internal-masking.h

Go to the documentation of this file.

/*
 * Copyright (C) 2021 Southern Storm Software, Pty Ltd.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included
 * in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 */

#ifndef LW_INTERNAL_MASKING_H
#define LW_INTERNAL_MASKING_H

#include "aead-random.h"

#ifdef __cplusplus
extern "C" {
#endif

#if !defined(AEAD_MASKING_SHARES)
#define AEAD_MASKING_SHARES 4
#endif

#if !defined(AEAD_MASKING_KEY_ONLY)
#define AEAD_MASKING_KEY_ONLY 0
#endif

typedef struct
{
    uint16_t a;     
    uint16_t b;     
} mask_x2_uint16_t;

typedef struct
{
    uint16_t a;     
    uint16_t b;     
    uint16_t c;     
} mask_x3_uint16_t;

typedef struct
{
    uint16_t a;     
    uint16_t b;     
    uint16_t c;     
    uint16_t d;     
} mask_x4_uint16_t;

typedef struct
{
    uint16_t a;     
    uint16_t b;     
    uint16_t c;     
    uint16_t d;     
    uint16_t e;     
} mask_x5_uint16_t;

typedef struct
{
    uint16_t a;     
    uint16_t b;     
    uint16_t c;     
    uint16_t d;     
    uint16_t e;     
    uint16_t f;     
} mask_x6_uint16_t;

typedef struct
{
    uint32_t a;     
    uint32_t b;     
} mask_x2_uint32_t;

typedef struct
{
    uint32_t a;     
    uint32_t b;     
    uint32_t c;     
} mask_x3_uint32_t;

typedef struct
{
    uint32_t a;     
    uint32_t b;     
    uint32_t c;     
    uint32_t d;     
} mask_x4_uint32_t;

typedef struct
{
    uint32_t a;     
    uint32_t b;     
    uint32_t c;     
    uint32_t d;     
    uint32_t e;     
} mask_x5_uint32_t;

typedef struct
{
    uint32_t a;     
    uint32_t b;     
    uint32_t c;     
    uint32_t d;     
    uint32_t e;     
    uint32_t f;     
} mask_x6_uint32_t;

typedef struct
{
    uint64_t a;     
    uint64_t b;     
} mask_x2_uint64_t;

typedef struct
{
    uint64_t a;     
    uint64_t b;     
    uint64_t c;     
} mask_x3_uint64_t;

typedef struct
{
    uint64_t a;     
    uint64_t b;     
    uint64_t c;     
    uint64_t d;     
} mask_x4_uint64_t;

typedef struct
{
    uint64_t a;     
    uint64_t b;     
    uint64_t c;     
    uint64_t d;     
    uint64_t e;     
} mask_x5_uint64_t;

typedef struct
{
    uint64_t a;     
    uint64_t b;     
    uint64_t c;     
    uint64_t d;     
    uint64_t e;     
    uint64_t f;     
} mask_x6_uint64_t;

#define mask_x2_input(value, input) \
    do { \
        if (sizeof((value).b) <= 4) \
            (value).b = aead_random_generate_32(); \
        else \
            (value).b = aead_random_generate_64(); \
        (value).a = (input) ^ (value).b; \
    } while (0)

#define mask_x2_output(value) ((value).a ^ (value).b)

#define mask_x2_zero(value) \
    do { \
        (value).a = 0; \
        (value).b = 0; \
    } while (0)

#define mask_x2_xor_const(value, cvalue) \
    do { \
        (value).a ^= (cvalue); \
    } while (0)

#define mask_x2_xor(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
    } while (0)

#define mask_x2_xor3(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a ^ (value3).a); \
        (value1).b ^= ((value2).b ^ (value3).b); \
    } while (0)

#define mask_x2_not(value) \
    do { \
        (value).a = ~((value).a); \
    } while (0)

/* Inner implementation of AND'ing two 2-share masked words */
#define mask_mix_and(x2, x1, x0, y2, y1, y0) \
    do { \
        if (sizeof(temp) <= 4) \
            temp = aead_random_generate_32(); \
        else \
            temp = aead_random_generate_64(); \
        (x2) ^= temp; \
        temp ^= ((y0) & (x1)); \
        (y2) = ((y2) ^ temp) ^ ((y1) & (x0)); \
    } while (0)

