diff --git a/argon2/blamka_amd64.go b/argon2/blamka_amd64.go
index 2fc1ec0..1108e11 100644
--- a/argon2/blamka_amd64.go
+++ b/argon2/blamka_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!gccgo,!appengine
+// +build amd64,gc,!purego
 
 package argon2
 
diff --git a/argon2/blamka_amd64.s b/argon2/blamka_amd64.s
index 74a6e73..c4c84f0 100644
--- a/argon2/blamka_amd64.s
+++ b/argon2/blamka_amd64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!gccgo,!appengine
+// +build amd64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/argon2/blamka_ref.go b/argon2/blamka_ref.go
index baf7b55..4a963c7 100644
--- a/argon2/blamka_ref.go
+++ b/argon2/blamka_ref.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64 appengine gccgo
+// +build !amd64 purego !gc
 
 package argon2
 
diff --git a/blake2b/blake2bAVX2_amd64.go b/blake2b/blake2bAVX2_amd64.go
index 4d31dd0..8a893fd 100644
--- a/blake2b/blake2bAVX2_amd64.go
+++ b/blake2b/blake2bAVX2_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build go1.7,amd64,!gccgo,!appengine
+// +build go1.7,amd64,gc,!purego
 
 package blake2b
 
diff --git a/blake2b/blake2bAVX2_amd64.s b/blake2b/blake2bAVX2_amd64.s
index 5593b1b..8608a7f 100644
--- a/blake2b/blake2bAVX2_amd64.s
+++ b/blake2b/blake2bAVX2_amd64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build go1.7,amd64,!gccgo,!appengine
+// +build go1.7,amd64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/blake2b/blake2b_amd64.go b/blake2b/blake2b_amd64.go
index 30e2fcd..a52c887 100644
--- a/blake2b/blake2b_amd64.go
+++ b/blake2b/blake2b_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !go1.7,amd64,!gccgo,!appengine
+// +build !go1.7,amd64,gc,!purego
 
 package blake2b
 
diff --git a/blake2b/blake2b_amd64.s b/blake2b/blake2b_amd64.s
index 578e947..1f4c6a9 100644
--- a/blake2b/blake2b_amd64.s
+++ b/blake2b/blake2b_amd64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!gccgo,!appengine
+// +build amd64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/blake2b/blake2b_ref.go b/blake2b/blake2b_ref.go
index da156a1..8597457 100644
--- a/blake2b/blake2b_ref.go
+++ b/blake2b/blake2b_ref.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64 appengine gccgo
+// +build !amd64 purego !gc
 
 package blake2b
 
diff --git a/blake2s/blake2s_386.go b/blake2s/blake2s_386.go
index d8f9cea..2d8ee63 100644
--- a/blake2s/blake2s_386.go
+++ b/blake2s/blake2s_386.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build 386,!gccgo,!appengine
+// +build 386,gc,!purego
 
 package blake2s
 
diff --git a/blake2s/blake2s_386.s b/blake2s/blake2s_386.s
index c123e5d..023532b 100644
--- a/blake2s/blake2s_386.s
+++ b/blake2s/blake2s_386.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build 386,!gccgo,!appengine
+// +build 386,gc,!purego
 
 #include "textflag.h"
 
diff --git a/blake2s/blake2s_amd64.go b/blake2s/blake2s_amd64.go
index 4e8d2d7..267bdce 100644
--- a/blake2s/blake2s_amd64.go
+++ b/blake2s/blake2s_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!gccgo,!appengine
+// +build amd64,gc,!purego
 
 package blake2s
 
diff --git a/blake2s/blake2s_amd64.s b/blake2s/blake2s_amd64.s
index 8da2802..b905944 100644
--- a/blake2s/blake2s_amd64.s
+++ b/blake2s/blake2s_amd64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!gccgo,!appengine
+// +build amd64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/blake2s/blake2s_ref.go b/blake2s/blake2s_ref.go
index a311273..94ef01d 100644
--- a/blake2s/blake2s_ref.go
+++ b/blake2s/blake2s_ref.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64,!386 gccgo appengine
+// +build !amd64,!386 !gc purego
 
