diff --git a/src/ref/lilliput-i.c b/src/ref/lilliput-i.c
index 6f869c3..f7bdbde 100644
--- a/src/ref/lilliput-i.c
+++ b/src/ref/lilliput-i.c
@@ -17,6 +17,8 @@ http://creativecommons.org/publicdomain/zero/1.0/
 This file implements Lilliput-AE's nonce-respecting mode based on ΘCB3.
 */
 
+#include "debug.h"
+
 #include <stdbool.h>
 #include <stdint.h>
 #include <string.h>
@@ -104,32 +106,54 @@ static void _encrypt_message(
     uint8_t checksum[BLOCK_BYTES];
     memset(checksum, 0, BLOCK_BYTES);
 
+    fprintf(DUMP, "message encryption\n");
+
     for (size_t j=0; j<l; j++)
     {
+        fprintf(DUMP, "    j=%zu\n", j);
+
+        debug_dump_buffer("Mj", BLOCK_BYTES, &M[j*BLOCK_BYTES], 8);
         xor_into(checksum, &M[j*BLOCK_BYTES]);
+        debug_dump_buffer("Checksum", BLOCK_BYTES, checksum, 8);
         _fill_msg_tweak(0x0, j, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, &M[j*BLOCK_BYTES], &C[j*BLOCK_BYTES]);
+        debug_dump_buffer("Cj", BLOCK_BYTES, &C[j*BLOCK_BYTES], 8);
     }
 
     if (rest == 0)
     {
+        fprintf(DUMP, "    no padding\n");
+
         _fill_msg_tweak(0x1, l, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, checksum, Final);
+        debug_dump_buffer("Final", BLOCK_BYTES, Final, 8);
     }
     else
     {
+        fprintf(DUMP, "    padding\n");
+
         uint8_t M_rest[BLOCK_BYTES];
         uint8_t Pad[BLOCK_BYTES];
 
         pad10(rest, &M[l*BLOCK_BYTES], M_rest);
+        debug_dump_buffer("M*", rest, &M[l*BLOCK_BYTES], 8);
+        debug_dump_buffer("pad10*(M*)", BLOCK_BYTES, M_rest, 8);
         xor_into(checksum, M_rest);
+        debug_dump_buffer("Checksum", BLOCK_BYTES, checksum, 8);
 
         _fill_msg_tweak(0x4, l, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, _0n, Pad);
         xor_arrays(rest, &C[l*BLOCK_BYTES], &M[l*BLOCK_BYTES], Pad);
+        debug_dump_buffer("Pad", BLOCK_BYTES, Pad, 8);
+        debug_dump_buffer("C*", rest, &C[l*BLOCK_BYTES], 8);
 
         _fill_msg_tweak(0x5, l+1, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, checksum, Final);
+        debug_dump_buffer("Final", BLOCK_BYTES, Final, 8);
     }
 }
 
@@ -151,32 +175,54 @@ static void _decrypt_message(
     uint8_t checksum[BLOCK_BYTES];
     memset(checksum, 0, BLOCK_BYTES);
 
+    fprintf(DUMP, "message decryption\n");
+
     for (size_t j=0; j<l; j++)
     {
+        fprintf(DUMP, "    j=%zu\n", j);
+
+        debug_dump_buffer("Cj", BLOCK_BYTES, &C[j*BLOCK_BYTES], 8);
         _fill_msg_tweak(0x0, j, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         decrypt(key, tweak, &C[j*BLOCK_BYTES], &M[j*BLOCK_BYTES]);
+        debug_dump_buffer("Mj", BLOCK_BYTES, &M[j*BLOCK_BYTES], 8);
         xor_into(checksum, &M[j*BLOCK_BYTES]);
+        debug_dump_buffer("Checksum", BLOCK_BYTES, checksum, 8);
     }
 
     if (rest == 0)
     {
+        fprintf(DUMP, "    no padding\n");
+
         _fill_msg_tweak(0x1, l, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, checksum, Final);
+        debug_dump_buffer("Final", BLOCK_BYTES, Final, 8);
     }
     else
     {
+        fprintf(DUMP, "    padding\n");
+
         uint8_t M_rest[BLOCK_BYTES];
         uint8_t Pad[BLOCK_BYTES];
 
