I have reviewed the test vectors for LRW-AES, and have concluded they
were generated correctly. The only caveat is that we might consider
specifying the bit order of the polynomial inputs. Specifically, block
1 is represented as 0...00000001, which is taken to be the identity
polynomial 1 (not x^127). Reversing the bits would mean 1 would be
represented by the vector 80000000...0, which is much less intuitive.
The test vectors are correct either way, it's just how we want to
represent them on paper.
I have generated a full sector test vector (attached), using block
numbers ('I' values in the standard) ranging from 1 to 32, and a 256-bit
AES key.
Ken Buchanan
Kasten Chase
This data starts at sector 0, so therefore the first tweak block will be number
1.
AES-256 Key (Key 1)
f8 d4 76 ff d6 46 ee 6c 23 84 cb 1c 77 d6 19 5d
fe f1 a9 f3 7b bc 8d 21 a7 9c 21 f8 cb 90 02 89
Tweak key (Key 2)
a8 45 34 8e c8 c5 b5 f1 26 f5 0e 76 fe fd 1b 1e
Plaintext:
The length of the data is 512
05 11 b7 18 ab c6 2d ac 70 5d f6 22 94 cd e5 6c
17 6b f6 1c f0 f3 6e f8 50 38 1f 71 49 b6 57 d6
8f cb 8d 6b e3 a6 29 90 fe 2a 62 82 ae 6d 8b f6
ad 1e 9e 20 5f 38 be 04 da 10 8e ed a2 a4 87 ab
da 6b b4 0c 75 ba d3 7c c9 ac 42 31 95 7c c9 04
eb d5 6e 32 69 8a db a6 15 d7 3f 4f 2f 66 69 03
9c 1f 54 0f de 1f f3 65 4c 96 12 ed 7c 92 03 01
6f bc 35 93 ac f1 27 f1 b4 96 82 5a 5f b0 a0 50
89 a4 8e 66 44 85 cc fd 33 14 70 e3 96 b2 c3 d3
bb 54 5a 1a f9 74 a2 c5 2d 64 75 dd b4 54 e6 74
8c d3 9d 9e 86 ab 51 53 b7 93 3e 6f d0 4e 2c 40
f6 a8 2e 3e 9d f4 66 a5 76 12 73 44 1a 56 d7 72
88 cd 21 8c 4c 0f fe da 95 e0 3a a6 a5 84 46 cd
d5 3e 9d 3a e2 67 e6 60 1a e2 70 85 58 c2 1b 09
e1 d7 2c ca ad a8 8f f9 ac b3 0e db ca 2e e2 b8
51 71 d9 3c 6c f1 56 f8 ea 9c f1 fb 0c e6 b7 10
1c f8 a9 7c e8 53 35 c1 90 3e 76 4a 74 a4 21 2c
f6 2c 4e 0f 94 3a 88 2e 41 09 6a 33 7d f6 dd 3f
8d 23 31 74 84 eb 88 6e cc b9 bc 22 83 19 07 22
a5 2d df a5 f3 80 85 78 84 39 6a 6d 6a 99 4f a5
15 fe 46 b0 e4 6c a5 41 3c ce 8f 42 60 71 a7 75
08 40 65 8a 82 bf f5 43 71 96 a9 4d 44 8a 20 be
fa 4d bb c0 7d 31 96 65 e7 75 e5 3e fd 92 3b c9
55 bb 16 7e f7 c2 8c a4 40 1d e5 ef 0e df e4 9a
62 73 65 fd 46 63 25 3d 2b af e5 64 fe a5 5c cf
24 f3 b4 ac 64 ba df 4b c6 96 7d 81 2d 8d 97 f7
c5 68 77 84 32 2b cc 85 74 96 f0 12 77 61 b9 eb
71 aa 82 cb 1c db 89 c8 c6 b5 e3 5c 7d 39 07 24
da 39 87 45 c0 2b bb 01 ac bc 2a 5c 7f fc e8 ce
6d 9c 6f ed d3 c1 a1 d6 c5 55 a9 66 2f e1 c8 32
a6 5d a4 3a 98 73 e8 45 a4 c7 a8 b4 f6 13 03 f6
e9 2e c4 29 0f 84 db c4 21 c4 c2 75 67 89 37 0a
Ciphertext:
The length of the data is 512
1a 1d a9 30 ad f9 2f 9b b6 1d ae ef f0 2f f8 5a
39 3c bf 2a b2 45 b2 23 1b 63 3c cf aa be cf 4e
fa e8 29 c2 20 68 2b 3c 2e 8b f7 6e 25 bd e3 3d
66 27 d6 af d6 64 3e e3 e8 58 46 97 39 51 07 de
cb 37 bc a9 c0 5f 75 c3 0e 84 23 1d 16 d4 1c 59
9c 1a 02 55 ab 3a 97 1d df dd c7 06 51 d7 70 ae
23 c6 8c f5 1e a0 e5 82 b8 b2 bf 04 a0 32 8e 68
eb af 6e 2d 94 22 2f ce 4c b5 59 e2 a2 2f a0 98
1a 97 c6 d4 b5 00 59 f2 84 14 72 b1 9a 6e a3 7f
ea 20 e7 cb 65 77 3a df c8 97 67 15 c2 2a 27 cc
18 55 a1 24 0b 24 24 af 5b ec 68 b8 c8 f5 ba 63
ff ed 89 ce d5 3d 88 f3 25 ef 05 7c 3a ef eb d8
7a 32 0d d1 1e 58 59 99 90 25 b5 26 b0 e3 2b 6c
4c a9 8b 84 4f 5e 01 50 41 30 58 c5 62 74 52 1d
45 24 6a 42 64 4f 97 1c a8 66 b5 6d 79 d4 0d 48
c5 5f f3 90 32 dd dd e1 e4 a9 9f fc c3 52 5a 46
e4 81 84 95 36 59 7a 6b aa b3 60 ad ce 9f 9f 28
e0 01 75 22 c4 4e a9 62 5c 62 0d 00 cb 13 e8 43
72 d4 2d 53 46 b5 d1 16 22 18 df 34 33 f5 d6 1c
b8 79 78 97 94 ff 72 13 4c 27 fc cb bf 01 53 a6
b4 50 6e de df b5 43 a4 59 df 52 f9 7c e0 11 6f
2d 14 8e 24 61 2c e1 17 cc ce 51 0c 19 8a 82 30
94 d5 3d 6a 53 06 5e bd b7 eb fa fd 27 51 de 85
1e 86 53 11 53 94 00 ee 2b 8c 08 2a bf dd ae 11
cb 1e a2 07 9a 80 cf 62 9b 09 dc 95 3c 96 8e b1
09 bd e4 eb db ca 70 7a 9e fa 31 18 45 3c 21 33
b0 b3 2b ea f3 71 2d e1 03 ad 1b 48 d4 67 27 f0
62 e4 3d fb 9b 08 76 e7 dd 2b 01 39 04 5a 58 7a
f7 11 90 ec bd 51 5c 32 6b d7 35 39 02 6b f2 a6
d0 0d 07 e1 06 c4 5b 7d e4 6a d7 ee 15 1f 83 b4
a3 a7 5e c3 90 b7 ef d3 b7 4f f8 92 4c b7 3c 29
cd 7e 2b 5d 43 ea 42 e7 74 3f 7d 58 88 75 de 3e