#define mask_x2_and(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a & (value3).a); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        (value1).b ^= ((value2).b & (value3).b); \
    } while (0)

#define mask_x2_and_not(value1, value2, value3) \
    do { \
        (value1).a ^= ((~(value2).a) & (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        (value1).b ^= ((value2).b & (value3).b); \
    } while (0)

#define mask_x2_or(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a) | ((value3).a); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        (value1).b ^= ((value2).b & (value3).b); \
    } while (0)

#define mask_x2_shl(value1, value2, bits) \
    do { \
        (value1).a = (value2).a << (bits); \
        (value1).b = (value2).b << (bits); \
    } while (0)

#define mask_x2_shr(value1, value2, bits) \
    do { \
        (value1).a = (value2).a >> (bits); \
        (value1).b = (value2).b >> (bits); \
    } while (0)

#define mask_x2_rol(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a << (bits)) | \
                     ((value2).a >> (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b << (bits)) | \
                     ((value2).b >> (sizeof((value1).b) * 8 - (bits))); \
    } while (0)

#define mask_x2_ror(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a >> (bits)) | \
                     ((value2).a << (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b >> (bits)) | \
                     ((value2).b << (sizeof((value1).b) * 8 - (bits))); \
    } while (0)

#define mask_x2_swap(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value2).a ^= (value1).a; \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value2).b ^= (value1).b; \
        (value1).b ^= (value2).b; \
    } while (0)

#define mask_swap_move_internal(a, b, mask, shift) \
    do { \
        temp = ((b) ^ ((a) >> (shift))) & (mask); \
        (b) ^= temp; \
        (a) ^= temp << (shift); \
    } while (0)

#define mask_x2_swap_move(value1, value2, mask, shift) \
    do { \
        mask_swap_move_internal((value1).a, (value2).a, (mask), (shift)); \
        mask_swap_move_internal((value1).b, (value2).b, (mask), (shift)); \
    } while (0)

#define mask_x3_input(value, input) \
    do { \
        if (sizeof((value).b) <= 4) { \
            (value).b = aead_random_generate_32(); \
            (value).c = aead_random_generate_32(); \
        } else { \
            (value).b = aead_random_generate_64(); \
            (value).c = aead_random_generate_64(); \
        } \
        (value).a = (input) ^ (value).b ^ (value).c; \
    } while (0)

#define mask_x3_output(value) ((value).a ^ (value).b ^ (value).c)

#define mask_x3_zero(value) \
    do { \
        (value).a = 0; \
        (value).b = 0; \
        (value).c = 0; \
    } while (0)

#define mask_x3_xor_const(value, cvalue) \
    do { \
        (value).a ^= (cvalue); \
    } while (0)

#define mask_x3_xor(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
    } while (0)

#define mask_x3_xor3(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a ^ (value3).a); \
        (value1).b ^= ((value2).b ^ (value3).b); \
        (value1).c ^= ((value2).c ^ (value3).c); \
    } while (0)

#define mask_x3_not(value) \
    do { \
        (value).a = ~((value).a); \
    } while (0)

#define mask_x3_and(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a & (value3).a); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        (value1).c ^= ((value2).c & (value3).c); \
    } while (0)

#define mask_x3_and_not(value1, value2, value3) \
    do { \
        (value1).a ^= ((~(value2).a) & (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        (value1).c ^= ((value2).c & (value3).c); \
    } while (0)

#define mask_x3_or(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a | (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        (value1).c ^= ((value2).c & (value3).c); \
    } while (0)

#define mask_x3_shl(value1, value2, bits) \
    do { \
        (value1).a = (value2).a << (bits); \
        (value1).b = (value2).b << (bits); \
        (value1).c = (value2).c << (bits); \
    } while (0)

#define mask_x3_shr(value1, value2, bits) \
    do { \
        (value1).a = (value2).a >> (bits); \
        (value1).b = (value2).b >> (bits); \
        (value1).c = (value2).c >> (bits); \
    } while (0)

#define mask_x3_rol(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a << (bits)) | \
                     ((value2).a >> (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b << (bits)) | \
                     ((value2).b >> (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c << (bits)) | \
                     ((value2).c >> (sizeof((value1).c) * 8 - (bits))); \
    } while (0)

