P_{i} = mbox h e a d (E_{K} (S_{i - 1}), x) \oplus C_{i}