Merge remote-tracking branch 'origin/master' into fix-vhdltbc

31 files changed, 374 insertions, 262 deletions

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 78e8e63..59c03db 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -38,6 +38,25 @@ ref
     - lane 6: M_R^3 (unchanged)
   (multiplications.h, tweakey.c)
 
+[break]
+- Make byte string concatenation more consistent in AE modes:
+
+    - v1 mixed two interpretations of concatenation:
+        1. M_0 || M_1 was interpreted as { M[0], ... M[15] } || { M[16], ... M[31] },
+        2. pad(10*) and tweak-building functions interpreted X||Y as { Y[0], ... Y[ylen-1] } || { X[0], ... X[xlen-1] }.
+
+      This was potentially confusing, and also led to inefficient hardware implementations. E.g. a message M of length 34 bytes was padded as follows:
+
+                  M_0                     M_1                     pad10*(M_*)
+          { M[0], ... M[15] } || { M[16], ... M[31] } || { 0, ... 0, 0x80, M[32], M[33] }
+
+    - v1.1 sticks to the first interpretation. The same message M is now padded as follows:
+
+                  M_0                     M_1                     pad10*(M_*)
+          { M[0], ... M[15] } || { M[16], ... M[31] } || { M[32], M[33], 0x80, 0, ... 0 }
+
+  (lilliput-ae-utils.h, lilliput-i.c, lilliput-ii.c)
+
 add_felicsref
 -------------
 
@@ -102,7 +121,8 @@ See [spec] and [break] changes in reference implementation. Further changes:
   - Isolate input and output from critical path.
   (roundexe_lilliput.vhd, machine_etat_chiffrement.vhd)
 
-v1.0
-====
+
+v1
+==
 
 Initial release to round 1 of the LWC standardization process.
diff --git a/Makefile b/Makefile
index 2b9e4e0..00d6f66 100644
--- a/Makefile
+++ b/Makefile
@@ -20,7 +20,7 @@ test: $(test_variants)
 traces: traces-ae traces-tbc
 
 traces-%: | results
-	@ echo "Collecting traces"
+	@ echo "Collecting $@"
 	@ ./traces/collect-traces.sh $@
 
 nist:
diff --git a/src/add_felicsref/cipher.c b/src/add_felicsref/cipher.c
index 7de0a08..59bc5d8 100644
--- a/src/add_felicsref/cipher.c
+++ b/src/add_felicsref/cipher.c
@@ -150,7 +150,7 @@ void lilliput_tbc_encrypt(
     uint8_t RTK[ROUND_TWEAKEY_BYTES];
     tweakey_state_init(TK, key, tweak);
 
-    for (unsigned i=0; i<ROUNDS-1; i++)
+    for (size_t i=0; i<ROUNDS-1; i++)
     {
         tweakey_state_extract(TK, i, RTK);
         _one_round_egfn(ciphertext, RTK, PERMUTATION_ENCRYPTION);
@@ -174,7 +174,7 @@ void lilliput_tbc_decrypt(
     uint8_t RTK[ROUNDS][ROUND_TWEAKEY_BYTES];
     _compute_round_tweakeys(key, tweak, RTK);
 
-    for (uint8_t i=0; i<ROUNDS-1; i++)
+    for (size_t i=0; i<ROUNDS-1; i++)
     {
         _one_round_egfn(X, RTK[ROUNDS-1-i], PERMUTATION_DECRYPTION);
     }
diff --git a/src/add_felicsref/tweakey.c b/src/add_felicsref/tweakey.c
index 18a7792..47badde 100644
--- a/src/add_felicsref/tweakey.c
+++ b/src/add_felicsref/tweakey.c
@@ -81,11 +81,10 @@ static void _multiply(uint8_t TKj[LANE_BYTES], matrix_multiplication alpha)
 
 void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES])
 {
-    /* Skip lane 0, as it is multiplied by the identity matrix. */
-
-    _multiply(TK + 1*LANE_BYTES, _multiply_M);
-    _multiply(TK + 2*LANE_BYTES, _multiply_M2);
-    _multiply(TK + 3*LANE_BYTES, _multiply_M3);
+    _multiply(TK + 0*LANE_BYTES, _multiply_M);
+    _multiply(TK + 1*LANE_BYTES, _multiply_M2);
+    _multiply(TK + 2*LANE_BYTES, _multiply_M3);
+    _multiply(TK + 3*LANE_BYTES, _multiply_M4);
 
 #if LANES_NB >= 5
     _multiply(TK + 4*LANE_BYTES, _multiply_MR);
diff --git a/src/add_python/lilliput/ae_common.py b/src/add_python/lilliput/ae_common.py
index b94be1b..db14ec3 100644
--- a/src/add_python/lilliput/ae_common.py
+++ b/src/add_python/lilliput/ae_common.py
@@ -15,7 +15,7 @@
 """Helper functions used in both Lilliput-I and Lilliput-II."""
 
 
-from .constants import BLOCK_BITS, BLOCK_BYTES
+from .constants import BLOCK_BYTES
 from .helpers import xor
 from . import tbc
 
@@ -48,11 +48,11 @@ def block_matrix_to_bytes(matrix):
 
 def pad10(X):
     zeroes = [0] * (BLOCK_BYTES-len(X)-1)
-    return zeroes + [0b10000000] + X
+    return X + [0b10000000] + zeroes
 
 
 def integer_to_byte_array(i, n):
-    return list(i.to_bytes(n, 'little'))
+    return list(i.to_bytes(n, 'big'))
 
 
 def _tweak_associated_data(t, i, padded):
@@ -61,8 +61,8 @@ def _tweak_associated_data(t, i, padded):
     prefix = 0b0110 if padded else 0b0010
 
     # Clear upper 4 bits and set them to prefix.
-    tweak[-1] &= 0b00001111
-    tweak[-1] = prefix << 4
+    tweak[0] &= 0b00001111
+    tweak[0] |= prefix << 4
 
     return tweak
 
diff --git a/src/add_python/lilliput/ae_mode_1.py b/src/add_python/lilliput/ae_mode_1.py
index 4a40b78..197bf37 100644
--- a/src/add_python/lilliput/ae_mode_1.py
+++ b/src/add_python/lilliput/ae_mode_1.py
@@ -52,27 +52,26 @@ def _lower_nibble(i):
     return i & 0b00001111
 
 
-def _byte_from_nibbles(lower, upper):
-    return upper<<4 | lower
+def _byte(high, low):
+    return high<<4 ^ low
 
 
 def _tweak_message(N, j, prefix):
-    # j is encoded on 68 bits; get 72 and clear the upper 4.
-    j_len = (TWEAK_BITS-NONCE_BITS-4)//8 + 1
-    tweak = integer_to_byte_array(j, j_len)
-    tweak[-1] &= 0b00001111
+    tweak = [_byte(prefix.value, _upper_nibble(N[0]))]
 
-    # Add nonce.
-    tweak[-1] |= _lower_nibble(N[0]) << 4
     tweak.extend(
-        _byte_from_nibbles(_upper_nibble(N[i-1]), _lower_nibble(N[i]))
+        _byte(_lower_nibble(N[i-1]), _upper_nibble(N[i]))
         for i in range(1, NONCE_BITS//8)
     )
 
