National Institute

of Standards and

Technology

U.S. Department

of Commerce

Information Technology

Laboratory

NIST Special Publication 800-17

Modes of Operation Validation System

(MOVS):

Requirements and Procedures

Sharon Keller and Miles Smid
Computer Science

and Technology

NIST Special Publication 800-17

Modes of Operation Validation System

(MOVS):

Requirements and Procedures

Sharon Keller

Miles Smid 

Security Technology Group

Computer Security Division

National Institute of Standards and Technology

Gaithersburg, MD 20899

February 1998

U.S. DEPARTMENT OF COMMERCE

William M. Daley, Secretary 

Technology Administration

Gary R. Bachula, Acting Under Secretary for Technology

National Institute of Standards and Technology

Raymond G. Kammer, Director 
iii

TABLE OF CONTENTS

ABSTRACT ..................................................................... 1

1. INTRODUCTION ............................................................. 1

1.1 Background ............................................................ 1

1.2 Organization ............................................................ 2

2. PRIVATE KEY ALGORITHMS ................................................... 3

2.1 Data Encryption Standard (DES) (FIPS PUB 46-2) .............................. 3

2.1.1 The S-boxes .................................................... 4

2.1.2 The Key Schedule ................................................ 4

2.1.3 The Permutations and E Operator .................................... 5

2.2 Skipjack Encryption Algorithm .............................................. 5

2.3 The Four Modes of Operation ............................................... 6

2.3.1 Electronic Codebook (ECB) Mode .................................... 7

2.3.2 Cipher Block Chaining (CBC) Mode .................................. 8

2.3.3 Cipher Feedback (CFB) Mode ...................................... 10

2.3.4 Output Feedback (OFB) Mode ..................................... 12

3. MODES OF OPERATION VALIDATION SYSTEM FOR THE DES AND SKIPJACK 

ALGORITHMS ..................................................... 14

3.1 The Known Answer Tests ................................................. 14

3.1.1 The Encryption Process ......................................... 15

3.1.1.1 The Variable Plaintext Known Answer Test .................... 15

3.1.1.2 The Inverse Permutation Known Answer Test for the Encrypt State . . 15

3.1.1.3 The Variable Key Known Answer Test for the Encryption Process ... 16

3.1.1.4 The Permutation Operation Known Answer Test for the Encryption 

Process ............................................... 17

3.1.1.5 The Substitution Table Known Answer Test for the Encryption Process

..................................................... 17

3.1.2 The Decryption Process ......................................... 18

3.1.2.1 The Variable Ciphertext Known Answer Test ................... 18

3.1.2.2 The Initial Permutation Known Answer Test for the Decryption 

Process ............................................... 18

3.1.2.3 The Variable Key Known Answer Test for the Decryption Process ... 19

3.1.2.4 The Permutation Operation Known Answer Test for the Decryption 

Process ............................................... 19

3.1.2.5 The Substitution Table Known Answer Test for the Decryption 

Process ............................................... 20

3.2 The Modes Test ........................................................ 20

4. BASIC PROTOCOL ........................................................... 22

4.1 Overview .............................................................. 22

4.1.1 Conventions .................................................... 22

4.1.2 Message Data Types ............................................. 22

4.2 Message Contents ....................................................... 23
iv

4.3 Input Types ..................................................... 24

4.3.1 Input Type 1 ............................................. 24

4.3.2 Input Type 2 ............................................. 24

4.3.3 Input Type 3 ............................................. 25

4.3.4 Input Type 4 ............................................. 25

4.3.5 Input Type 5 ............................................. 25

4.3.6 Input Type 6 ............................................. 26

4.3.7 Input Type 7 ............................................. 26

4.3.8 Input Type 8 ............................................. 27

4.3.9 Input Type 9 ............................................. 27

4.3.10 Input Type 10 ........................................... 28

4.3.11 Input Type 11 ........................................... 28

4.3.12 Input Type 12 ........................................... 29

4.4 Output Types .................................................... 29

4.4.1 Output Type 1 ........................................... 29

4.4.2 Output Type 2 ........................................... 30

5. TESTS REQUIRED TO VALIDATE AN IMPLEMENTATION OF THE DES OR SKIPJACK

ALGORITHM ............................................................ 31

5.1 Electronic Codebook (ECB) Mode ........................................... 33

5.1.1 Encryption Process ............................................... 33

5.1.1.1 The Variable Plaintext Known Answer Test - ECB Mode .......... 34

5.1.1.2 The Inverse Permutation Known Answer Test - ECB Mode ........ 36

5.1.1.3 The Variable Key Known Answer Test for the Encryption Process - 

ECB Mode ............................................ 38

5.1.1.4 Permutation Operation Known Answer Test for the Encryption Process -

ECB Mode ............................................ 40

5.1.1.5 Substitution Table Known Answer Test for the Encryption Process - 

ECB Mode ............................................ 42

5.1.1.6 Modes Test for the Encryption Process - ECB Mode ............. 44

5.1.2 Decryption Process .............................................. 46

5.1.2.1 The Variable Ciphertext Known Answer Test - ECB Mode ........ 47

5.1.2.2 The Initial Permutation Known Answer Test - ECB Mode ......... 49

5.1.2.3 The Variable Key Known Answer Test for the Decryption Process -

ECB Mode ............................................ 51

5.1.2.4 Permutation Operation Known Answer Test for Decryption Process - 

ECB Mode ............................................ 54

5.1.2.5 Substitution Table Known Answer Test for the Decryption Process - 

ECB Mode ............................................ 56

5.1.2.6 Modes Test for the Decryption Process - ECB Mode ............. 58

5.2 Cipher Block Chaining (CBC) Mode ......................................... 60

5.2.1 Encryption Process ............................................... 60

5.2.1.1 The Variable Plaintext Known Answer Test - CBC Mode .......... 61

5.2.1.2 The Inverse Permutation Known Answer Test - CBC Mode ......... 63

5.2.1.3 The Variable Key Known Answer Test for the Encryption Process - 

CBC Mode ............................................ 65

5.2.1.4 Permutation Operation Known Answer Test for the Encryption Process -
v

CBC Mode ............................................ 67

5.2.1.5 Substitution Table Known Answer Test for the Encryption Process - 

CBC Mode ............................................ 69

5.2.1.6 Modes Test for the Encryption Process - CBC Mode ............. 71

5.2.2 Decryption Process .............................................. 74

5.2.2.1 The Variable Ciphertext Known Answer Test - CBC Mode ......... 75

5.2.2.2 The Initial Permutation Known Answer Test - CBC Mode .......... 78

5.2.2.3 The Variable Key Known Answer Test for the Decryption Process - 

CBC Mode ............................................ 80

5.2.2.4 Permutation Operation Known Answer Test for Decryption Process - 

CBC Mode ............................................ 83

5.2.2.5 Substitution Table Known Answer Test for the Decryption Process - 

CBC Mode ............................................ 86

5.2.2.6 Modes Test for the Decryption Process - CBC Mode ............. 88

5.3 The Cipher Feedback (CFB) Mode .......................................... 91

5.3.1 The Known Answer Tests - CFB Mode ............................... 91

5.3.1.1 The Variable Text Known Answer Test - CFB Mode ............. 92

5.3.1.2 The Inverse Permutation Known Answer Test - CFB Mode ......... 94

5.3.1.3 The Variable Key Known Answer Test - CFB Mode .............. 96

5.3.1.4 The Permutation Operation Known Answer Test - CFB Mode ...... 99

5.3.1.5 The Substitution Table Known Answer Test - CFB Mode ........ 101

5.3.2 The Modes Tests - CFB Mode .................................... 103

5.3.2.1 The K-bit CFB Modes Test for the Encryption Process - CFB Mode

.................................................... 103

5.3.2.2 The Modes Test for the Decryption Process - CFB Mode ........ 106

5.4 The Output Feedback Mode - OFB Mode ................................. 109

5.4.1 The Known Answer Tests - OFB Mode .............................. 109

5.4.1.1 The Variable Text Known Answer Test - OFB Mode ............ 110

5.4.1.2 The Inverse Permutation Known Answer Test - OFB Mode ....... 112

5.4.1.3 The Variable Key Known Answer Test - OFB Mode ............ 114

5.4.1.4 The Permutation Operation Known Answer Test - OFB Mode ..... 116

5.4.1.5 The Substitution Table Known Answer Test - OFB Mode ........ 118

5.4.1.6 The Modes Test - OFB Mode ............................. 120

 6. DESIGN OF THE MODES OF OPERATION VALIDATION SYSTEM (MOVS) FOR DES 

AND SKIPJACK ......................................................... 123

6.1 Design Philosophy ...................................................... 123

6.2 Operation of the MOVS .................................................. 123

Appendix A Sample Round Outputs for the DES ....................................... 124

Appendix B Tables of Values for the Known Answer Tests ............................... 125

Table 1 Resulting Ciphertext from the Variable Plaintext Known Answer Test for DES .... 125

Table 2 Resulting Ciphertext from the Variable Key Known Answer Test for DES ........ 129

Table 3 Values To Be Used for the Permutation Operation Known Answer Test .......... 133

Table 4 Values To Be Used for the Substitution Table Known Answer Test ............. 136

Table 5 Resulting Ciphertext from the Variable Plaintext Known Answer Test for Skipjack . 137
vi

Table 6 Resulting Ciphertext from the Variable Key Known Answer Test for Skipjack ..... 140

REFERENCES ................................................................ 143
vii

LIST OF FIGURES

Figure 2.1 One of the Eight S-Boxes in the DES .......................................... 4

Figure 2.2 The Key Schedule for the DES ............................................... 5

Figure 2.3 Electronic Codebook (ECB) Mode ............................................ 7

Figure 2.4 Cipher Block Chaining (CBC) Mode .......................................... 8

Figure 2.5 Cipher Feedback (CFB) Mode .............................................. 10

Figure 2.6 Output Feedback (OFB) Mode .............................................. 12

Figure 5.1 The Variable Plaintext Known Answer Test - ECB Mode .......................... 34

Figure 5.2 The Inverse Permutation Known Answer Test - ECB Mode ........................ 36

Figure 5.3 The Variable Key Known Answer Test for the Encryption Process- ECB Mode ......... 38

Figure 5.4 The Permutation Operation Known Answer Test for the Encryption Process - ECB Mode 40

Figure 5.5 The Substitution Table Known Answer Test for the Encryption Process - ECB Mode ..... 42

Figure 5.6 The Modes Test for the Encryption Process - ECB Mode ......................... 44

Figure 5.7 The Variable Ciphertext Known Answer Test - ECB Mode ......................... 47

Figure 5.8 The Initial Permutation Known Answer Test - ECB Mode ......................... 49

Figure 5.9 The Variable Key Known Answer Test for the Decryption Process - ECB Mode ......... 51

Figure 5.10 The Permutation Operation Known Answer Test for the Decryption Process - ECB Mode 54

Figure 5.11 The Substitution Table Known Answer Test for the Decryption Process - ECB Mode .... 56

Figure 5.12 The Modes Test for the Decryption Process - ECB Mode ......................... 58

Figure 5.13 The Variable Plaintext Known Answer Test - CBC Mode ......................... 61

Figure 5.14 The Inverse Permutation Known Answer Test - CBC Mode ....................... 63

Figure 5.15 The Variable Key Known Answer Test for the Encryption Process - CBC Mode ........ 65

Figure 5.16 The Permutation Operation Known Answer Test for the Encryption Process - CBC Mode 67

Figure 5.17 The Substitution Table Known Answer Test for the Encryption Process -CBC Mode .... 69

Figure 5.18 The Modes Test for the Encryption Process - CBC Mode ......................... 71

Figure 5.19 The Variable Ciphertext Known Answer Test - CBC Mode ........................ 75

Figure 5.20 The Initial Permutation Known Answer Test - CBC Mode ........................ 78

Figure 5.21 The Variable Key Known Answer Test for the Decryption Process - CBC Mode ........ 80

Figure 5.22 The Permutation Operation Known Answer Test for the Decryption Process - CBC Mode 83

Figure 5.23 The Substitution Table Known Answer Test for the Decryption Process - CBC Mode .... 86

Figure 5.24 The Modes Test for the Decryption Process - CBC Mode ......................... 88

Figure 5.25 The Variable Text Known Answer Test - CFB Mode ............................. 92

Figure 5.26 The Inverse Permutation Known Answer Test - CFB Mode ....................... 94

Figure 5.27 The Variable Key Known Answer Test - CFB Mode ............................. 96

Figure 5.28 The Permutation Operation Known Answer Test - CFB Mode ..................... 99

Figure 5.29 The Substitution Table Known Answer Test - CFB Mode ........................ 101

Figure 5.30 The Modes Test for the Encryption Process - K-bit CFB Mode ................... 103

Figure 5.31 The Modes Test for the Decryption Process - CFB Mode ........................ 106

Figure 5.32 The Variable Text Known Answer Test - OFB Mode ............................ 110

Figure 5.33 The Inverse Permutation Known Answer Test - OFB Mode ...................... 112

Figure 5.34 The Variable Key Known Answer Test - OFB Mode ............................ 114

Figure 5.35 The Permutation Operation Known Answer Test - OFB Mode .................... 116

Figure 5.36 The Substitution Table Known Answer Test - OFB Mode ....................... 118

Figure 5.37 The Modes Test - OFB Mode ............................................. 120
viii

LIST OF ACRONYMS

CBC . . . . . . . . . . Cipher Block Chaining Mode

CMT . . . . . . . . . . Cryptographic Module Testing Laboratory

CMV . . . . . . . . . . NIST Cryptographic Module Validation Program

CFB . . . . . . . . . . Cipher Feed Back Mode

DES . . . . . . . . . . Data Encryption Standard

ECB . . . . . . . . . . Electronic Code Book Mode

EES . . . . . . . . . . Escrowed Encryption Standard

FIPS PUB . . . . . . . Federal Information Processing Standard Publication

IUT . . . . . . . . . . Implementation Under Test

MOVS. . . . . . . . . Modes of Operation Validation System

NSA . . . . . . . . . . National Security Agency

NVLAP . . . . . . . . .NIST National Voluntary Laboratory Accreditation Program

NBS. . . . . . . . . . National Bureau of Standards

NIST . . . . . . . . . National Institute of Standards and Technology

OFB. . . . . . . . . . Output Feed Back Mode
ix

ACKNOWLEDGMENTS

The authors would like to thank Donna Dodson (NIST), Lisa Carnahan (NIST), Elaine Barker

(NIST), and Jim Foti (NIST) for their significant assistance in the development of this Special

Publication.
x
1

ABSTRACT

The National Institute of Standards and Technology (NIST) Modes of Operation Validation

System (MOVS) specifies the procedures involved in validating implementations of the DES

algorithm in FIPS PUB 46-2 The Data Encryption Standard (DES) and the Skipjack algorithm in

FIPS PUB 185, Escrowed Encryption Standard (ESS). The MOVS is designed to perform

automated testing on Implementations Under Test (IUTs). This publication provides brief

overviews of the DES and Skipjack algorithms and introduces the basic design and configuration

of the MOVS. Included in this overview are the specifications for the two categories of tests

which make up the MOVS, i.e., the Known Answer tests and the Modes tests. The requirements

and administrative procedures to be followed by those seeking formal NIST validation of an

implementation of the DES or Skipjack algorithm are presented. The requirements described

include the specific protocols for communication between the IUT and the MOVS, the types of

tests which the IUT must pass for formal NIST validation, and general instructions for accessing

and interfacing with the MOVS. An appendix with tables of values and results for the DES and

Skipjack Known Answer tests is also provided.

Key words: automated testing, computer security, cryptographic algorithms, cryptography, Data

Encryption Standard (DES), Federal Information Processing Standard (FIPS), NVLAP, Skipjack

algorithm, secret key cryptography, validation.

1. INTRODUCTION

1.1 Background

This publication specifies the various tests required to validate implementations under test (IUTs)

for conformance to the DES and Skipjack algorithms. When applied to IUTs of the DES

algorithm, the Modes of Operation Validation System (MOVS) provides conformance testing for

the various components of the algorithm, as well as testing for apparent operational errors. The

MOVS is also used to test for apparent operational errors in IUTs of the Skipjack algorithm.

The MOVS is composed of two types of validation tests, the Known Answer tests and the Modes

tests. Both of these are based on validation tests described in SP500-20, Validating the

Correctness of Hardware Implementations of the NBS Data Encryption Standard. As SP500-

20's title implies, the validation tests were written to validate hardware implementations of the

DES algorithm. SP800-17 expands on this by specifying how to validate implementations of the

DES algorithm in software, firmware, hardware, or any combination thereof. The document also

addresses implementations of the Skipjack algorithm, which must be implemented in electronic

devices (e.g., very large scale integration chips). The Known Answer tests and Modes tests are

based on the standard DES test set and the Monte-Carlo tests respectively, as specified in SP500-

20.
2

To perform the Known Answer tests, the MOVS supplies known values to the IUT. The IUT

then processes the input through the implemented algorithm, and the results are compared to

expected values. When applied to IUTs of the DES algorithm, the Known Answer tests verify

that the IUT correctly implements the components of the algorithm (e.g., S boxes, ...). When

applied to IUTs of the Skipjack algorithm, these same tests verify that the implemented algorithm

produces the correct results, i.e., given known input, the correct results are produced. 

Since the test set used for the Known Answer tests is public knowledge, another type of

validation test has been designed to use pseudo-random data. This test is the Modes test. The

Modes test verifies that the IUT has not been designed just to pass the Known Answer tests. A

successful series of Modes tests gives some assurance that an anomalous combination of inputs

does not exist that would cause the test to end abnormally for reasons not directly related to the

implementation of the algorithm. An additional purpose of the Modes test is to verify that no

undesirable condition within the IUT will cause the key or plaintext to be exposed due to an

implementation or operational error. The Modes test is not a reliability test, but merely checks for

the presence of an apparent operational error.

1.2 Organization

Section 2 gives a brief overview of the DES and Skipjack algorithms and the four modes of

operation allowed by both of these algorithms. Section 3 provides an overview of the tests which

make up the Modes of Operation Validation System (MOVS) for the DES and Skipjack

algorithms. Section 4 describes the basic protocol used by the MOVS. Section 5 provides a

detailed explanation of each test required by the MOVS to validate an IUT of the DES and

Skipjack algorithms. Section 6 outlines the design of the MOVS. Appendix A provides an

example of round outputs for the DES, and Appendix B provides tables of values for the Known

Answer tests for both the DES and Skipjack algorithms. These tables include Table 1 - Resulting

Ciphertext from the Variable Plaintext Known Answer Test for DES, Table 2 - Resulting

Ciphertext from the Variable Key Known Answer Test for DES, Table 3 - Values to be Used for

the Permutation Operation Known Answer Test, Table 4 - Values to be Used for the Substitution

Tables Known Answer Test, Table 5 - Resulting Ciphertext from the Variable Plaintext Known

Answer Test for Skipjack, and Table 6 - Resulting Ciphertext from the Variable Key Known

Answer Test for Skipjack.
3

2. PRIVATE KEY ALGORITHMS

2.1 Data Encryption Standard (DES) (FIPS PUB 46-2)

FIPS PUB 46-2, The Data Encryption Standard (DES), published on December 30, 1993, is a

cryptographic algorithm which has been standardized for use within the Federal Government for

protecting the transmission and storage of unclassified computer data. DES is a FIPS approved

cryptographic algorithm as required by FIPS 140-1, Security Requirements for Cryptographic

Modules, January 11, 1994. 

The DES algorithm is a recirculating, 64-bit, block product cipher whose security is based on a

secret key. The DES keys are 64-bit binary vectors consisting of 56 information bits and 8 parity

bits. The parity bits are reserved for error detection purposes and are not used by the encryption

algorithm. The 56 information bits are used by the enciphering and deciphering operations and

are referred to as the active key. 

In the enciphering computation, a block to be enciphered is subjected to an initial permutation

(IP), then to a complex key-dependent computation and finally to a permutation which is the

inverse of the initial permutation (IP ). The key-dependent computation can be defined in terms -1

of a function f, called the cipher function, and a function KS, called the key schedule. The

function f involves E operators, substitution tables (S-boxes), and permutations (P). The 64 bit

input block is divided into two halves, each consisting of 32 bits. One half is used as input to the

function f, and the result is exclusive ORed to the other half. After one iteration, or round, the

two halves of data are swapped, and the operation is performed again. The DES algorithm uses

16 rounds to produce a recirculating block product cipher. The cipher produced by the algorithm

displays no correlation to the input. Every bit of the output depends on every bit of the input and

on every bit of the active key. An example of round-by-round encryption for a given key and

plaintext is shown in Appendix A.

For a thorough discussion of the DES algorithm and its components, consult FIPS PUB 46-2. 

Guidelines on the proper usage of the DES are published in FIPS PUB 74, Guidelines for

Implementing and Using the NBS Data Encryption Standard. A brief description of the

components of the DES algorithm follows.
4

2.1.1 The S-boxes

The non-linear substitution tables, or S-boxes, constitute an important part of the algorithm. The

purpose of the S-boxes is to ensure that the algorithm is not linear. There are eight different Sboxes. Figure 2.1 displays one of these. Each S-box contains 64 entries, organized as a 4×16

matrix. Each entry is a four bit binary number, represented as 0-15. A particular entry in a single

S-box is selected by six bits, two of which select a row and four select a column. The entry in the

corresponding row and column is the output for that input. Each row in each S-box is a

permutation of the numbers 0-15, so no entry is repeated in any one row. The output of the

parallel connection of eight S-boxes is 32 bits.

 

14 4 13 2 15 11 8 3 10 6 12 5 9 0 7

1

 0 15 7 14 2 13 1 10 6 12 11 9 5 3 8

4

 4 1 14 13 6 2 11 15 12 9 7 3 10 5 0

8

15 12 8 4 9 1 7 5 11 3 14 10 0 6 13

2

Figure 2.1 One of the Eight S-Boxes in the DES

2.1.2 The Key Schedule

The key schedule provides a linear means of thoroughly intermixing the bits of the 56-bit key

specified for use in the DES operation to form a different 48-bit key for each of the 16 rounds of

the DES algorithm. This is done in the following manner: The key is subjected to a permuted

choice 1 (PC1) where the bits of the key are reorganized. The permuted key is then divided into

two parts denoted C and D. These parts are shifted left a predetermined number of times i i

producing Ci+1 and Di+1. The resulting values are subjected to a permuted choice 2 (PC2) which

reorganizes the bits again, producing the round key K . To compute the next round key K ,

i+1 i+2

Ci+1 and Di+1 are shifted left a predetermined number of times. The resulting value is then

subjected to PC2. This procedure is repeated to calculate the 16 round keys.

Both the permutations in the key-schedule, PC1 and PC2, intermix the key bits among the round

keys in such a way as to equalize key-bit utilization. It does this by forcing each key bit to be

used no more than 15 times and no less than 12 times. 

Figure 2.2 shows how the key schedule determines the sixteen 48-bit round keys from the 56-bit

encryption key.
K PC2 Kn

5

Figure 2.2 The Key Schedule for the DES

 

2.1.3 The Permutations and E Operator

The role of the permutation P is to thoroughly mix the data bits so they cannot be traced back

through the S-boxes. The initial and final permutations are byte oriented, and the data is output

eight bits at a time. The operator E expands a 32 bit input to a 48 bit output that is added mod

two to the round key. The permutations in the key-schedule, PC1 and PC2, intermix the bits that

result from the S-box substitution in a complex way to prevent bit tracing.

Each permutation is a linear operator, and so can be thought of as an n × m matrix and can be

validated completely if it operates correctly on an appropriate maximal linearly independent set of

input vectors, i.e., a suitable basis.

2.2 Skipjack Encryption Algorithm

The Skipjack algorithm is a classified symmetric-key cryptographic algorithm designed by the

National Security Agency (NSA). The specifications for the Skipjack algorithm are contained in

the R21 Informal Technical Report entitled "SKIPJACK" (S), R21-TECH-044-91, May 21, 1991. 

Organizations holding an appropriate security clearance and entering into a Memorandum of

Agreement with the National Security Agency regarding implementations of the standard will be

provided access to the classified specifications. 

As discussed in FIPS PUB 185, Escrowed Encryption Standard (ESS), the Skipjack algorithm has
6

been approved for government applications requiring the encryption of sensitive but unclassified

data telecommunications. The Skipjack algorithm is a 64-bit code book transformation that

utilizes the same four DES modes of operation as specified in FIPS PUB 81, DES Modes of

Operation and FIPS PUB 74, Guidelines for Implementing and Using the NBS Data Encryption

Standard. Skipjack uses an 80-bit encryption/decryption key (compared with a 56-bit key used

by DES) and has 32 rounds of processing per single encrypt/decrypt operation (compared with 16

rounds for the DES). Skipjack outputs 64 bits of output per round.

The Skipjack algorithm may only be implemented in electronic devices (e.g., very large scale

integration chips). The devices may be incorporated in security equipment used to encrypt (and

decrypt) sensitive unclassified telecommunications data.

2.3 The Four Modes of Operation

The DES and Skipjack algorithms both utilize the same four modes of operation specified in FIPS

PUB 81, DES Modes of Operation. These modes are the Electronic Codebook (ECB) Mode, the

Cipher Block Chaining (CBC) Mode, the Cipher Feedback (CFB) Mode, and the Output

Feedback (OFB) Mode. 
ECB ENCRYPTION

PLAINTEXT

(D1, D2, ..., D64)

CIPHERTEXT

(C1, C2, ..., C64)

INPUT BLOCK

OUTPUT BLOCK

ENCRYPT

(I1, I2, ..., I64)

(O1, O2, ..., O64)

ECB DECRYPTION

PLAINTEXT

(D1, D2, ..., D64)

CIPHERTEXT

(C1, C2, ..., C64)

OUTPUT BLOCK

INPUT BLOCK

DECRYPT

(I1, I2, ..., I64)

(O1, O2, ..., O64)

7

Figure 2.3 Electronic Codebook (ECB) Mode

2.3.1 Electronic Codebook (ECB) Mode

The Electronic Codebook (ECB) mode is shown in Figure 2.3. In ECB encryption, a plaintext

data block (D , D , ..., D ) is used directly as the input block (I , I , ..., I ). The input block is 1 2 64 1 2 64

processed through the DES or Skipjack algorithm in the encrypt state. The resultant output block

(O , O ,...,O ) is used directly as ciphertext (C , C ,..., C ). 1 2 64 1 2 64

In ECB decryption, a ciphertext block (C , C , ..., C ) is used directly as the input block (I , 1 2 64 1

I ,...,I ). The input block is then processed through the DES or Skipjack algorithm in the decrypt 2 64

state. The resultant output block (O1, O2,...,O64) produces the plaintext (D1,D2,...,D64). The ECB

decryption process is the same as the ECB encryption process except that the decrypt state of the

DES or Skipjack algorithm is used rather than the encrypt state.
I D D D

I I I

C C C

C C C

I I I

ENCRYPT ENCRYPT ENCRYPT

DECRYPT DECRYPT DECRYPT

D D D

TIME=1 TIME=2 . . . TIME=N

LEGEND: D = DATA BLOCK I = INPUT BLOCK C = CIPHER BLOCK

IV = INITIALIZATION VECTOR = EXCLUSIVE-OR

NOTE: All variables are 64 bits in length.

