; check MSB of tmp
				ld a, (ix - 16)
				rla
				sbc a, a
				and a, 10000011b
				push af
					; now double tmp
					lea hl, ix - 16		; tmp in hl
					ld b, 16
					or a				; reset carry
.loop_mul2:
					rl (hl)
					inc hl
					djnz .loop_mul2

				; now xor with polynomial if tmp degree too high
				; method below is constant-time

				pop af
				xor a, (ix - 1)
				ld (ix - 1), a