Definition X_content (x: SixteenByte * SixteenByte * (SixteenByte * SixteenByte))
                     (i:Z) (l:list val) : Prop :=
    l = upd_upto x (Z.to_nat i) (list_repeat 16 Vundef).

(* Specifications: *)
Lemma XcontUpdate Nonce C Key1 Key2 i l (I: 0 <= i < 4) (L: X_content (Nonce, C, (Key1, Key2)) i l): X_content (Nonce, C, (Key1, Key2)) (i + 1) (upd_Znth (11 + i) (upd_Znth (6 + i) (upd_Znth (1 + i) (upd_Znth (5 * i) l (Vint (littleendian (Select16Q C i)))) (Vint (littleendian (Select16Q Key1 i)))) (Vint (littleendian (Select16Q Nonce i)))) (Vint (littleendian (Select16Q Key2 i)))).
Lemma XX data l: X_content data 4 l -> l = match data with ((Nonce, C), (Key1, Key2)) => match Nonce with (N1, N2, N3, N4) => match C with (C1, C2, C3, C4) => match Key1 with (K1, K2, K3, K4) => match Key2 with (L1, L2, L3, L4) => map Vint (map littleendian [C1; K1; K2; K3; K4; C2; N1; N2; N3; N4; C3; L1; L2; L3; L4; C4]) end end end end end.