 package blake2s
 
diff --git a/chacha20/chacha_arm64.go b/chacha20/chacha_arm64.go
index b799e44..c474e5a 100644
--- a/chacha20/chacha_arm64.go
+++ b/chacha20/chacha_arm64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build go1.11,!gccgo,!purego
+// +build go1.11,gc,!purego
 
 package chacha20
 
diff --git a/chacha20/chacha_arm64.s b/chacha20/chacha_arm64.s
index 8914815..8fb49a1 100644
--- a/chacha20/chacha_arm64.s
+++ b/chacha20/chacha_arm64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build go1.11,!gccgo,!purego
+// +build go1.11,gc,!purego
 
 #include "textflag.h"
 
diff --git a/chacha20/chacha_noasm.go b/chacha20/chacha_noasm.go
index 4635307..3e8a609 100644
--- a/chacha20/chacha_noasm.go
+++ b/chacha20/chacha_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !arm64,!s390x,!ppc64le arm64,!go1.11 gccgo purego
+// +build !arm64,!s390x,!ppc64le arm64,!go1.11 !gc purego
 
 package chacha20
 
diff --git a/chacha20/chacha_ppc64le.go b/chacha20/chacha_ppc64le.go
index b799330..2806c63 100644
--- a/chacha20/chacha_ppc64le.go
+++ b/chacha20/chacha_ppc64le.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 package chacha20
 
diff --git a/chacha20/chacha_ppc64le.s b/chacha20/chacha_ppc64le.s
index 23c6021..3dad4b2 100644
--- a/chacha20/chacha_ppc64le.s
+++ b/chacha20/chacha_ppc64le.s
@@ -19,7 +19,7 @@
 // The differences in this and the original implementation are
 // due to the calling conventions and initialization of constants.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/chacha20/chacha_s390x.go b/chacha20/chacha_s390x.go
index a9244bd..a0774dd 100644
--- a/chacha20/chacha_s390x.go
+++ b/chacha20/chacha_s390x.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 package chacha20
 
diff --git a/chacha20/chacha_s390x.s b/chacha20/chacha_s390x.s
index 89c658c..8181611 100644
--- a/chacha20/chacha_s390x.s
+++ b/chacha20/chacha_s390x.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 #include "go_asm.h"
 #include "textflag.h"
diff --git a/chacha20poly1305/chacha20poly1305_amd64.go b/chacha20poly1305/chacha20poly1305_amd64.go
index cda7781..c41d061 100644
--- a/chacha20poly1305/chacha20poly1305_amd64.go
+++ b/chacha20poly1305/chacha20poly1305_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 package chacha20poly1305
 
diff --git a/chacha20poly1305/chacha20poly1305_amd64.s b/chacha20poly1305/chacha20poly1305_amd64.s
index 3469c87..55226b0 100644
--- a/chacha20poly1305/chacha20poly1305_amd64.s
+++ b/chacha20poly1305/chacha20poly1305_amd64.s
@@ -4,7 +4,7 @@
 
 // This file was originally from https://golang.org/cl/24717 by Vlad Krasnov of CloudFlare.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 #include "textflag.h"
 // General register allocation
diff --git a/chacha20poly1305/chacha20poly1305_noasm.go b/chacha20poly1305/chacha20poly1305_noasm.go
index 9ce4aa9..13941c4 100644
--- a/chacha20poly1305/chacha20poly1305_noasm.go
+++ b/chacha20poly1305/chacha20poly1305_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64 gccgo purego
+// +build !amd64 !gc purego
 
 package chacha20poly1305
 
diff --git a/curve25519/curve25519_amd64.go b/curve25519/curve25519_amd64.go
index 5120b77..877b6de 100644
--- a/curve25519/curve25519_amd64.go
+++ b/curve25519/curve25519_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!gccgo,!appengine,!purego
+// +build amd64,gc,!purego
 
 package curve25519
 
diff --git a/curve25519/curve25519_amd64.s b/curve25519/curve25519_amd64.s
index 0250c88..6c53380 100644
--- a/curve25519/curve25519_amd64.s
+++ b/curve25519/curve25519_amd64.s
@@ -5,7 +5,7 @@
 // This code was translated into a form compatible with 6a from the public
 // domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html
 