-    # Add last nibble from nonce and prefix.
-    tweak.append(
-        _byte_from_nibbles(_upper_nibble(N[-1]), prefix.value)
-    )
+    # j is encoded on 68 bits; get 72 then set the upper 4 to the
+    # nonce's lower 4.
+    j_len = (TWEAK_BITS-NONCE_BITS-4)//8 + 1
+    j_array = integer_to_byte_array(j, j_len)
+    j_array[0] &= 0b00001111
+    j_array[0] |= _lower_nibble(N[-1]) << 4
+
+    tweak.extend(j_array)
 
     return tweak
 
diff --git a/src/add_python/lilliput/ae_mode_2.py b/src/add_python/lilliput/ae_mode_2.py
index 79d1bcd..a55ecb8 100644
--- a/src/add_python/lilliput/ae_mode_2.py
+++ b/src/add_python/lilliput/ae_mode_2.py
@@ -18,6 +18,8 @@ This module provides the functions for authenticated encryption and decryption
 using Lilliput-AE's nonce-misuse-resistant mode based on SCT-2.
 """
 
+from enum import Enum
+
 from .constants import BLOCK_BYTES
 from .ae_common import (
     bytes_to_block_matrix,
@@ -35,22 +37,24 @@ TWEAK_BITS = 128
 TWEAK_BYTES = TWEAK_BITS//8
 
 
-def _tweak_tag(j, padded):
-    tweak = integer_to_byte_array(j, TWEAK_BYTES)
+class _TagTweak(Enum):
+    BLOCK = 0b0000
+    PAD = 0b0100
 
-    prefix = 0b0100 if padded else 0b0000
+
+def _tweak_tag(j, prefix):
+    tweak = integer_to_byte_array(j, TWEAK_BYTES)
 
     # Clear upper 4 bits and set them to prefix.
-    tweak[-1] &= 0b00001111
-    tweak[-1] = prefix << 4
+    tweak[0] &= 0b00001111
+    tweak[0] |= prefix.value << 4
 
     return tweak
 
 
 def _add_tag_j(tag, j):
-    array_j = integer_to_byte_array(j, TWEAK_BYTES)
-    tweak = xor(tag, array_j)
-    tweak[-1] |= 0b10000000
+    tweak = xor(tag, integer_to_byte_array(j, TWEAK_BYTES))
+    tweak[0] |= 0b10000000
 
     return tweak
 
@@ -63,18 +67,16 @@ def _message_auth_tag(M, N, Auth, key):
     M = bytes_to_block_matrix(M)
 
     for j in range(0, l):
-        tweak = _tweak_tag(j, False)
+        tweak = _tweak_tag(j, _TagTweak.BLOCK)
         encryption = tbc.encrypt(tweak, key, M[j])
         tag = xor(tag, encryption)
 
     if need_padding:
-        tweak = _tweak_tag(l, True)
+        tweak = _tweak_tag(l, _TagTweak.PAD)
         encryption = tbc.encrypt(tweak, key, pad10(M[l]))
         tag = xor(tag, encryption)
 
-    tweak = N + [0b00010000]
-    encryption = tbc.encrypt(tweak, key, tag)
-    tag = encryption
+    tag = tbc.encrypt([0b00010000]+N, key, tag)
 
     return tag
 
@@ -88,12 +90,12 @@ def _message_encryption(M, N, tag, key):
 
     for j in range(0, l):
         tweak = _add_tag_j(tag, j)
-        encryption = tbc.encrypt(tweak, key, N+[0b00000000])
+        encryption = tbc.encrypt(tweak, key, [0b00000000]+N)
         C.append(xor(M[j], encryption))
 
     if need_padding:
         tweak = _add_tag_j(tag, l)
-        encryption = tbc.encrypt(tweak, key, N+[0b00000000])
+        encryption = tbc.encrypt(tweak, key, [0b00000000]+N)
         C.append(xor(M[l], encryption))
 
     return C
diff --git a/src/add_python/lilliput/multiplications.py b/src/add_python/lilliput/multiplications.py
index a5faa55..09eaa08 100644
--- a/src/add_python/lilliput/multiplications.py
+++ b/src/add_python/lilliput/multiplications.py
@@ -23,8 +23,11 @@ from functools import reduce
 from operator import xor
 
 
+def _shl(xi, n):
+    return (xi << n) & 0xff
+
 def _Sl(n):
-    return lambda xi: (xi<<n) & 0xff
+    return lambda xi: _shl(xi, n)
 
 def _Sr(n):
     return lambda xi: xi>>n
@@ -36,16 +39,25 @@ def _0(xi):
     return 0
 
 def _M1(xi):
-    return (xi<<3 ^ xi>>3) & 0xff
+    return _shl(xi, 3) ^ xi>>3
 
 def _M2(xi):
-    return (xi<<6 ^ (xi&0b11111000) ^ xi>>6) & 0xff
+    return _shl(xi, 6) ^ xi&0b11111000 ^ xi>>6
 
 def _M3(xi):
-    return xi & 0b00011111
+    return _shl(xi>>3, 6) ^ xi>>6<<3
 
 def _M4(xi):
-    return ((xi<<2) & 0xff) >> 3
+    return _shl(xi, 2) >> 3
+
+def _M5(xi):
+    return _shl(xi, 5) ^ xi>>3<<2
+
+def _M6(xi):
+    return xi & 0b00011111
+
+def _M7(xi):
+    return _shl(xi, 2) >> 3
 
 
 M = (
@@ -81,6 +93,17 @@ M3 = (
     ( _0,     _0,    _Id,     _0,     _0,     _0,  _0,  _0),
 )
 
+M4 = (
+    ( _0,     _0, _Sl(6),    _M1,    _Id,     _0,     _0,  _0),
+    ( _0,     _0,     _0,    _M2,    _M1,    _Id,     _0,  _0),
+    ( _0, _Sl(2),     _0,    _M3,    _M2,    _M1,    _Id,  _0),
+    ( _0,    _M4, _Sl(2),     _0,     _0, _Sr(6), _Sr(3), _Id),
+    (_Id,     _0, _Sl(5), _Sl(2),     _0,     _0,     _0,  _0),
+    ( _0,    _Id,     _0,    _M5, _Sl(2),     _0,     _0,  _0),
+    ( _0,     _0,    _Id,     _0,     _0,     _0,     _0,  _0),
+    ( _0,     _0, _Sl(3),    _Id,     _0,     _0,     _0,  _0),
+)
+
 # NB: shift directions are reversed with respect to the specification
 # for powers of M_R, since the specification reverses the byte order
 # for those matrices.
@@ -99,7 +122,7 @@ MR = (
 MR2 = (
     ( _0,  _0, _Id,     _0,     _0,     _0,     _0,     _0),
     ( _0,  _0,  _0,    _Id, _Sr(3),     _0,     _0,     _0),
-    ( _0,  _0,  _0,     _0,    _Id, _Sr(3),    _M3,     _0),
+    ( _0,  _0,  _0,     _0,    _Id, _Sr(3),    _M6,     _0),
     ( _0,  _0,  _0,     _0,     _0,    _Id, _Sl(3),     _0),
     ( _0,  _0,  _0, _Sl(2),     _0,     _0,    _Id, _Sl(3)),
     ( _0,  _0,  _0,     _0, _Sl(2),     _0,     _0,    _Id),
@@ -109,8 +132,8 @@ MR2 = (
 
 MR3 = (
     (    _0,  _0,  _0,    _Id, _Sr(3),     _0,     _0,     _0),
-    (    _0,  _0,  _0,     _0,    _Id, _Sr(3),    _M3,     _0),
-    (    _0,  _0,  _0,    _M4,     _0,    _Id,    _M1,    _M3),
+    (    _0,  _0,  _0,     _0,    _Id, _Sr(3),    _M6,     _0),
+    (    _0,  _0,  _0,    _M7,     _0,    _Id,    _M1,    _M6),
     (    _0,  _0,  _0, _Sl(2),     _0,     _0,    _Id, _Sl(3)),
     (_Sl(3),  _0,  _0,     _0, _Sl(2),     _0,     _0,    _Id),
     (   _Id,  _0,  _0,     _0,     _0, _Sl(2), _Sl(5),     _0),
@@ -135,10 +158,10 @@ def _multiplication(m, reverse=True):
 
