active uint32_t s; uint32_t *output; while (output_words--) { int i = Y[185] % 256; P[256] = P[i]; // This effectively swaps P[0] and P[i] P[i] = P[0]; // Then copies P[0] to P[256] P++; // Prior P[1] is new P[0], just-written P[256] is new P[255] s += Y[P[72]] - Y[P[239]]; s = ROTL32(s, (P[116] + 18) % 32); *output++ = (ROTL32(s, 25) ^ Y[256]) + Y[P[26]]; // This line omitted from Pypy & TPypy *output++ = ( s ^ Y[-1] ) + Y[P[208]]; Y[257] = (ROTL32(s, 14) ^ Y[-3] ) + Y[P[153]]; Y++; // Prior P[-2] is new P[-3], just-written P[257] is new P[256] } When byte output is required, Py specifies that the output words are converted little-endian. Line 17 is omitted from Pypy, Tpypy, and RCR-32. RCR-32 and RCR-64 are identical to the above, except that line 15 is changed to a fixed left-rotate of 19 bits. Py6 has the same structure, but the P and Y arrays are shortened to 64 bytes and 68 words, respectively. P entries are only 6 bits long, a savings that could be exploited in dedicated hardware. The various offsets into P[] and Y[] are, of course, modified, making the inner loop: while (output_words--) { int i = Y[43] % 64; P[64] = P[i]; P[i] = P[0]; P++; s += Y[P[18]] - Y[P[57]]; s = ROTL32(s, (P[26] + 18) % 32); *output++ = (ROTL32(s, 25) ^ Y[64]) + Y[P[8]]; *output++ = ( s ^ Y[-1]) + Y[P[21]]; Y[65] = (ROTL32(s, 14) ^ Y[-3]) + Y[P[48]]; Y++; } External links Eli Biham, Jennifer Seberry, Py specification (PostScript) Eli Biham, Jennifer Seberry, Tweaking the IV Setup of the Py Family of Stream Ciphers -- The Ciphers TPy, TPypy, and TPy6 eStream page on Py Paul Crowley,Cryptanalysis of Py Souradyuti Paul, Bart Preneel, Gautham Sekar, Distinguishing attacks on the stream cipher Py, FSE 2006. Gautham Sekar, Souradyuti Paul, Bart Preneel, Weaknesses in the Pseudorandom Bit Generation Algorithms of the Stream Ciphers TPypy and TPy, IACR-ePrint report. Souradyuti Paul, Bart Preneel, On the (In)security of Stream Ciphers Based on Arrays and Modular Addition (Full Version) , Asicrypt 2006. Gautham Sekar, Souradyuti Paul, Bart Preneel, Related-key Attacks on the Py-family of Ciphers and an Approach to Repair the Weaknesses, Indocrypt 2007. The Rijndael page - the "Rijndael FAQ" is gently parodied in Appendix B of the Py specification. Stream ciphers