Sorry, yet another correction: the G1 box, G[1][i], is parity(i&0x17), not parity(i) as I said, where parity is 0 or 1 depending on whether its argument has an even or odd number of 1 bits. I have checked via a small program that this is correct and that the earlier formula I posted for G0 is correct. Hal