ECRYPT Salsa20 Test Vectors Interpretation

Question

I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I wanted to test my encryption function. Unfortunately, there are no test vectors for the full encryption in the specification paper:

I have found test vectors for Salsa20/20 from the ECRYPT Stream cipher project here.

But for some reason, the first 64-byte sequence matches with the output of my expansion function with the given key and IV and counter set to 0, but the second 64-byte sequence differs.

Actual:

0xa360370ff47dd714684fd47584e46fe89e031b59072be978f7c0a56936151a3e9c52f7be26c687a5bc234640efed47b79b02d70dd666dc39cea9288e69427318

Expected:

0x57be81f47b17d9ae7c4ff15429a73e10acf250ed3a90a93c711308a74c6216a9ed84cd126da7f28e8abf8bb63517e1ca98e712f4fb2e1a6aed9fdc73291faa17

I have used the IV 0x0 (64-bit) and counter 0x1 (64-bit) concatenated such that the nonce given to the expansion function is

0x00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 01 

(big endian). But this leads to an incorrect result as shown above.

I have tried to write the bytes of the counter in littleendian since the specification paper mentions this in the last section about encryption:

0x00 00 00 00 00 00 00 00    01 00 00 00 00 00 00 00

but that only lead to a different wrong result:

0x8da2b74eef1b6283e7e20166abcae538e9716e4669e2816b6b20c5c356802001cc1403a9a117d12a2669f456366d6ebb0f1246f1265150f793cdb4b253e348ae

I am assuming that I have misinterpreted the test data since my expansion function passes all the tests with the test data given in the specs.

I found out here that the test vectors use the NESSIE format but could not explain the data that solves my problem (probably there is no explanation because I am doing something entirely wrong).

I am also confused about what "(stream is generated by encrypting 512 zero bytes)" should mean. The stream is independent of the plaintext; thus, I wonder what they mean by saying it "is generated by encrypting 512 zero bytes"?

I would be very glad if anyone could help or lead me in the right direction since I have been stuck with this for quite some days already.

Answer 1

Your "different wrong result" (based on a littleendian counter) appears to be the correct second 64-byte sequence. The test vector shows "stream[192..255] = ", which is the fourth 64-byte sequence. The test vector is generated by calling "the Salsa20 encryption function" (Section 10 of the spec) on 512 zero bytes using the indicated key and IV.