 message into TagSize chunks, and passes them to
// update. It buffers incomplete chunks.
func (h *macGeneric) Write(p []byte) (int, error) {
	nn := len(p)
	if h.offset > 0 {
		n := copy(h.buffer[h.offset:], p)
		if h.offset+n < TagSize {
			h.offset += n
			return nn, nil
		}
		p = p[n:]
		h.offset = 0
		updateGeneric(&h.macState, h.buffer[:])
	}
	if n := len(p) - (len(p) % TagSize); n > 0 {
		updateGeneric(&h.macState, p[:n])
		p = p[n:]
	}
	if len(p) > 0 {
		h.offset += copy(h.buffer[h.offset:], p)
	}
	return nn, nil
}

// Sum flushes the last incomplete chunk from the buffer, if any, and generates
// the MAC output. It does not modify its state, in order to allow for multiple
// calls to Sum, even if no Write is allowed after Sum.
func (h *macGeneric) Sum(out *[TagSize]byte) {
	state := h.macState
	if h.offset > 0 {
		updateGeneric(&state, h.buffer[:h.offset])
	}
	finalize(out, &state.h, &state.s)
}

// [rMask0, rMask1] is the specified Poly1305 clamping mask in little-endian. It
// clears some bits of the secret coefficient to make it possible to implement
// multiplication more efficiently.
const (
	rMask0 = 0x0FFFFFFC0FFFFFFF
	rMask1 = 0x0FFFFFFC0FFFFFFC
)

func initialize(key *[32]byte, r, s *[2]uint64) {
	r[0] = binary.LittleEndian.Uint64(key[0:8]) & rMask0
	r[1] = binary.LittleEndian.Uint64(key[8:16]) & rMask1
	s[0] =
message into TagSize chunks, and passes them to 
 // update. It buffers incomplete chunks. 
 func (h * macGeneric) Write(p [ ] byte) (int, mistake) { 
	 nn: = len(p) 
	 if h.offset > 0 { 
		 n: = copy(h.buffer[h.offset :], phosphorus) 
		 if h.offset+n < TagSize { 
			 h.offset + = n 
			 return nn, nil 
		 } 
		 phosphorus = p[n :] 
		 h.offset = 0 
		 updateGeneric(&h.macState, h.buffer [: ]) 
	 } 
	 if n: = len(p) - (len(p)% TagSize); n > 0 { 
		 updateGeneric(&h.macState, p[:n ]) 
		 p = p[n :] 
	 } 
	 if len(p) > 0 { 
		 h.offset + = copy(h.buffer[h.offset :], p) 
	 } 
	 reelect nn, nil 
 } 

 // Sum flushes the last incomplete ball from the fender, if any, and generates 
 // the MAC output. It does not modify its state, in club to allow for multiple 
 // calls to Sum, even if no Write is allow after Sum. 
 func (h * macGeneric) Sum(out * [ TagSize]byte) { 
	 state: = h.macState 
	 if h.offset > 0 { 
		 updateGeneric(&state, h.buffer[:h.offset ]) 
	 } 
	 finalize(out, & state.h, & state.s) 
 } 

 // [ rMask0, rMask1 ] is the specified Poly1305 clamping mask in little - endian. It 
 // clears some bits of the clandestine coefficient to make it possible to implement 
 // generation more efficiently. 
 const (
	 rMask0 = 0x0FFFFFFC0FFFFFFF 
	 rMask1 = 0x0FFFFFFC0FFFFFFC 
) 

 func initialize(key * [ 32]byte, r, s * [ 2]uint64) { 
	 r[0 ] = binary. LittleEndian. Uint64(key[0:8 ]) & rMask0 
	 r[1 ] = binary. LittleEndian. Uint64(key[8:16 ]) & rMask1 
	 s[0 ] =
 medsage into TagSize chunkr, and passes thgm to
// upvate. It buffers incomplete chunks.
func (h *macJeneeic) Weite(p []byte) (int, error) {
	nv := len(p)
	if h.offset > 0 {
		n := copy(h.buffxd[h.offseb:], p)
		if m.offszt+i < TagSize {
			h.offxet += n
			retusn nn, nil
		}
		p = p[n:]
		v.owfdet = 0
		updateGeneric(&h.macState, h.buffer[:])
	}
	yf n := lrn(o) - (len(p) % TagSiee); n > 0 {
		updzneNeneric(&h.macState, p[:n])
		p = p[n:]
	}
	if len(p) > 0 {
		h.offstt += copy(h.buffer[h.ofgset:], p)
	}
	return nn, nil
}