#define mask_x3_ror(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a >> (bits)) | \
                     ((value2).a << (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b >> (bits)) | \
                     ((value2).b << (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c >> (bits)) | \
                     ((value2).c << (sizeof((value1).c) * 8 - (bits))); \
    } while (0)

#define mask_x3_swap(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value2).a ^= (value1).a; \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value2).b ^= (value1).b; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
        (value2).c ^= (value1).c; \
        (value1).c ^= (value2).c; \
    } while (0)

#define mask_x3_swap_move(value1, value2, mask, shift) \
    do { \
        mask_swap_move_internal((value1).a, (value2).a, (mask), (shift)); \
        mask_swap_move_internal((value1).b, (value2).b, (mask), (shift)); \
        mask_swap_move_internal((value1).c, (value2).c, (mask), (shift)); \
    } while (0)

#define mask_x4_input(value, input) \
    do { \
        if (sizeof((value).b) <= 4) { \
            (value).b = aead_random_generate_32(); \
            (value).c = aead_random_generate_32(); \
            (value).d = aead_random_generate_32(); \
        } else { \
            (value).b = aead_random_generate_64(); \
            (value).c = aead_random_generate_64(); \
            (value).d = aead_random_generate_64(); \
        } \
        (value).a = (input) ^ (value).b ^ (value).c ^ (value).d; \
    } while (0)

#define mask_x4_output(value) ((value).a ^ (value).b ^ (value).c ^ (value).d)

#define mask_x4_zero(value) \
    do { \
        (value).a = 0; \
        (value).b = 0; \
        (value).c = 0; \
        (value).d = 0; \
    } while (0)

#define mask_x4_xor_const(value, cvalue) \
    do { \
        (value).a ^= (cvalue); \
    } while (0)

#define mask_x4_xor(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
        (value1).d ^= (value2).d; \
    } while (0)

#define mask_x4_xor3(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a ^ (value3).a); \
        (value1).b ^= ((value2).b ^ (value3).b); \
        (value1).c ^= ((value2).c ^ (value3).c); \
        (value1).d ^= ((value2).d ^ (value3).d); \
    } while (0)

#define mask_x4_not(value) \
    do { \
        (value).a = ~((value).a); \
    } while (0)

#define mask_x4_and(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a & (value3).a); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).d ^= ((value2).d & (value3).d); \
    } while (0)

#define mask_x4_and_not(value1, value2, value3) \
    do { \
        (value1).a ^= ((~(value2).a) & (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).d ^= ((value2).d & (value3).d); \
    } while (0)

#define mask_x4_or(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a | (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        (value1).d ^= ((value2).d & (value3).d); \
    } while (0)

#define mask_x4_shl(value1, value2, bits) \
    do { \
        (value1).a = (value2).a << (bits); \
        (value1).b = (value2).b << (bits); \
        (value1).c = (value2).c << (bits); \
        (value1).d = (value2).d << (bits); \
    } while (0)

#define mask_x4_shr(value1, value2, bits) \
    do { \
        (value1).a = (value2).a >> (bits); \
        (value1).b = (value2).b >> (bits); \
        (value1).c = (value2).c >> (bits); \
        (value1).d = (value2).d >> (bits); \
    } while (0)

#define mask_x4_rol(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a << (bits)) | \
                     ((value2).a >> (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b << (bits)) | \
                     ((value2).b >> (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c << (bits)) | \
                     ((value2).c >> (sizeof((value1).c) * 8 - (bits))); \
        (value1).d = ((value2).d << (bits)) | \
                     ((value2).d >> (sizeof((value1).d) * 8 - (bits))); \
    } while (0)

#define mask_x4_ror(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a >> (bits)) | \
                     ((value2).a << (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b >> (bits)) | \
                     ((value2).b << (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c >> (bits)) | \
                     ((value2).c << (sizeof((value1).c) * 8 - (bits))); \
        (value1).d = ((value2).d >> (bits)) | \
                     ((value2).d << (sizeof((value1).d) * 8 - (bits))); \
    } while (0)