 
 ALPHAS = (
-    list,                       # Identity.
     _multiplication(M),
     _multiplication(M2),
     _multiplication(M3),
+    _multiplication(M4),
     _multiplication(MR, reverse=False),
     _multiplication(MR2, reverse=False),
     _multiplication(MR3, reverse=False)
diff --git a/src/add_threshold/tweakey.c b/src/add_threshold/tweakey.c
index 8f531d9..7822564 100644
--- a/src/add_threshold/tweakey.c
+++ b/src/add_threshold/tweakey.c
@@ -90,10 +90,11 @@ void tweakey_state_extract(
 
 typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]);
 
-static const matrix_multiplication ALPHAS[6] = {
+static const matrix_multiplication ALPHAS[7] = {
     _multiply_M,
     _multiply_M2,
     _multiply_M3,
+    _multiply_M4,
     _multiply_MR,
     _multiply_MR2,
     _multiply_MR3
@@ -102,16 +103,14 @@ static const matrix_multiplication ALPHAS[6] = {
 
 void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES])
 {
-    /* Skip lane 0, as it is multiplied by the identity matrix. */
-
-    for (size_t j=1; j<TWEAK_LANES_NB; j++)
+    for (size_t j=0; j<TWEAK_LANES_NB; j++)
     {
         uint8_t *TKj_X = TK_X + j*LANE_BYTES;
 
         uint8_t TKj_old_X[LANE_BYTES];
         memcpy(TKj_old_X, TKj_X, LANE_BYTES);
 
-        ALPHAS[j-1](TKj_old_X, TKj_X);
+        ALPHAS[j](TKj_old_X, TKj_X);
     }
 
     for (size_t j=0; j<KEY_LANES_NB; j++)
@@ -124,7 +123,7 @@ void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES])
         memcpy(TKj_X_old, TKj_X, LANE_BYTES);
         memcpy(TKj_Y_old, TKj_Y, LANE_BYTES);
 
-        ALPHAS[j-1 + TWEAK_LANES_NB](TKj_X_old, TKj_X);
-        ALPHAS[j-1 + TWEAK_LANES_NB](TKj_Y_old, TKj_Y);
+        ALPHAS[j + TWEAK_LANES_NB](TKj_X_old, TKj_X);
+        ALPHAS[j + TWEAK_LANES_NB](TKj_Y_old, TKj_Y);
     }
 }
diff --git a/src/add_tweakeyloop/multiplications.h b/src/add_tweakeyloop/multiplications.h
index 45b9eaa..650373b 100644
--- a/src/add_tweakeyloop/multiplications.h
+++ b/src/add_tweakeyloop/multiplications.h
@@ -55,6 +55,17 @@ static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES])
     _multiply_M(M2_x, y);
 }
 
+static void _multiply_M4(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES])
+{
+    uint8_t M_x[LANE_BYTES];
+    uint8_t M2_x[LANE_BYTES];
+    uint8_t M3_x[LANE_BYTES];
+    _multiply_M(x, M_x);
+    _multiply_M(M_x, M2_x);
+    _multiply_M(M2_x, M3_x);
+    _multiply_M(M3_x, y);
+}
+
 static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES])
 {
     y[0] = x[1];
diff --git a/src/ref/cipher.c b/src/ref/cipher.c
index 8ebbbc3..07405e1 100644
--- a/src/ref/cipher.c
+++ b/src/ref/cipher.c
@@ -148,7 +148,7 @@ void lilliput_tbc_encrypt(
     uint8_t RTK[ROUNDS][ROUND_TWEAKEY_BYTES];
     _compute_round_tweakeys(key, tweak, RTK);
 
-    for (uint8_t i=0; i<ROUNDS-1; i++)
+    for (size_t i=0; i<ROUNDS-1; i++)
     {
         _one_round_egfn(X, RTK[i], PERMUTATION_ENCRYPTION);
     }
@@ -171,7 +171,7 @@ void lilliput_tbc_decrypt(
     uint8_t RTK[ROUNDS][ROUND_TWEAKEY_BYTES];
     _compute_round_tweakeys(key, tweak, RTK);
 
-    for (uint8_t i=0; i<ROUNDS-1; i++)
+    for (size_t i=0; i<ROUNDS-1; i++)
     {
         _one_round_egfn(X, RTK[ROUNDS-1-i], PERMUTATION_DECRYPTION);
     }
diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h
index 0efb776..19b4623 100644
--- a/src/ref/lilliput-ae-utils.h
+++ b/src/ref/lilliput-ae-utils.h
@@ -28,16 +28,6 @@ This file provides functions used by both authenticated encryption modes.
 #include "constants.h"
 
 
-static inline uint8_t upper_nibble(uint8_t i)
-{
-    return i >> 4;
-}
-
-static inline uint8_t lower_nibble(uint8_t i)
-{
-    return i & 0x0f;
-}
-
 static inline void encrypt(const uint8_t K[KEY_BYTES],
                            const uint8_t T[TWEAK_BYTES],
                            const uint8_t M[BLOCK_BYTES],
@@ -68,35 +58,41 @@ static inline void xor_arrays(size_t len, uint8_t out[len], const uint8_t a[len]
 
 static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BLOCK_BYTES])
 {
-    /* pad10*(X) = X || 1 || 0^{n-|X|-1} */
-
-    /* For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 }
+    /* Assuming 0 < |X| < n:
+     *
+     * pad10*(X) = X || 1 || 0^{n-|X|-1}
+     *
+     * For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 }
      *
      * pad10*(X) =
-     *       X[2]     X[1]     X[0]   1 0*
-     *     00000011 00000010 00000001 1 0000000 00000000...
+     *       X[0]     X[1]     X[2]   1 0*
+     *     00000001 00000010 00000011 1 0000000 00000000...
      *
-     * - padded[0, 11]:  zeroes
-     * - padded[12]:     10000000
-     * - padded[13, 15]: X[0, 2]
+     * - padded[0, 2]:  X[0, 2]
+     * - padded[3]:     10000000
+     * - padded[4, 15]: zeroes
      */
 
-    /* Assume that X_len<BLOCK_BYTES. */
+    memcpy(padded, X, X_len);
+    padded[X_len] = 0x80;
 
-    size_t pad_len = BLOCK_BYTES-X_len;
+    /* memset(&padded[BLOCK_BYTES], 0, 0) may or may not constitute
+     * undefined behaviour; use a straight loop instead. */
 
-    memset(padded, 0, pad_len-1);
-    padded[pad_len-1] = 0x80;
-    memcpy(padded+pad_len, X, X_len);
+    for (size_t i=X_len+1; i<BLOCK_BYTES; i++)
+    {
+        padded[i] = 0;
+    }
 }
 
 static inline void copy_block_index(size_t index, uint8_t tweak[TWEAK_BYTES])
 {
-    /* NB: little-endian architectures can simply use:
-     *     memcpy(tweak, &index, sizeof(index)); */
-    for (size_t i=0; i<sizeof(index); i++)
+    size_t s = sizeof(index);
+    uint8_t *dest = &tweak[TWEAK_BYTES-s];
+
+    for (size_t i=0; i<s; i++)
     {
-        tweak[i] = index >> 8*i & 0xff;
+        dest[i] = index >> 8*(s-1-i);
     }
 }
 
@@ -106,19 +102,22 @@ static inline void fill_index_tweak(
     uint8_t tweak[TWEAK_BYTES]
 )
 {
-    /* With an s-bit block index, the t-bit tweak is filled as follows:
+    /* The t-bit tweak is filled as follows:
      *
-     * - bits [  1, t-4]: block index
-     *        [  1,   s]: actual block index
-     *        [s+1, t-4]: 0-padding
-     * - bits [t-3,   t]: 4-bit prefix
+     *   1    4    5         t
+     * [ prefix || block index ]
+     *
+     * The s-bit block index is encoded as follows:
+     *
+     *   5        t-s    t-s+1                t
+     * [ zero padding || block index, MSB first ]
      */
 
