMP  openSSE128Open
-
-openSSETail16:
-	TESTQ BX, BX
-	JE    openSSEFinalize
-
-	// We can safely load the CT from the end, because it is padded with the MAC
-	MOVQ  BX, R9
-	SHLQ  $0x04, R9
-	LEAQ  ·andMask<>+0(SB), R13
-	MOVOU (SI), X12
-	ADDQ  BX, SI
-	PAND  -16(R13)(R9*1), X12
-	MOVO  X12, 64(BP)
-	MOVQ  X12, R13
-	MOVQ  72(BP), R14
-	PXOR  X1, X12
-
-	// We can only store one byte at a time, since plaintext can be shorter than 16 bytes
-openSSETail16Store:
-	MOVQ   X12, R8
-	MOVB   R8, (DI)
-	PSRLDQ $0x01, X12
-	INCQ   DI
-	DECQ   BX
-	JNE    openSSETail16Store
-	ADDQ   R13, R10
-	ADCQ   R14, R11
-	ADCQ   $0x01, R12
-	MOVQ   (BP), AX
-	MOVQ   AX, R15
-	MULQ   R10
-	MOVQ   AX, R13
-	MOVQ   DX, R14
-	MOVQ   (BP), AX
-	MULQ   R11
-	IMULQ  R12, R15
-	ADDQ   AX, R14
-	ADCQ   DX, R15
-	MOVQ   8(BP), AX
-	MOVQ   AX, R8
-	MULQ   R10
-	ADDQ   AX, R14
-	ADCQ   $0x00, DX
-	MOVQ   DX, R10
-	MOVQ   8(BP), AX
-	MULQ   R11
-	ADDQ   AX, R15
-	ADCQ   $0x00, DX
-	IMULQ  R12, R8
-	ADDQ   R10, R15
-	ADCQ   DX, R8
-	MOVQ   R13, R10
-	MOVQ   R14, R11
-	MOVQ   R15, R12
-	ANDQ   $0x03, R12
-	MOVQ   R15, R13
-	ANDQ   $-4, R13
-	MOVQ   R8, R14
-	SHRQ   $0x02, R8, R15
-	SHRQ   $0x02, R8
-	ADDQ   R13, R10
-	ADCQ   R14, R11
-	ADCQ   $0x00, R12
-	ADDQ   R15, R10
-	ADCQ   R8, R11
-	ADCQ   $0x00, R12
-	JMP    openSSEFinalize
-
-openSSETail64:
-	MOVO  ·chacha20Constants<>+0(SB), X0
-	MOVO  32(BP), X3
-	MOVO  48(BP), X6
-	MOVO  128(BP), X9
-	PADDL ·sseIncMask<>+0(SB), X9
-	MOVO  X9, 80(BP)
-	XORQ  R9, R9
-	MOVQ  BX, CX
-	CMPQ  CX, $0x10
-	JB    openSSETail64LoopB
-
-openSSETail64LoopA:
-	ADDQ  (SI)(R9*1), R10
-	ADCQ  8(SI)(R9*1), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	SUBQ  $0x10, CX
-
-openSSETail64LoopB:
-	ADDQ  $0x10, R9
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	CMPQ  CX, $0x10
-	JAE   openSSETail64LoopA
-	CMPQ  R9, $0xa0
-	JNE   openSSETail64LoopB
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL 32(BP), X3
-	PADDL 48(BP), X6
-	PADDL 80(BP), X9
-
-openSSETail64DecLoop:
-	CMPQ  BX, $0x10
-	JB    openSSETail64DecLoopDone
-	SUBQ  $0x10, BX
-	MOVOU (SI), X12
-	PXOR  X12, X0
-	MOVOU X0, (DI)
-	LEAQ  16(SI), SI
-	LEAQ  16(DI), DI
-	MOVO  X3, X0
-	MOVO  X6, X3
-	MOVO  X9, X6
-	JMP   openSSETail64DecLoop
-
-openSSETail64DecLoopDone:
-	MOVO X0, X1
-	JMP  openSSETail16
-
-openSSETail128:
-	MOVO  ·chacha20Constants<>+0(SB), X1
-	MOVO  32(BP), X4
-	MOVO  48(BP), X7
-	MOVO  128(BP), X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X10, 80(BP)
-	MOVO  X1, X0
-	MOVO  X4, X3
-	MOVO  X7, X6
-	MOVO  X10, X9
-	PADDL ·sseIncMask<>+0(SB), X9
-	MOVO  X9, 96(BP)
-	XORQ  R9, R9
-	MOVQ  BX, CX
-	ANDQ  $-16, CX
-
-openSSETail128LoopA:
-	ADDQ  (SI)(R9*1), R10
-	ADCQ  8(SI)(R9*1), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-
-openSSETail128LoopB:
-	ADDQ  $0x10, R9
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	CMPQ  R9, CX
-	JB    openSSETail128LoopA
-	CMPQ  R9, $0xa0
-	JNE   openSSETail128LoopB
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL ·chacha20Constants<>+0(SB), X1
-	PADDL 32(BP), X3
-	PADDL 32(BP), X4
-	PADDL 48(BP), X6
-	PADDL 48(BP), X7
-	PADDL 96(BP), X9
-	PADDL 80(BP), X10
-	MOVOU (SI), X12
-	MOVOU 16(SI), X13
-	MOVOU 32(SI), X14
-	MOVOU 48(SI), X15
-	PXOR  X12, X1
-	PXOR  X13, X4
-	PXOR  X14, X7
-	PXOR  X15, X10
-	MOVOU X1, (DI)
-	MOVOU X4, 16(DI)
-	MOVOU X7, 32(DI)
-	MOVOU X10, 48(DI)
-	SUBQ  $0x40, BX
-	LEAQ  64(SI), SI
-	LEAQ  64(DI), DI
-	JMP   openSSETail64DecLoop
-
-openSSETail192:
-	MOVO    ·chacha20Constants<>+0(SB), X2
-	MOVO    32(BP), X5
-	MOVO    48(BP), X8
-	MOVO    128(BP), X11
-	PADDL   ·sseIncMask<>+0(SB), X11
-	MOVO    X11, 80(BP)
-	MOVO    X2, X1
-	MOVO    X5, X4
-	MOVO    X8, X7
-	MOVO    X11, X10
-	PADDL   ·sseIncMask<>+0(SB), X10
-	MOVO    X10, 96(BP)
-	MOVO    X1, X0
-	MOVO    X4, X3
-	MOVO    X7, X6
-	MOVO    X10, X9
-	PADDL   ·sseIncMask<>+0(SB), X9
-	MOVO    X9, 112(BP)
-	MOVQ    BX, CX
-	MOVQ    $0x000000a0, R9
-	CMPQ    CX, $0xa0
-	CMOVQGT R9, CX
-	ANDQ    $-16, CX
-	XORQ    R9, R9
-
-openSSLTail192LoopA:
-	ADDQ  (SI)(R9*1), R10
-	ADCQ  8(SI)(R9*1), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-
-openSSLTail192LoopB:
-	ADDQ  $0x10, R9
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	CMPQ  R9, CX
-	JB    openSSLTail192LoopA
-	CMPQ  R9, $0xa0
-	JNE   openSSLTail192LoopB
-	CMPQ  BX, $0xb0