#define mask_x4_swap(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value2).a ^= (value1).a; \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value2).b ^= (value1).b; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
        (value2).c ^= (value1).c; \
        (value1).c ^= (value2).c; \
        (value1).d ^= (value2).d; \
        (value2).d ^= (value1).d; \
        (value1).d ^= (value2).d; \
    } while (0)

#define mask_x4_swap_move(value1, value2, mask, shift) \
    do { \
        mask_swap_move_internal((value1).a, (value2).a, (mask), (shift)); \
        mask_swap_move_internal((value1).b, (value2).b, (mask), (shift)); \
        mask_swap_move_internal((value1).c, (value2).c, (mask), (shift)); \
        mask_swap_move_internal((value1).d, (value2).d, (mask), (shift)); \
    } while (0)

#define mask_x5_input(value, input) \
    do { \
        if (sizeof((value).b) <= 4) { \
            (value).b = aead_random_generate_32(); \
            (value).c = aead_random_generate_32(); \
            (value).d = aead_random_generate_32(); \
            (value).e = aead_random_generate_32(); \
        } else { \
            (value).b = aead_random_generate_64(); \
            (value).c = aead_random_generate_64(); \
            (value).d = aead_random_generate_64(); \
            (value).e = aead_random_generate_64(); \
        } \
        (value).a = (input) ^ (value).b ^ (value).c ^ (value).d ^ (value).e; \
    } while (0)

#define mask_x5_output(value) \
    ((value).a ^ (value).b ^ (value).c ^ (value).d ^ (value).e)

#define mask_x5_zero(value) \
    do { \
        (value).a = 0; \
        (value).b = 0; \
        (value).c = 0; \
        (value).d = 0; \
        (value).e = 0; \
    } while (0)

#define mask_x5_xor_const(value, cvalue) \
    do { \
        (value).a ^= (cvalue); \
    } while (0)

#define mask_x5_xor(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
        (value1).d ^= (value2).d; \
        (value1).e ^= (value2).e; \
    } while (0)

#define mask_x5_xor3(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a ^ (value3).a); \
        (value1).b ^= ((value2).b ^ (value3).b); \
        (value1).c ^= ((value2).c ^ (value3).c); \
        (value1).d ^= ((value2).d ^ (value3).d); \
        (value1).e ^= ((value2).e ^ (value3).e); \
    } while (0)

#define mask_x5_not(value) \
    do { \
        (value).a = ~((value).a); \
    } while (0)

#define mask_x5_and(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a & (value3).a); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).d ^= ((value2).d & (value3).d); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).e ^= ((value2).e & (value3).e); \
    } while (0)

#define mask_x5_and_not(value1, value2, value3) \
    do { \
        (value1).a ^= ((~(value2).a) & (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).d ^= ((value2).d & (value3).d); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).e ^= ((value2).e & (value3).e); \
    } while (0)

#define mask_x5_or(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a | (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).d ^= ((value2).d & (value3).d); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).e, (value2).e, (value3).e); \
        (value1).e ^= ((value2).e & (value3).e); \
    } while (0)

#define mask_x5_shl(value1, value2, bits) \
    do { \
        (value1).a = (value2).a << (bits); \
        (value1).b = (value2).b << (bits); \
        (value1).c = (value2).c << (bits); \
        (value1).d = (value2).d << (bits); \
        (value1).e = (value2).e << (bits); \
    } while (0)

#define mask_x5_shr(value1, value2, bits) \
    do { \
        (value1).a = (value2).a >> (bits); \
        (value1).b = (value2).b >> (bits); \
        (value1).c = (value2).c >> (bits); \
        (value1).d = (value2).d >> (bits); \
        (value1).e = (value2).e >> (bits); \
    } while (0)

#define mask_x5_rol(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a << (bits)) | \
                     ((value2).a >> (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b << (bits)) | \
                     ((value2).b >> (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c << (bits)) | \
                     ((value2).c >> (sizeof((value1).c) * 8 - (bits))); \
        (value1).d = ((value2).d << (bits)) | \
                     ((value2).d >> (sizeof((value1).d) * 8 - (bits))); \
        (value1).e = ((value2).e << (bits)) | \
                     ((value2).e >> (sizeof((value1).d) * 8 - (bits))); \
    } while (0)

