1

I was looking at the test vectors of keccak provided by NIST here https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values and specifically for these example inputs of SHAKE-128 https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/SHAKE128_Msg5.pdf and https://csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/SHAKE128_Msg30.pdf

In the first page I noticed that the first values of the Data to be absorbed is not the same as the input binary string and the padding system in inconsistent with the pad10*1 method.

SHAKE-128 sample of 5-bit message

Msg as bit string
 1 1 0 0 1
about to call last of the absorb phase


About to Absorb data


State (in bytes)


00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
Data to be absorbed


F3 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

Can someone please explain how this works.

pro orp
  • 11
  • 1

2 Answers2

1

In the first page I noticed that the first values of the Data to be absorbed is not the same as the input binary string and the padding system in inconsistent with the pad10*1 method.

Actually, with SHAKE, you first append a 1 1 1 1 bit string, then you add the pad10*1 padding (see section 6.2 of FIPS 202).

Once you absorb the message, then the 1 1 1 1 bit string, and then the pad10*1 string, you get the state shown.

poncho
  • 154,064
  • 12
  • 239
  • 382
1

I find it much more informative to look at the "Xor'd state (as lanes of integers)" reading right to left, top to bottom. This way the bits appear in the order you would expect them to.

PeteR
  • 11
  • 1