V

IV

8

Figure 2.4 Cipher Block Chaining (CBC) Mode

2.3.2 Cipher Block Chaining (CBC) Mode

As shown in the upper half of Figure 2.4, the Cipher Block Chaining (CBC) mode begins

processing by dividing a plaintext message into 64 bit data blocks. In CBC encryption, the first

input block (I , I ,...,I ) is formed by exclusive-ORing the first plaintext data block (D , D , ..., 1 2 64 1 2

D64) with a 64-bit initialization vector IV, i.e., (I1,I2,...,I64) = (IV1rD1, IV2rD2, ... IV64rD64). The

input block is processed through the DES or Skipjack algorithm in the encrypt state, and the

resulting output block is used as the ciphertext, i.e., (C ,C ,...,C ) = (O ,O ,...,O ). This first 1 2 64 1 2 64

ciphertext block is then exclusive-ORed with the second plaintext data block to produce the

second input block, i.e., (I1,I2,...,I64) = (C1rD1,C2rD2,...,C64rD64). Note that I and D now refer to

the second block. The second input block is processed through the DES or Skipjack algorithm in

the encrypt state to produce the second ciphertext block. This encryption process continues to

"chain" successive cipher and plaintext blocks together until the last plaintext block in the message

is encrypted. If the message does not consist of an integral number of data blocks, then the final

partial data block should be encrypted in a manner specified for the application. One such method

is described in Appendix C of FIPS PUB 81.
9

In CBC decryption (see the lower half of Figure 2.4), the first ciphertext block of an encrypted

message is used as the input block and is processed through the DES or Skipjack algorithm in the

decrypt state, i.e., (I1,I2,...,I64) = (C1,C2,...,C64). The resulting output block, which equals the

original input block to the algorithm during encryption, is exclusive-ORed with the IV (which

must be the same as that used during encryption) to produce the first plaintext block, i.e.,

(D1,D2,...,D64) = (O1rIV1,O2rIV2,...,O64rIV64). The second ciphertext block is then used as the

next input block and is processed through the DES or Skipjack algorithm in the decrypt state. 

The resulting output block is exclusive-ORed with the first ciphertext block to produce the

second plaintext data block, i.e., (D1,D2,...,D64) = (O1rC1, O2rC2,...,O64rC64). (Note D and O

refer to the second block.) The CBC decryption process continues in this manner until the last

complete ciphertext block has been decrypted. Ciphertext representing a partial data block must

be decrypted in a manner as specified for the application.
INPUT BLOCK

(64-K) BITS K BITS

 1 K

ENCRYPT

OUTPUT BLOCK

SELECT DISCARD

K BITS (64-K) BITS

1 K

PLAINTEXT

K BITS

1 K

FEEDBACK

K BITS

INPUT BLOCK

(64-K) BITS K BITS

 1 K

ENCRYPT

OUTPUT BLOCK

SELECT DISCARD

K BITS (64-K) BITS

1 K

CIPHERTEXT

K BITS

1 K 1 K

CIPHERTEXT

K BITS

PLAINTEXT

K BITS

1 K

ENCRYPTION DECRYPTION

SHIFT SHIFT

INPUT BLOCK INITIALLY CONTAINS

AN IV RIGHT JUSTIFIED.

10

Figure 2.5 Cipher Feedback (CFB) Mode

2.3.3 Cipher Feedback (CFB) Mode

The Cipher Feedback (CFB) mode is shown in Figure 2.5. A message to be encrypted is divided

into K-bit data units, where K may equal 1 through 64 inclusively (K = 1,2,...,64). In both the

CFB encrypt and decrypt operations, an initialization vector (IV) of length L is used, where L

may equal 1 through 64 inclusively (L=1,2,...,64). The IV is placed in the least significant bits of

the input block with the unused bits set to "0", i.e., (I ,I ,...,I ) = (0,0,...,0,IV ,IV ,...,IV ). This 1 2 64 1 2 L

input block is processed through the DES or Skipjack algorithm in the encrypt state to produce an

output block. During encryption, ciphertext is produced by exclusive-ORing a K-bit plaintext

data unit with the most significant K bits of the output block, i.e.,(C ,C ,...,C ) = (D rO , D rO , 1 2 K 1 1 2 2

... , D rO ). Similarly, during decryption, plaintext is produced by exclusive-ORing a K-bit unit K K

of ciphertext with the most significant K bits of the output block, i.e., (D1,D2,...,DK) =

(C rO ,C rO ,...,C rO ). In both cases the unused bits of the output block are discarded. For 1 1 2 2 K K

both the encryption and decryption processes, the next input block is created by discarding the

most significant K bits of the previous input block, shifting the remaining bits K positions to the

left and then inserting the K bits of ciphertext just produced in the encryption operation or just

used in the decryption operation into the least significant bit positions, i.e., (I ,I ,...,I ) = (I , 1 2 64 [K+1]

I[K+2], ... , I64,C1,C2, ...CK). This input block is then processed through the DES or Skipjack
11

algorithm in the encrypt state to produce the next output block. This process continues until the

entire plaintext message has been encrypted or until the entire ciphertext message has been

decrypted. For each operation of the DES or Skipjack algorithm, one K-bit unit of plaintext

produces one K-bit unit of ciphertext, and one K-bit unit of ciphertext produces one K-bit unit of

plaintext.
INPUT BLOCK

 64 BITS

 

ENCRYPT

OUTPUT BLOCK

SELECT

K BITS 

1 K

PLAINTEXT

K BITS

1 K

FEEDBACK

64 BITS

INPUT BLOCK

 64 BITS

 

ENCRYPT

OUTPUT BLOCK

SELECT

K BITS 

1 K CIPHERTEXT

K BITS

1 K 1 K

CIPHERTEXT

K BITS

PLAINTEXT

K BITS

1 K

ENCRYPTION DECRYPTION

INPUT BLOCK INITIALLY CONTAINS

AN IV RIGHT JUSTIFIED.

12

Figure 2.6 Output Feedback (OFB) Mode

2.3.4 Output Feedback (OFB) Mode

The Output Feedback (OFB) mode is shown in Figure 2.6. A message to be encrypted is divided

into K-bit data units, where K may equal 1 through 64 inclusively, (K = 1,2,...,64). In both the

OFB encrypt and decrypt operations, an initialization vector (IV) of length L is used, where L

may equal 1 through 64 inclusively, (L=1,2,...,64). The IV is placed in the least significant bits of

the input block with the unused bits set to "0", i.e., (I ,I ,...,I ) = (0,0,...,0,IV ,IV ,...,IV ). This 1 2 64 1 2 L

input block is processed through the DES or Skipjack algorithm in the encrypt state to produce an

output block. During encryption, ciphertext is produced by exclusive-ORing a K-bit plaintext

data unit with the most significant K bits of the output block, i.e., (C ,C ,...,C ) = (D rO , D rO , 1 2 K 1 1 2 2

...,D rO ). Similarly, during decryption, plaintext is produced by exclusive-ORing a K-bit unit of K K

ciphertext with the most significant K bits of the output block, i.e., (D1,D2,...,DK) =

(C rO ,C rO ,...,C rO ). In both cases the next input block is assigned the value of the output 1 1 2 2 K K

block, i.e., (I ,I ,...,I ) = (O ,O , ...,O ). This input block is then processed through the DES or 1 2 64 1 2 64

Skipjack algorithm in the encrypt state to produce the next output block. This process continues
13

until the entire plaintext message has been encrypted or until the entire ciphertext message has

been decrypted. For each operation of the DES or Skipjack algorithm, one K-bit unit of plaintext

produces one K-bit unit of ciphertext or one K-bit unit of ciphertext produces one K-bit unit of

plaintext.

Note that, originally, FIPS 81 allowed less than 64 bits of feedback to be used. It was discovered

that when this is done, there is a risk of generating short cycles. That is, when the same key is

used, and multiple encryptions or decryptions have occurred, then the resulting output block may

be equal to an input block from a previous iteration. If that occurs, then further encryption or

decryption using the same key will result in a repetition of previously generated output and input

blocks. This increases the risk of a cryptanalyst recovering the original plaintext. Because of this

short cycle property, NIST does not support the use of the OFB mode for any amount of

feedback less than 64 bits. Note that this short cycle property is not a problem with the DES

algorithm, and would occur using any block cipher in a similar manner.
14

3. MODES OF OPERATION VALIDATION SYSTEM FOR THE DES AND SKIPJACK

ALGORITHMS

The MOVS for the DES and Skipjack algorithms consists of two types of tests, the Known

Answer tests and the Modes tests. The MOVS provides conformance testing for the individual

components of an IUT of the DES algorithm and analyzes IUTs of the DES and Skipjack

algorithms for apparent operational errors. Note that the individual components of an IUT of the

Skipjack algorithm are not tested by the MOVS since Skipjack is classified.

The IUTs of the DES algorithm may be written in software, firmware, hardware, or any

combination thereof. The IUTs of the Skipjack algorithm must be implemented in electronic

devices (e.g., very large scale integration chips). For the remainder of this document , the word

implementation will reflect the definition pertaining to the algorithm being discussed.

An IUT must allow the MOVS to have control over the required input parameters for validation

to be feasible. The ability to initialize or load known values to the variables required by a specific

test may exist at the device level or the chip level in an IUT. If an IUT does not allow the MOVS

to have control over the input parameter values, the MOVS tests cannot be performed.

An IUT may implement encryption only, decryption only, or both encryption and decryption. 

This will determine which MOVS tests will be performed by an IUT.

The following subsections provide an overview of the Known Answer tests and the Modes tests. 

Also discussed are the various tests required to validate IUTs of the DES and Skipjack

algorithms.

3.1 The Known Answer Tests

The Known Answer tests are based on the standard DES test set discussed in SP500-20. When

applied to IUTs of the DES algorithm, the Known Answer tests verify that the IUT correctly

performs the algorithm. The tests also provide conformance testing for the following components

of an IUT of the DES algorithm: the initial permutation IP, the inverse permutation IP , the -1

expansion matrix E, the data permutation P, the key permutations PC1 and PC2, and the

substitution tables S , S ,...,S . When applied to IUTs of the Skipjack algorithm, these same tests 1 2 8

verify that the implemented algorithm produces the correct results, i.e., given known input, the

correct results are produced.

A generic overview of the sets of Known Answer tests required for the validation of IUTs

implementing the encryption and/or decryption processes of all modes of operation for both the

DES and Skipjack algorithms are discussed below.
15

3.1.1 The Encryption Process

An IUT of the DES algorithm which allows encryption requires the successful completion of five

Known Answer tests. These are the Variable Plaintext Known Answer test, the Inverse

Permutation Known Answer test for the Encryption Process, the Variable Key Known Answer

test for the Encryption Process, the Permutation Operation Known Answer test for the

Encryption Process, and the Substitution Table Known Answer test for the Encryption Process. 

The Permutation Operation and the Substitution Table Known Answer tests do not apply to the

Skipjack algorithm. Therefore, an IUT of the Skipjack algorithm which allows encryption

requires only the successful completion of the Variable Plaintext Known Answer test, the Inverse

Permutation Known Answer test for the Encryption Process, and the Variable Key Known

Answer test for the Encryption Process.

These Known Answer tests are also used in the testing of IUTs implementing the CFB and OFB

modes of operation in the decryption process. The reason for this is that both of these modes

utilize the encrypt state in the decryption process.

3.1.1.1 The Variable Plaintext Known Answer Test

To perform the Variable Plaintext Known Answer test, the MOVS supplies the IUT with initial

values for the plaintext and, if applicable, the initialization vector. These values are dependent

upon the mode of operation being implemented. The key should be initialized to zero. Each

block of data input into the DES or Skipjack algorithm is represented as a 64-bit basis vector. By

definition, a basis vector is a vector consisting of a "1" in the i position and "0" in all of the other th

positions. The input block is processed through the algorithm in the encrypt state. The resulting

output block is used in the calculation of the ciphertext which is then recorded. Each of the basis

vectors is tested. At the completion of the 64 test, all results are verified for correctness. th

If correct results are obtained from an IUT of the DES algorithm, the Variable Plaintext Known

Answer test has verified the initial permutation (IP) and the expansion matrix E by presenting a

full set of basis vectors to the IP and to the E. If the results from each test of an IUT of the

Skipjack algorithm match the expected results, the Skipjack algorithm has been verified. 

3.1.1.2 The Inverse Permutation Known Answer Test for the Encrypt State

To perform the Inverse Permutation Known Answer test, the MOVS supplies the IUT with initial

values for the plaintext and, if applicable, the initialization vector. The plaintext values are set to

the ciphertext results obtained from the Variable Plaintext Known Answer test. 
16

The key being used by this test is called a self dual key. A self dual key is a key with the property

that when you encrypt twice with this key the result is the initial input. Therefore, it is like

encrypting and decrypting with the same key. The key should be initialized to zero, the same

value used in the Variable Plaintext Known Answer test. 

The input block is processed through the algorithm in the encrypt state. The resulting output

block is used in the calculation of the ciphertext which is then recorded. The ciphertext should be

the same as the plaintext used as input to the Variable Plaintext Known Answer test. At the

completion of the 64 test, all results are verified for correctness. th

This test, when applied to an IUT of the DES algorithm, verifies the inverse permutation (IP ) by -1

presenting each basis vector to the IP as the basis vectors are recovered. If the results from each -1

test of an IUT of the Skipjack algorithm match the expected results, the Skipjack algorithm has

been verified. 

3.1.1.3 The Variable Key Known Answer Test for the Encryption Process

To implement the Variable Key Known Answer test for the Encryption Process, the MOVS

supplies the IUT with initial values for the key, the plaintext, and, if applicable, the initialization

vector. During the initialization process, the plaintext and the initialization vector are set to zero. 

The key is initialized to an n-bit vector, where n is 56 if DES is being implemented, and 80 if

Skipjack is being implemented. This vector will contain a "1" in the i significant position and th

"0"s is all remaining significant positions of a key where i = 1 to n. (Note that the parity bits are

not counted in the significant bits. These parity bits may be "1"s or "0"s to maintain odd parity.) 

An input block is then formed according to the mode of the algorithm being implemented, and

encrypted. The resulting output block is used in the calculation of the ciphertext which is

recorded for later comparison. This test is repeated n times, allowing for every possible vector to

be tested. At the completion of the n test, all results are verified for correctness. th

When this test is performed for an IUT of the DES algorithm, the 56 possible basis vectors which

yield unique keys are presented to PC1 verifying the key permutation, PC1. Since the key

schedule consists of left shifts, as i ranges over the index set, a complete set of basis vectors is

presented to PC2 as well, so this is verified. If the results from each test of an IUT of the

Skipjack algorithm match the expected results, the Skipjack algorithm has been verified.

3.1.1.4 The Permutation Operation Known Answer Test for the Encryption Process

The Permutation Operation Known Answer test for the Encryption Process only applies to IUTs

of the DES algorithm. To implement this test, the MOVS supplies the IUT with initial values for

the key, the plaintext and, if applicable, the initialization vector, with the plaintext and

initialization vector being set to zero. Based on the mode of operation of DES implemented, an
17

input block is formed and encrypted. The resulting output block is used in the calculation of the

ciphertext which is recorded for later comparison. This test is repeated 32 times, allowing for 32

given values to be tested. At the completion of the 32 test, all results are verified for nd

correctness.

This test presents a complete set of basis vectors to the permutation operator P. By doing so, P is

verified. 

3.1.1.5 The Substitution Table Known Answer Test for the Encryption Process

The Substitution Table Known Answer test for the Encryption Process only applies to IUTs of

the DES algorithm. The MOVS supplies the IUT with initial values for the key, the plaintext and,

if applicable, the initialization vector which is initialized to zero. Based on the mode of operation

of DES implemented, an input block is formed and encrypted. The resulting output block is used

in the calculation of the ciphertext which is recorded for later comparison. This test is repeated

19 times in order to process a set of 19 key-data pairs. At the completion of the 19 test, all th

results are verified for correctness. 

The set of 19 key-data pairs used in this test result in every entry of all eight S-box substitution

tables being used at least once. Thus, this test verifies the eight substitution tables of 64 entries

each.
18

3.1.2 The Decryption Process

The five Known Answer tests required for validation of IUTs implementing the decryption

process of the DES or Skipjack algorithms consist of the Variable Ciphertext Known Answer test,

the Initial Permutation Known Answer test for the Decryption Process, the Variable Key Known

Answer test for the Decryption Process, the Permutation Operation Known Answer test for the

Decryption Process and the Substitution Table Known Answer test for the Decryption Process. 

These tests can only be performed by IUTs that support the Electronic Codebook (ECB) and the

Cipher Block Chaining (CBC) modes of operation since only these modes of operation utilize the

decrypt state during the decryption process. The CFB and OFB modes of operation utilize the

encrypt state in the decryption process and therefore should be tested using the same Known

Answer tests used for IUTs that support the encryption process. Only the Variable Ciphertext

Known Answer test, the Initial Permutation Known Answer test for the Decryption Process, and

the Variable Key Known Answer test for the Decryption Process apply to the Skipjack algorithm.

3.1.2.1 The Variable Ciphertext Known Answer Test

To perform the Variable Ciphertext Known Answer test, the values of the ciphertext, the key,

and, if applicable, the initialization vector are initialized, with the key and the initialization vector

being initialized to zero. If the IUT performs both encryption and decryption, the values resulting

from the encryption performed in the Variable Plaintext Known Answer test will be used to

initialize the ciphertext. Otherwise, the MOVS will supply the IUT with the ciphertext values. 

The value of the ciphertext is used directly as the input block of data. The input block is

processed through the algorithm in the decrypt state, resulting in an output block. The output

block is used in the calculation of the plaintext which is then recorded. This test is repeated for

64 cycles and should result in a set of 64 different basis vectors. For IUTs of the DES algorithm,

this test verifies the inverse permutation IP by presenting the basis vectors to the IP as they are -1 -1

recovered.

If the Skipjack algorithm is implemented and the IUT produces correct results (i.e., the basis

vectors are recovered), this test ends successfully.

3.1.2.2 The Initial Permutation Known Answer Test for the Decryption Process

To perform the Initial Permutation Known Answer test for the Decryption Process, the values of

the ciphertext are set to the resulting plaintext values obtained from the Variable Ciphertext

Known Answer test. The key, and, if applicable, the initialization vector are set to the same

values used in the Variable Ciphertext Known Answer test, i.e., they are set to zero.

The value of the ciphertext is used directly as the input block of data. The input block is
19

processed through the algorithm in the decrypt state, resulting in an output block. The output

block is used in the calculation of the plaintext which is then recorded. This test is repeated for

64 cycles and should result in the set of ciphertext values used as input to the Variable Ciphertext

Known Answer test. 

For IUTs of the DES algorithm, the initial permutation IP and the expansion matrix E are verified

by presenting the full set of basis vectors to both of them.

If the Skipjack algorithm is implemented and the IUT produces correct results (i.e., the basis

vectors are recovered), this test ends successfully.

3.1.2.3 The Variable Key Known Answer Test for the Decryption Process

To implement the Variable Key Known Answer test for the Decryption Process, the values of the

ciphertext, key, and, if applicable, the initialization vector are initialized. The ciphertext is

initialized in one of two ways. If the IUT performs both encryption and decryption, the values

resulting from the encryption performed in the Variable Key Known Answer test for the

Encryption Process will be used to initialize the ciphertext. Otherwise, the IUT will obtain the

ciphertext values from the MOVS. The IV is set to zero. The key is initialized to an n-bit vector,

where n is 56 if DES is being implemented and 80 if Skipjack is being implemented. This vector

will contain a "1" in the i significant position and "0"s is all remaining significant positions of a th

key where i = 1 to n. (Note that the parity bits are not counted in the significant bits. These

parity bits may be "1"s or "0"s to maintain odd parity.) 

The value of the ciphertext is used directly as the input block of data. The input block is

processed through the algorithm in the decrypt state. According to the mode of operation

supported by the IUT, the resulting output block is used in the calculation of the plaintext which

is recorded for later comparison. This test is repeated n times allowing for every possible vector

to be tested. At the completion of the n test, all results are verified against known values for th

correctness. If the results are correct for an IUT of the DES algorithm, it can be assumed that

this test verifies the right shifts in the key schedule as the basis vectors are recovered. 

If the results from each test of an IUT of the Skipjack algorithm match the expected results, the

Skipjack algorithm has been verified.

3.1.2.4 The Permutation Operation Known Answer Test for the Decryption Process

The Permutation Operation Known Answer test for the Decryption Process only applies to IUTs

of the DES algorithm. To implement this test, values for the key and ciphertext are supplied in

one of two ways. If the IUT performs both encryption and decryption, values for the key and

ciphertext resulting from the encryption performed in the Permutation Operation Known Answer
20

test for the Encryption Process will be used. Otherwise, the key and ciphertext values will be

supplied by the MOVS. If applicable, the initialization vector will be set to zero. 

The value of the ciphertext is used directly as the input block of data. The input block is

processed through the algorithm in the decrypt state. According to the mode of operation

supported by the IUT, the resulting output block is used in the calculation of the plaintext which

is recorded for later comparison. This test is repeated 32 times allowing for the 32 key-ciphertext

values to be tested. At completion, the results of each of the 32 tests is verified to be zero. 

The 32 key values used in this test present a complete set of basis vectors to the permutation

operator P. By doing so, P is verified.

3.1.2.5 The Substitution Table Known Answer Test for the Decryption Process

The Substitution Table Known Answer test for the Decryption Process only applies to IUTs of

the DES algorithm. To implement this test, values for the key and ciphertext are supplied in one

of two ways. If the IUT performs both encryption and decryption, the values for the key and

ciphertext resulting from the encryption performed in the Substitution Table Known Answer test

for the Encryption Process will be used. Otherwise, the key and ciphertext values will be supplied

by the MOVS. If applicable, the initialization vector will be set to zero. 

The value of the ciphertext is used directly as the input block of data. This input block is

processed through the algorithm in the decrypt state. Based on the mode of operation

implemented by the IUT, the resulting output block is used in the calculation of the plaintext

which is recorded for later comparison. This test is repeated 19 times in order to process the set

of 19 key-data pairs that result in every entry of all eight substitution tables being used at least

once. At the completion of the 19 test, all results are verified for correctness. If the IUT th

produces correct results, the eight S-box substitution tables of 64 entries each have been verified.

3.2 The Modes Test

The Modes test is the second type of validation test required to validate IUTs of the DES and

Skipjack algorithms. The Modes test is based on the Monte-Carlo test discussed in SP500-20. 

They are designed to use pseudo-random data to verify that the IUT has not been designed just to

pass the Known Answer tests. A successful series of Modes tests gives some assurance that an

anomalous combination of inputs does not exist that would cause the test to end abnormally for

reasons not directly related to the implementation of the algorithm. An additional purpose of the

Modes test is to verify that no undesirable condition within the IUT will cause the key or plaintext

to be exposed due to an implementation error. This test also checks for the presence of an

apparent operational error.
21

The MOVS supplies the IUT with initial input values for the key, the plaintext (or ciphertext),

and, if applicable, an initialization vector. The Modes test is then performed (as described in the

following paragraph) and the resulting ciphertext (or plaintext) values are recorded and compared

to known results. If an error is detected, the erroneous result is recorded, and the test terminates

abnormally. Otherwise, the test continues. If the IUT's results are correct, the Modes test for the

IUT ends successfully.

Each Modes test consists of four million cycles through the DES or Skipjack algorithm

implemented in the IUT. These cycles are divided into four hundred groups of 10,000 iterations

each. Each iteration consists of processing an input block through the DES or Skipjack algorithm

resulting in an output block. At the 10,000 cycle in an iteration, new values are assigned to the th

variables needed for the next iteration. The results of each 10,000 encryption or decryption th

cycle are recorded and evaluated as specified in the preceding paragraph.
22

4. BASIC PROTOCOL 

4.1 Overview

Input and output messages used to convey information between the MOVS and the IUT shall

consist of specific fields. The format of these input and output messages is beyond the scope of

this document and the testing laboratories have the option to determine the specific formats of

those messages. However, the results sent to NIST must include certain minimum information,

which is specified in Section 4.4 Output Types. 

A separate message shall be created for each mode of operation supported by an IUT. The

information shall indicate the algorithm used (DES or Skipjack), the mode of operation (ECB,

CBC, CFB-including feedback amounts, or OFB), the state (encrypt and/or decrypt), the test

being performed (one of the various Known Answer tests, or the Modes tests), and the required

data fields. The required data may consist of counts, keys, initialization vectors, and data

representing plaintext or ciphertext. Every field in an output message shall be clearly labeled to

indicate its contents - this is especially important for NIST to be able to ensure that test results are

complete.

4.1.1 Conventions

The following conventions shall be used in the data portion of messages between the MOVS and

the IUT:

1. Integers: integers shall be unsigned and shall be represented in decimal notation. 

(See Section 4.1.2 for these notations.)

2. Hexadecimal strings: shall consist of ASCII hexadecimal characters. The ASCII

hexadecimal characters to be used shall consist of the ASCII characters 0-9 and AF (or a-f), which represent 4-bit binary values.

3. Characters: the characters to be represented are A-Z (or a-z), 0-9, and underscore

(_).

 

4.1.2 Message Data Types

The following data types shall be used in messages between the MOVS and the IUT:

1. Decimal integers: a decimal integer shall have the form

ddd ... dd
23

where each 'd' shall represent a decimal character (0-9); one or more characters

shall be present. The characters must be contiguous.

2. Hexadecimal strings: a hexadecimal string shall have the form

hhh ... hh

where each 'h' shall represent an ASCII character 0-9 or A-F (or a-f). Each 'h'

shall represent a 4-bit binary value.

3. Characters: an ASCII character shall have the form

c

where 'c' shall represent an ASCII character A-Z (or a-z), 0-9, and underscore (_).

4.2 Message Contents

The information included in a message shall consist of the following:

Algorithm - selections shall consist of DES or Skipjack,

Mode - selections shall consist of ECB, CBC, CFB-including feedback amounts,

or OFB,

Process - selections shall consist of ENCRYPT or DECRYPT, 

Test - selections shall consist of: 

VTEXT for Variable Plaintext/Ciphertext Known Answer test

VKEY for Variable Key Known Answer test

INVPERM for Inverse Permutation Known Answer test

INITPERM for Initial Permutation Known Answer test

PERM for Permutation Operation Known Answer test

SUB for Substitution Table Known Answer test

MODES for Modes test

Input/Output Data

The contents of the input/output data included in a message shall depend on the algorithm, mode,

process, and test being performed. These different combinations of data have been organized into

input types and output types. The input types shall be used by the MOVS to supply data to the

IUT for testing. The output types shall be used by the IUT to supply results from the tests to the

MOVS, and eventually to NIST.
24

4.3 Input Types

Twelve different combinations of input data shall be used by the MOVS to support the various

Known Answer tests and Modes tests .

4.3.1 Input Type 1

Input Type 1 shall consist of:

KEY and DATA

where KEY shall be represented as k bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). If the IUT implements the DES algorithm, the KEY shall consist

of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be present but

ignored, yielding 56 significant bits. For consistency purposes, the DES key shall be

presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY shall

consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check parity,

thus every bit in the key is significant; and 

DATA shall be a 16 character ASCII hexadecimal string representing plaintext if the

encrypt process is being tested, or ciphertext if the decrypt process is being tested.

4.3.2 Input Type 2

Input Type 2 shall consist of:

KEY,IV, and DATA

where KEY shall be represented as k bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). If the IUT implements the DES algorithm, the KEY shall consist

of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be present but

ignored, yielding 56 significant bits. For consistency purposes, the DES key shall be

presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY shall

consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check parity,

thus every bit in the key is significant;

IV shall be a 16 character ASCII hexadecimal string representing the 64-bit initialization

vector; and

DATA shall be 1 to 64 binary bits represented as a 16 character ASCII hexadecimal string

representing plaintext if the encrypt process is being tested, or ciphertext if the decrypt
25

process is being tested.

4.3.3 Input Type 3

Input Type 3 shall consist of:

KEY,n,CT1,CT2,...CTn

where KEY shall be represented as k bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). If the IUT implements the DES algorithm, the KEY shall consist

of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be present but

ignored, yielding 56 significant bits. For consistency purposes, the DES key shall be

presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY shall

consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check parity,

thus every bit in the key is significant;

n is an integer which shall indicate the number of ciphertext (CT) values to follow; and

each CT shall be 1 to 64 binary bits represented as a 16 character ASCII hexadecimal n

string.

