* hbytes chopto VAR NEWVARLENGTH => suffix (removed from VAR)
* (too short? error)
*
+ * hbytes compare A B
+ * => -2 A is lexically earlier than B and not a prefix of B (A<B)
+ * -1 A is prefix of B but not equal (A<B)
+ * 0 A == B
+ * +1 A is B plus a nonempty suffix (ie, A has B as a prefix)
+ * +2 A is lexically later than B and does not have B as a prefix
+ *
* hbytes pkcs5 pa|ua VAR ALG => worked? (always 1 for p)
* hbytes pkcs5 pn|un VAR BLOCKSIZE => worked? (always 1 for p)
* hbytes blockcipher d|e VAR ALG KEY MODE [IV] => IV