-	JB    openSSLTail192Store
-	ADDQ  160(SI), R10
-	ADCQ  168(SI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	CMPQ  BX, $0xc0
-	JB    openSSLTail192Store
-	ADDQ  176(SI), R10
-	ADCQ  184(SI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-
-openSSLTail192Store:
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL ·chacha20Constants<>+0(SB), X1
-	PADDL ·chacha20Constants<>+0(SB), X2
-	PADDL 32(BP), X3
-	PADDL 32(BP), X4
-	PADDL 32(BP), X5
-	PADDL 48(BP), X6
-	PADDL 48(BP), X7
-	PADDL 48(BP), X8
-	PADDL 112(BP), X9
-	PADDL 96(BP), X10
-	PADDL 80(BP), X11
-	MOVOU (SI), X12
-	MOVOU 16(SI), X13
-	MOVOU 32(SI), X14
-	MOVOU 48(SI), X15
-	PXOR  X12, X2
-	PXOR  X13, X5
-	PXOR  X14, X8
-	PXOR  X15, X11
-	MOVOU X2, (DI)
-	MOVOU X5, 16(DI)
-	MOVOU X8, 32(DI)
-	MOVOU X11, 48(DI)
-	MOVOU 64(SI), X12
-	MOVOU 80(SI), X13
-	MOVOU 96(SI), X14
-	MOVOU 112(SI), X15
-	PXOR  X12, X1
-	PXOR  X13, X4
-	PXOR  X14, X7
-	PXOR  X15, X10
-	MOVOU X1, 64(DI)
-	MOVOU X4, 80(DI)
-	MOVOU X7, 96(DI)
-	MOVOU X10, 112(DI)
-	SUBQ  $0x80, BX
-	LEAQ  128(SI), SI
-	LEAQ  128(DI), DI
-	JMP   openSSETail64DecLoop
-
-openSSETail256:
-	MOVO  ·chacha20Constants<>+0(SB), X0
-	MOVO  32(BP), X3
-	MOVO  48(BP), X6
-	MOVO  128(BP), X9
-	PADDL ·sseIncMask<>+0(SB), X9
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X1, X2
-	MOVO  X4, X5
-	MOVO  X7, X8
-	MOVO  X10, X11
-	PADDL ·sseIncMask<>+0(SB), X11
-	MOVO  X2, X12
-	MOVO  X5, X13
-	MOVO  X8, X14
-	MOVO  X11, X15
-	PADDL ·sseIncMask<>+0(SB), X15
-
-	// Store counters
-	MOVO X9, 80(BP)
-	MOVO X10, 96(BP)
-	MOVO X11, 112(BP)
-	MOVO X15, 128(BP)
-	XORQ R9, R9
-
-openSSETail256Loop:
-	ADDQ  (SI)(R9*1), R10
-	ADCQ  8(SI)(R9*1), R11
-	ADCQ  $0x01, R12
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x0c
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x04
-	ADDQ  $0x10, R9
-	CMPQ  R9, $0xa0
-	JB    openSSETail256Loop
-	MOVQ  BX, CX
-	ANDQ  $-16, CX
-
-openSSETail256HashLoop:
-	ADDQ  (SI)(R9*1), R10
-	ADCQ  8(SI)(R9*1), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	ADDQ  $0x10, R9
-	CMPQ  R9, CX
-	JB    openSSETail256HashLoop
-
-	// Add in the state
-	PADDD ·chacha20Constants<>+0(SB), X0
-	PADDD ·chacha20Constants<>+0(SB), X1
-	PADDD ·chacha20Constants<>+0(SB), X2
-	PADDD ·chacha20Constants<>+0(SB), X12
-	PADDD 32(BP), X3
-	PADDD 32(BP), X4
-	PADDD 32(BP), X5
-	PADDD 32(BP), X13
-	PADDD 48(BP), X6
-	PADDD 48(BP), X7
-	PADDD 48(BP), X8
-	PADDD 48(BP), X14
-	PADDD 80(BP), X9
-	PADDD 96(BP), X10
-	PADDD 112(BP), X11
-	PADDD 128(BP), X15
-	MOVO  X15, 64(BP)
-
-	// Load - xor - store
-	MOVOU (SI), X15
-	PXOR  X15, X0
-	MOVOU 16(SI), X15
-	PXOR  X15, X3
-	MOVOU 32(SI), X15
-	PXOR  X15, X6
-	MOVOU 48(SI), X15
-	PXOR  X15, X9
-	MOVOU X0, (DI)
-	MOVOU X3, 16(DI)
-	MOVOU X6, 32(DI)
-	MOVOU X9, 48(DI)
-	MOVOU 64(SI), X0
-	MOVOU 80(SI), X3
-	MOVOU 96(SI), X6
-	MOVOU 112(SI), X9
-	PXOR  X0, X1
-	PXOR  X3, X4
-	PXOR  X6, X7
-	PXOR  X9, X10
-	MOVOU X1, 64(DI)
-	MOVOU X4, 80(DI)
-	MOVOU X7, 96(DI)
-	MOVOU X10, 112(DI)
-	MOVOU 128(SI), X0
-	MOVOU 144(SI), X3
-	MOVOU 160(SI), X6
-	MOVOU 176(SI), X9
-	PXOR  X0, X2
-	PXOR  X3, X5
-	PXOR  X6, X8
-	PXOR  X9, X11
-	MOVOU X2, 128(DI)
-	MOVOU X5, 144(DI)
-	MOVOU X8, 160(DI)
-	MOVOU X11, 176(DI)
-	LEAQ  192(SI), SI
-	LEAQ  192(DI), DI
-	SUBQ  $0xc0, BX
-	MOVO  X12, X0
-	MOVO  X13, X3
-	MOVO  X14, X6
-	MOVO  64(BP), X9
-	JMP   openSSETail64DecLoop
-
-chacha20Poly1305Open_AVX2:
+	MOVQ           SP, BP
+	ADDQ           $0x20, BP
+	ANDQ           $-32, BP
+	MOVQ           dst_base+0(FP), DI
+	MOVQ           key_base+24(FP), R8
+	MOVQ           src_base+48(FP), SI
+	MOVQ           src_len+56(FP), BX
+	MOVQ           ad_base+72(FP), CX
 	VZEROUPPER
-	VMOVDQU ·chacha20Constants<>+0(SB), Y0
-	BYTE    $0xc4
-	BYTE    $0x42
-	BYTE    $0x7d
-	BYTE    $0x5a
-	BYTE    $0x70
-	BYTE    $0x10
-	BYTE    $0xc4
-	BYTE    $0x42
-	BYTE    $0x7d
-	BYTE    $0x5a
-	BYTE    $0x60
-	BYTE    $0x20
-	BYTE    $0xc4
-	BYTE    $0xc2
-	BYTE    $0x7d
-	BYTE    $0x5a
-	BYTE    $0x60
-	BYTE    $0x30
-	VPADDD  ·avx2InitMask<>+0(SB), Y4, Y4
+	VMOVDQU        ·chacha20Constants<>+0(SB), Y0
+	VBROADCASTI128 16(R8), Y14
+	VBROADCASTI128 32(R8), Y12
+	VBROADCASTI128 48(R8), Y4
+	VPADDD         ·avx2InitMask<>+0(SB), Y4, Y4
 
 	// Special optimization, for very short buffers
 	CMPQ BX, $0xc0
@@ -3223,6 +754,144 @@ openAVX2MainLoopDone:
 	JBE   openAVX2Tail384
