poly1305-hash {
- ## The tests from Danial J. Bernstein, `The Poly1305-AES message-
+ ## The tests from Daniel J. Bernstein, `The Poly1305-AES message-
## authentication code', 2005-03-29, Appendix B,
## https://cr.yp.to/mac/poly1305-20050329.pdf
851fc40c3467ac0be05cc20404f3f700 580b3b0f9447bb1e69d095b5928b6dbc
7973f622a43d14a6599b1f654cb45a74e355a5
f3ffc7703f9400e52a7dfb4b3d3305d9;
}
+
+poly1305-mct {
+ ## Monte-Carlo test from https://cr.yp.to/mac/test.html.
+ ## Rather than check MD5 hashes of transcripts, I check the final tag
+ ## value. These were calculated from transcripts of a scratch
+ ## implementation (utils/poly1305-mct.c) which I checked against the
+ ## reference hashes.
+ ##
+ ## [universe /tmp/mdw]{ ./poly1305-mct | tee >(md5sum >&3) | tail -n1; } 3>&1
+ ## 3ceb64843c00984c5c2b7897f499141b -
+ ## df62013a9d388ea6e82cb7295fa706ec
+
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 1 596382b2c34704b87e291250fcb927fd;
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 10 7f1d971da577bdd6fb24437aaac845f5;
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 100 e1cb88ba2c498ade2091ab06cefa24fd;
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 00000000000000000000000000000000
+ 1000 f7064b7217e8a6b74b381c58175d9ff2;
+
+ ## The full test. This takes aaaaages.
+ ##00000000000000000000000000000000
+ ## 00000000000000000000000000000000
+ ## 00000000000000000000000000000000
+ ## 1000000 df62013a9d388ea6e82cb7295fa706ec;
+}