U.S Department National Institute

of Commerce of Standards and

 Technology

NIST Special Publication 800-20

Modes of Operation Validation System

for the Triple Data Encryption Algorithm

(TMOVS):

Requirements and Procedures

Sharon S. Keller

Information Technology

Laboratory
Computer Science

and Technology

NIST Special Publication 800-20

Modes of Operation Validation System for the Triple Data

Encryption Algorithm

(TMOVS):

Requirements and Procedures

Sharon Keller

Security Technology Group

Computer Security Division

National Institute of Standards and Technology

Gaithersburg, MD 20899-8930

Original Date: October 1999

Revision Date: April 2000

U.S. DEPARTMENT OF COMMERCE

William M. Daley, Secretary

Technology Administration

Gary R. Bachula, Acting Under Secretary for Technology

National Institute of Standards and Technology

Raymond G. Kammer, Director
iii

Revision History

April 2000

Page Revision

OVERALL Rename the Modes Tests to the Monte Carlo Tests to coincide with all other

documents.

OVERALL Represent “through” as “..” not “-“

OVERALL Draw a box around the Triple DES operations in the pseudocode to indicate what

code is from the Triple DES standard and what code is part of the Validation test.

OVERALL Replace subscript numbers with subscript variable names. For example, C9999 is

replaced with Cj.

6 Make reference to the three different keying options specified in FIPS PUB 46-3.

28 Input Type 2 – remove “...represented as a 16 character ASCII...”, replace with

“...represented as an ASCII...”

29 Input Type 5 – same as above

30 Input Type 8 – same as above

32 Input Type 13 – same as above

33 Input Type 15 – same as above

34 Input Type 18 – same as above

35 Input Type 21 – same as above

36 Input Type 22 – for TEXT1, TEXT2, and TEXT3 remove “...1 to 64 binary...”

replace with “...64 binary...”

37 Input Type 24 – same as above

38 Output Type 2 – for DATA and RESULT remove “...is a 16 character

hexidecimal...”, replace with “...is 1 – 64 binary bits represented as an ASCII

hexidecimal...”

39 Output Type 3 – same as above
iv

Page Revision

40 Output Type 6 – same as above

41 Output Type 7 – same as above

41 Output Type 8 – same as above

46 In pseudocode, Send statement – the subscript on C should be lowercase i.

57 Replace P0 = C9999 with P0 = Cj

78 In pseudocode, the subscript should be lowercase i

92 Switch 2) and 3) to make the text coincide with the pseudocode

114 In pseudocode, Send statement – I1i, I2i, and I3i should be sent instead of P1i, P2i,

and P3i

115 Clock Cycle T4, 2) – The subscript on TEMP3 should be 1.

115 b. – Replace P1i, P2i, P3i with I1i, I2i, I3i.

135 Replace Ck9998 with Ckj-1 and replace Ck9999 with Ckj

136 Clock Cycle T4, a) – replace DEA2 with DEA3

 b) – replace DEA3 with DEA2

 replace KEY3i with KEY2i

Swap a) and b) to make the text coincide with the pseudocode.

137 In f), g) and h) –

 Replace subscript 9999 with j

 Replace subscript 9998 with j-1

 Replace subscript 9997 with j-2

165 In the pseudocode, add “FOR k = 1 to 3”

165 Replace subscript 9999 with j

166 In Clock Cycle T1– b), Clock Cycle T2: b), and Clock Cycle T3: b):

 The j in I1j, I2j, and I3j, respectively, should be a subscript: I1j, I2j, I3j.
v

Page Revision

167 In 2b) – Add comma after P3j.

167 In f. – Add comment “Note j=9999.”

167 In f), g) and h) –

 Replace subscript 9999 with j

 Replace subscript 9998 with j-1

 Replace subscript 9997 with j-2

182 In pseudocode, replace the subscript 9999 with j

184 In 2) and 3) – Replace the subscript 9999 with j

184 In 3) – Add subscripts to I and k-bit C so they read Ij and Cj

185-186 In pseudocode, replace the subscript 9999 with j.

187 In 2) and 3) – Replace the subscript 9999 with j.

187 In 2) – Add subscripts to I and k-bit C so they read Ij and Cj

210 In pseudocode, the code pertaining to the Triple DES algorithm does not coincide

with the Triple DES standard. The subscript on RESULT should be j-3, i.e.,

 Ij = RM (64-K) (I(j-1)) || K-bit RESULTj-2

Should be

 Ij = RM (64-K) (I(j-1)) || K-bit RESULTj-3

210 Add a separate Monte Carlo Test for the Encryption and Decryption processes of

the CFB-P Mode of operation. (Section 5.5.2)

211 In pseudocode, replace I9999 with Ij.

212 In b2), replace subscript j-2 with j-3.

213 In 3) and 4) – Replace the subscript 9999 with j. Add statement “...where j =

9999.”

226 At the end of the external loop, where new values are generated for the keys, the

text and the input block, it was unclear in the generation of the new text which
vi

Page Revision

value of text was being referred to in this statement:

 TEXT0 = TEXT0 ⊕ Ij

TEXT0 is referring to the initial text of the INTERNAL loop. Therefore, add the

following code to make this clear:

In pseudocode, add statement “INITTEXT = TEXT0” in the external loop before

the internal loop. This will capture the initial text used for each internal loop.

Also, modify the statement at the end of the external loop:

TEXT0 = TEXT0 ⊕ Ij

To read

TEXT0 = INITTEXT ⊕ Ij

227 In the pseudocode, replace the subscript 9999 with j.

227 In the text, add after b:

“c. Assign the value of TEXT0 to INITTEXT. This will contain the initial text

from every j = 0 loop.”

228 Reletter text.

228 In g 1), 2), and 3) – Replace subscript 9999 with j.

 Replace subscript 9998 with j-1.

 Replace subscript 9997 with j-2.

228 In g 2) – This should read:

Assign a new value to the TEXT0. The TEXT0 should be assigned the value of

INITTEXT exclusive-ORed with Ij.

228 In g NOTE – P should be replaced with TEXT.

252 In the pseudocode, Replace the subscript 9999 with j.

253-254 Replace subscript 9999 with j.
vii

Page Revision

Table A.5 Replace column headings PLAINTEXT1, 2, and 3 with INPUTBLOCK1, 2, and 3.

Table A.7 Replace column headings PLAINTEXT1, 2, and 3 with one column labeled

CIPHERTEXTS.

Replace column headings CIPHERTEXT1, 2, and 3 with PLAINTEXT 1, 2, and 3.

Table A.8 Start ROUND numbers with 0.

Table A.8 Replace colum headings PLAINTEXT1, 2, and 3 with one column labeled

PLAINTEXTS.

Table A.9 Replace column headings PLAINTEXT1, 2, and 3 with PLAINTEXT1 ⊕ IV1,

PLAINTEXT2 ⊕ IV2, and PLAINTEXT3 ⊕ IV3, respectively.

Table A.10 Replace column headings PLAINTEXT1, 2, and 3 with IV1, 2, and 3.
viii

TABLE OF CONTENTS

1. INTRODUCTION....................................................................................................................................... 1

1.1 BACKGROUND ........................................................................................................................................... 1

1.2 ORGANIZATION ......................................................................................................................................... 2

1.3 DEFINITION(S)........................................................................................................................................... 3

1.4 SYMBOLS (AND ACRONYMS)...................................................................................................................... 4

2. TRIPLE DATA ENCRYPTION ALGORITHM (TDEA)......................................................................... 6

2.1 TDEA ELECTRONIC CODEBOOK (TECB) MODE......................................................................................... 7

2.2 TDEA CIPHER BLOCK CHAINING (TCBC) MODE ....................................................................................... 8

2.3 TDEA CIPHER BLOCK CHAINING - INTERLEAVED (TCBC-I) MODE ............................................................ 9

2.4 TDEA CIPHER FEEDBACK (TCFB) MODE ................................................................................................ 11

2.5 TDEA CIPHER FEEDBACK MODE OF OPERATION - PIPELINED (TCFB-P).................................................... 12

2.6 TDEA OUTPUT FEEDBACK (TOFB) MODE............................................................................................... 13

2.7 TDEA OUTPUT FEEDBACK MODE OF OPERATION - INTERLEAVED (TOFB-I).............................................. 14

3. MODES OF OPERATION VALIDATION SYSTEM FOR THE TRIPLE DES (TDES) ALGORITHM

................................................................................................................................................................... 15

3.1 THE KNOWN ANSWER TESTS ................................................................................................................... 15

3.1.1 The Encryption Process................................................................................................................. 15

3.1.1.1 The Variable Plaintext Known Answer Test............................................................................................. 16

3.1.1.2 The Inverse Permutation Known Answer Test .......................................................................................... 16

3.1.1.3 The Variable Key Known Answer Test for the Encryption Process ........................................................... 17

3.1.1.4 The Permutation Operation Known Answer Test for the Encryption Process............................................. 18

3.1.1.5 The Substitution Table Known Answer Test for the Encryption Process.................................................... 19

3.1.2 The Decryption Process ................................................................................................................ 20

3.1.2.1 The Variable Ciphertext Known Answer Test .......................................................................................... 20

3.1.2.2 The Initial Permutation Known Answer Test ............................................................................................ 21

3.1.2.3 The Variable Key Known Answer Test for the Decryption Process........................................................... 22

3.1.2.4 The Permutation Operation Known Answer Test for the Decryption Process............................................. 23

3.1.2.5 The Substitution Table Known Answer Test for the Decryption Process ................................................... 23

3.2 THE MONTE CARLO TEST ........................................................................................................................ 24

4. BASIC PROTOCOL................................................................................................................................. 26

4.1 OVERVIEW .............................................................................................................................................. 26

4.1.1 Conventions.................................................................................................................................. 26

4.1.2 Message Data Types ..................................................................................................................... 26

4.2 MESSAGE CONTENTS............................................................................................................................... 27

4.3 INPUT TYPES ........................................................................................................................................... 27

4.3.1 Input Type 1.................................................................................................................................. 28

4.3.2 Input Type 2.................................................................................................................................. 28

4.3.3 Input Type 3.................................................................................................................................. 28

4.3.4 Input Type 4.................................................................................................................................. 29

4.3.5 Input Type 5.................................................................................................................................. 29

4.3.6 Input Type 6.................................................................................................................................. 29

4.3.7 Input Type 7.................................................................................................................................. 29

4.3.8 Input Type 8.................................................................................................................................. 30

4.3.9 Input Type 9.................................................................................................................................. 30
ix

4.3.10 Input Type 10................................................................................................................................ 30

4.3.11 Input Type 11................................................................................................................................ 31

4.3.12 Input Type 12................................................................................................................................ 31

4.3.13 Input Type 13................................................................................................................................ 32

4.3.14 Input Type 14................................................................................................................................ 32

4.3.15 Input Type 15................................................................................................................................ 32

4.3.16 Input Type 16................................................................................................................................ 33

4.3.17 Input Type 17................................................................................................................................ 33

4.3.18 Input Type 18................................................................................................................................ 34

4.3.19 Input Type 19................................................................................................................................ 34

4.3.20 Input Type 20................................................................................................................................ 35

4.3.21 Input Type 21................................................................................................................................ 35

4.3.22 Input Type 22................................................................................................................................ 35

4.3.23 Input Type 23................................................................................................................................ 36

4.3.24 Input Type 24................................................................................................................................ 36

4.3.25 Input Type 25................................................................................................................................ 37

4.4 OUTPUT TYPES........................................................................................................................................ 37

4.4.1 Output Type 1 ............................................................................................................................... 38

4.4.2 Output Type 2 ............................................................................................................................... 38

4.4.3 Output Type 3 ............................................................................................................................... 38

4.4.4 Output Type 4 ............................................................................................................................... 39

4.4.5 Output Type 5 ............................................................................................................................... 40

4.4.6 Output Type 6 ............................................................................................................................... 40

4.4.7 Output Type 7 ............................................................................................................................... 41

4.4.8 Output Type 8 ............................................................................................................................... 41

5. TESTS REQUIRED TO VALIDATE AN IMPLEMENTATION OF THE TRIPLE DES

ALGORITHM .......................................................................................................................................................

................................................................................................................................................................... 43

5.1 TDEA ELECTRONIC CODEBOOK (TECB) MODE....................................................................................... 45

5.1.1 Encryption Process....................................................................................................................... 45

5.1.1.1 The Variable Plaintext Known Answer Test - TECB Mode ...................................................................... 46

5.1.1.2 The Inverse Permutation Known Answer Test - TECB Mode.................................................................... 48

5.1.1.3 The Variable Key Known Answer Test for the Encryption Process - TECB Mode..................................... 50

5.1.1.4 Permutation Operation Known Answer Test for the Encryption Process - TECB Mode ............................. 52

5.1.1.5 Substitution Table Known Answer Test for the Encryption Process - TECB Mode.................................... 54

5.1.1.6 Monte Carlo Test for the Encryption Process - TECB Mode .................................................................... 56

5.1.2 Decryption Process....................................................................................................................... 59

5.1.2.1 The Variable Ciphertext Known Answer Test - TECB Mode................................................................... 60

5.1.2.2 The Initial Permutation Known Answer Test - TECB Mode..................................................................... 63

5.1.2.3 The Variable Key Known Answer Test for the Decryption Process - TECB Mode..................................... 65

5.1.2.4 Permutation Operation Known Answer Test for Decryption Process - TECB Mode................................... 68

5.1.2.5 Substitution Table Known Answer Test for the Decryption Process - TECB Mode.................................... 71

5.1.2.6 Monte Carlo Test for the Decryption Process - TECB Mode .................................................................... 74

5.2 CIPHER BLOCK CHAINING (TCBC) MODE ................................................................................................ 77

5.2.1 Encryption Process....................................................................................................................... 77

5.2.1.1 The Variable Plaintext Known Answer Test - TCBC Mode ..................................................................... 78

5.2.1.2 The Inverse Permutation Known Answer - TCBC Mode .......................................................................... 80

5.2.1.3 The Variable Key Known Answer Test for the Encryption Process - TCBC Mode..................................... 82

5.2.1.4 Permutation Operation Known Answer Test for the Encryption Process - TCBC Mode ............................. 85

5.2.1.5 Substitution Table Known Answer Test for the Encryption Process - TCBC Mode.................................... 87

5.2.1.6 Monte Carlo Test for the Encryption Process - TCBC Mode .................................................................... 89

5.2.2 Decryption Process....................................................................................................................... 93

5.2.2.1 The Variable Ciphertext Known Answer Test - TCBC Mode................................................................... 94

5.2.2.2 The Initial Permutation Known Answer Test - TCBC Mode .................................................................... 97

5.2.2.3 The Variable Key Known Answer Test for the Decryption Process - TCBC Mode .................................... 99
x

5.2.2.4 Permutation Operation Known Answer Test for Decryption Process - TCBC Mode................................. 102

5.2.2.5 Substitution Table Known Answer Test for the Decryption Process - TCBC Mode ................................. 105

5.2.2.6 Monte Carlo Test for the Decryption Process - TCBC Mode .................................................................. 108

5.3 CIPHER BLOCK CHAINING MODE - INTERLEAVED (TCBC-I).................................................................... 112

5.3.1 Encryption Process..................................................................................................................... 112

5.3.1.1 The Variable Plaintext Known Answer Test - TCBC-I Mode................................................................. 113

5.3.1.2 The Inverse Permutation Known Answer Test - TCBC-I Mode .............................................................. 117

5.3.1.3 The Variable Key Known Answer Test for the Encryption Process - TCBC-I Mode ................................ 121

5.3.1.4 Permutation Operation Known Answer Test for the Encryption Process - TCBC-I Mode......................... 125

5.3.1.5 Substitution Table Known Answer Test for the Encryption Process - TCBC-I Mode ............................... 129

5.3.1.6 Monte Carlo Test for the Encryption Process - TCBC-I Mode................................................................ 133

5.3.2 Decryption Process..................................................................................................................... 138

5.3.2.1 The Variable Ciphertext Known Answer Test - TCBC-I Mode .............................................................. 139

5.3.2.2 The Initial Permutation Known Answer - TCBC-I Mode........................................................................ 143

5.3.2.3 The Variable Key Known Answer Test for the Decryption Process - TCBC-I Mode ................................ 147

5.3.2.4 Permutation Operation Known Answer Test for the Decryption Process - TCBC-I Mode......................... 152

5.3.2.5 Substitution Table Known Answer Test for the Decryption Process - TCBC-I Mode ............................... 157

5.3.2.6 Monte Carlo Test for the Decryption Process - TCBC-I Mode................................................................ 162

5.4 THE CIPHER FEEDBACK (TCFB) MODE .................................................................................................. 168

5.4.1 The Known Answer Tests - TCFB Mode....................................................................................... 168

5.4.1.1 The Variable TEXT Known Answer Test - TCFB Mode........................................................................ 169

5.4.1.2 The Inverse Permutation Known Answer Test - TCFB Mode................................................................. 171

5.4.1.3 The Variable KEY Known Answer Test - TCFB Mode.......................................................................... 173

5.4.1.4 The Permutation Operation Known Answer Test - TCFB Mode............................................................. 176

5.4.1.5 The Substitution Table Known Answer Test - TCFB Mode ................................................................... 178

5.4.2 The Monte Carlo Tests - TCFB Mode.......................................................................................... 180

5.4.2.1 The Monte Carlo Test for the Encryption Process - TCFB Mode............................................................. 180

5.4.2.2 The Monte Carlo Test for the Decryption Process - TCFB Mode............................................................ 184

5.5 THE CIPHER FEEDBACK (CFB-P) MODE ................................................................................................. 188

5.5.1 The Known Answer Tests - TCFB-P Mode ................................................................................... 188

5.5.1.1 The Variable TEXT Known Answer Test - TCFB-P Mode .................................................................... 189

5.5.1.2 The Inverse Permutation Known Answer Test - TCFB-P Mode.............................................................. 193

5.5.1.3 The Variable KEY Known Answer Test - TCFB-P Mode ...................................................................... 197

5.5.1.4 The Permutation Operation Known Answer Test - TCFB-P Mode .......................................................... 201

5.5.1.5 The Substitution Table Known Answer Test - TCFB-P Mode................................................................ 205

5.5.2 The Monte Carlo Tests - TCFB-P Mode ...................................................................................... 209

5.5.2.1 The Monte Carlo Test for the Encryption Process – K-bit TCFB-P Mode................................................ 209

5.5.2.2 The Monte Carlo Test for the Decryption Process – K-bit TCFB-P Mode................................................ 212

5.6 THE OUTPUT FEEDBACK MODE - TOFB MODE....................................................................................... 217

5.6.1 The Known Answer Tests - TOFB Mode ...................................................................................... 218

5.6.1.1 The Variable TEXT Known Answer Test - TOFB Mode ....................................................................... 218

5.6.1.2 The Inverse Permutation Known Answer Test - TOFB Mode................................................................. 220

5.6.1.3 The Variable KEY Known Answer Test - TOFB Mode ......................................................................... 222

5.6.1.4 The Permutation Operation Known Answer Test - TOFB Mode ............................................................ 225

5.6.1.5 The Substitution Table Known Answer Test - TOFB Mode ................................................................... 227

5.6.2 The Monte Carlo Test - TOFB Mode ........................................................................................... 229

5.7 THE OUTPUT FEEDBACK INTERLEAVED (OFB-I) MODE........................................................................... 233

5.7.1 The Known Answer Tests - TOFB-I Mode.................................................................................... 233

5.7.1.1 The Variable TEXT Known Answer Test - TOFB-I Mode ..................................................................... 234

5.7.1.2 The Inverse Permutation Known Answer Test - TOFB-I Mode .............................................................. 238

5.7.1.3 The Variable KEY Known Answer Test - TOFB-I Mode ....................................................................... 242

5.7.1.4 The Permutation Operation Known Answer Test - TOFB-I Mode .......................................................... 246

5.7.1.5 The Substitution Table Known Answer Test - TOFB-I Mode................................................................. 250

5.7.2 The Monte Carlo Tests - TOFB-I Mode ....................................................................................... 254

6. DESIGN OF THE TRIPLE DES MODES OF OPERATION VALIDATION SYSTEM (TMOVS) .. 258

6.1 DESIGN PHILOSOPHY ................................................................................................................................ 258
xi

6.2 OPERATION OF THE TMOVS..................................................................................................................... 258

APPENDIX A TABLES OF VALUES FOR THE KNOWN ANSWER TESTS ........................................... 259

REFERENCES................................................................................................................................................. 299
xii

FIGURES

Figure 1 TDEA Electronic Codebook (TECB) Mode.................................................................8

Figure 2 TDEA Cipher Block Chaining (TCBC) Mode ..............................................................8

Figure 3 TDEA Cipher Feedback (TCFB) Mode......................................................................11

Figure 4 TDEA Output Feedback (TOFB) Mode.....................................................................13
xiii

TABLES

Table 1 The Variable Plaintext Known Answer Test - TECB Mode........................................46

Table 2 The Inverse Permutation Known Answer Test - TECB Mode ....................................48

Table 3 The Variable Key Known Answer Test for the Encryption Process - TECB Mode .....50

Table 4 The Permutation Operation Known Answer Test for the Encryption Process - TECB

Mode.................................................................................................................................52

Table 5 The Substitution Table Known Answer Test for the Encryption Process - TECB Mode .

..................................................................................................................................54

Table 6 The Monte Carlo Test for the Encryption Process - TECB Mode...............................56

Table 7 The Variable Ciphertext Known Answer Tests - TECB Mode....................................60

Table 8 Initial Permutation Known Answer Test - TECB Mode..............................................63

Table 9 The Variable Key Known Answer Tests for the Decryption Process - TECB Mode....65

Table 10 The Permutation Operation Known Answer Test for the Decryption Process - TECB

Mode.................................................................................................................................68

Table 11 The Substitution Table Known Answer Test for the Decryption Process - TECB Mode .

..................................................................................................................................71

Table 12 The Monte Carlo Test for the Decryption Process - TECB Mode...............................74

Table 13 The Variable Plaintext Known Answer Test - TCBC Mode........................................78

Table 14 The Inverse Permutation Known Answer Test - TCBC Mode ....................................80

Table 15 The Variable Key Known Answer Test for the Encryption Process - TCBC Mode .....82

Table 16 The Permutation Operation Known Answer Test for the Encryption Process - TCBC

Mode.................................................................................................................................85

Table 17 The Substitution Table Known Answer Test for the Encryption Process - TCBC Mode .

..................................................................................................................................87

Table 18 The Monte Carlo Test for the Encryption Process - TCBC Mode...............................89

Table 19 The Variable Ciphertext Known Answer Test - TCBC Mode .....................................94

Table 20 The Initial Permutation Known Answer Test - TCBC Mode.......................................97
xiv

Table 21 The Variable Key Known Answer Test for the Decryption Process - TCBC Mode .....99

Table 22 The Permutation Operation Known Answer Test for the Decryption Process - TCBC

Mode...............................................................................................................................102

Table 23 The Substitution Table Known Answer Test for the Decryption Process - TCBC Mode .

................................................................................................................................105

Table 24 The Monte Carlo Test for the Decryption Process - TCBC Mode ............................108

Table 25 The Variable Plaintext Known Answer Test - TCBC-I Mode ...................................113

Table 26 The Inverse Permutation Known Answer Test - TCBC-I Mode................................117

Table 27 The Variable Key Known Answer Test for the Encryption Process - TCBC-I Mode.121

Table 28 The Permutation Operation Known Answer Test for the Encryption Process - TCBC-I

Mode...............................................................................................................................125

Table 29 The Substitution Table Known Answer Test for the Encryption Process - TCBC-I

Mode...............................................................................................................................129

Table 30 The Monte Carlo Test for the Encryption Process - TCBC-I Mode ..........................133

Table 31 The Variable Ciphertext Known Answer Test - TCBC-I Mode ................................139

Table 32 The Initial Permutation Known Answer Test - TCBC-I Mode..................................143

Table 33 The Variable Key Known Answer Test for the Decryption Process - TCBC-I Mode 147

Table 34 The Permutation Operation Known Answer Test for the Decryption Process - TCBC-I

Mode...............................................................................................................................152

Table 35 The Substitution Table Known Answer Test for the Decryption Process - TCBC-I

Mode...............................................................................................................................157

Table 36 The Monte Carlo Test for the Decryption Process - TCBC-I Mode..........................162

Table 37 The Variable TEXT Known Answer Test - TCFB Mode..........................................169

Table 38 The Inverse Permutation Known Answer Test - TCFB Mode...................................171

Table 39 The Variable Key Known Answer Test - TCFB Mode .............................................173

Table 40 The Permutation Operation Known Answer Test - TCFB Mode ..............................176

Table 41 The Substitution Table Known Answer Test - TCFB Mode .....................................178
xv

Table 42 The Monte Carlo Test for the Encryption Process - TCFB Mode .............................180

Table 43 The Monte Carlo Test for the Decryption Process - TCFB Mode.............................184

Table 44 The Variable TEXT Known Answer Test - TCFB-P Mode ......................................189

Table 45 The Inverse Permutation Known Answer Test - TCFB-P Mode ...............................193

Table 46 The Variable KEY Known Answer Test - TCFB-P Mode ........................................197

Table 47 The Permutation Operation Known Answer Test - TCFB-P Mode ...........................201

Table 48 The Substitution Table Known Answer Test - TCFB-P Mode ..................................205

Table 49 The Monte Carlo Test for the Encryption Process - K-bit TCFB-P Mode.................209

Table 50 The Monte Carlo Test for the Decryption Process - K-bit TCFB-P Mode ................212

Table 51 The Variable TEXT Known Answer Test - TOFB Mode .........................................218

Table 52 The Inverse Permutation Known Answer Test - TOFB Mode ..................................220

Table 53 The Variable Key Known Answer Test - TOFB Mode .............................................222

Table 54 The Permutation Operation Known Answer Test - TOFB Mode ..............................225

Table 55 The Substitution Table Known Answer Test - TOFB Mode .....................................227

Table 56 The Monte Carlo Test - TOFB Mode.......................................................................229

Table 57 The Variable TEXT Known Answer Test - TOFB-I Mode.......................................234

Table 58 The Inverse Permutation Known Answer Test - TOFB-I Mode................................238

Table 59 The Variable KEY Known Answer Test - TOFB-I Mode.........................................242

Table 60 The Permutation Operation Known Answer Test - TOFB-I Mode.............................246

Table 61 The Substitution Table Known Answer Test - TOFB-I Mode...................................250

Table A.1 Resulting Ciphertext from the Variable Plaintext Known Answer Test for the TECB,

TCBC, TCFB, and TOFB Modes of Operation................................................................259

Table A.2 Resulting Ciphertext from the Variable Key Known Answer Test for the TECB,

TCBC, TCFB, and TOFB Modes of Operation................................................................264

Table A.3 Values To Be Used for the Permutation Operation Known Answer Test for the TECB,

TCBC, TCFB, and TOFB Modes of Operation................................................................268
xvi

Table A.4 Values To Be Used for the Substitution Table Known Answer Test for the TECB,

TCBC, TCFB, and TOFB Modes of Operation................................................................271

Table A.5 Resulting Ciphertext from the Variable Plaintext Known Answer Test for TCBC-I

Mode of Operation ..........................................................................................................273

Table A.6 Resulting Ciphertext from the Inverse Permutation Known Answer Test for TCBC-I

Mode of Operation (Encryption Process)........................................................................278

Table A.7 Resulting Ciphertext from the Initial Permutation Known Answer Test for TCBC-I

Mode of Operation (Decryption Process).........................................................................281

Table A.8 Values To Be Used for the Substitution Table Known Answer Test for TCBC-I Mode

of Operation ....................................................................................................................284

Table A.9 Resulting Ciphertext from the Variable TEXT Known Answer Test for TCFB-P and

TOFB-I Modes of Operation ...........................................................................................285

Table A.10 Values to be Used for the Substitution Table Known Answer Test for TCFB-P and

TOFB-I Modes of Operation ...........................................................................................290

Table A.11 Resulting Ciphertext from the Variable KEY Known Answer Test for TCBC-I,

TCFB-P and TOFB-I Modes of Operation.......................................................................292

Table A.12 Values To Be Used for the Permutation Operation Known Answer Test for TCBC-I,

TCFB-P and TOFB-I Modes of Operation.......................................................................296
1

ABSTRACT

The National Institute of Standards and Technology (NIST) Triple Data Encryption Algorithm

(TDEA) Modes of Operation Validation System (TMOVS) specifies the procedures involved in

validating implementations of the Triple DES algorithm in FIPS PUB 46-3 Data Encryption

Standard (DES) (and ANSI X9.52 – 1998). The TMOVS is designed to perform automated

testing on Implementations Under Test (IUTs). This publication provides brief overviews of the

Triple DES algorithm and introduces the basic design and configuration of the TMOVS. Included

in this overview are the specifications for the two categories of tests that make up the TMOVS,

i.e., the Known Answer tests and the Monte Carlo tests. The requirements and administrative

procedures to be followed by those seeking formal NIST validation of an implementation of the

Triple DES algorithm are presented. The requirements described include the specific protocols for

communication between the IUT and the TMOVS, the types of tests which the IUT must pass for

formal NIST validation, and general instructions for accessing and interfacing with the TMOVS.

An appendix with tables of values and results for the Triple DES Known Answer tests is also

provided.

Key words: automated testing, computer security, cryptographic algorithms, cryptography, Triple

Data Encryption Algorithm (TDEA), Triple Data Encryption Standard (TDES), Federal

Information Processing Standard (FIPS), NVLAP, secret key cryptography, validation.

1. Introduction

1.1 Background

The publication specifies the tests required to validate Implementations Under Test (IUTs) for

conformance to the Triple DES algorithm (TDEA) as specified in ANSI X9.52, Triple Data

Encryption Algorithm Modes of Operation. When applied to IUTs that implement the TDEA, the

TDEA Modes of Operation Validation System (TMOVS) provides testing to determine the

correctness of the algorithm implementation. This involves both testing the specific components

of the algorithm, as well as, exercising the entire algorithm implementation. In addition to

determining conformance, the TMOVS is structured to detect implementation flaws including

pointer problems, insufficient allocation of space, improper error handling, and incorrect behavior

of the TDEA implementation.

The TMOVS is composed of two types of validation tests, the Known Answer tests and the

Monte Carlo tests. The validation tests are based on the standard DES test set and the Monte

Carlo test described in Special Publication 800-17, Modes of Operation Validation System

(MOVS): Requirements and Procedures. By applying the same framework specified in Special

Publication 800-17 to TDES, the TMOVS specifies how to validate implementations of the

TDEA in software, firmware, hardware, or any combination thereof.

The Known Answer tests are designed to verify the components of the DES algorithm in the IUT

(e.g., S boxes, permutation tables,...). The tests exercise each bit of every component of the
2

algorithm implementation. This is accomplished by processing all possible basis vectors through

the IUT. To perform the Known Answer tests, the TMOVS supplies known values to the IUT

and the IUT then processes the input through the implemented algorithm. The results produced

by the IUT are compared to the expected values.

The Monte Carlo Test is designed to exercise the entire implementation of the TDEA, as opposed

to testing only the individual components. The purpose of the Monte Carlo Test is to detect the

presence of flaws in the IUT that were not detected with the controlled input of the Known

Answer test. The Monte Carlo Test does not guarantee ultimate reliability of the IUT that

implements the TDEA (i.e., hardware failure, software corruption, etc.). To perform the Monte

Carlo Test, the TMOVS supplies the IUT with pseudorandom values for the initial plaintext,

key(s), and, if applicable, initialization vector(s). Using these values, the IUT is exercised through

four million DES encryption/decryption iterations. The results are then compared to the expected

values.

The successful completion of the tests contained within the TMOVS is required to claim

conformance of Triple DES implementations as defined in FIPS PUB 46-3, Data Encryption

Standard (DES). Testing for single DES implementations is defined in Special Publication 800-

17, Modes of Operation Validation System (MOVS): Requirements and Procedures. Testing for

the cryptographic module in which Triple DES is implemented is defined in FIPS PUB 140-1,

Security Requirements for Cryptographic Modules.

1.2 Organization

Section 2 gives a brief overview of the Triple DES algorithm and the five modes of operation

allowed by this algorithm as well as the interleaved and pipelined versions of several of these

modes. Section 3 provides an overview of the tests that make up the Triple DES Modes of

Operation Validation System (TMOVS). Section 4 describes the basic protocol used by the

TMOVS. Section 5 provides a detailed explanation of each test required by the TMOVS to

validate an IUT of the TDEA. Section 6 outlines the design of the TMOVS. Appendix A

provides tables of values for the Known Answer tests for TDEA. These tables include:

— For modes of operation including TECB, TCBC, TCFB, and TOFB:

Table A.1 - Resulting Ciphertext from the Variable Plaintext Known Answer Test

Table A.2 - Resulting Ciphertext from the Variable Key Known Answer Test

Table A.3 - Values to be Used for the Permutation Operation Known Answer Test

Table A.4 - Values to be Used for the Substitution Tables Known Answer Test

— For the TCBC-I mode of operation:

Table A.5 - Resulting Ciphertext from the Variable Plaintext Known Answer Test for

TCBC-I
3

Table A.6 - Resulting Ciphertext from the Inverse Permutation Known Answer Test for

TCBC-I

Table A.7 – Resulting Ciphertext from the Initial Permutation Known Answer Test for

TCBC-I

Table A.8 - Values to be Used for the Substitution Tables Known Answer Test for TCBCI

— For the TCFB-P and TOFB-I modes of operation:

Table A.9 - Resulting Ciphertext from the Variable Text Known Answer Test for TCFBP and TOFB-I

Table A.10 – Values to be Used for the Substitution Tables Known Answer Test for

TCFB-P and TOFB-I

— For the TCBC-I, TCFB-P, and TOFB-I modes of operation:

Table A.11 - Resulting Ciphertext from the Variable Key Known Answer Test for TCBCI, TCFB-P and TOFB-I

Table A.12 – Values to be Used for the Permutation Operation Known Answer Test for

TCBC-I, TCFB-P and TOFB-I

1.3 Definition(s)

1.3.1 Basis vector

A vector consisting of a “1” in the i

th position and “0” in all of the other positions.

1.3.2 Block

A binary vector. In this document, the input and output of encryption and decryption operation

are 64-bit block. The bits are numbered from left to right. The plaintext and ciphertext are

segmented to k-bit blocks, k = 1, 8, 64.

1.3.3 Ciphertext

Encrypted (enciphered) data.

1.3.4 Cryptographic boundary

An explicitly defined contiguous perimeter that establishes the physical bounds around the set of

hardware, software and firmware which is used to implement the TDEA and the associated

cryptographic processes.

1.3.5 Cryptographic key

A parameter that determines the transformation from plaintext to ciphertext and vice versa. (A

DEA key is a 64-bit parameter consisting of 56 independent bits and 8 parity bits). Multiple (1, 2

or 3) keys may be used in the Triple Data Encryption Algorithm.
4

1.3.6 Data Encryption Algorithm

The algorithm specified in FIPS PUB 46-3, Data Encryption Algorithm (DEA).

1.3.7 Decryption

The process of transforming ciphertext into plaintext.

1.3.8 Encryption

The process of transforming plaintext into ciphertext.

1.3.9 Exclusive-OR

The bit-by-bit modulo 2 addition of binary vectors of equal length.

1.3.10 Initialization Vector

A binary vector used as the input to initialize the algorithm for the encryption of a plaintext block

sequence to increase security by introducing additional cryptographic variance and to synchronize

cryptographic equipment. The initialization vector need not be secret. Some of the Triple Data

Encryption Algorithm Modes of Operation require 3 initialization vectors.

1.3.11 Key

See cryptographic key.

1.3.12 Plaintext

Intelligible data that has meaning and can be read or acted upon without the application of

decryption. Also known as cleartext.

1.3.13 Self-dual Key

A key with the property that when you encrypt twice with this key, the result is the initial input.

1.3.14 Triple Data Encryption Algorithm

The algorithm specified in FIPS PUB 46-3 –1999, Data Encryption Algorithm.

1.4 Symbols (and Acronyms)

1.4.1 C Ciphertext

1.4.2 Cn Block of data representing the Ciphertext n

1.4.3 C

1

,...,C64 Bits of the Ciphertext Block

1.4.4 DKEYx(Y) Decrypt Y with the key KEYx

1.4.5 DEA The Data Encryption Algorithm specified in FIPS 46-3

1.4.6 DES Data Encryption Standard specified in FIPS 46-3

1.4.7 EKEYx(Y) Encrypt Y with the key KEYx

1.4.8 FIPS PUB Federal Information Processing Standard Publication
5

1.4.9 I Input Block

1.4.10 In Block of data representing the Input Block n

1.4.11 I

1

, ..., I64 Bits of the Input Block

1.4.12 IUT Implementation Under Test

1.4.13 IV Initialization Vector

1.4.14 IVn Block of data representing IV n

1.4.15 KEYn Block of data representing KEY n

1.4.16 NIST National Institute of Standards and Technology

1.4.17 O Output Block

1.4.18 O

1

,...,O64 Bits of the Output Block

1.4.19 On Block of data representing Output Block n

1.4.20 P Plaintext

1.4.21 P

1

,...,P64 Bits of the Plaintext Block

1.4.22 Pn Block of data representing Plaintext n

1.4.23 RESULTn Block of data representing Plaintext n, if encryption state, or Ciphertext n,

if decryption state

1.4.24 TCBC TDEA Cipher Block Chaining Mode of Operation

1.4.25 TCBC-I TDEA Cipher Block Chaining Mode of Operation - Interleaved

1.4.26 TCFB TDEA Cipher Feedback Mode of Operation

1.4.27 TCFB-P TEA Cipher Feedback Mode of Operation - Pipelined

1.4.28 TDEA Triple Data Encryption Algorithm specified in FIPS 46-3

1.4.29 TDES Triple Data Encryption Standard specified in FIPS 46-3

1.4.30 TECB TDEA Electronic Codebook Mode of Operation

1.4.31 TEXTn Block of data representing Plaintext n, if encryption state, or Ciphertext n, 

if decryption state

1.4.32 TMOVS TDEA Modes of Operation Validation System
6

1.4.33 TOFB TDEA Output Feedback Mode of Operation

1.4.34 TOFB-I TDEA Output Feedback Mode of Operation – Interleaved

1.4.35 VARIABLE n Block of data representing the value of VARIABLE for the n

th iteration

1.4.36 X ⊕ Y Bit-wise inclusive-or of two bit-strings X and Y of the same bit length.

2. Triple Data Encryption Algorithm (TDEA)

FIPS PUB 46-3 - 1999, Data Encryption Standard (DES), (and ANSI X9.52 – 1998) specifies

the Triple Data Encryption Algorithm (TDEA) modes of operation for the enhanced

cryptographic protection of digital data. The modes of operation for TDEA provide a means of

extending the effective key space of the Data Encryption Algorithm (DEA). Certain modes also

provide increased protection against more sophisticated cryptanalytic attacks. FIPS PUB 46-3 -

1999 enhances the basic level of cryptographic protection of digital data provided by DEA, thus

extending the useful lifetime of this technology.

The TDEA consists of three components – the DES algorithm (DEA), multiple keys, and

initialization vector(s). The DEA is called three times in the TDEA. The TDEA utilizes one to

three keys and, depending on the mode of operation being implemented, zero, one or three

initialization vectors (IVs).

The basic processing involved in the TDEA is as follows: An input block is read into the first

DEA (DEA1) and encrypted using the first key (KEY1). The output produced from this stage is

read directly into the second DEA (DEA2) and decrypted using the second key (KEY2). The

output produced by the second stage is directly read into the third DEA (DEA3) and encrypted

using the third key (KEY3). The resultant output block is used, according to the mode

implemented, in the calculation of the ciphertext. Note that the output for the intermediate DEA

stages is never revealed outside the cryptographic boundary.

Three different keying options are allowed by the TDEA. The first option specifies that all the

keys are independent, i.e., KEY1, KEY2, and KEY3 are independent. This is referred to as

Keying Option 1 in FIPS PUB 46-3 – 1999 (and ANSI X9.52 – 1998). It will be referred to as 3-

key TDES in this document. The second option specifies that KEY1 and KEY2 are independent

and KEY3 is equal to KEY1, i.e., KEY1 and KEY2 are independent, KEY3 = KEY1. This is

referred to as Keying Option 2 in FIPS PUB 46-3 – 1999 (and ANSI X9.52 – 1998) and will be

referred to as 2-key TDES in this document. And the third option specifies that KEY1, KEY2

and KEY3 are equal, i.e., KEY1=KEY2=KEY3. This is referred to as Keying Option 3 in FIPS

PUB 46-3 – 1999 (and ANSI X9.52 – 1998 and will be referred to as 1-key TDES in this

document. 1-key TDES is equivalent to single DES.

The initialization vector (IV) must meet the following attributes as specified by the TDEA:

• For TECB, no IV is used.
7

• For all modes using an IV, the IV may be public information.

• For TOFB and TOFB-I, the IV should never be a constant.

• If the mode of operation implemented requires one IV, it may be generated in one of two

ways:

- Randomly or Pseudo-randomly

- As a counter

• If the mode of operation implemented requires three IVs, they should be generated as follows:

- IV1 should be generated in the same manner as one IV (described above).

- IV2 = IV1 + R1 mod 264, where R1 = 5555555555555555.

- IV3= IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA.

A thorough explanation of the processing involved in the four modes of operation supplied by

TDEA, as well as the new message-interleaved and pipelined versions of these modes can be

found in FIPS PUB 46-3 – 1999 (and ANSI X9.52-1998). A brief explanation of each mode is

found below.

2.1 TDEA Electronic Codebook (TECB) Mode

PLAINTEXT

P

↓ I

DEA ENCRYPTKEY1

DEA DECRYPTKEY2

DEA ENCRYPTKEY3

↓ O

CIPHERTEXT

C

CIPHERTEXT

C

↓ I

DEA DECRYPTKEY3

DEA ENCRYPTKEY2

DEA DECRYPTKEY1

↓ O

PLAINTEXT

P

TECB ENCRYPTION TECB DECRYPTION
8

Figure 1 TDEA Electronic Codebook (TECB) Mode

The TDEA Electronic Codebook (TECB) mode is shown in Figure 1. In TECB encryption, a 64-

bit plaintext data block (P) is used directly as the input block (I). The input block is processed

through the first DEA (DEA1) in the encrypt state using KEY1. The output of this process is fed

directly to the input of the second DEA (DEA2) where DES is performed in the decrypt state

using KEY2. The output of this process is fed directly to the input of the third DEA (DEA3)

where DES is performed in the encrypt state using KEY3. The resultant 64-bit output block (O)

is used directly as ciphertext (C).

In TECB decryption, a 64-bit ciphertext block (C) is used directly as the input block (I). The

keying sequence is reversed from the encrypt process. The input block is processed through

DEA3 in the decrypt state using KEY3. The output of this process is fed directly to the input of

DEA2, where DES is performed in the encrypt state using KEY2, and the result is directly fed to

the input of DEA1, where DES is performed in the decrypt state using KEY1. The resultant 64-

bit output block (O) produces the plaintext (P).

2.2 TDEA Cipher Block Chaining (TCBC) Mode

Figure 2 TDEA Cipher Block Chaining (TCBC) Mode

As shown in the upper half of Figure 2, the TDEA Cipher Block Chaining (TCBC) mode begins

processing by dividing a plaintext message into 64-bit data blocks. In TCBC encryption, the first

IV

IV

P1

↓

⊕

↓

I1

ENCRYPTKEY1

DECRYPTKEY2

ENCRYPTKEY3

C1

C1

DECRYPTKEY3

ENCRYPTKEY2

DECRYPTKEY1

O1

↓

⊕

↓

C1

P2

↓

⊕

↓

I2

ENCRYPTKEY1

DECRYPTKEY2

ENCRYPTKEY3

C2

C2

DECRYPTKEY3

ENCRYPTKEY2

DECRYPTKEY1

O2

↓

⊕

↓

C2

PN

↓

⊕

↓

IN

ENCRYPTKEY1

DECRYPTKEY2

ENCRYPTKEY3

CN

CN

DECRYPTKEY3

ENCRYPTKEY2

DECRYPTKEY1

ON

↓

⊕

↓

CN

TIME=1 TIME=2 TIME=N

NOTE: All variables are 64 bits in length.

LEGEND: P=Data Block I=Input Block C=Cipher Block IV=Initialization Vector Å=Exclusive-OR.

ENCRYPT DECRYPT
9

input block (I1) is formed by exclusive-ORing the first plaintext data block (P1) with a 64-bit

initialization vector IV, i.e., (I1 = IV ⊕ P1). The input block is processed through DEA1 in the

encrypt state using KEY1. The output of this process is fed directly to the input of DEA2, which

performs DES in the decrypt state using KEY2. The output of this process is fed directly to the

input of DEA3, which performs DES in the encrypt state using KEY3. The resultant 64-bit output

block (O1) is used directly as ciphertext (C1), i.e., (C1 = O1). This first ciphertext block is then

exclusive-ORed with the second plaintext data block to produce the second input block, i.e., (I2)

= (C1 ⊕ P2). Note that I2 and P2 now refer to the second block. The second input block is

processed through the TDEA to produce the second ciphertext block. This encryption process

continues to "chain" successive cipher and plaintext blocks together until the last plaintext block

in the message is encrypted. If the message does not consist of an integral number of data blocks,

then the final partial data block should be encrypted in a manner specified for the application.

In TCBC decryption (see the lower half of Figure 2), the first ciphertext block (C1) is used

directly as the input block (I1). The keying sequence is reversed from the encrypt process. The

input block is processed through DEA3 in the decrypt state using KEY3. The output of this

process is fed directly to the input of DEA2, where DES is processed in the encrypt state using

KEY2. This resulting value is directly fed to the input of DEA1, where DES is processed in the

decrypt state using KEY1. The resulting output block is exclusive-ORed with the IV (which must

be the same as that used during encryption) to produce the first plaintext block, i.e., (P1 = O1 ⊕

IV). The second ciphertext block is then used as the next input block and is processed through the

TDEA as shown above. The resulting output block is exclusive-ORed with the first ciphertext

block to produce the second plaintext data block, i.e., (P2 = O2 ⊕ C1). (NOTE – P2 and O2 refer

to the second block.) The TCBC decryption process continues in this manner until the last

complete ciphertext block has been decrypted. Ciphertext representing a partial data block must

be decrypted in a manner as specified for the application.

2.3 TDEA Cipher Block Chaining - Interleaved (TCBC-I) Mode

Both the encryption and decryption processes of the TDEA Cipher Block Chaining – Interleaved

(TCBC-I) mode of operation require 3 IVs, an n block message interleaved into three sub-texts,

and 3 keys. The IVs, denoted IV1, IV2, and IV3, are generated based on the specifications

mentioned in Section 2. For both the encryption and decryption processes of the TCBC-I mode of

operation, these values are assigned to the initial values of C1, C2, and C3.

Prior to commencing both the TCBC-I encryption and decryption processes, the TEXT (which

refers to plaintext, P, if encrypting and ciphertext, C, if decrypting) is interleaved into three subtexts. This is accomplished by taking an n-block TEXT and subdividing it into groups consisting

of three blocks each accordingly:

TEXT=(TEXT1, TEXT2,..., TEXTn) =(TEXT1,1, TEXT2,1, TEXT3,1, TEXT1,2, TEXT2,2,

TEXT3,2, TEXT1,3, TEXT2,3, TEXT3,3,...,TEXT1,i, TEXT2,i, TEXT3,i), where i = n/3.

Then the TEXT is decimated into three sub-texts:

TEXT1 = TEXT1,1, TEXT1,2, TEXT1,3,...,TEXT1,n1;
10

TEXT2 = TEXT2,1, TEXT2,2, TEXT2,3,...,TEXT2,n2;

TEXT3 = TEXT3,1, TEXT3,2, TEXT3,3,...,TEXT3,n3;

where

- if n mod 3 = 0, then n1 = n2 = n3 = n/3; The last block in TEXT is TEXT3,n3.

- if n mod 3 = 1, then n1 = (n+2)/3, n2 = n3 = (n-1)/3; The last block in TEXT is

TEXT1,n1.

- if n mod 3 = 2, then n1 = n2 = (n+1)/3, n3 = (n-2)/3; The last block in TEXT is

TEXT2,n2.

The TCBC-I mode of operation is intended for systems equipped with multiple DEA processors.

Each of the DEA processors used in both the encryption and decryption processes utilize the

same processing as that used in the TCBC mode of operation for all three sub-texts. The DEA

processors operate simultaneously.

During the encryption process of the TCBC-I mode of operation, for j=1 to 3 and i=1 to n, the Pj,i

is exclusive-ORed with the Cj,i-1. This value is processed through DEA1 in the encrypt state using

KEY1. The output of this process is fed directly to the input of DEA2, which performs DES in

the decrypt state using KEY2. The output of this process is fed directly to the input of DEA3,

which performs DES in the encrypt state using KEY3. The resultant 64-bit output block is used

directly as the Cj,i.

With three DEA functional blocks, DEA1, DEA2, and DEA3, which are simultaneously clocked,

the encryption of three sub-plaintexts can be interleaved.

In pseudocode terms,

For j = 1 to 3 {

 Cj,0 = IVj

 For i = 1 to nj {

 Cj,i = EKEY3 (DKEY2 (EKEY1 (Pj,i ⊕Cj,i-1)))

 Output Cj,i

 }

}

During the decryption process of the TCBC-I mode of operation, for j=1 to 3 and i=1 to n, the

Cj,i is processed through DEA3 in the decrypt state using KEY3. The output of this process is fed

directly to the input of DEA2, which performs DES in the encrypt state using KEY2. The output

of this process is fed directly to the input of DEA1, which performs DES in the decrypt state

using KEY1. The resultant 64-bit output block is exclusive-ORed with the Cj,i-1. This value is

used directly as the Pj,i.

Because there are three DEA functional blocks, DEA1, DEA2, and DEA3, which are

simultaneously clocked, the decryption of three sub-ciphertexts can be interleaved.
11

In terms of pseudocode,

For j = 1 to 3 {

 Cj,0 = IVj

 For i = 1 to nj {

 Pj,i = DKEY1 (EKEY2 (DKEY3 (Cj,i))) ⊕ Cj,i-1

 Output Pj,i

 }

}

2.4 TDEA Cipher Feedback (TCFB) Mode

Figure 3 TDEA Cipher Feedback (TCFB) Mode

The TDEA Cipher Feedback (TCFB) mode is shown in Figure 3. A message to be encrypted is

divided into K-bit data units, where K may equal 1 through 64 inclusively (K = 1,2,...,64). In both

the TCFB encrypt and decrypt operations, an initialization vector (IV) of length 64 is used. The

input block is assigned the value of the IV, i.e., (I = IV). The input block is processed through

DEA1 in the encrypt state using KEY1. The output of this process is fed directly to the input of

DEA2, where DES is performed in the decrypt state using KEY2. The output of this process is

fed directly to the input of DEA3, where DES is performed in the encrypt state using KEY3.

During encryption, ciphertext is produced by exclusive-ORing a K-bit plaintext data unit with the

most significant K bits of the output block, i.e.,(C1,C2,...,CK) = (P1 ⊕ O1, P2 ⊕ O2,..., PK ⊕ OK),

where each Ci, Pi, and Oi represents a single bit of the ciphertext block C, plaintext block P, and

ENCRYPTION

 SHIFT

INPUT BLOCK

(64-K) BITS K BITS

 1 ... K

ENCRYPTKEY1

DECRYPTKEY2

ENCRYPTKEY3

OUTPUT BLOCK

SELECT DISCARD

 K BITS (64-K) BITS

 1 ... K

 CIPHERTEXT

 ⊕ K BITS

 1 ... K

 PLAINTEXT

 K BITS

 1 ... K

DECRYPTION

 SHIFT

INPUT BLOCK

(64-K) BITS K BITS

 1 ... K

ENCRYPTKEY1

DECRYPTKEY2

ENCRYPTKEY3

OUTPUT BLOCK

SELECT DISCARD

 K BITS (64-K) BITS

 1 ... K

 ⊕

 PLAINTEXT

 K BITS

 1 ... K

CIPHERTEXT

K BITS

1 ... K

INPUT BLOCK INITIALLY

CONTAINS AN IV RIGHT

JUSTIFIED.

