/* key      = 00 01 02 .. 1f (LE words) */
/* counter  = 0x0900000000000001 (st12=1, st13=0x09000000) */
/* nonce    = 0x000000004a000000 (st14, st15=0) ? RFC 8439 ?2.4.2 */
static const u32 kat_key[8] = {0x03020100u,0x07060504u,0x0b0a0908u,0x0f0e0d0cu,0x13121110u,0x17161514u,0x1b1a1918u,0x1f1e1d1cu};
static const u64 kat_counter = 0x0900000000000001u;
static const u64 kat_nonce = 0x4a000000u;
static const u8 kat_expect[64] = {
    0x10,0xf1,0xe7,0xe4,0xd1,0x3b,0x59,0x15,
    0x50,0x0f,0xdd,0x1f,0xa3,0x20,0x71,0xc4,
    0xc7,0xd1,0xf4,0xc7,0x33,0xc0,0x68,0x03,
    0x04,0x22,0xaa,0x9a,0xc3,0xd4,0x6c,0x4e,
    0xd2,0x82,0x64,0x46,0x07,0x9f,0xaa,0x09,
    0x14,0xc2,0xd7,0x05,0xd9,0x8b,0x02,0xa2,
    0xb5,0x12,0x9c,0xd1,0xde,0x16,0x4e,0xb9,
    0xcb,0xd0,0x83,0xe8,0xa2,0x50,0x3c,0x4e,
};