-// +build amd64,!gccgo,!appengine,!purego
+// +build amd64,gc,!purego
 
 #define REDMASK51     0x0007FFFFFFFFFFFF
 
diff --git a/curve25519/curve25519_noasm.go b/curve25519/curve25519_noasm.go
index 047d49a..80d3300 100644
--- a/curve25519/curve25519_noasm.go
+++ b/curve25519/curve25519_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64 gccgo appengine purego
+// +build !amd64 !gc purego
 
 package curve25519
 
diff --git a/internal/subtle/aliasing.go b/internal/subtle/aliasing.go
index f38797b..281c27e 100644
--- a/internal/subtle/aliasing.go
+++ b/internal/subtle/aliasing.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !appengine
+// +build !purego
 
 // Package subtle implements functions that are often useful in cryptographic
 // code but require careful thought to use correctly.
diff --git a/internal/subtle/aliasing_appengine.go b/internal/subtle/aliasing_purego.go
similarity index 98%
rename from internal/subtle/aliasing_appengine.go
rename to internal/subtle/aliasing_purego.go
index 0cc4a8a..e20a296 100644
--- a/internal/subtle/aliasing_appengine.go
+++ b/internal/subtle/aliasing_purego.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build appengine
+// +build purego
 
 // Package subtle implements functions that are often useful in cryptographic
 // code but require careful thought to use correctly.
diff --git a/poly1305/mac_noasm.go b/poly1305/mac_noasm.go
index d118f30..af6c94f 100644
--- a/poly1305/mac_noasm.go
+++ b/poly1305/mac_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64,!ppc64le,!s390x gccgo purego
+// +build !amd64,!ppc64le,!s390x !gc purego
 
 package poly1305
 
diff --git a/poly1305/sum_amd64.go b/poly1305/sum_amd64.go
index 99e5a1d..cf3a69e 100644
--- a/poly1305/sum_amd64.go
+++ b/poly1305/sum_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 package poly1305
 
diff --git a/poly1305/sum_amd64.s b/poly1305/sum_amd64.s
index 8d394a2..2cb0373 100644
--- a/poly1305/sum_amd64.s
+++ b/poly1305/sum_amd64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/poly1305/sum_ppc64le.go b/poly1305/sum_ppc64le.go
index 2e7a120..cb4b718 100644
--- a/poly1305/sum_ppc64le.go
+++ b/poly1305/sum_ppc64le.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 package poly1305
 
diff --git a/poly1305/sum_ppc64le.s b/poly1305/sum_ppc64le.s
index 4e02813..5cd7494 100644
--- a/poly1305/sum_ppc64le.s
+++ b/poly1305/sum_ppc64le.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/poly1305/sum_s390x.go b/poly1305/sum_s390x.go
index 958fedc..188a665 100644
--- a/poly1305/sum_s390x.go
+++ b/poly1305/sum_s390x.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 package poly1305
 
diff --git a/poly1305/sum_s390x.s b/poly1305/sum_s390x.s
index 0fa9ee6..bdd882c 100644
--- a/poly1305/sum_s390x.s
+++ b/poly1305/sum_s390x.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!purego
+// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/salsa20/salsa/salsa20_amd64.go b/salsa20/salsa/salsa20_amd64.go
index 656e8df..5cf1d6d 100644
--- a/salsa20/salsa/salsa20_amd64.go
+++ b/salsa20/salsa/salsa20_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!appengine,!gccgo
+// +build amd64,!purego,gc
 
 package salsa
 
diff --git a/salsa20/salsa/salsa20_amd64.s b/salsa20/salsa/salsa20_amd64.s
index 18085d2..9c84012 100644
--- a/salsa20/salsa/salsa20_amd64.s
+++ b/salsa20/salsa/salsa20_amd64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!appengine,!gccgo
+// +build amd64,!purego,gc
 