FEEDBACK

K BITS
12

output block O, respectively. Similarly, during decryption, plaintext is produced by exclusiveORing a K-bit unit of ciphertext with the most significant K bits of the output block, i.e.,

(P1,P2,...,PK) = (C1 ⊕ O1, C2 ⊕ O2,..., CK ⊕ OK). In both cases, the unused bits of the output

block are discarded. For both the encryption and decryption processes, the next input block is

created by discarding the most significant K bits of the previous input block, shifting the

remaining bits K positions to the left and then inserting the K bits of ciphertext just produced in

the encryption operation or just used in the decryption operation into the least significant bit

positions, i.e., (I1,I2,...,I64) = (I[K+1], I[K+2],..., I64,C1,C2,...,CK). NOTE -- I, P, and C now refer to

the second block. The second block is processed through the TDEA to produce the second

ciphertext block (or plaintext block, if decrypting). The input block is then processed through

DEA1 in the encrypt state. This process continues until the entire plaintext message has been

encrypted or until the entire ciphertext message has been decrypted. For each operation of the

TDEA, one K-bit unit of plaintext produces one K-bit unit of ciphertext, and one K-bit unit of

ciphertext produces one K-bit unit of plaintext.

2.5 TDEA Cipher Feedback Mode of Operation - Pipelined (TCFB-P)

Both the encryption and decryption processes of the TDEA Cipher Feedback – Pipelined (TCFBP) mode of operation require 3 IVs, a K-bit TEXT and 3 keys. The IVs, denoted IV1, IV2, and

IV3 are generated based on the specifications mentioned in the introduction of Section 2. For

both the encryption and decryption processes of the TCFB-P mode of operation, the IV values

are assigned to the input block of DEA1 in succession.

The TCFB-P mode of operation is intended for systems equipped with multiple DEA processors.

Each of the DEA processors used in both the encryption and decryption processes utilize the

same processing as that used in the TCFB mode of operation. With three DEA functional blocks,

which are simultaneously clocked, and with three IVs, the TCFB encryption and decryption

processes can be pipelined.

Prior to commencing both the TCFB-P encryption and decryption processes, a 3-step initialization

process must be conducted as follows:

Step 1: IV1 is input to DEA1 and encrypted using KEY1.

Step 2: The output of DEA1 is input to DEA2 and decrypted using KEY2.

Simultaneously, IV2 is input to DEA1 and encrypted using KEY1.

Step 3: The output of DEA2 is input to DEA3 and encrypted using KEY3. This produces

the first output block. Simultaneous with encryption by DEA3, the output of

DEA1 (from step 2) is input to DEA2 and decrypted using KEY2, and IV3 is input

to DEA1 and encrypted using KEY1.

During encryption, a K-bit ciphertext block is produced by exclusive-ORing the

most significant K-bits of the output block from DEA3 with the K-bit plaintext

block.
13

Successive input blocks for DEA1 are formed by discarding the most significant K bits of the

previous DEA1 input block, shifting the remaining bits K positions to the left and then inserting

the K bits of the newest K-bit ciphertext block into the least significant bit positions. DEA1,

DEA2 and DEA3 are run simultaneously to produce successive output blocks that are exclusiveORed to successive K-bit plaintext blocks to produce successive K-bit ciphertext blocks.

Decryption is performed in the same manner as encryption, except that the role of the plaintext

and the ciphertext are reversed.

2.6 TDEA Output Feedback (TOFB) Mode

Figure 4 TDEA Output Feedback (TOFB) Mode

The TDEA Output Feedback (TOFB) mode is shown in Figure 4. A message to be encrypted is

divided into 64-bit data units. In both the TOFB encrypt and decrypt operations, a 64-bit

initialization vector (IV) is used. The IV is used as input in the first round, i.e., (I = IV). This

input block is processed through DEA1 where DES is processed in the encrypt state using KEY1.

The output of this process is fed directly to the input of DEA2 where DES is processed in the

decrypt state using KEY2. The output of this process is fed directly to the input of DEA3 where

DES is processed in the encrypt state using KEY3. During encryption, ciphertext is produced by

exclusive-ORing a plaintext data unit with an output block, i.e., (C = P ⊕ O). Similarly, during

ENCRYPTION

INPUT BLOCK

64BITS

ENCRYPTKEY1

DECRYPTKEY2

ENCRYPTKEY3

OUTPUT BLOCK

 CIPHERTEXT

 ⊕

 PLAINTEXT

DECRYPTION

INPUT BLOCK

64BITS

ENCRYPTKEY1

DECRYPTKEY2

ENCRYPTKEY3

OUTPUT BLOCK

⊕

 PLAINTEXT

CIPHERTEXT

INPUT BLOCK INITIALLY

CONTAINS AN IV RIGHT

JUSTIFIED.

FEEDBACK

64 BITS
14

decryption, plaintext is produced by exclusive-ORing a ciphertext with an output block, i.e., (P =

C ⊕ O). In both cases the next input block is assigned the value of the output block, i.e., (I = O).

This input block is then processed through the TDEA as described above. This process continues

until the entire plaintext message has been encrypted or until the entire ciphertext message has

been decrypted.

2.7 TDEA Output Feedback Mode of Operation - Interleaved (TOFB-I)

Both the encryption and decryption processes of the TDEA Output Feedback – Interleaved

(TOFB-I) mode of operation require 3 IVs, a TEXT and 3 keys. The IVs, denoted IV1, IV2, and

IV3, are generated based on the specifications mentioned in the introduction of Section 2. For

both the encryption and decryption processes of the TOFB-I mode of operation, the IV values are

assigned to the input block of DEA1 in succession.

The TOFB-I mode of operation is intended for systems equipped with multiple DEA processors.

Each of the DEA processors used in both the encryption and decryption processes utilize the

same processing as that used in the TOFB mode of operation. With three DEA functional blocks,

which are simultaneously clocked, and with three IVs, the TOFB encryption and decryption

processes can be interleaved.

Prior to commencing both the TOFB-I encryption and decryption processes, a 3-step initialization

process must be conducted as follows:

Step 1: IV1 is input to DEA1 and encrypted using KEY1.

Step 2: The output of DEA1 is input to DEA2 and decrypted using KEY2.

Simultaneously, IV2 is input to DEA1 and encrypted using KEY1.

Step 3: The output of DEA2 is input to DEA3 and encrypted using KEY3. This produces

the first output block. Simultaneous with encryption by DEA3, the output of

DEA1 (from step 2) is input to DEA and decrypted using KEY2, and IV3 is input

to DEA1 and encrypted using KEY1.

During encryption, a ciphertext block is produced by exclusive-ORing the output

block from DEA3 with the plaintext block.

Successive input blocks for DEA1 are formed by assigning them the value of the newest

ciphertext block. DEA1, DEA2 and DEA3 are run simultaneously to produce successive output

blocks that are exclusive-ORed to successive plaintext blocks to produce successive ciphertext

blocks.

Decryption is performed in the same manner as encryption, except that the role of the plaintext

and the ciphertext are reversed.
15

3. MODES OF OPERATION VALIDATION SYSTEM FOR THE

TRIPLE DES (TDES) ALGORITHM

The TMOVS for the Triple DES algorithm (TDEA) consists of two types of tests, the Known

Answer tests and the Monte Carlo tests. The TMOVS provides conformance testing for the

components of the algorithm, as well as testing for apparent implementation errors.

The IUTs may be written in software, firmware, hardware, or any combination thereof.

An IUT must allow the TMOVS to have control over the required input parameters for validation

to be feasible. The ability to initialize or load known values to the variables required by a specific

test may exist at the device level or the chip level in an IUT. If an IUT does not allow the

TMOVS to have control over the input parameter values, the TMOVS tests cannot be performed.

An IUT may implement encryption only, decryption only, or both encryption and decryption. This

will determine which TMOVS tests will be performed by an IUT.

The following subsections provide an overview of the Known Answer tests and the Monte Carlo

tests. This overview discusses the functionality of each test and the components of the TDEA

tested by the individual tests.

3.1 The Known Answer Tests

The Known Answer tests are based on the standard DES test set discussed in Special Publication

500-20. They are designed to verify the components of the DES algorithm in the IUT. These

components include the initial permutation IP, the inverse permutation IP-1, the expansion matrix

E, the data permutation P, the key permutations PC1 and PC2, and the substitution tables S1,

S2,...,S8. The tests exercise each bit of every component of the algorithm by processing all

possible basis vectors through the IUT.

A generic overview of the sets of Known Answer tests required for the validation of IUTs

implementing the encryption and/or decryption processes of all modes of operation for the TDEA

is discussed below.

3.1.1 The Encryption Process

An IUT which allows encryption requires the successful completion of five Known Answer tests:

the Variable Plaintext Known Answer Test, the Inverse Permutation Known Answer Test, the

Variable Key Known Answer Test for the Encryption Process, the Permutation Operation Known

Answer Test for the Encryption Process, and the Substitution Table Known Answer Test for the

Encryption Process.

These Known Answer tests are also used in the testing of IUTs implementing the decryption

process of the TCFB, TCFB-P, TOFB and TOFB-I modes of operation. This is due to the fact

that these modes call the three DEA stages in the same order for both the encryption and

decryption processes, i.e., encrypt KEY1, decrypt KEY2 and encrypt KEY3.
16

3.1.1.1 The Variable Plaintext Known Answer Test

To perform the Variable Plaintext Known Answer Test, the TMOVS supplies the IUT

with initial values for the three keys, the plaintext(s) and, if applicable, the initialization

vector(s). For IUTs supporting the interleaved and pipelined configurations of TDES,

initial values for three initialization vectors are supplied by the TMOVS. For IUTs

supporting the TCBC-I mode of operation, an initial value is supplied to three plaintext

variables. These three plaintext variables are initialized to the same value. The other

modes of operation only require one plaintext variable. The TMOVS initializes all keys to

zero (with odd parity set). Each block of data input into the TDEA is represented as a 64-

bit basis vector.

For the four basic modes of operation (TECB, TCBC, TCFB, and TOFB), the input block

is processed through the DEA three times -- first in the encrypt state with KEY1, next in

the decrypt state with KEY2, and lastly, in the encrypt state with KEY3. The resulting

output block is used in the calculation of the ciphertext.

For modes of operation supporting interleaving and pipelining (TCBC-I, TCFB-P, TOFBI), it is assumed that multiprocessing is possible, i.e., each block of input data is processed

by three DES processors. Therefore, three input blocks are processed simultaneously

through the three DES processors resulting in three output blocks which are then used in

the calculation of the three ciphertext values. The formation of the input block is

dependent upon the mode of operation supported. Note that the design of the TMOVS

assumes that, for security reasons, an IUT is designed so that intermediate values resulting

from the first two DES calls are never revealed.

This test is repeated 64 times, using the 64 input basis vectors, allowing for every possible

basis vector to be tested. At the completion of the 64th cycle, all results are verified for

correctness.

If correct results are obtained from an IUT, the Variable Plaintext Known Answer Test

has verified the initial permutation IP and the expansion matrix E via the encrypt operation

by presenting a full set of basis vectors to IP and to E. The test also verifies the inverse

permutation IP-1 via the decrypt operation. It does this by presenting the recovered basis

vectors to IP-1.

3.1.1.2 The Inverse Permutation Known Answer Test

To perform the Inverse Permutation Known Answer Test, the TMOVS supplies the IUT

with initial values for the three keys, the plaintext(s) and, if applicable, the initialization

vector(s). For IUTs supporting the interleaved and pipelined configurations of TDES,

three plaintext values and three initialization vector values are supplied by the TMOVS.

The values supplied are dependent upon the modes of operation being implemented.

This test performs the same processing as the Variable Plaintext Known Answer Test.

The difference is that the plaintext value(s) for this test are set to the ciphertext result(s)
17

obtained from the Variable Plaintext Known Answer Test for the corresponding modes of

operation.

The key is initialized to zero (with odd parity set). This key is a self-dual key. A self-dual

key is a key with the property that when you encrypt twice with this key, the result is the

initial input. Therefore, the result is the same as encrypting and decrypting with the same

key. Using a self-dual key allows basis vectors to be presented to components of the DEA

to validate the IUT’s performance. This is discussed further in the last paragraph of this

section.

For the four basic modes of operation (TECB, TCBC, TCFB, and TOFB), the input block

is processed through the DEA three times -- first in the encrypt state with KEY1, next in

the decrypt state with KEY2, and lastly, in the encrypt state with KEY3. The resulting

output block is used in the calculation of the ciphertext, which is then recorded.

For modes of operation supporting interleaving and pipelining (TCBC-I, TCFB-P, TOFBI), it is assumed that multiprocessing is possible, i.e., each block of input data is processed

by three DES processors. Therefore, three input blocks are processed simultaneously

through the three DES processors, resulting in three output blocks which are then used in

the calculation of the three ciphertext values. The formation of the input block is

dependent upon the mode of operation supported. Note that the design of the TMOVS

assumes that, for security reasons, an IUT is designed so that intermediate values resulting

from the first two DES calls are never revealed.

Using the plaintext and, if applicable, the IV’s supplied by the TMOVS, the IUT runs the

TDES for 64 cycles. At the completion of the 64th cycle, all results are verified for

correctness.

This test, when applied to an IUT, verifies the inverse permutation (IP-1) via the encrypt

operation, because as the basis vectors are recovered, each basis vector is presented to the

inverse permutation IP-1. By performing the decrypt operation, the initial permutation IP

and the expansion matrix E are verified by presenting the full set of basis vectors to them

as well.

3.1.1.3 The Variable Key Known Answer Test for the Encryption Process

To implement the Variable Key Known Answer Test for the Encryption Process, the

TMOVS supplies the IUT with initial values for the three keys, the plaintext(s), and, if

applicable, the initialization vector(s). For IUTs supporting the interleaved and pipelined

configurations of TDES, three initialization vector values are supplied by the TMOVS.

For IUTs supporting the TCBC-I mode of operation, an initial value is supplied to three

plaintext variables. These three plaintext variables are initialized to the same value. The

other modes of operation only require one plaintext variable.

During the initialization process, the plaintext value(s) and the initialization vector value(s)

are set to zero. All three keys for each round are initialized to a 56-bit key basis vector
18

which contains a "1" in the ith significant position and "0"s in all remaining significant

positions of the keys, i.e., KEY1 = KEY2 = KEY3. (NOTE -- the parity bits are not

considered as significant bits. These parity bits may be "1"s or "0"s to maintain odd

parity.)

For the four basic modes of operation (TECB, TCBC, TCFB, and TOFB), the input block

is processed through the DEA three times -- first in the encrypt state with KEY1, next in

the decrypt state with KEY2, and lastly, in the encrypt state with KEY3. The resulting

output block is used in the calculation of the ciphertext, which is then recorded.

For modes of operation supporting interleaving and pipelining (TCBC-I, TCFB-P, TOFBI), it is assumed that multiprocessing is possible, i.e., each block of input data is processed

by three DES processors. Therefore, three input blocks are processed simultaneously

through the three DES processors, resulting in three output blocks which are then used in

the calculation of the three ciphertext values. The formation of the input block is

dependent upon the mode of operation supported. Note that the design of the TMOVS

assumes that, for security reasons, an IUT is designed so that intermediate values resulting

from the first two DES calls are never revealed.

This test is repeated 56 times, using the 56 key basis vectors to allow for every possible

vector to be tested. At the completion of the 56th cycle, all results are verified for

correctness.

When this test is performed for an IUT, the 56 possible key basis vectors which yield

unique keys are presented to PC1, verifying the key permutation PC1 via the encrypt

operation. Also, during the encrypt operation, a complete set of key basis vectors is

presented to PC2 as well, so PC2 is verified.

This test also verifies the right shifts in the key schedule via the DES decrypt operation as

the basis vectors are recovered.

3.1.1.4 The Permutation Operation Known Answer Test for the Encryption

Process

To implement the Permutation Operation Known Answer Test for the Encryption Process,

the TMOVS supplies the IUT with 32 key values. The TMOVS also supplies initial

values for the plaintext(s) and, if applicable, the initialization vector(s). For IUTs

supporting the interleaved and pipelined configurations of TDES, initial values for three

initialization vectors are supplied by the TMOVS. For IUTs supporting the TCBC-I mode

of operation, an initial value to be assigned to all three plaintext values is supplied. The

other modes of operation only require one plaintext value. During the initialization of a

test, the plaintext value(s) and the first (or only) initialization vector value are set to 0,

while the key values are assigned to one of the 32 key values supplied by the TMOVS.

Note that KEY1=KEY2=KEY3. If more than one initialization vector is used by a TDES

mode of operation, the other IVs are computed according to specifications in Section 2.
19

For the four basic modes of operation (TECB, TCBC, TCFB, and TOFB), the input block

is processed through the DEA three times -- first in the encrypt state with KEY1, next in

the decrypt state with KEY2, and lastly, in the encrypt state with KEY3. The resulting

output block is used in the calculation of the ciphertext, which is then recorded.

For modes of operation supporting interleaving and pipelining (TCBC-I, TCFB-P, TOFBI), it is assumed that multiprocessing is possible, i.e., each block of input data is processed

by three DES processors. Therefore, three input blocks are processed simultaneously

through the three DES processors, resulting in three output blocks which are then used in

the calculation of the three ciphertext values. The formation of the input block is

dependent upon the mode of operation supported. Note that the design of the TMOVS

assumes that, for security reasons, an IUT is designed so that intermediate values resulting

from the first two DES calls are never revealed.

Each of the 32 key values supplied by the TMOVS is tested. At the completion of the 32nd

cycle, all results are verified for correctness.

The 32 key values used in this test present a complete set of basis vectors to the

permutation operator P. By doing so, P is verified. This occurs when both the encrypt and

decrypt operations are performed.

3.1.1.5 The Substitution Table Known Answer Test for the Encryption

Process

To implement the Substitution Table Known Answer Test for the Encryption Process, the

TMOVS supplies the IUT with 19 key-data sets. Depending on the mode of operation

implemented, the data value will be assigned to the plaintext or to the initialization vector

variables. For IUTs supporting the interleaved and pipelined configurations of TDES,

initial values for three initialization vectors are also supplied by the TMOVS. For the

TCBC-I mode of operation, initial values for three plaintext variables are supplied as well.

The other modes of operation only require one plaintext variable. During initialization, the

plaintext values (or the initialization vector values, depending on the mode of operation

supported), and the key values are initialized to one of the 19 key-data sets supplied by the

TMOVS.

For the four basic modes of operation (TECB, TCBC, TCFB, and TOFB), the input block

is processed through the DEA three times -- first in the encrypt state with KEY1, next in

the decrypt state with KEY2, and lastly, in the encrypt state with KEY3. The resulting

output block is used in the calculation of the ciphertext, which is then recorded.

For modes of operation supporting interleaving and pipelining (TCBC-I, TCFB-P, TOFBI), it is assumed that multiprocessing is possible, i.e., each block of input data is processed

by three DES processors. Therefore, three input blocks are processed simultaneously

through the three DES processors, resulting in three output blocks which are then used in

the calculation of the three ciphertext values. The formation of the input block is

dependent upon the mode of operation supported. Note that the design of the TMOVS
20

assumes that, for security reasons, an IUT is designed so that intermediate values resulting

from the first two DES calls are never revealed.

This test is repeated for each of the 19 key-data sets, allowing every value in the set of 19

key-data sets to be tested. At the completion of the 19th set, all results are verified for

correctness.

The set of 19 key-data sets used in this test result in every entry of all eight S-box

substitution tables being used at least once during both the encrypt and decrypt operations.

Thus, this test verifies the 64 entries in each of the eight substitution tables.

3.1.2 The Decryption Process

The five Known Answer tests required for validation of IUTs implementing the decryption

process of the TDEA consist of the Variable Ciphertext Known Answer Test, the Initial

Permutation Known Answer Test, the Variable Key Known Answer Test for the Decryption

Process, the Permutation Operation Known Answer Test for the Decryption Process and the

Substitution Table Known Answer Test for the Decryption Process. These tests are only

performed by IUTs that support the TECB, TCBC, and TCBC-I modes of operation, since only

these modes of operation utilize the three DES stages in reverse order during the decryption

process. The TCFB, TCFB-P, TOFB, and TOFB-I modes of operation utilize the DES calls in the

same order used in the encryption process, i.e., encrypt with KEY1, decrypt with KEY2 and

encrypt with KEY3. Therefore, these modes of operation should be tested using the same Known

Answer tests used for IUTs that support the encryption process.

3.1.2.1 The Variable Ciphertext Known Answer Test

To perform the Variable Ciphertext Known Answer Test, the TMOVS supplies the IUT

with 64 ciphertext values. These values are obtained from the results of the Variable

Plaintext Known Answer Test if the IUT performs both encryption and decryption.

Otherwise, the TMOVS will supply the IUT with the ciphertext values. If applicable, the

TMOVS also supplies initial values for the initialization vector(s). For IUTs supporting

the interleaved configuration of the TCBC mode of operation (TCBC-I), 64 sets of

ciphertext values consisting of three ciphertext values each and three initialization vectors

are supplied. These supplied values are dependent upon the mode of operation being

implemented. The keys and initialization vectors are initialized to zero for each test.

For the TECB and TCBC modes of operation, the value of the ciphertext is used directly

as the input block of data. The input block is processed through the DEA three times --

first in the decrypt state with KEY3, next in the encrypt state with KEY2, and lastly, in the

decrypt state with KEY1. The resulting output block is used in the calculation of the

plaintext, which is then recorded.

For the TCBC-I mode of operation, it is assumed that multiprocessing is possible, i.e.,

each block of input data is processed by three DES processors. Therefore, three input

blocks are processed simultaneously through the three DES processors, resulting in three
21

output blocks which are then used in the calculation of the three plaintext values. Note

that the design of the TMOVS assumes that, for security reasons, an IUT is designed so

that intermediate values resulting from the first two DES calls are never revealed.

This test is repeated once for each of the 64 ciphertext values. If the 64 resulting plaintext

values form the set of basis vectors, it can be assumed that all of the operations were

performed successfully.

As the basis vectors are recovered via the decrypt operation, they are presented to the

inverse permutation IP-1, thus verifying it. This test also verifies the initial permutation IP

and the expansion matrix E via the encrypt operation by presenting a full set of basis

vectors to these components.

3.1.2.2 The Initial Permutation Known Answer Test

To perform the Initial Permutation Known Answer Test, the TMOVS supplies the IUT

with initial values for the ciphertext, the keys, and, if applicable, the initialization vector(s).

For IUTs supporting the TCBC-I mode of operation, three ciphertext values and three

initialization vector values are supplied. The values supplied are dependent upon the mode

of operation being implemented. The ciphertext value(s) are set to the plaintext result(s)

obtained from the Variable Ciphertext Known Answer Test.

The key is initialized to zero (with odd parity set). This key is a self-dual key. A self-dual

key is a key with the property that when you decrypt (or encrypt) twice with this key, the

result is the initial input. Therefore, the result is the same as encrypting and decrypting

with the same key. Using a self-dual key allows basis vectors to be presented to

components of the DEA to validate the IUT’s performance. This is discussed further in

the last paragraph of this section.

For the TECB and TCBC modes of operation, the values of the ciphertext are used

directly as the input block of data. The input block is processed through the DEA three

times -- first in the decrypt state with KEY3, next in the encrypt state with KEY2, and

lastly, in the decrypt state with KEY1. The resulting output block is used in the calculation

of the plaintext, which is then recorded.

For the TCBC-I mode of operation, it is assumed that multiprocessing is possible, i.e.,

each block of input data is processed by three DES processors. Therefore, three input

blocks are processed simultaneously through the three DES processors, resulting in three

output blocks which are then used in the calculation of the three plaintext values. The

three input blocks are directly assigned the values of the three ciphertext values for each

iteration. Note that the design of the TMOVS assumes that, for security reasons, an IUT

is designed so that intermediate values resulting from the first two DES calls are never

revealed.

This test is run for each of the 64 ciphertext values. At the completion of the 64th cycle,

all results are verified for correctness.
22

This test, when applied to an IUT, verifies the initial permutation IP and the expansion

matrix E via the decrypt operation, by presenting the full set of basis vectors to these

components. Via the encrypt operation, this test also verifies the inverse permutation (IP1

) as the basis vectors are recovered by presenting each basis vector to the inverse

permutation IP-1.

3.1.2.3 The Variable Key Known Answer Test for the Decryption Process

To implement the Variable Key Known Answer Test for the Decryption Process, the

TMOVS supplies the IUT with 56 keys or, for the TCBC-I mode of operation, 56 key sets

consisting of three keys each. The TMOVS also supplies initial values for the initialization

vector values, if applicable.

During the initialization process, the ciphertext value(s) are initialized in one of two ways.

If the IUT supports both encryption and decryption, the values resulting from the

encryption performed in the Variable Key Known Answer Test for the Encryption Process

will be used to initialize the ciphertext values. Otherwise, the TMOVS will supply the

ciphertext values along with the information discussed in the previous paragraph. The

initialization vector value(s) are set to zero for each test. All three keys for each round are

initialized to a 56-bit key basis vector which contains a "1" in the ith significant position

and "0"s in all remaining significant positions of the keys, i.e., KEY1=KEY2=KEY3.

(NOTE -- the parity bits are not considered as significant bits. These parity bits may be

"1"s or "0"s to maintain odd parity.)

For the TECB and TCBC modes of operation, the values of the ciphertext are used

directly as the input blocks of data. The input blocks are processed through the DEA three

times -- first in the decrypt state with KEY3, next in the encrypt state with KEY2, and

lastly, in the decrypt state with KEY1. The resulting output blocks are used in the

calculation of the plaintext values, which are then recorded.

For the interleaved configuration of the TCBC mode of operation (TCBC-I), it is assumed

that multiprocessing is possible, i.e., each block of input data is processed by three DES

processors. Therefore, three input blocks are processed simultaneously through the three

DES processors, resulting in three output blocks which are then used in the calculation of

the three plaintext values. The three input blocks are directly assigned the values of the

three corresponding ciphertext values for each iteration. Note that the design of the

TMOVS assumes that, for security reasons, an IUT is designed so that intermediate values

resulting from the first two DES calls are never revealed.

This test is repeated for each of the 56 key basis vectors, allowing for every possible key

basis vector to be tested. At the completion of the 56th cycle, all results are verified for

correctness.

This test verifies the right shifts in the key schedule via the DES decrypt operation as the

basis vectors are recovered.
23

During the encrypt operation, a complete set of basis vectors is presented to the key

permutation, PC1, thus verifying PC1. Since the key schedule consists of left shifts, a

complete set of basis vectors is also presented to PC2 verifying PC2 as well.

3.1.2.4 The Permutation Operation Known Answer Test for the Decryption

Process

To implement the Permutation Operation Known Answer Test for the Decryption

Process, the TMOVS supplies the IUT with 32 key-data sets, consisting of an initial value

for the three keys and values for the ciphertext. The TMOVS also supplies initial values

for the initialization vector(s), if applicable. For IUTs supporting the TCBC-I mode of

operation, three ciphertext values are included in the key-data sets, and three initialization

vector values are supplied for each set. The values for the key and ciphertext are supplied

in one of two ways. If the IUT performs both encryption and decryption, values for the

key and ciphertext resulting from the encryption performed in the Permutation Operation

Known Answer Test for the Encryption Process will be used. Otherwise, the key and

ciphertext values will be supplied by the TMOVS. If applicable, the initialization vector

will be set to zero for each test.

For the TECB and TCBC modes of operation, the values of the ciphertext are used

directly as the input blocks of data. The input blocks are processed through the DEA three

times -- first in the decrypt state with KEY3, next in the encrypt state with KEY2, and

lastly, in the decrypt state with KEY1. The resulting output blocks are used in the

calculation of the plaintext values, which are then recorded.

For the TCBC mode of operation supporting interleaving (TCBC-I), it is assumed that

multiprocessing is possible, i.e., each block of input data is processed by three DES

processors. Therefore, three input blocks are processed simultaneously through the three

DES processors, resulting in three output blocks which are then used in the calculation of

the three plaintext values. The three input blocks are directly assigned the values of the

three corresponding ciphertext values for each iteration. Note that the design of the

TMOVS assumes that, for security reasons, an IUT is designed so that intermediate values

resulting from the first two DES calls are never revealed.

This test is repeated for each of the 32 key-data sets. At the completion of the 32nd set,

the results of each of the 32 tests are verified to be zero.

The 32 key sets used in this test present a complete set of basis vectors to the permutation

operator P. By doing so, P is verified. This occurs when both the encrypt and decrypt

operations are performed.

3.1.2.5 The Substitution Table Known Answer Test for the Decryption

Process

To implement the Substitution Table Known Answer Test for the Decryption Process, the

TMOVS supplies the IUT with 19 key-data sets consisting of an initial value for the three
24

keys and values for the ciphertext. The TMOVS also supplies initial values for the

initialization vector, if applicable. For IUTs supporting the TCBC-I mode of operation,

three ciphertext values are included in the key-data sets and three initialization vector

values are supplied for each set. The values for the keys and the ciphertext value(s) are

supplied in one of two ways. If the IUT performs both encryption and decryption, the

values for the key and ciphertext resulting from the encryption performed in the

Substitution Table Known Answer Test for the Encryption Process will be used.

Otherwise, the key and ciphertext values will be supplied by the TMOVS. If applicable,

the initialization vector will be set to zero for each test.

For the TECB and TCBC modes of operation, the values of the ciphertext are used

directly as the input blocks of data. The input blocks are processed through the DEA three

times -- first in the decrypt state with KEY3, next in the encrypt state with KEY2, and

lastly, in the decrypt state with KEY1. The resulting output blocks are used in the

calculation of the plaintext blocks, which are then recorded.

For the TCBC mode of operation supporting interleaving (TCBC-I), it is assumed that

multiprocessing is possible, i.e., each block of input data is processed by three DES

processors. Therefore, for interleaved modes of operation, three input blocks are

processed simultaneously through the three DES processors, resulting in three output

blocks which are then used in the calculation of the three plaintext values. The three input

blocks are directly assigned the values of the three corresponding ciphertext values for

each iteration. Note that the design of the TMOVS assumes that, for security reasons, an

IUT is designed so that intermediate values resulting from the first two DES calls are

never revealed.

This test is repeated for each of the 19 key-data sets allowing for the set of 19 key-data

sets to be processed. At the completion of the 19th set, all results are verified for

correctness.

The set of 19 key-data sets used in this test result in every entry of all eight S-box

substitution tables being used at least once during both the encrypt and decrypt operations.

Thus, this test verifies the 64 entries in each of the eight substitution tables.

The Monte Carlo Test

The Monte Carlo Test is the second type of validation test required to validate IUTs. The Monte

Carlo Test is based on the Monte-Carlo test discussed in Special Publication 500-20. It is

designed to exercise the entire implementation of the TDEA, as opposed to testing only the

individual components. The purpose of the Monte Carlo Test is to detect the presence of flaws in

the IUT that were not detected with the controlled input of the Known Answer tests. Such flaws

may include pointer problems, errors in the allocation of space, improper error handling, and

incorrect behavior of the TDEA implementation when random values are introduced. The Monte

Carlo Test does not guarantee ultimate reliability of the IUT that implements the TDEA (i.e.,

hardware failure, software corruption, etc.).
25

The TMOVS supplies the IUT with initial input values for the keys, the plaintext(s) (or

ciphertext(s)), and, if applicable, initialization vector(s). The Monte Carlo Test is then performed

(as described in the following paragraph), and the resulting ciphertext (or plaintext) values are

recorded and compared to expected values. If an error is detected, the erroneous result is

recorded, and the test terminates abnormally. Otherwise, the test continues. If the IUT's results

are correct, the Monte Carlo Test for the IUT ends successfully.

Each Monte Carlo Test consists of four million cycles through the TDEA implemented in the

IUT. These cycles are divided into four hundred groups of 10,000 iterations each. Each iteration

consists of processing an input block through three operations of the DEA resulting in an output

block. For IUTs of the encryption process, the three DES operations are encrypted with KEY1,

decrypted with KEY2, and encrypted with KEY3. For IUTs of the decryption process, the three

DES operations are decrypted with KEY3, encrypted with KEY2, and decrypted with KEY1. At

the 10,000th cycle in an iteration, new values are assigned to the variables needed for the next

iteration. The results of each 10,000th encryption or decryption cycle are recorded and evaluated

as specified in the preceding paragraph.
26

4. BASIC PROTOCOL

4.1 Overview

Input and output messages used to convey information between the TMOVS and the IUT consist

of specific fields. The format of these input and output messages is beyond the scope of this

document, and the testing laboratories have the option to determine the specific formats of those

messages. However, the results sent to NIST must include certain minimum information, which is

specified in Section 4.4 Output Types.

A separate message should be created for each mode of operation supported by an IUT. The

information should indicate the algorithm used (Triple DES), the mode of operation (TECB,

TCBC, TCBC-I, TCFB-including feedback amounts, TCFB-P-including feedback amounts,

TOFB, TOFB-I), the cryptographic process supported (encryption and/or decryption), the test

being performed (one of the various Known Answer tests, or the Monte Carlo Tests), and the

required data fields. The required data may consist of counts, keys, initialization vectors, and data

representing plaintext or ciphertext. Every field in an output message should be clearly labeled to

indicate its contents - this is especially important for NIST to be able to ensure that test results are

complete.

4.1.1 Conventions

The following conventions should be used in the data portion of messages between the TMOVS

and the IUT: (See Section 4.1.2 for these notations.)

1. Integers: integers should be unsigned and should be represented in decimal notation.

2. Hexadecimal strings: should consist of ASCII hexadecimal characters. The ASCII

hexadecimal characters to be used should consist of the ASCII characters 0-9 and A-F (or

a-f), which represent 4-bit binary values.

3. Characters: the characters to be represented are A-Z (or a-z), 0-9, and underscore (_).

4.1.2 Message Data Types

The following data types should be used in messages between the TMOVS and the IUT:

1. Decimal integers: a decimal integer should have the form

ddd ... dd

where each “d” represents a decimal character (0-9); one or more characters

should be present. The characters must be contiguous.

2. Hexadecimal strings: a hexadecimal string should have the form

hhh ... hh
27

where each “h” should represent an ASCII character 0-9 or A-F (or a-f). Each “h”

represents a 4-bit binary value.

3. Characters: an ASCII character should have the form

c

where “c” represents an ASCII character A-Z (or a-z), 0-9, or underscore (_).

4.2 Message Contents

The information included in a message consists of the following:

Algorithm - Triple DES,

Mode - selections consist of TECB, TCBC, TCBC-I, TCFB-including feedback amounts, TCFBP-including feedback amounts, TOFB, TOFB-I

Process - selections consist of ENCRYPT or DECRYPT,

Test - selections consist of:

VTEXT for Variable Plaintext/Ciphertext Known Answer Test

VKEY for Variable KEY Known Answer Test

INVPERM for Inverse Permutation Known Answer Test

INITPERM for Initial Permutation Known Answer Test

PERM for Permutation Operation Known Answer Test

SUB for Substitution Table Known Answer Test

MODES for Monte Carlo Test

Input/Output Data

The contents of the input/output data included in a message depend on the algorithm, mode,

process, and test being performed. These different combinations of data have been organized into

input types and output types. The input types are used by the TMOVS to supply data to the IUT

for testing. The output types are used by the IUT to supply results from the tests to the TMOVS,

and eventually to NIST.

4.3 Input Types

Twenty-five different combinations of input data are used by the TMOVS to support the various

Known Answer tests and Monte Carlo tests.
28

4.3.1 Input Type 1

Input Type 1 consists of:

KEY and DATA

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3; and

DATA is a 16 character ASCII hexadecimal string representing plaintext if the encryption process

is being tested, or ciphertext if the decryption process is being tested.

4.3.2 Input Type 2

Input Type 2 consists of:

KEY, IV, and DATA

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

IV is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector; and

DATA is 1 to 64 binary bits represented as an ASCII hexadecimal string representing plaintext if

the encrypt process is being tested, or ciphertext if the decrypt process is being tested.

4.3.3 Input Type 3

Input Type 3 consists of:

KEY, n, DATA1, DATA2,...,DATAn

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

n is an integer which indicates the number of ciphertext (C) values to follow; and

each DATAn is 1 to 64 binary bits represented as a 16 character ASCII hexadecimal string. This

field should provide plaintext if the encryption process is being tested, or ciphertext if the

decryption process is being tested.
29

4.3.4 Input Type 4

Input Type 4 consists of:

KEY

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3.

4.3.5 Input Type 5

Input Type 5 consists of:

KEY, IV, n, TEXT1, TEXT2,...,TEXTn

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

IV is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

n is an integer which indicates the number of TEXT values to follow; and

each TEXTn is 1 to 64 binary bits represented as an ASCII hexadecimal string. TEXT represents

P, C, or RESULT.

4.3.6 Input Type 6

Input Type 6 consists of:

KEY and IV

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3; and

IV is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector.

4.3.7 Input Type 7

Input Type 7 consists of

P, KEY1, KEY2,...,KEY32
30

where P is 1 to 64 binary bits represented as a 16 character ASCII hexadecimal string; and

each KEYi, where i=1 to 32, is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3.

4.3.8 Input Type 8

Input Type 8 consists of:

TEXT,IV,KEY1,KEY2,...,KEY32

where TEXT is 1 to 64 binary bits represented as an ASCII hexadecimal string. (NOTE -- TEXT

may be referred to as plaintext or text.);

IV is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector; and

each KEYi, where i=1 to 32, is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3.

4.3.9 Input Type 9

Input Type 9 supplies n key/input block pairs. It consists of:

n,PAIR1,PAIR2,...,PAIRn

In this input type, the integer n indicates the number of KEY values to follow. Each PAIRi

consists of:

KEYi and TEXTi

where each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3; and

each TEXTi, for i = 1 to n, is a 16 character ASCII hexadecimal string representing either

plaintext or ciphertext.

4.3.10 Input Type 10

Input Type 10 consists of:

n, KEY1, KEY2,...,KEYn
31

where n is an integer which indicates the number of KEY values to follow; and

each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3;

4.3.11 Input Type 11

Input Type 11 consists of:

INITVAL, n, PAIR1, PAIR2,...,PAIRn

where INITVAL is a 16 character ASCII hexadecimal string representing either the 64-bit IV or

the TEXT, depending on the mode of operation implemented by the IUT. (NOTE -- The TEXT

may be referred to as plaintext, ciphertext, or text.);

n is an integer, which indicates the number of KEY/INPUT PAIRs to follow.

Each PAIRi consists of:

KEYi and Ii

where each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3; and

each Ii is a 16 character ASCII hexadecimal string representing either the 64-bit IV, P or C,

depending on the mode of operation implemented.

4.3.12 Input Type 12

Input Type 12 consists of:

INITVAL, n, KEY1, KEY2,..., KEYn

where INITVAL is a 16 character ASCII hexadecimal string representing either the 64-bit IV or

the 64-bit TEXT depending on the mode of operation implemented by the IUT. (NOTE -- The

TEXT may be referred to as ciphertext.);

n is an integer which indicates the number of KEYS to follow; and

each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3.
32

4.3.13 Input Type 13

Input Type 13 consists of:

KEY, IV1, IV2, IV3, DATA

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

and

DATA is 1 to 64 binary bits represented as an ASCII hexadecimal string representing plaintext if

the encrypt process is being tested, ciphertext if the decrypt process is being tested, or TEXT for

TCFB-P mode. DATA may represent the value of DATA1, DATA2 and DATA3 for Interleaved

modes of operation.

4.3.14 Input Type 14

Input Type 14 consists of:

KEY, IV1, IV2, IV3

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

4.3.15 Input Type 15

Input Type 15 consists of:

KEY, IV1, IV2, IV3, n, TEXT11,...,TEXT1n, TEXT21,...,TEXT2n, TEXT31,...,TEXT3n
33

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

n is an integer, which indicates the number of TEXT1s, TEXT2s, and TEXT3s to follow;

each TEXT1n is 1 to 64 binary bits represented as an ASCII hexadecimal string. TEXT1

represents P, C, or RESULT;

each TEXT2n is 1 to 64 binary bits represented as an ASCII hexadecimal string. TEXT2

represents P, C, or RESULT; and

each TEXT3n is 1 to 64 binary bits represented as an ASCII hexadecimal string. TEXT3

represents P, C, or RESULT.

4.3.16 Input Type 16

Input Type 16 consists of:

IV1, IV2, IV3, n,KEY1, KEY2,...,KEYn

where IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

n is an integer which indicates the number of KEY values to follow; and

each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3;

4.3.17 Input Type 17

Input Type 17 consists of:

IV1, IV2, IV3, n, GROUP1, GROUP2,..., GROUPn

where IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;
34

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

n is an integer, which indicates the number of KEY/INPUT GROUPs to follow.

Each GROUPi consists of:

KEYi, TEXT1i, TEXT2i, and TEXT3i

where each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3; and

each TEXT1i, TEXT2i, and TEXT3i is a 16 character ASCII hexadecimal string representing the

64-bit C1, C2, and C3 respectively.

4.3.18 Input Type 18

Input Type 18 consists of

TEXT, IV1, IV2, IV3, KEY1, KEY2,...,KEY32

Where TEXT is 1 to 64 binary bits represented as an ASCII hexadecimal string. TEXT may

represent P or TEXT depending on the mode of operation being implemented;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA; and

each KEYi, where i=1 to 32, is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3.

4.3.19 Input Type 19

Input Type 19 consists of:

IV1, IV2, IV3, n, PAIR1, PAIR2,..., PAIRn

where IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;
35

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

n is an integer which indicates the number of KEY/INPUT PAIRs to follow.

Each PAIRi consists of:

KEYi and TEXTi

where each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3; and

each TEXTi is a 16 character ASCII hexadecimal string. TEXT may represent the 64-bit TEXT1,

TEXT2, and TEXT3 values, or the IV1 value depending on the mode of operation implemented.

4.3.20 Input Type 20

Input Type 20 consists of:

KEY1, KEY2, KEY3, DATA

where KEY1, KEY2, and KEY3 are represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity; and

DATA is a 16 character ASCII hexadecimal string representing plaintext if the encryption process

is being tested, or ciphertext if the decryption process is being tested.

4.3.21 Input Type 21

Input Type 21 consists of:

KEY1, KEY2, KEY3, IV, and DATA

where KEY1, KEY2, and KEY3 are represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity.;

IV is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector; and

DATA is 1 to 64 binary bits represented as an ASCII hexadecimal string representing plaintext if

the encrypt process is being tested, or ciphertext if the decrypt process is being tested.

4.3.22 Input Type 22

Input Type 22 consists of:
36

KEY1, KEY2, KEY3, IV1, IV2, IV3, TEXT1, TEXT2, and TEXT3

where KEY1, KEY2, and KEY3 are represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity.;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

TEXT1 is 64 binary bits represented as a 16 character ASCII hexadecimal string representing

plaintext if the encrypt process is being tested, or ciphertext if the decrypt process is being tested;

TEXT2 is 64 binary bits represented as a 16 character ASCII hexadecimal string representing

plaintext if the encrypt process is being tested, or ciphertext if the decrypt process is being tested;

and

TEXT3 is 1 to 64 binary bits represented as an ASCII hexadecimal string representing plaintext if

the encrypt process is being tested, or ciphertext if the decrypt process is being tested.

4.3.23 Input Type 23

Input Type 23 consists of:

KEY, IV1, IV2, IV3, n, TEXT1,...,TEXTn

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

n is an integer which indicates the number of TEXT values to follow; and

each TEXTn is 1 to 64 binary bits represented as a 16 character ASCII hexadecimal string.

TEXT1 represents P, C, or RESULT;

4.3.24 Input Type 24

Input Type 24 consists of:
37

KEY1, KEY2, KEY3, IV1, IV2, IV3, and TEXT

where KEY1, KEY2, and KEY3 are represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity.;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA; and

TEXT is 1 to 64 binary bits represented as an ASCII hexadecimal string representing plaintext if

the encrypt process is being tested, or ciphertext if the decrypt process is being tested.

4.3.25 Input Type 25

Input Type 25 consists of:

TEXT, n, GROUP1, GROUP2,..., GROUPn

where TEXT is 1 to 64 binary bits represented as a 16 character ASCII hexadecimal string

representing plaintext if the encrypt process is being tested, or ciphertext if the decrypt process is

being tested;

n is an integer which indicates the number of KEY/IV1/IV2/IV3 groups to follow.

Each GROUPi consists of:

KEYi, IV1i, IV2i, and IV3i

where each KEYi, where i=1 to n, is represented as 64 bits in hexadecimal notation (i.e., 4 bits

per hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES key should be presented in odd parity. KEY represents

the value of KEY1, KEY2, and KEY3;

IV1i is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2i is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555; and

IV3i is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA.

4.4 Output Types

Eight different combinations of output data are used by the TMOVS to support the various

Known Answer tests and Monte Carlo tests.
38

4.4.1 Output Type 1

Output Type 1 consists of:

COUNT, KEY, DATA, and RESULT

where COUNT is an integer between 1 and 64, i.e., 0 < COUNT <= 64, representing the output

line;

KEY should be represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES key should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

DATA is a 16 character hexadecimal string representing plaintext if the encrypt process is being

tested or ciphertext if the decrypt process is being tested; and

RESULT is a 16 character hexadecimal string indicating the resulting value. Depending on the

process of the IUT being tested, the resulting value represents ciphertext (if encrypting) or

plaintext (if decrypting).

4.4.2 Output Type 2

Output Type 2 consists of:

COUNT, KEY, CV, DATA, and RESULT

where COUNT is an integer between 1 and 64, i.e., 0 < COUNT <= 64, representing the output

line;

where KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal

character). The 8 parity bits should be present but ignored, yielding 56 significant bits. For

consistency purposes, the DES keys should be presented in odd parity. KEY represents the value

of KEY1, KEY2, and KEY3;

CV is a 16 character ASCII hexadecimal string;

DATA is 1-64 binary bits represented as an ASCII hexadecimal string representing plaintext if the

encrypt process is being tested, or ciphertext if the decrypt process is being tested.; and

RESULT is 1-64 binary bits represented as an ASCII hexadecimal string indicating the resulting

value. Depending on the process of the IUT being tested, the resulting value may be ciphertext (if

encrypting) or plaintext (if decrypting).

4.4.3 Output Type 3

Output Type 3 consists of:
39

COUNT, KEY, IV1, IV2, IV3, DATA1, DATA2, DATA3, RESULT1, RESULT2,

RESULT3

where COUNT is an integer between 1 and 64, i.e., 0 < COUNT <= 64, representing the output

line;

KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal character). The

8 parity bits should be present but ignored, yielding 56 significant bits. For consistency purposes,

the DES key should be presented in odd parity. KEY represents the value of KEY1, KEY2, and

KEY3;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

DATA1, DATA2, and DATA3 are 1-64 binary bits represented as an ASCII hexadecimal strings

representing values of plaintext P1, P2, and P3 or input blocks I1, I2, and I3 respectively, if the

encrypt process is being tested, or values of ciphertext for C1, C2, and C3 if the decrypt process

is being tested;

RESULT1, RESULT2, and RESULT3 are 1-64 binary bits represented as an ASCII hexadecimal

strings indicating the resulting values corresponding to either C1, C2, and C3 or P1, P2, and P3.

Depending on the process of the IUT being tested, the resulting value may be ciphertext (if

encrypting) or plaintext (if decrypting).

4.4.4 Output Type 4

Output Type 4 consists of:

COUNT, KEY1, KEY2, KEY3, CV1, CV2, CV3, DATA1, DATA2, DATA3,

RESULT1, RESULT2, RESULT3

where COUNT is an integer between 1 and 64, i.e., 0 < COUNT <= 64, representing the output

line;

where KEY1, KEY2, and KEY3 is represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES keys should be presented in odd parity.;

CV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

CV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

CV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;
40

DATA1, DATA2, and DATA3 are 16 character hexadecimal strings representing values of

plaintext for P1, P2, and P3 respectively, if the encrypt process is being tested, or values of

ciphertext for C1, C2, and C3 if the decrypt process is being tested;

RESULT1, RESULT2, and RESULT3 are 16 character hexadecimal strings indicating the

resulting values corresponding to either C1, C2, and C3 or P1, P2, and P3. Depending on the

process of the IUT being tested, the resulting value may be ciphertext (if encrypting) or plaintext

(if decrypting).

4.4.5 Output Type 5

Output Type 5 consists of:

COUNT, KEY1, KEY2, KEY3, DATA, and RESULT

where COUNT is an integer between 1 and 400, i.e., 0 < COUNT <= 400, representing the

output line;

KEY1, KEY2, and KEY3 are represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES keys should be presented in odd parity.;

DATA is a 16 character hexadecimal string representing plaintext if the encrypt process is being

tested, or ciphertext if the decrypt process is being tested; and

RESULT is a 16 character hexadecimal string indicating the resulting value. Depending on the

process of the IUT being tested, the resulting value represents ciphertext (if encrypting) or

plaintext (if decrypting).

4.4.6 Output Type 6

Output Type 6 consists of:

COUNT, KEY1, KEY2, KEY3, CV, DATA, and RESULT

where COUNT is an integer between 1 and 400, i.e., 0 < COUNT <= 400, representing the

output line;

KEY1, KEY2, and KEY3 are represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES keys should be presented in odd parity.;

CV is a 16 character ASCII hexadecimal string representing IV or I depending on the mode

implemented;

DATA is 1-64 binary bits represented as an ASCII hexadecimal string representing plaintext if the

encrypt process is being tested, or ciphertext if the decrypt process is being tested; and
41

RESULT is 1-64 binary bits represented as an ASCII hexadecimal string indicating the resulting

value. Depending on the process of the IUT being tested, the resulting value should represent

ciphertext (if encrypting) or plaintext (if decrypting).

4.4.7 Output Type 7

Output Type 7 consists of:

COUNT, KEY, IV1, IV2, IV3, DATA, RESULT1, RESULT2, RESULT3

where COUNT is an integer between 1 and 64, i.e., 0 < COUNT <= 64, representing the output

line;

KEY is represented as 64 bits in hexadecimal notation (i.e., 4 bits per hexadecimal character). The

8 parity bits should be present but ignored, yielding 56 significant bits. For consistency purposes,

the DES key should be presented in odd parity. KEY represents the value of KEY1, KEY2, and

KEY3;

IV1 is a 16 character ASCII hexadecimal string representing the 64-bit initialization vector;

IV2 is assigned the value of IV1 + R1 mod 264, where R1 = 5555555555555555;

IV3 is assigned the value of IV1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

DATA is 1-64 binary bits represented as an ASCII hexadecimal string representing the value of

the plaintext if the encrypt process is being tested, or the value of the ciphertext if the decrypt

process is being tested; and

RESULT1, RESULT2, and RESULT3 is 1-64 binary bits represented as an ASCII hexadecimal

string indicating the resulting values, which may be ciphertext (if encrypting), or plaintext (if

decrypting).

4.4.8 Output Type 8

Output Type 8 consists of:

COUNT, KEY1, KEY2, KEY3, I1, I2, I3, DATA, and RESULT

where COUNT is an integer between 1 and 400, i.e., 0 < COUNT <= 400, representing the

output line;

KEY1, KEY2, and KEY3 are represented as 64 bits in hexadecimal notation (i.e., 4 bits per

hexadecimal character). The 8 parity bits should be present but ignored, yielding 56 significant

bits. For consistency purposes, the DES keys should be presented in odd parity;

I1 is a 16 character ASCII hexadecimal string representing IV or I;

I2 is assigned the value of I1 + R1 mod 264, where R1 = 5555555555555555;
42

I3 is assigned the value of I1 + R2 mod 264, where R2 = AAAAAAAAAAAAAAAA;

DATA is 1-64 binary bits represented as an ASCII hexadecimal string representing plaintext if the

encrypt process is being tested or ciphertext if the decrypt process is being tested; and

RESULT is 1-64 binary bits represented as an ASCII hexadecimal string indicating the resulting

value. Depending on the process of the IUT being tested, the resulting value should represent

ciphertext (if encrypting) or plaintext (if decrypting).
43

5. TESTS REQUIRED TO VALIDATE AN IMPLEMENTATION

OF THE TRIPLE DES ALGORITHM

The validation of IUTs of the Triple DES algorithm (TDEA) should require the successful

completion of an applicable set of Known Answer tests and the appropriate Monte Carlo tests.

The tests required for validation of an IUT should be determined by several factors. These include

the mode(s) of operation supported (TECB, TCBC, TCBC-I, TCFB, TCFB-P, TOFB, TOFB-I),

the keying option used, and the allowed cryptographic processes (encryption, decryption, both).

A separate set of Known Answer tests has been designed for use with each of the seven modes of

TDES. Within these sets of tests are separate subsets of tests corresponding to the encryption and

decryption processes. If an IUT implements multiple modes of operation, the set of Known

Answer tests corresponding to each supported mode of operation should be tested.

