8 files changed, 92 insertions, 8 deletions

diff --git a/nist/README.md b/nist/README.md
index 51eca24..1e50043 100644
--- a/nist/README.md
+++ b/nist/README.md
@@ -3,7 +3,7 @@
 `make-package.sh` will create the directory structure specified by
 [NIST's requirements], compile and run `TestVectorGen/genkat_aead.c`
 against every member of the Lilliput-AE family, and bundle the sources
-and vectors into a folder.
+and vectors under `./crypto_aead`.
 
 
 [NIST's website]: https://csrc.nist.gov/projects/lightweight-cryptography
diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h
index 41acaf6..ce3f154 100644
--- a/src/ref/lilliput-ae-utils.h
+++ b/src/ref/lilliput-ae-utils.h
@@ -70,18 +70,24 @@ static inline void pad10(size_t X_len, const uint8_t X[X_len], uint8_t padded[BL
 {
     /* pad10*(X) = X || 1 || 0^{n-|X|-1} */
 
+    /* For example, with uint8_t X[3] = { [0]=0x01, [1]=0x02, [2]=0x03 }
+     *
+     * pad10*(X) =
+     *       X[2]     X[1]     X[0]   1 0*
+     *     00000011 00000010 00000001 1 0000000 00000000...
+     *
+     * - padded[0, 11]:  zeroes
+     * - padded[12]:     10000000
+     * - padded[13, 15]: X[0, 2]
+     */
+
     /* Assume that X_len<BLOCK_BYTES. */
 
     size_t pad_len = BLOCK_BYTES-X_len;
 
-    memcpy(padded+pad_len, X, X_len);
-
+    memset(padded, 0, pad_len-1);
     padded[pad_len-1] = 0x80;
-
-    if (pad_len > 1)
-    {
-        memset(padded, 0, pad_len-1);
-    }
+    memcpy(padded+pad_len, X, X_len);
 }
 
 static inline void fill_index_tweak(
diff --git a/test/i-128/traces-ae.c b/test/i-128/traces-ae.c
index cb8e4e2..441ae37 100644
--- a/test/i-128/traces-ae.c
+++ b/test/i-128/traces-ae.c
@@ -126,6 +126,19 @@ int main(int argc, char **argv)
         debug_dump_buffer("ciphertext", v->message_len, ciphertext, 0);
         debug_dump_buffer("tag", TAG_BYTES, tag, 0);
 
+        fprintf(DUMP, "DECRYPTING\n");
+
+        uint8_t cleartext[v->message_len];
+        lilliput_ae_decrypt(
+            sizeof(ciphertext), ciphertext,
+            v->auth_len, v->auth,
+            v->key, v->nonce,
+            tag,
+            cleartext
+        );
+
+        debug_dump_buffer("cleartext", sizeof(cleartext), cleartext, 0);
+
         fclose(DUMP);
     }
 }
diff --git a/test/i-192/traces-ae.c b/test/i-192/traces-ae.c
index c5d4820..6448928 100644
--- a/test/i-192/traces-ae.c
+++ b/test/i-192/traces-ae.c
@@ -128,6 +128,19 @@ int main(int argc, char **argv)
         debug_dump_buffer("ciphertext", v->message_len, ciphertext, 0);
         debug_dump_buffer("tag", TAG_BYTES, tag, 0);
 
+        fprintf(DUMP, "DECRYPTING\n");
+
+        uint8_t cleartext[v->message_len];
+        lilliput_ae_decrypt(
+            sizeof(ciphertext), ciphertext,
+            v->auth_len, v->auth,
+            v->key, v->nonce,
+            tag,
+            cleartext
+        );
+
+        debug_dump_buffer("cleartext", sizeof(cleartext), cleartext, 0);
+
         fclose(DUMP);
     }
 }
diff --git a/test/i-256/traces-ae.c b/test/i-256/traces-ae.c
index 77fe7c8..946518e 100644
--- a/test/i-256/traces-ae.c
+++ b/test/i-256/traces-ae.c
@@ -130,6 +130,19 @@ int main(int argc, char **argv)
         debug_dump_buffer("ciphertext", v->message_len, ciphertext, 0);
         debug_dump_buffer("tag", TAG_BYTES, tag, 0);
 
+        fprintf(DUMP, "DECRYPTING\n");
+
+        uint8_t cleartext[v->message_len];
+        lilliput_ae_decrypt(
+            sizeof(ciphertext), ciphertext,
+            v->auth_len, v->auth,
+            v->key, v->nonce,
+            tag,
+            cleartext
+        );
+
+        debug_dump_buffer("cleartext", sizeof(cleartext), cleartext, 0);
+
         fclose(DUMP);
     }
 }
diff --git a/test/ii-128/traces-ae.c b/test/ii-128/traces-ae.c
index cb8e4e2..441ae37 100644
--- a/test/ii-128/traces-ae.c
+++ b/test/ii-128/traces-ae.c
@@ -126,6 +126,19 @@ int main(int argc, char **argv)
         debug_dump_buffer("ciphertext", v->message_len, ciphertext, 0);
         debug_dump_buffer("tag", TAG_BYTES, tag, 0);
 
+        fprintf(DUMP, "DECRYPTING\n");
+
+        uint8_t cleartext[v->message_len];
+        lilliput_ae_decrypt(
+            sizeof(ciphertext), ciphertext,
+            v->auth_len, v->auth,
+            v->key, v->nonce,
+            tag,
+            cleartext
+        );
+
+        debug_dump_buffer("cleartext", sizeof(cleartext), cleartext, 0);
+
         fclose(DUMP);
     }
 }
diff --git a/test/ii-192/traces-ae.c b/test/ii-192/traces-ae.c
index c5d4820..6448928 100644
--- a/test/ii-192/traces-ae.c
+++ b/test/ii-192/traces-ae.c
@@ -128,6 +128,19 @@ int main(int argc, char **argv)
         debug_dump_buffer("ciphertext", v->message_len, ciphertext, 0);
         debug_dump_buffer("tag", TAG_BYTES, tag, 0);
 
+        fprintf(DUMP, "DECRYPTING\n");
+
+        uint8_t cleartext[v->message_len];
+        lilliput_ae_decrypt(
+            sizeof(ciphertext), ciphertext,
+            v->auth_len, v->auth,
+            v->key, v->nonce,
+            tag,
+            cleartext
+        );
+
+        debug_dump_buffer("cleartext", sizeof(cleartext), cleartext, 0);
+
         fclose(DUMP);
     }
 }
diff --git a/test/ii-256/traces-ae.c b/test/ii-256/traces-ae.c
index 77fe7c8..946518e 100644
--- a/test/ii-256/traces-ae.c
+++ b/test/ii-256/traces-ae.c
@@ -130,6 +130,19 @@ int main(int argc, char **argv)
         debug_dump_buffer("ciphertext", v->message_len, ciphertext, 0);
         debug_dump_buffer("tag", TAG_BYTES, tag, 0);
 
+        fprintf(DUMP, "DECRYPTING\n");
+
+        uint8_t cleartext[v->message_len];
+        lilliput_ae_decrypt(
+            sizeof(ciphertext), ciphertext,
+            v->auth_len, v->auth,
+            v->key, v->nonce,
+            tag,
+            cleartext
+        );
+
+        debug_dump_buffer("cleartext", sizeof(cleartext), cleartext, 0);
+
         fclose(DUMP);
     }
 }