libtom/libtomcrypt — Issue #5: Pi functions incorrect in ltc's Noekeon
Author: ppelleti
Created: 2011-12-28 11:07:22+00:00
State: open

I believe that libTomCrypt's implementation of Noekeon is incorrect. (There is only one test vector for Noekeon in LTC. Where did that test vector come from, and has LTC's Noekeon been tested for interoperation with any other implementation?)

According to the Noekeon spec (available at gro.noekeon.org), the Pi1 and Pi2 functions operate on a[1], a[2], and a[3]. (In the notation used by libTomCrypt, which uses scalar variables instead of an array, that would be b, c, and d.)

However, libTomCrypt's PI1 and PI2 operate on a, c, and d. (Which, in the array notation from the Noekeon paper, would be a[0], a[2], and a[3].)

I've done some testing, and libTomCrypt's Noekeon as it currently is does not match the result's of BouncyCastle's Noekeon. But, if I change LTC's Pi functions to match the Noekeon paper, then it does produce the same results as BouncyCastle.