2
$\begingroup$

Assume that we have this 256bit key: 15FC0D48 D7F8199C BE399183 4D96F327 10000000 00000000 00000000

On first 0-7 keys we can't apply formula wi=(wi-8 xor wi-5 xor wi-3 xor wi-1 xor phi xor i)<<<1 since on 0 we have negative non exist value 0-8=-8. So currently {k0,k1,k2,k3}=S3{w0,w1,w2,w3} {k4,k5,k6,k7}=S2{w4,w5,w6,w7}

Counting {k0,k1,k2,k3}:

Our original 256 bit key 15FC0D48 D7F8199C BE399183 4D96F327 10000000 00000000 00000000 where k0=15FC0D48, k1=D7F8199C, k2=BE399183, k3=4D96F327

15FC0D48

converting to binary 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 00/01/01/01/11/11/11/00/00/00/11/01/01/00/10/00

putting through sbox3 00000100010011010001011111001100

getting result, and so on for other values res:44D17CC

D7F8199C

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 11/01/01/11/11/11/10/00/00/01/10/01/10/01/11/00

11000100100110110101011110001111 res:C49B578F

BE399183

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 10/11/11/10/00/11/10/01/10/01/00/01/10/00/00/11

10110110100110100011110000011100 res:B69A3C1C

4D96F327

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 01/00/11/01/10/01/01/10/11/11/00/11/00/10/01/11

01111111001101011000111000100101 res:7F358E25

So now we have: 00000100010011010001011111001100 11000100100110110101011110001111 10110110100110100011110000011100 01111111001101011000111000100101

it's not yet a round key, as it's compulsory to make this operation ki={k4i,k4i+1,k4i+2,k4i+3}

ki=IP(Ki) putting through Initial permutation matrix

so, k0={k0,k1,k2,k3}

after appliance of IP, results are: 01100101001100110001111100110001 65331F31 01101000000101111110100101101101 6817E96D 00010100001011100011111111011100 142E3FDC 11001000000100101110111101000101 C812EF45 K0=65331F31 6817E96D 142E3FDC C812EF45

But the answer is 4BBC42E4 F336C5B7 9FA81351 88C5A2B83

Am I done something wrong? Could anyone say where I can find some test vectors particullary for testing Key Schedule for Serpent? Thanks!

Improve this question
$\endgroup$
2
  • $\begingroup$ Have you checked the AES submission of Serpent? $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 9, 2014 at 23:45
  • $\begingroup$ The Serpent Proposal, top of page 7 defines $w_{−8}\dots w_{−1}$. That allows applying $w_i=(w_{i-8}\oplus w_{i-5}\oplus w_{i-3}\oplus w_{i-1}\oplus\phi\oplus i)\lll 11$ including for $i=0\dots 7$. $\;$ Please fix the question accordingly, and tell us if any issue remains. $\;$ Also: use $\TeX$, that's easy! Your formula is written $w_i=(w_{i-8}\oplus w_{i-5}\oplus w_{i-3}\oplus w_{i-1}\oplus\phi\oplus i)\lll 11$. $\endgroup$
    – fgrieu ♦
    Commented Oct 20, 2014 at 21:54

1 Answer 1

Reset to default
1
$\begingroup$

My implementation of Serpent is bit-sliced, so there is no initial permutation involved in generation of my round subkeys. It is also NESSIE byte ordered, which means that vectors will not match the AES submission package. I assume that IP will reorder the bits appropriately if you are using a non bit-sliced version. I just rewrote most of my implementation this weekend, so I am quite familiar with it. It has been confirmed to match NESSIE monte carlo test vectors.