-    copy_block_index(block_index, tweak);
+    tweak[0] = prefix<<4;
 
     /* Assume padding bytes have already been set to 0. */
 
-    tweak[TWEAK_BYTES-1] |= prefix << 4;
+    copy_block_index(block_index, tweak);
 }
 
 static void process_associated_data(
diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c
index 6f869c3..3358b10 100644
--- a/src/ref/lilliput-i.c
+++ b/src/ref/lilliput-i.c
@@ -32,58 +32,71 @@ static const uint8_t _0n[BLOCK_BYTES] = {
 };
 
 
+static uint8_t _upper_nibble(uint8_t i)
+{
+    return i >> 4;
+}
+
+static uint8_t _lower_nibble(uint8_t i)
+{
+    return i & 0x0f;
+}
+
 static void _init_msg_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BYTES])
 {
-    /* With an s-bit block index, the t-bit tweak is filled as follows:
+    /* The t-bit tweak is filled as follows:
+     *
+     *   1    4    5     |N|+4    |N|+5     t
+     * [ prefix ||  nonce      || block index ]
      *
-     * - bits [      1, t-|N|-4]: block index
-     *        [      1,       s]: actual block index
-     *        [    s+1, t-|N|-4]: 0-padding
-     * - bits [t-|N|-3,     t-4]: nonce
-     * - bits [    t-3,       t]: 4-bit prefix
+     * The s-bit block index is encoded as follows:
      *
-     * This function sets bits s+1 to t-4 once and for all.
+     *   |N|+5    t-s    t-s+1                t
+     * [ zero padding || block index, MSB first ]
+     *
+     * This function sets bits 5 to t-s once and for all.
      */
 
-    size_t N_start = TWEAK_BYTES - NONCE_BYTES - 1;
-
-    for (size_t i=sizeof(size_t); i<N_start; i++)
-    {
-        tweak[i] = 0;
-    }
-
-    tweak[N_start] = lower_nibble(N[0]) << 4;
+    tweak[0] = _upper_nibble(N[0]);
 
     for (size_t i=1; i<NONCE_BYTES; i++)
     {
-        tweak[N_start+i] = lower_nibble(N[i]) << 4 ^ upper_nibble(N[i-1]);
+        tweak[i] = _lower_nibble(N[i-1]) << 4 ^ _upper_nibble(N[i]);
     }
 
-    tweak[TWEAK_BYTES-1] = upper_nibble(N[NONCE_BYTES-1]);
+    tweak[NONCE_BYTES] = _lower_nibble(N[NONCE_BYTES-1]) << 4;
+
+    /* The number of bits we need to zero out is:
+     *     t - |N| - s - 4        - 4
+     *                   (prefix)   (zeroed out by previous assignment)
+     */
+    memset(&tweak[NONCE_BYTES+1], 0, TWEAK_BYTES-NONCE_BYTES-sizeof(size_t)-1);
 }
 
 static void _fill_msg_tweak(
-    uint8_t       prefix,
-    size_t        block_index,
-    uint8_t       tweak[TWEAK_BYTES]
+    uint8_t prefix,
+    size_t  block_index,
+    uint8_t tweak[TWEAK_BYTES]
 )
 {
-    /* With an s-bit block index, the t-bit tweak is filled as follows:
+    /* The t-bit tweak is filled as follows:
      *
-     * - bits [      1, t-|N|-4]: block index
-     *        [      1,       s]: actual block index
-     *        [    s+1, t-|N|-4]: 0-padding
-     * - bits [t-|N|-3,     t-4]: nonce
-     * - bits [    t-3,       t]: 4-bit prefix
+     *   1    4    5     |N|+4    |N|+5     t
+     * [ prefix ||  nonce      || block index ]
      *
-     * This function assumes bits s+1 to t-3 have already been set,
-     * and only sets bits 1 to s and t-3 to t.
+     * The s-bit block index is encoded as follows:
+     *
+     *   |N|+5    t-s    t-s+1                t
+     * [ zero padding || block index, MSB first ]
+     *
+     * This function assumes bits 5 to t-s have already been set, and
+     * only sets bits 1 to 4 and t-s+1 to t.
      */
 
-    copy_block_index(block_index, tweak);
+    uint8_t *msb = &tweak[0];
+    *msb = prefix<<4 ^ _lower_nibble(*msb);
 
-    uint8_t *msb = &tweak[TWEAK_BYTES-1];
-    *msb = prefix<<4 ^ lower_nibble(*msb);
+    copy_block_index(block_index, tweak);
 }
 
 static void _encrypt_message(
diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c
index 6811d49..bb43d08 100644
--- a/src/ref/lilliput-ii.c
+++ b/src/ref/lilliput-ii.c
@@ -28,36 +28,42 @@ This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2.
 
 static void _init_msg_tweak(const uint8_t tag[TAG_BYTES], uint8_t tweak[TWEAK_BYTES])
 {
-    /* With an s-bit block index, the t-bit tweak is filled as follows:
+    /* The t-bit tweak is filled as follows:
+     *
+     *   1    2                      t
+     * [ 1 || tag[2,t] XOR block index  ]
+     *
+     * The s-bit block index is XORed to the tag as follows:
      *
-     * - bits [  1, t-1]: tag + block index
-     *        [  1,   s]: tag[1..s] XOR block index
-     *        [s+1, t-1]: tag[s+1..t-1]
-     * - bit t: 1
+     *   2       t-s    t-s+1                                  t
+     * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ]
      *
-     * This function sets bits s+1 to t once and for all.
+     * This function sets bits 1 to t-s once and for all.
      */
 
-    memcpy(tweak+sizeof(size_t), tag+sizeof(size_t), TAG_BYTES-sizeof(size_t));
-    tweak[TWEAK_BYTES-1] |= 0x80;
+    memcpy(tweak, tag, TAG_BYTES-sizeof(size_t));
+    tweak[0] |= 0x80;
 }
 
 static void _fill_msg_tweak(const uint8_t tag[TAG_BYTES], size_t block_index, uint8_t tweak[TWEAK_BYTES])
 {
-    /* With an s-bit block index, the t-bit tweak is filled as follows:
+    /* The t-bit tweak is filled as follows:
+     *
+     *   1    2                      t
+     * [ 1 || tag[2,t] XOR block index  ]
+     *
+     * The s-bit block index is XORed to the tag as follows:
      *
-     * - bits [  1, t-1]: tag + block index
-     *        [  1,   s]: tag[1..s] XOR block index
-     *        [s+1, t-1]: tag[s+1..t-1]
-     * - bit t: 1
+     *   2       t-s    t-s+1                                  t
+     * [ tag[2, t-s] || tag[t-s+1, t] XOR block index, MSB first ]
      *
-     * This function assumes bits s+1 to t have already been set, and
-     * only sets bits 1 to s.
+     * This function assumes bits 1 to t-s have already been set, and
+     * only sets bits t-s+1 to t.
      */
 
     copy_block_index(block_index, tweak);
 
-    for (size_t i=0; i<sizeof(block_index); i++)
+    for (size_t i=TWEAK_BYTES-sizeof(size_t); i<TWEAK_BYTES; i++)
     {
         tweak[i] ^= tag[i];
     }
@@ -67,12 +73,12 @@ static void _fill_tag_tweak(const uint8_t N[NONCE_BYTES], uint8_t tweak[TWEAK_BY
 {
     /* The t-bit tweak is filled as follows:
      *
-     * - bits [  1, t-7]: N
-     * - bits [t-7,   t]: 0001||0^4
+     *   1  4    5   8    t-|N|+1     t
+     * [ 0001 ||  0^4  ||        nonce  ]
      */
 