 	JMP   openAVX2Tail512
 
+openSSEFinalize:
+	// Hash in the PT, AAD lengths
+	ADDQ  ad_len+80(FP), R10
+	ADCQ  src_len+56(FP), R11
+	ADCQ  $0x01, R12
+	MOVQ  (BP), AX
+	MOVQ  AX, R15
+	MULQ  R10
+	MOVQ  AX, R13
+	MOVQ  DX, R14
+	MOVQ  (BP), AX
+	MULQ  R11
+	IMULQ R12, R15
+	ADDQ  AX, R14
+	ADCQ  DX, R15
+	MOVQ  8(BP), AX
+	MOVQ  AX, R8
+	MULQ  R10
+	ADDQ  AX, R14
+	ADCQ  $0x00, DX
+	MOVQ  DX, R10
+	MOVQ  8(BP), AX
+	MULQ  R11
+	ADDQ  AX, R15
+	ADCQ  $0x00, DX
+	IMULQ R12, R8
+	ADDQ  R10, R15
+	ADCQ  DX, R8
+	MOVQ  R13, R10
+	MOVQ  R14, R11
+	MOVQ  R15, R12
+	ANDQ  $0x03, R12
+	MOVQ  R15, R13
+	ANDQ  $-4, R13
+	MOVQ  R8, R14
+	SHRQ  $0x02, R8, R15
+	SHRQ  $0x02, R8
+	ADDQ  R13, R10
+	ADCQ  R14, R11
+	ADCQ  $0x00, R12
+	ADDQ  R15, R10
+	ADCQ  R8, R11
+	ADCQ  $0x00, R12
+
+	// Final reduce
+	MOVQ    R10, R13
+	MOVQ    R11, R14
+	MOVQ    R12, R15
+	SUBQ    $-5, R10
+	SBBQ    $-1, R11
+	SBBQ    $0x03, R12
+	CMOVQCS R13, R10
+	CMOVQCS R14, R11
+	CMOVQCS R15, R12
+
+	// Add in the "s" part of the key
+	ADDQ 16(BP), R10
+	ADCQ 24(BP), R11
+
+	// Finally, constant time compare to the tag at the end of the message
+	XORQ    AX, AX
+	MOVQ    $0x00000001, DX
+	XORQ    (SI), R10
+	XORQ    8(SI), R11
+	ORQ     R11, R10
+	CMOVQEQ DX, AX
+
+	// Return true iff tags are equal
+	MOVB AX, ret+96(FP)
+	RET
+
+openSSETail16:
+	TESTQ BX, BX
+	JE    openSSEFinalize
+
+	// We can safely load the CT from the end, because it is padded with the MAC
+	MOVQ  BX, R9
+	SHLQ  $0x04, R9
+	LEAQ  ·andMask<>+0(SB), R13
+	MOVOU (SI), X12
+	ADDQ  BX, SI
+	PAND  -16(R13)(R9*1), X12
+	MOVO  X12, 64(BP)
+	MOVQ  X12, R13
+	MOVQ  72(BP), R14
+	PXOR  X1, X12
+
+	// We can only store one byte at a time, since plaintext can be shorter than 16 bytes
+openSSETail16Store:
+	MOVQ   X12, R8
+	MOVB   R8, (DI)
+	PSRLDQ $0x01, X12
+	INCQ   DI
+	DECQ   BX
+	JNE    openSSETail16Store
+	ADDQ   R13, R10
+	ADCQ   R14, R11
+	ADCQ   $0x01, R12
+	MOVQ   (BP), AX
+	MOVQ   AX, R15
+	MULQ   R10
+	MOVQ   AX, R13
+	MOVQ   DX, R14
+	MOVQ   (BP), AX
+	MULQ   R11
+	IMULQ  R12, R15
+	ADDQ   AX, R14
+	ADCQ   DX, R15
+	MOVQ   8(BP), AX
+	MOVQ   AX, R8
+	MULQ   R10
+	ADDQ   AX, R14
+	ADCQ   $0x00, DX
+	MOVQ   DX, R10
+	MOVQ   8(BP), AX
+	MULQ   R11
+	ADDQ   AX, R15
+	ADCQ   $0x00, DX
+	IMULQ  R12, R8
+	ADDQ   R10, R15
+	ADCQ   DX, R8
+	MOVQ   R13, R10
+	MOVQ   R14, R11
+	MOVQ   R15, R12
+	ANDQ   $0x03, R12
+	MOVQ   R15, R13
+	ANDQ   $-4, R13
+	MOVQ   R8, R14
+	SHRQ   $0x02, R8, R15
+	SHRQ   $0x02, R8
+	ADDQ   R13, R10
+	ADCQ   R14, R11
+	ADCQ   $0x00, R12
+	ADDQ   R15, R10
+	ADCQ   R8, R11
+	ADCQ   $0x00, R12
+	JMP    openSSEFinalize
+
 openAVX2192:
 	VMOVDQA Y0, Y5
 	VMOVDQA Y14, Y9
@@ -4739,15 +2408,35 @@ DATA ·chacha20Constants<>+24(SB)/4, $0x79622d32
 DATA ·chacha20Constants<>+28(SB)/4, $0x6b206574
 GLOBL ·chacha20Constants<>(SB), RODATA|NOPTR, $32
 
+DATA ·avx2InitMask<>+0(SB)/8, $0x0000000000000000
+DATA ·avx2InitMask<>+8(SB)/8, $0x0000000000000000
+DATA ·avx2InitMask<>+16(SB)/8, $0x0000000000000001
+DATA ·avx2InitMask<>+24(SB)/8, $0x0000000000000000
+GLOBL ·avx2InitMask<>(SB), RODATA|NOPTR, $32
+
+DATA ·rol16<>+0(SB)/8, $0x0504070601000302
+DATA ·rol16<>+8(SB)/8, $0x0d0c0f0e09080b0a
+DATA ·rol16<>+16(SB)/8, $0x0504070601000302
+DATA ·rol16<>+24(SB)/8, $0x0d0c0f0e09080b0a
+GLOBL ·rol16<>(SB), RODATA|NOPTR, $32
+
+DATA ·rol8<>+0(SB)/8, $0x0605040702010003
+DATA ·rol8<>+8(SB)/8, $0x0e0d0c0f0a09080b
+DATA ·rol8<>+16(SB)/8, $0x0605040702010003
+DATA ·rol8<>+24(SB)/8, $0x0e0d0c0f0a09080b
+GLOBL ·rol8<>(SB), RODATA|NOPTR, $32
+
 DATA ·polyClampMask<>+0(SB)/8, $0x0ffffffc0fffffff
 DATA ·polyClampMask<>+8(SB)/8, $0x0ffffffc0ffffffc
 DATA ·polyClampMask<>+16(SB)/8, $0xffffffffffffffff
 DATA ·polyClampMask<>+24(SB)/8, $0xffffffffffffffff
 GLOBL ·polyClampMask<>(SB), RODATA|NOPTR, $32
 
-DATA ·sseIncMask<>+0(SB)/8, $0x0000000000000001
-DATA ·sseIncMask<>+8(SB)/8, $0x0000000000000000
-GLOBL ·sseIncMask<>(SB), RODATA|NOPTR, $16
+DATA ·avx2IncMask<>+0(SB)/8, $0x0000000000000002
+DATA ·avx2IncMask<>+8(SB)/8, $0x0000000000000000
+DATA ·avx2IncMask<>+16(SB)/8, $0x0000000000000002
+DATA ·avx2IncMask<>+24(SB)/8, $0x0000000000000000
+GLOBL ·avx2IncMask<>(SB), RODATA|NOPTR, $32
 
 DATA ·andMask<>+0(SB)/8, $0x00000000000000ff
 DATA ·andMask<>+8(SB)/8, $0x0000000000000000
@@ -4781,2382 +2470,23 @@ DATA ·andMask<>+224(SB)/8, $0xffffffffffffffff