+        debug_dump_buffer("C*", rest, &C[l*BLOCK_BYTES], 8);
         _fill_msg_tweak(0x4, l, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, _0n, Pad);
+        debug_dump_buffer("Pad", BLOCK_BYTES, Pad, 8);
         xor_arrays(rest, &M[l*BLOCK_BYTES], &C[l*BLOCK_BYTES], Pad);
+        debug_dump_buffer("M*", rest, &M[l*BLOCK_BYTES], 8);
 
         pad10(rest, &M[l*BLOCK_BYTES], M_rest);
+        debug_dump_buffer("pad10*(M*)", BLOCK_BYTES, M_rest, 8);
         xor_into(checksum, M_rest);
 
         _fill_msg_tweak(0x5, l+1, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
+        debug_dump_buffer("Checksum", BLOCK_BYTES, checksum, 8);
         encrypt(key, tweak, checksum, Final);
+        debug_dump_buffer("Final", BLOCK_BYTES, Final, 8);
     }
 }
 
@@ -186,7 +232,13 @@ static void _generate_tag(
     uint8_t       tag[TAG_BYTES]
 )
 {
+    fprintf(DUMP, "generating tag\n");
+    debug_dump_buffer("Final", BLOCK_BYTES, Final, 8);
+    debug_dump_buffer("Auth", BLOCK_BYTES, Auth, 8);
+
     xor_arrays(TAG_BYTES, tag, Final, Auth);
+
+    debug_dump_buffer("tag", TAG_BYTES, tag, 8);
 }
 
 
diff --git a/src/ref/lilliput-ii.c b/src/ref/lilliput-ii.c
index 862892c..7dfb38e 100644
--- a/src/ref/lilliput-ii.c
+++ b/src/ref/lilliput-ii.c
@@ -15,6 +15,8 @@ http://creativecommons.org/publicdomain/zero/1.0/
 This file implements Lilliput-AE's nonce-misuse-resistant mode based on SCT-2.
 */
 
+#include "debug.h"
+
 #include <stdbool.h>
 #include <stdint.h>
 #include <string.h>
@@ -79,24 +81,40 @@ static void _generate_tag(
     size_t l = M_len / BLOCK_BYTES;
     size_t rest = M_len % BLOCK_BYTES;
 
+    fprintf(DUMP, "computing tag\n");
+    debug_dump_buffer("Auth", BLOCK_BYTES, Auth, 8);
+
     for (size_t j=0; j<l; j++)
     {
+        fprintf(DUMP, "    j=%zu\n", j);
         fill_index_tweak(0x0, j, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, &M[j*BLOCK_BYTES], Ek_Mj);
+        debug_dump_buffer("Mj", BLOCK_BYTES, &M[j*BLOCK_BYTES], 8);
+        debug_dump_buffer("Ek(Mj)", BLOCK_BYTES, Ek_Mj, 8);
         xor_into(tag_tmp, Ek_Mj);
+        debug_dump_buffer("tag", TAG_BYTES, tag_tmp, 8);
     }
 
     if (rest != 0)
     {
+        fprintf(DUMP, "    l=%zu (padding)\n", l);
         uint8_t M_rest[BLOCK_BYTES];
         pad10(rest, &M[l*BLOCK_BYTES], M_rest);
         fill_index_tweak(0x4, l, tweak);
+        debug_dump_buffer("pad10*(M*)", BLOCK_BYTES, M_rest, 8);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, M_rest, Ek_Mj);
+        debug_dump_buffer("Ek(M*)", BLOCK_BYTES, Ek_Mj, 8);
         xor_into(tag_tmp, Ek_Mj);
+        debug_dump_buffer("tag", TAG_BYTES, tag_tmp, 8);
     }
 
+    fprintf(DUMP, "    Ek(tag)\n");
     _fill_tag_tweak(N, tweak);
+    debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
     encrypt(key, tweak, tag_tmp, tag);
+    debug_dump_buffer("tag = Ek(tag)", TAG_BYTES, tag, 8);
 }
 
 static void _encrypt_message(
@@ -120,18 +138,33 @@ static void _encrypt_message(
     size_t l = M_len / BLOCK_BYTES;
     size_t rest = M_len % BLOCK_BYTES;
 