-    memcpy(tweak, N, TWEAK_BYTES-1);
-    tweak[TWEAK_BYTES-1] = 0x10;
+    tweak[0] = 0x10;
+    memcpy(&tweak[1], N, TWEAK_BYTES-1);
 }
 
 static void _generate_tag(
@@ -129,8 +135,8 @@ static void _encrypt_message(
     _init_msg_tweak(tag, tweak);
 
     uint8_t padded_N[BLOCK_BYTES];
-    memcpy(padded_N, N, NONCE_BYTES);
-    padded_N[BLOCK_BYTES-1] = 0;
+    padded_N[0] = 0;
+    memcpy(&padded_N[1], N, NONCE_BYTES);
 
     size_t l = M_len / BLOCK_BYTES;
     size_t rest = M_len % BLOCK_BYTES;
diff --git a/src/ref/multiplications.h b/src/ref/multiplications.h
index 4de1848..c0645b9 100644
--- a/src/ref/multiplications.h
+++ b/src/ref/multiplications.h
@@ -71,6 +71,26 @@ static void _multiply_M3(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES])
     y[0] = x[5];
 }
 
+static void _multiply_M4(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES])
+{
+    uint8_t a_5  = x[5]<<3  ^ x[4];
+    uint8_t a_4  = x[4]>>3  ^ x[3];
+    uint8_t b_5 = a_5<<3 ^ a_4;
+    uint8_t b_4 = a_4>>3 ^ x[2];
+
+    uint8_t c_4 = b_4>>3 ^ x[6]<<2 ^ x[1];
+    uint8_t c_5 = b_5<<3 ^ b_4;
+
+    y[7] = b_5;
+    y[6] = c_5;
+    y[5] = c_5<<3 ^ c_4;
+    y[4] = c_4>>3 ^ x[5]<<2 ^ x[0];
+    y[3] = a_5<<2 ^ x[7];
+    y[2] = b_5<<2 ^ x[6];
+    y[1] = x[5];
+    y[0] = a_5;
+}
+
 static void _multiply_MR(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES])
 {
     y[0] = x[1];
diff --git a/src/ref/tweakey.c b/src/ref/tweakey.c
index 2f357ca..510f35a 100644
--- a/src/ref/tweakey.c
+++ b/src/ref/tweakey.c
@@ -63,10 +63,11 @@ void tweakey_state_extract(
 
 typedef void (*matrix_multiplication)(const uint8_t x[LANE_BYTES], uint8_t y[LANE_BYTES]);
 
-static const matrix_multiplication ALPHAS[6] = {
+static const matrix_multiplication ALPHAS[7] = {
     _multiply_M,
     _multiply_M2,
     _multiply_M3,
+    _multiply_M4,
     _multiply_MR,
     _multiply_MR2,
     _multiply_MR3
@@ -75,15 +76,13 @@ static const matrix_multiplication ALPHAS[6] = {
 
 void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES])
 {
-    /* Skip lane 0, as it is multiplied by the identity matrix. */
-
-    for (size_t j=1; j<LANES_NB; j++)
+    for (size_t j=0; j<LANES_NB; j++)
     {
         uint8_t *TKj = TK + j*LANE_BYTES;
 
         uint8_t TKj_old[LANE_BYTES];
         memcpy(TKj_old, TKj, LANE_BYTES);
 
-        ALPHAS[j-1](TKj_old, TKj);
+        ALPHAS[j](TKj_old, TKj);
     }
 }
diff --git a/test/check-all.sh b/test/check-all.sh
new file mode 100755
index 0000000..e59b98c
--- /dev/null
+++ b/test/check-all.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -eux
+
+run ()
+{
+    make clean
+    "$@"
+}
+
+add_implems=(src/add_felicsref src/add_tweakeyloop src/add_threshold)
+
+for implem in ref ${add_implems[@]}
+do
+    run make test IMPLEMENTATION=$(basename $implem)
+done
+
+run make traces
+run make traces IMPLEMENTATION=add_threshold
+
+for implem in ${add_implems[@]}
+do
+    run ./test/check-implementation.sh $(basename $implem)
+done
+
+run make nist
+./test/python.sh
diff --git a/test/debug.h b/test/debug.h
index 24b7787..56cd123 100644
--- a/test/debug.h
+++ b/test/debug.h
@@ -17,9 +17,7 @@ static inline void debug_dump_lanes(const char *header, size_t len, const uint8_
         fprintf(DUMP, "%*s", indent, "");
         for (size_t b=0; b<8; b++)
         {
-            /* start with MSB */
-            size_t byte_index = len-(1+line*8+b);
-            fprintf(DUMP, "%*s%02x", 5, "", buf[byte_index]);
+            fprintf(DUMP, "%*s%02x", 5, "", buf[line*8+b]);
         }
         fprintf(DUMP, "\n");
     }
@@ -30,26 +28,24 @@ static inline void debug_dump_buffer(const char *header, size_t len, const uint8
 {
     fprintf(DUMP, "%*s%s\n", indent, "", header);
 
-    if (len%8 != 0)
+    for (size_t line=0; line<len/8; line++)
     {
-        fprintf(DUMP, "%*s", (int)(3*(8-len%8))+indent, "");
-        for (size_t b=0; b<len%8; b++)
+        fprintf(DUMP, "%*s[0x%02zx] ", indent, "", line*8);
+        for (size_t b=0; b<8; b++)
         {
-            size_t byte_index = len-1-b;
-            fprintf(DUMP, "%02x ", buf[byte_index]);
+            /* fprintf(DUMP, "[%zu / %zu => %zu]", line, b, line*8+b); */
+            fprintf(DUMP, "%02x ", buf[line*8+b]);
         }
         fprintf(DUMP, "\n");
     }
 
