// Carry-less multiplier generated for N = 16: Karatsuba recursion, schoolbook below 5 bits (base 4).
// 144 AND, 225 XOR before synthesis.
// Scoring baseline only: correct at this N, NOT a parametric or proved entry.
module clmul_n #(parameter int N = 16) (
  input  logic [N-1:0]   a, b,
  output logic [2*N-2:0] p
);
  logic [368:0] w;
  assign w[0] = a[0] & b[0];
  assign w[1] = a[0] & b[1];
  assign w[2] = a[0] & b[2];
  assign w[3] = a[0] & b[3];
  assign w[4] = a[1] & b[0];
  assign w[5] = a[1] & b[1];
  assign w[6] = a[1] & b[2];
  assign w[7] = a[1] & b[3];
  assign w[8] = a[2] & b[0];
  assign w[9] = a[2] & b[1];
  assign w[10] = a[2] & b[2];
  assign w[11] = a[2] & b[3];
  assign w[12] = a[3] & b[0];
  assign w[13] = a[3] & b[1];
  assign w[14] = a[3] & b[2];
  assign w[15] = a[3] & b[3];
  assign w[16] = w[1] ^ w[4];
  assign w[17] = w[2] ^ w[5];
  assign w[18] = w[17] ^ w[8];
  assign w[19] = w[3] ^ w[6];
  assign w[20] = w[9] ^ w[12];
  assign w[21] = w[19] ^ w[20];
  assign w[22] = w[7] ^ w[10];
  assign w[23] = w[22] ^ w[13];
  assign w[24] = w[11] ^ w[14];
  assign w[25] = a[4] & b[4];
  assign w[26] = a[4] & b[5];
  assign w[27] = a[4] & b[6];
  assign w[28] = a[4] & b[7];
  assign w[29] = a[5] & b[4];
  assign w[30] = a[5] & b[5];
  assign w[31] = a[5] & b[6];
  assign w[32] = a[5] & b[7];
  assign w[33] = a[6] & b[4];
  assign w[34] = a[6] & b[5];
  assign w[35] = a[6] & b[6];
  assign w[36] = a[6] & b[7];
  assign w[37] = a[7] & b[4];
  assign w[38] = a[7] & b[5];
  assign w[39] = a[7] & b[6];
  assign w[40] = a[7] & b[7];
  assign w[41] = w[26] ^ w[29];
  assign w[42] = w[27] ^ w[30];
  assign w[43] = w[42] ^ w[33];
  assign w[44] = w[28] ^ w[31];
  assign w[45] = w[34] ^ w[37];
  assign w[46] = w[44] ^ w[45];
  assign w[47] = w[32] ^ w[35];
  assign w[48] = w[47] ^ w[38];
  assign w[49] = w[36] ^ w[39];
  assign w[50] = a[0] ^ a[4];
  assign w[51] = a[1] ^ a[5];
  assign w[52] = a[2] ^ a[6];
  assign w[53] = a[3] ^ a[7];
  assign w[54] = b[0] ^ b[4];
  assign w[55] = b[1] ^ b[5];
  assign w[56] = b[2] ^ b[6];
  assign w[57] = b[3] ^ b[7];
  assign w[58] = w[50] & w[54];
  assign w[59] = w[50] & w[55];
  assign w[60] = w[50] & w[56];
  assign w[61] = w[50] & w[57];
  assign w[62] = w[51] & w[54];
  assign w[63] = w[51] & w[55];
  assign w[64] = w[51] & w[56];
  assign w[65] = w[51] & w[57];
  assign w[66] = w[52] & w[54];
  assign w[67] = w[52] & w[55];
  assign w[68] = w[52] & w[56];
  assign w[69] = w[52] & w[57];
  assign w[70] = w[53] & w[54];
  assign w[71] = w[53] & w[55];
  assign w[72] = w[53] & w[56];
  assign w[73] = w[53] & w[57];
  assign w[74] = w[59] ^ w[62];
  assign w[75] = w[60] ^ w[63];
  assign w[76] = w[75] ^ w[66];
  assign w[77] = w[61] ^ w[64];
  assign w[78] = w[67] ^ w[70];
  assign w[79] = w[77] ^ w[78];
  assign w[80] = w[65] ^ w[68];
  assign w[81] = w[80] ^ w[71];
  assign w[82] = w[69] ^ w[72];
  assign w[83] = w[0] ^ w[23];
  assign w[84] = w[25] ^ w[58];
  assign w[85] = w[83] ^ w[84];
  assign w[86] = w[16] ^ w[24];
  assign w[87] = w[41] ^ w[74];
  assign w[88] = w[86] ^ w[87];
  assign w[89] = w[18] ^ w[15];
  assign w[90] = w[43] ^ w[76];
  assign w[91] = w[89] ^ w[90];
  assign w[92] = w[21] ^ w[46];
  assign w[93] = w[92] ^ w[79];
  assign w[94] = w[23] ^ w[25];
  assign w[95] = w[48] ^ w[81];
  assign w[96] = w[94] ^ w[95];
  assign w[97] = w[24] ^ w[41];