The Monte Carlo tests have been designed for use with each of the seven modes of TDES. For

the TECB, TCBC, TCBC-I, TCFB, and TCFB-P modes of operation, there are two tests

associated with each: one to be used for IUTs allowing the encryption process, and the other to

be used for IUTs allowing the decryption process. If both the encryption and decryption processes

are allowed by an IUT, both tests are required. The TOFB and TOFB-I modes of operation only

require one Monte Carlo test, which is designed for use with both the encryption and decryption

processes of an IUT. For example, if an IUT implements the TCBC mode of operation in both the

encryption and decryption processes, the Monte Carlo Test for the encryption process and the

Monte Carlo Test for the decryption process of the TCBC mode of operation should be

successfully completed to validate the IUT. If an IUT implements both the encryption and

decryption processes of the TCFB-P mode of operation, the Monte Carlo Test for the encryption

process and the Monte Carlo Test for the decryption process of the TCFB-P mode of operation

should be successfully completed to validate the IUT. If an IUT implements both the encryption

and decryption processes of the TOFB mode of operation, the Monte Carlo Test for the TOFB

mode of operation should be successfully completed to validate the IUT.

If an IUT supports more than one mode of operation, the Monte Carlo Test corresponding to

each supported mode should be performed successfully. For example, if an IUT implements the

TECB and TCBC modes of operation in the encryption process, the Monte Carlo Test for the

encryption process of both the TECB and the TCBC modes of operation should be successfully

completed to validate the IUT.

If an IUT supports the 3-key keying option, where KEY1, KEY2 and KEY3 are independent, the

Monte Carlo Test should be successfully completed three times – once where the three keys are

independent, once where KEY1 and KEY2 are independent and KEY3 = KEY1, and once where

KEY1 = KEY2 = KEY3 – to validate the IUT. If an IUT supports the 2-key keying option,

where KEY1 and KEY2 are independent and KEY3 = KEY1, the Monte Carlo Test should be

successfully completed two times – once where KEY1 and KEY2 are independent and KEY3 =

KEY1, and once where KEY1 = KEY2 = KEY3 – to validate the IUT. If an IUT only supports

the 1-key keying option, where KEY1=KEY2=KEY3, the Monte Carlo Test should be

successfully completed once with all the keys being equal to validate the IUT.
44

The tests required to successfully validate IUTs are detailed in the following sections. These

sections are categorized by mode of operation. Within each mode of operation, the tests are

divided into tests to use with the encryption process and tests to use with the decryption process.
45

5.1 TDEA Electronic Codebook (TECB) Mode

The IUTs which implement the TDES Electronic Codebook (TECB) mode should be validated by

the successful completion of a series of Known Answer tests and Monte Carlo tests

corresponding to the cryptographic processes allowed by the IUT.

5.1.1 Encryption Process

The process of validating an IUT which implements the TECB mode of operation for the

encryption process should involve the successful completion of the following six tests:

1. The Variable Plaintext Known Answer Test - TECB mode

2. The Inverse Permutation Known Answer Test - TECB mode

3. The Variable Key Known Answer Test for the Encryption Process - TECB mode

4. The Permutation Operation Known Answer Test for the Encryption Process - TECB

mode

5. The Substitution Table Known Answer Test for the Encryption Process - TECB mode

6. The Monte Carlo Test for the Encryption Process - TECB mode

An explanation of the tests follows.
46

5.1.1.1The Variable Plaintext Known Answer Test - TECB Mode

Table 1 The Variable Plaintext Known Answer Test - TECB Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

. P1 = 8000000000000000

. Send KEY (representing KEY1, KEY2, KEY3), P1

IUT: FOR i = 1 to 64

{

Ii = Pi

Ii is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2, resulting in TEMP2

Perform

Triple DES:

TEMP2 is encrypted by DEA3 using KEY3, resulting in Ci

Send i, KEY (representing KEY1, KEY2, and KEY3), Pi, Ci

Pi+1 = basis vector where single "1" bit is in position i+1

}

TMOVS: Compare results from each loop with known answers.

See Table A.1.

Table 1 illustrates the Variable Plaintext Known Answer Test for the TECB mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit plaintext P1 to the basis vector containing a"1" in the first bit

position and "0" in the following 63 positions, i.e., P1 bin = 10000000 00000000

00000000 00000000 00000000 00000000 00000000 00000000. The equivalent of

this value in hexadecimal notation is 80 00 00 00 00 00 00 00.
47

c. Forwards this information to the IUT using Input Type 1.

2. The IUT should perform the following for i=1 through 64:

a. Set the input block Ii equal to the value of Pi.

b. Process Ii through the three DEA stages resulting in ciphertext Ci. This involves

processing Ii through the first DEA stage, denoted DEA1, in the encrypt state

using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the second DEA stage, denoted DEA2, in the decrypt state using KEY2, resulting

in intermediate value TEMP2. TEMP2 is fed directly into the third DEA stage,

denoted DEA3, in the encrypt state using KEY3, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEY (where KEY represents the

value of KEY1, KEY2, and KEY3), Pi, and the resulting Ci to the TMOVS as

specified in Output Type 1.

d. Retain Ci for use with the Inverse Permutation Known Answer Test for the TECB

Mode (Section 5.1.1.2 ), and, if the IUT supports the decryption process, for use

with the Variable Ciphertext Known Answer Test for the TECB Mode (Section

5.1.2.1).

e. Assign a new value to Pi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i+1=2,...,64.

NOTE -- This continues until every possible basis vector has been represented by the P, i.e., 64 times. The output from the IUT

should consist of 64 output strings. Each output string should consist of information included in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values found in Table A.1.
48

5.1.1.2The Inverse Permutation Known Answer Test - TECB Mode

Table 2 The Inverse Permutation Known Answer Test - TECB Mode

TMOVS: Initialize: KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

Pi (where i=1..64) = 64 C values from the Variable Plaintext Known

Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), P1,...,P64

IUT: FOR i = 1 to 64

{

Ii = Pi

Ii is read into TDEA and is encrypted by DEA1 using KEY1, resulting in

TEMP1

TEMP1 is decrypted by DEA2 using KEY2, resulting in TEMP2

Perform

Triple DES:

TEMP2 is encrypted by DEA3 using KEY3, resulting in Ci

Send i, KEY (representing KEY1, KEY2, and KEY3), Pi, Ci

Pi+1 = corresponding Pi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers.

Should be the set of basis vectors.

Table 2 illustrates the Inverse Permutation Known Answer Test for the TECB mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit plaintext Pi (where i=1..64) to the Ci results obtained from the

Variable Plaintext Known Answer Test.

c. Forwards this information to the IUT using Input Type 3.
49

2. The IUT should perform the following for i=1 through 64:

a. Set the input block Ii equal to the value of Pi.

b. Process Ii through the three DEA stages resulting in ciphertext Ci. This involves

processing Ii through the first DEA stage, denoted DEA1, in the encrypt state

using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the second DEA stage, denoted DEA2, in the decrypt state using KEY2, resulting

in intermediate value TEMP2. TEMP2 is fed directly into the third DEA stage,

denoted DEA3, in the encrypt state using KEY3, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), Pi, and the resulting Ci to the TMOVS as specified in Output

Type 1.

d. Assign a new value to Pi+1 by setting it equal to the corresponding output from the

TMOVS.

NOTE -- The output from the IUT should consist of 64 output strings. Each output string should consist of information included

in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The C values should be the set of basis vectors.
50

5.1.1.3 The Variable Key Known Answer Test for the Encryption Process -

TECB Mode

Table 3 The Variable Key Known Answer Test for the Encryption Process - TECB

Mode

TMOVS: Initialize KEYs: KEY11 = KEY21 = KEY31 = 8001010101010101 (odd parity set)

P=0000000000000000

Send KEY1(representing KEY11, KEY21, KEY31), P

IUT: FOR i = 1 to 64

{

IF (i % 8 ≠ 0) {process every bit except parity bits}

{

I = P

I is read into TDEA and is encrypted by DEA1 using KEY1i, resulting in

TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in TEMP2

Perform

Triple DES:

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Ci

Send i, KEYi (representing KEY1i,KEY2i, and KEY3i), P, Ci

KEY1i+1 =KEY2i+1 =KEY3i+1 = vector consisting of "0" in every significant bit

position except for a single "1" bit in position i+1. Each parity bit may have the value

"1" or "0" to make the KEY odd parity.

}

}

TMOVS: Compare results of the 56 encryptions with known answers.

Use Table A.2.

As summarized in Table 3, the Variable Key Known Answer Test for the TECB Encryption

Process is performed as follows:

1. The TMOVS:
51

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 64-bit plaintext P to the value of 0, i.e., Phex = 00 00 00 00 00 00 00

00.

c. Forwards this information to the IUT using Input Type 1.

2. The IUT should perform the following for i = 1 to 56:

NOTE -- 56 is the number of significant bits in a TDES key.

a. Set the input block I equal to the value of P.

b. Using the corresponding KEY1i, KEY2i, and KEY3i parameters, process I through

the three DEA stages resulting in ciphertext Ci. This involves processing I through

the DEA stage DEA1 in the encrypt state using KEY1i, resulting in intermediate

value TEMP1. TEMP1 is fed directly into the DEA stage DEA2 in the decrypt

state using KEY2i, resulting in intermediate value TEMP2. TEMP2 is fed directly

into the DEA stage DEA3 in the encrypt state using KEY3i, resulting in ciphertext

Ci.

c. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, KEY3i), P, and the resulting Ci to the TMOVS as specified in Output

Type 1.

d. If the IUT supports the decryption process, retain Ci for use with the Variable Key

Known Answer Test for the Decryption Process for the TECB Mode (Section

5.1.2.3).

e. Set KEY1i+1,, KEY2i+1,, and KEY3i+1 equal to the vector consisting of "0" in every

significant bit position except for a single "1" bit in position i+1. The parity bits

may contain "1" or "0" to make odd parity.

NOTE -- The above processing continues until every significant basis vector has been represented by the KEY parameter. The

output from the IUT for this test should consist of 56 output strings. Each output string should consist of information included

in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values found in Table A.2.
52

5.1.1.4 Permutation Operation Known Answer Test for the Encryption

Process - TECB Mode

Table 4 The Permutation Operation Known Answer Test for the Encryption Process -

TECB Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i = 1-32)=32 KEY values in

Table A.3

P = 0000000000000000

Send P, KEY1, KEY2,...,KEY32 (Since all three keys are the same, these

key values represent the values of KEY1, KEY2, and KEY3.)

IUT: FOR i = 1 to 32

{

I = P

I is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in TEMP2

Perform

Triple DES:

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Ci

Send i, KEYi (representing KEY1i, KEY2i, KEY3i), P, Ci

KEY1i+1 = KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. Use Table A.3.

Table 4 illustrates the Permutation Operation Known Answer Test for the TECB Encryption

Process.

1. The TMOVS:

a. Initializes the KEY1, KEY2, and KEY3 variables with the 32 constant KEY values

from Table A.3.

b. Initializes the plaintext P to the value of 0, i.e., Phex=00 00 00 00 00 00 00 00.

c. Forwards this information to the IUT using Input Type 7.
53

2. The IUT should perform the following for i = 1 to 32:

a. Set the input block I equal to the value of P.

b. Using the corresponding KEY1i, KEY2i, and KEY3i values, process I through the

three DEA stages resulting in ciphertext Ci. This involves processing I through the

DEA stage DEA1 in the encrypt state using KEY1i, resulting in intermediate value

TEMP1. TEMP1 is fed directly into the DEA stage DEA2 in the decrypt state

using KEY2i, resulting in intermediate value TEMP2. TEMP2 is fed directly into

the DEA stage DEA3 in the encrypt state using KEY3i, resulting ciphertext Ci.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, KEY3), P, and the resulting Ci to the TMOVS as specified in Output Type

1.

d. If the IUT supports the decryption process, retain Ci for use with the Permutation

Operation Known Answer Test for the Decryption Process for the TECB mode

(Section 5.1.2.4).

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the next key supplied by the

TMOVS.

NOTE-- The above processing should continue until all 32 KEY values are processed. The output from the IUT for this test

should consist of 32 output strings. Each output string should consist of information included in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values found in Table A.3.
54

5.1.1.5 Substitution Table Known Answer Test for the Encryption Process -

TECB Mode

Table 5 The Substitution Table Known Answer Test for the Encryption Process -

TECB Mode

TMOVS: Initialize KEY1i, KEY2i, KEY3i (where i=1..19) = 19 KEY values in

Table A.4

Pi (where i=1..19) = 19 corresponding P values in Table A.4

Send KEY1, P1, KEY2, P2,..., KEY19, P19 (Since all three keys are

the same, these key values represent the values of KEY1,

KEY2, and KEY3.)

IUT: FOR i = 1 to 19

{

Ii = Pi

Ii is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

Perform Triple

DES:

TEMP2 is encrypted by DEA3 using KEY3i, resulting in

Ci

Send i, KEYi (representing KEY1i,KEY2i,KEY3i), Pi, Ci

KEY1i+1 = KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

Pi+1 = Pi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. Use Table A.4.

As summarized in Table 5, the Substitution Table Known Answer Test for the TECB Encryption

Process is performed as follows:

1. The TMOVS:
55

a. Initializes the KEY-plaintext (KEY-P) pairs with the 19 constant KEY-P values

from Table A.4. The KEY value indicates the value of KEY1, KEY2, and KEY3,

i.e., KEY1=KEY2=KEY3.

b. Forwards this information to the IUT using Input Type 9.

2. The IUT should perform the following for i = 1 to 19:

a. Set the input block Ii equal to the value of Pi.

b. Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ii through the

three DEA stages resulting in ciphertext Ci. This involves processing Ii through the

first DEA stage, denoted DEA1, in the encrypt state using KEY1i, resulting in

intermediate value TEMP1. TEMP1 is fed directly into the second DEA stage,

denoted DEA2, in the decrypt state using KEY2i, resulting in intermediate value

TEMP2. TEMP2 is fed directly into the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, KEY3), Pi, and the resulting Ci to the TMOVS as specified in Output Type

1.

d. If the IUT supports the decryption process, retain Ci for use with the Substitution

Table Known Answer Test for the Decryption Process for the TECB mode

(Section 5.1.2.5).

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the KEYi+1 supplied by the TMOVS.

f. Set Pi+1 equal to the corresponding Pi+1 value supplied by the TMOVS.

NOTE-- The above processing should continue until all 19 KEY-P pairs are processed. The output from the IUT for this test

should consist of 19 output strings. Each output string should consist of information included in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values found in Table A.4.
56

5.1.1.6 Monte Carlo Test for the Encryption Process - TECB Mode

Table 6 The Monte Carlo Test for the Encryption Process - TECB Mode

TMOVS: Initialize KEY10, KEY20, KEY30, P0

Send KEY10, KEY20, KEY30, P0

IUT: FOR i = 0 TO 399

{

Record i, KEY1i, KEY2i, KEY3i, P0

FOR j = 0 TO 9,999

{

Ij = Pj

Ij is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

Perform

Triple DES:

TEMP2 is encrypted by DEA3 using KEY3i, resulting in

Cj

Pj+1 = Cj

}

Record Cj

Send i, KEY1i, KEY2i, KEY3i, P0, Cj

KEY1i+1= KEY1i ⊕ Cj

If (KEY1i and KEY2i are independent and KEY3i = KEY1i) or

(KEY1i, KEY2i, and KEY3i are independent),

 KEY2i+1= KEY2i ⊕ Cj-1

else

 KEY2i+1= KEY2i ⊕ Cj
57

If (KEY1i =KEY2i =KEY3i) or (KEY1i and KEY2i are

independent and KEY3i = KEY1i),

 KEY3i+1= KEY3i ⊕ Cj

else

 KEY3i+1= KEY3i ⊕ Cj-2

P0 = Cj

}

TMOVS: Check IUT's output for correctness.

As summarized in Table 6, the Monte Carlo Test for the TECB Encryption Process is performed

as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, and the plaintext P

variables. The P and KEYs consist of 64 bits.

b. Forwards this information to the IUT using Input Type 20.

2. The IUT should perform the following for i = 0 through 399:

a. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

and P0.

b. Perform the following for j = 0 through 9999:

1) Set the input block Ij equal to the value of Pj.

2) Using the corresponding KEY1i, KEY2i and KEY3i values, process Ij

through the three DEA stages resulting in ciphertext Cj. This involves

processing Ij through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the DEA stage DEA2 in the decrypt state using KEY2i, resulting in

intermediate value TEMP2. TEMP2 is fed directly into the DEA stage

DEA3 in the encrypt state using KEY3i, resulting in ciphertext Cj.

3) Prepare for loop j+1 by assigning Pj+1 with the current value of Cj.

c. Record Cj.
58

d. Forward all recorded information for this loop, as specified in Output Type 5, to

the TMOVS.

e. Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop. Note j=9999.

The new KEY1i+1 should be calculated by exclusive-ORing the current KEY1i with

the Cj.

The new KEY2i+1 calculation is based on the values of the keys. If KEY1i and

KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and KEY3i are

independent, the new KEY2i+1 should be calculated by exclusive-ORing the current

KEY2i with the Cj-1. If KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be

calculated by exclusive-ORing the current KEY2i with the Cj.

The new KEY3i+1 calculation is also based on the values of the keys. If KEY1i,

KEY2i, and KEY3i are independent, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the Cj-2. If KEY1i and KEY2i are

independent and KEY3i = KEY1i, or if KEY1i=KEY2i=KEY3i, the new KEY3i+1

should be calculated by exclusive-ORing the current KEY3i with the Cj.

f. Assign a new value to P in preparation for the next output loop. P0 should be

assigned the value of the current Cj. Note j = 9999.

NOTE -- the new P should be denoted as P0 to be used for the first pass through the inner loop when j=0.

NOTE-- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 5.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values.
59

5.1.2 Decryption Process

The process of validating an IUT which implements the TECB mode of operation in the

decryption process should involve the successful completion of the following six tests:

1. The Variable Ciphertext Known Answer Test - TECB mode

2. The Initial Permutation Known Answer Test - TECB mode

3. The Variable Key Known Answer Test for the Decryption Process- TECB mode

4. The Permutation Operation Known Answer Test for the Decryption Process- TECB mode

5. The Substitution Table Known Answer Test for the Decryption Process - TECB mode

6. The Monte Carlo Test for the Decryption Process- TECB mode

An explanation of the tests follows.
60

5.1.2.1 The Variable Ciphertext Known Answer Test - TECB Mode

Table 7 The Variable Ciphertext Known Answer Tests - TECB Mode

TMOVS: Initialize KEYs: KEY1=KEY2=KEY3=0101010101010101 (odd parity set)

If encryption is supported by IUT:

Send KEY (representing KEY1, KEY2, and KEY3)

If encryption is not supported by IUT:

Initialize Ci (where i=1..64) = 64 C values in Table A.1

Send KEY (representing KEY1, KEY2, and KEY3), C1, C2,...,C64

IUT: If encryption is supported by IUT:

Initialize C1 = first value from output of Variable Plaintext Known Answer

Test.

Otherwise, use the first value received from the TMOVS.

FOR i = 1 to 64

{

Ii = Ci

Perform

Triple DES: Ii is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2, resulting in

TEMP2

TEMP2 is decrypted by DEA1 using KEY1, resulting in Pi

Send i, KEY (representing KEY1, KEY2, and KEY3), Ci, Pi

If encryption is supported:

Ci+1= corresponding Ci+1 from output of Variable Plaintext Known

Answer Test

else

Ci+1= the corresponding Ci+1 value from TMOVS
61

}

TMOVS: Compare results from each loop with known answers. Should be the set of basis

vectors.

Table 7 illustrates the Variable Ciphertext Known Answer test for the TECB mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. If the IUT does not support encryption, the 64 constant ciphertext values from

Table A.1 are initialized.

c. If encryption is supported by the IUT, the KEYs are forwarded to the IUT using

Input Type 4. If encryption is not supported by the IUT, forward the KEYs and 64

C values to the IUT using Input Type 3.

2. The IUT should:

a. If encryption is supported, initialize the C value with the first C value retained from

the Variable Plaintext Known Answer Test for the TECB Mode (Section 5.1.1.1).

Otherwise, use the first value received from the TMOVS.

b. Perform the following for i=1 through 64:

1) Set the input block Ii equal to the value of Ci.

2) Process Ii through the three DEA stages resulting in plaintext Pi. This

involves processing Ii through the DEA stage DEA3 in the decrypt state

using KEY3, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the DEA stage DEA2 in the encrypt state using KEY2,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the

DEA stage DEA1 in the decrypt state using KEY1, resulting plaintext Pi.

3) Forward the current values of the loop number i, KEY (representing

KEY1, KEY2, and KEY3), Ci, and the resulting Pi to the TMOVS as

specified in Output Type 1.

4) Retain Pi for use with the Initial Permutation Known Answer Test for the

TECB Mode (Section 5.1.2.2).

5) If encryption is supported, set Ci+1 equal to the corresponding output from

the Variable Plaintext Known Answer Test for the TECB mode. If
62

encryption is not supported, assign a new value to Ci+1 by setting it equal to

the corresponding Ci+1 value supplied by the TMOVS.

NOTE-- The output from the IUT for this test should consist of 64 output strings. Each output string should consist of

information included in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The P results should be the set of basis vectors.
63

5.1.2.2 The Initial Permutation Known Answer Test - TECB Mode

Table 8 Initial Permutation Known Answer Test - TECB Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity

set)

Ci (where i=1..64)=64 P values from Variable Ciphertext

Known Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), C1 .. C64

IUT: FOR i = 1 to 64

{

Ii = Ci

Perform

Triple DES: Ii is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2 , resulting in TEMP2

TEMP2 is decrypted by DEA1 using KEY1, resulting in Pi

Send i, KEY (representing KEY1, KEY2, and KEY3), Ci, Pi

Ci+1= corresponding Ci+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers.

See Table A.1.

Table 8 illustrates the Initial Permutation Known Answer Test for the TECB mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

NOTE -- the significant bits are set to "0" and the parity bits are set to "1" to make odd parity.

b. Initializes the 64-bit ciphertext Ci (where i=1,...,64) to the Pi results obtained from

the Variable Ciphertext Known Answer Test.
64

c. Forwards this information to the IUT using Input Type 3.

2. The IUT should perform the following for i=1 through 64:

a. Set the input block Ii equal to the value of Ci.

b. Process Ii through the three DEA stages resulting in plaintext Pi. This involves

processing Ii through the DEA stage DEA3 in the decrypt state using KEY3,

resulting in intermediate value TEMP1. TEMP1 is fed directly into the DEA stage

DEA2 in the encrypt state using KEY2, resulting in intermediate value TEMP2.

TEMP2 is fed directly into the DEA stage DEA1 in the decrypt state using KEY1,

resulting in plaintext Pi.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), Ci, and the resulting Pi to the TMOVS as specified in Output

Type 1.

d. Set Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE-- The output from the IUT should consist of 64 output strings. Each output string should consist of information included

in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values.
65

5.1.2.3 The Variable Key Known Answer Test for the Decryption Process -

TECB Mode

Table 9 The Variable Key Known Answer Tests for the Decryption Process - TECB

Mode

TMOVS: Initialize KEY1: KEY11 = KEY21 = KEY31 = 8001010101010101 (odd

parity set)

If encryption is supported by the IUT:

Send KEY1 (representing KEY11, KEY21, and KEY31)

If encryption is not supported by the IUT:

Initialize Ci(where i=1..56): 56 C values in Table A.2

Send KEY1 (representing KEY11, KEY21, and KEY31), C1, C2,...,C56

IUT: If encryption is supported by the IUT:

Initialize Ci = first value from output of Variable Key Known Answer Test

for the Encryption Process

Otherwise, use the first value received from the TMOVS.

FOR i = 1 to 64

{

IF (i mod 8 ≠ 0) {process every bit except parity bits}

{

Ii = Ci Perform

Triple

DES:

Ii is read into TDEA and is decrypted by DEA3 using

KEY3i resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i resulting

in TEMP2

TEMP2 is decrypted by DEA1 using KEY1i resulting

in Pi

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), Ci,

Pi
66

KEY1i+1 =KEY2i+1 =KEY3i+1 = vector consisting of "0" in

every significant bit position except for a single "1" bit in

position i+1. NOTE -- odd parity is set.

If encryption is supported by the IUT:

Ci+1= corresponding Ci+1 from output of Variable

Key Known Answer Test for the Encryption

Process

else

Ci+1= corresponding Ci+1 from TMOVS

}

}

TMOVS: Compare results of the 56 decryptions with known answers.

Should be P=0000000000000000 for all 56 rounds.

Table 9 illustrates the Variable Key Known Answer Test for the TECB Decryption Process.

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. If the IUT does not support encryption, the Ci values are initialized with the 56

constant C values from Table A.2.

c. If encryption is not supported by the IUT, the KEY (representing KEY1, KEY2,

KEY3), and the 56 C values are forwarded to the IUT using Input Type 3.

Otherwise, the KEY (representing KEY1, KEY2, and KEY3) is forwarded to the

IUT using Input Type 4.

2. The IUT should:
67

a. If encryption is supported, initialize the C value with the first C value retained from

the Variable KEY Known Answer Test for the Encryption Process for the TECB

Mode (Section 5.1.1.3). Otherwise, use the first value received from the TMOVS.

b. Perform the following for i = 1 to 56:

NOTE – 56 is the number of significant bits in a TDES key.

1) Set the input block Ii equal to the value of Ci.

2) Using the corresponding KEY1i, KEY2i, and KEY3i parameters, process Ii

through the three DEA stages resulting in plaintext Pi. This involves

processing Ii through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the DEA stage DEA2 in the encrypt state using KEY2i, resulting in

intermediate value TEMP2. TEMP2 is fed directly into the DEA stage

DEA1 in the decrypt state using KEY1i, resulting in plaintext Pi.

3) Forward the current values of the loop number i, KEYi (representing

KEY1i, KEY2i, and KEY3i), Ci, and the resulting Pi to the TMOVS as

specified in Output Type 1.

4) Set KEY1i+1,, KEY2i+1,, and KEY3i+1,, equal to the vector consisting of "0"

in every significant bit position except for a single "1" bit in position i+1.

The parity bits may contain "1" or "0" to make odd parity.

NOTE -- KEY1i+1 = KEY2i+1 = KEY3i+1.

5) If encryption is supported, set Ci+1 equal to the corresponding Ci+1 value

retained from the Variable Key Known Answer Test for the Encryption

Process for TECB mode. If encryption is not supported by the IUT, set

Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE -- The output from the IUT for this test should consist of 56 output strings. Each output string should consist of

information included in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The P results should be all zeros.
68

5.1.2.4 Permutation Operation Known Answer Test for Decryption Process -

TECB Mode

Table 10 The Permutation Operation Known Answer Test for the Decryption Process -

TECB Mode

TMOVS: Initialize KEY1i =KEY2i =KEY3i =(where i=1..32) = 32 KEY values in Table A.3

If encryption is supported by the IUT:

Send KEY1, KEY2,..., KEY32 (Since all three keys are the same, these

key values represent the values of KEY1, KEY2, and KEY3.)

If encryption is not supported by the IUT:

Initialize Ci (where i=1..32) = corresponding C values in Table 3

Send KEY1, C1, KEY2, C2,...,KEY32, C32 (The key values represent the

values of KEY1, KEY2, and KEY3.)

IUT: If encryption is supported by the IUT:

Initialize Ci = first value retained from Permutation Operation Known

Answer Test for the Encryption Process

Otherwise, use the first value received from the TMOVS.

FOR i = 1 to 32

{

Ii = Ci

Perform

Triple DES: Ii is read into TDEA and is decrypted by DEA3 using

KEY3i, resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is decrypted by DEA1 using KEY1i, resulting in

Pi

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), Ci,

Pi

KEY1i+1 = KEY2i+1 = KEY3i+1 = corresponding KEYi+1

supplied by TMOVS
69

If encryption is supported:

Ci+1 = corresponding Ci+1 from output of

Permutation Operation Known Answer Test for the

Encryption Process

else

Ci+1 = corresponding Ci+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers.

Should be P=0000000000000000 for all 32 rounds.

Table 10 illustrates the Permutation Operation Known Answer Test for the TECB Decryption

Process.

1. The TMOVS:

a. If the IUT supports encryption, the KEY1, KEY2, and KEY3 variables are

initialized with the 32 constant KEY values from Table A.3. If the IUT does not

support encryption, the KEY-ciphertext (KEY-C) pairs are initialized with the 32

constant KEY-C pairs from Table A.3.

NOTE -- KEY1=KEY2=KEY3.

b. If encryption is supported by the IUT, the 32 KEY values for KEY1, KEY2, and

KEY3 are forwarded using Input Type 10. If encryption is not supported by the

IUT, the 32 KEY-C pairs are forwarded to the IUT using Input Type 9.

2. The IUT should:

a. If encryption is supported, initialize the C value with the first C value retained from

the Permutation Operation Known Answer Test for the Encryption Process for the

TECB Mode (Section 5.1.1.4). Otherwise, use the first value received from the

TMOVS.

b. Perform the following for i = 1 to 32:

1) Set the input block Ii equal to the value of Ci.

2) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ii

through the three DEA stages resulting in plaintext Pi. This involves

processing Ii through the DEA stage DEA3 in the decrypt state using
70

KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the DEA stage DEA2 in the encrypt state using KEY2i, resulting in

intermediate value TEMP2. TEMP2 is fed directly into the DEA stage

DEA1 in the decrypt state using KEY1i, resulting in plaintext Pi.

3) Forward the current values of the loop number i, KEY (representing

KEY1, KEY2, and KEY3), Ci, and the resulting Pi to the TMOVS as

specified in Output Type 1.

4) Assign a new value to KEY1i+1, KEY2i+1, and KEY3i+1 by setting them

equal to the corresponding KEYi+1 value supplied by the TMOVS.

NOTE -- KEY1=KEY2=KEY3.

5) If encryption is supported, set Ci+1 equal to the corresponding Ci+1 value

retained from the Permutation Operation Known Answer Test for the

Encryption Process for the TECB mode. If encryption is not supported, set

Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE-- The above processing should continue until all 32 KEY-C values are passed as specified in Input Type 9, or all 32

KEY values are passed as specified in Input Type 10. The output from the IUT for this test should consist of 32 output strings.

Each output string should consist of information included in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The P results should be all zeros.
71

5.1.2.5 Substitution Table Known Answer Test for the Decryption Process -

TECB Mode

Table 11 The Substitution Table Known Answer Test for the Decryption Process -

TECB Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i=1..19) = 19 KEY values in Table A.4

If encryption is supported by the IUT:

Send KEY1, KEY2,...,KEY19 (Since all three keys are the same, these key

values represent the values of KEY1, KEY2, and KEY3.)

If encryption is not supported by the IUT:

Initialize Ci (where i=1..19) = corresponding C values in Table A.4

Send KEY1, C1, KEY2, C2,...,KEY19, C19 (The key values represent the values

of KEY1, KEY2 and KEY3.)

IUT: If encryption is supported by the IUT:

Initialize C1 = first value retained from the Substitution Table Known Answer

Test for the Encryption Process

Otherwise, use the first value received from the TMOVS.

FOR i = 1 to 19

{

Ii = Ci

Perform

Triple DES: Ii is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is decrypted by DEA1 using KEY1i, resulting in Pi

Send i, KEYi, Ci, Pi (where KEYi represents the value of KEY1, KEY2

and KEY3)

KEY1i+1 = KEY2i+1 = KEY3i+1 = corresponding KEYi+1 supplied by

TMOVS

If encryption is supported:
72

Ci+1 = corresponding Ci+1 from output of Substitution Table Known

Answer Test for the Encryption Process for the TECB mode

else

Ci+1 = corresponding Ci+1 from TMOVS

TMOVS: Compare results from each loop with known answers. See Table A.4.

As summarized in Table 11, the Substitution Table Known Answer Test for the TECB Decryption

Process is performed as follows:

1. The TMOVS:

a. If the IUT supports encryption, the KEY1, KEY2, and KEY3 variables are

initialized with the 19 constant KEY values from Table A.4. If the IUT does not

support encryption, the KEY-ciphertext (KEY-C) pairs are initialized with the 19

constant KEY-C pairs from Table A.4.

NOTE -- KEY1=KEY2=KEY3.

b. If encryption is supported by the IUT, the 19 KEY values for KEY1, KEY2, and

KEY3 are forwarded to the IUT using Input Type 10. The 19 KEY-C pairs are

forwarded to the IUT using Input Type 9 if encryption is not supported by the

IUT.

2. The IUT should:

a. If encryption is supported, initialize the Ci value with the first C value retained

from the Substitution Table Known Answer Test for the Encryption Process for

the TECB Mode (Section 5.1.1.5). Otherwise, use the first C value received from

the TMOVS.

b. Perform the following for i = 1 to 19:

1) Set the input block Ii equal to the value of Ci.

2) Using the corresponding KEY1i, KEY2i, and KEY3i values, process Ii

through the three DEA stages resulting in plaintext Pi. This involves

processing Ii through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the DEA stage DEA2 in the encrypt state using KEY2i, resulting in

intermediate value TEMP2. TEMP2 is fed directly into the DEA stage

DEA1 in the decrypt state using KEY1i, resulting in plaintext Pi.
73

3) Forward the current values of the loop number i, KEY (representing

KEY1, KEY2, and KEY3), Ci, and the resulting Pi to the TMOVS as

specified in Output Type 1.

4) Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the next key supplied by the

TMOVS.

5) If encryption is supported, set Ci+1 equal to the corresponding Ci+1 value

retained from the Substitution Table Known Answer Test for the

Encryption Process for the TECB mode. If encryption is not supported, set

Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE --The above processing should continue until all 19 KEY-C pairs, as specified in Input Type 9, or all 19 KEY values, as

specified in Input Type 10, are processed. The output from the IUT for this test should consist of 19 output strings. Each output

string should consist of information included in Output Type 1.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values.
74

5.1.2.6 Monte Carlo Test for the Decryption Process - TECB Mode

Table 12 The Monte Carlo Test for the Decryption Process - TECB Mode

TMOVS: Initialize KEY10, KEY20, KEY30, C0

Send KEY10, KEY20, KEY30, C0

IUT: FOR i = 0 TO 399

{

Record i, KEY1i, KEY2i, KEY3i, C0

FOR j = 0 TO 9,999

{

Ij = Cj

Process

Triple DES: Ij is read into TDEA and is decrypted by DEA3 using

KEY3i, resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is decrypted by DEA1 using KEY1i, resulting in

Pj

Cj+1 = Pj

}

Record Pj

Send i, KEY1i, KEY2i, KEY3i, C0, Pj

KEY1i+1= KEY1i ⊕ Pj

If (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, and KEY3i are independent),

 KEY2i+1= KEY2i ⊕ Pj-1

else

 KEY2i+1= KEY2i ⊕ Pj
75

If (KEY1i =KEY2i =KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i),

 KEY3i+1= KEY3i ⊕ Pj

else

 KEY3i+1= KEY3i ⊕ Pj-2

C0 = Pj

}

TMOVS: Check IUT's output for correctness.

As summarized in Table 12, the Monte Carlo Test for the TECB Decryption Process is performed

as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, and the ciphertext C

variables. The C and KEYs consist of 64 bits.

b. Forwards this information to the IUT using Input Type 20.

2. The IUT should perform the following for i = 0 through 399:

a. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

and C0.

b. Perform the following for j = 0 through 9999:

1) Set the input block Ij equal to the value of Cj.

2) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ij

through the three DEA stages resulting in plaintext Pj. This involves

processing Ij through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the DEA stage DEA2 in the encrypt state using KEY2i, resulting in

intermediate value TEMP2. TEMP2 is fed directly into the DEA stage

DEA1 in the decrypt state using KEY1i, resulting in plaintext Pj.

3) Prepare for loop j+1 by assigning Cj+1 with the current value of Pj.

c. Record Pj.
76

d. Forward all recorded information for this loop, as specified in Output Type 5, to

the TMOVS.

e. Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop. Note j = 9999.

The new KEY1i+1 should be calculated by exclusive-ORing the current KEY1i with

the Pj.

The new KEY2i+1 calculation is based on the values of the keys. . If KEY1i and

KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and KEY3i are

independent, the new KEY2i+1 should be calculated by exclusive-ORing the current

KEY2i with the Pj-1. If KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be

calculated by exclusive-ORing the current KEY2i with the Pj.

The new KEY3i+1 calculation is also based on the values of the keys. If KEY1i,

KEY2i, and KEY3i are independent, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the Pj-2. If KEY1i and KEY2i are

independent and KEY3i = KEY1i, or if KEY1i=KEY2i=KEY3i, the new KEY3i+1

should be calculated by exclusive-ORing the current KEY3i with the Pj.

f. Assign a new value to C in preparation for the next output loop. C0 should be

assigned the value of the current Pj. Note j = 9999.

NOTE -- the new C should be denoted as C0 to be used for the first pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 5.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values.
77

5.2 Cipher Block Chaining (TCBC) Mode

The IUTs which implement the Cipher Block Chaining (TCBC) mode are validated by

successfully completing a series of Known Answer tests and Monte Carlo tests corresponding to

the cryptographic processes allowed by the IUT.

5.2.1 Encryption Process

The process of validating an IUT which implements the TCBC mode of operation in the

encryption process should involve the successful completion of the following six tests:

1. The Variable Plaintext Known Answer Test - TCBC mode

2. The Inverse Permutation Known Answer Test - TCBC mode

3. The Variable Key Known Answer Test for the Encryption Process - TCBC mode

4. The Permutation Operation Known Answer Test for the Encryption Process - TCBC

mode

5. The Substitution Table Known Answer Test for the Encryption Process - TCBC mode

6. The Monte Carlo Test for the Encryption Process - TCBC mode

An explanation of the tests follows.
78

5.2.1.1 The Variable Plaintext Known Answer Test - TCBC Mode

Table 13 The Variable Plaintext Known Answer Test - TCBC Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity

set)

IV = 0000000000000000

P1 = 8000000000000000

Send KEY (representing KEY1, KEY2, and KEY3), IV, P1

IUT: FOR i = 1 to 64

{

Ii= Pi ⊕ IV

Ii is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2, resulting in TEMP2

Perform

Triple

DES:

TEMP2 is encrypted by DEA3 using KEY3, resulting in Ci

Send i, KEY (representing KEY1, KEY2, and KEY3), IV, Pi, Ci

Pi+1 = basis vector where single "1" bit is in position i+1

}

TMOVS: Compare results from each loop with known answers. See Table A.1.

Table 13 illustrates the Variable Plaintext Known Answer Test for the TCBC mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.
79

c. Initializes the 64-bit plaintext P1 to the basis vector containing a"1" in the first bit

position and "0" in the following 63 positions, i.e., P1 bin = 10000000 00000000

00000000 00000000 00000000 00000000 00000000 00000000. The equivalent of

this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 2.

2. The IUT should perform the following for i=1 through 64:

a. Calculate the input block Ii by exclusive-ORing Pi with IV.

b. Process Ii through the three DEA stages resulting in ciphertext Ci. This involves

processing Ii through the first DEA stage, denoted DEA1, in the encrypt state

using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the second DEA stage, denoted DEA2, in the decrypt state using KEY2, resulting

in intermediate value TEMP2. TEMP2 is fed directly into the third DEA stage,

denoted DEA3, in the encrypt state using KEY3, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, Pi, and the resulting Ci to the TMOVS as specified in

Output Type 2.

d. Retain Ci for use with the Inverse Permutation Known Answer Test for the TCBC

Mode (Section 5.2.1.2 ), and, if the IUT supports the decryption process, for use

with the Variable Ciphertext Known Answer Test for the TCBC Mode (Section

5.2.2.1).

e. Assign a new value to Pi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i +1=2,...,64.

NOTE -- This continues until every possible basis vector has been represented by the P, i.e., 64 times. The output from the IUT

should consist of 64 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.1.
80

5.2.1.2 The Inverse Permutation Known Answer - TCBC Mode

Table 14 The Inverse Permutation Known Answer Test - TCBC Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity

set)

IV = 0000000000000000

Pi (where i=1..64) = 64 C values from the Variable Plaintext

Known Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), IV, P1,...,P64

IUT: FOR i = 1 to 64

{

Ii= Pi ⊕ IV Perform

Triple

DES: Ii is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3, resulting in Ci

Send i, KEY (representing KEY1, KEY2, KEY3), IV, Pi, Ci

Pi+1 = corresponding Ci+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers.

Should be the set of basis vectors.

Table 14 illustrates the Inverse Permutation Known Answer Test for the TCBC mode of

operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

NOTE -- the significant bits are set to "0" and the parity bits are set to "1" to make odd parity.
81

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initializes the 64-bit plaintext Pi (where i=1..64) to the Ci results obtained from the

Variable Plaintext Known Answer Test.

d. Forwards this information to the IUT using Input Type 5.

2. The IUT should perform the following for i=1 through 64:

a. Calculate the input block Ii by exclusive-ORing Pi with IV.

b. Process Ii through the three DEA stages resulting in ciphertext Ci. This involves

processing Ii through the first DEA stage, denoted DEA1, in the encrypt state

using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the second DEA stage, denoted DEA2, in the decrypt state using KEY2, resulting

in intermediate value TEMP2. TEMP2 is fed directly into the third DEA stage,

denoted DEA3, in the encrypt state using KEY3, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, Pi, and the resulting Ci to the TMOVS as specified in

Output Type 2.

d. Assign a new value to Pi+1 by setting it equal to the corresponding output from the

TMOVS.

NOTE -- The output from the IUT should consist of 64 output strings. Each output string should consist of information included

in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The C values should be the set of basis vectors.
82

5.2.1.3 The Variable Key Known Answer Test for the Encryption Process -

TCBC Mode

Table 15 The Variable Key Known Answer Test for the Encryption Process - TCBC

Mode

TMOVS: Initialize KEY1: KEY11 = KEY21 = KEY31 = 8001010101010101 (odd

parity set)

IV = 0000000000000000

P = 0000000000000000

Send KEY1 (representing KEY11, KEY21, and KEY31), IV, P

IUT: FOR i = 1 to 64

{

IF (i mod 8 ≠ 0) {process every bit except parity bits}

{

Ii = P ⊕ IV

Perform

Triple DES: Ii is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in

Ci

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV, P,

CI

KEY1i+1 = KEY2i+1 = KEY3i+1 = vector consisting of "0" in

every significant bit position except for a single "1" bit in

position i+1.

NOTE -- that parity bits are "0" or "1" to make the KEYs odd parity.

}

}

TMOVS: Compare results of the 56 encryptions with known answers.
83

Use Table A.2.

As summarized in Table 15, the Variable Key Known Answer Test for the TCBC Encryption

Process is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0"

in every significant bit except for a "1" in the first position, i.e., the 64-bit

KEY11 bin= KEY21 bin= KEY31 bin= 10000000 00000001 00000001

00000001 00000001 00000001 00000001 00000001. The equivalent of this

value in hexadecimal notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initializes the 64-bit plaintext P to the value of 0, i.e., Phex = 00 00 00 00 00 00 00

00.

d. Forwards this information to the IUT using Input Type 2.

2. The IUT should perform the following for i = 1 to 56:

NOTE -- 56 is the number of significant bits in a TDES key.

a. Calculate the input block Ii by exclusive-ORing P with IV.

b. Using the corresponding KEY1i, KEY2i, and KEY3i parameters, process Ii

through the three DEA stages resulting in ciphertext Ci. This involves processing Ii

through the first DEA stage, denoted DEA1, in the encrypt state using KEY1i,

resulting in intermediate value TEMP1. TEMP1 is fed directly into the second

DEA stage, denoted DEA2, in the decrypt state using KEY2i, resulting in

intermediate value TEMP2. TEMP2 is fed directly into the third DEA stage,

denoted DEA3, in the encrypt state using KEY3i, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i,), IV, P, and the resulting Ci to the TMOVS as specified in

Output Type 2.

d. If the IUT supports the decryption process, retain Ci for use with the Variable

KEY Known Answer Test for the Decryption Process for the TCBC Mode

(Section 5.2.2.3).
84

e. Set KEY1i+1,, KEY2i+1,, and KEY3i+1,, equal to the vector consisting of "0" in

every significant bit position except for a single "1" bit in position i+1. The parity

bits may contain "1" or "0" to make odd parity.

NOTE -- The above processing continues until every significant basis vector has been represented by the KEY parameter. The

output from the IUT for this test should consist of 56 output strings. Each output string should consist of information included

in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.2.
85

5.2.1.4 Permutation Operation Known Answer Test for the Encryption

Process - TCBC Mode

Table 16 The Permutation Operation Known Answer Test for the Encryption Process -

TCBC Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i=1..32) = 32 KEY values in

Table A.3

IV = 0000000000000000

P = 0000000000000000

Send P, IV, KEY1, KEY2,...,KEY32 (Since all three keys are the same,

these key values represent the values of KEY1, KEY2 and KEY3.)

IUT: FOR i = 1 to 32

{

Ii = P ⊕ IV

Perform

Triple DES: Ii is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Ci

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV, P, Ci

KEY1i+1 = KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

}

TMOVS: Compare results with known answers. Use Table A.3.

Table 16 illustrates the Permutation Operation Known Answer Test for the TCBC Encryption

Process.

1. The TMOVS:

a. Initializes the KEY1, KEY2, and KEY3 variables with the 32 constant KEY values

from Table A.3.
86

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initializes the plaintext P to the value of 0, i.e., Phex=00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 8.

2. The IUT should perform the following for i = 1 to 32:

a. Calculate the input block Ii by exclusive-ORing P with IV.

b. Using the corresponding KEY1i, KEY2i, and KEY3i values, process Ii through the

three DEA stages resulting in ciphertext Ci. This involves processing Ii through the

first DEA stage, denoted DEA1, in the encrypt state using KEY1i, resulting in

intermediate value TEMP1. TEMP1 is fed directly into the second DEA stage,

denoted DEA2, in the decrypt state using KEY2i, resulting in intermediate value

TEMP2. TEMP2 is fed directly into the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, P, and the resulting Ci to the TMOVS as specified in

Output Type 2.

d. If the IUT supports the decryption process, retain Ci for use with the Permutation

Operation Known Answer Test for the Decryption Process for the TCBC mode

(Section 5.2.2.4).

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the next key supplied by the

TMOVS.

NOTE -- The above processing should continue until all 32 KEY values are processed. The output from the IUT for this test

should consist of 32 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.3.
87

5.2.1.5 Substitution Table Known Answer Test for the Encryption Process -

TCBC Mode

Table 17 The Substitution Table Known Answer Test for the Encryption Process -

TCBC Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i(where i=1..19) = 19 KEY values in Table

A.4

Pi (where i=1..19) = 19 corresponding P values in Table A.4

IV = 0000000000000000

Send IV, 19, KEY1, P1, KEY2, P2,...,KEY19, P19 (Since all three keys are the

same, these key values represent the values of KEY1, KEY2 and

KEY3.)

IUT: FOR i = 1 to 19

{

Ii = Pi ⊕ IV

Perform

Triple DES: Ii is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Ci

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV, Pi, Ci

KEY1i+1 = KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

Pi+1 = corresponding Pi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. Use Table A.4.

As summarized in Table 17, the Substitution Table Known Answer Test for the TCBC Encryption

Process is performed as follows:

1. The TMOVS:
88

a. Initializes the KEY-plaintext (KEY-P) pairs with the 19 constant KEY-P values

from Table A.4. The KEY value indicates the value of KEY1, KEY2, and KEY3,

i.e., KEY1=KEY2=KEY3.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Forwards this information to the IUT using Input Type 11.

2. The IUT should perform the following for i = 1 to 19:

a. Calculate the input block Ii by exclusive-ORing Pi with IV.

b. Using the corresponding KEY1i, KEY2i, and KEY3i values, process Ii through the

three DEA stages resulting in ciphertext Ci. This involves processing Ii through the

first DEA stage, denoted DEA1, in the encrypt state using KEY1i, resulting in

intermediate value TEMP1. TEMP1 is fed directly into the second DEA stage,

denoted DEA2, in the decrypt state using KEY2i, resulting in intermediate value

TEMP2. TEMP2 is fed directly into the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in ciphertext Ci.

c. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, Pi, and the resulting Ci to the TMOVS as specified in

Output Type 2.

d. If the IUT supports the decryption process, retain Ci for use with the Substitution

Table Known Answer Test for the Decryption Process for the TCBC mode

(Section 5.2.2.5).

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the KEYi+1 supplied by the TMOVS.

f. Set Pi+1 equal to the corresponding Pi+1 value supplied by the TMOVS.

NOTE -- The above processing should continue until all 19 KEY-P pairs are processed. The output from the IUT for this test

should consist of 19 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.4.
89

5.2.1.6 Monte Carlo Test for the Encryption Process - TCBC Mode

Table 18 The Monte Carlo Test for the Encryption Process - TCBC Mode

TMOVS: Initialize KEY10, KEY20, KEY30, IV, P0

Send KEY10, KEY20, KEY30, IV, P0

IUT: FOR i = 0 TO 399

{

If (i==0) CV0 = IV

Record i, KEY1i, KEY2i, KEY3i, CV0, P0

FOR j = 0 TO 9,999

{

Ij = Pj ⊕ CVj

Process

Triple DES: Ij is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in

Cj

IF j=0

Pj+1 = CV0

ELSE

Pj+1 = Cj-1

CVj+1 = Cj

}

Record Cj

Send i, KEY1i, KEY2i, KEY3i, CV0, P0, Cj

KEY1i+1 = KEY1i ⊕ Cj
90

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, and KEY3i are independent)

 KEY2i+1= KEY2i ⊕ Cj-1

ELSE

 KEY2i+1= KEY2i ⊕ Cj

IF (KEY1i= KEY2i= KEY3i) or (KEY1I and KEY2i are independent and

KEY3i = KEY1i)

 KEY3i+1= KEY3i ⊕ Cj

ELSE

 KEY3i+1= KEY3i ⊕ Cj-2

P0 = Cj-1

CV0 = Cj

}

TMOVS: Check IUT's output for correctness.

As summarized in Table 18, the Monte Carlo Test for the TCBC Encryption Process is performed

as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, the initialization vector

IV, and the plaintext P variables. The P, IV, and KEYs consist of 64 bits each.

b. Forwards this information to the IUT using Input Type 21.

2. The IUT should perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), set the chaining value CV0 equal

to the IV.

b. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

CV0, and P0.

c. Perform the following for j = 0 through 9999:
91

1) Calculate the input block Ij by exclusive-ORing Pj with CVj.

2) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ij

through the three DEA stages resulting in ciphertext Cj. This involves

processing Ij through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the second DEA stage, denoted DEA2, in the decrypt state

using KEY2i, resulting in intermediate value TEMP2. TEMP2 is fed

directly into the third DEA stage, denoted DEA3, in the encrypt state using

KEY3i, resulting in ciphertext Cj.

3) Prepare for loop j+1 by doing the following:

a) If the inner loop being processed in the first loop, i.e., j=0, assign

Pj+1 with the current value of CV0. Otherwise, assign Pj+1 with the C

from the previous inner cycle, Cj-1.

b) Assign CVj+1 with the current value of Cj.

d. Record the Cj.

e. Forward all recorded information from this loop, as specified in Output Type 6, to

the TMOVS.

f. In preparation for the next outer loop (Note j = 9999):

1) Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop.

The new KEY1i+1 should be calculated by exclusive-ORing the current

KEY1i with the Cj.

The new KEY2i+1 calculation is based on the values of the keys. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and

KEY3i are independent, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the Cj-1. If

KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the Cj.

The new KEY3i+1 calculation is also based on the values of the keys. If

KEY1i, KEY2i, and KEY3i are independent, the new KEY3i+1 should be

calculated by exclusive-ORing the current KEY3i with the Cj-2. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or if

KEY1i=KEY2i=KEY3i, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the Cj.
92

2) Assign a new value to P0 in preparation for the next output loop. P0 should

be assigned the value of Cj-1.

NOTE -- the new P should be denoted as P0 to be used for the first pass through the inner loop

when j=0.

3) Assign a new value to CV0 in preparation for the next outer loop. CV0

should be assigned the value of Cj.

NOTE -- the new CV should be denoted as CV0 because this value is used for the first pass

through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 6.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
93

5.2.2 Decryption Process

The process of validating an IUT for the TCBC mode which implements the decryption process

involves the successful completion of the following six tests:

1. The Variable Ciphertext Known Answer Test - TCBC mode

2. The Initial Permutation Known Answer Test - TCBC mode

3. The Variable Key Known Answer Test for the Decryption Process - TCBC mode

4. The Permutation Operation Known Answer Test for the Decryption Process - TCBC

mode

5. The Substitution Table Known Answer Test for the Decryption Process - TCBC mode

6. The Monte Carlo Test for the Decryption Process - TCBC mode

An explanation of the tests follows.
94

5.2.2.1 The Variable Ciphertext Known Answer Test - TCBC Mode

Table 19 The Variable Ciphertext Known Answer Test - TCBC Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd

parity set)

IV = 0000000000000000

If encryption is supported by the IUT:

Send KEY (representing KEY1, KEY2, and KEY3), IV

If encryption is not supported by the IUT:

Initialize Ci (where i=1..64) = C values in Table A.1

Send KEY (representing KEY1, KEY2, and KEY3), IV, C1, C2,...,C64

IUT: If encryption is supported

Initialize C1= first value from output of Variable Plaintext Known Answer

Test.

