docs: function (x, y) {
      var i, j, xi, Zi, Vi, lsb_Vi, w=sjcl.bitArray, xor=w._xor4;
  
      Zi = [0,0,0,0];
      Vi = y.slice(0);
  
      // Block size is 128 bits, run 128 times to get Z_128
      for (i=0; i<128; i++) {
        xi = (x[Math.floor(i/32)] & (1 << (31-i%32))) !== 0;
        if (xi) {
          // Z_i+1 = Z_i ^ V_i
          Zi = xor(Zi, Vi);
        }
  
        // Store the value of LSB(V_i)
        lsb_Vi = (Vi[3] & 1) !== 0;
  
        // V_i+1 = V_i >> 1
        for (j=3; j>0; j--) {
          Vi[j] = (Vi[j] >>> 1) | ((Vi[j-1]&1) << 31);
        }
        Vi[0] = Vi[0] >>> 1;
  
        // If LSB(V_i) is 1, V_i+1 = (V_i >> 1) ^ R
        if (lsb_Vi) {
          Vi[0] = Vi[0] ^ (0xe1 << 24);
        }
      }
      return Zi;
    }