  assign w[98] = w[49] ^ w[82];
  assign w[99] = w[97] ^ w[98];
  assign w[100] = w[15] ^ w[43];
  assign w[101] = w[40] ^ w[73];
  assign w[102] = w[100] ^ w[101];
  assign w[103] = a[8] & b[8];
  assign w[104] = a[8] & b[9];
  assign w[105] = a[8] & b[10];
  assign w[106] = a[8] & b[11];
  assign w[107] = a[9] & b[8];
  assign w[108] = a[9] & b[9];
  assign w[109] = a[9] & b[10];
  assign w[110] = a[9] & b[11];
  assign w[111] = a[10] & b[8];
  assign w[112] = a[10] & b[9];
  assign w[113] = a[10] & b[10];
  assign w[114] = a[10] & b[11];
  assign w[115] = a[11] & b[8];
  assign w[116] = a[11] & b[9];
  assign w[117] = a[11] & b[10];
  assign w[118] = a[11] & b[11];
  assign w[119] = w[104] ^ w[107];
  assign w[120] = w[105] ^ w[108];
  assign w[121] = w[120] ^ w[111];
  assign w[122] = w[106] ^ w[109];
  assign w[123] = w[112] ^ w[115];
  assign w[124] = w[122] ^ w[123];
  assign w[125] = w[110] ^ w[113];
  assign w[126] = w[125] ^ w[116];
  assign w[127] = w[114] ^ w[117];
  assign w[128] = a[12] & b[12];
  assign w[129] = a[12] & b[13];
  assign w[130] = a[12] & b[14];
  assign w[131] = a[12] & b[15];
  assign w[132] = a[13] & b[12];
  assign w[133] = a[13] & b[13];
  assign w[134] = a[13] & b[14];
  assign w[135] = a[13] & b[15];
  assign w[136] = a[14] & b[12];
  assign w[137] = a[14] & b[13];
  assign w[138] = a[14] & b[14];
  assign w[139] = a[14] & b[15];
  assign w[140] = a[15] & b[12];
  assign w[141] = a[15] & b[13];
  assign w[142] = a[15] & b[14];
  assign w[143] = a[15] & b[15];
  assign w[144] = w[129] ^ w[132];
  assign w[145] = w[130] ^ w[133];
  assign w[146] = w[145] ^ w[136];
  assign w[147] = w[131] ^ w[134];
  assign w[148] = w[137] ^ w[140];
  assign w[149] = w[147] ^ w[148];
  assign w[150] = w[135] ^ w[138];
  assign w[151] = w[150] ^ w[141];
  assign w[152] = w[139] ^ w[142];
  assign w[153] = a[8] ^ a[12];
  assign w[154] = a[9] ^ a[13];
  assign w[155] = a[10] ^ a[14];
  assign w[156] = a[11] ^ a[15];
  assign w[157] = b[8] ^ b[12];
  assign w[158] = b[9] ^ b[13];
  assign w[159] = b[10] ^ b[14];
  assign w[160] = b[11] ^ b[15];
  assign w[161] = w[153] & w[157];
  assign w[162] = w[153] & w[158];
  assign w[163] = w[153] & w[159];
  assign w[164] = w[153] & w[160];
  assign w[165] = w[154] & w[157];
  assign w[166] = w[154] & w[158];
  assign w[167] = w[154] & w[159];
  assign w[168] = w[154] & w[160];
  assign w[169] = w[155] & w[157];
  assign w[170] = w[155] & w[158];
  assign w[171] = w[155] & w[159];
  assign w[172] = w[155] & w[160];
  assign w[173] = w[156] & w[157];
  assign w[174] = w[156] & w[158];
  assign w[175] = w[156] & w[159];
  assign w[176] = w[156] & w[160];
  assign w[177] = w[162] ^ w[165];
  assign w[178] = w[163] ^ w[166];
  assign w[179] = w[178] ^ w[169];
  assign w[180] = w[164] ^ w[167];
  assign w[181] = w[170] ^ w[173];
  assign w[182] = w[180] ^ w[181];
  assign w[183] = w[168] ^ w[171];
  assign w[184] = w[183] ^ w[174];
  assign w[185] = w[172] ^ w[175];
  assign w[186] = w[103] ^ w[126];
  assign w[187] = w[128] ^ w[161];
  assign w[188] = w[186] ^ w[187];
  assign w[189] = w[119] ^ w[127];
  assign w[190] = w[144] ^ w[177];
  assign w[191] = w[189] ^ w[190];
  assign w[192] = w[121] ^ w[118];
  assign w[193] = w[146] ^ w[179];
  assign w[194] = w[192] ^ w[193];
  assign w[195] = w[124] ^ w[149];
  assign w[196] = w[195] ^ w[182];
