# ECRYPT Salsa20 Test Vectors Interpretation

I am currently implementing Salsa20 for my bachelor thesis. After having verified all the functions needed for the final encryption function with the given test data in the specification from DJB, I wanted to test my encryption function. Unfortunately, there are no test vectors for the full encryption in the specification paper:

I have found test vectors for Salsa20/20 from the ECRYPT Stream cipher project here.

But for some reason, the first 64-byte sequence matches with the output of my expansion function with the given key and IV and counter set to 0 but the second 64-byte sequence differs.

Actual:

0xa360370ff47dd714684fd47584e46fe89e031b59072be978f7c0a56936151a3e9c52f7be26c687a5bc234640efed47b79b02d70dd666dc39cea9288e69427318


Expected:

0x57be81f47b17d9ae7c4ff15429a73e10acf250ed3a90a93c711308a74c6216a9ed84cd126da7f28e8abf8bb63517e1ca98e712f4fb2e1a6aed9fdc73291faa17


I have used the IV 0x0 (64-bit) and counter 0x1 (64-bit) concatenated such that the nonce given to the expansion function is

0x00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 01


(big endian). But this leads to an incorrect result as shown above.

I have tried to write the bytes of the counter in littleendian since the specification paper mentions this in the last section about encryption:

0x00 00 00 00 00 00 00 00    01 00 00 00 00 00 00 00


but that only lead to a different wrong result:

0x8da2b74eef1b6283e7e20166abcae538e9716e4669e2816b6b20c5c356802001cc1403a9a117d12a2669f456366d6ebb0f1246f1265150f793cdb4b253e348ae


I am assuming I am interpreting the test data incorrectly since my expansion function passes all the tests with the test data given in the specs.

I have found out here that the test vectors are using the NESSIE format but couldn't find a explanation about the data which solves my problem (probably there is no explanation because I am doing something quite obvious wrong?)

I am also confused what "(stream is generated by encrypting 512 zero bytes)" should mean. The stream is independent from the plaintext thus I am wondering what they mean by that it "is generated by encrypting 512 zero bytes"?

I would be very glad if anyone could help or lead me into the right direction since I am stuck with this for quite some days already. :)