 DATA ·andMask<>+232(SB)/8, $0x00ffffffffffffff
 GLOBL ·andMask<>(SB), RODATA|NOPTR, $240
 
-DATA ·avx2InitMask<>+0(SB)/8, $0x0000000000000000
-DATA ·avx2InitMask<>+8(SB)/8, $0x0000000000000000
-DATA ·avx2InitMask<>+16(SB)/8, $0x0000000000000001
-DATA ·avx2InitMask<>+24(SB)/8, $0x0000000000000000
-GLOBL ·avx2InitMask<>(SB), RODATA|NOPTR, $32
-
-DATA ·rol16<>+0(SB)/8, $0x0504070601000302
-DATA ·rol16<>+8(SB)/8, $0x0d0c0f0e09080b0a
-DATA ·rol16<>+16(SB)/8, $0x0504070601000302
-DATA ·rol16<>+24(SB)/8, $0x0d0c0f0e09080b0a
-GLOBL ·rol16<>(SB), RODATA|NOPTR, $32
-
-DATA ·rol8<>+0(SB)/8, $0x0605040702010003
-DATA ·rol8<>+8(SB)/8, $0x0e0d0c0f0a09080b
-DATA ·rol8<>+16(SB)/8, $0x0605040702010003
-DATA ·rol8<>+24(SB)/8, $0x0e0d0c0f0a09080b
-GLOBL ·rol8<>(SB), RODATA|NOPTR, $32
-
-DATA ·avx2IncMask<>+0(SB)/8, $0x0000000000000002
-DATA ·avx2IncMask<>+8(SB)/8, $0x0000000000000000
-DATA ·avx2IncMask<>+16(SB)/8, $0x0000000000000002
-DATA ·avx2IncMask<>+24(SB)/8, $0x0000000000000000
-GLOBL ·avx2IncMask<>(SB), RODATA|NOPTR, $32
-
 // func chacha20Poly1305Seal(dst []byte, key []uint32, src []byte, ad []byte)
 // Requires: AVX, AVX2, BMI2, CMOV, SSE2
 TEXT ·chacha20Poly1305Seal(SB), $288-96
-	MOVQ SP, BP
-	ADDQ $0x20, BP
-	ANDQ $-32, BP
-	MOVQ dst_base+0(FP), DI
-	MOVQ key_base+24(FP), R8
-	MOVQ src_base+48(FP), SI
-	MOVQ src_len+56(FP), BX
-	MOVQ ad_base+72(FP), CX
-	CMPB ·useAVX2+0(SB), $0x01
-	JE   chacha20Poly1305Seal_AVX2
-
-	// Special optimization, for very short buffers
-	CMPQ BX, $0x80
-	JBE  sealSSE128
-
-	// In the seal case - prepare the poly key + 3 blocks of stream in the first iteration
-	MOVOU ·chacha20Constants<>+0(SB), X0
-	MOVOU 16(R8), X3
-	MOVOU 32(R8), X6
-	MOVOU 48(R8), X9
-
-	// Store state on stack for future use
-	MOVO X3, 32(BP)
-	MOVO X6, 48(BP)
-
-	// Load state, increment counter blocks
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X1, X2
-	MOVO  X4, X5
-	MOVO  X7, X8
-	MOVO  X10, X11
-	PADDL ·sseIncMask<>+0(SB), X11
-	MOVO  X2, X12
-	MOVO  X5, X13
-	MOVO  X8, X14
-	MOVO  X11, X15
-	PADDL ·sseIncMask<>+0(SB), X15
-
-	// Store counters
-	MOVO X9, 80(BP)
-	MOVO X10, 96(BP)
-	MOVO X11, 112(BP)
-	MOVO X15, 128(BP)
-	MOVQ $0x0000000a, R9
-
-sealSSEIntroLoop:
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x0c
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x04
-	DECQ  R9
-	JNE   sealSSEIntroLoop
-
-	// Add in the state
-	PADDD ·chacha20Constants<>+0(SB), X0
-	PADDD ·chacha20Constants<>+0(SB), X1
-	PADDD ·chacha20Constants<>+0(SB), X2
-	PADDD ·chacha20Constants<>+0(SB), X12
-	PADDD 32(BP), X3
-	PADDD 32(BP), X4
-	PADDD 32(BP), X5
-	PADDD 32(BP), X13
-	PADDD 48(BP), X7
-	PADDD 48(BP), X8
-	PADDD 48(BP), X14
-	PADDD 96(BP), X10
-	PADDD 112(BP), X11
-	PADDD 128(BP), X15
-
-	// Clamp and store the key
-	PAND ·polyClampMask<>+0(SB), X0
-	MOVO X0, (BP)
-	MOVO X3, 16(BP)
-
-	// Hash AAD
-	MOVQ  ad_len+80(FP), R9
-	CALL  polyHashADInternal<>(SB)
-	MOVOU (SI), X0
-	MOVOU 16(SI), X3
-	MOVOU 32(SI), X6
-	MOVOU 48(SI), X9
-	PXOR  X0, X1
-	PXOR  X3, X4
-	PXOR  X6, X7
-	PXOR  X9, X10
-	MOVOU X1, (DI)
-	MOVOU X4, 16(DI)
-	MOVOU X7, 32(DI)
-	MOVOU X10, 48(DI)
-	MOVOU 64(SI), X0
-	MOVOU 80(SI), X3
-	MOVOU 96(SI), X6
-	MOVOU 112(SI), X9
-	PXOR  X0, X2
-	PXOR  X3, X5
-	PXOR  X6, X8
-	PXOR  X9, X11
-	MOVOU X2, 64(DI)
-	MOVOU X5, 80(DI)
-	MOVOU X8, 96(DI)
-	MOVOU X11, 112(DI)
-	MOVQ  $0x00000080, CX
-	SUBQ  $0x80, BX
-	LEAQ  128(SI), SI
-	MOVO  X12, X1
-	MOVO  X13, X4
-	MOVO  X14, X7
-	MOVO  X15, X10
-	CMPQ  BX, $0x40
-	JBE   sealSSE128SealHash
-	MOVOU (SI), X0
-	MOVOU 16(SI), X3
-	MOVOU 32(SI), X6
-	MOVOU 48(SI), X9
-	PXOR  X0, X12
-	PXOR  X3, X13
-	PXOR  X6, X14
-	PXOR  X9, X15
-	MOVOU X12, 128(DI)
-	MOVOU X13, 144(DI)
-	MOVOU X14, 160(DI)
-	MOVOU X15, 176(DI)
-	ADDQ  $0x40, CX
-	SUBQ  $0x40, BX
-	LEAQ  64(SI), SI
-	MOVQ  $0x00000002, CX
-	MOVQ  $0x00000008, R9
-	CMPQ  BX, $0x40
-	JBE   sealSSETail64
-	CMPQ  BX, $0x80
-	JBE   sealSSETail128
-	CMPQ  BX, $0xc0
-	JBE   sealSSETail192
-
-sealSSEMainLoop:
-	// Load state, increment counter blocks
-	MOVO  ·chacha20Constants<>+0(SB), X0
-	MOVO  32(BP), X3
-	MOVO  48(BP), X6
-	MOVO  128(BP), X9
-	PADDL ·sseIncMask<>+0(SB), X9
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X1, X2
-	MOVO  X4, X5
-	MOVO  X7, X8
-	MOVO  X10, X11
-	PADDL ·sseIncMask<>+0(SB), X11
-	MOVO  X2, X12
-	MOVO  X5, X13