Otherwise, use the first value received from the TMOVS.

FOR i = 1 to 64

{

Ii = Ci Perform

Triple

DES:

Ii is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2, resulting in TEMP2

TEMP2 is decrypted by DEA1 using KEY1, resulting in Oi

Pi = Oi ⊕ IV

Send i, KEY (representing KEY1, KEY2, and KEY3), IV, Ci, Pi

If encryption is supported:

Ci+1 = corresponding Ci+1 from output of Variable Plaintext Known

Answer Test
95

else

Ci+1 = corresponding Ci+1 value from TMOVS

}

TMOVS: Compare results from each loop with known answers. Should be the set of basis

vectors.

Table 19 illustrates the Variable Ciphertext Known Answer Test for the TCBC mode of

operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. If the IUT does not support encryption, the 64 constant ciphertext values are

initialized with the 64 constant C values from Table A.1.

d. If encryption is supported by the IUT, the KEYs and the IV are forwarded to the

IUT, as specified in Input Type 6. If encryption is not supported by the IUT, the

KEYs, the IV, and 64 C values are forwarded to the IUT using Input Type 5.

2. The IUT should:

a. If encryption is supported, initialize the C value with the first C value retained from

the Variable Plaintext Known Answer Test for the TCBC Mode (Section 5.2.1.1).

Otherwise, use the first value received from the TMOVS.

b. Perform the following for i=1 through 64:

1) Set the input block Ii equal to the value of Ci.

2) Process Ii through the three DEA stages resulting in the output block Oi.

This involves processing Ii through the DEA stage DEA3, in the decrypt

state using KEY3, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the DEA stage DEA2, in the encrypt state using KEY2,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the

DEA stage DEA1, in the decrypt state using KEY1, resulting in output

block Oi.
96

3) Calculate the plaintext Pi by exclusive-ORing Oi with IV.

4) Forward the current values of the loop number i, KEY (representing

KEY1, KEY2, and KEY3), IV, Ci, and the resulting Pi to the TMOVS as

specified in Output Type 2.

5) Retain Pi for use with the Initial Permutation Known Answer Test for the

TCBC Mode (Section 5.2.2.2).

6) If encryption is supported, set Ci+1 equal to the corresponding output from

the Variable Plaintext Known Answer Test for the TCBC mode. If

encryption is not supported, assign a new value to Ci+1 by setting it equal to

the corresponding Ci+1 value supplied by the TMOVS.

NOTE -- The output from the IUT for this test should consist of 64 output strings. Each output string should consist of

information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values. The P results should be the set of basis vectors.
97

5.2.2.2 The Initial Permutation Known Answer Test - TCBC Mode

Table 20 The Initial Permutation Known Answer Test - TCBC Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity

set)

IV = 0000000000000000

Ci (where i=1..64) = 64 P values from Variable Ciphertext Known

Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), IV, C1..C64

IUT: FOR i = 1 to 64

{

Ii = Ci Perform

Triple

DES:

Ii is read into TDEA and is decrypted by DEA3 using KEY3, resulting

in TEMP1

TEMP1 is encrypted by DEA2 using KEY2, resulting in TEMP2

TEMP2 is decrypted by DEA1 using KEY1, resulting in Oi

Pi = Oi ⊕ IV

Send i, KEY (representing KEY1, KEY2, and KEY3), IV, Ci, Pi

Ci+1 = corresponding Ci+1 value from TMOVS

}

TMOVS: Compare results from each loop with known answers.

Table 20 illustrates the Initial Permutation Known Answer Test for the TCBC mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.
98

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c Initializes the 64 C values with the 64 P values obtained from the Variable

Ciphertext Known Answer Test.

d. Forwards the KEY (representing KEY1, KEY2, and KEY3), IV, and the 64 C

values to the IUT using Input Type 5.

2. The IUT should perform the following for i=1 through 64:

a. Set the input block Ii equal to the value of Ci.

b. Process Ii through the three DEA stages resulting in the output block Oi. This

involves processing Ii through the DEA stageDEA3 in the decrypt state using

KEY3, resulting in intermediate value TEMP1. TEMP1 is fed directly into the

DEA stage DEA2 in the encrypt state using KEY2, resulting in intermediate value

TEMP2. TEMP2 is fed directly into the DEA stage DEA1 in the decrypt state

using KEY1, resulting in Oi.

c. Calculate the plaintext Pi by exclusive-ORing Oi with IV.

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, Ci, and the resulting Pi to the TMOVS as specified in

Output Type 2.

e. Set Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE -- The output from the IUT should consist of 64 output strings. Each output string should consist of information included

in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
99

5.2.2.3 The Variable Key Known Answer Test for the Decryption Process -

TCBC Mode

Table 21 The Variable Key Known Answer Test for the Decryption Process - TCBC

Mode

TMOVS: Initialize KEYs: KEY11 = KEY21 = KEY31 = 8001010101010101 (odd

parity set)

IV=0000000000000000

If encryption is supported by the IUT:

Send KEY1 (representing KEY11, KEY21, and KEY31), IV

If encryption is not supported by the IUT:

Initialize Ci values (where i=1..56): C values in Table A.2

Send KEY1 (representing KEY11, KEY21, and KEY31), IV, C1, C2,..., C56

IUT: If encryption is supported by the IUT:

Initialize C1 = first value from output of Variable Key Known Answer Test

for the Encryption Process

Otherwise, use the first value received from the TMOVS.

FOR i = 1 to 64

{

IF (i mod 8 ≠ 0) {process every bit except parity bits}

{

Ii = Ci Perform

Triple

DES:

Ii is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is decrypted by DEA1 using KEY1i, resulting in Oi

Pi = Oi ⊕ IV

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV, Ci, Pi
100

KEY1i+1 = KEY2i+1 = KEY3 i+1 = vector consisting of "0" in every

significant bit position except for a single "1" bit in the i+1th position.

NOTE -- odd parity is set.

If encryption is supported by the IUT:

Ci+1 = corresponding Ci+1 from output of Variable Key Known

Answer Test for the Encryption Process

else

Ci+1 = corresponding Ci+1 value from TMOVS

}

}

TMOVS: Compare results of the 56 decryptions with known answers.

Should be P=0000000000000000 for all 56 rounds.

Table 21 illustrates the Variable Key Known Answer Test for the TCBC Decryption Process.

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. If the IUT does not support encryption, the Ci values are initialized with the 56

constant C values from Table A.2.

d. If encryption is not supported by the IUT, the KEY (representing KEY1, KEY2,

and KEY3), IV, and the 56 C values are forwarded to the IUT, as specified in

Input Type 5. Otherwise, the KEY1, KEY2, KEY3, and IV are forwarded to the

IUT, as specified in Input Type 6.

2. The IUT should:
101

a. If encryption is supported, initialize the C1 value with the first C value retained

from the Variable KEY Known Answer Test for the Encryption Process for the

TCBC Mode (Section 5.2.1.3). Otherwise, use the first value received from the

TMOVS.

b. Perform the following for i = 1 to 56:

NOTE -- 56 is the number of significant bits in a TDES key.

1) Set the input block Ii equal to the value of Ci.

2) Using the corresponding KEY1i, KEY2i, and KEY3i parameters, process Ii

through the three DEA stages resulting in the output block Oi. This

involves processing Ii through the DEA stage DEA3 in the decrypt state

using KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the DEA stage DEA2 in the encrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the

DEA stage DEA1 in the decrypt state using KEY1i, resulting in Oi.

3) Calculate the plaintext Pi by exclusive-ORing Oi with IV.

4) Forward the current values of the loop number i, KEYi (representing

KEY1i, KEY2i, and KEY3i), IV, Ci, and the resulting Pi to the TMOVS as

specified in Output Type 2.

5) Set KEY1i+1,, KEY2i+1,, and KEY3i+1,, equal to the vector consisting of "0"

in every significant bit position except for a single "1" bit in position i+1.

The parity bits may contain "1" or "0" to make odd parity.

NOTE -- KEY1i+1 = KEY2i+1 = KEY3i+1.

6) If encryption is supported, set Ci+1 equal to the corresponding Ci+1 value

retained from the Variable Key Known Answer Test for the Encryption

Process for TCBC mode. If encryption is not supported by the IUT, set

Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE -- The output from the IUT for this test should consist of 56 output strings. Each output string should consist of

information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values. The P results should be all zeros.
102

5.2.2.4 Permutation Operation Known Answer Test for Decryption Process -

TCBC Mode

Table 22 The Permutation Operation Known Answer Test for the Decryption Process -

TCBC Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i=1..32) = 32 KEY values in

Table A.3

IV = 0000000000000000

If encryption is supported by the IUT:

Send IV, KEY1, KEY2,...,KEY32 (Since all three keys are the same, these

key values represent the values of KEY1, KEY2, and KEY3.)

If encryption not supported by the IUT:

Initialize Ci (where i=1..32) = corresponding C values in Table A.3

Send IV, KEY1, C1, KEY2, C2,...,KEY32, C32 (The key values represent

the values of KEY1, KEY2, and KEY3.)

IUT: If encryption is supported by the IUT:

Initialize C1 = first value retained from Permutation Operation Known

Answer Test for the Encryption Process

Otherwise, use the first value received from the TMOVS.

FOR i = 1 to 32

{

Ii = Ci Perform

Triple

DES:

Ii is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is decrypted by DEA1 using KEY1i, resulting in Oi

Pi = Oi ⊕ IV

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV, Ci, Pi

KEY1i+1 = KEY2i+1 = KEY3i+1 = corresponding KEYi+1 supplied by
103

TMOVS

If encryption is supported:

Ci+1 = corresponding Ci+1 from output of Permutation Operation Known

Answer Test for the Encryption Process

else

Ci+1 = corresponding Ci+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers.

Should be P=0000000000000000 for all 32 rounds.

Table 22 illustrates the Permutation Operation Known Answer Test for the TCBC Decryption

Process.

1. The TMOVS:

a. If the IUT supports encryption, the KEY1, KEY2, and KEY3 variables are

initialized with the 32 constant KEY values from Table A.3. If the IUT does not

support encryption, the KEY-ciphertext (KEY-C) pairs are initialized with the 32

constant KEY-C pairs from Table A.3.

NOTE -- KEY1=KEY2=KEY3.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. If encryption is supported by the IUT, the 32 KEY values for KEY1, KEY2, and

KEY3, and the IV value are forwarded to the IUT using Input Type 12. If

encryption is not supported by the IUT, the 32 KEY and C pairs and the IV value

are forwarded to the IUT using Input Type 11.

2. The IUT should:

a. If encryption is supported, initialize the Ci value with the first C value retained

from the Permutation Operation Known Answer Test for the Encryption Process

for the TCBC Mode (Section 5.2.1.4). Otherwise, use the first value received from

the TMOVS.

b. Perform the following for i = 1 to 32:
104

1) Set the input block Ii equal to the value of Ci.

2) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ii

through the three DEA stages resulting in output block Oi. This involves

processing Ii through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed directly into

the DEA stage DEA2 in the encrypt state using KEY2i, resulting in

intermediate value TEMP2. TEMP2 is fed directly into the DEA stage

DEA1 in the decrypt state using KEY1i, resulting in Oi.

3) Calculate the plaintext Pi by exclusive-ORing Oi with IV.

4) Forward the current values of the loop number i, KEY (representing

KEY1, KEY2, and KEY3), IV, Ci, and the resulting Pi to the TMOVS as

specified in Output Type 2.

5) Assign a new value to KEY1i+1, KEY2i+1, and KEY3i+1 by setting them

equal to the corresponding KEYi+1 value supplied by the TMOVS.

NOTE -- KEY1=KEY2=KEY3.

6) If encryption is supported, set Ci+1 equal to the corresponding Ci+1 value

retained from the Permutation Operation Known Answer Test for the

Encryption Process for the TCBC mode. If encryption is not supported, set

Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE -- The above processing should continue until all 32 KEY-C values are passed as specified in Input Type 11, or all 32

KEY values are passed as specified in Input Type 12. The output from the IUT for this test should consist of 32 output strings.

Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values. The P results should be all zeros.
105

5.2.2.5 Substitution Table Known Answer Test for the Decryption Process -

TCBC Mode

Table 23 The Substitution Table Known Answer Test for the Decryption Process -

TCBC Mode

TMOVS: Initialize KEY1i , KEY2i, KEY3i (where i=1..19)= 19 KEY values in Table A.4

IV = 0000000000000000

If encryption is supported by the IUT:

Send IV, KEY1, KEY2,...,KEY19 (Since all three keys are the same, these

key values represent the values of KEY1, KEY2, and KEY3.)

If encryption not supported:

Initialize Ci (where i=1..19)= 19 C values in Table A.4

Send IV, KEY1, C1, KEY2, C2,...,KEY19, C19 (These key values represent

the values of KEY1, KEY2, and KEY3.)

IUT: If encryption is supported:

Initialize C1 = first C value retained from the Substitution Table Known Answer

Test for the Encryption Process.

Otherwise, use the first value received from the TMOVS

FOR i = 1 to 19

{

Ii = Ci Perform

Triple

DES:

Ii is read into TDEA and is decrypted by DEA3 using KEY3i, resulting

in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is decrypted by DEA1 using KEY1i, resulting in Oi

Pi=Oi ⊕ IV

Send i, KEYi, IV, Ci, Pi (where KEYi represents the value of KEY1, KEY2

and KEY3)

KEY1i+1 = KEY2i+1 = KEY3i+1 = corresponding KEYi+1 supplied by
106

TMOVS

If encryption is supported:

Ci+1 = corresponding C from output of Substitution Table Known Answer

Test for the Encryption Process for the TCBC mode

else

Ci+1 = corresponding Ci+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. See Table A.4.

As summarized in Table 23, the Substitution Table Known Answer Test for the TCBC

Decryption Process is performed as follows:

1. The TMOVS:

a. If the IUT supports encryption, the KEY1, KEY2, and KEY3 variables are

initialized with the 19 constant KEY values from Table A.4. If the IUT does not

support encryption, the KEY-ciphertext (KEY-C) pairs are initialized with the 19

constant KEY-C pairs from Table A.4.

NOTE -- KEY1=KEY2=KEY3.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. If encryption is supported by the IUT, the IV and the 19 KEY values for KEY1,

KEY2, and KEY3 are forwarded to the IUT using Input Type 12. Otherwise, if

encryption is not supported by the IUT, the IV and the 19 KEY-C pairs are

forwarded to the IUT using Input Type 11.

2. The IUT should:

a. If encryption is supported, initialize the C1 value with the first C value retained

from the Substitution Table Known Answer Test for the Encryption Process for

the TCBC Mode (Section 5.2.1.5). Otherwise, use the first C value received from

the TMOVS.

b. Perform the following for i = 1 to 19:

1) Set the input block Ii equal to the value of Ci.
107

2) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ii

through the three DEA stages resulting in the output block Oi. This

involves processing Ii through the DEA stage DEA3 in the decrypt state

using KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the DEA stage DEA2 in the encrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the

DEA stage DEA1 in the decrypt state using KEY1i, resulting in Oi.

3) Calculate the plaintext Pi by exclusive-ORing Oi with IV.

4) Forward the current values of the loop number i, KEY (representing

KEY1, KEY2, and KEY3), IV, Ci, and the resulting Pi to the TMOVS as

specified in Output Type 2.

5) Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the next key supplied by the

TMOVS.

6) If encryption is supported, set Ci+1 equal to the corresponding Ci+1 value

retained from the Substitution Table Known Answer Test for the

Encryption Process for the TCBC mode. If encryption is not supported, set

Ci+1 equal to the corresponding Ci+1 value supplied by the TMOVS.

NOTE -- The above processing should continue until all 19 KEY-C pairs, as specified in Input Type 11, or all 19 KEY values,

as specified in Input Type 12, are processed. The output from the IUT for this test should consist of 19 output strings. Each

output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
108

5.2.2.6 Monte Carlo Test for the Decryption Process - TCBC Mode

Table 24 The Monte Carlo Test for the Decryption Process - TCBC Mode

TMOVS: Initialize KEY10, KEY20, KEY30, IV, C0

Send KEY10, KEY20, KEY30, IV, C0

IUT: FOR i = 0 TO 399

{

If (i==0) CV0 = IV

Record i, KEY1i, KEY2i, KEY3i, CV0, C0

FOR j = 0 TO 9,999

{

Ij = Cj

Perform

Triple DES: Ij is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP1

TEMP1 is encrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is decrypted by DEA1 using KEY1i, resulting in Oj

Pj = Oj ⊕ CVj

CVj+1 = Cj

Cj+1 = Pj

}

Record Pj

Send i, KEY1i, KEY2i, KEY3i, CV0, C0, Pj

KEY1i+1 = KEY1i ⊕ Pj

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, and KEY3i are independent),

 KEY2i+1= KEY2i ⊕ Pj-1
109

ELSE

 KEY2i+1= KEY2i ⊕ Pj

IF (KEY1i =KEY2i =KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i),

 KEY3i+1= KEY3i ⊕ Pj

ELSE

 KEY3i+1= KEY3i ⊕ Pj-2

CV0 = Cj

C0 = Pj

}

TMOVS: Check IUT's output for correctness.

As summarized in Table 24, the Monte Carlo Test for the TCBC Decryption Process is performed

as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, the initialization vector

IV, and the ciphertext C variables. All variables consist of 64 bits.

b. Forwards this information to the IUT using Input Type 21.

2. The IUT should perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), set the chaining value CV0 equal

to IV.

b. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

CV0 and C0.

c. Perform the following for j = 0 through 9999:

1) Set the input block Ij equal to the value of Cj.

2) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ij

through the three DEA stages resulting in the output block Oj. This

involves processing Ij through the DEA stage DEA3 in the decrypt state
110

using KEY3i, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the DEA stage DEA2 in the encrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the

DEA stage DEA1 in the decrypt state using KEY1i, resulting in Oj.

3) Calculate the plaintext Pj by exclusive-ORing Oj with CVj.

4) Prepare for loop j+1 by:

a) Assigning CVj+1 with the current value of Cj.

b) Assigning Cj+1 with the current value of Pj.

d. Record Pj.

e. Forward all recorded information for this loop, as specified in Output Type 6 to

the TMOVS.

f. Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop. Note j = 9999.

The new KEY1i+1 should be calculated by exclusive-ORing the current KEY1i with

the Pj.

The new KEY2i+1 calculation is based on the values of the keys. If KEY1i and

KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and KEY3i are

independent, the new KEY2i+1 should be calculated by exclusive-ORing the current

KEY2i with the Pj-1. If KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be

calculated by exclusive-ORing the current KEY2i with the Pj.

The new KEY3i+1 calculation is also based on the values of the keys. If KEY1i,

KEY2i, and KEY3i are independent, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the Pj-2. If KEY1i and KEY2i are

independent and KEY3i = KEY1i, or if KEY1i=KEY2i=KEY3i, the new KEY3i+1

should be calculated by exclusive-ORing the current KEY3i with the Pj.

g. Assign a new value to CV0 in preparation for the next outer loop. CV0 should be

assigned the value of the current Cj. Note j = 9999.

NOTE -- the new CV should be denoted as CV0 to be used for the first pass through the inner loop when

j=0.

h. Assign a new value to C0 in preparation for the next outer loop. C0 should be

assigned the value of the current Pj. Note j = 9999.

NOTE -- the new C should be denoted as C0 to be used for the first pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 6.
111

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
112

5.3 Cipher Block Chaining Mode - Interleaved (TCBC-I)

The IUTs in the Cipher Block Chaining mode - Interleaved (TCBC-I) are validated by

successfully completing a series of Known Answer tests and Monte Carlo tests corresponding to

the cryptographic processes allowed by the IUT.

The interleaved configuration is intended for systems equipped with multiple DEA processors. By

interleaving the data, throughput is improved and propagation delay is minimized by initializing

the three individual DEA stages and then simultaneously clocking them. Thus, with each clock

cycle, data is processed by each DEAi stage (where i = 1, 2, 3) and passed onward to the output

buffer or the next stage so that idle DEAi stages are minimized.

The processing for each Known Answer test and Monte Carlo Test is broken down into clock

cycles T1, T2, T3.... Within each clock cycle, the processing occurring on each active DEA is

discussed. For convenience, let KEY1 represent the key used on processor DEA1, KEY2

represent the key used on processor DEA2, and KEY3 represent the key used on processor

DEA3.

5.3.1 Encryption Process

The process of validating an IUT which implements the TCBC-I mode of operation in the

encryption process involves the successful completion of the following six tests:

1. The Variable Plaintext Known Answer Test - TCBC-I mode

2. The Inverse Permutation Known Answer Test - TCBC-I mode

3. The Variable Key Known Answer Test for the Encryption Process - TCBC-I mode

4. The Permutation Operation Known Answer Test for the Encryption Process - TCBC-I

mode

5. The Substitution Table Known Answer Test for the Encryption Process - TCBC-I mode

6. The Monte Carlo Test for the Encryption Process - TCBC-I mode

An explanation of the tests follows.
113

5.3.1.1 The Variable Plaintext Known Answer Test - TCBC-I Mode

Table 25 The Variable Plaintext Known Answer Test - TCBC-I Mode

TMOVS: Initialize KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV1=0000000000000000

IV2 = 5555555555555555 (based on specifications in ANSI X9.52

- 1998)

IV3 = AAAAAAAAAAAAAAAA (based on specifications in

ANSI X9.52 - 1998)

P11 = P21 = P31 = 8000000000000000

Send KEY (representing KEY1, KEY2, and KEY3), IV1, IV2, IV3, P11,

P21, P31

IUT: FOR i = 1 to 64

{

T1: I1i= P1i ⊕ IV1

Perform Triple

DES: I1i is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP11

T2: I2i= P2i ⊕ IV2

I2i is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3i= P3i ⊕ IV3

I3i is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2, resulting in

TEMP22

TEMP12 is encrypted by DEA3 using KEY3, resulting in C1i

T4: TEMP31 is decrypted by DEA2 using KEY2, resulting in
114

TEMP32

TEMP22 is encrypted by DEA3 using KEY3, resulting in C2i

T5: TEMP32 is encrypted by DEA3 using KEY3, resulting in C3i

Send i, KEY (representing KEY1, KEY2, and KEY3), IV1, IV2, IV3, I1i,

I2i, and I3i, C1i,C2i,C3i

P1i+1 = P2i+1 = P3i+1 = basis vector where single "1" bit is in position i+1

}

TMOVS: Compare results from each loop with known answers. See Table A.5.

Table 25 illustrates the Variable Plaintext Known Answer Test for the TCBC-I mode of

operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. Initializes the 64-bit plaintext values P11, P21, P31 to the basis vector containing a

"1" in the first bit position and "0" in the following 63 positions, i.e., P11 bin = P21

bin = P31 bin = 10000000 00000000 00000000 00000000 00000000 00000000

00000000 00000000. The equivalent of this value in hexadecimal notation is 80 00

00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 13.

2. The IUT should perform the following for i=1 through 64:

NOTE -- the processing for each clock cycle Ti is displayed.

a. At clock cycle T1:

1) Calculate the input block I1i by exclusive-ORing P1i with IV1.
115

2) Process I1i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP11.

At clock cycle T2:

1) Calculate the input block I2i by exclusive-ORing P2i with IV2.

2) Process I2i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP21.

3) Process TEMP11 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2, resulting in intermediate value TEMP12.

At clock cycle T3:

1) Calculate the input block I3i by exclusive-ORing P3i with IV3.

2) Process I3i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP31.

3) Process TEMP21 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2, resulting in intermediate value TEMP22.

4) Process TEMP12 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3, resulting in the ciphertext value C1i.

At clock cycle T4:

1) Process TEMP22 through the third DEA stage, denoted DEA2, in the

encrypt state using KEY3, resulting in the ciphertext value C2i.

2) Process TEMP31 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2, resulting in intermediate value TEMP32.

At clock cycle T5:

1) Process TEMP32 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3, resulting in the ciphertext value C3i.

b. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV1, IV2, IV3, I1i, I2i, I3i, and the resulting C1i, C2i, and C3i,

to the TMOVS as specified in Output Type 3.

c. Retain C1i, C2i, and C3i, for use with the Inverse Permutation Known Answer

Test for the TCBC-I Mode (Section 5.3.1.2 ), and, if the IUT supports the

decryption process, for use with the Variable Ciphertext Known Answer Test for

the TCBC-I Mode (Section 5.3.2.1).
116

d. Assign a new value to P1i+1, P2i+1, and P3i+1, by setting them equal to the value of

a basis vector with a "1" bit in position i+1, where i+1=2,...,64.

NOTE -- This continues until every possible basis vector has been represented by the P variables, i.e., 64 times. The output

from the IUT should consist of 64 output strings. Each output string should consist of information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received C1

results to the known values found in Table A.5.
117

5.3.1.2 The Inverse Permutation Known Answer Test - TCBC-I Mode

Table 26 The Inverse Permutation Known Answer Test - TCBC-I Mode

TMOVS: Initialize KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV1=0000000000000000

IV2 = 5555555555555555 (based on specifications in ANSI X9.52 -

1998)

IV3 = AAAAAAAAAAAAAAAA (based on specifications in ANSI

X9.52 - 1998)

Pki (where k=1..3 and i=1..64) = 64 corresponding Cki values from

Variable Plaintext Known Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), IV1, IV2, IV3,

P11,...,P164, P21,...,P264, P31,...,P364

IUT: FOR i = 1 to 64

{

T1: I1i= P1i ⊕ IV1

Perform

Triple DES: I1i is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP11

T2: I2i= P2i ⊕ IV2

I2i is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3i= P3i ⊕ IV3

I3i is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2, resulting in

TEMP22

TEMP12 is encrypted by DEA3 using KEY3, resulting in C1i
118

T4: TEMP31 is decrypted by DEA2 using KEY2, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3, resulting in C2i

T5: TEMP32 is encrypted by DEA3 using KEY3, resulting in C3i

Send i, Key (representing KEY1, KEY2, and KEY3), IV1, IV2, IV3, P1i,

P2i, P3i, C1i,C2i,C3i

Pki+1 (where k=1..3) = corresponding Cki+1 from TMOVS

}

TMOVS: Compare C1, C2, and C3 results from each loop with known answers. See Table

A.6.

C1 should be the set of basis vectors.

Table 26 illustrates the Inverse Permutation Known Answer Test for the TCBC-I mode of

operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. Initializes the 64-bit plaintext values P1, P2, P3 to the 64-bit ciphertext values C1,

C2, and C3 respectively, obtained from the Variable Plaintext Known Answer Test.

d. Forwards this information to the IUT using Input Type 15.

2. The IUT should perform the following for i=1 through 64:

NOTE -- the processing for each clock cycle Ti is displayed.

a. At clock cycle T1:
119

1) Calculate the input block I1i by exclusive-ORing P1i with IV1.

2) Process I1i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP11.

At clock cycle T2:

1) Calculate the input block I2i by exclusive-ORing P2i with IV2.

2) Process I2i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP21.

3) Process TEMP11 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2, resulting in intermediate value TEMP12.

At clock cycle T3:

1) Calculate the input block I3i by exclusive-ORing P3i with IV3.

2) Process I3i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP31.

3) Process TEMP21 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2, resulting in intermediate value TEMP22.

4) Process TEMP12 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3, resulting in the ciphertext value C1i.

At clock cycle T4:

1) Process TEMP22 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3, resulting in the ciphertext value C2i.

2) Process TEMP31 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2, resulting in intermediate value TEMP32.

At clock cycle T5:

1) Process TEMP32 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3, resulting in the ciphertext value C3i.

b. Forward the current values of the loop number i, KEY (which represents KEY1,

KEY2, and KEY3), IV1, IV2, IV3, P1i, P2i, and P3i, and the resulting C1i, C2i,

and C3i, to the TMOVS as specified in Output Type 3.

c. Assign a new value to the plaintext values, P1i+1, P2i+1, and P3i+1, by setting them

equal to the corresponding output from the TMOVS.
120

NOTE -- This processing continues until all ciphertext values from the Variable Plaintext Known Answer Test have been used

as input. The output from the IUT should consist of 64 output strings. Each output string should consist of information included

in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received C1, C2,

and C3 results to known values. The C1 values should be the set of basis vectors. See

Table A.6.
121

5.3.1.3 The Variable Key Known Answer Test for the Encryption Process -

TCBC-I Mode

Table 27 The Variable Key Known Answer Test for the Encryption Process - TCBC-I

Mode

TMOVS: Initialize KEY11 = KEY21 = KEY31 = 8001010101010101 (odd parity

set)

IV1=0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

P1 = P2 = P3 = 0000000000000000

Send KEY1 (representing KEY11, KEY21, and KEY31), IV1, IV2,

IV3, P1, P2, P3

IUT: FOR i = 1 to 64

{

IF (i mod 8 ≠ 0) {process every bit except parity bits}

{

T1: I1i= P1 ⊕ IV1 Perform

Triple

DES: I1i is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP11

T2: I2i= P2 ⊕ IV2

I2i is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3i= P3 ⊕ IV3

I3i is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2i , resulting in
122

TEMP22

TEMP12 is encrypted by DEA3 using KEY3i, resulting in

C1i

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in

C2i

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in

C3i

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1, IV2,

IV3, P1, P2, P3, C1i, C2i, C3i

KEY1i+1 = KEY2i+1 = KEY3i+1 = vector consisting of “0" in every

significant bit position except for a single "1" bit in position i+1.

NOTE -- the parity bits are “0" or “1" to set odd parity.

}

}

TMOVS: Compare results of the 3 triple DES encryptions per 56 different keys with known

answers. See Table A.11.

Table 27 illustrates the Variable Key Known Answer Test for the Encryption Process for the

TCBC-I mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin =

KEY21 bin = KEY31 bin = 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or"1" to get odd parity.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55
123

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. Initializes the P parameters P1, P2, and P3 to the constant hexadecimal value 0,

i.e., P1hex=P2hex=P3hex=00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 13.

2. The IUT should perform the following for i=1 through 56:

NOTE -- 56 is the number of significant bits in a TDES key.

NOTE -- the processing for each clock cycle Ti is displayed.

a. At clock cycle T1:

1) Calculate the input block I1i by exclusive-ORing P1 with IV1.

2) Process I1i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP11.

At clock cycle T2:

1) Calculate the input block I2i by exclusive-ORing P2 with IV2.

2) Process I2i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP21.

3) Process TEMP11 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP12.

At clock cycle T3:

1) Calculate the input block I3i by exclusive-ORing P3 with IV3.

2) Process I3i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP31.

3) Process TEMP21 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP22.

4) Process TEMP12 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C1i.

At clock cycle T4:

1) Process TEMP22 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C2i.
124

2) Process TEMP31 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP32.

At clock cycle T5:

1) Process TEMP32 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C3i.

b. Forward the current values of the loop number i, KEYi (which represents KEY1i,

KEY2i, and KEY3i), IV1, IV2, IV3, P1, P2, and P3, and the resulting C1i, C2i,

and C3i, to the TMOVS as specified in Output Type 3.

c. If the IUT supports the decryption process, retain C1, C2, and C3 for use with the

Variable KEY Known Answer Test for the Decryption Process for the TCBC-I

Mode (Section 5.3.2.3).

d. Assign a new value to KEY1i+1, KEY2i+1, and KEY3i+1, by setting them equal to

the vector consisting of "0" in every significant bit position except for a single "1"

bit in position i+1. The parity bits may contain "1" or "0" to make odd parity.

NOTE -- The above processing continues until every significant basis vector has been represented by the KEY parameters, i.e.,

56 times. The output from the IUT should consist of 56 output strings. Each output string should consist of information

included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values found in Table A.11.
125

5.3.1.4 Permutation Operation Known Answer Test for the Encryption

Process - TCBC-I Mode

Table 28 The Permutation Operation Known Answer Test for the Encryption Process -

TCBC-I Mode

TMOVS: Initialize KEY1i =KEY2i = KEY3i (where i=1..32) = 32 KEY values from

Table A.12

IV1=0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

P1 = P2 = P3 = 0000000000000000

Send P (where P represents the values of P1, P2, and P3),

IV1, IV2, and IV3,

KEY1, KEY2,..., KEY32 (where KEY represents the values of KEY1,

KEY2, and KEY3)

IUT: FOR i = 1 to 32

{

T1: I1i= P1 ⊕ IV1

Process

Triple DES: I1i is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP11

T2: I2i= P2 ⊕ IV2

I2i is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3i= P3 ⊕ IV3

I3i is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2i , resulting in
126

TEMP22

TEMP12 is encrypted by DEA3 using KEY3i, resulting in C1i

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in C2i

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in C3i

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3, P1,

P2, P3, C1i,C2I,C3i

KEY1i+1 = KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

}

TMOVS: Compare results with known answers. See Table A.12.

Table 28 illustrates the Permutation Operation Known Answer Test for the Encryption Process

for the TCBC-I mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, KEY31 to the 32 constant KEY

values from Table A.12.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. Initializes the P parameters P1, P2, and P3 to the constant hexadecimal value 0,

i.e., P1hex=P2hex=P3hex=00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 18.

2. The IUT should perform the following for i=1 through 32:

NOTE -- that the processing for each clock cycle Ti is displayed.

a. At clock cycle T1:
127

1) Calculate the input block I1i by exclusive-ORing P1 with IV1.

2) Process I1i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP11.

 At clock cycle T2:

1) Calculate the input block I2i by exclusive-ORing P2 with IV2.

2) Process I2i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP21.

3) Process TEMP11 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP12.

 At clock cycle T3:

1) Calculate the input block I3i by exclusive-ORing P3 with IV3.

2) Process I3i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP31.

3) Process TEMP21 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP22.

4) Process TEMP12 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C1i.

5) Set ciphertext1 C1i equal to the value of O1i.

 At clock cycle T4:

1) Process TEMP22 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C2i.

2) Process TEMP31 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP32.

 At clock cycle T5:

1) Process TEMP32 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C3i.

b. Forward the current values of the loop number i, KEY (which represents KEY1,

KEY2, and KEY3), IV1, IV2, IV3, P1i, P2i, and P3i, and the resulting C1i, C2i,

and C3i, to the TMOVS as specified in Output Type 3.
128

c. If the IUT supports the decryption process, retain C1i, C2i, and C3i for use with

the Permutation Operation Known Answer Test for the Decryption Process for the

TCBC-I Mode (Section 5.3.2.4).

d. Assign a new value to KEY1i+1, KEY2i+1, and KEY3i+1, by setting them equal to

the next key supplied by the TMOVS.

NOTE -- The above processing continues until all 32 KEY values are processed. The output from the IUT should consist of 32

output strings. Each output string should consist of information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.12.
129

5.3.1.5 Substitution Table Known Answer Test for the Encryption Process -

TCBC-I Mode

Table 29 The Substitution Table Known Answer Test for the Encryption Process -

TCBC-I Mode

TMOVS: Initialize KEY1i =KEY2i = KEY3i (where i=1..19) = 19 KEY values from

Table A.8

P1i =P2i = P3i (where i=1..19) = 19 corresponding P values from

Table A.8

IV1 = 0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

Send IV1, IV2, and IV3,

P1, P2,..., P19(where P represents the values of P1, P2, and P3),

KEY1, KEY2,..., KEY19 (where KEY represents the values of KEY1,

KEY2, and KEY3)

IUT: FOR i = 1 to 19

{

T1: I1i= P1i ⊕ IV1 Perform

Triple

DES: I1i is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP11

T2: I2i= P2i ⊕ IV2

I2i is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3i= P3i ⊕ IV3

I3i is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP31
130

TEMP21 is decrypted by DEA2 using KEY2i , resulting in

TEMP22

TEMP12 is encrypted by DEA3 using KEY3i, resulting in C1i

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in C2i

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in C3i

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3,

P1i, P2i, P3i, C1i,C2i,C3i

KEY1i+1 = KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

P1i+1 = P2i+1 = P3i+1 = corresponding Pi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. See Table A.8.

Table 29 illustrates the Substitution Table Known Answer Test for the Encryption Process of the

TCBC-I mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, KEY3 to the 19 constant KEY

values from Table A.8.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. Initializes the P parameters P1, P2, and P3 to the 19 constant P values from Table

A.8.

d. Forwards this information to the IUT using Input Type 19.

2. The IUT should perform the following for i=1 through 19:

NOTE -- the processing for each clock cycle Ti is displayed.
131

a. At clock cycle T1:

1) Calculate the input block I1i by exclusive-ORing P1i with IV1.

2) Process I1i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP11.

At clock cycle T2:

1) Calculate the input block I2i by exclusive-ORing P2i with IV2.

2) Process I2i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP21.

3) Process TEMP11 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP12.

At clock cycle T3:

1) Calculate the input block I3i by exclusive-ORing P3i with IV3.

2) Process I3i through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP31.

3) Process TEMP21 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP22.

4) Process TEMP12 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C1i..

At clock cycle T4:

1) Process TEMP22 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C2i.

2) Process TEMP31 through the second DEA stage, denoted DEA2, in the

decrypt state using KEY2i, resulting in intermediate value TEMP32.

At clock cycle T5:

1) Process TEMP32 through the third DEA stage, denoted DEA3, in the

encrypt state using KEY3i, resulting in the ciphertext value C3i.

b. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV1, IV2, IV3, P1i, P2i, P3i, and the resulting C1i, C2i, and

C3i, to the TMOVS as specified in Output Type 3.
132

c. If the IUT supports the decryption process, retain C1, C2, and C3 for use with the

Substitution Table Known Answer Test for the Decryption Process for the TCBCI Mode (Section 5.3.2.5).

d. Assign a new value to KEY1i+1, KEY2i+1, and KEY3i+1 by setting them equal to

the next key supplied by the TMOVS.

e. Assign a new value to P1i+1, P2i+1, and P3i+1 by setting them equal to the

corresponding P supplied by the TMOVS.

NOTE -- The above processing continues until all 19 KEY-P values are processed. The output from the IUT should consist of

19 output strings. Each output string should consist of information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.8.
133

5.3.1.6 Monte Carlo Test for the Encryption Process - TCBC-I Mode

Table 30 The Monte Carlo Test for the Encryption Process - TCBC-I Mode

TMOVS: Initialize KEY10, KEY20, KEY30, IV1, IV2, IV3, P10,P20, P30

Send KEY10, KEY20, KEY30, IV1, IV2, IV3, P10,P20, P30

IUT: FOR i = 0 TO 399

{

If (i==0)

FOR k = 1 TO 3

CVk0 = IVk

Record i, KEY1i, KEY2i, KEY3i, CV10, CV20, CV30, P10, P20, P30

FOR j = 0 TO 9,999

{

T1: I1j= P1j ⊕ CV1j Perform

Triple

DES: I1j is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP11

T2: I2j= P2j ⊕ CV2j

I2j is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3j= P3j ⊕ CV3j

I3j is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2i , resulting in

TEMP22

TEMP12 is encrypted by DEA3 using KEY3i, resulting in

C1j
134

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in

C2j

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in

C3j

IF (j==0)

FOR k = 1 TO 3

Pkj+1 = CVk0

ELSE

FOR k = 1 TO 3

Pkj+1 = Ckj-1

FOR k = 1 TO 3

CVkj+1 = Ckj

}

Record C1j,C2j,C3j

Send i, KEY1i, KEY2i, KEY3i, CV10, CV20, CV30, P10, P20, P30, C1j, C2j,

C3j

KEY1i+1 = KEY1i ⊕ C1j

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, and KEY3i are independent)

 KEY2i+1= KEY2i ⊕ C2j-1

ELSE

 KEY2i+1= KEY2i ⊕ C1j

IF (KEY1i= KEY2i= KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i)

 KEY3i+1= KEY3i ⊕ C1j
135

ELSE

 KEY3i+1= KEY3i ⊕ C3j-2

FOR k = 1 TO 3

{

Pk0 = Ckj-1

CVk0 = Ckj

}

}

TMOVS: Check IUT's output for correctness.

As summarized in Table 30, the Monte Carlo Test for the TCBC-I Encryption Process is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, the initialization vectors

IV1, IV2, and IV3, and the plaintext variables P1, P2, and P3. The P, IV, and

KEY parameters consist of 64 bits each. IV2 is assigned the value of IV1+R1 mod

2

64 where R1 = 5555555555555555. IV3 is assigned the value of IV1+R2 mod 264

where R2 = AAAAAAAAAAAAAAAA.

b. Forwards this information to the IUT using Input Type 22.

2. The IUT should perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), set the chaining value CV10 equal

to the IV1, CV20 equal to the IV2, and CV30 equal to the IV3.

b. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

CV10, CV20, CV30, and P10, P20, P30.

c. Perform the following for j = 0 through 9999:

NOTE -- the processing for each clock cycle Ti is displayed.

1) At clock cycle T1:

a) Calculate the input block I1j by exclusive-ORing P1j with CV1j.
136

b) Process I1j through the first DEA stage, denoted DEA1, in the

encrypt state using KEY1i, resulting in intermediate value TEMP11.

At clock cycle T2:

a) Calculate the input block I2j by exclusive-ORing P2j with CV2j.

b) Process I2j through the first DEA stage, denoted DEA1, in the

encrypt state using KEY1i, resulting in intermediate value TEMP21.

c) Process TEMP11 through the second DEA stage, denoted DEA2, in

the decrypt state using KEY2i, resulting in intermediate value

TEMP12.

At clock cycle T3:

a) Calculate the input block I3j by exclusive-ORing P3j with CV3j.

b) Process I3j through the first DEA stage, denoted DEA1, in the

encrypt state using KEY1i, resulting in intermediate value TEMP31.

c) Process TEMP21 through the second DEA stage, denoted DEA2, in

the decrypt state using KEY2i, resulting in intermediate value

TEMP22.

d) Process TEMP12 through the third DEA stage, denoted DEA3, in

the encrypt state using KEY3i, resulting in the ciphertext value C1j.

At clock cycle T4:

a) Process TEMP31 through the second DEA stage, denoted DEA2, in

the decrypt state using KEY2i, resulting in intermediate value

TEMP32.

b) Process TEMP22 through the third DEA stage, denoted DEA3, in

the encrypt state using KEY3i, resulting in the ciphertext value C2j.

At clock cycle T5:

a) Process TEMP32 through the third DEA stage, denoted DEA3, in

the encrypt state using KEY3i, resulting in the ciphertext value C3j.

2) Prepare for loop j+1 by doing the following:

a) If the inner loop being processed is the first loop, i.e., j=0, assign

P1j+1, P2j+1, and P3j+1, with the current value of CV10, CV20, and

CV30, respectively. Otherwise, assign P1j+1 with C1j-1, P2j+1 with

C2j-1, and P3j+1 with C3j-1.
137

b) Assign CV1j+1, CV2j+1, CV3j+1, with the current value of C1j, C2j,

C3j, respectively.

d. Record the C1j, C2j, C3j.

e. Forward all recorded information from this loop, as specified in Output Type 4, to

the TMOVS.

f. Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop. Note j = 9999.

The new KEY1i+1 should be calculated by exclusive-ORing the current

KEY1i with the C1j.

The new KEY2i+1 calculation is based on the values of the keys. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and

KEY3i are independent, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the C2j-1. If

KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the C1j.

The new KEY3i+1 calculation is also based on the values of the keys. If

KEY1i, KEY2i, and KEY3i are independent, the new KEY3i+1 should be

calculated by exclusive-ORing the current KEY3i with the C3j-2. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or if

KEY1i=KEY2i=KEY3i, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the C1j.

g. Assign new values to CV10, CV20, and CV30, in preparation for the next outer

loop. CV10, CV20, and CV30 should be assigned the value of the current C1j, C2j,

and C3j.

NOTE -- the new CV should be denoted as CV0 because this value is used for the first pass through the

inner loop when j=0.

h. Assign a new value to P10, P20, and P30 in preparation for the next output loop.

P10 should be assigned the value of the C1j-1. P20 should be assigned the value of

the C2j-1, and P30 should be assigned the value of the C3j-1.

NOTE -- the new P variables, P1, P2, and P3 should be denoted as P10, P20, and P30, respectively, to be

used for the first pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 4.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values.
138

5.3.2 Decryption Process

The process of validating an IUT for the TCBC-I mode which implements the decryption process

involves the successful completion of the following six tests:

1. The Variable Ciphertext Known Answer Test - TCBC-I mode

2. The Initial Permutation Known Answer Test - TCBC-I mode

3. The Variable Key Known Answer Test for the Decryption Process - TCBC-I mode

4. The Permutation Operation Known Answer Test for the Decryption Process - TCBC-I

mode

5. The Substitution Table Known Answer Test for the Decryption Process - TCBC-I mode

6. The Monte Carlo Test for the Decryption Process - TCBC-I mode

An explanation of the tests follows.
139

5.3.2.1 The Variable Ciphertext Known Answer Test - TCBC-I Mode

Table 31 The Variable Ciphertext Known Answer Test - TCBC-I Mode

TMOVS: Initialize KEY1 =KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV1=0000000000000000

IV2 = 5555555555555555 (based on specifications in ANSI

X9.52 – 1998)

IV3 = AAAAAAAAAAAAAAAA (based on specifications in

ANSI X9.52 – 1998)

Send KEY (representing KEY1, KEY2, and KEY3), IV1,IV2,IV3

If encryption is not supported by the IUT:

Initialize Cki (where k=1..3 and i=1..64) = Ck values in Table A.5

Send C11, C12,...,C164, C21, C22,...,C264 C31, C32,...,C364

IUT: If encryption is supported:

Initialize C11, C21, C31 = corresponding values from output of Variable

Plaintext Known Answer Test.

Otherwise, use the corresponding values received from the TMOVS.

FOR i = 1 to 64

{

T1: I1i = C1i Process

Triple

DES:

I1i is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP11

T2: I2i = C2i

I2i is read into TDEA and is decrypted by DEA3 using

KEY3, resulting in TEMP21

TEMP11 is encrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3i = C3i
140

I3i is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP31

TEMP21 is encrypted by DEA2 using KEY2, resulting in

TEMP22

TEMP12 is decrypted by DEA1 using KEY1, resulting in O1i

P1i = O1i ⊕ IV1

T4: TEMP31 is encrypted by DEA2 using KEY2, resulting in

TEMP32

TEMP22 is decrypted by DEA1 using KEY1, resulting in O2i

P2i= O2i ⊕ IV2

T5: TEMP32 is decrypted by DEA1 using KEY1, resulting in O3i

P3i= O3i ⊕ IV3

Send i, KEY (representing KEY1, KEY2, and KEY3), IV1, IV2, IV3,

C1i, C2i, C3i, P1i, P2i, P3i

If encryption is supported:

Cki+1 (where k=1..3) = corresponding Cki+1 from output of Variable

Plaintext Known Answer Test

}

TMOVS: Compare results from each loop with known answers. Should be the set of basis

vectors.

Table 31 illustrates the Variable Ciphertext Known Answer Test for the TCBC-I mode of

operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:
141

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. If the IUT does not support encryption, the 64 constant ciphertext values C1, C2,

and C3 are initialized with the corresponding 64 constant C1, C2, and C3 values

from Table A.5.

d. If encryption is supported by the IUT, the KEYs and the IVs are forwarded to the

IUT, as specified in Input Type 14. If encryption is not supported by the IUT, the

KEYs, the IVs, and the 64 C1i, C2i, and C3i values are forwarded to the IUT using

Input Type 15.

2. The IUT should:

a. If encryption is supported, initialize the C values C11, C21, and C31, with the

corresponding C11, C21, and C31 values retained from the Variable Plaintext

Known Answer Test for the TCBC-I Mode (Section 5.3.1.1). Otherwise, use the

first values received from the TMOVS.

b. Perform the following for i = 1 through 64:

NOTE -- the processing for each clock cycle Ti is displayed.

At clock cycle T1:

1) Set the input block I1i equal to the value of C1i.

2) Process I1i through the DEA stage DEA3, in the decrypt state using KEY3,

resulting in intermediate value TEMP11.

At clock cycle T2:

1) Set the input block I2i equal to the value of C2i.

2) Process I2i through the DEA stage DEA3 in the decrypt state using KEY3,

resulting in intermediate value TEMP21.

3) Process TEMP11 through the second DEA stage, denoted DEA2, in the

encrypt state using KEY2, resulting in intermediate value TEMP12.

At clock cycle T3:

1) Set the input block I3i equal to the value of C3i.

2) Process I3i through the DEA stage DEA3 in the decrypt state using KEY3,

resulting in intermediate value TEMP31.
142

3) Process TEMP21 through the second DEA stage, denoted DEA2, in the

encrypt state using KEY2, resulting in intermediate value TEMP22.

4) Process TEMP12 through the DEA stage DEA1 in the decrypt state using

KEY1, resulting in the output block O1i.

5) Calculate the plaintext P1i by exclusive-ORing O1i with IV1.

At clock cycle T4:

1) Process TEMP22 through the DEA stage DEA1 in the decrypt state using

KEY1, resulting in the output block O2i.

2) Calculate the plaintext P2i by exclusive-ORing O2i with IV2.

3) Process TEMP31 through the second DEA stage, denoted DEA2, in the

encrypt state using KEY2, resulting in intermediate value TEMP32.

At clock cycle T5:

1) Process TEMP32 through the DEA stage DEA1 in the decrypt state using

KEY1, resulting in the output block O3i.

2) Calculate the plaintext P3i by exclusive-ORing O3i with IV3.

c. Forward the current values of the loop number i, KEY (which represents KEY1,

KEY2, and KEY3), IV1, IV2, IV3, C1i, C2i, and C3i, and the resulting P11, P21

and P31 as specified in Output Type 3.

d. Retain P1i, P2i, and P3i, for use with the Initial Permutation Known Answer Test

for the TCBC-I Mode (Section 5.3.2.2 ).

e. If encryption is supported, set C1i+1, C2i+1, and C3i+1 equal to the corresponding

output from the Variable Plaintext Known Answer Test for the TCBC-I mode. If

encryption is not supported, assign new values to C1i+1, C2i+1, and C3i+1, by setting

them equal to the corresponding C values supplied by the TMOVS.

NOTE -- The output from the IUT should consist of 64 output strings. Each output string should consist of information included

in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values. The values of the P1, P2, and P3 variables should be the set of basis

vectors.
143

5.3.2.2 The Initial Permutation Known Answer - TCBC-I Mode

Table 32 The Initial Permutation Known Answer Test - TCBC-I Mode

TMOVS: Initialize KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV1=0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

Cki (where k=1..3 and i=1..64) = 64 corresponding Pki values from

Variable Ciphertext Known Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), IV1, IV2, IV3,

C11,...,C164, C21,...,C264, C31,...,C364

IUT: FOR i = 1 to 64

{

I1i = C1i

Perform

Triple

DES:

T1:

I1i is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP11

T2: I2i = C2i

I2i is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP21

TEMP11 is encrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3i = C3i

I3i is read into TDEA and is decrypted by DEA3 using KEY3,

resulting in TEMP31

TEMP21 is encrypted by DEA2 using KEY2, resulting in

TEMP22

TEMP12 is decrypted by DEA1 using KEY1, resulting in O1i

P1i = O1i ⊕ IV1
144

T4: TEMP31 is encrypted by DEA2 using KEY2, resulting in

TEMP32

TEMP22 is decrypted by DEA1 using KEY1, resulting in O2i

P2i= O2i ⊕ IV2

T5: TEMP32 is decrypted by DEA1 using KEY1, resulting in O3i

P3i= O3i ⊕ IV3

Send i, KEY (representing KEY1, KEY2, and KEY3), IV1, IV2, IV3, C1i,

C2i, C3i, P1i,P2i,P3i

Ck i+1 (where k=1..3) = corresponding Pki+1 from TMOVS

}

TMOVS: Compare C1, C2, and C3 results from each loop with known answers.

See Table A.7.

Table 32 illustrates the Initial Permutation Known Answer Test for the TCBC-I mode of

operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. Initializes the 64-bit ciphertext values C1i, C2i, and C3i to the corresponding

plaintext values P1i, P2i, and P3i, respectively, obtained from the Variable

Ciphertext Known Answer Test.

d. Forwards this information to the IUT using Input Type 15.

2. The IUT should perform the following for i=1 through 64:
145

NOTE -- the processing for each clock cycle Ti is displayed.

a. At clock cycle T1:

1) Set the input block I1i equal to the value of C1i.

