that the key schedule can be run backwards from
the end point, using only 128 bits of key material state. However, this obstacle is easily overcome
by performing the one-time precomputation of the
key schedule when the SA is initially established,
and placing the “decrypt” key starting point value
in the session context. Depending on whether encryption or decryption is needed, only the forward
or backward subkey (16 bytes for a 128-bit key)
starting point would be loaded from memory.