<svg viewBox="0 0 700 200" xmlns="http://www.w3.org/2000/svg">
  <defs>
    <marker id="arrow" markerWidth="6" markerHeight="4" refX="6" refY="2" orient="auto">
      <polygon points="0 0, 6 2, 0 4" fill="#d97706"/>
    </marker>
    <marker id="arrow-b" markerWidth="6" markerHeight="4" refX="6" refY="2" orient="auto">
      <polygon points="0 0, 6 2, 0 4" fill="#6366f1"/>
    </marker>
  </defs>

  <!-- Title -->
  <text x="350" y="18" text-anchor="middle" font-family="'Space Mono', monospace" font-size="12" fill="#6366f1">Header Protection (short header)</text>

  <!-- Header byte -->
  <rect x="10" y="30" width="60" height="45" rx="3" fill="none" stroke="#6366f1" stroke-width="1.5"/>
  <text x="40" y="48" text-anchor="middle" font-family="'Space Mono', monospace" font-size="9" fill="#6366f1">01smmmmm</text>
  <text x="40" y="62" text-anchor="middle" font-family="'Space Mono', monospace" font-size="7" fill="#888">1 byte</text>

  <!-- Dest CID -->
  <rect x="70" y="30" width="110" height="45" rx="3" fill="none" stroke="#818cf8" stroke-width="1"/>
  <text x="125" y="50" text-anchor="middle" font-family="'Space Mono', monospace" font-size="9" fill="#818cf8">Dest CID</text>
  <text x="125" y="62" text-anchor="middle" font-family="'Space Mono', monospace" font-size="7" fill="#888">e.g. 8 bytes</text>

  <!-- PN (masked, 3 bytes in this example) -->
  <rect x="180" y="30" width="42" height="45" rx="3" fill="#6366f108" stroke="#6366f1" stroke-width="1.5"/>
  <text x="201" y="48" text-anchor="middle" font-family="'Space Mono', monospace" font-size="9" fill="#6366f1">PN</text>
  <text x="201" y="60" text-anchor="middle" font-family="'Space Mono', monospace" font-size="7" fill="#888">1-4 b</text>
  <text x="201" y="70" text-anchor="middle" font-family="'Space Mono', monospace" font-size="6" fill="#6366f1">masked</text>

  <!-- Encrypted payload -->
  <rect x="222" y="30" width="468" height="45" rx="3" fill="none" stroke="#888" stroke-width="1" stroke-dasharray="4 3"/>
  <text x="500" y="50" text-anchor="middle" font-family="'Space Mono', monospace" font-size="9" fill="#888">Encrypted Payload + AEAD Tag</text>

  <!-- Sample highlight within encrypted payload (starts at pn_offset + 4, not at PN end) -->
  <rect x="236" y="32" width="140" height="41" rx="2" fill="#d9770610" stroke="#d97706" stroke-width="1.5"/>
  <text x="306" y="62" text-anchor="middle" font-family="'Space Mono', monospace" font-size="7" fill="#d97706">sample (16 bytes)</text>

  <!-- Offset markers -->
  <line x1="180" y1="78" x2="180" y2="90" stroke="#888" stroke-width="0.5"/>
  <text x="180" y="99" text-anchor="middle" font-family="'Space Mono', monospace" font-size="7" fill="#888">pn_offset</text>

  <line x1="236" y1="78" x2="236" y2="90" stroke="#888" stroke-width="0.5"/>
  <text x="249" y="99" text-anchor="middle" font-family="'Space Mono', monospace" font-size="7" fill="#888">pn_offset + 4</text>

  <!-- Arrow from sample down to AES box -->
  <line x1="306" y1="76" x2="306" y2="110" stroke="#d97706" stroke-width="1" marker-end="url(#arrow)"/>

  <!-- AES box -->
  <rect x="211" y="114" width="190" height="22" rx="3" fill="none" stroke="#d97706" stroke-width="1"/>
  <text x="306" y="128" text-anchor="middle" font-family="'Space Mono', monospace" font-size="9" fill="#d97706">AES-ECB(hp_key, sample)</text>

  <!-- Result arrow down -->
  <line x1="306" y1="136" x2="306" y2="148" stroke="#d97706" stroke-width="1" marker-end="url(#arrow)"/>

  <!-- Mask -->
  <text x="306" y="160" text-anchor="middle" font-family="'Space Mono', monospace" font-size="9" fill="#d97706">mask</text>

  <!-- XOR back to PN (inner, above) then header (outer, below) — no crossing -->
  <path d="M 288 157 L 201 157 L 201 78" fill="none" stroke="#6366f1" stroke-width="1" marker-end="url(#arrow-b)"/>
  <path d="M 282 162 L 40 162 L 40 78" fill="none" stroke="#6366f1" stroke-width="1" marker-end="url(#arrow-b)"/>

  <!-- XOR labels -->
  <text x="100" y="185" text-anchor="middle" font-family="'Space Mono', monospace" font-size="8" fill="#6366f1">mask[0] &#x2295; header &#x2192; unmask mmmmm</text>
  <text x="420" y="185" text-anchor="middle" font-family="'Space Mono', monospace" font-size="8" fill="#6366f1">mask[1..1+len] &#x2295; PN bytes &#x2192; packet number</text>
</svg>
