pub const DIGEST_BYTES: [usize; 32];Expand description
Source-byte positions of the standard 256-bit feed-forward/truncation.
Digest byte i is final[DIGEST_BYTES[i]] ⊕ input[DIGEST_BYTES[i]]. The
picked bytes are the upper half of AES lanes 0 and 1 (bytes 8..16 and
24..32) and the lower half of lanes 2 and 3 (bytes 32..40 and 48..56).
DSig keeps the first 18 of them, which come from only five of the sixteen
32-bit words; crate::chain_step uses that to skip unobserved S-boxes.