I have been working on implementing the NORX V3.0 authenticated encryption algorithm and I have run into a very confusing contradiction regarding the order in which padding and permutation are performed during header, encryption, and trailer operations.
According to the V3.0 specifications (https://github.com/norx/resources/blob/master/specs/norxv30.pdf) , they show that the final block is padded after the ID is absorbed into the state.
According to the authors C reference code (https://github.com/norx/norx/blob/master/norx6444/ref/norx.c) the padding is performed before absorbing the block.
When I implement it according to the V3.0 specifications, the output of my code matches the test vectors.
When I swap the order to match the reference code, the test vectors fail completely.
Based on my general knowledge of sponge functions, I would expect that padding is done before executing the permutation. This is consistent with what I see on the reference code, but contradicts what the specifications say.
I have searched the web to see of perhaps there are errors in the V3.0 specifications that have not yet been updated into the document.
I have also noticed that when I pad after the permutation as per the spec, parallel mode (NORX64-4-4-4) matches all the test vectors except the final output tag. Changing between the two padding orders yields different tags, but none that match the test vectors given in the specification.
Having seen reference code in multiple languages (C, GO, PYTHON, C++, etc.) all showing padding before permuting, and given that a sponge is normally padded before permutation, I am beginning to suspect that the specification is incorrect.
If anyone knows the correct ordering to use, would you please confirm it.
Related : The test vectors are very limited. Does anyone know of a set of more comprehensive vectors (single and parallel mode) that are available?