5

I have noticed a slight change in the standard documentation of FIPS-202 and ISO/IEC 10118-3 documents for algorithm 5:rc(t) as below:

ISO/IEC 10118-3

Algorithm 5: rc(t)
Input: integer t
Output: bit rc(t)
Steps:
a)If t mod 255 = 0, return 1.
c)For i from 1 to t mod 255, let:
b) Let R = 10 000 000.
1) R = 0 || R;
2) R[0] = R[0] ⊕ R[8];
3) R[6] = R[6] ⊕ R[8];
4) R[3] = R[3] ⊕ R[8];
5) R[2] = R[2] ⊕ R[8];
6) R = Trunc8

FIPS-202

Algorithm 5: rc(t)
Input:
integer t.
Output:
bit rc(t).
Steps:
1. If t mod 255 = 0, return 1.
2. Let R = 10000000.
3. For i from 1 to t mod 255, let:
a. R = 0 || R;
b. R[0] = R[0] ⊕ R[8];
c. R[4] = R[4] ⊕ R[8];
d. R[5] = R[5] ⊕ R[8];
e. R[6] = R[6] ⊕ R[8];
f. R =Trunc8[R].
4. Return R[0]

Can anybody explain these difference or are the same?

kelalaka
  • 49,797
  • 12
  • 123
  • 211

1 Answers1

6

The aim of ISO/IEC 10118-3:2018 (partial preview) sections 19 to 22, and appendixes B.14 to B.17, is (I believe) to match the algorithm, results, and test vectors of FIPS 202. Any discrepancy there may be in ISO/IEC 10118-3 w.r.t. FIPS 202 that would change the output is probably unintentional and should be ignored IMHO.

Update: As pointed in comment, even if in the ISO/IEC 10118-3 pseudocode of the question we reorder b) and c), ignore conventions for numbering, and assume the result is implicit, the two algorithms are NOT equivalent due to differences in indexes. I initially missed that.

I can't believe such discrepancy is intentional. I don't have a copy of ISO/IEC 10118-3:2018 to check (this is the fourth and current version, and the only one with SHA3).

fgrieu
  • 149,326
  • 13
  • 324
  • 622