2) Process I1i through the DEA stage DEA3 in the decrypt state using KEY3,

resulting in intermediate value TEMP11.

At clock cycle T2:

1) Set the input block I2i equal to the value of C2i.

2) Process I2i through the DEA stage DEA3 in the decrypt state using KEY3,

resulting in intermediate value TEMP21.

3) Process TEMP11 through the second DEA stage, denoted DEA2, in the

encrypt state using KEY2, resulting in intermediate value TEMP12.

At clock cycle T3:

1) Set the input block I3i equal to the value of C3i.

2) Process I3i through the DEA stage DEA3 in the decrypt state using KEY3,

resulting in intermediate value TEMP31.

3) Process TEMP21 through the second DEA stage, denoted DEA2, in the

encrypt state using KEY2, resulting in intermediate value TEMP22.

4) Process TEMP12 through the DEA stage DEA1, in the decrypt state using

KEY1, resulting in the output block O1i.

5) Calculate the plaintext P1i by exclusive-ORing O1i with IV1.

At clock cycle T4:

1) Process TEMP22 through the DEA stage DEA1 in the decrypt state using

KEY1, resulting in the output block O2i.

2) Calculate the plaintext P2i by exclusive-ORing O2i with IV2.

3) Process TEMP31 through the second DEA stage, denoted DEA2, in the

encrypt state using KEY2, resulting in intermediate value TEMP32.

At clock cycle T5:

1) Process TEMP32 through the DEA stage DEA1 in the decrypt state using

KEY1, resulting in the output block O3i.
146

2) Calculate the plaintext P3i by exclusive-ORing O3i with IV3.

b. Forward the current values of the loop number i, KEY (which represents KEY1,

KEY2, and KEY3), IV1, IV2, IV3, C1i, C2i, and C3i, and the resulting P1i, P2i

and P3i as specified in Output Type 3.

c. Set C1i+1, C2i+1, and C3i+1 equal to the corresponding output supplied by the

TMOVS.

NOTE -- The output from the IUT should consist of 64 output strings. Each output string should consist of information included

in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received C1, C2,

and C3 results to the known values. See Table A.7.
147

5.3.2.3 The Variable Key Known Answer Test for the Decryption Process -

TCBC-I Mode

Table 33 The Variable Key Known Answer Test for the Decryption Process - TCBC-I

Mode

TMOVS: Initialize KEY11= KEY21 = KEY31 = 8001010101010101 (odd parity set)

IV1=0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

If encryption supported by IUT:

Send KEY1 (representing KEY11, KEY21, and KEY31), IV1, IV2, IV3

If encryption is not supported by the IUT:

Initialize Cki (where k=1..3 and i=1..56) = Ck values in Table A.11

Send KEY1 (representing KEY11, KEY21, and KEY31), IV1,IV2,IV3,

C11,...,C156, C21,...,C256, C31,...,C356

IUT: If encryption is supported by the IUT:

Initialize Ck1 (where k=1..3) = corresponding values from output of Variable

Key Known Answer Test for the Encryption Process.

Otherwise, use the corresponding value received from the TMOVS.

FOR i = 1 to 64

{

If (i mod 8 ≠ 0) {process every bit except parity bits}

{

T1: I1i = C1i Perform

Triple

DES:

I1i is read into TDEA and is decrypted by DEA3 using

KEY3i, resulting in TEMP11

T2: I2i = C2i

I2i is read into TDEA and is decrypted by DEA3 using
148

KEY3i, resulting in TEMP21

TEMP11 is encrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3i = C3i

I3i is read into TDEA and is decrypted by DEA3 using

KEY3i, resulting in TEMP31

TEMP21 is encrypted by DEA2 using KEY2i, resulting in

TEMP22

TEMP12 is decrypted by DEA1 using KEY1i, resulting in

O1i

P1i = O1i ⊕ IV1

T4: TEMP31 is encrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is decrypted by DEA1 using KEY1i, resulting in

O2i

P2i= O2i ⊕ IV2

T5: TEMP32 is decrypted by DEA1 using KEY1i, resulting in

O3i

P3i= O3i ⊕ IV3

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3,

C1i, C2i, C3i, P1i, P2i, P3i

KEY1i+1 = KEY2i+1 = KEY3i+1 = vector consisting of “0" in every

significant bit position except for a single “1" bit in the i+1th position.

NOTE -- odd parity is set.

If encryption is supported:

Assign C1i+1, C2i+1, and C3i+1 to corresponding C1i+1, C2i+1, and

C3i+1 values from Variable Key Known Answer Test for the

Encryption Process

else

Ck i+1 (where k=1..3) = corresponding Cki+1 value from
149

TMOVS

}

}

TMOVS: Compare results from the 56 decryptions with known answers. Should be P1 = P2 =

P3 = 0 for all 56 rounds.

Table 33 illustrates the Variable Key Known Answer Test for the Decryption Process - TCBC-I

mode of operation.

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. If the IUT does not support encryption, C1i, C2i, and C3i values are initialized

with the constant C1i, C2i, and C3i values from Table A.11 where i=1..56.

d. If encryption is not supported by the IUT, KEY (representing KEY1, KEY2, and

KEY3), IV1, IV2, and IV3, and the 56 C1, C2, and C3 values are forwarded to

the IUT, as specified in Input Type 15. Otherwise, the KEY (representing KEY1,

KEY2, and KEY3), IV1, IV2, and IV3 are forwarded to the IUT, as specified in

Input Type 14.

2. The IUT should:

a. If encryption is supported, initialize the C11, C21, and C31 values with the first

corresponding C1, C2, and C3 values retained from the Variable KEY Known

Answer Test for the Encryption Process for the TCBC-I Mode (Section 5.3.1.3).

Otherwise, use the first values received from the TMOVS.

b. Perform the following for i = 1 to 56:
150

NOTE -- 56 is the number of significant bits in a TDES key.

NOTE -- the processing for each clock cycle Ti is displayed.

1) At clock cycle T1:

a) Set the input block I1i equal to the value of C1i.

b) Process I1i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP11.

 At clock cycle T2:

a) Set the input block I2i equal to the value of C2i.

b) Process I2i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP21.

c) Process TEMP11 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP12.

 At clock cycle T3:

a) Set the input block I3i equal to the value of C3i.

b) Process I3i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP31.

c) Process TEMP21 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP22.

d) Process TEMP12 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O1i.

e) Calculate the plaintext P1i by exclusive-ORing O1i with IV1.

 At clock cycle T4:

a) Process TEMP22 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O2i.

b) Calculate the plaintext P2i by exclusive-ORing O2i with IV2.

c) Process TEMP31 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP32.

At clock cycle T5:
151

a) Process TEMP32 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O3i.

b) Calculate the plaintext P3i by exclusive-ORing O3i with IV3.

2) Forward the current values of the loop number i, KEYi (representing

KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3, C1i, C2i, C3i, and the

resulting P1i, P2i, and P3i to the TMOVS as specified in Output Type 3.

3) Set KEY1i+1,, KEY2i+1,, and KEY3i+1,, equal to the vector consisting of "0"

in every significant bit position except for a single "1" bit in position i+1.

The parity bits may contain "1" or "0" to make odd parity.

NOTE --KEY1i+1 = KEY2i+1 = KEY3i+1.

4) If encryption is supported, set the C values C1i+1, C2i+1, and C3i+1, equal to

the corresponding C1i+1, C2i+1, and C3i+1 values retained from the Variable

KEY Known Answer Test for the Encryption Process for TCBC-I mode. If

encryption is not supported by the IUT, set C1i+1, C2i+1, and C3i+1 equal to

the corresponding C1i+1, C2i+1, and C3i+1, values supplied by the TMOVS.

NOTE -- The output from the IUT for this test should consist of 56 output strings. Each output string should consist of

information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values. The P1, P2, and P3 results should be all zeros.
152

5.3.2.4 Permutation Operation Known Answer Test for the Decryption

Process - TCBC-I Mode

Table 34 The Permutation Operation Known Answer Test for the Decryption Process -

TCBC-I Mode

TMOVS: Initialize KEY1i =KEY2i = KEY3i (where i=1..32) = 32 KEY values from

Table A.12

IV1 = 0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

If encryption is supported by the IUT:

Send IV1, IV2, and IV3

KEY1, KEY2,..., KEY32 (where KEY represents the values of

KEY1, KEY2, and KEY3)

If encryption is not supported by the IUT:

Initialize Cki (where k=1..3 and i=1..32) = corresponding Cki values from

Table A.12

Send IV1, IV2, and IV3,

KEY1, KEY2,..., KEY32 (where KEY represents the values of

KEY1, KEY2, and KEY3)

C11,...,C132, C21,...,C232, C31,...,C332

IUT: If encryption is supported by the IUT:

Initialize C11, C21, C31 values with corresponding values retained from

Permutation Operation Known Answer Test for Encryption

Process.

Otherwise, use the first values received from the TMOVS.

FOR i = 1 to 32

{

Perform

Triple DES:

T1: I1i = C1i
153

I1i is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP11

T2: I2i = C2i

I2i is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP21

TEMP11 is encrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3i = C3i

I3i is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP31

TEMP21 is encrypted by DEA2 using KEY2i , resulting in

TEMP22

TEMP12 is decrypted by DEA1 using KEY1i, resulting in O1i

P1i= O1i ⊕ IV1

T4: TEMP31 is encrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is decrypted by DEA1 using KEY1i, resulting in O2i

P2i= O2i ⊕ IV2

T5: TEMP32 is decrypted by DEA1 using KEY1i, resulting in O3i

P3i= O3i ⊕ IV3

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3,

C1i, C2i, C3i, P1i, P2i, P3i

KEY1i+1 = KEY2i+1 = KEY3i+1 = corresponding KEYi+1 supplied from

TMOVS

If encryption is supported:

Cki+1 (where k=1..3) = corresponding Cki+1 from Permutation

Operation Known Answer Test for the Encryption Process

else
154

Cki+1 (where k=1..3) = corresponding Cki+1 from TMOVS

}

TMOVS: Compare results with known answers. Results should be P1=P2=P3=0.

Table 34 illustrates the Permutation Operation Known Answer Test for the TCBC-I Decryption

Process.

1. The TMOVS:

a. If the IUT supports encryption, the KEY1i, KEY2i, and KEY3i variables are

initialized with the 32 constant KEYi values from Table A.12. If the IUT does not

support encryption, the KEY variables, KEY1i, KEY2i, and KEY3i, and the C

variables, C1, C2, and C3 are initialized with the 32 constant KEY and C1, C2, and

C3 values from Table A.12.

NOTE -- KEY1=KEY2=KEY3.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. If encryption is supported by the IUT, the 32 KEY values for KEY1, KEY2, and

KEY3, and the IV1, IV2, and IV3 values are forwarded to the IUT using Input

Type 16. If encryption is not supported by the IUT, the 32 KEY, C1, C2, and C3

groups and the IV1, IV2, and IV3 values are forwarded to the IUT using Input

Type 17.

2. The IUT should:

a. If encryption is supported by the IUT, initialize the C11, C21, and C31 values with

the first C11, C21, and C31 values retained from the Permutation Operation Known

Answer Test for the Encryption Process for the TCBC-I Mode (Section 5.3.1.4).

Otherwise, use the first values received from the TMOVS.

b. Perform the following for i = 1 to 32:

NOTE -- the processing for each clock cycle Ti is displayed.

1) At clock cycle T1:

a) Set the input block I1i equal to the value of C1i.
155

b) Process I1i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP11.

At clock cycle T2:

a) Set the input block I2i equal to the value of C2i.

b) Process I2i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP21.

c) Process TEMP11 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP12.

At clock cycle T3:

a) Set the input block I3i equal to the value of C3i.

b) Process I3i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP31.

c) Process TEMP21 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP22.

d) Process TEMP12 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O1i.

e) Calculate the plaintext P1i by exclusive-ORing O1i with IV1.

At clock cycle T4:

a) Process TEMP22 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O2i.

b) Calculate the plaintext P2i by exclusive-ORing O2i with IV2.

c) Process TEMP31 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP32.

At clock cycle T5:

a) Process TEMP32 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O3i.

b) Calculate the plaintext P3i by exclusive-ORing O3i with IV3.

2) Forward the current values of the loop number i, KEYI (representing

KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3, C1i, C2i, C3i, and the

resulting P1i, P2i, and P3i to the TMOVS as specified in Output Type 3.
156

3) Assign new values to KEY1i+1,, KEY2i+1,, and KEY3i+1, by setting them

equal to the corresponding KEY values supplied by the TMOVS.

NOTE -- KEY1=KEY2=KEY3.

4) If encryption is supported, set the C values C1i+1, C2i+1, and C3i+1 equal to

the corresponding C1i+1, C2i+1, and C3i+1 values retained from the

Permutation Operation Known Answer Test for the Encryption Process for

TCBC-I mode. If encryption is not supported by the IUT, set C1i+1, C2i+1,

and C3i+1 equal to the corresponding C1i+1, C2i+1, and C3i+1, values

supplied by the TMOVS.

NOTE -- The above processing should continue until all 32 KEY values are processed. The output from the IUT for this test

should consist of 32 output strings. Each output string should consist of information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The resulting P1, P2, and P3 results should be all zeros.
157

5.3.2.5 Substitution Table Known Answer Test for the Decryption Process -

TCBC-I Mode

Table 35 The Substitution Table Known Answer Test for the Decryption Process -

TCBC-I Mode

TMOVS: Initialize KEY1i =KEY2i = KEY3i (where i = 1..19) = 19 KEY values from

Table A.8

IV1=0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

If encryption is supported by the IUT:

Send IV1, IV2, and IV3,

KEY1, KEY2,..., KEY19 (where KEY represents the values of

KEY1, KEY2, and KEY3)

If encryption is not supported by the IUT:

Initialize Cki (where k=1..3 and where i=1..19) = corresponding Cki values

from Table A.8

Send IV1, IV2, and IV3,

KEY1, KEY2,..., KEY19 (where KEY represents the values of

KEY1, KEY2, and KEY3)

C11,...,C119, C21,...,C219, C31,...,C319

IUT: If encryption is supported by the IUT:

Initialize C11, C21, C31 values retained from Substitution Table Known

Answer Test for Encryption Process.

Otherwise, use the first values received from the TMOVS.

FOR i = 1 to 19

{

Perform

Triple DES:

T1: I1i = C1i
158

I1i is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP11

T2: I2i = C2i

I2i is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP21

TEMP11 is encrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3i = C3i

I3i is read into TDEA and is decrypted by DEA3 using KEY3i,

resulting in TEMP31

TEMP21 is encrypted by DEA2 using KEY2i , resulting in

TEMP22

TEMP12 is decrypted by DEA1 using KEY1i, resulting in O1i

P1i= O1i ⊕ IV1

T4: TEMP31 is encrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is decrypted by DEA1 using KEY1i, resulting in O2i

P2i= O2i ⊕ IV2

T5: TEMP32 is decrypted by DEA1 using KEY1i, resulting in O3i

P3i= O3i ⊕ IV3

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3,

C1i, C2i, C3i, P1i,P2i,P3i

KEY1i+1 = KEY2i+1 = KEY3i+1 = corresponding KEYi+1 supplied from

TMOVS

If encryption is supported:

Cki+1 (where k=1..3) = corresponding Cki+1 from output of

Substitution Table Known Answer Test for the Encryption

Process

else
159

Cki+1 (where k=1..3) = corresponding Cki+1 values from

TMOVS

}

TMOVS: Compare results with known answers.

Table 35 illustrates the Substitution Table Known Answer Test for the TCBC-I Decryption

Process.

1. The TMOVS:

a. If the IUT supports encryption, the KEY1i, KEY2i, and KEY3i variables are

initialized with the 19 constant KEY values from Table A.8. If the IUT does not

support encryption, the KEY variables, KEY1, KEY2, and KEY3, and the C

variables, C1, C2, and C3 are initialized with the 19 constant KEY and C1, C2, and

C3 values from Table A.8.

NOTE -- KEY1=KEY2=KEY3.

b. Initializes the 64-bit IV parameters, IV1, IV2, and IV3. IV1 is initialized to the

constant hexadecimal value 0, i.e., IV1hex = 00 00 00 00 00 00 00 00. Based on

specifications in ANSI X9.52-1998, IV2 is computed by the following equation:

IV1 + R1 mod 264 where R1=5555555555555555, i.e., IV2hex = 55 55 55 55 55 55

55 55. IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA, i.e., IV3hex = AA AA AA AA AA AA AA AA.

c. If encryption is supported by the IUT, the 19 KEY values for KEY1, KEY2, and

KEY3, and the IV1, IV2, and IV3 values are forwarded to the IUT using Input

Type 16. If encryption is not supported by the IUT, the 19 KEY, C1, C2, and C3

groups and the IV1, IV2, and IV3 values are forwarded to the IUT using Input

Type 17.

2. The IUT should:

a. If encryption is supported by the IUT, initialize the C1, C2, and C3 values with the

first C1, C2, and C3 values retained from the Substitution Table Known Answer

Test for the Encryption Process for the TCBC-I Mode (Section 5.3.1.5).

Otherwise, use the first value received from the TMOVS.

b. Perform the following for i = 1 to 19:

NOTE -- the processing for each clock cycle Ti is displayed.

1) At clock cycle T1:
160

a) Set I1i equal to the value of C1i.

b) Process I1i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP11.

 At clock cycle T2:

a) Set I2i equal to the value of C2i.

b) Process I2i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP21.

c) Process TEMP11 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP12.

At clock cycle T3:

a) Set I3i equal to the value of C3i.

b) Process I3i through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP31.

c) Process TEMP21 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP22.

d) Process TEMP12 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O1i.

e) Calculate the plaintext P1i by exclusive-ORing O1i with IV1.

At clock cycle T4:

a) Process TEMP22 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O2i.

b) Calculate the plaintext P2i by exclusive-ORing O2i with IV2.

c) Process TEMP31 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP32.

At clock cycle T5:

a) Process TEMP32 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O3i.

b) Calculate the plaintext P3i by exclusive-ORing O3i with IV3.
161

2) Forward the current values of the loop number i, KEYi (representing

KEY1i, KEY2i, and KEY3i), IV1, IV2, IV3, C1i, C2i, C3i, and the

resulting P1i, P2i, and P3i to the TMOVS as specified in Output Type 3.

3) Assign new values to KEY1i+1,, KEY2i+1,, and KEY3i+1, by setting them

equal to the corresponding KEYi+1 values supplied by the TMOVS.

NOTE -- KEY1i+1 = KEY2i+1 = KEY3i+1.

4) If encryption is supported, set the C values C1i+1, C2i+1, and C3i+1 equal to

the corresponding C1i+1, C2i+1, and C3i+1 values retained from the

Substitution Table Known Answer Test for the Encryption Process for

TCBC-I mode. If encryption is not supported by the IUT, set C1i+1, C2i+1,

and C3i+1 equal to the corresponding C1i+1, C2i+1, and C3i+1, values

supplied by the TMOVS.

NOTE -- The above processing should continue until all 19 KEY, C1, C2, and C3 groups, as specified in Input Type 17, or all

19 KEY values, as specified in Input Type 16, are processed. The output from the IUT for this test should consist of 19 output

strings. Each output string should consist of information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
162

5.3.2.6 Monte Carlo Test for the Decryption Process - TCBC-I Mode

Table 36 The Monte Carlo Test for the Decryption Process - TCBC-I Mode

TMOVS

:

Initialize KEY10, KEY20, KEY30, IV1, IV2, IV3, C10,C20, C30

Send KEY10, KEY20, KEY30, IV1, IV2, IV3, C10,C20, C30

IUT: FOR i = 0 TO 399

{

If (i==0)

FOR k=1 to 3

CVk0 = IVk

Record i, KEY1i, KEY2i, KEY3i, CV10, CV20, CV30, C10, C20, C30

FOR j = 0 TO 9,999

{

T1: I1j = C1j

Perform

Triple DES: I1j is read into TDEA and is decrypted by DEA3 using

KEY3i, resulting in TEMP11

T2: I2j = C2j

I2j is read into TDEA and is decrypted by DEA3 using

KEY3i, resulting in TEMP21

TEMP11 is encrypted by DEA2 using KEY2i, resulting

in TEMP12

T3: I3j = C3j

I3j is read into TDEA and is decrypted by DEA3 using

KEY3i, resulting in TEMP31

TEMP21 is encrypted by DEA2 using KEY2i , resulting

in TEMP22

TEMP12 is decrypted by DEA1 using KEY1i, resulting

in O1j
163

P1j= O1j ⊕ CV1

T4: TEMP31 is encrypted by DEA2 using KEY2i, resulting

in TEMP32

TEMP22 is decrypted by DEA1 using KEY1i, resulting

in O2j

P2j= O2j ⊕ CV2

T5: TEMP32 is decrypted by DEA1 using KEY1i, resulting

in O3j

P3j= O3j ⊕ CV3

FOR k= 1 to 3

{

CVkj+1 = Ckj

Ckj+1 = Pkj

}

}

Record P1j, P2j, P3j

Send i, KEY1i, KEY2i, KEY3i, CV10, CV20, CV30, C10, C20, C30, P1j, P2j,

P3j

KEY1i+1 = KEY1i ⊕ P1j

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, and KEY3i are independent)

 KEY2i+1= KEY2i ⊕ P2j-1

ELSE

 KEY2i+1= KEY2i ⊕ P1j

IF (KEY1i= KEY2i= KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i)

 KEY3i+1= KEY3i ⊕ P1j
164

ELSE

 KEY3i+1= KEY3i ⊕ P3j-2

FOR k= 1 to 3

{

CVk0 = Ckj

Ck0 = Pkj

}

}

TMOVS

:

Check IUT's output for correctness.

As summarized in Table 36, the Monte Carlo Test for the TCBC-I Decryption Process is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, the initialization vectors

IV1, IV2, and IV3, and the ciphertext variables C1, C2, and C3. The C variables,

the IV variables , and the KEY variables consist of 64 bits each. IV2 is assigned

the value of IV1+R1 mod 264 where R1 = 5555555555555555. IV3 is assigned the

value of IV1+R2 mod 264 where R2 = AAAAAAAAAAAAAAAA.

b. Forwards this information to the IUT using Input Type 22.

2. The IUT should perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), set the chaining value CV10 equal

to the IV1, CV20 equal to the IV2, and CV30 equal to the IV3.

b. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

CV10, CV20, CV30, and C10, C20, C30.

c. Perform the following for j = 0 through 9999:

NOTE -- the processing for each clock cycle Ti is displayed.

1) At clock cycle T1:
165

a) Set the input block I1j equal to the value of C1j.

b) Process I1j through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP11.

At clock cycle T2:

a) Set the input block I2j equal to the value of C2j.

b) Process I2j through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP21.

c) Process TEMP11 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP12.

At clock cycle T3:

a) Set the input block I3j equal to the value of C3j.

b) Process I3j through the DEA stage DEA3 in the decrypt state using

KEY3i, resulting in intermediate value TEMP31.

c) Process TEMP21 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP22.

d) Process TEMP12 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O1j.

e) Calculate the plaintext P1j by exclusive-ORing O1j with IV1.

At clock cycle T4:

a) Process TEMP22 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O2j.

b) Calculate the plaintext P2j by exclusive-ORing O2j with IV2.

c) Process TEMP31 through the DEA stage DEA2 in the encrypt state

using KEY2i, resulting in intermediate value TEMP32.

At clock cycle T5:

a) Process TEMP32 through the DEA stage DEA1 in the decrypt state

using KEY1i, resulting in the output block O3j.

b) Calculate the plaintext P3j by exclusive-ORing O3j with IV3.

2) Prepare for loop j+1 by doing the following:
166

a) Assign CV1j+1, CV2j+1, CV3j+1 the current value of C1j, C2j, C3j,

respectively.

b) Assign C1j+1, C2j+1, C3j+1 the current value of P1j, P2j, P3j,

respectively.

d. Record P1j, P2j, P3j.

e. Forward all recorded information for this loop, as specified in Output Type 4, to

the TMOVS.

f. Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop. Note j = 9999.

The new KEY1i+1 should be calculated by exclusive-ORing the current

KEY1i with the P1j.

The new KEY2i+1 calculation is based on the values of the keys. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and

KEY3i are independent, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the P2j-1. If

KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the P1j.

The new KEY3i+1 calculation is also based on the values of the keys. If

KEY1i, KEY2i, and KEY3i are independent, the new KEY3i+1 should be

calculated by exclusive-ORing the current KEY3i with the P3j-2. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or if

KEY1i=KEY2i=KEY3i, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the P1j.

g. Assign new values to CV10, CV20, and CV30, in preparation for the next outer

loop. CV10, CV20, and CV30 should be assigned the value of the current C1j, C2j,

and C3j, respectively.

NOTE -- the new CV should be denoted as CV0 because this value is used for the first pass through the

inner loop when j=0.

h. Assign a new value to C10, C20, and C30 in preparation for the next output loop.

C10 should be assigned the value of the P1j. Likewise, C20 should be assigned the

value of the P2j, and C30 should be assigned the value of the P3j.

NOTE -- the new C variables, C1, C2, and C3 should be denoted as C10, C20, and C30, respectively, to be

used for the first pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 4.
167

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values.
168

5.4 The Cipher Feedback (TCFB) Mode

The IUTs in the TDES Cipher Block Feedback (TCFB) mode of operation are validated by

successfully completing (1) a set of Known Answer tests applicable to both IUTs supporting

encryption and/or decryption and (2) a Monte Carlo test for each cryptographic process

supported by the IUT.

The process of validating an IUT which supports the K-bit TCFB mode in either the encryption

and/or decryption process involves the successful completion of the following six tests:

1. The Variable Text Known Answer Test - K-bit TCFB mode

2. The Inverse Permutation Known Answer Test - K-bit TCFB mode

3. The Variable Key Known Answer Test - K-bit TCFB mode

4. The Permutation Operation Known Answer Test - K-bit TCFB mode

5. The Substitution Table Known Answer Test - K-bit TCFB mode

6. The Monte Carlo Test for the Encryption Process - K-bit TCFB mode (if encryption is

supported)

OR

The Monte Carlo Test for the Decryption Process - K-bit TCFB mode (if decryption is

supported)

NOTE -- For IUTs, K can range from 1 to 64 bits.

An explanation of the tests follows.

5.4.1 The Known Answer Tests - TCFB Mode

The K-bit TCFB mode has one set of Known Answer tests which is used regardless of supported

process, i.e., the same set of Known Answer tests is for IUTs supporting the encryption and/or

decryption processes.

Throughout this section, TEXT and RESULT will refer to different variables depending on

whether the encryption or decryption process is being tested. If the IUT performs TCFB

encryption, TEXT refers to plaintext, and RESULT refers to ciphertext. If the IUT performs

TCFB decryption, TEXT refers to ciphertext, and RESULT refers to plaintext.

The notation LMK(A) refers to the leftmost K-bits of A.
169

5.4.1.1 The Variable TEXT Known Answer Test - TCFB Mode

Table 37 The Variable TEXT Known Answer Test - TCFB Mode

TMOVS: Initialize KEYS: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity

set)

IV1 = 8000000000000000

K-bit TEXT = 0

Send KEY (representing KEY1, KEY2, and KEY3), IV1, K-bit TEXT

IUT: FOR i = 1 to 64

{

Ii = IVi Perform

Triple

DES:

Ii is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3, resulting in Oi

K-bit RESULTi = LMK(Oi) ⊕ K-bit TEXT

Send i, KEY (representing KEY1, KEY2, and KEY3), IVi, K-bit

TEXT, K-bit RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

}

TMOVS: Compare RESULT from each loop with known answers.

Use K bits of output in Table A.1.

As summarized in Table 37, the Variable TEXT Known Answer Test for the TCFB mode of

operation is performed as follows:

1. The TMOVS:
170

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit initialization vector IV1 to the basis vector containing a"1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

c. Initializes the K-bit TEXT parameter to the constant hexadecimal value 0, i.e.,

TEXThex = 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 2.

2. The IUT should perform the following for i=1 through 64:

a. Assign the value of the initialization vector IVi to the input block Ii.

b. Process Ii through the three DEA stages, resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3, resulting in output block

Oi.

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of Oi with

the K-bit TEXT, i.e., (RESULT1

i, RESULT2i,..., RESULTKi) = (O1i ⊕ TEXT1

, O2

i

⊕ TEXT2,..., OK

i ⊕ TEXTK

).

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IVi, K-bit TEXT, and the resulting K-bit RESULTi to the

TMOVS as specified in Output Type 2.

e. Retain the K-bit RESULT values for use with the Inverse Permutation Known

Answer Test for the TCFB Mode (Section 5.4.1.2).

f. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i+1=2,...,64.

NOTE -- This continues until every possible basis vector has been represented by the IV, i.e., 64 times. The output from the

IUT should consist of 64 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.1. For IUTs where K is less than 64, the leftmost K

bits of output for each RESULT value in Table A.1 are used.
171

5.4.1.2 The Inverse Permutation Known Answer Test - TCFB Mode

Table 38 The Inverse Permutation Known Answer Test - TCFB Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101

(odd parity set)

K-bit TEXTi (where i=1..64)=64 RESULT values from the

Variable TEXT Known Answer Test

IV1= 8000000000000000

Send KEY (representing KEY1, KEY2, and KEY3), IV1, K-bit

TEXT1,...,K-bit TEXT64

IUT: FOR i = 1 to 64

{

Ii = IVi

Ii is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP1

Perform

Triple

DES:

TEMP1 is decrypted by DEA2 using KEY2, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3, resulting in Oi

K-bit RESULTi= LMK(Oi) ⊕ K-bit TEXTi

Send i, KEY (representing KEY1, KEY2, and KEY3), IVi, K-bit TEXTi,

K-bit RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

K-bit TEXTi+1 = corresponding K-bit RESULT value from the TMOVS

}

TMOVS: Compare RESULT from each loop with known answers.

The RESULTs should be all zeros.

As summarized in Table 38, the Inverse Permutation Known Answer Test for the TCFB mode of

operation is performed as follows:
172

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit initialization vector IV1 to the basis vector containing a"1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

c. Initializes the K-bit TEXTi (where i=1..64) to the RESULTi values obtained from

the Variable TEXT Known Answer Test.

d. Forwards this information to the IUT using Input Type 5.

2. The IUT should perform the following for i=1 through 64:

a. Assign the value of the initialization vector IVi to the input block Ii.

b. Process Ii through the three DEA stages, resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3, resulting in output block

Oi.

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of Oi with

the K-bit TEXTi, i.e., (RESULT1

i, RESULT2i,..., RESULTKi) = (O1i ⊕ TEXT1i,

O

2

i ⊕ TEXT2i,..., OKi ⊕ TEXTKi).

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, K-bit TEXTi, and the resulting K-bit RESULTi to the

TMOVS as specified in Output Type 2.

e. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i+1=2,...,64.

f. Assign a new value to TEXTi+1 by setting it equal to the corresponding output

from the TMOVS.

NOTE -- This processing continues until all RESULT values from the Variable TEXT Known Answer Test have been used as

input. The output from the IUT should consist of 64 output strings. Each output string should consist of information included in

Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values. The RESULT values should be all zeros.
173

5.4.1.3 The Variable KEY Known Answer Test - TCFB Mode

Table 39 The Variable Key Known Answer Test - TCFB Mode

TMOVS: Initialize KEYs: KEY11 = KEY21 = KEY31 = 8001010101010101 (odd

parity set)

IV = 0000000000000000

K-bit TEXT = 0

Send KEY1 (representing KEY11, KEY21, and KEY31), IV, K-bit

TEXT

IUT: FOR i = 1 to 64

{

IF( i mod 8 ≠ 0) {process all bits except parity bits}

{

Ii = IV

Ii is read into TDEA and is encrypted by DEA1 using

KEY1i, resulting in TEMP1 Perform

Triple DES:

TEMP1 is decrypted in DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oi

K-bit RESULTi= LMK(Oi) ⊕ K-bit TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV, K-bit

TEXT, K-bit RESULTi

KEY1i+1 =KEY2i+1 =KEY3i+1 = vector consisting of "0" in every

significant bit position except for a single "1" bit in position i+1.

NOTE: Each parity bit may have the value "1" or "0" to make the KEY odd parity.

}

}

TMOVS: Compare results of the 56 encryptions with known answers.
174

Use K bits of the results in Table A.2.

As summarized in Table 39, the Variable Key Known Answer Test for the TCFB mode of

operation is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initializes the K-bit TEXT to the constant hexadecimal value 0. It is represented as

K binary bits, where K=1,...,64, i.e., TEXTbin = 01 02,...,0K. This is then translated

into hexadecimal.

d. Forwards this information to the IUT using Input Type 2.

2. The IUT should perform the following for i = 1 to 56:

NOTE -- 56 is the number of significant bits in a TDES key.

a. Assign the value of the initialization vector IV to the input block Ii.

b. Process Ii through the three DEA stages, resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3i, resulting in output block

Oi.

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of Oi with

the K-bit TEXT, i.e., (RESULT1

i, RESULT2i,..., RESULTKi) = (O1i ⊕ TEXT1

, O2

i

⊕ TEXT2,..., OK

i ⊕ TEXTK

).

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, K-bit TEXT, and the resulting K-bit RESULTi to the

TMOVS as specified in Output Type 2.
175

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the vector consisting of “0" in every

significant bit position except for a single “1" bit in position i+1. The parity bits

contain “1" or “0" to make odd parity.

NOTE -- This processing should continue until every significant basis vector has been represented by the KEY parameters. The

output from the IUT should consist of 56 output strings. Each output string should consist of information included in Output

Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.2. For IUTs where K is less than 64, the leftmost K

bits of output for each RESULT in Table A.2 are used.
176

5.4.1.4 The Permutation Operation Known Answer Test - TCFB Mode

Table 40 The Permutation Operation Known Answer Test - TCFB Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i =1..32) = 32 KEY values in

Table A.3

IV = 0000000000000000

K-bit TEXT = 0

Send K-bit TEXT, IV, KEY1, KEY2,...,KEY32 (Since all three keys are the

same, these KEY values represent the values of KEY1, KEY2, and

KEY3.)

IUT: FOR i = 1 to 32

{

Ii = IV

Ii is read into TDEA and is encrypted by DEA1 using KEY1i, resulting

in TEMP1

Perform

Triple

DES:

TEMP1 is decrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oi

K-bit RESULTi= LMK(Oi) ⊕ K-bit TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV, K-bit TEXT,

K-bit RESULTi

 KEY1i+1 =KEY2i+1 =KEY3i+1 = corresponding KEYi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. Use Table A.3.

As summarized in Table 40, the Permutation Operation Known Answer Test for the TCFB mode

of operation is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 with the 32 constant

KEY values from Table A.3.
177

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initializes the K-bit TEXT parameter to the constant hexadecimal value 0, i.e.,

TEXThex = 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 8.

2. The IUT should perform the following for i=1 through 32:

a. Assign the value of the initialization vector IV to the input block Ii.

b. Process Ii through the three DEA stages resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3i, resulting in output block

Oi.

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of Oi with

the K-bit TEXT, i.e., (RESULT1

i, RESULT2i,..., RESULTKi) = (O1i ⊕ TEXT1

, O2

i

⊕ TEXT2,..., OK

i ⊕ TEXTK

).

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, K-bit TEXTi, and the resulting K-bit RESULTi to the

TMOVS as specified in Output Type 2.

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 supplied

by the TMOVS.

NOTE -- The above processing should continue until all 32 KEY values are processed. The output from the IUT for this test

should consist of 32 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.3. For IUTs where K is less than 64, the leftmost K

bits of output for each RESULT value in Table A.3 are used.
178

5.4.1.5 The Substitution Table Known Answer Test - TCFB Mode

Table 41 The Substitution Table Known Answer Test - TCFB Mode

TMOVS: Initialize KEY1i ,KEY2i ,KEY3i (where i=1..19) = 19 KEY values in Table

A.4

IVi (where i=1..19) = 19 corresponding TEXT values in Table A.4

K-bit TEXT = 0

Send K-bit TEXT, 19, KEY1, IV1, KEY2, IV2,..., KEY19, IV19 (Since all

three keys are the same, these key values represent the values of

KEY1, KEY2 and KEY3.)

IUT: FOR i = 1 to 19

{

Ii = IVi

Ii is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

Perform

Triple

DES:

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oi

K-bit RESULTi= LMK(Oi) ⊕ K-bit TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IVi, K-bit

TEXT, K-bit RESULTi

KEY1i+1 = KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

IVi+1 = corresponding DATAi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. Use Table A.4.

As summarized in Table 41, the Substitution Table Known Answer Test for the TCFB mode of

operation is performed as follows:

1. The TMOVS:
179

a. Initializes the KEY-IV pairs with the 19 constant KEY-DATA values from Table

A.4. The DATA values are assigned to the values of the initialization vectors IV.

The KEY value indicates the values of KEY1, KEY2, and KEY3, i.e.,

KEY1=KEY2=KEY3.

b. Initializes the K-bit TEXT parameter to the constant hexadecimal value 0, where

K=1,...,64, i.e., TEXTbin = 01, 02,..., 0K.

c. Forwards this information to the IUT using Input Type 11.

2. The IUT should perform the following for i=1 through 19:

a. Assign the value of the initialization vector IVi to the input block Ii.

b. Process Ii through the three DEA stages resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3i, resulting in output block

Oi.

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of Oi,

LMK(Oi), with the K-bit TEXT, i.e., (RESULT1

i, RESULT2i,..., RESULTKi) = (O1i

⊕ TEXT1, O2

i ⊕ TEXT2

,..., OK

i ⊕ TEXTK

).

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV, K-bit TEXTi, and the resulting K-bit RESULTi to the

TMOVS as specified in Output Type 2.

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 supplied

by the TMOVS.

f. Set IVi+1 equal to the corresponding DATAi+1 supplied by the TMOVS.

NOTE -- The above processing should continue until all 19 KEY-DATA are processed. The output from the IUT for this test

should consist of 19 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.4. For IUTs where K is less than 64, the leftmost K

bits of output for each RESULT value in the Table A.4 are used.
180

5.4.2 The Monte Carlo Tests - TCFB Mode

The Monte Carlo Tests required to validate an IUT for the TCFB mode of operation are

determined by the process or processes allowed by an IUT. The K-bit TCFB Monte Carlo Test

for the Encryption Process is successfully completed if an IUT supports the encryption process of

the TCFB mode of operation. The K-bit TCFB Monte Carlo Test for the Decryption Process is

successfully completed if an IUT supports the decryption process.

5.4.2.1 The Monte Carlo Test for the Encryption Process - TCFB Mode

Table 42 The Monte Carlo Test for the Encryption Process - TCFB Mode

TMOVS: Initialize KEY10,KEY20,KEY30, IV, K-bit P0

Send KEY10,KEY20,KEY30, IV, K-bit P0

IUT: FOR i = 0 TO 399

{

(Part of

Triple DES

processing):

If (i==0) I0 = IV

Record i, KEY1i,KEY2i,KEY3i, P0

FOR j = 0 TO 9,999

{

Ij is read into TDEA and is encrypted by DEA1 using

Perform KEY1i, resulting in TEMP1

Triple

DES: TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oj.

Select the leftmost K bits of the Oj, LMK(Oj), discarding the

rest.

K-bit Cj = LMK(Oj) ⊕ K-bit Pj

K-bit Pj+1 = LMK(Ij)
181

(Part of Triple

DES

processing):

Ij+1 = RM(64-K)(Ij) || K-bit Cj

}

Record K-bit Cj, I0

Send i, KEY1i, KEY2i, KEY3i, I0, K-bit P0, K-bit Cj

Concatenate enough Cs together to get (length(KEY)*3) bits (192 bits)

KEY1i+1 = KEY1i ⊕ bits 129-192 of C

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, KEY3i are independent),

 KEY2i+1 = KEY2i ⊕ bits 65-128 of C

ELSE

 KEY2i+1 = KEY2i ⊕ bits 129-192 of C

IF (KEY1i=KEY2i=KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i),

 KEY3i+1 = KEY3i ⊕ bits 129-192 of C

ELSE

 KEY3i+1 = KEY3i ⊕ bits 1-64 of C

K-bit P0 = LMK(Ij)

I0 = RM(64-K)(Ij) || K-bit Cj

}

TMOVS: Check the IUT's output for correctness.

As summarized in Table 42, the Monte Carlo Test for the TCFB Encryption Process is performed

as follows:

1. The TMOVS:
182

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, the initialization vector

IV, and the plaintext P variables. The IV, and KEYs consist of 64 bits each. The P

is represented as K-bits, where K=1,...,64.

b. Forwards this information to the IUT using Input Type 21.

2. The IUT should perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), assign the value of the

initialization vector IV to the input block Ii.

b. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

and the K-bit P0.

c. Perform the following for j = 0 through 9999:

1) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ij

through the three DEA stages resulting in output block Oj. This involves

processing Ij through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the second DEA stage, denoted DEA2, in the decrypt state

using KEY2i, resulting in intermediate value TEMP2. TEMP2 is fed

directly into the third DEA stage, denoted DEA3, in the encrypt state using

KEY3i, resulting in output block Oj.

2) Calculate the K-bit Cj by exclusive-ORing the leftmost K-bits of Oj,

LMK(Oj), with the K-bit Pj, i.e., (C1

j, C2j,..., CKj) = (O1j ⊕ P1j, O2j ⊕ P2j,...,

O

K

j ⊕ PKj).

3) Prepare for loop j+1 by doing the following:

a) Assign the K-bit Pj+1 with the value of the leftmost K-bits of the Ij,

i.e., (P1

j+1, P2j+1,..., PKj+1) = (I1j, I2j,..., IKj).

b) Assign Ij+1 with the value of the concatenation of the rightmost (64-

K) bits of Ij with the K-bit Cj, i.e.,(I1

j+1, I2j+1,...,I64j+1) = (I[K+1]j,

I

[K+2]

j,..., I64j, C1j, C2j,...,CKj).

d. Record the K-bit Cj and I0.

e. Forward all recorded values for this loop, as specified in Output Type 6, to the

TMOVS.

f. In preparation for the next output loop:

1) Assign new values to the KEY parameters KEY1, KEY2, and KEY3. This

is accomplished by exclusive-ORing C with the KEY value to obtain the
183

new KEY. If the length of the C is less than 64 (the length of a DES key),

then C should be expanded in length to 64*3 (to correspond to the

combined lengths of KEY1+KEY2+KEY3) before forming the new KEY

values. This expansion should be accomplished by concatenating X of the

most current Cs together to obtain 192 bits of C. For example, if the length

of the C is 50 bits (K=50), the expanded C = (C9

9996,...,C509996, C19997,...,

C

50

9997, C19998,...,C509998, C19999,...,C509999).

Bits 129-192 of the expanded C will be exclusive-ORed with KEY1 to

form the new KEY1.

The calculation of the new KEY2 and KEY3 are based on the values of the

keys. . If KEY1i and KEY2i are independent and KEY3i = KEY1i, or

KEY1, KEY2 and KEY3 are independent, the new KEY2 should be

calculated by exclusive-ORing the current KEY2 with bits 65-128 of the

expanded C. If KEY1=KEY2=KEY3, the current KEY2 will be exclusiveORed with bits 129-192 of the expanded C to calculate the new KEY2.

If KEY1, KEY2, and KEY3 are independent, the new KEY3 should be

calculated by exclusive-ORing the current KEY3 with bits 1-64 of the

expanded C. Otherwise, the current KEY3 will be exclusive-ORed with

bits 129-192 of the expanded C to calculate the new KEY3.

2) Assign a new value to the K-bit P0. The K-bit P0 should be assigned the

value of the leftmost K-bits of the current Ij, i.e., (P1

0, P20,...,PK0) = (I1j,

I

2

j,..., IKj). Note j = 9999.

3) Assign a new value to I0. I0 should be assigned the value of the rightmost

(64-K) bits of the current Ij concatenated with the current K-bit Cj, i.e.,

(I1

0, I20,..., I640) = (I[K+1]j, I[K+2]j,..., I64j, C1j, C2j,..., CKj). Note j = 9999.

NOTE -- the new P and I should be denoted as P0 and I0 because these values are used for the first

pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 6.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
184

5.4.2.2 The Monte Carlo Test for the Decryption Process - TCFB Mode

Table 43 The Monte Carlo Test for the Decryption Process - TCFB Mode

TMOVS: Initialize KEY10,KEY20,KEY30, IV, K-bit C0

Send KEY10,KEY20,KEY30, IV, K-bit C0

IUT: FOR i = 0 TO 399

{

(Part of Triple

DES

processing):

If (i==0) I0 = IV

Record i, KEY1i,KEY2i,KEY3i, K-bit C0

FOR j = 0 TO 9,999

{

Ij is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1 Perform

Triple DES: TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oj

Select the leftmost K bits of the Oj, LMK(Oj),discarding the

rest.

K-bit Pj = LMK(Oj) ⊕ K-bit Cj

Ij+1 = RM(64-K)(Ij) || K-bit Cj

K-bit Cj+1 = LMK(Oj)

}

Record I0, K-bit Pj

Send i, KEY1i, KEY2i, KEY3i, I0, K-bit Pj, K-bit Cj

Concatenate enough Ps together to get (length(KEY)*3) bits (192 bits)
185

KEY1i+1 = KEY1i ⊕ bits 129-192 of P

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, KEY3i are independent),

 KEY2i+1 = KEY2i ⊕ bits 65-128 of P

ELSE

 KEY2i+1 = KEY2i ⊕ bits 129-192 of P

IF (KEY1i=KEY2i=KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i),

 KEY3i+1 = KEY3i ⊕ bits 129-192 of P

ELSE

 KEY3i+1 = KEY3i ⊕ bits 1-64 of P

I0 = RM(64-K)(Ij) || K-bit Cj

K-bit C0 = LMK(Oj)

}

TMOVS: Check the IUT's output for correctness.

As summarized in Table 43, the Monte Carlo Test for the TCFB Decryption Process is performed

as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3, the initialization vector

IV, and the ciphertext C variables. The IV and KEYs consist of 64 bits each. The

C is represented as K-bits, where K=1,...,64.

b. Forwards this information to the IUT using Input Type 21.

2. The IUT should perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), assign the value of the

initialization vector IV to the input block Ii.

b. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

and the K-bit C0.
186

c. Perform the following for j = 0 through 9999:

1) Using the corresponding KEY1i, KEY2i, and KEY3i values, process Ij

through the three DEA stages resulting in output block Oj. This involves

processing Ij through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the second DEA stage, denoted DEA2, in the decrypt state

using KEY2i, resulting in intermediate value TEMP2. TEMP2 is fed

directly into the third DEA stage, denoted DEA3, in the encrypt state using

KEY3i, resulting in output block Oj.

2) Calculate the K-bit Pj by exclusive-ORing the leftmost K-bits of Oj,

LMK(Oj), with the K-bit Cj, i.e., (P1

j, P2j,..., PKj) = (O1j ⊕ C1j, O2j ⊕ C2j,...,

O

K

j ⊕ CKj).

3) Prepare for loop j+1 by doing the following:

a) Assign Ij+1 with the value of the concatenation of the rightmost (64-

K) bits of Ij with the K-bit Cj, i.e.,(I1

j+1, I2j+1,...,I64j+1) = (I[K+1]j,

I

[K+2]

j,..., I64j, C1j, C2j,...,CKj).

b) Assign the K-bit Cj+1 with the value of the leftmost K-bits of the Oj,

i.e., (C1

j+1, C2j+1,..., CKj+1) = (O1j, O2j,..., OKj).

d. Record the K-bit Pj and I0.

e. Forward all recorded values for this loop, as specified in Output Type 6, to the

TMOVS.

f. In preparation for the next output loop:

1) Assign new values to the KEY parameters KEY1, KEY2, and KEY3. This

is accomplished by exclusive-ORing P with the KEY value to obtain the

new KEY. If the length of the P is less than 64 (the length of a DES key),

then P should be expanded in length to 64*3 (to correspond to the

combined lengths of KEY1+KEY2+KEY3) before forming the new KEY

values. This expansion should be accomplished by concatenating X of the

most current Ps together to obtain 192 bits of P. For example, if the length

of the P is 50 bits (K=50), the expanded P = (P9

9996,...,P509996, P19997,...,

P

50

9997, P19998,...,P509998, P19999,...,P509999).

Bits 129-192 of the expanded P will be exclusive-ORed with KEY1 to

form the new KEY1.

The calculation of the new KEY2 and KEY3 are based on the values of the

keys. . If KEY1i and KEY2i are independent and KEY3i = KEY1i, or

KEY1, KEY2 and KEY3 are independent, the new KEY2 should be
187

calculated by exclusive-ORing the current KEY2 with bits 65-128 of the

expanded P. If KEY1=KEY2=KEY3, the current KEY2 will be exclusiveORed with bits 129-192 of the expanded P to calculate the new KEY2.

If KEY1, KEY2, and KEY3 are independent, the new KEY3 should be

calculated by exclusive-ORing the current KEY3 with bits 1-64 of the

expanded P. Otherwise, the current KEY3 will be exclusive-ORed with

bits 129-192 of the expanded P to calculate the new KEY3.

2) Assign a new value to I0. I0 should be assigned the value of the rightmost

(64-K) bits of the current Ij concatenated with the current K-bit Cj, i.e.,

(I1

0, I20,...,I640) = (I[K+1]j, I[K+2]j,..., I64j, C1j, C2j,..., CKj). Note j = 9999.

3) Assign a new value to the K-bit C0. The K-bit C0 should be assigned the

value of the leftmost K-bits of the current Oj, i.e., (C1

0, C20,..., CK0) = (O1j,

O

2

j,..., OKj). Note j = 9999.

NOTE -- the new C and I should be denoted as C0 and I0 because these values are used for the first

pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 6.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
188

5.5 The Cipher Feedback (CFB-P) Mode

The IUTs that implement the Cipher Block Feedback - Pipelined (CFB-P) mode of operation are

validated by successfully completing (1) a set of Known Answer tests applicable to both IUTs

supporting encryption and/or decryption and (2) a Monte Carlo test designed for use with both

the encryption process and the decryption process.

The pipelined configuration is intended for systems equipped with multiple DEA processors. By

pipelining the data, throughput is improved and propagation delay is minimized by initializing the

three individual DEA stages and then simultaneously clocking them. Thus, with each clock cycle,

data is processed by each DEAi stage and passed onward to the output buffer or the next stage so

that idle DEAi stages are minimized.

The processing for each Known Answer test and Monte Carlo test is broken down into clock

cycles T1, T2, T3,.... Within each clock cycle, the processing occurring on each active DEA is

discussed. For convenience, let KEY1 represent the key used on processor DEA1, KEY2

represent the key used on processor DEA2, and KEY3 represent the key used on processor

DEA3.

The process of validating an IUT which only supports the K-bit TCFB-P mode in either the

encryption and/or decryption processes involves the successful completion of the following six

tests:

1. The Variable Text Known Answer Test - K-bit TCFB-P mode

2. The Inverse Permutation Known Answer Test - K-bit TCFB-P mode

3. The Variable Key Known Answer Test - K-bit TCFB-P mode

4. The Permutation Operation Known Answer Test - K-bit TCFB-P mode

5. The Substitution Table Known Answer Test - K-bit TCFB-P mode

6. The Monte Carlo Test - K-bit TCFB-P mode

NOTE -- for IUTs, K can range from 1 to 64 bits.

The notation LMK(A) refers to the leftmost K bits of A.

An explanation of the tests follows.

5.5.1 The Known Answer Tests - TCFB-P Mode

The K-bit TCFB-P mode has only one set of Known Answer tests which are used regardless of

process, i.e., the same set of Known Answer tests are used for IUTs supporting the encryption

and/or decryption processes.
189

Throughout this section, TEXT and RESULT will refer to different variables depending on

whether the encryption or decryption process is being tested. If the IUT performs TCFB-P

encryption, TEXT refers to plaintext, and RESULT refers to ciphertext. If the IUT performs

TCFB-P decryption, TEXT refers to ciphertext, and RESULT refers to plaintext.