4.3.4 Input Type 4

Input Type 4 shall consist of:

KEY

where KEY shall be represented as k bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). If the IUT implements the DES algorithm, the KEY shall consist

of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be present but

ignored, yielding 56 significant bits. For consistency purposes, the DES key shall be

presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY shall

consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check parity,

thus every bit in the key is significant.

4.3.5 Input Type 5

Input Type 5 shall consist of:

KEY,IV,n,TEXT1,TEXT2,...TEXTn
26

where KEY shall be represented as k bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). If the IUT implements the DES algorithm, the KEY shall consist

of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be present but

ignored, yielding 56 significant bits. For consistency purposes, the DES key shall be

presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY shall

consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check parity,

thus every bit in the key is significant;

IV shall be a 16 character ASCII hexadecimal string representing the 64-bit initialization

vector;

n is an integer which shall indicate the number of TEXT values to follow; and

each TEXT shall be 1 to 64 binary bits represented as a 16 character ASCII hexadecimal n

string. TEXT shall represent PT, CT, or RESULT.

4.3.6 Input Type 6

Input Type 6 shall consist of:

KEY and IV

where KEY shall be represented as k bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). If the IUT implements the DES algorithm, the KEY shall consist

of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be present but

ignored, yielding 56 significant bits. For consistency purposes, the DES key shall be

presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY shall

consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check parity,

thus every bit in the key is significant; and 

IV shall be a 16 character ASCII hexadecimal string representing the 64-bit initialization

vector.

4.3.7 Input Type 7

Input Type 7 shall consist of

PT,KEY1,KEY2,...KEY32

where PT shall be 1 to 64 binary bits represented as a 16 character ASCII hexadecimal

string; and
27

each KEYi, where i=1 to 32, shall be represented as k bits in hexadecimal notation (i.e., 4

bits per hexadecimal character). If the IUT implements the DES algorithm, the KEY shall

consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be

present but ignored, yielding 56 significant bits. For consistency purposes, the DES key

shall be presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY

shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check

parity, thus every bit in the key is significant.

4.3.8 Input Type 8

Input Type 8 shall consist of:

TEXT,IV,KEY1,KEY2,...KEY32

where TEXT shall be 1 to 64 binary bits represented as a 16 character ASCII hexadecimal

string. (NOTE: TEXT may be referred to as plaintext or text.); 

IV shall be a 16 character ASCII hexadecimal string representing the 64-bit initialization

vector; and

each KEYi, where i=1 to 32, shall be represented as k bits in hexadecimal notation (i.e., 4

bits per hexadecimal character). If the IUT implements the DES algorithm, the KEY shall

consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be

present but ignored, yielding 56 significant bits. For consistency purposes, the DES key

shall be presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY

shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check

parity, thus every bit in the key is significant.

4.3.9 Input Type 9

Input Type 9 supplies n key/input block pairs. It shall consist of:

n,PAIR1,PAIR2,...PAIRn

In this input type, the integer n shall indicate the number of KEY values to follow. Each

PAIR shall consist of: i

KEYi and TEXTi

where each KEYi, where i=1 to n, shall be represented as k bits in hexadecimal notation

(i.e., 4 bits per hexadecimal character). If the IUT implements the DES algorithm, the

KEY shall consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits
28

shall be present but ignored, yielding 56 significant bits. For consistency purposes, the

DES key shall be presented in odd parity. If the IUT implements the Skipjack algorithm,

the KEY shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does

not check parity, thus every bit in the key is significant; and

each TEXTi, for i = 1 to n, shall be a 16 character ASCII hexadecimal string representing

either plaintext or ciphertext.

4.3.10 Input Type 10

Input Type 10 shall consist of:

n,KEY1,KEY2,...KEYn

where n is an integer which shall indicate the number of KEY values to follow; and

each KEYi, where i=1 to n, shall be represented as k bits in hexadecimal notation (i.e., 4

bits per hexadecimal character). If the IUT implements the DES algorithm, the KEY shall

consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be

present but ignored, yielding 56 significant bits. For consistency purposes, the DES key

shall be presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY

shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check

parity, thus every bit in the key is significant.

4.3.11 Input Type 11

Input Type 11 shall consist of:

INITVAL,n,PAIR1,PAIR2,...PAIRn

where INITVAL shall be a 16 character ASCII hexadecimal string representing either the

64 bit IV or the TEXT, depending on the mode of operation implemented by the IUT. 

(NOTE: The TEXT may be referred to as plaintext, ciphertext, or text.);

n is an integer which shall indicate the number of KEY/INPUT PAIRs to follow.

Each PAIR shall consist of: i

KEYi and IBi

where each KEYi, where i=1 to n, shall be represented as k bits in hexadecimal notation

(i.e., 4 bits per hexadecimal character). If the IUT implements the DES algorithm, the
29

KEY shall consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits

shall be present but ignored, yielding 56 significant bits. For consistency purposes, the

DES key shall be presented in odd parity. If the IUT implements the Skipjack algorithm,

the KEY shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does

not check parity, thus every bit in the key is significant; and

each IB shall be a 16 character ASCII hexadecimal string representing either the 64 bit i

IV, PT or CT, depending on the mode of operation implemented.

4.3.12 Input Type 12

Input Type 12 shall consist of:

INITVAL,n,KEY1,KEY2,...KEYn

where INITVAL shall be a 16 character ASCII hexadecimal string representing either the

64 bit IV or the 64 bit TEXT depending on the mode of operation implemented by the

IUT. (NOTE: The TEXT may be referred to as ciphertext.);

n is an integer which shall indicate the number of KEYS to follow; and

each KEYi, where i=1 to n, shall be represented as k bits in hexadecimal notation (i.e., 4

bits per hexadecimal character). If the IUT implements the DES algorithm, the KEY shall

consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). The 8 parity bits shall be

present but ignored, yielding 56 significant bits. For consistency purposes, the DES key

shall be presented in odd parity. If the IUT implements the Skipjack algorithm, the KEY

shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does not check

parity, thus every bit in the key is significant.

4.4 Output Types

Two different combinations of output data are used by the MOVS to support the various Known

Answer tests and Modes tests. 

4.4.1 Output Type 1

Output Type 1 shall consist of:

COUNT,KEY,DATA, and RESULT

where COUNT shall be an integer between 1 and 400, i.e., 0 < COUNT <= 400,

representing the output line;
30

KEY shall be represented as k bits in hexadecimal notation. If the IUT implements the

DES algorithm, the KEY shall consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). 

The parity bits shall be ignored, yielding 56 significant bits. For consistency purposes, the

DES key shall be displayed in odd parity. If the IUT implements the Skipjack algorithm,

the KEY shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does

not check parity, thus every bit in the key is significant;

DATA shall be a 16 character hexadecimal string representing plaintext if the encrypt

process is being tested or ciphertext if the decrypt process is being tested; and

RESULT shall be a 16 character hexadecimal string indicating the resulting value.

Depending on the process of the IUT being tested, the resulting value shall represent

ciphertext (if encrypting) or plaintext (if decrypting).

4.4.2 Output Type 2

Output Type 2 shall consist of:

COUNT,KEY,CV,DATA, and RESULT

where COUNT shall be an integer between 1 and 400, i.e., 0 < COUNT <= 400,

representing the output line;

KEY shall be represented as k bits in hexadecimal notation. If the IUT implements the

DES algorithm, the KEY shall consist of 16 hexadecimal characters (i.e., 64 bits, k = 64). 

The parity bits shall be ignored, yielding 56 significant bits. For consistency purposes, the

DES key shall be displayed in odd parity. If the IUT implements the Skipjack algorithm,

the KEY shall consist of 20 hexadecimal characters (i.e. 80 bits, k = 80). Skipjack does

not check parity, thus every bit in the key is significant;

 CV shall be a 16 character ASCII hexadecimal string;

DATA shall be a 16 character hexadecimal string representing plaintext if the encrypt

process is being tested or ciphertext if the decrypt process is being tested.; and

RESULT shall be a 16 character hexadecimal string indicating the resulting value.

Depending on the process of the IUT being tested, the resulting value may be ciphertext

(if encrypting) or plaintext (if decrypting).
31

5. TESTS REQUIRED TO VALIDATE AN IMPLEMENTATION OF THE DES OR

SKIPJACK ALGORITHM

The validation of IUTs of the DES and Skipjack algorithms shall require the successful

completion of an applicable set of Known Answer tests and the successful completion of the

appropriate Modes tests. The tests required for validation of an IUT shall be determined by

several factors. These include the algorithm implemented (DES or Skipjack), the mode(s) of

operation supported ( ECB, CBC, CFB, OFB), and the allowed cryptographic processes

(encryption, decryption, both). 

A separate set of Known Answer tests has been designed for use with each of the four modes of

DES and Skipjack. Within these sets of tests are separate subsets of tests corresponding to the

encrypt and decrypt processes. If an IUT implements multiple modes of operation but does not

implement the ECB mode, each supported mode of operation shall be tested. If an IUT

implements multiple modes of operation which does include the ECB mode, the set of Known

Answer tests corresponding to the implemented cryptographic state of the ECB mode of

operation shall be the only set of Known Answer tests conducted. The reasoning behind this is

that other modes of operation implemented should follow the same logic as that for the ECB

mode of operation.

The Modes tests have been designed for use with each of the four modes of DES and Skipjack. 

For the ECB, CBC, and CFB modes of operation, there are two tests associated with each: one to

be used for IUTs allowing the encryption process and the other to be used for IUTs allowing the

decryption process. If both the encryption and decryption processes are allowed by an IUT, both

tests shall be required. The OFB mode of operation only requires one Modes test which is

designed for use with both the encryption and decryption processes of an IUT. For example, if an

IUT implements the CBC mode of operation in the encryption process only, the Modes test for

the encryption process of the CBC mode of operation shall be successfully completed to validate

the IUT. Likewise, if an IUT implements both the encryption and decryption processes of the

CFB mode of operation, both the Modes test for the CFB encryption process and the Modes test

for the CFB decryption process shall be successfully completed to validate the IUT. If an IUT

implements both the encryption and decryption processes of the OFB mode of operation, the

Modes test for the OFB mode of operation shall be successfully completed to validate the IUT. 

If an IUT of the DES or Skipjack algorithm supports more than one mode of operation, the

Modes test corresponding to each supported mode shall be performed successfully. For example,

if an IUT implements the ECB and CBC modes of operation for the encryption process, the

Modes test for the encryption process of the ECB mode of operation and the Modes test for the

encryption process of the CBC mode of operation shall be successfully completed to validate the

IUT.
32

The tests required to successfully validate IUTs of the DES and Skipjack algorithms are detailed

in the following sections. These sections are categorized by mode of operation. Within each

mode of operation, the tests are divided into tests to use with the encryption process and tests to

use with the decryption process. 
33

5.1 Electronic Codebook (ECB) Mode

The IUTs of the DES or Skipjack algorithm in the Electronic Codebook (ECB) mode shall be

validated by the successful completion of a series of Known Answer tests and Modes tests

corresponding to the cryptographic processes allowed by the IUT. 

5.1.1 Encryption Process

The process of validating an IUT of the DES algorithm which implements the encryption process

of the ECB mode of operation shall involve the successful completion of the following six tests:

1. The Variable Plaintext Known Answer Test - ECB mode

2. The Inverse Permutation Known Answer Test for the Encryption Process - ECB mode

3. The Variable Key Known Answer Test for the Encryption Process - ECB mode

4. The Permutation Operation Known Answer Test for the Encryption Process - ECB

mode

5. The Substitution Table Known Answer Test for the Encryption Process - ECB mode 

6. The Modes Test for the Encryption Process - ECB mode

The validation process for an IUT of the Skipjack algorithm which implements the encryption

process of the ECB mode of operation shall require the successful completion of tests 1,2,3, and 6

only.

An explanation of the tests follows.
34

MOVS: Initialize KEY: If DES, KEY=0101010101010101 (odd parity set)

If Skipjack, KEY=00000000000000000000

PT1 = 8000000000000000

Send KEY, PT1

IUT: FOR i = 1 to 64

 {

IBi = PTi

Perform algorithm in encrypt state, resulting in CTi

Send i, KEY, PTi, CTi

PTi+1 = basis vector where single "1" bit is in position I+1

 }

MOVS: Compare results from each loop with known answers

If DES, use Appendix B, Table 1. If Skipjack, use Appendix B, Table 5.

Figure 5.1 The Variable Plaintext Known Answer Test - ECB Mode

5.1.1.1 The Variable Plaintext Known Answer Test - ECB Mode

Figure 5.1 illustrates the Variable Plaintext Known Answer test for the ECB mode of operation.

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant hex

bits are set to "0" and the parity bits are set to "1" to make odd parity. 

For IUTs of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the 64 bit plaintext PT to the basis vector containing a "1" in the first bit 1

position and "0" in the following 63 positions, i.e., PT1 bin = 10000000 00000000

00000000 00000000 00000000 00000000 00000000 00000000. The equivalent

of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

 

c. Forward this information to the IUT using Input Type 1.

2. The IUT shall perform the following for i=1 through 64:

a. Set the input block IBi equal to the value of PTi, i.e, (IB1i,IB2i,...IB64i) =

(PT1 ,PT2 ,...,PT64 ). i i i
35

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in ciphertext CT. i

c. Forward the current values of the loop number i, KEY, PTi, and the resulting CTi

to the MOVS as specified in Output Type 1.

d. Retain CTi for use with the Inverse Permutation Known Answer test for the ECB

Mode (Section 5.1.1.2), and, if the IUT supports the decryption process, for use

with the Variable Ciphertext Known Answer test for the ECB Mode (Section

5.1.2.1). 

e. Assign a new value to PTi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i+1=2..64. 

NOTE: This continues until every possible basis vector has been represented by the PT,

i.e. 64 times. The output from the IUT shall consist of 64 output strings. Each output

string shall consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 1 for DES or Table 5 for Skipjack.
36

MOVS: Initialize KEY: If DES, KEY=0101010101010101 (odd parity set)

If Skipjack, KEY=00000000000000000000

PTi (where i=1-64) = 64 CT values from the Variable Plaintext Known

Answer test

Send KEY, 64, PT1 ... PT64

IUT: FOR i = 1 to 64

 {

IBi = PTi

Perform algorithm in encrypt state, resulting in CTi

Send i, KEY, PTi, CTi

PTi+1 = corresponding PTi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers.

Should be the set of basis vectors.

Figure 5.2 The Inverse Permutation Known Answer Test - ECB Mode

5.1.1.2 The Inverse Permutation Known Answer Test - ECB Mode

Figure 5.2 illustrates the Inverse Permutation Known Answer test for the ECB mode of operation.

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant hex

bits are set to "0" and the parity bits are set to "1" to make odd parity. 

For IUTs of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the 64 bit plaintext values PTi (where i=1- 64) to the CTi results obtained

from the Variable Plaintext Known Answer test.

 

c. Forward this information to the IUT using Input Type 3.

2. The IUT shall perform the following for i=1 through 64:

a. Set the input block IBi equal to the value of PTi, i.e, (IB1i,IB2i,...IB64i) =

(PT1 ,PT2 ,...,PT64 ). i i i
37

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in ciphertext CT. i

c. Forward the current values of the loop number i, KEY, PTi, and the resulting CTi

to the MOVS as specified in Output Type 1.

d. Assign a new value to PTi+1 by setting it equal to the corresponding output from

the Variable Plaintext Known Answer test for the ECB mode. 

NOTE: The output from the IUT shall consist of 64 output strings. Each output string

shall consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. The CT values should be the set of basis vectors.
38

MOVS: Initialize KEY : If DES, KEY = 8001010101010101 (with odd parity) 1 1

If Skipjack, KEY1 = 80000000000000000000

PT=0000000000000000

Send KEY1, PT

IUT: FOR i= 1 to n, where n = 64 if DES, 80 if Skipjack

 {

IF (algorithm == SKIPJACK) {process every bit} 

OR

 (algorithm == DES AND I %8 != 0)

{process every bit except parity bits}

 {

IBi = PT

Perform algorithm in encrypt state using KEYi, resulting in CTi

Send i, KEYi, PT, CTi

KEYi+1 = vector consisting of "0" in every significant bit position

except for a single "1" bit in position i+1. Each parity bit may have

the value "1" or "0" to make the KEY odd parity.

 }

 }

MOVS: Compare results of the n encryptions with known answers

For DES, use Appendix B, Table 2. For Skipjack, use Appendix B, Table 6.

Figure 5.3 The Variable Key Known Answer Test for the Encryption Process- ECB

Mode

5.1.1.3 The Variable Key Known Answer Test for the Encryption Process - ECB Mode

As summarized in Figure 5.3, the Variable Key Known Answer test for the ECB Encryption

Process shall be performed as follows:

1. The MOVS shall:

a. Initialize the KEY1 to contain "0" in every significant bit except for a "1" in the

first position. For example, if validating an IUT of the DES algorithm, the 64 bit

KEY1 bin = 10000000 00000001 00000001 00000001 00000001 00000001

00000001 00000001. The equivalent of this value in hexadecimal notation is 80

01 01 01 01 01 01 01. Note that the parity bits are set to "0" or "1" to get odd

parity.

If validating an IUT of the Skipjack algorithm, the 80 bit KEY1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000 00000000. The equivalent of this value in hexadecimal notation is 80
39

00 00 00 00 00 00 00 00 00.

b. Initialize the 64 bit plaintext PT to the value of 0, i.e., PThex=00 00 00 00 00 00 00

00. 

c. Forward this information to the IUT using Input Type 1.

2. The IUT shall perform the following for i= 1 to n: (NOTE: n equals the number of

significant bits in a DES or Skipjack key.)

a. Set the input block IBi equal to the value of PT, i.e, (IB1i,IB2i,...IB64i) =

(PT1,PT2,...,PT64). 

b. Using the corresponding KEYi, process IBi through the DES or Skipjack algorithm

in the encrypt state, resulting in ciphertext CT. i

c. Forward the current values of the loop number i, KEYi, PT, and the resulting CTi

to the MOVS as specified in Output Type 1.

d. If the IUT supports the decryption process, retain CTi for use with the Variable

Key Known Answer test for the Decryption Process for the ECB Mode (Section

5.1.2.3). 

e. Set KEYi+1 equal to the vector consisting of "0" in every significant bit position

except for a single "1" bit in position i+1. The parity bits may contain "1" or "0" to

make odd parity. 

NOTE: The above processing continues until every significant basis vector has been

represented by the KEY parameter. The output from the IUT for this test shall consist of

56 output strings if DES is implemented and 80 output strings if Skipjack is implemented. 

Each output string shall consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 2 for DES, or Table 6 for Skipjack.
40

MOVS: Initialize KEYi (where i= 1-32) = 32 KEY values in Appendix B, Table 3

 PT = 0000000000000000

Send PT, 32, KEY1, KEY2....,KEY32

IUT: FOR i = 1 to 32

 {

IBi = PTi

Perform DES algorithm in encrypt state using KEYi, resulting in CTi

Send i, KEYi, PT, CTi

KEYi+1 = KEYi+1 from MOVS

 }

MOVS: Compare results with known answers

Figure 5.4 The Permutation Operation Known Answer Test for the Encryption Process -

ECB Mode

5.1.1.4 Permutation Operation Known Answer Test for the Encryption Process - ECB

Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

Figure 5.4 illustrates the Permutation Operation Known Answer test for the ECB Encryption

Process.

1. The MOVS shall:

a. Initialize the KEY with the 32 constant KEY values from Appendix B, Table 3.

b. Initialize the plaintext PT to the value of 0, i.e., PT = 00 00 00 00 00 00 00 00. hex

c. Forward this information to the IUT using Input Type 7.

2. The IUT shall perform the following for i= 1 to 32:

a. Set the input block IBi equal to the value of PT, i.e, (IB1i,IB2i,...IB64i) =

(PT1,PT2,...,PT64). 

b. Using the corresponding KEYi, process IBi through the DES algorithm in the
41

encrypt state, resulting in ciphertext CT. i

c. Forward the current values of the loop number i, KEYi, PT, and the resulting CTi

to the MOVS as specified in Output Type 1. 

d. If the IUT supports the decryption process, retain CTi for use with the Permutation

Operation Known Answer test for the Decryption Process for the ECB mode

(Section 5.1.2.4).

e. Set KEY equal to the next KEY supplied by the MOVS. i+1

NOTE: The above processing shall continue until all 32 KEY values are processed. The

output from the IUT for this test shall consist of 32 output strings. Each output string

shall consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 3.
42

MOVS: Initialize KEYi (where i=1-19) = 19 KEY values in Appendix B, Table 4

PTi (where i=1-19) = 19 corresponding PT values in Table 4

Send 19, KEY1, PT1, KEY2, PT2,..., KEY19, PT19

IUT: FOR i= 1 to 19

 {

IBi = PT

Perform DES algorithm in encrypt state resulting in CTi

Send i, KEYi, PTi, CTi

KEYi+1 = KEYi+1 from MOVS

PTi+1 = PTi+1 from MOVS

 }

MOVS: Compare results with known answers

Figure 5.5 The Substitution Table Known Answer Test for the Encryption

Process - ECB Mode

5.1.1.5 Substitution Table Known Answer Test for the Encryption Process - ECB Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

As summarized in Figure 5.5, the Substitution Table Known Answer test for the ECB Encryption

Process shall be performed as follows:

1. The MOVS shall:

a. Initialize the KEY-plaintext (KEY-PT) pairs with the 19 constant KEY-PT values

from Appendix B, Table 4.

b. Forward this information to the IUT using Input Type 9.

2. The IUT shall perform the following for i= 1 to 19:

a. Set the input block IBi equal to the value of PTi, i.e, (IB1i,IB2i,...IB64i) =

(PT1 ,PT2 ,...,PT64 ). i i i

b. Using the corresponding KEYi, process IBi through the DES algorithm in the

encrypt state, resulting in ciphertext CT. i

c. Forward the current values of the loop number i, KEYi, PTi, and the resulting CTi

to the MOVS as specified in Output Type 1. 
43

d. If the IUT supports the decryption process, retain CTi for use with the Substitution

Table Known Answer test for the Decryption Process for the ECB mode (Section

5.1.2.5).

e. Set KEY equal to the next KEY supplied by MOVS. i+1

f. Set PT equal to the corresponding PT supplied by MOVS. i+1

NOTE: The above processing shall continue until all 19 KEY-PT pairs are processed. 

The output from the IUT for this test shall consist of 19 output strings. Each output

string shall consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 4.
44

MOVS: Initialize KEY0, PT0

Send KEY0, PT0

IUT: FOR i= 0 TO 399

 {

Record i, KEYi, PT0

FOR j = 0 TO 9,999

 {

IBj = PTj

Perform algorithm in encrypt state, resulting in CTj

PTj+1 = CTj

 }

Record CTj

Send i, KEYi, PT0, CTj

KEYi+1= KEYi r last n bits of CT, where n=64 if DES, n=80 if Skipjack

PT0 = CT9999

 }

MOVS: Check IUT's output for correctness

Figure 5.6 The Modes Test for the Encryption Process - ECB Mode 

5.1.1.6 Modes Test for the Encryption Process - ECB Mode

As summarized in Figure 5.6, the Modes test for the ECB Encryption Process shall be performed

as follows:

1. The MOVS shall:

a. Initialize the KEY and plaintext PT variables. The PT shall consist of 64 bits,

while the KEY length shall be dependent on the algorithm implemented by the

IUT.

b. Forward this information to the IUT using Input Type 1.

2. The IUT shall perform the following for i= 0 through 399:

a. Record the current values of the outer loop number i, KEY , and PT .

i 0
45

b. Perform the following for j=0 through 9999:

I. Set the input block IB equal to the value of PT , i.e., (IB1 , IB2 , ..., IB64 ) j j j j j

= (PT1 , PT2 ,..., PT64 ). j j j

ii. Process IBj through the DES or Skipjack algorithm in the encrypt state

resulting in CT. j

iii. Prepare for loop j+1 by assigning PT with the current value of CT , i.e., j+1 j

(PT1 , PT2 , ... PT64 ) = (CT1 , CT2 , ..., CT64 ). j+1 j+1 j+1 j j j

c. Record CT . j

d. Forward all recorded information for this loop, as specified in Output Type 1, to

the MOVS.

e. Assign a new value to KEY in preparation for the next outer loop. The new KEY

shall be calculated by exclusive-ORing the current KEY with the current CT. For

IUTs of the DES algorithm, this shall equate to (KEY1 , KEY2 , ... KEY64 ) i+1 i+1 i+1

= (KEY1rCT1 , KEY2rCT2 , ... KEY64rCT64 ). i 9999 i 9999 i 9999

For IUTs of the Skipjack algorithm, CT shall be expanded in length to 80 bits (the

length of a Skipjack key) before the new KEY can be formed. This expansion

shall be accomplished by concatenating the 16 rightmost bits of the previous CT

(CT9998) with the 64 bits of the current CT (CT9999). This value shall then be

exclusive-ORed with the current KEY to form the new KEY, i.e., (KEY1 ,

i+1

KEY2 , ... KEY80 ) = (KEY1rCT49 , KEY2rCT50 , ... i+1 i+1 i 9998 i 9998

KEY16rCT64 , KEY17rCT1 , KEY18rCT2 , ... KEY80rCT64 ). i 9998 i 9999 i 9999 i 9999

f. Assign a new value to PT in preparation for the next outer loop. PT0 shall be

assigned the value of the current CT, i.e., (PT1 , PT2 ,...,PT64 ) = (CT1 , 0 0 0 9999

CT29999,...,CT649999). (Note that the new PT shall be denoted as PT0 to be used

for the first pass through the inner loop when j=0.) 

NOTE: The output from the IUT for this test shall consist of 400 output strings. Each

output string shall consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
46

5.1.2 Decryption Process

The process of validating an IUT for the ECB mode of the DES algorithm which implements the

decryption process shall involve the successful completion of the following six tests:

1. The Variable Ciphertext Known Answer Test

2. The Initial Permutation Known Answer Test

3. The Variable Key Known Answer Test for the Decryption Process

4. The Permutation Operation Known Answer Test for the Decryption Process

5. The Substitution Table Known Answer Test for the Decryption Process 

6. The Modes Test for the Decryption Process

The validation process for an IUT of the Skipjack algorithm using the ECB mode of operation in

the decryption process shall require the successful completion of tests 1, 2, 3, and 6 only.

An explanation of the tests follows.
47

MOVS: Initialize KEY: If DES, KEY=0101010101010101 (odd parity set)

If Skipjack, KEY=00000000000000000000

If encryption is supported by IUT: 

Send KEY

If encryption is not supported by IUT:

Initialize CT values: If DES, use values in Appendix B, Table 1

 If Skipjack, use values in Appendix B, Table 5

Send KEY, 64, CT1, CT2,...CT64

IUT: If encryption is supported by IUT:

 Initialize CT = first value from output of Variable Plaintext Known Answer test. 1

Otherwise, use the first value received from the MOVS.

