0
$\begingroup$

I was looking at the test vectors of keccak provided by NIST here https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values and specifically for these example inputs of SHAKE-128 https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/SHAKE128_Msg5.pdf and https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/SHAKE128_Msg30.pdf

In the first page I noticed that the first values of the Data to be absorbed is not the same as the input binary string and the padding system in inconsistent with the pad10*1 method.

SHAKE-128 sample of 5-bit message

Msg as bit string
 1 1 0 0 1
about to call last of the absorb phase

About to Absorb data

State (in bytes)

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
Data to be absorbed

F3 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 

Can someone please explain how this works.

$\endgroup$

2 Answers 2

0
$\begingroup$

In the first page I noticed that the first values of the Data to be absorbed is not the same as the input binary string and the padding system in inconsistent with the pad10*1 method.

Actually, with SHAKE, you first append a 1 1 1 1 bit string, then you add the pad10*1 padding (see section 6.2 of FIPS 202).

Once you absorb the message, then the 1 1 1 1 bit string, and then the pad10*1 string, you get the state shown.

$\endgroup$
3
  • $\begingroup$ Thanks for the reply, I just noticed that but the behavior is like this for the input string 11001 the padded message would 1100 1111 1100 000 which is CFC0 but only when fliped to 1111 0011 0000 0011 that it becomes F3 03 like in the document. is this flipping done automatically in software? I am doing implementation in VHDL so I work directly with binary strings $\endgroup$
    – pro orp
    Apr 17 at 12:43
  • $\begingroup$ @proorp The test vector is showing the bits in each byte in the state in 'little-endian' order; that is, the lsbit comes first when considered as a bitstring; this looks a bit confusing when we print the byte values in big-endian order (the msnybble is printed first when we display the byte value in hex) and so it looks like there's bit-flipping going on - that's just an artifact of how we display the bytes. $\endgroup$
    – poncho
    Apr 17 at 12:50
  • $\begingroup$ Thanks a lot for your help, my implementation was correct I was just reading it the wrong way compared to the test vector until you cleared the matter for me. $\endgroup$
    – pro orp
    Apr 18 at 15:27
0
$\begingroup$

I find it much more informative to look at the "Xor'd state (as lanes of integers)" reading right to left, top to bottom. This way the bits appear in the order you would expect them to.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.