5.5.1.1 The Variable TEXT Known Answer Test - TCFB-P Mode

Table 44 The Variable TEXT Known Answer Test - TCFB-P Mode

TMOVS: Initialize KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV11 = 8000000000000000

IV21 = D555555555555555 (based on specifications in ANSI

X9.52-1998)

IV31 = 2AAAAAAAAAAAAAAA (based on specifications in

ANSI X9.52-1998)

K-bit TEXT = 0

Send KEY (representing KEY1, KEY2, and KEY3), IV11, IV21, IV31,

K-bit TEXT

IUT: FOR i = 1 to 64

{

With the feedback path disconnected:

T1: I1 = IV1i

Perform

Triple DES: I1 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP11

T2: I2 = IV2i

I2is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3 = IV3i

I3 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP31
190

TEMP21 is decrypted by DEA2 using KEY2, resulting in

TEMP22

Connect the feedback path:

TEMP12 is encrypted by DEA3 using KEY3, resulting in O1i

K-bit RESULT1i = LMK(O1i) ⊕ K-bit TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3, resulting in O2i

K-bit RESULT2i = LMK(O2i) ⊕ K-bit TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3, resulting in O3i

K-bit RESULT3i = LMK(O3i) ⊕ K-bit TEXT

Send i, KEY (representing KEY1, KEY2, and KEY3), I1, I2, I3, K-bit

TEXT, K-bit RESULT1i, K-bit RESULT2i, K-bit RESULT3i

IV1i+1 = basis vector where single "1" bit is in position i+1

IV2i+1 = IV1i +R1 mod 264 where R1=5555555555555555

IV3i+1 = IV1i +R2 mod 264 where R2=AAAAAAAAAAAAAAAA

}

TMOVS: Compare RESULT1, RESULT2, and RESULT3 from each loop with known

answers.

Use K bits of output in Table A.9.

As summarized in Table 44, the Variable TEXT Known Answer Test for the TCFB-P mode of

operation is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.
191

b. Initializes the 3 initialization vectors accordingly: IV11 is set to the basis vector

containing a"1" in the first bit position and "0" in the following 63 positions, i.e.,

IV1 bin = 10000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000. The equivalent of this value in hexadecimal notation is 80 00 00 00 00

00 00 00. Based on specifications in ANSI X9.52-1998, IV21 is computed by the

following equation: IV11 + R1 mod 264 where R1=5555555555555555 . In

hexadecimal, this equates to D5 55 55 55 55 55 55 55. And IV31 is computed by

the equation IV11 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA . In

hexadecimal, this equates to 2A AA AA AA AA AA AA AA.

c. Initializes the K-bit TEXT parameter to the constant hexadecimal value 0, i.e.,

TEXThex = 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 13.

2. The IUT should perform the following for i=1 through 64:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1i to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP11.

At time T2:

a) Assign the value of the initialization vector IV2i to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP12.

At time T3:

a) Assign the value of the initialization vector IV3i to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP22.
192

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3, resulting in output block O1i.

e) Calculate the K-bit RESULT1i by exclusive-ORing the leftmost Kbits of O1i with the K-bit TEXT.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O2i.

b) Calculate the K-bit RESULT2i by exclusive-ORing the leftmost Kbits of O2i with the K-bit TEXT.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O3i.

b) Calculate the K-bit RESULT3i by exclusive-ORing the leftmost Kbits of O3i with the K-bit TEXT.

b. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV1i, IV2i, IV3i, K-bit TEXT, K-bit RESULT1i, K-bit

RESULT2i, and K-bit RESULT3i, to the TMOVS as specified in Output Type 7.

c. Retain the K-bit RESULT1, RESULT2, and RESULT3 values for use with the

Inverse Permutation Known Answer Test for the TCFB-P Mode (Section 5.5.1.2).

d. Assign a new value to the IV variables. IV1i+1 is set to the value of a basis vector

with a "1" bit in position i+1, where i+1=2,...,64. IV2i+1 is set to the value of IV1i+1

+ R1 mod 264 where R1=5555555555555555. And IV3i+1 is set to IV1i+1 + R2 mod

2

64 where R2=AAAAAAAAAAAAAAAA.

NOTE -- This continues until every possible basis vector has been represented by the IV1, i.e., 64 times. The output from the

IUT should consist of 64 output strings. Each output string should consist of information included in Output Type 7.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.9. For IUTs where K is less than 64, the leftmost K

bits of output for each RESULT value in the Table A.9 are used.
193

5.5.1.2 The Inverse Permutation Known Answer Test - TCFB-P Mode

Table 45 The Inverse Permutation Known Answer Test - TCFB-P Mode

TMOVS: Initialize KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV11 = 8000000000000000

IV21 = D555555555555555

IV31 = 2AAAAAAAAAAAAAAA

K-bit TEXTri (where r=1..3 and i=1..64) = 64 corresponding

RESULTri values from Variable TEXT Known Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), IV11, IV21, IV31, Kbit TEXT11,..., K-bit TEXT164, K-bit TEXT21,..., K-bit TEXT264,

K-bit TEXT31,..., K-bit TEXT364

IUT: FOR i = 1 to 64

{

With the feedback path disconnected:

T1: I1 = IV1i

Perform

Triple DES: I1 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP11

T2: I2 = IV2i

I2 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3 = IV3i

I3 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2, resulting in

TEMP22

Connect the feedback path:
194

TEMP12 is encrypted by DEA3 using KEY3, resulting in O1i

K-bit RESULT1i = LMK(O1i) ⊕ K-bit TEXT1i

T4: TEMP31 is decrypted by DEA2 using KEY2, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3, resulting in O2i

K-bit RESULT2i = LMK(O2i) ⊕ K-bit TEXT2i

T5: TEMP32 is encrypted by DEA3 using KEY3, resulting in O3i

K-bit RESULT3i = LMK(O3i) ⊕ K-bit TEXT3i

Send i, KEY (representing KEY1, KEY2, and KEY3), I1, I2, I3, K-bit

TEXT1i, , K-bit TEXT2i, K-bit TEXT3i, K-bit RESULT1i, K-bit

RESULT2i, K-bit RESULT3i

IV1i+1 = basis vector where single "1" bit is in position i+1

IV2i+1 = IV1i + R1 mod 264 where R1=5555555555555555

IV3i+1 = IV1i + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

K-bit TEXTri+1 (where r = 1..3)= corresponding K-bit RESULTri+1 value

from the TMOVS

}

TMOVS: Compare RESULT1, RESULT2, and RESULT3 from each loop with known

answers,

They should be all zeros.

As summarized in Table 45 the Inverse Permutation Known Answer Test for the TCFB-P mode

of operation is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant hexadecimal

value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01 01 01 01 01 01

01.

b. Initializes the 3 initialization vectors accordingly: IV11 is set to the basis vector

containing a"1" in the first bit position and "0" in the following 63 positions, i.e., IV1bin
195

= 10000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000. The equivalent of this value in hexadecimal notation is 80 00 00 00 00 00

00 00. Based on specifications in ANSI X9.52-1998, IV21 is computed by the

following equation: IV11 + R1 mod 264 where R1=5555555555555555 . In

hexadecimal, this equates to D5 55 55 55 55 55 55 55. And IV31 is computed by the

equation IV11 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA . In hexadecimal,

this equates to 2A AA AA AA AA AA AA AA.

c. Initializes the K-bit TEXTri (where r=1,...,3 and i=1,...,64) to the RESULTri

obtained from the Variable TEXT Known Answer Test.

d. Forwards this information to the IUT using Input Type 15.

2. The IUT should perform the following for i=1 through 64:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1i to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP11.

At time T2:

a) Assign the value of the initialization vector IV2i to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP12.

At time T3:

a) Assign the value of the initialization vector IV3i to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP22.

Connect the feedback path:
196

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3, resulting in output block O1i.

e) Calculate the K-bit RESULT1i by exclusive-ORing the leftmost Kbits of O1i with the K-bit TEXT1i.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O2i.

b) Calculate the K-bit RESULT2i by exclusive-ORing the leftmost Kbits of O2i with the K-bit TEXT2i.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O3i.

b) Calculate the K-bit RESULT3i by exclusive-ORing the leftmost Kbits of O3i with the K-bit TEXT3i.

b. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV1i, IV2i, IV3i, K-bit TEXT1i, K-bit TEXT2i, K-bit TEXT3i,

K-bit RESULT1i, K-bit RESULT2i, and K-bit RESULT3i, to the TMOVS as

specified in Output Type 3.

c. Assign a new value to the IV variables. IV1i+1 is set to the value of a basis vector

with a "1" bit in position i+1, where i+1=2,...,64. IV2i+1 is set to the value of

IV1i+1 + R1 mod 264 where R1=5555555555555555. And IV3i+1 is set to IV1i+1 +

R2 mod 264 where R2=AAAAAAAAAAAAAAAA.

d. Assign a new value to the K-bit TEXT1i+1, K-bit TEXT2i+1, and K-bit TEXT3i+1

by setting it equal to the corresponding output from the TMOVS.

NOTE -- This continues until every RESULT1, RESULT2, and RESULT3 value from the Variable TEXT Known Answer Test

has been used as input. The output from the IUT should consist of 64 output strings. Each output string should consist of

information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The RESULT1, RESULT2, and RESULT3 values should be all zeros.
197

5.5.1.3 The Variable KEY Known Answer Test - TCFB-P Mode

Table 46 The Variable KEY Known Answer Test - TCFB-P Mode

TMOVS: Initialize KEY11 = KEY21 = KEY31 = 8001010101010101 (odd parity set)

IV1 = 0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

K-bit TEXT = 0

Send KEY1 (representing KEY11, KEY21, and KEY31), IV1, IV2, IV3,

K-bit TEXT

IUT: FOR i = 1 to 64

IF (i mod 8≠0){process all bits except parity bits}

{

With the feedback path disconnected:

T1: I1 = IV1 Perform

Triple

DES:

I1 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP11

T2: I2 = IV2

I2 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3 = IV3

I3 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2i, resulting in

TEMP22

Connect the feedback path:
198

TEMP12 is encrypted by DEA3 using KEY3i, resulting in O1i

K-bit RESULT1i = LMK(O1i) ⊕ K-bit TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in O2i

K-bit RESULT2i = LMK(O2i) ⊕ K-bit TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in O3i

K-bit RESULT3i = LMK(O3i) ⊕ K-bit TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), I1, I2, I3, K-bit

TEXT, K-bit RESULT1i, K-bit RESULT2i, K-bit RESULT3i

KEY1i+1 = KEY2 i+1 = KEY3 i+1= vector consisting of “0" in every

significant bit position except for a single “1" bit in position i+1. Each

parity bit may have the value “1" or “0" to make the KEY odd parity.

}

TMOVS: Compare results of the 56 encryptions with known answers.

Use K bits of the results in Table A.11.

As summarized in Table 46, the Variable KEY Known Answer Test for the TCFB-P Mode is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 3 initialization vectors accordingly: IV1 is assigned the value 0, i.e.,

IV1 hex = 00 00 00 00 00 00 00 00. Based on specifications in ANSI X9.52-1998,

IV2 is computed by the following equation: IV1 + R1 mod 264 where

R1=5555555555555555. In hexadecimal, this equates to 55 55 55 55 55 55 55 55.

And IV3 is computed by the equation IV1 + R2 mod 264 where
199

R2=AAAAAAAAAAAAAAAA. In hexadecimal, this equates to AA AA AA AA

AA AA AA AA.

c. Initializes the K-bit TEXT parameter to the constant hexadecimal value 0, i.e.,

TEXThex = 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 13.

2. The IUT should perform the following for i=1 through 64:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1 to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP11.

At time T2:

a) Assign the value of the initialization vector IV2 to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP12.

At time T3:

a) Assign the value of the initialization vector IV3 to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3i, resulting in output block O1i.
200

e) Calculate the K-bit RESULT1i by exclusive-ORing the leftmost Kbits of O1i with the K-bit TEXT.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O2i.

b) Calculate the K-bit RESULT2i by exclusive-ORing the leftmost Kbits of O2i with the K-bit TEXT.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2i, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O3i.

b) Calculate the K-bit RESULT3i by exclusive-ORing the leftmost Kbits of O3i with the K-bit TEXT.

b. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV1, IV2, IV3, K-bit TEXT, K-bit RESULT1i, K-bit

RESULT2i, and K-bit RESULT3i, to the TMOVS as specified in Output Type 7.

c. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the vector consisting of “0" in every

significant bit position except for a single “1" bit in position i+1. The parity bits

contain “1" or “0" to make odd parity.

NOTE -- This processing should continue until every significant basis vector has been represented by the KEY parameters. The

output from the IUT should consist of 56 output strings. Each output string should consist of information included in Output

Type 7.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.11. For IUTs where K is less than 64, the leftmost K

bits of output for each RESULT value in the Table A.11 are used.
201

5.5.1.4 The Permutation Operation Known Answer Test - TCFB-P Mode

Table 47 The Permutation Operation Known Answer Test - TCFB-P Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i=1..32) = 32 KEY values in

Table A.12

IV1= 0000000000000000

IV2 =5555555555555555

IV3 =AAAAAAAAAAAAAAAA

K-bit TEXT = 0

Send IV1, IV2, IV3, K-bit TEXT, KEY1, KEY2,...,KEY32 (Since all

three keys are the same, these key values represent the values of

KEY1, KEY2, and KEY3.)

IUT: FOR i = 1 to 32

{

With the feedback path disconnected:

T1: I1 = IV1 Perform

Triple

DES: I1 is read into TDEA and is encrypted by DEA using KEY1i,

resulting in TEMP11

T2: I2 = IV2

I2 is read into TDEA and is encrypted by DEA using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA using KEY2i, resulting in

TEMP12

T3: I3 = IV3

I3 is read into TDEA and is encrypted by DEA using KEY1i,

resulting in TEMP31

TEMP21 is decrypted by DEA using KEY2i, resulting in

TEMP22

Connect the feedback path:
202

TEMP12 is encrypted by DEA using KEY3i, resulting in O1i

K-bit RESULT1i = LMK(O1i) ⊕ K-bit TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in O2i

K-bit RESULT2i = LMK(O2i) ⊕ K-bit TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in O3i

K-bit RESULT3i = LMK(O3i) ⊕ K-bit TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), I1, I2, I3, K-bit

TEXT, K-bit RESULT1i, K-bit RESULT2i, K-bit RESULT3i

KEY1i+1 = KEY2i+1 = KEY3i+1= corresponding KEYi+1 from TMOVS.

TMOVS: Compare results from each loop with known answers.

Use K bits of output in Table A.12.

As summarized in Table 47, the Permutation Operation Known Answer Test for the TCFB-P

mode of operation is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 with the 32 constant

KEY values from Table A.12.

b. Initializes the 3 initialization vectors accordingly: IV1 is assigned the value 0, i.e.,

IV hex = 00 00 00 00 00 00 00 00. Based on specifications in ANSI X9.52-1998,

IV2 is computed by the following equation: IV1 + R1 mod 264 where

R1=5555555555555555. In hexadecimal, this equates to 55 55 55 55 55 55 55 55.

And IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA. In hexadecimal, this equates to AA AA AA AA

AA AA AA AA.

c. Initializes the K-bit TEXT parameter to the constant hexadecimal value 0, i.e.,

TEXThex = 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 18.

2. The IUT should perform the following for i=1 through 32:
203

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1 to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP11.

At time T2:

a) Assign the value of the initialization vector IV2 to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP12.

At time T3:

a) Assign the value of the initialization vector IV3 to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3i, resulting in output block O1i.

e) Calculate the K-bit RESULT1i by exclusive-ORing the leftmost Kbits of O1i with the K-bit TEXT.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O2i.

b) Calculate the K-bit RESULT2i by exclusive-ORing the leftmost Kbits of O2i with the K-bit TEXT.
204

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2i, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O3i.

b) Calculate the K-bit RESULT3i by exclusive-ORing the leftmost Kbits of O3i with the K-bit TEXT.

b. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV1, IV2, IV3, K-bit TEXT, K-bit RESULT1i, K-bit

RESULT2i, and K-bit RESULT3i, to the TMOVS as specified in Output Type 7.

c. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 supplied

by the TMOVS.

NOTE -- The above processing should continue until all 32 KEY values are processed. The output from the IUT for this test

should consist of 32 output strings. Each output string should consist of information included in Output Type 7.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found Table A.12. For IUTs where K is less than 64, the leftmost K bits

of output for each RESULT value in Table A.12 are used.
205

5.5.1.5 The Substitution Table Known Answer Test - TCFB-P Mode

Table 48 The Substitution Table Known Answer Test - TCFB-P Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i=1..19) = 19 KEY values in

Table A.10

IV1i (where i=1..19) = 19 corresponding TEXT values in Table

A.10

IV2i = IV1i + R1 mod 264 where R1=5555555555555555

IV3i = IV1i + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

K-bit TEXT = 0

Send IV1i, IV2i, IV3i, K-bit TEXT, KEY1, KEY2,...,KEY19 (These key

values represent the values of KEY1, KEY2, and KEY3.)

IUT: FOR i = 1 to 19

{

With the feedback path disconnected:

T1: I1 = IV1i

Perform

Triple

DES: I1 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP11

T2: I2 = IV2i

I2 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3 = IV3i

I3 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2i, resulting in

TEMP22

Connect the feedback path:
206

TEMP12 is encrypted by DEA3 using KEY3i, resulting in O1i

K-bit RESULT1i = LMK(O1i) ⊕ K-bit TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in O2i

K-bit RESULT2i = LMK(O2i) ⊕ K-bit TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in O3i

K-bit RESULT3i = LMK(O3i) ⊕ K-bit TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1i, IV2i, IV3i,

K-bit TEXT, K-bit RESULT1i, K-bit RESULT2i, K-bit RESULT3i

KEY1i+1 = KEY2i+1 = KEY3i+1= Corresponding KEYi+1 from TMOVS

IV1i+1= corresponding DATAi+1 from TMOVS

IV2i+1 = IV1i+1 + R1 mod 264 where R1=5555555555555555

IV3i+1 = IV1i+1 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

}

TMOVS: Compare results from each loop with known answers.

Use K bits of output in Table A.10.

As summarized in Table 48, the Substitution Table Known Answer Test for the TCFB-P Mode is

performed as follows:

1. The TMOVS:

a. Initializes the KEY-IV1 pairs with the 19 constant KEY-DATA values from Table

A.10. The DATA values are assigned to the values of the initialization vectors

IV1i. The KEY value indicates the values of KEY1i, KEY2i, and KEY3i, i.e.,

KEY1i=KEY2i=KEY3i. Based on specifications in ANSI X9.52-1998, IV2i is set

to IV1i + R1 mod 264 where R1=5555555555555555 and IV3i is set to IV1i + R2

mod 264 where R2=AAAAAAAAAAAAAAAA.

b. Initializes the K-bit TEXT parameter to the constant hexadecimal value 0, i.e.,

TEXThex = 00 00 00 00 00 00 00 00.
207

c. Forwards this information to the IUT using Input Type 25.

2. The IUT should perform the following for i=1 through 19:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1i to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP11.

At time T2:

a) Assign the value of the initialization vector IV2i to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP12.

At time T3:

a) Assign the value of the initialization vector IV3i to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3i, resulting in output block O1i.

e) Calculate the K-bit RESULT1i by exclusive-ORing the leftmost Kbits of O1i with the K-bit TEXT.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O2i.
208

b) Calculate the K-bit RESULT2i by exclusive-ORing the leftmost Kbits of O2i with the K-bit TEXT.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2i, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O3i.

b) Calculate the K-bit RESULT3i by exclusive-ORing the leftmost Kbits of O3i with the K-bit TEXT.

b. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV1i, IV2i, IV3i, K-bit TEXT, K-bit RESULT1i, K-bit

RESULT2i, and K-bit RESULT3i, to the TMOVS as specified in Output Type 7.

c. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 supplied

by the TMOVS.

d. Set IV1i+1 equal to the corresponding DATAi+1 supplied by the TMOVS. Based on

specifications in ANSI X9.52-1998, IV2i+1 is set to IV1i+1 + R1 mod 264 where

R1=5555555555555555 and IV3i+1 is set to IV1i+1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA.

NOTE -- The above processing should continue until all 19 KEY-DATA are processed. The output from the IUT for this test

should consist of 19 output strings. Each output string should consist of information included in Output Type 7.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.10. For IUTs where K is less than 64, the leftmost K

bits of output for each RESULT value in the Table A.10 are used.
209

5.5.2 The Monte Carlo Tests - TCFB-P Mode

The Monte Carlo tests required to validate an IUT for the K-bit TCFB-P mode of operation are

determined by the process or processes allowed by an IUT. The K-bit TCFB-P Monte Carlo Test

for the Encryption Process is successfully completed if an IUT supports the encryption process of

the TCFB-P mode of operation. The K-bit TCFB-P Monte Carlo Test for the Decryption Process

is successfully completed if an IUT supports the decryption process.

5.5.2.1 The Monte Carlo Test for the Encryption Process – K-bit TCFB-P

Mode

Table 49 The Monte Carlo Test for the Encryption Process - K-bit TCFB-P Mode

TMOVS: Initialize KEY10,KEY20,KEY30, IV1, IV2, IV3, K-bit P0

Send KEY10,KEY20,KEY30, IV1, IV2, IV3, K-bit P0

IUT: FOR i = 0 TO 399

{

FOR j = 0 TO 9,999

{

IF (j == 0, 1, or 2) Perform

Triple DES: Ij = IV (j+1)

 ELSE

Ij = RM(64-K) (I(j-1)) || K-bit Cj-3

Ij is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oj

K-bit Cj = LMK (Oj) ⊕ K-bit Pj

K-bit Pj+1 = LMK (Ij)

}

Record I0, Cj
210

Send i, KEY1i, KEY2i, KEY3i, I0, I1, I2, K-bit P0 , K-bit Cj

Concatenate enough C together to get (length(KEY)*3) bits (192 bits)

KEY1i+1 = KEY1i ⊕ bits 129-192 of C

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, KEY3i are independent),

 KEY2i+1 = KEY2i ⊕ bits 65-128 of C

ELSE

 KEY2i+1 = KEY2i ⊕ bits 129-192 of C

IF (KEY1i=KEY2i=KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i),

 KEY3i+1 = KEY3i ⊕ bits 129-192 of C

ELSE

 KEY3i+1 = KEY3i ⊕ bits 1-64 of C

K-bit P0 = LMK(Ij)

I0 = RM(64-K)(Ij) || K-bit Cj

I1 =I0 + R1 mod 264 where R1=5555555555555555

I2 =I0 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

}

TMOVS: Check the IUT's output for correctness.

As summarized in Table 49, the Monte Carlo Test for the TCFB-P Encryption Process is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY10, KEY20, and KEY30, the initialization

vectors IV1, IV2, and IV3, and the K-bit plaintext P0. The IVs, and KEYs consist

of 64 bits each. The P is represented as K-bits, where K=1,...,64. IV2 is assigned

the value of IV1+R1 mod 264 where R1 = 5555555555555555. IV3 is assigned the

value of IV1+R2 mod 264 where R2 = AAAAAAAAAAAAAAAA.
211

b. Forwards this information to the IUT using Input Type 24.

2. The IUT should perform the following for i = 0 through 399:

a. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

IV1, IV2, IV3, and P0.

b. Perform the following for j = 0 through 9,999:

1) If j = 0, 1, or 2, assign the value of the initialization vector IVj+1 to the input

block Ij.

2) If j > 2, assign Ij with the value of the concatenation of the rightmost (64-

K) bits of I(j-1) with the K-bit Cj-3.

3) Process Ij through the DEA stage DEA1 in the encrypt state using KEY1i,

resulting in intermediate value TEMP1.

4) TEMP1 is fed into the DEA stage DEA2 in the decrypt state using KEY2i,

resulting in intermediate value TEMP2.

5) TEMP2 is fed into the DEA stage DEA3 in the encrypt state using KEY3i,

resulting in output block Oj.

6) Calculate the K-bit Cj by exclusive-ORing the leftmost K-bits of Oj with

the K-bit Pj.

7) Prepare for loop j+1 by assigning the K-bit Pj+1 with the value of the

leftmost K-bits of the Ij.

c. Record the current values of the input block I0 and Cj.

d. Forward all recorded values for this loop, as specified in Output Type 8, to the

TMOVS.

e. In preparation for the next output loop:

1) Concatenate enough C values together to obtain (length (KEY)*3) bits of

data (192 bits).

2) Assign new values to the KEY parameters KEY1, KEY2, and KEY3. This

is accomplished by exclusive-ORing C with the KEY value to obtain the

new KEY. If the length of the C is less than 64 (the length of a DES key),

the C should be expanded in length to 64*3 (to correspond to the

combined lengths of KEY1+KEY2+KEY3) before forming the new KEY

values. This expansion should be accomplished by concatenating X of the

most current Cs together to obtain 192 bits of C. For example, if the length
212

of the C is 50 bits (K=50), the expanded C = (C9

9996,..., C509996, C19997 ,...,

C

50

9997, C19998,..., C509998, C19999,..., C509999).

Bits 129-192 of the expanded C will be exclusive-ORed with KEY1 to

form the new KEY1.

The calculation of the new KEY2 and KEY3 are based on the values of the

keys. . If KEY1i and KEY2i are independent and KEY3i = KEY1i, or

KEY1, KEY2 and KEY3 are independent, the new KEY2 should be

calculated by exclusive-ORing the current KEY2 with bits 65-128 of the

expanded C. If KEY1=KEY2=KEY3, the current KEY2 will be exclusiveORed with bits 129-192 of the expanded C to calculate the new KEY2.

If KEY1, KEY2, and KEY3 are independent, the new KEY3 should be

calculated by exclusive-ORing the current KEY3 with bits 1-64 of the

expanded C. Otherwise, the current KEY3 will be exclusive-ORed with

bits 129-192 of the expanded C to calculate the new KEY3.

3) Assign a new value to the K-bit P0. The K-bit P0 should be assigned the

value of the leftmost K-bits of the current Ij, where j = 9999, i.e., (P1

0,

P

2

0,...,PK0) = (I1j, I2j,..., IKj).

4) Assign a new value to the I parameters. I0 should be assigned the value of

the concatenation of the rightmost (64-K) bits of Ij with the K-bit Cj, i.e.

(I1

0, I20,..., I640) = (I[K+1]j, I[K+2]j,...,I64j, C1j, C2j,...,CKj). I1 should be

assigned the value of I0+R1 mod 264 where R1 = 5555555555555555. I2

should be assigned the value of I0+R2 mod 264 where R2 =

AAAAAAAAAAAAAAAA. Note j = 9999.

NOTE -- the new P and I should be denoted as P0 and I0 because these values are used for the first pass

through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 8.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.

 5.5.2.2 The Monte Carlo Test for the Decryption Process – K-bit TCFB-P

Mode

Table 50 The Monte Carlo Test for the Decryption Process - K-bit TCFB-P Mode

TMOVS: Initialize KEY10,KEY20,KEY30, IV1, IV2, IV3, K-bit C0

Send KEY10,KEY20,KEY30, IV1, IV2, IV3, K-bit C0

IUT: FOR i = 0 TO 399
213

{

FOR j = 0 TO 9,999

{

IF (j == 0, 1, or 2) Perform

Triple DES: Ij = IV (j+1)

 ELSE

Ij = RM(64-K) (I(j-1)) || K-bit Cj-3

Ij is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oj

K-bit Pj = LMK (Oj) ⊕ K-bit Cj

K-bit Cj+1 = LMK (Oj)

}

Record I0, K-bit Pj

Send i, KEY1i, KEY2i, KEY3i, I0, I1, I2, K-bit C0 , K-bit Pj

Concatenate enough Ps together to get (length(KEY)*3) bits (192 bits)

KEY1i+1 = KEY1i ⊕ bits 129-192 of P

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, KEY3i are independent),

 KEY2i+1 = KEY2i ⊕ bits 65-128 of P

ELSE

 KEY2i+1 = KEY2i ⊕ bits 129-192 of P

IF (KEY1i=KEY2i=KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i),
214

 KEY3i+1 = KEY3i ⊕ bits 129-192 of P

ELSE

 KEY3i+1 = KEY3i ⊕ bits 1-64 of P

I0 = RM(64-K)(Ij) || K-bit Cj

I1 =I0 + R1 mod 264 where R1=5555555555555555

I2 =I0 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

K-bit C0 = LMK(Oj)

}

TMOVS: Check the IUT's output for correctness.

As summarized in Table 50, the Monte Carlo Test for the TCFB-P Decryption Process is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY10, KEY20, and KEY30, the initialization

vectors IV1, IV2, and IV3, and the K-bit C0. The IVs, and KEYs consist of 64 bits

each. The C is represented as K-bits, where K=1,...,64. IV2 is assigned the value

of IV1+R1 mod 264 where R1 = 5555555555555555. IV3 is assigned the value of

IV1+R2 mod 264 where R2 = AAAAAAAAAAAAAAAA.

b. Forwards this information to the IUT using Input Type 24.

2. The IUT should perform the following for i = 0 through 399:

a. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

IV1, IV2, IV3, and C0.

b. Perform the following for j = 0 through 9,999:

1) If j = 0, 1, or 2, assign the value of the initialization vector IVj+1 to the input

block Ij.

2) If j > 2, assign Ij with the value of the concatenation of the rightmost (64-

K) bits of I(j-1) with the K-bit Cj-3.

3) Process Ij through the DEA stage DEA1 in the encrypt state using KEY1i,

resulting in intermediate value TEMP1.
215

4) TEMP1 is fed into the DEA stage DEA2 in the decrypt state using KEY2i,

resulting in intermediate value TEMP2.

5) TEMP2 is fed into the DEA stage DEA3 in the encrypt state using KEY3i,

resulting in output block Oj.

6) Calculate the K-bit Pj by exclusive-ORing the leftmost K-bits of Oj with the

K-bit Cj.

7) Prepare for loop j+1 by assigning the K-bit Cj+1 with the value of the

leftmost K-bits of the Oj.

c. Record the current values of the input block I0 and K-bit Pj.

d. Forward all recorded values for this loop, as specified in Output Type 8, to the TMOVS.

e. In preparation for the next output loop:

1) Concatenate enough P values together to obtain (length (KEY)*3) bits of

data (192 bits).

3) Assign new values to the KEY parameters KEY1, KEY2, and KEY3. This

is accomplished by exclusive-ORing P with the KEY value to obtain the

new KEY. If the length of the P is less than 64 (the length of a DES key),

the P should be expanded in length to 64*3 (to correspond to the combined

lengths of KEY1+KEY2+KEY3) before forming the new KEY values.

This expansion should be accomplished by concatenating X of the most

current Ps together to obtain 192 bits of P. For example, if the length of the

P is 50 bits (K=50), the expanded P = (P9

9996,..., P509996, P19997 ,..., P509997,

P

1

9998,..., P509998, P19999,..., P509999).

Bits 129-192 of the expanded P will be exclusive-ORed with KEY1 to

form the new KEY1.

The calculation of the new KEY2 and KEY3 are based on the values of the

keys. . If KEY1i and KEY2i are independent and KEY3i = KEY1i, or

KEY1, KEY2 and KEY3 are independent, the new KEY2 should be

calculated by exclusive-ORing the current KEY2 with bits 65-128 of the

expanded P. If KEY1=KEY2=KEY3, the current KEY2 will be exclusiveORed with bits 129-192 of the expanded P to calculate the new KEY2.

If KEY1, KEY2, and KEY3 are independent, the new KEY3 should be

calculated by exclusive-ORing the current KEY3 with bits 1-64 of the

expanded P. Otherwise, the current KEY3 will be exclusive-ORed with

bits 129-192 of the expanded P to calculate the new KEY3.
216

3) Assign a new value to the I parameters. I0 should be assigned the value of

the concatenation of the rightmost (64-K) bits of Ij with the K-bit Cj, i.e.

(I1

0, I20,..., I640) = (I[K+1]j, I[K+2]j,...,I64j, C1j, C2j,...,CKj). I1 should be

assigned the value of I0+R1 mod 264 where R1 = 5555555555555555. I2

should be assigned the value of I0+R2 mod 264 where R2 =

AAAAAAAAAAAAAAAA. Note j = 9999.

4) Assign a new value to the K-bit C0. The K-bit C0 should be assigned the

value of the leftmost K-bits of the current Oj, where j = 9999, i.e., (C1

0,

C

2

0,...,CK0) = (O1j, O2j,..., OKj).

NOTE -- the new C and I should be denoted as C0 and I0 because these values are used for the first pass

through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 8.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
217

5.6 The Output Feedback Mode - TOFB Mode

The IUTs which implement the Output Feedback (TOFB) mode of operation are validated by

successfully completing a set of Known Answer tests and a Monte Carlo test applicable to both

IUTs supporting encryption and/or decryption. Encryption and decryption using the TOFB mode

of operation involve processing an input block through the encryption process of the specified

algorithm. Therefore, the same set of Known Answer tests and Monte Carlo test can be applied to

IUTs supporting both encryption and decryption.

The process of validating an IUT which supports the encryption and/or decryption processes of

the TOFB mode of operation involves the successful completion of the following six tests:

1. The Variable Text Known Answer Test - TOFB mode

2 The Inverse Permutation Known Answer Test - TOFB mode

3. The Variable Key Known Answer Test - TOFB mode

4. The Permutation Operation Known Answer Test - TOFB mode

5. The Substitution Table Known Answer Test - TOFB mode

6. The Monte Carlo Test - TOFB mode

An explanation of the tests for the TOFB mode follows.
218

5.6.1 The Known Answer Tests - TOFB Mode

In the following description of the Known Answer tests, TEXT refers to plaintext, and RESULT

refers to ciphertext if the IUT performs TOFB encryption. If the IUT supports TOFB decryption,

TEXT refers to ciphertext, and RESULT refers to plaintext.

5.6.1.1 The Variable TEXT Known Answer Test - TOFB Mode

Table 51 The Variable TEXT Known Answer Test - TOFB Mode

TMOVS: Initialize KEYs: KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity

set)

IV1= 8000000000000000

TEXT = 0000000000000000

Send KEY (representing KEY1, KEY2, and KEY3), IV1, TEXT

IUT: FOR i = 1 to 64

{

Ii = IVi

Perform

Triple DES: Ii is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3, resulting in Oi

RESULTi= Oi ⊕ TEXT

Send i, KEY (representing KEY1, KEY2, and KEY3), IVi, TEXT,

RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

}

TMOVS: Compare results from each loop with known answers. Use Table A.1.

As summarized in Table 51, the Variable TEXT Known Answer Test for the TOFB mode of

operation is performed as follows:
219

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit initialization vector IV1 to the basis vector containing a"1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

c. Initializes the TEXT parameter to the constant hexadecimal value 0, i.e., TEXThex

= 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 2.

2. The IUT should perform the following for i=1 through 64:

a. Assign the value of the initialization vector IVi to the input block Ii.

b. Process Ii through the three DEA stages, resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3, resulting in output block

Oi.

c. Calculate the K-bit RESULTi by exclusive-ORing the leftmost K-bits of Oi with

the K-bit TEXT.

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IVi, TEXT, and the RESULTi to the TMOVS as specified in

Output Type 2.

e. Retain the RESULT values for use with the Inverse Permutation Known Answer

Test for the TOFB Mode (Section 5.6.1.2).

f. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i+1=2,...,64.

NOTE -- This continues until every possible basis vector has been represented by the IV, i.e., 64 times. The output from the

IUT should consist of 64 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.1.
220

5.6.1.2 The Inverse Permutation Known Answer Test - TOFB Mode

Table 52 The Inverse Permutation Known Answer Test - TOFB Mode

TMOVS: Initialize KEYs:KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity

set)

TEXTi (where i=1..64)=64 RESULT values from the Variable

TEXT Known Answer Test

IV1= 8000000000000000

Send KEY (representing KEY1, KEY2, and KEY3), IV1,

TEXT1..TEXT64

IUT: FOR i = 1 to 64

{

Ii = IVi Perform

Triple

DES:

Ii is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3, resulting in Oi

RESULTi= Oi ⊕ TEXTI

Send i, KEY (representing KEY1, KEY2, and KEY3), IVi, TEXTi,

RESULTi

IVi+1 = basis vector where single "1" bit is in position i+1

TEXTi+1 = corresponding RESULTi+1 value from the TMOVS

}

TMOVS: Compare RESULT from each loop with known answers.

The TEXT should be all zeros.

As summarized in Table 52 the Inverse Permutation Known Answer Test for the TOFB mode of

operation is performed as follows:
221

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 64-bit initialization vector IV1 to the basis vector containing a"1" in

the first bit position and "0" in the following 63 positions, i.e., IV1 bin = 10000000

00000000 00000000 00000000 00000000 00000000 00000000 00000000. The

equivalent of this value in hexadecimal notation is 80 00 00 00 00 00 00 00.

c. Initializes the TEXTi (where i=1,...,64) to the RESULTi values obtained from the

Variable TEXT Known Answer Test.

d. Forwards this information to the IUT using Input Type 5.

2. The IUT should perform the following for i=1 through 64:

a. Assign the value of the initialization vector IVi to the input block Ii.

b. Process Ii through the three DEA stages resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3, resulting in output block

Oi.

c. Calculate the RESULTi by exclusive-ORing the Oi with the TEXTi.

d. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IVi, TEXTi, and the RESULTi to the TMOVS as specified in

Output Type 2.

e. Assign a new value to IVi+1 by setting it equal to the value of a basis vector with a

"1" bit in position i+1, where i+1=2,...,64.

f. Assign a new value to TEXTi+1 by setting it equal to the corresponding output

from the TMOVS.

NOTE -- This processing continues until all RESULT values from the Variable TEXT Known Answer Test have been used as

input. The output from the IUT should consist of 64 output strings. Each output string should consist of information included in

Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values. The RESULT values should be all zeros.
222

5.6.1.3 The Variable KEY Known Answer Test - TOFB Mode

Table 53 The Variable Key Known Answer Test - TOFB Mode

TMOVS: Initialize KEYs: KEY11 = KEY21 = KEY31 = 8001010101010101 (odd

parity set)

IV = 0000000000000000

TEXT = 0000000000000000

Send KEY1 (representing KEY11, KEY21, and KEY31), IV, TEXT

IUT: FOR i = 1 to 64

{

IF (i mod 8 ≠ 0) {process all bits except parity bits}

{

Ii = IV Perform

Triple

DES:

Ii is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oi

RESULTi= Oi ⊕ TEXT

Send i, KEYi (representing KEY1i,KEY2i, and KEY3i), IV, TEXT,

RESULTi

KEY1i+1 = KEY2i+1 = KEY3i+1 = vector consisting of "0" in every

significant bit position except for a single "1" bit in position i+1.

Each parity bit may have the value "1" or "0" to make the KEY odd

parity.

}

}

TMOVS: Compare results of the 56 encryptions with known answers. Use Table A.2.
223

As summarized in Table 53, the Variable Key Known Answer Test for the TOFB mode is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initializes the TEXT to the constant hexadecimal value 0, i.e., TEXThex = 00 00 00

00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 2.

2. The IUT should perform the following for i = 1 to 56:

NOTE -- 56 is the number of significant bits in a TDES key.

a. Assign the value of the initialization vector IV to the input block Ii.

b. Process Ii through the three DEA stages resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3i, resulting in output block

Oi.

c. Calculate the RESULTi by exclusive-ORing the Oi with the TEXT.

d. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV, TEXT, and the resulting RESULTi to the TMOVS as

specified in Output Type 2.

e. Set KEY1i+1, KEY2i+1, KEY3i+1 equal to the vector consisting of “0" in every

significant bit position except for a single “1" bit in position i+1. The parity bits

contain “1" or “0" to make odd parity.

NOTE -- This processing should continue until every significant basis vector has been represented by the KEY parameters. The

output from the IUT should consist of 56 output strings. Each output string should consist of information included in Output

Type 2.
224

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.2.
225

5.6.1.4 The Permutation Operation Known Answer Test - TOFB Mode

Table 54 The Permutation Operation Known Answer Test - TOFB Mode

TMOVS: Initialize KEY1i=KEY2i=KEY3i (where i=1..32) = 32 KEY values in

Table A.3

IV = 0000000000000000

TEXT = 0000000000000000

Send TEXT, IV, KEY1, KEY2,..., KEY32 (Since all three keys are the

same, these key values represent the values of KEY1, KEY2, and

KEY3.)

IUT: FOR i = 1 to 32

{

Ii = IV

Perform

Triple DES: Ii is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oi

RESULTi= Oi ⊕ TEXT

Send i, KEYi (representing KEY1i,KEY2i, and KEY3i), IV, TEXT,

RESULTi

KEY1i+1 = KEY2i+1 = KEY3i+1 = Corresponding KEYi+1 in Table A.3

}

TMOVS: Compare results with known answers. Use Table A.3.

As summarized in Table 54, the Permutation Operation Known Answer Test for the TOFB mode

of operation is performed as follows:

1. The TMOVS:

a. Initializes the KEY1i, KEY2i, and KEY3i variables with the 32 constant KEY

values from Table A.3.
226

b. Initializes the 64-bit IV parameter to the constant hexadecimal value 0, i.e., IVhex =

00 00 00 00 00 00 00 00.

c. Initializes the TEXT to the constant hexadecimal value 0, i.e., TEXThex = 00 00 00

00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 8.

2. The IUT should perform the following for i=1 through 32:

a. Assign the value of the initialization vector IV to the input block Ii.

b. Process Ii through the three DEA stages resulting in a 64-bit output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3i, resulting in output block

Oi.

c. Calculate the RESULTi by exclusive-ORing the Oi with the TEXT.

d. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV, TEXT, and the RESULTi to the TMOVS as specified in

Output Type 2.

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 supplied

by the TMOVS.

NOTE --The above processing should continue until all 32 KEY values are processed. The output from the IUT for this test

should consist of 32 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.3.
227

5.6.1.5 The Substitution Table Known Answer Test - TOFB Mode

Table 55 The Substitution Table Known Answer Test - TOFB Mode

TMOVS: Initialize KEY1i, KEY2i, KEY3i (where i=1..19) = 19 KEY values in

Table A.4

IVi (where i=1..19) = 19 corresponding DATA values in Table

A.4

TEXT = 0000000000000000

Send TEXT, KEY1, IV1, KEY2, IV2,...,KEY19, IV19 (Since all three

keys are the same, these key values represent the values of

KEY1, KEY2, and KEY3.)

IUT: FOR i = 1 to 19

{

Ii = IVi Perform

Triple

DES:

Ii is read into TDEA and is encrypted by DEA1 using KEY1i, resulting

in TEMP1

TEMP1is decrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oi

RESULTi= Oi ⊕ TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IVi, TEXT,

RESULTi

KEY1i+1 =KEY2i+1 = KEY3i+1 = KEYi+1 from TMOVS

IVi+1 = corresponding DATAi+1 from TMOVS

}

TMOVS: Compare results from each loop with known answers. Use Table A.4.

As summarized in Table 55, the Substitution Table Known Answer Test for the TOFB mode of

operation is performed as follows:

1. The TMOVS:
228

a. Initializes the KEY-IV pairs with the 19 constant KEY-DATA values from Table

A.4. The DATA values are assigned to the values of the initialization vectors IVs.

The KEY value indicates the value of KEY1, KEY2 and KEY3, i.e.,

KEY1=KEY2=KEY3.

b. Initializes the TEXT parameter to the constant hexadecimal value 0, i.e., TEXThex

= 00 00 00 00 00 00 00 00.

c. Forwards this information to the IUT using Input Type 11.

2. The IUT should perform the following for i=1 through 19:

a. Assign the value of the initialization vector IVi to the input block Ii.

b. Process Ii through the three DEA stages, resulting in an output block Oi. This

involves processing Ii through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed directly

into the second DEA stage, denoted DEA2, in the decrypt state using KEY2i,

resulting in intermediate value TEMP2. TEMP2 is fed directly into the third DEA

stage, denoted DEA3, in the encrypt state using KEY3i, resulting in output block

Oi.

c. Calculate the RESULTi by exclusive-ORing the Oi with the TEXT.

d. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IVi, TEXT, and the RESULTi to the TMOVS as specified in

Output Type 2.

e. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 value

supplied by the TMOVS.

f. Set IVi+1 equal to the corresponding DATAi+1 value supplied by the TMOVS.

NOTE -- The above processing should continue until all 19 KEY-DATA pairs are processed. The output from the IUT for this

test should consist of 19 output strings. Each output string should consist of information included in Output Type 2.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.4.
229

5.6.2 The Monte Carlo Test - TOFB Mode

The TOFB mode has one Monte Carlo test that is used regardless of process, i.e., the same

Monte Carlo test is used for IUTs supporting the encryption and/or decryption processes.

Table 56 The Monte Carlo Test - TOFB Mode

TMOVS: Initialize KEY10,KEY20, KEY30, IV, TEXT0

Send KEY10,KEY20, KEY30, IV, TEXT0

IUT: FOR i = 0 TO 399

{

(Part of

Triple DES

processing):

If (i==0) I0 = IV

Record i, KEY1i, KEY2i, KEY3i, TEXT0

INITTEXT = TEXT0

FOR j = 0 TO 9,999

{

Ij is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1 Perform

Triple DES: TEMP1 is decrypted by DEA2 using KEY2i, resulting in

TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oj

RESULTj = Oj ⊕ TEXTj

TEXTj+1 = Ij

(Part of

Triple DES

processing):

Ij+1 = Oj

}

Record I0, RESULTj
230

Send i,KEY1i,KEY2i, KEY3i, I0, TEXT0, RESULTj

KEY1i+1 = KEY1i ⊕ RESULTj

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or

(KEY1i, KEY2i, and KEY3i are independent)

 KEY2i+1= KEY2i ⊕ RESULTj-1

ELSE

 KEY2i+1= KEY2i ⊕ RESULTj

IF (KEY1i= KEY2i= KEY3i) or (KEY1i and KEY2i are independent

and KEY3i = KEY1i)

 KEY3i+1= KEY3i ⊕ RESULTj

ELSE

 KEY3i+1= KEY3i ⊕ RESULTj-2

TEXT0 = INITTEXT ⊕ Ij

I0 = Oj

}

TMOVS: Check IUT's output for correctness.

As summarized in Table 56, the Monte Carlo Test for the TOFB mode of operation is performed

as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY10, KEY20, and KEY30, the initialization

vector IV, and the TEXT0 variables. All variables consist of 64 bits each.

b. Forwards this information to the IUT using Input Type 21.

2. The IUT should perform the following for i = 0 through 399:

a. If i=0 (if this is the first time through this loop), assign the value of the

initialization vector IV to the input block I0.
231

b. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

and the TEXT0.

c. Assign the value of TEXT0 to INITTEXT. This will contain the initial value of the

text from every j = 0 loop.

d. Perform the following for j = 0 through 9999:

1) Using the corresponding KEY1i,KEY2i, and KEY3i values, process Ij

through the three DEA stages resulting in output block Oj. This involves

processing Ij through the first DEA stage, denoted DEA1, in the encrypt

state using KEY1i, resulting in intermediate value TEMP1. TEMP1 is fed

directly into the second DEA stage, denoted DEA2, in the decrypt state

using KEY2i, resulting in intermediate value TEMP2. TEMP2 is fed

directly into the third DEA stage, denoted DEA3, in the encrypt state using

KEY3i, resulting in output block Oj.

2) Calculate the RESULTj by exclusive-ORing the Oj with the TEXTj.

3) Prepare for loop j+1 by doing the following:

a) Assign the TEXTj+1 with the value of the Ij.

b) Assign Ij+1 with the value of the Oj.

e. Record the RESULTj and the I0.

f. Forward all recorded information for this loop, as specified in Output Type 6, to

the TMOVS.

g. In preparation for the next output loop (note j = 9999):

1) Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop.

The new KEY1i+1 should be calculated by exclusive-ORing the current

KEY1i with the RESULTj.

The new KEY2i+1 calculation is based on the values of the keys. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and

KEY3i are independent, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the RESULTj-1. If

KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the RESULTj.

The new KEY3i+1 calculation is also based on the values of the keys. If

KEY1i, KEY2i, and KEY3i are independent, the new KEY3i+1 should be
232

calculated by exclusive-ORing the current KEY3i with the RESULTj-2. If

KEY1i and KEY2i are independent and KEY3i = KEY1i, or if

KEY1i=KEY2i=KEY3i, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the RESULTj.

2) Assign a new value to the TEXT0. The TEXT0 should be assigned the

value of INITTEXT exclusive-ORed with Ij.

3) Assign a new value to I0. I0 should be assigned the value of the Oj.

NOTE -- the new TEXT and I should be denoted as TEXT0 and I0 because these values are used

for the first pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 6.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values.
233

5.7 The Output Feedback Interleaved (OFB-I) Mode

The IUTs which implement the Output Feedback Interleaved (OFB-I) mode are validated by

successfully completing a set of Known Answer tests and a Monte Carlo test applicable to both

IUTs supporting encryption and/or decryption. Encryption and decryption using the TOFB-I

mode of operation involve initializing the three individual DEA stages and then simultaneously

clocking them. This improves the throughput and minimizes the propagation delay. Each clock

cycle involves the data being processed by each DEAi stage and passing it onward to the output

buffer or the next stage so that idle DEAi stages are minimized. The pipelined configuration is

intended for systems equipped with multiple DEA processors. The same set of Known Answer

tests and Monte Carlo test can be applied to IUTs supporting both encryption and decryption

because the same sequence of encrypt with KEY1, decrypt with KEY2 and encrypt with KEY3 is

used for both encryption and decryption.

The processing for each Known Answer test and Monte Carlo test is broken down into clock

cycles T1, T2, T3,.... Within each clock cycle, the processing occurring on each active DEA is

discussed. For convenience, let KEY1 represent the key used on processor DEA1, KEY2

represent the key used on processor DEA2, and KEY3 represent the key used on processor

DEA3.

The process of validating an IUT which supports the TOFB-I mode of operation in the encryption

and/or the decryption processes involves the successful completion of the following six tests:

1. The Variable Text Known Answer Test - TOFB-I mode

2. The Inverse Permutation Known Answer Test - TOFB-I mode

3. The Variable Key Known Answer Test - TOFB-I mode

4. The Permutation Operation Known Answer Test - TOFB-I mode

5. The Substitution Table Known Answer Test - TOFB-I mode

6. The Monte Carlo Test - TOFB-I mode

An explanation of the tests for the TOFB-I mode follows.

5.7.1 The Known Answer Tests - TOFB-I Mode

In the following description of the Known Answer tests, TEXT refers to plaintext, and RESULT

refers to ciphertext if the IUT performs TOFB-I encryption. If the IUT supports TOFB-I

decryption, TEXT refers to ciphertext, and RESULT refers to plaintext.
234

5.7.1.1 The Variable TEXT Known Answer Test - TOFB-I Mode

Table 57 The Variable TEXT Known Answer Test - TOFB-I Mode

TMOVS: Initialize KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV11 = 8000000000000000

IV21 = D555555555555555

IV31 = 2AAAAAAAAAAAAAAA

TEXT = 0

Send KEY (representing KEY1, KEY2, and KEY3), IV11 , IV21 , IV31 ,

TEXT

IUT: FOR i = 1 to 64

{

With feedback path disconnected:

Perform T1: I1 = IV1i

Triple DES:

I1 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP11

T2: I2 = IV2i

I2 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3 = IV3i

I3 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2, resulting in

TEMP22

Connect the feedback path:

TEMP12 is encrypted by DEA3 using KEY3, resulting in O1i
235

RESULT1i = O1i ⊕ TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3, resulting in O2i

RESULT2i = O2i ⊕ TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3, resulting in O3i

RESULT3i = O3i ⊕ TEXT

Send i, KEY (representing KEY1, KEY2, and KEY3), I1, I2, I3, TEXT,

RESULT1i, RESULT2i, RESULT3i

IV1i+1 = basis vector where single "1" bit is in position i+1

IV2i+1 = IV1i+1 + R1 mod 264 where R1=5555555555555555

IV3i+1 = IV1i+1 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

}

TMOVS: Compare RESULT1, RESULT2, and RESULT3 from each loop with known

answers. See Table A.9.

As summarized in Table 57, the Variable TEXT Known Answer Test for the TOFB-I mode is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 3 initialization vectors accordingly: IV11 is set to the basis vector

containing a"1" in the first bit position and "0" in the following 63 positions, i.e.,

IV1 bin = 10000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000. The equivalent of this value in hexadecimal notation is 80 00 00 00 00

00 00 00. Based on specifications in ANSI X9.52-1998, IV21 is computed by the

following equation: IV11 + R1 mod 264 where R1=5555555555555555. In

hexadecimal, this equates to D5 55 55 55 55 55 55 55. And IV31 is computed by

the equation IV11 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA. In

hexadecimal, this equates to 2A AA AA AA AA AA AA AA.
236

c. Initializes the TEXT parameter to the constant hexadecimal value 0, i.e., TEXThex

= 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 13.

2. The IUT should perform the following for i=1 through 64:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1i to the input block I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP11.

2) At time T2:

a) Assign the value of the initialization vector IV2i to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP12.

3) At time T3:

a) Assign the value of the initialization vector IV3i to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3, resulting in output block O1i.

e) Calculate the RESULT1i by exclusive-ORing O1i with TEXT1i.