-	MOVO  X8, X14
-	MOVO  X11, X15
-	PADDL ·sseIncMask<>+0(SB), X15
-
-	// Store counters
-	MOVO X9, 80(BP)
-	MOVO X10, 96(BP)
-	MOVO X11, 112(BP)
-	MOVO X15, 128(BP)
-
-sealSSEInnerLoop:
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x0c
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	LEAQ  16(DI), DI
-	MOVO  X14, 64(BP)
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X3
-	PXOR  X14, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X14)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X3
-	PXOR  X14, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X4
-	PXOR  X14, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X14)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X4
-	PXOR  X14, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x0c, X14
-	PSRLL $0x14, X5
-	PXOR  X14, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X14)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X14
-	PSLLL $0x07, X14
-	PSRLL $0x19, X5
-	PXOR  X14, X5
-	MOVO  64(BP), X14
-	MOVO  X7, 64(BP)
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL16(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x0c, X7
-	PSRLL $0x14, X13
-	PXOR  X7, X13
-	PADDD X13, X12
-	PXOR  X12, X15
-	ROL8(X15, X7)
-	PADDD X15, X14
-	PXOR  X14, X13
-	MOVO  X13, X7
-	PSLLL $0x07, X7
-	PSRLL $0x19, X13
-	PXOR  X7, X13
-	MOVO  64(BP), X7
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x04
-	DECQ  R9
-	JGE   sealSSEInnerLoop
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(DI), DI
-	DECQ  CX
-	JG    sealSSEInnerLoop
-
-	// Add in the state
-	PADDD ·chacha20Constants<>+0(SB), X0
-	PADDD ·chacha20Constants<>+0(SB), X1
-	PADDD ·chacha20Constants<>+0(SB), X2
-	PADDD ·chacha20Constants<>+0(SB), X12
-	PADDD 32(BP), X3
-	PADDD 32(BP), X4
-	PADDD 32(BP), X5
-	PADDD 32(BP), X13
-	PADDD 48(BP), X6
-	PADDD 48(BP), X7
-	PADDD 48(BP), X8
-	PADDD 48(BP), X14
-	PADDD 80(BP), X9
-	PADDD 96(BP), X10
-	PADDD 112(BP), X11
-	PADDD 128(BP), X15
-	MOVO  X15, 64(BP)
-
-	// Load - xor - store
-	MOVOU (SI), X15
-	PXOR  X15, X0
-	MOVOU 16(SI), X15
-	PXOR  X15, X3
-	MOVOU 32(SI), X15
-	PXOR  X15, X6
-	MOVOU 48(SI), X15
-	PXOR  X15, X9
-	MOVOU X0, (DI)
-	MOVOU X3, 16(DI)
-	MOVOU X6, 32(DI)
-	MOVOU X9, 48(DI)
-	MOVO  64(BP), X15
-	MOVOU 64(SI), X0
-	MOVOU 80(SI), X3
-	MOVOU 96(SI), X6
-	MOVOU 112(SI), X9
-	PXOR  X0, X1
-	PXOR  X3, X4
-	PXOR  X6, X7
-	PXOR  X9, X10
-	MOVOU X1, 64(DI)
-	MOVOU X4, 80(DI)
-	MOVOU X7, 96(DI)
-	MOVOU X10, 112(DI)
-	MOVOU 128(SI), X0
-	MOVOU 144(SI), X3
-	MOVOU 160(SI), X6
-	MOVOU 176(SI), X9
-	PXOR  X0, X2
-	PXOR  X3, X5
-	PXOR  X6, X8
-	PXOR  X9, X11
-	MOVOU X2, 128(DI)
-	MOVOU X5, 144(DI)
-	MOVOU X8, 160(DI)
-	MOVOU X11, 176(DI)
-	ADDQ  $0xc0, SI
-	MOVQ  $0x000000c0, CX
-	SUBQ  $0xc0, BX
-	MOVO  X12, X1
-	MOVO  X13, X4
-	MOVO  X14, X7
-	MOVO  X15, X10
-	CMPQ  BX, $0x40
-	JBE   sealSSE128SealHash
-	MOVOU (SI), X0
-	MOVOU 16(SI), X3
-	MOVOU 32(SI), X6
-	MOVOU 48(SI), X9
-	PXOR  X0, X12
-	PXOR  X3, X13
-	PXOR  X6, X14
-	PXOR  X9, X15
-	MOVOU X12, 192(DI)
-	MOVOU X13, 208(DI)
-	MOVOU X14, 224(DI)
-	MOVOU X15, 240(DI)
-	LEAQ  64(SI), SI
-	SUBQ  $0x40, BX
-	MOVQ  $0x00000006, CX
-	MOVQ  $0x00000004, R9
-	CMPQ  BX, $0xc0
-	JG    sealSSEMainLoop
-	MOVQ  BX, CX
-	TESTQ BX, BX
-	JE    sealSSE128SealHash
-	MOVQ  $0x00000006, CX
-	CMPQ  BX, $0x40
-	JBE   sealSSETail64
-	CMPQ  BX, $0x80
-	JBE   sealSSETail128
-	JMP   sealSSETail192
-
-sealSSETail64:
-	MOVO  ·chacha20Constants<>+0(SB), X1
-	MOVO  32(BP), X4
-	MOVO  48(BP), X7
-	MOVO  128(BP), X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X10, 80(BP)
-
-sealSSETail64LoopA:
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(DI), DI
-
-sealSSETail64LoopB:
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X13)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X13
-	PSLLL $0x0c, X13
-	PSRLL $0x14, X4
-	PXOR  X13, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X13)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X13
-	PSLLL $0x07, X13
-	PSRLL $0x19, X4
-	PXOR  X13, X4
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X13)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X13
-	PSLLL $0x0c, X13
-	PSRLL $0x14, X4
-	PXOR  X13, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X13)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X13
-	PSLLL $0x07, X13
-	PSRLL $0x19, X4
-	PXOR  X13, X4
