Doubt about published test vectors for gimli hash

Question

In https://eprint.iacr.org/2017/630.pdf and https://gimli.cr.yp.to/gimli-20170627.pdf there are test vectors for the gimli hash function. I have compile the reference C code test_hash.c from https://gimli.cr.yp.to/gimli-20170627.tar.gz on two systems (Intel x86/Win, ARMV7l GNU/Linux) and consistently get results that differ from the printed vectors. The paper lists e.g.

input: "" (empty string)
input (bytes): (0 bytes)
output:
bd2a1b1cdab81f9fea9d5fd513372ab9d1481428385de2b2d3571d8504fdd703

but both executables give

b0634b2c0b082aedc5c0a2fe4ee3adcfc989ec05de6f00addb04b3aaac271f67

Has anybody verified the test vectors from the papers?

For the permutation/compression function test program test.c my results are the same as given in the file test.exp.

Answer 1

I'm one of the authors of Gimli.

TL;DR: Test vectors provided by the paper are indeed wrong.

We had a error when we generated the paper and the test vectors have not been updated with respect to the last iteration of Gimli (in development stages).

Also one of the test vectors had a double space at some place. This has been corrected and will be updated in the revision of the paper.

Please find the correct ones below:

Test vectors

input 1:

There's plenty for the both of us, may the best Dwarf win.

54686572 65277320 706c656e 74792066 6f722074 68652062 6f746820
6f662075 732c206d 61792074 68652062 65737420 44776172 66207769
6e2e

output 1:

4afb3ff784c7ad6943d49cf5da79facfa7c4434e1ce44f5dd4b28f91a84d22c8

input 2:

If anyone was to ask for my opinion, which I note they're not, I'd say we were taking the long way around.

49662061 6e796f6e 65207761 7320746f 2061736b 20666f72 206d7920
6f70696e 696f6e2c 20776869 63682049 206e6f74 65207468 65792772
65206e6f 742c2049 27642073 61792077 65207765 72652074 616b696e
67207468 65206c6f 6e672077 61792061 726f756e 642e

output 2:

ba82a16a7b224c15bed8e8bdc88903a4006bc7beda78297d96029203ef08e07c

input 3:

Speak words we can all understand!

53706561 6b20776f 72647320 77652063 616e2061 6c6c2075 6e646572
7374616e 6421

output 3:

8dd4d132059b72f8e8493f9afb86c6d86263e7439fc64cbb361fcbccf8b01267

input 4:

It's true you don't see many Dwarf-women. And in fact, they are so alike in voice and appearance, that they are often mistaken for Dwarf-men. And this in turn has given rise to the belief that there are no Dwarf-women, and that Dwarves just spring out of holes in the ground! Which is, of course, ridiculous.

49742773 20747275 6520796f 7520646f 6e277420 73656520 6d616e79
20447761 72662d77 6f6d656e 2e20416e 6420696e 20666163 742c2074
68657920 61726520 736f2061 6c696b65 20696e20 766f6963 6520616e
64206170 70656172 616e6365 2c207468 61742074 68657920 61726520
6f667465 6e206d69 7374616b 656e2066 6f722044 77617266 2d6d656e
2e20416e 64207468 69732069 6e207475 726e2068 61732067 6976656e
20726973 6520746f 20746865 2062656c 69656620 74686174 20746865
72652061 7265206e 6f204477 6172662d 776f6d65 6e2c2061 6e642074
68617420 44776172 76657320 6a757374 20737072 696e6720 6f757420
6f662068 6f6c6573 20696e20 74686520 67726f75 6e642120 57686963
68206973 2c206f66 20636f75 7273652c 20726964 6963756c 6f75732e

output 4:

8887a5367d961d6734ee1a0d4aee09caca7fd6b606096ff69d8ce7b9a496cd2f

input 5:

 no bytes

ouput 5:

b0634b2c0b082aedc5c0a2fe4ee3adcfc989ec05de6f00addb04b3aaac271f67