At time T4:
237

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O2i.

b) Calculate RESULT2i by exclusive-ORing O2i with TEXT2i.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O3i.

b) Calculate the RESULT3i by exclusive-ORing O3i with TEXT3i.

b. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV1i, IV2i, IV3i, TEXT, RESULT1i, RESULT2i, and

RESULT3i, to the TMOVS as specified in Output Type 7.

c. Retain the RESULT1, RESULT2, and RESULT3 values for use with the Inverse

Permutation Known Answer Test for the TOFB-I Mode (Section 5.7.1.2).

d. Assign a new value to the IV variables. IV1i+1 is set to the value of a basis vector

with a "1" bit in position i+1, where i+1=2,...,64. IV2i+1 is set to the value of IV1i+1

+ R1 mod 264 where R1=5555555555555555. And IV3i+1 is set to IV1i+1 + R2 mod

2

64 where R2=AAAAAAAAAAAAAAAA.

NOTE -- This continues until every possible basis vector has been represented by the IV1, i.e., 64 times. The output from the

IUT should consist of 64 output strings. Each output string should consist of information included in Output Type 7.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.9.
238

5.7.1.2 The Inverse Permutation Known Answer Test - TOFB-I Mode

Table 58 The Inverse Permutation Known Answer Test - TOFB-I Mode

TMOVS: Initialize KEY1 = KEY2 = KEY3 = 0101010101010101 (odd parity set)

IV11 = 8000000000000000

IV21 = D555555555555555

IV31 = 2AAAAAAAAAAAAAAA

TEXTri (where r=1..3 and i=1..64) = 64 corresponding RESULTri

values from Variable TEXT Known Answer Test

Send KEY (representing KEY1, KEY2, and KEY3), IV11, IV21, IV31

TEXT11,...,TEXT164, TEXT21,...,TEXT264, TEXT31,...,TEXT364

IUT: FOR i = 1 to 64

{

With the feedback path disconnected:

Perform T1: I1 = IV1i

Triple DES:

I1 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP11

T2: I2 = IV2i

I2 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2, resulting in

TEMP12

T3: I3 = IV3i

I3 is read into TDEA and is encrypted by DEA1 using KEY1,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2, resulting in

TEMP22

Connect the feedback path:

TEMP12 is encrypted by DEA3 using KEY3, resulting in O1i
239

RESULT1i = O1i ⊕ TEXT1i

T4: TEMP31 is decrypted by DEA2 using KEY2, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3, resulting in O2i

RESULT2i = O2i ⊕ TEXT2i

T5: TEMP32 is encrypted by DEA3 using KEY3, resulting in O3i

RESULT3i = O3i ⊕ TEXT3i

Send i, KEY (representing KEY1, KEY2, and KEY3), I1, I2, I3, TEXT1i,

TEXT2i, TEXT3i, RESULT1i, RESULT2i, RESULT3i

IV1i+1 = basis vector where single "1" bit is in position i+1

IV2i+1 = IV1i + R1 mod 264 where R1=5555555555555555

IV3i+1 = IV1i + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

TEXTri+1 (where r = 1..3)= corresponding RESULTri+1 value from the

TMOVS

}

TMOVS: Compare RESULT1, RESULT2, and RESULT3 from each loop with known

answers.

They should be all zeros.

As summarized in Table 58 the Inverse Permutation Known Answer Test for the TOFB-I mode is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 to the constant

hexadecimal value 0 with odd parity set, i.e., KEY1hex=KEY2hex=KEY3hex=01 01

01 01 01 01 01 01.

b. Initializes the 3 initialization vectors accordingly: IV11 is set to the basis vector

containing a"1" in the first bit position and "0" in the following 63 positions, i.e.,

IV1 bin = 10000000 00000000 00000000 00000000 00000000 00000000 00000000

00000000. The equivalent of this value in hexadecimal notation is 80 00 00 00 00

00 00 00. Based on specifications in ANSI X9.52-1998, IV21 is computed by the
240

following equation: IV11 + R1 mod 264 where R1=5555555555555555. In

hexadecimal, this equates to D5 55 55 55 55 55 55 55. And IV31 is computed by

the equation IV11 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA. In

hexadecimal, this equates to 2A AA AA AA AA AA AA AA.

c. Initializes the TEXTri (where r=1,...,3 and i=1,...,64) to the RESULTri obtained

from the Variable TEXT Known Answer Test.

d. Forwards this information to the IUT using Input Type 15.

2. The IUT should perform the following for i=1 through 64:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1i to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP11.

2) At time T2:

a) Assign the value of the initialization vector IV2i to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP12.

3) At time T3:

a) Assign the value of the initialization vector IV3i to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3, resulting in output block O1i.
241

e) Calculate the RESULT1i by exclusive-ORing O1i with TEXT1i.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O2i.

b) Calculate the RESULT2i by exclusive-ORing O2i with TEXT2i.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3, resulting in output block O3i.

b) Calculate the RESULT3i by exclusive-ORing O3i with TEXT3i.

b. Forward the current values of the loop number i, KEY (representing KEY1,

KEY2, and KEY3), IV1i, IV2i, IV3i, TEXT1i, TEXT2i, TEXT3i, RESULT1i,

RESULT2i, and RESULT3i, to the TMOVS as specified in Output Type 3.

c. Assign a new value to the IV variables. IV1i+1 is set to the value of a basis vector with

a "1" bit in position i+1, where i+1=2,...,64. IV2i+1 is set to the value of IV1i+1 + R1

mod 264 where R1=5555555555555555. And IV3i+1 is set to IV1i+1 + R2 mod 264

where R2=AAAAAAAAAAAAAAAA.

d. Assign a new value to the TEXT1i+1, TEXT2i+1, and TEXT3i+1 by setting it equal to

the corresponding output from the TMOVS.

NOTE -- This continues until every RESULT1, RESULT2, and RESULT3 value from the Variable TEXT Known Answer Test

has been used as input. The output from the IUT should consist of 64 output strings. Each output string should consist of

information included in Output Type 3.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values. The RESULT1, RESULT2, and RESULT3 values should be all zeros.
242

5.7.1.3 The Variable KEY Known Answer Test - TOFB-I Mode

Table 59 The Variable KEY Known Answer Test - TOFB-I Mode

TMOVS: Initialize KEY11 = KEY21 = KEY31 = 8001010101010101 (odd parity set)

IV1 = 0000000000000000

IV2 = 5555555555555555

IV3 = AAAAAAAAAAAAAAAA

TEXT = 0

Send KEY1 (representing KEY11, KEY21, and KEY31), IV1, IV2, IV3,

TEXT

IUT: FOR i = 1 to 64

IF (i mod 8 ≠ 0){process all bits except parity bits}

{

With the feedback path disconnected:

T1: I1 = IV1 Perform

Triple

DES: I1 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP11

T2: I2 = IV2

I2 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3 = IV3

I3 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2i, resulting in

TEMP22

Connect the feedback path:
243

TEMP12 is encrypted by DEA3 using KEY3i, resulting in O1i

RESULT1i = O1i ⊕ TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in O2i

RESULT2i = O2i ⊕ TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in O3i

RESULT3i = O3i ⊕ TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), I1, I2, I3, TEXT,

RESULT1i, RESULT2i, RESULT3i

KEY1i+1 = KEY2 i+1 = KEY3 i+1= vector consisting of “0” in every

significant bit position except for a single “1” bit in position i+1. Each parity

bit may have the value “1” or “0” to make the KEY odd parity.

}

TMOVS: Compare results of the 56 encryptions with known answers.

See Table A.11.

As summarized in Table 59, the Variable KEY Known Answer Test for the TOFB-I Mode is

performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY11, KEY21, and KEY31 to contain "0" in every

significant bit except for a "1" in the first position, i.e., the 64-bit KEY11 bin=

KEY21 bin= KEY31 bin= 10000000 00000001 00000001 00000001 00000001

00000001 00000001 00000001. The equivalent of this value in hexadecimal

notation is 80 01 01 01 01 01 01 01.

NOTE -- the parity bits are set to "0" or "1" to get odd parity.

b. Initializes the 3 initialization vectors accordingly: IV1 is set to zero, i.e., IV1 hex =

00 00 00 00 00 00 00 00. Based on specifications in ANSI X9.52-1998, IV2 is

computed as IV1 + R1 mod 264 where R1 = 5555555555555555 and IV3 is

computed as IV1 + R2 mod 264 where R2 = AAAAAAAAAAAAAAAA. Since
244

IV1hex = 0000000000000000, this equates to IV2hex = 5555555555555555 and

IV3hex = AAAAAAAAAAAAAAAA.

c. Initializes the TEXT parameter to the constant hexadecimal value 0, i.e., TEXThex

= 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 13.

2. The IUT should perform the following for i=1 through 64:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1 to the input block I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP11.

2) At time T2:

a) Assign the value of the initialization vector IV2 to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP12.

3) At time T3:

a) Assign the value of the initialization vector IV3 to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3i, resulting in output block O1i.

e) Calculate the RESULT1i by exclusive-ORing O1i with TEXT.
245

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O2i.

b) Calculate the RESULT2i by exclusive-ORing O2i with TEXT.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2i, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O3i.

b) Calculate the RESULT3i by exclusive-ORing O3i with TEXT.

b. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV1, IV2, IV3, TEXT, RESULT1i, RESULT2i, and

RESULT3i, to the TMOVS as specified in Output Type 7.

c. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the vector consisting of “0” in every

significant bit position except for a single “1” bit in position i+1. The parity bits

contain “1” or “0” to make odd parity.

NOTE -- This processing should continue until every significant basis vector has been represented by the KEY parameters. The

output from the IUT should consist of 56 output strings. Each output string should consist of information included in Output

Type 7.

3. The TMOVS checks the IUT’s output for correctness by comparing the received results

to the known values found in Table A.11.
246

5.7.1.4 The Permutation Operation Known Answer Test - TOFB-I Mode

Table 60 The Permutation Operation Known Answer Test - TOFB-I Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i=1..32) = 32 KEY values in

Table A.12

IV1= 0000000000000000

IV2 =5555555555555555

IV3 =AAAAAAAAAAAAAAAA

TEXT = 0

Send IV1, IV2, IV3, TEXT, KEY1, KEY2,...,KEY32 (Since all three keys

are the same, these key values represent the values of KEY1,

KEY2, and KEY3.)

IUT: FOR i = 1 to 32

{

With the feedback path disconnected:

T1: I1 = IV1 Perform

Triple

DES: I1 is read into TDEA and is encrypted by DEA using KEY1i,

resulting in TEMP11

T2: I2 = IV2

I2 is read into TDEA and is encrypted by DEA using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA using KEY2i, resulting in

TEMP12

T3: I3 = IV3

I3 is read into TDEA and is encrypted by DEA using KEY1i,

resulting in TEMP31

TEMP21 is decrypted by DEA using KEY2i, resulting in

TEMP22

Connect the feedback path:
247

TEMP12 is encrypted by DEA using KEY3i, resulting in O1i

RESULT1i = O1i ⊕ TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in O2i

RESULT2i = O2i ⊕ TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in O3i

RESULT3i = O3i ⊕ TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), I1, I2, I3, TEXT,

RESULT1i, RESULT2i, RESULT3i

KEY1i+1 = KEY2i+1 = KEY3i+1= corresponding KEYi+1 from TMOVS.

TMOVS: Compare results from each loop with known answers.

See Table A.12.

As summarized in Table 60, the Permutation Operation Known Answer Test for the TOFB-I

Mode is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY1, KEY2, and KEY3 with the 32 constant

KEY values from Table A.12.

b. Initializes the 3 initialization vectors accordingly: IV1 is assigned the value 0, i.e.,

IV hex = 00 00 00 00 00 00 00 00. Based on specifications in ANSI X9.52-1998,

IV2 is computed by the following equation: IV1 + R1 mod 264 where

R1=5555555555555555. In hexadecimal, this equates to 55 55 55 55 55 55 55 55.

And IV3 is computed by the equation IV1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA. In hexadecimal, this equates to AA AA AA AA

AA AA AA AA.

c. Initializes the TEXT parameter to the constant hexadecimal value 0, i.e., TEXThex

= 00 00 00 00 00 00 00 00.

d. Forwards this information to the IUT using Input Type 18.

2. The IUT should perform the following for i=1 through 32:
248

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1 to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP11.

At time T2:

a) Assign the value of the initialization vector IV2 to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP12.

At time T3:

a) Assign the value of the initialization vector IV3 to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3i, resulting in output block O1i.

e) Calculate the RESULT1i by exclusive-ORing O1i with TEXT.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O2i.

b) Calculate the RESULT2i by exclusive-ORing O2i with TEXT.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2i, resulting in intermediate value TEMP32.
249

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O3i.

b) Calculate the RESULT3i by exclusive-ORing O3i with TEXT.

b. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV1, IV2, IV3, TEXT, RESULT1i, RESULT2i, and

RESULT3i, to the TMOVS as specified in Output Type 7.

c. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 supplied

by the TMOVS.

NOTE -- The above processing should continue until all 32 KEY values are processed. The output from the IUT for this test

should consist of 32 output strings. Each output string should consist of information included in Output Type 7.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found Table A.12.
250

5.7.1.5 The Substitution Table Known Answer Test - TOFB-I Mode

Table 61 The Substitution Table Known Answer Test - TOFB-I Mode

TMOVS: Initialize KEY1i = KEY2i = KEY3i (where i=1..19) = 19 KEY values in

Table A.10

IV1i (where i=1..19) = 19 corresponding TEXT values in Table

A.10

IV2i = IV1i + R1 mod 264 where R1=5555555555555555

IV3i = IV1i + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

TEXT = 0

Send IV1i, IV2i, IV3i, TEXT, KEY1, KEY2,...,KEY19 (These key values

represent the values of KEY1, KEY2, and KEY3.)

IUT: FOR i = 1 to 19

{

With the feedback path disconnected:

Perform T1: I1 = IV1i

Triple DES:

I1 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP11

T2: I2 = IV2i

I2 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP21

TEMP11 is decrypted by DEA2 using KEY2i, resulting in

TEMP12

T3: I3 = IV3i

I3 is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP31

TEMP21 is decrypted by DEA2 using KEY2i, resulting in

TEMP22

Connect the feedback path:
251

TEMP12 is encrypted by DEA3 using KEY3i, resulting in O1i

RESULT1i = O1i ⊕ TEXT

T4: TEMP31 is decrypted by DEA2 using KEY2i, resulting in

TEMP32

TEMP22 is encrypted by DEA3 using KEY3i, resulting in O2i

RESULT2i = O2i ⊕ TEXT

T5: TEMP32 is encrypted by DEA3 using KEY3i, resulting in O3i

RESULT3i = O3i ⊕ TEXT

Send i, KEYi (representing KEY1i, KEY2i, and KEY3i), IV1i, IV2i, IV3i,

TEXT, RESULT1i, RESULT2i, RESULT3i

KEY1i+1 = KEY2i+1 = KEY3i+1= Corresponding KEYi+1 from TMOVS

IV1i+1= corresponding DATAi+1 from TMOVS

IV2i+1 = IV1i+1 + R1 mod 264 where R1=5555555555555555

IV3i+1 = IV1i+1 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

}

TMOVS: Compare results from each loop with known answers.

See Table A.10.

As summarized in Table 61, the Substitution Table Known Answer Test for the TCFB-P Mode is

performed as follows:

1. The TMOVS:

a. Initializes the KEY-IV1 pairs with the 19 constant KEY-DATA values from Table

A.10. The DATA values are assigned to the values of the initialization vectors

IV1i. The KEY value indicates the values of KEY1i, KEY2i, and KEY3i, i.e.,

KEY1i=KEY2i=KEY3i. Based on specifications in ANSI X9.52-1998, IV2i is

computed as IV1i + R1 mod 264 where R1 = 5555555555555555 and IV3i is

computed as IV1i + R2 mod 264 where R2 = AAAAAAAAAAAAAAAA.

b. Initializes the TEXT parameter to the constant hexadecimal value 0, i.e., TEXThex

= 00 00 00 00 00 00 00 00.
252

c. Forwards this information to the IUT using Input Type 25.

2. The IUT should perform the following for i=1 through 19:

a. With the feedback path disconnected:

1) At time T1:

a) Assign the value of the initialization vector IV1i to the input block

I1.

b) Process I1 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP11.

At time T2:

a) Assign the value of the initialization vector IV2i to the input block

I2.

b) Process I2 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP21.

c) TEMP11 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP12.

At time T3:

a) Assign the value of the initialization vector IV3i to the input block

I3.

b) Process I3 through the DEA stage DEA1 in the encrypt state using

KEY1i, resulting in intermediate value TEMP31.

c) TEMP21 is fed into the DEA stage DEA2 in the decrypt state using

KEY2i, resulting in intermediate value TEMP22.

Connect the feedback path:

d) TEMP12 is fed into the DEA stage DEA3 in the encrypt state using

KEY3i, resulting in output block O1i.

e) Calculate the RESULT1i by exclusive-ORing O1i with TEXT.

At time T4:

a) TEMP22 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O2i.
253

b) Calculate RESULT2i by exclusive-ORing O2i with TEXT.

c) TEMP31 is fed into the DEA stage DEA2 in the decrypt 

state using KEY2i, resulting in intermediate value TEMP32.

At time T5:

a) TEMP32 is fed into the DEA stage DEA3 in the encrypt 

state using KEY3i, resulting in output block O3i.

b) Calculate the RESULT3i by exclusive-ORing O3i with TEXT.

b. Forward the current values of the loop number i, KEYi (representing KEY1i,

KEY2i, and KEY3i), IV1i, IV2i, IV3i, TEXT, RESULT1i, RESULT2i, and

RESULT3i, to the TMOVS as specified in Output Type 7.

c. Set KEY1i+1, KEY2i+1, and KEY3i+1 equal to the corresponding KEYi+1 supplied

by the TMOVS.

d. Set IV1i+1 equal to the corresponding DATAi+1 supplied by the TMOVS. Based on

specifications in ANSI X9.52-1998, IV2i+1 is set to IV1i+1 + R1 mod 264 where

R1=5555555555555555 and IV3i+1 is set to IV1i+1 + R2 mod 264 where

R2=AAAAAAAAAAAAAAAA.

NOTE -- The above processing should continue until all 19 KEY-DATA are processed. The output from the IUT for this test

should consist of 19 output strings. Each output string should consist of information included in Output Type 7.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

the known values found in Table A.10.
254

5.7.2 The Monte Carlo Tests - TOFB-I Mode

The TOFB-I mode of operation has one Monte Carlo test that is used regardless of the process,

i.e., the same Monte Carlo test is used for IUTs supporting the encryption and/or decryption

process. In the following description of the Monte Carlo test, TEXT refers to plaintext, and

RESULT refers to ciphertext if the IUT performs TOFB-I encryption. If the IUT supports TOFBI decryption, TEXT refers to ciphertext, and RESULT refers to plaintext.

Table 62 The Monte Carlo Test - TOFB-I Mode

TMOVS: Initialize KEY10,KEY20,KEY30, IV1, IV2, IV3, TEXT0

Send KEY10,KEY20,KEY30, IV1, IV2, IV3, TEXT0

IUT: FOR i = 0 TO 399

{

FOR j = 0 TO 9,999

{

IF (j == 0, 1, or 2)

 Ij = IV(j+1)

Perform

Triple DES:

ELSE

 Ij=Oj-2

Ij is read into TDEA and is encrypted by DEA1 using KEY1i,

resulting in TEMP1

TEMP1 is decrypted by DEA2 using KEY2i, resulting in TEMP2

TEMP2 is encrypted by DEA3 using KEY3i, resulting in Oj

RESULTj = Oj ⊕ TEXTj

TEXTj+1 = Ij

}

Record I0, RESULTj

Send i, KEY1i, KEY2i, KEY3i, I0, I1, I2, TEXT0 , RESULTj
255

KEY1i+1 = KEY1i ⊕ RESULTj

IF (KEY1i and KEY2i are independent and KEY3i = KEY1i) or (KEY1i,

KEY2i, and KEY3i are independent)

 KEY2i+1= KEY2i ⊕ RESULTj-1

ELSE

 KEY2i+1= KEY2i ⊕ RESULTj

IF (KEY1i= KEY2i= KEY3i) or (KEY1i and KEY2i are independent and

KEY3i = KEY1i)

 KEY3i+1= KEY3i ⊕ RESULTj

ELSE

 KEY3i+1= KEY3i ⊕ RESULTj-2

TEXT0 = TEXT0 ⊕ Ij

I0 = Oj

I1 =I0 + R1 mod 264 where R1=5555555555555555

I2 =I0 + R2 mod 264 where R2=AAAAAAAAAAAAAAAA

}

TMOVS: Check the IUT's output for correctness.

As summarized in Table 62, the Monte Carlo Test for the TOFB-I is performed as follows:

1. The TMOVS:

a. Initializes the KEY parameters KEY10, KEY20, and KEY30, the initialization

vectors IV1, IV2, and IV3, and the TEXT0. The TEXT, IVs, and KEYs consist of

64 bits each. IV2 is assigned the value of IV1+R1 mod 264 where R1 =

5555555555555555. IV3 is assigned the value of IV1+R2 mod 264 where R2 =

AAAAAAAAAAAAAAAA.

b. Forwards this information to the IUT using Input Type 24.

2. The IUT should perform the following for i = 0 through 399:
256

a. Record the current values of the output loop number i, KEY1i, KEY2i, KEY3i,

IV1, IV2, IV3, and TEXT0.

b. Perform the following for j = 0 through 9,999:

1) If j = 0, 1, or 2, assign the value of the initialization vector IV(j+1) to the

input block Ij.

2) If j > 2, assign Ij with the value of the output block O(j-2).

3) Process Ij through the DEA stage DEA1 in the encrypt state using KEY1i,

resulting in intermediate value TEMP1.

4) TEMP1 is fed into the DEA stage DEA2 in the decrypt state using KEY2i,

resulting in intermediate value TEMP2.

5) TEMP2 is fed into the DEA stage DEA3 in the encrypt state using KEY3i,

resulting in output block Oj.

6) Calculate the RESULTj by exclusive-ORing the Oj with the TEXTj.

7) Prepare for loop j+1 by assigning the TEXTj+1 with the value of the Ij.

c. Record the current values of the input block I0 and RESULTj.

d. Forward all recorded values for this loop, as specified in Output Type 8, to the

MOVS.

e. In preparation for the next output loop:

1) Assign new values to the KEY parameters, KEY1, KEY2, and KEY3 in

preparation for the next outer loop.

The new KEY1i+1 should be calculated by exclusive-ORing the current

KEY1i with the RESULTj.

The new KEY2i+1 calculation is based on the values of the keys. If KEY1i

and KEY2i are independent and KEY3i = KEY1i, or KEY1i, KEY2i, and

KEY3i are independent, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the RESULTj-1. If

KEY1i=KEY2i=KEY3i, the new KEY2i+1 should be calculated by

exclusive-ORing the current KEY2i with the RESULTj.

The new KEY3i+1 calculation is also based on the values of the keys. If

KEY1i, KEY2i, and KEY3i are independent, the new KEY3i+1 should be

calculated by exclusive-ORing the current KEY3i with the RESULTj-2. If

KEY1i and KEY2i are independent and KEY3i = KEY1i, or if
257

KEY1i=KEY2i=KEY3i, the new KEY3i+1 should be calculated by

exclusive-ORing the current KEY3i with the RESULTj.

2) Assign a new value to the TEXT0. The TEXT0 should be assigned the

value of the current Ij exclusive-ORed with TEXT0.

3) Assign a new value to the I parameters. I0 should be assigned the value of

Oj. I1 should be assigned the value of I0+R1 mod 264 where R1 =

5555555555555555. I2 should be assigned the value of I0+R2 mod 264

where R2 = AAAAAAAAAAAAAAAA.

NOTE -- the new TEXT and I should be denoted as TEXT0 and I0 because these values are used for the first

pass through the inner loop when j=0.

NOTE -- The output from the IUT for this test should consist of 400 output strings. Each output string should consist of

information included in Output Type 8.

3. The TMOVS checks the IUT's output for correctness by comparing the received results to

known values.
258

6. DESIGN OF THE TRIPLE DES MODES OF OPERATION

VALIDATION SYSTEM (TMOVS)

6.1 Design Philosophy

NIST validation programs are conformance tests rather than measures of product security. NIST

validation tests are designed to assist in the detection of accidental implementation errors, and are

not designed to detect intentional attempts to misrepresent conformance. Thus, validation by

NIST should not be interpreted as an evaluation or endorsement of overall product security.

An IUT is considered validated for a test option when it passes the appropriate set of TMOVS

tests. TMOVS testing is via statistical sampling, so validation of an option does not guarantee

100 % conformance with the option in the standards.

The intent of the validation process is to provide a rigorous conformance process that can be

performed at modest cost. NIST does not try to prevent a dishonest vendor from purchasing a

validated implementation and using this implementation as the vendor's IUT. Customers who

wish to protect themselves against a dishonest vendor could require that the vendor revalidate the

IUT in the customer's presence.

6.2 Operation of the TMOVS

TMOVS testing is done through the NIST Cryptographic Module Validation (CMV) Program.

The CMV Program uses laboratories accredited by the NIST National Voluntary Laboratory

Accreditation Program (NVLAP) to perform conformance tests to cryptographic-related FIPS. A

vendor contracts with a Cryptographic Module Testing (CMT) Laboratory accredited by

NVLAP. The CMT laboratory either conducts the TMOVS tests on the IUT or supplies initial

values to the vendor to conduct the tests. If the vendor conducts the tests, the vendor sends the

results to the CMT where they are verified. In both situations, the CMT laboratory submits the

results to NIST for validation. If the IUT has successfully completed the tests, NIST issues a

validation certificate for the IUT to the vendor. A list of CMT laboratories is available at

http://csrc.nist.gov/cryptval.

.
259

Appendix A

Tables of Values for the Known Answer Tests

Tables A.1 through A.4 were used with single DES. They will work with the triple DES Validation Modes that are backwards

compatible with their single counterparts. These include TECB, TCBC, TCFB, and TOFB.

The other tables include the values obtained for ciphertexts C2 and C3. These values are a result of having three initialization vectors.

These tables can be used with the interleaved and pipelined configurations of the Triple DES modes of operation.

Table A.1 Resulting Ciphertext from the Variable Plaintext Known Answer Test

for the TECB, TCBC, TCFB, and TOFB Modes of Operation

(NOTE -- KEY1=KEY2=KEY3 = 01 01 01 01 01 01 01 01 (odd parity set))

ROUND PLAINTEXT or IV

(depending on mode)

CIPHERTEXT

0 80 00 00 00 00 00 00 00 95 F8 A5 E5 DD 31 D9 00

1 40 00 00 00 00 00 00 00 DD 7F 12 1C A5 01 56 19

2 20 00 00 00 00 00 00 00 2E 86 53 10 4F 38 34 EA

3 10 00 00 00 00 00 00 00 4B D3 88 FF 6C D8 1D 4F

4 08 00 00 00 00 00 00 00 20 B9 E7 67 B2 FB 14 56

5 04 00 00 00 00 00 00 00 55 57 93 80 D7 71 38 EF

6 02 00 00 00 00 00 00 00 6C C5 DE FA AF 04 51 2F
260

ROUND PLAINTEXT or IV

(depending on mode)

CIPHERTEXT

7 01 00 00 00 00 00 00 00 0D 9F 27 9B A5 D8 72 60

8 00 80 00 00 00 00 00 00 D9 03 1B 02 71 BD 5A 0A

9 00 40 00 00 00 00 00 00 42 42 50 B3 7C 3D D9 51

10 00 20 00 00 00 00 00 00 B8 06 1B 7E CD 9A 21 E5

11 00 10 00 00 00 00 00 00 F1 5D 0F 28 6B 65 BD 28

12 00 08 00 00 00 00 00 00 AD D0 CC 8D 6E 5D EB A1

13 00 04 00 00 00 00 00 00 E6 D5 F8 27 52 AD 63 D1

14 00 02 00 00 00 00 00 00 EC BF E3 BD 3F 59 1A 5E

15 00 01 00 00 00 00 00 00 F3 56 83 43 79 D1 65 CD

16 00 00 80 00 00 00 00 00 2B 9F 98 2F 20 03 7F A9

17 00 00 40 00 00 00 00 00 88 9D E0 68 A1 6F 0B E6

18 00 00 20 00 00 00 00 00 E1 9E 27 5D 84 6A 12 98

19 00 00 10 00 00 00 00 00 32 9A 8E D5 23 D7 1A EC

20 00 00 08 00 00 00 00 00 E7 FC E2 25 57 D2 3C 97

21 00 00 04 00 00 00 00 00 12 A9 F5 81 7F F2 D6 5D
261

ROUND PLAINTEXT or IV

(depending on mode)

CIPHERTEXT

22 00 00 02 00 00 00 00 00 A4 84 C3 AD 38 DC 9C 19

23 00 00 01 00 00 00 00 00 FB E0 0A 8A 1E F8 AD 72

24 00 00 00 80 00 00 00 00 75 0D 07 94 07 52 13 63

25 00 00 00 40 00 00 00 00 64 FE ED 9C 72 4C 2F AF

26 00 00 00 20 00 00 00 00 F0 2B 26 3B 32 8E 2B 60

27 00 00 00 10 00 00 00 00 9D 64 55 5A 9A 10 B8 52

28 00 00 00 08 00 00 00 00 D1 06 FF 0B ED 52 55 D7

29 00 00 00 04 00 00 00 00 E1 65 2C 6B 13 8C 64 A5

30 00 00 00 02 00 00 00 00 E4 28 58 11 86 EC 8F 46

31 00 00 00 01 00 00 00 00 AE B5 F5 ED E2 2D 1A 36

32 00 00 00 00 80 00 00 00 E9 43 D7 56 8A EC 0C 5C

33 00 00 00 00 40 00 00 00 DF 98 C8 27 6F 54 B0 4B

34 00 00 00 00 20 00 00 00 B1 60 E4 68 0F 6C 69 6F

35 00 00 00 00 10 00 00 00 FA 07 52 B0 7D 9C 4A B8

36 00 00 00 00 08 00 00 00 CA 3A 2B 03 6D BC 85 02
262

ROUND PLAINTEXT or IV

(depending on mode)

CIPHERTEXT

37 00 00 00 00 04 00 00 00 5E 09 05 51 7B B5 9B CF

38 00 00 00 00 02 00 00 00 81 4E EB 3B 91 D9 07 26

39 00 00 00 00 01 00 00 00 4D 49 DB 15 32 91 9C 9F

40 00 00 00 00 00 80 00 00 25 EB 5F C3 F8 CF 06 21

41 00 00 00 00 00 40 00 00 AB 6A 20 C0 62 0D 1C 6F

42 00 00 00 00 00 20 00 00 79 E9 0D BC 98 F9 2C CA

43 00 00 00 00 00 10 00 00 86 6E CE DD 80 72 BB 0E

44 00 00 00 00 00 08 00 00 8B 54 53 6F 2F 3E 64 A8

45 00 00 00 00 00 04 00 00 EA 51 D3 97 55 95 B8 6B

46 00 00 00 00 00 02 00 00 CA FF C6 AC 45 42 DE 31

47 00 00 00 00 00 01 00 00 8D D4 5A 2D DF 90 79 6C

48 00 00 00 00 00 00 80 00 10 29 D5 5E 88 0E C2 D0

49 00 00 00 00 00 00 40 00 5D 86 CB 23 63 9D BE A9

50 00 00 00 00 00 00 20 00 1D 1C A8 53 AE 7C 0C 5F

51 00 00 00 00 00 00 10 00 CE 33 23 29 24 8F 32 28
263

ROUND PLAINTEXT or IV

(depending on mode)

CIPHERTEXT

52 00 00 00 00 00 00 08 00 84 05 D1 AB E2 4F B9 42

53 00 00 00 00 00 00 04 00 E6 43 D7 80 90 CA 42 07

54 00 00 00 00 00 00 02 00 48 22 1B 99 37 74 8A 23

55 00 00 00 00 00 00 01 00 DD 7C 0B BD 61 FA FD 54

56 00 00 00 00 00 00 00 80 2F BC 29 1A 57 0D B5 C4

57 00 00 00 00 00 00 00 40 E0 7C 30 D7 E4 E2 6E 12

58 00 00 00 00 00 00 00 20 09 53 E2 25 8E 8E 90 A1

59 00 00 00 00 00 00 00 10 5B 71 1B C4 CE EB F2 EE

60 00 00 00 00 00 00 00 08 CC 08 3F 1E 6D 9E 85 F6

61 00 00 00 00 00 00 00 04 D2 FD 88 67 D5 0D 2D FE

62 00 00 00 00 00 00 00 02 06 E7 EA 22 CE 92 70 8F

63 00 00 00 00 00 00 00 01 16 6B 40 B4 4A BA 4B D6
264

Table A.2 Resulting Ciphertext from the Variable Key Known Answer Test

for the TECB, TCBC, TCFB, and TOFB Modes of Operation

(NOTE -- Plaintext/text = 00 00 00 00 00 00 00 00 and, where applicable, IV = 00 00 00 00 00 00 00 00)

ROUND KEY CIPHERTEXT

 0 80 01 01 01 01 01 01 01 95 A8 D7 28 13 DA A9 4D

 1 40 01 01 01 01 01 01 01 0E EC 14 87 DD 8C 26 D5

 2 20 01 01 01 01 01 01 01 7A D1 6F FB 79 C4 59 26

 3 10 01 01 01 01 01 01 01 D3 74 62 94 CA 6A 6C F3

 4 08 01 01 01 01 01 01 01 80 9F 5F 87 3C 1F D7 61

 5 04 01 01 01 01 01 01 01 C0 2F AF FE C9 89 D1 FC

 6 02 01 01 01 01 01 01 01 46 15 AA 1D 33 E7 2F 10

 7 01 80 01 01 01 01 01 01 20 55 12 33 50 C0 08 58

 8 01 40 01 01 01 01 01 01 DF 3B 99 D6 57 73 97 C8

 9 01 20 01 01 01 01 01 01 31 FE 17 36 9B 52 88 C9

10 01 10 01 01 01 01 01 01 DF DD 3C C6 4D AE 16 42

11 01 08 01 01 01 01 01 01 17 8C 83 CE 2B 39 9D 94
265

ROUND KEY CIPHERTEXT

12 01 04 01 01 01 01 01 01 50 F6 36 32 4A 9B 7F 80

13 01 02 01 01 01 01 01 01 A8 46 8E E3 BC 18 F0 6D

14 01 01 80 01 01 01 01 01 A2 DC 9E 92 FD 3C DE 92

15 01 01 40 01 01 01 01 01 CA C0 9F 79 7D 03 12 87

16 01 01 20 01 01 01 01 01 90 BA 68 0B 22 AE B5 25

17 01 01 10 01 01 01 01 01 CE 7A 24 F3 50 E2 80 B6

18 01 01 08 01 01 01 01 01 88 2B FF 0A A0 1A 0B 87

19 01 01 04 01 01 01 01 01 25 61 02 88 92 45 11 C2

20 01 01 02 01 01 01 01 01 C7 15 16 C2 9C 75 D1 70

21 01 01 01 80 01 01 01 01 51 99 C2 9A 52 C9 F0 59

22 01 01 01 40 01 01 01 01 C2 2F 0A 29 4A 71 F2 9F

23 01 01 01 20 01 01 01 01 EE 37 14 83 71 4C 02 EA

24 01 01 01 10 01 01 01 01 A8 1F BD 44 8F 9E 52 2F

25 01 01 01 08 01 01 01 01 4F 64 4C 92 E1 92 DF ED

26 01 01 01 04 01 01 01 01 1A FA 9A 66 A6 DF 92 AE

27 01 01 01 02 01 01 01 01 B3 C1 CC 71 5C B8 79 D8
266

ROUND KEY CIPHERTEXT

28 01 01 01 01 80 01 01 01 19 D0 32 E6 4A B0 BD 8B

29 01 01 01 01 40 01 01 01 3C FA A7 A7 DC 87 20 DC

30 01 01 01 01 20 01 01 01 B7 26 5F 7F 44 7A C6 F3

31 01 01 01 01 10 01 01 01 9D B7 3B 3C 0D 16 3F 54

32 01 01 01 01 08 01 01 01 81 81 B6 5B AB F4 A9 75

33 01 01 01 01 04 01 01 01 93 C9 B6 40 42 EA A2 40

34 01 01 01 01 02 01 01 01 55 70 53 08 29 70 55 92

35 01 01 01 01 01 80 01 01 86 38 80 9E 87 87 87 A0

36 01 01 01 01 01 40 01 01 41 B9 A7 9A F7 9A C2 08

37 01 01 01 01 01 20 01 01 7A 9B E4 2F 20 09 A8 92

38 01 01 01 01 01 10 01 01 29 03 8D 56 BA 6D 27 45

39 01 01 01 01 01 08 01 01 54 95 C6 AB F1 E5 DF 51

40 01 01 01 01 01 04 01 01 AE 13 DB D5 61 48 89 33

41 01 01 01 01 01 02 01 01 02 4D 1F FA 89 04 E3 89

42 01 01 01 01 01 01 80 01 D1 39 97 12 F9 9B F0 2E

43 01 01 01 01 01 01 40 01 14 C1 D7 C1 CF FE C7 9E
267

ROUND KEY CIPHERTEXT

44 01 01 01 01 01 01 20 01 1D E5 27 9D AE 3B ED 6F

45 01 01 01 01 01 01 10 01 E9 41 A3 3F 85 50 13 03

46 01 01 01 01 01 01 08 01 DA 99 DB BC 9A 03 F3 79

47 01 01 01 01 01 01 04 01 B7 FC 92 F9 1D 8E 92 E9

48 01 01 01 01 01 01 02 01 AE 8E 5C AA 3C A0 4E 85

49 01 01 01 01 01 01 01 80 9C C6 2D F4 3B 6E ED 74

50 01 01 01 01 01 01 01 40 D8 63 DB B5 C5 9A 91 A0

51 01 01 01 01 01 01 01 20 A1 AB 21 90 54 5B 91 D7

52 01 01 01 01 01 01 01 10 08 75 04 1E 64 C5 70 F7

53 01 01 01 01 01 01 01 08 5A 59 45 28 BE BE F1 CC

54 01 01 01 01 01 01 01 04 FC DB 32 91 DE 21 F0 C0

55 01 01 01 01 01 01 01 02 86 9E FD 7F 9F 26 5A 09
268

Table A.3 Values To Be Used for the Permutation Operation Known Answer Test

for the TECB, TCBC, TCFB, and TOFB Modes of Operation

 (NOTE -- P/TEXT = 00 00 00 00 00 00 00 00 for each round

where applicable, IV = 00 00 00 00 00 00 00 00.

ROUND KEY C/RESULT

0 10 46 91 34 89 98 01 31 88 D5 5E 54 F5 4C 97 B4

1 10 07 10 34 89 98 80 20 0C 0C C0 0C 83 EA 48 FD

2 10 07 10 34 C8 98 01 20 83 BC 8E F3 A6 57 01 83

3 10 46 10 34 89 98 80 20 DF 72 5D CA D9 4E A2 E9

4 10 86 91 15 19 19 01 01 E6 52 B5 3B 55 0B E8 B0

5 10 86 91 15 19 58 01 01 AF 52 71 20 C4 85 CB B0

6 51 07 B0 15 19 58 01 01 0F 04 CE 39 3D B9 26 D5

7 10 07 B0 15 19 19 01 01 C9 F0 0F FC 74 07 90 67

8 31 07 91 54 98 08 01 01 7C FD 82 A5 93 25 2B 4E

 9 31 07 91 94 98 08 01 01 CB 49 A2 F9 E9 13 63 E3

10 10 07 91 15 B9 08 01 40 00 B5 88 BE 70 D2 3F 56
269

ROUND KEY C/RESULT

11 31 07 91 15 98 08 01 40 40 6A 9A 6A B4 33 99 AE

12 10 07 D0 15 89 98 01 01 6C B7 73 61 1D CA 9A DA

13 91 07 91 15 89 98 01 01 67 FD 21 C1 7D BB 5D 70

14 91 07 D0 15 89 19 01 01 95 92 CB 41 10 43 07 87

15 10 07 D0 15 98 98 01 20 A6 B7 FF 68 A3 18 DD D3

16 10 07 94 04 98 19 01 01 4D 10 21 96 C9 14 CA 16

17 01 07 91 04 91 19 04 01 2D FA 9F 45 73 59 49 65

18 01 07 91 04 91 19 01 01 B4 66 04 81 6C 0E 07 74

19 01 07 94 04 91 19 04 01 6E 7E 62 21 A4 F3 4E 87

20 19 07 92 10 98 1A 01 01 AA 85 E7 46 43 23 31 99

21 10 07 91 19 98 19 08 01 2E 5A 19 DB 4D 19 62 D6

22 10 07 91 19 98 1A 08 01 23 A8 66 A8 09 D3 08 94

23 10 07 92 10 98 19 01 01 D8 12 D9 61 F0 17 D3 20

24 10 07 91 15 98 19 01 0B 05 56 05 81 6E 58 60 8F

25 10 04 80 15 98 19 01 01 AB D8 8E 8B 1B 77 16 F1

26 10 04 80 15 98 19 01 02 53 7A C9 5B E6 9D A1 E1
270

ROUND KEY C/RESULT

27 10 04 80 15 98 19 01 08 AE D0 F6 AE 3C 25 CD D8

28 10 02 91 15 98 10 01 04 B3 E3 5A 5E E5 3E 7B 8D

29 10 02 91 15 98 19 01 04 61 C7 9C 71 92 1A 2E F8

30 10 02 91 15 98 10 02 01 E2 F5 72 8F 09 95 01 3C

31 10 02 91 16 98 10 01 01 1A EA C3 9A 61 F0 A4 64
271

Table A.4 Values To Be Used for the Substitution Table Known Answer Test

for the TECB, TCBC, TCFB, and TOFB Modes of Operation

ROUND KEY P/TEXT C/RESULT

0 7C A1 10 45 4A 1A 6E 57 01 A1 D6 D0 39 77 67 42 69 0F 5B 0D 9A 26 93 9B

1 01 31 D9 61 9D C1 37 6E 5C D5 4C A8 3D EF 57 DA 7A 38 9D 10 35 4B D2 71

2 07 A1 13 3E 4A 0B 26 86 02 48 D4 38 06 F6 71 72 86 8E BB 51 CA B4 59 9A

3 38 49 67 4C 26 02 31 9E 51 45 4B 58 2D DF 44 0A 71 78 87 6E 01 F1 9B 2A

4 04 B9 15 BA 43 FE B5 B6 42 FD 44 30 59 57 7F A2 AF 37 FB 42 1F 8C 40 95

5 01 13 B9 70 FD 34 F2 CE 05 9B 5E 08 51 CF 14 3A 86 A5 60 F1 0E C6 D8 5B

6 01 70 F1 75 46 8F B5 E6 07 56 D8 E0 77 47 61 D2 0C D3 DA 02 00 21 DC 09

7 43 29 7F AD 38 E3 73 FE 76 25 14 B8 29 BF 48 6A EA 67 6B 2C B7 DB 2B 7A

8 07 A7 13 70 45 DA 2A 16 3B DD 11 90 49 37 28 02 DF D6 4A 81 5C AF 1A 0F

9 04 68 91 04 C2 FD 3B 2F 26 95 5F 68 35 AF 60 9A 5C 51 3C 9C 48 86 C0 88

10 37 D0 6B B5 16 CB 75 46 16 4D 5E 40 4F 27 52 32 0A 2A EE AE 3F F4 AB 77

11 1F 08 26 0D 1A C2 46 5E 6B 05 6E 18 75 9F 5C CA EF 1B F0 3E 5D FA 57 5A

12 58 40 23 64 1A BA 61 76 00 4B D6 EF 09 17 60 62 88 BF 0D B6 D7 0D EE 56

13 02 58 16 16 46 29 B0 07 48 0D 39 00 6E E7 62 F2 A1 F9 91 55 41 02 0B 56
272

ROUND KEY P/TEXT C/RESULT

14 49 79 3E BC 79 B3 25 8F 43 75 40 C8 69 8F 3C FA 6F BF 1C AF CF FD 05 56

15 4F B0 5E 15 15 AB 73 A7 07 2D 43 A0 77 07 52 92 2F 22 E4 9B AB 7C A1 AC

16 49 E9 5D 6D 4C A2 29 BF 02 FE 55 77 81 17 F1 2A 5A 6B 61 2C C2 6C CE 4A

17 01 83 10 DC 40 9B 26 D6 1D 9D 5C 50 18 F7 28 C2 5F 4C 03 8E D1 2B 2E 41

18 1C 58 7F 1C 13 92 4F EF 30 55 32 28 6D 6F 29 5A 63 FA C0 D0 34 D9 F7 93
273

Table A.5 Resulting Ciphertext from the Variable Plaintext Known Answer Test for TCBC-I Mode of Operation

(NOTE -- KEY1 = KEY2 = KEY3 = 01 01 01 01 01 01 01 01

 IV1 = 00 00 00 00 00 00 00 00

 IV2 = 55 55 55 55 55 55 55 55

 IV3 = aa aa aa aa aa aa aa aa)

ROUND INPUTBLOCK 1 CIPHERTEXT1 INPUTBLOCK 2 CIPHERTEXT2 INPUTBLOCK 3 CIPHERTEXT3

0 8000000000000000 95f8a5e5dd31d900 d555555555555555 f7552ab6cb21e2bc 2aaaaaaaaaaaaaaa 5a48d3de869557fd

1 4000000000000000 dd7f121ca5015619 1555555555555555 e0c2af1ebd89a262 eaaaaaaaaaaaaaaa f15ee2019a5b547c

2 2000000000000000 2e8653104f3834ea 7555555555555555 05b865a1e49ed109 8aaaaaaaaaaaaaaa 3bee595ef860316a

3 1000000000000000 4bd388ff6cd81d4f 4555555555555555 b447313fc704d321 baaaaaaaaaaaaaaa f6089ca9b722765c

4 0800000000000000 20b9e767b2fb1456 5d55555555555555 c39193d42381b313 a2aaaaaaaaaaaaaa af15a8e9b2c14de5

5 0400000000000000 55579380d77138ef 5155555555555555 6a2afdae188494b8 aeaaaaaaaaaaaaaa 45089186180bd591

6 0200000000000000 6cc5defaaf04512f 5755555555555555 1359f4d663a3209c a8aaaaaaaaaaaaaa 280d3ae3a00cfbc9

7 0100000000000000 0d9f279ba5d87260 5455555555555555 4a035e6a81d1314b abaaaaaaaaaaaaaa d27eb94e56c3172a

8 0080000000000000 d9031b0271bd5a0a 55d5555555555555 4334b5fe1b7f5320 aa2aaaaaaaaaaaaa b0555ab990b7e95c

9 0040000000000000 424250b37c3dd951 5515555555555555 f41a29e0d31107b4 aaeaaaaaaaaaaaaa f54f2bd8e2eb2bc6

10 0020000000000000 b8061b7ecd9a21e5 5575555555555555 c8eb2e340855325b aa8aaaaaaaaaaaaa d51175259c607fb4
274

ROUND INPUTBLOCK 1 CIPHERTEXT1 INPUTBLOCK 2 CIPHERTEXT2 INPUTBLOCK 3 CIPHERTEXT3

11 0010000000000000 f15d0f286b65bd28 5545555555555555 b75847a2f3f2458a aabaaaaaaaaaaaaa 72ea3aadb569af43

12 0008000000000000 add0cc8d6e5deba1 555d555555555555 be433af4c5ae0f97 aaa2aaaaaaaaaaaa 9b003151e8602b7d

13 0004000000000000 e6d5f82752ad63d1 5551555555555555 f68101d125e2e284 aaaeaaaaaaaaaaaa fc1463bb9bba9e11

14 0002000000000000 ecbfe3bd3f591a5e 5557555555555555 fa510732fa871094 aaa8aaaaaaaaaaaa 65f94c59c59b06e1

15 0001000000000000 f356834379d165cd 5554555555555555 458d97a8b6ebd0d7 aaabaaaaaaaaaaaa fbcfc086f8111572

16 0000800000000000 2b9f982f20037fa9 5555d55555555555 f4169ca3fc6799ed aaaa2aaaaaaaaaaa 68c9e70b9de8db79

17 0000400000000000 889de068a16f0be6 5555155555555555 f47b9f01a5ee74e9 aaaaeaaaaaaaaaaa 63fc8ec1421399b8

18 0000200000000000 e19e275d846a1298 5555755555555555 ee26a403caca387d aaaa8aaaaaaaaaaa 3f1d10e9a1a44a92

19 0000100000000000 329a8ed523d71aec 5555455555555555 af7e5ad1d9f4ecf8 aaaabaaaaaaaaaaa e3f663de44003f9b

20 0000080000000000 e7fce22557d23c97 55555d5555555555 bb04e854f99f6352 aaaaa2aaaaaaaaaa bc2452fd13e00dcc

21 0000040000000000 12a9f5817ff2d65d 5555515555555555 01f57b1e69290d90 aaaaaeaaaaaaaaaa 4432a11e1c320e7a

22 0000020000000000 a484c3ad38dc9c19 5555575555555555 8ae9dee849b46527 aaaaa8aaaaaaaaaa a1e9e67f13f932b3

23 0000010000000000 fbe00a8a1ef8ad72 5555545555555555 cb706efba6b5110e aaaaabaaaaaaaaaa 6fd1d0793c1b7af2

24 0000008000000000 750d079407521363 555555d555555555 b8b27d1286bdbb26 aaaaaa2aaaaaaaaa 3d2c39f9d26b589e

25 0000004000000000 64feed9c724c2faf 5555551555555555 9862c9d770558095 aaaaaaeaaaaaaaaa e3a7abc88132ad7d

26 0000002000000000 f02b263b328e2b60 5555557555555555 a213c5c56fdca139 aaaaaa8aaaaaaaaa 08cd945738a222c8
275

ROUND INPUTBLOCK 1 CIPHERTEXT1 INPUTBLOCK 2 CIPHERTEXT2 INPUTBLOCK 3 CIPHERTEXT3

27 0000001000000000 9d64555a9a10b852 5555554555555555 a3bebc0e23ab87f2 aaaaaabaaaaaaaaa 568fa34d2fc7225e

28 0000000800000000 d106ff0bed5255d7 5555555d55555555 c32c19229d84e2b4 aaaaaaa2aaaaaaaa 3771887d7266b49d

29 0000000400000000 e1652c6b138c64a5 5555555155555555 e628ceae5cb3bb34 aaaaaaaeaaaaaaaa edd6029a6b80a442

30 0000000200000000 e428581186ec8f46 5555555755555555 5924454953ad5732 aaaaaaa8aaaaaaaa 0313da097aec4a43

31 0000000100000000 aeb5f5ede22d1a36 5555555455555555 7cc987f5fb33b813 aaaaaaabaaaaaaaa 91f5b30f015b4a54

32 0000000080000000 e943d7568aec0c5c 55555555d5555555 88e3dd1448c4e0ff aaaaaaaa2aaaaaaa 1e60759f038beec1

33 0000000040000000 df98c8276f54b04b 5555555515555555 a49d286e5dfc6143 aaaaaaaaeaaaaaaa 97061699383bbfe0

34 0000000020000000 b160e4680f6c696f 5555555575555555 a5206a311e9c2515 aaaaaaaa8aaaaaaa 311f3c96e071f173

35 0000000010000000 fa0752b07d9c4ab8 5555555545555555 b6e4686a8b957cf2 aaaaaaaabaaaaaaa 1a6849edcb701b07

36 0000000008000000 ca3a2b036dbc8502 555555555d555555 af1200418fd37fdd aaaaaaaaa2aaaaaa fa5b2fa26d03558b

37 0000000004000000 5e0905517bb59bcf 5555555551555555 487deccf0fde5b88 aaaaaaaaaeaaaaaa bcaa0b7b7b3464c5

38 0000000002000000 814eeb3b91d90726 5555555557555555 456a1865905ed57d aaaaaaaaa8aaaaaa 3d245b501c6abb74

39 0000000001000000 4d49db1532919c9f 5555555554555555 3e2601fa20895e62 aaaaaaaaabaaaaaa 62133d9330e2e86b

40 0000000000800000 25eb5fc3f8cf0621 5555555555d55555 58da89972266a7e3 aaaaaaaaaa2aaaaa 5d7d6bd225890b4d

41 0000000000400000 ab6a20c0620d1c6f 5555555555155555 feaca17e5dd05c87 aaaaaaaaaaeaaaaa db36baba70c3b9af

42 0000000000200000 79e90dbc98f92cca 5555555555755555 88249b73e99c5ac0 aaaaaaaaaa8aaaaa a2f5ea90c2179ab4
276

