MixColumns

MixColumns multiplies each column by a fixed matrix in GF(2^8):

| 02 03 01 01 |   | s0c |
| 01 02 03 01 | * | s1c |   (over GF(2^8))
| 01 01 02 03 |   | s2c |
| 03 01 01 02 |   | s3c |

For each column c, the new bytes are:

new[0] = 2*s0c ^ 3*s1c ^ s2c ^ s3c
new[1] = s0c ^ 2*s1c ^ 3*s2c ^ s3c
new[2] = s0c ^ s1c ^ 2*s2c ^ 3*s3c
new[3] = 3*s0c ^ s1c ^ s2c ^ 2*s3c

(All multiplications in GF(2^8); * is gf_mul; + is XOR.)

Pre-compute xtime (multiply by 2): 2*x = (x << 1) ^ (0x1B if high_bit else 0). Then 3*x = 2*x ^ x.

InvMixColumns uses a different matrix:

| 0E 0B 0D 09 |
| 09 0E 0B 0D |
| 0D 09 0E 0B |
| 0B 0D 09 0E |

These constants ARE the inverse — applying both gives the identity in GF(2^8).

The last round of AES SKIPS MixColumns (a quirk of the spec; makes encrypt + decrypt symmetric in implementation).