This document summarizes the modifications brought by each version. Some modifications are tagged as follows:

- [spec] when the modification is brought by a new revision of the specification,
- [break] when the modification changes the implementation's output.

A modification that has no tag corresponds to stylistic and/or structural changes that have no impact on test vectors.


v1.1
====

ref
---

- Introduce helper function copy_block_index() to make tweak-building functions more legible.
  (lilliput-ae-utils.h, lilliput-i.c, lilliput-ii.c)

- Initialize ΘCB3 tweak with nonce instead of copying the latter into the latter repeatedly.
  (lilliput-i.c)

- Re-write _nonlinear_layer() and _linear_layer() functions to better resemble the specification.
  (cipher.c)

- Extract tweakey multiplications into their own header file, so that other implementations can make more targeted changes.
  (constants.h, multiplications.h, tweakey.c)

- Use size_t to iterate on arrays in lilliput_tbc_encrypt() and lilliput_tbc_decrypt().
  (cipher.c)

[spec][break]
- Change alpha coefficients in tweakey schedule to ensure lane 0 is updated between each round:
    - lane 0: Id  => M
    - lane 1: M   => M^2
    - lane 2: M^2 => M^3
    - lane 3: M^3 => M^4
    - lane 4: M_R   (unchanged)
    - lane 5: M_R^2 (unchanged)
    - lane 6: M_R^3 (unchanged)
  (multiplications.h, tweakey.c)

[break]
- Make byte string concatenation more consistent in AE modes:

    - v1 mixed two interpretations of concatenation:
        1. M_0 || M_1 was interpreted as { M[0], ... M[15] } || { M[16], ... M[31] },
        2. pad(10*) and tweak-building functions interpreted X||Y as { Y[0], ... Y[ylen-1] } || { X[0], ... X[xlen-1] }.

      This was potentially confusing, and also led to inefficient hardware implementations. E.g. a message M of length 34 bytes was padded as follows:

                  M_0                     M_1                     pad10*(M_*)
          { M[0], ... M[15] } || { M[16], ... M[31] } || { 0, ... 0, 0x80, M[32], M[33] }

    - v1.1 sticks to the first interpretation. The same message M is now padded as follows:

                  M_0                     M_1                     pad10*(M_*)
          { M[0], ... M[15] } || { M[16], ... M[31] } || { M[32], M[33], 0x80, 0, ... 0 }

  (lilliput-ae-utils.h, lilliput-i.c, lilliput-ii.c)

add_felicsref
-------------

See reference implementation. Further changes:

- Introduce helper function _multiply() to reduce code duplication.
  (tweakey.c)

- Compute round-tweakeys on the fly to save on RAM, instead of storing all pre-computed round-tweakeys.
  (cipher.c)

add_threshold
-------------

See reference implementation. Further changes:

- Add constant macros KEY_LANES_NB and TWEAK_LANES_NB to make tweakey schedule code more legible.
  (tweakey.c)

add_tweakeyloop
---------------

See reference implementation.

add_python
----------

See [spec] and [break] changes in reference implementation. Further changes:

- Re-write tweakey multiplications to better resemble the specification.
  (multiplications.py)

add_vhdl
--------

TODO


v1
==

Initial release to round 1 of the LWC standardization process.