dspdon

I see a problem in the last byte of all bit-oriented VOT test cases in your latest SHAKE128 dataset. I did not test SHAKE256 data set. I believe the spec...

I confirmed that the same problem exists in the new SHAKE256 data set. The last byte in all VOT test cases requires a left-shift by "8 - outLen % 8"...

Ok, timing is up to you of course. And you are so close ! Your final byte just has its bits aligned to the LSbits, instead of the MSbits. Shifting...

It's been a few months! Are you able to address the last-byte bit-alignment issue for SHAKE VOT tests now? I downloaded the most recent offline test vectors today, and again...

Could it be that FIPS-202 Appendix B.1 is what is controlling the verification spec you are pursuing here, which is to keep trailing bits in the LSbits of the last...

The B_0 block defines a 104-bit IV and CCM-ECMA requires a 104-bit IV. However, "ivLen" is zero in the ACVP test cases for CCM-ECMA, not 104. Your statement could be...

This approach to verify the problem (much less solve it) is overly complex and simpler approaches now seem possible. I am closing this issue and will provide a simpler approach...

Yes please, just the first few iterations to help me see if this is where things break down.

Thank you! That seems to be just what I need. I hope we can keep this Issue open until I confirm results.

BLOT: Can you re-run your partial-results script for the first 100 or even all 1000 i-iterations in order to provide all partial results needed to replicate the result for j=0?...