-    for (size_t line=0; line<len/8; line++)
+    size_t rest = len%8;
+    if (rest != 0)
     {
-        fprintf(DUMP, "%*s", indent, "");
-        for (size_t b=0; b<8; b++)
+        fprintf(DUMP, "%*s[0x%02zx] ", indent, "", len-rest);
+        for (size_t b=0; b<rest; b++)
         {
-            /* start with MSB */
-            size_t byte_index = 8*(len/8 - 1 - line) + 7-b;
-            /* fprintf(DUMP, "[%zu / %zu => %zu]", line, b, byte_index); */
-            fprintf(DUMP, "%02x ", buf[byte_index]);
+            fprintf(DUMP, "%02x ", buf[len-rest+b]);
         }
         fprintf(DUMP, "\n");
     }
diff --git a/test/i-128/test-ae-decrypt.c b/test/i-128/test-ae-decrypt.c
index 043185b..812eda2 100644
--- a/test/i-128/test-ae-decrypt.c
+++ b/test/i-128/test-ae-decrypt.c
@@ -47,18 +47,18 @@ const vector VECTORS[] = {
         },
         .ciphertext_len = 64,
         .ciphertext = (uint8_t[]) {
-            0x86, 0x09, 0xbe, 0x90, 0xa2, 0x9f, 0xa0, 0xed,
-            0x9a, 0xf6, 0xeb, 0x8d, 0x96, 0x0e, 0x83, 0x81,
-            0x0a, 0x6b, 0x00, 0xf4, 0x76, 0x99, 0xf4, 0x62,
-            0x4e, 0x3d, 0x91, 0x4c, 0x95, 0x96, 0x56, 0x91,
-            0x94, 0xf2, 0x29, 0x55, 0x20, 0x11, 0x2c, 0x93,
-            0x15, 0x23, 0x59, 0xe2, 0xa3, 0xc4, 0xc4, 0x62,
-            0xbb, 0xa3, 0x11, 0xf1, 0x39, 0xa2, 0xe2, 0xc9,
-            0x47, 0x6b, 0xe5, 0x6a, 0x97, 0x07, 0xc0, 0x87
+            0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90,
+            0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12,
+            0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48,
+            0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3,
+            0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f,
+            0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0,
+            0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c,
+            0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62
         },
         .tag = {
-            0x2e, 0xe5, 0xbf, 0x50, 0x87, 0x71, 0x17, 0x40,
-            0x1b, 0xa7, 0xe9, 0xed, 0xd5, 0xcb, 0xec, 0x6d
+            0x04, 0xaa, 0xc8, 0x19, 0x32, 0x70, 0x32, 0x24,
+            0xe8, 0x27, 0xb7, 0xab, 0xec, 0xd8, 0x2f, 0x6c
         },
         .message = (uint8_t[]) {
             0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -95,19 +95,19 @@ const vector VECTORS[] = {
         },
         .ciphertext_len = 66,
         .ciphertext = (uint8_t[]) {
-            0x86, 0x09, 0xbe, 0x90, 0xa2, 0x9f, 0xa0, 0xed,
-            0x9a, 0xf6, 0xeb, 0x8d, 0x96, 0x0e, 0x83, 0x81,
-            0x0a, 0x6b, 0x00, 0xf4, 0x76, 0x99, 0xf4, 0x62,
-            0x4e, 0x3d, 0x91, 0x4c, 0x95, 0x96, 0x56, 0x91,
-            0x94, 0xf2, 0x29, 0x55, 0x20, 0x11, 0x2c, 0x93,
-            0x15, 0x23, 0x59, 0xe2, 0xa3, 0xc4, 0xc4, 0x62,
-            0xbb, 0xa3, 0x11, 0xf1, 0x39, 0xa2, 0xe2, 0xc9,
-            0x47, 0x6b, 0xe5, 0x6a, 0x97, 0x07, 0xc0, 0x87,
-            0x4f, 0x09
+            0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90,
+            0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12,
+            0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48,
+            0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3,
+            0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f,
+            0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0,
+            0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c,
+            0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62,
+            0x88, 0x5a
         },
         .tag = {
-            0x04, 0x10, 0xbc, 0x6f, 0xe5, 0x88, 0xe0, 0xd5,
-            0x09, 0x59, 0x26, 0x17, 0x12, 0x49, 0x35, 0x9a
+            0x64, 0xa2, 0x24, 0x03, 0xc5, 0x79, 0x4f, 0xec,
+            0xe7, 0x7d, 0xc1, 0xf6, 0xc9, 0xc6, 0x77, 0x2c
         },
         .message = (uint8_t[]) {
             0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
diff --git a/test/i-128/test-ae-encrypt.c b/test/i-128/test-ae-encrypt.c
index 522a3e6..09fbb32 100644
--- a/test/i-128/test-ae-encrypt.c
+++ b/test/i-128/test-ae-encrypt.c
@@ -57,18 +57,18 @@ const vector VECTORS[] = {
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
         },
         .ciphertext = (uint8_t[]) {
-            0x86, 0x09, 0xbe, 0x90, 0xa2, 0x9f, 0xa0, 0xed,
-            0x9a, 0xf6, 0xeb, 0x8d, 0x96, 0x0e, 0x83, 0x81,
-            0x0a, 0x6b, 0x00, 0xf4, 0x76, 0x99, 0xf4, 0x62,
-            0x4e, 0x3d, 0x91, 0x4c, 0x95, 0x96, 0x56, 0x91,
-            0x94, 0xf2, 0x29, 0x55, 0x20, 0x11, 0x2c, 0x93,
-            0x15, 0x23, 0x59, 0xe2, 0xa3, 0xc4, 0xc4, 0x62,
-            0xbb, 0xa3, 0x11, 0xf1, 0x39, 0xa2, 0xe2, 0xc9,
-            0x47, 0x6b, 0xe5, 0x6a, 0x97, 0x07, 0xc0, 0x87
+            0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90,
+            0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12,
+            0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48,
+            0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3,
+            0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f,
+            0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0,
+            0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c,
+            0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62
         },
         .tag = {
-            0x2e, 0xe5, 0xbf, 0x50, 0x87, 0x71, 0x17, 0x40,
-            0x1b, 0xa7, 0xe9, 0xed, 0xd5, 0xcb, 0xec, 0x6d
+            0x04, 0xaa, 0xc8, 0x19, 0x32, 0x70, 0x32, 0x24,
+            0xe8, 0x27, 0xb7, 0xab, 0xec, 0xd8, 0x2f, 0x6c
         }
     },
     {
@@ -106,19 +106,19 @@ const vector VECTORS[] = {
             0x40, 0x01
         },
         .ciphertext = (uint8_t[]) {
-            0x86, 0x09, 0xbe, 0x90, 0xa2, 0x9f, 0xa0, 0xed,
-            0x9a, 0xf6, 0xeb, 0x8d, 0x96, 0x0e, 0x83, 0x81,
-            0x0a, 0x6b, 0x00, 0xf4, 0x76, 0x99, 0xf4, 0x62,
-            0x4e, 0x3d, 0x91, 0x4c, 0x95, 0x96, 0x56, 0x91,
-            0x94, 0xf2, 0x29, 0x55, 0x20, 0x11, 0x2c, 0x93,
-            0x15, 0x23, 0x59, 0xe2, 0xa3, 0xc4, 0xc4, 0x62,
-            0xbb, 0xa3, 0x11, 0xf1, 0x39, 0xa2, 0xe2, 0xc9,
-            0x47, 0x6b, 0xe5, 0x6a, 0x97, 0x07, 0xc0, 0x87,
-            0x4f, 0x09
+            0xa2, 0xd5, 0xa6, 0x38, 0xca, 0xcf, 0xce, 0x90,
+            0xaf, 0xc3, 0xb8, 0x99, 0x36, 0xba, 0xf1, 0x12,
+            0x94, 0x13, 0x87, 0xb8, 0x7e, 0x6c, 0x07, 0x48,
+            0x25, 0x25, 0x66, 0xd8, 0xa4, 0x05, 0xc9, 0xd3,
+            0xc0, 0xaa, 0x27, 0xc6, 0xa6, 0x67, 0x53, 0x8f,
+            0xcc, 0xd9, 0xd3, 0xdb, 0xf5, 0xdc, 0xad, 0xa0,
+            0x4b, 0x3e, 0x9a, 0xfb, 0x7c, 0xe9, 0x17, 0x9c,
+            0xb8, 0x17, 0x13, 0x9f, 0x32, 0x70, 0x5c, 0x62,
+            0x88, 0x5a
         },
         .tag = {