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(DI), DI
-	DECQ  CX
-	JG    sealSSETail64LoopA
-	DECQ  R9
-	JGE   sealSSETail64LoopB
-	PADDL ·chacha20Constants<>+0(SB), X1
-	PADDL 32(BP), X4
-	PADDL 48(BP), X7
-	PADDL 80(BP), X10
-	JMP   sealSSE128Seal
-
-sealSSETail128:
-	MOVO  ·chacha20Constants<>+0(SB), X0
-	MOVO  32(BP), X3
-	MOVO  48(BP), X6
-	MOVO  128(BP), X9
-	PADDL ·sseIncMask<>+0(SB), X9
-	MOVO  X9, 80(BP)
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X10, 96(BP)
-
-sealSSETail128LoopA:
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(DI), DI
-
-sealSSETail128LoopB:
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(DI), DI
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	DECQ  CX
-	JG    sealSSETail128LoopA
-	DECQ  R9
-	JGE   sealSSETail128LoopB
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL ·chacha20Constants<>+0(SB), X1
-	PADDL 32(BP), X3
-	PADDL 32(BP), X4
-	PADDL 48(BP), X6
-	PADDL 48(BP), X7
-	PADDL 80(BP), X9
-	PADDL 96(BP), X10
-	MOVOU (SI), X12
-	MOVOU 16(SI), X13
-	MOVOU 32(SI), X14
-	MOVOU 48(SI), X15
-	PXOR  X12, X0
-	PXOR  X13, X3
-	PXOR  X14, X6
-	PXOR  X15, X9
-	MOVOU X0, (DI)
-	MOVOU X3, 16(DI)
-	MOVOU X6, 32(DI)
-	MOVOU X9, 48(DI)
-	MOVQ  $0x00000040, CX
-	LEAQ  64(SI), SI
-	SUBQ  $0x40, BX
-	JMP   sealSSE128SealHash
-
-sealSSETail192:
-	MOVO  ·chacha20Constants<>+0(SB), X0
-	MOVO  32(BP), X3
-	MOVO  48(BP), X6
-	MOVO  128(BP), X9
-	PADDL ·sseIncMask<>+0(SB), X9
-	MOVO  X9, 80(BP)
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X10, 96(BP)
-	MOVO  X1, X2
-	MOVO  X4, X5
-	MOVO  X7, X8
-	MOVO  X10, X11
-	PADDL ·sseIncMask<>+0(SB), X11
-	MOVO  X11, 112(BP)
-
-sealSSETail192LoopA:
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(DI), DI
-
-sealSSETail192LoopB:
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	LEAQ  16(DI), DI
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	DECQ  CX
-	JG    sealSSETail192LoopA
-	DECQ  R9
-	JGE   sealSSETail192LoopB
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL ·chacha20Constants<>+0(SB), X1
-	PADDL ·chacha20Constants<>+0(SB), X2
-	PADDL 32(BP), X3
-	PADDL 32(BP), X4
-	PADDL 32(BP), X5
-	PADDL 48(BP), X6
-	PADDL 48(BP), X7
-	PADDL 48(BP), X8
-	PADDL 80(BP), X9
-	PADDL 96(BP), X10
-	PADDL 112(BP), X11
-	MOVOU (SI), X12
-	MOVOU 16(SI), X13
-	MOVOU 32(SI), X14
-	MOVOU 48(SI), X15
-	PXOR  X12, X0
-	PXOR  X13, X3
-	PXOR  X14, X6
-	PXOR  X15, X9
-	MOVOU X0, (DI)
-	MOVOU X3, 16(DI)
-	MOVOU X6, 32(DI)
-	MOVOU X9, 48(DI)
-	MOVOU 64(SI), X12
-	MOVOU 80(SI), X13
-	MOVOU 96(SI), X14
-	MOVOU 112(SI), X15
-	PXOR  X12, X1
-	PXOR  X13, X4
-	PXOR  X14, X7
-	PXOR  X15, X10
-	MOVOU X1, 64(DI)
-	MOVOU X4, 80(DI)
-	MOVOU X7, 96(DI)
-	MOVOU X10, 112(DI)
-	MOVO  X2, X1
-	MOVO  X5, X4
-	MOVO  X8, X7
-	MOVO  X11, X10
-	MOVQ  $0x00000080, CX
-	LEAQ  128(SI), SI
-	SUBQ  $0x80, BX
-	JMP   sealSSE128SealHash
-
-sealSSE128:
-	MOVOU ·chacha20Constants<>+0(SB), X0
-	MOVOU 16(R8), X3
-	MOVOU 32(R8), X6
-	MOVOU 48(R8), X9
-	MOVO  X0, X1
-	MOVO  X3, X4
-	MOVO  X6, X7
-	MOVO  X9, X10
-	PADDL ·sseIncMask<>+0(SB), X10
-	MOVO  X1, X2
-	MOVO  X4, X5
-	MOVO  X7, X8
-	MOVO  X10, X11
-	PADDL ·sseIncMask<>+0(SB), X11
-	MOVO  X3, X13
-	MOVO  X6, X14
-	MOVO  X10, X15
-	MOVQ  $0x0000000a, R9
-
-sealSSE128InnerCipherLoop:
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL16(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X3
-	PXOR  X12, X3
-	PADDD X3, X0
-	PXOR  X0, X9
-	ROL8(X9, X12)
-	PADDD X9, X6
-	PXOR  X6, X3
-	MOVO  X3, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X3
-	PXOR  X12, X3
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL16(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X4
-	PXOR  X12, X4
-	PADDD X4, X1
-	PXOR  X1, X10
-	ROL8(X10, X12)
-	PADDD X10, X7
-	PXOR  X7, X4
-	MOVO  X4, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X4
-	PXOR  X12, X4
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL16(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x0c, X12
-	PSRLL $0x14, X5
-	PXOR  X12, X5
-	PADDD X5, X2
-	PXOR  X2, X11
-	ROL8(X11, X12)
-	PADDD X11, X8
-	PXOR  X8, X5
-	MOVO  X5, X12
-	PSLLL $0x07, X12
-	PSRLL $0x19, X5
-	PXOR  X12, X5
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xe4
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xed
-	BYTE  $0x0c
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xf6
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xff
