I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I wanted to test my encryption function. Unfortunately, there are no test vectors for the full encryption in the specification paper:
I have found test vectors for Salsa20/20 from the ECRYPT Stream cipher project here.
But for some reason, the first 64-byte sequence matches with the output of my expansion function with the given key and IV and counter set to 0, but the second 64-byte sequence differs.
I have used the IV 0x0 (64-bit) and counter 0x1 (64-bit) concatenated such that the nonce given to the expansion function is
0x00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
(big endian). But this leads to an incorrect result as shown above.
I have tried to write the bytes of the counter in littleendian since the specification paper mentions this in the last section about encryption:
0x00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
but that only lead to a different wrong result:
I am assuming that I have misinterpreted the test data since my expansion function passes all the tests with the test data given in the specs.
I found out here that the test vectors use the NESSIE format but could not explain the data that solves my problem (probably there is no explanation because I am doing something entirely wrong).
I am also confused about what "(stream is generated by encrypting 512 zero bytes)" should mean. The stream is independent of the plaintext; thus, I wonder what they mean by saying it "is generated by encrypting 512 zero bytes"?
I would be very glad if anyone could help or lead me in the right direction since I have been stuck with this for quite some days already.