crypto_le32enc
crypto_le32enc(out + 0, x0 + j0);
crypto_le32enc(out + 4, x1 + j1);
crypto_le32enc(out + 8, x2 + j2);
crypto_le32enc(out + 12, x3 + j3);
crypto_le32enc(out + 16, x4 + j4);
crypto_le32enc(out + 20, x5 + j5);
crypto_le32enc(out + 24, x6 + j6);
crypto_le32enc(out + 28, x7 + j7);
crypto_le32enc(out + 32, x8 + j8);
crypto_le32enc(out + 36, x9 + j9);
crypto_le32enc(out + 40, x10 + j10);
crypto_le32enc(out + 44, x11 + j11);
crypto_le32enc(out + 48, x12 + j12);
crypto_le32enc(out + 52, x13 + j13);
crypto_le32enc(out + 56, x14 + j14);
crypto_le32enc(out + 60, x15 + j15);
crypto_le32enc(&nonce[0], 1 + crypto_le32dec(&nonce[0]));
crypto_le32enc(&nonce[0], 1 + crypto_le32dec(&nonce[0]));
crypto_le32enc(&nonce[1],
crypto_le32enc(&nonce[0], 1 + crypto_le32dec(&nonce[0]));
crypto_le32enc(&nonce[1],