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc0
-	BYTE  $0x08
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xc9
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xd2
-	BYTE  $0x04
-	BYTE  $0x66
-	BYTE  $0x45
-	BYTE  $0x0f
-	BYTE  $0x3a
-	BYTE  $0x0f
-	BYTE  $0xdb
-	BYTE  $0x04
-	DECQ  R9
-	JNE   sealSSE128InnerCipherLoop
-
-	// A0|B0 hold the Poly1305 32-byte key, C0,D0 can be discarded
-	PADDL ·chacha20Constants<>+0(SB), X0
-	PADDL ·chacha20Constants<>+0(SB), X1
-	PADDL ·chacha20Constants<>+0(SB), X2
-	PADDL X13, X3
-	PADDL X13, X4
-	PADDL X13, X5
-	PADDL X14, X7
-	PADDL X14, X8
-	PADDL X15, X10
-	PADDL ·sseIncMask<>+0(SB), X15
-	PADDL X15, X11
-	PAND  ·polyClampMask<>+0(SB), X0
-	MOVOU X0, (BP)
-	MOVOU X3, 16(BP)
-
-	// Hash
-	MOVQ ad_len+80(FP), R9
-	CALL polyHashADInternal<>(SB)
-	XORQ CX, CX
-
-sealSSE128SealHash:
-	CMPQ  CX, $0x10
-	JB    sealSSE128Seal
-	ADDQ  (DI), R10
-	ADCQ  8(DI), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-	SUBQ  $0x10, CX
-	ADDQ  $0x10, DI
-	JMP   sealSSE128SealHash
-
-sealSSE128Seal:
-	CMPQ BX, $0x10
-	JB   sealSSETail
-	SUBQ $0x10, BX
-
-	// Load for decryption
-	MOVOU (SI), X12
-	PXOR  X12, X1
-	MOVOU X1, (DI)
-	LEAQ  16(SI), SI
-	LEAQ  16(DI), DI
-
-	// Extract for hashing
-	MOVQ   X1, R13
-	PSRLDQ $0x08, X1
-	MOVQ   X1, R14
-	ADDQ   R13, R10
-	ADCQ   R14, R11
-	ADCQ   $0x01, R12
-	MOVQ   (BP), AX
-	MOVQ   AX, R15
-	MULQ   R10
-	MOVQ   AX, R13
-	MOVQ   DX, R14
-	MOVQ   (BP), AX
-	MULQ   R11
-	IMULQ  R12, R15
-	ADDQ   AX, R14
-	ADCQ   DX, R15
-	MOVQ   8(BP), AX
-	MOVQ   AX, R8
-	MULQ   R10
-	ADDQ   AX, R14
-	ADCQ   $0x00, DX
-	MOVQ   DX, R10
-	MOVQ   8(BP), AX
-	MULQ   R11
-	ADDQ   AX, R15
-	ADCQ   $0x00, DX
-	IMULQ  R12, R8
-	ADDQ   R10, R15
-	ADCQ   DX, R8
-	MOVQ   R13, R10
-	MOVQ   R14, R11
-	MOVQ   R15, R12
-	ANDQ   $0x03, R12
-	MOVQ   R15, R13
-	ANDQ   $-4, R13
-	MOVQ   R8, R14
-	SHRQ   $0x02, R8, R15
-	SHRQ   $0x02, R8
-	ADDQ   R13, R10
-	ADCQ   R14, R11
-	ADCQ   $0x00, R12
-	ADDQ   R15, R10
-	ADCQ   R8, R11
-	ADCQ   $0x00, R12
-
-	// Shift the stream "left"
-	MOVO X4, X1
-	MOVO X7, X4
-	MOVO X10, X7
-	MOVO X2, X10
-	MOVO X5, X2
-	MOVO X8, X5
-	MOVO X11, X8
-	JMP  sealSSE128Seal
-
-sealSSETail:
-	TESTQ BX, BX
-	JE    sealSSEFinalize
-
-	// We can only load the PT one byte at a time to avoid read after end of buffer
-	MOVQ BX, R9
-	SHLQ $0x04, R9
-	LEAQ ·andMask<>+0(SB), R13
-	MOVQ BX, CX
-	LEAQ -1(SI)(BX*1), SI
-	XORQ R15, R15
-	XORQ R8, R8
-	XORQ AX, AX
-
-sealSSETailLoadLoop:
-	SHLQ   $0x08, R15, R8
-	SHLQ   $0x08, R15
-	MOVB   (SI), AX
-	XORQ   AX, R15
-	LEAQ   -1(SI), SI
-	DECQ   CX
-	JNE    sealSSETailLoadLoop
-	MOVQ   R15, 64(BP)
-	MOVQ   R8, 72(BP)
-	PXOR   64(BP), X1
-	MOVOU  X1, (DI)
-	MOVOU  -16(R13)(R9*1), X12
-	PAND   X12, X1
-	MOVQ   X1, R13
-	PSRLDQ $0x08, X1
-	MOVQ   X1, R14
-	ADDQ   R13, R10
-	ADCQ   R14, R11
-	ADCQ   $0x01, R12
-	MOVQ   (BP), AX
-	MOVQ   AX, R15
-	MULQ   R10
-	MOVQ   AX, R13
-	MOVQ   DX, R14
-	MOVQ   (BP), AX
-	MULQ   R11
-	IMULQ  R12, R15
-	ADDQ   AX, R14
-	ADCQ   DX, R15
-	MOVQ   8(BP), AX
-	MOVQ   AX, R8
-	MULQ   R10
-	ADDQ   AX, R14
-	ADCQ   $0x00, DX
-	MOVQ   DX, R10
-	MOVQ   8(BP), AX
-	MULQ   R11
-	ADDQ   AX, R15
-	ADCQ   $0x00, DX
-	IMULQ  R12, R8
-	ADDQ   R10, R15
-	ADCQ   DX, R8
-	MOVQ   R13, R10
-	MOVQ   R14, R11
-	MOVQ   R15, R12
-	ANDQ   $0x03, R12
-	MOVQ   R15, R13
-	ANDQ   $-4, R13
-	MOVQ   R8, R14
-	SHRQ   $0x02, R8, R15
-	SHRQ   $0x02, R8
-	ADDQ   R13, R10
-	ADCQ   R14, R11
-	ADCQ   $0x00, R12
-	ADDQ   R15, R10
-	ADCQ   R8, R11
-	ADCQ   $0x00, R12
-	ADDQ   BX, DI
-
-sealSSEFinalize:
-	// Hash in the buffer lengths
-	ADDQ  ad_len+80(FP), R10
-	ADCQ  src_len+56(FP), R11
-	ADCQ  $0x01, R12
-	MOVQ  (BP), AX
-	MOVQ  AX, R15
-	MULQ  R10
-	MOVQ  AX, R13
-	MOVQ  DX, R14
-	MOVQ  (BP), AX
-	MULQ  R11
-	IMULQ R12, R15
-	ADDQ  AX, R14
-	ADCQ  DX, R15
-	MOVQ  8(BP), AX
-	MOVQ  AX, R8
-	MULQ  R10
-	ADDQ  AX, R14
-	ADCQ  $0x00, DX
-	MOVQ  DX, R10
-	MOVQ  8(BP), AX
-	MULQ  R11
-	ADDQ  AX, R15
-	ADCQ  $0x00, DX
-	IMULQ R12, R8
-	ADDQ  R10, R15
-	ADCQ  DX, R8
-	MOVQ  R13, R10
-	MOVQ  R14, R11
-	MOVQ  R15, R12
-	ANDQ  $0x03, R12
-	MOVQ  R15, R13
-	ANDQ  $-4, R13
-	MOVQ  R8, R14
-	SHRQ  $0x02, R8, R15
-	SHRQ  $0x02, R8
-	ADDQ  R13, R10
-	ADCQ  R14, R11
-	ADCQ  $0x00, R12
-	ADDQ  R15, R10
-	ADCQ  R8, R11
-	ADCQ  $0x00, R12
-
-	// Final reduce