ROUND INPUTBLOCK 1 CIPHERTEXT1 INPUTBLOCK 2 CIPHERTEXT2 INPUTBLOCK 3 CIPHERTEXT3

43 0000000000100000 866ecedd8072bb0e 5555555555455555 5f8add8784cc3174 aaaaaaaaaabaaaaa 70470a07cb34e109

44 0000000000080000 8b54536f2f3e64a8 55555555555d5555 cd8dc942ae2bb175 aaaaaaaaaaa2aaaa 659610094ab3824e

45 0000000000040000 ea51d3975595b86b 5555555555515555 cf8442863e68e644 aaaaaaaaaaaeaaaa 26e6223634c857a3

46 0000000000020000 caffc6ac4542de31 5555555555575555 16952dc89c0acd65 aaaaaaaaaaa8aaaa ddd0a647be96041f

47 0000000000010000 8dd45a2ddf90796c 5555555555545555 8a4fca2b00c49807 aaaaaaaaaaabaaaa 363219d8cec5a9f3

48 0000000000008000 1029d55e880ec2d0 555555555555d555 b40225aea121c8d3 aaaaaaaaaaaa2aaa bb5710f9dc8dde46

49 0000000000004000 5d86cb23639dbea9 5555555555551555 711c066c13222f1c aaaaaaaaaaaaeaaa ae527ed311a25ea2

50 0000000000002000 1d1ca853ae7c0c5f 5555555555557555 4fb69c832db68026 aaaaaaaaaaaa8aaa af94496800a32656

51 0000000000001000 ce332329248f3228 5555555555554555 f24c7444edf1c394 aaaaaaaaaaaabaaa c55d7544a1eae274

52 0000000000000800 8405d1abe24fb942 5555555555555d55 6be457abc511e87c aaaaaaaaaaaaa2aa 9ba49db251748896

53 0000000000000400 e643d78090ca4207 5555555555555155 6136fefebb0c8118 aaaaaaaaaaaaaeaa 3d19267de9c12e7b

54 0000000000000200 48221b9937748a23 5555555555555755 d23a8dfe39c98883 aaaaaaaaaaaaa8aa 5ce84637532650c8

55 0000000000000100 dd7c0bbd61fafd54 5555555555555455 afe2e34f009924e2 aaaaaaaaaaaaabaa d43941ab72932bb0

56 0000000000000080 2fbc291a570db5c4 55555555555555d5 0adcf552ec1754c6 aaaaaaaaaaaaaa2a 816c454ba7894865

57 0000000000000040 e07c30d7e4e26e12 5555555555555515 c06e80c5238135bb aaaaaaaaaaaaaaea 74bc744f10f63889

58 0000000000000020 0953e2258e8e90a1 5555555555555575 0912754e7c42f637 aaaaaaaaaaaaaa8a 3d2565d9bf62cdbd
277

ROUND INPUTBLOCK 1 CIPHERTEXT1 INPUTBLOCK 2 CIPHERTEXT2 INPUTBLOCK 3 CIPHERTEXT3

59 0000000000000010 5b711bc4ceebf2ee 5555555555555545 b4f82967c658adb8 aaaaaaaaaaaaaaba a2e13c5701a60444

60 0000000000000008 cc083f1e6d9e85f6 555555555555555d 006fa12a796ac4d3 aaaaaaaaaaaaaaa2 cbe2873fd6f63048

61 0000000000000004 d2fd8867d50d2dfe 5555555555555551 1a4a364616460d44 aaaaaaaaaaaaaaae cc6adcef1be975ef

62 0000000000000002 06e7ea22ce92708f 5555555555555557 f307b5bcd44f3d8d aaaaaaaaaaaaaaa8 991d770b2bf051dc

63 0000000000000001 166b40b44aba4bd6 5555555555555554 9cb1c3932c005c49 aaaaaaaaaaaaaaab 17d8e9c374d14494
278

Table A.6 Resulting Ciphertext from the Inverse Permutation Known Answer Test for TCBC-I Mode of Operation

(Encryption Process)

(NOTE -- KEY1 = KEY2 = KEY3 = 01 01 01 01 01 01 01 01

IV1 = 00 00 00 00 00 00 00 00

IV2 = 55 55 55 55 55 55 55 55

IV3 = aa aa aa aa aa aa aa aa)

ROUND PLAINTEXT1 CIPHERTEXT1 PLAINTEXT2 CIPHERTEXT2 PLAINTEXT3 CIPHERTEXT3

0 95f8a5e5dd31d900 8000000000000000 f7552ab6cb21e2bc 713d058fe58a43f7 5a48d3de869557fd e4999d5c3cceee44

1 dd7f121ca5015619 4000000000000000 e0c2af1ebd89a262 0ac760c01e5927ef f15ee2019a5b547c accd15b5dde0b5c2

2 2e8653104f3834ea 2000000000000000 05b865a1e49ed109 363130ca94da9d8a 3bee595ef860316a 69732f3dbb5652b1

3 4bd388ff6cd81d4f 1000000000000000 b447313fc704d321 1e14d9109bc1f46c f6089ca9b722765c ace935a115450a05

4 20b9e767b2fb1456 0800000000000000 c39193d42381b313 6a46ef972da6a833 af15a8e9b2c14de5 c1b2f69f9a21090d

5 55579380d77138ef 0400000000000000 6a2afdae188494b8 330aec7886295181 45089186180bd591 a8f987e6d0d3af25

6 6cc5defaaf04512f 0200000000000000 1359f4d663a3209c e518b154c8b8c8a6 280d3ae3a00cfbc9 87f0fbcb6b40af68

7 0d9f279ba5d87260 0100000000000000 4a035e6a81d1314b 8dec119b560a53d0 d27eb94e56c3172a 6aa899298c76715b

8 d9031b0271bd5a0a 0080000000000000 4334b5fe1b7f5320 d8807ced29f8f8d1 b0555ab990b7e95c 7f17a4e7532b04f9

9 424250b37c3dd951 0040000000000000 f41a29e0d31107b4 dbe8eba35e2a295b f54f2bd8e2eb2bc6 5c899d0cf0f8a135

10 b8061b7ecd9a21e5 0020000000000000 c8eb2e340855325b fa5b70d1b836e88d d51175259c607fb4 726616043a1c0107

11 f15d0f286b65bd28 0010000000000000 b75847a2f3f2458a 4be2d4ffa6f22133 72ea3aadb569af43 ba0432be3b5bb6f8

12 add0cc8d6e5deba1 0008000000000000 be433af4c5ae0f97 b85a5c395b3a5885 9b003151e8602b7d e40807ea13dd109e

13 e6d5f82752ad63d1 0004000000000000 f68101d125e2e284 9f65cff48d26c258 fc1463bb9bba9e11 7851707ef934aa75

14 ecbfe3bd3f591a5e 0002000000000000 fa510732fa871094 40e8813c718539ac 65f94c59c59b06e1 d51aab52aa37dc8d

15 f356834379d165cd 0001000000000000 458d97a8b6ebd0d7 289a7729f22d7703 fbcfc086f8111572 266e7b0862cf5fc2

16 2b9f982f20037fa9 0000800000000000 f4169ca3fc6799ed a11b556e8c1b26c5 68c9e70b9de8db79 aedab274b2ef15c9

17 889de068a16f0be6 0000400000000000 f47b9f01a5ee74e9 3683a86916c7b11d 63fc8ec1421399b8 80fbb2539dd96d8f

18 e19e275d846a1298 0000200000000000 ee26a403caca387d 9f073f4f068f3d0e 3f1d10e9a1a44a92 498437929c6ccf59

19 329a8ed523d71aec 0000100000000000 af7e5ad1d9f4ecf8 07712f196c02eb9b e3f663de44003f9b c4ebb01e305e41e2

20 e7fce22557d23c97 0000080000000000 bb04e854f99f6352 93f4126615626c01 bc2452fd13e00dcc 82fb4a9ce4c92818

21 12a9f5817ff2d65d 0000040000000000 01f57b1e69290d90 b6958170aba384c9 4432a11e1c320e7a 91239239e22f0280

22 a484c3ad38dc9c19 0000020000000000 8ae9dee849b46527 3bb724cf5e35707d a1e9e67f13f932b3 cc30662b51d40c1a

23 fbe00a8a1ef8ad72 0000010000000000 cb706efba6b5110e 9fe1afb876cdb756 6fd1d0793c1b7af2 8e67cf5371a467a2

24 750d079407521363 0000008000000000 b8b27d1286bdbb26 1db03e2b95785d8a 3d2c39f9d26b589e 6e79366486097eba
279

ROUND PLAINTEXT1 CIPHERTEXT1 PLAINTEXT2 CIPHERTEXT2 PLAINTEXT3 CIPHERTEXT3

25 64feed9c724c2faf 0000004000000000 9862c9d770558095 ea4e26144ada8e2b e3a7abc88132ad7d ce2971055091a1af

26 f02b263b328e2b60 0000002000000000 a213c5c56fdca139 97255bd98b5ed9b3 08cd945738a222c8 252e33166953cd68

27 9d64555a9a10b852 0000001000000000 a3bebc0e23ab87f2 85a52d6656cf13be 568fa34d2fc7225e 39a971317391242b

28 d106ff0bed5255d7 0000000800000000 c32c19229d84e2b4 6965b2633fbe37a8 3771887d7266b49d d95a7aa0bec4fa7a

29 e1652c6b138c64a5 0000000400000000 e628ceae5cb3bb34 0e8317ae44e3caa0 edd6029a6b80a442 4dfdcc7a4279b2c0

30 e428581186ec8f46 0000000200000000 5924454953ad5732 567efb50dc99f5dc 0313da097aec4a43 96bb89c941631bed

31 aeb5f5ede22d1a36 0000000100000000 7cc987f5fb33b813 46814855930b3a3f 91f5b30f015b4a54 1c3ba8fbadab9a22

32 e943d7568aec0c5c 0000000080000000 88e3dd1448c4e0ff a77142eabd2bd877 1e60759f038beec1 8fc77798b1692ab2

33 df98c8276f54b04b 0000000040000000 a49d286e5dfc6143 76395f51bdf699db 97061699383bbfe0 ace5681dfba69ceb

34 b160e4680f6c696f 0000000020000000 a5206a311e9c2515 c3e20437ad6c32b7 311f3c96e071f173 782058f728c21174

35 fa0752b07d9c4ab8 0000000010000000 b6e4686a8b957cf2 34cfbfca8df5fb9d 1a6849edcb701b07 fc14dafe9d171db5

36 ca3a2b036dbc8502 0000000008000000 af1200418fd37fdd b372320762d438f8 fa5b2fa26d03558b 339189931ada4474

37 5e0905517bb59bcf 0000000004000000 487deccf0fde5b88 882402b6dec6675f bcaa0b7b7b3464c5 c6d1f875363bf7ea

38 814eeb3b91d90726 0000000002000000 456a1865905ed57d 69e1758b520187d4 3d245b501c6abb74 31097d931da2e7bd

39 4d49db1532919c9f 0000000001000000 3e2601fa20895e62 ab8232a31d78e0fc 62133d9330e2e86b 0bff0085bb36e9b0

40 25eb5fc3f8cf0621 0000000000800000 58da89972266a7e3 aeed06b9f51ce37a 5d7d6bd225890b4d 5d09a28ee99cb585

41 ab6a20c0620d1c6f 0000000000400000 feaca17e5dd05c87 96dc5bd6e0b10d83 db36baba70c3b9af 46d9a629a0616379

42 79e90dbc98f92cca 0000000000200000 88249b73e99c5ac0 55a4cdc28ecf0541 a2f5ea90c2179ab4 ab239da3e3fab21b

43 866ecedd8072bb0e 0000000000100000 5f8add8784cc3174 7349bfc7f6461210 70470a07cb34e109 9331573af5067b09

44 8b54536f2f3e64a8 0000000000080000 cd8dc942ae2bb175 90b4544c9e6ad23b 659610094ab3824e 3133eeddd4f2ffec

45 ea51d3975595b86b 0000000000040000 cf8442863e68e644 2d7e77de47d0dad4 26e6223634c857a3 408e7d58ba623208

46 caffc6ac4542de31 0000000000020000 16952dc89c0acd65 b87887b6dddaab6f ddd0a647be96041f 0e5b54a5a9cfbed1

47 8dd45a2ddf90796c 0000000000010000 8a4fca2b00c49807 8fdec1977d446e54 363219d8cec5a9f3 b875b2ffa6fea146

48 1029d55e880ec2d0 0000000000008000 b40225aea121c8d3 aedc1e02bd099571 bb5710f9dc8dde46 1a190ba501176f51

49 5d86cb23639dbea9 0000000000004000 711c066c13222f1c 1404bcbe41ce6aa1 ae527ed311a25ea2 863541107db40094

50 1d1ca853ae7c0c5f 0000000000002000 4fb69c832db68026 83804ddd1b5cd4fd af94496800a32656 0d3834749def9e7a

51 ce332329248f3228 0000000000001000 f24c7444edf1c394 5f54383a55d6198a c55d7544a1eae274 b601d210b21d541b

52 8405d1abe24fb942 0000000000000800 6be457abc511e87c f1c2172a084f656f 9ba49db251748896 50d294abb12450bb

53 e643d78090ca4207 0000000000000400 6136fefebb0c8118 88b53f4066285776 3d19267de9c12e7b 010a1b96b9017a94

54 48221b9937748a23 0000000000000200 d23a8dfe39c98883 4dc3b1bc755eb684 5ce84637532650c8 15acb37fde2a095a

55 dd7c0bbd61fafd54 0000000000000100 afe2e34f009924e2 45c93fbf9ea29104 d43941ab72932bb0 7bd2597948ce5bc8

56 2fbc291a570db5c4 0000000000000080 0adcf552ec1754c6 e5c336ae5360d967 816c454ba7894865 b3f30f939f9bc4db

57 e07c30d7e4e26e12 0000000000000040 c06e80c5238135bb 31c1c1914e9d7278 74bc744f10f63889 d30cbd5808d8e0ef
280

ROUND PLAINTEXT1 CIPHERTEXT1 PLAINTEXT2 CIPHERTEXT2 PLAINTEXT3 CIPHERTEXT3

58 0953e2258e8e90a1 0000000000000020 0912754e7c42f637 ca1dad0fa1978258 3d2565d9bf62cdbd b30b208b6ccecada

59 5b711bc4ceebf2ee 0000000000000010 b4f82967c658adb8 afd29a3fba18602a a2e13c5701a60444 027d03f04016c3c2

60 cc083f1e6d9e85f6 0000000000000008 006fa12a796ac4d3 c291dff5ec01e8b3 cbe2873fd6f63048 c0950b7f3c1bfaca

61 d2fd8867d50d2dfe 0000000000000004 1a4a364616460d44 6491ba623149f3d0 cc6adcef1be975ef 2e475e2153d1c64a

62 06e7ea22ce92708f 0000000000000002 f307b5bcd44f3d8d 87c6963b33be0353 991d770b2bf051dc f8f7ded629f3fc48

63 166b40b44aba4bd6 0000000000000001 9cb1c3932c005c49 4fce2baa2cd647d3 17d8e9c374d14494 776bd1e53ef1d7d6
281

Table A.7 Resulting Ciphertext from the Initial Permutation Known Answer Test for TCBC-I Mode of Operation

(Decryption Process)

(NOTE -- KEY1 = KEY2 = KEY3 01 01 01 01 01 01 01 01

IV1 = 00 00 00 00 00 00 00 00

IV2 = 55 55 55 55 55 55 55 55

IV3 = aa aa aa aa aa aa aa aa)

ROUND CIPHERTEXTS PLAINTEXT1 PLAINTEXT2 PLAINTEXT3

0 8000000000000000 95f8a5e5dd31d900 c0adf0b088648c55 3f520f4f779b73aa

1 4000000000000000 dd7f121ca5015619 882a4749f054034c 77d5b8b60fabfcb3

2 2000000000000000 2e8653104f3834ea 7bd306451a6d61bf 842cf9bae5929e40

3 1000000000000000 4bd388ff6cd81d4f 1e86ddaa398d481a e1792255c672b7e5

4 0800000000000000 20b9e767b2fb1456 75ecb232e7ae4103 8a134dcd1851befc

5 0400000000000000 55579380d77138ef 0002c6d582246dba fffd392a7ddb9245

6 0200000000000000 6cc5defaaf04512f 39908baffa51047a c66f745005aefb85

7 0100000000000000 0d9f279ba5d87260 58ca72cef08d2735 a7358d310f72d8ca

8 0080000000000000 d9031b0271bd5a0a 8c564e5724e80f5f 73a9b1a8db17f0a0

9 0040000000000000 424250b37c3dd951 171705e629688c04 e8e8fa19d69773fb

10 0020000000000000 b8061b7ecd9a21e5 ed534e2b98cf74b0 12acb1d467308b4f

11 0010000000000000 f15d0f286b65bd28 a4085a7d3e30e87d 5bf7a582c1cf1782

12 0008000000000000 add0cc8d6e5deba1 f88599d83b08bef4 077a6627c4f7410b

13 0004000000000000 e6d5f82752ad63d1 b380ad7207f83684 4c7f528df807c97b

14 0002000000000000 ecbfe3bd3f591a5e b9eab6e86a0c4f0b 4615491795f3b0f4

15 0001000000000000 f356834379d165cd a603d6162c843098 59fc29e9d37bcf67

16 0000800000000000 2b9f982f20037fa9 7ecacd7a75562afc 813532858aa9d503

17 0000400000000000 889de068a16f0be6 ddc8b53df43a5eb3 22374ac20bc5a14c

18 0000200000000000 e19e275d846a1298 b4cb7208d13f47cd 4b348df72ec0b832

19 0000100000000000 329a8ed523d71aec 67cfdb8076824fb9 9830247f897db046

20 0000080000000000 e7fce22557d23c97 b2a9b770028769c2 4d56488ffd78963d

21 0000040000000000 12a9f5817ff2d65d 47fca0d42aa78308 b8035f2bd5587cf7

22 0000020000000000 a484c3ad38dc9c19 f1d196f86d89c94c 0e2e6907927636b3

23 0000010000000000 fbe00a8a1ef8ad72 aeb55fdf4badf827 514aa020b45207d8
282

ROUND CIPHERTEXTS PLAINTEXT1 PLAINTEXT2 PLAINTEXT3

24 0000008000000000 750d079407521363 205852c152074636 dfa7ad3eadf8b9c9

25 0000004000000000 64feed9c724c2faf 31abb8c927197afa ce544736d8e68505

26 0000002000000000 f02b263b328e2b60 a57e736e67db7e35 5a818c91982481ca

27 0000001000000000 9d64555a9a10b852 c831000fcf45ed07 37cefff030ba12f8

28 0000000800000000 d106ff0bed5255d7 8453aa5eb8070082 7bac55a147f8ff7d

29 0000000400000000 e1652c6b138c64a5 b430793e46d931f0 4bcf86c1b926ce0f

30 0000000200000000 e428581186ec8f46 b17d0d44d3b9da13 4e82f2bb2c4625ec

31 0000000100000000 aeb5f5ede22d1a36 fbe0a0b8b7784f63 041f5f474887b09c

32 0000000080000000 e943d7568aec0c5c bc168203dfb95909 43e97dfc2046a6f6

33 0000000040000000 df98c8276f54b04b 8acd9d723a01e51e 7532628dc5fe1ae1

34 0000000020000000 b160e4680f6c696f e435b13d5a393c3a 1bca4ec2a5c6c3c5

35 0000000010000000 fa0752b07d9c4ab8 af5207e528c91fed 50adf81ad736e012

36 0000000008000000 ca3a2b036dbc8502 9f6f7e5638e9d057 609081a9c7162fa8

37 0000000004000000 5e0905517bb59bcf 0b5c50042ee0ce9a f4a3affbd11f3165

38 0000000002000000 814eeb3b91d90726 d41bbe6ec48c5273 2be441913b73ad8c

39 0000000001000000 4d49db1532919c9f 181c8e4067c4c9ca e7e371bf983b3635

40 0000000000800000 25eb5fc3f8cf0621 70be0a96ad9a5374 8f41f5695265ac8b

41 0000000000400000 ab6a20c0620d1c6f fe3f75953758493a 01c08a6ac8a7b6c5

42 0000000000200000 79e90dbc98f92cca 2cbc58e9cdac799f d343a71632538660

43 0000000000100000 866ecedd8072bb0e d33b9b88d527ee5b 2cc464772ad811a4

44 0000000000080000 8b54536f2f3e64a8 de01063a7a6b31fd 21fef9c58594ce02

45 0000000000040000 ea51d3975595b86b bf0486c200c0ed3e 40fb793dff3f12c1

46 0000000000020000 caffc6ac4542de31 9faa93f910178b64 60556c06efe8749b

47 0000000000010000 8dd45a2ddf90796c d8810f788ac52c39 277ef087753ad3c6

48 0000000000008000 1029d55e880ec2d0 457c800bdd5b9785 ba837ff422a4687a

49 0000000000004000 5d86cb23639dbea9 08d39e7636c8ebfc f72c6189c9371403

50 0000000000002000 1d1ca853ae7c0c5f 4849fd06fb29590a b7b602f904d6a6f5

51 0000000000001000 ce332329248f3228 9b66767c71da677d 649989838e259882

52 0000000000000800 8405d1abe24fb942 d15084feb71aec17 2eaf7b0148e513e8

53 0000000000000400 e643d78090ca4207 b31682d5c59f1752 4ce97d2a3a60e8ad

54 0000000000000200 48221b9937748a23 1d774ecc6221df76 e288b1339dde2089

55 0000000000000100 dd7c0bbd61fafd54 88295ee834afa801 77d6a117cb5057fe

56 0000000000000080 2fbc291a570db5c4 7ae97c4f0258e091 851683b0fda71f6e
283

ROUND CIPHERTEXTS PLAINTEXT1 PLAINTEXT2 PLAINTEXT3

57 0000000000000040 e07c30d7e4e26e12 b5296582b1b73b47 4ad69a7d4e48c4b8

58 0000000000000020 0953e2258e8e90a1 5c06b770dbdbc5f4 a3f9488f24243a0b

59 0000000000000010 5b711bc4ceebf2ee 0e244e919bbea7bb f1dbb16e64415844

60 0000000000000008 cc083f1e6d9e85f6 995d6a4b38cbd0a3 66a295b4c7342f5c

61 0000000000000004 d2fd8867d50d2dfe 87a8dd32805878ab 785722cd7fa78754

62 0000000000000002 06e7ea22ce92708f 53b2bf779bc725da ac4d40886438da25

63 0000000000000001 166b40b44aba4bd6 433e15e11fef1e83 bcc1ea1ee010e17c
284

Table A.8 Values To Be Used for the Substitution Table Known Answer Test

for TCBC-I Mode of Operation

(NOTE -- IV1 = 00 00 00 00 00 00 00 00

 IV2 = 55 55 55 55 55 55 55 55

 IV3 = aa aa aa aa aa aa aa aa)

ROUND KEY PLAINTEXTS CIPHERTEXT1 CIPHERTEXT2 CIPHERTEXT3

0 7ca110454a1a6e57 01a1d6d039776742 690f5b0d9a26939b 89202f224f1f2261 585a1e8d89705d10

1 0131d9619dc1376e 5cd54ca83def57da 7a389d10354bd271 6dda0de99d3c86b9 99985b67b598bd25

2 07a1133e4a0b2686 0248d43806f67172 868ebb51cab4599a 8200616c589bc7aa d2ff67461377fbb5

3 3849674c2602319e 51454b582ddf440a 7178876e01f19b2a 64757292febccad1 93bd8beeea2310fc

4 04b915ba43feb5b6 42fd443059577fa2 af37fb421f8c4095 204fc6123992d4e9 6bfb4df0569cebce

5 0113b970fd34f2ce 059b5e0851cf143a 86a560f10ec6d85b 1fa86f6f735603a3 0be3558738c6d7c3

6 0170f175468fb5e6 0756d8e0774761d2 0cd3da020021dc09 65e05d62b35aa365 3bfc9a3f034da292

7 43297fad38e373fe 762514b829bf486a ea676b2cb7db2b7a 95c0f9e595aec2ff ea9ab3585f166586

8 07a7137045da2a16 3bdd119049372802 dfd64a815caf1a0f 127359c20e10e25a 953a36ff13a08906

9 04689104c2fd3b2f 26955f6835af609a 5c513c9c4886c088 b089d90f84ef0c4c 08bd60f6f80d6fad

10 37d06bb516cb7546 164d5e404f275232 0a2aeeae3ff4ab77 32bbdd67d4e66dd6 83a30606fc78d740

11 1f08260d1ac2465e 6b056e18759f5cca ef1bf03e5dfa575a b4873081fdebc81d 6445799c9b701694

12 584023641aba6176 004bd6ef09176062 88bf0db6d70dee56 988fe2e8e1755e78 1e1fdd8660a75bb5

13 025816164629b007 480d39006ee762f2 a1f9915541020b56 ee6c0febb212b218 60bae59c51767394

14 49793ebc79b3258f 437540c8698f3cfa 6fbf1cafcffd0556 c03adc2b6aa85b5b 826ec7e02f486885

15 4fb05e1515ab73a7 072d43a077075292 2f22e49bab7ca1ac 096a4136e0f65f76 9e30377b7a39d5d3

16 49e95d6d4ca229bf 02fe55778117f12a 5a6b612cc26cce4a bf4da6aa59ed5751 64b77306321a932c

17 018310dc409b26d6 1d9d5c5018f728c2 5f4c038ed12b2e41 aab93390e13d3bb3 3b17daff733fcfb0

18 1c587f1c13924fef 305532286d6f295a 63fac0d034d9f793 db3c4106c5db5648 7f38215d73b0ee62
285

Table A.9 Resulting Ciphertext from the Variable TEXT Known Answer Test

for TCFB-P and TOFB-I Modes of Operation

(NOTE -- TEXT = 00 00 00 00 00 00 00 00

 IV1 = 00 00 00 00 00 00 00 00

 IV2 = 55 55 55 55 55 55 55 55

 IV3 = aa aa aa aa aa aa aa aa)

RND PLAINTEXT1 ⊕ IV1 CIPHERTEXT1 PLAINTEXT2 ⊕ IV2 CIPHERTEXT2 PLAINTEXT3 ⊕ IV3 CIPHERTEXT3

0 8000000000000000 95f8a5e5dd31d900 d555555555555555 f7552ab6cb21e2bc 2aaaaaaaaaaaaaaa 5a48d3de869557fd

1 4000000000000000 dd7f121ca5015619 9555555555555555 0c783d97d0dbf51a eaaaaaaaaaaaaaaa f15ee2019a5b547c

2 2000000000000000 2e8653104f3834ea 7555555555555555 05b865a1e49ed109 caaaaaaaaaaaaaaa f925b68465b6078c

3 1000000000000000 4bd388ff6cd81d4f 6555555555555555 9e51152dbce90b02 baaaaaaaaaaaaaaa f6089ca9b722765c

4 0800000000000000 20b9e767b2fb1456 5d55555555555555 c39193d42381b313 b2aaaaaaaaaaaaaa 4f1b8036d441af95

5 0400000000000000 55579380d77138ef 5955555555555555 e293394891554b68 aeaaaaaaaaaaaaaa 45089186180bd591

6 0200000000000000 6cc5defaaf04512f 5755555555555555 1359f4d663a3209c acaaaaaaaaaaaaaa d86dd807085fa8e6

7 0100000000000000 0d9f279ba5d87260 5655555555555555 0d0f03e8f8594a66 abaaaaaaaaaaaaaa d27eb94e56c3172a

8 0080000000000000 d9031b0271bd5a0a 55d5555555555555 4334b5fe1b7f5320 ab2aaaaaaaaaaaaa d6ad42065e31bdb1

9 0040000000000000 424250b37c3dd951 5595555555555555 9484c1c29b62c41e aaeaaaaaaaaaaaaa f54f2bd8e2eb2bc6

10 0020000000000000 b8061b7ecd9a21e5 5575555555555555 c8eb2e340855325b aacaaaaaaaaaaaaa 6cf8932328c7e49b
286

RND PLAINTEXT1 ⊕ IV1 CIPHERTEXT1 PLAINTEXT2 ⊕ IV2 CIPHERTEXT2 PLAINTEXT3 ⊕ IV3 CIPHERTEXT3

11 0010000000000000 f15d0f286b65bd28 5565555555555555 e88a676ef848e6d1 aabaaaaaaaaaaaaa 72ea3aadb569af43

12 0008000000000000 add0cc8d6e5deba1 555d555555555555 be433af4c5ae0f97 aab2aaaaaaaaaaaa 0d71ecadd7a49fec

13 0004000000000000 e6d5f82752ad63d1 5559555555555555 9e32639bb9d27cc7 aaaeaaaaaaaaaaaa fc1463bb9bba9e11

14 0002000000000000 ecbfe3bd3f591a5e 5557555555555555 fa510732fa871094 aaacaaaaaaaaaaaa 31568f2e0ac0d693

15 0001000000000000 f356834379d165cd 5556555555555555 9f1b31571ed41078 aaabaaaaaaaaaaaa fbcfc086f8111572

16 0000800000000000 2b9f982f20037fa9 5555d55555555555 f4169ca3fc6799ed aaab2aaaaaaaaaaa d67ca5071769cafe

17 0000400000000000 889de068a16f0be6 5555955555555555 e9a738ac85e2ca4b aaaaeaaaaaaaaaaa 63fc8ec1421399b8

18 0000200000000000 e19e275d846a1298 5555755555555555 ee26a403caca387d aaaacaaaaaaaaaaa 5d84b7acabb63bfb

19 0000100000000000 329a8ed523d71aec 5555655555555555 0b3f88ef87d85953 aaaabaaaaaaaaaaa e3f663de44003f9b

20 0000080000000000 e7fce22557d23c97 55555d5555555555 bb04e854f99f6352 aaaab2aaaaaaaaaa 4e5892f230b6d6d1

21 0000040000000000 12a9f5817ff2d65d 5555595555555555 f0881280455dec63 aaaaaeaaaaaaaaaa 4432a11e1c320e7a

22 0000020000000000 a484c3ad38dc9c19 5555575555555555 8ae9dee849b46527 aaaaacaaaaaaaaaa 02ce21a9c83ba4d6

23 0000010000000000 fbe00a8a1ef8ad72 5555565555555555 74b7d252cae558fb aaaaabaaaaaaaaaa 6fd1d0793c1b7af2

24 0000008000000000 750d079407521363 555555d555555555 b8b27d1286bdbb26 aaaaab2aaaaaaaaa fc286fa362d8c93c

25 0000004000000000 64feed9c724c2faf 5555559555555555 4e3dd222e292dd96 aaaaaaeaaaaaaaaa e3a7abc88132ad7d

26 0000002000000000 f02b263b328e2b60 5555557555555555 a213c5c56fdca139 aaaaaacaaaaaaaaa 8868d3114021a027
287

RND PLAINTEXT1 ⊕ IV1 CIPHERTEXT1 PLAINTEXT2 ⊕ IV2 CIPHERTEXT2 PLAINTEXT3 ⊕ IV3 CIPHERTEXT3

27 0000001000000000 9d64555a9a10b852 5555556555555555 05df49a56a345cf9 aaaaaabaaaaaaaaa 568fa34d2fc7225e

28 0000000800000000 d106ff0bed5255d7 5555555d55555555 c32c19229d84e2b4 aaaaaab2aaaaaaaa 1f81cbb9403ecc59

29 0000000400000000 e1652c6b138c64a5 5555555955555555 89c6e06ce6164d84 aaaaaaaeaaaaaaaa edd6029a6b80a442

30 0000000200000000 e428581186ec8f46 5555555755555555 5924454953ad5732 aaaaaaacaaaaaaaa ef90911c0f9a66f3

31 0000000100000000 aeb5f5ede22d1a36 5555555655555555 7a3e15c0953b08cc aaaaaaabaaaaaaaa 91f5b30f015b4a54

32 0000000080000000 e943d7568aec0c5c 55555555d5555555 88e3dd1448c4e0ff aaaaaaab2aaaaaaa a5aec2896cff08e5

33 0000000040000000 df98c8276f54b04b 5555555595555555 9f55ebaca42cb845 aaaaaaaaeaaaaaaa 97061699383bbfe0

34 0000000020000000 b160e4680f6c696f 5555555575555555 a5206a311e9c2515 aaaaaaaacaaaaaaa 08e218f2cb1ede18

35 0000000010000000 fa0752b07d9c4ab8 5555555565555555 e944c64af09dfa84 aaaaaaaabaaaaaaa 1a6849edcb701b07

36 0000000008000000 ca3a2b036dbc8502 555555555d555555 af1200418fd37fdd aaaaaaaab2aaaaaa 85480c507233c006

37 0000000004000000 5e0905517bb59bcf 5555555559555555 574a377b5a150353 aaaaaaaaaeaaaaaa bcaa0b7b7b3464c5

38 0000000002000000 814eeb3b91d90726 5555555557555555 456a1865905ed57d aaaaaaaaacaaaaaa 0439f36972dc531f

39 0000000001000000 4d49db1532919c9f 5555555556555555 8427c42d027a34d0 aaaaaaaaabaaaaaa 62133d9330e2e86b

40 0000000000800000 25eb5fc3f8cf0621 5555555555d55555 58da89972266a7e3 aaaaaaaaab2aaaaa f9c2472742b5f9e8

41 0000000000400000 ab6a20c0620d1c6f 5555555555955555 1ed858bcbc934c17 aaaaaaaaaaeaaaaa db36baba70c3b9af

42 0000000000200000 79e90dbc98f92cca 5555555555755555 88249b73e99c5ac0 aaaaaaaaaacaaaaa 0758b13e912d53cb
288

RND PLAINTEXT1 ⊕ IV1 CIPHERTEXT1 PLAINTEXT2 ⊕ IV2 CIPHERTEXT2 PLAINTEXT3 ⊕ IV3 CIPHERTEXT3

43 0000000000100000 866ecedd8072bb0e 5555555555655555 69314212c7a9d6b1 aaaaaaaaaabaaaaa 70470a07cb34e109

44 0000000000080000 8b54536f2f3e64a8 55555555555d5555 cd8dc942ae2bb175 aaaaaaaaaab2aaaa 9c6ade3a9e772c7c

45 0000000000040000 ea51d3975595b86b 5555555555595555 4c0a052894ed7436 aaaaaaaaaaaeaaaa 26e6223634c857a3

46 0000000000020000 caffc6ac4542de31 5555555555575555 16952dc89c0acd65 aaaaaaaaaaacaaaa 72dfd337fe183a6d

47 0000000000010000 8dd45a2ddf90796c 5555555555565555 92ef4c4350711745 aaaaaaaaaaabaaaa 363219d8cec5a9f3

48 0000000000008000 1029d55e880ec2d0 555555555555d555 b40225aea121c8d3 aaaaaaaaaaab2aaa 4bc89c1804bcae82

49 0000000000004000 5d86cb23639dbea9 5555555555559555 a9eab121edde0ca7 aaaaaaaaaaaaeaaa ae527ed311a25ea2

50 0000000000002000 1d1ca853ae7c0c5f 5555555555557555 4fb69c832db68026 aaaaaaaaaaaacaaa a1584c1024f61f3d

51 0000000000001000 ce332329248f3228 5555555555556555 761b3d1ff06c513e aaaaaaaaaaaabaaa c55d7544a1eae274

52 0000000000000800 8405d1abe24fb942 5555555555555d55 6be457abc511e87c aaaaaaaaaaaab2aa aef861c69fd34489

53 0000000000000400 e643d78090ca4207 5555555555555955 ebb5a1887b1f6e3a aaaaaaaaaaaaaeaa 3d19267de9c12e7b

54 0000000000000200 48221b9937748a23 5555555555555755 d23a8dfe39c98883 aaaaaaaaaaaaacaa ade513b3ed994800

55 0000000000000100 dd7c0bbd61fafd54 5555555555555655 9f986bb8f7e6fa46 aaaaaaaaaaaaabaa d43941ab72932bb0

56 0000000000000080 2fbc291a570db5c4 55555555555555d5 0adcf552ec1754c6 aaaaaaaaaaaaab2a 7f7352dfade13e13

57 0000000000000040 e07c30d7e4e26e12 5555555555555595 6c25b868caf1f7d3 aaaaaaaaaaaaaaea 74bc744f10f63889

58 0000000000000020 0953e2258e8e90a1 5555555555555575 0912754e7c42f637 aaaaaaaaaaaaaaca a483f2da4099a136
289

RND PLAINTEXT1 ⊕ IV1 CIPHERTEXT1 PLAINTEXT2 ⊕ IV2 CIPHERTEXT2 PLAINTEXT3 ⊕ IV3 CIPHERTEXT3

59 0000000000000010 5b711bc4ceebf2ee 5555555555555565 2fa6a76d9b83e3dd aaaaaaaaaaaaaaba a2e13c5701a60444

60 0000000000000008 cc083f1e6d9e85f6 555555555555555d 006fa12a796ac4d3 aaaaaaaaaaaaaab2 bc10a45ceedb56b3

61 0000000000000004 d2fd8867d50d2dfe 5555555555555559 6a0bd7954b5aa04d aaaaaaaaaaaaaaae cc6adcef1be975ef

62 0000000000000002 06e7ea22ce92708f 5555555555555557 f307b5bcd44f3d8d aaaaaaaaaaaaaaac 3dc004f9cd4a9c22

63 0000000000000001 166b40b44aba4bd6 5555555555555556 009e8232891c8a36 aaaaaaaaaaaaaaab 17d8e9c374d14494
290

Table A.10 Values to be Used for the Substitution Table Known Answer Test

for TCFB-P and TOFB-I Modes of Operation

(NOTE -- TEXT = 00 00 00 00 00 00 00 00)

RND KEY IV1 CIPHERTEXT2 IV2 CIPHERTEXT2 IV3 CIPHERTEXT3

0 7ca110454a1a6e57 01a1d6d039776742 690f5b0d9a26939b 56f72c258eccbc97 97fc1b9381f05ffa ac4c817ae42211ec e90a658ca212b240

1 0131d9619dc1376e 5cd54ca83def57da 7a389d10354bd271 b22aa1fd9344ad2f 1697f74514a33238 077ff752e89a0284 21329d25683b4606

2 07a1133e4a0b2686 0248d43806f67172 868ebb51cab4599a 579e298d5c4bc6c7 3c33dc00289664d0 acf37ee2b1a11c1c 66477e326b77dd91

3 3849674c2602319e 51454b582ddf440a 7178876e01f19b2a a69aa0ad8334995f 941fcf0e43a965af fbeff602d889eeb4 8d71d3da699fa6f5

4 04b915ba43feb5b6 42fd443059577fa2 af37fb421f8c4095 98529985aeacd4f7 1e327e778501022a eda7eedb04022a4c 9e547f92a9ad358c

5 0113b970fd34f2ce 059b5e0851cf143a 86a560f10ec6d85b 5af0b35da724698f 637038eaaa7d167e b04608b2fc79bee4 6f975aa305eb7548

6 0170f175468fb5e6 0756d8e0774761d2 0cd3da020021dc09 5cac2e35cc9cb727 1c7fe0ddc80d3f6e b201838b21f20c7c cad8716fc1176297

7 43297fad38e373fe 762514b829bf486a ea676b2cb7db2b7a cb7a6a0d7f149dbf 4b36062823e8190f 20cfbf62d469f314 664e8d98d3986cfe

8 07a7137045da2a16 3bdd119049372802 dfd64a815caf1a0f 913266e59e8c7d57 1ff289bc8e07c5f3 e687bc3af3e1d2ac 948ab876125e7c7f

9 04689104c2fd3b2f 26955f6835af609a 5c513c9c4886c088 7beab4bd8b04b5ef 19f76ad4a415b1c1 d1400a12e05a0b44 75d6085d1b1e472d

10 37d06bb516cb7546 164d5e404f275232 0a2aeeae3ff4ab77 6ba2b395a47ca787 c78b293dc022c9aa c0f808eaf9d1fcdc 6ac4da432141aa16

11 1f08260d1ac2465e 6b056e18759f5cca ef1bf03e5dfa575a c05ac36dcaf4b21f 5469ad2a9c97bf19 15b018c3204a0774 9983b852b915da86

12 584023641aba6176 004bd6ef09176062 88bf0db6d70dee56 55a12c445e6cb5b7 77aeb7e9d51577e5 aaf68199b3c20b0c fb716445f1a43232

13 025816164629b007 480d39006ee762f2 a1f9915541020b56 9d628e55c43cb847 08cdd6072e276e2e f2b7e3ab19920d9c fdb44a9e6f4bd7dc
291

RND KEY IV1 CIPHERTEXT2 IV2 CIPHERTEXT2 IV3 CIPHERTEXT3

14 49793ebc79b3258f 437540c8698f3cfa 6fbf1cafcffd0556 98ca961dbee4924f 0aa3768ad4358b6c ee1feb731439e7a4 68b40c29c2238233

15 4fb05e1515ab73a7 072d43a077075292 2f22e49bab7ca1ac 5c8298f5cc5ca7e7 7fd1411fd6a31497 b1d7ee4b21b1fd3c dd6359e601656be3

16 49e95d6d4ca229bf 02fe55778117f12a 5a6b612cc26cce4a 5853aaccd66d467f 116a6ae6e1e47270 ada900222bc29bd4 b16f4467a4f95fd0

17 018310dc409b26d6 1d9d5c5018f728c2 5f4c038ed12b2e41 72f2b1a56e4c7e17 de11d7e1c6d5797c c84806fac3a1d36c 9cb7c0a87fa2bdbe

18 1c587f1c13924fef 305532286d6f295a 63fac0d034d9f793 85aa877dc2c47eaf 9896336cbadada37 daffdcd31819d404 1c5e61a81d05a5ef
292

Table A.11 Resulting Ciphertext from the Variable KEY Known Answer Test

for TCBC-I, TCFB-P and TOFB-I Modes of Operation

(NOTE -- TEXT1 = TEXT2 = TEXT3 = 00 00 00 00 00 00 00 00

 IV1 = 00 00 00 00 00 00 00 00

 IV2 = 55 55 55 55 55 55 55 55

 IV3 = aa aa aa aa aa aa aa aa)

ROUND KEY C1/RESULT1 C2/RESULT2 C3/RESULT3

0 8001010101010101 95a8d72813daa94d b8bc8dbc0b24cfa9 1e08a515c11e0de1

1 4001010101010101 0eec1487dd8c26d5 badb3425df504209 0608b0c77f0ab511

2 2001010101010101 7ad16ffb79c45926 34069d06536cfaf8 3d090b850910022e

3 1001010101010101 d3746294ca6a6cf3 53edd6c7b2d8663c 19d83418eaf8e3ab

4 0801010101010101 809f5f873c1fd761 17d1d4a8731b3acd 91da457d7e16d6a5

5 0401010101010101 c02faffec989d1fc 51454c54f4ea817e 6a4ec92bc50c9503

6 0201010101010101 4615aa1d33e72f10 8f640c66e3ad6c5f a185e92b67a45257

7 0180010101010101 2055123350c00858 e09a8dbe2b782986 0b7e13fdbadc96aa

8 0140010101010101 df3b99d6577397c8 6b1e20d1be1c25e5 eacef886f5087ce8

9 0120010101010101 31fe17369b5288c9 d7c9ed116a4ca5c3 69c60f1118060221

10 0110010101010101 dfdd3cc64dae1642 bb34b6ec92447bdc 99547b8b947e8c44
293

ROUND KEY C1/RESULT1 C2/RESULT2 C3/RESULT3

11 0108010101010101 178c83ce2b399d94 39ad35b103ea754c aef4932bb880ffe7

12 0104010101010101 50f636324a9b7f80 502c48c0b6f5da1e cd7942c2f0db9598

13 0102010101010101 a8468ee3bc18f06d 6da06bc26cd27347 b299efe073df56d0

14 0101800101010101 a2dc9e92fd3cde92 048b509f61329322 57fd7a94bd090076

15 0101400101010101 cac09f797d031287 cf18ef06ff4726dd 364898370f13783a

16 0101200101010101 90ba680b22aeb525 5e68a2a3f420ced2 7021fa3c611c5353

17 0101100101010101 ce7a24f350e280b6 f2241608a9c01443 4ad01e2a4f325e1b

18 0101080101010101 882bff0aa01a0b87 4d5268c568b57e87 d06a7e3c1016a256

19 0101040101010101 25610288924511c2 12537c78d5b135f5 af1c2074ea3952f7

20 0101020101010101 c71516c29c75d170 2a447d1d0918e635 643eacd845d0ac81

21 0101018001010101 5199c29a52c9f059 c45e53dbad3642c6 077f60d16feecc6d

22 0101014001010101 c22f0a294a71f29f 86b57a072d1af70c 2add0d3ff6b568ba

23 0101012001010101 ee371483714c02ea 3c6c5d0ad80d7409 0730787152b406bc

24 0101011001010101 a81fbd448f9e522f 3613b5811324cac7 ae3ef9ebdca26f00

25 0101010801010101 4f644c92e192dfed 50ed144cedb736ac 2abd3b256652632b

26 0101010401010101 1afa9a66a6df92ae bc5bc5a66a53b929 a2e9fa40e6b6cfca
294

ROUND KEY C1/RESULT1 C2/RESULT2 C3/RESULT3

27 0101010201010101 b3c1cc715cb879d8 5d1f09ffcd80d21b bd11881fa1f9c189

28 0101010180010101 19d032e64ab0bd8b a8b79d2e02415d8e 925d1851ab04bafa

29 0101010140010101 3cfaa7a7dc8720dc 932c31352789dff9 4dafea6ad259c035

30 0101010120010101 b7265f7f447ac6f3 2ec8e9923a8a010c e0f7a70dbdd597b7

31 0101010110010101 9db73b3c0d163f54 f36e475bb9a8fb57 88dad0c28986f116

32 0101010108010101 8181b65babf4a975 73f174b827a22fbf 205fd48356602a2f

33 0101010104010101 93c9b64042eaa240 c76d844d9918627d ddaba956a4fd22c5

34 0101010102010101 5570530829705592 beff48907877eedd 775f3bbfea9a0637

35 0101010101800101 8638809e878787a0 7829e156fdd34db6 c26ea76714b38596

36 0101010101400101 41b9a79af79ac208 7b2545576a6992d9 46ca820bcf0a462b

37 0101010101200101 7a9be42f2009a892 0b59503dc812b27f 2a5e46fd70852d73

38 0101010101100101 29038d56ba6d2745 07b67fe9359a3026 145ad75857e4b4b3

39 0101010101080101 5495c6abf1e5df51 a82b120e4080136e 99525cafa664a0f9

40 0101010101040101 ae13dbd561488933 e3533571ee3d99eb d1c679a7a2c4156c

41 0101010101020101 024d1ffa8904e389 eb57f8c58f18b849 e653401e4d004c74

42 0101010101018001 d1399712f99bf02e 505e3b0af188d731 02b8091c05f5e061
295

ROUND KEY C1/RESULT1 C2/RESULT2 C3/RESULT3

43 0101010101014001 14c1d7c1cffec79e 0f38a59e95a70f13 9879d116764dafe3

44 0101010101012001 1de5279dae3bed6f 97108885fe2018ed 154b6e3c9a2871b1

45 0101010101011001 e941a33f85501303 71147052540af3d8 21397c0ec6a47e75

46 0101010101010801 da99dbbc9a03f379 563df95ec668d933 d11d4e56261716a9

47 0101010101010401 b7fc92f91d8e92e9 c8003e219b996cc7 fb258b1abf89b7c4

48 0101010101010201 ae8e5caa3ca04e85 722fb450715fb317 c52f5e37f39d1e6f

49 0101010101010180 9cc62df43b6eed74 7edfaaa980158515 e91439e9838dcc9d

50 0101010101010140 d863dbb5c59a91a0 82fb07d5e1d5b100 78c2810a85028047

51 0101010101010120 a1ab2190545b91d7 04f0cbaff1735340 d466ec944a1fe7f7

52 0101010101010110 0875041e64c570f7 70ee1ae9b095db22 2fcd9094c8d397f2

53 0101010101010108 5a594528bebef1cc 004dd0b91a2e7709 80181b831cdc8d61

54 0101010101010104 fcdb3291de21f0c0 cab8e849e0ab0c32 3367b1fbb4d2ffa7

55 0101010101010102 869efd7f9f265a09 451f0c33f24fb8dc 2b74c1d96cde840b
296

Table A.12 Values To Be Used for the Permutation Operation Known Answer Test

for TCBC-I, TCFB-P and TOFB-I Modes of Operation

(NOTE -- TEXT1 = TEXT2 = TEXT3 = 00 00 00 00 00 00 00 00

 IV1 = 00 00 00 00 00 00 00 00

 IV2 = 55 55 55 55 55 55 55 55

 IV3 = aa aa aa aa aa aa aa aa)

ROUND KEY C1/RESULT1 C2/RESULT2 C3/RESULT3

0 1046913489980131 88d55e54f54c97b4 23c25ab3e19b6b94 e5b490db69b0f2ec

1 1007103489988020 0c0cc00c83ea48fd 9e7b9f655eafef5d 2031be52988cd49e

2 10071034c8980120 83bc8ef3a6570183 948e0180ec95ab61 fcb4a56abf4b7b4e

3 1046103489988020 df725dcad94ea2e9 e97bb3b10db9f700 f627685cf879c481

4 1086911519190101 e652b53b550be8b0 df9e3ce144e6a0df 373a495e2a289a9e

5 1086911519580101 af527120c485cbb0 5fc7e5405519f6fb 5d8c63f84dc7b760

6 5107b01519580101 0f04ce393db926d5 4ce6c34fc99a7e47 43599c906eaa26af

7 1007b01519190101 c9f00ffc74079067 d59da3b97fa77d57 3ad69f58d64555fd

8 3107915498080101 7cfd82a593252b4e 2c90e8dcbfd28764 f5fec7cc3602fb9c

9 3107919498080101 cb49a2f9e91363e3 e3ef1da5cdfe2040 cbab42d154f3248c

10 10079115b9080140 00b588be70d23f56 ab256e068344f3d9 2957f7aec090659f
297

ROUND KEY C1/RESULT1 C2/RESULT2 C3/RESULT3

11 3107911598080140 406a9a6ab43399ae 142df8fbcdf06f6c f3e52c8470bd4d49

12 1007d01589980101 6cb773611dca9ada 646449eb196edbc7 2c73895acb28e4d4

13 9107911589980101 67fd21c17dbb5d70 5bc918389c2a4f52 6d09d8d4450d34ef

14 9107d01589190101 9592cb4110430787 325e278ccb35a9b4 c67bed021618f6e8

15 1007d01598980120 a6b7ff68a318ddd3 bb2eaf9937470838 e45e7c5e8ba13dae

16 1007940498190101 4d102196c914ca16 a79acae80a89e1cf 73a5317d256ee9e6

17 0107910491190401 2dfa9f4573594965 70ce079b819d62a4 a6683459b9162215

18 0107910491190101 b46604816c0e0774 d40017b0499f3b3f ef4c12c38fa94b67

19 0107940491190401 6e7e6221a4f34e87 484e191a8899dbd3 5bc2e500fd653804

20 19079210981a0101 aa85e74643233199 34ca696261a93635 d566849104e9f2f4

21 1007911998190801 2e5a19db4d1962d6 59a314314758d33c fde57dae97810b56

22 10079119981a0801 23a866a809d30894 7782def75ae242b2 efaaba105ea97d41

23 1007921098190101 d812d961f017d320 e216e1e31589ec45 046bb3c67162342f

24 100791159819010b 055605816e58608f 75ecaecf73060451 e1729017bbdcfbd2

25 1004801598190101 abd88e8b1b7716f1 19dfcaebdf3f8958 ab3b5a50ebd4c354

26 1004801598190102 537ac95be69da1e1 16886a23bbb4cdba 353357f88bec120f
298

ROUND KEY C1/RESULT1 C2/RESULT2 C3/RESULT3

27 1004801598190108 aed0f6ae3c25cdd8 fc9e390a9093a7ac 8868a9829113d4a3

28 1002911598100104 b3e35a5ee53e7b8d 13685e1b83c61eef 0ec122be6dc26c83

29 1002911598190104 61c79c71921a2ef8 1d19adde7fb74e34 9792ca21f5adbce6

30 1002911598100201 e2f5728f0995013c 1423db30c7e118fb e5f2d4dd2f43d9d1

31 1002911698100101 1aeac39a61f0a464 31eed52fa33c013d dcf4548cf2374875
299

REFERENCES

[1] Triple Data Encryption Algorithm Modes of Operation, ANSI X9.52 - 1998.

[2] Modes of Operation Validation System (MOVS): Requirements and Procedures, NIST

Special Publication 800-17, 1998.

[3] Data Encryption Standard (DES), FIPS PUB 46-3 - 1999.