byteorder.BePutUint32(digest[8:], d.h[2])
	byteorder.BePutUint32(digest[12:], d.h[3])
	byteorder.BePutUint32(digest[16:], d.h[4])

	return digest
}

// ConstantTimeSum computes the same result of [Sum] but in constant time
func (d *digest) ConstantTimeSum(in []byte) []byte {
	d0 := *d
	hash := d0.constSum()
	return append(in, hash[:]...)
}

func (d *digest) constSum() [Size]byte {
	var length [8]byte

	copy(ret.nonceMask[:], nonceMask)
	return ret
}

type constantTimeHash interface {
	hash.Hash
	ConstantTimeSum(b []byte) []byte
}

// cthWrapper wraps any hash.Hash that implements ConstantTimeSum, and replaces
// with that all calls to Sum. It's used to obtain a ConstantTimeSum-based HMAC.
type cthWrapper struct {
	h constantTimeHash
}

				sum = c.Sum(nil)
			case 3:
				if boring.Enabled {
					continue
				}
				io.WriteString(c, g.in[0:len(g.in)/2])
				c.(*digest).ConstantTimeSum(nil)
				io.WriteString(c, g.in[len(g.in)/2:])
				sum = c.(*digest).ConstantTimeSum(nil)
			}
			s := fmt.Sprintf("%x", sum)
			if s != g.out {
				t.Fatalf("sha1[%d](%s) = %s want %s", j, g.in, s, g.out)
			}
			c.Reset()
		}
	}
}