static void ctr_df(DRBG_CTR_CTX *cctx,
                   const unsigned char *in1, size_t in1len,
                   const unsigned char *in2, size_t in2len,
                   const unsigned char *in3, size_t in3len)
{
    static unsigned char c80 = 0x80;
    size_t inlen;
    unsigned char *p = cctx->bltmp;

    ctr_BCC_init(cctx);
    if (in1 == NULL)
        in1len = 0;
    if (in2 == NULL)
        in2len = 0;
    if (in3 == NULL)
        in3len = 0;
    inlen = in1len + in2len + in3len;
    /* Initialise L||N in temporary block */
    *p++ = (inlen >> 24) & 0xff;
    *p++ = (inlen >> 16) & 0xff;
    *p++ = (inlen >> 8) & 0xff;
    *p++ = inlen & 0xff;

    /* NB keylen is at most 32 bytes */
    *p++ = 0;
    *p++ = 0;
    *p++ = 0;
    *p = (unsigned char)((cctx->keylen + 16) & 0xff);
    cctx->bltmp_pos = 8;
    ctr_BCC_update(cctx, in1, in1len);
    ctr_BCC_update(cctx, in2, in2len);
    ctr_BCC_update(cctx, in3, in3len);
    ctr_BCC_update(cctx, &c80, 1);
    ctr_BCC_final(cctx);
    /* Set up key K */
    AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks);
    /* X follows key K */
    AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks);
    AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks);
    if (cctx->keylen != 16)
        AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks);
}