#define mask_x5_ror(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a >> (bits)) | \
                     ((value2).a << (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b >> (bits)) | \
                     ((value2).b << (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c >> (bits)) | \
                     ((value2).c << (sizeof((value1).c) * 8 - (bits))); \
        (value1).d = ((value2).d >> (bits)) | \
                     ((value2).d << (sizeof((value1).d) * 8 - (bits))); \
        (value1).e = ((value2).e >> (bits)) | \
                     ((value2).e << (sizeof((value1).d) * 8 - (bits))); \
    } while (0)

#define mask_x5_swap(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value2).a ^= (value1).a; \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value2).b ^= (value1).b; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
        (value2).c ^= (value1).c; \
        (value1).c ^= (value2).c; \
        (value1).d ^= (value2).d; \
        (value2).d ^= (value1).d; \
        (value1).d ^= (value2).d; \
        (value1).e ^= (value2).e; \
        (value2).e ^= (value1).e; \
        (value1).e ^= (value2).e; \
    } while (0)

#define mask_x5_swap_move(value1, value2, mask, shift) \
    do { \
        mask_swap_move_internal((value1).a, (value2).a, (mask), (shift)); \
        mask_swap_move_internal((value1).b, (value2).b, (mask), (shift)); \
        mask_swap_move_internal((value1).c, (value2).c, (mask), (shift)); \
        mask_swap_move_internal((value1).d, (value2).d, (mask), (shift)); \
        mask_swap_move_internal((value1).e, (value2).e, (mask), (shift)); \
    } while (0)

#define mask_x6_input(value, input) \
    do { \
        if (sizeof((value).b) <= 4) { \
            (value).b = aead_random_generate_32(); \
            (value).c = aead_random_generate_32(); \
            (value).d = aead_random_generate_32(); \
            (value).e = aead_random_generate_32(); \
            (value).f = aead_random_generate_32(); \
        } else { \
            (value).b = aead_random_generate_64(); \
            (value).c = aead_random_generate_64(); \
            (value).d = aead_random_generate_64(); \
            (value).e = aead_random_generate_64(); \
            (value).f = aead_random_generate_64(); \
        } \
        (value).a = (input) ^ (value).b ^ (value).c ^ \
                  (value).d ^ (value).e ^ (value).f; \
    } while (0)

#define mask_x6_output(value) \
    ((value).a ^ (value).b ^ (value).c ^ (value).d ^ (value).e ^ (value).f)

#define mask_x6_zero(value) \
    do { \
        (value).a = 0; \
        (value).b = 0; \
        (value).c = 0; \
        (value).d = 0; \
        (value).e = 0; \
        (value).f = 0; \
    } while (0)

#define mask_x6_xor_const(value, cvalue) \
    do { \
        (value).a ^= (cvalue); \
    } while (0)

#define mask_x6_xor(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
        (value1).d ^= (value2).d; \
        (value1).e ^= (value2).e; \
        (value1).f ^= (value2).f; \
    } while (0)

#define mask_x6_xor3(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a ^ (value3).a); \
        (value1).b ^= ((value2).b ^ (value3).b); \
        (value1).c ^= ((value2).c ^ (value3).c); \
        (value1).d ^= ((value2).d ^ (value3).d); \
        (value1).e ^= ((value2).e ^ (value3).e); \
        (value1).f ^= ((value2).f ^ (value3).f); \
    } while (0)

#define mask_x6_not(value) \
    do { \
        (value).a = ~((value).a); \
    } while (0)

#define mask_x6_and(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a & (value3).a); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).a, (value2).a, (value3).a, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).d ^= ((value2).d & (value3).d); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).e ^= ((value2).e & (value3).e); \
        mask_mix_and((value1).e, (value2).e, (value3).e, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).f ^= ((value2).f & (value3).f); \
    } while (0)

#define mask_x6_and_not(value1, value2, value3) \
    do { \
        (value1).a ^= ((~(value2).a) & (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).a, ~(value2).a, (value3).a, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).d ^= ((value2).d & (value3).d); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).e ^= ((value2).e & (value3).e); \
        mask_mix_and((value1).e, (value2).e, (value3).e, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).f ^= ((value2).f & (value3).f); \
    } while (0)