-            0x04, 0x10, 0xbc, 0x6f, 0xe5, 0x88, 0xe0, 0xd5,
-            0x09, 0x59, 0x26, 0x17, 0x12, 0x49, 0x35, 0x9a
+            0x64, 0xa2, 0x24, 0x03, 0xc5, 0x79, 0x4f, 0xec,
+            0xe7, 0x7d, 0xc1, 0xf6, 0xc9, 0xc6, 0x77, 0x2c
         }
     }
 };
diff --git a/test/i-128/test-tbc-decrypt.c b/test/i-128/test-tbc-decrypt.c
index 6b558cb..b76f6c0 100644
--- a/test/i-128/test-tbc-decrypt.c
+++ b/test/i-128/test-tbc-decrypt.c
@@ -33,8 +33,8 @@ const vector VECTORS[] = {
             0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
         },
         .ciphertext = {
-            0x8d, 0x95, 0xa2, 0x10, 0xe6, 0xb2, 0xce, 0xc2,
-            0x52, 0x0b, 0x06, 0xaf, 0x26, 0x00, 0xce, 0xe5
+            0x03, 0xb0, 0x31, 0x5e, 0xd8, 0x98, 0x43, 0x7e,
+            0xc5, 0x06, 0x4a, 0x83, 0x64, 0x11, 0xf8, 0x02
         },
         .message = {
             0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
@@ -53,8 +53,8 @@ const vector VECTORS[] = {
             0x7f, 0xf4, 0x23, 0x4d, 0x3d, 0xd5, 0xf9, 0x9b
         },
         .ciphertext = {
-            0x5b, 0x5a, 0x1c, 0xfe, 0x25, 0x6e, 0x85, 0x69,
-            0x3e, 0x71, 0x3e, 0x43, 0x30, 0xa8, 0x4c, 0x82
+            0x97, 0xff, 0x85, 0x27, 0xb6, 0x09, 0x1f, 0x51,
+            0xf3, 0xcb, 0xfd, 0xd0, 0xf2, 0x72, 0xa5, 0x90
         },
         .message = {
             0xbc, 0xd7, 0xf0, 0x29, 0x84, 0xb6, 0xc8, 0xf9,
diff --git a/test/i-128/test-tbc-encrypt.c b/test/i-128/test-tbc-encrypt.c
index c83754b..6503455 100644
--- a/test/i-128/test-tbc-encrypt.c
+++ b/test/i-128/test-tbc-encrypt.c
@@ -37,8 +37,8 @@ const vector VECTORS[] = {
             0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
         },
         .ciphertext = {
-            0x8d, 0x95, 0xa2, 0x10, 0xe6, 0xb2, 0xce, 0xc2,
-            0x52, 0x0b, 0x06, 0xaf, 0x26, 0x00, 0xce, 0xe5
+            0x03, 0xb0, 0x31, 0x5e, 0xd8, 0x98, 0x43, 0x7e,
+            0xc5, 0x06, 0x4a, 0x83, 0x64, 0x11, 0xf8, 0x02
         }
     },
     {
@@ -57,8 +57,8 @@ const vector VECTORS[] = {
             0x9c, 0x9d, 0x1d, 0xbd, 0x0d, 0x30, 0x94, 0x0b
         },
         .ciphertext = {
-            0x5b, 0x5a, 0x1c, 0xfe, 0x25, 0x6e, 0x85, 0x69,
-            0x3e, 0x71, 0x3e, 0x43, 0x30, 0xa8, 0x4c, 0x82
+            0x97, 0xff, 0x85, 0x27, 0xb6, 0x09, 0x1f, 0x51,
+            0xf3, 0xcb, 0xfd, 0xd0, 0xf2, 0x72, 0xa5, 0x90
         }
     }
 };
diff --git a/test/i-128/test-tweakey.c b/test/i-128/test-tweakey.c
index a9b8b5f..ba27340 100644
--- a/test/i-128/test-tweakey.c
+++ b/test/i-128/test-tweakey.c
@@ -32,7 +32,7 @@ const vector VECTORS[] = {
             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
         },
         .last_rtk = {
-            0xec, 0xb3, 0x30, 0xd0, 0xe2, 0x90, 0xc8, 0x56
+            0x53, 0x40, 0x95, 0x96, 0xea, 0x82, 0x2b, 0x28
         }
     },
     {
@@ -63,7 +63,7 @@ const vector VECTORS[] = {
             0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
         },
         .last_rtk = {
-            0xda, 0xcd, 0xb4, 0x0b, 0x7b, 0x80, 0x1e, 0x9a
+            0xfa, 0xd6, 0x9e, 0x4d, 0x08, 0x9a, 0x46, 0x5b
         }
     },
     {
@@ -78,7 +78,7 @@ const vector VECTORS[] = {
             0x7f, 0xf4, 0x23, 0x4d, 0x3d, 0xd5, 0xf9, 0x9b
         },
         .last_rtk = {
-            0xdd, 0xc6, 0x4e, 0xd7, 0x1a, 0x82, 0x11, 0xf3
+            0xc2, 0xd1, 0xb0, 0x98, 0xf3, 0x74, 0x8a, 0xc0
         }
     }
 };
diff --git a/test/i-128/traces-ae.c b/test/i-128/traces-ae.c
index 441ae37..a22260d 100644
--- a/test/i-128/traces-ae.c
+++ b/test/i-128/traces-ae.c
@@ -78,7 +78,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         },
         .message_len = 66,
         .message = (uint8_t[]) {
@@ -90,7 +90,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         }
     }
 };
diff --git a/test/i-192/traces-ae.c b/test/i-192/traces-ae.c
index 6448928..328204a 100644
--- a/test/i-192/traces-ae.c
+++ b/test/i-192/traces-ae.c
@@ -80,7 +80,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         },
         .message_len = 66,
         .message = (uint8_t[]) {
@@ -92,7 +92,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         }
     }
 };
diff --git a/test/i-256/traces-ae.c b/test/i-256/traces-ae.c
index 946518e..9b75273 100644
--- a/test/i-256/traces-ae.c
+++ b/test/i-256/traces-ae.c
@@ -82,7 +82,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         },
         .message_len = 66,
         .message = (uint8_t[]) {
@@ -94,7 +94,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         }
     }
 };
diff --git a/test/ii-128/traces-ae.c b/test/ii-128/traces-ae.c
index 441ae37..a22260d 100644
--- a/test/ii-128/traces-ae.c
+++ b/test/ii-128/traces-ae.c
@@ -78,7 +78,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         },
         .message_len = 66,
         .message = (uint8_t[]) {
@@ -90,7 +90,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         }
     }
 };
diff --git a/test/ii-192/traces-ae.c b/test/ii-192/traces-ae.c
index 6448928..328204a 100644
--- a/test/ii-192/traces-ae.c
+++ b/test/ii-192/traces-ae.c
@@ -80,7 +80,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         },
         .message_len = 66,
         .message = (uint8_t[]) {
@@ -92,7 +92,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         }
     }
 };
diff --git a/test/ii-256/traces-ae.c b/test/ii-256/traces-ae.c
index 946518e..9b75273 100644
--- a/test/ii-256/traces-ae.c
+++ b/test/ii-256/traces-ae.c
@@ -82,7 +82,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         },
         .message_len = 66,
         .message = (uint8_t[]) {
@@ -94,7 +94,7 @@ const vector VECTORS[] = {
             0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
             0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
             0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x01
+            0x40, 0x41
         }
     }
 };
diff --git a/traces/add_threshold/traces-tbc.patch b/traces/add_threshold/traces-tbc.patch
index f1d897d..ac239fa 100644
--- a/traces/add_threshold/traces-tbc.patch
+++ b/traces/add_threshold/traces-tbc.patch
@@ -240,7 +240,7 @@ index a966a8e..8d5f2cc 100644
 +        out[i] = i;
  }
 diff --git a/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/add_threshold/tweakey.c b/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/add_threshold/tweakey.c
-index e228a69..b1aadc6 100644
+index 7822564..e1abbb6 100644
 --- a/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/add_threshold/tweakey.c
 +++ b/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/add_threshold/tweakey.c
 @@ -20,6 +20,8 @@ This file provides a first-order threshold implementation of Lilliput-TBC's
@@ -252,7 +252,7 @@ index e228a69..b1aadc6 100644
  #include <stdint.h>
  #include <string.h>
  
