Torbjörn Granlund wrote on 15/04/2019 21.57: > Or return the low bit k bits (not all 128)? That works too, at the cost of reducing the throughput. If that's faster than including a 128-bit addition in the process, sure.