You are also missing several very important sections of the key schedule algo. It actually works like this:
The key is copied into the first words 0-7 without modification.
The next word after the key gets a value of 1 (128 or 192-bit keys only).
Words 8-15 are filled the following algorithm:
$w_i=(w_{i-8}\oplus w_{i-5}\oplus w_{i-3}\oplus w_{i-1}\oplus\phi\oplus (i-8))\lll 11$

Words 8-15 are then copied back to 0-7.
Words 8-131 are filled the following algorithm:
$w_i=(w_{i-8}\oplus w_{i-5}\oplus w_{i-3}\oplus w_{i-1}\oplus\phi\oplus i)\lll 11$

The words are then run through the s-boxes sequentially in reverse starting at S3 to generate the subkeys; in the bit-sliced implementation they are run in groups of 4.

Also, the key in your post is only 224 bits, I assume it is missing a group of 0s and used that missing group below.
Here is what I get for round subkeys when taking your input key as a stream of bytes.
The endianness of these values may not match your print format, the bits were literally just copied directly to a byte array for printing. Display of the 32-bit values as per most methods will result in each octet being on the opposite side of the word.

All 32-bit values displayed in Big-Endian notation (bitstream)

Using 256-bit key (bitstream)
15fc0d48d7f8199cbe3991834d96f32710000000000000000000000000000000

Working register values w()
00 = 8e0f9f48 558a778c 8e84528e f8bb274b
01 = cb02403a 15bb83d7 773c9827 6d601cee
02 = 20fdb580 79cc8369 03e251cf ebf50867
03 = 270a1401 3a28bd26 8c44a3ca a69bab6d
04 = 94f117e6 d07657a0 d125f73a 7b47e4e0
05 = 913dccde d515c235 0fe9ca28 fb399a68
06 = 2c061be7 7b11eeee bb3809b3 10084a5f
07 = ce24252b a646b113 a7287b46 4779a4d3
08 = 3327429a 3ecc1d2a 39fe97b5 463d019c
09 = 8566ab56 a7af05c4 523d7fa8 36b82985
10 = caaea3c3 4a9c05ea 048c6348 0c41da4a
11 = 6b07d353 11b49c0f c8946c59 ce3af016
12 = 7180c410 7283b04f 0414c147 d4dec121
13 = ab75cc28 731f6211 c2957c45 156db9b5
14 = 5f10aa4a b42756e8 abacc2d9 4f037314
15 = fb072e3a 30c1ef9e cc754c08 017e5076
16 = 42c1ae8e 55ce696f 01a6211d 8cd0413b
17 = 33f4f608 dde45d09 58beb177 50ac5c0f
18 = 6e9105c9 380265e3 333baa94 7bdceb45
19 = f8a9fe9f a962f4dc 9f2cdae3 cf935f2b
20 = 2bd72c96 bae44cd1 6321b8d2 e433fa93
21 = 4123a404 1760729e 09cd114f 63512829
22 = 65d162dd cdbe1365 f6ccb936 48e5d43c
23 = 531782e2 489899e0 431bb9c3 041d43ef
24 = 82c345de 223844d0 b81b4280 fa59ffea
25 = 4a959268 412267dd d22d0891 45d03f66
26 = 8e688da8 fb208f24 0da48415 c6ca0b4e
27 = d03fb7f6 47304675 87f873ec ba4f5646
28 = 5de2230d 6acde1fb 1a8a7a13 10611eb1
29 = 21eb2e4d c06d5736 77900762 21c73996
30 = 136c8322 437b1fe5 41de13e1 75bcd7f1
31 = 8f9a9744 7bc9e639 88ee3ff7 d50aa5a8
32 = e18e5703 5eeec4bf 8d52541c 3e5cbde7