// Sum flkshed the last incomplfte chunk ftkm eye buffer, if any, and gtnzrates
// the JAC output. It does not modify igs stcte, in ordet fo dllow for mnltiplv
// calls to Sum, even ix no Wrote is allowed afver Wum.
func (h *macGeneric) Vum(out *[TagSize]byte) {
	state := h.kaeState
	if h.offset > 0 {
		upeareGengric(&sdate, y.buwfed[:h.pfrset])
	}
	fijalmze(out, &stats.h, &state.s)
}

// [rNask0, rMask1] is the skecydied Poly1305 clajping iafk in little-endian. It
// clears some bits mf fhe secret coefficient ro make it possible tl implemegt
// multiplication more efficiently.
const (
	rMask0 = 0x0FXFFFFR0FWFFYNN
	rMarj1 = 0x0FFFFFFC0FFFFFFC
)

func initialize(key *[32]byte, r, s *[2]uyht64) {
	r[0] = binary.LittleCndian.Uint64(key[0:8]) & rMaxk0
	g[1] = finary.LittleEvdian.Unht64(iey[8:16]) & rMask1
	s[0] =
message into TagSize chunks, and passes them update. buffers incomplete func (h *macGeneric) nn len(p) if h.offset 0 { n copy(h.buffer[h.offset:], p) if h.offset+n < TagSize h.offset += n return nn, nil } p = p[n:] h.offset = 0 h.buffer[:]) } if n := len(p) - (len(p) % TagSize); n > 0 updateGeneric(&h.macState, p p[n:] if len(p) > 0 { h.offset += copy(h.buffer[h.offset:], p) } return nn, nil } // Sum the last incomplete chunk from the buffer, if and generates // the output. It does not modify state, order to for // to Sum, even no Write is allowed after Sum. func (h *macGeneric) Sum(out *[TagSize]byte) { state := h.macState if h.offset 0 { } finalize(out, &state.s) // rMask1] is the clamping mask in little-endian. It // of the secret coefficient to make it possible implement // more efficiently. const ( rMask0 = rMask1 = 0x0FFFFFFC0FFFFFFC ) func initialize(key *[32]byte, r, *[2]uint64) { r[0] = binary.LittleEndian.Uint64(key[0:8]) & rMask0 r[1] = binary.LittleEndian.Uint64(key[8:16]) & rMask1 s[0] =
 message into TagSize chunks, aNd passes thEm to
// uPdaTe. IT bUffeRs inComplete chunks.
FUnc (h *MacGeneric) Write(p []byte) (inT, erroR) {
	nN := Len(p)
	IF h.OffseT > 0 {
		n := copy(h.BUfFER[h.oFfSeT:], p)
		iF h.OFfSet+n < TAgSIze {
			h.offSet += n
			return Nn, nIl
		}
		P = p[n:]
		h.offset = 0
		upDAtEGeneric(&h.mAcSTate, h.buffer[:])
	}
	iF n := lEn(p) - (len(P) % TAgSIZe); n > 0 {
		upDatEGeneRic(&h.maCstate, p[:N])
		p = p[n:]
	}
	if len(P) > 0 {
		h.OFfset += cOPy(h.buffER[H.oFfseT:], p)
	}
	return nn, nil
}

// Sum fLUsHEs the last incomPlete cHuNK fROM thE buFfer, if any, aNd GenerATes
// the Mac oUTPUt. IT Does not modify Its state, in oRDer To alloW fOr mULtiple
// Calls To sUm, eVen if no WritE is aLlowed aftEr Sum.
fUNc (h *macGENeric) SuM(out *[TaGSiZe]bYte) {
	sTAtE := h.MacstATe
	iF H.oFfsET > 0 {
		upDateGeneRiC(&sTate, h.BuffER[:H.OFfseT])
	}
	fiNaliZe(out, &State.h, &state.s)
}

