Main changes:
BigInteger encoding is now always a multiple of 2.
Comments try to be a bit more precise. This leads to a different
grouping of the test vectors.
All test vectors with result="acceptable" have at least one
flag.
New vectors:
AEGIS: adding test vectors with the same tag (basically just
answers the question: is AEGIS a hash?)
Test vectors from old versions of the cipher now have ciphertext.
I.e. both encrypting or decrypting should tell testers that they
are using old versions.
AES-CMAC: more test vectors with 128-bit tag.
DSA, ECDSA: better description of the ASN modifications (this reorders
the test vectors) and a few more ASN modifications
KWP: adding modified paddings
XDH: adding more edge cases, no longer using the same private key for multiple
test vectors.
RSA-PSS: adding more valid test vectors. The new test vectors have an edge case
message digest.
NOKEYCHECK=True
PiperOrigin-RevId: 264817632
GitOrigin-RevId: 0c8e6eec11db1ca7088f89d0c1de48c5af892e47
AEGIS256 is described here:
https://eprint.iacr.org/2013/695.pdfhttps://competitions.cr.yp.to/round3/aegisv11.pdf
Test vector generation:
I'm using a python version for the generation of the test vectors:
CL 252436459
The test vectors are then compared against a second implementation:
CL 252613429
Third party test vectors:
I don't have any third party test vectors.
https://eprint.iacr.org/2013/695.pdf contains some test vectors.
But, these test vectors can only be reproduced if the number of rounds
in finalize is reduced from 7 to 6.
Both papers describe AEGIS256 with 7 rounds in finalize.
All third party implementations I've found use 7 rounds, such as
this one:
https://github.com/torvalds/linux/blob/master/crypto/aegis256.c
NOKEYCHECK=True
PiperOrigin-RevId: 252811267
GitOrigin-RevId: 1de1fb2cb2c4e7d33a1ab8a23ddd63c79b143d3a
bleichen