Yes, you're right, I am calling the AES round once per `next()` call. But note that this his could be rewritten as if(counter_ >= 4) { counter_ = 0;

Yes, you're right, I am calling the AES round once per `next()` call. But note that this his could be rewritten as if(counter_ >= 4) { counter_ = 0; u_.words_[0] = _mm_aesenc_si128(u_.words_[0], key_); } return u_.state_[counter_++]; Which only uses one AES call every 4 words (and only one block of storage). Instead, I chose to avoid the `if` and compute blocks ahead of time, which makes for more predictable performance.