FOR i = 1 to 64

 {

IBi = CTi

Perform algorithm in decrypt state, resulting in PTi

Send i, KEY, CTi, PTi

If encryption is supported: 

CT = corresponding CT from output of Variable Plaintext Known Answer test i+1 i+1

else

 CTi+1= the corresponding CTi+1 value from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.7 The Variable Ciphertext Known Answer Test - ECB Mode

5.1.2.1 The Variable Ciphertext Known Answer Test - ECB Mode

As summarized in Figure 5.7, the Variable Ciphertext Known Answer test for the ECB Mode of

Operation shall be performed as follows:

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, KEY = 01 01 01 01 01 01 01 01. Note that the significant bits hex

are set to "0" and the parity bits are set to "1" to make odd parity. For IUTs of

the Skipjack algorithm, KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. If the IUT implements the DES algorithm and it does not support encryption,
48

initialize the 64 ciphertext CT values with the 64 constant CT values from

Appendix B, Table 1. Likewise, if the IUT is of the Skipjack algorithm, and it

does not support encryption, initialize the 64 ciphertext CT values with the 64

constant CT values from Appendix B, Table 5.

c. If encryption is supported by the IUT, forward the KEY to the IUT using Input

Type 4. If encryption is not supported by the IUT, forward the KEY and 64 CT

values to the IUT using Input Type 3.

2. The IUT shall:

a. If encryption is supported, initialize the CT value with the first CT value retained

from the Variable Plaintext Known Answer test for the ECB Mode (Section

5.1.1.1). Otherwise, use the first value received from the MOVS.

b. Perform the following for i=1 through 64:

 i. Set the input block IBi equal to the value of CTi, i.e., (IB1i,IB2i,...,IB64i) =

(CT1 ,CT2 ,...,CT64 ). i i i

 ii. Process IB through the DES or Skipjack algorithm in the decrypt state, i

resulting in plaintext PT.

i

iii. Forward the current values of the loop number i, KEY, CTi, and the

resulting PT to the MOVS as specified in Output Type 1. i

 iv. Retain PTi for use with the Initial Permutation Known Answer test for the

ECB mode (Section 5.1.2.2).

 v. If encryption is supported, set CT equal to the corresponding output i+1

from the Variable Plaintext Known Answer test for the ECB mode. If

encryption is not supported, assign a new value to CT by setting it equal i+1

to the corresponding CT value supplied by the MOVS. i+1

NOTE: The output from the IUT for this test shall consist of 64 output strings. Each

output string shall consist of information included in Output Type 1. 

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values.
49

MOVS: Initialize KEY: If DES, KEY=0101010101010101 (odd parity set)

If Skipjack, KEY=00000000000000000000

CT (where i=1-64) = 64 PT values from Variable Ciphertext Known Answer test i

Send KEY, 64, CT1, CT2,...CT64

IUT: Initialize CT = first value from output of Variable Ciphertext Known Answer test. 1

FOR i = 1 to 64

 {

IBi = CTi

Perform algorithm in decrypt state, resulting in PTi

Send i, KEY, CTi, PTi

CTi+1= the corresponding CTi+1 value from MOVS

 }

MOVS: Compare results from each loop with known answers. For DES, use Appendix B, Table 1. For

Skipjack, use Appendix B, Table 5.

Figure 5.8 The Initial Permutation Known Answer Test - ECB Mode

5.1.2.2 The Initial Permutation Known Answer Test - ECB Mode

As summarized in Figure 5.8, the Initial Permutation Known Answer test for the ECB Mode of

Operation shall be performed as follows:

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, KEY = 01 01 01 01 01 01 01 01. Note that the significant bits hex

are set to "0" and the parity bits are set to "1" to make odd parity. For IUTs of

the Skipjack algorithm, KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the 64 CT values with the 64 PT values obtained from the Variable

Ciphertext Known Answer test.

c. Forward the KEY and the 64 CT values to the IUT using Input Type 3.

2. The IUT shall perform the following for i=1 through 64:

a. Set the input block IBi equal to the value of CTi, i.e., (IB1i,IB2i,...,IB64i) =
50

(CT1 ,CT2 ,...,CT64 ). i i i

b. Process IBi through the DES or Skipjack algorithm in the decrypt state, resulting

in plaintext PT.

i

c. Forward the current values of the loop number i, KEY, CTi, and the resulting PTi

to the MOVS as specified in Output Type 1. 

d. Set CT equal to the corresponding CT value supplied by the MOVS. i+1 i+1

NOTE: The output from the IUT for this test shall consist of 64 output strings. Each

output string shall consist of information included in Output Type 1. 

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values.
51

MOVS: Initialize KEY : If DES, KEY = 8001010101010101 (odd parity) 1 1

If Skipjack, KEY1 = 80000000000000000000

If encryption is supported by the IUT:

Send KEY1

If encryption is not supported by the IUT:

Initialize CT values: If DES, initialize CT values with values in Appendix B, Table 2

 If Skipjack, initialize CT values with values in Appendix B, 

Table 6

Send KEY1, n (where n=64 if DES, 80 if Skipjack), CT1, CT2,...,CTn

IUT: If encryption is supported by the IUT:

Initialize CTi = first value from output of Variable Key Known Answer test for the

Encryption Process for the ECB Mode.

Otherwise, use the first value received from the MOVS.

FOR i = 1 to n, where n = 64 if DES, 80 if Skipjack

 {

IF (algorithm == SKIPJACK) {process every bit} 

 OR

 (algorithm == DES AND i %8 != 0)

{process every bit except parity bits}

 {

IBi = CTi

Perform algorithm in decrypt state, resulting in PTi

Send i, KEYi, CTi, PTi

KEYi+1 = vector consisting of "0" in every

significant bit position except for a single "1" bit in position

i+1. Note that odd parity is set.

If encryption is supported by the IUT:

 CTi+1= corresponding CTi+1 from output of Variable Key

Known Answer test for the Encryption Process for the ECB

Mode

else

 CTi+1= corresponding CTi+1 from MOVS

 }

 }

MOVS: Compare results of the n decryptions with known answers

Figure 5.9 The Variable Key Known Answer Test for the Decryption Process - ECB

Mode

5.1.2.3 The Variable Key Known Answer Test for the Decryption Process - ECB Mode
52

Figure 5.9 illustrates the Variable Key Known Answer test for the ECB Decryption Process.

1.The MOVS shall:

a. Initialize the KEY1 to contain "0" in every significant bit except for a "1" in the

first position. For example, if validating an IUT of the DES algorithm, the 64 bit

KEY1 bin = 1000000 00000001 00000001 00000001 00000001 00000001

00000001 00000001. The equivalent of this value in hexadecimal notation is 80

01 01 01 01 01 01 01. Note that the parity bits are set to "0" or "1" to set odd

parity.

 If validating an IUT of the Skipjack algorithm, the 80 bit KEY1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000 00000000. The equivalent of this value in hexadecimal notation is 80

00 00 00 00 00 00 00 00 00.

b. If the IUT implements the DES algorithm and encryption is not supported,

initialize CT values with the 56 constant CT values from Appendix B, Table 2. If i

the IUT implements the Skipjack algorithm, and encryption is not supported,

initialize CT values with the 80 constant CT values from Appendix B, Table 6. i

c. If encryption is not supported by the IUT, forward KEY and the CT values to the

IUT using Input Type 3. Otherwise, forward the KEY to the IUT using Input

Type 4.

2. The IUT shall:

a. If encryption is supported, initialize the CT value with the first CT value retained

from the Variable Key Known Answer test for the Encryption Process for the ECB

Mode (Section 5.1.1.3). Otherwise, use the first value received from the MOVS.

b. Perform the following for i=1 to n, where n = 56 for DES or 80 for Skipjack:

 i. Set the input block IB equal to the value of CT, i.e., (IB1 , IB2 ,..., IB64 ) i i i i i

= (CT1 , CT2 ,...,CT64 ). i i i

 ii. Process IB through the DES or Skipjack algorithm in the decrypt state, i

resulting in plaintext PT.

i

iii. Forward the current values of the loop number i, KEYi, CTi, and the

resulting PT to the MOVS as specified in Output Type 1. i
53

 iv. Set KEY equal to the vector consisting of "0" in every significant bit i+1

position except for a single "1" bit in position i+1. The parity bits are set

for odd parity.

 v. If encryption is supported, set CTi+1 equal to the corresponding CTi+1 value

retained from the Variable Key Known Answer test for the Encryption

Process for ECB mode. If encryption is not supported by the IUT, set

CT equal to the corresponding CT value supplied by the MOVS. i+1 i+1

NOTE: The output from the IUT for this test shall consist of 56 output strings if DES is

implemented or 80 output strings if Skipjack is implemented. Each output string shall

consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
54

MOVS: Initialize KEYi (where i=1-32) = KEY values in Appendix B, Table 3

If encryption is supported by the IUT:

Send 32, KEY1, KEY2,..., KEY32

If encryption is not supported by the IUT:

Initialize CTi (where i=1-32) = corresponding CT values in Table 3

Send 32, KEY1, CT1, KEY2, CT2,...,KEY32, CT32

IUT: If encryption is supported by the IUT:

 Initialize CT = first value retained from Permutation Operation Known Answer test for i

the Encryption Process for the ECB Mode.

Otherwise, use the first values received from the MOVS.

FOR i = 1 to 32

 {

IBi = CTi

Perform DES algorithm in decrypt state using KEYi, resulting in PTi

Send i, KEYi, CTi, PTi

KEYi+1 = corresponding KEY supplied by MOVS

If encryption is supported by the IUT:

CTi+1= the corresponding CTi+1 retained from Permutation Operation Known

Answer test for the Encryption Process for the ECB Mode

else

 CTi+1= the corresponding CTi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.10 The Permutation Operation Known Answer Test for the Decryption Process -

ECB Mode

5.1.2.4 Permutation Operation Known Answer Test for Decryption Process - ECB Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

As summarized in Figure 5.10, the Permutation Operation Known Answer test for the ECB

Decryption Process shall be performed as follows:

1. The MOVS shall:

a. If the IUT supports encryption, initialize the KEY values with the 32 constant

KEY values supplied from Table 3. If the IUT does not support encryption,

initialize the KEY-ciphertext (KEY-CT) pairs with the 32 constant KEY-CT pairs

from Appendix B, Table 3. 
55

b. If encryption is supported by the IUT, forward the 32 KEY values using Input

Type 10. If encryption is not supported by the IUT, forward the 32 KEY and CT

pairs to the IUT using Input Type 9. 

2. The IUT shall:

a. If encryption is supported by the IUT, initialize the CT value with the first CT

value retained from the Permutation Operation Known Answer test for the

Encryption Process for the ECB Mode (Section 5.1.1.4). Otherwise, use the first

value received from the MOVS.

b. Perform the following for i = 1 to 32:

 i. Set the input block IB equal to the value of CT, i.e, i i

(IB1 ,IB2 ,...IB64 )=(CT1 ,CT2 ,..., CT64 ). i i i i i i

 ii. Using the corresponding KEYi, process IBi through the DES algorithm in

the decrypt state, resulting in plaintext PT. i

iii. Forward the current values of the loop number i, KEYi, CTi, and the

resulting PT to the MOVS as specified in Output Type 1. i

iv. Assign a new value to KEYi+1 by setting it equal to the corresponding KEY

value supplied by the MOVS.

 v. If encryption is supported, set CTi+1 equal to the corresponding CT value

retained from the Permutation Operation Known Answer test for the

Encryption Process for ECB mode. If encryption is not supported, set

CT equal to the corresponding CT value supplied by the MOVS. i+1

NOTE: The above processing shall continue until all 32 KEY-CT values are passed as

specified in Input Type 9 or all 32 KEY values are passed as specified in Input Type 10. 

The output from the IUT for this test shall consist of 32 output strings. Each output

string shall consist of information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
56

MOVS: Initialize KEYi (where i=1-19) = KEY values in Appendix B, Table 4

If encryption is supported by the IUT:

Send 19, KEY1, KEY2,...,KEY19

If encryption is not supported by the IUT:

Initialize CTi (where i=1-19) = corresponding CT values in Table 4

Send 19, KEY1, CT1, KEY2, CT2,...,KEY19, CT19

IUT: If encryption is supported by the IUT:

Initialize CT1 = first value from output of Substitution Table Known Answer test for the

Encryption Process for the ECB Mode.

Otherwise, use the first value received from the MOVS.

FOR i = 1 to 19

 {

IBi = CTi

Perform DES algorithm in decrypt state using KEYi, resulting in PTi

Send i, KEYi, CTi, PTi

KEYi+1 = corresponding KEYi+1 supplied by MOVS

If encryption is supported

 CTi+1= corresponding CTi+1 from output of Substitution Table Known

Answer test for the Encryption Process for the ECB Mode

else

 CTi+1= the corresponding CTi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.11 The Substitution Table Known Answer Test for the Decryption Process - ECB

Mode

5.1.2.5 Substitution Table Known Answer Test for the Decryption Process - ECB Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

Figure 5.11 illustrates the Substitution Table Known Answer test for the ECB Decryption

Process.

1. The MOVS shall:

a. If the IUT supports encryption, initialize the KEY values with the 19 constant
57

KEY values supplied from Appendix B, Table 4. If the IUT does not support

encryption, initialize the KEY-ciphertext (KEY-CT) pairs with the 19 constant

KEY-CT pairs from Appendix B, Table 4. 

b. If encryption is supported by the IUT, forward the 19 KEY values using Input Type

10. Forward the 19 KEY-CT pairs to the IUT using Input Type 9 if encryption is not

supported by the IUT. 

2. The IUT shall:

a. If encryption is supported, initialize the CT value with the first CT value retained

from the Substitution Table Known Answer test for the Encryption Process for the

ECB Mode (Section 5.1.1.5). Otherwise, use the first value received from the

MOVS.

b. Perform the following for i = 1 to 19:

 i. Set the input block IBi equal to the value of CTi, i.e, (IB1i,IB2i,...IB64i) =

(CT1 ,CT2 ,...,CT64 ). i i i

 ii. Using the corresponding KEYi, process IBi through the DES algorithm in the

decrypt state, resulting in plaintext PT. i

iii. Forward the current values of the loop number i, KEYi, CTi, and the resulting

PT to the MOVS as specified in Output Type 1. i

iv. Set KEY equal to the corresponding KEY supplied by MOVS. i+1

 v. If encryption is supported, set CTi+1 equal to the corresponding CT value

retained from the Substitution Table Known Answer test for the Encryption

Process for the ECB mode. If encryption is not supported, set CTi+1 equal to

the corresponding CT value supplied by the MOVS. 

NOTE: The above processing shall continue until all 19 KEY-CT pairs, as specified in Input

Type 9, or all 19 KEY values, as specified in Input Type 10, are processed. The output from

the IUT for this test shall consist of 19 output strings. Each output string shall consist of

information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results to

known values. 
58

MOVS: Initialize KEY0, CT0

Send KEY0, CT0

IUT: FOR i = 0 TO 399

 {

Record i, KEYi, CT0

FOR j = 0 TO 9,999

 {

IBj = CTj

Perform algorithm in decrypt state, resulting in PTj

CTj+1 = PTj

 }

Record PTj

Send i, KEYi, CT0, PTj

KEY = KEY r last n bits of PT, i+1 i 

where n=64 if DES and n=80 if Skipjack

CT0 = PT9999

 }

MOVS:Check IUT's output for correctness

Figure 5.12 The Modes Test for the Decryption Process - ECB Mode

5.1.2.6 Modes Test for the Decryption Process - ECB Mode

Figure 5.12 illustrates the Modes test for the ECB Decryption Process.

1. The MOVS shall:

a. Initialize KEY and ciphertext CT variables. The CT shall consist of 64 bits, while the

KEY length shall be dependent on the algorithm implemented by the IUT. 

b. Forward these values to the IUT using Input Type 1.

2. The IUT shall perform the following for i=0 through 399:

a. Record the current values of the outer loop number i, the KEY, and the CT .

i 0

b. Perform the following for j=0 through 9999:

 i. Set the input block IBj equal to the value of CTj, i.e., (IB1j, IB2j, ..., IB64j) =

(CT1 , CT2 ,..., CT64 ). j j j
59

 ii. Process IB through the DES or Skipjack algorithm in the decrypt state, j

resulting in plaintext PT. j

iii. Prepare for loop j+1 by assigning CT with the current value of PT , i.e., j+1 j

(CT1 , CT2 , ... CT64 ) = (PT1 , PT2 , ..., PT64 ). j+1 j+1 j+1 j j j

c. Record the PT . j

d. Output all recorded information for this loop as specified in Output Type 1.

e. Assign a new value to the KEY in preparation for the next outer loop. The new KEY

shall be calculated by exclusive-ORing the current KEY with the current PT. For

IUTs of the DES algorithm, this shall equate to (KEY1 , KEY2 , ... KEY64 ) = ( i+1 i+1 i+1

(KEY1rPT1 , KEY2rPT2 , ... KEY64rPT64 ). i 9999 i 9999 i 9999

For IUTs for the Skipjack algorithm, the PT shall be expanded in length to 80 bits

(the length of a Skipjack key) before the new KEY can be formed. This expansion

shall be accomplished by concatenating the 16 rightmost bits of the previous PT

(PT ) with the 64 bits of the current PT (PT ). This value shall then be exclusive- 9998 9999

ORed with the current KEY to form the new KEY, i.e., (KEY1 , KEY2 , ... i+1 i+1

KEY80 ) = (KEY1rPT49 , KEY2rPT50 , ... KEY16rPT64 ,

i+1 i 9998 i 9998 i 9998

KEY17rPT1 , KEY18rPT2 , ... KEY80rPT64 ). i 9999 i 9999 i 9999

f. Assign a new value to CT in preparation for the next outer loop. CT0 shall be

assigned the value of the current PT, i.e., (CT1 , CT2 ,...,CT64 ) = (PT1 , 0 0 0 9999

PT2 ,...,PT64 ). (Note that the new CT shall be denoted as CT to be used for 9999 9999 0

the first pass through the inner loop when j=0.)

NOTE: The output from the IUT for this test shall consist of 400 output strings consisting of

information included in Output Type 1.

3. The MOVS shall check the IUT's output for correctness by comparing the received results to

known values. 
60

5.2 Cipher Block Chaining (CBC) Mode

The IUTs for the DES or Skipjack algorithm in the Cipher Block Chaining (CBC) mode shall be

validated by successfully completing a series of Known Answer tests and Modes tests corresponding

to the cryptographic processes allowed by the IUT. 

5.2.1 Encryption Process

The process of validating an IUT for the DES algorithm which implements the encryption process of

the CBC mode of operation shall involve the successful completion of the following six tests:

1. The Variable Plaintext Known Answer Test - CBC mode

2. The Inverse Permutation Known Answer Test - CBC mode

3. The Variable Key Known Answer Test for the Encryption Process - CBC mode

4. The Permutation Operation Known Answer Test for the Encryption Process - CBC mode

5. The Substitution Table Known Answer Test for the Encryption Process - CBC mode

6. The Modes Test for the Encryption Process - CBC mode

The validation process for an IUT of the Skipjack algorithm which implements the encryption

process of the CBC mode of operation shall require the successful completion of tests 1, 2, 3, and 6

only.

An explanation of the tests follows. 
61

MOVS: Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

 If Skipjack, KEY = 00000000000000000000

 IV = 0000000000000000

 PT1 = 8000000000000000

Send KEY, IV, PT1

IUT: FOR i = 1 to 64

 {

IBi= PTir IV

Perform algorithm in encrypt state, resulting in CTi

Send i, KEY, IV, PTi, CTi

PTi+1 = basis vector where single "1" bit is in position i+1

 }

MOVS: Compare results from each loop with known answers

If DES, use Appendix B, Table 1. If Skipjack, use Appendix B, Table 5.

Figure 5.13 The Variable Plaintext Known Answer Test - CBC Mode

5.2.1.1 The Variable Plaintext Known Answer Test - CBC Mode

Figure 5.13 illustrates the Variable Plaintext Known Answer test for the CBC mode.

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant hex

bits are set to "0" and the parity bits are set to "1" to make odd parity. 

For IUTs of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the 64 bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initialize the 64 bit plaintext PT to the basis vector containing a "1" in the first bit 1

position and "0" in the following 63 positions, i.e., PT1 bin = 10000000 00000000

00000000 00000000 00000000 00000000 00000000 00000000. The equivalent

of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

 

d. Forward this information to the IUT using Input Type 2.

2. The IUT shall perform the following for i = 1 through 64:
62

a. Calculate the input block IB by exclusive-ORing PT with IV, i.e., i i

(IB1 ,IB2 ,...IB64 ) = (PT1rIV1,PT2rIV2,..., PT64rIV64). i i i i i i

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in ciphertext CT. i

c. Forward the current values of the loop number i, KEY, IV, PTi, and the resulting

CT to the MOVS as specified in Output Type 2. i

d. Retain CTi for use with the Inverse Permutation Known Answer test for the CBC

Mode of Operation (Section 5.2.1.2), and, if the IUT supports decryption, for use

with the Variable Ciphertext Known Answer test for the CBC Mode (Section

5.2.2.1). 

e. Assign a new value to PTi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i+1=2..64. 

NOTE: This continues until every possible basis vector has been represented by the PT,

i.e. 64 times. The output from the IUT shall consist of 64 output strings. Each output

string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 1 for DES or Table 5 for Skipjack.
63

MOVS: Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

 If Skipjack, KEY = 00000000000000000000

 IV = 0000000000000000

 PT (where i=1-64) = 64 CT values from the Variable Plaintext Known Answer i

test

Send KEY, IV, 64, PT1..PT64

IUT: FOR i = 1 to 64

 {

IBi= PTir IV

Perform algorithm in encrypt state, resulting in CTi

Send i, KEY, IV, PTi, CTi

PTi+1 = corresponding PTi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers

Should be the set of basis vectors

Figure 5.14 The Inverse Permutation Known Answer Test - CBC Mode

5.2.1.2 The Inverse Permutation Known Answer Test - CBC Mode

Figure 5.14 illustrates the Inverse Permutation Known Answer test for the CBC mode.

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant hex

bits are set to "0" and the parity bits are set to "1" to make odd parity. 

For IUTs of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the 64 bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initialize the 64 bit plaintext values PTi (where i=1-64) to the CTi results obtained

from the Variable Plaintext Known Answer test.

 

d. Forward this information to the IUT using Input Type 5.

2. The IUT shall perform the following for i = 1 through 64:

a. Calculate the input block IB by exclusive-ORing PT with IV, i.e., i i
64

(IB1 ,IB2 ,...IB64 ) = (PT1rIV1,PT2rIV2,..., PT64rIV64). i i i i i i

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in ciphertext CT. i

c. Forward the current values of the loop number i, KEY, IV, PTi, and the resulting

CT to the MOVS as specified in Output Type 2. i

d. Assign a new value to PTi+1 by setting it equal to the corresponding output from

the Variable Plaintext Known Answer test for the CBC mode.

NOTE: This processing continues until all ciphertext values from the Variable Plaintext

Known Answer test have been used as input. The output from the IUT shall consist of 64

output strings. Each output string shall consist of information included in Output Type 2. 

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. The CT values should be the set of basis vectors that were used as

plaintext for the Variable Plaintext Known Answer test.
65

MOVS: Initialize KEY : If DES, KEY = 8001010101010101 (with odd parity) 1 1

 If Skipjack, KEY1 = 80000000000000000000

IV = 0000000000000000

PT = 0000000000000000

Send KEY1, IV, PT

IUT: FOR i = 1 to n, where n = 64 if DES, 80 if Skipjack

 {

IF (algorithm == SKIPJACK) {process every bit} 

 OR

 (algorithm == DES AND i %8 != 0)

{process every bit except parity bits}

 {

IBi = PT r IV

Perform algorithm in encrypt state using KEYi, resulting in CTi

Send i, KEYi, IV, PT, CTi

KEYi+1 = vector consisting of "0" in every significant bit position

except for a single "1" bit in position i+1. Note that parity bits are "0"

or "1" to make the KEY odd parity.

 }

 }

MOVS: Compare results of the n encryptions with known answers

For DES, use Appendix B, Table 2. For Skipjack, use Appendix B, Table 6.

Figure 5.15 The Variable Key Known Answer Test for the Encryption Process - CBC

Mode

5.2.1.3 The Variable Key Known Answer Test for the Encryption Process - CBC Mode

As summarized in Figure 5.15, the Variable Key Known Answer test for the CBC Encryption

Process shall be performed as follows:

1. The MOVS shall:

a. Initialize KEY to contain "0" in every significant bit except for a "1" in the first 1

position. For example, if validating an IUT of the DES algorithm, the 64 bit KEY1

bin = 10000000 00000001 00000001 00000001 00000001 00000001 00000001

00000001. The equivalent of this value in hexadecimal notation is 80 01 01 01 01

01 01 01. Note that the parity bits are set to "0" or "1" to get odd parity.
66

If validating an IUT for the Skipjack algorithm, the 80 bit KEY1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000 00000000. The equivalent of this value in hexadecimal notation is 80

00 00 00 00 00 00 00 00 00.

b. Initialize the 64 bit initialization vector IV to the value of 0, i.e., IVhex=00 00 00 00

00 00 00 00. 

c. Initialize the 64 bit plaintext PT to the value of 0, i.e., PThex=00 00 00 00 00 00 00

00. 

d. Forward this information to the IUT using Input Type 2.

2. The IUT shall perform the following for i = 1 to n: (NOTE: n equals the number of

significant bits in a DES or Skipjack key.)

a. Calculate the input block IB by exclusive-ORing PT with the IV, i.e, i

(IB1 ,IB2 ,...IB64 ) = (PT1rIV1,PT2rIV2,...,PT64rIV64). i i i

b. Using the corresponding KEYi, process IBi through the DES or Skipjack algorithm

in the encrypt state, resulting in ciphertext CT. i

c. Forward the current value of the loop number i, KEYi, IV, PT, and the resulting

CT to the MOVS as specified in Output Type 2. i

d. If the IUT supports decryption, retain CTi for use with the Variable Key Known

Answer test for the Decryption Process for the CBC Mode (Section 5.2.2.3). 

e. Set KEYi+1 equal to the vector consisting of "0" in every significant bit position

except for a single "1" bit in position i+1. The parity bits are set for odd parity. 

 NOTE: The above processing continues until every significant basis vector has been

represented by the KEY parameter. The output from the IUT for this test shall consist of

56 output strings if DES is implemented and 80 output strings if Skipjack is implemented. 

Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 2 for DES or Table 6 for Skipjack.
67

MOVS: Initialize KEYi (where i=1-32) = 32 KEY values in Appendix B, Table 3

IV = 0000000000000000

PT = 0000000000000000

Send PT, IV, KEY1, KEY2, ... KEY32

IUT: FOR i = 1 to 32

 {

IBi = PT r IV

Perform DES algorithm in encrypt state using KEYi, resulting in CTi

Send i, KEYi, IV, PT, CTi

KEYi+1 = KEYi+1 from MOVS

 }

MOVS: Compare results with known answers

Figure 5.16 The Permutation Operation Known Answer Test for the Encryption Process

- CBC Mode

5.2.1.4 Permutation Operation Known Answer Test for the Encryption Process - CBC

Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

Figure 5.16 illustrates the Permutation Operation Known Answer test for the CBC Encryption

Process.

1. The MOVS shall:

a. Initialize KEY, where i=1-32, with the 32 constant KEY values from Appendix B, i

Table 3.

b. Initialize the 64 bit IV to the value of 0, i.e., IV =00 00 00 00 00 00 00 00. hex

c. Initialize the plaintext PT to the value of 0, i.e., PT =00 00 00 00 00 00 00 00. hex

d. Forward this information to the IUT using Input Type 8.

