On Wed, 20 May 2020 at 09:01, Stephan Mueller <smueller@xxxxxxxxxx> wrote: > > Am Mittwoch, 20. Mai 2020, 08:54:10 CEST schrieb Ard Biesheuvel: > > Hi Ard, > > > On Wed, 20 May 2020 at 08:47, Stephan Mueller <smueller@xxxxxxxxxx> wrote: ... > > > The state of all block chaining modes we currently have is defined with > > > the > > > IV. That is the reason why I mentioned it can be implemented stateless > > > when I am able to get the IV output from the previous operation. > > > > But it is simply the same as the penultimate block of ciphertext. So > > you can simply capture it after encrypt, or before decrypt. There is > > really no need to rely on the CTS transformation to pass it back to > > you via the buffer that is only specified to provide an input to the > > CTS transform. > > Let me recheck that as I am not fully sure on that one. But if it can be > handled that way, it would make life easier. Please refer to patch 2. The .iv_out test vectors were all simply copied from the appropriate offset into the associated .ctext member.