  assign w[197] = w[126] ^ w[128];
  assign w[198] = w[151] ^ w[184];
  assign w[199] = w[197] ^ w[198];
  assign w[200] = w[127] ^ w[144];
  assign w[201] = w[152] ^ w[185];
  assign w[202] = w[200] ^ w[201];
  assign w[203] = w[118] ^ w[146];
  assign w[204] = w[143] ^ w[176];
  assign w[205] = w[203] ^ w[204];
  assign w[206] = a[0] ^ a[8];
  assign w[207] = a[1] ^ a[9];
  assign w[208] = a[2] ^ a[10];
  assign w[209] = a[3] ^ a[11];
  assign w[210] = a[4] ^ a[12];
  assign w[211] = a[5] ^ a[13];
  assign w[212] = a[6] ^ a[14];
  assign w[213] = a[7] ^ a[15];
  assign w[214] = b[0] ^ b[8];
  assign w[215] = b[1] ^ b[9];
  assign w[216] = b[2] ^ b[10];
  assign w[217] = b[3] ^ b[11];
  assign w[218] = b[4] ^ b[12];
  assign w[219] = b[5] ^ b[13];
  assign w[220] = b[6] ^ b[14];
  assign w[221] = b[7] ^ b[15];
  assign w[222] = w[206] & w[214];
  assign w[223] = w[206] & w[215];
  assign w[224] = w[206] & w[216];
  assign w[225] = w[206] & w[217];
  assign w[226] = w[207] & w[214];
  assign w[227] = w[207] & w[215];
  assign w[228] = w[207] & w[216];
  assign w[229] = w[207] & w[217];
  assign w[230] = w[208] & w[214];
  assign w[231] = w[208] & w[215];
  assign w[232] = w[208] & w[216];
  assign w[233] = w[208] & w[217];
  assign w[234] = w[209] & w[214];
  assign w[235] = w[209] & w[215];
  assign w[236] = w[209] & w[216];
  assign w[237] = w[209] & w[217];
  assign w[238] = w[223] ^ w[226];
  assign w[239] = w[224] ^ w[227];
  assign w[240] = w[239] ^ w[230];
  assign w[241] = w[225] ^ w[228];
  assign w[242] = w[231] ^ w[234];
  assign w[243] = w[241] ^ w[242];
  assign w[244] = w[229] ^ w[232];
  assign w[245] = w[244] ^ w[235];
  assign w[246] = w[233] ^ w[236];
  assign w[247] = w[210] & w[218];
  assign w[248] = w[210] & w[219];
  assign w[249] = w[210] & w[220];
  assign w[250] = w[210] & w[221];
  assign w[251] = w[211] & w[218];
  assign w[252] = w[211] & w[219];
  assign w[253] = w[211] & w[220];
  assign w[254] = w[211] & w[221];
  assign w[255] = w[212] & w[218];
  assign w[256] = w[212] & w[219];
  assign w[257] = w[212] & w[220];
  assign w[258] = w[212] & w[221];
  assign w[259] = w[213] & w[218];
  assign w[260] = w[213] & w[219];
  assign w[261] = w[213] & w[220];
  assign w[262] = w[213] & w[221];
  assign w[263] = w[248] ^ w[251];
  assign w[264] = w[249] ^ w[252];
  assign w[265] = w[264] ^ w[255];
  assign w[266] = w[250] ^ w[253];
  assign w[267] = w[256] ^ w[259];
  assign w[268] = w[266] ^ w[267];
  assign w[269] = w[254] ^ w[257];
  assign w[270] = w[269] ^ w[260];
  assign w[271] = w[258] ^ w[261];
  assign w[272] = w[206] ^ w[210];
  assign w[273] = w[207] ^ w[211];
  assign w[274] = w[208] ^ w[212];
  assign w[275] = w[209] ^ w[213];
  assign w[276] = w[214] ^ w[218];
  assign w[277] = w[215] ^ w[219];
  assign w[278] = w[216] ^ w[220];
  assign w[279] = w[217] ^ w[221];
  assign w[280] = w[272] & w[276];
  assign w[281] = w[272] & w[277];
  assign w[282] = w[272] & w[278];
  assign w[283] = w[272] & w[279];
  assign w[284] = w[273] & w[276];
  assign w[285] = w[273] & w[277];
  assign w[286] = w[273] & w[278];
  assign w[287] = w[273] & w[279];
  assign w[288] = w[274] & w[276];
  assign w[289] = w[274] & w[277];
  assign w[290] = w[274] & w[278];
  assign w[291] = w[274] & w[279];
  assign w[292] = w[275] & w[276];
  assign w[293] = w[275] & w[277];