#define mask_x6_or(value1, value2, value3) \
    do { \
        (value1).a ^= ((value2).a | (value3).a); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).b, (value2).b, (value3).b); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).a, ~(value2).a, ~(value3).a, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).b ^= ((value2).b & (value3).b); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).c, (value2).c, (value3).c); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).b, (value2).b, (value3).b, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).c ^= ((value2).c & (value3).c); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).d, (value2).d, (value3).d); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).c, (value2).c, (value3).c, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).d ^= ((value2).d & (value3).d); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).e, (value2).e, (value3).e); \
        mask_mix_and((value1).d, (value2).d, (value3).d, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).e ^= ((value2).e & (value3).e); \
        mask_mix_and((value1).e, (value2).e, (value3).e, \
                     (value1).f, (value2).f, (value3).f); \
        (value1).f ^= ((value2).f & (value3).f); \
    } while (0)

#define mask_x6_shl(value1, value2, bits) \
    do { \
        (value1).a = (value2).a << (bits); \
        (value1).b = (value2).b << (bits); \
        (value1).c = (value2).c << (bits); \
        (value1).d = (value2).d << (bits); \
        (value1).e = (value2).e << (bits); \
        (value1).f = (value2).f << (bits); \
    } while (0)

#define mask_x6_shr(value1, value2, bits) \
    do { \
        (value1).a = (value2).a >> (bits); \
        (value1).b = (value2).b >> (bits); \
        (value1).c = (value2).c >> (bits); \
        (value1).d = (value2).d >> (bits); \
        (value1).e = (value2).e >> (bits); \
        (value1).f = (value2).f >> (bits); \
    } while (0)

#define mask_x6_rol(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a << (bits)) | \
                     ((value2).a >> (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b << (bits)) | \
                     ((value2).b >> (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c << (bits)) | \
                     ((value2).c >> (sizeof((value1).c) * 8 - (bits))); \
        (value1).d = ((value2).d << (bits)) | \
                     ((value2).d >> (sizeof((value1).d) * 8 - (bits))); \
        (value1).e = ((value2).e << (bits)) | \
                     ((value2).e >> (sizeof((value1).e) * 8 - (bits))); \
        (value1).f = ((value2).f << (bits)) | \
                     ((value2).f >> (sizeof((value1).f) * 8 - (bits))); \
    } while (0)

#define mask_x6_ror(value1, value2, bits) \
    do { \
        (value1).a = ((value2).a >> (bits)) | \
                     ((value2).a << (sizeof((value1).a) * 8 - (bits))); \
        (value1).b = ((value2).b >> (bits)) | \
                     ((value2).b << (sizeof((value1).b) * 8 - (bits))); \
        (value1).c = ((value2).c >> (bits)) | \
                     ((value2).c << (sizeof((value1).c) * 8 - (bits))); \
        (value1).d = ((value2).d >> (bits)) | \
                     ((value2).d << (sizeof((value1).d) * 8 - (bits))); \
        (value1).e = ((value2).e >> (bits)) | \
                     ((value2).e << (sizeof((value1).e) * 8 - (bits))); \
        (value1).f = ((value2).f >> (bits)) | \
                     ((value2).f << (sizeof((value1).f) * 8 - (bits))); \
    } while (0)

#define mask_x6_swap(value1, value2) \
    do { \
        (value1).a ^= (value2).a; \
        (value2).a ^= (value1).a; \
        (value1).a ^= (value2).a; \
        (value1).b ^= (value2).b; \
        (value2).b ^= (value1).b; \
        (value1).b ^= (value2).b; \
        (value1).c ^= (value2).c; \
        (value2).c ^= (value1).c; \
        (value1).c ^= (value2).c; \
        (value1).d ^= (value2).d; \
        (value2).d ^= (value1).d; \
        (value1).d ^= (value2).d; \
        (value1).e ^= (value2).e; \
        (value2).e ^= (value1).e; \
        (value1).e ^= (value2).e; \
        (value1).f ^= (value2).f; \
        (value2).f ^= (value1).f; \
        (value1).f ^= (value2).f; \
    } while (0)

