18 votes
Accepted

Doubt about published test vectors for gimli hash

I'm one of the authors of Gimli. TL;DR: Test vectors provided by the paper are indeed wrong. We had a error when we generated the paper and the test vectors have not been updated with respect to the ...
Biv's user avatar
  • 9,989
7 votes
Accepted

What's the reason for Monte Carlo tests for block ciphers?

As usual, government departments simply repeat their existing rules. So they incorporated the Monte Carlo tests from earlier test documents, this time from 1980. If you follow the dusty trail from ...
Paul Uszak's user avatar
  • 15.4k
7 votes

Need a test suite for my RSA implementation

There are RSA keys pairs in the validation suite for the RSA part of FIPS 186-4 (see second part of this answer for details). Because "encrypt/decrypt by RSA method" is not well-defined (for lack of ...
fgrieu's user avatar
  • 141k
6 votes
Accepted

ChaCha20-Poly1305 test vectors

For the complete picture, as was pointed out, you should use the final RFC, not drafts. There are two relevant RFC here: RFC 7539 describes the stream cipher ChaCha20, the MAC algorithm Poly1305, and ...
Thomas Pornin's user avatar
5 votes

Explanation of CAVP format for NIST Test Vectors for SHA-2 and 3

All of your questions are answered in the Validation System documents that are linked to by the algorithm test pages. In this case, look at http://csrc.nist.gov/groups/STM/cavp/documents/shs/SHAVS....
trb's user avatar
  • 51
5 votes
Accepted

64 DES full example with all the stages

Might I suggest the "DES cipher internals in Excel" page by Nayuki? Because everything's in Excel, all the internal values are openly displayed.
poncho's user avatar
  • 147k
5 votes
Accepted

How are long IVs used in AES-GCM?

The processing of non-96-bit IVs are specified in and as part of the GCM algorithm in section 7. And as anyone can tell, non-96-bit IVs are ultimately compressed to 96-bit, which means they're ...
DannyNiu's user avatar
  • 9,207
4 votes
Accepted

SHA3-512 troubleshooting - is there a worked example for hashing the "zero-length string"?

Does anyone know of some document or tutorial that gives a worked example of each step in using SHA3-512 to generate a digest of the message "" (or some other short message), giving detailed step-by-...
SEJPM's user avatar
  • 46k
4 votes

Implementations of GCM with 64-bit cipher

This would not be recommended in most cases. Note that AES-GCM fails terribly if an IV repeats. In a 64-bit block cipher, if you want the probability of such a failure to be below $2^{-32}$, then you ...
Yehuda Lindell's user avatar
4 votes
Accepted

NIST HMAC Test vectors

RFC4868 is not the HMAC RFC, which is actually RFC 2104. 4868 refers to the use of HMAC within IPSEC, which is why there is a key length restriction. The maximum length key that can be used internally ...
Richie Frame's user avatar
  • 13.1k
4 votes
Accepted

Complete Set of Test-Vectors for ECDSA secp256k1

OK, so I quickly found out that there is a test in Bouncy Castle called: org.bouncycastle.crypto.test.ECTest.testECDSASecP224k1sha256() which tests exactly what ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
Accepted

Byte order in AES-CMAC test code

Keys for AES are not numbers; they are defined as bits / octets (or bytes). They therefore do not have a "least significant octet", they just consist of octets. So the same order from lowest ...
Maarten Bodewes's user avatar
  • 92.6k
3 votes

ChaCha20-Poly1305 test vectors

I wound up finding RFC 7539, and using the test vector from section 2.8.2 of that document. I present the same vector here, in a more code-friendly format: ...
Jonas's user avatar
  • 779
3 votes

Where can I find test vectors for ciphers?

Maarten's answer is totally right, but I would like to add a very convenient link: The python library pyca features a Test vectors page in their documentation, which gives a very nice overview of test ...
mat's user avatar
  • 2,518
3 votes
Accepted

Is there any place where I can find test vectors for point addition and doubling of ECC?