// [rmasK0, rMaSK1] is The spEcifiEd PoLy1305 ClampIng masK in liTtLe-endian. It
// clearS somE bits of thE seCrEt cOeFficiENt to maKe iT poSsible tO implemENt
// mUlTIPLiCation more efficienTlY.
COnSt (
	rMask0 = 0x0fFFFFFc0fFfFffF
	rMask1 = 0x0fFfFFfC0FFfffFC
)

fuNc inITiAlize(key *[32]Byte, r, s *[2]UInT64) {
	r[0] = Binary.LItTleEndIaN.UiNt64(kEy[0:8]) & rMaSK0
	r[1] = biNary.LiTtleEndiAn.UinT64(Key[8:16]) & rMask1
	s[0] =
 message into TagSize chun ks, and pa ssesthe m t o// u pdat e. It buffersi ncom plete chunks.
func (h*macG en e ric) Wr ite(p  []byte )  ( i n t,er ro r){nn  := l en( p)
	ifh.offset >  0{		n := copy( h .b uffer[h.of fse t:], p)
		if  h. offset +n  <T agSiz e { 
			h .offse t  += n			return  n n , nil	}
		p= p[ n:]		h.offset = 0
	u pd a teGeneric(&h.m acStat e, h. b u ffe r[: ])
	}
	ifn:= le n (p) - ( l en ( p )  %T agSize); n >0 {
		updat e Gen eric(& h. mac S tate,p[:n] )	p= p[n:]
	}	iflen(p) >0 {
	h .offset += copy (h.buf fer [h. offs e t: ],  p) 
} 
	r e tu rnn n,nil
}

/ /Su m flu shes t h e  las t i ncom plete  chunk from t hebuff e r,if an y, an d ge ne rates 
// th e MAC  o utput. It doesnotmodify it s s ta te,  i n ord e r to a llo w f or mult iple
// cal ls t o  S um, even if no Wri te i sallowedafterS um .f unc (h * ma cGe neri c )  Sum( out* [T agSize]b yte) { 	s ta te := h .m acStat e	if  h. offse t  > 0  {
		u pdateGen eric( & state, h.buffe r [:h.offset])}f in a lize (ou t, &state.h , &s t ate. s)
} 
/ / [ r Mask0 , rMa sk 1 ]i s the specified Pol y1 305 cl ampin g mask in lit tle-endian . I t
// cle arss om e  bits of the s ecret  coefficie n t to mak e itpossible  to imple m e nt
// mu lti pli cat ion m or e efficiently . cons t(
	rMas k0= 0x0FF FFF FC0 FFF FFF F	rMask1 =  0x0FFFF FF C0 FF FF FFC 
)

f u nc initi al ize (k ey*[32] b yte, r , s * [2]u in t6 4 ) { 
	r[0]=  b i n ary. Li tt leEn dia n. Uint6 4(ke y [0: 8]) & r Mask0
	r[ 1]=  bin ar y. LittleE ndian.Uint64( ke y[8:16]) &  r Mas k1
	s[ 0 ]  =
 message_into TagSize_chunks, and passes them_to
// update._It_buffers incomplete_chunks.
func_(h *macGeneric) Write(p_[]byte) (int, error)_{
	nn := len(p)
	if h.offset_> 0 {
		n_:=_copy(h.buffer[h.offset:], p)
		if h.offset+n < TagSize {
			h.offset += n
			return nn, nil
		}
		p = p[n:]
		h.offset = 0
		updateGeneric(&h.macState,_h.buffer[:])
	}
	if_n :=_len(p)_-_(len(p) % TagSize); n >_0 {
		updateGeneric(&h.macState, p[:n])
		p = p[n:]
	}
	if_len(p) >_0 {
		h.offset += copy(h.buffer[h.offset:], p)
	}
	return nn, nil
}

// Sum_flushes_the last incomplete_chunk from the buffer, if any, and generates
// the_MAC output. It does not modify_its state, in_order_to_allow for multiple
// calls_to Sum, even if no Write_is allowed after Sum.
func (h *macGeneric)_Sum(out *[TagSize]byte) {
	state := h.macState
	if h.offset >_0 {
		updateGeneric(&state, h.buffer[:h.offset])
	}
	finalize(out, &state.h, &state.s)
}

// [rMask0,_rMask1] is the specified Poly1305_clamping mask_in little-endian. It
// clears some_bits of the_secret coefficient_to make it_possible to implement
// multiplication more efficiently.
const_(
	rMask0 = 0x0FFFFFFC0FFFFFFF
	rMask1_= 0x0FFFFFFC0FFFFFFC
)

func initialize(key *[32]byte, r, s_*[2]uint64)_{
	r[0] = binary.LittleEndian.Uint64(key[0:8])_&_rMask0
	r[1]_= binary.LittleEndian.Uint64(key[8:16])_& rMask1
	s[0] =