I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I wanted to test my encryption function. Unfortunately, there are no test vectors for the full encryption in the specification paper:

I have found test vectors for Salsa20/20 from the ECRYPT Stream cipher project here.

But for some reason, the first 64-byte sequence matches with the output of my expansion function with the given key and IV and counter set to 0 but the second 64-byte sequence differs.





I have used the IV 0x0 (64-bit) and counter 0x1 (64-bit) concatenated such that the nonce given to the expansion function is

0x00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 01 

(big endian). But this leads to an incorrect result as shown above.

I have tried to write the bytes of the counter in littleendian since the specification paper mentions this in the last section about encryption:

0x00 00 00 00 00 00 00 00    01 00 00 00 00 00 00 00

but that only lead to a different wrong result:


I am assuming I am interpreting the test data incorrectly since my expansion function passes all the tests with the test data given in the specs.

I have found out here that the test vectors are using the NESSIE format but couldn't find a explanation about the data which solves my problem (probably there is no explanation because I am doing something quite obvious wrong?)

I am also confused what "(stream is generated by encrypting 512 zero bytes)" should mean. The stream is independent from the plaintext thus I am wondering what they mean by that it "is generated by encrypting 512 zero bytes"?

I would be very glad if anyone could help or lead me into the right direction since I am stuck with this for quite some days already. :)


Your "different wrong result" (based on a littleendian counter) appears to be the correct second 64-byte sequence. The test vector shows "stream[192..255] = ", which is the fourth 64-byte sequence. The test vector is generated by calling "the Salsa20 encryption function" (Section 10 of the spec) on 512 zero bytes using the indicated key and IV.

  • $\begingroup$ Oh, wow, I should have noticed this myself... Thank you so much, that solved my problem! $\endgroup$ – ekzyis May 31 '20 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.