Definition padlen' (n: Z) : list Int.int :=
     let q := (n+8)/64*16 + 15 - (n+8)/4   (* number of zero-pad words *)
      in zeros q ++ [Int.repr (n * 8 / Int.modulus); Int.repr (n * 8)].

(* Specifications: *)
Lemma padlen_eq: padlen=padlen'.
Lemma length_generate_and_pad'': forall (l: list byte) (k: Z), k >= 0 -> k + Zlength (generate_and_pad' l (k*4)) = roundup (((k*4+Zlength l)+12)/4) 16.
Lemma length_generate_and_pad': forall (l: list byte), Zlength (generate_and_pad' l 0) = roundup ((Zlength l +12)/4) 16.
Lemma roundup_ge: forall a b, b > 0 -> roundup a b >= a.
Lemma generate_and_pad'_eq: generate_and_pad = generate_and_pad_alt.
Lemma length_generate_and_pad: forall (l: list byte), Zlength (generate_and_pad l) = roundup ((Zlength l +12)/4) 16.
Lemma generate_word_lemma1: forall b n, length b = 16%nat -> firstn 16 (rev (generate_word (rev b) n)) = b.
Lemma length_generate_word: forall b n, length (generate_word b n) = (length b + n)%nat.
Lemma nth_generate_word_S: forall k i n b', nth (i+k) (generate_word b' (n+k)) = nth i (generate_word b' n).
Lemma generate_word_small: forall i b n, length b = 16%nat -> (i < length b)%nat -> nth i (rev (generate_word (rev b) n)) = nth i b.
Lemma generate_word_plus: forall msg a b, (16 <= length msg)%nat -> generate_word msg (a+b) = generate_word (generate_word msg a) b.