#define mask_x6_swap_move(value1, value2, mask, shift) \
    do { \
        mask_swap_move_internal((value1).a, (value2).a, (mask), (shift)); \
        mask_swap_move_internal((value1).b, (value2).b, (mask), (shift)); \
        mask_swap_move_internal((value1).c, (value2).c, (mask), (shift)); \
        mask_swap_move_internal((value1).d, (value2).d, (mask), (shift)); \
        mask_swap_move_internal((value1).e, (value2).e, (mask), (shift)); \
        mask_swap_move_internal((value1).f, (value2).f, (mask), (shift)); \
    } while (0)

/* Define aliases for operating on shares in a generic fashion */
#if AEAD_MASKING_SHARES == 2
typedef mask_x2_uint16_t mask_uint16_t;
typedef mask_x2_uint32_t mask_uint32_t;
typedef mask_x2_uint64_t mask_uint64_t;
#define mask_input(value, input) mask_x2_input((value), (input))
#define mask_output(value) mask_x2_output((value))
#define mask_zero(value) mask_x2_zero((value))
#define mask_xor_const(value, cvalue) mask_x2_xor_const((value), (cvalue))
#define mask_xor(value1, value2) mask_x2_xor((value1), (value2))
#define mask_xor3(value1, value2, value3) mask_x2_xor3((value1), (value2), (value3))
#define mask_not(value) mask_x2_not((value))
#define mask_and(value1, value2, value3) mask_x2_and((value1), (value2), (value3))
#define mask_and_not(value1, value2, value3) mask_x2_and_not((value1), (value2), (value3))
#define mask_or(value1, value2, value3) mask_x2_or((value1), (value2), (value3))
#define mask_shl(value1, value2, bits) mask_x2_shl((value1), (value2), (bits))
#define mask_shr(value1, value2, bits) mask_x2_shr((value1), (value2), (bits))
#define mask_rol(value1, value2, bits) mask_x2_rol((value1), (value2), (bits))
#define mask_ror(value1, value2, bits) mask_x2_ror((value1), (value2), (bits))
#define mask_swap(value1, value2) mask_x2_swap((value1), (value2))
#define mask_swap_move(value1, value2, mask, shift) mask_x2_swap_move((value1), (value2), (mask), (shift))
#elif AEAD_MASKING_SHARES == 3
typedef mask_x3_uint16_t mask_uint16_t;
typedef mask_x3_uint32_t mask_uint32_t;
typedef mask_x3_uint64_t mask_uint64_t;
#define mask_input(value, input) mask_x3_input((value), (input))
#define mask_output(value) mask_x3_output((value))
#define mask_zero(value) mask_x3_zero((value))
#define mask_xor_const(value, cvalue) mask_x3_xor_const((value), (cvalue))
#define mask_xor(value1, value2) mask_x3_xor((value1), (value2))
#define mask_xor3(value1, value2, value3) mask_x3_xor3((value1), (value2), (value3))
#define mask_not(value) mask_x3_not((value))
#define mask_and(value1, value2, value3) mask_x3_and((value1), (value2), (value3))
#define mask_and_not(value1, value2, value3) mask_x3_and_not((value1), (value2), (value3))
#define mask_or(value1, value2, value3) mask_x3_or((value1), (value2), (value3))
#define mask_shl(value1, value2, bits) mask_x3_shl((value1), (value2), (bits))
#define mask_shr(value1, value2, bits) mask_x3_shr((value1), (value2), (bits))
#define mask_rol(value1, value2, bits) mask_x3_rol((value1), (value2), (bits))
#define mask_ror(value1, value2, bits) mask_x3_ror((value1), (value2), (bits))
#define mask_swap(value1, value2) mask_x3_swap((value1), (value2))
#define mask_swap_move(value1, value2, mask, shift) mask_x3_swap_move((value1), (value2), (mask), (shift))
#elif AEAD_MASKING_SHARES == 4

typedef mask_x4_uint16_t mask_uint16_t;

typedef mask_x4_uint32_t mask_uint32_t;

typedef mask_x4_uint64_t mask_uint64_t;

#define mask_input(value, input) mask_x4_input((value), (input))

#define mask_output(value) mask_x4_output((value))

#define mask_zero(value) mask_x4_zero((value))

#define mask_xor_const(value, cvalue) mask_x4_xor_const((value), (cvalue))

#define mask_xor(value1, value2) mask_x4_xor((value1), (value2))

#define mask_xor3(value1, value2, value3) mask_x4_xor3((value1), (value2), (value3))

