The reference shares a first substitution stage between two output bytes, each with another substitution stage and affine maps. The substitution stages derive from the BearSSL AES Boolean implementation. The target is a generated fixed function, not the AES table; no cryptographic security claim is made.

BearSSL source: https://www.bearssl.org/gitweb/?p=BearSSL;a=blob_plain;f=src/symcipher/aes_ct.c;hb=HEAD
Downloaded2026-10-15. Copyright Thomas Pornin, MIT license; notice included.

The reference uses 96 AND gates and490 total gates. This is a feasible implementation, not a claim of globally minimal gate count.
