Serpent cipher : Osvik S-Boxes confusion and test vectors

I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. Here's my implementation of $S_0$ as an example :

UInt32Vector Serpent::S0(const UInt32Vector &Y)
{
UInt32Vector X = Y;
X ^= X; uint32_t X4 = X;
X &= X; X4 ^= X;
X ^= X; X |= X;
X ^= X4;   X4 ^= X;
X ^= X; X |= X;
X ^= X4;   X4 = ~X4;
X4 |= X;   X ^= X;
X ^= X4;   X |= X;
X ^= X; X4 ^= X;

return {X, X4, X, X};
}

As you can see, this is exactly the $S_0$ from the paper. I have to precise that I checked my s-boxes 3 times to be sure there are the same as the one in the paper. Now, here's how I use $S_i$ for $i=0,\ldots,7$ :

subkeys.push_back(S[k & 7]({W[j], W[j+1], W[j+2], W[j+3]}));

where $k = 3$ and decreasing by 1 as it is mentioned in the algorithm specification.

What's confusing me is the Osvik implementation of his s-boxes compared to the ones described in his paper. This seems to be different. Moreover, in his key schedule, $i = 3$ is increasing instead of decreasing.

Now, here's my questions :

1. Where can I find test vectors to test my s-boxes ? I found one for the key schedule in Floppy 4 (ecb_iv.txt) from the full submission package, but nothing about the s-boxes.

2. Why his s-boxes implementation are different than the ones in his paper ?

3. Are my $S_0$ implementation and usage corrects with what I gave or did I miss something important ?

Thanks a lot for your helps.

• It should be noted that the endianness in the NIST submission and in all other implementations of Serpent is reversed. For S0 with inputs of all FE25B6A1, I get 01DA495E 01DA495E FE25B6A1 FE25B6A1. This is not the NIST byte order. – Richie Frame Nov 1 '13 at 18:45
• I just tested the values and I got the same results as you. My implementation is done in LittleEndian as it is mentioned in the paper. So am I right ? Sorry, but now, I'm still more confused... which one is right ? – Gabriel L. Nov 1 '13 at 19:12