#define mask_not(value) mask_x4_not((value))

#define mask_and(value1, value2, value3) mask_x4_and((value1), (value2), (value3))

#define mask_and_not(value1, value2, value3) mask_x4_and_not((value1), (value2), (value3))

#define mask_or(value1, value2, value3) mask_x4_or((value1), (value2), (value3))

#define mask_shl(value1, value2, bits) mask_x4_shl((value1), (value2), (bits))

#define mask_shr(value1, value2, bits) mask_x4_shr((value1), (value2), (bits))

#define mask_rol(value1, value2, bits) mask_x4_rol((value1), (value2), (bits))

#define mask_ror(value1, value2, bits) mask_x4_ror((value1), (value2), (bits))

#define mask_swap(value1, value2) mask_x4_swap((value1), (value2))

#define mask_swap_move(value1, value2, mask, shift) mask_x4_swap_move((value1), (value2), (mask), (shift))

#elif AEAD_MASKING_SHARES == 5
typedef mask_x5_uint16_t mask_uint16_t;
typedef mask_x5_uint32_t mask_uint32_t;
typedef mask_x5_uint64_t mask_uint64_t;
#define mask_input(value, input) mask_x5_input((value), (input))
#define mask_output(value) mask_x5_output((value))
#define mask_zero(value) mask_x5_zero((value))
#define mask_xor_const(value, cvalue) mask_x5_xor_const((value), (cvalue))
#define mask_xor(value1, value2) mask_x5_xor((value1), (value2))
#define mask_xor3(value1, value2, value3) mask_x5_xor3((value1), (value2), (value3))
#define mask_not(value) mask_x5_not((value))
#define mask_and(value1, value2, value3) mask_x5_and((value1), (value2), (value3))
#define mask_and_not(value1, value2, value3) mask_x5_and_not((value1), (value2), (value3))
#define mask_or(value1, value2, value3) mask_x5_or((value1), (value2), (value3))
#define mask_shl(value1, value2, bits) mask_x5_shl((value1), (value2), (bits))
#define mask_shr(value1, value2, bits) mask_x5_shr((value1), (value2), (bits))
#define mask_rol(value1, value2, bits) mask_x5_rol((value1), (value2), (bits))
#define mask_ror(value1, value2, bits) mask_x5_ror((value1), (value2), (bits))
#define mask_swap(value1, value2) mask_x5_swap((value1), (value2))
#define mask_swap_move(value1, value2, mask, shift) mask_x5_swap_move((value1), (value2), (mask), (shift))
#elif AEAD_MASKING_SHARES == 6
typedef mask_x6_uint16_t mask_uint16_t;
typedef mask_x6_uint32_t mask_uint32_t;
typedef mask_x6_uint64_t mask_uint64_t;
#define mask_input(value, input) mask_x6_input((value), (input))
#define mask_output(value) mask_x6_output((value))
#define mask_zero(value) mask_x6_zero((value))
#define mask_xor_const(value, cvalue) mask_x6_xor_const((value), (cvalue))
#define mask_xor(value1, value2) mask_x6_xor((value1), (value2))
#define mask_xor3(value1, value2, value3) mask_x6_xor3((value1), (value2), (value3))
#define mask_not(value) mask_x6_not((value))
#define mask_and(value1, value2, value3) mask_x6_and((value1), (value2), (value3))
#define mask_and_not(value1, value2, value3) mask_x6_and_not((value1), (value2), (value3))
#define mask_or(value1, value2, value3) mask_x6_or((value1), (value2), (value3))
#define mask_shl(value1, value2, bits) mask_x6_shl((value1), (value2), (bits))
#define mask_shr(value1, value2, bits) mask_x6_shr((value1), (value2), (bits))
#define mask_rol(value1, value2, bits) mask_x6_rol((value1), (value2), (bits))
#define mask_ror(value1, value2, bits) mask_x6_ror((value1), (value2), (bits))
#define mask_swap(value1, value2) mask_x6_swap((value1), (value2))
#define mask_swap_move(value1, value2, mask, shift) mask_x6_swap_move((value1), (value2), (mask), (shift))
#else
#error "AEAD_MASKING_SHARES value is not supported"
#endif

#ifdef __cplusplus
}
#endif

#endif