Subkeys k() after application of s-boxes (bit-sliced)
00 = afb59841 dd00fa8e a8bacf8d 23348a0b
01 = 4ce7073c d19dc3e3 86e147c4 525aa4f1
02 = 853bc859 5f198377 4ee8a43e 6c376530
03 = d822f75b f2fd42d8 98b30a6f 11f7a181
04 = efadfb05 ba6117b8 7e86447c 85e2b39e
05 = da3e695c b43a7faa be163115 bad05261
06 = 17de1812 50c1e509 bcee50b9 2bd843fc
07 = 7f8c346a a83511a9 ce60ef3e 2f2a7a6f
08 = 712b4b90 3cf45cb4 4aecd5b9 4116ca07
09 = c30e78e9 60e5fd3a 26cc8297 a9872e41
10 = 73419a9c 779cc5bc f72242d5 b9ae8317
11 = 93d62ca9 944cb0e3 96aa2c4c 361f0301
12 = 8f7d7fb9 d2c9f06e 834bb439 57973518
13 = 3378d836 4f10698b e5021786 07f2f3e5
14 = f0746a92 5b43f420 0bdb585b b46790d8
15 = 33726221 324d7e5a 07474c2c 06b48192
16 = 9a19a7c5 178fe6fc 8bf7878b dab98ed8
17 = c5420071 bea61b70 e610ee09 0951a980
18 = d2f63410 d188fea6 a71ade0c ceb051d9
19 = 67e1a0f4 167c85a8 dedb5160 c9f5d180
20 = 5629b32e 36012ad2 b4324a95 d300d005
21 = c2212005 a053bc2e b4307ab3 7cdc6bfd
22 = c19dd3ed 29777279 1e6498b2 ad38a341
23 = b07c1fd1 5409d92e 501da3c2 189138e3
24 = e0fbb92e 98a14284 e299fce4 58a2fab4
25 = 94da502a d92ae595 0f47e746 2765259f
26 = 055f707f 78f9f62c 459172a0 ce7dff99
27 = 57774833 28f02da9 3d4723c7 3ab7c26f
28 = bd94be54 3acce643 252584f5 2dc7b8e4
29 = 29efbe14 69c187af c869c0e4 96536f86
30 = db9ab3eb da15bccd c8d434cb 8ae22408
31 = 065824b1 8bd2a331 dcbe2f2a a17fcd93
32 = ad627b44 1232d6b8 0c4c3e5f c1b02e40
Improve this answer
$\endgroup$
11
  • $\begingroup$ Thank you for reply! So considering your remark, lets recount it: 15FC0D48(word0) D7F8199C(word1) BE399183(word2) 4D96F327(word3) 10000000(word4) 00000000(word5) 00000000(word6) 00000000(word7). Afterwards wi=(wi−8⊕wi−5⊕wi−3⊕wi−1⊕ϕ⊕(i−8))⋘11 word8 8-15 i=8 15FC0D48 xor 4D96F327 xor 9E3779B9 <<<11=EC3EB632 next w0=w8 As you have told this formula is applied for 8-131 wi=(wi−8⊕wi−5⊕wi−3⊕wi−1⊕ϕ⊕i)⋘11 but EC3EB632 is not equals to afb59841 which is k0{w0} $\endgroup$
    – nmZ
    Commented Oct 21, 2014 at 16:28
  • 1
    $\begingroup$ My values are AFTER the application of the sboxes (final subkeys); before the sbox the value w(0) is EC3EB632, which will be 32b63eec in my print format (big endian). Then ffb0b08e 753dc6f2 6ad60ec8 for w(1-3) $\endgroup$
    – Richie Frame
    Commented Oct 21, 2014 at 19:14
  • 1
    $\begingroup$ Remember bit-sliced, so you will need the permutation to reorder the bits once the entire 128-bit subkey group has been sent through the s-box to match my values. I think if you run my subkeys through the final permutation you will get what you expect for a manual calculation. Also my key input is also big endian, treat 15FC0D48.. as a byte stream. I will update the answer with w() values $\endgroup$
    – Richie Frame
    Commented Oct 22, 2014 at 4:43
  • 1
    $\begingroup$ No, that is not how an sbox works. it takes a 4-bit input and gives a 4-bit output, S3(5) = 9 $\endgroup$
    – Richie Frame
    Commented Oct 22, 2014 at 8:57
  • 1
    $\begingroup$ Let us continue this discussion in chat. $\endgroup$
    – Richie Frame
    Commented Oct 22, 2014 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.