2. The IUT shall perform the following for i = 1 to 32:

a. Calculate the input block IB by exclusive-ORing PT with IV, i.e, i

(IB1 ,IB2 ,...IB64 ) = (PT1rIV1,PT2rIV2,..., PT64rIV64). i i i
68

b. Using the corresponding KEYi, process IBi through the DES algorithm in the

encrypt state, resulting in ciphertext CT. i

c. Forward the current value of the loop number i, KEYi, IV, PT, and the resulting

CT to the MOVS as specified in Output Type 2. i

d. If the IUT supports decryption, retain CTi for use with the Permutation Operation

Known Answer test for the Decryption Process for the CBC mode (Section

5.2.2.4).

e. Set KEY equal to the corresponding KEY supplied by the MOVS. i+1

NOTE: The above processing shall continue until all 32 KEY values as specified in Input

Type 8 are processed. The output from the IUT for this test shall consist of 32 output

strings. Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 3.
69

MOVS: Initialize KEYi (where i=1-19) = 19 KEY values in Appendix B, Table 4

PTi = (where i=1-19) = 19 corresponding PT values in Table 4

IV = 0000000000000000

Send IV, 19, KEY1, PT1, KEY2, PT2,...,KEY19, PT19

IUT: FOR i = 1 to 19

 {

IBi = PTi r IV

Perform DES algorithm in encrypt state using KEYi, resulting in CTi

Send i, KEYi, IV, PTi, CTi

KEYi+1 = KEYi+1 from MOVS

PTi+1 = corresponding PTi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.17 The Substitution Table Known Answer Test for the Encryption Process -

CBC Mode

5.2.1.5 Substitution Table Known Answer Test for the Encryption Process - CBC Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

As summarized in Figure 5.17, the Substitution Table Known Answer test for the CBC

Encryption Process shall be performed as follows:

1. The MOVS shall:

a. Initialize the KEY-plaintext (KEY-PT) pairs with the 19 constant KEY-PT values

from Appendix B, Table 4. 

b. Initialize IV to the value of 0, i.e., IV =00 00 00 00 00 00 00 00. hex

c. Forward this information to the IUT using Input Type 11.

2. The IUT shall perform the following for i = 1 to 19:

a. Calculate the input block IB by exclusive-ORing PT with the IV, i.e, i i
70

(IB1 ,IB2 ,...IB64 ) = (PT1rIV1,PT2rIV2,...,PT64rIV64). i i i i i i

b. Using the corresponding KEYi, process IBi through the DES algorithm in the

encrypt state, resulting in ciphertext CT. i

c. Forward the current value of the loop number i, KEYi, IV, PTi, and the resulting

CT to the MOVS as specified in Output Type 2. i

d. If the IUT supports decryption, retain CTi for use with the Substitution Table

Known Answer test for the CBC Decryption Process (Section 5.2.2.5).

e. Set KEY equal to the corresponding KEY value supplied by MOVS. i+1

f. Set PT equal to the corresponding PT value supplied by MOVS. i+1

NOTE: The above processing continues until all 19 KEY-PT pairs, as specified in Input

Type 11, are processed. The output from the IUT for this test shall consist of 19 output

strings. Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 4.
71

MOVS: Initialize KEY0, IV, PT0

Send KEY0, IV, PT0

IUT: FOR i= 0 TO 399

 {

If (i==0) CV0 = IV

Record i, KEYi, CV0, PT0

FOR j = 0 TO 9,999

 {

IBj = PTj r CVj

Perform algorithm in encrypt state, resulting in CTj

IF j=0

 PTj+1 = CV0

ELSE

 PTj+1 = CTj-1

CVj+1 = CTj

 }

Record CTj

Send i, KEYi, CV0, PT0, CTj

KEYi+1 = KEYi r last n bits of CT, where n=64 if DES, n=80 if Skipjack

PT0 = CT9998

CV0 = CT9999

 }

Figure 5.18 The Modes Test for the Encryption Process - CBC Mode

5.2.1.6 Modes Test for the Encryption Process - CBC Mode

As summarized in Figure 5.18, the Modes test for the CBC Encryption Process shall be

performed as follows:

1. The MOVS shall:

a. Initialize the KEY, initialization vector IV and plaintext PT variables. The PT and

IV shall consist of 64 bits each. The KEY length shall be dependent on the

algorithm implemented by the IUT.

b. Forward these values to the IUT using Input Type 2.

2. The IUT shall perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), set the chaining value CV equal 0
72

to the IV.

b. Record the current value of the outer loop number i, KEY, CV and PT .

i 0 0

c. For j = 0 through 9999, perform the following:

 i. Set the input block IBj equal to the value of PTj exclusive-ORed with the

CV , i.e., (IB1 , IB2 , ...,IB64 ) = (PT1 rCV1 , PT2 rCV2 , ..., j j j j j j j j

PT64 rCV64 ). j j

 ii. Process IB through the DES or Skipjack algorithm in the encrypt state, j

resulting in CT. j

iii. Prepare for loop j+1 by doing the following:

- Assign CV with the current value of CT , i.e., (CV1 , CV2 , ..., j+1 j j+1 j+1

CV64 ) = (CT1 , CT2 , ..., CT64 ). j+1 j j j

- If the inner loop being processed is the first loop, i.e., j = 0, assign

PTj+1 with the current value of CV0, i.e., (PT11, PT21, ..., PT641) =

(CV10, CV20, ..., CV640). Otherwise, assign PTj+1 with the CT

from the previous inner cycle, CT , i.e., (PT1 , PT2 ,...,PT64 ) j-1 j+1 j+1 j+1

= (CT1 , CT2 ,...CT64 ). j-1 j-1 j-1

d. Record the CT . j

e. Output all recorded information from this loop, as specified in Output Type 2, to

the MOVS.

f. Assign a new value to the KEY in preparation for the next outer loop. The new

KEY shall be calculated by exclusive-ORing the current KEY with the current CT. 

For IUTs of the DES algorithm, this shall equate to (KEY1 , KEY2 , ... i+1 i+1

KEY64 ) = (KEY1rCT1 , KEY2rCT2 , ... KEY64rCT64 ). i+1 i 9999 i 9999 i 9999

For IUTs of the Skipjack algorithm, CT shall be expanded in length to 80 bits (the

length of a Skipjack key) before the new KEY can be formed. This expansion

shall be accomplished by concatenating the 16 rightmost bits of the previous CT

(CT9998) with the 64 bits of the current CT (CT9999). This value shall then be

exclusive-ORed with the current KEY to form the new KEY, i.e., (KEY1 ,

i+1

KEY2 , ... KEY80 ) = (KEY1rCT49 , KEY2rCT50 , ... i+1 i+1 i 9998 i 9998

KEY16rCT64 , KEY17rCT1 , KEY18rCT2 , ... KEY80rCT64 ). i 9998 i 9999 i 9999 i 9999

g. Assign a new value to CV0 in preparation for the next outer loop. CV0 shall be
73

assigned the value of the current CT, i.e., (CV1 , CV2 , ..., CV64 ) = (CT1 , 0 0 0 9999

CT2 , ..., CT64 ).(Note that the new CV shall be denoted as CV because this 9999 9999 0

value is used for the first pass through the inner loop when j=0.)

h. Assign a new value to the PT in preparation of the next outer loop. PT0 shall be

assigned the value of the CT from the previous cycle, i.e., (PT10, PT20,...,PT640) =

(CT19998, CT29998,...,CT649998). (Note that the new PT shall be denoted as PT0

because this value is used for the first pass through the inner loop when j=0.)

NOTE: The output from the IUT for this test shall consist of 400 output strings. Each

output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
74

5.2.2 Decryption Process

The process of validating an IUT for the CBC mode of the DES algorithm which implements the

decryption process shall involve the successful completion of the following six tests:

1. The Variable Ciphertext Known Answer Test - CBC mode

2. The Initial Permutation Known Answer Test - CBC mode

3. The Variable Key Known Answer Test for the Decryption Process - CBC mode

4. The Permutation Operation Known Answer Test for the Decryption Process - CBC

mode

5. The Substitution Table Known Answer Test for the Decryption Process - CBC mode

6. The Modes Test for the Decryption Process - CBC mode

The validation process for an IUT of the Skipjack algorithm using the CBC mode of operation in

the decryption process shall require the successful completion of tests 1, 2, 3, and 6 only.

An explanation of the tests follows.
75

MOVS: If encryption is supported by the IUT:

Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

 If Skipjack, KEY=00000000000000000000

IV = 0000000000000000

Send KEY, IV

If encryption is not supported by the IUT:

Initialize KEY: If DES, KEY=0101010101010101 (odd parity set)

If Skipjack, KEY=00000000000000000000

IV = 0000000000000000

CTi (where i=1-64): If DES, CT values in Appendix B, Table 1

If Skipjack, CT values in Appendix B, Table 5

Send KEY, IV, 64, CT1, CT2,...,CT64

IUT: If encryption is supported:

Initialize CT = first value from output of Variable Plaintext Known Answer test. 1

Otherwise, use the first value received from the MOVS.

FOR i = 1 to 64

 {

IBi = CTi

Perform algorithm in decrypt state, resulting in OBi

PTi = OBi r IV

Send i, KEY, IV, CTi, PTi

If encryption is supported:

CT = corresponding CT from output of Variable Plaintext Known Answer test i+1 i+1

else

CTi+1 = corresponding CTi+1 value from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.19 The Variable Ciphertext Known Answer Test - CBC Mode

5.2.2.1 The Variable Ciphertext Known Answer Test - CBC Mode

As summarized in Figure 5.19, the Variable Ciphertext Known Answer test for the CBC mode of

operation shall be performed as follows:
76

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, KEY = 01 01 01 01 01 01 01 01. Note that the significant bits hex

are set to "0" and the parity bits are set to "1" to make odd parity. For Skipjack

implementations, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the initialization vector IV to the constant hexadecimal value 0, i.e., IVhex

= 00 00 00 00 00 00 00 00. 

c. If the IUT is of the DES algorithm, and it does not support encryption, initialize

the 64 ciphertext CT values with the 64 constant CT values from Appendix B,

Table 1. If the IUT is of the Skipjack algorithm, and it does not support

encryption, initialize the 64 ciphertext CT values with the 64 constant values from

Appendix B, Table 5.

 

d. If encryption is supported by the IUT, forward the KEY and IV to the IUT, as

specified in Input Type 6. If encryption is not supported by the IUT, forward the

KEY, IV and CT to the IUT, as specified in Input Type 5. 

2. The IUT shall:

a. If encryption is supported, initialize the CT value with the first CT value retained

from the Variable Plaintext Known Answer test for the CBC Mode (Section

5.2.1.1). Otherwise, use the first value received from the MOVS.

b. Perform the following for i=1 through 64:

 i. Set the input block IBi equal to the value of CTi, i.e., (IB1i,IB2i,...,IB64i) =

(CT1 ,CT2 ,...,CT64 ). i i i

 ii. Process IB through the DES or Skipjack algorithm in the decrypt state, i

resulting in the output block OB.

i

iii. Calculate the plaintext PT by exclusive-ORing OB with IV, i.e., (PT1 ,

i i i

PT2 ,...,PT64 ) = (OB1rIV1, OB2rIV2,...,OB64rIV64). i i i i i

 iv. Forward the current value of the loop number i, KEY, IV, CTi, and the

resulting PT to the MOVS using Output Type 2. i

 v. If encryption is supported, set CT equal to the corresponding output i+1

from the Variable Plaintext Known Answer test for CBC mode. If
77

encryption is not supported, assign a new value to CT by setting it equal i+1

to the corresponding CT value supplied by the MOVS. i+1

NOTE: The output from the IUT for this test shall consist of 64 output strings. Each

output string shall consist of information included in Output Type 2. 

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
78

MOVS: Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

 If Skipjack, KEY=00000000000000000000

IV = 0000000000000000

CTi (where i=1-64): 64 PT values from Variable Ciphertext Known

Answer test

Send KEY, IV, 64, CT1, CT2,...,CT64

IUT: Initialize CT = first value from output of Variable Ciphertext Known Answer test. 1

FOR i = 1 to 64

 {

IBi = CTi

Perform algorithm in decrypt state, resulting in OBi

PTi = OBi r IV

Send i, KEY, IV, CTi, PTi

CTi+1 = corresponding CTi+1 value from MOVS

 }

MOVS: Compare results from each loop with known answers. For DES, use Appendix B, Table 1, For

Skipjack, use Appendix B, Table 5.

Figure 5.20 The Initial Permutation Known Answer Test - CBC Mode

5.2.2.2 The Initial Permutation Known Answer Test - CBC Mode

As summarized in Figure 5.20, the Initial Permutation Known Answer test for the CBC mode of

operation shall be performed as follows:

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, KEY = 01 01 01 01 01 01 01 01. Note that the significant bits hex

are set to "0" and the parity bits are set to "1" to make odd parity. For Skipjack

implementations, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the initialization vector IV to the constant hexadecimal value 0, i.e., IVhex

= 00 00 00 00 00 00 00 00. 

c. Initialize the 64 CT values with the 64 PT values obtained from the Variable

Ciphertext Known Answer test.
79

d. Forward the KEY, IV and the 64 CT values to the IUT, as specified in Input Type

5. 

2. The IUT shall perform the following for i=1 through 64:

a. Set the input block IBi equal to the value of CTi, i.e., (IB1i,IB2i,...,IB64i) =

(CT1 ,CT2 ,...,CT64 ). i i i

b. Process IBi through the DES or Skipjack algorithm in the decrypt state, resulting

in the output block OB.

i

c. Calculate the plaintext PT by exclusive-ORing OB with IV, i.e., (PT1 ,

i i i

PT2 ,...,PT64 ) = (OB1rIV1, OB2rIV2,...,OB64rIV64). i i i i i

d. Forward the current value of the loop number i, KEY, IV, CTi, and the resulting

PT to the MOVS using Output Type 2. i

e. Set CT equal to the corresponding CT value supplied by the MOVS. i+1 i+1

NOTE: The output from the IUT for this test shall consist of 64 output strings. Each

output string shall consist of information included in Output Type 2. 

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
80

MOVS: Initialize KEY: If DES, KEY = 8001010101010101 (odd parity set) 1

If Skipjack, KEY1 = 80000000000000000000

 IV=0000000000000000

If encryption is supported by the IUT:

Send KEY1, IV

If encryption is not supported by the IUT:

Initialize CT values: If DES, initialize CT values with values in Appendix B, Table 2

 If Skipjack, initialize CT values with values in Appendix B, 

 Table 6.

Send KEY1, IV, n (where n=64 if DES, 80 if Skipjack), CT1, CT2,..., CTn

IUT: If encryption is supported by the IUT:

Initialize CT1 = first value from output of Variable Key Known Answer test for the

Encryption Process for the CBC Mode.

Otherwise, use the first value received from the MOVS.

FOR i = 1 to n, where n = 56 if DES, 80 if Skipjack

 {

IF (algorithm == SKIPJACK) {process every bit} 

 OR

 (algorithm == DES AND i %8 != 0)

{process every bit except parity bits}

 {

IBi = CTi

Perform algorithm in decrypt state, resulting in OBi

PTi = OBi r IV

Send i, KEYi, IV, CTi, PTi

KEY = vector consisting of "0" in every significant bit position except i+1

for a single "1" bit in the i+1 position. Note that odd parity is set. st

If encryption is supported by the IUT:

CTi+1 = corresponding CTi+1 from output of Variable Key Known

Answer test for the Encryption Process for CBC Mode

else

CTi+1 = corresponding CTi+1 value from MOVS

 }

 }

MOVS: Compare results of the n decryptions with known answers

Figure 5.21 The Variable Key Known Answer Test for the Decryption Process - CBC

Mode

5.2.2.3 The Variable Key Known Answer Test for the Decryption Process - CBC Mode

Figure 5.21 illustrates the Variable Key Known Answer test for the CBC Decryption Process.

1. The MOVS shall:
81

a. Initialize KEY to contain "0" in every significant bit except for a "1" in the first 1

position. (Note that odd parity is set on the KEY.) For example, if validating an

IUT of the DES algorithm, the 64 bit KEY1 bin = 10000000 00000001 00000001

00000001 00000001 00000001 00000001 00000001. The equivalent of this value

in hexadecimal notation is 80 01 01 01 01 01 01 01.

If validating an IUT of the Skipjack algorithm, the 80 bit KEY1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000 00000000. The equivalent of this value in hexadecimal notation is 80

00 00 00 00 00 00 00 00 00.

b. Initialize IV to contain the value of zero, i.e., IV = 00 00 00 00 00 00 00 00. hex

c. If the IUT is of the DES algorithm, and encryption is not supported, initialize CTi

values with the 56 constant CT values from Appendix B, Table 2. Otherwise, if

the IUT is of the Skipjack algorithm, and encryption is not supported, initialize the

CT values with the 80 constant CT values from Appendix B, Table 6. i

d. If encryption is not supported by the IUT, forward the KEY, IV, and the multiple

CT values to the IUT, as specified in Input Type 5. Otherwise, forward the KEY

and IV to the IUT, as specified in Input Type 6. 

2. The IUT shall:

a. If encryption is supported, initialize the CT value with the first CT value retained

from the Variable Key Known Answer test for the Encryption Process for the CBC

Mode (Section 5.2.1.3). Otherwise, use the first value received from the MOVS.

b. Perform the following for i=1 to n, where n = 56 for DES or 80 for Skipjack:

 i. Set the input block IB equal to the value of CT, i.e., (IB1 , IB2 ,..., IB64 ) i i i i i

= (CT1 , CT2 ,...,CT64 ). i i i

 ii. Process IB through the DES or Skipjack algorithm in the decrypt state, i

resulting in output block OB.

i

iii. Calculate the plaintext PT by exclusive-ORing OB with IV, i.e., (PT1 ,

i i i

PT2 ,...,PT64 ) = (OB1rIV1, OB2rIV2,...,OB64rIV64). i i i i i

 iv. Forward the current values of the loop number i, KEYi, IV, CTi and the

resulting PT to the MOVS using Output Type 2. i
82

 v. Set KEY equal to the vector consisting of "0" in every significant bit i+1

position except for a single "1" bit in the i+1 position. The parity bits are st

set for odd parity.

 vi. If encryption is supported, set CTi+1 equal to the corresponding CTi+1 value

retained from the Variable Key Known Answer test for the Encryption

Process for CBC mode. If encryption is not supported by the IUT, set 

CT equal to the corresponding CT value supplied by the MOVS. i+1 i+1

NOTE: The output from the IUT for this test shall consist of 56 output strings if DES is

being implemented, or 80 output strings if Skipjack is implemented. Each output string

shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
83

MOVS: Initialize KEYi (where i=1-32) = KEY values in Appendix B, Table 3

 IV = 0000000000000000

If encryption is supported by the IUT:

Send IV,32, KEY1, KEY2,...,KEY32

If encryption not supported by the IUT:

Initialize CTi (where i=1-32) = corresponding CT values in Table 3

Send IV,32, KEY1, CT1, KEY2, CT2,...,KEY32, CT32

IUT: If encryption is supported by the IUT:

Initialize CT1 = first value retained from Permutation Operation Known Answer test for the

Encryption Process for the CBC Mode.

Otherwise, use the first value received from the MOVS.

FOR i = 1 to 32

 {

IBi = CTi

Perform DES algorithm in decrypt state using KEYi, resulting in OBi

PT = OB r IV i i

Send i, KEYi, IV, CTi, PTi

KEYi+1 = corresponding KEY supplied by MOVS

If encryption is supported:

CT = corresponding CT from output of Permutation Operation Known Answer i+1 i+1

test for the Encryption Process for the CBC mode

else

CTi+1 = corresponding CTi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.22 The Permutation Operation Known Answer Test for the Decryption Process -

CBC Mode

5.2.2.4 Permutation Operation Known Answer Test for Decryption Process - CBC Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

As summarized in Figure 5.22, the Permutation Operation Known Answer test for the CBC

Decryption Process shall be performed as follows:

1. The MOVS shall:

a. If the IUT supports encryption, initialize the KEY values with the 32 constant

KEY values supplied from Appendix B, Table 3. If the IUT does not support
84

encryption, initialize the KEY-ciphertext (KEY-CT) pairs with the 32 constant

KEY-CT pairs from Table 3. 

b. Initialize IV to contain the value of zero, i.e., IV = 00 00 00 00 00 00 00 00. hex

c. If encryption is supported by the IUT, forward the KEY and IV, as specified in

Input Type 12. Forward the KEY, CT, and IV to the IUT using Input Type 11 if

encryption is not supported by the IUT. 

2. The IUT shall:

a. If encryption is supported, initialize the CT value with the first CT value retained

from the Permutation Operation Known Answer test for the Encryption Process

for the CBC Mode (Section 5.2.1.4). Otherwise, use the first value received from

the MOVS.

b. Perform the following for i = 1 to 32:

 i. Set the input block IBi equal to the value of CTi, i.e, (IB1i,IB2i,...IB64i) =

(CT1 ,CT2 ,...,CT64 ). i i i

 ii. Using the corresponding KEYi, process IBi through the DES algorithm in

the decrypt state, resulting in OB. i

iii. Calculate PTi by exclusive-ORing OBi with IV, i.e., (PT1i, PT2i,...,PT64i) =

(OB1rIV1, OB2rIV2,...,OB64rIV64). i i i

 iv. Forward the current values of the loop number i, KEYi, IV, CTi and the

resulting PT to the MOVS using Output Type 2. i

 v. Set KEY equal to the i+1 value supplied by the MOVS. i+1

st

 vi. If encryption is supported, set CTi+1 equal to the corresponding CTi+1 value

retained from the Permutation Operation Known Answer test for the

Encryption Process for CBC Mode. If encryption is not supported, set

CT equal to the corresponding CT value supplied by the MOVS. i+1 i+1

NOTE: The above processing shall continue until all 32 KEY-CT values, as

specified in Input Type 11, or all 32 KEY values, as specified in Input Type 12 are

processed. The output from the IUT for this test shall consist of 32 output strings. 

Each output string shall consist of information contained in Output Type 2.
85

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values.
86

MOVS: Initialize: KEYi (where i=1-19)= KEY values in Appendix B, Table 4

IV = 0000000000000000

If encryption is supported by the IUT:

Send IV, 19, KEY1, KEY2,...,KEY19

If encryption not supported:

Initialize CTi (where i=1-19)= CT values in Table 4

Send IV, 19, KEY1, CT1, KEY2, CT2,...,KEY19, CT19

IUT: If encryption is supported:

Initialize CT1 = first CT value from output of Substitution Table Known Answer test for the

Encryption Process for the CBC Mode.

Otherwise, use the first value received from the MOVS.

FOR i = 1 to 19

 {

IBi = CTi

Perform DES algorithm in decrypt state using KEYi, resulting in OBi

PTi=OBi r IV

Send i, KEYi, IV, CTi, PTi

KEYi+1 = corresponding KEY supplied by MOVS

If encryption is supported:

 CT = corresponding CT from output of Substitution Table Known Answer test i+1

for the Encryption Process for the CBC mode

else

CTi+1 = corresponding CT from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.23 The Substitution Table Known Answer Test for the Decryption Process - CBC

Mode

5.2.2.5 Substitution Table Known Answer Test for the Decryption Process - CBC Mode

NOTE: This test shall only be performed for IUTs of the DES algorithm.

Figure 5.23 illustrates the Substitution Table Known Answer test for the CBC Decryption

Process.

1. The MOVS shall:

a. If the IUT supports encryption, initialize the KEY values with the 19 constant

KEY values supplied from Appendix B, Table 4. If the IUT does not support

encryption, initialize the KEY-ciphertext (KEY-CT) pairs with 19 constant KEYCT pairs from Appendix B, Table 4. 

b. Initialize IV to contain the value of zero, i.e., IV = 00 00 00 00 00 00 00 00. hex
87

c. If encryption is supported by the IUT, forward the IV and the 19 KEY values, as

specified in Input Type 12. Otherwise, forward the IV and the 19 KEY-CT pairs

to the IUT, as specified in Input Type 11.

2. The IUT shall:

a. If encryption is supported, initialize the CT value with the first CT value retained

from the Substitution Table Known Answer test for the Encryption Process for the

CBC Mode (Section 5.2.1.5). Otherwise, use the first CT value received from the

MOVS.

b. Perform the following for i = 1 to 19:

 i. Set the input block IBi equal to the value of CTi, i.e, (IB1i,IB2i,...IB64i) =

(CT1 ,CT2 ,...,CT64 ). i i i

 ii. Using the corresponding KEYi, process IBi through the DES algorithm in

the decrypt state, resulting in the output block OB. i

iii. Calculate PTi by exclusive-ORing OBi with IV, i.e., (PT1i, PT2i,...,PT64i) =

(OB1rIV1, OB2rIV2, ...,OB64rIV64). i i i

 iv. Forward the current values of the loop number i, KEYi, IV, CTi and the

resulting PT to the MOVS as specified in Output Type 2. i

 v. Set KEY equal to i+1 value supplied by MOVS. i+1

st

 vi. If encryption is supported, set CTi+1 equal to the corresponding CTi+1 value

retained from the Substitution Table Known Answer test for the

Encryption Process for the CBC Mode. If encryption is not supported, set

CT equal to the corresponding CT value supplied by the MOVS. i+1 i+1

NOTE: The above processing shall continue until the IV and all 19 KEY-CT pairs, as

specified in Input Type 11, or the IV and all 19 KEY values, as specified in Input Type 12,

are processed. The output from the IUT for this test shall consist of 19 output strings. 

Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values.
88

MOVS: Initialize KEY0, IV0, CT0

Send KEY0, IV0, CT0

IUT: FOR i = 0 TO 399

 {

If (i==0) CV0 = IV0

Record i, KEYi, CV0, CT0

FOR j = 0 TO 9,999

 {

IBj = CTj

Perform algorithm in decrypt state, resulting in OBj

PTj = OBj r CVj

CVj+1 = CTj

CTj+1 = PTj

 }

Record PTj

Send i, KEYi, CV0, CT0, PTj

KEYi+1 = KEYi r last n bits of PT, where n=64 if DES, n=80 if Skipjack

CV0 = CT9999

CT0 = PT9999

 }

MOVS: Check IUT's output for correctness

Figure 5.24 The Modes Test for the Decryption Process - CBC Mode

5.2.2.6 Modes Test for the Decryption Process - CBC Mode

Figure 5.24 illustrates the Modes test for the CBC Decryption Process.

1. The MOVS shall:

a. Initialize KEY, the initialization vector IV and ciphertext CT variables. The CT

and IV shall consist of 64 bits, while the KEY length shall be dependent on the

algorithm implemented by the IUT.

b. Forward these values to the IUT using Input Type 2.
89

2. The IUT shall perform the following for i=0 through 399:

a. If i=0 (if this is the first time through this loop), set the chaining value CV equal 0

to IV.

b. Record the current value of the outer loop number i, KEY, CV , and CT .

i 0 0

c. For j=0 through 9999, perform the following:

 i. Set the input block IB equal to the value of CT , i.e., (IB1 , IB2 , ..., IB64 ) j j j j j

= (CT1 , CT2 ,..., CT64 ). j j j

 ii. Process the IB through the DES or Skipjack algorithm in the decrypt state, j

resulting in an output block OB. j

iii. Form the plaintext PT by exclusive-ORing OB with the current CV , i.e., j j j

(PT1 , PT2 ,...,PT64 ) = (OB1 rCV1 , OB2 rCV2 , ..., OB64 rCV64 ). j j j j j j j j j

 iv. Prepare for the j+1 loop by:

- Assigning CV with the value of the current CT , i.e., (CV1 ,

j+1 j j+1

 CV2 , ..., CV64 ) = (CT1 , CT2 , ..., CT64 ); j+1 j+1 j j j

- Assigning CT with the value of the current PT , i.e., (CT1 ,

j+1 j j+1

 CT2 , ..., CT64 ) = (PT1 , PT2 ,...,PT64 ). j+1 j+1 j j j

d. Record PT .

j

e. Output all the recorded information from this loop using Output Type 2.

f. Assign a new value to the KEY in preparation for the next outer loop. The new

KEY shall be calculated by exclusive-ORing the current KEY with the current PT. 

