private byte[] pdf() {
      // Make Nonce 16 bytes by prepending zeroes. done (see init())

      // one AES invocation is enough for more than one PDF invocation
      // number of index bits needed = 1

      // Extract index bits and zero low bits of Nonce
      BigInteger Nonce = new BigInteger(1, nonce);
      int nlowbitsnum = Nonce.testBit(0) ? 1 : 0;
      Nonce = Nonce.clearBit(0);

      // Generate subkey, AES and extract indexed substring
      IRandom kdf = new UMacGenerator();
      Map map = new HashMap();
      map.put(IBlockCipher.KEY_MATERIAL, K);
//      map.put(IBlockCipher.CIPHER_BLOCK_SIZE, new Integer(128/8));
      map.put(UMacGenerator.INDEX, new Integer(128));
//      map.put(UMacGenerator.CIPHER, Registry.AES_CIPHER);
      kdf.init(map);
      byte[] Kp = new byte[KEY_LEN];
      try {
         kdf.nextBytes(Kp, 0, KEY_LEN);
      } catch (IllegalStateException x) {
         x.printStackTrace(System.err);
         throw new RuntimeException(String.valueOf(x));
      } catch (LimitReachedException x) {
         x.printStackTrace(System.err);
         throw new RuntimeException(String.valueOf(x));
      }
      IBlockCipher aes = CipherFactory.getInstance(Registry.AES_CIPHER);
      map.put(IBlockCipher.KEY_MATERIAL, Kp);
      try {
         aes.init(map);
      } catch (InvalidKeyException x) {
         x.printStackTrace(System.err);
         throw new RuntimeException(String.valueOf(x));
      } catch (IllegalStateException x) {
         x.printStackTrace(System.err);
         throw new RuntimeException(String.valueOf(x));
      }
      byte[] T = new byte[16];
      aes.encryptBlock(nonce, 0, T, 0);
      byte[] result = new byte[OUTPUT_LEN];
      System.arraycopy(T, nlowbitsnum, result, 0, OUTPUT_LEN);

      return result;
   }