  assign w[294] = w[275] & w[278];
  assign w[295] = w[275] & w[279];
  assign w[296] = w[281] ^ w[284];
  assign w[297] = w[282] ^ w[285];
  assign w[298] = w[297] ^ w[288];
  assign w[299] = w[283] ^ w[286];
  assign w[300] = w[289] ^ w[292];
  assign w[301] = w[299] ^ w[300];
  assign w[302] = w[287] ^ w[290];
  assign w[303] = w[302] ^ w[293];
  assign w[304] = w[291] ^ w[294];
  assign w[305] = w[222] ^ w[245];
  assign w[306] = w[247] ^ w[280];
  assign w[307] = w[305] ^ w[306];
  assign w[308] = w[238] ^ w[246];
  assign w[309] = w[263] ^ w[296];
  assign w[310] = w[308] ^ w[309];
  assign w[311] = w[240] ^ w[237];
  assign w[312] = w[265] ^ w[298];
  assign w[313] = w[311] ^ w[312];
  assign w[314] = w[243] ^ w[268];
  assign w[315] = w[314] ^ w[301];
  assign w[316] = w[245] ^ w[247];
  assign w[317] = w[270] ^ w[303];
  assign w[318] = w[316] ^ w[317];
  assign w[319] = w[246] ^ w[263];
  assign w[320] = w[271] ^ w[304];
  assign w[321] = w[319] ^ w[320];
  assign w[322] = w[237] ^ w[265];
  assign w[323] = w[262] ^ w[295];
  assign w[324] = w[322] ^ w[323];
  assign w[325] = w[0] ^ w[96];
  assign w[326] = w[103] ^ w[222];
  assign w[327] = w[325] ^ w[326];
  assign w[328] = w[16] ^ w[99];
  assign w[329] = w[119] ^ w[238];
  assign w[330] = w[328] ^ w[329];
  assign w[331] = w[18] ^ w[102];
  assign w[332] = w[121] ^ w[240];
  assign w[333] = w[331] ^ w[332];
  assign w[334] = w[21] ^ w[46];
  assign w[335] = w[124] ^ w[243];
  assign w[336] = w[334] ^ w[335];
  assign w[337] = w[85] ^ w[48];
  assign w[338] = w[188] ^ w[307];
  assign w[339] = w[337] ^ w[338];
  assign w[340] = w[88] ^ w[49];
  assign w[341] = w[191] ^ w[310];
  assign w[342] = w[340] ^ w[341];
  assign w[343] = w[91] ^ w[40];
  assign w[344] = w[194] ^ w[313];
  assign w[345] = w[343] ^ w[344];
  assign w[346] = w[93] ^ w[196];
  assign w[347] = w[346] ^ w[315];
  assign w[348] = w[96] ^ w[103];
  assign w[349] = w[199] ^ w[318];
  assign w[350] = w[348] ^ w[349];
  assign w[351] = w[99] ^ w[119];
  assign w[352] = w[202] ^ w[321];
  assign w[353] = w[351] ^ w[352];
  assign w[354] = w[102] ^ w[121];
  assign w[355] = w[205] ^ w[324];
  assign w[356] = w[354] ^ w[355];
  assign w[357] = w[46] ^ w[124];
  assign w[358] = w[149] ^ w[268];
  assign w[359] = w[357] ^ w[358];
  assign w[360] = w[48] ^ w[188];
  assign w[361] = w[151] ^ w[270];
  assign w[362] = w[360] ^ w[361];
  assign w[363] = w[49] ^ w[191];
  assign w[364] = w[152] ^ w[271];
  assign w[365] = w[363] ^ w[364];
  assign w[366] = w[40] ^ w[194];
  assign w[367] = w[143] ^ w[262];
  assign w[368] = w[366] ^ w[367];
  assign p[0] = w[0];
  assign p[1] = w[16];
  assign p[2] = w[18];
  assign p[3] = w[21];
  assign p[4] = w[85];
  assign p[5] = w[88];
  assign p[6] = w[91];
  assign p[7] = w[93];
  assign p[8] = w[327];
  assign p[9] = w[330];
  assign p[10] = w[333];
  assign p[11] = w[336];
  assign p[12] = w[339];
  assign p[13] = w[342];
  assign p[14] = w[345];
  assign p[15] = w[347];
  assign p[16] = w[350];
  assign p[17] = w[353];
  assign p[18] = w[356];
  assign p[19] = w[359];
  assign p[20] = w[362];
  assign p[21] = w[365];
  assign p[22] = w[368];
  assign p[23] = w[196];
  assign p[24] = w[199];
  assign p[25] = w[202];
  assign p[26] = w[205];
  assign p[27] = w[149];
  assign p[28] = w[151];
  assign p[29] = w[152];
  assign p[30] = w[143];
endmodule