For IUTs of the DES algorithm, this shall equate to (KEY1 , KEY2 , ... i+1 i+1

KEY64 ) = (KEY1rPT1 , KEY2rPT2 , ... KEY64rPT64 ). i+1 i 9999 i 9999 i 9999

 For IUTs of the Skipjack algorithm, the PT shall be expanded in length to 80 bits

(the length of a Skipjack key) before the new KEY can be formed. This expansion

shall be accomplished by concatenating the 16 rightmost bits of the previous PT

(PT9998) with the 64 bits of the current PT (PT9999). This value shall then be

exclusive-ORed with the current KEY to form the new KEY, i.e., (KEY1 ,

i+1

KEY2 , ... KEY80 ) = (KEY1rPT49 , KEY2rPT50 , ... i+1 i+1 i 9998 i 9998

KEY16rPT64 , KEY17rPT1 , KEY18rPT2 , ... KEY80rPT64 ). i 9998 i 9999 i 9999 i 9999

g. Assign a new value to CV in preparation for the next outer loop. CV0 shall be
90

assigned the value of the current CT, i.e., (CV1 , CV2 ,...,CV64 ) = (CT1 , 0 0 0 9999

CT29999,...,CT649999). (Note that the new CV shall be denoted as CV0 to be used

for the first pass through the inner loop when j=0.)

h. Assign a new value to CT in preparation for the next outer loop. CT0 shall be

assigned the value of the current PT, i.e., (CT1 , CT2 ,...,CT64 ) = (PT1 , 0 0 0 9999

PT29999,...,PT649999). (Note that the new CT shall be denoted as CT0 to be used

for the first pass through the inner loop when j=0.)

NOTE: The output from the IUT for this test shall consist of 400 output strings

consisting of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
91

5.3 The Cipher Feedback (CFB) Mode

The IUTs of the DES or Skipjack algorithm in the Cipher Feedback (CFB) mode of operation

shall be validated by successfully completing (1) a set of Known Answer tests applicable to both

IUTs supporting encryption and/or decryption and (2) a Modes test for each cryptographic

process supported by the IUT. 

The process of validating an IUT of the DES algorithm which supports the encryption and/or

decryption processes of the K-bit CFB mode shall involve the successful completion of the

following six tests:

1. The Variable Text Known Answer Test - K-bit CFB mode

2. The Inverse Permutation Known Answer Test - K-bit CFB mode 

3. The Variable Key Known Answer Test - K-bit CFB mode

4. The Permutation Operation Known Answer Test - K-bit CFB mode

5. The Substitution Table Known Answer Test - K-bit CFB mode

6. The Modes Test for the Encryption Process - K-bit CFB mode (if encryption is

supported)

OR

 The Modes Test for the Decryption Process - K-bit CFB mode (if decryption is

supported)

Note, for IUTs of the DES algorithm, K can range from 1 to 64 bits.

The validation process for an IUT of the Skipjack algorithm which supports the encryption and/or

decryption process of the 64-bit CFB mode of operation shall involve the successful completion

of tests 1, 2, 3, and 6 only.

An explanation of the tests follows.

5.3.1 The Known Answer Tests - CFB Mode

The K-bit CFB mode shall only have one set of Known Answer tests which shall be used

regardless of supported process, i.e., the same set of Known Answer tests shall be used for IUTs

supporting the encryption and/or decryption processes. 

Throughout this section, TEXT and RESULT will refer to different variables depending on

whether the encryption or decryption process is being tested. If the IUT performs CFB

encryption, TEXT refers to plaintext, and RESULT refers to ciphertext. If the IUT performs

CFB decryption, TEXT refers to ciphertext, and RESULT refers to plaintext.
92

NOTE: If Skipjack, K shall equal 64.

MOVS: Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

If Skipjack, KEY = 00000000000000000000

 IV1 = 8000000000000000

 K-bit TEXT = 0

Send KEY, IV1, K-bit TEXT

IUT: FOR i = 1 to 64

 {

IBi = IVi

Perform algorithm in encrypt state, resulting in OBi

K-bit RESULTi= LM (OBi)r K-bit TEXT K

Send i, KEY, IVi, K-bit TEXT, K-bit RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

 }

MOVS: Compare RESULT from each loop with known answers

If DES, use K bits of output in Appendix B, Table 1. If Skipjack, use 64 bits of output in Appendix

B, Table 5.

Figure 5.25 The Variable Text Known Answer Test - CFB Mode

5.3.1.1 The Variable Text Known Answer Test - CFB Mode

As summarized in Figure 5.25, the Variable Text Known Answer test for the CFB mode shall be

performed as follows (Note, in the following text, if the IUT is of the Skipjack algorithm, K shall

equal 64.):

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant bits

are set to "0" and the parity bits are set to "1" to make odd parity. 

For IUTs of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00.

b. Initialize the 64 bit initialization vector IV1 to the basis vector containing a "1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.
93

c. Initialize the K-bit TEXT parameter to the constant hexadecimal value 0, where K

= 1 ... 64 for DES and K = 64 for Skipjack.

d. Forward this information to the IUT using Input Type 2.

2. The IUT shall perform the following for i = 1 through 64:

a. Assign the value of the initialization vector IV to the input block IB, i.e., (IB1 ,

i i i

IB2 ,..., IB64 ) = (IV1 , IV2 ,..., IV64 ). i i i i i

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in a 64-bit output block OB. i

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of OBi with

the K-bit TEXT, i.e., (RESULT1 , RESULT2 ,..., RESULTK) = (OB1rTEXT1, i i i i

OB2rTEXT2,...,OBKrTEXTK). i i

d. Forward the current values of the loop number i, KEY, IV, K-bit TEXT and K-bit i

RESULT to the MOVS, as specified in Output Type 2. i

e. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1 , where i=1...64. 

 NOTE: This processing continues until every possible basis vector has been represented

by the IV, i.e., 64 times. The output from the IUT shall consist of 64 output strings. 

Each output string shall consist of information included in Output Type 2. 

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 1 for DES or Table 5 for Skipjack. For

IUTs of DES where K is less than 64, the leftmost K bits of output for each CT value in

Table 1 shall be used.
94

NOTE: If Skipjack, K shall equal 64.

MOVS: Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

If Skipjack, KEY = 00000000000000000000

 IV1 = 8000000000000000

 K-bit TEXT (where i=1-64) = 64 CT values from the Variable Text Known Answer i

test

Send KEY, IV1, 64, K-bit TEXT1 ... TEXT64

IUT: FOR i = 1 to 64

 {

IBi = IVi

Perform algorithm in encrypt state, resulting in OBi

K-bit RESULTi= LM (OBi)r K-bit TEXT K

Send i, KEY, IVi, K-bit TEXT, K-bit RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

K-bit TEXT = corresponding K-bit RESULT value from the Variable Text Known Anwer i+1

test

 }

MOVS: Compare RESULT from each loop with known answers

The RESULTs should be all zeros.

Figure 5.26 The Inverse Permutation Known Answer Test - CFB Mode

5.3.1.2 The Inverse Permutation Known Answer Test - CFB Mode

As summarized in Figure 5.26, the Inverse Permutation Known Answer test for the CFB mode

shall be performed as follows (Note, in the following text, if the IUT is of the Skipjack algorithm,

K shall equal 64.):

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant bits

are set to "0" and the parity bits are set to "1" to make odd parity. 

For IUTs of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00.

b. Initialize the 64 bit initialization vector IV1 to the basis vector containing a "1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.
95

c. Initialize the K-bit TEXTi (where i=1-64) to the RESULTi obtained from the

Variable Text Known Answer test.

d. Forward this information to the IUT using Input Type 5.

2. The IUT shall perform the following for i = 1 through 64:

a. Assign the value of the initialization vector IV to the input block IB, i.e., (IB1 ,

i i i

IB2 ,..., IB64 ) = (IV1 , IV2 ,..., IV64 ). i i i i i

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in a 64-bit output block OB. i

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of OBi with

the K-bit TEXT, i.e., (RESULT1 , RESULT2 ,..., RESULTK) = (OB1rTEXT1, i i i i

OB2rTEXT2,...,OBKrTEXTK). i i

d. Forward the current values of the loop number i, KEY, IV, K-bit TEXT and K-bit i

RESULT to the MOVS, as specified in Output Type 2. i

e. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1 , where i=1...64. 

f. Assign a new value to the K-bit TEXTi+1 by setting it equal to the corresponding

output from the Variable Text Known Answer test for the CFB mode.

 NOTE: This processing continues until all ciphertext values from the Variable Text

Known Answer test have been used as input. The output from the IUT shall consist of 64

output strings. Each output string shall consist of information included in Output Type 2. 

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. The RESULT values should be all zeros.
96

NOTE: If Skipjack, K shall equal 64.

MOVS: Initialize KEY: If DES, KEY = 8001010101010101 (odd parity set) 1

 If Skipjack, KEY1 = 80000000000000000000

 IV= 0000000000000000

K-bit TEXT = 0

Send KEY, IV, K-bit TEXT

 

IUT: FOR i = 1 to n, where n = 64 if DES, 80 if Skipjack

 {

IF (algorithm == Skipjack) {process all bits}

 OR

 (algorithm == DES AND i %8 != 0)

{process all bits except parity bits}

 {

IBi = IV

Perform algorithm in encrypt state using KEYi, resulting in OBi

K-bit RESULTi= leftmost K bits of OB, denoted LM (OBi) r K-bit TEXT K

Send i, KEYi, IV, K-bit TEXT, K-bit RESULTi

KEYi+1 = vector consisting of "0" in every significant bit position except for a

single "1" bit in position i+1. Each parity bit may have the value "1" or "0" to make

the KEY odd parity.

 }

 }

MOVS: Compare results of the n encryptions with known answers

If DES, use K bits of the results in Appendix B, Table 2. If Skipjack, use 64 bits of the results in

Appendix B, Table 6.

Figure 5.27 The Variable Key Known Answer Test - CFB Mode

5.3.1.3 The Variable Key Known Answer Test - CFB Mode

Figure 5.27 illustrates the Variable Key Known Answer test for the CFB Mode. (Note, if the IUT

is of the Skipjack algorithm, K shall equal 64.)

1. The MOVS shall:

a. Initialize KEY to contain a "0" in every significant bit except for a "1" in the first 1

position. For example, if validating an IUT of the DES algorithm, the 64 bit KEY1

bin= 10000000 00000001 00000001 00000001 00000001 00000001 00000001

00000001. The equivalent of this value in hexadecimal notation is 80 01 01 01 01

01 01 01. Note that the parity bits are set to "0" or "1" to get odd parity.
97

If validating an IUT of the Skipjack algorithm, the 80-bit KEY1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000 00000000. The equivalent of this value in hexadecimal notation is 80

00 00 00 00 00 00 00 00 00.

b. Initialize the 64-bit initialization vector IV to the value of 0, i.e., IVhex= 00 00 00

00 00 00 00 00.

c. Initialize the K-bit TEXT to the value of 0. It shall be represented as K binary bits,

where K=1...64 for DES and K=1...80 for Skipjack, i.e., TEXT =0 0 ...0 . This bin 1 2 K

shall then be translated into hexadecimal.

d. Forward this information to the IUT using Input Type 2. 

2. The IUT shall perform the following for i = 1 to n: (NOTE: n equals the number of

significant bits in a DES or Skipjack key.)

a. Assign the value of the IV to IB, i.e., (IB1 , IB2 ,..., IB64 ) = (IV1, IV2,..., IV64). i i i i

b. Using the corresponding KEY, process IBi through the DES or Skipjack algorithm

in the encrypt state resulting in OB. i

c. Calculate the K-bit RESULT by exclusive-ORing the leftmost K-bits of OB,

i i

denoted LM (OB), with the K-bit TEXT, i.e.,(RESULT1 , RESULT2 ,...,

K

i i i

RESULTK) = (OB1rTEXT1, OB2rTEXT2,...,OBKrTEXTK). i i i i

d. Forward the current value of the loop number i, KEY, IV, K-bit TEXT and K-bit i

RESULT to the MOVS, as specified in Output Type 2. i

e. Set KEYi+1 equal to the vector consisting of "0" in every significant bit position

except for a single "1" bit in position i+1. The parity bits contain "1" or "0" to

make odd parity. 

NOTE: The above processing shall continue until every significant basis vector has been

represented by the KEY parameter. The output from the IUT for this test shall consist of

56 output strings if the IUT implements the DES algorithm, and 80 output strings if the

IUT implements the Skipjack algorithm. Each output string shall consist of information

included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing received results to

known values found in Appendix B, Table 2 for DES or Table 6 for Skipjack. For IUTs
98

of DES where K is less than 64, the leftmost K bits of output for each CT in Table 2 shall

be used.
99

MOVS: Initialize KEYi (where i =1-32) = 32 KEY values in Appendix B, Table 3

 IV = 0000000000000000

K-bit TEXT = 0

Send K-bit TEXT, IV, KEY1, KEY2,...,KEY32

IUT: FOR i = 1 to 32

 {

IBi = IV

Perform DES algorithm in encrypt state, resulting in OBi

K-bit RESULTi= LM (OBi) r K-bit TEXT K

Send i, KEYi, IV, K-bit TEXT, K-bit RESULTi

KEYi+1 = Corresponding KEYi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.28 The Permutation Operation Known Answer Test - CFB Mode

5.3.1.4 The Permutation Operation Known Answer Test - CFB Mode

NOTE: This test shall only be performed for the DES algorithm.

As summarized in Figure 5.28, the Permutation Operation Known Answer test for the CFB mode

shall be performed as follows:

1. The MOVS shall:

a. Initialize the KEY parameter with the 32 constant KEY values from Appendix B,

Table 3.

b. Initialize the 64-bit initialization vector IV to the value of 0, i.e., IVhex=00 00 00 00

00 00 00 00.

c. Initialize the K-bit TEXT to the value of 0. The TEXT shall be represented as K

hexadecimal bits, where K=1...64 or K=1...16 , i.e., TEXT =0 0 ...0 . bin hex hex 1 2 k

d. Forward this information to the IUT using Input Type 8. 

2. The IUT shall perform the following for i = 1 to 32:
100

a. Assign the value of the IV to IB, i.e., (IB1 , IB2 ,..., IB64 ) = (IV1, IV2,..., IV64). i i i i

b. Process IB through the DES algorithm in the encrypt state, resulting in OB. i i

c. Calculate the K-bit RESULT by exclusive-ORing the leftmost K-bits of OB,

i i

LM (OB), with the K-bit TEXT, i.e.,(RESULT1 , RESULT2 ,..., RESULTK) = K

i i i i

(OB1rTEXT1, OB2rTEXT2,...,OBKrTEXTK). i i i

d. Forward the current values of the loop number i, KEY, IV, K-bit TEXT and K-bit i

RESULT to the MOVS, as specified in Output Type 2. i

e. Set KEY equal to the corresponding KEY supplied by the MOVS. i+1

NOTE: The above processing shall continue until all 32 KEY values, as specified in Input

Type 8, are processed. The output from the IUT for this test shall consist of 32 output

strings. Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 3.
101

MOVS: Initialize KEYi (where i=1-19) = 19 KEY values in Appendix B, Table 4

 IVi (where i=1-19) = 19 corresponding TEXT values in Table 4

K-bit TEXT = 0

Send K-bit TEXT, 19, KEY1, IV1, KEY2, IV2,..., KEY19, IV19

IUT: FOR i = 1 to 19

 {

IBi = IVi

Perform DES algorithm in encrypt state, resulting in OBi

K-bit RESULTi= LM (OBi) r K-bit TEXT K

Send i, KEYi, IVi, K-bit TEXT, K-bit RESULTi

KEYi+1 = KEYi+1 from MOVS

IVi+1 = corresponding DATAi+1 from MOVS

 }

MOVS: Compare results from each loop with known answers

Figure 5.29 The Substitution Table Known Answer Test - CFB Mode

5.3.1.5 The Substitution Table Known Answer Test - CFB Mode

NOTE: This test shall only be performed for the DES algorithm.

Figure 5.29 illustrates the Substitution Table Known Answer test for the CFB Mode.

1. The MOVS shall:

a. Initialize the KEY-DATA pairs with the 19 constant KEY-DATA values from

Appendix B, Table 4. The DATA values shall then be assigned to the values of the

initialization vectors IV. 

b. Initialize the K-bit TEXT to the value of 0, where K=1...64, i.e.,

TEXT =0 0 ...0 . bin 1 2 K

c. Forward this information to the IUT using Input Type 11.

2. The IUT shall perform the following for i = 1 to 19:

a. Assign the value of IV to IB, i.e., (IB1 , IB2 ,..., IB64 ) = (IV1 , IV2 ,..., IV64 ). i i i i i i i i

b. Process IB through the DES algorithm in the encrypt state, resulting in OB. i i
102

c. Calculate the K-bit RESULT by exclusive-ORing the leftmost K-bits of OB,

i i

LM (OB), with the K-bit TEXT, i.e.,(RESULT1 , RESULT2 ,..., RESULTK) = K

i i i i

(OB1rTEXT1, OB2rTEXT2,...,OBKrTEXTK). i i i

d. Forward the current value of the loop number i, KEYi, IV, the K-bit TEXT, and

the K-bit RESULT.

i

e. Set KEY equal to the corresponding KEY in the input from the MOVS. i+1

f. Set IV equal to the corresponding DATA value in the input from the MOVS. i+1

 

NOTE: The above processing shall continue until all 19 KEY-DATA pairs, as specified in

Input Type 11, are processed. The output from the IUT for this test shall consist of 19

output strings. Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 4.
103

MOVS: Initialize KEY0, IV, K-bit PT0

Send KEY0, IV, K-bit PT0

IUT: FOR i = 0 TO 399

 {

If (i==0) IB0 = IV

Record i, KEYi, PT0

FOR j = 0 TO 9,999

 {

Perform algorithm in encrypt state, resulting in OB. j

Select the leftmost K bits of the OB, LM (OB ), j j

K

 discarding the rest.

K-bit CTj = LM (OBj) r K-bit PTj

K

K-bit PT = LM (IB) j+1 j

K

IBj+1 = RM (IBj) || K-bit CTj

(64-K)

 }

Record K-bit CTj, IB0

Send i, KEYi, IB0, K-bit PT0, K-bit CTj

KEYi+1 = KEYi r last n bits of CT, where n=64 if DES, n=80 if Skipjack

K-bit PT = LM (IB ) 0 9999

K

IB0 = RM (IB9999) || K-bit CT9999

(64-K)

 }

MOVS: Check the IUT's output for correctness

Figure 5.30 The Modes Test for the Encryption Process - K-bit CFB Mode

5.3.2 The Modes Tests - CFB Mode

The Modes tests required to validate an IUT for the CFB mode of operation shall be determined

by the process or processes allowed by an IUT. The K-bit CFB Modes test for the Encryption

Process shall be successfully completed if an IUT supports the encryption process of the CFB

mode of operation. The K-bit CFB Modes test for the Decryption Process shall be successfully

completed if an IUT supports the decryption process.

5.3.2.1 The K-bit CFB Modes Test for the Encryption Process - CFB Mode

As summarized in Figure 5.30, the K-bit CFB Modes test for the Encryption Process shall be

performed as follows:

1. The MOVS shall:

a. Initialize KEY, the initialization vector IV and the plaintext PT variables. The IV
104

shall consist of 64 bits. The PT shall be represented as K-bits, where K=1...64. 

The KEY length shall be dependent on the algorithm implemented by the IUT.

b. Forward these values to the IUT using Input Type 2.

2. The IUT shall perform the following for i = 0 through 399:

a. If i = 0 (if this is the first time through the loop), set the input block IB0 equal to

the value of the IV, i.e., (IB1 , IB2 ,...,IB64 ) = (IV1, IV2,...,IV64). 0 0 0

b. Record the current value of the outer loop number i, KEY, and the K-bit PT .

i 0

c. For j=0 through 9999, perform the following:

 i. Process IB through the DES or Skipjack algorithm in the encrypt state, j

resulting in a 64-bit output block OB.

j

ii. Calculate the K-bit ciphertext CT by exclusive-ORing the leftmost K-bits j

of OB with the K-bit PT , i.e., (CT1 , CT2 ,..., CTK ) = (OB1 rPT1 ,

j j j j j j j

OB2 rPT2 , ... OBK rPTK ). j j j j

 iii. Prepare for loop j+1 by doing the following:

- Assign the K-bit PTj+1 with the value of the leftmost K-bits of the

IB, i.e., (PT1 , PT2 , ... PTK ) = (IB1 , IB2 , ..., IBK ). j j+1 j+1 j+1 j j j

- Assign IB with the value of the concatenation of the rightmost j+1

(64-K) bits of IB with the K-bit CT , i.e.,(IB1 , IB2 ,...,IB64 ) j j j+1 j+1 j+1

= (IB[K+1], IB[K+2],..., IB64 , CT1 , CT2 ,...,CTK ). j j j j j j

d. Record the K-bit CTj and IBi

e. Output all recorded values for this loop, as specified in Output Type 2, to the

MOVS.

f. In preparation for the next output loop:

 i. Assign a new value to the KEY in preparation for the next outer loop. The

new KEY shall be calculated by exclusive-ORing the current KEY of

length n with n bits of CT. 

For IUTs of the DES algorithm, if the length of the CT is less than 64 (the
105

length of a DES key), the CT shall be expanded in length to 64 bits before

forming the new KEY. This expansion shall be accomplished by

concatenating x of the most current CTs together to obtain 64 bits of CT. 

For example, if the length of the CT is 14 (K=14), the expanded CT =

(CT7 ... CT14 , CT1 ... CT14 , CT1 ... CT14 , CT1 ... 9995 9995 9996 9996 9997 9997 9998

CT149998, CT19999 ... CT149999). This value shall then be exclusive-ORed

with the current KEY to form the new KEY. Using the same example as

above, (KEY1 , KEY2 , ... KEY64 ) = (KEY1rCT7 , ... i+1 i+1 i+1 i 9995

KEY8rCT14 , KEY9rCT1 , ... KEY22rCT14 , KEY23rCT1 ,

i 9995 i 9996 i 9996 i 9997

... KEY36rCT14 , KEY37rCT1 , ... KEY50rCT14 ,

i 9997 i 9998 i 9998

KEY51rCT7 , ... KEY64rCT14 ,). i 9999 i 9999

For IUTs of the Skipjack algorithm, CT shall be expanded in length to 80

bits (the length of a Skipjack key) before the new KEY can be formed. 

This expansion shall be accomplished in the same manner described above

for DES. The resulting value shall then be exclusive-ORed with the current

KEY to form the new KEY.

 ii. Assign a new value to the K-bit PT0. The K-bit PT0 shall be assigned the

value of the leftmost K-bits of the current IB, i.e., (PT10, PT20, ... PTK0) =

(IB1 , IB2 , ..., IBK ). 9999 9999 9999

iii. Assign a new value to IB . IB shall be assigned the value of the rightmost 0 0

(64-K) bits of the current IB concatenated with the current K-bit CT, i.e.,

(IB1 , IB2 ,...,IB64 ) = (IB[K+1] , IB[K+2] ,..., IB64 , CT1 , 0 0 0 9999 9999 9999 9999

CT2 ,..., CTK ). (Note that the new PT and IB shall be denoted as 9999 9999

PT0 and IB0 because these values are used for the first pass through the

inner loop when j=0.)

NOTE: The output from the IUT for this test shall consist of 400 output strings. Each

output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
106

MOVS: Initialize KEY0, IV, K-bit CT0

Send KEY0, IV, K-bit CT0

IUT: FOR i = 0 TO 399

 {

if (i==0) IB0 = IV

Record i, KEYi, K-bit CT0

FOR j = 0 TO 9,999

 {

Perform algorithm in encrypt state, resulting in OB. j

Select the leftmost K bits of the OB, LM (OB ), j j

K

 discarding the rest.

K-bit PTj = LM (OBj) r K-bit CTj

K

IBj+1 = RM (IBj) || K-bit CTj

(64-K)

K-bit CT = LM (OB ) j+1 j

K

 }

Record IB0, K-bit PTj

Send i, KEYi, IB0, K-bit PTi, K-bit CTi

KEYi+1 = KEYi r last n bits of PT, where n=64 if DES, n=80 if Skipjack

IB0 = RM (IB9999) || K-bit CT9999

(64-K)

K-bit CT = LM (OB ) 0 9999

K

 }

MOVS: Check the IUT's output for correctness

Figure 5.31 The Modes Test for the Decryption Process - CFB Mode

5.3.2.2 The Modes Test for the Decryption Process - CFB Mode

Figure 5.31 illustrates the Modes test for the CFB Decryption Process.

1. The MOVS shall:

a. Initialize KEY, the initialization vector IV, and the ciphertext CT variables. The

IV shall consist of 64 bits, and the CT shall be represented as K bits, where

K=1...64. The KEY length shall be dependent on the algorithm implemented.

b. Forward these values to the IUT using Input Type 2.
107

2. The IUT shall perform the following for i = 0 through 399:

a. If i = 0 (if this is the first time through the loop), set the input block IB0 equal to

the value of IV, i.e., (IB1 , IB2 ,...,IB64 ) = (IV1, IV2,...,IV64). 0 0 0

b. Record the current value of the outer loop number i, KEY, and the K-bit CT.

i i

c. For j=0 through 9999, perform the following:

 i. Process IB through the DES or Skipjack algorithm in the encrypt state, j

resulting in a 64-bit output block OB.

j

ii. Calculate the K-bit PT by exclusive-ORing the leftmost K-bits of OBj with

the K-bit CT , i.e., (PT1 , PT2 ,..., PTK ) = (OB1 rCT1 , OB2 rCT2 , ... j j j j j j j j

OBK rCTK ). j j

 iii. Prepare for loop j+1 by doing the following:

- Assign IB with the value of the concatenation of the rightmost (64-K) j+1

bits of the IBj with the K-bit CTj, i.e.,(IB1j+1, IB2j+1,...,IB64j+1) =

(IB[K+1], IB[K+2],..., IB64 , CT1 , CT2 ,...,CTK ). j j j j j j

- Assign the K-bit CT with the value of the leftmost K-bits of OB, i.e., j+1 j

(CT1 , CT2 , ... CTK ) = (OB1 , OB2 , ..., OBK ). j+1 j+1 j+1 j j j

d. Record IB and PT . j j

e. Output all recorded values for this loop, as specified in Output Type 2.

f. In preparation for the next outer loop:

 i. Assign a new value to the KEY in preparation for the next outer loop. The

new KEY shall be calculated by exclusive-ORing the current KEY of

length n with n bits of PT. 

For IUTs of the DES algorithm, if the length of the PT is less than 64 (the

length of a DES key), the PT shall be expanded in length to 64 bits before

forming the new KEY. This expansion shall be accomplished by

concatenating x of the most current PTs together to obtain 64 bits of PT. 

For example, if the length of the PT is 14 (K=14), the expanded PT =

(PT7 ... PT14 , PT1 ... PT14 , PT1 ... PT14 , PT1 ... 9995 9995 9996 9996 9997 9997 9998

PT149998, PT19999 ... PT149999). This value shall then be exclusive-ORed

with the current KEY to form the new KEY. Using the same example as
108

above, (KEY1 , KEY2 , ... KEY64 ) = (KEY1rPT7 , ... i+1 i+1 i+1 i 9995

KEY8rPT14 , KEY9rPT1 , ... KEY22rPT14 , KEY23rPT1 ,

i 9995 i 9996 i 9996 i 9997

... KEY36rPT14 , KEY37rPT1 , ... KEY50rPT14 ,

i 9997 i 9998 i 9998

KEY51rPT7 , ... KEY64rPT14 ,). i 9999 i 9999

For IUTs of the Skipjack algorithm, the PT shall be expanded in length to

80 bits (the length of a Skipjack key) before the new KEY can be formed. 