-	MOVQ    R10, R13
-	MOVQ    R11, R14
-	MOVQ    R12, R15
-	SUBQ    $-5, R10
-	SBBQ    $-1, R11
-	SBBQ    $0x03, R12
-	CMOVQCS R13, R10
-	CMOVQCS R14, R11
-	CMOVQCS R15, R12
-
-	// Add in the "s" part of the key
-	ADDQ 16(BP), R10
-	ADCQ 24(BP), R11
-
-	// Finally store the tag at the end of the message
-	MOVQ R10, (DI)
-	MOVQ R11, 8(DI)
-	RET
-
-chacha20Poly1305Seal_AVX2:
+	MOVQ           SP, BP
+	ADDQ           $0x20, BP
+	ANDQ           $-32, BP
+	MOVQ           dst_base+0(FP), DI
+	MOVQ           key_base+24(FP), R8
+	MOVQ           src_base+48(FP), SI
+	MOVQ           src_len+56(FP), BX
+	MOVQ           ad_base+72(FP), CX
 	VZEROUPPER
-	VMOVDQU ·chacha20Constants<>+0(SB), Y0
-	BYTE    $0xc4
-	BYTE    $0x42
-	BYTE    $0x7d
-	BYTE    $0x5a
-	BYTE    $0x70
-	BYTE    $0x10
-	BYTE    $0xc4
-	BYTE    $0x42
-	BYTE    $0x7d
-	BYTE    $0x5a
-	BYTE    $0x60
-	BYTE    $0x20
-	BYTE    $0xc4
-	BYTE    $0xc2
-	BYTE    $0x7d
-	BYTE    $0x5a
-	BYTE    $0x60
-	BYTE    $0x30
-	VPADDD  ·avx2InitMask<>+0(SB), Y4, Y4
+	VMOVDQU        ·chacha20Constants<>+0(SB), Y0
+	VBROADCASTI128 16(R8), Y14
+	VBROADCASTI128 32(R8), Y12
+	VBROADCASTI128 48(R8), Y4
+	VPADDD         ·avx2InitMask<>+0(SB), Y4, Y4
 
 	// Special optimizations, for very short buffers
 	CMPQ BX, $0x000000c0
@@ -8170,6 +3500,144 @@ sealAVX2InternalLoopStart:
 	JBE   sealAVX2Tail384
 	JMP   sealAVX2Tail512
 
+sealSSETail:
+	TESTQ BX, BX
+	JE    sealSSEFinalize
+
+	// We can only load the PT one byte at a time to avoid read after end of buffer
+	MOVQ BX, R9
+	SHLQ $0x04, R9
+	LEAQ ·andMask<>+0(SB), R13
+	MOVQ BX, CX
+	LEAQ -1(SI)(BX*1), SI
+	XORQ R15, R15
+	XORQ R8, R8
+	XORQ AX, AX
+
+sealSSETailLoadLoop:
+	SHLQ   $0x08, R15, R8
+	SHLQ   $0x08, R15
+	MOVB   (SI), AX
+	XORQ   AX, R15
+	LEAQ   -1(SI), SI
+	DECQ   CX
+	JNE    sealSSETailLoadLoop
+	MOVQ   R15, 64(BP)
+	MOVQ   R8, 72(BP)
+	PXOR   64(BP), X1
+	MOVOU  X1, (DI)
+	MOVOU  -16(R13)(R9*1), X12
+	PAND   X12, X1
+	MOVQ   X1, R13
+	PSRLDQ $0x08, X1
+	MOVQ   X1, R14
+	ADDQ   R13, R10
+	ADCQ   R14, R11
+	ADCQ   $0x01, R12
+	MOVQ   (BP), AX
+	MOVQ   AX, R15
+	MULQ   R10
+	MOVQ   AX, R13
+	MOVQ   DX, R14
+	MOVQ   (BP), AX
+	MULQ   R11
+	IMULQ  R12, R15
+	ADDQ   AX, R14
+	ADCQ   DX, R15
+	MOVQ   8(BP), AX
+	MOVQ   AX, R8
+	MULQ   R10
+	ADDQ   AX, R14
+	ADCQ   $0x00, DX
+	MOVQ   DX, R10
+	MOVQ   8(BP), AX
+	MULQ   R11
+	ADDQ   AX, R15
+	ADCQ   $0x00, DX
+	IMULQ  R12, R8
+	ADDQ   R10, R15
+	ADCQ   DX, R8
+	MOVQ   R13, R10
+	MOVQ   R14, R11
+	MOVQ   R15, R12
+	ANDQ   $0x03, R12
+	MOVQ   R15, R13
+	ANDQ   $-4, R13
+	MOVQ   R8, R14
+	SHRQ   $0x02, R8, R15
+	SHRQ   $0x02, R8
+	ADDQ   R13, R10
+	ADCQ   R14, R11
+	ADCQ   $0x00, R12
+	ADDQ   R15, R10
+	ADCQ   R8, R11
+	ADCQ   $0x00, R12
+	ADDQ   BX, DI
+
+sealSSEFinalize:
+	// Hash in the buffer lengths
+	ADDQ  ad_len+80(FP), R10
+	ADCQ  src_len+56(FP), R11
+	ADCQ  $0x01, R12
+	MOVQ  (BP), AX
+	MOVQ  AX, R15
+	MULQ  R10
+	MOVQ  AX, R13
+	MOVQ  DX, R14
+	MOVQ  (BP), AX
+	MULQ  R11
+	IMULQ R12, R15
+	ADDQ  AX, R14
+	ADCQ  DX, R15
+	MOVQ  8(BP), AX
+	MOVQ  AX, R8
+	MULQ  R10
+	ADDQ  AX, R14
+	ADCQ  $0x00, DX
+	MOVQ  DX, R10
+	MOVQ  8(BP), AX
+	MULQ  R11
+	ADDQ  AX, R15
+	ADCQ  $0x00, DX
+	IMULQ R12, R8
+	ADDQ  R10, R15
+	ADCQ  DX, R8
+	MOVQ  R13, R10
+	MOVQ  R14, R11
+	MOVQ  R15, R12
+	ANDQ  $0x03, R12
+	MOVQ  R15, R13
+	ANDQ  $-4, R13
+	MOVQ  R8, R14
+	SHRQ  $0x02, R8, R15
+	SHRQ  $0x02, R8
+	ADDQ  R13, R10
+	ADCQ  R14, R11
+	ADCQ  $0x00, R12
+	ADDQ  R15, R10
+	ADCQ  R8, R11
+	ADCQ  $0x00, R12
+
+	// Final reduce
+	MOVQ    R10, R13
+	MOVQ    R11, R14
+	MOVQ    R12, R15
+	SUBQ    $-5, R10
+	SBBQ    $-1, R11
+	SBBQ    $0x03, R12
+	CMOVQCS R13, R10
+	CMOVQCS R14, R11
+	CMOVQCS R15, R12
+
+	// Add in the "s" part of the key
+	ADDQ 16(BP), R10
+	ADCQ 24(BP), R11
+
+	// Finally store the tag at the end of the message
+	MOVQ R10, (DI)
+	MOVQ R11, 8(DI)
+	RET
+
 seal192AVX2:
 	VMOVDQA Y0, Y5
 	VMOVDQA Y14, Y9
diff --git a/backend/vendor/modules.txt b/backend/vendor/modules.txt
index 84a7de0..564da90 100644
--- a/backend/vendor/modules.txt
+++ b/backend/vendor/modules.txt
@@ -545,7 +545,7 @@ go.uber.org/zap/zapcore
 # golang.org/x/arch v0.9.0
 ## explicit; go 1.18
 golang.org/x/arch/x86/x86asm
-# golang.org/x/crypto v0.51.0
+# golang.org/x/crypto v0.52.0
 ## explicit; go 1.25.0
 golang.org/x/crypto/argon2
 golang.org/x/crypto/bcrypt