P i = \ m b o x h e a d ( E K ( S i - 1 ) , x ) ⊕ C i P_i = \mbox{head}(E_K (S_{i-1}), x) \oplus C_i