 // This code was translated into a form compatible with 6a from the public
 // domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html
diff --git a/salsa20/salsa/salsa20_amd64_test.go b/salsa20/salsa/salsa20_amd64_test.go
index d4e779c..a9cb697 100644
--- a/salsa20/salsa/salsa20_amd64_test.go
+++ b/salsa20/salsa/salsa20_amd64_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!appengine,!gccgo
+// +build amd64,!purego,gc
 
 package salsa
 
diff --git a/salsa20/salsa/salsa20_noasm.go b/salsa20/salsa/salsa20_noasm.go
index 8a46bd2..24f03c1 100644
--- a/salsa20/salsa/salsa20_noasm.go
+++ b/salsa20/salsa/salsa20_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64 appengine gccgo
+// +build !amd64 purego !gc
 
 package salsa
 
diff --git a/sha3/hashes_generic.go b/sha3/hashes_generic.go
index f455147..fac0c0e 100644
--- a/sha3/hashes_generic.go
+++ b/sha3/hashes_generic.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build gccgo appengine !s390x
+// +build !gc purego !s390x
 
 package sha3
 
diff --git a/sha3/keccakf.go b/sha3/keccakf.go
index 46d03ed..92b63a3 100644
--- a/sha3/keccakf.go
+++ b/sha3/keccakf.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//  +build !amd64 appengine gccgo
+//  +build !amd64 purego !gc
 
 package sha3
 
diff --git a/sha3/keccakf_amd64.go b/sha3/keccakf_amd64.go
index 7886795..3e3e760 100644
--- a/sha3/keccakf_amd64.go
+++ b/sha3/keccakf_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!appengine,!gccgo
+// +build amd64,!purego,gc
 
 package sha3
 
diff --git a/sha3/keccakf_amd64.s b/sha3/keccakf_amd64.s
index f88533a..8f4d187 100644
--- a/sha3/keccakf_amd64.s
+++ b/sha3/keccakf_amd64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build amd64,!appengine,!gccgo
+// +build amd64,!purego,gc
 
 // This code was translated into a form compatible with 6a from the public
 // domain sources at https://github.com/gvanas/KeccakCodePackage
diff --git a/sha3/sha3_s390x.go b/sha3/sha3_s390x.go
index 259ff4d..485e2d5 100644
--- a/sha3/sha3_s390x.go
+++ b/sha3/sha3_s390x.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!appengine
+// +build gc,!purego
 
 package sha3
 
diff --git a/sha3/sha3_s390x.s b/sha3/sha3_s390x.s
index 8a4458f..e2df641 100644
--- a/sha3/sha3_s390x.s
+++ b/sha3/sha3_s390x.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !gccgo,!appengine
+// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/sha3/shake_generic.go b/sha3/shake_generic.go
index add4e73..68148f2 100644
--- a/sha3/shake_generic.go
+++ b/sha3/shake_generic.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build gccgo appengine !s390x
+// +build !gc purego !s390x
 
 package sha3
 
diff --git a/sha3/xor.go b/sha3/xor.go
index 079b650..ddafa82 100644
--- a/sha3/xor.go
+++ b/sha3/xor.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !amd64,!386,!ppc64le appengine
+// +build !amd64,!386,!ppc64le purego
 
 package sha3
 
diff --git a/sha3/xor_unaligned.go b/sha3/xor_unaligned.go
index 5f19cdf..6249ad8 100644
--- a/sha3/xor_unaligned.go
+++ b/sha3/xor_unaligned.go
@@ -3,7 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // +build amd64 386 ppc64le
-// +build !appengine
+// +build !purego
 
 package sha3