This expansion shall be accomplished in the same manner described above

for DES. The resulting value shall then be exclusive-ORed with the current

KEY to form the new KEY.

 ii. Assign a new value to IB . IB shall be assigned the value of the rightmost 0 0

(64-K) bits of the current IB concatenated with the current K-bit CT, i.e.,

(IB1 , IB2 ,...,IB64 ) = (IB[K+1] , IB[K+2] ,..., IB64 , CT1 , 0 0 0 9999 9999 9999 9999

CT2 ,..., CTK ). 9999 9999

iii. Assign a new value to CT . CT shall be assigned the value of the leftmost 0 0

K-bits of the current OB, LM (OB ), i.e., (CT1 , CT2 , ... CTK ) = K

9999 0 0 0

(OB19999, OB29999, ..., OBK9999). (Note that the new CT and IB shall be

denoted as CT and IB because these values are used for the first pass 0 0

through the inner loop when j=0.) 

NOTE: The output from the IUT for this test shall consist of 400 output strings. Each

output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
109

5.4 The Output Feedback Mode - OFB Mode

The IUTs of the DES and Skipjack algorithm in the Output Feedback (OFB) mode shall be

validated by successfully completing a set of Known Answer tests and a Modes test applicable to

both IUTs supporting the encryption and/or the decryption processes. Encryption and decryption

using the OFB mode of operation involve processing an input block through the encrypt state of

the specified algorithm. Therefore, the same set of Known Answer tests and Modes test can be

applied to IUTs supporting both encryption and decryption. 

The process of validating an IUT of the OFB mode of the DES algorithm which implements the

encryption and/or decryption processes shall involve the successful completion of the following

six tests:

1. The Variable Text Known Answer Test - OFB mode

2. The Inverse Permutation Known Answer Test - OFB mode

3. The Variable Key Known Answer Test - OFB mode 

4. The Permutation Operation Known Answer Test - OFB mode

5. The Substitution Table Known Answer Test - OFB mode

6. The Modes Test - OFB mode

The IUTs of the Skipjack algorithm shall successfully complete tests 1, 2, 3, and 6 only. 

An explanation of the tests for the OFB mode follows.

5.4.1 The Known Answer Tests - OFB Mode

In the following description of the Known Answer tests, TEXT refers to plaintext, and RESULT

refers to ciphertext if the IUT implements the encryption process of the OFB mode of operation. 

If the IUT supports the decryption process of the OFB mode of operation, TEXT refers to

ciphertext, and RESULT refers to plaintext.
110

MOVS:Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

If Skipjack, KEY = 00000000000000000000

IV1= 8000000000000000

TEXT = 0000000000000000

Send KEY, IV1, TEXT

IUT: FOR i = 1 to 64

 {

IBi = IVi

Perform algorithm in encrypt state resulting in OBi

RESULTi= OBir TEXT

Send i, KEY, IVi,TEXT, RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

 }

MOVS: Compare results from each loop with known answers

If DES, use Appendix B, Table 1. If Skipjack, use Appendix B, Table 5.

Figure 5.32 The Variable Text Known Answer Test - OFB Mode

5.4.1.1 The Variable Text Known Answer Test - OFB Mode

Figure 5.32 illustrates the Variable Text Known Answer test for the OFB Mode.

1. The MOVS shall:

a. Initialize the KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant hex

bits are set to "0" and the parity bits are set to "1" to make odd parity. For IUTs

of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the 64 bit initialization vector IV1 to the basis vector containing a "1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

c. Initialize the TEXT parameter to the constant hexadecimal value 0, i.e., TEXThex =

00 00 00 00 00 00 00 00.
111

d. Forward this information to the IUT using Input Type 2.

2 The IUT shall perform the following for i = 1 through 64:

a. Assign the value of IV to the input block IB i.e., (IB1 , IB2 ,..., IB64 ) = (IV1 ,

i i i i i i

IV2 ,..., IV64 ). i i

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in output block OB. i

c. Calculate RESULT by exclusive-ORing OB with TEXT, i.e., (RESULT1 ,

i i i

RESULT2 ,..., RESULT64 ) = (OB1rTEXT1, OB2rTEXT2, ..., i i i i

OB64rTEXT64). i

d. Forward the current value of the loop number i, KEY, IVi, TEXT, and RESULTi

to the MOVS, as specified by Output Type 2.

e. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i=1...64. 

NOTE: This processing shall continue until every possible basis vector has been

represented by the IV, i.e., 64 times. The output from the IUT for this test shall consist of

64 output strings. Each output string shall consist of information included in Output Type

2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 1 for DES and Table 5 for Skipjack .
112

MOVS:Initialize KEY: If DES, KEY = 0101010101010101 (odd parity set)

If Skipjack, KEY = 00000000000000000000

IV1= 8000000000000000

TEXT (where i=1-64) = 64 RESULT values from the Variable Text Known Answer test i

Send KEY, IV1, 64, TEXT1 ... TEXT64

IUT: FOR i = 1 to 64

 {

IBi = IVi

Perform algorithm in encrypt state resulting in OBi

RESULTi= OBir TEXT

Send i, KEY, IVi,TEXT, RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

TEXT = corresponding RESULT value from the Variable Text Known Answer test i+1

 }

MOVS: Compare RESULT from each loop with known answers.

The TEXT should be all zeros.

Figure 5.33 The Inverse Permutation Known Answer Test - OFB Mode

5.4.1.2 The Inverse Permutation Known Answer Test - OFB Mode

Figure 5.33 illustrates the Inverse Permutation Known Answer test for the OFB Mode.

1. The MOVS shall:

a. Initialize KEY parameter to the constant hexadecimal value 0. For IUTs of the

DES algorithm, the KEY = 01 01 01 01 01 01 01 01. Note that the significant hex

bits are set to "0" and the parity bits are set to "1" to make odd parity. 

For IUTs of the Skipjack algorithm, the KEY = 00 00 00 00 00 00 00 00 00 00. hex

b. Initialize the 64 bit initialization vector IV1 to the basis vector containing a "1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

c. Initialize the TEXTi parameter (where i=1-64) to the RESULTi obtained from the
113

Variable Plaintext Known Answer test.

d. Forward this information to the IUT using Input Type 5.

2 The IUT shall perform the following for i = 1 through 64:

a. Assign the value of IV to the input block IB i.e., (IB1 , IB2 ,..., IB64 ) = (IV1 ,

i i i i i i

IV2 ,..., IV64 ). i i

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in output block OB. i

c. Calculate RESULT by exclusive-ORing OB with TEXT, i.e., (RESULT1 ,

i i i

RESULT2 ,..., RESULT64 ) = (OB1rTEXT1, OB2rTEXT2, ..., i i i i

OB64rTEXT64). i

d. Forward the current value of the loop number i, KEY, IVi, TEXT, and RESULTi

to the MOVS, as specified by Output Type 2.

e. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i=1...64. 

f. Assign a new value to the TEXTi+1 by setting it equal to the corresponding

RESULT value from the Variable Text Known Answer test for the OFB mode.

NOTE: This processing shall continue until all ciphertext values from the Variable Text

Known Answer Text have been used as input. The output from the IUT for this test shall

consist of 64 output strings. Each output string shall consist of information included in

Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. The RESULT values should be all zeros.
114

MOVS: Initialize KEY : If DES, KEY =8001010101010101 (odd parity set) 1 1

If Skipjack, KEY1=80000000000000000000

IV = 0000000000000000

TEXT = 0000000000000000

Send KEY1, IV, TEXT

IUT: FOR i = 1 to n, where n = 64 if DES, 80 if Skipjack

 {

IF (Skipjack) {process all bits}

 or

 (DES AND i %8 != 0)

{process all bits except parity bits}

 {

IBi = IV

Perform algorithm in encrypt state, resulting in OBi

RESULTi= OBi r TEXT

Send i, KEYi, IV, TEXT, RESULTi

KEYi+1 = vector consisting of "0" in every significant bit position except for a

single "1" bit in position i+1. Each parity bit may have the value "1" or "0" to make

the KEY odd parity.

 }

 }

MOVS: Compare results of the n encryptions with known answers

If DES, use Appendix B, Table 2. If Skipjack, use Appendix B, Table 6.

Figure 5.34 The Variable Key Known Answer Test - OFB Mode

5.4.1.3 The Variable Key Known Answer Test - OFB Mode

As summarized in Figure 5.34, the Variable Key Known Answer test for the OFB mode shall be

performed as follows:

1. The MOVS shall:

a. Initialize KEY to contain a "0" in every significant bit except for a "1" in the first 1

position. For an IUT of the DES algorithm, the 64 bit KEY1 bin= 10000000

00000001 00000001 00000001 00000001 00000001 00000001 00000001. The

equivalent of this value in hexadecimal notation is 80 01 01 01 01 01 01 01. Note

that the parity bits are set to "0" or "1" to get odd parity.

For an IUT of the Skipjack algorithm, the 80 bit KEY1 bin = 10000000 00000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000. The equivalent of this value in hexadecimal notation is 80 00 00 00 00

00 00 00 00 00.
115

b. Initialize the 64 bit initialization vector IV to the value of 0, i.e., IVhex=00 00 00 00

00 00 00 00.

c. Initialize TEXT to the value of 0, i.e., TEXT =00 00 00 00 00 00 00 00. hex

d. Forward this information to the IUT using Input Type 2. 

2. The IUT shall perform the following for i = 1 to n: (NOTE: n equals the number of

significant bits in a DES or Skipjack key.)

a. Assign the value of IV to IB, i.e., (IB1 , IB2 ,..., IB64 ) = (IV1, IV2,..., IV64). i i i i

b. Process IBi through the DES or Skipjack algorithm in the encrypt state, resulting

in output block OB. i

c. Calculate RESULT by exclusive-ORing OB with TEXT, i.e.,(RESULT1 ,

i i i

RESULT2 ,..., RESULT64 ) = (OB1rTEXT1, i i i

OB2rTEXT2,...,OB64rTEXT64). i i

d. Forward the current value of the loop number i, KEYi, IV, TEXT and RESULTi to

the MOVS, as specified in Output Type 2.

e. Set KEYi+1 equal to the vector consisting of "0" in every significant bit position

except for a single "1" bit in position i+1. 

NOTE: The above processing shall continue until every significant basis vector has been

represented by the KEY parameter. The output from the IUT for this test shall consist of

56 output strings if the IUT implements the DES algorithm and 80 output strings if the

IUT implements the Skipjack algorithm. Each output string shall consist of information

included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 2 for DES and Table 6 for Skipjack.
116

MOVS: Initialize KEYi (where i=1-32) = 32 KEY values in Appendix B, Table 3

IV = 0000000000000000

TEXT = 0000000000000000

Send TEXT, IV, KEY1, KEY2, ..., KEY32

IUT: FOR i = 1 to 32

 {

IBi = IV

Perform DES algorithm in encrypt state, resulting in OBi

RESULTi= OBi r TEXT

Send i, KEYi, IV, TEXT, RESULTi

KEYi+1 = Corresponding KEYi+1 from MOVS

 }

MOVS: Compare results with known answers

Figure 5.35 The Permutation Operation Known Answer Test - OFB Mode

5.4.1.4 The Permutation Operation Known Answer Test - OFB Mode 

NOTE: This test shall only be performed for the DES algorithm.

Figure 5.35 illustrates the Permutation Operation Known Answer test for the OFB mode.

1. The MOVS shall:

a. Initialize the KEY parameter with the 32 constant KEY values from Appendix B,

Table 3.

b. Initialize IV to the value of 0, i.e., IV =00 00 00 00 00 00 00 00. hex

c. Initialize TEXT to the value of 0, i.e., TEXT =00 00 00 00 00 00 00 00. hex

d. Forward this information to the IUT using Input Type 8. 

2. The IUT shall perform the following for i = 1 to 32:

a. Assign the value of IV to the input block IB, i.e., (IB1 , IB2 ,..., IB64 ) = (IV1, i i i i

IV2,..., IV64).

b. Process IB through the DES algorithm in the encrypt state, resulting in the output i

block OB. i
117

c. Calculate RESULT by exclusive-ORing OB with TEXT, i.e.,(RESULT1 ,

i i i

RESULT2 ,..., RESULT64 ) = (OB1rTEXT1, OB2rTEXT2, ..., i i i i

OB64rTEXT64). i

d. Forward the current values of the loop number i, KEY, IV, TEXT and RESULT.

i i

e. Set KEY equal to the corresponding KEY supplied from the MOVS. i+1

NOTE: The above processing shall continue until all 32 KEY values, as specified in Input

Type 8, are processed. The output from the IUT for this test shall consist of 32 output

strings. Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 3.
118

MOVS: Initialize KEYi (where i=1-19) = 19 KEY values in Appendix B, Table 4

IVi (where i=1-19) = 19 corresponding PT values in Appendix B, Table 4

TEXT = 0000000000000000

Send TEXT, 19, KEY1, IV1, KEY2, IV2,...,KEY19, IV19

IUT: FOR i = 1 to 19

 {

IBi = IVi

Perform DES algorithm in encrypt state, resulting in OBi

RESULTi= OBi r TEXT

Send i, KEYi, IVi, TEXT, RESULTi

KEYi+1 = KEYi+1 from MOVS

IV = corresponding DATA from MOVS i+1 i+1

 }

MOVS: Compare results from each loop with known answers

Figure 5.36 The Substitution Table Known Answer Test - OFB Mode

5.4.1.5 The Substitution Table Known Answer Test - OFB Mode

NOTE: This test shall only be performed for the DES algorithm.

As summarized in Figure 5.36, the Substitution Table Known Answer test for the OFB mode shall

be performed as follows:

1. The MOVS shall:

a. Initialize the KEY-INPUT pairs with the 19 constant KEY-IV values from

Appendix B, Table 4. The PT/TEXT/IV values from the table shall then be

assigned to the values of the initialization vector IVs. 

b. Initialize TEXT to the value of 0, i.e., TEXT =00 00 00 00 00 00 00 00. hex

c. Forward this information to the IUT using Input Type 11.

2. The IUT shall perform the following for i = 1 to 19:

a.. Assign the value of IV to the input block IB, i.e., (IB1 , IB2 ,..., IB64 ) = (IV1 ,

i i i i i i

IV2 ,..., IV64 ). i i
119

b. Process IB through the DES algorithm in the encrypt state, resulting in the output i

block OB. i

c. Calculate RESULT by exclusive-ORing OB, with TEXT, i.e.,(RESULT1 ,

i i i

RESULT2 ,..., RESULT64 ) = (OB1rTEXT1, OB2rTEXT2, ..., i i i i

OB64rTEXT64). i

d. Forward the current value of the loop number i, KEY, IV , TEXT and RESULT.

i i i

e. Set KEY equal to the corresponding KEY value supplied by the MOVS. i+1

f. Set IV equal to the corresponding PT/TEXT/IV value supplied by the MOVS. i+1

NOTE: The above processing shall continue until all 19 KEY/INPUT pairs, as specified

in Input Type 11, are processed. The output from the IUT for this test shall consist of 19

output strings. Each output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values found in Appendix B, Table 4.
120

MOVS: Initialize KEY0, IV, TEXT0

Send KEY0, IV, TEXT0

IUT: FOR i = 0 TO 399

 {

If (i==0) IB0 = IV

Record i, KEYi, TEXT0

FOR j = 0 TO 9,999

 {

Perform algorithm in encrypt state, resulting in OBj

RESULTj = OBj r TEXTj

TEXTj+1 = IBj

IBj+1 = OBj

 }

Record IB0, RESULTi

Send i, KEYi, IB0, TEXT0, RESULTj

KEYi+1 = KEYi r last n bits of RESULT, where n=64 if DES, n=80 if Skipjack

TEXT0 = TEXT0 r IB9999

IB0 = OB9999

 }

MOVS: Check IUT's output for correctness

Figure 5.37 The Modes Test - OFB Mode

5.4.1.6 The Modes Test - OFB Mode

As summarized in Figure 5.37, the Modes test for the OFB mode shall be performed as follows:

1. The MOVS shall:

a. Initialize KEY, IV and TEXT. The TEXT and IV shall consist of 64 bits, while

the KEY length is dependent on the algorithm implemented.

b. Forward these values to the IUT using Input Type 2.

2. The IUT shall perform the following, for i=0 through 399:

a. If i=0 (if this is the first time through the loop), set the input block IB0 equal to the
121

value of IV, i.e., (IB1 , IB2 ,...,IB64 ) = (IV1, IV2,...,IV64). 0 0 0

b. Record the current value of the outer loop number i, KEY, and TEXT .

i 0

c. For j=0 through 9999, perform the following:

 i. Process IB through the DES or Skipjack algorithm in the encrypt state, j

resulting in the output block OB. j

ii. Calculate RESULT by exclusive-ORing OB with the value of TEXT , i.e., j j j

(RESULT1 , RESULT2 ,..., RESULT64 ) = (OB1 rTEXT1 ,

j j j j j

OB2 rTEXT2 , ... OB64 rTEXT64 ). j j j j

 iii. Prepare for loop j+1 by doing the following:

- Assign the current value of IB to TEXT , i.e., (TEXT1 , TEXT2 , ... j j+1 j+1 j+1

TEXT64 ) = (IB1 , IB2 , ..., IB64 ). j+1 j j j

- Assign the value of the current OB to IB , i.e.,(IB1 , IB2 ,...,IB64 ) j j+1 j+1 j+1 j+1

= (OB1 , OB2 ,...,OB64 ). j j j

d. Record the IB and RESULT . 0 j

e. Output all recorded values for this loop using Output Type 2.

f. In preparation of the next outer loop:

 i. Assign a new value to KEY in preparation for the next outer loop. The

new KEY shall be calculated by exclusive-ORing the current KEY with the

current RESULT. For IUTs of the DES algorithm, this shall equate to

(KEY1 , KEY2 , ... KEY64 ) = (KEY1rRESULT1 ,

i+1 i+1 i+1 i 9999

KEY2irRESULT29999, ... KEY64irRESULT649999). For IUTs of the

Skipjack algorithm, the RESULT shall be expanded in length to 80 bits

(the length of a Skipjack key) before the new KEY can be formed. This

expansion shall be accomplished by concatenating the 16 rightmost bits of

the previous RESULT (RESULT ) with the 64 bits of the current 9998

RESULT (RESULT9999). This value shall then be exclusive-ORed with the

current KEY to form the new KEY, i.e., (KEY1 , KEY2 , ... KEY80 ) i+1 i+1 i+1

= (KEY1rRESULT49 , KEY2rRESULT50 , ... i 9998 i 9998

KEY16rRESULT64 , KEY17rRESULT1 , KEY18rRESULT2 ,

i 9998 i 9999 i 9999

... KEY80rRESULT64 ). i 9999

 ii. Assign a new value to TEXT . The TEXT shall be assigned the value of 0 0
122

the old TEXT , exclusive-ORed with IB , i.e., (TEXT1 , TEXT2 , ... 0 9999 0 0

TEXT64 ) = (TEXT1 rIB1 , TEXT2 rIB2 , ..., TEXT64 rIB64 ). 0 0 9999 0 9999 0 9999

(Note that the new TEXT shall be denoted as TEXT because this value is 0

used for the first pass through the inner loop when j=0.)

iii. Assign a new value to IB . The IB shall be assigned the current value of 0 0

OB9999, i.e., (IB10, IB20,...,IB640) = (OB19999, OB29999,...,OB649999). (Note

that the new IB shall be denoted as IB0 because this value is used for the

first pass through the inner loop when j=0.)

NOTE: The output from the IUT for this test shall consist of 400 output strings. Each

output string shall consist of information included in Output Type 2.

3. The MOVS shall check the IUT's output for correctness by comparing the received results

to known values. 
123

 6. DESIGN OF THE MODES OF OPERATION VALIDATION SYSTEM (MOVS) FOR

DES AND SKIPJACK

6.1 Design Philosophy

NIST validation programs are conformance tests rather than measures of product security. NIST

validation tests are designed to assist in the detection of accidental implementation errors, and are

not designed to detect intentional attempts to misrepresent conformance. Thus, validation by

NIST should not be interpreted as an evaluation or endorsement of overall product security.

An IUT is considered validated for a test option when it passes the appropriate set of MOVS

tests. MOVS testing is via statistical sampling, so validation of an option does not guarantee

100% conformance with the option in the standards.

The intent of the validation process is to provide a rigorous conformance process that can be

performed at modest cost. NIST does not try to prevent a dishonest vendor from purchasing a

validated implementation and using this implementation as the vendor's IUT. Customers who

wish to protect themselves against a dishonest vendor could require that the vendor revalidate the

IUT in the customer's presence.

6.2 Operation of the MOVS

MOVS testing is done through the NIST Cryptographic Module Validation (CMV) Program. 

The CMV Program uses laboratories accredited by the NIST National Voluntary Laboratory

Accreditation Program (NVLAP) to perform conformance tests to cryptographic-related FIPS. A

vendor contracts with a Cryptographic Module Testing (CMT) Laboratory accredited by

NVLAP. The CMT laboratory conducts the MOVS tests on the IUT. The CMT laboratory

submits the results to NIST for validation. If the IUT has successfully completed the tests, NIST

issues a validation certificate for the IUT to the vendor. A list of CMT laboratories is available at

http://csrc.nist.gov/cryptval.
124

Appendix A Sample Round Outputs for the DES

INPUT

KEY = 10316E028C8F3B4A

PLAINTEXT = 0000000000000000

L R

00000000 47092B5B

47092B5B 53F372AF

53F372AF 9F1D158B

9F1D158B 8109CBEE

8109CBEE 60448698

60448698 29EBB1A4

29EBB1A4 620CC3A3

620CC3A3 DEEB3D8A

DEEB3D8A A1A0354D

A1A0354D 9F0303DC

9F0303DC FD898EE8

FD898EE8 2D1AE1DD

2D1AE1DD CBC829FA

CBC829FA B367DEC9

B367DEC9 3F6C3EFD

3F6C3EFD 5A1E5228

OUTPUT

82DCBAFBDEAB6602
125

Appendix B Tables of Values for the Known Answer Tests

Table 1

Resulting Ciphertext from the Variable Plaintext Known Answer Test for DES

(NOTE: KEY = 01 01 01 01 01 01 01 01 (odd parity set))

ROUND PLAINTEXT or IV CIPHERTEXT

(depending on mode)

0 80 00 00 00 00 00 00 00 95 F8 A5 E5 DD 31 D9 00

1 40 00 00 00 00 00 00 00 DD 7F 12 1C A5 01 56 19

2 20 00 00 00 00 00 00 00 2E 86 53 10 4F 38 34 EA

3 10 00 00 00 00 00 00 00 4B D3 88 FF 6C D8 1D 4F

4 08 00 00 00 00 00 00 00 20 B9 E7 67 B2 FB 14 56

5 04 00 00 00 00 00 00 00 55 57 93 80 D7 71 38 EF

6 02 00 00 00 00 00 00 00 6C C5 DE FA AF 04 51 2F

7 01 00 00 00 00 00 00 00 0D 9F 27 9B A5 D8 72 60

8 00 80 00 00 00 00 00 00 D9 03 1B 02 71 BD 5A 0A

9 00 40 00 00 00 00 00 00 42 42 50 B3 7C 3D D9 51

10 00 20 00 00 00 00 00 00 B8 06 1B 7E CD 9A 21 E5

11 00 10 00 00 00 00 00 00 F1 5D 0F 28 6B 65 BD 28

12 00 08 00 00 00 00 00 00 AD D0 CC 8D 6E 5D EB A1

13 00 04 00 00 00 00 00 00 E6 D5 F8 27 52 AD 63 D1
ROUND PLAINTEXT or IV CIPHERTEXT

(depending on mode)

126

14 00 02 00 00 00 00 00 00 EC BF E3 BD 3F 59 1A 5E

15 00 01 00 00 00 00 00 00 F3 56 83 43 79 D1 65 CD

16 00 00 80 00 00 00 00 00 2B 9F 98 2F 20 03 7F A9

17 00 00 40 00 00 00 00 00 88 9D E0 68 A1 6F 0B E6

18 00 00 20 00 00 00 00 00 E1 9E 27 5D 84 6A 12 98

19 00 00 10 00 00 00 00 00 32 9A 8E D5 23 D7 1A EC

20 00 00 08 00 00 00 00 00 E7 FC E2 25 57 D2 3C 97

21 00 00 04 00 00 00 00 00 12 A9 F5 81 7F F2 D6 5D

22 00 00 02 00 00 00 00 00 A4 84 C3 AD 38 DC 9C 19

23 00 00 01 00 00 00 00 00 FB E0 0A 8A 1E F8 AD 72

24 00 00 00 80 00 00 00 00 75 0D 07 94 07 52 13 63

25 00 00 00 40 00 00 00 00 64 FE ED 9C 72 4C 2F AF

26 00 00 00 20 00 00 00 00 F0 2B 26 3B 32 8E 2B 60

27 00 00 00 10 00 00 00 00 9D 64 55 5A 9A 10 B8 52

28 00 00 00 08 00 00 00 00 D1 06 FF 0B ED 52 55 D7

29 00 00 00 04 00 00 00 00 E1 65 2C 6B 13 8C 64 A5

30 00 00 00 02 00 00 00 00 E4 28 58 11 86 EC 8F 46

31 00 00 00 01 00 00 00 00 AE B5 F5 ED E2 2D 1A 36
ROUND PLAINTEXT or IV CIPHERTEXT

(depending on mode)

127

32 00 00 00 00 80 00 00 00 E9 43 D7 56 8A EC 0C 5C

33 00 00 00 00 40 00 00 00 DF 98 C8 27 6F 54 B0 4B

34 00 00 00 00 20 00 00 00 B1 60 E4 68 0F 6C 69 6F

35 00 00 00 00 10 00 00 00 FA 07 52 B0 7D 9C 4A B8

36 00 00 00 00 08 00 00 00 CA 3A 2B 03 6D BC 85 02

37 00 00 00 00 04 00 00 00 5E 09 05 51 7B B5 9B CF

38 00 00 00 00 02 00 00 00 81 4E EB 3B 91 D9 07 26

39 00 00 00 00 01 00 00 00 4D 49 DB 15 32 91 9C 9F

40 00 00 00 00 00 80 00 00 25 EB 5F C3 F8 CF 06 21

41 00 00 00 00 00 40 00 00 AB 6A 20 C0 62 0D 1C 6F

42 00 00 00 00 00 20 00 00 79 E9 0D BC 98 F9 2C CA

43 00 00 00 00 00 10 00 00 86 6E CE DD 80 72 BB 0E

44 00 00 00 00 00 08 00 00 8B 54 53 6F 2F 3E 64 A8

45 00 00 00 00 00 04 00 00 EA 51 D3 97 55 95 B8 6B

46 00 00 00 00 00 02 00 00 CA FF C6 AC 45 42 DE 31

47 00 00 00 00 00 01 00 00 8D D4 5A 2D DF 90 79 6C

48 00 00 00 00 00 00 80 00 10 29 D5 5E 88 0E C2 D0

49 00 00 00 00 00 00 40 00 5D 86 CB 23 63 9D BE A9
ROUND PLAINTEXT or IV CIPHERTEXT

(depending on mode)

128

50 00 00 00 00 00 00 20 00 1D 1C A8 53 AE 7C 0C 5F

51 00 00 00 00 00 00 10 00 CE 33 23 29 24 8F 32 28

52 00 00 00 00 00 00 08 00 84 05 D1 AB E2 4F B9 42

53 00 00 00 00 00 00 04 00 E6 43 D7 80 90 CA 42 07

54 00 00 00 00 00 00 02 00 48 22 1B 99 37 74 8A 23

55 00 00 00 00 00 00 01 00 DD 7C 0B BD 61 FA FD 54

56 00 00 00 00 00 00 00 80 2F BC 29 1A 57 0D B5 C4

57 00 00 00 00 00 00 00 40 E0 7C 30 D7 E4 E2 6E 12

58 00 00 00 00 00 00 00 20 09 53 E2 25 8E 8E 90 A1

59 00 00 00 00 00 00 00 10 5B 71 1B C4 CE EB F2 EE

60 00 00 00 00 00 00 00 08 CC 08 3F 1E 6D 9E 85 F6

61 00 00 00 00 00 00 00 04 D2 FD 88 67 D5 0D 2D FE

62 00 00 00 00 00 00 00 02 06 E7 EA 22 CE 92 70 8F

63 00 00 00 00 00 00 00 01 16 6B 40 B4 4A BA 4B D6
129

Table 2

Resulting Ciphertext from the Variable Key Known Answer Test for DES

(NOTE: Plaintext/text = 00 00 00 00 00 00 00 00 and, where applicable, IV = 00 00 00 00 00 00 00 00)

