docs: function(prp, plaintext, iv, adata, tlen, premac) {
      if (sjcl.bitArray.bitLength(iv) !== 128) {
        throw new sjcl.exception.invalid("ocb iv must be 128 bits");
      }
      var i,
          times2 = sjcl.mode.ocb2._times2,
          w = sjcl.bitArray,
          xor = w._xor4,
          checksum = [0,0,0,0],
          delta = times2(prp.encrypt(iv)),
          bi, bl,
          output = [],
          pad;
  
      adata = adata || [];
      tlen  = tlen || 64;
  
      for (i=0; i+4 < plaintext.length; i+=4) {
        /* Encrypt a non-final block */
        bi = plaintext.slice(i,i+4);
        checksum = xor(checksum, bi);
        output = output.concat(xor(delta,prp.encrypt(xor(delta, bi))));
        delta = times2(delta);
      }
  
      /* Chop out the final block */
      bi = plaintext.slice(i);
      bl = w.bitLength(bi);
      pad = prp.encrypt(xor(delta,[0,0,0,bl]));
      bi = w.clamp(xor(bi.concat([0,0,0]),pad), bl);
  
      /* Checksum the final block, and finalize the checksum */
      checksum = xor(checksum,xor(bi.concat([0,0,0]),pad));
      checksum = prp.encrypt(xor(checksum,xor(delta,times2(delta))));
  
      /* MAC the header */
      if (adata.length) {
        checksum = xor(checksum, premac ? adata : sjcl.mode.ocb2.pmac(prp, adata));
      }
  
      return output.concat(w.concat(bi, w.clamp(checksum, tlen)));
    }