You can check Elliptic Curve Calculator. It has point addition and scalar multiplication. For doubling, adding the same points(P+P) should do the work.
Makif's user avatar
  • 820
3 votes

Bleichenbacher attack test vectors

As mentioned by j.p., the original attack has been (quite significantly) improved in 2012 and some great tutorials are available online, often demonstrated with example. If you want a more exhaustive ...
Faulst's user avatar
  • 852
2 votes

NIST HMAC Test vectors

The question why these things are chosen is not really answerable, except by the persons involved at NIST. I don't think there is too much to test though; after you test a few vectors you're testing ...
Maarten Bodewes's user avatar
  • 92.6k
2 votes

Where can I find NTRU test vectors?

The most recent version of the paper indeed seems to be: Efficient Embedded Security Standards (EESS) EESS #1: Implementation Aspects of NTRUEncrypt and NTRUSign Consortium for Efficient Embedded ...
e-sushi's user avatar
  • 17.9k
2 votes

Testing implementation of cryptography algorithms: Brainstorm

My own algorithm validation for block ciphers consists of the combination of the AESAVS KAT and MCT tests from the NIST CAVP, plus the NESSIE test vector sets, plus an additional MCT of 400 key ...
Richie Frame's user avatar
  • 13.1k
2 votes
Accepted

Using NIST SP 800 - 90Ar1 Test Vectors for HMAC_DRBG with Reseeding and AdditionalInput

The other two AdditionalInput are to be used with the Generate function. Page 47 of the spec describes it. Step 2 of the algorithm performs: ...
Ruggero's user avatar
  • 7,084
2 votes

Test Vectors for XEdDSA

Open Whisper Systems' own curve25519-java repository has a few test vectors in the code in android/jni/ed25519/tests/. From <...
xorhash's user avatar
  • 231
2 votes

IEEE P1619/XTS, inconsistent reference implementation and test vectors

From §5.1 ‘Data units and tweaks’, p. 4: Each data unit is assigned a tweak value which is a non-negative integer. The tweak values are assigned consecutively, starting from an arbitrary non-...
Squeamish Ossifrage's user avatar
2 votes

Bleichenbacher attack test vectors

Here is another possibility for learning purposes. You could use the free, open-source elearning program CrypTool 2. In the tab "Crypto Tutorials" there is a section "Attacks on PKCS#1". There you can ...
phdgroupA's user avatar
2 votes
Accepted

ECRYPT Salsa20 Test Vectors Interpretation

Your "different wrong result" (based on a littleendian counter) appears to be the correct second 64-byte sequence. The test vector shows "stream[192..255] = ", which is the fourth 64-byte sequence. ...
WeeknightMVP's user avatar
2 votes

Public key derivation for Ed448

If you read all of the RF 8032 you will see that there is a compression (endcodings) of the points. ...
kelalaka's user avatar
  • 48.5k
2 votes
Accepted

Test vectors (points) for Ed25519

Just use a reliable library to generate your test vectors. For example, using elliptic: ...
knaccc's user avatar
  • 4,732
1 vote

Where can I find test vectors for the PRESENT cipher with a 128-bit key?

The test vectors for PRESENT cipher 128 bit key size are: $$ \begin{array}{c|c} \def\tabentry#1 {{\scriptstyle\mathtt{#1 }}} K & P & C \\ \hline \tabentry 0x00000000000000000000000000000000 &...
hardyrama's user avatar
  • 2,126
1 vote
Accepted

How can I get select messages ciphers for salsa20poly1305 for unit tests?

Just use the test vector specified by DJB himself, specified here, chapter 4 (just XSalsa20) and chapter 10 for the box. This will already test all your primitives. To perform boundary tests, I would ...
Maarten Bodewes's user avatar
  • 92.6k
1 vote

Implementations of GCM with 64-bit cipher

I've been struggling with good ways to protect data from passively-powered RFID tags that send less than 1k of data during their life. Cryptographers do not understand engineering constraints that ...
b degnan's user avatar
  • 4,820

Only top scored, non community-wiki answers of a minimum length are eligible