-@@ -42,6 +44,7 @@ void tweakey_state_init(
+@@ -43,6 +45,7 @@ void tweakey_state_init(
  {
      uint8_t SHARES_0[KEY_BYTES];
      randombytes(sizeof(SHARES_0), SHARES_0);
@@ -260,7 +260,7 @@ index e228a69..b1aadc6 100644
  
      memcpy(TK_Y, SHARES_0, KEY_BYTES);
      memcpy(TK_X, tweak, TWEAK_BYTES);
-@@ -67,10 +70,16 @@ void tweakey_state_extract(
+@@ -68,20 +71,32 @@ void tweakey_state_extract(
      {
          const uint8_t *TKj_X = TK_X + j*LANE_BYTES;
  
@@ -276,8 +276,7 @@ index e228a69..b1aadc6 100644
 +        debug_dump_buffer("=> RTK_X", ROUND_TWEAKEY_BYTES, round_tweakey_X, 12);
      }
  
- 
-@@ -78,10 +87,16 @@ void tweakey_state_extract(
+     for (size_t j=0; j<KEY_LANES_NB; j++)
      {
          const uint8_t *TKj_Y = TK_Y + j*LANE_BYTES;
  
@@ -294,34 +293,34 @@ index e228a69..b1aadc6 100644
      }
  
      round_tweakey_X[0] ^= round_constant;
-@@ -184,6 +199,10 @@ static const matrix_multiplication ALPHAS[6] = {
+@@ -100,6 +115,10 @@ static const matrix_multiplication ALPHAS[7] = {
      _multiply_MR3
  };
  
-+static char const * const ALPHAS_STR[6] = {
-+    "M", "M²", "M³", "MR", "MR²", "MR³"
++static char const * const ALPHAS_STR[7] = {
++    "M", "M²", "M³", "M⁴", "MR", "MR²", "MR³"
 +};
 +
  
  void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES])
  {
-@@ -197,6 +216,10 @@ void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES])
+@@ -111,6 +130,10 @@ void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES])
          memcpy(TKj_old_X, TKj_X, LANE_BYTES);
  
-         ALPHAS[j-1](TKj_old_X, TKj_X);
+         ALPHAS[j](TKj_old_X, TKj_X);
 +
-+        fprintf(DUMP, "        multiplying lane %zu/%zu by %s\n", 1+j, (size_t)LANES_NB, ALPHAS_STR[j-1]);
++        fprintf(DUMP, "        multiplying lane %zu/%zu by %s\n", 1+j, (size_t)LANES_NB, ALPHAS_STR[j]);
 +        debug_dump_buffer("TK_j_X^i-1", LANE_BYTES, TKj_old_X, 12);
 +        debug_dump_buffer("TK_j_X^i", LANE_BYTES, TKj_X, 12);
      }
  
-     for (size_t j=0; j<(KEY_BYTES/LANE_BYTES); j++)
-@@ -211,5 +234,11 @@ void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES])
+     for (size_t j=0; j<KEY_LANES_NB; j++)
+@@ -125,5 +148,11 @@ void tweakey_state_update(uint8_t TK_X[TWEAKEY_BYTES], uint8_t TK_Y[KEY_BYTES])
  
-         ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_X_old, TKj_X);
-         ALPHAS[j-1 + (TWEAK_BYTES/LANE_BYTES)](TKj_Y_old, TKj_Y);
+         ALPHAS[j + TWEAK_LANES_NB](TKj_X_old, TKj_X);
+         ALPHAS[j + TWEAK_LANES_NB](TKj_Y_old, TKj_Y);
 +
-+        fprintf(DUMP, "        multiplying lane %zu/%zu by %s\n", 1+j + (TWEAK_BYTES/LANE_BYTES), (size_t)LANES_NB, ALPHAS_STR[j-1 + (TWEAK_BYTES/LANE_BYTES)]);
++        fprintf(DUMP, "        multiplying lane %zu/%zu by %s\n", 1+j + TWEAK_LANES_NB, (size_t)LANES_NB, ALPHAS_STR[j + TWEAK_LANES_NB]);
 +        debug_dump_buffer("TK_j_X^i-1", LANE_BYTES, TKj_X_old, 12);
 +        debug_dump_buffer("TK_j_X^i", LANE_BYTES, TKj_X, 12);
 +        debug_dump_buffer("TK_j_Y^i-1", LANE_BYTES, TKj_Y_old, 12);
diff --git a/traces/traces-tbc.patch b/traces/traces-tbc.patch
index 2b81a6b..ff36123 100644
--- a/traces/traces-tbc.patch
+++ b/traces/traces-tbc.patch
@@ -1,5 +1,5 @@
 diff --git a/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/cipher.c b/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/cipher.c
-index 6f1b4b5..7a2ae05 100644
+index 07405e1..0997cac 100644
 --- a/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/cipher.c
 +++ b/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/cipher.c
 @@ -17,6 +17,8 @@ http://creativecommons.org/publicdomain/zero/1.0/
@@ -98,9 +98,9 @@ index 6f1b4b5..7a2ae05 100644
  
 +    fprintf(DUMP, "running EGFN %zu times\n", (size_t)ROUNDS);
 +
-     for (uint8_t i=0; i<ROUNDS-1; i++)
+     for (size_t i=0; i<ROUNDS-1; i++)
      {
-+        fprintf(DUMP, "    round %zu\n", (size_t)i);
++        fprintf(DUMP, "    round %zu\n", i);
          _one_round_egfn(X, RTK[i], PERMUTATION_ENCRYPTION);
      }
  
@@ -109,11 +109,11 @@ index 6f1b4b5..7a2ae05 100644
  
      memcpy(ciphertext, X, BLOCK_BYTES);
 diff --git a/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/tweakey.c b/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/tweakey.c
-index 78c6060..75e9290 100644
+index 510f35a..4bf027c 100644
 --- a/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/tweakey.c
 +++ b/SOUMISSION_NIST/REFERENCE_IMPLEMENTATION/src/ref/tweakey.c
-@@ -19,6 +19,8 @@ where multiplications by matrices M and M_R to the power n are performed
- by functions expressing the exponentiated matrices with shifts and XORs.
+@@ -17,6 +17,8 @@ http://creativecommons.org/publicdomain/zero/1.0/
+ This file provides the implementation of Lilliput-TBC's tweakey schedule.
  */
  
 +#include "debug.h"
@@ -121,7 +121,7 @@ index 78c6060..75e9290 100644
  #include <stdint.h>
  #include <string.h>
  
-@@ -54,10 +56,16 @@ void tweakey_state_extract(
+@@ -51,10 +53,16 @@ void tweakey_state_extract(
      {
          const uint8_t *TKj = TK + j*LANE_BYTES;
  
@@ -138,23 +138,23 @@ index 78c6060..75e9290 100644
      }
  
      round_tweakey[0] ^= round_constant;
-@@ -160,6 +168,10 @@ static const matrix_multiplication ALPHAS[6] = {
+@@ -73,6 +81,10 @@ static const matrix_multiplication ALPHAS[7] = {
      _multiply_MR3
  };
  
-+static char const * const ALPHAS_STR[6] = {
-+    "M", "M²", "M³", "MR", "MR²", "MR³"
++static char const * const ALPHAS_STR[7] = {
++    "M", "M²", "M³", "M⁴", "MR", "MR²", "MR³"
 +};
 +
  
  void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES])
  {
-@@ -173,5 +185,9 @@ void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES])
+@@ -84,5 +96,9 @@ void tweakey_state_update(uint8_t TK[TWEAKEY_BYTES])
          memcpy(TKj_old, TKj, LANE_BYTES);
  
-         ALPHAS[j-1](TKj_old, TKj);
+         ALPHAS[j](TKj_old, TKj);
 +
-+        fprintf(DUMP, "        multiplying lane %zu/%zu by %s\n", 1+j, (size_t)LANES_NB, ALPHAS_STR[j-1]);
++        fprintf(DUMP, "        multiplying lane %zu/%zu by %s\n", 1+j, (size_t)LANES_NB, ALPHAS_STR[j]);
 +        debug_dump_buffer("TK_j^i-1", LANE_BYTES, TKj_old, 12);
 +        debug_dump_buffer("TK_j^i", LANE_BYTES, TKj, 12);
      }