+    fprintf(DUMP, "message encryption\n");
+
     for (size_t j=0; j<l; j++)
     {
+        fprintf(DUMP, "    j=%zu\n", j);
+
         _fill_msg_tweak(tag, j, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, padded_N, Ek_N);
+        debug_dump_buffer("N (padded)", BLOCK_BYTES, padded_N, 8);
+        debug_dump_buffer("Ek(Mj, N)", BLOCK_BYTES, Ek_N, 8);
+        debug_dump_buffer("Mj", BLOCK_BYTES, &M[j*BLOCK_BYTES], 8);
         xor_arrays(BLOCK_BYTES, &C[j*BLOCK_BYTES], &M[j*BLOCK_BYTES], Ek_N);
+        debug_dump_buffer("Cj", BLOCK_BYTES, &C[j*BLOCK_BYTES], 8);
     }
 
     if (rest != 0)
     {
+        fprintf(DUMP, "    l=%zu (padding)\n", l);
         _fill_msg_tweak(tag, l, tweak);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
         encrypt(key, tweak, padded_N, Ek_N);
+        debug_dump_buffer("N (padded)", BLOCK_BYTES, padded_N, 8);
+        debug_dump_buffer("Ek(M*, N)", BLOCK_BYTES, Ek_N, 8);
+        debug_dump_buffer("M*", rest, &M[l*BLOCK_BYTES], 8);
         xor_arrays(rest, &C[l*BLOCK_BYTES], &M[l*BLOCK_BYTES], Ek_N);
+        debug_dump_buffer("C*", rest, &C[l*BLOCK_BYTES], 8);
     }
 }
 
diff --git a/src/ref/lilliput-ae-utils.h b/src/ref/lilliput-ae-utils.h
index 6b60adc..0bd77cf 100644
--- a/src/ref/lilliput-ae-utils.h
+++ b/src/ref/lilliput-ae-utils.h
@@ -18,6 +18,8 @@ This file provides functions used by both authenticated encryption modes.
 #ifndef LILLIPUT_AE_UTILS_H
 #define LILLIPUT_AE_UTILS_H
 
+#include "debug.h"
+
 #include <stddef.h>
 #include <stdint.h>
 #include <string.h>
@@ -122,20 +124,45 @@ static void process_associated_data(
     size_t l_a = A_len / BLOCK_BYTES;
     size_t rest = A_len % BLOCK_BYTES;
 
+    fprintf(DUMP, "computing Auth\n");
+
     for (size_t i=0; i<l_a; i++)
     {
+        fprintf(DUMP, "    i=%zu\n", i);
+
         fill_index_tweak(0x2, i, tweak);
+
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
+
         encrypt(key, tweak, &A[i*BLOCK_BYTES], Ek_Ai);
+
+        debug_dump_buffer("Ai", BLOCK_BYTES, &A[i*BLOCK_BYTES], 8);
+        debug_dump_buffer("Ek(Ai)", BLOCK_BYTES, Ek_Ai, 8);
+
         xor_into(Auth, Ek_Ai);
+
+        debug_dump_buffer("Auth", BLOCK_BYTES, Auth, 8);
     }
 
     if (rest != 0)
     {
         uint8_t A_rest[BLOCK_BYTES];
         pad10(rest, &A[l_a*BLOCK_BYTES], A_rest);
+
+        fprintf(DUMP, "    l_a=%zu (padding)\n", l_a);
+
         fill_index_tweak(0x6, l_a, tweak);
+
+        debug_dump_buffer("pad10*(A*)", BLOCK_BYTES, A_rest, 8);
+        debug_dump_buffer("tweak", TWEAK_BYTES, tweak, 8);
+
         encrypt(key, tweak, A_rest, Ek_Ai);
+
+        debug_dump_buffer("Ek(A*)", BLOCK_BYTES, Ek_Ai, 8);
+
         xor_into(Auth, Ek_Ai);
+
+        debug_dump_buffer("Auth", BLOCK_BYTES, Auth, 8);
     }
 }