Ajout du test de déchiffrement et correction de l'implémentation

J'étais parti du principe que pour inverser

        non-linear layer
    r0  linear layer
        permutation layer
    …
        non-linear layer
    r31 linear layer
        /

Il allait falloir faire

        non-linear layer
    r0  linear layer
        /
    …
        non-linear layer
    r31 linear layer
        permutation layer

Mais en fait  non, on procède comme au chiffrement  : c'est le dernier
tour   qui   saute   la   permutation.   C'est   bien   précisé   dans
Lilliput (annexe B, figure 8).

✨ MathéMagie ✨

1 files changed, 10 insertions, 2 deletions

diff --git a/crypto_aead/lilliputaei128v1/ref/cipher.c b/crypto_aead/lilliputaei128v1/ref/cipher.c
index c866e4c..6c9302b 100644
--- a/crypto_aead/lilliputaei128v1/ref/cipher.c
+++ b/crypto_aead/lilliputaei128v1/ref/cipher.c
@@ -194,18 +194,26 @@ void lilliput_tbc_decrypt(
     FILE *debug
 )
 {
+    debug_dump_lanes(debug, "Tweak :", TWEAK_BYTES, tweak, 0);
+    debug_dump_lanes(debug, "Key :", KEY_BYTES, key, 0);
+    debug_dump_buffer(debug, "Ciphertext :", BLOCK_BYTES, ciphertext, 0);
+
     cipher_state X;
     _state_init(&X, ciphertext, debug);
 
     uint8_t RTK[ROUNDS][ROUND_TWEAKEY_BYTES];
     _compute_round_tweakeys(key, tweak, RTK);
 
-    _one_round_egfn(&X, RTK[ROUNDS-1], PERMUTATION_NONE);
-
     for (uint8_t i=0; i<ROUNDS-1; i++)
     {
+        _debug_announce_round(debug, i);
         _one_round_egfn(&X, RTK[ROUNDS-1-i], PERMUTATION_DECRYPTION);
     }
 
+    _debug_announce_round(debug, ROUNDS-1);
+    _one_round_egfn(&X, RTK[0], PERMUTATION_NONE);
+
     memcpy(message, X.X, BLOCK_BYTES);
+
+    debug_dump_buffer(debug, "\nDeciphered :", BLOCK_BYTES, message, 0);
 }