ROUND KEY CIPHERTEXT

 0 80 01 01 01 01 01 01 01 95 A8 D7 28 13 DA A9 4D

 1 40 01 01 01 01 01 01 01 0E EC 14 87 DD 8C 26 D5

 2 20 01 01 01 01 01 01 01 7A D1 6F FB 79 C4 59 26

 3 10 01 01 01 01 01 01 01 D3 74 62 94 CA 6A 6C F3

 4 08 01 01 01 01 01 01 01 80 9F 5F 87 3C 1F D7 61

 5 04 01 01 01 01 01 01 01 C0 2F AF FE C9 89 D1 FC

 6 02 01 01 01 01 01 01 01 46 15 AA 1D 33 E7 2F 10

 7 01 80 01 01 01 01 01 01 20 55 12 33 50 C0 08 58

 8 01 40 01 01 01 01 01 01 DF 3B 99 D6 57 73 97 C8

 9 01 20 01 01 01 01 01 01 31 FE 17 36 9B 52 88 C9

10 01 10 01 01 01 01 01 01 DF DD 3C C6 4D AE 16 42

11 01 08 01 01 01 01 01 01 17 8C 83 CE 2B 39 9D 94

12 01 04 01 01 01 01 01 01 50 F6 36 32 4A 9B 7F 80

13 01 02 01 01 01 01 01 01 A8 46 8E E3 BC 18 F0 6D

14 01 01 80 01 01 01 01 01 A2 DC 9E 92 FD 3C DE 92
ROUND KEY CIPHERTEXT

130

15 01 01 40 01 01 01 01 01 CA C0 9F 79 7D 03 12 87

16 01 01 20 01 01 01 01 01 90 BA 68 0B 22 AE B5 25

17 01 01 10 01 01 01 01 01 CE 7A 24 F3 50 E2 80 B6

18 01 01 08 01 01 01 01 01 88 2B FF 0A A0 1A 0B 87

19 01 01 04 01 01 01 01 01 25 61 02 88 92 45 11 C2

20 01 01 02 01 01 01 01 01 C7 15 16 C2 9C 75 D1 70

21 01 01 01 80 01 01 01 01 51 99 C2 9A 52 C9 F0 59

22 01 01 01 40 01 01 01 01 C2 2F 0A 29 4A 71 F2 9F

23 01 01 01 20 01 01 01 01 EE 37 14 83 71 4C 02 EA

24 01 01 01 10 01 01 01 01 A8 1F BD 44 8F 9E 52 2F

25 01 01 01 08 01 01 01 01 4F 64 4C 92 E1 92 DF ED

26 01 01 01 04 01 01 01 01 1A FA 9A 66 A6 DF 92 AE

27 01 01 01 02 01 01 01 01 B3 C1 CC 71 5C B8 79 D8

28 01 01 01 01 80 01 01 01 19 D0 32 E6 4A B0 BD 8B

29 01 01 01 01 40 01 01 01 3C FA A7 A7 DC 87 20 DC

30 01 01 01 01 20 01 01 01 B7 26 5F 7F 44 7A C6 F3

31 01 01 01 01 10 01 01 01 9D B7 3B 3C 0D 16 3F 54

32 01 01 01 01 08 01 01 01 81 81 B6 5B AB F4 A9 75
ROUND KEY CIPHERTEXT

131

33 01 01 01 01 04 01 01 01 93 C9 B6 40 42 EA A2 40

34 01 01 01 01 02 01 01 01 55 70 53 08 29 70 55 92

35 01 01 01 01 01 80 01 01 86 38 80 9E 87 87 87 A0

36 01 01 01 01 01 40 01 01 41 B9 A7 9A F7 9A C2 08

37 01 01 01 01 01 20 01 01 7A 9B E4 2F 20 09 A8 92

38 01 01 01 01 01 10 01 01 29 03 8D 56 BA 6D 27 45

39 01 01 01 01 01 08 01 01 54 95 C6 AB F1 E5 DF 51

40 01 01 01 01 01 04 01 01 AE 13 DB D5 61 48 89 33

41 01 01 01 01 01 02 01 01 02 4D 1F FA 89 04 E3 89

42 01 01 01 01 01 01 80 01 D1 39 97 12 F9 9B F0 2E

43 01 01 01 01 01 01 40 01 14 C1 D7 C1 CF FE C7 9E

44 01 01 01 01 01 01 20 01 1D E5 27 9D AE 3B ED 6F

45 01 01 01 01 01 01 10 01 E9 41 A3 3F 85 50 13 03

46 01 01 01 01 01 01 08 01 DA 99 DB BC 9A 03 F3 79

47 01 01 01 01 01 01 04 01 B7 FC 92 F9 1D 8E 92 E9

48 01 01 01 01 01 01 02 01 AE 8E 5C AA 3C A0 4E 85

49 01 01 01 01 01 01 01 80 9C C6 2D F4 3B 6E ED 74

50 01 01 01 01 01 01 01 40 D8 63 DB B5 C5 9A 91 A0
ROUND KEY CIPHERTEXT

132

51 01 01 01 01 01 01 01 20 A1 AB 21 90 54 5B 91 D7

52 01 01 01 01 01 01 01 10 08 75 04 1E 64 C5 70 F7

53 01 01 01 01 01 01 01 08 5A 59 45 28 BE BE F1 CC

54 01 01 01 01 01 01 01 04 FC DB 32 91 DE 21 F0 C0

55 01 01 01 01 01 01 01 02 86 9E FD 7F 9F 26 5A 09
133

Table 3

Values To Be Used for the Permutation Operation Known Answer Test

(NOTE: Plaintext/text = 00 00 00 00 00 00 00 00 for each round and, 

where applicable, IV = 00 00 00 00 00 00 00 00)

ROUND KEY CT/RESULT

0 10 46 91 34 89 98 01 31 88 D5 5E 54 F5 4C 97 B4

1 10 07 10 34 89 98 80 20 0C 0C C0 0C 83 EA 48 FD

2 10 07 10 34 C8 98 01 20 83 BC 8E F3 A6 57 01 83

3 10 46 10 34 89 98 80 20 DF 72 5D CA D9 4E A2 E9

4 10 86 91 15 19 19 01 01 E6 52 B5 3B 55 0B E8 B0

5 10 86 91 15 19 58 01 01 AF 52 71 20 C4 85 CB B0

6 51 07 B0 15 19 58 01 01 0F 04 CE 39 3D B9 26 D5

7 10 07 B0 15 19 19 01 01 C9 F0 0F FC 74 07 90 67

8 31 07 91 54 98 08 01 01 7C FD 82 A5 93 25 2B 4E

 9 31 07 91 94 98 08 01 01 CB 49 A2 F9 E9 13 63 E3

10 10 07 91 15 B9 08 01 40 00 B5 88 BE 70 D2 3F 56

11 31 07 91 15 98 08 01 40 40 6A 9A 6A B4 33 99 AE

12 10 07 D0 15 89 98 01 01 6C B7 73 61 1D CA 9A DA
ROUND KEY CT/RESULT

134

13 91 07 91 15 89 98 01 01 67 FD 21 C1 7D BB 5D 70

14 91 07 D0 15 89 19 01 01 95 92 CB 41 10 43 07 87

15 10 07 D0 15 98 98 01 20 A6 B7 FF 68 A3 18 DD D3

16 10 07 94 04 98 19 01 01 4D 10 21 96 C9 14 CA 16

17 01 07 91 04 91 19 04 01 2D FA 9F 45 73 59 49 65

18 01 07 91 04 91 19 01 01 B4 66 04 81 6C 0E 07 74

19 01 07 94 04 91 19 04 01 6E 7E 62 21 A4 F3 4E 87

20 19 07 92 10 98 1A 01 01 AA 85 E7 46 43 23 31 99

21 10 07 91 19 98 19 08 01 2E 5A 19 DB 4D 19 62 D6

22 10 07 91 19 98 1A 08 01 23 A8 66 A8 09 D3 08 94

23 10 07 92 10 98 19 01 01 D8 12 D9 61 F0 17 D3 20

24 10 07 91 15 98 19 01 0B 05 56 05 81 6E 58 60 8F

25 10 04 80 15 98 19 01 01 AB D8 8E 8B 1B 77 16 F1

26 10 04 80 15 98 19 01 02 53 7A C9 5B E6 9D A1 E1

27 10 04 80 15 98 19 01 08 AE D0 F6 AE 3C 25 CD D8

28 10 02 91 15 98 10 01 04 B3 E3 5A 5E E5 3E 7B 8D

29 10 02 91 15 98 19 01 04 61 C7 9C 71 92 1A 2E F8
ROUND KEY CT/RESULT

135

30 10 02 91 15 98 10 02 01 E2 F5 72 8F 09 95 01 3C

31 10 02 91 16 98 10 01 01 1A EA C3 9A 61 F0 A4 64
136

Table 4

Values To Be Used for the Substitution Table Known Answer Test

KEY PT/TEXT/IV CT/RESULT

(depending on mode)

0 7C A1 10 45 4A 1A 6E 57 01 A1 D6 D0 39 77 67 42 69 0F 5B 0D 9A 26 93 9B

1 01 31 D9 61 9D C1 37 6E 5C D5 4C A8 3D EF 57 DA 7A 38 9D 10 35 4B D2 71

2 07 A1 13 3E 4A 0B 26 86 02 48 D4 38 06 F6 71 72 86 8E BB 51 CA B4 59 9A

3 38 49 67 4C 26 02 31 9E 51 45 4B 58 2D DF 44 0A 71 78 87 6E 01 F1 9B 2A

4 04 B9 15 BA 43 FE B5 B6 42 FD 44 30 59 57 7F A2 AF 37 FB 42 1F 8C 40 95

5 01 13 B9 70 FD 34 F2 CE 05 9B 5E 08 51 CF 14 3A 86 A5 60 F1 0E C6 D8 5B

6 01 70 F1 75 46 8F B5 E6 07 56 D8 E0 77 47 61 D2 0C D3 DA 02 00 21 DC 09

7 43 29 7F AD 38 E3 73 FE 76 25 14 B8 29 BF 48 6A EA 67 6B 2C B7 DB 2B 7A

8 07 A7 13 70 45 DA 2A 16 3B DD 11 90 49 37 28 02 DF D6 4A 81 5C AF 1A 0F

9 04 68 91 04 C2 FD 3B 2F 26 95 5F 68 35 AF 60 9A 5C 51 3C 9C 48 86 C0 88

10 37 D0 6B B5 16 CB 75 46 16 4D 5E 40 4F 27 52 32 0A 2A EE AE 3F F4 AB 77

11 1F 08 26 0D 1A C2 46 5E 6B 05 6E 18 75 9F 5C CA EF 1B F0 3E 5D FA 57 5A

12 58 40 23 64 1A BA 61 76 00 4B D6 EF 09 17 60 62 88 BF 0D B6 D7 0D EE 56

13 02 58 16 16 46 29 B0 07 48 0D 39 00 6E E7 62 F2 A1 F9 91 55 41 02 0B 56

14 49 79 3E BC 79 B3 25 8F 43 75 40 C8 69 8F 3C FA 6F BF 1C AF CF FD 05 56

15 4F B0 5E 15 15 AB 73 A7 07 2D 43 A0 77 07 52 92 2F 22 E4 9B AB 7C A1 AC

16 49 E9 5D 6D 4C A2 29 BF 02 FE 55 77 81 17 F1 2A 5A 6B 61 2C C2 6C CE 4A

17 01 83 10 DC 40 9B 26 D6 1D 9D 5C 50 18 F7 28 C2 5F 4C 03 8E D1 2B 2E 41

18 1C 58 7F 1C 13 92 4F EF 30 55 32 28 6D 6F 29 5A 63 FA C0 D0 34 D9 F7 93
137

Table 5

Resulting Ciphertext from the Variable Plaintext Known Answer Test for Skipjack

(NOTE: KEY = 00 00 00 00 00 00 00 00 00 00)

ROUND PLAINTEXT or IV (depending CIPHERTEXT

on mode)

00 80 00 00 00 00 00 00 00 9A 90 BC 0B 75 C7 37 03

01 40 00 00 00 00 00 00 00 CC 68 43 59 8C 73 2B BE

02 20 00 00 00 00 00 00 00 13 72 95 35 09 B3 C1 4C

03 10 00 00 00 00 00 00 00 70 AA AA 84 18 E4 89 30

04 08 00 00 00 00 00 00 00 E4 B0 B4 A1 39 E8 54 6E

05 04 00 00 00 00 00 00 00 70 18 F7 13 66 14 6E AF

06 02 00 00 00 00 00 00 00 B3 8F 3D 7E 4F 2D 25 3D

07 01 00 00 00 00 00 00 00 D6 4B A2 06 51 13 D9 1E

08 00 80 00 00 00 00 00 00 F9 5B 92 2F 14 27 A9 F2

09 00 40 00 00 00 00 00 00 6B 64 2F DE 40 85 85 86

10 00 20 00 00 00 00 00 00 6C F5 2D 5E 61 69 52 17

11 00 10 00 00 00 00 00 00 BC 0F 6B CA 62 E1 39 A6

12 00 08 00 00 00 00 00 00 6A D5 03 DC 2A B0 BF E2

13 00 04 00 00 00 00 00 00 AF AD D7 CA B6 72 35 16

14 00 02 00 00 00 00 00 00 00 42 1B 89 5A F5 C0 0A

15 00 01 00 00 00 00 00 00 CA D0 45 6C F8 6C D5 98

16 00 00 80 00 00 00 00 00 16 F4 1C 8F 8A 6A 5B 79

17 00 00 40 00 00 00 00 00 4C E7 71 C7 51 BA 27 60

18 00 00 20 00 00 00 00 00 72 C9 02 E5 8C E5 5B 87

19 00 00 10 00 00 00 00 00 6D 37 8C 66 64 D0 01 10

20 00 00 08 00 00 00 00 00 AC 27 B8 5B 0A 75 E8 BA

21 00 00 04 00 00 00 00 00 54 DF 3A 75 5B 00 63 D2

22 00 00 02 00 00 00 00 00 31 4F 4D 28 6D B4 90 58

23 00 00 01 00 00 00 00 00 88 AE 06 66 B2 A0 78 46
ROUND PLAINTEXT or IV (depending CIPHERTEXT

on mode)

138

24 00 00 00 80 00 00 00 00 D8 60 A8 D9 A0 2C BC E8

25 00 00 00 40 00 00 00 00 37 CE 5E EA 53 13 53 5D

26 00 00 00 20 00 00 00 00 73 3A F9 2D A1 C1 80 26

27 00 00 00 10 00 00 00 00 34 1C 23 5F 6E 32 98 1D

28 00 00 00 08 00 00 00 00 C6 A6 56 14 47 D9 E0 96

29 00 00 00 04 00 00 00 00 C5 50 66 A8 D8 39 E5 FA

30 00 00 00 02 00 00 00 00 65 86 4B 48 79 11 A1 0C

31 00 00 00 01 00 00 00 00 87 29 07 E2 D3 36 33 2A

32 00 00 00 00 80 00 00 00 AF 03 76 88 E7 A5 24 9C

33 00 00 00 00 40 00 00 00 C1 FC D1 B4 DC C2 AC BB

34 00 00 00 00 20 00 00 00 40 48 48 80 2D 69 3D DA

35 00 00 00 00 10 00 00 00 B2 DC CE E3 3B 15 6D B6

36 00 00 00 00 08 00 00 00 E6 20 F4 2A 7F A9 01 0B

37 00 00 00 00 04 00 00 00 7C F0 67 F3 BD 3E C3 53

38 00 00 00 00 02 00 00 00 06 37 78 1F 1A 34 72 81

39 00 00 00 00 01 00 00 00 47 41 F1 46 4B 71 70 8E

40 00 00 00 00 00 80 00 00 ED AD 33 F4 56 F5 14 DF

41 00 00 00 00 00 40 00 00 ED 81 27 48 B7 F5 23 E9

42 00 00 00 00 00 20 00 00 83 8C 9C C3 83 D4 62 97

43 00 00 00 00 00 10 00 00 FB 2B C0 FC C9 2F 9B 24

44 00 00 00 00 00 08 00 00 E5 9A A1 12 2A 65 44 32

45 00 00 00 00 00 04 00 00 D4 C8 EF 7E 06 43 12 53

46 00 00 00 00 00 02 00 00 32 ED 63 28 14 C2 A8 56

47 00 00 00 00 00 01 00 00 5D C2 9F 7D E9 6E E5 2C

48 00 00 00 00 00 00 80 00 68 A0 7C 7E 8E AD D5 61

49 00 00 00 00 00 00 40 00 B2 70 68 F2 D6 B3 37 E2

50 00 00 00 00 00 00 20 00 1A F5 1E 9C 29 BF DC 7B

51 00 00 00 00 00 00 10 00 92 1D BD 9B 1C 6B EA EB
ROUND PLAINTEXT or IV (depending CIPHERTEXT

on mode)

139

52 00 00 00 00 00 00 08 00 5B 6A 60 22 35 94 35 D2

53 00 00 00 00 00 00 04 00 D7 74 C6 23 74 B2 3B 09

54 00 00 00 00 00 00 02 00 FD 9F 05 27 59 4C E3 7B

55 00 00 00 00 00 00 01 00 67 86 01 C8 B3 64 A7 94

56 00 00 00 00 00 00 00 80 D5 18 22 8D 5B 0B E3 D7

57 00 00 00 00 00 00 00 40 A4 5F EE 6B DD 1F 73 4A

58 00 00 00 00 00 00 00 20 D1 BA 95 51 DF 7C D5 68

59 00 00 00 00 00 00 00 10 AE A3 3D 09 DC 9D 13 10

60 00 00 00 00 00 00 00 08 96 B4 91 C1 FE 44 3E 9A

61 00 00 00 00 00 00 00 04 D0 E0 14 CF EE 94 58 9D

62 00 00 00 00 00 00 00 02 0B 9E 44 B5 37 AF 28 79

63 00 00 00 00 00 00 00 01 22 F4 28 E3 EC 49 1E 60
140

 Table 6

Resulting Ciphertext from the Variable Key Known Answer Test for Skipjack

((NOTE: Plaintext/text = 00 00 00 00 00 00 00 00 and, where applicable, IV = 00 00 00 00 00 00 00 00)

ROUND KEY CIPHERTEXT

0 80 00 00 00 00 00 00 00 00 00 7A 00 E4 94 41 46 1F 5A

1 40 00 00 00 00 00 00 00 00 00 A1 4F F8 BC D1 BC 9E F9

2 20 00 00 00 00 00 00 00 00 00 D7 E8 10 38 5A 42 AA EA

3 10 00 00 00 00 00 00 00 00 00 28 FE 2C 33 32 AA BD 35

4 08 00 00 00 00 00 00 00 00 00 3F C0 F0 5E E6 CE 78 8A

5 04 00 00 00 00 00 00 00 00 00 44 3D D0 CB 75 26 F7 4B

6 02 00 00 00 00 00 00 00 00 00 AD 81 9E 67 7C F9 03 05

7 01 00 00 00 00 00 00 00 00 00 98 91 75 5E 5E BA 5B 1D

8 00 80 00 00 00 00 00 00 00 00 0E 64 B4 94 63 3B F2 CB

9 00 40 00 00 00 00 00 00 00 00 63 38 1A 08 A4 7F C4 8D

10 00 20 00 00 00 00 00 00 00 00 F4 10 8B 09 9B 04 70 40

11 00 10 00 00 00 00 00 00 00 00 74 02 16 61 4E D0 E2 5B

12 00 08 00 00 00 00 00 00 00 00 80 00 91 7B 2E 16 B9 2A

13 00 04 00 00 00 00 00 00 00 00 A9 76 9B 62 B3 A0 BE 4E

14 00 02 00 00 00 00 00 00 00 00 42 FD B8 72 EA 31 41 21

15 00 01 00 00 00 00 00 00 00 00 1D 67 2B A0 15 6A B3 9D

16 00 00 80 00 00 00 00 00 00 00 F4 44 41 D7 C7 77 F0 57

17 00 00 40 00 00 00 00 00 00 00 EA 48 7D DC 36 0D 15 94

18 00 00 20 00 00 00 00 00 00 00 32 4B 0E 78 5F F2 B9 08

19 00 00 10 00 00 00 00 00 00 00 1A F5 9E C2 B9 D6 4C 4F

20 00 00 08 00 00 00 00 00 00 00 81 9B 7E 10 2E 76 A0 EE

21 00 00 04 00 00 00 00 00 00 00 0B 0B FE 0D 4A 37 AA 9E

22 00 00 02 00 00 00 00 00 00 00 12 B4 3E 37 60 D3 0D A6

23 00 00 01 00 00 00 00 00 00 00 31 77 25 6C 46 15 41 EE
ROUND KEY CIPHERTEXT

141

24 00 00 00 80 00 00 00 00 00 00 36 00 EB 92 83 6C A0 26

25 00 00 00 40 00 00 00 00 00 00 75 A4 35 AD 22 EC F7 93

26 00 00 00 20 00 00 00 00 00 00 71 90 AA 99 13 C1 F9 EC

27 00 00 00 10 00 00 00 00 00 00 AB A7 18 B1 85 A1 1D D0

28 00 00 00 08 00 00 00 00 00 00 40 F6 7A BF CC 3B 87 3C

29 00 00 00 04 00 00 00 00 00 00 38 A0 A5 8F B0 97 28 F2

30 00 00 00 02 00 00 00 00 00 00 CA 70 2E 49 BF 6F A6 45

31 00 00 00 01 00 00 00 00 00 00 45 5D 93 F0 39 EA 08 60

32 00 00 00 00 80 00 00 00 00 00 53 47 64 3F E8 03 88 3F

33 00 00 00 00 40 00 00 00 00 00 F4 0F F1 DC BA 2B C1 E5

34 00 00 00 00 20 00 00 00 00 00 57 4A 48 48 36 9D 41 2E

35 00 00 00 00 10 00 00 00 00 00 B2 BE 93 6E 36 67 06 36

36 00 00 00 00 08 00 00 00 00 00 5C 88 51 7D 27 42 E6 19

37 00 00 00 00 04 00 00 00 00 00 99 3C 89 D0 9A 2F E5 56

38 00 00 00 00 02 00 00 00 00 00 1A 3F 72 DA 69 4C 9F C7

39 00 00 00 00 01 00 00 00 00 00 96 59 D5 22 8F 4C B1 51

40 00 00 00 00 00 80 00 00 00 00 7C 13 F4 9E 75 0F 5C 30

41 00 00 00 00 00 40 00 00 00 00 35 00 BD 40 7B CD 01 F6

42 00 00 00 00 00 20 00 00 00 00 85 C5 8E 3C 49 44 20 28

43 00 00 00 00 00 10 00 00 00 00 84 13 84 0A 2D 48 AB EA

44 00 00 00 00 00 08 00 00 00 00 83 28 50 E6 E5 C4 AE 5A

45 00 00 00 00 00 04 00 00 00 00 29 E9 7F 0D 9F 0F DC 5F

46 00 00 00 00 00 02 00 00 00 00 2C 45 23 04 37 FF 2E 04

47 00 00 00 00 00 01 00 00 00 00 10 C4 09 FB 87 2A 98 4F

48 00 00 00 00 00 00 80 00 00 00 14 69 3B 30 C3 AF 74 70

49 00 00 00 00 00 00 40 00 00 00 91 3A 90 50 D5 85 BA B9

50 00 00 00 00 00 00 20 00 00 00 5B FB 0F 83 AB 0C 6E EA

51 00 00 00 00 00 00 10 00 00 00 6C 0C A7 28 4D 83 6A AE
ROUND KEY CIPHERTEXT

142

52 00 00 00 00 00 00 08 00 00 00 AC 57 27 D6 12 E1 85 E8

53 00 00 00 00 00 00 04 00 00 00 38 D7 D5 96 A3 D2 9D 90

54 00 00 00 00 00 00 02 00 00 00 78 BA DA D3 BC 43 6C A2

55 00 00 00 00 00 00 01 00 00 00 E4 05 77 87 41 B0 4B A0

56 00 00 00 00 00 00 00 80 00 00 72 FF E4 3D EA 02 AF A5

57 00 00 00 00 00 00 00 40 00 00 52 E9 31 DF 24 8C E4 C7

58 00 00 00 00 00 00 00 20 00 00 4B B1 65 FD B3 BF F6 5C

59 00 00 00 00 00 00 00 10 00 00 7C FA FA 68 61 D7 B4 7D

60 00 00 00 00 00 00 00 08 00 00 48 D1 75 52 31 F8 7A 2A

61 00 00 00 00 00 00 00 04 00 00 41 32 07 DA 1C 9B 6A B5

62 00 00 00 00 00 00 00 02 00 00 63 F8 18 E9 38 2A 27 78

63 00 00 00 00 00 00 00 01 00 00 ED AF 2B 85 FC 30 EB 09

64 00 00 00 00 00 00 00 00 80 00 11 FC 59 93 82 07 63 F7

65 00 00 00 00 00 00 00 00 40 00 E5 39 C3 96 99 15 09 2F

66 00 00 00 00 00 00 00 00 20 00 50 6F 6A 1E 83 4A D8 F7

67 00 00 00 00 00 00 00 00 10 00 8B 15 BA 30 47 FA 31 95

68 00 00 00 00 00 00 00 00 08 00 13 0B E1 5C 39 3E 4B 7A

69 00 00 00 00 00 00 00 00 04 00 88 95 EC 31 04 CA 10 41

70 00 00 00 00 00 00 00 00 02 00 E4 40 AC DF 4B 64 C9 C9

71 00 00 00 00 00 00 00 00 01 00 C2 32 80 EB E0 93 F0 02

72 00 00 00 00 00 00 00 00 00 80 52 64 A6 57 41 FE 78 E3

73 00 00 00 00 00 00 00 00 00 40 80 89 2E 76 85 47 CE 61

74 00 00 00 00 00 00 00 00 00 20 09 11 41 2D 72 09 34 75

75 00 00 00 00 00 00 00 00 00 10 9F 21 AA 76 47 83 E6 49

76 00 00 00 00 00 00 00 00 00 08 4C A9 FA BE AD 2C 02 C6

77 00 00 00 00 00 00 00 00 00 04 59 CE 10 97 3A 7B 1F D5

78 00 00 00 00 00 00 00 00 00 02 68 3B 29 34 E0 CC BE AA

79 00 00 00 00 00 00 00 00 00 01 74 D0 E7 C2 E3 B4 50 A8
143

REFERENCES

1. Data Encryption Standard (DES), FIPS PUB 46-2, December 30, 1993.

2. Escrowed Encryption Standard (EES), FIPS PUB 185, February 9, 1994.

3. Validating the Correctness of Hardware Implementations of the NBS Data Encryption

Standard, NBS Special Publication 500-20, November, 1977.

4. DES Modes of Operation, FIPS PUB 81, December 2, 1980.

5. Security Requirements for Cryptographic Modules, FIPS PUB 140-1, January 11, 1994.

6. Guidelines for Implementing and Using the NBS Data Encryption Standard, FIPS PUB

74, April 1, 1981.